Integrating Security and Real-Time Requirements Using Covert Channel Capacity.
AbstractDatabase systems for real-time applications must satisfy timing constraints associated with transactions in addition to maintaining data consistency. In addition to real-time requirements, security is usually required in many applications. Multilevel security requirements introduce a new dimension to transaction processing in real-time database systems. In this paper, we argue that, due to the conflicting goals of each requirement, trade-offs need to be made between security and timeliness. We first define mutual information, a measure of the degree to which security is being satisfied by a system. A secure two-phase locking protocol is then described and a scheme is proposed to allow partial violations of security for improved timeliness. Analytical expressions for the mutual information of the resultant covert channel are derived and a feedback control scheme is proposed that does not allow the mutual information to exceed a specified upper bound. Results showing the efficacy of the scheme obtained through simulation experiments are also discussed.
Introduction
Database security is concerned with the ability of a database management system to enforce a
security policy governing the disclosure, modification or destruction of information. Most secure
database systems use an access control mechanism based on the Bell-LaPadula model [3]. This
model is stated in terms of subjects and objects. An object is understood to be a data file, record
or a field within a record. A subject is an active process that requests access to objects. Every
object is assigned a classification and every subject a clearance. Classifications and clearances
are collectively referred to as security classes (or levels) and they are partially ordered. The Bell-LaPadula
model imposes the following restrictions on all data accesses:
a) Simple Security Property: A subject is allowed read access to an object only if the former's
clearance is identical to or higher (in the partial order) than the latter's classification.
b) The *-Property: A subject is allowed write access to an object only if the former's clearance
is identical to or lower than the latter's classification.
The above two restrictions are intended to ensure that there is no flow of information from
objects at a higher access class to subjects at a lower access class. Since the above restrictions are
mandatory and enforced automatically, the system checks security classes of all reads and writes.
Database systems that support the Bell-LaPadula properties are called multilevel secure database
systems (MLS/DBMS).
The Bell-LaPadula model prevents direct flow of information from a higher access class to a lower
access class, but the conditions are not sufficient to ensure that security is not violated indirectly
through what are known as covert channels [14]. A covert channel allows indirect transfer of
information from a subject at a higher access class to a subject at a lower access class. In the
context of concurrency control approaches, a covert channel arises when a resource or object in the
database is shared between subjects with different access classes. The two subjects can cooperate
with each other to transfer information. An important measure of the degree to which security is
compromised by a covert channel is measured by the amount of information that may be transferred
from a high-subject to a low-subject. This will be explained in greater detail in Section 3.
A real-time database management system (RTDBMS) is a transaction processing system where
transactions have explicit timing constraints. Typically a timing constraint is expressed in the
form of a deadline, a certain time in the future by which a transaction needs to be completed. In
a real-time system, transactions must be scheduled and processed in such a way that they can be
completed before their corresponding deadline expires. Conventional data models and databases are
not adequate for time-critical applications. They are designed to provide good average performance,
while possibly yielding unacceptable worst-case response times. As advances in multilevel security
take place, MLS/DBMSs are also required to support real-time requirements. As more and more of
such systems are in use, one cannot avoid the need for integrating real-time transaction processing
techniques into MLS/DBMSs.
Concurrency control is used in databases to manage the concurrent execution of operations by
different subjects on the same data object such that consistency is maintained. In multilevel secure
databases, there is the additional problem of maintaining consistency without introducing covert
channels. In this paper, we concern ourselves with concurrency control mechanisms that have to
satisfy both security and real-time requirements. We advance our claim that conflicts between
these two requirements are inherent and hence trade-offs between them are necessary. A summary
of related work in this area is included in Section 2. Some background information on correctness
criteria for secure schedulers is covered in Section 3. In Section 4, the problems associated with
time-constrained secure concurrency control are studied. In Section 5, the secure two phase locking
protocol and 2PL-High Priority are discussed. A scheme that allows partial violations of security
requirements is proposed in Section 6, and the mutual information of the resultant covert channel
is derived. A feedback control mechanism that maintains the amount of mutual information of the
system at a specified upper bound is described in Section 7. In Section 8, it is shown that the
analysis and control of the single covert channel considered in Section 6 is enough to bound the
mutual information of all covert channels that could be potentially exploited. An implementation
and performance analysis of the feedback control mechanism is explained in Section 9. Section 10
concludes the paper.
Related Work
There have been several interesting approaches to analyzing and reducing the covert channel band-width
[30, 11, 19, 9]. While some of these approaches could be used to specify policies to make
it difficult to exploit the covert channels that may arise from the trade-off, others may not be
applicable in real-time application. For example, a collection of techniques known as fuzzy time
[30, 11] is inappropriate in a real-time setting, since the overall mission may be jeopardized by not
getting the exact timing information. In fact, this problem between real-time and covert channel
was identified in Secure Alpha work [10]. They have pointed out that slowing clocks or isolating
processes from precise timing information is impractical for real-time systems. An adaptive solution
to make appropriate trade-offs between the requirements of real-time and security is essential,
and it requires resolution rules to specify the appropriate behavior. To be effective, it is desirable
that the rules be based on application-specific knowledge [5]. Our resolution specification approach
is similar to their idea of "Important Enough to Interfere" and signaling cost which consider the
timeliness and levels between which a covert channel could be established.
The idea of using probabilistic partitioning in bus-contention covert channel is proposed in [9].
Instead of keeping track of the percentage of violations for making decisions when conflicts occur,
the system could enforce a certain pre-determined percentage by picking up a random number that
generates 0 or 1, based on the required percentage. It needs further study to find out whether
this way of enforcing the requirements provides a reasonable level of flexibility in specifying the
requirements and reduced system overhead.
To improve the practicality and usability of the covert channel analysis in real systems, it might
be necessary to provide methods to specify a higher-level goals regarding the potential trade-offs
between real-time requirements and covert channel leaks. The user-centered security approach [31]
which considers user needs as a primary design goal of secure system development could be useful
to figure out a higher-level description of user needs and expectations on specific situations. It
could begin with some scenario-based requirement specification for the system to clearly identify
the situation and necessary actions to take. The system may need to install monitors to check the
system states and perform necessary adjustments by feedback control mechanisms to maintain the
high-level goals specified by the user. Ideas similar to the dynamic adaptive security model proposed
in [29] could be used to provide allowable trade-offs between security and real-time performance.
George and Haritsa studied the problem of supporting real-time and security requirements [7].
They examined real-time concurrency control protocols to identify the ones that can support the
security requirement of non-interference. This work is fundamentally different from our work because
they make the assumption that security must always be maintained. In their work, it is not
permissible to allow a security violation in order to improve on real-time performance.
There have been several approaches to exploit the possible trade-offs between real-time and
security requirements. In [20], a novel concurrency control protocol has been proposed to meet
the real-time, security, and serializability requirements of applications. This protocol employs a
primary and secondary copies for each object. While the transactions at higher levels refer to
the secondary copy, the transactions at the same classification level as the object refer to the
primary copy. Due to this scheme, a higher level transaction is never delayed due to a lower-level
transaction. Similarly, a high-level transaction never interferes with a low-level transaction. In
[27], an adaptive protocol was proposed with performance results which illustrate the clear benefit
of using adaptive approach in secure real-time databases. In their approach, conflicts are resolved
based on two factors: the security factor which indicates the degree of security violations, and the
deadline miss factor which indicates the timeliness of the system. Depending on the values of those
factors, the system takes either secure option (no security violation) or insecure option (no priority
In [21], a multiversion locking protocol was proposed to provide security and timeliness
together, using multiple versions of data objects. The protocol provides 1-copy serializability and
eliminates all the covert channels. The protocol ensures that high priority transactions are neither
delayed nor aborted by low priority transactions. In [28], a set of flexible security policies were
proposed and evaluated, based on the notion of partial security, instead of absolute security. They
proposed a specification method that enables the system designer to specify important properties
of the database at an appropriate level. A tool can analyze the database specification to find
potential conflicts, and to allow the designer to specify the rules to follow during execution when
those conflicts arise. Ahmed and Vrbsky also studied the trade-offs between security and real-time
requirements, and proposed a secure optimistic concurrency control protocol [2].
3 Correctness Criteria for Secure Schedulers
Covert channel analysis and removal is one of the most important issues in multilevel secure concurrency
control. The notion non-interference has been proposed [8] as a simple and intuitively
satisfying definition of what it means for a system to be secure. The property of non-interference
states that the output as seen by a subject must be unaffected by the inputs of another subject
at a higher access class. This means that a subject at a lower access class should not be able to
distinguish between the outputs from the system in response to an input sequence including actions
from a higher level subject and an input sequence in which all inputs at a higher access class have
been removed [13].
An extensive analysis of the possible covert channels in a secure concurrency control mechanism
and the necessary and sufficient conditions for a secure, interference-free scheduler are given in [13].
Three of these properties are of relevance to the secure two phase locking protocol discussed in this
paper. Each property represents one way to prevent a covert channel in a secure system. Clearly,
all three properties need to be enforced to completely eliminate the possibility of covert channels
with secure two-phase concurrency control protocols.
For the following definitions, given a schedule s and an access level l, purge(s; l) is the schedule
with all actions at a level ? l removed from s.
scheduler satisfies this property if values read by a subject are not
affected by actions with higher subject classification levels. Stated formally, for an input
schedule p, the output schedule s is said to be value secure if purge(s; l) is view equivalent 1
to the output schedule produced for purge(p; l).
Delay Security: This property ensures that the delay experienced by an action is not
affected by the actions of a subject at a higher classification level. Here, the delay is measured
as the time between the arrival of the request for the execution of an action at the system
to the time the action is completed. For an input schedule p and an output schedule s, a
scheduler is delay secure if for all levels l in p, each of the actions a 1 in purge(p; l) is delayed
in the output schedule produced for purge(p; l) if and only if it is delayed in purge(s; l).
Recovery Security: Due to conflicting actions, transactions in a real-time database system
may be involved in a deadlock. Recovery of the system from this state involves aborting
one or more actions leading to the deadlock. The recovery security property ensures that
the occurrence of a deadlock appears the same to a low-level subject, independent of whether
higher level actions are in the schedule or not. The actions taken to recover from deadlock are
also not affected by the presence of higher level transactions. When a deadlock occurs, other
channels are available for signaling in addition to those protected by value security and delay
security. The following condition takes care of these channels [13]: A scheduler is recovery
secure for all schedules p if, on the arrival of an action AX for scheduling:
1) If a deadlock occurs, resulting in a set of actions D being rolled back, then for all subject
classification levels l in p, which dominate one of those in D, a deadlock also occurs in
response to the schedule purge(p; l) on the arrival of the action AX , with the actions
purge(D; l) being rolled back. In other words, the presence of the higher level actions
did not interfere with the occurrence of deadlocks among lower level actions.
Two schedules are view equivalent if each read operation reads the same value (reads-from relationship) and the
final values of each data object is the same in both schedules [4].
If no deadlock occurs on the arrival of AX , then for all subject classification levels l in
it does not occur on the arrival of AX in the input schedule purge(p; l). In other
words, if there were no deadlocks among actions at a lower level in the presence of
higher level actions, then there would be none in their absence. This again emphasizes
the non-interference of high-level actions with low-level actions.
Performance Penalty of Enforcing Security
In order to enforce security in database systems, we need to enforce the property of non-interference
of high-level transactions with low-level transactions. For example, in a secure environment, a
transaction at a higher level:
ffl cannot cause a transaction at a lower access class to abort. If it is allowed to do so, it is
possible that it can control the number of times a lower level transaction is aborted, thereby
opening a covert channel.
ffl cannot conflict with a transaction at a lower access class. If such a conflict does occur, the
higher level transaction has to be blocked or aborted, not the low level transaction.
ffl cannot be granted greater priority of execution over a transaction at a lower access class.
However, such enforcement has the unfortunate effect of degrading performance for high-level
transactions in a real-time system. For example, a typical real-time data base assigns priorities
to transactions based on how close they are to missing their deadlines [1, 22, 24]. A high-level
transaction with a closer deadline is assigned a higher-priority than a possibly conflicting low-level
transaction with farther deadlines. However, this may be interpreted as interference of the high-level
transaction the with the low-level transaction in a secure environment. In other words, if
we were to enforce security and hence the non-interference properties described above, we need to
assign higher priority to the low-level transaction and a lower priority to the high-level transaction.
This may, however, result in missing of deadlines for the high-level transaction. In other words,
the performance of high-level transactions is being penalized to enforce security.
To illustrate the penalty on high-level transactions due to security enforcement, let us consider
the following example. A sequence of four transactions are input to a scheduler (the transactions
arrived in the T
Assume that T 1 , T 2 , T 3 and T 4 have priorities 5, 7, 10 and 12 respectively and the priority
assignment scheme is such that if priority(T critical and has to
be scheduled ahead of T 1 . In the above example, T 2 and T 3 are initially blocked by T 1 when they
arrive. When T 1 completes execution, T 3 is scheduled ahead of T 2 , since it has a greater priority
than T 2 and the transaction execution order would be T 1 However, if the transaction T 1
is removed, the execution order would be T 2 T 3 T 4 because T 2 would have been scheduled as soon
as it had arrived. The presence of the SECRET transaction T 1 thus changes the value read by
the UNCLASSIFIED transaction T 4 , which is a violation of value security. Delay security is also
violated, since the presence of T 1 delays both T 2 and T 3 .
Therefore, to satisfy the correctness properties discussed in Section 3 (i.e., to close all covert
channels), we see that very high performance penalty would be paid. In our approach to improving
performance, we shall discuss a method to trade-off mutual information transfer allowed by a covert
channel with performance (measured in terms of deadline miss percentage).
5 Secure Two Phase Locking
Before a discussion and analysis of covert channels, let us study two concurrency control approaches
at different ends of the spectrum-Secure 2PL, a fully secure protocol which does not consider
transaction priorities while scheduling and 2PL-HP, which has some deadline cognizance built into
it, but is not free from covert channels.
5.1 Secure 2PL
Basic two-phase locking does not work for secure databases because a transaction at a lower access
class (say T l ) cannot be blocked due to a conflicting lock held by a transaction at a higher access class
(T h ). If T l were somehow allowed to continue with its execution in spite of the conflict, then non-interference
would be satisfied. The basic principle behind the secure two-phase locking protocol is
to try to simulate execution of Basic 2PL without blocking the lower access class transactions by
higher access class transactions.
Consider the two transactions in the following example (Example 1):
Basic two phase locking would fail because w 2 [x] would be blocked waiting for T 1 to commit and
release read-lock on x (i.e., ru 1 [x]). In our modification to the two phase locking protocol, T 2 is
allowed to set a virtual lock vwl 2 [x], write onto a version of x local to T 2 and continue with the
execution of its next operation, i.e., c 2 . When T 1 commits and releases the lock on x, T 2 's virtual
write lock is upgraded to a real lock and w 2 [x] is performed. Until w 2 [x] is performed, no conflicting
action is allowed to set a lock on x. The sequence of operations performed are therefore, rl 1 [x] r 1 [x]
This modification alone is not enough, as illustrated in the following example (Example 2):
The sequence of operations that would be performed are rl 1 [x] r 1 [x] vwl 2 [x] vw 2 [x] wl 2 [y] w 2 [y]
c 2 . After these operations, deadlock would occur because r 1 [y] waits for w 2 [y] to release its virtual
lock and vw 2 [x] waits for r 1 [x] to release its lock. This deadlock would not have occurred in basic
two phase locking. Note that our aim of trying to simulate execution of basic two phase locking
is not being achieved. On closer inspection, it is obvious that this problem arises because w 2 [y] is
allowed to proceed with its execution even though w 2 [x] could only write onto a local version of x
due to the read lock rl 1 [x] set by T 1 . To avoid this problem, for each transaction T i , two lists are
maintained - before(T i ) which is the list of active transactions that precede T i in the serialization
order and after(T i ) which is the list of active transactions that follow T i in the serialization order.
This idea is adapted from [24], where before cnt and after cnt are used to dynamically adjust the
serialization order of transactions. The following additions are made to the basic two phase locking
protocol:
When an action p i [x] sets a virtual lock on x because of a real lock ql j [x] held by T j , then
transactions in after(T i ) are added to after(T j ), and T j and all transactions in
are added to before(T i ).
When an action w i [x] arrives and finds that a previous action w i [y] (for some data item y)
has already set a virtual write lock vwl i [y], then a dependent lock dvwl i [x] is set with respect
to vwl i [y].
When an action p i [x] arrives and finds that a conflicting virtual or dependent lock vql j [x] or
dvql j [x] has been set by a transaction T j which is in after(T i ), then p i [x] is allowed to set a
lock on x and perform p i [x] in spite of the conflicting lock.
dependent virtual lock dvp i [x], dependent on some action q i [y], is upgraded to a virtual
lock when vql i [x] is upgraded to a real lock.
The maintenance of a serialization order and the presence of dependent locks are necessary to
prevent uncontrolled acquisition of virtual locks by transactions at lower access classes.
For example 2, the sequence of operations that would now be performed are rl 1 [x] r 1 [x] vwl 2 [x]
A formal description of the Secure 2PL algorithm and its correctness proofs are given in [6].
5.2 2PL - High Priority
In 2PL-HP [1], all data conflicts are resolved in favor of the transaction with higher priority. When
a transaction requests a lock on an object held by other transactions in a conflicting mode, if the
requester's priority is higher than that of all lock holders, the holders are restarted and the requester
is granted the lock; if the requester's priority is lower, it waits for the lock holders to release the
lock. In addition, a new read lock requester can join a group of read lock holders only if its priority
is higher than that of all waiting write lock operations.
A real-time secure concurrency control must possess two characteristics - high performance and
minimal deadline miss percentage. The secure two phase locking protocol [6] was shown to yield best
average case performance among all the secure concurrency control approaches whose performance
was evaluated in [26]. We therefore use it as a basis for our approach to the problem of real-time
secure concurrency control. From our discussion earlier in this paper, it is clear that priority
based transaction scheduling is not feasible for a fully secure database system. Therefore, for
minimizing deadline miss percentage, we take the approach that partial security violations under
certain conditions are permissible, if it results in substantial gain in time cognizance.
6 Covert Channel Analysis
6.1 Covert Channels and Mutual Information
The systematic study of covert channels began with [14]. As an example of a simple covert channel
consider two processes running on a system that schedules them alternately for exactly one or two
time quanta each, the choice being up to the process [16]. One process (the sender) may send
information covertly to the other (receiver) by encoding successive symbols (0's and 1's in this
paper) in the amount of time taken for its execution. If the receiver had to wait for one quantum
before its execution, then it assumes a "0" was sent; if it waits for two quanta, it assumes a "1"
was sent. In the absence of any other processes, the maximum rate at which information can
be transmitted through this channel is one bit per quantum (assuming only 0's are transmitted).
Assuming that 0's and 1's are transmitted with equal frequency the information rate is 1/((0.5)(1)
(0.5(2)), or 2/3 bits per quanta. The presence of other processes in the system interferes with
the transmission and can be viewed as "noise". The presence of noise decreases the information
rate.
Covert channel analysis is just a subset of information theory, which is concerned with sending
signals from a transmitter to a receiver, with the possibility of noise degrading the signal fidelity.
Shannon's pioneering work [23] gives an upper limit on the rate at which messages can be passed
through the communication channel based solely on how noise affects the transmission of signals.
In popular usage, the term "information" is elusive to define. However, information has a precise
meaning to a communication theorist, expressed solely in terms of probabilities of source messages
and actions of the channel. A precise measurement of information is based on various entropy
(or uncertainty) measures associated with the communication process and information exchange is
defined by reduction in entropy.
Consider a discrete scalar random variable X, which can be regarded as an output of a discrete
message source. Suppose the variable X can assume one of K possible outcomes, labeled x
specified by P i . The entropy of the random variable X is
The entropy measures the "information" or "surprise" of the different values of X. For a particular
value x i the surprise is log(1=P i ); if x i happens with certainty then its surprise is zero, and
if x i never occurs its surprise is maximal at infinity. Note that base two logarithm is used so that
the units of information is in bits.
Information theory is concerned with how the input or transmission entropy changes while it
travels through the channel. If the channel is noiseless then the amount of information in a transmission
should be unchanged. If there is noise in the channel, then the fidelity of the signal is
degraded and the information sent is diminished. If the channel noise is so great and all encom-
passing, then there is no more surprise in seeing any symbol over another. This is mathematically
modeled by the equivocation or conditional entropy H(XjY ), where X is the random variable representing
the channel input and Y is the random variable representing the channel output. The
uncertainty associated with X, given that
Conditional entropy can therefore be defined as:
Shannon defined information as follows: the (average) mutual information shared between random
variables X and Y is
i.e., the information Y reveals about X is the prior uncertainty in X, less the posterior uncertainty
about X after Y is specified. From this definition, we have
Using the definition of conditional probability,
When transmitting, the transmitter can do nothing about the noise, and the receiver is passive
and waits for symbols to be passed over the channel. However, the transmitter can send different
symbols with different frequencies; thus there are different distributions for X. By changing the
frequency of the symbols sent, the transmitter can affect the amount of information sent to the
receiver.
There is a critical difference between covert channels and communication channels, though. The
goal of a communication channel designer is to maximize mutual information and minimize the
influence of noise. When covert channels exist, the goal of the system designer is exactly the
opposite-to try to minimize the mutual information, usually by increasing noise.
6.2 A Noisy Covert Channel
In any system where a locking mechanism is used for synchronization of concurrently executing
transactions, whenever a transaction T 1 requests a lock on a data item x on which another trans-action
holds a conflicting lock, there are two possible options:
could be blocked until T 2 releases the lock.
could be aborted and the lock granted to T 1 .
The latter option is a "non-secure" option that is taken by 2PL-HP when T 1 has a higher priority
than T 2 . The former option, along with the additional conditions and actions described in Section
5.1, would be the "secure" option if T 1 were at a higher security level than T 2 . However, this option
does not take into account the priorities of T 1 and T 2 . In our approach, we try to strike a balance
between these two options. Consider a Bernoulli random variable X with parameter q (i.e., X takes
value 1 with probability q and a 0 with probability conflict arises between
a lock holding transaction (T 2 ) and a lock requesting transaction (T 1 ), such that priority(T 1
aborted if aborted with a probability q (the
"non-secure" option is taken). If then the "secure" option is taken. Note that q can be
used to control the extent to which security is satisfied. Lesser the value of q, greater the extent to
which security is satisfied and therefore greater the miss percentage.
Unfortunately, this approach is not free from covert channels. Consider two collaborating trans-
actions, one at security level LOW and the other at security level HIGH, each consisting of just
one operation. Assume that at the start of a time interval of duration t (henceforth referred to as
a tick), the LOW transaction submits a write on a data item x and shortly thereafter (within the
tick), the HIGH transaction submits a read on x. Also assume that the transactions collaborate
to ensure that the HIGH transaction has an earlier deadline than the LOW transaction. Now, in
the absence of other transactions and if q were 1, then the LOW transaction would certainly be
aborted due to the HIGH transaction. If the HIGH transaction were not submitted, then the LOW
transaction would commit. Therefore it takes just one tick for the HIGH transaction to transmit
either a "1" (by submitting its operation) or a "0" (by not submitting its operation). In this case,
the mutual information of the channel is 1 bit/tick. There are, however, two factors which introduce
noise into this channel - firstly, the presence of other transactions and secondly, the probability q
of the lock holding transaction being aborted.
The first factor is modeled by a set of parameters: r (Table 1) and p 1 through p 6 (Table 2).
r is the probability that a transaction T i (other than T 1 and T 2 ) with an earlier deadline than
the LOW transaction submits a read or a write on x before the end of execution of the LOW
transaction, i.e., the aborting of the LOW transaction may be caused by either HIGH transaction
or T i . The probabilities (shown as S i ) with respect
to the LOW and HIGH transactions. These are summarized in Table 2. For example, p 1 is the
probability that T i does not arrive within -L units of arrival of LOW transaction (or In other
words, if the HIGH transaction (T H ) has not been submitted, then with p 1 probability, would
be committed and "0" conveyed to the LOW user. Similarly, p 2 is the probability with which T i
arrives after 's arrival but within the lock holding time (- L ) of . Since a transaction is often
delayed due to other operating system overheads such as interrupt handling, we have introduced a
time-out factor for the transactions. For example, if the LOW user does not get a response (abort
or commit of units of the initiation of automatically aborted by an explicit
operation from the LOW user. Such instances are considered as ERROR by that user. In the next
sub-section, we shall derive an equation for mutual information in terms of these factors.
An important assumption has to be stated at this point regarding the extent of knowledge that a
HIGH user has. We assume that a HIGH user has information only about the transactions that it
and its collaborators submit, i.e., all system-maintained information such as current arrival rate of
transactions, the deadlines of other transactions in the system, locks held by other transactions, etc.,
is at a SUPER-HIGH level and inaccessible to HIGH users. This assumption is not unfair because
the concurrency control manager is trusted and therefore, should not leak out information that
could be used by a malicious user. This assumption is important because if a malicious HIGH user
has access to system information, it has control over q. If it knows which transactions could possibly
interfere with its transmission of a "1" to the LOW user, it can then get rid of those transactions
as follows: At the start of a tick, the HIGH user first finds a set of active transactions that have
an earlier deadline than the collaborating LOW level transaction and a data item on which each
transaction holds a lock. This can be represented as a set of tuples
It then submits transactions with a lesser deadline that access each of these data items, thereby
causing the abortion of all the transactions in the set. This does not eliminate the effect of q on
the channel, but reduces its value.
6.3 Analysis of Mutual Information
To derive an expression for mutual information of the covert channel, we make the following
assumptions:
ffl The LOW user submits transaction periodically. has a period of -, computation time
requirement of -L , and a priority of PL .
ffl requires a write-lock on a data object x at the beginning of execution. The lock is released
only at the end of its execution.
ffl The HIGH user also has a periodic behavior (with periodicity -). Whenever it intends to
send "1" via the covert channel to the LOW user, it submits transaction TH ; it does not
submit TH in a period when it intends to send "0". In other words, the time interval between
successive arrivals of TH is an integral multiple of -.
ffl The arrivals of and TH are out of phase (or phase-shifted) in the sense that, the arrival of
TH always takes place at exactly \Delta units from the last arrival of . Since the information is
conveyed through the abort/commit of In other words, should hold the lock
on x long enough that it is aborted when the high priority TH requests for a readlock on x.
Parameter Description
low-level transaction
TH High-priority and high-level transaction
(besides
Request time of T i
Phase out time between arrivals of
-L Lock holding (or execution) time for
- L Time-out period for LOW user
PL Priority of
PH Priority of TH
q Prob. of aborting a low-priority transaction when a conflicting
data lock request is made by a high-priority transaction
r Prob. of
Prob. that "0" is sent by HIGH user

Table

1: Modeling Parameters for Covert Channel Analysis
Event Probability of event
Relationships among probabilities

Table

2: Probabilities related to T i 's lock request and release times
As discussed above, T i represents other transactions (besides may have conflicting
data access requirements with on x. For simplicity of analysis, we assume that at most
one such exists to interfere with the covert operations of TH and through the data access of
object x.
Let us assume that the low user has submitted TL at time t. More precisely, the instance of
under consideration has arrived and requested for a write-lock on x at time t. The final outcome
of will depend on the behavior of TH as well as T i . We present the analysis in terms of the two
cases: HIGH user sends "0" and HIGH user send "1".
Case 1: High user sends "0": In this case, since the phase-out time between and TH is \Delta,
the HIGH user does not submit TH at t + \Delta. Accordingly, this instance of TL has no interference
from TH . However, it may be affected by T i . The following subcases arise:
unlocked at t: gets writelock at t. However, whether it commits or aborts (prior to
We have the following cases.
(a does not arrive prior to t + -L . So commits and releases x at t + -L .
arrives prior to t + -L . Accordingly, commits and releases
x at t + -L .
arrives prior to t + -L . Now, as per the concurrency control
aborts continues and commits at t + -L
with probability
locked by T i at t: We have the following cases:
(a waits until either the readlock is released or the low-user aborts it inten-
tionally. If T i releases the lock prior to t gets the lock and commits
prior to t . Otherwise, the low-user aborts considering it as an error bit.
(a 22 ) aborts T i , gets lock, and commits at t + -L .
However, with probability its lock. If T i releases the lock
prior to t gets the lock and commits prior to t . Otherwise, the
low-user aborts considering it as an error bit.
Case 2: High user sends "1": In this case, the HIGH user submits TH at t + \Delta. Hence,
outcome may depend on both TH and T i . The following cases arise:
unlocked at t: Whether commits or not depends on both TH and We have the
following cases.
(a does not arrive prior to t + -L . But TH arrives at t + \Delta. So aborted by TH
with probability q and it commits at t + -L with probability
(a \Delta. Thus T i cannot influence
may be aborted by TH at commits at t +-L with
(a \Delta. Hence, with probability q,
aborted by T i . With probability \Delta. At this time TH arrives.
Now, two cases are possible. (i) TH aborts
and commits at t + -L with probability
arrives at t + \Delta,
may have already been aborted by TH at that time with probability q or commits
at
(a arrives between t+ \Delta and t+-L . As before, may be aborted
by TH at t + \Delta with probability q or TL is still active when T i arrives with probability
In the latter case, once again, may be aborted by T i with probability q, or
continues and commits at t + -L with probability
locked by T i at t: We have the following cases.
(a has a lock on x at t. Hence, one of the following subcases arise.
aborted by TL at t with probability q. Further, aborted by TH with
probability q at commits at t + -L with probability
waits and T i continues at time t. Further, the following
cases arise.
(a 4121 ) If T i releases lock prior to t hence prior to t
aborted by TH with probability q or T i commits prior to t+-L with probability
(a 4122 then the low-user aborts
considering it as an error bit.
a lock on x at t. Hence, one of the following subcases arise.
(a 421 ) If T i releases lock prior to t hence prior to t + \Delta). either
aborted by TH with probability q or T i commits prior to t
(a 422 then the low-user aborts
considering it as an error bit.
All the subcases, the outcomes, and the corresponding probabilities are summarized in Table 3.
From these probabilities, we now derive the following factors for covert channel analysis. Here, x i
refers to the event when the input the input is binary, i is either 0 or 1. Similarly,
Case Abort/Commit of
TH Not Submitted at time t
a 11 Commit p 1
a 12 Commit
a 13 Abort
Commit
a
a 22 Commit (p 3
Commit
TH submitted at time t
a
Commit
a
Commit
a
Commit
a 34 Abort
a
a 411 Abort (p 3
Commit (p 3
a 4121 Abort
Commit
a 4122
a 421 Abort
Commit
a 422

Table

3: Abort/Commit Probabilities
refers to the event when the output as conceived by the LOW user can be 0, 1,
or ERROR (denoted by e), j can take these values. The ERROR value essentially represents the
event when the LOW user intentionally aborts its execution is not complete within the
time-out period (- L ).
Further, if we assume that HIGH user sends "0" with probability
then we can derive the following:
Substituting these terms in Equation 1, we get the expression for the mutual information, I.
A plot of I vs. r for different values of fl with aborted when HIGH
arrives) is shown in Figure 1. In addition, the other parameters are chosen such that it is possible
to exchange maximum mutual information through the covert channel. Accordingly,
It may be observed that the mutual information is the
highest when there is least intervention from the other transactions or r = 1:0. Similarly, the
mutual information reaches the upper bound of 1.0 when the probability of sending "0" or "1" is
equal
The impact of the arrival of other transactions on I is further illustrated in Figure 2 where
different values of p i 's are chosen. Once again, to maximize I, it is assumed that an arriving high
priority transaction always aborts a low priority holder.
r
Capacity
q=1.0 ((LOW always aborted for HIGH)

Figure

1: Mutual Information (I) vs. r when Low priority is always aborted for High priority
r
Capacity
q=1.0 ((LOW always aborted for HIGH)

Figure

2: Mutual Information (I) vs. r when Low priority is always aborted for High priority
r
Capacity
aborted for HIGH half the time)

Figure

3: Mutual Information (I) vs. r when Low priority is aborted half the time by High priority
Further, the impact of the "High aborting Low" is illustrated in Figure 3 where or a low
priority is aborted by a high priority transaction only with probability 0.5. Clearly, the mutual
information is smaller in this case.
Assuming that there is no interference from other transactions (i.e., r=1.0), the effect of q on I
is illustrated in Figure 4. Since there is no interference, the p i s are irrelevant. It may be observed
that the mutual information increases with the value of q.
Finally, a plot of the I versus both q and r with chosen values of p i s is displayed
in

Figure

5. The results support our intuitive understanding of the effect of the system parameters
on the mutual information transferred through the covert channel.
7 A Secure Real-Time Concurrency Control Mechanism
From the above discussion, it is clear that the mutual information of a covert channel is determined
by the parameters p 1 through p 6 , q, and r. Clearly, q is a parameter that is completely under the
control of our system. The parameter r, however, depends on the characteristic of other transactions
in the system. Obviously, r varies with system load and the relative priority of other transactions
with respect to the LOW transaction. Larger values of r implies higher interference for the LOW
and HIGH users, and hence lower transfer of mutual information through the covert channel. Thus,
to reduce the mutual information, r can be arbitrarily increased by introducing "fake" transactions
which do not change the state of the database, but which access data items randomly. This is
Capacity
r=1.0 (No Interference from others)

Figure

4: Mutual Information (I) vs. q with no interference from other transactions0.20.610.20.610.20.61
r
Capacity

Figure

5: Mutual Information (I) vs. q and r
not a desirable option, since these transactions compete for resources and data items that would
otherwise be allocated to normal transactions, thereby degrading the performance.
The parameters p 1 through p 6 are influenced by the start and finish times of other transactions
that are active during In addition, they are influenced by -L , - L , and \Delta of the LOW user
transaction. In particular, smaller time-out periods (- imply higher value of p 4 and
hence a higher probability for the LOW-user to receive the error symbol "e". On the other hand,
higher values of time-out imply larger value of p 3 and smaller value of p 4 resulting in larger value
of P )-probability that TL is committed even when TH is submitted.
Therefore, we shall assume that r is a parameter that cannot be controlled; however, the average
value of r can be estimated by the scheduler for each level of transactions, periodically. The
parameters are even more difficult to estimate since they depend on the parameters
dictated by the LOW and HIGH user, and hence are not known to the scheduler (or any other
trusted component of the system). For this reason, it is best to make a conservative estimate of
these parameters resulting in maximal mutual information for the covert channel. Finally, it is q
that is under the control of the scheduler and can be tuned according to the allowable I. Given r
and the allowable value for I, the system can adjust the value of q.
The two transactions involved in the covert channel can collaborate to reduce the duration of a
tick, thereby reducing r. However, there is a certain lower bound, below which the duration cannot
be reduced. This is because there are three steps involved in the transmission of a symbol ("0" or
- at the start of a tick, the LOW transaction submits its write operation.
- if the HIGH user wishes to transmit a "1", it submits its read operation.
- the system has to send a "TRANSACTION ABORTED" message to the LOW user.
Or alternately,
- at the start of a tick, the LOW transaction submits its write operation.
- if the HIGH user wishes to transmit a "0", no operation is submitted; otherwise it submits a
read operation.
- the system sends either a "TRANSACTION COMMITTED" or a "TRANSACTION ABORTED"
message depending on the interference and its decision to abort/not-abort a low-priority trans-action
for a high-priority transaction.
For the covert channel to be effective, the duration of a tick cannot be lower than the overhead
involved in performing these three operations in the worst case.
There are two requirements on a secure real-time concurrency control mechanism-a security
requirement, expressed as an upper bound on mutual information and a real-time requirement,
expressed as an upper bound on miss percentage. Given I and values for r and p 1 through p 6 (recall
that the value of r is estimated and p 1 through p 6 are computed based on conservative assumptions)
q can be calculated from the equation derived for mutual information in the previous section. It is
very difficult to derive a closed form solution for q in terms of r, I, and p 1 through p 6 . But a simple
iterative solution for q can be obtained easily using the Newton-Raphson method. While there is
no direct mathematical relationship between the deadline miss percentage and these parameters,
simulation studies [26] indicate that with increasing arrival rate (and therefore increasing r), the
deadline miss percentage increases slowly but steadily up to a certain point, after which the system
becomes unstable. Similarly, with increasing q (from 0 to 1), the deadline miss percentage first
increases (up to a value of r in the range 0.3 to 0.4) and then decreases continuously until
Our approach to a real-time secure concurrency control mechanism uses a feedback control
mechanism to ensure that the mutual information at any given time does not exceed the upper
bound specified. The approach is described by the following pseudo-code:
desired deadline miss percentage (DDMP) and mutual information (I)
Calculate q, given I and current r (with computed conservative estimates of
resulting deadline miss percentage (DMP)
report back to database administrator (DBA);
DBA readjusts DDMP and(or) I;
go to step 2;
Else If ((DDMP - DMP) ? THRESHOLD)
decrease q to 0; /* reduce mutual information to 0 */
go to step 3;
Else
go to step 3;
This approach provides guarantees only on the mutual information allowed by the resulting
channel, not on the deadline miss percentage. If the miss percentage increases above the desired
miss percentage specified, there is nothing that the system can do. The only thing that can be
done is to report to DBA as in step 4. The DBA can then either increase the upper bound on I,
thereby increasing q and in turn decreasing the miss percentage, or can relax the miss percentage
requirement and increase the value of the desired miss percentage.
If the deadline miss percentage requirement is being comfortably met by the system, then a drop
in miss percentage can be afforded. This is what is done in step 5, where the covert channel is
effectively closed by setting q to 0. When the miss percentage again increases and approaches the
desired miss percentage value, normal operation is resumed and the value of q is calculated from I
and the current value of r and p 1 through p 6 .
The amount of mutual information transferred through a covert channel varies inversely with the
degree of randomness in the system. In the scheme that we have discussed, there is not much
randomness, since we strive to maintain the mutual information at a specified value. One can
therefore argue that since the amount of mutual information allowed is maintained more or less
constant, a malicious subject can utilize this channel-albeit at a much lower fidelity-to transmit
information. A certain degree of randomness can be introduced by the following procedure: the
value of q is calculated from the desired value of I and the current value of r. Instead of using
the value of q thus calculated, the value of q is sampled (for example) from a uniform distribution
between ffi]. The greater the value of ffi, the greater the uncertainty in the resulting value
of I. This might mean that sometimes the mutual information might increase beyond the upper
bound specified, but due to the uncertainty it is very difficult for a user to exploit this channel.
All the derivations and methods to control I explained in this paper have been for the type of the
covert channel discussed in Section 6.2. Are there other covert channels that malicious users can
exploit and whose allowed mutual information would not be controlled by the feedback monitoring
method explained earlier in the previous section? Let us investigate this issue further. From
the correctness criteria for secure schedulers, covert channels can be broadly classified into three
categories - those that communicate information through a violation of delay security, those that
violate recovery security and those that violate value security. In [6], it is proved that Secure 2PL
satisfies delay security. Our real-time secure concurrency control mechanism explained in Section
7 is based on the Secure 2PL protocol. The approach differs from Secure 2PL only when there is a
conflict between a lock holding transaction T 1 and a lock requesting transaction T 2 and priority(T 2 )
In this case, T 1 is aborted and T 2 granted the lock, i.e., no transaction is being
blocked. Therefore, delay security is not violated at any point. The covert channel studied in
Section 6.2 is a canonical example of a channel that exploits a violation of recovery security. There
might be other, more complicated, channels that could involve more than two transactions, but
the parameters on which the mutual information that they could exchange would be dependent on
a superset of q and r. A covert channel involving four collaborating transactions - one at HIGH
and the rest at LOW - that exploits a violation in value security can work as follows:
ffl At the start of a tick, a LOW transaction T 1 submits a write on a data item x (w 1 [x]).
ffl A second LOW transaction T 2 then submits a write on x (w 2 [x]).
ffl If the HIGH transaction T 3 wants to transmit a "1," it submits a read on x, such that
As a result, T 2 is aborted.
ffl The "receiving" LOW transaction T 4 then submits a read on x. If it reads the value written
by T 1 , then a "1"is received and if it reads the value written by T 2 , a "0" is received.
This covert channel too is dependent on two factors - the probability that a transaction T 4
would cause the aborting of T 2 before T 3 arrives and a probability q that T 2 would actually be
aborted when T 3 submits its operation. In addition, there is also the possibility that T 1 could
be aborted before T 4 submits its read, introducing an additional "noise" factor. As a result, the
mutual information allowed by this channel would actually be less than that of the simple channel
studied in Section 6.2.
Summarizing, we find that simpler the covert channel, the lesser the number of factors that the
mutual information of the channel is dependent on and therefore greater is its I. The covert channel
studied in Section 6.2 is the simplest possible channel that can be exploited, given the correctness
properties that are violated and therefore bounding its I is enough to bound the mutual information
of more complicated covert channels that could be exploited.
9 Performance Evaluation
In this section, we present the results of our performance study of the feedback control mechanism
for a range of transaction arrival rates. The goal of the analysis is to show the variation in miss
percentage for varying amounts of mutual information transferred through the covert channel.
9.1 Simulation Model
Central to the simulation model is a single-site disk resident database system operating on shared-memory
multiprocessors [15]. The system consists of a disk-based database and a main memory
cache. The unit of database granularity is the page. When a transaction needs to perform an
operation on a data item it accesses a page. If the page is not found in the cache, it is read from
disk. CPU or disk access is through an M/M/k queueing system, consisting of a single queue with
servers (where k is the number of disks or CPUs). The amounts of CPU and disk I/O times are
specified as model parameters in Table 4. Since we are concerned only with providing security at
the concurrency control level, the issue of providing security at the operating system or resource
scheduling layer is not considered in this paper. That is the reason why we do not consider a
secure CPU/disk scheduling approach. Our assumption is that the lower layers provide the higher
concurrency control layer with a fair resource scheduling policy.
The feedback approach is implemented as a layer over Secure 2PL. In the model, the execution of
a transaction consists of multiple instances of alternating data access requests and data operation
steps, until all the data operations in it complete or it is aborted. When a transaction makes a
data request, i.e., lock request on a data object, the request must go through concurrency control
to obtain a lock on the data object. If the transaction's priority is greater than all of the lock
holders, and its lock request conflicts with that of the holders, then the holders are aborted and the
transaction is granted a lock with a probability q else the steps taken by the Secure 2PL protocol
are followed; if the transaction's priority is lower, it waits for the lock holders to release the lock
[1]. The probability q depends on the factors I and r. I is available directly, but r is calculated
based on the arrival rate of transactions, the probability of contention, and their deadlines. The
analysis is based on preemptive priority queueing policy with restart. The details of the analysis
can be found in [6].
If the request for a lock is granted, the transaction proceeds to perform the data operation,
which consists of a possible disk access (if the data item is not present in the cache) followed by
CPU computation. However, if only a virtual or dependent lock is granted, the transaction only
does CPU computation, since the operation should only be performed on a local version. If the
request for the lock is denied (the transaction is blocked), the transaction is placed into the data
queue. When the waiting transaction is granted a lock, only then can it perform its data operation.
Also, when a virtual lock for an operation is upgraded to a real lock, the data operation requires
disk access and CPU computation. At any stage, if a deadlock is detected, the transaction to be
aborted to break the deadlock is determined, aborted and restarted. When all the operations in a
transaction are completed, the transaction commits. Even if a transaction misses its deadline, it is
allowed to execute until all its actions are completed.
9.2 Parameters and Performance Metrics

Table

4 gives the names and meanings of the parameters that control system resources. The
parameters, CPUTime and DiskTime capture the CPU and disk processing times per data page.
Our simulation system does not explicitly account for the time needed for data operation scheduling.
We assume that these costs are included in CPUTime on a per data object basis. The use of a
database cache is simulated using probability. When a transaction attempts to read a data page,
the system determines whether the page is in cache or disk using the probability BufProb. If the
page is determined to be in cache, the transaction can continue processing without disk access.
Otherwise disk access is needed.

Table

5 summarizes the key parameters that characterize system workload and transactions.
Parameter Meaning Base Value
hline DBSize Number of data pages in database 350
NumCPUs Number of processors 2
NumDisks Number of disks 4
CPUTime CPU time for processing an action 15 msec
DiskTime Disk service time for an action 25 msec
BufProb Prob. of a page in memory buffer 0.5
NumSecLevels Num. of security levels supported 6

Table

4: System Resource Parameters
Parameter Meaning Base Value
hline ArriRate Mean transaction arrival rate -
TransSize Average transaction size 6
RestartDelay Mean overhead in restarting 1 msec
MinSlack Minimum slack factor 2
MaxSlack Maximum slack factor 8

Table

5: Workload Parameters
Transactions arrive in a Poisson stream, i.e., their inter-arrival rates are exponentially distributed.
The ArriRate parameter specifies the mean rate of transaction arrivals. The number of data objects
accessed by a transaction is determined by a normal distribution with mean TranSize, and the actual
data objects to be accessed are determined uniformly from the database.
The assignment of deadlines to transactions is controlled by the parameters MinSlack and MaxS-
lack, which set a lower and upper bound, respectively, on a transaction's slack time. We use the
formula for deadline-assignment to a transaction.
AT and ET denote the arrival time and execution time, respectively. The execution time of a
transaction used in this formula is not an actual execution time, but a time estimated using the
values of parameters TranSize, CPUTime and DiskTime. The priorities of transactions are decided
by the Earliest Deadline First policy.
The performance metric used is miss percentage, which is the ratio of the number of transactions
that do not meet their deadline to the total number of transactions committed.
9.3 Experimental Results
An event-based simulation framework was written in 'C'. For each experiment, we ran the simulation
with the same parameters for 6 different random number seeds. Each simulation run was continued
until 200 transactions at each access class were committed. For each run, the statistics gathered
during the first few seconds were discarded in order to let the system stabilize after an initial
transient condition. For each experiment the required performance metric was measured over a
wide range of workload. All the data reported in this paper have 90% confidence intervals, whose
endpoints are within 10% of the point estimate.
In the experiment, the miss percentages for the feedback approach are measured for two different
arrival rates. The resulting graph is shown in Figure 6. Since we are considering a real-time database
system, we restrict attention to the portion of the graph where miss percentages are less than 10%.
The performance after the saturation point is not an issue. We also do not consider the section of
the graph for I less than 0.1. At such low values of I, the value of q is also very low, which means
that the behavior of the system is near identical to the Secure 2PL. Only for higher values of I is a
certain degree of deadline cognizance introduced and that is the portion of the graph that we need
to concentrate on. At low arrival rates, the dependence of miss percentage on I is minimal. This
is because very few transactions miss their deadline even at low values of I and further increase in
I does not appreciably decrease it either. At high arrival rates, however, the miss percentage rate
is quite sensitive to changes in I. As is to be expected, for lower values of I, the miss percentage is
the highest. This is obviously because of a low value of q, which signifies that very few transactions
are being aborted to give greater priority to transactions with an earlier deadline. As the value of
I increases, the value of q increases and the behavior of the system approaches that of 2PL-HP,
resulting in decreased miss-percentage.
In this paper, we have explored a possible direction for research in scheduling transactions to meet
their timing constraints in a secure database. A possible way in which security could be partially
compromised for improved miss percentage was explained and an expression for the mutual information
(I) of the resultant covert channel derived. A feedback control system was then developed,
which ensured that the mutual information transferred through the covert channel did not exceed a
desired upper bound. Although no guarantees can be provided by the system on the deadline miss
percentage, a facility is provided for renegotiating on the desired deadline miss percentage and the
desired amount of mutual information when the desired miss percentage is exceeded.
The importance of real-time database systems in an increasing number of applications, such as
those used in the military or the ones used in national infrastructure such as electric power and
telecommunications is growing. These applications obviously need to support both security and
Capacity
Miss
Percentage
x Arr rate=40 transactions/sec

Figure

Miss percentage vs. Mutual Information (I)
real-time requirements. For example, when an accident or a failure is detected and considered
severe, or physical or electronic attack is under way, the system must switch into crisis mode so
that critical transactions can be executed by the deadline and essential data can be maintained.
In such situations, it would be much more desirable to allow minor security violations to satisfy
critical timing constraints.
There are a number of issues for future work. In the derivation of the mutual information of
the covert channel, we have concentrated mainly on the dependence of I on parameter q. The
dependence of I on the presence of other transactions in the system was conveniently abstracted
away into a single parameter q. Although an approximate method for the estimation of q was
used in the performance analysis, a precise calculation of q has not been considered. A formal
queueing model of the system, based on the arrival rate of transactions, a calculation of lock
conflict probabilities, blocking time, etc., is important not only for determining q, but could also
help in establishing a probabilistic relationship between miss percentage and q and r. This could
eliminate the need for raising an ERROR condition when the desired miss percentage is exceeded,
since the correct setting of r can be obtained mathematically from I and desired miss percentage.
Secondly, in [18] the use of I as a measure of security is questioned. Examples of zero mutual
information channels are provided, where short messages can be sent through without any errors
(or loss in fidelity). A small message criterion (SMC) is introduced, which is an indication of what
will be tolerated by the system in terms of covertly leaking a short covert message of length n
("0"s and "1"s) in time t and with fidelity of transmission r%. Further work is needed to design a
formal criterion that captures all these factors and has the same mathematical elegance as mutual
information.

Acknowledgements

This work was supported in part by NASA LaRC, ONR, and VCIT.



--R

"Scheduling Real-Time Transactions: A Performance Evaluation,"
"Maintaining Security in Firm Real-Time Database Systems,"
"Secure Computer Systems: Unified Exposition and Multics Interpretation,"
Concurrency Control and Recovery in Database Systems
"Toward a Multilevel-Secure, Best-Effort, Real-Time Scheduler,"
"A Secure Two Phase Locking Protocol,"
"Secure Transaction Processing in Firm Real-Time Database Sys- tems,"
"Security Policy and Security Models,"
On Introducing Noise into the Bus-Contention Channel
The Secure Alpha Study - Final Summary Report
"Reducing Timing Channels with Fuzzy Time,"
"Alternative Correctness Criteria for Concurrent Execution of Transactions in Multilevel Secure Databases,"
"Multilevel Secure Database Concurrency Control,"
"A Note on the Confinement Problem,"
"Concurrency Control Algorithms for Real-Time Database Systems,"
"Finite-State Noiseless Covert Channels,"
"The Channel Capacity of a Certain Noisy Timing Channel,"
"Covert Channels - Here to Stay?,"
"An Analysis of Timed Z-Channel,"
"A Secure Concurrency Control Protocol for Real-Time Databases,"
"Priority-driven Secure Multiversion Locking Protocol for Real-Time Secure Database Systems,"
"Priority Inheritance Protocol: An Approach to Real-time Synchronization,"
The Mathematical Theory of Communication
"Hybrid Protocols Using Dynamic Adjustment of Serialization Order for Real-Time Concurrency Control,"
"Towards a Multilevel Secure Database Management System for Real-Time Applications,"
"Design and Analysis of a Secure Two-Phase Locking Protocol,"
"Design and Analysis of an Adaptive Policy for Secure Real-Time Locking Protocol"
"Partial Security Policies to Support Timeliness in Secure Real-Time Databases,"
"A Security Model for Dynamic Adaptive Traffic Masking,"
"An Analysis of Covert Timing Channels,"
"User-Centered Security,"
--TR

--CTR
Sang H. Son , Ravi Mukkamala , Rasikan David, Correction to 'Integrating Security and Real-Time Requirements Using Covert Channel Capacity', IEEE Transactions on Knowledge and Data Engineering, v.13 n.5, p.862, September 2001
Quazi N. Ahmed , Susan V. Vrbsky, Maintaining security and timeliness in real-time database system, Journal of Systems and Software, v.61 n.1, p.15-29, March 2002
Kyoung-Don Kang , Sang H. Son, Towards security and QoS optimization in real-time embedded systems, ACM SIGBED Review, v.3 n.1, p.29-34, January 2006
Kyoung-Don Kang , Sang H. Son , John A. Stankovic, Managing Deadline Miss Ratio and Sensor Data Freshness in Real-Time Databases, IEEE Transactions on Knowledge and Data Engineering, v.16 n.10, p.1200-1216, October 2004
Kyoung-Don Kang , Sang H. Son , John A. Stankovic, Differentiated Real-Time Data Services for E-Commerce Applications, Electronic Commerce Research, v.3 n.1-2, p.113-142, January-April
Tao Xie , Xiao Qin, Improving security for periodic tasks in embedded systems through scheduling, ACM Transactions on Embedded Computing Systems (TECS), v.6 n.3, p.20-es, July 2007
Chanjung Park , Seog Park , Sang H. Son, Multiversion Locking Protocol with Freezing for Secure Real-Time Database Systems, IEEE Transactions on Knowledge and Data Engineering, v.14 n.5, p.1141-1154, September 2002
Krithi Ramamritham , Sang H. Son , Lisa Cingiser Dipippo, Real-Time Databases and Data Services, Real-Time Systems, v.28 n.2-3, p.179-215, November-December 2004
concurrency control;database systems;real-time systems;covert channel analysis;multilevel security;locking protocols