Bell LaPadula with Empty Set

Question

I've been answering some questions about the Bell LaPadula model in my book, but I don't seem to get the correct answer on b). Below I've tried to explain my thought process on how I've attemped to solve these problems.

Question: Imagine a user that has access level:(Confidential, {Research, Accounting}) This user tries to access File1 and File2 with different categories.

a) File1:(Top Secret, {Empty Set})

Confidential < Top Secret -> Append {Research, Accounting} dominates {Empty} the user can thus append to File1.

b) File2:(Top Secret, {Research})

Confidential < Top Secret -> Append {Research, Accounting} dominates {Research} the user can thus append to File2.

According to the book the answer on B is that the user has NO access.

I believe I'm using the same logic for answering the questions, but the answers are apparently wrong. Any ideas of why? My current theory is that it has something to do with the empty set some way.

Answer 1

I see the empty set as being excluded from the dominance expression:

for write up,

• confidential < TS, write up is possible subject to:

• {research and accounting} is incommensurable with the empty set, write fails

• research and research are equal, write succeeds

for read down,

• confidential < TS, read down is possible, under the same conditions

With Trusted Solaris, I don't think you can create a container without a level and at least one category.

I'm not so sure about users, I vaguely remember accidentally creating one who was utterly powerless (;-)) and it probably was for lack of a category.