A Complete Protection Model

The Bell & LaPadula computer security model is, to date, the most successful data flow restriction security model. Specifically, it prevents unauthorized downgrading of data. K.J. Bibs strengthened the Bell & LaPadula security model by adding security's mathematical dual (integrity) to prevent unauthorized upgrading of data. The security and integrity constraints are overly restrictive in some cases and not restrictive enough in others. This paper describes another extension to the Bell & LaPadula security model (with integrity) to better accommodate secure systems designers and implementers.