A multilevel security(MLS)model with credibility characteristics was proposed to solve the problem of trusted subjects’ hidden security flaw and poor system usability in present MLS systems.By introducing credibility labels of subjects and objects and credibility evaluation functions in original BLP model

it can evaluate credibility of access requests as well as corresponding credibility variation of subjects and objects.Since this model establishes restriction mechanism against trusted subjects and assigns limited privileges to all subjects

it is more flexible and practicable than present security-label based MLS models.