In my lecture on formal methods in IT security as-well as on Wikipedia it is stated that the BLP model is a mandatory access control model. It is not clear to me why this is the case.

We have defined mandatory access control models as ones where modifications are constrained. I don't see why this is the case here. We have security properties (ss-property, *-property and ds-property) which restrict the set of protection states to a set of BLP-secure protection states, however it is possible to define a BLP system whose transition relation allows transitions in those states, then the system is just not BLP-secure anymore.

1 Answer 1


It's mandatory because the state stays the same while the system is in operation. Each subject and object is given a security level (clearance technically for subjects) of which cannot be altered when the system is running.

If the system allows changes of security levels then true BLP is not being practised, for example using likes of Harrison-Ruzzo-Ullman (HRU).

If your security policy allows changes then BLP is not the security model to use.

  • You are right that the security policy is fixed, but I could as-well introduce a fixed security policy for an HRU model and then formulate security properties for them, would that make HRU a mandatory one? Commented Jun 2, 2017 at 12:13
  • HRU allows changing of subjects, objects and access control matrix entries. Therefore it cannot be fixed. If it's fixed then it's not truely HRU
    Commented Jun 2, 2017 at 12:14
  • At least in my definition of BLP model the subjects, objects, access control matrices and security domain assignments can be changed as well, just the security policy is fixed. Commented Jun 2, 2017 at 12:15
  • 1
    But the security policy is what the model represents. If the model allows something that violates the policy then it does not accurately represent the policy goals. I think we are getting wires crossed, somewhere, I would love to help answer your question. If you think I am mis-understanding the question can you try rephrasing it?
    Commented Jun 2, 2017 at 12:20
  • What is a security policy for you in this context. For me it is a partially ordered set of security domains to which the entities in the system (i.e. subjects and objects) belong. Using the security policy we can formalize the security policies ss-property and *-property. In a protection state those are satisfied or not. But a system with protection states that are not BLP-secure is, in my opinion, a BLP model as-well. Commented Jun 2, 2017 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .