Bell-LaPadula no read no write

Question

I'm reading about the Bell-LaPadula model. I understand the Simple Security Property and the Star Property, and I see that the model also incorporates a Discretional Security Property. My question is:

Let's imagine that we have one user (U1) and two objects (O1 and O2), and that we need to asign security levels to U1, O1 and O2 so that (a) U1 can read O1 (but no write it) AND (b) U1 cannot read O2 and cannot write O2

I can see how to fulfill condition (a): U1 must have a higher/equal security level than O1.

But what about condition (b)? If SecurityLevel(U1)>=SecurityLevel(O2) then U1 would be able to read O2. If SecurityLevel(U1)<=SecurityLevel(O2) then U1 would be able to write O2. Since we do not want U1 to read or write O2, I guess that this can only be achieved by the Discretional Security control?

Answer 1

A demonstration may be of help here. Let's say that there are three security clearance levels: top secret, secret, and unclassified. Let's assign our User (U1) the secret status. In this case, your (a) claim

U1 must have a higher security level than O1.

is correct, because U1 can read but not write to the file (the star property). To prohibit read access for U1 on O2, the second object, the object would require top secret level clearance.

But what about write access? A controller of 02 at the top secret level can rescind access to that object from a subject. Rescinding access would therefore prevent U1 from writing up to 02.

For more information, see: http://courses.cs.vt.edu/~cs5204/fall99/protection/harsh/

Answer 2

Not meaningful for levels, but fine for categories. Assume O1 is from company X, 02 is from company Y, and I have different levels between X and Y.

The underlying difficulty this exposes is that a unit of information is much smaller than a file: how are we to compose the two?