Security theory for data flow and access control: From partial orders to lattices and back, a half-century trip

2025-09-12

AI Summary

Classical lattice-based models for multilevel secure data flow control suffer from structural limitations, failing to express non-lattice, fine-grained data dependencies and directional flow constraints. Method: This work proposes an alternative modeling framework grounded in partial order theory. It formally compares the expressive power of classical models (e.g., Bell-LaPadula) against lattice models and integrates attribute-based access control (ABAC) to design and validate a practical, non-lattice data flow network prototype. Contribution/Results: Experimental evaluation demonstrates that the partial-order model significantly outperforms traditional lattice models in supporting dynamic policies, heterogeneous subjects, and complex interdependencies—enhancing both flexibility and practicality of security policies. The study advances access control theory beyond monolithic lattice algebra toward diverse mathematical structures, establishing a novel paradigm for next-generation adaptive data flow security mechanisms.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Reasoning under Uncertainty: Relational Probabilistic Models
• Planning, Routing, and Scheduling: Model-Based Reasoning

Application Category

• Security and Privacy: Authentication, authorization, and access control
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

The multi level Bell La Padula model for secure data access and data flow control, formulated in the 1970s, was based on the theory of partial orders. Since then, another model, based on lattice theory, has prevailed. We present reasons why the partial order model is more appropriate. We also show, by example, how non lattice data flow networks can be easily implemented by using Attribute-based access control (ABAC).

Problem

• Comparing partial order and lattice models for data security
• Arguing partial orders are better for access control
• Implementing non-lattice data flow with ABAC

Innovation

• Advocates partial order over lattice theory
• Uses ABAC for non-lattice networks
• Enables flexible data flow implementation