Participate in software certification

1. What standards/tests are offered by Drummond Group?
2. How to get a software product tested and certified
3. Need assistance in resolving a problem with a certified product
4. What is InSitu® automation? How will that help me in the test?
5. What are the rules for using the Drummond Certified Seal?
6. Test calendar
7. AS2 test overview
8. How can I safeguard my intellectual property?
9. Where will the test take place?
10. What is Vendor Neutrality?

1. What standards/tests are offered by Drummond Group?

• Drummond Certified - AS1, AS2, AS2 ITQ Self Paced, AS2 Optional Profiles, AS3, ebMS 2.0, CSOS
• GDSN

For more information, http://www.drummondgroup.com/html-v2/interop-prod.html

AS2 Interoperability Test - AS2 (Applicability Statement 2) is the RFC standard (RFC 4130) by which vendor applications communicate EDI or other business-to-business data (such as XML) over the Internet using HTTP, a standard used by the World Wide Web. The AS2 standard continues to be one of the most widely adopted messaging standards in the world. With retailers, consumer products goods, hard-lines, insurance, financial services, petroleum and government industries (to name a few) adopting AS2, the critical financial information that flows over AS2 messaging represents billions of dollars each year. To ensure that important transactional information is received securely, full matrix interoperability certification is mission critical for these industries. There are typically some 25-30 participating products from around the globe participating in each certification testing event.

AS2 Optional Test Profiles -Optional Test Profiles are value added functionality built upon an existing technical standard. Various industries have additional requirements which they want added to the AS2 standard and therefore to the AS2 Interoperability Test Plan. The various AS2 Optional Test Profiles are in various stages of being added to the AS2 standard or listed as "Informational Status" to the standard within IETF. Participation in these test profiles is optional. By making the Industry Test Profiles optional, it maintains the integrity of the existing standard while providing interested software companies who sell into the respective vertical with the opportunity to certify their capabilities. Those software companies who do not sell into the vertical can opt out. The end result is a group of software products certified for compliance and interoperability of the AS2 standard as well as a sub-set of AS2 software products also certified for the AS2 Optional Test Profile(s).

Vendors who pass these test profiles are denoted on the test results page. Test results can be found at: http://www.drummondgroup.com/html-v2/as2-companies.html

• Certificate Exchange Messaging (CEM) - CEM is now an Internet-Draft within the IETF. There is interest and demand from supply chains (namely retail and consumer products goods) for CEM because of the significant time savings it provides by automating the manual effort of managing certificates that are about to expire. Certificates can be specified for use in digital signatures, data encryption or SSL/TLS over HTTP (HTTPS). For more info: http://www.drummondgroup.com/html-v2/standards-as2-2.html
• Filename Preservation (FN) - The banking industry (specifically FSTC) relies on filenames being communicated between trading partners. AS2 vendors are currently certifying that implementation of filename communication conforms to the standard and is interoperable. There are two test profiles for filenames: FN and FN-MDN. FN specifically refers to the filename preservation profile WITHOUT MDN responses
• Filename Preservation MDN (FN-MDN previously referred to as FSTC MDN) refers to the Filename preservation WITH an associated MDN error or warning response notification. Some banks were interested in software that provided an MDN response, therefore a distinction was made for the buyers. For more info: http://www.drummondgroup.com/html-v2/standards-as2-1.html
• Multiple Attachments (MA) - Multiple Attachment (MA) capability is the ability to transfer multiple documents within a single AS2 message. This feature may be useful for any industry, but it is extensively used by the Petroleum Industry Data Exchange (PIDX). For more info: http://www.drummondgroup.com/html-v2/standards-as2-3.html
• Chunk Transfer - The chunked encoding modifies the body of a message in order to transfer it as a series of chunks, each with its own size indicator, followed by an OPTIONAL trailer containing entity-header fields. This allows dynamically produced content to be transferred along with the information necessary for the recipient to verify that it has received the full message. Please refer to the following specification for more details: http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.6.1
• AS2 Reliability - The AS2 Reliability Profile addresses duplicate message elimination and standardizes mechanisms for retrying and resending AS2 Messages and MDNs which are crucial to reliable operation of production AS2 installations. This feature may be utilized by any industry but the standards work has been undertaken by eCommerce Technology Group (eTG) under GS1.

  MessageID - AS2 Reliability testing has focused on reusing "same AS2 message" as originally packaged and attempted be retried or resent. This guarantees that the MessageID as originally provided will also be reused, without generating a new MessageID, and allows the receiving side to detect duplicate messages based on the MessageID and to eliminate them. This functionality will continue to be tested in each subsequent AS2 Interop test.

InSitu InSitu (InSitu Dev for AS1, AS2 and AS3) Drummond Group Inc. has a patented test automation tool called InSitu(TM) for conducting automated interoperability testing. InSitu is truly revolutionary as it adds flexibility and makes it easier for companies across numerous industries and countries to complete interoperability testing in less time than ever before. InSitu(TM) has an install base of committed software companies and has been in use for several years delivering manpower savings, speed, scalability, reduction of time-consuming manual steps and automation for convenient testing across different time zones. InSitu is mandatory for AS1, AS2 and AS3 Interops.

AS1 (Applicability Statement 1) is the RFC standard (RFC 3335) by which vendor applications communicate EDI or other business-to-business data (such as XML) over the Internet using SMTP, the standard used for email. This standard continues to be utilized by companies who primarily utilize email as their primary (or secondary) mode of communication.

AS3 Interoperability Test - AS3 (Applicability Statement 3) is the RFC standard (RFC 4823), by which, vendor applications communicate EDI (or other data such as XML) over the Internet using File Transfer Protocol (FTP). AS3 is uniquely marketed by several vendors as being able to exchange Very Large Files easily. For more info: http://www.drummondgroup.com/html-v2/as3.html

AS4 Interoperability Test - AS4: Secure B2B Document Exchange Using Web Services is a standard being developed by a subcommittee of the OASIS ebXML Messaging Services Technical Committee. The intent and purpose of the formation of the AS4 subcommittee is the development of a Conformance Profile of the ebMS v3.0 specification. This profile provides guidance for a standardized methodology for the secure and document-agnostic exchange of B2B payloads using Web services. By constraining the ebMS v3.0 specification and the underlying WS-I profiles for messaging packaging, transport, security, and non-repudiation, the profile focuses on providing an entry-level on-ramp for Web services B2B messaging. The end goal of this profile development is to replicate and strategically extend the existing functional requirements currently satisfied by RFC4130 (AS2) by mapping those requirements onto the Web services platform.

CSOS - The Controlled Substances Ordering System (CSOS) is an electronic commerce initiative overseen by the U.S. Drug Enforcement Administration (DEA) to provide an automated alternative to the current paper-intensive process required for purchasing and distributing Level I and II controlled substances. As a neutral third party, DGI provides CSOS Auditing services such as delivering certification for software products-with-version in compliance with DEA rules. This is not an interoperability test but an on-site software audit. In addition, the pharmaceutical distributors have chosen AS2 as the messaging layer.

ebMS 2.0 Interoperability Test - - ebXML Messaging (also called TRP - Transport Routing & Packaging) specifically focuses on the means to transmit a document (payload) from one party to another, possibly via intermediaries. Companies from around the globe find great value in ebMS interoperability certification. For more info: http://www.drummondgroup.com/html-v2/ebxml.html There are two optional ebMS test profiles included in this test:

• The Automotive Retail Profile is a profile test designed specifically for GZIP-based compression. The profile is based on recommendations from the Standards for Technology in Automotive Retail (STAR) consortium.
• o The XML Encryption Profile enables XML encryption and SSL client authentication. Initially, it was proposed by and is used by the Centers For Disease Control and Prevention in the CDC's Public Health Information Network. The XML Encryption Profile is appropriate for cross-industry use where message level encryption and client authentication are desired.

GDSN. The GDSN is built around the GS1 Global Registry(R), GDSN-certified data pools, the GS1 Data Quality Framework and GS1 Global Product Classification, which when combined provide a powerful environment for secure and continuous synchronisation of accurate data.

With GDSN, trading partners always have the latest information in their systems, and any changes made to one company's database are automatically and immediately provided to all of the other companies who do business with them. When a supplier and a customer know they are looking at the same accurate and up-to-date data, it is smoother, quicker and less expensive for them to do business together. The GDSN provides a single point of truth for product information.

Drummond Group facilitates the GDSN certification for new Data Pools through GDSN KATO™ Reference Data Pool. This testing is done under the GDSN certification program by Drummond Group.

SAML 2.0 Interoperability Test. The SAML standard continues to be one of the most widely adopted identity management standards in the world. With industries from around the globe adopting SAML, the critical identity information that flows over SAML represents billions of identities each year. To ensure that identity information is securely handled, Liberty Interoperable full matrix interoperability certification is mission critical for these industries. There are typically some 6-8 participating products from around the globe participating in each round of testing, with some 500 SAML transactions performed.

This event covers the SAML 2.0 specification set and also include the eGov Profile. The completion of the eGov profile 1.0 is a prerequisite requirement for being certified by General Services Administration (GSA)and entering the eAuth federation deployment. Please note that this is a Liberty Interoperable Certification facilitated by Drummond Group.

2. How to get a software product tested and certified

Depending on the standard, there are different steps and processes involved for preparing for an interoperability test. Some tests for example, require undergoing a "In-the-Queue" process which is a conformance and debugging round against reference products hosted by DGI. Some tests like AS1, AS2, and AS3 require InSitu automation.

3. Need assistance in resolving a problem with a certified product

If you have further questions, contact: info2@drummondgroup.com

4. What is InSitu® automation? How will that help me in the test?

5. What are the rules for using the Drummond Certified Seal?

6. Test calendar

7. AS2 test overview

For detailed information on AS2 Interoperability testing, see - http://www.drummondgroup.com/html-v2/as2-test-overview.html

8. How can I safeguard my intellectual property?

• No one sees your actual products (ie not your competitors, not even DGI)
• You choose how much you want to share with the group on specific code problems within your product
• All testing is done over the internet from your controlled environment
• All discussions on problems and code adjustment are via conference calls and email
• Other participants only see data exchanged (we provide the data for the test in concert with the participants)
• All participants will be exchanging a series of test messages to complete the test
• No sales or marketing contacts are allowed on the phone. Only approved technical contacts are allowed on the daily phone calls and email.

DGI's role is to administer the testing. The test administration key points are:

• We provide a neutral environment to test you and your competitor's implementations for interoperability.
• We do not see or request code at anytime
• We see the test data and ensure the test results are recorded appropriately
• We notify the sponsoring industry organization who has passed the test. Neither DGI nor the sponsoring industry group will publicly announce who has NOT passed the test, only those vendors who HAVE passed the test.
• We help resolve individual participant and group problems as they arise to keep the testing process moving forward
• While DGI cannot guarantee that you will pass the testing, we try very hard to help all participants succeed while attempting not to slow down the test progress for the group - it's a balance.

9. Where will the test take place?

10. What is Vendor Neutrality?

• DGI maintains confidentiality of each participant's progress during the testing process
• DGI only interacts with the software development teams of the testing participants on the phone calls during the testing process (Sales or Marketing are only involved in related press releases on pilot.)
• DGI creates a non-competitive, cooperative environment for vendors to successfully pass and complete testing
• DGI only announces those vendors who have successfully passed the interoperability tests - i.e. DGI does not make public those companies who have not yet succeeded passing the tests