Enforcing Mandatory Access Control in Object Bases

Enforcement of mandatory policies in object-oriented systems generally requires objects to be single level; i.e., all attributes of an object must have the same security level. However, entities in real world are often multilevel and, therefore, support must be provided for representing these entities. In this paper, we show how multilevel entities can be represented using single level objects. The approach, which extends an earlier proposal by Bertino and Jajodia [4], is based on the notions of composite objects and delegations. We also discuss how our approach can be implemented by extending the message filter proposed by Jajodia and Kogan in [15].