Biba

The Bell-LaPadula (BLP) model addresses confidentiality in a multilevel security (MLS) system by defining two primary security constructs: subjects and objects.

The BLP model system uses labels to keep track of clearances and classifications and implements a set of rules to limit interactions between different types of subjects and objects.

Subjects are the active parties, while objects are the passive parties. To help determine what subjects will be allowed to do, they are assigned clearances that outline what modes of access (e.g., read, write) they can use when they interact with objects.

It was an early security model and does not provide a mechanism for a one-to-one mapping of individual subjects and objects, which is a fundamental requirement for building a practical operating system (OS).

This model defines three properties: the Simple Security property (SS property), the Star property (sometimes written with an asterisk), and the Strong Star property. Each are described below:

• Simple Integrity property. A subject with this property cannot read or observe an object of lower integrity (i.e., no read down).
• Star property. A subject with this property cannot modify an object of higher integrity (i.e., no write up).
• Invocation property. A subject with a lower integrity level cannot request access to a higher integrity level object, only to objects at an equal or lower integrity level.

The BLP model does not attempt to define technical constructs or solutions. It merely identifies a high-level set of rules that, if implemented correctly, prevent the exposure or unauthorized disclosure of information in a system processing different classification levels of data.