"Chosen Channel" "Chosen Attacker Model" "Promela Model" "Attack Trace" "Promela Model" "Spin Model Checker" "Korg" "Correctness Property" "Exhaustive Search"