Bell–LaPadula

The Bell-LaPadula (BLP) model addresses confidentiality in a multilevel security (MLS) system by defining two primary security constructs: subjects and objects.

Subjects are the active parties, while objects are the passive parties. To help determine what subjects will be allowed to do, they are assigned clearances that outline what modes of access (e.g., read, write) they can use when they interact with objects.

The BLP model system uses labels to keep track of clearances and classifications and implements a set of rules to limit interactions between different types of subjects and objects.

It was an early security model and does not provide a mechanism for a one-to-one mapping of individual subjects and objects, which is a fundamental requirement for building a practical operating system (OS).

This model defines three properties: the Simple Security property (SS property), the Star property (sometimes written with an asterisk), and the Strong Star property. Each are described below:

• Simple Security (SS) property. A subject with this property cannot read/access an object of a higher classification (i.e., no read up).
• Star (*) property. A subject with this property can only save an object at the same or higher classification (i.e., no write down).
• Strong Star property. A subject with this property can only write to objects at the same security classification level as the subject (i.e., lateral write,

no write down, and no write up).

The BLP model does not attempt to define technical constructs or solutions. It merely identifies a high-level set of rules that, if implemented correctly, prevent the exposure or unauthorized disclosure of information in a system processing different classification levels of data.