Library Requirements

Transcription

1 The Open Group Future Airborne Capability Environment (FACE ) Library Requirements Version 2.2 April 2015 Prepared by The Open Group FACE Consortium Business Working Group Library Subcommittee AMRDEC PR1201 Distribution Statement A Approved for public release; distribution is unlimited

2 Copyright 2015, The Open Group All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior permission of the copyright owner. ArchiMate, DirecNet, Making Standards Work, OpenPegasus, The Open Group, TOGAF, UNIX, and the Open Brand ( X Device ) are registered trademarks and Boundaryless Information Flow, Build with Integrity Buy with Confidence, Dependability Through Assuredness, FACE, IT4IT, Open Platform 3.0, Open Trusted Technology Provider, The Open Group Certification Mark ( Open O ), and UDEF are trademarks of The Open Group. All other brands, company, and product names are used for identification purposes only and may be trademarks that are the sole property of their respective owners. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements, Version 2.2 Document Number: X1317US Authored by The Open Group FACE Consortium. Published by The Open Group, April Comments relating to the material contained in this document may be submitted to: The Open Group, 8 New England Executive Park, Burlington, MA 01803, United States or by electronic mail to: ogface-admin@opengroup.org The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 2

3 Contents 1. Introduction Scope Assumptions Related Documents Library Overview FACE Landing Page FACE Library Portal FACE Registry FACE Library Repositories FACE Product Repositories FACE Product Repositories Verification Retention Repositories Certification Retention Repository PR/CR System Requirements Landing Page Requirements Library Portal Requirements Portal Content Library Portal Metrics User Account Creation Library Portal User Access Verification/Certification/Registration Process UoC Metadata Collection Verification Certification Registration FACE Registry Problem Reporting/Change Requests Repository Requirements General Repository Requirements Reference Repository Requirements Product Repository Requirements Certification Retention Repository Requirements Verification Retention Repository Requirements A Registry Metadata B Product Artifacts C Reference Repository Metadata The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 3

4 1. Introduction The purpose of the Future Airborne Capability Environment (FACE ) Library is to provide the infrastructure for the Software Supplier to develop and certify FACE conformant products. The FACE Library is a tool to connect Software Suppliers with customers through an open listing of FACE certified products and their associated artifacts in a centrally located and managed gateway. This document outlines the architecture and functionality for the FACE Library and defines the Library s requirements. It is written for developers responsible for the design, implementation, and maintenance of FACE Library functions, as well as anyone interested about the operation of the FACE Library. The primary goal of this document is to define the operational and functional requirements for identification, storage, management, certification workflow, and distribution of FACE certified products. This document also communicates the organization and functionality of the FACE Library to stakeholders in government, industry, and academia. 1.1 Scope The basic FACE Library overview, concept, and functionality are summarized in this document. This version of the document updates those requirements based on the latest evolution of the FACE ecosystem and addresses changes to the overall structure of the FACE Library. This version of the document is intended to address US stakeholders only; future versions of this document will address international requirements. 1.2 Assumptions The following assumptions have been identified as relevant to this document: 1. Only products that have achieved FACE conformance certification are listed in the FACE Registry. 2. The FACE Registry (as defined in Section 2.3) is the single reference listing for FACE certified products. 3. FACE product discovery is publicly accessible after login to the FACE Library Portal with a valid address. All Unit of Conformance (UoC) product metadata will be available to the public. 4. Responsibility lies with the Software Supplier to ensure all information is publicly releasable. 5. The FACE Library supports multiple FACE Product Repositories, multiple FACE Verification Retention Repositories, and a single FACE Certification Retention Repository. 6. At the time of this publication, the Certification Authority (CA) has not been selected. Formal certification of FACE conformance can be completed once the CA is officially established. Therefore, portions of this document referring to the CA are for future guidance only. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 4

5 1.3 Related Documents The following is a list of references used in developing this document: Future Airborne Capability Environment (FACE) Technical Standard FACE Conformance Policy FACE Conformance Authorities Plan FACE PR/CR Process The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 5

6 2. Library Overview The FACE Library consists of the following components (see Figure 1): Main FACE Landing Page FACE Library Portal FACE Registry FACE Product Repositories (hosted by individual Software Suppliers) FACE Reference Repository FACE Certification Retention Repository (hosted by the CA) FACE Verification Retention Repositories (hosted by individual VAs) PR/CR System Library Administration FACE Consoritum information FACE Events Procurements FACE Library Infrastructure Main Landing Page Manages conformance and registration workflow VA CoP Library Portal Listing of FACE Certified UoCs Searchable Metadata Registry PR/CR System Reference Repository Verification Retention Repositories Certification Retention Repository Product Repositories VA Site CA Site Vendors Site Problem reports and change requests for Consortium artifacts and tools Dev/Test Tools Business Guide Technical Standard Contract Guide Artifacts submitted for FACE conformance verification / certification Certified FACE Conformant Software and associated artifacts Figure 1: FACE Library Infrastructure The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 6

7 2.1 FACE Landing Page The FACE Landing Page is the public-facing website for the FACE Consortium. The entry point for all components of the FACE Library is via the Landing Page. This page serves to direct users to relevant FACE content. Content on the FACE Landing Page includes, but is not limited to: General information about the FACE Consortium and its products and processes Information about how to develop and certify FACE UoCs Upcoming FACE events Recent FACE solicitations and procurement activities Links to specific FACE content Link to the Problem Reporting and Change Request (PR/CR) System 2.2 FACE Library Portal The Library Portal is accessed via the FACE Landing Page and facilitates moving data through a series of FACE Consortium defined processes. The Library Portal enables: Software Suppliers to enter metadata information about a product into the Verification/Certification/Registration workflow for Library Administrator (LA) review prior to publication in the Registry of FACE certified products. Software Suppliers to initiate a Registry submittal following successful completion of the FACE conformance certification process. Users to initiate a search to find FACE certified products based on the product s metadata. Users to access the Library Portal to collect metrics about a product or group of products. 2.3 FACE Registry The Registry is the single source for listing all FACE certified products. The Registry provides a central point for users to access a searchable listing of all products and information available in the FACE Product Repositories. The Registry requires a user to register and be authenticated prior to being directed to a FACE Repository. The Library Portal allows full public access to the Registry after creation of an account with a valid address. The Registry contains and presents only information that is approved for public release. Only products that are FACE certified products are listed in the Registry. Software Suppliers will be responsible for ensuring all information in the FACE Registry is publicly releasable. 2.4 FACE Library Repositories FACE certified products are stored in a Repository that meets the minimum requirements described in this document. FACE Repositories may be owned and managed by Software Suppliers, government agencies, or other organizations. Information about each FACE certified product or application stored in any of these Repositories is listed in the Registry. The Registry provides contact information for a prospective customer to contact the Software Supplier and initiate discussions to gain access to a registered FACE certified product and artifacts from a Product Repository. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 7

8 2.4.1 FACE Product Repositories A Reference Repository maintains products and documents that are used to define FACE requirements and processes, provide contracting guidance, and facilitate conformance verification. Examples of documents and tools that are stored in a Reference Repository and available for download include: Approved versions of the FACE Conformance Test Suite Published editions of the FACE Technical Standard FACE Conformance Policy FACE Business Guide FACE Reference Implementation Guide A FACE Reference Repository may be controlled and managed by the FACE Consortium, a for-profit company, a government organization, or an academic institution FACE Product Repositories A Product Repository may be controlled and managed by the FACE Consortium, a Software Supplier, a government organization, or an academic institution. Product Repository owners may be contacted through information provided in the Registry and are responsible for determining specific access controls for customers. These repositories are expected to reside at the Software Supplier s site and be physically separate from the centralized FACE Library infrastructure. Software Suppliers are responsible for ensuring the integrity of FACE products stored in a Repository under their control/management in accordance with the FACE Conformance Policy. The minimal requirements for a FACE Product Repository are described in this document Verification Retention Repositories The Verification Authority (VA) must retain a copy of the Verification Package and the Verification Results Package for each product that initiates verification, as detailed in the FACE Conformance Policy and the FACE Conformance Authorities Plan. A Verification Retention Repository is used to store these files. Access to the Repository is restricted to the associated VA and a designated Auditor. These repositories are expected to reside at the VA site and be physically separated from the FACE Library construct. Each VA maintains its own Verification Retention Repository Certification Retention Repository The Certification Authority (CA) must retain a copy of the files generated during certification for each product that initiates FACE Conformance Certification, as detailed in the FACE Conformance Policy and FACE Conformance Authorities Plan. A Certification Retention Repository is used to store these files. Access to this Repository is restricted to the CA and a designated Auditor. The set of files for Conformance Certification includes the following: Conformance Statement Verification Statement, including VA ID Conformance Certificate Legal Agreements The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 8

9 2.4.5 PR/CR System The Problem Reporting/Change Request (PR/CR) System is a tool that implements the FACE PR/CR Process as defined by the FACE Enterprise Architecture Standing Committee. A Problem Report (PR) identifies an issue with FACE Consortium products that prevents a UoC developed to the intent of a particular edition of the FACE Technical Standard from obtaining a Conformance Certificate. A Change Request (CR) identifies either an issue with one or more FACE Consortium products, or a desired improvement to one or more FACE Consortium products. The PR/CR System is used to create, manage, track, and store PRs and CRs that affect the FACE Consortium and its products. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 9

10 3. Requirements 1. The FACE Library shall support modern browsers that conform to current IETF and W3C standards for HTML, JavaScript, and associated technologies. 3.1 Landing Page Requirements 2. The Landing Page shall be hosted on a publicly available, secure web server. 3. The Landing Page web page content shall be updated at the direction of the FACE Library Subcommittee. 4. The Landing Page shall provide administrative backup and archival functions. 5. The Landing Page shall be discoverable by public Internet search engines. 6. The Landing Page shall provide access to the Library Portal. 7. The Landing Page shall provide access to the Registry. 8. The Landing Page shall provide access to Reference Repositories. 9. The Landing Page shall contain overview information about the FACE Consortium. 10. The Landing Page shall provide a list of VAs and their contact information as directed by the FACE Consortium. 11. The Landing Page shall provide guidance to a Software Supplier on how to submit a FACE product for verification, certification, and registration. 12. The Landing Page shall provide a link to the FACE PR/CR System. 13. The Landing Page shall provide Search Engine Optimization (SEO) capabilities. 3.2 Library Portal Requirements 14. The Library Portal shall be hosted on a publicly available, web server. 15. The Library Portal shall use a third-party SSL certificate authority to enable SSL access. 16. The Library Portal shall have intrusion detection capability. 17. The Library Portal shall have tamper detection capability Portal Content 18. The Library Portal web page content shall be updated at the direction of the FACE Library Subcommittee. 19. The Library Portal shall utilize styling attributes as directed by the Library Subcommittee, to include: a. Website theme The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 10

11 b. Full-width or boxed format c. Logos/graphics d. Fonts/text styling e. Color palette 20. The Library Portal shall host a Library Portal user s guide. 21. The Library Portal shall be governed by a Configuration Management (CM) process that covers: a. Configuration management of all Portal website data (e.g., text, graphics, themes) b. Configuration management of all Registry metadata c. Audit procedures Library Portal Metrics 22. The Library Portal shall generate a daily metrics report with the following information: a. Number of page visits b. Number of unique visitors c. IP address of page visitors d. Registry search terms e. Portal entry points (e.g., direct, Google, Bing, , FACE Landing Page) f. Most viewed pages g. Viewership via mobile devices and tablets h. Home page bounce rate 23. The Library Portal shall export metrics in the following formats: a. PDF b. XLSX c. XML 24. The LA shall have the ability to view metrics reports for the entire Library Portal. 25. Software Supplier users shall only have the ability to view metrics reports for the UoCs assigned to their account User Account Creation 26. The Library Portal shall enable a user to create a unique account. 27. The Library Portal shall provide role-based user authentication and access privileges as defined in the Library Policy document. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 11

12 28. The default user account category shall be Software Supplier. 29. Verification Authority and Certification Authority user accounts shall be created at the direction of the Library Subcommittee. 30. The Library Portal shall capture, at a minimum, the following information about users prior to creating a new account: a. First name b. Last name c. Username d. Password e. Company f. Country g. address 31. The Library Portal shall enable access privileges to be granted at both the user and organization levels. 32. The Library Portal shall enable administrator privileges at the organization level. 33. Library Portal usernames shall: a. Include only letters, numbers, and dashes b. Start with a letter and be at least three (3) characters long 34. Library Portal passwords shall: a. Be at least eight (8) characters b. Include at least one (1) of each: upper and lowercase character, number, special character (!%&@#$^*?_~) 35. When creating new user accounts, Library Portal users shall enter password information in two (2) separate text fields for validation. 36. The Library Portal shall generate an confirmation to the user s address with a link for account validation. 37. The Library Portal shall receive validation of an address prior to creating a new user account Library Portal User Access 38. Users shall be able to log into the Library Portal directly from the Library Portal homepage. 39. Prior to log in, users shall be presented with a pop-up message requiring acknowledgement. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 12

13 a. The pop up shall contain, at a minimum, the following message: All content of this website is approved for public and unlimited release. The administrator of this website is not responsible for verifying content is approved for public release. 40. Upon login to the Library Portal, Software Supplier users shall be able to: a. Search the Registry b. Enter metadata information about a UoC into the Verification/Certification/Registration workflow c. View the status of all their UoCs that have been submitted by the user to the Verification/Certification/Registration workflow 41. Upon login to the Library Portal, Verification Authority (VA) Community of Practice (COP) users shall be able to: a. View contact information from all VA COP members b. Access a VA COP knowledge base c. View a VA COP message list d. View an event log of past and future VA COP events e. Participate in a discussion forum with other VA COP members f. Send messages to the VA COP administration 42. The Library Portal shall log users out of the Portal after 15 minutes of inactivity Verification/Certification/Registration Process 43. The Library Portal shall provide notifications to the Software Supplier, VA, and/or Certification authority after each change of status. 44. The Library Portal shall capture the status of the Verification/Certification/Registration process for each FACE product UoC Metadata Collection 45. The Library Portal shall require positive affirmation of public availability of submitted metadata. 46. The Library Portal shall assign a single unique identifier to associate a single FACE product with its associated Verification/Certification/Registration data. 47. The Registry shall allow the administrator to create and maintain metadata templates to collect UoC metadata information defined in Appendix A, or as directed by the Library Subcommittee. a. UoC metadata templates shall be customizable by the LA in real time. b. UoC metadata templates shall contain, at a minimum, the following field types: i. Headings ii. Text (single line) The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 13

14 iii. iv. Text (multi-line) URL v. vi. vii. viii. ix. Number Selection Date Checkbox x. Image upload xi. xii. File upload Linked field 48. The Registry shall enable updated metadata templates to be applied to all UoCs in the Registry Verification 49. The Library Portal shall allow a VA to securely submit the Verification Statement. 50. The Library Portal will enable the VA to generate the Verification Statement in PDF format Certification 51. The Library Portal shall allow the CA to securely submit a Conformance Certificate Registration 52. The Library Portal shall allow a Software Supplier to submit metadata for a FACE certified product for Registration. 53. The Library Portal shall allow the LA to review and approve product metadata for publication. 54. The Library Portal shall allow a Software Supplier to modify metadata on registered FACE products except for those fields reserved for the VA and CA. 55. The Library Portal shall allow a Software Supplier to remove a UoC from published Registry listings. 56. The Library Portal shall allow an LA to remove a UoC from published Registry listings. 57. The Library Portal shall allow transfer of a registered UoC between individual Software Supplier user accounts. 58. The Library Portal shall allow a Software Supplier to delete a FACE product from the Portal. 59. The Library Portal shall provide user access to FACE Consortium work products and tools in the Reference Repository. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 14

15 FACE Registry 60. The FACE Library shall provide a single Registry of certified FACE UoCs and UoC Packages. 61. The Library Portal shall allow public access to the Registry after creation of a user account with a valid address. 62. The Library Portal shall allow an authenticated user to browse listings of FACE products in the Registry. 63. The Registry shall maintain links between UoCs and their associated approved UoC Packages, if applicable. 64. The Registry shall be hosted on a publicly available web server that is secured with SSL. 65. The Library Portal shall allow an authenticated user to submit search queries on product metadata in the Registry and return results. 66. The Registry shall display UoC metadata fields defined in Appendix A, or as directed. 67. The Registry shall enable keyword search of all the UoC metadata fields. 68. The Registry shall enable search of each UoC metadata field. 69. The Registry shall enable filtering of the UoC metadata for each of the following field types, at a minimum: a. Selection b. Checkbox c. Number 70. The Registry shall enable sorting by the UoC metadata fields. 71. The Registry shall support export of UoC metadata content in the following formats, at a minimum: a. PDF b. XLSX c. XML 72. The Registry shall allow Software Suppliers to view real-time metrics related to their UoC listings, including: a. Keywords searched b. Frequency of appearance in search results c. Number of views of a UoC d. Country of origin of viewers of a UoC The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 15

16 Problem Reporting/Change Requests 73. The Library Portal shall provide a tool to collect and manage feedback from users on FACE Consortium work products and tools via the Consortium-defined PR/CR process. 3.3 Repository Requirements General Repository Requirements These general Repository requirements apply to the Reference Repository, Certification Retention Repository, and the Verification Retention Repositories. 74. The FACE Library shall allow multiple, independent Product Repositories managed by Software Suppliers. 75. The FACE Library shall support a single Certification Retention Repository managed by the CA. 76. The FACE Library shall allow multiple, independent Verification Repositories managed by VAs. 77. Repositories shall enable authenticated access control. 78. Repositories shall permit Repository administrator removal of products. 79. Repositories shall provide the services listed below and depicted in Figure 2: a. A front end device is the end user s method of interacting with the FACE Repository and provides the user interface. b. Encryption services ensure a secure connection between a user and the Repository. c. Connection services define how data will be moved within the FACE Repository. d. Authentication and authorization services ensure users are authorized to access material stored in the FACE Repository. e. Content Management services manage the storage, indexing, and retrieval of data in the Repository. f. Library Management services provide data to support administration of the FACE Repository and ensure Configuration Management of Repository data. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 16

17 Authentication and Authorization Services User Credentials Permissions Content Management Services Storage Retrieval KEY External System Elements Service Internal Interfaces External Interfaces Indexing Connection Services Service Interfaces Library Management Services Configuration Management/ Version Control Logging Dashboard Metrics Front End Device Encryption Services Maintenance Encryption Figure 2: FACE Repository Services Reference Repository Requirements 80. The FACE Library shall provide a single Reference Repository Portal, with links as appropriate to individual FACE products, documents, and tools that may be controlled and managed by the FACE Consortium, a for-profit company, a government organization, or an academic institution. 81. The Reference Repository shall only accept products that have been approved by the FACE Consortium for publication. 82. The Reference Repository shall allow the LA to create reference product listings. 83. The Reference Repository shall maintain all previous versions of stored work products and tools. 84. The Reference Repository shall store metadata for work products and tools as defined in Appendix C. 85. The Reference Repository shall allow for downloading of FACE work products and tools Product Repository Requirements This section contains recommended requirements for the Software Supplier s Product Repository. 86. The Product Repository shall limit access to users defined by the Software Supplier. 87. The Product Repository shall store certified FACE UoCs and any associated artifacts (see Appendix B) that are advertised in the UoC Registry entry. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 17

18 88. The Product Repository shall enable retrieval of a certified FACE UoC and its associated artifacts. 89. The Product Repository shall retain a certified FACE UoC for the duration that the UoC is listed in the Registry. 90. The Product Repository shall provide a unique designation for an unalterable configuration of a specific UoC Certification Retention Repository Requirements 91. The Certification Retention Repository shall contain a working subsection. 92. The Certification Retention Repository shall contain a retention subsection. 93. The Certification Retention Repository shall contain a directed output subsection. 94. The working subsection of the Certification Retention Repository shall be restricted to Software Suppliers and the CA. 95. The retention subsection of the Conformance Certification Retention Repository shall only be accessible by the CA and designated Auditor. 96. The directed output subsection of the Certification Retention Repository shall be accessible by the CA for Software Supplier output. 97. The Certification Retention Repository shall allow selective deletion of contents within all subsections when selected by the CA. 98. The Certification Retention Repository shall allow selective moving of contents within all subsections when selected by the CA Verification Retention Repository Requirements 99. A Verification Retention Repository shall contain a working subsection A Verification Retention Repository shall contain a retention subsection A Verification Retention Repository shall contain a directed output subsection The retention subsection of a Verification Retention Repository shall be accessible by only the VA and designated Auditor The working subsection of a Verification Retention Repository shall be accessible by only the Software Supplier and the VA The directed output subsection of a Verification Retention Repository shall be accessible by only the Software Supplier and the VA The Verification Retention Repository shall allow selective deletion of contents within all subsections when selected by the VA The Verification Retention Repository shall allow selective moving of contents within all subsections when selected by the VA. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 18

19 A Registry Metadata Metadata Metadata Description Name of product Acronym FACE Conformance Certificate FACE Base Line (B/L) Product Version Date of Approval Software Supplier s Name Software Supplier s Address Software Supplier Point of Contact (POC) Licensing Categories Repository Links Key Words Product Background Description Safety Certifications Security Certifications Information Assurance (IA) Certifications Applicable Segment(s) Dependencies The formal name of the product. The abbreviated name for the product. The FACE Conformance Certificate from the CA. Version number of the FACE Technical Standard that the product was certified against. The specific product version number certified as FACE conformant. The date the product was certified as FACE conformant. The name of the organization or company providing the product. The address of the organization or company providing the product. The title, name, and contact information of the primary person to be contacted. The terms under which the product is available to be licensed. Individual or multiple web-based links from the Registry to any appropriate Repository and/or back to any vendor's website. Links may also take the form of links. Identification of key words that describe the product for searching purposes. Identifies whether the product has been used before and provides some high-level descriptions or where or how without mentioning the aviation platforms. Also describes the organization(s) supported. Free text description of the FACE product. Applicable product safety certifications and certifying authority. Applicable product security certifications and certifying authority. Applicable product IA certifications and certifying authority. The segment or layer within the FACE Technical Standard such as PCS transport, platform-specific, operating, etc. (Segment selection will be mutually exclusive.) Applicable hardware or software dependencies. The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 19

20 Metadata Previous Versions Logo FACE Profile OS API Type Flash Memory Size RAM Memory Size Application Interfaces Available Artifacts Metadata Description Registry links to previous versions of the product. Company/product logo. Identifies which FACE operating profiles are supported by the product. Identifies certified FACE conformant operating system requirements for the product. Minimum static memory requirements (OFP footprint). Minimum dynamic memory requirements. Listing of exposed product application interfaces. Listing of artifacts available (see Appendix B: Product Artifacts). The Open Group Future Airborne Capability Environment (FACE ): Library Requirements 20