STANAG

You are currently browsing articles tagged STANAG.

Confidentiality Metadata-based Access Control (CMBAC) core to enabling NATO Data-Centric Security (DCS) vision and strategy

December 3, 2025 in STANAG, Uncategorized by xmlspif | No comments

DCS is recognised as a key enabler for NATO to evolve towards digital transformation exploiting new technologies and processes that treats data as a strategic resource to help inform timely decision making at all political and military levels across multiple domains of operations.

NATO vision for DCS is to deliver shareable, timely and reliable information: protected at source; and, controlled for life.

NATO strategy for implementing DCS is evolutionary defined by three Maturity Levels (MLs), whereby each ML facilitates interoperability and builds ontop of each other to reach the defined end-state.

DCS ML 1: Basic Labelling (DCS-1) – Facilitated by the NATO standards (STANAG 4774, STANAG 5636 and STANAG 4778) to provide consistent, reliable and trustworthy labelling with metadata associated for use with all common types of file formats and core services. Use of the XMLSPIF is fundamental for ensuring confidentiality metadata (STANAG 4774 confidentiality label and confidentiality clearance) is consistently applied and consistently displayed based upon the governing security policy that is being enforced.

DCS ML 2: Enhanced Labelling (DCS-2) – Facilitated by the emerging NATO standard (STANAG 5663) to provide federated identity and access management (FIAM) and facilitate attribute-based access control (ABAC). The “Holy Trinity” (not George Best, Dennis Law and Sir Bobby Charlton) of STANAG 4774 confidentiality label, STANAG 4774 confidentiality clearance and XMLSPIF are used to provide Confidentiality Metadata-based Access Control (CMBAC; pronounced as “Come Back“), fundamental for facilitating ABAC. XMLSPIF specifies the rules for how CMBAC is enforced based upon comparing the confidentiality metadata value domains provided in a STANAG 4774 confidentiality label (associated with a resource) against a STANAG 4774 confidentiality clearance (associated with a Subject i.e. a user, application, device or service). Implementation of CMBAC (as illustrated below), through the ratification of ADatP-5663: Federated Identity, Credentials and Access Management, is recognised as a core capability for evolving NATO DCS vision and strategy towards achieving DCS-2.

cmbac

DCS ML 3: Cryptographic Protection (DCS-3) – NATO are currently developing an interoperable, standardised and federated approach for achieving DCS-3.

Tags: , , ,

XMLSPIF used in STANAG to describe Security Labelling Policy

November 9, 2017 in Uncategorized by Graeme Lunt | No comments

The goal of the Research Task Group in Cross Domain Security Solutions (IST-068/RTG-031) of the NATO Science and Technology Organization (STO)  was to improve the sharing of information in military environments and to facilitate the evolution of a flexible infrastructure by utilizing the eXtensible Markup Language (XML) to create suitable security solutions.

In 2010, the group published for a proposal for an XML Labelling and Metadata Binding specification.

This work has gone on to be developed into two new Standards Agreements (STANAGS), which in turn, are cover documents for the associated Allied Data Publications (ADatPs)):

  • STANAG 4774 – Confidentiality Metadata Label Syntax – an XML schema that can be used to represent a confidentiality (security) label.
  • STANAG 4778 – Metadata Binding Mechanism - an XML Schema that can be used to bind arbitrary metadata (including metadata that uses the confidentiality metadata label syntax, to pieces of information.

Both of these STANAGs are currently in the process of being ratified by the NATO Nations.

STANAG 4774 defines the structure of a confidentiality label, which includes elements such as the policy identifier, classifications and security categories. The non-normative Annexes B and D of STANAG 4774 provide descriptions of two security labelling policies, “NATO” and “PUBLIC”, in the form of Security Policy Information Files (SPIFs), which provide the value domains for the elements of the confidentiality label.

The SPIFs in the STANAG obviously can only contain a snapshot of the NATO security labelling policy, as new categories are added and removed to support missions and exercises. However, an up-to-date SPIF is maintained in the NATO Metadata Registry and Repository (NMRR) (login required), along with the STANAG 4774 and 4778 XML schemas, and other associated artefacts.

 

 

Tags: , ,