An Integrative Framework to Protocol Analysis and Repair: Bellare-Rogaway Model + Planning + Model Checker