I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language (for example Java). I consider to have the following classifications:
and the following categories:
How do I represent the lattice?
I suspect you are slightly confused about how Bell-Lapadula works, and in particular, how categories work in Bell-Lapadula.
Classifications are necessarily ordered. In your example, we have Restricted < Confidential < Secret < Top Secret. So far, so good.
Categories are, in general, not ordered. Often, they are a set, with no ordering amongst them. They are used for compartmentalization, and they are orthogonal to classification. A compartment is used to further restrict dissemination to a group of individuals with a need-to-know. Examples of compartments (categories) might be GAMMA (interception of Soviet communications), RUFF (images obtained by satellite), or somesuch. For instance, the set of categories might be {GAMMA, RUFF}, with no ordering implied between GAMMA vs RUFF.
A document might be stamped, e.g., Top Secret GAMMA RUFF. For someone to be allowed to read this document, they need both Top Secret clearance, and they need to be authorized to access material in the GAMMA compartment and to access material in the RUFF compartment. In general, to read some document, your clearance needs to be at least as high as the classification, and you have to be a member of every compartment (category) that the document is labelled with.
Thus, in practice, compartments would never be ranks like Lieutenant. Your example doesn't make sense.
With this background, each document / data item is labelled as follows:
It has a classification.
It has a set of categories (compartments).
You can represent the classification as @Jeff Ferland suggests. To represent the set of categories, you'll need to modify @Jeff's suggestion, and store a set of categories.
The most interesting part is not the representation of labels; the most interesting part is to figure out how to compare two labels. If a document has label L, and a person has label L', should the person be allowed to read the document? To check that you understand the Bell-Lapadula model, I suggest that you code up this check, for some example.
[Restricted, Confidential, Secret, Top Secret] => [0, 1, 2, 3] //constants
[Lieutenant, Colonel, Captain, Lieutenant General, General] => [0, 1, 2, 3, 4] //constants
Set this up in a static class similar to how Math.MAX_INT and others work ... Classification.RESTRICTED will return 0. That makes it easy to read from a programmer's standpoint.
How your relate the categories is up to you. Your read / write tests are simple "is this value lower / higher than user.getClassification() (user.setClassficiation(Classification.SECRET))" (or wherever you place that).
The categories aren't spec'd in Bell-LaPadula, so you'll either have to hint how you plan to use them or figure out how to relate it as I assume that a rank doesn't directly relate to a clearance.
The simple way to remember the Bell-LaPadula model is: No read up, no write down.
A classification is the label and controls whether the subject (person) can read the object (document, file, etc). For this example, I will ignore compartments.
Let's create four people Alice, Bob, Charlie, Diana, and Eve. Now let's give each one a label: Alice is Confidential, Bob is Restricted, Charlie is Confidential, Diana is Secret, Eve is Top Secret. Each person creates a document, and when they create a document the document gets the same label as the person who created it. Alice creates Document A, Bob creates Document B, Charlie creates Document C, Diana creates Document D, and Eve creates Document E.
You can now create a simple table showing what happens when someone tries to read a document.
For reading:
| Doc A | Doc B | Doc C | Doc D | Doc E |
-------------------------------------------------
Alice | allow | deny | deny | deny | deny |
Bob | allow | allow | deny | deny | deny |
Charlie | allow | allow | allow | deny | deny |
Diana | allow | allow | allow | allow | deny |
Eve | allow | allow | allow | allow | allow |
