The Instance-Based Multilevel Security Model - Multilevel Security for Relational Databases - page 157

8.7 The Delete Operation Procedure of the IBMSM
The SQL-like command for the delete operation has the following
form:
DELETE
FROM R
WHERE P
where R is an MLS relation and P is a delete condition that identifies
tuples that are to be deleted.
Step 1: get the classification level of the user that executes the
delete operation L(User).
Step 2: get the class views that belong to this user.
Step 3: get all the instance views that belong to the class views of
the user and satisfy the update condition P.
Step 4: for each instance, in the instance views, delete the
property that has class level equal to the class level of the
user.
Figure 8.5 illustrates the DELETE operation procedure in
IBMSM.
8.8 Comparative Study for Polyinstantiation Models
Table 8.6 illustrates the strengths and weaknesses of each model
in the last section. This table explains that earlier MLS database
models did not consider semantics as important as implementation.
Over time, the importance of semantics was properly recognized
and the Smith-Winslett model introduced simple semantics con-
cepts. That simplicity is paid for with restricting the scope of an
update to a single entity during the update procedure. The MLR
model removed that restriction (among other things), but it can-
not assert disbelief into the tuple. The belief-consistent model has
the most complete semantics but it has never been fully imple-
mented within a software application because it is very complex.
The IBMSM provides the ability to save one instance [107]. So, the
IBMSM provides multilevel security and maximizes sharing of
data at various classification levels.