Classic Security Models

Security models are concepts in information security that help control access to information and protect sensitive data. They define rules to ensure that information is handled securely, particularly regarding confidentiality and integrity. We will briefly explore three classic security models.

Bell-LaPadula Model

The Bell-LaPadula Model aims to ensure confidentiality by enforcing three security rules:

  • Simple Security Property (No Read Up): A subject cannot read information at a higher security level than its own. This prevents unauthorized access to sensitive information.

Note: Level 2 is higher than level 1.

Subject Object Read Allowed
Level 1 Level 1 Yes
Level 1 Level 2 No
Level 2 Level 1 Yes
Level 2 Level 2 Yes
  • Star Security Property (No Write Down): A subject cannot write information to a lower security level than its own. This prevents sensitive information from being disclosed to lower security levels.
Subject Object Write Allowed
Level 1 Level 1 Yes
Level 1 Level 2 Yes
Level 2 Level 1 No
Level 2 Level 2 Yes
  • Discretionary Security Property: An access matrix defines which subjects are allowed to read or write specific objects. These permissions must also comply with the first two security properties.

Note: AM = Access Matrix

No Read Up No Write Down AM Read AM Write Read Access Granted Write Access Granted
TRUE TRUE TRUE TRUE Yes Yes
TRUE FALSE TRUE TRUE Yes No
FALSE TRUE TRUE TRUE No Yes
TRUE TRUE FALSE TRUE No Yes
TRUE TRUE TRUE FALSE Yes No
TRUE TRUE FALSE FALSE No No
... ... ... ... ... ...

Note: Access is only granted if both the security properties and the access matrix permit it.

Biba Model

The Strict Biba Integrity Model aims to ensure integrity by enforcing three security rules. The first two rules are the opposite of those in the Bell-LaPadula Model:

  • Simple Integrity Property (No Read Down): A subject cannot read information at a lower integrity level than its own. This prevents potentially untrustworthy information from affecting higher-integrity subjects.
  • Star Integrity Property (No Write Up): A subject cannot write information to a higher integrity level than its own. This prevents lower-integrity subjects from modifying higher-integrity information.
  • Invocation Property: A process cannot invoke another process at a higher integrity level than its own. This prevents lower-integrity processes from influencing higher-integrity processes.

Clark-Wilson Model

The Clark-Wilson Model aims to ensure integrity by controlling how data is accessed and modified. It focuses on well-formed transactions and separation of duties to prevent unauthorized or improper changes to data.

The model uses four main components:

  • Constrained Data Item (CDI): Data whose integrity must be protected.
  • Unconstrained Data Item (UDI): Data that has not yet been validated, such as user input.
  • Transformation Procedures (TPs): Authorized procedures that modify protected data from one valid state to another.
  • Integrity Verification Procedures (IVPs): Procedures that verify whether protected data is in a valid state.

Example: In a banking system, an employee cannot directly modify an account balance. Instead, changes must be made through authorized transactions that preserve data integrity. Separation of duties can require different employees to initiate and approve a transaction.

References:

  • D. D. Clark and D. R. Wilson, "A Comparison of Commercial and Military Computer Security Policies," in 1987 IEEE Symposium on Security and Privacy, Oakland, CA, USA, 1987, doi: 10.1109/SP.1987.10001.