Sapphire

Security Classifications

A SPIF specifies a number of Security Classifications, such as “SECRET”. A security label has a single classification, and a security clearance has a list of classifications. Sapphire can edit several classification elements.

• Number, which is used to encode the classification in a label or clearance.
• Hierarchy, which can be different from number and is used for label handling.
• Foreground and Background colour.

Security Categories

A SPIF can specify one or more Security Categories and allowed values for each category.  This allows qualification of a label’s basic classification. Security Categories define the following information:

• A string value that is encoded in a label when using NATO format.
• Object Identifier. A unique identifier of the category, encoded in a label.
• Category Type (Permissive, Restrictive, or Informative), which controls how access control (CMBAC) is applied for the category.
• How category values are encoded in a label (typically integer or bit string).

Each category value specifies a name and an encoding.

The SPIF controls how labels and clearances are displayed. There are four types of marking that can be configured:

1. This is mandatory and is the Unicode value that will be used for display to a user.
2. This is an alternative for use when a shorter label is preferred (e.g., NS as shorthand for NATO SECRET).
3. This is a variant with a restricted character set. This is used in scenarios where a constrained character set is needed.
4. This is a value that will be recognized as equivalent on user input (e.g., when mapping a marking to a label)

Short and Simple are optional and will default to the default if not specified.

Marking values are specified for Policy, Classification, Category Type, and Category Value.   This may be an empty string to support scenarios where an element of a label is hidden.

Marking Qualifiers can also be specified to control how the elements are bound together. For example, this controls the separators between category values. It enables specifying syntaxes to enable things like  “XXX SECRET RELTO CA, US AND UK”. This enables display markings to align to national and other policies.

Marking language can also be specified to support multi-language policies, such as NATO policy, which needs English and French marking. The screenshot above shows multi-language markings and the use of Simple to support markings without accents. Locale can be set in Sapphire to test label display in different languages. The following screenshot shows this with an example of all three output markings.

Sapphire enables configuring equivalent labels by allowing one or more equivalent policies to be loaded. Mappings of equivalencies can then be specified at both classification and category level. This is important for two scenarios:

1. Servers such as Isode M-Link and M-Switch will generally operate as a single policy. Equivalences can be used to support the use of labels from another policy (e.g., to mix NATO and National labels).
2. When performing policy mappings, as supported by Isode products, a SPIF of the outbound policy is used, with equivalence mapping from the inbound policy.

Sapphire provides many advanced capabilities, as described in the manual. Many of these are to support detailed alignment to specific security policy requirements. A few features of note:

• Classifications may be required to include certain categories, with control over which category values are required.
• Categories can be restricted to a specified list of classifications.
• Categories can be made mutually exclusive.

Categories can be made mutually dependent.

It is anticipated that Sapphire will primarily be used to modify existing policies. It is straightforward to create a brand new policy, as shown in the screenshots above. Sensible defaults and randomly generated numbers will be suggested to make things quick when there are no external requirements.

The Label and Clearance catalogs are important for both Isode UIs and Server Management tools. Sapphire can generate both label and clearance catalogs, by default using STANAG 4774 formats.

Catalogs can be generated with all values for very simple policies, but this would generate impossibly large catalogs for most policies. Sapphire provides an option for generating a fairly constrained list.

It also enables custom list generation.

Entries can then be added manually. It is anticipated that most useful catalogs will be generated manually.