seL4: From General Purpose to a Proof of Information Flow EnforcementToby Murray, Gerwin Klein|Unknown|2013Cited by 204