# Multilevel security

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2Ffj0McBItdhtMzxg9fCFs%2FScreenshot%20from%202024-02-22%2010-37-21.png?alt=media&#x26;token=bfe11234-3cda-4f79-8ea3-e26d3358185f" alt=""><figcaption></figcaption></figure>

Subjects (or roles) act on different security levels.

* **Levels do not intersect themselves.**
* Levels have some **partial order**.
  * Hierarchy.
  * Lattice.

**Levels are used as attributes** of subjects and objects.

* Subjects: security level clearance.
* Objects: security classification.

Information flows and security levels.

* Same security level → authorized.
* Different security levels → controlled.
  * Authorized or denied on a “need to know” basis.

## Levels

### Military / Intelligence organizations

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FMIogXZPHFjQuGUOUcjwN%2FScreenshot%20from%202024-02-22%2010-40-02.png?alt=media&#x26;token=155568c4-e83b-4757-aaa9-8cb8715f60fb" alt=""><figcaption></figcaption></figure>

Typical levels.

* Top secret.
* Secret.
* Confidential.
* Restricted.
* Unclassified.

Portugal (NTE01, NTE04).

* Muito Secreto.
* Secreto.
* Confidencial.
* Reservado.

EU example.

* EU TOP SECRET.
* EU SECRET.
* EU CONFIDENTIAL.
* EU RESTRICTED.
* EU COUNCIL / COMMISSION.

NATO example.

* COSMIC TOP SECRET (CTS).
* NATO SECRET (NS).
* NATO CONFIDENTIAL (NC).
* NATO RESTRICTED (NR).

### Civil organizations

Typical levels.

* Restricted.
* Proprietary.
* Sensitive.
* Public.

## Security categories (or compartments)

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FgZ9kng92Xw4Qo4ffFK68%2FScreenshot%20from%202024-02-22%2010-44-03.png?alt=media&#x26;token=e5061958-163d-4d88-b51d-fc4fbb5ab648" alt=""><figcaption></figcaption></figure>

**Self-contained** information **environments**.

* May span several security levels.

Military environments.

* Military branches, military units.

Civil environments.

* Departments, organizational units.

An object can belong to different compartments and have a different security classification in each of them.

## Labels

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FZGFCgnicgXYBfUMVaNxY%2FScreenshot%20from%202024-02-22%2010-45-44.png?alt=media&#x26;token=1aed7bff-bf97-4b45-88b2-f377bd975801" alt=""><figcaption></figcaption></figure>

* Label = Category + Level
* Relative order between labels.
  * Lb1 $$\le$$ Lb2 $$\implies$$ C1 $$\subseteq$$ C2 $$\wedge$$ Lv1 $$\leq$$ Lv2
* Labels form a lattice.

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FMXIzwRs8kSPjMojW5Ttx%2FScreenshot%20from%202024-02-22%2010-51-46.png?alt=media&#x26;token=11f82717-c023-4bc9-b33c-0d6b8a0f4004" alt=""><figcaption></figcaption></figure>

## Bell-La Padula MLS Model

Access control policy for **controlling information flows**.

* **Addresses data confidentiality and access to classified information.**
* Addresses disclosure of classified information.
  * Object access control is not enough.
  * One needs to restrict the flow of information from a source to authorized destinations.

**Uses a state-transition model**.

* In each state, there are subjects, objects, **an access matrix and the current access information**.
* State transition rules.
* Security levels and clearances.
  * Objects have security labels.
  * Subjects have security clearances.
  * Both refer to security levels (e.g. CONFIDENTIAL).

### Secure state-transition model

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FqW9dJqjfwk0K4NryFYFD%2FScreenshot%20from%202024-02-22%2010-54-36.png?alt=media&#x26;token=65ed8199-0232-4574-95d2-be905fcdb70a" alt=""><figcaption></figcaption></figure>

Simple security condition (**no read-up**).

* S can read O iff L(S) $$\ge$$ L(O)

\*-property (**no write down**).

* S can write O iff L(S) $$\le$$ L(O)
* aka confinement property.

Discretionary Security Property.

* DAC-based access control.

### Secure state-transition model

#### Strong Star Property

* S can read O iff L(S) = L(O)

#### Tranquility Principle

* Strong tranquillity: S/O levels are static for the entire S/O lifetime.
* Weak tranquillity: S/O levels may change if the security _spirit_ of the system is not compromised.

#### Trusted Subjects

* S can write to lower levels.

## Biba Integrity Model

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2F0dWQBNRwUm2XVL2ZDUyG%2FScreenshot%20from%202024-02-22%2010-58-04.png?alt=media&#x26;token=a2da1957-3027-431e-a5ac-e19a6307cd07" alt=""><figcaption></figcaption></figure>

Access control policy for controlling information flows.

* To **enforce data integrity control**.
* **Uses integrity levels, not security levels.**
* Subjects cannot corrupt objects at higher levels.

Similar to Bell-La Padula, with inverse rules.

* Simple Integrity Property (**no read down**).
  * S can read O iff I(S) $$\le$$ I(O)
* Integrity \*-Property (**no write-up**).
  * S can write O iff I(S) $$\ge$$ I(O)

Invocation Property.

* S cannot request higher access.
