Articles by Graeme Lunt

You are currently browsing Graeme Lunt’s articles.

After being ratified by a quorum of NATO Nations, STANAG 4774, Metadata Confidentiality Label Syntax, has been promulgated (published) by NATO.

STANAG 4774 provides a XML syntax for representing a confidentiality label in an arbitrary policy, and includes information about the life-cycle of the confidentiality label e.g. when it should be reviewed.

An example of simple confidentiality label using the example AMOCO security policy, is shown below:


An XMLSPIF can be used to describe the value domains for the PolicyIdentifier, Classification, GenericValue (a category value), and PrivacyMark elements of the confidentiality metadata label.

The confidentiality metadata label syntax was designed to be used define metadata elements, with those metadata elements in turn being bound to information. STANAG 4774 defines two metadata elements that use the syntax:

  • originatorConfidentialityLabel – the confidentiality label assigned to the information by the originator
  • alternativeConfidentialityLabel – an confidentiality label in a different policy that is equivalent to the originatorConfidentialityLabel

The binding of metadata elements to information (both XML and non-XML) is the subject of a second STANAG, STANAG 4778, Metadata Binding Mechanism, which is expected to be ratified in 1Q18.

It is highly recommended that metadata elements which use the confidentiality metadata label syntax only use the STANAG 4778 binding mechanism to associate a confidentiality label with information.

STANAG 4774 is not openly available, so in order to obtain a copy of STANAG 4774, you should contact your National Technical Expert (NATEX).

The goal of the Research Task Group in Cross Domain Security Solutions (IST-068/RTG-031) of the NATO Science and Technology Organization (STO)  was to improve the sharing of information in military environments and to facilitate the evolution of a flexible infrastructure by utilizing the eXtensible Markup Language (XML) to create suitable security solutions.

In 2010, the group published for a proposal for an XML Labelling and Metadata Binding specification.

This work has gone on to be developed into two new Standards Agreements (STANAGS), which in turn, are cover documents for the associated Allied Data Publications (ADatPs)):

  • STANAG 4774 – Confidentiality Metadata Label Syntax – an XML schema that can be used to represent a confidentiality (security) label.
  • STANAG 4778 – Metadata Binding Mechanism - an XML Schema that can be used to bind arbitrary metadata (including metadata that uses the confidentiality metadata label syntax, to pieces of information.

Both of these STANAGs are currently in the process of being ratified by the NATO Nations.

STANAG 4774 defines the structure of a confidentiality label, which includes elements such as the policy identifier, classifications and security categories. The non-normative Annexes B and D of STANAG 4774 provide descriptions of two security labelling policies, “NATO” and “PUBLIC”, in the form of Security Policy Information Files (SPIFs), which provide the value domains for the elements of the confidentiality label.

The SPIFs in the STANAG obviously can only contain a snapshot of the NATO security labelling policy, as new categories are added and removed to support missions and exercises. However, an up-to-date SPIF is maintained in the NATO Metadata Registry and Repository (NMRR) (login required), along with the STANAG 4774 and 4778 XML schemas, and other associated artefacts.



Tags: , ,