"Proving Multilevel Security of a System Design."

Richard J. Feiertag, Karl N. Levitt, Lawrence Robinson (1977)
a service of Schloss Dagstuhl - Leibniz Center for Informatics