Biba Model


The Biba Model or Biba Integrity Model developed by Kenneth J. Biba in 1975, is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that subjects may not corrupt data in a level ranked higher than the subject, or be corrupted by data from a lower level than the subject.
In general the model was developed to address integrity as the core principle, which is the direct inverse of the Bell–LaPadula model.

Features

In general, preservation of data integrity has three goals:
This security model is directed toward data integrity and is characterized by the phrase: "read up, write down". This is in contrast to the Bell-LaPadula model which is characterized by the phrase "read down, write up".
In the Biba model, users can only create content at or below their own integrity level. Conversely, users can only view content at or above their own integrity level. Another analogy to consider is that of the military chain of command. A General may write orders to a Colonel, who can issue these orders to a Major. In this fashion, the General's original orders are kept intact and the mission of the military is protected. Conversely, a Private can never issue orders to his Sergeant, who may never issue orders to a Lieutenant, also protecting the integrity of the mission.
The Biba model defines a set of security rules, the first two of which are similar to the Bell–LaPadula model. These first two rules are the reverse of the Bell–LaPadula rules:
  1. The Simple Integrity Property states that a subject at a given level of integrity must not read data at a lower integrity level.
  2. The * Integrity Property states that a subject at a given level of integrity must not write to data at a higher level of integrity.
  3. Invocation Property states that a process from below cannot request higher access; only with subjects at an equal or lower level.

    Implementations