Theory: Integrity Models (Biba & Clark-Wilson)
Access control (Week 6) answers who may change data. Integrity also needs rules about how data may change and which data may flow into trusted records. Security models write these rules down formally.
Why Do We Need Security Models?
A security model is a set of formal rules that describes how a system must behave to stay secure.
| Goal | Model(s) | Notes |
|---|
| Confidentiality | Bell-LaPadula (1973) | Protects secrets; built for the military. Not covered in detail in this course. |
| Integrity | Biba (1977), Clark-Wilson (1987) | Protect correctness. This week’s focus. |
The Biba Model
Biba gives every subject (user, process) and every object (data) an integrity level, and controls how data moves between levels.
| Level | MediCare Plus example |
|---|
| HIGH | Clinical record, lab system |
| MEDIUM | Staff workstation data |
| LOW | Patient portal, web forms |
Two rules:
- No Read Down: a high-trust process should not read low-trust data. The lab system should not import values from an unchecked web form.
- No Write Up: a low-trust user cannot write to high-trust data. A patient portal user cannot edit the clinical record.
Goal of Biba: stop low-trust data from contaminating high-trust data. Data may flow down the levels, never up.
Diagram loads as you scroll.
Common mistake: mixing Biba up with Bell-LaPadula. Bell-LaPadula (confidentiality) is the reverse: no read up, no write down, to stop secrets leaking downwards. Biba (integrity) is no read down, no write up, to stop dirt flowing upwards.
Limits of Biba
- Hard to maintain: every user and every data item needs a level, and real organizations change too fast.
- Trusted insiders: a high-level user can still write wrong or false data. Biba cannot stop fraud or errors by authorized people.
- No business process: Biba says who may write, but not how the change must happen.
So we need a model built for business: Clark-Wilson.
Clark-Wilson: Four Key Terms
| Term | Meaning | Hospital example |
|---|
| CDI (Constrained Data Item) | Data that must stay correct | Medication orders |
| UDI (Unconstrained Data Item) | Data from outside that is not trusted yet | A form a patient typed online |
| TP (Transformation Procedure) | The only approved way to change a CDI | The “Create Order” function |
| IVP (Integrity Verification Procedure) | A check that CDIs are still correct | Nightly pharmacy reconciliation |
Clark-Wilson: The Main Rules
- Well-formed transactions: data is changed only through approved procedures (TPs), never directly.
- Separation of duties: no single person can complete a whole critical process alone.
- Access triple: (User, TP, CDI). Each user may run only certain TPs on certain data.
- Audit: every TP writes a log, so every change can be traced.
Also: a UDI must be checked (validated) before it can become a CDI.
Diagram loads as you scroll.
Clark-Wilson in the Hospital
| Role | TP | What it does |
|---|
| Doctor | TP1: Create Order | Writes the medication order |
| Pharmacist | TP2: Verify Order | Checks dose, allergy, interactions |
| Nurse | TP3: Record Given | Scans patient and drug, gives dose |
- CDI: the medication order and the administration record.
- IVP: pharmacy compares drugs given with orders every night.
- Audit: each step logs who, what, and when.
Because three different roles run the three TPs, no one person can create, approve and give a drug alone: that is separation of duties built into the process.
Biba vs. Clark-Wilson
| Biba | Clark-Wilson |
|---|
| Main idea | Integrity levels (labels) | Business processes |
| Protects against | Low-trust data flowing up | Errors and fraud by authorized users |
| Main tools | No Read Down, No Write Up | TPs, separation of duties, audit |
| Best fit | Military, operating systems (e.g. Windows Mandatory Integrity Control) | Banks, hospitals, business systems |
Most real organizations use Clark-Wilson ideas every day, often without knowing the name: approval workflows, “four-eyes” checks, and audit logs are all Clark-Wilson.
Worked Examples
Exercise 1
In the HR system, the head nurse can enter her own overtime hours AND approve the payment for them. Which Clark-Wilson rule is broken?
A. Well-formed transaction B. Separation of duties C. Audit D. Integrity verification (IVP)
Show solution ↓Hide solution ↑
Solution
- The process has two steps: enter overtime (maker) and approve payment (checker).
- One person can do both steps, so she can complete the whole critical process alone and could pay herself for hours she did not work.
- The data may still be changed through proper TPs (so well-formed transactions hold) and may be logged (audit holds); the missing piece is a second, independent person.
Answer: B, separation of duties. Fix: a different manager must approve the head nurse’s own overtime.
Exercise 2
Apply Biba’s two rules to MediCare Plus:
- A lab system is configured to automatically import glucose values that patients type into a web form.
- A patient logged into the portal tries to edit his own diagnosis in the clinical record.
Show solution ↓Hide solution ↑
Solution
Place each subject and object on a level: lab system and clinical record = HIGH; patient portal and web forms = LOW.
- A HIGH process reading LOW data → violates No Read Down. Unchecked patient-typed values would contaminate trusted lab data.
- A LOW user writing to HIGH data → violates No Write Up.
Answer: 1 breaks No Read Down; 2 breaks No Write Up; both would let low-trust data contaminate high-trust data and must be blocked.
Exercise 3
A senior doctor has the highest integrity level in a Biba system. She enters a false diagnosis to support a fraudulent insurance claim. Can Biba stop this? Which model handles it better, and how?
Show solution ↓Hide solution ↑
Solution
- Biba only checks levels. A HIGH user writing to HIGH data is allowed, so Biba cannot stop it. This is the “trusted insider” limit of Biba.
- Clark-Wilson is designed for errors and fraud by authorized users:
- Well-formed transactions: the diagnosis can be changed only through an approved TP.
- Separation of duties: an insurance claim needs a second person (e.g. a coder or reviewer) to check it.
- Audit: the TP logs who entered the diagnosis and when, so the fraud can be traced.
- IVP: periodic checks (e.g. claims vs. treatment records) can detect mismatches.
Answer: No, Biba cannot stop fraud by a high-level user; Clark-Wilson handles it through TPs, separation of duties, audit and IVP.
Exercise 4
Classify each item as CDI, UDI, TP or IVP:
- A referral letter uploaded by a clinic outside the hospital
- The patient’s medication administration record
- The “Verify Order” function used by pharmacists
- A nightly job that compares drugs dispensed with medication orders
Show solution ↓Hide solution ↑
Solution
- Outside data, not yet trusted → UDI. It must be validated (e.g. checked by a doctor) before it becomes part of the record.
- Data that must stay correct → CDI.
- An approved procedure that changes a CDI (the order’s verification status) → TP.
- A check that CDIs are still correct → IVP.
Answer: 1 UDI, 2 CDI, 3 TP, 4 IVP.