[Popek75] G. Popek and C. Kline, A Verifiable Protection System, IEEE, Reliable Software Design, 294-304, 1975. []