I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I have learned is regarding Database Object Size:

  • High clearance subject adds or removes data
  • Low clearance subject checks pattern of size changes.
  • Bandwidth of covert channel could be increased by using multiple objects

However, I neither understand the benefit of this example to a malicious user, or just how it is carried out. I do understand how covert channels work in general though, but do not understand why it is particularly highlighted as a pitfall of this MAC method - perhaps, as opposed to the Biba model?

My question then, requires an explanation of how covert channels are exploited in a database using the Bell-LaPadula model - with perhaps an explanation of the related example or the explanation of a better example.

  • 1
    Security Engineering by Ross Anderson (a recommended read) has examples in the chapter on multilevel security. May 9 '12 at 17:11
  • related question here - perhaps this should be migrated here too?
    – user2752
    May 9 '12 at 17:13
  • Certainly, @JackDouglas :)
    – Jonathan
    May 10 '12 at 10:31

If I understand your question correctly, the point that is shown in your example is that even without direct read access to the data being written, you can create covert channels that could theoretically leak information.

Say I am a spy and managed to get a high security clearance with access to Top-Secret Data. I want to somehow copy this data and send it to my government. With a BLP security system I can only write data up, meaning I cannot try to write the data and lower its security level. Equally, my junior collaborator spy (with security clearance Secret) cannot read data that is written up (on Top-Secret).

The covert channel that can be established here according to your example, is in a form similar of a side channel attack. Lets say the collaborator in security clearance Secret cannot read the data, but can gain access to meta-data stored about the files or database tables where the top-secret information is stored. This data might be low-classified, since it doesn't contain any real confidential information. The spy on top-secret can construct a pattern of changes to data, which itself decodes to a covert message.

As a simple example, lets say they agreed on morse-code, and that changes to column A in the database table == dot ; changes to column B == dash; The spy can create a sequence of writes to the tables, that will be decoded by the collaborator on the lower level into a message. All the collaborator at the lower clearance level needs is access to the timestamps of changes to columns A and B in the table. This (timestamp data) in itself could usually be considered unclassified, or certainly discounted as having no real security value.

  • 1
    Exactly right. A covert channel is one that is undetected by analysis of the security model. The fact that metadata (data about data) is leaked from one security level to another is not prevented by the Bell-LaPadula model. Covert channels generally come in two forms: storage and timing. By analyzing system resources that perform storage and timing functions, some covert channels can be prevented.
    – this.josh
    May 9 '12 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.