1. Optimising XML Schema for IODEF Data model INCH WG, IETF57 July 16, 2003 Yuri Demchenko

2. March 19, 2003. San Francisco XML Security Slide2 _2 Outlines  Motivation for moving to Schema definition  Changes and Optimisations to IODEF elements semantics  Extra features: XML Signature and Multilingual text type

3. March 19, 2003. San Francisco XML Security Slide2 _3 Motivation for moving to XML Schema DTD is document-oriented  Like HTML Schema is data-oriented  More object oriented  Integrated into development tools  Easier maintenance (validation, modification, documentation - using tools) Enabling other useful features  XML Signature  SAML  XPath, XSL and XSLT, XLink, XPointer

4. March 19, 2003. San Francisco XML Security Slide2 _4 Semantics change for some attributes (1) Due to more complex way of naming attributes in the schema, introduced and redefined few attributes:  introduced Contact.contactrole u was just “role” defined locally for the Contact element  introduced Contact.contacttype u was just “type” defined locally for the Contact element  cloned attribute Expectation.priority from attvals.severity u Was priority %attvals.severity; #IMPLIED  renamed yesno -> spoofed  renamed Expectation.category -> expectation and attvals.expectation u Was just “category” defined as attvals.expectations

5. March 19, 2003. San Francisco XML Security Slide2 _5 Semantics change for some attributes (2)  Attribute dtype is used for both AdditionalData and RecordItem u Was adtype and dtype u Problems with IDMEF compatibility?  Data types for Telephone and Fax remains “string” u Mistakenly was defined in my early comments as "decimal"

6. March 19, 2003. San Francisco XML Security Slide2 _6 Container for Signature Added container element Signatures to top level class IODEF-Document  May contain multiple signatures ds:Signature with imported namespace

7. March 19, 2003. San Francisco XML Security Slide2 _7 Simplified definition: elements Node, Service, UserId   (domain) name of a node is one but optional; IP Addresses may be many   port primary identified by number, optionally - by name  this simplified definition will help to avoid warnings in the future from too strict validators and parsers  this definition will also validate initial IDMEF definition and XML text  Old definition (name | number | (name, number)) generate warning of non-deterministic Schema  Other possibility - (name?, number?)

8. March 19, 2003. San Francisco XML Security Slide2 _8 New data types Some elements are defined not as a complexElement but via complexType to allow reuse and easier redefine some complexTypes, in particular:  AdditionalDataType  IncidentIDType  DateTimeType  DescriptionType  MultilingTextType  TextAbstractType

9. March 19, 2003. San Francisco XML Security Slide2 _9 MultilingualTextType and TextAbstractType To mark-up multilingual text preservation features, introduced two new classes:  TextAbstractType to carry language attribute  MultilingTextType to describe possible multilingual text transformation by Transform class imported from XMLSig Schema Introduced new element "Name" for Contact class instead of more simple "name"  Name defined via MultilingTextType

10. March 19, 2003. San Francisco XML Security Slide2 _10 ds:Transform element ## (1,1) elements from (0,unbounded) namespaces ##

11. March 19, 2003. San Francisco XML Security Slide2 _11 Issue to discuss: Preserving multilingual text Measures to preserve multilingual non-UTF-8 text look complex, so they better will be limited to elements which are really sensitive to non-UTF-8 encoding: Description Name PostalAddress Impact Location IDN (internationalised domain name) – required to use UTF-8 or other derived encoding.

12. March 19, 2003. San Francisco XML Security Slide2 _12 Preserving ML text - usage Two cases are possible when using XML Signature:  Transform to UTF-8 all document and sign the document  Use text transformation to keep multilingual text in binary form and sign the document  In both cases you need to make conversion to display text on user machine that doesn’t use/handle UTF-8/Unicode

13. March 19, 2003. San Francisco XML Security Slide2 _13 Future steps  Make changes to current DTD-01  Include Schema into next IODEF draft?