Updated the Product Architecture chapter

## 4.2 Product Architecture

The product contains the following elements:

<!-- Add definition of below elements -->

A PKI Product is defined by the integration of several key elements, including **Product audit & administration**, **Registration**, **Certificate generation**, **Certificate status**, and/or **Revocation management**. Each element exposes functions that are defined in [Product Functions](#41-product-functions). The diagram below provides a high-level overview of the product architecture and the interactions between its constituent elements.

Product audit & administration

- F.UserAccountManagement

- F.Network_Configuration

- F.None_SCDBasedKeyManagement

- F.OfficerRegistrationApproval

- F.AuditEventManagement

- F.LoggingOfSecurityEvents

- F.CertificateProfileManagement

Registration

- F.OnlineRegService

- F.CertificateDissemination

- F.PrivateKeyExport

- F.OfficerRegistrationApproval

Certificate generation

- F.SCD_BasedKeyPairGen

- F.NoneSCD_BasedKeyPairGen

- F.SubjectCertSignCreation

- F.OfficerCertGenApproval

- F.PseudonymCertIssuance

Certificate status

- F.CertificateStatus

Revocation management

- F.RevocationManagement

- F.OfficerRevocationApproval

![Figure 4.3-1: Indicative product architecture](media/Figures/UC_Architecture/FunctionalArchitecture.png)

In addition the elements can be configured in multiple ways:

In addition, the product elements may be configured in multiple ways depending on the deployment requirements:

 - **ARC.Monolithic**: All components are integrated and run on a single machine or platform.

 - **ARC.Distributed**:  Functions are split across multiple machines or services, often communicating over a network.

![Figure 4.3-1: Indicative product architecture](media/Figures/UC_Architecture/FunctionalArchitecture.png)

Logical environments include the connected systems around the main product that shape how it operates in its environment. The trusted boundary is affected by potential third party software that runs on the product, data links to the outside world using radio interfaces, and user permissions and access control.

Each component defining the Product is accessible through the interfaces defined below.

- **I.LocalInterface**	- Local user interface used by the different privileged users to access the product functionalities and data.

The different elements are accessible through the interfaces defined below:

- **I.AuditAndAdministration**	- Interface for remote access to for product for administration and audit purposes.

- **I.Registration**	- Online registration interface receiving remote Certificates Signing Requests from subscribers.

- **I.CertificateGeneration**	- Interface with external components providing cryptographic services such as signature or key management.

- **I.RevocationManagement**	- Online access to revocation management services (certificate revocation requests).

- **I.NetworkServices**	- Interface to local network services  (secure storage, timesources, user directory

<mark>El-Houari Suggestion :</mark>

<mark>I suggest to move the Interfaces in a dedicated chapter in operation environment. 4.3.5 Interfaces</mark>

<mark>Interfaces are accessible through logical environment (COM.Local, ...), Therefore, I.LocalInterface becomes useless as it is a combination of COM.Local and I.AuditAndAdministration. I suggest then, to remove I.LocalInterface.</mark>

Logical environments include the connected systems around the main product that shape how it operates in its environment. The trusted boundary is affected by potential third party software that runs on the product, data links to the outside world using radio interfaces, and user permissions and access control.

## 4.3 Operational Environment