Verification of the security of a secure network component

The author formally proves using a mechanical verifier that a security multiplexer for a network is secure and has no timing channels. While this multiplexer is only a small piece of a system, it handles multiple security levels and contains a process and two procedures that interact with other parts of the system. Security is expressed using an information flow model, extended to handle time. He shows how the multiplexer is specified in this model, describes the synchronous deterministic security model used, and discuss the security proof