An advanced commit protocol for MLS distributed database systems
The classical Early Prepare commit protocol (EP), used in many commercial systems, is not suitable for use in multilevel secure distributed database systems that employ a locking protocol for concurrency control. This is because EP requires that read locks be not released by a subtransaction during its window of uncertainty; however, it is not possible for a locking protocol to provide this guarantee in a multilevel secure system (since read lock of a higher level transaction on a lower level data object must be released whenever a lower level transaction wants to write it). The Secure Early Prepare protocol (SEP) overcomes this difficulty by aborting those distributed transactions that release their low level read locks prematurely. We see this approach as being too restrictive. One of the major benefits of distributed processing is its robustness to failures, and SEP fails to take advantage of this. In this work, we propose the Advanced Secure Early Prepare commit protocol (ASEP) together with a number of language primitives that can be used as system calls in distributed transactions. These language primitives permit features like partial rollback and forward recovery, and allow a distributed transaction to proceed even when a subtransaction has released its low level read locks prematurely. This not only offers flexibility, but also can be used, if desired, by a sophisticated programmer to tradeoff consistency for atomicity of the distributed transaction. •Partially supported by National Science Foundation under grants

title: An Approach to Authorization Modeling in Object-Oriented Database Systems
abstract: Authorization is an important functionality that every data management system should provide. An authorization mechanism allows different access rights on data items to be selectively assigned to users. Authorization models and mechanisms have been widely investigated in the framework of traditional database systems. The extension of those models and mechanisms to advanced data management systems is quite complex, because those systems are characterized by data models with a larger number of semantic constructs than traditional models, like the relational one. A first authorization model defined for object-oriented (and semantic) database systems has been presented in . In this paper we present an authorization model that substantially extends and revises that model. The most significant extension concerns the support for content-dependent authorization, which was not provided in . Content-dependent authorization is very important in providing an authorization mechanism able to directly support authorization policies of application environments. Moreover, it is a crucial functionality in environments where data objects frequently change their status. In addition, the model presented here differs from the model defined in [20] in that new authorization types are introduced and a finer control of versions is provided. Finally, authorization administration of objects is considered.

title: A temporal authorization model
abstract: This paper presents a discretionary access control model in which authorizations contain temporal information. This information can be used to specify temporal intervals of validity for authorizations and temporal dependencies among authorizations. A formal definition of those concepts is presented in the paper, in terms of their interpretation in first order logic. We characterize sets of temporal dependencies that can lead to undesirable states of the authorization system and we sketch an algorithm for their detection. Finally, operations to add, remove, or modify authorizations and temporal dependencies are described.

title: An index allocation tool for object-oriented database systems
abstract: The problem of index configuration is an important topic for database system performance and has been extensively investigated for relational Database Management Systems (DBMS). By contrast, the problem of index allocation for Object-Oriented DBMS (OODBMS) has been considered only from a theoretical point of view and no practical development of any tool for commercial OODBMS has been reported. In this paper, we investigate the problem of index configuration in the framework of a commercially available OODBMS. We first identify the features that characterize such OODBMS and we develop two cost models: the first extends the generic cost model presented by Gardarin et al. (), the second is an analytical cost model tailored to the OODBMS at hand. Both cost models have been validated by comparing the estimated costs and the actual costs observed from the system. The comparison has shown that both models are quite accurate. Using the proposed cost models, we have also developed an algorithm for the efficient index allocation on a given path, given a workload specified in terms of operation frequencies. Even though our algorithm has been developed for a specific OODBMS, we believe that it can be easily tailored to other OODBMS and persistent programming languages.

title: Extending the ODMG object model with composite objects
abstract: In this paper we extend the ODMG object data model with composite objects. A composite object is an object built by aggregating other component objects. Exclusiveness and dependency constraints, as well as referential integrity, can be associated with composition relationships among objects. Our composite object model is developed in the framework of the ODMG object database standard data model, but can be used in both object-oriented and object-relational database systems. In the paper, we propose a language for defining composite objects and we define the semantics of update operations on composite objects.

title: Extending the ODMG Object Model with Time
abstract: Although many temporal extensions of the relational data model have been proposed, there is no comparable amount of work in the context of object-oriented data models. Moreover, extensions to the relational model have been proposed in the framework of SQL standards, whereas no attempts have been made to extend the standard for objectoriented databases, defined by ODMG. This paper presents T_ODMG, a temporal extension of the ODMG-93 standard data model. The main contributions of this work are, thus, the formalization of the ODMG standard data model and its extension with time. Another contribution of this work is the investigation, on a formal basis, of the main issues arising from the introduction of time in an object-oriented model.

title: Systematic control and management of data integrity
abstract: Integrity has long been considered a fundamental requirement for secure computerized systems, and especially today's demand for data integrity is stronger than ever as many organizations are in-creasing their reliance on data and information systems. A number of recently enacted data privacy regulations also require high in-tegrity for personal data. In this paper, we discuss various issues concerning systematic control and management of data integrity with a primary focus on access control. We first examine some previously proposed integrity models and define a set of integrity requirements. We then present an architecture for comprehensive integrity control systems, which has its basis on data validation and metadata management. We also provide an integrity control policy language that we believe is flexible and intuitive.

title: Controlled and cooperative updates of XML documents in byzantine and failure-prone distributed systems
abstract: This paper proposes an infrastructure and related algorithms for the controlled and cooperative updates of XML documents. Key components of the proposed system are a set of XML-based languages for specifying access-control policies and the path that the document must follow during its update. Such path can be fully specified before the update process begins or can be dynamically modified by properly authorized subjects while being transmitted. Our approach is fully distributed in that each party involved in the process can verify the correctness of the operations performed until that point on the document without relying on a central authority. More importantly, the recovery procedure also does not need the participation of a central authority. Our approach is based on the use of some special control information that is transmitted together with the document and a suite of protocols. We formally specify the structure of such control information and the protocols. We also analyze security and complexity of the proposed protocols.

title: Privacy preserving schema and data matching
abstract: In many business scenarios, record matching is performed across different data sources with the aim of identifying common information shared among these sources. However such need is often in contrast with privacy requirements concerning the data stored by the sources. In this paper, we propose a protocol for record matching that preserves privacy both at the data level and at the schema level. Specifically, if two sources need to identify their common data, by running the protocol they can compute the matching of their datasets without sharing their data in clear and only sharing the result of the matching. The protocol uses a third party, and maps records into a vector space in order to preserve their privacy. Experimental results show the efficiency of the matching protocol in terms of precision and recall as well as the good computational performance.