anchor.diff:  "JCAALIGNMENT","JCA Alignment","true","false","true","false","9.1.2","9.1.2 Audit, Inspection and Investigation",,
   "JCAALIGNMENT","JCA Alignment","true","false","true","false","9.1.2.1","9.1.2.1 Audits",,
   "JCAALIGNMENT","JCA Alignment","true","false","true","false","9.1.2.2","9.1.2.2 Inspections",,
  -"JCAALIGNMENT","JCA Alignment","true","false","true","false","9.1.2.3","9.1.2.3 Investigations �",,
  +"JCAALIGNMENT","JCA Alignment","true","false","true","false","9.1.2.3","9.1.2.3 Investigations  ",,
   "JCAALIGNMENT","JCA Alignment","true","false","true","false","9.1.3","9.1.3 Operational Test and Evaluation",,
   "JCAALIGNMENT","JCA Alignment","true","false","true","false","9.2","9.2 Strategy and Assessment",,
   "JCAALIGNMENT","JCA Alignment","true","false","true","false","9.2.1","9.2.1 Strategy Development",,
  
positive.code: "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.3.2","1.2.3.2 Security Label Format Validation","<b>Definition:</b>Security Label Format Validation validates the security marking of metadata.<br><b>Description:</b>Security Label Format Validation validates the security marking of metadata.  Forwards metadata that passes validation.  Rejects metadata that fails validation.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.3.1","1.2.3.1 Data Security Marking","<b>Definition:</b>Data Security Marking defines the services that create<br>and annotate security classification to a specific information resource<br><b>Description:</b>none",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.3","1.2.3 Security Metadata Management","<b>Definition:</b>Security Metadata Management supports the annotation of data items (such as content, documents, records) with the proper security classifications, and applicable metadata for access control (which may include environment metadata).<br><b>Description:</b>The Security Metadata Management family of services help ensure that products within the system have proper security markings and labels appropriate to their classification.  These markings may be used by other automated systems, such as the services within the Dissemination Management family, to make authorization or releasability decisions.  While releasability may still have a man-in-the-loop, it is nonetheless important to ensure that consistent, properly-formatted and well-understood security markings are present, to minimize unauthorized disclosure or other classified information spillage.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.11","1.2.1.11 Certificate Validation","<b>Definition:</b>Certificate Validation ensures a presented security assertion within a security token matches similar data in the Certification Authority's (CA) root certificate.<br><b>Description:</b>Certificate Validation ensures a presented PKI certificate has been signed by a trusted CA, is within the valid timeframe, has not been tampered with, has not been revoked, etc.  Certificate Validation Service allows clients to delegate some or all certificate validation tasks and is especially useful when a client application has limited Public Key Infrastructure (PKI) services.   The service corresponds to a �Tier 2 Validation Service� and shields client applications from such PKI complexities as X.509v3 certificate syntax processing (e.g., expiration), revocation status checking, or certificate path validation.  <br>Certificate Validation may include any OCSP responders.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.2.1","1.2.2.1 Encryption/ Decryption","<b>Definition:</b>Encryption/Decryption defines the set of services that encrypt and decrypt interactions between consumers and providers to support minimal confidentiality requirements. Within a PKI-environment, encryption and decryption processes are done using the provider�s public and private keys.<br><b>Description:</b>Encryption/Decryption can occur at multiple �levels� within an interaction.  For example, transport level encryption may be sufficient for many interactions. In this case, the provider�s public and private keys are used in the encryption process. For interactions requiring additional encryption, message-level encryption may be used where the subject�s public and private key may be utilized.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.2","1.2.2 Cryptography Management","<b>Definition:</b>Cryptography Management defines the set of services that support the generation, exchange, use, escrow and management of ciphers (e.g., keys), including the use of encryption/decryption processes to ensure the confidentiality and integrity of data.<br><b>Description:</b>The Cryptography Management family covers all manner of cryptography-related services.  This includes both symmetric and asymmetric crypto functions, one-way hashing functions, management of encryption keys, digital signature verification, and validation of PKI certificates.  The services within this family may not be discrete, stand-alone services as one would picture in the traditional SOA sense; rather, many Cryptography Management services are likely to be libraries or executables that are embedded within, or bundled with, other applications.  For example, encryption-in-transit is required for many types of data.  An encryption service, for these types of data, would create a chicken-and-egg problem: data must be encrypted before it can be sent to the encryption service, but the encryption service must do the encryption.  In this example, the encryption libraries will likely be resident on the system that generates the sensitive data.  Nonetheless, it is important to explicitly call out the cryptographic functions that are performed within the architecture, to ensure that they are properly accounted for and not overlooked.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.10","1.2.1.10 Attribute Access","<b>Definition:</b>Attribute Access provides values that describe human users and non-person entities (NPE) for the purpose of making authorization decisions.<br><b>Description:</b>Attribute Access  accepts attribute requests from authorized consumers and responds with an attribute assertion containing the requested attribute values that are releasable to that consumer.   Attributes for either human users or non-person entities (NPE) can be passed and are typically used by Policy Decision Services, Policy Decision Points, Application Servers, or other SAML endpoints.   Secure attribute passing supports an Attribute-Based Access Control (ABAC) authorization model.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.9","1.2.1.9 Federation Service Management","<b>Definition:</b>Federation Service Management establishes trust relationships between different organizations or systems, allowing entities within an environment to access resources within another environment without the need to have an individual account on the remote environment.  This service defines and maintains trust relationships, which are then queried by the Security Token Validation service when making validation decisions.<br><b>Description:</b>none",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.8","1.2.1.8 Security Token Service","<b>Definition:</b>Security Token Service creates enterprise security tokens to provide authentication across systems and services.<br><b>Description:</b>Security Token Service forms the basis for identification and authentication activities by generating security tokens and inserting them in outgoing encrypted messages.   Passed security tokens contain authentication and attribute assertions that temporarily authenticate users.  Tokens also contain user attributes and a security assertion which can be validated by receiving policy services.  The Security Token Service may also perform token validation if required.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.7","1.2.1.7 Policy Access Point","<b>Definition:</b>Policy Access Point enables service providers and applications to request and retrieve access policies.<br><b>Description:</b>The Policy Access Point exposes authorization policies by retrieving and managing policies as implemented by Policy Decision Point (PDP) logic (e.g., access control over portlets in a portal server, or whether a service consumer may search the registry for the key to retrieve all implementations). Implementation may optionally be published in the Enterprise Service Registry (ESR) as defined by the DoD/IC Service Registry and Governance Working Group.     [SSP note: a recommended format for PAS messages is extensible Access Control Markup Language (XACML)]",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.6","1.2.1.6 Policy Enforcement Point","<b>Definition:</b>Policy Enforcement Point (PEP)enforces security-related policies for access to protected resources.<br><b>Description:</b>Policy Enforcement Points sit in front of the requested web services, intercepting incoming requests and outgoing responses to apply the appropriate access policies.  The PEP generates the access request to the Policy Decision Point (PDP) and interprets and enforces the PDP's decision.   Policies can be built to include, but are not limited to, authentication, authorization, data integrity, and confidentiality. When enforcing authorization policies, the PEP uses the PDP to evaluate an authorization policy for the resource.  When a security token is provided to the PEP, that token is validated prior to being trusted.  Token validation may occur in the PEP itself, or if the PEP is unable to validate the token, the PEP may leverage an STS to perform validation on its behalf.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.5","1.2.1.5 Policy Decision Point","<b>Definition:</b>Policy Decision Points accepts access requests and returns whether the request is appropriate given access rules and conditions.<br><b>Description:</b>A Policy Decision Point service hosts Quality of Protection (QoP) parameters and user attributes so that services can flexibly determine and execute protection measures.   For example, some services may require X.509 certificate based authentication whereas others may only need username / password authentication.   Or, clients that access a resource from different domains may require different �strengths� of authentication and access control.   PDPs do this by accepting authorization queries (typically XACML based), evaluating the request based on a variety of inputs (target resource, requested operation, requester's identity, etc.) and returning authorization decision assertions.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.4","1.2.1.4 Authentication Service","<b>Definition:</b>Authentication Service performs authentication of entities within the enterprise.<br><b>Description:</b>none",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.3","1.2.1.3 Resource Policy Management","<b>Definition:</b>Resource Policy Management creates and maintains access control policies for protected resources.<br><b>Description:</b>none",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","1.2.1.1","1.2.1.1 Local Identity Management","<b>Definition:</b>Local Identity Management provides the creation, maintenance, and deletion of user accounts, password maintenance, and the administration of user access rights. Also Creates local account from PKI certificate.  Maps DN to UserID in local account.<br><b>Description:</b>Local Identity Management provides the creation, maintenance, and deletion of user accounts, group membership and other user attributes, password maintenance, and the administration of user access rights for local, role-based access control systems. This service also creates local accounts from PKI certificates, and maps the DN from a certificate to a local UserID.",
  
negative.code: "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.4.1.3","3.4.1.3 Resection","<b>Definition:</b>Resection adjusts image support data when the sensor model data is unknown, incomplete, or imprecise.<br><br><b>Description:</b>Resection uses Digital Point Positioning Database (DPPDB) stereo reference image pairs or other reference imagery, possibly combined with a reference Digital Elevation Map (DEM), to adjust the support data of an image acquired by a less accurate source.  <br><br>The service ingests the image coordinates of tie points in all the images including reference images and the acquired image that is to be resected as well as instantiated sensor models.  The sensor model of the acquired image has adjustable parameters and enhancing the values of these adjustable sensor model parameters is the objective of the Resection service.<br><br>The Resection service uses the reference data to compute 3D geolocations for the selected tie points.  It then performs cycles of bundle adjustment (i.e. least squares sensor model parameter value and tie point coordinate value adjustment) until  it achieves convergence with the measured image coordinates for all the 3D reference points mapped onto the acquired image coordinate space. The resulting adjusted sensor model parameter values for the acquired image constitute the resection results.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.4.1.2","3.4.1.2 Triangulation","<b>Definition:</b>Triangulation calculates a geolocation estimate based on multiple image collections acquired from distinct collection angles. <br><br><b>Description:</b>Triangulation performs a geolocation estimate of a photo identifiable point based on multiple image collections acquired from distinct collection angles.  In this process it combines four distinct algorithmic functions: 1) least squares adjustment of sensor support data along with selected image plane tie or control point measurements that are each common to two or more images, 2) rigorous uncertainty propagation calculations, 3) geolocation computations using a triangulation method, and 4) blunder detection to discard point measurement outliers.<br><br>To initiate a triangulation the service is presented with a set of images and associated image point coordinates.  Image sensor models and coordinates are also provided from each image for the point to be geolocated.    Adjustable parameters include image collection geometries and (sometimes) sensor internal parameters, such as lens focal length or lens distortion.<br>",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.4.1.1","3.4.1.1 Change Detection","<b>Definition:</b>Change Detection identifies feature changes via a pixel analysis between two images of the same area.<br><b>Description:</b>Change detection ingests two precisely co-registered images and identifies differences in pixels collected before and after some interval of time at the same geographic location.   Typically the changes in pixel values must exceed a user defined thresholds including registration uncertainty ""guard band"", size, color, and/or shape in order to screen out noise/clutter changes.   Output is an image formatted mask that identifies which pixels have significant changes between the two images.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.4.1","3.4.1 GEOINT Analysis","<b>Definition:</b>GEOINT Analysis services describe, assess, and visually depict physical features and geographically referenced activities on the Earth.<br><b>Description:</b>GEOINT Analysis services provide intelligence information ( imagery, imagery intelligence, multi-spectral analysis, hyper-spectral analysis, etc.) for geographically referenced features and activities.   Specific services include:<br>   Change Detection - which identifies pixel-by-pixel differences between two images of the same area.<br>    Source Selection - which presents a user with sets of images that can satisfy a geopositioning precision requirement.<br>    Sensor Model Instantiation - which generates sensor model state data from image metadata. <br>    Triangulation  - which calculates a geolocation estimate based on multiple image collections acquired from distinct collection angles. <br>    State Service - which converts image support data into a related sensor model state string.<br>    Resection  - which adjusts image support data when the sensor model data is unknown, incomplete, or imprecise.<br>    Geomensuration  - which computes image based mensuration calculations using image points measured from an image.<br>    DPPDB Mensuration - which performs geopositioning by aligning directly to DPPDB metadata.<br>    Image Registration - which matches points in a selected image to one or more control images to increase the accuracy of geoposition coordinates.<br>    Moving Target Indicator (MTI) - which links 'dots' of point locations into tracks that indicate historical & projected direction and speed.<br>    Topographical Survey - which derives and represents elevation and terrain characteristics from reports and data. <br>    Automatic Target Recognition - which identifies specified entities on an image using image processing techniques. <br>    Emitter Geolocation - which determines the likely position of an emitter source from emitter intercept data.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.4","3.4 Analysis, Prediction and Production","<b>Definition:</b>The Analysis, Prediction & Production line includes services that provide the ability to integrate, evaluate, interpret, and predict knowledge and information from available sources to develop intelligence and forecast the future state to enable situational awareness and provide actionable information.<br><b>Description:</b>The Analysis, Prediction & Production line includes services that provide the ability to integrate, evaluate, interpret, and predict knowledge and information from available sources to develop intelligence and forecast the future state to enable situational awareness and provide actionable information.  This includes the following sub-areas: Integration   The ability to identify, assimilate and correlate relevant information from single or multiple sources.  Evaluation   The ability to provide focused examination of the information and assess its reliability and credibility to a stated degree of confidence.  Interpretation   The ability to derive knowledge and develop new insight from gathered information to postulate its significance.  Prediction   The ability to describe the anticipated future state of the operational/physical environment based on the depiction of past and current information.  Product Generation   The ability to develop and tailor intelligence, information, and environmental content and products per customer requirements.  (Ref. Joint Service Areas, JCA 2010 Refinement, 8 April 2011)<br>Families in this line: GEOINT ANALYSIS, SIGINT ANALYSIS, HUMINT ANALYSIS, MASINT/AGI ANALYSIS, and TARGETING SUPPORT.",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.3.6.7","3.3.6.7 BDA/CDA","<b>Definition:</b>This component performs Battle Damage Assessment (BDA) analysis. BDA is the estimate of damage resulting from the application of lethal or nonlethal military force. BDA is composed of physical damage assessment, functional damage assessment, and target system assessment.  <br><br>GCCS Spec/USMTF message<br><b>Description:</b>N/A",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.3.6.6","3.3.6.6 Target Mensuration","<b>Definition:</b>Target Mensuration services provide the measurement of a feature or location on the earth to determine an absolute latitude, longitude, and height.<br><b>Description:</b>N/A",
  "DI2E-SVCV4-A","DI2E SvcV-4 Alignment","true","true","true","false","3.3.6.5","3.3.6.5 Target List","<b>Definition:</b>The Target List service maintains the various target lists that are kept as part of the target strike management process.<br><b>Description:</b>The Target List service provides methods to retrieve a prioritized list of target lists by type; query for an existing list by name; create or remove target lists;  and add, remove, or edit targets in existing target lists.  Targets can also be transferred from one target list to another list type in accordance with the target management process.<br><br>Examples of target list types include: 1) the Joint Integrated Prioritized Target List (JIPTL) which are targets prioritized to be struck; 2) the Air Tasking Order (ATO); 3) on-call targets; 4) no-strike targets; 5) nominated targets; and 6) targets scheduled for battle damage assessment (BDA).",
  