Enlisting Hardware Architecture to Thwart Malicious Code Injection
Thirty years later: lessons from the Multics security evaluation