Model Checking -- Method-Specific Java Access Control via RMI Proxy Objects Using