In the context of OODB (Object-Oriented DataBases), several multilevel security models appeared in the literature. In this paper, we are mainly interested in the MultiView model [BCCGY93, BCCGY94a] . Our first objective is not to propose a new security model but rather to present the MultiView model in a formal way. Another objective is to extend the MultiView model to include new security functionalities, in particular the protection of the database schema. Our approach can be sum up as

more »

... . We propose a language based on first-order logic to represent an OODB content and specify integrity constraints which must be enforced in an OODB. A first security model called Single-View is then defined. In this security model, every atomic formula. of the language used to represent the OODB is a piece of information we may associate with a classification level. We also derive general theorems which must be enforced when classifying each piece of information. Finally, we show how to refine the Single-View model to obtain the Multi View model. We give a sketch of implementation of the MultiView model.