Label Support in XMPP Clients : Evolution from XEP-0258 to NATO DCS

Isode pioneered Security Label support in XMPP with the XEP-0258 standard, which is the way that deployed XMPP systems support security labels.  XEP-0258 gives a means of transporting a security label of any format along with a marking that the client displays without being aware of the security label details.  When sending a message, a client asks the server for a list of labels suitable for the destination.   This allows a server that performs access control checking to present the client with a list of labels it will accept.   This mechanism allows XMPP clients to handle security labels with very simple, lightweight support.  This approach has been widely adopted.

NATO is introducing a new Data-Centric Security (DCS) framework. This framework and Isode’s approach to it are described here.

This plan will result in several Isode product updates. The first of these is an update to Isode’s Swift product 6.2 release. This post looks at what has changed.

NATO DCS is based on STANAG 4774 Confidentiality Labels. STANAG 4778 specifies how these are transported in XMPP. A key difference from XEP-0258 is that labels will typically not include display markings, so an XMPP client needs to be able to parse and display Confidentiality Labels. Swift does this by using a SPIF (Security Policy Information File) that specifies the information needed to correctly display a Confidentiality Label. There are two advantages of this over the XEP-0258 approach:

• The actual label is displayed, which avoids problems with the marking and label being different
• Correct language can be selected, which is important for policies with multiple display languages (e.g., the NATO Security Policy supports English and French)

The XEP-0258 catalog approach continues to be used, using catalogs containing STANAG 4774 Confidentiality Labels.   This facilitates an approach where the server provides access control following the NATO Confidentiality Metadata-Based Access Control (CMBAC). NATO DCS needs more client-side capability, but the heavy lifting is still done by the server. Details here.

The following screenshot shows a catalog of DCS Confidentiality Labels presented by Swift, showing the CWIX 26 catalog rendered in French:

This drop-down selection is a convenient way for a user to select a frequently used label, which will be retained for messages until the user changes it.

A limitation of this model, inherent to XEP-0258, is that only these labels can be used. Most security policies permit a vast number of labels and catalogs, but they need to be limited to a small subset. To address this, Swift 6.2 allows users to create custom labels, enabling any desired Confidentiality Label to be used. The UI to achieve this is shown below:

As we have always done, we will work closely with NATO and the relevant national teams to ensure our products provide the right functionality to enable interoperability between nations in a simple, configurable way.