1. Computer Security Confidentiality Policies
11/20/2018

2. Confidentiality Policies
A confidentiality policy, or information flow policy
prevents unauthorized disclosure of information.
11/20/2018

3. The Bell-LaPadula model
Confidentiality, in its
simplest form, can be
achieved by using a set
of security clearances,
arranged, say linearly
(hierarchically).
Top secret (TS)
Personnel files
Alice, Bob
Secret (S)
Electronic mail files
Sally, Cindy
Confidential (C)
Activity log files
Claire, David
Unclassified (UC)
Telephone list files
Joe Bloggs
11/20/2018

4. The Bell-LaPadula model
Let L(S) = lS be the security clearance of subject S and
L(O) = lO be the security clearance of object O.
Simple Security Property (ss- Property), Preliminary version :
S can read O iff
.lO ≤ lS (MAC) and
S has discretionary read access to O (DAC).
*- Property (star Property), Preliminary version :
S can write O iff
.lS ≤ lO (MAC) and
S has discretionary write access to O (DAC).
11/20/2018

5. Secure Systems A system S is secure if all its states satisfy the ss
and * properties.
Theorem. Basic Security Theorem, Preliminary version.
Let S be a system with secure initial state s0, and let T
be the set of its state transformations. If every element of
T preserves the ss and *properties then S is secure.
11/20/2018

6. Extending the model
Extend the structure of the security clearances by using
a lattice instead of a hierarchical (linear) structure.
This model uses categories.
Objects are placed in multiple categories
Sets of category are added to each security classification.
11/20/2018

7. An example of a lattices: the set of subsets of {a,b,c}
{a,b} {b,c}
{a,c}
{a} {b} {c}
{0}
11/20/2018

8. An example, continued
Let H = TS, SC, UC be a set of classifications with hierarchical ordering
Take a set of categories NUC, EUR, US
A compartment is a set of categories.
A security label is a pair (L,C), where L in H is
the security level and C is a compartment.
11/20/2018

9. An example, continued The partial ordering is defined by:
(L,C) dom (L,C) if and only if L L and C C .
We say that (L,C) dominates (L,C).
Example:
(S, NUC,EUR) dominates (C, NUC).
11/20/2018

10. A sublattice of a partial ordering
{TS; NUC,EUR, US} .
{S; NUC, EUR}
{S; NUC, US} {S; EUR, US}
{C;NUC} {C;EUR} {C; US} 
(the full lattice has 48=32 nodes)
11/20/2018

11. Examples Suppose George is cleared into security level (S, NUC,EUR)
DocA is classified (C, NUC)
DocB is classified (C, EUR,US)
DocC is classified (S, EUR)
Then
George dom DocA, George dom DocC,
George dom DocB,
11/20/2018

12. Bell-LaPadula (BLP) Model
BLP Structure
Combines,
.access permission matrices for access control,
a security lattice, for security levels,
an automaton, for access operations.
Security policies are reduced to relations in the BLP
structure.
11/20/2018

13. BLP Model A set of subjects S A set of objects O
A set of access operations
A = {execute,read,append,write}
A set L of security levels, with a partial ordering.
11/20/2018

14. The Bell-LaPadula model (general case)
Simple Security Condition (ss-Condition):
S can read O iff
S dom O (MAC) and
S has discretionary read access to O (DAC).
*- Condition (star Condition), Preliminary version :
S can write O iff
S has discretionary write access to O (DAC).
11/20/2018

15. Secure Systems Theorem. Basic Security Theorem
Let S be a system with secure initial state s0, and let T
be the set of its state transformations. If every element of
T preserves the ss and * conditions then S is secure.
11/20/2018

16. Formal model S = set of subjects O = set of objects
P = set of rights: r (read), a (write), w (read/write),
e (empty) (= execute in BLP)
M = set of possible ACMs
L = CK lattice of security levels, where:
C = set of clearances, K = set of categories
F = set of triples (fs, fo, fc,) where
fs and fc, associate to each subject a maximum/current security level and
fo associates with each object a security level.
11/20/2018

17. Formal model Objects may be organized as a set of hierarchies (trees).
Let H =  h: OP (O) represent the set of hierarchy
functions.
For oi, oj, ok  O we require that:
If oi,≠ oj, then h(oi)∩ h(oi) =
There is no set o1, o2,…,ok  O such that for each i=1,2,…, k, oi+1 h(oi) and ok+1= o1
11/20/2018

18. Formal model A state v  V of the system is a 4-tuple (b,m,f,h), where
b P (SOP) indicates which subjects have access
to which objects,
m  M is the ACM for the current state,
f is the triple indicating the current subject and object clearances,
h  H is the hierarchy of objects for the current state.
11/20/2018

19. Formal model R denotes the set of requests.
D denotes the set of outcomes (decisions).
W  R D V V the set of actions of the system.
The history of a system as it executes. Let N be the set of +ve integers
(representing time)
X = RN are sequences of requests x (a tuple)
Y = DN are sequences of decisions y (a tuple)
Z = VN are sequences of states z (a tuple)
We interpret this as follows: at some point in time t N:
The system is in state vt-1
A subject makes a request xi
The system makes a decision yi
The system transitions into a possibly new state yi
11/20/2018

20. Formal model A system S is represented by an initial state and a
sequence of requests, decisions and corresponding
states. Formally:
S = S (R,D,W,z0)  X Y  Z V,
with z0 the initial state.
Furthermore,
(x,y,z)  S (R,D,W,z0) iff (xt, yt, zt , zt-1)  W for all t  N
11/20/2018

21. An example
See textbook p.133
11/20/2018

22. The Bell-LaPadula model
ss-property:
(s,o,p) SOP satisfies the ss-property relative
to the security level f iff one of the following holds:
p = e or p = a
p = r or p = w and fc(s) dom fo(o).
A system satisfies the ss-property if all its states
satisfy it.
11/20/2018

23. The Bell-LaPadula model
Define b(s: p1,…,pn) to be the set of objects that s
has access to.
*-propety:
A state satisfies the *-property iff for each sS
the following hold:
b(s:a) ≠  [o b(s:a) [fc(o) dom fc(s)] ] (write-up)
b(s:w) ≠  [o b(s:w) [fc(o) = fc(s)] ] (equality for read)
b(s:r) ≠  [o b(s:r) [fc(s) dom fo(o)] ] (read-down)
11/20/2018

24. The Bell-LaPadula model
ds-property
A state v = (b,m,f,h) satisfies the discretionary
security property (ds-property) iff:
 (s,o,p)  b we have p  m[s,o].
A system is secure if it satisfies the ss-property, the
*-property and the ds-property.
11/20/2018

25. The Bell-LaPadula model
Basic Security Theorem
S(R,D,W,z0) is a secure system if it satisfies the ss-
property, the *-property and the ds-property.
11/20/2018

26. Example model instantiation Multics
The Multics system
There are five groups of rules
A set of requests: to request & release access
A set of requests: to give access & remove access from a different subject
A set of requests: to create and reclassify objects
A set of requests: to remove objects
A set of requests: to change a subjects security level
11/20/2018

27. Tranquility Principle of tranquility
Subjects and objects may not change their security
levels once they have been instantiated.
Principle of strong tranquility
No change during the lifetime of the system.
Principle of weak tranquility
Security levels do not change in a way that violates the
rules of a given security policy. (for BLP: ss & *)
11/20/2018

28. McLean’s system Z
Mc Lean reformulated the notion of a secure action and
defined an alternative version of ss, * and ds
Roughly: a system S satisfies these properties if: given a
state of S that satisfies them, the action transforms the
state into a possibly new state that also satisfies them and
eliminates any accesses present in the transformed state
of S that would violate the initial state.
11/20/2018

29. McLean’s system Z Theorem
S is secure if its initial state is secure and if each
action satisfies the alternative versions of ss, * and ds.
11/20/2018