Capabilities without a trusted kernel (1991)

by M Herlihy, J D Tygar