Namespace and Schema Information Security

Copyright © 2013 Open Geospatial Consortium. 89 4.3 Registry Repository 4.3.1 Interface Discoverability SWIM-SC-0070 WSDL documents corresponding to SWIM service endpoints SHALL be registered with the SWIM Service Registry Repository in accordance with TBD. One WSDL document may describe many endpoints. OGC Standards Perspective - Fully Compliant The OGC service standards define web service operations and schema, which can easily be integrated in a WSDL description of the service. Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. SWIM-SC-0071 SWIM service WSDL documents SHALL NOT be published through any mechanism other than the SWIM Service Registry Repository. Those mechanisms prohibited include, but are not limited to direct publishing using HTTP from the service provider site. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied by service providers.

4.3.2 Interface Categorization

SWIM-SC-0080 SWIM services SHALL be categorized in the SWIM Service RegistryRepository as described in FAA-STD-064 and FAA-STD-066. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the standards to create this information. SWIM-SC-0082 ?419-?4-0125:141 structure for SWIM service messages SHALL be categorized in the SWIM Service RegistryRepository using SWIM service taxonomy categories as described in TBD. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the standards to create this information.

4.4 Namespace and Schema

SWIM-SC-0090 SWIM service WSDL documents SHALL define services within a namespace that has been registered by the service provider in the FAA Data Registry FDR. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the 90 Copyright © 2013 Open Geospatial Consortium. standards to create this information. SWIM-SC-0091 SWIM service message schemas SHALL use namespaces that have been registered in the FAA Data Registry FDR. OGC Standards Perspective - Fully Compliant Schemas are defined in OGC standards for the information exchanges and are registered in the namespace defined by the OGC. These namespaces would need to be registered with the FAA Data Registry FDR by an implementer, FDR administrator or other entity. Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set.

4.5 Service Interface Design

SWIM-SC-0100 SWIM service interfaces SHALL be described by a Web Service Definition Language WSDL v2.0 document. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the standards to create this information. SWIM-SC-0101 SWIM service interfaces MAY be described by a WSDL v1.1 document. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the standards to create this information. Copyright © 2013 Open Geospatial Consortium. 91 SWIM-SC-0102 The message content that may be sent or received by a SWIM service SHALL be described by one or more 419-125:55;: documents. OGC Standards Perspective - Fully Compliant However, it is appropriate to note that even if there is a schema, its contents still do not define all necessary details to make use of messages that comply to it. The schema may allow for dynamic or even any content using substitution groups or elements of anyType, or any elements. In addition the semantic of the encoded data is usually described elsewhere. Product Implementation Perspective - Fully Compliant This is certainly fulfilled by all OGC compliant services in implementation. SWIM-SC-0103 The message content schema for messages that may be sent or received by a SWIM service SHALL NOT be defined in the WSDL document, and SHALL be in a ?1--1 OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the standards to create this information. SWIM-SC-0104 SWIM services shall be described by an FAA Web Service Definition Document WSDD in accordance with STD065, Preparation of Web Service Description Documents. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant A WSDD is a more detailed service description and is designed to communicate service capabilities to human readers. If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer can develop this information if required. 92 Copyright © 2013 Open Geospatial Consortium.

4.5.2 Service Interface WS-I Compliance

SWIM-SC-0110 SWIM service WSDL interface descriptions SHALL be compliant with the Service Description requirements defined in the SWIM Interoperability Basic Profile a SWIM-annotated version of the Web Services Interoperability Basic Profile v1.2, section 4. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant Although some participants indicate that they support this requirement, most products do not at this time. If required for the implementation, this requirement can be satisfied within the OGC standards set. The product developer has the tools within the standards to satisfy this requirement.

4.6 Information Security

SWIM-SC-0120 SWIM services shall implement security consistent with NIST Special Publication 800-95 Guide to Secure Web Services [NIST800-95]. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant Security is generally implemented by OGC services at the HTTPS, SOAP, REST layers as a common practice. Higher level application layer security including registry security, e.g. identity management and access controls, are usually applied outside of the services to ensure that the user is authorized to access the service and has the permissions for the types of data requested. Additional security measures can be implemented depending upon the requirements. Copyright © 2013 Open Geospatial Consortium. 93 SWIM-SC-0121 SWIM services shall be compliant with the requirements defined in the SWIM Interoperability Basic Security Profile a SWIM-annotated version of the Web Services Interoperability Basic Security Profile. OGC Standards Perspective - Fully Compliant Product Implementation Perspective - Provisionally Compliant Security is generally implemented by OGC services at the HTTPS, SOAP, REST layers as a common practice. Higher level application layer security including registry security e.g. identity management and access controls are usually applied outside of the services to ensure that the user is authorized to access the service and has the permissions for the types of data requested. Additional security measures e.g. those in the SWIM WS-I Basic Security Profile can be implemented depending upon the requirements.

4.7 Service Management