Question about compare Bell-LaPadula and Biba models with Chinese wall policy

Question

what the Chinese wall models try to achieve and how it differ from or improve upon the Bell-LaPadula and Biba models

Answer 1

Chinese Wall Model

This is an access control confidentiality policy. The access control policy states that a subject may access information from any company provided that the subject has never accessed information from a different company in the same conflict class. Consider the following conflict classes:

• {Ford, Honda, Toyota}
• {Bank of America, Wells Fargo, Chase}
• {Microsoft}

If you access a file from Honda, you're prohibited from accessing files from Ford and Toyota, but you can access files from Bank of America, Wells Fargo, Chase, and Microsoft. The policy restricts access according to two properties:

1. Simple security rule: A subject can be granted access to an object only if the object (a) is in the same company datasets as the objects already accessed by the subject and (b) belongs to a different conflict of interest class
2. Star property: write access is only permitted if (a) access is permitted by the simple security rule and (b) no object can be read which is (i) in a different company dataset than the one for which write access is requested and (ii) contains sanitized information

The Chinese wall model addresses a specific concern: conflicts of interest by a consultant or contractor.

Biba Model

This model aims at the preservation of data integrity. Data integrity has three goals:

• Prevent data modification by unauthorized parties
• Prevent unauthorized data modification by authorized parties
• Maintain internal and external consistency (i.e. data reflects the real world)

In short, it's characterized by the phrase: "read up, write down." This differs from the Bell-LaPadula model, which is captured by the phrase "read down, write up." In the Biba model, users can create content at or below their integrity level. For instance, a monk can write a prayer book that can be read by the common folk, but not by the high priest. On the other hand, users can only view content at or above their own integrity level. To continue the analogy, a monk may read a book written by a high priest, but may not read something written by a commoner.

The security rules for the Biba model are below. Note that they are the reverse of the Bell LaPadula model:

1. Simple Integrity Property: a subject at a given level of integrity must not read data at a lower integrity level (read up).
2. Star Integrity Property: a subject at a given level of integrity must not write to data at a higher level of integrity (write down).
3. Invocation Property: a process from below cannot request higher access; only with subjects at an equal or lower level.

Chinese Wall vs Bell LaPadula vs Biba

Now, to your questions:

what the Chinese wall models try to achieve and how it differ from or improve upon the Bell-LaPadula and Biba models

I described what the Chinese wall model and the Biba model try to achieve above. In doing so, I also explained how they are different. The Chinese wall model is an improvement on Bell LaPadula and Biba because it provides confidentiality and integrity of data, whereas Bell LaPadula provides confidentiality, and Biba provides integrity alone.

Please see these sources for additional reading:

1. https://coronaluo.wordpress.com/2013/10/08/chinese-wall-vs-blp-vs-biba/
2. https://www.cs.utexas.edu/~byoung/cs361/lecture25.pdf
3. https://en.wikipedia.org/wiki/Chinese_wall#Computer_security
4. https://en.wikipedia.org/wiki/Biba_Model