A Provably Secure Operating System: The system, its applications, and proofs (1980)

by P G Neumann, R Boyer, R Feiertag, K Levitt, L Robinson