GP.Data Transport - Revision history

Jan Schoonderbeek: brought access aggregation back in the pattern

2015-01-15T19:34:54Z

brought access aggregation back in the pattern

← Older revision		Revision as of 19:34, 15 January 2015
Line 15:		Line 15:
	{{Pattern Graphic		{{Pattern Graphic
	\|graphic=GP.Data Transport.png		\|graphic=GP.Data Transport.png
			\|source=GP.
	\|size=600px		\|size=600px
	\|title=Data Transport pattern		\|title=Data Transport pattern
Line 22:		Line 23:
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
	\|function=GF.Access Conditioning		\|function=GF.Access Conditioning
	\|choice=~~May~~		\|choice=Must
	\|reason=This function indicates special or additional processing that needs to occur when an infrastructure facility is going to use this Data Transport service.		\|reason=This function indicates special or additional processing that needs to occur when an infrastructure facility is going to use this Data Transport service.
			}}
			{{Generic Pattern Composition Row
			\|function=GF.Access Aggregation
			\|choice=Must
			\|reason=This function handles the concentration of network access.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
Line 33:		Line 39:
	\|function=GF.Address Lookup		\|function=GF.Address Lookup
	\|choice=May		\|choice=May
	\|reason=Usually an address scheme is chosen for a logical network (or combination thereof), but a different scheme of names is used by the clients (or the network internally). This facility takes care of the translation from name to address (and optionally from address to name). It is not needed in the rare case that no name schemes are in use.		\|reason=Usually an address scheme is chosen for a logical network (or combination thereof), but a different scheme of names is used by the clients (or the network internally). This facility takes care of the translation from name to address (and optionally from address to name). It is not needed in the rare case that no name schemes are in use.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
	\|function=GF.Interconnection		\|function=GF.Interconnection
	\|choice=May		\|choice=May
	\|reason=When designing larger networks, then there may be a need to link multiple network segments over relatively large distances. Interconnection is the Generic Function that can provide this functionality, and it handles the challenges that are associated with networking over these longer distances. Note that this GF also allows for (unencrypted) tunneling between Data Transport Zones.		\|reason=When designing larger networks, then there may be a need to link multiple network segments over relatively large distances. Interconnection is the Generic Function that can provide this functionality, and it handles the challenges that are associated with networking over these longer distances. Note that this GF also allows for (unencrypted) tunneling between Data Transport Zones.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
Line 56:		Line 62:
	Also, the combination of Encryption and Interconnection can represent remote-connection facilities like a VPN service/dial-in service. Note however that most often it is required to route the traffic entering and leaving this remote-connection facility through the Data Zone Protection pattern. This is because users and systems connecting to the Data Transport Zone often reside in a different Data Transport Zone, security-wise.		Also, the combination of Encryption and Interconnection can represent remote-connection facilities like a VPN service/dial-in service. Note however that most often it is required to route the traffic entering and leaving this remote-connection facility through the Data Zone Protection pattern. This is because users and systems connecting to the Data Transport Zone often reside in a different Data Transport Zone, security-wise.

	Note that when modeling a remote-connection facility, the Data Transport pattern represents a logical data transport zone that encompasses the remote users and the interlinks to the organization's remote connection facility; this zone is separate from the logical data transport zone that the users are connecting to.		Note that when modeling a remote-connection facility, the Data Transport pattern represents a logical data transport zone that encompasses the remote users and the interlinks to the organization's remote connection facility; this zone is separate from the logical data transport zone that the users are connecting to.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
	\|function=GF.Reduction		\|function=GF.Reduction
	\|choice=May		\|choice=May
	\|reason=Just as with Encryption, it may be necessary to add extra functionality to any Interconnection. Reduction in this case can be added to make better use of the available capacity on the Interconnection.		\|reason=Just as with Encryption, it may be necessary to add extra functionality to any Interconnection. Reduction in this case can be added to make better use of the available capacity on the Interconnection.
	}}		}}
	{{Table Ending}}		{{Table Ending}}
Line 68:		Line 74:
	\|service=GS.Authentication+Authorization		\|service=GS.Authentication+Authorization
	\|choice=May		\|choice=May
	\|reason=If a network section needs security, this facility can be included. In essence it provides (a generic form of) access control, by performing one or more checks on the connecting infrastructure facility that tries to gain access to, or use, the network. Access controls are a form of authorization data, which are stored in an (included) Permission Register.		\|reason=If a network section needs security, this facility can be included. In essence it provides (a generic form of) access control, by performing one or more checks on the connecting infrastructure facility that tries to gain access to, or use, the network. Access controls are a form of authorization data, which are stored in an (included) Permission Register.
	}}		}}
	{{Generic Pattern Adjacent Service Row		{{Generic Pattern Adjacent Service Row
	\|service=GS.Data Zone Protection		\|service=GS.Data Zone Protection
	\|choice=May		\|choice=May
	\|reason=Usually two logical network segments are described by different Data Transport pattern variants because the security contexts (and thus requirements) for the segments differ. If this is the case, then a connection between these segments needs to make use of this pattern Data Zone Protection, in order to ensure the right security levels in both segments. However if the network segments have the same security requirements (and differ only in characteristics and/or quality levels), then they can be linked without use of this adjacent pattern.		\|reason=Usually two logical network segments are described by different Data Transport pattern variants because the security contexts (and thus requirements) for the segments differ. If this is the case, then a connection between these segments needs to make use of this pattern Data Zone Protection, in order to ensure the right security levels in both segments. However if the network segments have the same security requirements (and differ only in characteristics and/or quality levels), then they can be linked without use of this adjacent pattern.
	}}		}}
	{{Generic Pattern Adjacent Service Row		{{Generic Pattern Adjacent Service Row

Jan Schoonderbeek: New GP

2014-12-19T10:47:03Z

New GP

New page

{{Maturity|2}}
{{Pageheaderbox4GP
|name=Data Transport
|sector=Core
|version=0.4
|owner=J.A.H. Schoonderbeek
|summary=This Pattern provides the means to transport digital data between automated systems.
}}
This Pattern provides the means to transport digital data between automated systems, within a single "Data Transport Zone", as well as to and from adjacent Data Transport Zones.

Note that the data transport over multiple Data Transport Zones with differing owners and/or security requirements must usually pass one or more Data Transport Zone Protection services, to satisfy the respecitve security requirements.
{{Pattern Realizes
|service=GS.Data Transport
}}
{{Pattern Graphic
|graphic=GP.Data Transport.png
|size=600px
|title=Data Transport pattern
|kind=Generic
}}
{{Generic Pattern Composition}}
{{Generic Pattern Composition Row
|function=GF.Access Conditioning
|choice=May
|reason=This function indicates special or additional processing that needs to occur when an infrastructure facility is going to use this Data Transport service.
}}
{{Generic Pattern Composition Row
|function=GF.Distribution
|choice=Must
|reason=This function lies at the heart of the data transport service.
}}
{{Generic Pattern Composition Row
|function=GF.Address Lookup
|choice=May
|reason=Usually an address scheme is chosen for a logical network (or combination thereof), but a different scheme of names is used by the clients (or the network internally). This facility takes care of the translation from name to address (and optionally from address to name). It is not needed in the rare case that no name schemes are in use.
}}
{{Generic Pattern Composition Row
|function=GF.Interconnection
|choice=May
|reason=When designing larger networks, then there may be a need to link multiple network segments over relatively large distances. Interconnection is the Generic Function that can provide this functionality, and it handles the challenges that are associated with networking over these longer distances. Note that this GF also allows for (unencrypted) tunneling between Data Transport Zones.
}}
{{Generic Pattern Composition Row
|function=GF.Controlling
|choice=Must
|reason=The purpose of this function within the Pattern is to focus the attention on the security aspects of an available means to read and/or alter the configuration of the Data Transport facility, thereby revealing security sensitive details and/or allow unauthorized modification of access to the Data Transport facility.
}}
{{Generic Pattern Composition Row
|function=GF.Connection Handling
|choice=May
|reason=This function supports users or systems connecting with this Data Transport Zone over a different path than a connection with this or an adjacent Data Transport Zone. The most common example of this would be a VPN connection. Note that the VPN solution itself is likely to form a Data Transport Zone separate from the Data Transport Zone that it's providing access to.
}}
{{Generic Pattern Composition Row
|function=GF.Encryption
|choice=May
|reason=It may be necessary to connect Data Transport Zones using untrusted intermediary networks (essentially all networks not under control by the organization). In this case, the tunnel between the Zones must be encrypted using this GF.
Also, the combination of Encryption and Interconnection can represent remote-connection facilities like a VPN service/dial-in service. Note however that most often it is required to route the traffic entering and leaving this remote-connection facility through the Data Zone Protection pattern. This is because users and systems connecting to the Data Transport Zone often reside in a different Data Transport Zone, security-wise.

Note that when modeling a remote-connection facility, the Data Transport pattern represents a logical data transport zone that encompasses the remote users and the interlinks to the organization's remote connection facility; this zone is separate from the logical data transport zone that the users are connecting to.
}}
{{Generic Pattern Composition Row
|function=GF.Reduction
|choice=May
|reason=Just as with Encryption, it may be necessary to add extra functionality to any Interconnection. Reduction in this case can be added to make better use of the available capacity on the Interconnection.
}}
{{Table Ending}}
{{Pattern Adjacent Services}}
{{Generic Pattern Adjacent Service Row
|service=GS.Authentication+Authorization
|choice=May
|reason=If a network section needs security, this facility can be included. In essence it provides (a generic form of) access control, by performing one or more checks on the connecting infrastructure facility that tries to gain access to, or use, the network. Access controls are a form of authorization data, which are stored in an (included) Permission Register.
}}
{{Generic Pattern Adjacent Service Row
|service=GS.Data Zone Protection
|choice=May
|reason=Usually two logical network segments are described by different Data Transport pattern variants because the security contexts (and thus requirements) for the segments differ. If this is the case, then a connection between these segments needs to make use of this pattern Data Zone Protection, in order to ensure the right security levels in both segments. However if the network segments have the same security requirements (and differ only in characteristics and/or quality levels), then they can be linked without use of this adjacent pattern.
}}
{{Generic Pattern Adjacent Service Row
|service=GS.Data Transport
|choice=May
|reason=Different Data Transport facilities can be linked - the facilities would differ in e.g. organizational ownership, security level or physical location.
}}
{{Table Ending}}
{{Text Footer GP}}