Starship Mission Destination Enterprise L Spying M 1 Rigel M 2 Enterprise L Spying M 1 ? Enterprise L ? Rigel M 2 5 Polyinstantiation Integrity Figure 6: Element-level Classiication 4.3 Tradeoo 4.2 Element-level Classiication

We characterized the information in a multilevel state of the world that is captured by a multilevel relational database. Based on the characterization, we formalized the security semantics of tuple-level and element-level data classiication schemes. Entity and referential integrity constraints for the multilevel relational model are derived from the security semantics. We also showed that the two data classiication schemes are equally expressive, and identiied design tradeoos between the two in developing a multilevel relational database. Polyinstantiation integrity is critical in the multilevel relational model. Besides capturing the notion of functional dependency, it not only provides the basis of an operational semantics of multilevel relational databases, but also serves as correctness criteria for implementation techniques such as the decomposition and recovery algorithm. Applying our security semantics, we derived the polyinstantiation integrity for element-level classiication, and showed that existing approaches to polyinstantiation integrity are inappropriate. We believe that the controversy surrounding the polyinstantiation integrity, the operational semantics, and even the decomposition and recovery algorithm in multilevel relational databases is primarily due to the lack of a proper security semantics for element-level classiication. By formalizing the security semantics, our results supply the foundation for the multilevel relational model, its integrity properties, its operational semantics, and its implementation. Hence it is fair to say that, while the essence of the basic polyinstantiation integrity property is to capture functional dependencies in a multilevel state of the world, the essence of various extensions of the basic polyinstantiation integrity property is instead to eliminate redundancy in a multilevel database, although no existing proposals fully meet this requirement. In fact, we can show that redundancy cannot be completely eliminated without problematic uses of null values, as evidenced by the second relation of Figure 10. So there cannot be a perfect polyinstantiation integrity that both preserves functional dependency and eliminates redundancy. Notice that redundancy is not an artifact of the state of the world that a database is to capture, but rather an artifact of the database itself. In comparison, functional dependencies represent general laws of a state of the world. Following the spirit of standard relation model where integrity constraints capture real world semantics, we conclude that polyinstantiation integrity should be designed to represent functional dependencies only, and should not be overloaded with the task of redundancy elimination. In other words, the basic polyinstantiation integrity property is appropriate in capturing polyinstantiation integrity in the multilevel relational model. …