Holger Grandy Kurt Stenzel Wolfgang Reif Object Oriented Verification Kernels for Secure Java Applications. 170-179 2005 conf/sefm/2005 SEFM http://doi.ieeecomputersociety.org/10.1109/SEFM.2005.28 db/conf/sefm/sefm2005.html#GrandySR05