Star Property (No Write Down)
The Bell-LaPadula rule that a subject cannot write to a lower classification level, stopping cleared users from leaking secrets into documents that lower clearances can read.
Full guide: Bell-LaPadula: No Read Up, No Write Down (CISSP)
The Star Property, written as the *-property and usually stated as No Write
Down, is the second rule of the
Bell-LaPadula model. A subject may write to an
object only at or above its own security level.
The point is easily missed on first reading: the rule is not protecting the lower-level document, it is protecting the higher-level information in the subject’s head. A Top Secret analyst pasting a paragraph into an Unclassified memo would move secrets to where anyone can read them, so the write is refused regardless of intent.
Where the rule sits among its siblings
| Rule | Model | Formal name | Protects | Direction blocked |
|---|---|---|---|---|
| Star Property (No Write Down) | Bell-LaPadula | *-property | Confidentiality | Writing to lower classification |
| No Read Up | Bell-LaPadula | Simple Security Property | Confidentiality | Reading from higher classification |
| No Write Up | Biba | Star Integrity Property | Integrity | Writing to higher integrity |
| No Read Down | Biba | Simple Integrity Property | Integrity | Reading from lower integrity |
Simple governs reading, Star governs writing, in both models. Together with No Read Up the Star Property closes both directions of leakage: you cannot look above your level, and you cannot carry what you already know below it. The Biba model mirrors the rule as No Write Up, protecting accuracy instead of secrecy.
A worked case
An analyst holds Secret clearance and is drafting an Unclassified briefing while a Secret intelligence summary is open in another window.
Under the Star Property the system refuses any write from the analyst’s Secret session into the Unclassified document, including a paste of text the analyst believes is harmless. The model does not evaluate the content, only the levels, which is what makes it enforceable by a machine. Getting that paragraph into the briefing legitimately requires declassification: a human authority decides the content is releasable and a trusted process moves it down.
That deliberate rigidity is the model’s design, not an oversight. In mandatory access control terms the label comparison is the whole decision, so a rule that depended on reading the text would not be a lattice rule at all.
The source
Bell-LaPadula is set out in D. E. Bell and L. J. LaPadula, Secure Computer
System: Unified Exposition and Multics Interpretation, MITRE Technical Report
MTR-2997 Rev. 1 (1976), produced for the US Air Force. The formal *-property
appears there alongside the simple security property and the discretionary
security property, the third and often forgotten rule requiring that an access
also be permitted by an access matrix.
Exam relevance: Star means write, in both models. A question quoting “Star Property” on its own conventionally means Bell-LaPadula’s No Write Down, while “Star Integrity Property” or integrity-axiom phrasing signals Biba’s No Write Up. Where a scenario gives only a direction, decide the model first from what it is worried about, disclosure or modification, and the direction follows. Scenarios in this area tend to reward noticing that a refused write is protecting information the subject already holds.
Frequently asked questions
- What is the Star Property in Bell-LaPadula?
- The Star Property, written as the *-property and usually stated as No Write Down, says a subject may write to an object only at or above its own security level. It stops a cleared subject moving classified information into a document that less-cleared readers can open. Star is the convention for the rule governing writing, as Simple is the convention for the rule governing reading.
- Why does the Star Property restrict writing downward rather than upward?
- Because the risk it addresses is the information already inside the subject. A Top Secret analyst carries Top Secret knowledge, so anything they write could contain it. Writing upward is harmless, since the destination is at least as protected. Writing downward moves that knowledge somewhere less protected, which is precisely the leak the model exists to prevent.
- What is the blind write problem in Bell-LaPadula?
- Permitting writes upward means a subject can write to objects it cannot read, so it can overwrite or append to a file whose contents it will never see. This is often called blind write or write-up, and it is a recognised awkwardness of the model rather than a flaw in it. Real systems normally constrain writes to the subject's own level, giving what is sometimes called the strong star property.
- Does the Star Property mean a general cannot write a memo to a private?
- Under the pure model, yes, and that is the standard illustration of why the rule is inconvenient in practice. Implementations resolve it with trusted subjects, which are processes exempted from the Star Property because they are trusted not to leak, and with formal declassification procedures that move information downward under human authority rather than by an ordinary write.