Independent Submission K. Zeilenga
Request for Comments: 7444 A. Melnikov
Category: Informational Isode Limited
ISSN: 2070-1721 February 2015
Independent Submission K. Zeilenga
Request for Comments: 7444 A. Melnikov
Category: Informational Isode Limited
ISSN: 2070-1721 February 2015
Security Labels in Internet Email
Internet电子邮件中的安全标签
Abstract
摘要
This document describes a header field, SIO-Label, for use in Internet email to convey the sensitivity of the message. This header field may carry a textual representation (a display marking) and/or a structural representation (a security label) of the sensitivity of the message. This document also describes a header field, SIO-Label-History, for recording changes in the message's label.
本文档描述了一个标题字段SIO Label，用于在Internet电子邮件中传达消息的敏感性。该标题字段可能包含消息敏感度的文本表示（显示标记）和/或结构表示（安全标签）。本文档还描述了标题字段SIO Label History，用于记录邮件标签的更改。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor has chosen to publish this document at its discretion and makes no statement about its value for implementation or deployment. Documents approved for publication by the RFC Editor are not a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
这是对RFC系列的贡献，独立于任何其他RFC流。RFC编辑器已选择自行发布此文档，并且未声明其对实现或部署的价值。RFC编辑批准发布的文件不适用于任何级别的互联网标准；见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7444.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc7444.
Copyright Notice
版权公告
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2015 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。
Table of Contents
目录
1. Introduction ....................................................2
1.1. Relationship to Inline Sensitivity Markings ................3
1.2. Relationship to Preexisting Security Label Header Fields ...4
1.3. Relationship to Enhanced Security Services for S/MIME ......4
2. Conventions Used in This Document ...............................5
3. Overview ........................................................5
4. The SIO-Label Header Field ......................................6
5. The SIO-Label-History Header Field ..............................9
6. IANA Considerations ............................................12
7. Security Considerations ........................................12
8. References .....................................................14
8.1. Normative References ......................................14
8.2. Informative References ....................................15
Acknowledgements ..................................................16
Authors' Addresses ................................................16
1. Introduction ....................................................2
1.1. Relationship to Inline Sensitivity Markings ................3
1.2. Relationship to Preexisting Security Label Header Fields ...4
1.3. Relationship to Enhanced Security Services for S/MIME ......4
2. Conventions Used in This Document ...............................5
3. Overview ........................................................5
4. The SIO-Label Header Field ......................................6
5. The SIO-Label-History Header Field ..............................9
6. IANA Considerations ............................................12
7. Security Considerations ........................................12
8. References .....................................................14
8.1. Normative References ......................................14
8.2. Informative References ....................................15
Acknowledgements ..................................................16
Authors' Addresses ................................................16
A security label, sometimes referred to as a confidentiality label, is a structured representation of the sensitivity of a piece of information. A security label can be used in conjunction with a clearance, a structured representation of what sensitive information a person (or other entity) is authorized to access, and a security policy to control access to each piece of information. For instance, an email message could have an "EXAMPLE CONFIDENTIAL" label that requires the sender and the receiver to have a clearance granting access to information labeled "EXAMPLE CONFIDENTIAL". X.841 [X.841] provides a discussion of security labels, clearances, and security policy.
安全标签（有时称为保密标签）是信息敏感度的结构化表示。安全标签可以与许可、个人（或其他实体）有权访问哪些敏感信息的结构化表示以及控制对每一条信息的访问的安全策略结合使用。例如，一封电子邮件可能有一个“示例机密”标签，要求发送者和接收者有一个许可证，允许访问标记为“示例机密”的信息。X.841[X.841]讨论了安全标签、许可和安全政策。
A display marking is a textual representation of the sensitivity of a piece of information. For instance, "EXAMPLE CONFIDENTIAL" is a textual representation of the sensitivity. A security policy can be used to generate display markings from security labels. Display markings are generally expected to be prominently displayed whenever the content is displayed.
显示标记是信息敏感度的文本表示。例如，“示例机密”是敏感度的文本表示。安全策略可用于从安全标签生成显示标记。每当显示内容时，通常都会突出显示显示标记。
Sensitivity-based authorization is used in networks that operate under a set of information classification rules, such as in government and military agency networks. The standardized formats for security labels, clearances, security policy, and associated authorization models are generalized and can be used in non-government deployments where appropriate.
基于敏感度的授权用于在一组信息分类规则下运行的网络，如政府和军事机构网络。安全标签、许可、安全策略和相关授权模型的标准化格式是通用的，可以在适当的情况下用于非政府部署。
Security labels may also be used for purposes other than authorization. In particular, they may be used simply to convey the sensitivity of a piece information. The security label could be used, for instance, to organize content in a content store.
安全标签也可用于授权以外的目的。特别地，它们可以简单地用于传达工件信息的敏感性。例如，可以使用安全标签来组织内容存储中的内容。
This document describes a protocol for conveying the sensitivity of a electronic mail message [RFC5322] as a whole. In particular, this document describes a header field, SIO-Label, that carries a security label, a display marking, and display colors. This document also describes a header field, SIO-Label-History, that records changes in the message's security label.
本文档描述了一种用于整体传达电子邮件消息[RFC5322]敏感性的协议。特别是，本文档描述了标题字段SIO Label，其中包含安全标签、显示标记和显示颜色。本文档还描述了标题字段SIO Label History，该字段记录邮件安全标签中的更改。
This protocol is based in part upon "XEP-0258: Security Labels in XMPP" [XEP258].
该协议部分基于“XEP-0258:XMPP中的安全标签”[XEP258]。
In environments requiring messages to be marked with an indication of their sensitivity, it is common to place a textual representation of the sensitivity, a display marking, within the body to the message and/or in the Subject header field. For instance, the authors often receives messages of the form:
在要求用敏感度指示标记消息的环境中，通常在消息正文和/或主题标题字段中放置敏感度的文本表示，即显示标记。例如，作者经常收到以下形式的消息：
To: author <author@example.com>;
From: Some One <someone@example.net>;
Subject: the subject (UNCLASSIFIED)
To: author <author@example.com>;
From: Some One <someone@example.net>;
Subject: the subject (UNCLASSIFIED)
UNCLASSIFIED
未分类
Text of the message.
信息文本。
UNCLASSIFIED
未分类
Typically, when placed in the body of the message, the marking is inserted into the content such that it appears as the first line(s) of text in the body of the message. This is known as a FLOT (First Line(s) of Text) marking. The marking may or may not be surrounded by other text indicating that the marking denotes the sensitivity of the message. A FLOT may also be accompanied by a LLOT (Last Line(s) of Text) marking. The message above contains a two-line FLOT and a two-line LLOT (in both cases, a line providing the marking and an empty line between the marking and the original content appear).
通常，将标记放置在邮件正文中时，会将其插入到内容中，使其显示为邮件正文中的第一行文本。这称为FLOT（文本的第一行）标记。标记可能被其他文本包围，也可能不被其他文本包围，表明标记表示信息的敏感性。FLOT还可附有LLOT（文本的最后一行）标记。上面的消息包含两行FLOT和两行LLOT（在这两种情况下，都会出现一行提供标记，标记和原始内容之间会出现一条空行）。
Typically, when placed in the Subject of the message, the marking is inserted before or after the contents of the original Subject field; it is surrounded by parentheses or the like and/or separated from the content by white space.
通常，当放置在消息的主题中时，标记插入原始主题字段的内容之前或之后；它由括号或类似内容包围和/或由空格与内容分隔。
The particular syntax and semantics of inline sensitivity markings are generally a local matter. This hinders interoperability within an organization wanting to take actions based upon these markings and hinders interoperability between cooperating organizations wanting to usefully share sensitivity information
内联敏感标记的特定语法和语义通常是局部问题。这妨碍了希望根据这些标记采取行动的组织内部的互操作性，也妨碍了希望有效共享敏感信息的合作组织之间的互操作性
The authors expect that such markings will continue to be widely used, especially in the absence of ubiquitous support for a standardized header field indicating the sensitivity of the message.
作者期望这种标记将继续被广泛使用，特别是在没有普遍支持指示消息敏感性的标准化报头字段的情况下。
The authors hope that through the use of a formally specified header field, interoperability within organizations and between organizations can be improved.
作者希望通过使用正式指定的标题字段，可以改进组织内部和组织之间的互操作性。
A number of non-standard header fields, such as the X-X411 field, are used to carry a representation of the sensitivity of the message, whether a structured representation or textual representation.
许多非标准标题字段（如X-X411字段）用于表示消息的敏感性，无论是结构化表示还是文本表示。
The authors hope that the use of preexisting (non-standard) header fields will be replaced, over time, with the use of the header field described in this document.
作者希望，随着时间的推移，使用本文档中描述的标题字段将取代先前存在的（非标准）标题字段。
Enhanced Security Services for S/MIME (ESS) [RFC2634] provides, amongst other services, signature services "for content integrity, non-repudiation with the proof of origin, and [securely] binding attributes (such as a security label) to the original content".
增强的S/MIME安全服务（ESS）[RFC2634]除其他服务外，还提供签名服务，“用于内容完整性、来源证明的不可否认性，以及[安全地]将属性（如安全标签）绑定到原始内容”。
While it may be possible to utilize the protocol described in this document concurrently with ESS, this protocol should generally be viewed as an alternative to ESS.
虽然可以与ESS同时使用本文件中描述的协议，但该协议通常应视为ESS的替代方案。
It is noted that in ESS, the security label applies to MIME [RFC2045] content, where in this protocol, the label applies to the message as a whole.
需要注意的是，在ESS中，安全标签适用于MIME[RFC2045]内容，而在本协议中，标签适用于整个消息。
It is also noted that in ESS, security labels are securely bound to the MIME content through the use of digital signatures. This protocol does not provide message-signing services and hence does not provide secure binding the label to the message, content integrity, or non-repudiation of the proof of origin.
还需要注意的是，在ESS中，安全标签通过使用数字签名安全地绑定到MIME内容。此协议不提供消息签名服务，因此不提供标签与消息的安全绑定、内容完整性或原产地证明的不可否认性。
This protocol is designed for situations/environments where message signing is not necessary to provide sufficient security.
此协议设计用于不需要消息签名来提供足够安全性的情况/环境。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
The formal syntax specifications in this document use the Augmented Backus-Naur Form (ABNF) as described in [RFC5234].
本文档中的正式语法规范使用[RFC5234]中所述的增广巴科斯诺尔形式（ABNF）。
The term "base64 encoding" is used to refer to the "Base 64 encoding" defined in Section 4 of [RFC4648]. The term "BER encoding" is used to refer to encoding per the Basic Encoding Rules (BER) as defined in [X.690].
术语“base64编码”用于指[RFC4648]第4节中定义的“base64编码”。术语“BER编码”是指按照[X.690]中定义的基本编码规则（BER）进行编码。
A Mail User Agent (MUA) originating a message can, if so configured, offer the user a menu of sensitivities to choose from and, upon selection, insert the display marking, foreground and background colors, and security label parameters associated with that selection into the SIO-Label header field of the message.
如果这样配置，发起消息的邮件用户代理（MUA）可以向用户提供可供选择的敏感度菜单，并在选择后将显示标记、前景和背景颜色以及与该选择相关联的安全标签参数插入消息的SIO标签标题字段。
Mail Submission Agents (MSAs), Mail Transfer Agents (MTAs), and Mail Delivery Agents (MDAs) can then, if so configured, use the provided sensitivity information (or lack thereof) in determining whether to accept, forward, or otherwise act on the message as submitted. These agents, hereafter referred to as Service Agents (SAs), can, if so configured, modify the sensitivity information of the message, such as replacing the security label and/or display marking with equivalent representations of the sensitivity of the message. SAs that add, modify, or delete the SIO-Label header field SHOULD add an SIO-Label-History header.
然后，邮件提交代理（MSA）、邮件传输代理（MTA）和邮件传递代理（MDA）（如果已配置）可以使用提供的敏感度信息（或缺少敏感度信息）来确定是否接受、转发或以其他方式处理已提交的邮件。这些代理（以下称为服务代理（SA）），如果这样配置，可以修改消息的敏感度信息，例如用消息敏感度的等效表示替换安全标签和/或显示标记。添加、修改或删除SIO标签标题字段的SA应添加SIO标签历史标题。
Receiving MUAs that implement this extension SHALL, when displaying the message, also prominently display the marking, if any, conveyed in the SIO-Label header field or, if policy-aware and configured to display locally generated markings, a marking generated by the conveyed label and the governing policy. It is also desirable to display this marking in listings of messages. In the case the conveyed marking is displayed, the marking SHOULD be displayed using the foreground and background colors conveyed in the header field. In the case the marking was generated from a conveyed label and the governing policy, the marking SHOULD be displayed using the foreground and background colors conveyed by the governing policy.
在显示信息时，接收实现该扩展的MUA还应突出显示SIO标签标题字段中传达的标记（如有），或者，如果策略意识到并配置为显示本地生成的标记，则应突出显示由传达的标签和管理策略生成的标记。还希望在消息列表中显示此标记。如果显示传送的标记，则应使用标题字段中传送的前景色和背景色显示标记。如果标记是根据传送的标签和管理策略生成的，则应使用管理策略传送的前景色和背景色显示标记。
While MUAs are not expected to make authorization decisions based upon values of the SIO-Label header field, MUAs can otherwise use the provided sensitivity information (or lack thereof) in determining how to act on the message. For instance, the MUA may organize messages in its store of messages based upon the content of this header field.
虽然MUA不会根据SIO标签头字段的值做出授权决策，但MUA可以使用提供的敏感度信息（或缺少敏感度信息）来确定如何对消息采取行动。例如，MUA可以基于该报头字段的内容在其消息存储器中组织消息。
The header field name is "SIO-Label", and its content is a set of key/value pairs, each referred to as a parameter.
标题字段名为“SIO标签”，其内容是一组键/值对，每个键/值对称为参数。
Formal header field syntax:
正式标题字段语法：
sio-label = "SIO-Label:" [FWS] sio-label-parm-seq [FWS] CRLF
sio label=“sio label:[FWS]sio label parm seq[FWS]CRLF
sio-label-parm-seq = sio-label-parm [ [FWS] ";" [FWS] sio-label-parm-seq ]
sio标签参数顺序=sio标签参数[[FWS]；“[FWS]sio标签参数顺序]
sio-label-parm = parameter
sio-label-parm = parameter
where the parameter production is defined in [RFC2231], the FWS production is defined in [RFC5322], and the CRLF production is defined in [RFC5234]. It is noted that the productions defined in [RFC2231] rely on the ABNF in [RFC0822], which implicitly allows for white space in certain cases. In particular, white space is implicitly allowed in the parameter production immediately before and after the "=". It is also noted that [RFC2231] allows for quoted-string values (for parameter production) of substantial length, for string characters outside of US-ASCII, or for other such cases. Implementors should consult the referenced specifications for details.
在[RFC2231]中定义了参数生产，在[RFC5322]中定义了FWS生产，在[RFC5234]中定义了CRLF生产。需要注意的是，[RFC2231]中定义的产品依赖于[RFC0822]中的ABNF，这在某些情况下隐含地允许空白。特别是，在“=”前后的参数生成中隐式允许空白。还需要注意的是，[RFC2231]允许引用大量长度的字符串值（用于参数生成）、US-ASCII以外的字符串或其他此类情况。实施者应参考参考规范了解详细信息。
The "marking" parameter is a display string for use by implementations that are unable or unwilling to utilize the governing security policy to generate display markings. The "marking" parameter SHOULD generally be provided in SIO-Label header fields. It ought only be absent where an SA relies on other SAs to generate the marking.
“marking”参数是一个显示字符串，供无法或不愿意使用管理安全策略生成显示标记的实现使用。“标记”参数通常应在SIO标签标题字段中提供。仅当SA依赖其他SA生成标记时，才应不存在该标记。
The "fgcolor" and "bgcolor" parameters are tokens restricted to color production representing the foreground and background colors, respectively, for use in colorizing the display marking string. Their values are RGB colors in hexadecimal format (e.g., "#ff0000"), or one of the Cascading Style Sheets (CSS) color names (e.g., "red") given in named-color type below (the 16 HTML4 colors + "orange") [CSS3-Color]. The default foreground color is black. The default
“fgcolor”和“bgcolor”参数是仅限于分别表示前景色和背景色的颜色生成的标记，用于为显示标记字符串着色。它们的值是十六进制格式的RGB颜色（例如“#ff0000”），或下面命名颜色类型中给出的一个级联样式表（CSS）颜色名称（例如“红色”）（16种HTML4颜色+橙色”）[CSS3颜色]。默认的前景色是黑色。默认值
background is white. The "fgcolor" and "bgcolor" parameters SHALL be absent if the "marking" parameter is absent. The HEXDIG production below is defined in [RFC5234].
背景是白色的。如果“标记”参数不存在，“fgcolor”和“bgcolor”参数应不存在。[RFC5234]中定义了以下HEXDIG生产。
Formal color syntax:
形式颜色语法：
color = hex-color / named-color
color = hex-color / named-color
hex-color = "#" 6HEXDIG ; Hex-encoded RGB
hex-color = "#" 6HEXDIG ; Hex-encoded RGB
named-color = "aqua" / "black" / "blue" / "fuschia" / "gray" / "green" / "lime" / "maroon" / "navy" / "olive" / "purple" / "red" / "silver" / "teal" / "white" / "yellow" / "orange" ; named colors
命名为color=“aqua”/“黑色”/“蓝色”/“fuschia”/“灰色”/“绿色”/“莱姆”/“栗色”/“海军蓝”/“橄榄色”/“紫色”/“红色”/“银色”/“青色”/“白色”/“黄色”/“橙色”；命名颜色
The "type" parameter is a quoted string containing the string ":ess", the string ":x411", the string ":xml", or a URI [RFC3986] denoting the type and encoding of the "label" parameter. The "label" parameter value is a quoted string. The "type" parameter SHALL be present if the "label" parameter is present. The "label" parameter SHALL be present if the "type" parameter is present. When sensitivity-based authorization is performed, the absence of the "type" and "label" parameters indicates that the message is handled under default handling rules (e.g., as if no SIO-Label was present).
“type”参数是一个带引号的字符串，其中包含字符串“：ess”、字符串“：x411”、字符串“：xml”或表示“label”参数的类型和编码的URI[RFC3986]。“label”参数值是一个带引号的字符串。如果存在“标签”参数，则应存在“类型”参数。如果存在“类型”参数，“标签”参数应存在。当执行基于灵敏度的授权时，如果没有“类型”和“标签”参数，则表明消息是按照默认处理规则处理的（例如，就好像没有SIO标签一样）。
The string ":ess" indicates that the "label" parameter value is the base64 encoding of the BER encoding of an ESS security label [RFC2634].
字符串“：ess”表示“label”参数值是ess安全标签[RFC2634]的BER编码的base64编码。
ESS Label Example:
ESS标签示例：
SIO-Label: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":ess"; label="MQYGASkCAQM="
SIO-Label: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":ess"; label="MQYGASkCAQM="
The string ":x411" indicates that the "label" parameter value is the base64 encoding of the BER encoding of an X.411 security label [X.411].
字符串“：x411”表示“label”参数值是X.411安全标签[X.411]的BER编码的base64编码。
X.411 Label Example:
X.411标签示例：
SIO-Label: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":x411"; label="MQYGASkCAQM="
SIO-Label: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":x411"; label="MQYGASkCAQM="
The string ":xml" indicates that the "label" parameter value is the base64 encoding of a security label represented using [XML]. The XML prolog SHOULD be absent unless specifically required (such as when the character encoding is not UTF-8). The particular flavor of security label representation is indicated by the root element name and its name space.
字符串“：xml”表示“label”参数值是使用[xml]表示的安全标签的base64编码。除非特别需要（例如，当字符编码不是UTF-8时），否则XML序言应该不存在。安全标签表示的特殊风格由根元素名称及其名称空间表示。
XML Label Example:
XML标签示例：
SIO-Label: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":xml";
label*0="PFNlY0xhYmVsIHhtbG5zPSJodHRwOi8vZXhhbX";
label*1="BsZS5jb20vc2VjLWxhYmVsLzAiPjxQb2xpY3lJ";
label*2="ZGVudGlmaWVyIFVSST0idXJuOm9pZDoxLjEiLz";
label*3="48Q2xhc3NpZmljYXRpb24+MzwvQ2xhc3NpZmlj";
label*4="YXRpb24+PC9TZWNMYWJlbD4=";
SIO-Label: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":xml";
label*0="PFNlY0xhYmVsIHhtbG5zPSJodHRwOi8vZXhhbX";
label*1="BsZS5jb20vc2VjLWxhYmVsLzAiPjxQb2xpY3lJ";
label*2="ZGVudGlmaWVyIFVSST0idXJuOm9pZDoxLjEiLz";
label*3="48Q2xhc3NpZmljYXRpb24+MzwvQ2xhc3NpZmlj";
label*4="YXRpb24+PC9TZWNMYWJlbD4=";
where the XML label, with new lines and white space added for readability, is:
其中，添加了新行和空白以提高可读性的XML标签为：
<SecLabel xmlns="http://example.com/sec-label/0">
<PolicyIdentifier URI="urn:oid:1.1"/>
<Classification>3</Classification>
</SecLabel>
<SecLabel xmlns="http://example.com/sec-label/0">
<PolicyIdentifier URI="urn:oid:1.1"/>
<Classification>3</Classification>
</SecLabel>
The ":ess" and ":x411" formats SHOULD be used to represent ESS or X.411 security labels, respectively, instead of any direct XML representation of these formats.
“：ess”和“：x411”格式应分别用于表示ess或X.411安全标签，而不是这些格式的任何直接XML表示。
The header field SHALL minimally contain a "marking" parameter or contain both the "type" and "label" parameters.
标题字段应至少包含一个“标记”参数或同时包含“类型”和“标签”参数。
This header field may be extended to include additional parameters by future document formally updating (or replacing) this document. Implementations SHOULD ignore additional parameters they do not recognize. This recommendation is not a mandate so as to allow agents to process a message with an SIO-Label header field with unrecognized parameters differently than a message with an SIO-Label header field without the unrecognized parameters.
通过将来正式更新（或替换）此文档，可以扩展此标题字段以包括其他参数。实现应该忽略它们无法识别的其他参数。本建议并非强制要求，以允许代理处理带有SIO标签头字段且参数无法识别的消息，而不是处理带有SIO标签头字段且参数无法识别的消息。
Each message SHALL contain zero or one SIO-Label header field.
每条信息应包含零或一个SIO标签标题字段。
Extended Example:
扩展示例：
SIO-Label: marking*=us-ascii'en'EXAMPLE%20CONFIDENTIAL;
fgcolor = black ; bgcolor = red ;
type=":ess"; label*0="MQYG";
label*1="ASkCAQM="
SIO-Label: marking*=us-ascii'en'EXAMPLE%20CONFIDENTIAL;
fgcolor = black ; bgcolor = red ;
type=":ess"; label*0="MQYG";
label*1="ASkCAQM="
The Extended Example is equivalent to the ESS Label Example above.
扩展示例相当于上面的ESS标签示例。
Any service agent MAY record label changes in an SIO-Label-History header. This header field is intended to provide trace information (and only trace information). For instance, it can be used to record the label change when an SIO-Label header is added, modified, or deleted by a service agent. This field can be used in other situations as well. For instance, a gateway that translates X.400 messages to RFC 5322 mail can use this header field to record labeling changes made while translating a message.
任何服务代理都可以在SIO标签历史标题中记录标签更改。此标题字段旨在提供跟踪信息（并且仅提供跟踪信息）。例如，它可用于记录服务代理添加、修改或删除SIO标签头时的标签更改。此字段也可用于其他情况。例如，将X.400邮件翻译为RFC 5322邮件的网关可以使用此标题字段记录翻译邮件时所做的标签更改。
The SIO-Label-History header field is considered to be a trace field as defined in Section 3.6.7 of [RFC5322].
SIO标签历史标题字段被视为[RFC5322]第3.6.7节中定义的跟踪字段。
The formal syntax of the SIO-Label-History header is the same as the SIO-Label, but with the following parameters:
SIO标签历史头的形式语法与SIO标签相同，但具有以下参数：
o change - one of "add", "replace", "delete".
o 更改-添加、替换、删除中的一个。
o changed-by - contains a string identifying the agent, commonly the agent's fully qualified domain name.
o changed by-包含标识代理的字符串，通常是代理的完全限定域名。
o changed-at - contains a date-time production, as specified in [RFC5322], representing the date and time the header was rewritten.
o changed at-包含[RFC5322]中指定的日期-时间生产，表示头被重写的日期和时间。
o changed-comment - contains a string containing a comment.
o 已更改的注释-包含包含注释的字符串。
o marking, fgcolor, bgcolor, type, label - records the message's label information prior to adding, modifying, or deleting SIO-Label, using the same parameter syntax used for SIO-Label. These parameters are absent when the change action is "add".
o 标记、fgcolor、bgcolor、类型、标签-在添加、修改或删除SIO标签之前，使用与SIO标签相同的参数语法记录消息的标签信息。当更改操作为“添加”时，这些参数不存在。
o new-marking, new-fgcolor, new-bgcolor, new-type, new-label - records the message's label information after adding, modifying, or deleting SIO-Label, using the same parameter syntax used for corresponding SIO-Label parameters. These parameters are absent when the change type is "delete".
o 新标记、新fgcolor、新bgcolor、新类型、新标签-在添加、修改或删除SIO标签后，使用与相应SIO标签参数相同的参数语法记录消息的标签信息。当更改类型为“删除”时，这些参数不存在。
The header field SHALL minimally contain the "change", "changed-by", and "changed-at" parameters.
标题字段应至少包含“更改”、“更改人”和“更改地点”参数。
This header field can be extended to include additional parameters by future documents formally updating (or replacing) this document.
通过将来的文档正式更新（或替换）此文档，可以扩展此标题字段以包括其他参数。
Each message can contain zero or more SIO-Label-History header fields. All SIO-Label-History header fields should immediately follow the SIO-Label header field, if any, and be grouped together. Additional SIO-Label-History header fields should be added immediately preceding any existing SIO-Label-History header fields.
每条消息可以包含零个或多个SIO标签历史标题字段。所有SIO标签历史标题字段应紧跟在SIO标签标题字段之后（如有），并分组在一起。应在任何现有SIO标签历史标题字段之前添加其他SIO标签历史标题字段。
SIO Label History Add, Modify, Delete Example:
SIO标签历史添加、修改、删除示例：
SIO-Label-History: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":xml";
label*0="PFNlY0xhYmVsIHhtbG5zPSJodHRwOi8vZXhhbX";
label*1="BsZS5jb20vc2VjLWxhYmVsLzAiPjxQb2xpY3lJ";
label*2="ZGVudGlmaWVyIFVSST0idXJuOm9pZDoxLjEiLz";
label*3="48Q2xhc3NpZmljYXRpb24+MzwvQ2xhc3NpZmlj";
label*4="YXRpb24+PC9TZWNMYWJlbD4=";
change=delete;
changed-by="delete.example.com";
changed-at="18 Feb 2013 9:24 PDT";
changed-comment="delete"
SIO-Label-History: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":ess"; label="MQYGASkCAQM=";
new-marking="EXAMPLE CONFIDENTIAL";
new-fgcolor=black; new-bgcolor=red;
new-type=":xml";
new-label*0="PFNlY0xhYmVsIHhtbG5zPSJodHRwOi8vZXhhbX";
new-label*1="BsZS5jb20vc2VjLWxhYmVsLzAiPjxQb2xpY3lJ";
new-label*2="ZGVudGlmaWVyIFVSST0idXJuOm9pZDoxLjEiLz";
new-label*3="48Q2xhc3NpZmljYXRpb24+MzwvQ2xhc3NpZmlj";
new-label*4="YXRpb24+PC9TZWNMYWJlbD4=";
change=replace;
changed-by="modify.example.net";
changed-at="18 Feb 2013 8:24 PDT";
changed-comment="replaced with XML variant"
SIO-Label-History: new-marking="EXAMPLE CONFIDENTIAL";
new-fgcolor=black; new-bgcolor=red;
new-type=":ess"; new-label="MQYGASkCAQM=";
change=add;
changed-by="add.example.net";
changed-at="18 Feb 2013 7:24 PDT";
changed-comment="added label"
SIO-Label-History: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":xml";
label*0="PFNlY0xhYmVsIHhtbG5zPSJodHRwOi8vZXhhbX";
label*1="BsZS5jb20vc2VjLWxhYmVsLzAiPjxQb2xpY3lJ";
label*2="ZGVudGlmaWVyIFVSST0idXJuOm9pZDoxLjEiLz";
label*3="48Q2xhc3NpZmljYXRpb24+MzwvQ2xhc3NpZmlj";
label*4="YXRpb24+PC9TZWNMYWJlbD4=";
change=delete;
changed-by="delete.example.com";
changed-at="18 Feb 2013 9:24 PDT";
changed-comment="delete"
SIO-Label-History: marking="EXAMPLE CONFIDENTIAL";
fgcolor=black; bgcolor=red;
type=":ess"; label="MQYGASkCAQM=";
new-marking="EXAMPLE CONFIDENTIAL";
new-fgcolor=black; new-bgcolor=red;
new-type=":xml";
new-label*0="PFNlY0xhYmVsIHhtbG5zPSJodHRwOi8vZXhhbX";
new-label*1="BsZS5jb20vc2VjLWxhYmVsLzAiPjxQb2xpY3lJ";
new-label*2="ZGVudGlmaWVyIFVSST0idXJuOm9pZDoxLjEiLz";
new-label*3="48Q2xhc3NpZmljYXRpb24+MzwvQ2xhc3NpZmlj";
new-label*4="YXRpb24+PC9TZWNMYWJlbD4=";
change=replace;
changed-by="modify.example.net";
changed-at="18 Feb 2013 8:24 PDT";
changed-comment="replaced with XML variant"
SIO-Label-History: new-marking="EXAMPLE CONFIDENTIAL";
new-fgcolor=black; new-bgcolor=red;
new-type=":ess"; new-label="MQYGASkCAQM=";
change=add;
changed-by="add.example.net";
changed-at="18 Feb 2013 7:24 PDT";
changed-comment="added label"
The SIO-Label and SIO-Label-History header fields have been registered in the "Provisional Message Header Field Registry" in accordance with [RFC3864].
SIO标签和SIO标签历史标题字段已根据[RFC3864]在“临时消息标题字段注册表”中注册。
Header field name: SIO-Label
Applicable protocol: mail [RFC5322]
Status: provisional
Author/change controller: Kurt Zeilenga (kurt.zeilenga@isode.com)
Specification document(s): RFC 7444
Header field name: SIO-Label
Applicable protocol: mail [RFC5322]
Status: provisional
Author/change controller: Kurt Zeilenga (kurt.zeilenga@isode.com)
Specification document(s): RFC 7444
Header field name: SIO-Label-History
Applicable protocol: mail [RFC5322]
Status: provisional
Author/change controller: Kurt Zeilenga (kurt.zeilenga@isode.com)
Specification document(s): RFC 7444
Header field name: SIO-Label-History
Applicable protocol: mail [RFC5322]
Status: provisional
Author/change controller: Kurt Zeilenga (kurt.zeilenga@isode.com)
Specification document(s): RFC 7444
Sensitive information should be appropriately protected (whether labeled or not). For email messages, it is generally appropriate for the sending entity to authenticate the receiving entity and to establish transport-level security, including protective services for both data integrity and data confidentiality. When a receiving entity makes authorization decisions based upon assertions of the sending entity, including assertions of identity, it is generally appropriate for the receiving entity to authenticate the sending entity.
应适当保护敏感信息（无论是否贴标签）。对于电子邮件，发送实体通常适合对接收实体进行身份验证，并建立传输级安全，包括数据完整性和数据机密性的保护服务。当接收实体根据发送实体的断言（包括身份断言）做出授权决策时，接收实体通常适合对发送实体进行身份验证。
This document provides a facility for expressing the sensitivity of an email message. The mere expression of actual sensitivity generally does not elevate the sensitivity of the message; however, expressions of sensitivities can themselves be regarded as sensitive information. For instance, a marking of "BLACK PROJECT RESTRICTED" could disclose the existence of a sensitivity project.
本文档提供了一种表达电子邮件敏感性的工具。仅仅表达实际敏感性通常不会提高信息的敏感性；然而，敏感性表达本身可被视为敏感信息。例如，标记为“黑色项目受限”可能表明存在敏感项目。
The SIO-Label header field expresses the sensitivity of the whole message, including the header and body. This document does not provide a means to express the sensitivity of portions of an email message, such as the possibly different sensitivities of various MIME parts that the message may be composed of. The approach used in this document favors simplicity and ease of use (i.e., a single expression of sensitivity) over the complexity and difficulty of marking and labeling portions of a message.
SIO标签标题字段表示整个消息的敏感度，包括标题和正文。本文档不提供一种方法来表示电子邮件消息部分的敏感度，例如消息可能由不同MIME部分组成的可能不同的敏感度。与标记和标记消息部分的复杂性和难度相比，本文档中使用的方法更倾向于简单易用（即敏感性的单一表达）。
The expressed sensitivity can be used in determining how to handle a message. For instance, the value of the SIO-Label header field (or lack thereof) can be used to determine if it is appropriate to be forwarded to a particular entity and, if so, what minimum security services ought to be used in the forwarding exchange. The mechanism for determining how to handle a message-based expressed sensitivity is beyond the scope of this document.
表达的敏感度可用于确定如何处理消息。例如，SIO标签头字段的值（或缺少该字段）可用于确定转发给特定实体是否合适，如果合适，在转发交换中应使用何种最低安全服务。确定如何处理基于消息的敏感度的机制超出了本文档的范围。
The actual content may have more or less sensitivity than indicated by the security label. Agents should avoid lowering security requirements for message exchange with a particular entity based upon conveyed sensitivity.
实际内容的灵敏度可能高于或低于安全标签指示的灵敏度。代理应避免降低与特定实体的消息交换的安全性要求。
This protocol does not itself provide message-signing services, such as used in providing message integrity protection, non-repudiation, and binding of attributes (such as the security label to the message). While it possible that this protocol could be used with a general message-signing service, this document does not detail such use.
此协议本身不提供消息签名服务，例如用于提供消息完整性保护、不可否认性和属性绑定（例如消息的安全标签）。虽然此协议可能与通用消息签名服务一起使用，但本文档未详细说明此类使用。
While security label and display marking parameters are expected to express the same sensitivity, nothing in this specification ensures that the security label and display marking values express the same sensitivity. For instance, an MUA could submit a message that contains a security label that expresses one sensitivity and a display marking with a different sensitivity, and by doing so, possibly cause an SA to inappropriately handle the message. It is generally appropriate for each SA using the SIO-Label values to determine if the security label and display marking values express the same sensitivity and, if not, take appropriate action (such as rejecting the message).
虽然安全标签和显示标记参数应表示相同的灵敏度，但本规范中的任何内容都不能确保安全标签和显示标记值表示相同的灵敏度。例如，MUA可以提交包含表示一种敏感度的安全标签和具有不同敏感度的显示标记的消息，这样做可能会导致SA不适当地处理该消息。通常适用于每个SA，使用SIO标签值来确定安全标签和显示标记值是否表示相同的灵敏度，如果没有，则采取适当的措施（例如拒绝消息）。
This document also provides a facility for expressing changes to the label of a message. This is intended to be used for trace purposes only. It is noted that the SIO-Label-History header field can include sensitive information and, as such, can be removed from the message when its inclusion would result in disclosure of inappropriate information.
本文档还提供了一种工具，用于表示对消息标签的更改。这仅用于跟踪目的。需要注意的是，SIO Label History标头字段可以包含敏感信息，因此，当包含该字段将导致不适当信息的披露时，可以从消息中删除该字段。
[CSS3-Color] Celik, T. and C. Lilley, "CSS3 Color Module", W3C Candidate Recommendation CR-css3-color-20030514, May 2003, <http://www.w3.org/TR/2003/CR-css3-color-20030514>.
[CSS3颜色]Celik，T.和C.Lilley，“CSS3颜色模块”，W3C候选推荐CR-CSS3-Color-20030514，2003年5月<http://www.w3.org/TR/2003/CR-css3-color-20030514>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月<http://www.rfc-editor.org/info/rfc2119>.
[RFC2231] Freed, N. and K. Moore, "MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations", RFC 2231, November 1997, <http://www.rfc-editor.org/info/rfc2231>.
[RFC2231]Freed，N.和K.Moore，“MIME参数值和编码字扩展：字符集、语言和连续体”，RFC 22311997年11月<http://www.rfc-editor.org/info/rfc2231>.
[RFC2634] Hoffman, P., Ed., "Enhanced Security Services for S/MIME", RFC 2634, June 1999, <http://www.rfc-editor.org/info/rfc2634>.
[RFC2634]Hoffman，P.，Ed.，“S/MIME的增强安全服务”，RFC 2634，1999年6月<http://www.rfc-editor.org/info/rfc2634>.
[RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration Procedures for Message Header Fields", BCP 90, RFC 3864, September 2004, <http://www.rfc-editor.org/info/rfc3864>.
[RFC3864]Klyne，G.，Nottingham，M.和J.Mogul，“消息头字段的注册程序”，BCP 90，RFC 3864，2004年9月<http://www.rfc-editor.org/info/rfc3864>.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005, <http://www.rfc-editor.org/info/rfc3986>.
[RFC3986]Berners Lee，T.，Fielding，R.，和L.Masinter，“统一资源标识符（URI）：通用语法”，STD 66，RFC 3986，2005年1月<http://www.rfc-editor.org/info/rfc3986>.
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, October 2006, <http://www.rfc-editor.org/info/rfc4648>.
[RFC4648]Josefsson，S.，“Base16、Base32和Base64数据编码”，RFC4648，2006年10月<http://www.rfc-editor.org/info/rfc4648>.
[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, January 2008, <http://www.rfc-editor.org/info/rfc5234>.
[RFC5234]Crocker，D.，Ed.和P.Overell，“语法规范的扩充BNF:ABNF”，STD 68，RFC 5234，2008年1月<http://www.rfc-editor.org/info/rfc5234>.
[RFC5322] Resnick, P., Ed., "Internet Message Format", RFC 5322, October 2008, <http://www.rfc-editor.org/info/rfc5322>.
[RFC5322]Resnick，P.，Ed.，“互联网信息格式”，RFC5222008年10月<http://www.rfc-editor.org/info/rfc5322>.
[X.411] ITU-T, "Message Handling Systems (MHS) - Message Transfer System: Abstract Service Definition and Procedures", ITU-T Recommendation X.411, June 1999.
[X.411]ITU-T，“信息处理系统（MHS）-信息传输系统：抽象服务定义和程序”，ITU-T建议X.4111999年6月。
[X.690] ITU-T, "ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", ITU-T Recommendation X.690, November 2008.
[X.690]ITU-T，“ASN.1编码规则：基本编码规则（BER）、规范编码规则（CER）和区分编码规则（DER）规范”，ITU-T建议X.690，2008年11月。
[XML] Bray, T., Paoli, J., Sperberg-McQueen, C., Maler, E., and F. Yergeau, "Extensible Markup Language (XML) 1.0 (Fifth Edition)", W3C Recommendation REC-xml-20081126, November 2008, <http://www.w3.org/TR/2008/REC-xml-20081126>.
[XML]Bray，T.，Paoli，J.，Sperberg McQueen，C.，Maler，E.，和F.Yergeau，“可扩展标记语言（XML）1.0（第五版）”，W3C建议REC-XML-20081126，2008年11月<http://www.w3.org/TR/2008/REC-xml-20081126>.
[RFC0822] Crocker, D., "STANDARD FOR THE FORMAT OF ARPA INTERNET TEXT MESSAGES", STD 11, RFC 822, August 1982, <http://www.rfc-editor.org/info/rfc822>.
[RFC0822]Crocker，D.，“ARPA互联网文本信息格式标准”，STD 11，RFC 822，1982年8月<http://www.rfc-editor.org/info/rfc822>.
[RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996, <http://www.rfc-editor.org/info/rfc2045>.
[RFC2045]Freed，N.和N.Borenstein，“多用途Internet邮件扩展（MIME）第一部分：Internet邮件正文格式”，RFC 20451996年11月<http://www.rfc-editor.org/info/rfc2045>.
[X.841] ITU-T, "Security information objects for access control", ITU-T Recommendation X.841, October 2000.
[X.841]ITU-T，“访问控制的安全信息对象”，ITU-T建议X.841，2000年10月。
[XEP258] Zeilenga, K., "XEP-0258: Security Labels in XMPP", XEP XMPP Extension Protocols, April 2013.
[XEP258]Zeilenga，K.，“XEP-0258：XMPP中的安全标签”，XEP XMPP扩展协议，2013年4月。
Acknowledgements
致谢
The authors appreciate the review, comment, and text provided by community members, including Dave Cridland, Brad Hards, Russ Housley, Steve Kille, Graeme Lunt, Alan Ross, Jim Schaad, and David Wilson.
作者感谢社区成员提供的评论、评论和文本，包括戴夫·克里德兰（Dave Cridland）、布拉德·哈德斯（Brad Hards）、罗斯·霍斯利（Russ Housley）、史蒂夫·基尔（Steve Kille）、格雷姆·伦特（Graeme Lunt）、艾伦·罗斯（Alan Ross）、吉姆·沙德（Jim Schaad）和大卫·威尔逊（David Wilson）。
Authors' Addresses
作者地址
Kurt Zeilenga Isode Limited
库尔特泽林加伊索德有限公司
EMail: Kurt.Zeilenga@isode.com
EMail: Kurt.Zeilenga@isode.com
Alexey Melnikov Isode Limited 14 Castle Mews Hampton, Middlesex TW12 2NP United Kingdom
Alexey Melnikov Isode Limited 14 Castle Mews Hampton，英国米德尔塞克斯TW12 2NP
EMail: Alexey.Melnikov@isode.com
EMail: Alexey.Melnikov@isode.com