"Reflections on the Verification of the Security of an Operating System Kernel."

Jonathan M. Silverman (1983)
a service of Schloss Dagstuhl - Leibniz Center for Informatics