A Single-Level Scheduler for the Replicated Architecture for Multilevel-Secure Databases John P. McDermott Naval Research Laboratory Sushil Jajodia Ravi S. Sandhu George Mason University The replicated architecture for multilevel secure data- [11,14,16] places less trust in the database system software base systems provides security by replicating data into and thus should cost less to build to the same level of as- separate untrusted single-level database systems. To be surance. It finesses the trust problem by storing multilevel successful, a system using the replicated architecture must objects in single-level fragments that are protected by the have a concurrency and replica control algorithm that underlying trusted operating system. However, the Hinke- does not introduce any covert channels. Jajodia and Schaefer approach needs to reconstruct logical multilevel Kogan have developed one such algorithm that uses up- objects from separate single-level objects and may give up date projections and a write-all replica control algorithm. some time performance in return. Here we describe an alternative algorithm. The new algo- In the frontend-backend architecture category, the in- rithm uses replicated transactions and a set of queues or- tegrity-lock architecture [8,5] uses a trusted frontend sys- ganized according to security class. A new definition of tem to apply cryptographic check values to data stored in a correctness is required for this approach, so we present single backend database system. It is generally not intend- one and use it to show that our algorithm is correct. The ed for use in high assurance systems. The SD-DBMS ar- existence of this new algorithm increases the viability of chitecture [20,9] uses a trusted frontend to control multiple the replicated architecture as an alternative to kernelized backends where the data is distributed but not replicated. approaches. Like the Hinke-Schaefer architecture, the SD-DBMS architecture places little trust in the database system soft- 1. Introduction ware thus reducing assurance costs. Like the Hinke- Schaefer architecture, the SD-DBMS architecture can The architecture of a high-assurance multilevel secure have time performance problems due to the need to mate- database system is critical to its effectiveness. Convention- rialize logical objects whose physical representation is al database system architectures do not include a trusted fragmented. computing base and incorporating one requires significant Our paper is concerned with another frontend-backend change to the conventional architecture. Multilevel secure architecture, which we call the replicated architecture. database system architectures can be characterized as ei- The Naval Research Laboratory, in its SINTRA project therkernelized architectures orfrontend-backend architec- (Secure INformation Through Replicated Architecture), is tures [18]. Kernelized architectures incorporate the trusted investigating the replicated architecture. Like the Hinke- computing base into some architectural layer of the ma- Schaefer architecture, little trust is placed in database sys- chine that hosts the database system. Frontend-backend ar- tem software but where the Hinke-Schaefer architecture chitectures incorporate the trusted computing base on a fragments apparently-multilevel objects into single-level frontend machine and host the database system on one or fragments the SINTRA architecture replicates apparently- more backend machines. There are many variations of ei- multilevel objects as single-level copies. Lower-level data ther approach [10]. is replicated in the higher level databases (See Figure 1). Kernelized architectures can place more or less trust in The replication overcomes the object-materialization per- the database system software. For example, the Advanced formance problem facing other architectures. Data that is Secure DBMS architecture [7] places more trust in the da- apparently (to the user) multilevel is physically stored to- tabase system software by allowing it to process multilevel gether as a single-level object in a single-level database objects directly (most of the DBMS is part of the trusted system and thus does not need to be materialized. computing base) and as a consequence of this potentially The critical difficulty with the replicated approach is achieves higher performance than other approaches but correct replication. Conventional approaches to replication costs more to assure. The Hinke-Schaefer approach Report Documentation Page Form Approved OMB No. 0704-0188 Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. 1. REPORT DATE 3. DATES COVERED 1991 2. REPORT TYPE 00-00-1991 to 00-00-1991 4. TITLE AND SUBTITLE 5a. CONTRACT NUMBER A Single-Level Scheduler for the Replicated Architecture for 5b. GRANT NUMBER Multilevel-Secure Databases 5c. PROGRAM ELEMENT NUMBER 6. AUTHOR(S) 5d. PROJECT NUMBER 5e. TASK NUMBER 5f. WORK UNIT NUMBER 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION Naval Research Laboratory,Center for High Assurance Computer REPORT NUMBER Systems,4555 Overlook Avenue, SW,Washington,DC,20375 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR/MONITOR’S ACRONYM(S) 11. SPONSOR/MONITOR’S REPORT NUMBER(S) 12. DISTRIBUTION/AVAILABILITY STATEMENT Approved for public release; distribution unlimited 13. SUPPLEMENTARY NOTES 14. ABSTRACT 15. SUBJECT TERMS 16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF 18. NUMBER 19a. NAME OF ABSTRACT OF PAGES RESPONSIBLE PERSON a. REPORT b. ABSTRACT c. THIS PAGE 10 unclassified unclassified unclassified Standard Form 298 (Rev. 8-98) Prescribed by ANSI Std Z39-18 and the related concurrency control issues are well under- Figure 1 illustrates the basic SINTRA architecture. No- stood. Unfortunately, the conventional solutions are either tice that the low data appears at all backends, blue data at unworkable in the context of multilevel security or at best the blue and high backends, etc. introduce covert channels. If data cannot be correctly replicated without introducing security flaws, then the replicated approach is not viable. high DBS In this paper we show a new way of maintaining correct frontend replication in a secure manner and relate it to the previous- ly published algorithm of Jajodia and Kogan [12]. Our DBS red T scheduler does not use any trusted components and uses C conventional algorithms for the local scheduling. The new B DBS blue algorithm increases the viability of the replicated architecture as an alternative to the kernelized approach. We continue in this section with a discussion of the DBS SINTRA architecture and the problem of replicating data low in a multilevel-secure database system. We also present the model and notation we use for the rest of the paper. high Next, in section 2, we explain why conventional approach- security class partial order es to replica and concurrency control are not suitable for blue red multilevel-secure database systems. In sections 3 and 4 we present two algorithms: write-all using update projections and a central queue and write-all using replicated low transactions and multiple queues. Then we show the cor- Figure 1. The Replicated Architecture rectness of the new algorithm, using a new definition of correctness mandated by our replicated-transaction ap- For this paper, our mathematical model of the SINTRA proach. In section 6, we compare the algorithms qualita- architecture consists of a finite set of passive entities D, tively and in section 7 we conclude our paper. called data items, a finite set of active entities T, called transactions, and a finite partial order (SC, £ ) of security 1.1 The SINTRA Architecture classes. The frontend-backend architecture with full replication We denote elements ofD by lower case lettersx,y, and has been around as a concept for some time [18]. In its z, and subscript them asx ,x ,x , etc. when emphasizing A B C SINTRA project, the Naval Research Laboratory is cur- the fact that the data items in question are replicas of each rently prototyping several frontend-backend architectures other. We denote the elements of T by T or by T, T, and i j with full replication. What will be called in this paper the elements ofSC by uppercase lettersA,B,C, etc. We use a SINTRA architecture was first proposed for serious con- mapping L:D¨ Tfi SC to give the security class of every sideration by Froscher and Meadows [6]. data element and every transaction and a similar mapping The SINTRA architecture uses full replication to pro- S:D¨ Tfi SC to give the apparent orsource security class vide multilevel security. There is an untrusted backend da- of every data element and every transaction. The mapping tabase system for each security class. Data from S models the fact that replicas of data may appear to the dominated security classes is replicated in each backend user to have a lower classification than the backend that system. Logically, the user is allowed to read down and holds the replica. For example, in the database system of write at the same class but physically the frontend reads all Figure 1, if a transactionT withL(T)=low writes a logical data at the same class and writes at the same class and up data item x, there will be, among others, replicasx and red into dominating classes to maintain the replicas. It is im- x withL(x )=red andL(x )=high but with high red high portant to remember that while the replicated architecture S(x ) = S(x ) = low. red high uses distributed database system technology, the replicated The model contains the following (partial) security pol- architecture is for centralized database systems and not for icy: distributed systems. It could be implemented on a single 1. TransactionT is not allowed to read data element machine such as LOCK [22]. x˛ D unless L(T)=L(x). 2. TransactionT is not allowed to write into data ele- mentx˛ D unlessL(T)£ L(x). 3. L(T)andS(T)do not change, andL(x) andS(x) do not change. We model the replication by partitioning the data items Transactions T andT originate at security classB and 1 2 D into a set of equivalence classes [A] where are also run at security classA to maintain consistency be- [A]={x˛ D|L(x)=A}. We will frequently denote equiva- tween the replicas of x. Transaction T runs at security 3 lence class [A] asD .The SINTRA architecture requires, class A only. Transaction T is used by an automatic-up- A 1 for any security classesAandB˛ SC such thatB£ A, that date program to updatex from raw reports. TransactionT 2 there be a corresponding replica data itemx ˛ D if there at security class B is used by a program EstimateX to A A is a data itemx ˛ D . compute a best estimate of current position, course, and B B speed. Another program, EstimateY, uses transaction T 1.2 The Problem of Maintaining Consistency Be- 3 and sometimes changes the estimate of track hostility. tween Replicas A locally correct scheduler for a backend could inter- The concurrency control algorithm of a single-copy da- leave the operations ofT1,T2, andT3 as long as the result tabase system is considered to be correct if its execution of was equivalent to some serial schedule. Instead of giving a concurrent transactions is equivalent (we define equiva- locally correct interleaving of individual operations we lence more precisely in the following section) to some se- will simply list the transactions below at each back-end rial execution of those transactions on the same data items. database they act on and assume that each transaction is This correctness criterion is called serializability [2, 21]. executed serially. Clearly, this execution represents local For replicated databases, the correctness criterion is gener- serializability at each security class. alized to require that an algorithm appear to execute con- At backendDB:T2; T1 current transactions on replicas of data in a way that is At backendDA:T1;T2;T3 equivalent to serial execution of those transactions on a This particular execution by the database concurrency single copy of the data. This is called one-copy serializ- control mechanism would cause the program EstimateY ability [2]. If the values stored in the replicas are produced running at A to base its computation of y on EstimateX’s by a one-copy serializable execution of the transactions value for x (that is, T2’s value). The program EstimateX then the replicas areconsistent. Readers interested in seri- running T2 at security class B would read the value of x alizability for kernelized architectures should see [16, 13]. that held before T1 ran at security class B. Unfortunately, A replicated database that has local serializability (i.e. even thoughEstimateY, through its action in T3, would use in each back-end database system) cannot achieve one- T2’s value forx, the valueT2 would compute forx could be copy serializability by simply copying everything, as the different because at security class A transaction T2 read following example will show. T1’s value forx when it should have read the value ofx be- Example 1. Consider a hypothetical database system foreT1 changed it. with the SINTRA architecture that has just two security The two expert systems could advise a user based on classesA andB, withB

DTIC ADA462621: A Single-Level Scheduler for the Replicated Architecture for Multilevel-Secure Databases

Similar DTIC ADA462621: A Single-Level Scheduler for the Replicated Architecture for Multilevel-Secure Databases