On the synthesis and analysis of protection systems
Lawrence Snyder · ACM SIGOPS Operating Systems Review · 1977
The design of a protection system for an operating system is seen to involve satisfying the competing properties of richness and integrity. Achieving both requires the interplay of analysis and synthesis. Using a formal model from the literature, three designs are developed whose integrity (with the help of the model) can be shown.