This paper makes original contributions in two different areas related to the concurrency control in multilevel secure, multiversion databases. First, it explores the issue of correctness criteria that are weaker than one-copy serializability. The requirements for a weaker correctness criterion are that it should preserve database consistency in some meaningful way, and moreover, it should be implementable in a way that does not require the scheduler to be trusted. This paper proposes three different, increasingly stricter notions of serializability that can serve as substitutes for one-copy serializability. Second, it presents a multiversion timestamping protocol that has several very desirable properties: It is secure, produces multiversion histories that are equivalent to one-serial histories in which transactions are placed in a timestamp order, avoids livelocks, and can be implemented using single-level untrusted schedulers.