REASONING Computer ABOUT SECURITY MODELS

A method for evaluating security models is developed and applied to the model of Bell and LaPadula. The method shows the inadequacy of the Bell and LaPadula model, in particular,and the impossibilityof any adequate definitionof a secure system based solely on the notion of a secure state. The implications for the fruitfulnessof seeking a global definition of a secure system and for the state of foundational research in computer security, in general, is discussed. And so of the virtues, however many and different they may be, they have all a common nature which makes them virtues; and on this he who would answer the question, ‘What is virtue? ’ would do well to have his eye fixed. Plato,J4eno (B. Jowett trans.)72c6-dl For if you look at them you will not see something that is common to all, but similarities,relationships, and whole seriesof them at that...1can think of no better expression to characterize these similaritiesthan “family resemblance”... Wittgenstein [1, $66-7] If a concept fundamental to a mighty science gives rise to difficulties,then it is surely an imperative task to investigate it more closely until those difficultiesare overcome... Frege [2,p. II] 1