Sensitivity label translation
View Patent ↗A Sensitivity Label Translation system allows internal Compartmented Mode Workstation (CMW) format labels to be translated to SELinux policy labels and vice-versa. This translation occurs by mapping the internal CMW bit-mapped representation to predefined SELinux policy strings and vice-versa. Particular enabled CMW categories are converted into SELinux category strings and vice-versa. The respective category values and policies are unaffected.
1. A method of translating from a Compartmented Mode Workstation labeling encoding format to a SELinux policy language format, where the Compartmented Mode Workstation labeling encoding format includes first sensitivity classifications and categories represented as a binary mapping and the SELinux policy language format includes second sensitivity classifications and categories represented as policy strings of a pre-existing security policy defining relationships of persons and subjects within a system, comprising the steps of:
converting a first sensitivity classification to a corresponding second sensitivity classification policy string; and
converting each enabled category of the Compartmented Mode Workstation labeling encoding format to a policy string representing the enabled category in the SELinux policy language format.
2. A method as in claim 1 , comprising the further step of converting from a human readable sensitivity label to said Compartmented Mode Workstation labeling encoding format by selectively enabling the categories of the Compartmented Mode Workstation labeling encoding format based on the enabled categories in the human readable sensitivity label.
3. A method as in claim 1 , comprising the further step of representing the policy strings representing the enabled categories in the SELinux policy language format in a category compression format.
4. A method of translating from a SELinux policy language format to a Compartmented Mode Workstation labeling encoding format, where the SELinux policy language format includes first sensitivity classifications and categories represented as policy strings of a pre-existing security policy defining relationships of persons and subjects within a system and the Compartmented Mode Workstation labeling encoding format includes second sensitivity classifications and categories represented as a binary mapping, comprising the steps of:
converting a first sensitivity classification of the SELinux policy language format to a corresponding second sensitivity classification of the Compartmented Mode Workstation labeling encoding format; and
converting each category policy string of the SELinux policy language format to an enabled category in the binary mapping of the Compartmented Mode Workstation labeling encoding format.
5. A method as in claim 4 , comprising the further step of converting the Compartmented Mode Workstation labeling encoding format to a human readable sensitivity label by spelling out the enabled categories of the Compartmented Mode Workstation labeling encoding format.
6. A computer readable storage medium comprising:
a first code block that converts a first sensitivity classification of a Compartmented Mode Workstation labeling encoding format to a corresponding second sensitivity classification of a SELinux policy language format, where the Compartmented Mode Workstation labeling encoding format includes first sensitivity classifications and categories represented as a binary mapping and the SELinux policy language format includes second sensitivity classifications and categories represented as policy strings of a pre-existing security policy defining relationships of persons and subjects within a system; and
a second code block that converts each enabled category of the Compartmented Mode Workstation labeling encoding format to a policy string representing the enabled category in the SELinux policy language format.
7. A computer readable storage medium as in claim 6 , further comprising a third code block that converts a human readable sensitivity label to said Compartmented Mode Workstation labeling encoding format by selectively enabling the categories of the Compartmented Mode Workstation labeling encoding format based on the enabled categories in the human readable sensitivity label.
8. A computer readable storage medium as in claim 6 , wherein said second code block represents the policy strings representing the enabled categories in the SELinux policy language format in a category compression format.
9. A computer readable storage medium comprising:
a first code block that converts a first sensitivity classification of a SELinux policy language format to a corresponding second sensitivity classification of a Compartmented Mode Workstation labeling encoding format, where the SELinux policy language format includes first sensitivity classifications and categories represented as policy strings of a pre-existing security policy defining relationships of persons and subjects within a system and the Compartmented Mode Workstation labeling encoding format includes second sensitivity classifications and categories represented as a binary mapping; and
a second code block that converts each category policy string of the SELinux policy language format to an enabled category in the binary mapping of the Compartmented Mode Workstation labeling encoding format.
10. A computer readable storage medium as in claim 9 , further comprising a third code block that converts the Compartmented Mode Workstation labeling encoding format to a human readable sensitivity label by spelling out the enabled categories of the Compartmented Mode Workstation labeling encoding format.
11. A system for translating between a Compartmented Mode Workstation (CMW) sensitivity level format and a SELinux sensitivity level format, comprising:
a memory that stores sensitivity classification data for processing; and
a processor that is programmed to convert a sensitivity classification of the CMW sensitivity level format to a corresponding sensitivity classification of the SELinux sensitivity level format and vice-versa and that is programmed to convert each enabled category in a bit mapping of the CMW sensitivity level format to a policy string representing the enabled category in the SELinux sensitivity level format and vice-versa.
12. A system as in claim 11 , wherein said processor is further programmed to convert a human readable sensitivity label to said CMW sensitivity level format by selectively enabling the categories of the CMW sensitivity level format based on the enabled categories in the human readable sensitivity label.
13. A system as in claim 11 , wherein said processor is programmed to represent the policy strings representing the enabled categories in the SELinux sensitivity level format in a category compression format.