Biba Model¶

A mandatory access-control integrity model that orders subjects and objects by integrity level and restricts information flow to prevent lower-integrity data from contaminating higher-integrity state.

Version: v2 · 2026-09-19 · History
Domain-specific #: 3453
Domain group: Applied Sciences & Engineering
Origin domain: Computer Science & Software Engineering
Subdomain: Computer Security Models → Computer Science & Software Engineering

Core Idea¶

Biba's strict integrity policy is commonly summarized as no read down and no write up, the integrity-oriented dual of Bell-LaPadula confidentiality, with variants for invocation and dynamic policy. Labels order trust; reference-monitor rules test every read, write, and invocation against subject and object levels so permitted state transitions preserve the declared integrity invariant. The abstraction is therefore identified by a declared carrier, a transformation or constraint over that carrier, and an invariant that tells an analyst whether the named structure is genuinely present.

How would you explain it like I'm…

Keep the Good Notebooks Clean

Imagine some notebooks you trust a lot and some you don't trust much. The Biba rule says: don't copy from the untrusty notebooks into your head, and don't scribble into the extra-trusty notebooks if you're less trusty. That way, the good notebooks never get messed up by bad information.

No Read Down, No Write Up

The Biba Model is a set of security rules for computers that protects integrity, meaning keeping information correct and trustworthy. Every user, program and file gets a trust level. The main rules are 'no read down' (a trusted program shouldn't read from less trusted files, so it isn't fooled by bad data) and 'no write up' (a less trusted program can't write into more trusted files). The computer checks every read and write against these levels. It is like the mirror image of a well-known secrecy model that keeps secrets from leaking down to people who shouldn't see them.

Integrity Access-Control Model

The Biba model is a formal computer security policy focused on integrity rather than confidentiality. Subjects (users or processes) and objects (files, data) get integrity labels arranged in an order of trust. Its strict integrity policy is summarized as 'no read down, no write up': a subject may not read data of lower integrity, which could contaminate it, and may not write to objects of higher integrity, which it could corrupt. A reference monitor checks every read, write and invocation against these labels so that allowed actions preserve the integrity invariant. Biba is described as the dual of the Bell–LaPadula model, which protects confidentiality with 'no read up, no write down'. There are several variants, including rules for invocation and dynamic policies, so you need to say which one you mean.

The Biba integrity model is a formal access-control model in which integrity labels on subjects and objects form an ordered structure (a lattice with a dominance relation) expressing trust. Its strict integrity policy is commonly stated as 'no read down' (a subject may read only objects whose integrity dominates its own, the simple integrity property) and 'no write up' (a subject may write only objects whose integrity it dominates, the star integrity property), plus an invocation rule restricting calls to higher-integrity subjects. A reference monitor mediates every read, write and invocation so that all permitted state transitions preserve the integrity invariant: low-integrity information never flows into high-integrity objects. It is the integrity-oriented dual of Bell–LaPadula confidentiality. Biba also defined other variants, such as dynamic low-water-mark policies. Any concrete analysis must fix the subjects and objects, the lattice, the semantics of read, write and invoke, the transition rules, trusted subjects, any endorsement or declassification mechanism, covert channels, and which exact variant is being used.

Scope of Application¶

Biba Model belongs to computer security models and is useful where the analyst can specify the typed computer security models carrier, defining objects and relations, parameters, conventions, evidence, boundary cases, and comparison targets, then evaluate the subjects and objects, integrity lattice and dominance relation, read, write and invocation semantics, transition rules, trusted subjects, declassification or endorsement, covert channels, and exact Biba variant are explicit. The scope is broad within that domain but bounded by the need for the subjects and objects, integrity lattice and dominance relation, read, write and invocation semantics, transition rules, trusted subjects, declassification or endorsement, covert channels, and exact Biba variant are explicit.

Clarity¶

The abstraction clarifies a crowded vocabulary by making the subjects and objects, integrity lattice and dominance relation, read, write and invocation semantics, transition rules, trusted subjects, declassification or endorsement, covert channels, and exact Biba variant are explicit the center of the account. A claim should name the carrier, the governing operation or relation, the applicable assumptions, and the recognition test.

Manages Complexity¶

Without the abstraction, an analyst must reason directly over many local details: the carrier roles, admissibility assumptions, competing conventions, derived invariants, boundary cases, and proof or validation obligations specific to Biba Model. Biba Model compresses them into the roles in the structural signature. That compression permits comparison across instances without erasing the variables that determine validity. It also exposes which details may be varied safely and which are constitutive.

Abstract Reasoning¶

Identify the carrier. State what the elements, states, objects, or observations are: the typed computer security models carrier, defining objects and relations, parameters, conventions, evidence, boundary cases, and comparison targets. Reject examples whose alleged carrier belongs to a different problem.
Lock the constitutive rule. Express the subjects and objects, integrity lattice and dominance relation, read, write and invocation semantics, transition rules, trusted subjects, declassification or endorsement, covert channels, and exact Biba variant are explicit independently of one notation or implementation.

Knowledge Transfer¶

Knowledge transfers strongly among subfields of computer security models because they reuse the typed computer security models carrier, defining objects and relations, parameters, conventions, evidence, boundary cases, and comparison targets, Labels order trust; reference-monitor rules test every read, write, and invocation against subject and object levels so permitted state transitions preserve the declared integrity invariant., and type the carrier, state every parameter and convention in the definition, test that the subjects and objects, integrity lattice and dominance relation, read, write and invocation semantics, transition rules, trusted subjects, declassification or endorsement, covert channels, and exact Biba variant are explicit, compare the nearest accepted identity, and report counterexamples, uncertainty, and limiting cases.

Relationships to Other Abstractions¶

Current abstraction Biba Model Domain-specific

Parents (1) — outgoing typed relations

Biba Model is a kind of Data Integrity Prime

It remains its own entry because its identity is fixed by the subjects and objects, integrity lattice and dominance relation, read, write and invocation semantics, transition rules, trusted subjects, declassification or endorsement, covert channels, and exact Biba variant.

Hierarchy paths (2) — routes to 2 parentless roots

Biba Model → is a kind of Data Integrity → is a kind of Verification → is a kind of Evaluation → presupposes Comparison

Show alternative path (1)

Neighborhood in Abstraction Space¶

Biba Model sits in a crowded region of the domain-specific corpus (29^th percentile for distinctiveness): several abstractions share nearly its structure, so a description that fits it tends to fit its neighbors too.

Family — Cryptographic Protocols & Ciphers (15 abstractions)

Nearest neighbors

Abstract state machine — 0.89
Reachability problem — 0.89
State space (computer science) — 0.89
Decision table — 0.88
Reliability (computer networking) — 0.88

Computed from structural-signature embeddings · 2026-10-25