Using model checking to test a firewall: a case study | IEEE Conference Publication | IEEE Xplore