1. Optimising XML Schema for IODEF Data model
INCH WG, IETF57
July 16, 2003
Yuri Demchenko

2. Outlines Motivation for moving to Schema definition
Changes and Optimisations to IODEF elements semantics
Extra features: XML Signature and Multilingual text type
March 19, San Francisco
XML Security

3. Motivation for moving to XML Schema
DTD is document-oriented
Like HTML
Schema is data-oriented
More object oriented
Integrated into development tools
Easier maintenance (validation, modification, documentation - using tools)
Enabling other useful features
XML Signature
SAML
XPath, XSL and XSLT, XLink, XPointer
March 19, San Francisco
XML Security

4. Semantics change for some attributes (1)
Due to more complex way of naming attributes in the schema, introduced and redefined few attributes:
introduced Contact.contactrole
was just “role” defined locally for the Contact element
introduced Contact.contacttype
was just “type” defined locally for the Contact element
cloned attribute Expectation.priority from attvals.severity
Was priority %attvals.severity; #IMPLIED
renamed yesno -> spoofed
renamed Expectation.category -> expectation and attvals.expectation
Was just “category” defined as attvals.expectations
March 19, San Francisco
XML Security

5. Semantics change for some attributes (2)
Attribute dtype is used for both AdditionalData and RecordItem
Was adtype and dtype
Problems with IDMEF compatibility?
Data types for Telephone and Fax remains “string”
Mistakenly was defined in my early comments as "decimal"
March 19, San Francisco
XML Security

6. Container for Signature
Added container element Signatures to top level class IODEF-Document
May contain multiple signatures ds:Signature with imported namespace
<xs:element name="IODEF-Document">     <xs:complexType>      <xs:sequence>      <xs:element ref="Incident" maxOccurs="unbounded"/>      <xs:element ref="Signatures"/>      </xs: sequence>      <xs:attribute name="version" type="xs:string" fixed="0.1"/>     </xs:complexType> </xs:element> <xs:element name="Signatures">     <xs:complexType>      <xs:sequence>       <xs:element ref="ds:Signature" maxOccurs="unbounded"/>      </xs:sequence>     </xs:complexType> </xs:element>
March 19, San Francisco
XML Security

7. Simplified definition: elements Node, Service, UserId
<!ELEMENT Node (name?, Address*, DateTime?, Location?, NodeRole*)>
<!ELEMENT Node (((name | Address), Address*), DateTime?, name?, Address*, Location?, NodeRole*)>
(domain) name of a node is one but optional; IP Addresses may be many
<!ELEMENT Service (((name?, port) | portlist), protocol?, SNMPService?, WebService?)>
<!ELEMENT Service (((name | port | (name, port)) | portlist), protocol?, SNMPService?, WebService?)>
port primary identified by number, optionally - by name
this simplified definition will help to avoid warnings in the future from too strict validators and parsers
this definition will also validate initial IDMEF definition and XML text
<!ELEMENT UserId ((number, name?) | (name, number?))>
Old definition (name | number | (name, number)) generate warning of non-deterministic Schema
Other possibility - (name?, number?)
March 19, San Francisco
XML Security

8. New data types
Some elements are defined not as a complexElement but via complexType to allow reuse and easier redefine some complexTypes, in particular:
AdditionalDataType
IncidentIDType
DateTimeType
DescriptionType
MultilingTextType
TextAbstractType
March 19, San Francisco
XML Security

9. MultilingualTextType and TextAbstractType
To mark-up multilingual text preservation features, introduced two new classes:
TextAbstractType to carry language attribute
MultilingTextType to describe possible multilingual text transformation by Transform class imported from XMLSig Schema
Introduced new element "Name" for Contact class instead of more simple "name"
Name defined via MultilingTextType <xs:element name="Name" type="MultilingTextType"/>
March 19, San Francisco
XML Security

10. ds:Transform element
<xs:schema xmlns:ds=" xmlns:xs="
<xs:element name="Transforms" type="TransformsType"/>
<xs:complexType name="TransformsType">
<xs:sequence>
<xs:element ref="Transform" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
<xs:element name="Transform" type="TransformType"/>
<xs:complexType name="TransformType" mixed="true">
<xs:choice minOccurs="0" maxOccurs="unbounded">
<xs:any namespace="##other" processContents="lax"/>
<xs:element name="XPath" type="string"/>
## (1,1) elements from (0,unbounded) namespaces ##
</xs:choice>
<xs:attribute name="Algorithm" type="xs:anyURI" use="required"/>
March 19, San Francisco
XML Security

11. Issue to discuss: Preserving multilingual text
Measures to preserve multilingual non-UTF-8 text look complex, so they better will be limited to elements which are really sensitive to non-UTF-8 encoding: Description Name PostalAddress Impact Location
IDN (internationalised domain name) – required to use UTF-8 or other derived encoding.
March 19, San Francisco
XML Security

12. Preserving ML text - usage
Two cases are possible when using XML Signature:
Transform to UTF-8 all document and sign the document
Use text transformation to keep multilingual text in binary form and sign the document
In both cases you need to make conversion to display text on user machine that doesn’t use/handle UTF-8/Unicode
March 19, San Francisco
XML Security

13. Future steps Make changes to current DTD-01
Include Schema into next IODEF draft?
March 19, San Francisco
XML Security