ADatP-4778 metadata binding mechanism

What it is

ADatP-4778 is a NATO Allied Data Processing Publication that defines a Metadata Binding Mechanism: an XML syntax for tying a piece of metadata to the data object it describes, so that a system receiving both can trust the association between them. The document's own objective is "to provide a generally applicable, formal and consistent way to describe and categorise Binding Mechanisms of various types and strengths", and it names its primary audiences plainly as "the capability development and information assurance communities" building NATO information-sharing systems, not the acquisition or contracting side of a programme. The metadata in question is most often a STANAG 4774 Confidentiality Metadata Label in the worked examples, though the mechanism "makes no assumptions about the type of Metadata or the format of the Data Object" it is bound to.

Three ways to bind metadata to a data object

The document sets out three binding approaches, and does not prescribe which one to use for a given case. Encapsulating wraps the data object and its metadata together inside one new composite structure - in XML terms, a new root element containing both. Embedded puts the binding inside the data object itself, as a child element carrying a reference back to that same object. Detached keeps the binding physically separate from what it describes, referencing the data object, the metadata, or both by URI; where a cryptographic artefact exists, that too can be referenced rather than carried inline. The three approaches "may be applied iteratively and in any combination", and the document leaves the choice to whatever a given data format, protocol or operational picture calls for.

Making the binding stand up to tampering

A binding on its own only records an association; nothing stops either side of it being altered afterwards unless something protects it. "Policy and operational requirements may dictate the use of cryptographic techniques to protect the Integrity of the Metadata, the Data Object, and hence the Binding" - producing what the document calls a Cryptographically Protected Binding, carried as a digital-signature element alongside the binding. This is optional: the mechanism supports it when policy calls for it, and does not require it by itself. Whether or not it is cryptographically protected, the whole set of metadata, data references and any cryptographic artefact is called Binding Information, structured as a Binding Data Object (BDO) - normally in the XML this document defines, though the document allows other grammars for it, Extended Backus-Naur Form or formatted text among them, "if they can be validated against the standard."

How metadata cascades through a composite object

Where a data object is made up of smaller ones - a document with chapters, a message with attachments - the document fixes four rules for how metadata carries down. A child data object inherits its parent's metadata unless the child already has metadata of that same type bound to it, and inheritance runs one way only: a parent never inherits metadata bound to one of its children. Where a data object that already carries metadata has metadata of a different type bound to it, "it will retain all existing Metadata"; where the new metadata is of the same type, "the new Metadata will supersede the existing Metadata." This is the detail most likely to be implemented wrong, because it is the same-type-or-different-type distinction that decides whether new metadata adds to what is there or replaces it, not simply whether the object is a parent or a child.

The XML a system actually has to produce

Chapter 4 fixes the syntax. A MetadataBindingContainer is the mandatory top-level element, holding one or more MetadataBinding elements. Each MetadataBinding must contain at least one metadata component - an embedded Metadata element or a detached MetadataReference - and at least one data component - an embedded Data element or a detached DataReference - and binds every piece of metadata within it to every data component within it. A detached reference carries a mandatory URI and can carry an XPath expression, in a Transforms element, to select a subset of a referenced XML object rather than the whole thing. The wrapper that holds all of this, BindingInformation, "SHALL be qualified with the" urn:nato:stanag:4778:bindinginformation:1:0 namespace, and may additionally carry a digital signature. Every one of these elements can be extended with local, national or Community-of-Interest attributes that other systems "MAY be ignored" if they do not recognise them - a deliberate escape hatch for local requirements that does not break interoperability for everyone else.

Where a BDO is embedded in, or detached from, the very object it describes, a null URI or a Base URI both "MUST return the root node of the document" being referenced; anything after a "#" is a fragment identifier, and interpreting it correctly "is dependent upon the content type of the Data Object" - which has to be a registered IANA content type for a receiving system to resolve it unambiguously.

Conformance: no certification, just correct XML

There is no certification scheme attached to this document, and no product is submitted for approval against it. ADatP-4778 "defines the syntax and semantics of a Metadata Binding Mechanism", and what gets checked is technical conformance: does a produced Binding Data Object validate against the schema in clause 4.8, are the mandatory elements present, and does a detached reference's URI - and its XPath Transform, where one is used - resolve to the object actually intended. The document names no accredited body, no notified body and no government-surveillance role assessing conformance to this mechanism specifically. Where NATO systems are tested for interoperability, that testing runs against the Binding Profile that the NATO Interoperability Standards and Profiles (NISP) sets for a particular data format and protocol, not against ADatP-4778 on its own.

What it does not cover

The mechanism is deliberately silent on how to apply itself to any one data format or protocol: "the normative specifications for profiling of the BDO are not contained within this standard but are provided in the" NISP, published separately as ADatP-34(I) and revised annually. It also takes no position on which of the three binding approaches, or which metadata type, suits a given system - those are choices a programme has to make and record for itself.

Standards it references

ADatP-4778 is promulgated under STANAG 4778, the agreement NATO's Standardization Document Database records as its cover; the STANAG is what a nation ratifies, not this document directly, and it reaches a supplier only through a contract, a tender, or a Community of Interest agreement that names it. Every worked example in the document binds a STANAG 4774 Confidentiality Metadata Label as its metadata, cited as the source for that label format rather than as a requirement to use it - the mechanism itself takes any metadata type. Beyond the catalogue, the document points to the NATO Interoperability Standards and Profiles (published as ADatP-34(I)) for the Binding Profile a specific format or protocol needs, and to the W3C and IETF specifications - XML Signature, XPath 1.0, and URI generic syntax among them - that its schema builds on.

ADatP-4778 is published free of charge by NATO through the Standardization Document Database. ComplyTrain does not sell it or host a copy.

Standards it references

• STANAG 4774Background