Proof of separability: A verification technique for a class of security kernels (1982)

by John M Rushby
Venue:In Proceedings of the 5th International Symposium on Programming