Peter G. Neumann Richard J. Feiertag Karl N. Levitt Lawrence Robinson Software Development and Proofs of Multi-Level Security. 421-428 1976 conf/icse/1976 ICSE db/conf/icse/icse76.html#NeumannFLR76 http://dl.acm.org/citation.cfm?id=807715