Past exam of the computer science course of the University of Oxford / 2015 / Computer security / 1 / a

The Bell-LaPadula model protects information confidentiality by controlling information flow between security levels. Its simple security property says that a subject may read only objects whose classification does not exceed its maximum clearance:Thus a user cleared for confidential material cannot directly read a secret file. A readwrite permission includes reading and must satisfy the same restriction. This is an access control rule about who can learn existing contents; it says nothing by itself about where a cleared subject can subsequently copy them.

The Bell-LaPadula star property restricts information flow using the subject's current level. With the paper's distinction between blind writing and reading, its usual current-level formulation isHere $f_C(s)\le f_S(s)$ also holds. The first row means that reading above the current level is forbidden; the second is the familiar prohibition on writing down. Their conjunction gives the third row. Blind writing upwards is allowed because it need not disclose the higher file's contents to the writer.

For example, a subject operating at secret level cannot copy a secret file into a public file, even though its clearance would permit reading both files. More generally, any simultaneously readable object must be at most as highly classified as any writable object. A subject must not evade the rule by retaining secret information and then lowering its current level: level-changing transitions need their own safe treatment of retained information and open accesses.

First, the Bell-LaPadula model is a information confidentiality policy. It permits a low-level subject to overwrite a more highly classified object by blind writing. That can destroy a high-level file or introduce false data without disclosing its old contents. Thus it does not supply a data integrity policy, and it also does not ensure service availability. Modern multiuser operating systems require protection against modification and resource exhaustion as well as disclosure.

Second, a single hierarchy of classifications cannot express ordinary independent user ownership and selective collaboration. Two users at the same level may still need different permissions on their respective files; conversely, an authorised publication may deliberately release selected information to lower levels. The simple model lacks those owner-specific permissions and controlled release decisions. Adding discretionary access control, categories and explicit declassification mechanisms is substantial additional policy.