Verifying the EROS confinement mechanismJonathan S. ShapiroSam Weber2000Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy