4

I've been reading a Computer Security book by William Stallings and have found this example of an Access Control Matrix:

enter image description here

Any example will do. I just thought I'd screenshot this off CourseSmart.

How does one convert an access control matrix like the above into a Bell-LaPadula model and if there should be any additional security level(s) added?

schroeder
  • 123,438
  • 55
  • 284
  • 319
John
  • 41
  • 1
  • 3

1 Answers1

3

If I recall correctly, BLP is an example of a MAC (mandatory access control) system, while the access matrix you post is a simple RBAC system. You can't necessarily 'convert' between the two. MAC is based on the idea of labels (secret, top-secret etc), preventing information flow in certain directions between labels. RBAC is a completely 'flat' system; users are given rights to objects without regards to information flow.

So, you can't 'convert' the access matrix, but you can arrive at a lattice based on the access matrix by 'inventing' the extra information needed. Try to categorize the objects into MAC levels, and then assign users to those levels. You may arrive at conflicts: a user that has write access to a lower level (which violates the no-write-down property of BLP). Perhaps you could split the user in two, but in reality you wouldn't want people using multiple accounts. Another solution is to upgrade the classification of some objects, but that may give rise to new conflicts.

chris
  • 3,000
  • 14
  • 22
  • How would one represent BLP? – John Aug 28 '11 at 07:21
  • As a stack. Each label is higher than the previous, and users are associated with a label. For confidentiality use no-write-down and no-read-up, for integrity use no-write-up and no-read-down (see the Biba model). http://img835.imageshack.us/img835/301/screenshot20110829at610.jpg – chris Aug 29 '11 at 16:11
  • 1
    Additionally, MAC systems can be represented as a lattice. But then you use levels and compartments within the levels: http://img402.imageshack.us/img402/3040/screenshot20110829at612.jpg – chris Aug 29 '11 at 16:13