<Li> Networks of systems . Later modeling work did address this topic . </Li> <Li> Policies outside multilevel security . Work in the early 1990s showed that MLS is one version of boolean policies, as are all other published policies . </Li> <P> The Strong Star Property is an alternative to the * - Property, in which subjects may write to objects with only a matching security level . Thus, the write - up operation permitted in the usual * - Property is not present, only a write - to - same operation . The Strong Star Property is usually discussed in the context of multilevel database management systems and is motivated by integrity concerns . This Strong Star Property was anticipated in the Biba model where it was shown that strong integrity in combination with the Bell--LaPadula model resulted in reading and writing at a single level . </P> <P> The tranquility principle of the Bell--LaPadula model states that the classification of a subject or object does not change while it is being referenced . There are two forms to the tranquility principle: the "principle of strong tranquility" states that security levels do not change during the normal operation of the system . The "principle of weak tranquility" states that security levels may never change in such a way as to violate a defined security policy . Weak tranquility is desirable as it allows systems to observe the principle of least privilege . That is, processes start with a low clearance level regardless of their owners clearance, and progressively accumulate higher clearance levels as actions require it . </P>

Bell and lapadula model for security and protection