Richard J. Feiertag Karl N. Levitt Lawrence Robinson Proving Multilevel Security of a System Design. 57-65 1977 SOSP db/conf/sosp/sosp77.html#FeiertagLR77