MLS model

based on the Bell-La Padula (BLP) model

multi-level subject - its low level differs from its high level, it is trusted to handle data at any level in its range while maintaing proper separation among the different levels

multi-level object - used for the private state of multi-level subjects and for data sharing between multi-level subjects