The Trusted Domain Machine: A Secure Communication Device for Security Guard Applications. - R. A. Carlson; Teresa F. Lunt (S&P, 1986)