April 8, 2026 Outline

Reading: text, §5.2.3–5.54, 6.1
Assignments: Project selection, due April 17; Homework #2, due April 24

1. Bell-LaPadula: formal model
   1. Set of requests is R
   2. Set of decisions is D
   3. W ⊆ R×D×V×V is motion from one state to another.
   4. System Σ(R, D, W, z₀) ⊆ X×Y×Z such that (x, y, z) ∈ Σ(R, D, W, z₀) iff (x_t, y_t, z_t, z_t−1) ∈ W for each t ∈ T; latter is an action of system
   5. Theorem: Σ(R, D, W, z₀) satisfies the simple security condition for any initial state z₀ that satisfies the simple security condition iff W satisfies the following conditions for each action (r_i, d_i, (b′, m′, f′, h′), (b, m, f, h)):
      1. each (s, o, x) ∈ b′ - b satisfies the simple security condition relative to f′ (i.e., x is not read, or x is read and f_s(s) dom f_o(o)); and
      2. if (s, o, x) ∈ b does not satisfy the simple security condition relative to f′, then (s, o, x) ∉ b′
   6. Theorem: Σ(R, D, W, z₀) satisfies the *-property relative to S′ ⊆ S for any initial state z₀ that satisfies the *-property relative to S′ iff W satisfies the following conditions for each (r_i, d_i, (b′, m′, f′, h′), (b, m, f, h)):
      1. for each s ∈ S′, any (s, o, x) ∈ b′ − b satisfies the *-property with respect to f′ and
      2. for each s ∈ S′, if (s, o, x) ∈ b does not satisfy the *-property with respect to f′, then (s, o, x) ∉ b′

2. Using the Bell-LaPadula model
   1. Define ssc-preserving, *-property-preserving, ds-property-preserving
   2. Define relation W(\omega)
   3. Show conditions under which rules are ssc-preserving, *-property-preserving, ds-property-preserving
   4. Show when adding a state preserves those properties
   5. Example instantiation: get-read for Multics

3. Tranquility

4. System Z and the controversy

5. Integrity policy requirements

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 235B, Foundations of Computer and Information Security Version of April 12, 2026 at 3:14PM

You can also obtain a PDF version of this.