Verifying the EROS confinement mechanism | IEEE Conference Publication | IEEE Xplore