What's the difference between the Bell-LaPadula and Biba security models, and why are their rules mirror images of each other?
Bell-LaPadula protects secrecy ("no read up, no write down"); Biba protects integrity ("no read down, no write up"). They're inverses because confidentiality and integrity flow in opposite directions.
* Confidentiality and integrity flow in opposite directions, so the read/write rules are mirror images. *
Both are multi-level MAC models: every subject and object sits at a level in a lattice (e.g. Public < Confidential < Secret < Top-Secret), and a central policy — not the owner — enforces the rules. The two models optimise for opposite goals, so their rules invert:
| Bell-LaPadula (confidentiality) | Biba (integrity) | |
|---|---|---|
| Protects | Secrets don't leak down to lower clearances | Garbage doesn't flow up into trusted data |
| Read rule | No read up — you can't read above your level | No read down — you can't read below your level |
| Write rule | No write down — you can't write below your level | No write up — you can't write above your level |
| Slogan | "Read down, write up" | "Read up, write down" |
Why the rules must be mirror images:
- Bell-LaPadula asks "how do I stop a secret leaking to someone not cleared for it?" A Secret-cleared analyst may read Confidential files (down) but must not write into a Public file (down), or they could copy Secret content into a place a Public user reads. Hence no write down.
- Biba asks the opposite: "how do I stop untrusted data corrupting trusted data?" A high-integrity process may read other high-integrity data but must not read low-integrity input (down) that could poison it, and must not let low-integrity actors write up into it. Hence no write up.
The one-line intuition: information should only ever flow toward your own level from the direction that keeps the property. Confidentiality wants data to flow up the lattice; integrity wants it to flow down. Enforce one and you get BLP; enforce the mirror and you get Biba.
Tip: Remember them as a pair — "Bell-LaPadula = Privacy/secrecy; Biba = integrity." A real system rarely uses either in pure form (they're too rigid), but they're the reference models every MAC scheme is measured against.
Go deeper:
Bell–LaPadula model (Wikipedia) — the simple-security and star (*) properties for confidentiality.- Biba Model (Wikipedia) — the mirror-image integrity rules.