A Protocol for Releasing Purpose Marks to Prevent Illegal Information Flow

A transaction is assigned with a purpose which is a collection of roles. Suppose a transaction T
₁
writes an object o
₂
after reading an object o
₁
and then another transaction T
₂
reads the object o
₂
and writes an object o
₃
. Here, data in the object o
₁
might flow into o
₃
via o
₂
. Unless T
₂
is granted a read access right of the object o
₁
, illegal information flow occur. In order to prevent the illegal information flow, T
₁
marks the object o
₂
with the purpose of T
₁
. T
₂
cannot read o
₂
unless the purpose of T
₂
includes a read right of o
₁
. In result, the throughput is degraded. Objects whose information may flow into an object o are source objects of o. An object is timed out if it takes some time units after the object is lastly written. While there occur no illegal information flow in our purpose marking (PM)protocol, transactions which imply illegal information flow are aborted. We evaluate the PM protocol in terms of how many transactions are aborted.