MLSvisual: a visualization tool for teaching access control using multi-level security

Abstract

Information security continues to be a pressing issue for industry and government. Perhaps the two most fundamental mechanisms for controlling access to information are cryptography and access control systems. This paper presents MLSvisual, a tool that helps students learn the multi-level(Bell-LaPadula) access control model. MLSvisual allows students to create, explore, and modify an MLS policy through a graphical visualization system. A query system can be used by students to test their understanding of a given policy. Instructors can utilize a test function in the tool to assign an exercise or quiz, with answers sent to them via email. We also present the results of an evaluation of MLSvisual within a senior-level course on information security. This evaluation received positive feedback and showed that MLSviusal helped the understanding of the Bell-LaPadula model and enhanced the course. We believe that this user-level tool will help instructors to teach this material more effectively, and make teaching this material more practical in resource-constrained environments.