Tanya Korelsky David Sutherland Formal Specification of a Multi-Level Secure Operating System. 209-218 1984 IEEE Symposium on Security and Privacy db/conf/sp/sp1984.html#KorelskyS84