draft-ietf-mile-enum-reference-format-01.txt   draft-ietf-mile-enum-reference-format-02.txt 
INTERNET-DRAFT Adam W. Montville INTERNET-DRAFT Adam W. Montville
Intended Status: Standards Track (CIS) Intended Status: Standards Track (CIS)
Expires: January 31, 2014 David Black Expires: May 2, 2014 David Black
(EMC) (EMC)
July 30, 2013 November 4, 2013
IODEF Enumeration Reference Format IODEF Enumeration Reference Format
draft-ietf-mile-enum-reference-format-01 draft-ietf-mile-enum-reference-format-02
Abstract Abstract
The Incident Object Description Exchange Format [IODEF] provides a The Incident Object Description Exchange Format [IODEF] provides a
Reference class used to reference external entities (such as Reference class used to reference external entities (such as
enumeration identifiers). However, the method of external entity enumeration identifiers). However, the method of external entity
identification has been left unstructured. This document describes a identification has been left unstructured. This document describes a
method to provide structure for referencing external entities for the method to provide structure for referencing external entities for the
[IODEF] Reference class. [IODEF] Reference class.
skipping to change at page 3, line 25 skipping to change at page 3, line 25
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119]. document are to be interpreted as described in RFC 2119 [RFC2119].
2. Referencing External Enumerations 2. Referencing External Enumerations
The need is to place enumeration identifiers and their references in The need is to place enumeration identifiers and their references in
[IODEF]'s Reference class. There are several ways to accomplish this [IODEF]'s Reference class. There are several ways to accomplish this
goal, but the most appropriate at this point is to require a specific goal, but the most appropriate at this point is to require a specific
format for the ReferenceName string of the [IODEF] Reference class, format for the ReferenceName string of the [IODEF] Reference class,
such that an IANA table can be used to catalog a variety of reference and use an IANA registry to manage the resulting reference formats.
types.
+------------------+ +------------------+
| Reference | | Reference |
+------------------+ +------------------+
| |<>----------[ ReferenceName ] | |<>----------[ ReferenceName ]
| |<>--{0..*}--[ URL ] | |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ] | |<>--{0..*}--[ Description ]
+------------------+ +------------------+
FIGURE 1: [IODEF] Reference Class FIGURE 1: [IODEF] Reference Class
Per [IODEF] the ReferenceName is of type ML_STRING. This becomes Per [IODEF] the ReferenceName is of type ML_STRING. This becomes
problematic when specific references, especially enumerations such as problematic when specific references, especially enumerations such as
[CVE], [CCE], [CPE] and so on, are referenced - how is an implementer [CVE], [CCE], [CPE] and so on, are referenced - how is an implementer
to know which type of reference this is, and thus how to parse it? to know which type of reference this is, and thus how to parse it?
One solution, presented here, is to require that ReferenceName follow One solution, presented here, is to require that ReferenceName follow
a particular format. a particular format.
Inclusion of such enumerations, especially those related to security
automation, is important to incident communication and investigation.
Typically, an enumeration identifier is simply an identifier with a
specific format as defined by an external party.
2.1 Reference Name Format 2.1 Reference Name Format
The Reference Name Format uses XML to provide the structure for The Reference Name Format uses XML to provide the structure for
enumeration identification, and requires that a specific Abbreviation enumeration identification, and requires that a specific Abbreviation
and RegistryVersion be associated with the ID. An implementer can and RegistryVersion be associated with the ID. An implementer can
look up the ID type (as referenced by the logical tuple of look up the ID type (as referenced by the logical tuple of
Abbreviation and RegistryVersion) in the IANA table (see Section 4) Abbreviation and Version) in the IANA table (see Section 4) to
to understand how the ID is structured. understand how the ID is structured. Multiple registry entries may
use the same abbreviation. The Index field in the XML unambiguously
indicates which version of the referenced specification is intended
without requiring interpretation of version strings that may have
specification-specific formats.
<Reference> <Reference>
<ReferenceName> <ReferenceName>
<EnumRef> <EnumRef>
<Abbreviation>CXI</Abbreviation> <Abbreviation>CXI</Abbreviation>
<RegistryVersion>1</RegistryVersion> <Index>1</Index>
<ID>CXI-1234-XYZ</ID> <ID>CXI-1234-XYZ</ID>
</EnumRef> </EnumRef>
</ReferenceName> </ReferenceName>
<URL>http://cxi.example.com</URL> <URL>http://cxi.example.com</URL>
<Description>Foo</Description> <Description>Foo</Description>
</Reference> </Reference>
LISTING 1: Example Use of IODEF Enumeration Reference Format
Information in the IANA table (see Section 4) would include: Information in the IANA table (see Section 4) would include:
Full Name: Concept X Identifier Full Name: Concept X Identifier
Abbreviation: CXI Abbreviation: CXI
Registry Version: 1 Index: 1
Enumeration Version: any Version: any
Specification URI: http://cxi.example.com/spec_url Specification URI: http://cxi.example.com/spec_url
2.3 Reference Method Applicability 2.3 Reference Method Applicability
While the scope of this document pertains to [IODEF], it should be While the scope of this document pertains to [IODEF], it should be
readily apparent that any standard needing to reference an readily apparent that any standard needing to reference an
enumeration identified by a specially formatted string can use enumeration identified by a specially formatted string can use
this method of providing structure after the standard has been this method of providing structure after the standard has been
published. In effect, this method provides a standardized published. In effect, this method provides a standardized
interface for enumerations, thus allowing a loose coupling between interface for enumerations, thus allowing a loose coupling between
skipping to change at page 5, line 24 skipping to change at page 5, line 24
This memo creates the following registry for IANA to manage: This memo creates the following registry for IANA to manage:
Name of the Registry: "Enumeration Reference Type Identifiers" Name of the Registry: "Enumeration Reference Type Identifiers"
Note that certain name requests should not be permitted as either Note that certain name requests should not be permitted as either
Full Name or Abbreviation entries for the requested IANA table. Full Name or Abbreviation entries for the requested IANA table.
Fields to record in the registry: Fields to record in the registry:
Full Name: The full name of the enumeration as a string from Full Name: The full name of the enumeration as a string from
the ASCII character set. the printable ASCII character set.
Abbreviation: The abbreviation of the enumeration as a string Abbreviation: An abbreviation may be an acronym - it consists
from the ASCII character set. An abbreviation may be an of upper-case characters (at least two, upper-case is used to
initialism or acronym, is free-form, but is limited to between avoid mismatches due to case differences), as specified by this
two and ten upper-case characters (used to avoid case-specific ABNF [RFC5234] syntax:
mismatch errors) meeting the regular expression (between the
quotes; Perl Regular Expressions): ^[A-Z]{2,20}$
Registry Version: The IANA-registry-specific version to which ABBREVIATION = 2*UC-ALPHA ; At least two
an enumeration identifier pertains as an integer greater than UC-ALPHA = %x41-5A ; A-Z
zero. The Registry Version is intended to be incremented for
each new entry, which permits any string representation for the
Enumeration Version, but explicitly structures enumeration ID
versions for the purpose of the registry.
Enumeration Version: The version of the enumeration as a free- Multiple registrations MAY use the same Abbreviation but
form string from the ASCII character set. MUST have different Versions.
Index: This is an IANA-assigned positive integer that
identifies the registration. The first entry added to this
registry uses the value 1, and this value is incremented for
each subsequent entry added to the registry.
Version: The version of the enumeration as a free-form string
from the printable ASCII character set excepting white space.
Specification URI: A list of one or more URIs [RFC3986] from Specification URI: A list of one or more URIs [RFC3986] from
which the registered specification can be obtained. The which the registered specification can be obtained. The
registered specification MUST be readily and publicly available registered specification MUST be readily and publicly available
from that URI. from that URI. The URI SHOULD be a stable reference to a
specific version of the specification. URIs that designate the
latest version of a specification (which changes when a new
version appears) SHOULD NOT be used.
Initial registry contents: None. Initial registry contents: None.
Allocation Policy: Expert Review [RFC5226] and Specification Allocation Policy: Expert Review [RFC5226] and Specification
Required [RFC5226] Required [RFC5226]
The Designated Expert is expected to consult with the MILE (Managed The Designated Expert is expected to consult with the MILE (Managed
Incident Lightweight Exchange) working group or its successor if any Incident Lightweight Exchange) working group or its successor if any
such WG exists (e.g., via email to the working group's mailing list). such WG exists (e.g., via email to the working group's mailing list).
The Designated Expert is expected to review the request and validate The Designated Expert is expected to review the request and validate
the appropriateness of the enumeration for the attribute. If a the appropriateness of the enumeration for the attribute. If a
specification is associated with the request, it MUST be reviewed by specification is associated with the request, it MUST be reviewed by
the Designated Expert. the Designated Expert.
The Designated Expert will need to ensure the Full Name or The Designated Expert is expected to ensure that the Full Name,
Abbreviation entry under consideration is appropriate for the problem Abbreviation and Version are appropriate and that the information at
domain and that information at the Specification URI is sufficient the Specification URI is sufficient to unambiguously parse
for unambiguously parsing the identifier. The Designated Expert identifiers based on that specification. Additionally, the Designated
should also validate that the next appropriate Registry Version is
being used for a new registration. Additionally, the Designated
Expert should prefer short Abbreviations over long ones. Expert should prefer short Abbreviations over long ones.
5 XML Schema 5 XML Schema
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified"> elementFormDefault="qualified">
<xs:element name="EnumRef"> <xs:element name="EnumRef">
<xs:complexType> <xs:complexType>
<xs:sequence> <xs:sequence>
<xs:element ref="Abbreviation"/> <xs:element ref="Abbreviation"/>
<xs:element ref="RegistryVersion"/> <xs:element ref="Index"/>
<xs:element ref="ID"/> <xs:element ref="ID"/>
</xs:sequence> </xs:sequence>
</xs:complexType> </xs:complexType>
</xs:element> </xs:element>
<xs:element name="Abbreviation" type="xs:NCName"/> <xs:element name="Abbreviation" type="xs:NCName"/>
<xs:element name="RegistryVersion" type="xs:integer"/> <xs:element name="Version" type="xs:integer"/>
<xs:element name="ID" type="xs:NCName"/> <xs:element name="ID" type="xs:NCName"/>
</xs:schema> </xs:schema>
LISTING 2: IODEF Enumeration Reference Format Schema
The root element of the XML schema listed here can be contained
within the IODEF XML as showin in Listing 1 of Section 2.1.
6 References 6 References
6.1 Normative References 6.1 Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[IODEF] Danyliw, R., Meijer, J., and Y. Demchenko, "The Incident [IODEF] Danyliw, R., Meijer, J., and Y. Demchenko, "The Incident
Object Description Exchange Format", RFC 5070, December Object Description Exchange Format", RFC 5070, December
2007. 2007.
[3986] Narten, T. and H. Alvestrand, "Guidelines for Writing an [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226, IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008. May 2008.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66,
RFC 3986, January 2005.
[RFC5234] Crocker, D., Ed., and P. Overell, "Augmented BNF for
Syntax Specifications: ABNF", STD 68, RFC 5234, January
2008.
6.2 Informative References 6.2 Informative References
[CCE] http://cce.mitre.org [CCE] http://cce.mitre.org
[CPE] http://cpe.mitre.org [CPE] http://cpe.mitre.org
[CVE] http://cve.mitre.org [CVE] http://cve.mitre.org
Authors' Addresses Authors' Addresses
Adam W. Montville Adam W. Montville
Center for Internet Security Center for Internet Security
EMail: adam.montville@cisecurity.org EMail: adam.montville@cisecurity.org
David Black David Black
EMC, Inc. EMC Corporation
EMail: david.black@emc.com EMail: david.black@emc.com
 End of changes. 21 change blocks. 
36 lines changed or deleted 62 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/