Secure Virtualization With Formal Methods