McLean, J., C. Landwehr and C. Heitmeyer, ``A Formal Statement of the MMS Security Model'', Proc. 1984 IEEE Symposium on Research in Security and Privacy, IEEE Press, 1984.