Classic Security Models are used for maintaining security regarding confidentiality, integrity and availability.
These models deal with the CIA Triad.
There are three key models for maintaining these triads.
Bell-LaPadula Model
This Model focuses on maintaining confidentiality by preventing unauthorized access.
The model was invented by Scientists David Elliot Bell and Leonard. J. LaPadula.
Thus this model is called the Bell-LaPadula Model.
Here, the classification of Subjects(Users) and Objects(Files) is organized in a non-discretionary fashion, with respect to different layers of secrecy.
Simple Confidentiality Rule: This rule states that the subject can only read the files on the same layer of secrecy and the lower layer of secrecy but not the upper layer of secrecy, due to which we call this rule NO READ-UP
Star Confidentiality Rule: This rule states that the subject can only write the files on the same layer of secrecy and the upper layer of secrecy but not the lower layer of secrecy, due to which we call this rule the NO WRITE-DOWN rule
Strong Confidentiality Rule: This rule is highly secured and the strongest which states that the subject can read and write the files on the same layer of secrecy only and not the Upper Layer of Secrecy or the Lower Layer of Secrecy, due to which we call this rule as NO READ WRITE UP DOWN
Biba Model
This Model focuses on integrity rather than confidentiality, preventing unauthorized and improper modifications.
This model was invented by Scientist Kenneth .J. Biba.
The classification of Subjects(Users) and Objects(Files) is organized in a non-discretionary fashion, with respect to different layers of secrecy.
This works the exact reverse of the Bell-LaPadula Model.
Simple the: This rule states that the Subject can only read the files on the same layer of secrecy and the upper layer of secrecy but not the lower layer of secrecy, due to which we call this rule as NO READ DOWN.
Star Integrity Rule: This rule states that the Subject can only write the files on the same layer of secrecy and the lower layer of secrecy but not the upper layer of secrecy, due to which we call this rule the NO WRITE-UP
Strong Star Integrity Rule: This rule is highly secured and the strongest, which states that the subject can read and write the files on the same layer of secrecy only and not the Upper Layer of Secrecy or the Lower Layer of Secrecy, due to which we call this rule as NO READ WRITE UP DOWN
Clarke Wilson Security Model
This Model is a highly secured model. It has the following entities:
Subject: It is any user who is requesting data items.
Constrained Data Items: They cannot be accessed directly by the subject. These need to be accessed via the Clarke Wilson Security Model.
Unconstrained Data Items: It can be accessed directly by the subject.
Transformation Process: The subject's request to access the constrained data items is handled by the transformation process, which then converts it into permissions and then forwards it to the integration verification process.
Integration Verification Process: It will perform authentication and authorization. If that is successful, then the subject is given access to constrained data items.
