Verifying Operating System Security (1997)

by J. S. Shapiro, S. Weber