8

To answer all your questions at once, since the BLP is no read up, no write down data confidentiality model, and Biba is no read down, no write up data integrity model, you effectively end up with a prohibitive, same level only data confidentiality and integrity model. In theory, it shouldn't result in any less secure model, quite the contrary, it might be ...


8

If I understand your question correctly, the point that is shown in your example is that even without direct read access to the data being written, you can create covert channels that could theoretically leak information. Say I am a spy and managed to get a high security clearance with access to Top-Secret Data. I want to somehow copy this data and send it ...


8

I suspect you are slightly confused about how Bell-Lapadula works, and in particular, how categories work in Bell-Lapadula. Classifications are necessarily ordered. In your example, we have Restricted < Confidential < Secret < Top Secret. So far, so good. Categories are, in general, not ordered. Often, they are a set, with no ordering amongst ...


6

[Restricted, Confidential, Secret, Top Secret] => [0, 1, 2, 3] //constants [Lieutenant, Colonel, Captain, Lieutenant General, General] => [0, 1, 2, 3, 4] //constants Set this up in a static class similar to how Math.MAX_INT and others work ... Classification.RESTRICTED will return 0. That makes it easy to read from a programmer's standpoint. How your ...


5

I tend not to pay much attention to textbooks that recommend Bell-Lapadula or Biba multi-level security. Those schemes are impractical for most real-world settings. They make some beautiful theory, but they have not worked out well for general-purpose computing in practice. Bell-Lapadula and Biba models have several major problems. Here are two of them: ...


4

The simple way to remember the Bell-LaPadula model is: No read up, no write down. A classification is the label and controls whether the subject (person) can read the object (document, file, etc). For this example I will ignore compartments. Lets create four people Alice, Bob, Charlie, Diana, and Eve. Now lets give each one a laebl: Alice is Confidential, ...


4

The model is used in Multilevel Security (MLS) systems which provide trusted computing used by folks that have labels like the one you describe. In other words, the governments of the world. Wikipedia has some good links here There are solutions available today that use the model. Some of those are listed in the article.


3

The system Bell and LaPadula describe exists in SE Linux, but is not used the way permissions and access-control lists are, but instead to limit the capabilities of programs, to avoid them leaking information. Something my phone needs! As it stands, the system is logical, powerful and subtle. The latter two, together, means that it's easy to get wrong (:-))...


3

I think I'm taking the same class as you and I think I've figured out a solution to this problem, but I may be wrong. The low watermark policy of the Biba Model allows one to write up and read down, but in order to read down the subject must lower their integrity level to do so. This means that when accessing information, it is crucial that it is done in the ...


2

https://thumbs.gfycat.com/AcrobaticLegitimateAnura-mobile.mp4 As the name suggests, these are models, and not implementations. Bell-LaPadula provided a framework that guided how to think about confidentiality (and that significantly impacted the military clearance system) but it is not actively the source of any modern systems security. from: ...


1

No write-down means you can't perform any action to make changes to a system below your authorization level. The purpose is to prevent higher authorized entities from intentionally or unintentionally leaving classified data in an inappropriate location. Applied properly, this should mean that appends, overwrites, new files, etc. cannot be written/created/...


1

I see the empty set as being excluded from the dominance expression: for write up, confidential < TS, write up is possible subject to: {research and accounting} is incommensurable with the empty set, write fails research and research are equal, write succeeds for read down, confidential < TS, read down is possible, under the same conditions With ...


1

I think you may be confused about the terminology, if I'm understanding your question correctly. Security levels can dominate each other. Security level X dominates Y if and only if X is a higher classification than Y, and X is granted at least the full set of privileges Y has. In your example X = {TOP SECRET, {A,C}} does NOT dominate Y = {SECRET, {B,C}}...


1

according to bellow mentioned paper, Bell-Lapadula Model is not compatible with Composite services: Incompatible Access Control Models: Access control of a composition is dependent on the access control capabilities of the individual services. Where different component services use different access control models, the result could be a violation of any of ...


Only top voted, non community-wiki answers of a minimum length are eligible