Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

their own classification level nor can they write information to a lower classification level,
except via the controlled intervention by a trusted subject (e.g., HAG).
The Bell-LaPadula framework is realized within military communications by creating networks,
each operating at a specific classification level. These networks can operate as MSLS (see
section 5.2) systems 28 or as DoD networks operating at system high, where the network is
classified at the highest classification level of the data it conveys. For example, a system-high
secret network could transmit secret information as well as information classified below the
secret level (e.g., SBU information and unclassified information), but not information at a higher
classification level than secret.
DoD networks operating at different classification levels are orthogonal to each other. For
example, they are addressed, by definition, from address and naming spaces that pertain to their
classification level. This results into network systems having distinct (i.e., unrelated) IP
addresses and naming spaces than networks operating at other classification levels in general.
“The Bell-LaPadula model is built on the state machine concept. This concept
defines a set of allowable states (A i ) in a system. The transition from one state to
another upon receipt of an input(s) (X j ) is defined by transition functions (f k ).
The objective of this model is to ensure that the initial state is secure and that the
transitions always result in a secure state.
The Bell-LaPadula Confidentiality Model defines a secure state through three
multilevel properties. The first two properties implement mandatory access
control, and the third one permits discretionary access control. These properties
are defined as follows:
1. The Simple Security Property (ss Property). States that reading of
information by a subject at a lower sensitivity level from an object at a higher
sensitivity level is not permitted (no read up).
2. The * (star) Security Property, also known as the confinement property.
States that writing information by a subject at a higher level of sensitivity to
an object at a lower level of sensitivity is not permitted (no write down).
3. The Discretionary Security Property. Uses an access matrix to specify
discretionary access control.” (Quoted from page 202 of reference 85.)
The Bell-LaPadula Confidentiality Model, therefore, creates access control protections between
entities at different sensitivity levels. These sensitivity levels are the DoD classification levels
(see section 6.3). A weakness of the Bell-LaPadula Confidentiality Model is that it only deals
with confidentiality of classified material. It does not address integrity or availability—the key
28
Other possibilities also exist, including multiple levels of security and multiple independent levels of security.
However, the goal of this paragraph is to contrast MSLS with system high because that contrast is relevant to
subsequent airborne network policy issues discussed in section 8.2.
81