| Name | Data Type | Value | Scope | Flavors |
| Description | string | An instance of this class defines a security label used to characterize the security clearance necessary to access information in a system that supports mandatory access controls. The labels have two components, one a hierarchical security level and the other a set of non-hierarchical security categories.
Mandatory access control determines whether to allow certain actions, based on the following rules: - If the security level of a security principal is equal to or greater than the security level of an element, and the security categories the security principal include all of the security categories of the element, then the security principal may read from the element. - If the security label of a security principal is equal to or less than the security label of an element, and the security categories the element include all of the security categories of the security principal, then the security principal may write to the element.
An element is assigned a security level via the association, ElementSecurityLevel. It can be assigned to any ManagedElement, such as Locations, Identities, Roles, Systems, Services and LogicalFiles.
The clearance of a security principal, represented by an instance of Identity may be specified by associating an instance of this class via IdentitySecurityClearance.
The set of security levels and categories are determined by a business, organization and/or government based on the need to protect data and entities from attack, loss, abuse or unauthorized disclosure, and the ramifications if this protection is not maintained. | None | TRANSLATABLE= true |
| UMLPackagePath | string | CIM::User::SecurityLevel | None | None |
| Version | string | 2.19.0 | TOSUBCLASS= false | TRANSLATABLE= true |
| Name | Data Type | Qualifiers |
| Name | Data Type | Value | Scope | Flavors |
| Caption | string |
| Description | string | The Caption property is a short textual description (one- line string) of the object. | None | TRANSLATABLE= true |
| MaxLen | uint32 | 64 | None | None |
| Description | string |
| Description | string | The Description property provides a textual description of the object. | None | TRANSLATABLE= true |
| ElementName | string |
| Description | string | A user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information.
Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a Key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a Key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. | None | TRANSLATABLE= true |
| Generation | uint64 |
| Description | string | Generation is an optional, monotonically increasing property that may be used to identify a particular generation of the resource represented by this class.
If Generation is supported by the implementation, its value shall not be null.
Except as otherwise specified, a value (including null) of Generation specified at creation time shall be replaced by null if Generation is not supported by the implementation or shall be a, (possibly different), non-null value if the implementation does support Generation.
After creation and if supported, Generation shall be updated, at least once per access, whenever the represented resource is modified, regardless of the source of the modification.
Note: the Generation value only needs to be updated once between references, even if the resource is updated many times. The key point is to assure that it will be different if there have been updates, not to count each update.
Note: unless otherwise specified, the value of Generation within one instance is not required to be coordinated with the value of Generation in any other instance.
Note:the semantics of the instance, (as defined by its creation class), define the underlying resource. That underlying resource may be a collection or aggregation of resources. And, in that case, the semantics of the instance further define when updates to constituent resources also require updates to the Generation of the collective resource. Default behavior of composite aggregations should be to update the Generation of the composite whenever the Generation of a component is updated.
Subclasses may define additional requirements for updates on some or all of related instances.
For a particular instance, the value of Generation may wrap through zero, but the elapsed time between wraps shall be greater than 10's of years.
This class does not require Generation to be unique across instances of other classes nor across instances of the same class that have different keys. Generation shall be different across power cycles, resets, or reboots if any of those actions results in an update. Generation may be different across power cycles, resets, or reboots if those actions do not result in an update. If the Generation property of an instance is non-null, and if any attempt to update the instance includes the Generation property, then if it doesn't match the current value, the update shall fail.
The usage of this property is intended to be further specified by applicable management profiles.
Typically, a client will read the value of this property and then supply that value as input to an operation that modifies the instance in some means. This may be via an explicit parameter in an extrinsic method or via an embedded value in an extrinsic method or intrinsic operation.
For example: a profile may require that an intrinsic instance modification supply the Generation property and that it must match for the modification to succeed. | None | TRANSLATABLE= true |
| Experimental | boolean | true | TOSUBCLASS= false | None |
| InstanceID | string |
| Description | string | Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following 'preferred' algorithm:
<OrgID>:<LocalID>
Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>.
<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace. For DMTF defined instances, the 'preferred' algorithm MUST be used with the <OrgID> set to 'CIM'. | None | TRANSLATABLE= true |
| Key | boolean | true | None | OVERRIDABLE= false
|
| Override | string | InstanceID | TOSUBCLASS= false | None |
| LabelExpiration | datetime |
| Description | string | Expiration date for this secutitysensitivity label. After this date and time, the clearance represented by this label of a security principal associated by IdentitySecurityClearance shall be revoked.
After this date and time, the security sensitivity of an element associated by ElementSecuritySensitivity should be reevaluated.
If set to NULL, then no expiration date is set, the infinite future default is used, which and implies no expiration date. | None | TRANSLATABLE= true |
| Experimental | boolean | true | TOSUBCLASS= false | None |
| SecurityCategories | string |
| Description | string | A string array that defines zero or more security categories. Examples are business categories such as: Finance, Engineering, Sales, Project X. | None | TRANSLATABLE= true |
| Experimental | boolean | true | TOSUBCLASS= false | None |
| SecurityLevel | string |
| Description | string | A string defining the security sensitivity level. Since individual organizations each may have their own classification systems, the value of this property should include sufficient information to assure that the value is unambiguous. The value of SecurityLevel should be constructed using the following 'preferred' algorithm:
<OrgID>:[<ClassificationScheme>:]<LevelName>
Where <OrgID> and <ClassificationScheme> and <LevelName> are each separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business or government entity creating/defining the classification scheme or is a registered ID that is assigned to the business or government entity by a recognized global authority. In addition, to ensure uniqueness both <OrgID> and <ClassificationScheme> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in SecurityLevel MUST appear between <OrgID> and <ClassificationScheme> and the second colon to appear in SecurityLevel MUST appear between <ClassificationScheme> and <LevelName>.
<ClassificationName> is chosen by the business or government entity and SHOULD not be re-used to identify classification schemes. Each classification scheme defines one or more LevelNames that are unique within the classification scheme. An organization may choose to not use a classification scheme. In that case, each <LevelName> must not contain a colon (':') and must be unique within the organization.
Examples: 'Buffalo.edu:Public', 'Buffalo.edu:Internal Use', 'Buffalo.edu:Confidential', 'Buffalo.edu:Restricted Confidential', 'NSI:Confidential', 'NSI:Secret', and 'NSI: Top Secret' | None | TRANSLATABLE= true |
Copyright © 2008-2010 VMware, Inc. All rights reserved.