Tessera for Windows

Standards-Compliant Data-Centric Security

Labels and protection for the Windows desktop. Every file carries a bound NATO confidentiality label, and its key is released only after the reader's clearance has been checked against that label.

The Problem with Perimeter Security

Traditional network-perimeter security works well when all sensitive work happens inside a controlled boundary. In practice, that boundary is constantly crossed: files are shared with coalition partners, archived on removable media, sent by email, or moved to systems outside the organisation's direct control.

When a file leaves the perimeter, it leaves behind the access controls that were protecting it. At that point there is nothing stopping an unauthorised recipient from reading it — or an authorised one from forwarding it further.

Data-centric security inverts this model. The protection is not in the boundary around the data — it is embedded in the data itself. A protected file opens only after a key access service has checked the reader's clearance against the file's label, wherever the file is.
Perimeter Model
Inside network boundary
Secret file — protected
File crosses boundary
No protection — policy lost
Partner / archive / cloud
Anyone can read
Data-Centric Model
Inside or outside boundary
Encrypted, label bound
File crosses boundary
Still encrypted, label bound
Decryption attempt
Clearance checked: allow or deny

How It Works

Three steps, each defined by NATO standards.

1
Protect

The user labels a file from the application they are working in. The file is encrypted, and the label is bound to the content with a digital signature.

2
Travel

The protected file can be stored, copied, e-mailed or archived. The label and the protection travel with it and cannot be removed without detection.

3
Enforce

When someone opens the file, a key access service checks their clearance against the label at that moment. The key is released only if every condition is met.

Components

The desktop components handle labelling and display. The services decide who may read what.

Office add-ins

Word, Excel, PowerPoint and Outlook show the marking of every document and message, and apply labels from the ribbon.

Notepad++ plug-in

Plain-text files get the same banner and the same labelling as Office documents.

File Explorer integration

Markings on file icons and in columns, and Protect and Open commands in the context menu.

Protected drives

Protected files open for editing and are sealed again on close. No readable copy is left on the disk.

Key access service

Releases a file's key only after the reader's clearance has been checked. It never stores content.

Management and identity

Central configuration, audit of every key release, and sign-in with the organisation's identity provider.

Security Characteristics

Strong encryption

Each file has its own key. Any change to the encrypted content is detected.

Signed labels

The label is bound to the content with a digital signature, so it cannot be altered or moved to another file.

Decision at every open

Access is checked each time a file is opened. A withdrawn clearance takes effect at the next attempt.

Keys bound to the device

Key requests are tied to the requesting device, so a stolen sign-in token cannot be used elsewhere.

Several key services

A file can name key services at several sites. When one is unreachable, another releases the key.

No plaintext on disk

Files being edited are kept out of reach of other programs and are sealed again when they close.

View the standards reference →

The Label, in the Application

Classifications are not hard-coded. Everything the user is offered — the levels, their order, and the categories that may qualify them — is read from the domain's XMLSPIF, so the desktop speaks exactly the vocabulary the policy authority published. The screenshots below use TESSERA, a fictional demonstration policy we publish for testing, so that nothing shown here is a real classification marking.

The Tessera dialog with the classification list open, showing the six levels of the TESSERA demonstration policy: UNMARKED, INTERNAL, RESTRICTED, CONFIDENTIAL, SECRET and TOP SECRET.
The levels come from the policy. Selecting a policy fills the classification list from that policy's definition, in the order the policy ranks the levels.
The Tessera dialog with a completed label: TESSERA policy, SECRET classification, releasable to ARC and SYL, LODESTAR special category designator and DEMO administrative marking.
Categories follow the policy. Each kind of category behaves as the policy defines it: Releasable To admits a reader who holds any one of the values, a Special Category Designator must be held explicitly, and an Administrative marking informs the reader without affecting access.
Notepad++ with the Tessera banner above the text, reading TESSERA, SECRET, Releasable To ARC and SYL, Special Category Designators LODESTAR, Administrative DEMO, and the signed-in user.
The label where the work happens. The banner shows the label that is bound to the file, not text typed into it. The tick names the user the label was verified for.
Microsoft Word with a labelled document and the Tessera banner above it, reading TESSERA, CONFIDENTIAL, Rel ARC and SYL, and the signed-in user.
The label travels inside the document. It survives a copy, a rename and an e-mail, and appears in whichever application opens the file next.
Microsoft Excel with a labelled workbook and the Tessera banner reading TESSERA, RESTRICTED, Rel TCN, and the signed-in user.
A different level, a different marking. This workbook is RESTRICTED and released to a coalition group. The add-in shows what the policy defines for that level, including the colour.
Notepad++ with the Tessera banner in green, reading TESSERA, INTERNAL, Releasable To TCN, and the signed-in user.
The banner follows the level. The same editor with an INTERNAL document, shown in the colour the policy assigns to that level.

Standards implemented in Tessera for Windows

ACP-240 STANAG 4774 STANAG 4778 ADatP-5636 ADatP-5663 XMLSPIF v2.1/v3.0 RFC 8785 JCS RFC 9449 DPoP RFC 5652 CMS