Reasoning About Security Models