BSL GEN Requirements

Rqmt ID	Title	Description	Rationale	Verification
BSL-GEN-1-0	RFC 9172 Compliance	The BSL shall be compliant with RFC 9172.	RFC 9172 defines the purposes and function of an implementation of BPSec to include normative statements of required structures and behaviors that do not need to be recreated in this document.	Test
BSL-GEN-1-1	Deterministic Processing Order for Security Blocks	The BSL shall impose a deterministic processing order for all security blocks.	RFC9172 requires security block processing order in certain circumstances (Section 5.1). The BSL will implement a deterministic processing order in all cases as part of the BSL design.	Test
BSL-GEN-2-0	Addition of a Security Block	The BSL shall construct security blocks for inclusion in a bundle.	To add a security operation to a bundle, the BSL may construct a new security block. Alternatively, some security operations can be added to existing security blocks in the bundle (see BSL-GEN-2-2). The actual addition of a security block to a bundle is performed by the BPA.	Test
BSL-GEN-2-1	Addition of Security Operations	The BSL shall add security operations to a security block.	To fulfill the Security Source role, the BSL adds security operations to a bundle.	Test
BSL-GEN-2-2	Determination of Addition of Security Block	The BSL shall determine whether a new security block can be added to the bundle when adding a security operation to a bundle.	The BPA defers to the BSL when security needs to be added.	Test
BSL-GEN-2-3	Validate SOP Uniqueness	The BSL shall ensure that security operations in a bundle are unique.	The BSL will maintain compliance with RFC 9172. This requirement captures that it is the responsibility of the BSL to check/enforce this uniqueness constraint.	Test
BSL-GEN-3-0	Removal of Security Operations	The BSL shall remove security operations from a bundle.	To fulfill the Security Acceptor role (and to handle some security processing failure cases), the BSL removes security operations from a bundle.	Test
BSL-GEN-3-1	Determination of Removal of a Security Block	The BSL shall determine when a security block should be removed from a bundle.	The BSL may request the removal of a security block from the bundle for several reasons, including: a)     All of the security operations associated with that security block have been removed; b)     Removal of the security block is required by policy; or c)     An error has occurred during security processing. The actual removal of information from a bundle is performed by the BPA.	Test
BSL-GEN-3-2	Discarding a Security Block Upon Security Operation Removal	The BSL shall inform the BPA to discard a security block when all security operations for that block have been removed.	The BPA will act upon information regarding successful processing.	Test
BSL-GEN-4-0	Read Block Contents	The BSL shall read non-security block contents as provided by the BPA.	The BSL needs block data, such as block type and the BTSD of security target blocks, in order to apply security services to the blocks in a bundle.	Test
BSL-GEN-5-0	Update Block Contents	The BSL shall provide updated block contents to the BPA.	The BSL may need to change the contents of a security target block. For instance, the BSL must replace the security target block’s BTSD with ciphertext when it is the target of a BCB-confidentiality security operation.	Test
BSL-GEN-6-0	Encode BTSD	The BSL shall encode the BTSD produced for a security block in compliance with RFC9172 encodings.	Security blocks are wire-encoded when provided to the BPA for inclusion. This avoids issues with differing internal representations of bundle structures for different BPA implementations. The information necessary to represent the security block in the bundle is provided, in part, by the BPA (described in Assumptions). The BSL produces security-specific configuration information for a new security block is provided by security policy.	Test
BSL-GEN-7-0	Decode BTSD	The BSL shall decode the BTSD of a RFC9172 encoded security block.	Security blocks are wire-encoded when received by the BPA for processing. This avoids issues with differing internal representations of bundle structures for different BPA implementations. Blocks provided by the BPA must be decoded so that the BSL can use the block characteristics and data to generate and process security results.	Test
BSL-GEN-8-0	SOP Role Determination	The BSL shall determine what security role (if any) the local node shall have for a given security operation.	The BPA defers to the BSL when security needs to be processed. Some of this processing is adding security operations/blocks and some of the processing is removing security operations/blocks. RFC9172 defines three security roles: 1) Security Acceptor 2) Security Verifier 3) Security Source	Test
BSL-GEN-9-0	Perform Processing Action(s)	The BSL shall perform processing action(s) in response to security operation lifecycle events when required by policy.	To apply security policy to a bundle, the BSL must execute the configured processing actions associated with a security operation lifecycle event if it occurs. Processing actions may be performed using host interface calls as opposed to directly implementing actions in the BSL itself.	Test
BSL-GEN-9-1	Delete Security Block	The BSL shall request that a BPA remove a security block when required by policy.	Local security policy may require the BSL to delete a security block in response to the occurrence of a particular security operation lifecycle event.	Test
BSL-GEN-9-2	Delete Security Target Block	The BSL shall request that a BPA delete a security target block when required by policy.	Local security policy may require the BSL to delete a security target block in response to the occurrence of a particular security operation lifecycle event.	Test
BSL-GEN-9-3	Delete Security Operations	The BSL shall request that the BPA delete all security operations represented by a security block when required by policy.	Local security policy may require the BSL to delete all security operations for a specific security block in response to the occurrence of a particular security operation lifecycle event.	Test
BSL-GEN-9-4	Delete Bundle	The BSL shall request that the BPA delete a bundle when required by policy.	Local security policy may require the BSL to delete a bundle in response to the occurrence of a particular security operation lifecycle event.	Test
BSL-GEN-9-5	Generate Status Report	The BSL shall generate a bundle status report when required by policy.	Local security policy may require the BSL to generate a bundle status report in response to the occurrence of a particular security operation lifecycle event.	Test