Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive?

[Edit: Follow up from this question on SU]

share|improve this question
About the edit: This was my own question. It was recommended that I migrate it here. – Will Kunkel Dec 20 '10 at 4:27
As you will see from the initial question on SU linked above, there is only one instance I have ever seen this used in, and judging from the answers below, that may well be unique. – Rory Alsop Dec 21 '10 at 23:14
up vote 2 down vote accepted

While technically they don't conflict, functionally they do.
It is possible to implement both, i.e.

  • No Read Up
  • No Write Up
  • No Read Down
  • No Write Down

i.e, a user can only read and write in his own classification level.

While the models explicitly support combining them (with strong * properties), I'd have difficulty figuring out why you'd want to, what situation would require such a model, and what benefit you're trying to acheive. (I admit that I've never used or seen this in practice).

This seems like you're trying to implement some form of hard separation between classes of users, and I would think there are simpler ways to do so.

Just noticed you were asking specifically about operating systems - well, other than the fact that current OS's don't support this (except perhaps with the possible exception of specialized military systems), you'd again be creating a very strong separation between classes of users. Effectively granting each class its own, unshareable space.

But more than that, assuming this would be system-wide, there would be no way to share program files, e.g. OS / system code. So, no - short of implementing strong VM's (hmm, will Qubes support this?) there would be no way of implementing this in OS (unless you limit it to part of the system, which again becomes pointless...)

share|improve this answer

They're definitely not mutually exclusive, because they're orthogonal, they deal with different issues altogether. One deals with confidentiality, the other with integrity. @AviD pointed out correctly that the combination of both is called the 'strong * property' which disallows reading or writing from any other level but your own. This idea was introduced to battle the problem inherent to Biba-LaPadulla: no state. If you have three levels, A, B and C, and B can read from A and write to C, then you can traverse data from A to C, even though there are no explicit rules allowing such transfer. The whole 'no state' thing is so severely limiting that the Biba-LaPadulla is really only taught to security students as the first and simplest security model, it's really a toy, an educational construct.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.