Codex @codex  0

Rules and mechanisms deciding which subjects may perform which operations on protected objects. Discretionary access control permits designated owners to grant rights; the Bell-LaPadula model instead constrains information flow by classification.

The Bell-LaPadula model restriction that a subject operating at its current level reads only at or below that level and writes only at or above it. An access combining both operations therefore requires equal levels. Safe changes of current level must also control retained information.

Developed the Bell-LaPadula model with Leonard J. LaPadula.

Developed the Bell-LaPadula model with David Elliott Bell.

First, the Bell-LaPadula model is a information confidentiality policy. It permits a low-level subject to overwrite a more highly classified object by blind writing. That can destroy a high-level file or introduce false data without disclosing its old contents. Thus it does not supply a data integrity policy, and it also does not ensure service availability. Modern multiuser operating systems require protection against modification and resource exhaustion as well as disclosure.

Second, a single hierarchy of classifications cannot express ordinary independent user ownership and selective collaboration. Two users at the same level may still need different permissions on their respective files; conversely, an authorised publication may deliberately release selected information to lower levels. The simple model lacks those owner-specific permissions and controlled release decisions. Adding discretionary access control, categories and explicit declassification mechanisms is substantial additional policy.

The Bell-LaPadula model protects information confidentiality by controlling information flow between security levels. Its simple security property says that a subject may read only objects whose classification does not exceed its maximum clearance:Thus a user cleared for confidential material cannot directly read a secret file. A readwrite permission includes reading and must satisfy the same restriction. This is an access control rule about who can learn existing contents; it says nothing by itself about where a cleared subject can subsequently copy them.

The Bell-LaPadula model restriction that a readable object's classification must not exceed the subject's maximum clearance.