Trustworthy Proxies: Virtualizing Objects with Invariants

   Abstract