Kang, M., O. Costich, and J.N. Froscher, "A Practical Transaction
   Model and Untrusted Transaction Manager for a Multilevel-Secure
   Database system" Proc.  6th IFIP Working Conference on Database
   Security, August 1992, Vancouver, British Columbia, pp. 289-310.
   <a href="1992kang-ifip.ps">
    PostScript</a>

<blockquote>
A new transaction model for multilevel-secure databases which use the
replicated architecture is presented.  A basic concurrency control
algorithm and two variations are given based on this transaction model.
We also present new correctness criteria for multilevel-secure
databases which use the replicated architecture.  Based on this
criteria, we prove that our algorithms are correct.
</blockquote>