Bell-LaPadula formally
BLP defines security labels as elements of a lattice with two operations: dominance (a partial order: TS > S > C > U) and least upper bound. A subject has a clearance; an object has a classification. Two rules:
- Simple security property ("no read up"): subject S may read object O only if clearance(S) dominates classification(O).
- * (star) property ("no write down"): subject S may write object O only if classification(O) dominates clearance(S). The constraint is on the subject's current security level, which can be lower than max clearance.
The * property prevents a SECRET-cleared user from copying SECRET data into an UNCLASSIFIED file. Without it, BLP collapses.
Biba's integrity model
Inverts BLP for integrity. Integrity labels: HIGH > MEDIUM > LOW. Rules:
- Simple integrity ("no read down"): a HIGH-integrity process cannot read LOW-integrity data, which might corrupt its decisions.
- Integrity * property ("no write up"): a LOW-integrity subject cannot write to HIGH-integrity objects.
Biba has a ring policy variant that allows reads down but still blocks writes up. Used in practice: Windows Mandatory Integrity Control labels (Low/Medium/High/System) implement a Biba-like policy. A Low-integrity process (Internet Explorer Enhanced Protected Mode) cannot write to user files.
Brewer-Nash (Chinese Wall)
Designed for financial analyst firms where one consultant cannot have access to two competing companies' confidential data. Objects belong to conflict-of-interest classes. Once a subject accesses any object in a class, they are barred from accessing any other object in the same class.
State-dependent (unlike BLP which is purely lattice-based). A subject's permissions narrow over time as they touch objects. Used in legal, audit, and consulting software.
Clark-Wilson
Commercial integrity model from 1987 (Clark and Wilson). Two key concepts:
- Transformation Procedures (TPs): only certified procedures may modify Constrained Data Items (CDIs). Users can read CDIs freely but mutations go only through TPs.
- Separation of duty: two-person rules baked in. The user who certifies a TP cannot be the one who runs it on production data.
The model maps onto modern database transactions, signed deploys, and dual-control for production changes. Most banking systems implement it without naming it.
Covert channels and aggregation
Lattice-based models cannot capture:
- Covert timing channels: a process at SECRET varies its CPU usage to signal one bit at a time to an UNCLASSIFIED observer.
- Covert storage channels: a process at SECRET fills a shared disk to signal a bit by whether the next allocation succeeds.
- Aggregation attacks: each individual fact may be UNCLASSIFIED but their combination is SECRET. The model labels objects individually.
TCSEC (Orange Book, 1985) required covert channel analysis above the B2 evaluation level. The Common Criteria successor keeps this notion. Real systems mitigate with resource limits, padding, and statistical-disclosure techniques.
What survives in modern security engineering
You rarely write "Bell-LaPadula" in a design doc. You do write:
- Per-process security labels (SELinux types, AppArmor profiles, Android UIDs).
- Information-flow taint tracking in modern frameworks (React's strict mode catches some cross-context writes).
- Separation of duties (production access requires two approvals).
- Compartmentation (project-level data segregation, conflict-of-interest enforcement in legal software).
The formal models are the intellectual ancestors of every per-process isolation scheme in your modern OS.