Pattern-based approach to modelling and verifying system security