Bell-LaPadula Security Model

TL;DR

The Bell-LaPadula model is a cybersecurity access control system that prevents information leaks. It has two main rules: ‘No Read Up’ (you can’t read files at a higher security level) and ‘No Write Down’ (you can’t write to files at a lower security level). This guide explains how it works and how to implement basic checks.

Understanding Bell-LaPadula

Bell-LaPadula is based on the idea of security levels. Think of these like classifications: Top Secret, Secret, Confidential, Unclassified. Each file (or resource) and each user has a security level assigned to it.

The Two Core Rules

1. No Read Up: A subject (user) cannot read objects (files) with a higher security level than its own. This prevents users from accessing more sensitive information than they are authorised for.
2. No Write Down: A subject (user) cannot write to objects (files) with a lower security level than its own. This stops users from downgrading the classification of data, potentially leaking it to unauthorised individuals.

Implementing Basic Checks

Let’s look at how you might implement these rules in a simplified system. We’ll use Python for demonstration.

Step 1: Define Security Levels

First, we need to represent our security levels. We can do this with strings or numbers (where higher numbers mean higher security).

security_levels = {
    'Unclassified': 0,
    'Confidential': 1,
    'Secret': 2,
    'Top Secret': 3
}

Step 2: Assign Levels to Users and Files

Now, let’s assign security levels to users and files.

user_levels = {
    'Alice': 'Secret',
    'Bob': 'Confidential',
    'Charlie': 'Unclassified'
}

file_levels = {
    'report.txt': 'Confidential',
    'budget.xlsx': 'Top Secret',
    'notes.doc': 'Unclassified'
}

Step 3: Implement the No Read Up Check

This function checks if a user is allowed to read a file.

def can_read(user, filename):
    if user not in user_levels or filename not in file_levels:
        return False  # User or file doesn't exist

    user_level = security_levels[user_levels[user]]
    file_level = security_levels[file_levels[filename]]

    if user_level <= file_level:
        return True  # User can read (same or higher level)
    else:
        return False # No Read Up violation

Step 4: Implement the No Write Down Check

This function checks if a user is allowed to write to a file.

def can_write(user, filename):
    if user not in user_levels or filename not in file_levels:
        return False  # User or file doesn't exist

    user_level = security_levels[user_levels[user]]
    file_level = security_levels[file_levels[filename]]

    if user_level >= file_level:
        return True  # User can write (same or lower level)
    else:
        return False # No Write Down violation

Step 5: Example Usage

Let’s see how these functions work in practice.

print(f"Alice can read report.txt: {can_read('Alice', 'report.txt')}") # True
print(f"Bob can read budget.xlsx: {can_read('Bob', 'budget.xlsx')}")   # False
print(f"Charlie can write notes.doc: {can_write('Charlie', 'notes.doc')}") # True
print(f"Alice can write budget.xlsx: {can_write('Alice', 'budget.xlsx')}") # False

Important Considerations

• Discretionary Access Control (DAC): Bell-LaPadula is a Mandatory Access Control (MAC) system. DAC relies on user permissions, which can be bypassed; MAC enforces rules centrally.
• Trusted Subjects: Some users might need exceptions to the rules for legitimate administrative tasks. These are called trusted subjects and require careful management.
• Real-World Complexity: This is a simplified example. Real implementations involve more complex security level structures, object types, and access control mechanisms.