The current commercial multilevel secure (MLS) database management system (DBMS) products provide extensions to SQL to support multilevel database applications. However, the DBMS vendors have implemented a variety of mechanisms that are both difficult to understand and ineffective in addressing a number of application concerns. The paper documents and compares the SQL extensions for Informix Online/Secure, Trusted Oracle, Trusted Rubix, and Sybase Secure SQL server. Based on the vendors' current implementations, we have developed recommendations for an MLS SQL standard that would support interoperability both among the MLS DBMS products and with standard SQL client applications. We have also analyzed the vendors' approaches to polyinstantiation and signaling channels; our recommendations include improved support for cover stories and better control of inherent signaling channels.

A referential secrecy model is presented that simplifies automatic data classification within a relational database. The model captures the secrecy semantics that reflect the dependencies among foreign key references. These dependencies form the basis for specifying classification constraints, without the complexity of rule-based or view-based mechanisms. The secrecy semantics are expressed within the database schema as parameters to the foreign key definitions. Data classification is a function of the access levels of the foreign key reference tuples, as well as the access class of the subject.>