About the SPIF namespace

This schema document describes the Security Policy Information File (SPIF) namespace, in a form suitable for import by other schema documents.

A SPIF describes a security labelling policy including:

  • Policy - its name and other unique identifiers
  • Classifications - the valid classifications within the policy and their associated values for use within a security label and to support the access control decision function
  • Security Categories - the valid categories with the policy and their associated values for use within a security label and to support the access control decision function
  • Relationships - the relationships (e.g. required, excluded) between categories and classification and other categories
  • Equivalency - the equivalent values of classifications and categories in another policy
  • Marking - instructions how to generate a marking from classification and category values
  • Input - directions for how the user may enter free-form category values

A SPIF can be used to promote the consistent use of security labels and marking and may be used, for example, to

  • generate a semantically valid security label
  • generate a semantically valid security clearance
  • verify the validity of a security label
  • generate a corresponding marking
  • generate an equivalent security label in an alternate policy

See http://www.xmlspif.org for further information.

The version of the schema:

  • 1.0 - the original schema derived from SDN.801
  • 2.0 - updated to support for:
    • Validity period for the whole SPIF and individual category values
    • MarkingData and MarkingQualifier for privacyMark
    • MarkingData and MarkingQualifier for privacyMarks
    • MarkingData and MarkingQualifier for securityClassifications
    • Constrain the number of privacy mark values that can be selected
    • MarkingQualifier with tagCategory
    • Better constraints for the number of allowed tags from a tagset
    • DateFormat for Date category values
    • MarkingData and MarkingQualifier for an ObjectIDData
    • MarkingData and MarkingQualifier for a SPIF
    • Required categories for an equivalentPolicy
    • Required categories for an equivalentClassification
    • Equivalency between tag sets and allow required categories for a equivalentTagSet
  • 2.1 - small update for :
    • Additional markingCode for policy annotation.
    • Additional schema constraints

An Object IDentifier as a string, for example 1.3.26.1.

For further information see X.680 or www.oid-info.com

The Label and Certificate Value as an integer member type.

The Label and Certificate Value as a string member type.

Typically used for category values rather than classifications.

The Label and Certificate Value type, which is the union of the lacvInt and lacvString types.

This value is encoded within the classification and security categories in a security label or a security clearance (which may be held within a certificate).

The selection integer member type, which allows the specification of the maximum number of selections to be made.

The selection string member type, which have specific values:

  • unbounded - any number of selections can be made.

The selection type, which is the union of the selectionInt and selectionString types, allows the specification of the maximum number of category values that can be made.

The equivalencyAction type indicates the action to be performed on a category value when mapping a security label to an equivalent policy.

The values are:

  • discard - it is acceptable that the original category value has no mapping. The tagSetId and lacv will not be used.

The operation type indicates how many of the categories within an optionalCategoryGroup are required.

The values are:

  • onlyOne - only one of the values identified within the optionalCategoryGroup are required.
  • oneOrMore - one or more of the values identified within the optionalCategoryGroup are required.
  • all - all of the values identified within the optionalCategoryGroup are required.

The format of a tagCategory value that can be entered by the user.

The values are:

  • string - an arbitrary string
  • integer - an unsigned integer
  • date - a date in the format defined by the dateFormat attribute.

The hierarchy type represents the hierarchical value of a classification, as opposed to the value that will be placed into a security label or certificate (the lacv).

The hierarchy value is used to determine the dominance of classification values, for example, when making an access control decision.

Classification name - the name of a classification (limited to a maximum of 256 characters).

The classification name is the default marking phrase for the classification.

The classification name is also used to identify any classifications that are excluded by a tagCategory.

An instance of a className type which is referenced by the tagCategory type.

Policy name - the name of a policy (limited to a maximum of 256 characters).

The policy name is also used to identify the policy for equivalent policies, classifications and categoryTags.

Marking phrase - a string (limited to a maximum of 256 characters) that will be used in generation a marking from a security label.

Multiple marking phrases may be concatenated to generate the final marking, and different marking phrases may be used in different locations.

Tag Set Name - the name (limited to a maximum of 256 characters) of a set of tags (or categories).

Generalised Time - a string (limited to a maximum of 256 characters) that represents a time.

It may take one of three forms:

  • Local time - `YYYYMMDDHH[MM[SS[.fff]]]', where the optional fff is accurate to three decimal places.
  • Universal time (UTC time, or Zulu time) - `YYYYMMDDHH[MM[SS[.fff]]]Z'.
  • Offset from Universal time. `YYYYMMDDHH[MM[SS[.fff]]]+-HHMM'

Note that these formats are not currently enforced within the type.

Marking Code - the location to display a marking phrase.

The values are:

  • pageTop - Display on top of the page or viewing area e.g. header.
  • pageBottom - Display on bottom of the page or viewing area e.g. footer.
  • pageTopBottom - Display on top and bottom of the page or viewing area e.g. header and footer.
  • documentStart - Display at the start of document e.g. cover page
  • documentEnd - Display at the end of document e.g. end page
  • noNameDisplay - Do not display of the classification or security category name; only display the marking phrase.
  • noMarkingDisplay - Do not display marking phrase on output; display marking phrase only during operator input
  • suppressClassName - Do not display of the classification name, but display security category.
  • firstLineOfText - Display on the first line of the body text e.g. the body text of an email message.
  • lastLineOfText - Display on the last line of the body text e.g. the body text of an email message.
  • subject - The subject of an email message.
  • xHeader - The header of an email message. The actual header name is held within the prefix qualifier.
  • portionMarking - Display on a portion of a document
  • inputTitle - Display a title, or label, on a GUI element. The title will be held within the prefix qualifier.
  • waterMark - Display as a watermark behind the main text of a document.
  • replacePolicy - Replace the policy marking phrase.

An instance of a markingCode type which is referenced by the markingData type.

Tag Type - the type of tag category.

The values are:

  • notApplicable - not applicable
  • restrictive - bit set of tag categories where all of the selected tag categories are required in the security clearance.
  • enumerated - integer set of tag categories, with tag further refined by the enumType.
  • permissive - bit set of tag categories where at least one of the selected tag categories are required in the security clearance
  • tagType7 - (or informative) tag categories; informative tag categories are not used in the access control decision function.

Enum Type - the type of an enumerated tag category.

The values are:

  • restrictive - tag categories where all of the selected tag categories are required in the security clearance.
  • permissive - tag categories where at least one of the selected tag categories are required in the security clearance

Tag7 Encoding - the type of tagType7 (informative) tagType.

The same value must be used for all tagType7 tag categories within a category tag set.

The values are:

  • bitSetAttributes - bit set values
  • securityAttributes - integer set value c.f. enumerated permissive or restrictive

Qualifier Code - indicates how a markingQualifier is to be applied

The values are:

  • prefix - as a prefix to the values
  • suffix - as a suffix to the values
  • separator - as a separator between the values

Use this value to indicate that the equivalency may be applied when considering the security clearance of the recipient.

The values are:

  • encrypt - by the originator (e.g. before sending an email to the recipient)
  • decrypt - by the recipient (e.g. before opening an email)
  • both - by both the originator (e.g. before sending an email to the recipient) and recipient (e.g. before opening an email)

The color W3C member type, which allows the specification of a color using a standard W3C color name.

The color RGB member type, which allows the specification of a color using Red Green Blue (RGB) values.

The color type, which is the union of the colorW3C and colorRGB types, allows the specification of a color.

A group of attributes that determine the period in which the associated element is valid

An individual category within a tag set or all categories within a tag set.

Typically, these will be used to indicate required or excluded categories for classifications or other categories.

It consists of:

  • tagSetRef- the tag set of the category
  • tagType - the tag type of the category
  • enumType- if the tagType is enumerated, indicates the type of the enumerated tag type
  • lacv- the lacv of the specific category
  • all - boolean indicating if all category values in the tag set are being selected

One, and only one, of lacv or all should be present.

An instance of a optionalCategoryData type which is referenced by the optionalCategoryGroup type.

An instance of a optionalCategoryData type which is referenced by the tagCategory type to indicate the excluded tagCategories.

A group of categories together with an associated operation that indicates how many should be selected.

Typically, this will be used to indicate required categories.

It consists of:

  • categoryGroups - one or more category groups
  • operation - indicating how many of the categories identified in the category groups should be selected.

An instance of an optionalCategory type which is referenced by the equivalentSecurityTagSet, equivalentClassification, equivalentPolicy, securityClassification and tagCategory types to indicate the required tagCategories.

The updateInfo type is not currently defined.

Identifies the equivalent classification that should be used in an equivalent label in the target policy.

It may also include a set of categories from the specified policy that must also be included in the equivalent label.

It consists of:

  • policyRef - the policy of the equivalent security label. The policyRef must be declared in the equivalentPolicies.
  • lacv - the lacv of the securityClassification in the policy
  • applied - when the equivalency should be applied.
  • requiredCategories - the categories that must be included in the equivalent security label

An instance of a equivalentClassification type which is referenced by the securityClassification type.

Identifies the equivalent policies into which a label from the SPIF policy may be mapped.

It consists of:

  • name - the name of the equivalent policy
  • id - the id of the equivalent policy
  • userRefURI - a URI to user documentation on how the equivalent policy should be used
  • docRefURI - a URI that describes the equivalent policy and its associated classification and category values.
  • requiredCategory - categories that must be included in the equivalent label

An instance of an equivalentPolicy type which is referenced by the equivalentPolicies type.

The set of all equivalent policies for which equivalent classifications and equivalent categories are defined for the SPIF policy.

It consists of:

  • equivalentPolicy - one or more equivalent policies

An instance of an equivalentPolicies type which is referenced by the SPIF element.

The privacyMark type describes a privacy mark that may be used in security label.

It consists of:

  • name - the privacy mark to be used within the label.
  • obsolete - whether the privacy mark can be used in newly created security labels
  • markingData - the marking information for the privacy mark
  • markingQualifier - qualifies the markingData associated with a privacy mark (e.g. it specifies a suffix or a prefix).

An instance of a privacyMark type which is referenced by the privacyMarks type.

The privacy marks that may be used in the label.

It consists of:

  • privacyMark - one or more privacy marks that can be used within the label.
  • markingData - the marking information for the privacy marks
  • markingQualifier - qualifies the markingData associated with a privacy marks (e.g. it specifies a suffix or a prefix).
  • maxSelection - the maximum number of privacy marks that can be selected
  • minSelection - the minimum number of privacy marks that must be selected

An instance of a privacyMarks type which is referenced by the SPIF element.

The markingData identifies the marking information attached to the data object

It consists of:

  • phrase - the marking phrase
  • code - a sequence of marking codes which identifies where the marking phrase is to be physically applied.

If the markingPhrase is absent, then the markingCode applies to the SecurityClassification classificationName, TagCategories secCategoryName or SPIF securityPolicyId name, depending on the component the markingData is associated with.

An instance of a markingData type which is referenced by the objectIdData, securityClassifications, securityClassification, tagCategory, privacyMarks and privacyMark types and the SPIF element.

The securityClassification identifies a valid classification within the policy

It consists of:

  • name - the name used of the security classification
  • color - the color associated with the security classification (e.g. in which to render a marking)
  • lacv - the label and certificate value (lacv) to be used in the security label
  • hierarchy - the relative level of the classification to other classifications
  • obsolete - whether the classification value can be used in newly created security labels
  • equivalentClassification - the equivalent classification in a different security policy
  • markingData - the marking information for the classification
  • markingQualifier - qualifies the markingData associated with a classification (e.g. it specifies a suffix or a prefix).
  • requiredCategory - the category values that must also be present if this classification is selected.

An instance of a securityClassification type which is referenced by the securityClassifications type.

The securityClassifications type identifies the valid security classifications within the policy

It consists of:

  • securityClassification - a set of security classifications defined within the policy
  • markingData - the marking information for the security classifications
  • markingQualifier - qualifies the markingData associated with security classifications (e.g. it specifies a suffix or a prefix)
  • name - name of the set of security classifications

An instance of a securityClassifications type which is referenced by the SPIF element.

The equivalentSecCategoryTag type identifies an equivalent secCategoryTag in a different security policy

It consists of:

  • policyRef - the policy of the equivalent security label. The policyRef must be declared in the equivalentPolicies.
  • tagSetId - the id of the equivalent securityCategoryTagSet
  • tagType - the tag type of the equivalent securityCategoryTag within the equivalent securityCategoryTagSet
  • enumType - the enumerated type of the equivalent securityCategoryTag within the equivalent securityCategoryTagSet if the tagType=enumerated
  • lacv - the label and certificate value of the equivalent tagCategory
  • applied - when the equivalency should be applied (e.g. on origination, on reception)
  • action - the action to be performed on the equivalent tagCategory

An instance of an equivalentSecCategoryTag type which is referenced by the tagCategory type.

The tagCategory type identifies a tagCategory in a given securityCategoryTag. For example, a value within the "Releasable To" securityCategoryTag.

It consists of:

  • equivalentSecCategoryTag - the equivalent categoryTags in other security policies
  • markingData - the marking information for the tagCategory
  • markingQualifier - qualifies the markingData
  • excludedClass - securityClassifications which must not be selected if this tagCategory is selected
  • requiredCategory - tagCategories that must be selected if this tagCategory is selected
  • excludedCategory - tagCategories that must not be selected with this tagCategory is selected
  • name - the name of the tagCategory
  • lacv - the label and certificate value of the tagCategory
  • userInput - allows the user to specify a value of a given format
  • dateFormat - the format of the date to use if userInput=date
  • requiredClass - securityClassification that must be selected if the tagCategory is selected
  • obsolete - whether the tagCategory can be used in newly created security labels
 Format as defined in ISO 8601

An instance of an tagCategory type which is referenced by the securityCategoryTag type.

The qualifier type identifies a set of qualifiers.

It consists of:

  • markingQualifier - the marking phrase to be used
  • qualifierCode - where the markingQualifier is to be applied

An instance of a qualifier type which is referenced by the markingQualifier type.

The markingQualifier type contains information that qualifies the markingData associated with a data object (e.g. it specifies a suffix or a prefix).

It consists of:

  • qualifier - a qualifier (e.g. a suffix, prefix or separator)
  • markingCode - a code which identifies where the qualifier is to be applied.

An instance of a markingQualifier type which is referenced by the objectIdData, securityClassifications, securityClassification, securityCategoryTag, tagCategory, privacyMarks and privacyMark types and the SPIF element.

The securityCategoryTag type provides information to qualify the markingData associated with a data object (e.g. it specifies a suffix or a prefix).

It consists of:

  • tagCategory - a set of tagCategories
  • markingQualifier - qualifies the markingData associated with the tagCategories (e.g. it specifies a separator between tagCategories).
  • name - the name of the securityCategoryTag
  • tagType - the type of the tagCategory
  • enumType - the type of the tagCategory if tagType=enumerated
  • tag7Encoding - the encoding of tagCategory values if tagType=tagType7 (informative)
  • singleSelection - whether only a single may be selected (equivalent to maxSelection=1)
  • maxSelection - the maximum number of tagCategories that may be selected
  • minSelection - the minimum number of tagCategories that must be selected

An instance of a securityCategoryTag type which is referenced by the securityCategoryTagSet type.

The securityCategoryTagSet type contains information about a given securityCategoryTagSet (e.g. "Relesable To"), including the allowed values.

It consists of:

  • securityCategoryTag - the set of securityCategoryTags
  • equivalentSecurityCategoryTagSet - the equivalent securityCategoryTagSet in a different policy

An instance of a securityCategoryTagSet type which is referenced by the securityCategoryTagSets type.

The equivalentSecurityCategoryTagSet type contains information for mapping a securityCategoryTagSet to a equivalent securityCategoryTagSet in a different policy which contains the same tagCategory values.

It consists of:

  • policyRef - the policy of the equivalent security label. The policyRef must be declared in the equivalentPolicies.
  • name - the name of the equivalent securityCategoryTagSet in a different policy
  • id - the id of the equivalent securityCategoryTagSet in a different policy
  • requiredCategory - aditional tagCategories that are required in addition to the mapped values

An instance of a equivalentSecurityCategoryTag type which is referenced by the securityCategoryTagSet type.

The securityCategoryTagSets type contains the list of securityCategoryTagSet defined with the security policy.

It consists of:

  • securityCategoryTagSet - the tag sets

An instance of a securityCategoryTagSets type which is referenced by the SPIF element.

The objectIdData type contains information about the security policy identifier and how it should be rendered in a marking.

It consists of:

  • markingData - the marking information for the security policy identifier
  • markingQualifier - qualifies the markingData associated with security policy identifier (e.g. it specifies a suffix or a prefix).
  • name - a unique name for the security policy identifier
  • id - a unique id (object identifier) for the security policy identifier
    •

    An instance of a objectIdData type which is referenced by the SPIF element.

    An instance of a objectIdData type which is referenced by the SPIF element.

    An element where vendor or community of interest extensions can be placed to augment the processing of the SPIF.

    An instance of an extensions type which is referenced by the SPIF element.

    The complete Security Policy Information.

    It consists of:

    • defaultSecurityPolicyId - identifies the security policy which will apply if data is received without a security label
    • securityPolicyId - identifies the security policy to which the SPIF applies
    • updateInfo - not currently used
    • securityClassifications - the set of security classifications defined within the policy, together with their equivalency mappings
    • securityCategoryTagSets - the set of security category tags defined within the policy, together with their equivalency mappings
    • privacyMarks - the set of privacy marks defined within the policy, together with their equivalency mappings
    • equivalentPolicies - consolidated list of all equivalent policies used within the SPIF
    • markingData - the marking information for the security policy
    • markingQualifer - qualifies the markingData associated with a security policy
    • extensions - provides a mechanism to include additional capabilities as future requirements are identified.
    • schemaVersion - the version of the schema being used
    • version - the version of the SPIF. Changes to the SPIF will generally update the version.
    • creationDate - the date the SPIF was created/updated
    • originatorDN - the distinguished name (DN) of creator of the SPIF, using an LDAP encoding as defined in RFC 4514.
    • keyIdentifier identifies the key used to sign the SPIF.
    • privilegeId - identifies the syntax that is included in the clearance attribute security category of relying certificates
    • rbacId - identifies the syntax of the security category that is used in conjunction with the SPIF
    • userRefURI - a reference to a document that provides further information on the use of the values defined within the SPIF.
    • docRefURI - a reference to a document that provides information on the values defined within the SPIF.
    • validity - the validaty of the SPIF (e.g. it may only be used for a specific exercise)

    The SPIF also include some constraints to ensure the uniqueness and referential integrity of the elements within the SPIF. These include:

    • uqPolicyId - ensures that all PolicyId idf attributes referenced within the SPIF are unique
    • refPolicy2 - ensures that all equivalentSecCategoryTag policyRef attributes reference a declared PolicyId within the SPIF
    • refPolicy1 - ensures that all equivalentClassification policyRef attributes reference a declared PolicyId within the SPIF
    • uqClass - ensures that all securityClassification lacv (label and certificate value) attributes are unique
    • uqClassColor - ensure that all securityClassification color attributes are unique
    • refClass1 - ensure that all tagCategory requiredClass attributes reference a declared securityClassification within the SPIF
    • refClass2 - ensure that all excludedClass elements reference a declared securityClassification within the SPIF
    • uqSecurityCategoryTagSetId - ensure that all securityCategoryTagSets have a unique id
    • refTagSet1/3 - ensure that all requiredCategory tagSetRef attributes reference a declared securityCategorySet within the SPIF
    • refTagSet2 - ensure that all excludedCategory tagSetRef attributes reference a declared securityCategorySet within the SPIF