# Assignment 5: Bell LaPadula Model, Biba Integrity Model

## Start date 1 October, due beginning of class 8 October.

1. For T/F questions, answer T (for True) and F (for False) . Back up your answer with a brief explanation or example (e.g., assumptions you are making, an example of why a false statement is false, etc.)
(a) (5 Pts) T/F: Release-read and rescind-read have identical semantics in Multics instantiation of Bell LaPadula model. By semantics we mean that : two systems with same semantics lead to the same output/error on the same input.
(b) (5 Pts) T/F: Integrity level of a subject remains static for subjects and objects in Biba's strict integrity model.

2. (a) (10 Pts) Question 5.8.6 in textbook (about hierarchy) - page 150.  (b) (10 Pts) By an example, show what problem/problems may arise in Bell LaPadula model if an object hierarchy function does not result in a tree, but results in a graph (such as a Directed Acyclic Graph or Graph with cycles).

3. (10 Pts) We want to build a system that implements both Bell Lapadula and Biba strict Integrity Models.  Is it possible especially when a subject would have "high" privilege for BLP and "high" integrity for Biba, and an object that such subjects can access have "higher" classification level in BLP and "higher" integrity level in Biba ("higher" dominates "high"). Explain.

4. (10 Pts) Consider that you are designing a "self-destructive" operating system. All the processes (subjects) are at the highest level of integrity at the beginning, and as they start reading user submitted data (objects of lower integrity), their integrity level changes to lower integrity. The integrity level of the operating system is the minimum of such levels of all processes. As the system reaches the lowest integrity level, it stops functioning (self-destroys). Which integrity model you would use for designing this system and why.