Covert Channels Exploit and the Bell-LaPadula MAC Model

Question

I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I have learned is regarding Database Object Size:

• High clearance subject adds or removes data
• Low clearance subject checks pattern of size changes.
• Bandwidth of covert channel could be increased by using multiple objects

However, I neither understand the benefit of this example to a malicious user, or just how it is carried out. I do understand how covert channels work in general though, but do not understand why it is particularly highlighted as a pitfall of this MAC method - perhaps, as opposed to the Biba model?

My question then, requires an explanation of how covert channels are exploited in a database using the Bell-LaPadula model - with perhaps an explanation of the related example or the explanation of a better example.

Answer 1

If I understand your question correctly, the point that is shown in your example is that even without direct read access to the data being written, you can create covert channels that could theoretically leak information.

Say I am a spy and managed to get a high security clearance with access to Top-Secret Data. I want to somehow copy this data and send it to my government. With a BLP security system I can only write data up, meaning I cannot try to write the data and lower its security level. Equally, my junior collaborator spy (with security clearance Secret) cannot read data that is written up (on Top-Secret).

The covert channel that can be established here according to your example, is in a form similar of a side channel attack. Lets say the collaborator in security clearance Secret cannot read the data, but can gain access to meta-data stored about the files or database tables where the top-secret information is stored. This data might be low-classified, since it doesn't contain any real confidential information. The spy on top-secret can construct a pattern of changes to data, which itself decodes to a covert message.

As a simple example, lets say they agreed on morse-code, and that changes to column A in the database table == dot ; changes to column B == dash; The spy can create a sequence of writes to the tables, that will be decoded by the collaborator on the lower level into a message. All the collaborator at the lower clearance level needs is access to the timestamps of changes to columns A and B in the table. This (timestamp data) in itself could usually be considered unclassified, or certainly discounted as having no real security value.