Technical Analysis of Microsoft Excel

Transcription

1 A MULTI{LEVEL SECURE OBJECT-ORIENTED DATABASE MODEL Gerge B. Durham ; Knsanins Kalpakis Cmpuer Science and Elecrical Engineering Deparmen Universiy f Maryland Balimre Cuny 000 Hillp Circle Balimre MD 50 Absrac This mdel presens a muli-level secure (MLS) daabase using bjec-riened echnlgy. The mdel is based n, and exends he requiremens f he Deparmen f Defense STD, DD Trused Cmpuer Sysem Evaluain Crieria (TCSEC) daed December 985, cmmnly knwn as he Orange Bk. Currenly, here des n exis a daabase mdel in any echnlgy which mees he requiremens f he Orange Bk. There has been lile ineres uside f he U.S. Gvernmen and he academic cmmuniy because he Orange Bk is believed fcus n miliary needs raher han cmmercial needs. Since cmmercial espinage is grwing daily, and wihu prper precin, cmmercial infrmain will be pilfered bh nainally and inernainally, ur mdel is f ineres cmmercial users as well. Previus wrk has fcused n Discreinary Access Cnrls (DAC), Mandary Access Cnrls (MAC), r her securiy requiremens n included in he Orange Bk, bu n wrk includes all hree. We develp plicies fr access cnrls, inference cnrls, and implemenain sraegy based n he MAC, DAC, and her securiy requiremens. The access auhrizain mechanism is based n a cmbinain f DAC and MAC requiremens, and he prpsed mdel is easily exended include her access requiremens. We als presen an uline fr implemening ur mdel. Keywrds: Daabase securiy, bjec{riened daabases, mandary access cnrls, discreinary access cnrls, inference channels, muli{level securiy. I. Inrducin Many rganizains day wan disribue infrmain via he Inerne and Wrld Wide Web, ye hey als have les which hey wan resric access. Even wihin an rganizain, sme infrmain may be disribued all emplyees, while her infrmain need g nly selec grups f emplyees. These rganizains mus emply a Muli-Level Secure (MLS) daabase prvide fr variable access cnrls, ye have ecien access infrmain. Suppred in par by he Deparmen f Defense Advanced Sudies Prgram. gdurha@cs.umbc.edu Endrsing Advisr

2 Alhugh each rganizain will have is wn se f securiy requiremens based n is rganizain and purpse, here are cerain general plicies and requiremens which mus exis. Because here is n agreemen n, r deniin f a secure daabase mdel uside f he U.S. Gvernmen, his paper will emphasize he requiremens as se frh in he "Deparmen f Defense Trused Cmpuer Sysem Evaluain Crieria" (TCSEC), cmmnly knwn as he Orange Bk [5]. The mdel described in his paper ies geher many f he cnceps develped in earlier wrks, alng wih he Orange Bk requiremens, frm a base fr he mdel. I hen renes and exends he basic plicies and cnceps presen a cmpsie MLS daabase mdel which mees he needs f he miliary and cmmercial cusmers. 4 Such a mdel has n previusly been dened, since ms research has emphasized nly ne aspec f he securiy requiremens, raher han lking a all f hem simulaneusly. The remainder f his paper is rganized as fllws: In secin II, we presen a brief verview f he TCSEC divisins and classes, dene sme f he cnceps f secure daabases and infrmain securiy, and discuss previus wrk. In secin III, we develp he securiy plicies and implemenain sraegies fr ur mdel. In secin IV, we develp he daabase mdel. In secin V, we explain he implemenain f he securiy plicies and implemenain sraegies. In secin VI, we presen sme cnclusins abu ur mdel, and sugges areas fr fuure wrk. II. Preliminaries and Previus Wrk In his secin, we discuss securiy plicies and cnceps ha are essenial ur mdel. Furher, we review previus wrk in daabase securiy, relaed ur mdel. II-. DOD STD: The Orange Bk The requiremens fr his mdel are based n he TCSEC [5], which describes fur divisins f rus fr cmpuer sysems. The fur divisins, D hrugh A, wih A being he highes level f assurance, have subdivisins, knwn as classes. Each divisin and subdivisin wihin he TCSEC is dened by is requiremens fr implemenain and validain f eiher Discreinary Access Cnrl (DAC) r Mandary Access Cnrl (MAC), r bh. In general, DAC may be hugh f as resricing a user's access infrmain based n heir psiin r membership in a grup, and hus, is he user's "need--knw" he infrmain in rder fulll heir duies. MAC may be hugh f as resricing a user's access infrmain based n ha user's securiy clearance level as cmpared he assigned securiy level f he infrmain. The ineresed reader is referred he surce [5] fr furher deail. II-. Preliminaries We dene a secure daabase as ne which can be shwn auhrize r deny user access infrmain in accrdance wih he securiy plicies f an rganizain. The se f securiy plicies cvers hree areas: securiy clearance, securiy level, and need--knw rules. A securiy clearance is a measure f he level f rus given an individual. The securiy level is a label assigned infrmain, designaing he infrmain's classicain level as 4 The mdel assumes a Trused Cmpuing Base (TCB) which isinvulnerable uside aack.

3 ne f a se f hierarchical classicain labels, and pssibly, ne f a se f nn-hierarchical cmparmen labels. Need--knw rules are dynamic rules which dene he infrmain a persn needs knw in rder d heir jb. We als need inrduce he idea f access cnrls. Abrams and Smih [] describe access cnrl plicies fr daabases in reference a Generalized Framewrk fr Access Cnrl (GFAC), which cnains hree cmpnens: Access Cnrl Infrmain (ACI), Access Cnrl Rules (ACR), and Access Cnrl Auhriy (ACA). Abrams and Smih [] believe ha he radiinal MAC and DAC requiremens are resricive cver he brad specrum f access cnrl plicies, and hus, he sysem mus be able aumaically change daa classicain labels as he values r sysem aribues change. II-. Previus Wrk Bell and Lapadula [] frmally dene a cmpuer securiy mdel which is he defac sandard fr ms laer wrk, and include he *-prpery, which saes ha a subjec, which is an acive eniy, may access an bjec, which is a passive eniy, nly if he subjec's securiy level is equal r greaer han he securiy level f he bjec, and any nnhierarchical caegries f he bjec are included in he subjec's caegries. When a subjec represens a user, he subjec's securiy level equaes he securiy clearance f he user. The TCSEC [5], which relies heavily n he wrk f Bell and Lapadula [], was he rs frmal deniin fr Muli-Level Secure (MLS) cmpuing. Denning [4] prvides an inrducin cver channels and inference cnrl heries, which need be cnsidered when evaluaing a secure cmpuing sysem. Several research ers have fcused n DAC. Fernandez e al. [7, 8, 6] use frmal mdels describe access auhrizain in he frm f direced graphs based n inheried permissins beween superclasses and heir subclasses. Gudes e al. [0] exend he abve mdel include negaive auhrizain. Keler's mdel [, 4], based n access cnrl liss (ACL), prvides a ner level f granulariy, and mdels access cnrl f ypes as well as bjecs. The user-rle based mdel f Demurjian e al. [] prvides a hrugh presenain f auhrizain analysis. Oher ers have fcused n MAC requiremens. Garvey and Lun [9] prvide a unique apprach an MLS daabase wih a sudy f using knwledge base rules as access cnrls an bjec-riened daabase. Jajdia and Kgan [], Sandhu e al. [], and Schaefer e al. [] base heir sudies n a Trused Cmpuer Base (TCB) ler cnrlling access he daabase. The uniqueness f Schaefer e al. [] is ha i has been implemened as a prype. McCllum e al. [7] fcus n resricing access by allwing he riginar cnrl access auhrizain via an ACL, which is aached each bjec. Millen and Lun [8] fcus n he inference prblem. Their mdel des n allw a message direcly invke he mehd f an bjec, bu raher, a new subjec is creaed a he bjec fr he sle purpse f invking he prper mehd n behalf f he message. Marks e al. [6] and Mr e al. [9] presen ascheme fr slving he inference prblem in relainal daabases via a user access hisry lis and pre-dened hreshlds f aggregain. Keefe and Tsai [] prvide a cmparisn f hree bjec-riened mdels agains wha he auhrs dene as general principles fr "well frmed" mulilevel daabases. Their cnribuin is ha hey shw he srenghs and weakness f he hree mdels, and er insigh

4 in pssibiliies fr a jin DAC/MAC mdel. Thuraisingham [5] discusses a mulilevel mulimedia daabase sysem which reassembles a cmplex bjec frm is many pars a a requesed level. Sibley and Smih [4] prvide a sudy f secure behavir in which he sysem respnse incrrec acins varies depending n he plicy, r inerpreain f plicy f he paricular implemenain. III. Plicy Deniins and Descripins We prvide securiy deniins rs, hen plicies, and nally sraegies fr implemenain which will help ensure he securiy f ur mdel. III-. Deniins Level is dened be any ne f a se f securiy levels which frm a linear rder L = fl ;l ;:::; : l l g, frm lwes highes, and ha cnfrm he requiremens se frh fr MAC in he TCSEC. Access-Requiremen AR = far ; ar ;:::gis dened be any ne f a se f labels which dene he accessibiliy daa elemens required accmplish a dened ask. The se Access-Requiremens is an arbirary se f labels whse cmpsiin varies ver ime and can be expressed hrugh DAC as se frh in he TCSEC. Tasking T = f = (l; ar) : l L and ar AR g is dened be a pair f Level and Access-Requiremen such ha i delimis he access a a paricular securiy level which is needed fulll a dened jb funcin. We shw he mapping f users and bjecs Taskings in secin IV-. III-. Basic Securiy Plicies BP Daa bundaries depend n Tasking. Access daa is limied by bh Level and Access-Requiremen, he cmbinain f which frms he limiains required fr levels f securiy access, and implemens he plicy f leas privilege r need knw, hus cmplying wih bh DAC and MAC requiremens. BP Wrie auhrizain is nly fr he curren Tasking. A user can wrie nly heir curren Level and wihin heir curren Access-Requiremen. They mus exi he daabase and re-ener in he apprpriae Tasking in rder wrie a higher r lwer Level, r anher Access-Requiremen a heir curren Level. BP Read auhrizain is fr he curren Tasking and any auhrized lwer level bjecs which are in he Access-Requiremen dened fr he curren Tasking. Read up is n allwed. BP4 A user is graned nly ne daabase access a a ime. This plicy ensures ha here is n daa w beween w cncurren prcesses f a single user. BP5 Adminisrain is a Tasking. Adminisraive duies are dened in Taskings which allws fr sandardizain f user access, and als limis adminisrars wih he need knw requiremen. BP6 There is n aumaically inheried access auhrizain beween classes. T be auhrized access, a Tasking mus have explici auhrizain each bjec.

5 BP7 The granulariy f access auhrizain is variable; auhrizain may be an enire class, bjec, r aribue. This plicy allws fr he exibiliy needed dene Taskings which will exacly mee he needs f he users, bu n be in vilain f eiher MAC r DAC. III-. Implemenain Sraegies The fllwing sraegies exend he basic plicies beer rene he securiy mechanisms f he mdel. IS Tasking auhrizain is veried fr each acin. The sysem mus ensure ha n user can access daa based n an udaed auhrizain, and herefre, mus ake acin revalidae all users as sn as any user access is mdied. IS Full auhrizain all bjecs needed execue a query is required. This plicy limis inference channels. IS All daabase reques failures, wih limied excepin, reurn he same infrmain he user. This plicy eliminaes an inference channel. The limied excepins are sysem failures which are independen f he requesed acin; e.g., an peraing sysem failure. IS4 Reuse f a user bjec idenier frm a lwer Level, r a dieren Access- Requiremen will succeed. This plicy resuls in allwable plyinsaniain a he expense f daabase cmplexiy. I is necessary blck infrmain inference. IS5 There will n be muliple cpies f daa iems wihin he daabase. Access a daa iem frm muliple Taskings will reference he same acual daa iem. IS6 Once an bjec is creaed wihin he daabase, i will remain a is creain Level and Access-Requiremen fr he life f he daabase unless all acive references are deleed. When a user in ne Tasking delees an bjec, ha bjec cninues exis fr all her Taskings which reference i. IS7 N bjec may be aumaically reclassied. T mdify he Level f an bjec, ha bjec mus be deleed frm he daabase and re-creaed a is new Level. IV. Daabase Mdel The daabase mdel prvides a frmal descripin in erms f he daa as bjecs, and he funcins access he daa as mehds. The daabase securiy is implemened as access cnrl funcins. IV-. Daabase Objecs The erm "bjec-riened" evkes dieren hughs fr dieren peple. The erms assciaed wih bjec echnlgy are given varying inerpreains depending n he auhr and circumsances. Rishe [0], Rumbaugh e al. [], and Kim and Lchvsky [5] prvide furher explanain f bjec-riened cnceps and design inerpreains. By sric deniin, all elemens in an bjec-riened sysem are bjecs. Jajdia and Kgan [] use his ype f deniin in heir saemen ha heir mdel has nly bjecs, and n subjecs. We,

6 hwever, will use he erm bjec in he sense ha an bjec is a passive elemen sred in he daabase. A subjec is an acive elemen, usually invked n behalf f a user, which sends a message an bjec acivae a mehd fr ha bjec. A daabase is a riple DB = (U; S; O), where U = f (u ; s ); (u ; s );::: : u i is eiher a single user r a grup f users, and s i is he user saus f acive r inacive g (users), S = fs ;s ;:::g (subjecs), and O = f ; ;:::g (bjecs). An bjec Obj = (OID; Val; M) has an idenier, a value, and a se f mehds. The idenier (OID), is a sysem assigned unique label. The value (Val) may be an amic value, r i may be a cmplex value f muliple bjecs. Mehds (M) is a nn-empy se f mehds used access he values in Val. There is a se User ID cnaining uples (UOID, Tasking). The UOIDs are user generaed labels which are human readable, and he user uses reference he bjecs. The UOID mus be paired wih a Tasking because ne UOID may reference muliple bjecs frm dieren Access-Requiremens. We dene map bjec(u,) bea funcin which given a UOID and Tasking reurns he OID f he assciaed bjec. There may be a {{ r a {{many relainship beween UOID and OID. There may n be a many{{ r a many{{many relainship. Objecs are insaniains f classes, hus, each bjec is a member f a single class which is dened fr he daabase. Our bjec-riened daabase schema is a red direced acyclic graph. A he r, here is a class, knwn as a meaclass, which is he superclass f all her classes. There is a subclass{superclass relainship, beween he elemens f he se f classes C = fc ;c ;:::g in he daabase, which frms a parial rder. We wrie c i c j whenever c i is a subclass f c j. Therefre, her classes are eiher subclasses f he meaclass, r hey are subclasses f her subclasses f he meaclass. IV-. Access Vericain Vericain f a user access daa in he daabase is a {sep prcess. Afer sysem lgin, gain iniial enry in he daabase, user vericain Vu(u; ) mus ccur fr he user in a seleced Tasking. Le saus(u) be a funcin which given a user u, reurns rue if he user is n acive in he daabase, and false herwise. Als, le member(u; ) be a funcin which given a user u and a Tasking, reurns rue if he user is dened fr he Tasking, and false herwise. We dene Vu(u; ) reurn null, if he user r Tasking are invalid; acceped if saus(u) and member(u; ) are rue; and, rejeced herwise. The secnd sep is an perain vericain Vp(u,m; ) which ccurs whenever he user makes a reques he daabase. The user reques is parsed s ha curren auhrizain each bjec needed saisfy he reques is veried. Le map bjec(u,) be a funcin which akes a UOID u and a Tasking, and reurns he OID f he referenced bjec. Le allwed(; m; ) be a funcin which akes an bjec, amdem,andatasking, and reurns a mehd if he Tasking is dened fr mde m n bjec ; null herwise. Mde is dened be any ne f he se Mde = fread, Updae, Creae, Deleeg. Operain vericain is dened as reurning null if he bjec r mde m are n valid; a mehd if allwed(; m; ) reurns a mehd; and, rejeced herwise.

7 IV-. Reference Srucure An impran feaure f an MLS daabase is he capabiliy fr a user have read access he values f bjecs which are belw he user's level as well as access bjec values a he user's level. Our mdel uses a Muliple Objec Blck (MOB) implemen ha capabiliy. The MOB is a dynamically creaed lis f references bjecs, indexed in sme predened rder. In ur mdel, we dene he rder have he "primary reference" a he beginning f his lis. The her bjecs in his lis are in descending rder f heir assciaed Levels, cver sries rs, hen re-creaed bjecs. Tw assciaed mechanisms are he Muliple Objec Prmp (MOP) and he Deleed Objec Prmp (DOP). The MOP prmps he user whenever he sysem nds an MOB assciaed wih a uple (u,) enable he user designae which f he muliple referenced bjecs is desired. The DOP nies a user ha a lwer Level user has deleed he bjec, frm his r her space, which he curren user is requesing. The DOP allws he user cnrm he delee, reques he bjec persis, r re-creae he bjec a he curren user's Level. Take fr example a -- relainship beween UOID and OID where he UOID is dened fr muliple Taskings. In his circumsance, here are muliple references frm he UOID lis an OID, which references an bjec, as in Figure. UOID Tasking Ref. u u u OID Ref. u Figure : {{ Relainship The sae represened by Figure is ha where Tasking,, and all have he same Access-Requiremen, bu securiy levels unclassied, cndenial, and secre, respecively, fr example. Objecs and, herefre, represen bjecs a he unclassied Level. Nw, le a user in Tasking delee he bjec wih UOID u, and hen creae a new bjec using u as he UOID. A he same ime, he users in and may wan bjec persis. This sae is accmplished wih he use f a MOB, wih a lis f references muliple bjecs. The sysem creaes he MOB when i recgnizes he exisence f muliple bjecs being referenced frm wihin a cmmn Access-Requiremen. The resul is shwn in Figure. UOID Tasking Ref. OID u u u u Ref. Figure : New bjec a lwes level The assumpin we make here is ha unil a user delees an exising bjec, ha bjec

8 remains f primary ineres he user ver any newly creaed bjec a a lwer level. Ging back he riginal sae as in Figure, le a user in Tasking delee his r her reference, hen creae a new bjec using u. Cver sries can be creaed in his manner. The cmplexiy f his creae arises frm he fac ha alhugh his acin will n aec 's view, i will aec 's view since bh, and he newly creaed bjec will be wihin 's view, and fr ha maer, remains wihin 's view. An alernaive wuld be nly allw he user view he neares bjec, and require he user lgin a he apprpriae level see a cver sry bjec. The securiy aspecs are unaeced by he chice f implemenain. Figure shws he resul. UOID u u u u Tasking Ref. OID Ref. Figure : Cver Sry Implemenain We make he assumpin ha a user a any Level will be primarily ineresed in viewing he neares bjec, ha is, an bjec a he same, r nex lwer Level wihin ha user's view. Therefre, he primary bjec which is accessed by hrugh UOID u will be, n. V. Ouline fr Implemening Plicies in he Mdel We nw discuss he securiy requiremens in erms f he access cnrls shw ha he mdel implemens he requiremens as given in secin III. V-. Basic Plicy Implemenain BP, BP, BP, and BP5 rely n allwed(; m; ) reurning he crrec mehd. If an incrrec mehd is reurned, hen eiher allwed(; m; ) is in errr, r ne r mre f he her mapping funcins has an errr in hem, and he incrrec parameers were passed allwed. BP4 relies ally n saus(u) prvide a crrec mapping fr he specied user. BP6 is accmplished during class deniin alng wih BP7. In bh cases, he class mehds mus be prperly dened such ha hey will be accessible nly when Taskings are dened fr hem, and in he case f BP7, ha hey prperly access mehds f her bjecs. V-. Implemenain Sraegy Design IS and IS rely n crrec mappings wihin vericain perain such ha a crrec, curren mehd is reurned fr each bjec in he user reques. IS is accmplished wih excepin handlers. IS4 and IS5 bh require he crrec implemenain f MOBs. IS6 and IS7 rely n he MOBs as well, bu hey als require prper acin in respnse DOPs. VI. Cnclusins When implemened as previusly described, his mdel prvides an MLS daabase meeing he saed requiremens. Alhugh here is n aggregae plicy saed, he necessiy f ne is deermined by he implemenain. Als, sme rganizains may n require

9 such a high level f assurance fr heir paricular use. Variains f he mdel can easily be implemened because f he underlying bjec-riened echnlgy. The bjec access assumpins made in his mdel can easily be changed fr implemenains wih her requiremens. There may n be a requiremen, fr insance, ha a user be able read he value f all bjecs a lwer levels referenced by a UOID wihin an Access-Requiremen. The user may nly require access he neares bjec. Oher mdels [, 0] allw inheriance f access, and use dieren access cnrl mechanisms, such as negaive auhrizain, and class securiy hierarchy rules limi access via inheriance. We believe ha ur mdel, which des n allw inheriance f access, is far less cmplex, and has access cnrls which are mre veriable, and herefre is superir in is implemenain. Our nex sep is build a prype demnsraing he feasibiliy and prperies f ur mdel. We als plan incrprae aggregae plicies in ur mdel. Much f he basis f such plicies depends n semanic inerpreains being develped fr he daa. The securiy plicies f his mdel are designed mee he needs f he U.S. gvernmen. T make ur mdel mre aracive cmmercial users, ne migh relax sme f he securiy requiremens, and hereby prduce a mre user friendly and simpler sysem. Acknwledgmens I acknwledge wih deep graiude he echnical guidance, advice, and criique prvided by my Advisr, Dr. Knsanins Kalpakis, he mral suppr f Dr. Yelena Yesha, and he guidance f Dr. Charles Abzug. I wuld als like hank my c-wrker, Mr. Dnald Marks, fr he many discussins n securiy plicies and inerpreains. References [] M. D. Abrams and G. W. Smih. A rused basis fr daabase access cnrls. Technical repr, The Mire Crprain, McLean, VA, and Nainal Defense Universiy, Washingn, D.C., 99. [] D.E. Bell and L.J. LaPadula. Secure cmpuer sysems: Unied expsiin and mulics inerpreain. Technical repr, The Mire Crprain, Bedfrd, MA, 976. [] S.A. Demurjian, M.Y. Hu, T.C. Ting, and D. Kleinman. Twards an auhrizain mechanism fr user-rle based securiy in an bjec-riened design mdel. In Prceedings f he h Annual Inernainal Phenix Cnference n Cmpuers and Cmmunicains, pages 95{ 0, 99. [4] D. E. Denning. Crypgraphy and Daa Securiy. Addisn-Wesley Publishing Cmpany, Reading, MA, 98. [5] DD. Trused cmpuer sysem evaluain crieria. Technical Repr DD STD, Deparmen f Defense, Nainal Cmpuer Securiy Cener., 985. [6] E. B. Fernandez, R.B. France, and D. Wei. A frmal specicain f an auhrizain mdel fr bjec-riened daabases. In Prceedings f he IFIP WG. Ninh Annual Wrking Cnference n Daabase Securiy, pages 05{9, 995. [7] E. B. Fernandez, E. Gudes, and H. Sng. A securiy mdel fr bjec-riened daabases. In Prceedings f he 989 IEEE Sympsium n Securiy and Privacy, pages 0{5, 989.

10 [8] E. B. Fernandez, E. Gudes, and H. Sng. A mdel fr evaluain and adminisrain f securiy in bjec-riened daabases. IEEE Transacins n Knwledge and Daa Engineering, 6():75{9, 994. [9] T. D. Garvey and T. F. Lun. Mulilevel securiy fr knwledge based sysems. Technical Repr SRI-CSL-9-0, SRI Inernainal, Menl Park, CA, 99. [0] E. Gudes, H. Sng, and E. B. Fernandez. Evaluain f negaive, predicae, and insancebased auhrizain in bjec-riened daabases. Technical repr, Ben-Gurin Universiy, Beer-Sheva, Israel, and Flrida Alanic Universiy, Bca Ran, FL., 99. [] S. Jajdia and B. Kgan. Inegraing an bjec-riened daa mdel wih mulilevel securiy. In Prceedings f he 990 IEEE Sympsium n Research in Securiy and Privacy, pages 76{85, 990. [] T. F. Keefe and W. T. Tsai. Securiy mdel cnsisency in secure bjec-riened sysems. In Prceedings f he Fifh Annual Cmpuer Securiy Applicains Cnference, pages 90{ 98, 989. [] U. Keler. Grup-riened discreinary access cnrls fr disribued srucurally bjecriened daabase sysems. In Prceedings f he Eurpean Sympsium n Research n Cmpuer Securiy, pages {, 990. [4] U. Keler. Discreinary access cnrls in a high-perfrmance bjec managemen sysem. Technical repr, Fern Universia Hagen, Prakische Infrmaik V, Hagen, Germany, 99. [5] W. Kim and F. H. Lchvsky. Objec-Oriened Cnceps, Daabases and Applicains. ACM Press, New Yrk, NY, 989. [6] D. G. Marks, A. Mr, and S. Jajdia. Enhancing he cnrlled disclsure f sensiive infrmain. In Prceedings f Cmpuer Securiy - ESORICS 96, 4h Eurpean Sympsium n Research in Cmpuer Securiy, pages 90{0, 996. [7] C. J. McCllum, J. R. Messing, and L. Nargiacm. Beynd he pale f MAC and DAC - dening new frms f access cnrl. In Prceedings IEEE Sympsium n Securiy and Privacy, 990. [8] J. K. Millen and T. F. Lun. Securiy fr bjec-riened daabase sysems. In Prceedings f he 99 IEEE Cmpuer Sciey Sympsium n Securiy and Privacy, pages 60{7, 99. [9] A. Mr, D. G. Marks, and S. Jajdia. Aggregain in relainal daabases: Cnrlled disclsure f sensiive infrmain. In Prceedings f ESORICS-94, Third Eurpean Sympsium n Research in Cmpuer Securiy, pages 4{445, 994. [0] N. Rishe. Daabase Design. McGraw-Hill, Inc., New Yrk, NY, 99. [] J. Rumbaugh, M. Blaha, W. Premerlani, F. Eddy, and W. Lrensen. Objec-Oriened Mdeling and Design. Prenice-Hall, Inc., Englewd Clis, NJ, 99. [] R. Sandhu, R. Thmas, and S. Jajdia. A secure kernelized archiecure fr mulilevel bjecriened daabases. In Prceedings f he IEEE Cmpuer Securiy Fundains Wrkshp IV, pages 9{5, 99. [] M. Schaefer, P. Marel, T. Kanawai, and V. Lyns. Mulilevel daa mdel fr he Trused ONTOS Prype. In Prceedings f he IFIP WG. Ninh Annual Wrking Cnference n Daabase Securiy, pages {4, 995. [4] E. H. Sibley and G. W. Smih. On he behavir f mulilevel daabase sysems. Technical repr, Gerge Masn Universiy and Nainal Defense Universiy, 99. [5] B. Thuraisingham. Mulilevel securiy fr mulimedia daabase sysems. Technical repr, The Mire Crprain, Bedfrd, MA., 99.