1

diagram

I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level.

Would it make the BLP lattice more secure if I added them? If so why?

3
  • Huh? If you've got no layers and no separated privilege levels, how is this a BLP lattice? Just sounds like a flat ACL to me.
    – Polynomial
    Oct 31, 2012 at 11:16
  • there are layers and seperated privilege levels, just not top and bottom layer.
    – null
    Oct 31, 2012 at 11:30
  • @polynomial Just that i see most blp always end with exactly 1 node on the top and bottom. do we have to do it to make it more secure?
    – null
    Oct 31, 2012 at 11:32

2 Answers 2

5

You seem to have misunderstood how this lattice model works, and the diagram you gave doesn't really help. It's meant to be a 3D structure.

In this model, we have:

  • Entities - These are things that you can have access to. In your diagram, these are crypto and nuclear.
  • Privilege levels - These are generic levels of privilege that can be applied to any entity. Each higher privilege inherits the privilege below it. In your diagram, these are secret and top secret.
  • Entity privileges - These are privilege levels associated with an individual entity. For example, you might have (Top Secret {nuclear}), or (Secret {crypto}).
  • Escalation paths - These are ways to increase an individual's privilege. Notice that each line on the lattice increases one type of privilege - e.g. it's not possible to jump directly from (Secret {nuclear}) to (Top Secret {nuclear,crypto}). This allows for strongly defined privilege escalation procedures, and proper audit trails.

The lattice model essentially puts all possible combinations of entity access on each privilege level. As such, an individual can only possibly be at one point in the lattice.

Entity privileges in this model do not allow for cases where an individual can have a higher privilege on one entity than another. You have the same privilege for all entities that you have access to, but you might not have access to some entities at all. This is often a good thing in classic law enforcement and government systems, but doesn't lend well to modern business computer systems.

Altering this model to have missing privilege levels or have missing layers doesn't make any sense. From a software design point of view, your administrator would hold the highest privilege level for all entities, whilst an unauthenticated user has no privileges on any entity. Individual users would be at any point in between. Removing any of these entity privileges makes escalation paths more circuitous, and makes for some unnecessary validation work.

If you're looking for a more flexible access control model, try access control lists with inheritance. In such a model, users may be organised into groups and subgroups, each of which have a base privilege level that inherits from its parent. Individual users may be escalated beyond the base level, but not below. This allows for complex privilege groups to be created with minimal work, in an intuitive way that mirrors your physical infrastructure.

2
  • hi thank you so much for the long reply, is it possible for me to private message you in some means in order for me to clarify my question better?
    – null
    Oct 31, 2012 at 12:11
  • Hop onto the DMZ.
    – Polynomial
    Oct 31, 2012 at 12:31
3

BLP assumes that the lattice is, well, a lattice. The mathematical definition of a lattice says that it must have a top and a bottom. If you don't have a top and a bottom, it's not a lattice.

If you are asking whether you can make Bell-Lapadula work with a partial order that is not a lattice, the answer is that it depends. If you don't have a lattice, stuff may fall apart in unexpected ways if there is anything in your system that ever updates the labels on subjects or objects. For example, if it's not a lattice and if you update subject labels on the fly, you may run into situations where you won't be able to update a subject's label as required by the rules, because you won't have any suitable lattice point that meets all the requirements.

This doesn't have anything to do with security that I can see; it has to do with ensuring that you have a coherent set of rules that can actually be executed, without getting stuck.

Caveat: The Bell-Lapadula model has a lot of problems and is (in my opinion) a poor choice for most new systems, so you should be looking very carefully at whether it's really the right choice for you.

4
  • So meaning i have to add a top and bottom?
    – null
    Oct 31, 2012 at 12:15
  • @Null, yes -- but more than that, you should not be using the Bell-Lapadula model without understanding the theory.
    – D.W.
    Oct 31, 2012 at 12:17
  • This is actually based on an assignment from school, we had to convert an Access control matrix to a blp lattice-structure and then suggest an additional security level. I am done with the lattice structure, however im not sure if adding the top and bottom helps with the additional security level part, or do i need to do more.
    – null
    Oct 31, 2012 at 12:20
  • 2
    @Null, I encourage you to review the FAQ about how to ask a good question and what questions are on-topic for this site. It's important to ask a well-formulated question from the start, and to understand that this is not a homework-help site (nor a discussion site). In this case, you might want to start by reviewing your knowledge of ACLs and BLP (read your textbook?), talk to your instructor or teaching assistant, and then see if you can formulate a specific question about what aspect of BLP you don't understand.
    – D.W.
    Oct 31, 2012 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .