Search

The Interconnected Network or the Internet has revolutionized digital communications. It has expanded worldwide over the past four decades due to numerous features such as connectivity, transparency, hierarchy, and openness. Several drawbacks, including mobility, scalability, controllability, security, etc., have been presented due to continuous developments. Although several network paradigms exist to address such drawbacks, many issues still persist. This research proposed a future network paradigm that addresses multilevel security shortcomings. It suggested the following: (i) a two-router network-based cyber security architecture for multilevel data sharing; (ii) using a scheduler to deal with the multilevel transmitted packets scheduling problem; (iii) five algorithms for the studied difficult problem; and (iv) providing an experimental result to show the optimal results obtained by the developed algorithms and comparing it with algorithms in the literature. The experimental result shows that the random-grouped classification with shortest scheduling algorithm (RGS) performed the best at 37.7% with a gap of 0.03. This result proves the practicality of our approach in terms of two-machine scheduling problems.

The exponential advancement in telecommunication embeds the Internet in every aspect of communication. Interconnections of networks all over the world impose monumental risks on the Internet. A Flooding Attack (FA) is one of the major intimidating risks on the Internet where legitimate users are prevented from accessing network services. Irrespective of the protective measures incorporated in the communication infrastructure, FA still persists due to the lack of global cooperation. Most of the existing mitigation is set up either at the traffic starting point or at the traffic ending point. Providing mitigation at one or the other end may not be a complete solution. To insist on better protection against flooding attacks, this work proposes a cooperative multilevel defense mechanism. The proposed cooperative multilevel defense mechanism consists of two-level of mitigation. In the first level, it is proposed to design a Threshold-based rate-limiting with a Spoofing Resistant Tag (TSRT), as a source end countermeasure for High-Rate Flooding Attacks (HRFA) and spoofing attacks. In the second level, the accent is to discriminate normal traffic after Distributed Denial of Service (DDoS) traffic and drop the DDoS traffic at the destination end. Flow Congruence-based Selective Pushback (FCSP), as a destination-initiated countermeasure for the Low Rate Flooding Attack (LRFA). The source and the destination cooperate to identify and block the attack. A key advantage of this cooperative mechanism is that it can distinguish and channel down the attack traffic nearer to the starting point of the attack. The presentation of the agreeable cooperative multilevel safeguard mechanism is approved through broad recreation in NS-2. The investigation and the exploratory outcomes show that the proposed plan can effectively identify and shield from the attack. [ABSTRACT FROM AUTHOR]

Multilevel Security (MLS) is one of the ways that protects the stored information in the computer and mobile devices. It classifies users and information into levels of security; thus, the user can access information within its level or less. A smartphone is used in managing some of businesses, controlling the home and car devices within the smart city environment by using a set of data stored in the database. The database is used by more than one authorized user some of this data is confidential and important that requires protection from un authorized users. In this research a proposed system to implement the MLS principle within three levels of security is presented. The first level gives the user its own security level. The second level transfers users through the system parts according to their security level (system administrator or regular user). The third level allows users to manipulate the stored encrypted data in SQLite database by using a simple and quick cryptographic algorithm. The proposed system is implemented in the smart mobile devices which are supported by the Android operating system. The experimental result showed that the proposed system has the ability to protect the data in the database and prevents users to view the data at upper levels. Also, the inability of users to change the security level of data that prevents the leak of data from the upper security levels to the lower level. Moreover, the proposed system works quickly and needs a little storage space.

A secure concurrency control algorithms must be devoid of covert channels originating from data conflicts between transactions, in addition to ensuring database integrity. Current secure concurrency control algorithms mistreat transactions with higher access classes. Because it better solves the priority inversion problem. A widely used concurrency control algorithm is the two-phase locking with high priority (2 PL-HP). The inclusion of cyclic restart, deadlock, unnecessary abort, pseudo-priority inversion, and starvation, on the other hand, may reduce its performance. In this paper, a new enhanced of secure two-phase locking protocol with multilevel secure distributed database systems is presented, the idea of enhanced secure Two-Phase locking protocol by adding the security level to assign the priority to the transaction. The enhanced add a secure manager to decide the level of the security and give the instruction to process the transaction in real lock with data x/virtual lock with version data x0 or decided to Abort the transaction based on the security level. The suggested study intends to reduce transaction miss rate by addressing the following issues: deadlock by splitting the execution stage into locking and processing phases, it reduces unnecessary cycle restart, transaction aborts by checking the security priority level (high, medium, low), and generating virtual lock and versions data. Finally, simulation performance confirms that improvement in transactions miss's percent and reduction in transactions' rollbacks compared to other secure concurrency control.

Multilevel security (MLS) systems control access to data by formalizing permissible and impermissible information flows between data sources and destinations (e.g., database servers and clients) fixed with distinct security labels. In computer networks, MLS systems have been used to prevent unauthorized data disclosure in shared-infrastructure settings where network hosts and devices may fall within different trust domains (e.g., in multi-tenant cloud networks or wireless mesh networks). However, current MLS systems assume static network behavior—thus preventing the network from being practically usable in the presence of dynamic network events that frequent unstable network environments, including sudden changes in traffic patterns, link failures, and topology changes as a result of device movement or intermittent device connectivity. In this paper, we introduce MLS-Enforcer, a software-defined networking (SDN) controller application that can efficiently deploy network-level MLS policies while retaining the ability to securely relabel network nodes under changing topology state and network traffic demands. We model network adaptivity as an integer linear programming problem that reflects a given security policy. We then introduce heuristic relabeling algorithms that achieve near-optimal performance and are more tractable and efficient for larger networks. We validate MLS-Enforcer on several network topologies and traffic loads, demonstrating that it can relabel the network to route 90%+ of flows under normal conditions and quickly converge (on the order of seconds for the heuristic algorithms) under changing needs—from small network structure changes to catastrophic failures. This shows that formally secured networks can feasibly be deployed in diverse, changing, and unpredictable environments. [ABSTRACT FROM AUTHOR]

A secure concurrency control algorithms must be devoid of covert channels originating from data conflicts between transactions, in addition to ensuring database integrity. Current secure concurrency control algorithms mistreat transactions with higher access classes. Because it better solves the priority inversion problem. A widely used concurrency control algorithm is the two-phase locking with high priority (2 PL-HP). The inclusion of cyclic restart, deadlock, unnecessary abort, pseudo-priority inversion, and starvation, on the other hand, may reduce its performance. In this paper, a new enhanced of secure two-phase locking protocol with multilevel secure distributed database systems is presented, the idea of enhanced secure Two-Phase locking protocol by adding the security level to assign the priority to the transaction. The enhanced add a secure manager to decide the level of the security and give the instruction to process the transaction in real lock with data x/virtual lock with version data x0 or decided to Abort the transaction based on the security level. The suggested study intends to reduce transaction miss rate by addressing the following issues: deadlock by splitting the execution stage into locking and processing phases, it reduces unnecessary cycle restart, transaction aborts by checking the security priority level (high, medium, low), and generating virtual lock and versions data. Finally, simulation performance confirms that improvement in transactions miss's percent and reduction in transactions' rollbacks compared to other secure concurrency control. [ABSTRACT FROM AUTHOR]

High-assurance systems found in safety-critical infrastructures are facing steadily increasing cyber threats. These critical systems require rigorous guarantees in information flow security to prevent confidential information from leaking to an unclassified domain and the root of trust from being violated by an untrusted party. To enforce bit-tight information flow control, gate-level information flow tracking (GLIFT) has recently been proposed to precisely measure and manage all digital information flows in the underlying hardware, including implicit flows through hardware-specific timing channels. However, existing work in this realm either restricts to two-level security labels or essentially targets two-input primitive gates and several simple multilevel security lattices. This article provides a general way to expand the GLIFT method for multilevel security. Specifically, it formalizes tracking logic for an arbitrary Boolean gate under finite security lattices, presents a precise tracking logic generation method for eliminating false positives in GLIFT logic created in a constructive manner, and illustrates application scenarios of GLIFT for enforcing multilevel information flow security. Experimental results show various trade-offs in precision and performance of GLIFT logic created using different methods. It also reveals the area and performance overheads that should be expected when expanding GLIFT for multilevel security.

A multilevel secure access control strategy for distributed system was proposed,which could guarantee the data confidentiality and security,through adding platform and middleware modules.The security policy was described in the XACML language,and the security and flexibility of the policy were analyzed.

Abstract Covert channels can be used to transfer confidential information in multilevel secure operating systems. In this article authors will discuss an improvement of our technique of transferring data using covert channels. To achieve the maximum "top-down" data transfer rate authors presented synchronization and cooperation of two processes using the Linux task scheduler feature, proof-of-concept of explit were presented as well. In this article, authors will study the throughput of well-known covert communication channels on various modern multi-core processors under the Linux operating system - network port binding and file lock. Authors implement and analyze various methods of channel throughput increasing for different processors and different Linux-based operating systems. Optimization technique described in this paper allows to achieve more than 2 million bits per second using storage covert channel which appears a real threat to multilevel systems security where even more than 100 bits per second is considered unacceptable. [ABSTRACT FROM AUTHOR]

In transparent computing, client terminals are rather lightweight, while all other resources (including OSs) are stored on remote servers and delivered on demand to clients via streaming. In this article, the authors propose a Multilevel Access Control Scheme in Transparent Computing (MACTC) to protect user data with different security levels and provide multilevel access control and valid identity authentication. The proposed scheme is effective in multilevel data security, flexible in authorized resource sharing, and secure against various malicious attacks. [ABSTRACT FROM PUBLISHER]

In order to solve the problem caused by the variety and openness of the network,the research for the models of structured document and access control were taken.A new structured document representation model and method for the security requirements of the multi-element access control and multi-level security was proposed,and corresponding structure of security attribute and example of extensible markup language (XML) was given.Finally,analyzed the security performance.

A model which enhances the integrity of BLP model was presented based on the BLP model.This model was called as EIBLP model.Some necessary restraints to upward information flow were appended in EIBLP without chang-ing the information flow direction（down-read and up-write） of BLP model and the security axiom,access labels of sub-ject and object,access control operation mode,and state transition policy of BLP model were improved.And then,ana-lyzes the security of EIBLP was analyzed and proved.It shows that the improved EIBLP model not only satisfies com-pletely the basic security of BLP,but also enhances the integrity of BLP with improving the upward restraints,the subject and object access labels,the model operation mode,and the model state translation rules.At the same time,the improved EIBLP raises the confidentiality of BLP at a certain extent.

The Interconnected Network or the Internet has revolutionized digital communications. It has expanded worldwide over the past four decades due to numerous features such as connectivity, transparency, hierarchy, and openness. Several drawbacks, including mobility, scalability, controllability, security, etc ., have been presented due to continuous developments. Although several network paradigms exist to address such drawbacks, many issues still persist. This research proposed a future network paradigm that addresses multilevel security shortcomings. It suggested the following: (i) a two-router network-based cyber security architecture for multilevel data sharing; (ii) using a scheduler to deal with the multilevel transmitted packets scheduling problem; (iii) five algorithms for the studied difficult problem; and (iv) providing an experimental result to show the optimal results obtained by the developed algorithms and comparing it with algorithms in the literature. The experimental result shows that the random-grouped classification with shortest scheduling algorithm (RGS) performed the best at 37.7% with a gap of 0.03. This result proves the practicality of our approach in terms of two-machine scheduling problems., Competing Interests: The author declares that they have no competing interests., (©2023 Sarhan.)

Vulnerabilities such as design flaws, malicious codes and covert channels residing in hardware design are known to expose hard-to-detect security holes. However, security hole detection methods based on functional testing and verification cannot guarantee test coverage or identify malicious code triggered under specific conditions and hardware-specific covert channels. As a complement approach to cipher algorithms and access control, information flow analysis techniques have been proved to be effective in detecting security vulnerabilities and preventing attacks through side channels. Recently, gate level information flow tracking (GLIFT) has been proposed to enforce bittight information flow security from the level of Boolean gates, which allows detection of hardware-specific security vulnerabilities. However, the inherent high complexity of GLIFT logic causes significant overheads in verification time for static analysis or area and performance for physical implementation, especially under multilevel security lattices. This paper proposes to reduce the complexity of GLIFT logic through state encoding and logic optimization techniques. Experimental results show that our methods can reduce the complexity of GLIFT logic significantly, which will allow the application of GLIFT for proving multilevel information flow security. [ABSTRACT FROM AUTHOR]

Integrating and sharing data from different data sources is one of the trends to make better use of data. However, data integration hampers data confidentiality where each data source has its own access control policy. This paper includes a discussion on the issue about access control across multiple data sources when they are combined together in the scenario of searching over these data. A method based on multilevel security for data integration is proposed. The proposed method allows the merging of policies and also tackles the issue of policy conflicts between different data sources. [ABSTRACT FROM AUTHOR]

The paper presents some of the results obtained within the ongoing project related with functional requirements and design models of secure workstation for special applications (SWSA). SWSA project is directed toward the combination of the existing hardware and software virtualization with cryptography and identification technologies to ensure the security of multilevel classified data by means of some formal methods. In the paper the requirements for SWSA, its hardware and software architecture, selected security solution for data processing and utilized approach to designing secure software are presented. The novel method for secure software design employs dedicated tools to verify the confidentiality and the integrity of data using Unified Modeling Language (UML) models. In general, the UML security models are embedded in and simulated with the system architecture models, thus the security problems in SWSA can be detected early during the software design. The application of UML topology models enables also to verify the fundamental requirement for MLS systems, namely the hardware isolation of subjects from different security domains.

This paper presents the design and implementation features of Centralized Pervasive Computing Environment/Multilevel Security (CPCE/MLS), a multilevel security (MLS) system in pervasive computing environment deployed in Local area network (LAN) with a Mandatory Access Control (MAC) mechanism. By introducing the server-storage terminals and implementing the multilevel security access control mechanism based on the Bell–LaPadula model, process creation supervision, and an auditing mechanism, the CPCE/MLS system is able to provide the security guarantee of the whole computing environment. As such, each terminal is controlled under an integrated security policy. The performance test results show that the CPCE/MLS system, without optimization, generates great overhead but achieves significantly better performance after the cache mechanism is added in the monitor agent and in the hook driver. The system with the hook driver cache mechanism is able to achieve the 95.9% throughput of the native system with 8 K and 16 K requested data blocksize. [ABSTRACT FROM AUTHOR]

Abstract: Multilevel security (MLS) is specifically created to protect information from unauthorized access. In MLS, documents are assigned to a security label by a trusted subject e.g. an authorized user and based on this assignment; the access to documents is allowed or denied. Using a large number of security labels lead to a complex administration in MLS based operating systems. This is because the manual assignment of documents to a large number of security labels by an authorized user is time-consuming and error-prone. Thus in practice, most MLS based operating systems use a small number of security labels. However, information that is normally processed in an organization consists of different sensitivities and belongs to different compartments. To depict this information in MLS, a large number of security labels is necessary. The aim of this paper is to show that the use of latent semantic indexing is successful in assigning textual information to security labels. This supports the authorized user by his manual assignment. It reduces complexity by the administration of a MLS based operating system and it enables the use of a large number of security labels. In future, the findings probably will lead to an increased usage of these MLS based operating systems in organizations. [Copyright &y& Elsevier]

The proliferation of sensors and mobile devices and their connectedness to the network have given rise to numerous types of situation monitoring applications. Data Stream Management Systems (DSMSs) have been proposed to address the data processing needs of such applications that require collection of high-speed data, computing results on-the-fly, and taking actions in real-time. Although a lot of work appears in the area of DSMS, not much has been done in multilevel secure (MLS) DSMS making the technology unsuitable for highly sensitive applications, such as battlefield monitoring. An MLS-DSMS should ensure the absence of illegal information flow in a DSMS and more importantly provide the performance needed to handle continuous queries. We illustrate why the traditional DSMSs cannot be used for processing multilevel secure continuous queries and discuss various DSMS architectures for processing such queries. We implement one such architecture and demonstrate how it processes continuous queries. In order to provide better quality of service and memory usage in a DSMS, we show how continuous queries submitted by various users can be shared. We provide experimental evaluations to demonstrate the performance benefits achieved through query sharing. [ABSTRACT FROM AUTHOR]

The paper presents some of the results obtained within the ongoing project related with functional requirements and design models of secure workstation for special applications (SWSA). SWSA project is directed toward the combination of the existing hardware and software virtualization with cryptography and identification technologies to ensure the security of multilevel classified data by means of some formal methods. In the paper the requirements for SWSA, its hardware and software architecture, selected security solution for data processing and utilized approach to designing secure software are presented. The novel method for secure software design employs dedicated tools to verify the confidentiality and the integrity of data using Unified Modeling Language (UML) models. In general, the UML security models are embedded in and simulated with the system architecture models, thus the security problems in SWSA can be detected early during the software design. The application of UML topology models enables also to verify the fundamental requirement for MLS systems, namely the hardware isolation of subjects from dif- ferent security domains. [ABSTRACT FROM AUTHOR]

Abstract: In this paper, a classification label addition and management scheme for binary documents is proposed. Firstly, with the help of invisibility and robustness of watermarking, the consistency between classified documents and classification labels is realized. Then, for achieving the hierarchy access control, the cryptographic keys manage scheme based on Chinese remainder theorem is proposed to manage the documents with classification labels. The analyses show that proposed scheme achieves the consistency between the classified documents, the users and the classification labels. [Copyright &y& Elsevier]

The SELinux mandatory access control (MAC) policy has recently added a multilevel security (MLS)model which is able to express a fine granularity of control over a subject's access rights. The problem is that the richness of the SELinux MLS model makes it impractical to manually evaluate that a given policy meets certain specific properties. To address this issue, we have modeled the SELinux MLS model, using a logical specification and implemented that specification in the Prolog language. Furthermore, we have developed some analyses for testing information flow properties of a given policy as well as an algorithm to determine whether one policy is compliant with another. We have implemented these analyses in Prolog and compiled our implementation into a tool for SELinux MLS policy analysis, called PALMS.Using PALMS, we verified some important properties of the SELinux MLS reference policy, namely that it satisfies the simple security condition and ⋆ - property defined by Bell and LaPadula. We also evaluated whether the policy associated to a given application is compliant with the policy of the SELinux system in which it would be deployed. [ABSTRACT FROM AUTHOR]

Mandatory access control models have traditionally been employed as a robust security mechanism in multilevel security environments such as military domains. In traditional mandatory models, the security classes associated with entities are context-insensitive. However, context-sensitivity of security classes and flexibility of access control mechanisms may be required especially in pervasive computing environments. To this aim, we propose a context-aware mandatory access control model (CAMAC) capable of dynamic adaptation of access control policies to context, and of handling context-sensitive class association, in addition to preservation of confidentiality and integrity as specified in traditional mandatory access control models. In order to prevent any ambiguity, a formal specification of the model and its elements such as context predicates, context types, level update rules, and operations is required. High expressiveness of the model allows specification of the traditional mandatory access control models such as BLP, Biba, Dion, and Chinese Wall. The model can also be considered as an information flow control model with context-sensitive association of security classes. [ABSTRACT FROM AUTHOR]

A new concept, the security level difference of a covert channel, is presented, which means the security level span from the sender to the receiver of the covert channel. Based on this, the integrated criteria for covert channel auditing are given. Whereas TCSEC (Trusted Computer System Evaluation Criteria) or CC (Common Criteria for Information Technology Security Evaluation) only use the bandwidth to evaluate the threat of covert channels, our new criteria integrate the security level difference, the bandwidth sensitive parameter, bandwidth, duration and instantaneous time of covert channels, so as to give a comprehensive evaluation of the threat of covert channels in a multilevel security system. [ABSTRACT FROM AUTHOR]

Multilevel security is the prevention of unauthorized disclosure among multiple information classes. The threat source for the disclosures includes unauthorized users and subverted software operating on behalf of authorized users. The terminology might be more explicit if we could call this concept multidomain confidentiality, but it is worth resisting multiplying terminology. Nonetheless, we should understand that multilevel security means multidomain confidentiality. The author asks if there is less need for multilevel security today, and if there is still a need, how we might address it. [ABSTRACT FROM PUBLISHER]

Database systems for real-time applications must satisfy timing constraints associated with transactions. Typically, a timing constraint is expressed in the form of a deadline and is represented as a priority to be used by schedulers. Recently, security has become another important issue in many real-time applications. In many systems, sensitive information is shared by multiple users with different levels of security clearance. As more advanced database systems are being used in applications that need to support timeliness while managing sensitive information, there is an urgent need to develop concurrency control (CC) algorithms in transaction management that satisfy both timing and security requirements.In this paper, we propose two CC algorithms that ensure both security and real-time requirements. The proposed algorithms are primarily based on MV locking. However, in order to satisfy timing constraints and security requirements, a new method, called the Freeze, is proposed. In addition, we show that our algorithms work correctly and they provide a higher degree of concurrency than existing MV algorithms. We present several examples to illustrate the behavior of our algorithms, along with performance comparisons with other algorithms. The simulation results show significant performance improvement of the proposed algorithms. [Copyright &y& Elsevier]

Numerous extended transaction models have been proposed in the literature to overcome the limitations of the traditional transaction model for advanced applications characterized by their long durations, cooperation between activities and access to multiple databases (like CAD/CAM and office automation). However, most of these extended models have been proposed with specific applications in mind and almost always fail to support applications with slightly different requirements. We propose the Multiform Transaction model to overcome this limitation. The multiform transaction model supports a variety of other extended transaction models. A multiform transaction consists of a set of component transactions together with a set of coordinators which specify the transaction completion dependencies among the component transactions. A set of transaction primitives allow the programmer to define custom completion dependencies. We show how a wide range of extended transactions can be implemented as multiform transactions, including sagas, transactional workflows, nested transactions, and contingent transactions. We allow the programmers to define their own primitives—having very well-defined interfaces—so that application specific transaction models like distributed multilevel secure transactions can also be supported. [ABSTRACT FROM AUTHOR]

This paper introduces a technique for detecting covert storage channels using a tree structure called a Covert Flow Tree (CFT). The benefits of using Covert Flow Trees to perform a covert channel analysis are twofold. First, by traversing the paths of a Covert Flow Tree, a comprehensive list of scenarios that potentially support covert communication via particular resource attributes can be automatically constructed. Secondly, Covert Flow Trees graphically illustrate the process through which information regarding the state of one attribute is relayed to another attribute, and how in turn that information is relayed to a listening process. Using this visual model to examine the routes by which information travels during covert communication enhances the analyst's understanding of the storage channel and may provide insight into the formation of countermeasures. Algorithms for automating the construction of Covert Flow Trees and potential covert channel operation sequences are presented. To illustrate this technique, two example systems are analyzed and their results compared to two currently accepted analysis techniques performed on identical systems. This comparison shows that the CFT approach not only identified all covert storage channels found by the other analysis techniques, but discovered a channel not detected by the other techniques. [ABSTRACT FROM AUTHOR]

A database system must have knowledge of the semantics (the properties) of the data it manages to accomplish its tasks. For a multilevel secure database system to provide effective multilevel support to users, it must have knowledge of the security-relevant data semantics. Modeling the data semantics of an application domain has been a subject of research for many years in the database community, but these efforts only address integrity properties of data. This paper demonstrates the use of an extended data model which represents both integrity and secrecy aspects of data. This modeling technique can be used as a database design tool and, more importantly, as a vehicle for domain experts, database designers, and security officers to precisely define the security requirements for an application domain. A second contribution is a comprehensive taxonomy of security-relevant data semantics that must be captured and understood to implement a multilevel secure automated information system. [ABSTRACT FROM AUTHOR]

A multilevel database is intended to provide the security needed for database systems that contain data at a variety of classifications and serve a set of users having different clearances. This paper describes a formal security model for a such a system. The model is formulated in two layers, one corresponding to a reference monitor that enforces mandatory security, and the second an extension of the standard relational model, defining multilevel relations and formalizing policies for labeling new and derived data, data consistency, and discretionary security. The model also defines application-independent properties for entity integrity, referential integrity, and polyinstantiation integrity. [ABSTRACT FROM AUTHOR]

This paper examines the application of two covert channel analysis techniques to a high level design for a real system, the Honeywell Secure Ada® Target (SAT). The techniques used were a version of the noninterference model of multilevel security due to Goguen and Meseguer and the shared resource matrix method of Kemmerer. Both techniques were applied to the Gypsy Abstract Model of the SAT. The paper discusses the application of the techniques and the nature of the covert channels discovered. The relative strengths and weaknesses of the two methods are discussed and criteria for an ideal covert channel tool are developed. [ABSTRACT FROM AUTHOR]

A noninterference formulation of MLS applicable to the Secure Ada® Target (SAT) Abstract Model is developed. An analogous formulation is developed to handle the SAT type enforcement policy. Unwinding theorems are presented for both MLS and Multidomain Security (MDS) and the SAT Abstract Model is shown to satisfy both MLS and MDS. Generalizations and extensions are also considered. [ABSTRACT FROM AUTHOR]

Because views on relational database systems mathematically define arbitrary sets of stored and derived data, they have been proposed as a way of handling context- and content-dependent classification, dynamic classification, inference, aggregation, and sanitization in multilevel database systems. This paper describes basic view concepts for a multilevel-secure relational database model that addresses the above issues. All data entering the database are labeled according to views called classification constraints, which specify access classes for related data. In addition, views called aggregation constraints restrict access to aggregates of information. All data accesses are confined to a third set of views called access views. [ABSTRACT FROM AUTHOR]

In multilevel systems, it is important to avoid unwanted indirect information flow from higher levels to lower levels, namely, the so-called covert channels. Initial studies of information flow analysis were performed by abstracting away from time and probability. It is already known that systems that are proven to be secure in a possibilistic framework may turn out to be insecure when time or probability is considered. Recently, work has been done in order to consider also aspects either of time or of probability, but not both. In this paper, we propose a general framework based on Probabilistic Timed Automata, where both probabilistic and timing covert channels can be studied. We define a Noninterference security property and a Nondeducibility on Composition security property, which allow expressing information flow in a timed and probabilistic setting. We then compare these properties with analogous ones defined in contexts where either time or probability or neither of them are taken into account. This permits a classification of the properties depending on their discerning power. As an application, we study a system with covert channels that we are able to discover by applying our techniques. [ABSTRACT FROM PUBLISHER]