Scalable parametric verification of secure systems: How to verify reference monitors without worrying about data structure sizeJason FranklinSagar Chakiet al.2010S&P 2010