0

The Bell-LaPadula model is useful for access control. Can I use this model for access control in composite services?

The security level of each service is exported from WS_SecurityPolicy file.

Improve this question

1 Answer 1

Reset to default
1

according to bellow mentioned paper, Bell-Lapadula Model is not compatible with Composite services:

Incompatible Access Control Models: Access control of a composition is dependent on the access control capabilities of the individual services. Where different component services use different access control models, the result could be a violation of any of the models. As a simple example, consider a travel assistance service composition where the POI service applies BellLaPadula (“no read up, no write down” for confidentiality), while the route service applies Biba (“no read down, no write up” for integrity), is liable to result in a confused system with both models partially implemented.

Security and Trustworthiness Threats to Composite Services: Taxonomy, Countermeasures, and Research Directions springer

Improve this answer
1
  • Thank you for your answer. If we use the blp model in all component services,then can we use this idea?we can assume that each service is a subject,then according the ws_security policy,we can intriduce security level for each service And implement the blp model.is this idea correct?please help me.
    – M Barazande
    Commented May 4, 2015 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .