Transaction Processing Environment Kernelized Architecture in Multilevel Secure Application Policies

Abstract

Abstract-Multilevel security poses many challenging problems for transaction processing. The challenges are due to the conflicting requirements imposed by confidentiality, integrity, and availability} the three components of security. We identify these requirements on transaction processing in Multilevel Secure (MLS) database management systems (DBMSs) and survey the efforts of a number of researchers to meet these requirements .While our emphasis on centralized system based on kernelized Architecture, we briefly overview the research in the distributed MLS DBMSs as well.Keywords-Database systems, transaction processing, security, concurrency control, mandatory access control, covert channel, kernelized architecture, replicated architecture. I. INTRODUCTIONMULTILEVEL SECURE (MLS) databases are characterized by systems that contain sensitive data classified at different levels of sensitivity. An MLS database management system (DBMS) enforces controlled access to data by assigning a security clearance to every user. Unlike conventional databases, users of MLS databases cannot, at their discretion, give away the access privileges on their data to other users, even though they are the owners of the data. An MLS DBMS decides the access privileges of the users based on the classification label associated with the data and the clearance level of the user. These are the so called mandatory access controls [12]. Classifications and clearances are collectively known as security classes or levels. A security class is made up of two components: a hierarchical component and a (possibly empty) non-hierarchical component, called a category. As an example, the different security levels distinguished in the structure of U.S. military security are unclassified, confidential, secret, and top secret, ordered in the increasing order of their importance to the national security. Categories are independent of each other, and are not ordered. NATO, Nuclear, and Crypto are examples of some of the categories used by U.S. military; they form the basis for enforcing need-to-know. The general structure of security classes' forms a lattice using the following dominance relation: A security class is said to dominate another security class if the hierarchical component of the first is greater than or equal to that of the second and the category set of the first contains all the categories of the second. (See [1], [12], [28] for additional details on multilevel security.) To enforce mandatory access control, all MLS systems use a trusted computing base (TCB), a small part of the operating system, which is responsible for all security relevant actions of the system. The TCB always has to be invoked, cannot be bypassed, and must be shown to perform only its intended functions (the code that implements the TCB must be verified for the presence of any malicious code). Concurrency control is crucial to transaction processing since databases are generally meant to cater to multiple users. Therefore, every DBMS must be equipped with a proper concurren...