"Resolving the Tension between Integrity and Security Using a Theorem Prover."

Subhasish Mazumdar, David W. Stemple, Tim Sheard (1988)
a service of Schloss Dagstuhl - Leibniz Center for Informatics