Proof of separability: A verification technique for a class of security kernels (1982)

by John Rushby
Venue:In Proc. International Symposium on Programming, Lecture Notes in Computer Science