EditWYSIWYGAttach PDF Raw View►More Actions▼More Actions


Restore topic to revision: You will be able to review the topic before saving it to a new revision

Copy text and form data to a new topic (no attachments will be copied though).
Name of copy:
You will be able to review the copied topic before saving

Rename/move topic... scans links in all public webs (recommended)
Rename/move topic... scans links in CBI_ComputerSecurity web only
Delete topic... scans links in all public webs (recommended)
Delete topic... scans links in CBI_ComputerSecurity web only

Revision Date Username Comment
1726 Feb 2015 - 13:34ThomasMisa 
1602 Dec 2014 - 12:09ThomasMisa 
1522 Oct 2013 - 12:46ThomasMisa 
1403 Oct 2013 - 15:25norqu036? 
1324 Jun 2013 - 09:23NicLewis 
1219 Jun 2013 - 13:48ThomasMisa 
1103 Jun 2013 - 11:02NicLewis 
1003 Jun 2013 - 10:58NicLewis 
920 May 2013 - 10:15NicLewis 
817 May 2013 - 11:46NicLewis 
earlier first

Render style:     Context:


 History: r17 | r13 < r12 < r11 < r10
[X] Hide this message.
Notice: On June 30, 2016, UMWiki service will be decommissioned. If you have information in UMWIki that needs to be preserved, you should make plans to move it before that date. Google Sites is anticipated to be the most popular and appropriate alternative for users because it offers a more modern and user-friendly interface and unlimited capacity. To learn more about the features of Google Sites and other alternatives, and to identify which one best fits your needs, see the University’s Website Solution Selection Guide. If you have concerns or would like help regarding this change and your options, please contact Technology Help at help@umn.edu
You are here: UMWiki>CBI_ComputerSecurity Web>Publications>PubBibaModel (revision 11)

Biba Model

 

The Biba Model (or Biba Integrity Model) was first published in 1975, then revised in 1977, approximately one year after the Bell-LaPadula Model of computer security. Like Bell-LaPadula, the Biba model, named after Kenneth Biba, was developed at the MITRE Corporation as part of the United States Air Force Electronic Systems Division's Secure General Purpose Computer Project. The Bell-LaPadula and Biba models represented two somewhat different conceptualizations of what constituted computer security. The principle concern in computer security research for Department of Defense agencies during the 1970s was of data confidentiality, the prevention of unauthorized subjects (human or software) viewing data above their assigned security classification. This represented the primary concern of the Bell-LaPadula Model, which ensured that a subject could not read data of a higher security classification, nor could it write down to data of a lower classification. The Biba Model addresses the concern of data integrity, attempting to ensure that data cannot be altered without authorization. This includes not only malicious alterations, but accidental changes, as well. The Biba model employs a system of integrity labels whose properties follow the counterpoint of Bell-LaPadula. According to the Biba model's "Simple Integrity Property," a subject may alter an object if the subject has an integrity level greater than the object being modified. Subjects also must not read-down to objects of a lower integrity level. The Biba model's "Invoke Property" allows subjects to call upon another subject, such as a program, to access and potentially alter an object. However, that program, once it has been used to read data of a lower integrity level, the system will not allow that program to alter data of a higher integrity level, preventing "contamination" of the higher level data. While David Bell, of the Bell-LaPadula model, stated that the Biba model was not strong in implementation, he argued that it was important for drawing attention to the issue of data integrity.(1)(2)(3)(4)

Notes

1 : Dieter Gollman, "Security Models," 628-629, in Karl de Leeuw and Jan Bergstra, eds., The History of Information Security: A Comprehensive Handbook, (Oxford, UK: Elsevier, 2007), 595-621.

2 : lock Kenneth J. Biba, "Integrity Considerations for Secure Computer Systems", MTR-3153, The Mitre Corporation, April 1977, 5, 9. (Log-in required)

3 : Jeffrey R. Yost, "An Interview with David Elliott Bell, OH 411," Charles Babbage Institute, 2012, 40-41.

4 : lock David D. Clark and David R. Wilson, "A Comparison of Commercial and Military Computer Security Policies," 191, in Proceedings of the 1987 IEEE Symposium on Research in Security and Privacy, Oakland, CA: IEEE Press, May 1987, 184–193. (Login required)


Edit | WYSIWYG | Attach |  PDF |  History: r17 | r13 < r12 < r11 < r10 |  Backlinks |  Raw View | More topic actions...
Topic revision: r11 - 03 Jun 2013 - 11:02:15 - NicLewis
 
Signed in as lewi0740 (NicLewis) | Sign out
UMWiki UMWiki
This site is powered by FoswikiCopyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding UMWiki? Send feedback