The Multilevel Relational ( MLR ) Data Model 3 SHIP OBJ DEST

Many multilevel relational data models have been proposed, and diierent models ooer diierent advantages. In this paper, we adapt and reene several of the best ideas from previous models and add new ideas to build the new Multilevel Relational (MLR) data model. MLR provides multilevel relations with element-level labeling, as a natural extension of the traditional relational data model. MLR introduces several new concepts (notably data-borrow integrity and the UPLEVEL statement) and signiicantly redeenes existing concepts from the literature (notably polyinstantiation and referential integrity as well as data manipulation operations). A central contribution of this paper is proofs of soundness, completeness and security of MLR. A new data-based semantics is given to the MLR data model by combining ideas from SeaView, belief-based semantics and LDV. This new semantics has the advantages of both eliminating ambiguity and retaining upward information ow. MLR is secure, unambiguous and powerful. It has ve integrity properties and ve operations for manipulating multilevel relations. Soundness, completeness and security respectively show that any of the ve database manipulation operations will keep database states legal (i.e., satisfying all integrity properties), that every legal database state can be constructed, and that MLR is non-interfering. The expressive power of MLR is also compared favorably with several other models. by subjects are restricted by mandatory access controls, roughly expressed as \no read up, no write down", to follow the well-known Bell-LaPadula model 1; 11]. However, from a security standpoint, this restriction should be strengthened by a further requirement: operations from any given level should not be accepted or rejected due to existence or absence of any higher level data, otherwise there will be some signaling channels for leakage of high-level data (i.e., indirect methods of communication from higher-level processes to lower-level ones 7]). Many multilevel relational data models have been proposed in the literature, for example SeaView 3; 8], LDV 5], and those proposed by Sandhu-Jajodia 13; 14], Jajodia-Sandhu 6; 7], Smith-Winslett 16], etc. Each of these models has its innovations and strong points, e.g., the integrity properties in SeaView and Sandhu-Jajodia model, the belief-based semantics of Smith-Winslett model, the multilevel manipulation of Jajodia-Sandhu model, the derive option of LDV, etc. How can the best features of these models be reconciled and uniied into a secure, unambiguous and powerful multilevel relational data model? This paper directly confronts this question by the presenting the Multilevel Relational (MLR) data model. MLR introduces several …