Eliminating polyinstantiation securely

Polyinstantiation has generated a great deal of controversy lately. Some have argued that pol~nstantia~on and integriry are fundamentally incompatible, and have proposed alternatives to polyinstantiation. Others have argued about the correct definition of polyinstantiation and its operational semantics. In this paper we provide a fresh analysis of the basic problem that we are rrying ro solve; that is, how can an honest database keep secrets? Our analysis leads us to the concept of restricted polyinstantiation wherein we show how to solve this problem without compromising on any of the following requirements: secrecy, integrity, availability-of-service, element-level labeling and high assurance. This is the first solution to meet all these requirements simultaneously.