Janice I. Glasgow Glenn H. MacEwen The Development and Proof of a Formal Specification for a Multilevel Secure System. 151-184 1987 5 ACM Trans. Comput. Syst. 2 http://doi.acm.org/10.1145/13677.22724 db/journals/tocs/tocs5.html#GlasgowM87