Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been reading a Computer Security book by Walliam Stallings and have found this example: http://i.imgur.com/5CAlc.png of an Access Control Matrix. Any example will do I just thought I'd screenshot this off coursesmart.

My question is on how to convert an access control matrix like the above into a BLP and if there should be any additional security level(s) added?

Edit: BLP is http://en.wikipedia.org/wiki/Bell%E2%80%93LaPadula_model

share|improve this question

1 Answer 1

If I recall correctly, BLP is an example of a MAC (mandatory access control) system, while the access matrix you post is a simple RBAC system. You can't necessarily 'convert' between the two. MAC is based on the idea of labels (secret, top-secret etc), preventing information flow in certain directions between labels. RBAC is a completely 'flat' system; users are given rights to objects without regards to information flow.

So, you can't 'convert' the access matrix, but you can arrive at a lattice based on the access matrix by 'inventing' the extra information needed. Try to categorize the objects into MAC levels, and then assign users to those levels. You may arrive at conflicts: a user that has write access to a lower level (which violates the no-write-down property of BLP). Perhaps you could split the user in two, but in reality you wouldn't want people using multiple accounts. Another solution is to upgrade the classification of some objects, but that may give rise to new conflicts.

share|improve this answer
    
How would one represent BLP? –  John Aug 28 '11 at 7:21
    
As a stack. Each label is higher than the previous, and users are associated with a label. For confidentiality use no-write-down and no-read-up, for integrity use no-write-up and no-read-down (see the Biba model). img835.imageshack.us/img835/301/screenshot20110829at610.jpg –  chris Aug 29 '11 at 16:11
1  
Additionally, MAC systems can be represented as a lattice. But then you use levels and compartments within the levels: img402.imageshack.us/img402/3040/screenshot20110829at612.jpg –  chris Aug 29 '11 at 16:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.