Module 1: Advanced System Security and Digital Forensics

1. Lecture #7: Bell Lapdula Model and Biba Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai
August 14, 2020
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 1 / 27

2. Multilevel Security Models
Bell La Padula Model
Biba Model
Chinese Wall Model
Clark-Wilson Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 2 / 27

3. Bell LaPadula Model
David Bell, Len Lapadula, DoD, TCSEC
An abstract model intended to control information flow
Prevent unauthorized disclosure of information
Objects have a security level (e.g., unclassified, classified, secret, top secret)
Security levels are arranged in Linear order
Subjects (think: principals, processes) have a level
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 3 / 27

4. Bell LaPadula Model : An Institute Example
Security Level Subject Object
TOP SECRET PRINCIPAL AICTE FILE
SECRET HOD & FACULTY ANSWER SHEETS
CONFIDENTIAL STUDENT, T.ASSISTANT ASSIGNMENTS
UNCLASSIFIED DAILY-WAGES BILLS, RECEIPTS
Table 1: Example: Simple Bell Lapdula Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 4 / 27

5. Bell LaPadula Model
Figure 1: Information Flow 1
Information Flow “UP”not “DOWN”
“No Read up”and “No Write Down”
1www.cs.utexas.edu/~byoung/cs361
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 5 / 27

6. Reading Information
Figure 2: Reading Information 2
2http://nob.cs.ucdavis.edu/
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 6 / 27

7. Simple-Security Property
The Simple-Security Property:
Subject S with clearance (LS , CS ) may be granted read access to object O
with classification (LO, CO) only if (LS , CS ) dominates (LO, CO).
OR
Subject S with clearance (LS , CS ) may be granted read access to object O
with classification (LO, CO) only if (LS , CS ) ! (LO; CO):
LX Security Level Subject Object
4 Top Secret PRINCIPAL AICTE FILE
3 Secret HOD, FACULTY
2 Confidential STUDENT & T.ASSISTANT
1 Unclassified DAILYWAGES
Table 2: Example: Simple Bell Lapdula Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 7 / 27

8. Simple-Security Property
HOD Trying to READ file Available with PRINCIPAL
Level (PRINCIPAL) = 4, LS = L(PRINCIPAL) = 4;
CS = C(PRINCIPAL) = 4;
Level (HOD) = 3, LS = L(HOD) = 3;
CS = C(HOD) = 3;
Object = AICTE FILE belongs to PRINCIPAL
LO=4,CO=4
(LS,CS) = (3,3) & (LO,CO) = (4,4)
(LS,CS) ! (LO; CO) FALSE
i.e. (3,3) ! (4; 4) FALSE
READS UP - DISALLOWED
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 8 / 27

9. Simple-Security Property
LX Security Level Subject Object
4 Top Secret PRINCIPAL
3 Secret HOD, FACULTY
2 Confidential STUDENT & T.ASSISTANT ASSIGNMENT
1 Unclassified DAILYWAGES
Table 3: Example: Simple Bell Lapdula Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 9 / 27

10. Simple-Security Property
FACULTY Trying to READ ASSIGNMENTS of STUDENTS
Level (FACULTY) = 3, LS = L(FACULTY) = 3;
CS = C(FACULTY) = 3;
Level (STUDENTS) = 2, LS = L(STUDENT) = 2;
CS = C(STUDENT) = 2;
Object = ASSIGNMENT belongs to STUDENT
LO=2,CO=2
(LS,CS) = (3,3) & (LO,CO) = (2,2)
(LS,CS) ! (LO; CO) TRUE
i.e. (3,3) ! (2; 2) TRUE
READS DOWN - ALLOWED
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 10 / 27

11. Figure 3: READS DOWN-ALLOWED
Figure 4: READS UP - DISALLOWED
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 11 / 27

12. Figure 5: Writing Information 3
3http://nob.cs.ucdavis.edu/
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 12 / 27

13. The *-Property
The *-Property: Subject S with clearance (LS , CS ) may be granted write
access to object O with classification (LO, CO)
only if (LS , CS ) (LO; CO):
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 13 / 27

14. *- Property
LX Security Level Subject Object
4 Top Secret PRINCIPAL
3 Secret HOD, FACULTY ANSWER-SHEETS
2 Confidential STUDENT & T.ASSISTANT
1 Unclassified DAILYWAGES
Table 4: Example: Simple Bell Lapdula Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 14 / 27

15. *- Property
STUDENTS Trying to WRITE ANSWER-SHEETS DISCTRIBUTED by FACULTY
Level (FACULTY) = 3, LS = L(FACULTY) = 3;
CS = C(FACULTY) = 3;
Level (STUDENTS) = 2, LS = L(STUDENT) = 2;
CS = C(STUDENT) = 2;
Object = ANSWER-SHEETS belongs to FACULTY
LO=3,CO=3
(LS,CS) = (2,2) & (LO,CO) = (3,3)
(LS,CS) (LO; CO) TRUE
i.e. (2,2) (3; 3) TRUE
HENCE, WRITE UP ALLOWED
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 15 / 27

16. *- Property
LX Security Level Subject Object
4 Top Secret PRINCIPAL
3 Secret HOD, FACULTY
2 Confidential STUDENT & T.ASSISTANT ASSIGNMENT
1 Unclassified DAILYWAGES
Table 5: Example: Simple Bell Lapdula Model
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 16 / 27

17. Simple-Security Property
FACULTY Trying to WRITE Assignment of STUDENT
Level (FACULTY) = 3, LS = L(FACULTY) = 3;
CS = C(FACULTY) = 3;
Level (STUDENTS) = 2, LS = L(STUDENT) = 2;
CS = C(STUDENT) = 2;
Object = ASSIGNMENT belongs to STUDENT
LO=2,CO=2
(LS,CS) = (3,3) & (LO,CO) = (2,2)
(LS,CS) (LO; CO) TRUE
i.e. (3,3) (2; 2) TRUE
HENCE, WRITE DOWN DISALLOWED
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 17 / 27

18. Bell Lapdula Model : No Read Up, No Write Down
Figure 6: Bell Lapdula Model : No Read Up, No Write Down 4
4https://www.ktunotes.in/wp-content
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 18 / 27

19. Bell Lapdula Model : No Read Up, No Write Down
Figure 7: Bell Lapdula Model : No Read Up, No Write Down 5
5https://www.ktunotes.in/wp-content
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 19 / 27

20. Open Questions
Design suitable hierarchy and demonstrate the working of Bell-Lapdula Model
1 : HR at office writes remarks on file available with Principal.
2 : HODs putting their remarks on Students Journal
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 20 / 27

21. BIBA MODEL
The Bell-LaPadula model was designed strictly to address confidentiality.
The Biba model is a similar multi-level security model that is designed to
address data integrity.
With confidentiality, we were primarily interested with who could read the
data and ensuring that nobody at a lower classification level was able to
access the data.
With integrity, we are primarily concerned with imposing constraints on who
can write data and ensuring that a lower-integrity subject cannot write or
modify higher-integrity data.
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 21 / 27

22. Biba Model
Objects and users are assigned integrity levels that form a partial order,
similar to the BLP model.
The integrity levels in the Biba model indicate degrees of trustworthiness, or
accuracy, for objects and users.
e.g. a file stored on a machine in a closely monitored data center would be
assigned a higher integrity level than a file stored on a laptop
In general, a data-center computer is less likely to be compromised than a
random laptop computer.
e.g.when it comes to users, a senior employee with years of experience would
have a higher integrity level than an intern.
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 22 / 27

23. The Biba Model : The Simple Integrity Property:
The access-control rules for Biba are the reverse of those for BLP.
Biba does not allow reading from lower levels and writing to upper levels.
If we let I(S) denote the integrity level of a Subject S and I(O) denote the
integrity level for an object, O, we have the
The Simple Integrity Property:
A Subject S can read an Object O only if
I(S) I(O):
i.e A subject cannot read an object from a lower integrity level.
This ensures that subjects will not be corrupted with information from
objects at a lower integrity level.
For example, a process will not read a system configuration file created by a
lower-integrity-level process.
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 23 / 27

24. The Biba Model : The *-property (Star Property)
The *-property (Star Property):
A Subject S can write (create, edit or append to) an Object O only if
I(S) I(O):
A subject cannot write to an object of a higher integrity level.
This means that lower-integrity subjects will not corrupt objects at a higher
integrity level.
For example, A web browser may not write a system configuration file.
Biba rules express the principle that information can only flow down, going
from higher integrity levels to lower integrity levels.
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 24 / 27

25. The Biba Model Example
Figure 8: The Biba Model Example 6
6https://www.researchgate.net/
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 25 / 27

26. The Biba Model Example
Figure 9: The Biba Model Example 7
7https://www.researchgate.net/
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 26 / 27

27. Workling Example
Microsoft implemented support for the Biba model in Windows with their
Mandatory Integrity Control. File objects are marked with an integrity level:
-Critical files: System
-Regular users and objects: Medium
-Elevated users: High]
-Internet Explorer: Low
Dr.Ramchandra Mangrulkar, DJSCE Mumbai Lecture #7: Bell Lapdula Model and Biba Model August 14, 2020 27 / 27