Increased information flow needs for high-assurance composite evaluationsPaul A. KargerHelmut Kurth2004IEEE IWIA 2004
Thirty years later: Lessons from the Multics security evaluationPaul A. KargerRoger R. Schell2002ACSAC 2002