Intrusion detection technologies have well-known shortcomings, such as a very high false alarm rate and the ability to detect only a limited class of attacks on a limited set of system components. Specialized attack types on unique system components cannot be detected, and neither can application-specific attacks. Even generic attacks on operating systems and networks cannot be reliably detected. Moreover, today's technology does only poorly at detecting new attack types, whereas much effort goes into developing signatures indicative of known attacks.

A multilevel relational database represents information in a multilevel state of the world, which is the knowledge of the truth value of a statement with respect to a level in a security lattice. The authors develop a semantic framework of the multilevel secure relational model with tuple-level labelling, which formalizes the notion of validity in multilevel relational databases. They also identify the multilevel security properties that precisely characterize the validity of multilevel relational databases, which can be maintained efficiently. Finally, they give an update semantics of the multilevel secure relational model that preserves both integrity and secrecy.

The US telecommunications infrastructure is a very complex system of interconnected heterogeneous networks that include both wireline and wireless systems. Because of the vital services provided by this infrastructure, there is a need to protect it against a wide range of mishaps. Such mishaps include terrorist attacks, malicious code, natural disasters, unauthorized access to information and other incidents which can seriously disrupt the networks or reduce the confidence level of the information traversing or residing in the infrastructure. This Panel will explore several security related issues that are directly related to the telecommunications infrastructure and the challenges and opportunities they offer.

We develop a formal framework of MAC policies in multilevel relational databases. We identify the important components of MAC policies and their desirable properties. The framework provides a basis for systematically specifying MAC policies and characterizing their potential mismatches. Based on the framework, we compare and unify the MAC policies and policy components that are proposed in the literature or imposed in existing systems. Our framework could be used to capture and resolve MAC policy mismatches in the trusted interoperation of heterogeneous multilevel relational databases.

The US Department of Defense (DoD) has begun to plan for the implementation of a DoD Directory capability based on the CCITT X.500 series recommendations, which define the data communication network directory. The DoD Directory statement of requirements has established the need to hold data of different classifications (UNCLASSIFIED to SECRET) and to serve users with different clearances. We describe a prototype secure read only directory system agent emulator (SRODE) far the DoD directory. The demonstration of a multilevel SRODE, which is implemented as an application on SeaView, has shown the feasibility of building an MLS DoD Directory with existing technology.>

This paper presents a brief overview of a notional airborne application scenario that requires both multilevel security and real-time processing. It was used to guide decisions related to formation of the security policy interpretation, the operating system interface, and the system services design for a multilevel secure real-time distributed operating system (MLS RT DOS) called Secure Alpha. We compare secure and nonsecure application designs for the scenario to assess the effects of MLS RT DOS security features on the structure of the application. The comparison reveals that the security features make real-time scheduling and the construction of robust applications more difficult for this scenario.>

Multilevel relational database systems store information at different security classifications. An inference problem exists if it is possible for a user with a low-level clearance to draw conclusions about information at higher classifications. The authors are developing DISSECT, a tool for analyzing multilevel relational database schemas to assist in the detection and elimination of inference problems. A translation is defined from schemas to an equivalent graph representation, which can be presented graphically in DISSECT. The initial focus is on detection of inference problems that depend only on information all of which is stored in the database. In particular, potential inference problems are identified as different sequences of foreign key relationships that connect the same entities. Inferences can be blocked by upgrading the security classification of some of foreign key relationships. A global optimization approach to upgrading is suggested to block a set of inference problems that allows upgrade costs to be considered, and supports security categories as well as levels.>

A design approach for a secure multilevel object-oriented database system is proposed by which a multilevel object-oriented system can be implemented on a conventional mandatory security kernel. Each object is assigned a single security level that applies to all its contents (variables and methods). The informal security policy model includes properties such as compatibility of security level assignments with the class hierarchy. After discussing the essential features of a general object system model, and then extending the object model to incorporate mandatory label-based security, it is shown how typical database security and integrity policies can be supported by this model, with special attention to inference problems and integrity constraints. The representation of integrity constraints and classification constraints are illustrated.>

A serious problem in computer database and knowledge base security is detecting and eliminating so-called inference channels. The existence of such channels enables a user with access to information classified at a low level to infer information classified at a high level, and through the transformation of low level data to high level data may provide an unacceptable information flow. In order to estimate the presence of inference channels, determine the degree of risk which they present, and find ways to eliminate them, one needs a formal model to describe them. The authors introduce abductive reasoning. Abduction provides both the basis for a formal model for the inference problem and a computational mechanism for detecting inference channels. Abduction additionally provides a framework for reasoning with approximate and uncertain information, which enables them to extend the model for inference channels by taking into account the likelihood that a person might believe some statement of interest.>

Polyinstantiation is a phenomenon of multilevel data. As such, it exists as a property of information and is not merely the result of any specific technology. Polyinstantiation is an inevitable property of a multilevel world. Recognizing this, the author investigates how best to reflect it in technologies. She discusses polyinstantiation as a property of the world of multilevel information.>

Work aimed at defining a multilevel, mandatory security policy for knowledge based systems. The authors address two distinct issues: an effective implementation formalism based on a multilevel, object oriented programming paradigm and requirements for ensuring the correctness of inferences computed on the basis of possibly contradictory information from different access classes. They define requirements for an object-oriented system capable of handling multilevel objects within a single access class. They then outline a method by which multilevel objects may be used to implement a simple knowledge based system built on production rules. The authors argue that the issues regarding correctness are similar to those of truth maintenance in standard knowledge based systems and may be addressed by similar methods.>

Describes a real-time intrusion-detection expert system (IDES), that observes user behavior on a monitored computer system and adaptively learns what is normal for individual users, groups, remote hosts, and the overall system behavior. Observed behavior is flagged as a potential intrusion if it deviates significantly from the expected behavior or if it triggers a rule in the expert-system rule base.>

A new polyinstantiation integrity constraint for multilevel relations based on the intuitive idea that every entity in a relation can have at most one tuple for every access class is proposed. The consequences of this property and some of its variations are discussed. A core set of properties which should apply to all relations is identified. These are entity integrity, interinstance integrity, subsumption integrity, and polyinstantiation integrity in the sense of PI-FD. Specific models impose additional polyinstantiation constraints. Oakland requires PI-null, Sea View requires PI-MVD, and the new Franconia model requires PI-Tuple-class. Each of these properties appears likely to arise often enough in practice to justify DBMS (database management system) support for its enforcement on a relation-by-relation basis.>

A multilevel database is intended to provide the security needed for database systems that contain data at a variety of classifications and serve a set of users having different clearances. A formal security model for such a system is described. The model is formulated in two layers, one corresponding to a reference monitor that enforces mandatory security, and the second an extension of the standard relational model defining multilevel relations and formalizing policies for labeling new and derived data, data consistency, and discretionary security. The model also defines application-independent properties for entity integrity, referential integrity, and polyinstantiation integrity.>

The requirements for multilevel security have been shown to conflict with some database integrity and consistency properties. The authors examine the data consistency requirements for a distributed database system, consider the effects of multilevel security on meeting those requirements, and consider architecture for achieving them. They discuss the problem of providing serializability in a single-site database system and propose a solution based on optimistic concurrency control. They then extend this solution to a distributed database system. They also describe an approach for weak consistency concurrency control in a distributed database system based on the Optimistic Protocol.>

The second RADC (Rome Air Development Center) Invitational Database Security Workshop (held May 15-18 in Bethlehem, New Hampshire) focused on multilevel security issues for Class B3 or A1 database systems. The workshop participants discussed operating system support for secure database systems; database system process privilege; mandatory, discretionary, and need-to-know requirements; modeling issues; auditing; and vendor developments. Perhaps the most valuable part of the workshop was the discussion of the homework problem, a 22-page specification for a multilevel secure (MLS) database. The participants discovered that it is important to know what makes a particular datum classified in order to known how to protect that datum in a secure database system. They also discovered that, for most of the systems under development, the discretionary access controls did not have nearly the flexibility that the application required. It was concluded that discretionary access controls on views are needed, pointing to the need for balanced assurance.>

The advantages of TCB (trusted computing base) subsetting for building multilevel database systems are discussed, and the architectural impact on the database system when the TCB subsetting approach is used in a real implementation is described. Particular attention is given to such areas of difficulty as concurrency controls, recovery management, and buffer management. In discussing implications for the architecture of the database system, it is noted that the standard ORACLE database system already supports those architectural features that are required, and ORACLE is proceeding with product development and product evaluation projects to extend the promise of TCB subsetting to commercially available ORACLE RDBMS (relational database management system) products on a wide variety of platforms. The SeaView prototype takes advantage of the architectural features of ORACLE with a TCB subsetting approach to achieve a class A1 system that reuses existing TCB and database technology.>

The SeaView project was a three-year program to create the design of a multilevel secure relational database system that meets the criteria for Class A1. The verification of the SeaView formal top-level specifications and the benefits that were gained from the exercise are discussed. The SeaView specifications describe the database system in the formal specification language of the SRI specification and verification system, Enhanced HDM. The process of specification and verification substantially improved the quality and completeness of the SeaView design.>

The author examines inference and aggregation problems that can arise in multilevel relational database systems and points out some fallacies in current thinking about these problems that may hinder real progress from being made toward their solution. She distinguishes several different types of aggregation and inference problems and shows that the different types of problems are best addressed by different approaches. In particular, it is shown that sensitive associations among entities of different types are best treated by representing the sensitive association separately and classifying the individual entities low and the relationship high. Sensitive associations among the various properties of an entity are best treated by determining those properties that contribute most to the inference and by storing those separately at a higher classification. Sensitive associations among entities of the same type are best treated by storing the individual data items comprising the aggregate at the aggregate-high classification; they must be sanitized for release to lower-level users. The suggested approaches allow the mandatory reference monitor to protect the sensitive associations, with no additional trusted mechanism needed.>

A formal security policy model that uses basic view concepts for a secure multilevel relational database system is described. The model is formulated in two layers, one corresponding to a security kernel of reference monitor that enforces mandatory security, and the other defining multilevel relations and formalizing policies for labeling new and derived data, data consistency, discretionary security, and transaction consistency. This includes the policies for sanitization, aggregation, and downgrading. The model also defines application-independent properties for entity integrity, referential integrity, and polyinstantiation integrity.>

The design and implementation of a prototype intrusion-detection expert system (IDES) are described. IDES is based on the concept that an intrusion manifests itself as a departure from expected behavior for a user. The prototype monitors users on a remote system, using audit records that characterize their activities. It adaptively learns the normal behavior of each user and detects and reports anomalous user behavior in real time.>

The SeaView formal security policy model admits a range of designs for a multilevel secure relational database system. The requirement for a near-term implementation suggests that the design should utilize existing technology to the extent possible. Thus the design uses an existing database management system ported to an existing TCB (trusted computing base) environment. A preprocessor translates key constructs of the SeaView multilevel relational data model to those of the standard relational model used by the commercial database system. The underlying reference monitor enforces mandatory and basic discretionary controls with A1 assurance. By combining single-level data into a multilevel view, it is possible to use a commercial database system and classify data at the relation level to implement the SeaView model, with element-level classification.>

The paper presents results of an initial investigation of multilevel security for knowledge-based systems. Knowledge-based systems are computer programs that give advice using techniques developed in artificial intelligence research. Although many apparently multilevel knowledge-based systems are now being developed, security requirements have not yet been articulated for them. We adopt the production system model as a generalization of knowledge-based systems. We apply noninterference concepts of multilevel security to the production model, and from this we suggest an approach for achieving multilevel secure production systems. Our approach puts control structures at system low, assigns a single classification to entries in the knowledge base, and provide different views both of the database and of the rule base depending upon the clearance of the user. We conclude that it will be possible to achieve multilevel security for many knowledge-based systems. We present a research agenda for further study,

A multilevel relational data model that meets the basic operational requirements for a multilevel database system is described. The model is an extension of the standard relational model, and consists of multilevel relations, which contain classification attributes as well as data attributes; multilevel relational integrity rules, which extend the integrity constraints of the relational model in order to pro vide consistency for data at different access classes, including data that becomes "polyinstantiated," a decomposition method for mapping all multilevel real relations into standard (single-level) base relations; and multilevel relational operators, which perform the functions of their counterparts in the standard relational model, while also labeling derived tuples with access classes. The model is defined in terms of the standard relational model, but lends itself to a design and implementation that offers a high level of assurance for mandatory security.

Because views on relational database systems mathematically define arbitrary sets of stored and derived data, they have been proposed as a way of handling context-and content-dependent classification, dynamic classification, inference, aggregation, and sanitization in multilevel database systems. This paper describes basic view concepts for a multilevel-secure relational database model that addresses the above issues. All data entering the database are labeled according to views called classification constraints, which specify access classes for related data. In addition, views called aggregation constraints restrict access to aggregates of information. All data accesses are confined to a third set of views called access views.

The Trusted Domain Machine (TDM) is a secure communication device for security guard applications. Its design isolates the security-critical functions into a physically isolated processing domain. This trusted physical domain includes a layer of core software that allows applications that are implemented on the TDM to control interdomain communication. The security-relevant application software is further separated into execution domains within the trusted domain to simplify its verification.