Richard A. Kemmerer

• Formal verification of an operating system security kernel