Multilevel Database Research Articles

Logical foundations of multilevel databases

In this paper, we propose a formal model for multilevel databases. This model aims at being a generic model, that is it can be interpreted for any kind of database (relational, object-oriented …). Our model has three layers. The first layer corresponds to a model for a non-protected database. The second layer corresponds to a model for a multilevel database. In this second layer, we propose a list of theorems that must be respected in order to build a secure multilevel database. We also propose a new solution to manage cover stories without using the ambiguous technique of polyinstantiation. The third layer corresponds to a model for a MultiView database, that is, a database that provides at each security level a consistent view of the multilevel database. Finally, as an illustration, we interpret our 3-layer model in the case of an object-oriented database.

Multilevel secure database encryption with subkeys

In this paper, we propose a multilevel database encryption system with subkeys. This new system is called the record-oriented cryptosystem which encrypts each record with different field-subkeys according to a security class of the data element. Each field is decrypted individually by the field-subkeys of which security class is higher than or equal to that of the encrypted field-subkeys. This system is based on the Chinese Remainder Theorem. Our scheme can protect the finest level of granularity such as relation level, attribute level, tuple level, or data element level in the relational database model.

Semantics-based transaction processing: satisfying conflicting objectives

The traditional correctness criteria of serializability forces database designers to make design trade-offs. For example, in multidatabases, the designer balances the objectives of local design and execution autonomy, decentralized management of global transactions, maintenance of global integrity constraints, and execution-history correctness. The last objective is typically assessed with respect to some variant of conflict serializability. Switching to a semantics-based perspective of correctness can greatly reduce the conflict between the remaining objectives. In the case of multidatabases, the conflict can be entirely avoided for certain applications. We describe the success of the semantics-based perspective in three distinct application areas: multidatabases, secure multilevel databases, and long-duration transactions. Others have developed a fault tolerance approach with a closely related formal basis. Moreover, the method holds promise for such areas as database recovery and survivability. The cost of the semantics-based approach is additional off-line transaction analysis early in the system's life cycle, but this up-front cost is amortized over the numerous transaction invocations during the system's lifetime. We describe such off-line analysis and discuss progress in its automation.

A trusted subject architecture for multilevel secure object-oriented databases

We address security in object-oriented database systems for multilevel secure environments. Such an environment consists of users cleared to various security levels, accessing information labeled with varying classifications. Our purpose is three-fold. First, we show how security can be naturally incorporated into the object model of computing so as to form a foundation for building multilevel secure object-oriented database management systems. Next, we show how such an abstract security model can be realized under a cost-effective, viable, and popular security architecture. Finally, we give security arguments based on trusted subjects and a formal proof to demonstrate the confidentiality of our architecture and approach. A notable feature of our solution is the support for secure synchronous write-up operations. This is useful when low level users want to send information to higher level users. In the object-oriented context, this is naturally modeled and efficiently accomplished through write-up messages sent by low level subjects. However, such write-up messages can pose confidentiality leaks (through timing and signaling channels) if the timing of the receipt and processing of the messages is observable to lower level senders. Such covert channels are a formidable obstacle in building high-assurance secure systems. Further, solutions to problems such as these have been known to involve various tradeoffs between confidentiality, integrity, and performance. We present a concurrent computation model that closes such channels while preserving the conflicting goals of confidentiality, integrity, and performance. Finally, we give a confidentiality proof for a trusted subject architecture and implementation and demonstrate that the trusted subject (process) cannot leak information in violation of multilevel security.

Concurrency Control in a Secure Multilevel Database via a Two-Snapshot Algorithm

We offer a concurrency conirol algorithm for replicated, secure, multilevel databases. We compare the algorithm with a multiversion approach and with the typical full-replication approach. In the full-replication approach, each security level maintai

Maintaining secretary and integrity in multilevel databases: A practical approach: Sushil Jajodia, George Mason University, Fairfax, VA; Don Marks, Department of Defense, Ft. Meade; and Elisa Bertino, Universita di Milano, Milano, Italy.

Maintaining secretary and integrity in multilevel databases: A practical approach: Sushil Jajodia, George Mason University, Fairfax, VA; Don Marks, Department of Defense, Ft. Meade; and Elisa Bertino, Universita di Milano, Milano, Italy.

Security issues for federated database systems

This paper describes security issues for federated database management systems set up for managing distributed, heterogeneous and autonomous multilevel databases. It builds on our previous work in multilevel secure distributed database management systems and on the results of others' work in federated database systems. In particular, we define a multilevel secure federated database system and discuss issues on heterogeneity, autonomy, security policy and architecture.

Design and implementation of a database inference controller

The Inference Problem compromises database systems which are usually considered to be secure. here, users pose sets of queries and infer unauthorized information from the responses that they obtain. An Inference Controller is a device that prevents and/or detects security violations via inference. We are particularly interested in the inference problem which occurs in a multilevel operating environment. In such an environment, the users are cleared at different security levels and they access a multilevel database where the data is classified at different sensitivity levels. A multilevel secure database management system (MLS/DBMS) manages a multilevel database where its users cannot access data to which they are not authorized. However, providing a solution to the inference problem, where users issue multiple requests and consequently infer unauthorized knowledge is beyond the capability of currently available MLS/DBMSs. This paper describes the design and prototype development of an Inference Controller for a MLS/DBMS that functions during query processing. To our knowledge this is the first such inference controller prototype to be developed. We also describe some extensions to the inference controller so that an integrated solution can be provided to the problem.

An integrated access control in heterogeneous distributed database systems

As a number of diverse, heterogeneous types of database management systems are employed within a single organization, the need to integrate those systems is stringent to have an efficient and transparent accesses to remote sites. Of our particular interest among various heterogeneity issues is integrated access control that combines mandatory access control (MAC) and discretionary access control (DAC) together, with MAC based on a lattice of sensitivity labels and DAC based on individual and group access privileges. The necessity for integrating MAC and DAC arises in an open, heterogeneous multidatabase system, since any trusted system has so far provided a single, exclusive type of access control paradigm: either MAC or DAC. In this paper, we tried to formulate an integrated access control, which can provide a new and general framework to access control in heterogeneous distributed database systems (HDDBSs). The integrated access control, placed at the level of global data manager in each site, is used for security enforcement in an HDDBS. The global data manager maintains a data dictionary that contains meta data describing the global schema of the multilevel databases, clearances of users, security classifications of data, and access authorizations. Our integrated access control restricts both access to information and the flow of information only in authorized ways.

Some thoughts on access control

Teresa Lunt is director of Secure Systems Research at SRI International, Menlo Park, Cafifornia. She is leading two landmark projects: the SeaView mul t i level secure relat ional da tabase sys tem and the IDES intrusion-detection system. She is also leading new research in the areas of: security for real-time systems, inference control in multilevel database systems, security for knowledge-based systems, and using AI techniques for computer security. SOME THOUGHTS ON ACCESS CONTROL

The Medina Formation in New York State: a Computer-Assisted Regional Study Using an Integrated Database

Modern personal computers or work stations with access to user-friendly Geological Information Systems software and multilevel geologic databases permit the exploration geologist to extract and display a variety of geologic information in a fraction of the time it would take to compile the same data without the assistance of the computer. Integrated exploration systems include the database, which may be composed of a number of information files, computer programs that have the ability to interrogate any number of the different data files, cross-reference and select specific information, process the data, and present the output as significant visual images, maps, and correlated sections. A study of the Lower Silurian Medina Formation in New York State uses surface information, formation tops, production data, and digital well-log files to present a series of regional views that clearly display the depositional sequence. Maps and cross sections illustrate the development of shorelines, barrier bars, and deltaic deposits. The interactive features of integrated systems allow a geologist to create and capture those pictures that lead to the most likely interpretation.

Computing transitive closures of multilevel relations

Recently many attempts have been made to implement recursive queries. Such queries are essential for the new generation intelligent database system applications. Much of the effort in recursive queries is focussed on transitive closure queries which are of practical significance. None of the work described investigates recursive query processing in secure database management systems. In this paper we propose centralized and distributed algorithms for implementing transitive closure queries for multilevel secure relational database management systems.

The SeaView security model

A multilevel database is intended to provide the security needed for database systems that contain data at a variety of classifications and serve a set of users having different clearances. A formal security model for such a system is described. The model is formulated in two layers, one corresponding to a reference monitor that enforces mandatory security, and the second an extension of the standard relational model defining multilevel relations and formalizing policies for labeling new and derived data, data consistency, and discretionary security. The model also defines application-independent properties for entity integrity, referential integrity, and polyinstantiation integrity. >

A functional view of multilevel databases

We introduce the notion of multilevel security in functional database systems. We discuss (1) the representation of security constraints in functional systems, (2) the query modification technique, (3) an architecture for query processing and (4) a multilevel functional data model.

A model for concurrency in nested transactions systems

Today's standard model for database concurrency control, called serializability theory, represents executions of transactions as partial orders of operations. The theory tells when an execution is serializable, that is, when the set of operations of a transaction execute atomically with respect to those of other transactions. It has been used successfully to prove correctness of most database concurrency control algorithms. Its most serious limitation is its inability to represent nested computations conveniently.This paper presents a more general model that permits nested transactions. In this model, transactions may execute subtransactions, giving rise to tree-structured computations. A serializability theory is developed for this model, which can be used to prove the correctness of concurrency control algorithms for nested transactions and for multilevel database systems.The theory is based on an abstract model of computation that allows arbitrary operations, and parallel and even nondeterministic programs. Axioms are presented that express the basic properties that programs that manage or access data need to satisfy. We use these axioms to derive proof techniques. One new technique—substitution—shows the equivalence of two executions by substituting one subcomputation by another, usually shallower (i.e., less nested), one. Our proof techniques are illustrated by applying them to several well-known concurrency control problems.

A unified approach for multilevel database security based on inference engines

A multilevel relational database system handles data at different security classifications and provides access to users with different security clearances. Many methods for enforcing security in this environment have been investigated. This paper presents a unified approach to multilevel database security based on two ideas: a trusted filter and an inference engine. These two approaches are introduced separately and then the motivation for the unified system and the system model itself are presented.

Development of an experimental hospital database system using a relational database management system.

The development of an integrated database system for the satisfactory support of the information processing requirements of a modern hospital is clearly a major task with many associated problems. A design and implementation procedure for the development of a relational hospital database system based on an experimental relational database management system is presented which should help overcome some of the problems currently encountered. A brief outline of the application and the underlying database management system is given and a standardized procedure for the design of the multilevel database schemata is presented. The associated problems and procedures required for such a development are also examined and a number of theoretical conclusions and claims are tested in a real life application environment.

Security and inference in multilevel database and knowledge-base systems

This paper addresses the threat to multilevel security that arises from logical inference and the semantics of the application. Such compromises of security are particularly challenging since they circumvent traditional security mechanisms and rely on a user's knowledge of the application. The problems of inference and security have heretofore been amorphous and difficult to circumscribe. We focus on these problems in the context of a multilevel database system and show their relevance to knowledge-based systems, sometimes referred to as expert systems. Here we establish a framework for studying these inference control problems, describe a representation for relevant semantics of the application, develop criteria for safety and security of a system to prevent these problems, and outline algorithms for enforcing these criteria.

Views for Multilevel Database Security

Because views on relational database systems mathematically define arbitrary sets of stored and derived data, they have been proposed as a way of handling context-and content-dependent classification, dynamic classification, inference, aggregation, and sanitization in multilevel database systems. This paper describes basic view concepts for a multilevel-secure relational database model that addresses the above issues. All data entering the database are labeled according to views called classification constraints, which specify access classes for related data. In addition, views called aggregation constraints restrict access to aggregates of information. All data accesses are confined to a third set of views called access views.

Authorization in multilevel database models

In a multilevel database architecture, authorization rules may be written at the conceptual level or at the external level. We analyze here the consistency of authorization rules written at these two levels. We assume that the conceptual level model is of the entity-relationship type and the external model is relational. The validation of access requests against authorization rules is also discussed.