Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level.

Would it make the BLP lattice more secure if I added them? If so why?

share|improve this question
Huh? If you've got no layers and no separated privilege levels, how is this a BLP lattice? Just sounds like a flat ACL to me. – Polynomial Oct 31 '12 at 11:16
there are layers and seperated privilege levels, just not top and bottom layer. – null Oct 31 '12 at 11:30
@polynomial Just that i see most blp always end with exactly 1 node on the top and bottom. do we have to do it to make it more secure? – null Oct 31 '12 at 11:32
up vote 4 down vote accepted

You seem to have misunderstood how this lattice model works, and the diagram you gave doesn't really help. It's meant to be a 3D structure.

In this model, we have:

  • Entities - These are things that you can have access to. In your diagram, these are crypto and nuclear.
  • Privilege levels - These are generic levels of privilege that can be applied to any entity. Each higher privilege inherits the privilege below it. In your diagram, these are secret and top secret.
  • Entity privileges - These are privilege levels associated with an individual entity. For example, you might have (Top Secret {nuclear}), or (Secret {crypto}).
  • Escalation paths - These are ways to increase an individual's privilege. Notice that each line on the lattice increases one type of privilege - e.g. it's not possible to jump directly from (Secret {nuclear}) to (Top Secret {nuclear,crypto}). This allows for strongly defined privilege escalation procedures, and proper audit trails.

The lattice model essentially puts all possible combinations of entity access on each privilege level. As such, an individual can only possibly be at one point in the lattice.

Entity privileges in this model do not allow for cases where an individual can have a higher privilege on one entity than another. You have the same privilege for all entities that you have access to, but you might not have access to some entities at all. This is often a good thing in classic law enforcement and government systems, but doesn't lend well to modern business computer systems.

Altering this model to have missing privilege levels or have missing layers doesn't make any sense. From a software design point of view, your administrator would hold the highest privilege level for all entities, whilst an unauthenticated user has no privileges on any entity. Individual users would be at any point in between. Removing any of these entity privileges makes escalation paths more circuitous, and makes for some unnecessary validation work.

If you're looking for a more flexible access control model, try access control lists with inheritance. In such a model, users may be organised into groups and subgroups, each of which have a base privilege level that inherits from its parent. Individual users may be escalated beyond the base level, but not below. This allows for complex privilege groups to be created with minimal work, in an intuitive way that mirrors your physical infrastructure.

share|improve this answer
hi thank you so much for the long reply, is it possible for me to private message you in some means in order for me to clarify my question better? – null Oct 31 '12 at 12:11
Hop onto the DMZ. – Polynomial Oct 31 '12 at 12:31

BLP assumes that the lattice is, well, a lattice. The mathematical definition of a lattice says that it must have a top and a bottom. If you don't have a top and a bottom, it's not a lattice.

If you are asking whether you can make Bell-Lapadula work with a partial order that is not a lattice, the answer is that it depends. If you don't have a lattice, stuff may fall apart in unexpected ways if there is anything in your system that ever updates the labels on subjects or objects. For example, if it's not a lattice and if you update subject labels on the fly, you may run into situations where you won't be able to update a subject's label as required by the rules, because you won't have any suitable lattice point that meets all the requirements.

This doesn't have anything to do with security that I can see; it has to do with ensuring that you have a coherent set of rules that can actually be executed, without getting stuck.

Caveat: The Bell-Lapadula model has a lot of problems and is (in my opinion) a poor choice for most new systems, so you should be looking very carefully at whether it's really the right choice for you.

share|improve this answer
So meaning i have to add a top and bottom? – null Oct 31 '12 at 12:15
@Null, yes -- but more than that, you should not be using the Bell-Lapadula model without understanding the theory. – D.W. Oct 31 '12 at 12:17
This is actually based on an assignment from school, we had to convert an Access control matrix to a blp lattice-structure and then suggest an additional security level. I am done with the lattice structure, however im not sure if adding the top and bottom helps with the additional security level part, or do i need to do more. – null Oct 31 '12 at 12:20
@Null, I encourage you to review the FAQ about how to ask a good question and what questions are on-topic for this site. It's important to ask a well-formulated question from the start, and to understand that this is not a homework-help site (nor a discussion site). In this case, you might want to start by reviewing your knowledge of ACLs and BLP (read your textbook?), talk to your instructor or teaching assistant, and then see if you can formulate a specific question about what aspect of BLP you don't understand. – D.W. Oct 31 '12 at 13:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.