Rance J. DeLong Thuy D. Nguyen Cynthia E. Irvine Timothy E. Levin Toward a Medium-Robustness Separation Kernel Protection Profile. 40-51 2007 ACSAC http://doi.ieeecomputersociety.org/10.1109/ACSAC.2007.48 conf/acsac/2007 db/conf/acsac/acsac2007.html#DeLongNIL07