Security Model and Verification