Querying a Multilevel Database: A Logical Analysis

This paper proposes a new formal model and semantics for answering queries in a multilevel polyinstantiated database. A polyinstantiated database may contain some contradict,ory facts distinguished by their classification. The main objective of this paper is then to provide the user cleared at a given level with a consistent and complete view of the multilevel database corresponding to his clearance level. In our model, a multilevel database is simply viewed as a set of ordinary single-level databases. This model is based on propositional logic and each single-level database is associated with its logical models, as in the model-theoretic approach. It includes the possibility to hide some parts of the database schema. Finally, it. may be used as a formal semantics for multilevel deductive databases. An application that has been of particular interest since the beginning of work on secure computer systems is the implementation of a multilevel database management system (DBMS). Intuitively, a given multilevel policy assigns a clearance level to subjects and a classification level to sentences of the language used to represent the database content. Classifications and clearances are both taken in a set of security levels. For instance, the sensitivity levels Top Secret (TS), Secret (S), Confidential (C), and Unclassified (U) may be used as security levels. In this case, the set of sensitivity levels is associated with a total order, viz. U < C < S < TS. However, it is also possible to define a more complex set of security levels by combining a set of sensitivity levels with a set of compartments. Particular examples of compart8ments may be NUCLEAR, MISSILE... In this case, it is generally assumed that the security levels are partially ordered in a lattice. For instance, (C, {NUCLEAR}) < (S,{NUCLEAR,MISSILE}) because C < S and {NUCLEAR} c (NUCLEAR, MISSILE} but (C, {NUCLEAR}) and (S,{MISSILE}) are not comparable.