Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Introduction
A security label, sometimes referred to as a confidentiality label, is a structured representation of the
sensitivity of a piece of information. A security label is used in conjunction with a clearance, a structured
representation of what information sensitivities a person (or other entity) is authorized to access and a
security policy to control access to each piece of information. (XMPP)
Organizations typically have one or more security policies that provide for the compartmentalization of
data into groupings that are to be protected and handled in the same way. The security policy defines
the protection to be applied to each compartment.
The aspects of security expressed by a security policy, indicated in a security label, include the following:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
The level of protection to be given to data stored on a system;
Who is authorized to access data, processes or resources;
Security markings required to be shown on any display or print of the material;
Routing and enciphering requirements for data transmitted between systems;
Requirements for protection against unauthorized copying;
Methods for storage of data;
Enciphering algorithms to be used;
Methods of authenticating entities;
Whether operations on the object are to be audited;
Whether preventing repudiation of receipt of an object by recipients is required;
Whether, and whose, digital signatures are required to authenticate the data.
When data is held on an Information Technology (IT) system, or when it is transmitted electronically
between systems, the data are labeled to indicate the security compartment to which the data belongs
and thus how the data is to be handled for security. The label may be separately identifiable from the
protected information but is logically bound to it.
The integrity of the labels, and the integrity of their binding to the information, must be assured. This
allows IT systems and networks to make security-relevant decisions, such as access control and routing,
without the need to access the information that is being protected. The security label may be associated
with each data object in an IT system, such as documents, electronic mail messages, display windows,
database entries, directory entries and electronic forms.
The labels are intended for use when objects are stored, moved around (particularly between systems),
and when they are being handled by applications that act on labels, including applications that create
new objects from existing ones. When labeled data is to be passed between different security domains,
the domains should agree on a security policy to be applied to that data. If the labels specified by the
policy applied within a domain differ from the labels specified by the policy for shared data, then the
policy for the shared data shall specify how to translate between the two sets of labels.
Page 1
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Labels alone are not sufficient to ensure the security of information. The security policy that applies to
the information needs to be enforced by each organization while the labeled information is within the
scope of their control. All the organizations, individuals and IT systems that process an item of
information are presumed to know the security policy for that information.
Organizations that exchange information need to establish trust in one another to be satisfied that
information will be handled according to agreed security policies. This trust is usually established
through a formal agreement. (ITU-T X.841)
There are two principal models that apply to the HCS. The first is the Biba Integrity Model developed by
Kenneth J. Biba in 1977, is a formal state transition system of computer security policy that describes a
set of access control rules designed to ensure data integrity (Biba). The second is the Bell–LaPadula
Model of computer security policy that describes a set of access control rules which use security labels
on objects and clearances for subjects (Bell). In both the Biba model and the Bell and LaPadula model,
the security label is an attribute of the data. In general, the security label associated with the data
remains constant. Since the security label is an attribute of data, it should be bound to the data.
Definitions
Term
Definition
Access (Security) Level A level associated with an individual who may be accessing information (for
example, a clearance level) or with the information which may be accessed (for
example, a classification level). NRC
The combination of a hierarchical security classification and a security category
that represents the sensitivity of an object or the security clearance of an
individual.(ISO 2382-8)
Clearance
Initiator-bound access control information (ACI) that can be compared with
security labels of targets. ISO-10181-3
Confidentiality
The property that information is not made available or disclosed to
unauthorized individuals, entities, or processes (ISO 7492-2)
Compartmentalization A division of data into isolated blocks with separate security controls for the
purpose of reducing risk. (ISO 2382-8)
Example: The division of data relative to a major project into blocks
corresponding to subprojects, each with its own security protection, in order to
limit exposure of the overall project.
Page 2
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Healthcare
Classification System
(HCS)
A defined scheme for the classification, declassification, and handling of health
care and health care related information.
Security Classification
The determination of which specific degree of protection against access the
data or information requires, together with a designation of that degree of
protection. Examples: "Top secret", "secret", "confidential".(ISO 2382-8)
Security Label
The marking bound to a resource CCITT Rec. X.800 and ISO/IEC 7498-2
The means used to associate a set of security attributes with a specific
information object as part of the data structure for that object. NIST SP 800-53
The marking bound to a resource (which may be a data unit) that names or
designates the security attributes of that resource. NOTE - The marking and/or
binding may be explicit or implicit.(ISO 7498-2)
Sensitivity labels are security labels which support data confidentiality models,
like the Bell and LaPadula model. The sensitivity label tells the amount of
damage that will result from the disclosure of the data and also indicates which
measures the data requires for protection from disclosure. The amount of
damage that results from unauthorized disclosure depends on who obtains the
data; the sensitivity label should reflect the worst case. IETF RFC 1457
Sensitivity
The characteristic of a resource which implies its value or importance and may
include its vulnerability (ISO 7492-2)
Page 3
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Components of the Health Care Classification Scheme
When two end systems communicate, common security label syntax and semantics are needed. The
security label, as an attribute of the data, indicates what measures need to be taken to preserve the
condition of security. The security label must communicate all of the integrity and confidentiality
handling requirements. (IETF RFC 1457)
Security labels support a number of policy models. From a security labeling perspective within this
health care security system, the most important models are: (Adapted from Ford)
Multi-Level Policies (Hierarchical). A multi-level policy operates by assigning to each target a
classification level, from a hierarchy of levels. Each user is assigned a clearance level from the same
hierarchy. The targets assignment reflects it sensitivity. The users assignment reflects general
trustworthiness based, for example, on an investigation of a person's background.
Compartment-Based Policies. In a compartment-based policy, sets of targets are associated with a
named security compartment are category, which isolates them from other targets. Users need to be
given a distinct clearance for a compartment to be able to access targets in the compartment.
Value-Dependent Controls. In a value-dependent policy, the sensitivity of a target can vary depending
upon values stored. For example, information regarding contracts with a dollar value exceeding a certain
threshold might be afforded greater protection than other contracts in the same corporate database.
The basic features of the health care security label based scheme are:
a) This scheme makes use of security labels which can be assigned to subjects and resources, and data
passed between systems.
b) This scheme is most convenient when there are many initiators accessing many targets and only a
coarse granularity of access control is required.
c) This scheme, given certain policy restrictions, can be used to control the flow of data within a security
domain. Security labels also may be convenient for providing access control between security domains.
d) The allowed operations are not explicitly included in the initiator-bound or target-bound ACI, but are
defined as part of the security policy.
NOTES
1 Labels are not necessarily simple structures.
2 When an initiator is a human user (or an initiator process represents a human user), the label bound to
the initiator often is called a clearance. In these cases, the label bound to the target is called a
classification. (Adapted from ISO 10181-3)
Page 4
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Context-Based Controls. Context-based controls allow an access control policy to specify that access to
a target will depend upon external factors such as:
1.
The time of day,
2.
The current location of the user,
3.
The communication path used between subject and resource; and/or
4.
The strength of the authentication method used in confirming the identity of the subject.
Included in context-based controls are concepts such as the purpose of use for which the resource
information is requested or allowed. Obligations are also a form of context policy requiring acceptance
by the subject in the context of particular circumstances.
This health care classification scheme adopts the core structure contained in NIST FIPS PUB 188. Figure
1, illustrates the general structure of the NIST label structure as consisting of a set of fields. Each field
comprises a globally unique Tag Set Name, plus a set of security tags.
Figure 1 NIST Standard Security Label
The HCS defines a quadruplet (4-tuple) of resource label fields plus one handling label field as follows:
1.
Confidentiality (Hierarchical),
2.
Sensitivity (Compartment),
3.
Integrity ( Hierarchical), and
1.
Compartment (Compartment)
2.
Handling Caveat (Contextual)
Page 5
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
These define the classification of each labeled item and constituent components (inner envelope, cover
sheet, body, and section(s) and sub-sections or segments).
Page 6
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Table 1: Health Care Classification System Security Labels
Security Label
Field
Label Definition
Tag Set Name
Notes
Confidentiality Information metadata which is based on an 1.
HL7 Confidentiality Code
analysis of applicable policies and the risk of
harm that could result from unauthorized
disclosure.
Sensitivity
Privacy metadata for information perceived as 1. HL7 Sensitivity and Privacy Policy Codes
undesirable to share.
Field type: Multi-Level (Hierarchical). Only one
classification value is permitted on the header of
an information resource. It must be high water
mark (most restrictive).
Field type: Compartment. In order to access
sensitivity tagged data, the user must possess
“rights” corresponding to the tag set values.
Integrity
Information metadata which indicates level of
confidence, reliability or trustworthiness.
Field type: Multi-Level (Hierarchical).
Compartment
Information segment tag which indicates access 3. HL7 ActUSPrivacyLawPolicy
4. (TBD)
only by members of a defined community
belonging to the compartment
2.
HL7 Resource Provenance; Integrity Status; and
Integrity; Confidence. Data Integrity. Entity
Authentication (TBD)
Handling Caveat Information tag which conveys instructions for 5. HL7 ActHealthInformationPurposeofUseReason Codes
secure distribution, transmission, storage or use. (need to validate definition)
6. HL7 ActObligationSecurityPolicyType
7. HL7 ActRefrainPolicyType
8. Distribution Codes (TBD) (Functional or Hierarchical
Group, Authority)
Classifier
Competent Authority who tags the information 9. Classifier Authority Identifier (TBD)
Derivative
Classifier
10.
Competent Authority who tags a
portion of the classified information
Declassification 12.
NARA retentions Policies
13.
Health care record retention policies
(e.g., 85 years)
11.
Derivative Classifier Authority Identifier (TBD)
14.
Declassification Date, Classification review date
Page 7
Field Type: Compartment. Composite Privacy
Policy label that applies to all information
contained within the compartment.
Field Type: Contextual. Applies to all information
within scope of the caveat
Authority responsible for original classification
Document automatically declassified and subject
to FOIA request
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Page 8
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
HCS Field Definitions
This section explains the components of each member of the HCS label 4-tuplet.
Field 1: Confidentiality (Type Multi-Level (Hierarchical))
Definition: Information metadata which is based on an analysis of applicable policies and the risk of
harm that could result from unauthorized disclosure.
Confidentiality labels are access control decision information applied as resource attributes. The
attributes are hierarchical with rights to higher levels providing read down and write up but not write
down privileges. For information and access rights at lower levels of the hierarchy write up privileges
are not allowed. For example, a user with a Very Restricted clearance may read and write Very
Restricted data, read down and write up from lower levels, but may not write down to them. A user
with Restricted privileges may read and write Restricted data, read down and write up from low levels,
but may not write down to them.
Confidentiality Label Guideline 1: Apply confidentiality labels to identify categories of protected
information to which specific information object, cover sheet, section or segment belongs.
Note: Confidentiality labels are applied at the segment (entry), section, body, cover sheet levels of an
information object including inner envelope layers wrapping the information object.
Confidentiality Label Guideline 2: Apply confidentialitylabels at the information object body level to
indicate the “high water mark” of all information contained within the information object and its
components.
Field 2: Sensitivity (Type compartment)
Definition: Privacy metadata for information perceived as undesirable to share.
Confidentiality labels are applied to data items stored in an EHR regardless of the data type or value. On
the other hand, information belonging to a specific category and value may require greater protections
than other information in the EHR. For example, sets of information associated with the HIV condition
distinguishes them from other information and may require the evaluation of specific security policies
for that category. The sensitivity label policy operates by assigning to select resource one or more
labels from a list of such labels. The resource assignment reflects its sensitivity. Each user is assigned
sensitivity clearance levels from the same list.
Sensitivity labeled sections may contain multiple items within their individual sub-sections. For
example, a summary Lab report sub- sections may contain many individual line items for different types
of tests including HIV, Sickle Cell, etc. Anyone receiving such a report must be cleared for HIV, and
Page 9
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Sickle Cell, Label markings of any type cannot be assumed to indicate anything about the results (actual
data values) other than the contents refer to HIV.
Sensitivity Guideline 1: Apply sensitivity labels to identify categories of protected information to which
a specific information object belongs but from which no diagnostic conclusion may be drawn.
Corollary to Sensitivity Guideline 1: Sensitivity labels are not to be interpreted as a “result” but instead
as a label for each instance of information of a particular sensitivity type.
Note: In other words, lab data associated with HIV is tagged “HIV” whether or not the results are
positive or negative and no conclusion may be drawn regarding the result based on the information
label alone.
Sensitivity Guideline 2: Apply sensitivity classifications codes at the lowest level for which a single code
value (e.g. sensitivity code) can be expressed. Sensitivity codes are applied as single values and not a
list. Since these codes are not hierarchical there is no high water mark sensitivity code.
Field 3: Integrity (Type Value)
Definition: Information metadata which indicates level of confidence, reliability or trustworthiness
Integrity labeled sections may contain multiple items within their individual sub-sections. Binary
integrity values such as “High” or “Low” allow for discrimination of segments containing such things as
unsigned notes, patient provided information or lab results. Evaluation of integrity labels is a policy
matter providing segmentation of information potentially impacting patient safety.
Integrity Guideline 1: Apply integrity labels to identify categories of information for which diagnostic
conclusions may or may not be appropriate.
Field 4: Compartment (Type Compartment)
Definition: Information segment tag which indicates access only by members of a defined community
belonging to the compartment
In a compartment-based policy, sets of resources are associated with a named security compartment or
category, which isolates them from other resources. Users need to be given a distinct clearance for a
compartment to be able to access resources in that compartment. (Ford)
Compartments encompass data items tagged for access to specific named groups. Being a member of
the group is sufficient to determine access. Compartments provide broad access to data items but do
not determine what fine-grained rights a subject may have with respect to that resource (e.g. Role
based access control). Examples of compartments include, “For Pharmacy Personnel Only”, “Agent
Orange”, and “VIP”.
Page 10
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Compartment Guideline 1: Apply compartment labels to identify categories of information groups
accessible only to subjects entitled access by virtue of group membership.
Field 5: Handling Caveats and Labels (Type: Contextural):
Definition: Information tag which conveys instructions for secure distribution, transmission, storage or
use.
Handling instructions are by definition actions. For example, the following are examples of handling
instructions:
1.
Obligation. An operation specified in a policy or policy set performed in conjunction with the
enforcement of an authorization decision. The acceptance of an obligation may be implicit
(e.g., in an MOU, DURSA or contract) or explicit as in a returned response (e.g. a promise).
2.
Routing and communication path related instructions. For example, “Dr. Bob eyes only”.
Handling Caveat Guideline 1 Apply handling caveats to obtain implicit or explicit acceptance of a source
rule required of a subject prior to use or access to any or all data encompassed by the obligation or
routing instruction.
Note 1: For example, a handling caveat of NoResdisclosure is intended to evoke a subject’s implicit or
explicit agreement of the policy rule as a condition for receipt or access to the information object or
segments.
Note 2: Inherent in the acceptance of an obligation is placing the obligation rule within the rule sets
associated with the applicable purpose of use.
Handling Caveat 2: Apply purpose of use as an obligation type designating the policy rule set that is
intended and authorized by the source to be applied for use or access by the subject to the source
information object.
Corollary to Handling Caveat Guideline 2: Nothing in Rule 2 should be interpreted as either
a prohibition or authorization for use for other purposes other than the one designated.
Note: For example, information provided with a purpose of use of “Treatment” may be used for
“Payment” if payment policies so allow. In other words, a purpose of use handling caveat is not
exclusionary. On the other hand, information provided for “Treatment” may not be available for
“Marketing” without a patient authorization if so required by subject policy.
Handling Caveat Guideline 3: Apply Handling Caveats as access control decision information to any and
all segments of an information object.
Page 11
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Note: For example, data may be labeled with the “NoRedisclosure” attribute permanently affixed to all
data within an information object. Used as ACI, NoRredisclosure can be viewed as being in the same
category as NOFORN. Handling caveats as ACI allows, in addition to use as an obligation, the retention of
information attributes needed to make future access control decisions.
Figure 2 Types of Resource Access Control Decision Information
Granularity and containment
Access control policies may define targets at varying levels of granularity. Each level of granularity may
have its own logically separate policy and may entail the use of different Access Control Enforcement
Function (AEF) and Access Control Decision Function (ADF) components (although they might use the
same ADI). For example, access to a database server might be controlled only to the server as a whole;
that is, either an initiator is denied access entirely or is allowed access to anything in the server.
Alternatively, access might be controlled to individual files, records within files, or even data items
Page 12
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
within records. A particular database might be a Directory Information Tree, access to which might be
controlled at the granularity of the entire tree, or sub-trees within the tree, or entries in the tree, or
even attribute values in entries. Another example of granularity is a computer system and applications
within the system. Containment may be used to control access to a set of targets by specifying a policy
that allows access to these targets only if access is allowed to a target that encompasses them.
Containment might also be applied to subgroups of initiators contained in a larger group. Often the
notion of containment is applied to targets that are related to one another, such as files in a database or
data items in records. In the case of an element being contained within another, it is necessary for the
initiator to be given the access right required to “pass through” the enclosing element before
attempting to access the enclosed element. Unless designers of these security policies exercise care,
access denied by one policy may effectively be allowed by another when this is not the intention. (ITU
X.812/ISO 10181-3 Access Control)
Page 13
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
Figure 3 HL7 Derived HCS Security Tags
Page 14
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
References
1.
ACP 332 INFOSEC Technical and Implementation Guidance for Labelling of NATO
Information. March 2004.
2.
(Biba) Biba, K. J. "Integrity Considerations for Secure Computer Systems", MTR-3153,
The Mitre Corporation, April 1977.
(Bell) Bell, D. E.; LaPadula, L. J. "Secure Computer System: Unified Exposition and
Multics Interpretation", MTR-2997, The MITRE Corporation, March 1976.
CCITT Rec. X.800 and ISO/IEC 7498-2
3.
4.
5.
ESS (Extended Security Services) <http://www.isode.com/products/security-policyinfrastructure.html>
6.
(Ford) Ford, Warwick, Computer Communications Security, Principles, Standard Protocols and
Techniques, Prentice Hall, 1994
7.
(IETF RFC 1457) IETF RFC 1457 Security Label Framework for the Internet, May 1993
8.
Institute of Electrical and Electronics Engineers (IEEE) 802.10g Secure Data Exchange
(SDE) Security Label.
9.
International Organization of Standardization (ISO) SC-32 Security Label.
10.
ISO 2382-8 Information technology - Vocabulary - Part 8: Security , 1998
11.
ISO 10181-1 Information technology. Open systems interconnection. Security
frameworks for open systems. Overview, Nov 1996
12.
ISO 10181-3 Information technology - Open Systems Interconnection - Security
frameworks for open systems: Access control framework, 1996
ISO 22600 PMAC Part 3, Health informatics. Privilege management and access control.
Implementations, Jan 2010
13.
14.
ISO MHS X.411 Security Label.
15.
ISO/IEC 15816 Security Information Objects for Access Control
16.
ITU X.411 Message Transfer System: Abstract Service Definition and Procedures,
ISO/IEC 10021-4, 1988
17.
ITU X.501 The Directory: Models, ISO/IEC 9594-2, 2008
18.
19.
(ITU-T X.841) Information technology – Security techniques –
Security information objects for access control, OCT 2000
Page 15
Unlocking the Power
HEALTH LEVEL SEVEN
of Health Information
HL7(tm) (c) 2009 Health Level Seven(tm), Inc. All Rights Reserved.
HL7 and Health Level Seven are registered trademarks of Health Level Seven, Inc. Reg. U.S. Pat & TM
20.
ITU X.812 INFORMATION TECHNOLOGY OPEN SYSTEMS INTERCONNECTION
SECURITY FRAMEWORKS FOR OPEN SYSTEMS: ACCESS CONTROL
FRAMEWORK, 1995
21.
Military Standard (MIL STD) 2045-48501 (Common Security Label).
22.
National Institute of Standards and Technology (NIST) Federal Information Processing
Standard (FIPS) 188 Standard Security Label.
23.
NIST SP 800-53 Recommended Security Controls for Federal Information Systems and
Organizations
24.
(NRC) NRC, 1991, as cited in HISB, DRAFT GLOSSARY OF TERMS RELATED TO
INFORMATION SECURITY IN HEALTH CARE INFORMATION SYSTEMS
25.
President’s Council of Advisors on Science and Technology, Health Information
Technology Report, Dec 2010
26.
RFC 2634 Enhanced Security Services for S/MIME, P. Hoffman, June 1999
27.
SDN 801c Access Control Concept and Mechanism: Revision C. May 1999
28.
SDN.801 Reference Security Label.
29.
30.
XMLSPIF Version 2: http://www.xmlspif.org/schema/xmlspif.xsd
(XMPP) Extensible Messaging and Presence Protocol (XMPP) XEP-0258: Security Labels in
XMPP http://xmpp.org
Page 16