COMMERCIAL IP SECURITY OPTION (CIPSO)

Citation

• Internet draft, July 1992

Annotations

• DoD? Basic Security Option (BSO) (Type 130)
• DoD? Extended Security Option (ESO) (Type 133)
• CIPSO has been designed to provide the format and procedures required to support a Mandatory Access Control security policy and multi-level security in commercial operating systems.

CIPSO Format

Option type: 134 (Class 0, Number 6, Copy on Fragmentation) Option length: Variable

• DOI governs the interpretation of those tags.

• SELinux: focus on enforce security on local resources.
• Netlabel: focus on enforce security by packet labeling (CIPSO) using LSM hooks to implementing the labeling and checking. Incoming sockets get a context that is based on the CIPSO tag and the context of the listening socket. Current implementation of NetLabel? support just one tag type.