"Design and Verification of Secure Systems."

John M. Rushby (1981)
a service of Schloss Dagstuhl - Leibniz Center for Informatics