used in assuring IA applications, however, have wider applications in assuring
correctness forthose willing to incurthe costs. In IA applications, formal methods
have been used to prove correctness of security functionalities (e.g., authentication,
secure input/output, mandatory access control) and security-related trace