The server has to be able to handle multiple clients at the same time, so yes, multiple threads are involved.
s far as the locking... Wow, I wouldn't know where to start. This is one of the biggest parts of the assignment. Most people I talk to have implemented something akin to the approach in Max's book, where the Data class has a static reference to some type of collection that identifies locked records and their associated security cookie.
“Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.” - Rich Cook