Attachment_A1_FBI_-_XML_Cross_Domain_Services_Web_Services_Interface_Requ...pdf

RFQ0016671 – FBI STACH

Attachment A1

UNCLASSIFIED

FEDERAL BUREAU OF INVESTIGATION UNCLASSIFIED PAGE 1 of 2

Attachment 1:

Federal Bureau of Investigation XML-Based Cross Domain Services Web Services Interface Requirements

Related Definitions

Cross Domain Solution (CDS) – all components within the accreditation boundary of the Cross Domain Solution

Guard – the specific security appliance certified to connect to two networks of different classifications.

Broker – a system outside the CDS boundary that initiates Web Service traffic through the CDS

Non-text data – non text data that needs to be included in the XML envelop. Typically non-text documents (PDF, Microsoft Word).

HTTPS – Hypertext Transfer Protocol – Secured is an encrypted application layer protocol for communication over a computer network.

REST – Representational State Transfer is an architectural style, and an approach to communications that is often used in the development of web services.

SOAP – Simple Object Access Protocol is an application layer protocol for exchanging structured data using XML as a messaging format optimized for web services architecture.

Web Services – is an interoperable communication architecture optimized for computer to computer communication. It supersedes and is superior to legacy electronic data interchange (EDI) formats as EDIs are generally proprietary and hence are more difficult to adopt on a wide basis. Web services are based on a common industry standards such as XML, a markup language. Applications can reference the standards to create valid XML Schemas which in turn can be used to validate other XML documents. This permits more flexibility for adding and deleting markup fields.

Web Services Description Language – is a XML-based interface definition language which is used for describing the functionality offered by the web service. It provides a machine readable description of the service, how it can be called , what parameters to expect, and what data structures it returns.

Web Services Interface Requirements:

Consuming the CDS will require programs to adhere to the following requirements:

1. All brokers connecting to the CDS shall connect using HTTPS.

2. Data passed to the CDS shall be in format that can be inspected by the guard.

3. Data must be encrypted at the transport level, not the message level.

4. Prior to submitting data to the guard, a broker shall perform data validation to ensure malicious content is not passed to the guard .

5. The SOAP data shall adhere to Web Service Interoperability (WS-1) Basic Profile Version 1.2.

RFQ0016671 – FBI STACH

Attachment A1

UNCLASSIFIED

FEDERAL BUREAU OF INVESTIGATION UNCLASSIFIED PAGE 2 of 2

6. The SOAP XML data shall pass schema validation checks performed by commercial XML firewalls and the xmllint utility.

All Systems:

The SOAP or REST data shall not contain base-64 encoded objects in the message body.

The SOAP or REST message shall not use SOAP or REST with attachments.

The total SOAP or REST message size shall be less than 30 MB.

For systems that need to pass non-XML data:

The total SOAP or REST message size shall be less than 30 MB.

Any non-XML data imbedded in the SOAP or REST message shall be not be encrypted at the message level, only at the transport level.

Compressed file types shall not be nested more than two files deep.