Data Protection and Security

V

Access Control

V.V

Formal Models for Access Control

The Bell-LaPadula Model

It was designed in 1973 in response to US Air Force concerns over the security of time-sharing mainframe systems. By the early 1970's, people had realized that the protection offered by many commercial OS's was poor, and was not getting better. Bell-LaPadula Model (BLP) is a state machine model capturing the confidentiality aspects of access control.

The model defines two mandatory access rules:

• The Simple Security Property states that a subject at a given level of confidentiality may not read an object at a higher confidentiality level (no read-up).
• The * (star) Security Property states that a subject at a given level of confidentiality must not write to any object at a lower level of confidentiality (no write-down).

A formal description of BLP is as follows:

The current state a Bell / LaPadula (BLP) system is described by:

Access control matrix M with M s,o

b S O A is the set of all tuples ( s,o,a ) that indicate that s currently performs operation a on o .

: defines the maximum security level that each subject can see

: is the current security level subjects ( )

defines the classification of objects

The following security properties are defined:

discretionary security property – obey the access control matrix

simple security property – no read up

*-property – no write down