An Application of Automated Theorem Provers to Computer System Security: The Schematic Protection Model