Bell LaPadula

In recent years, the Bell-LaPadula model has been employed more and more in scientific Since publication, the Bell-LaPadula model has helped in the advancement of science and technology by providing a mathematical basis for the examination of laboratory security. Moreover, this model is a major component of having a disciplined approach to building secure and effective laboratory systems.

The Bell-LaPadula model can also be used to abstractly describe the computer security system in the laboratory, without regard to the system’s application.

The goal of modern security research is to facilitate the construction of multilevel secure systems, which can protect information of differing classification from users that have varying levels of clearance. There are some deficiencies inherent in the Bell and LaPadula model, and there have been efforts to develop a new approach to defining laboratory security models, on the basis that security models should be derived from specific applications. Project Aims and Objectives:

The objective of this research is to ascertain the ways in which the bell-lapadula model can be applied to Laboratory Information Management Systems. Laboratory automation occurs when the application of technology is used to reduce the need for human intervention in the laboratory. This makes it possible for scientists to explore data rates that otherwise may be too fast or too slow for proper scientific examination. Moreover, the research was also aimed to investigate the possible practical applications of the Bell-Lapadula model in library information management systems (LIMS).

The main intention of this modern security research is to facilitate the construction of multilevel security systems, which can protect information of differing classification from users that have varying levels of clearance. Since publication, the Bell-LaPadula model has helped in the advancement of science and technology by providing a mathematical basis for the examination of laboratory security. Moreover, this model has been major component of having a disciplined approach to the building of effective and secure laboratory systems.

Project Outline: Literature Survey: The use of the Bell and LaPadula Model has been successful in modeling information that is relevant to security, even though this success might be responsible for the vagueness of the model about its primitives. This vagueness can also be examined with respect to the theory that the Bell and LaPadula Model and Noninterference are equivalent. Laboratory automation makes it possible for scientists to explore data rates that otherwise may be too fast or too slow to properly examine.

Therefore, an automated laboratory reduces the need for human intervention and creates a more efficient environment in which human beings and technology can interact to produce a great deal more information and accurate data that was not possible prior to automation. Its approach is to define a set of system constraints whose enforcement will prevent any application program executed on the system from compromising system security.

The model includes subjects, which represent active entities in a system (such as active processes), and objects, which represent passive entities (such as files and inactive processes). Both subjects and objects have security levels, and the constraints on the system take the form of axioms that control the kinds of access subjects may have to objects. (http://chacs. nrl. navy. mil/publications/CHACS/2001/2001landwehr-ACSAC. pdf)

While the complete formal statement of the Bell-LaPadula model is quite complex, the model can be briefly summarized by these two axioms stated below: (a) The simple security rule, which states that a subject cannot read information for which it is not cleared (i. e. no read up) (b) The property that states that a subject cannot move information from an object with a higher security classification to an object with a lower classification (i. e. no write down). (http://chacs. nrl. navy. mil/publications/CHACS/2001/2001landwehr-ACSAC. pdf)

These axioms are meant to be implemented by restriction of access rights that users or processes can have to certain objects like devices and files. The concept of trusted subjects is a less frequently described part of the Bell-LaPadula model. Systems that enforce the axioms of the original Bell-LaPadula model very strictly are often impractical, because in a real system, a user might need to invoke operations that would require subjects to violate the property, even though they do not go against our basic intuitive concept of laboratory security.

For instance, there might be need in the laboratory to extract an UNCLASSIFIED paragraph from a CONFIDENTIAL document for use in a document that is UNCLASSIFIED. A system that strictly enforces the properties of the original Bell-LaPadula model might prohibit this kind of operation. As a result, a class of trusted subjects has had to be included in the Bell-LaPadula model, and is trusted not to violate security, although they might violate the property.

Laboratory systems that are based on this less restrictive model usually have mechanisms that permit some of the operations that the property would normally not allow. It should also be noted that a number of projects have used the Bell-LaPadula model for description of their security requirements, although strict enforcement of the Bell-LaPadula axioms without the implementation of trusted subjects turns out to be overly restrictive in these projects. Thus, there has been widespread introduction of these trusted processes to implement the concept of trusted subjects.

There are also some limitations involved in the use of the Bell-LaPadula model, including an absence of policies for changing user access rights. With this model, there can be secure and complete general downgrade, and is it is intended for systems that have static security levels. The Bell-Lapadula model would be a suitable idea for Laboratory Information Management Systems because the model focuses on data confidentiality and access to classified information, in contrast to some other models that describe rules for data protection and integrity.

Clear and concise access rules for clinical information systems spells out by this model. Furthermore, it reflects current best clinical practice, and it’s informed by the actual threats to privacy, its objective is to the maximum number of records accessed by any user, and at the same time the number of users who can access any record and this has to do with controlling information flows across rather than down and at the same time a strong notification property should be enforced.

I will also discuss its relationship with other existing security policy models available, and the possibility of its usage in other applications where information exposure must be localized, which ranges from private banking to the management of intelligence data, and much more. Another area in which laboratories could benefit by using the Bell-Lapadula model is the multi million dollar drug industry, which requires a high level of security and confidentiality since drug research sensitive, and results or findings in an ongoing research may sometimes need to be kept from unauthorized persons.

Description of the Deliverables: This research will be conducted by investigating the possible practical applications of the Bell-Lapadula model. This would be conducted and tested physically and objectively. A prototype will be built in order for it to be properly tested, since it is practical. The testing stage will involve programming codes for different levels of security and the objective is to find out if security can be breached at any stage. Evaluation Criteria Evaluation of the involve the Resource Plan:

The equipment, software, and other materials necessary to complete the project, how they are to be provided, and what the financial costs will be, such as travel. Project Plan and Timing: Anticipated milestones and interim deliverables. A detailed timetable (schedule) of the stages, including the estimated finishing date, is a must. Stages will be reviewed with the sponsor and Dissertation Advisor. Don’t simply list the stages of the project and their timetables, but supply information what is done in each of them with special emphasis on the last stage of the project.

Risk Assessment: A description of what obstacles may arise and contingency plans to meet them. One aspect that should be considered here is the availability of the software and hardware you intend to use and, if you need to interface several pieces of software, whether this is known to be possible. Quality Assurance: How progress on your project will be monitored and how success at each stage will be assessed. This may include, but should not be limited to, the formal project assessments.