<?xml version="1.0" encoding="UTF-8"?>
<!-- edited with XMLSpy v2005 rel. 3 U (http://www.altova.com) by KATHLEEN MORIARTY (MIT LINCOLN LABORATORY) -->
<!-- edited with XMLSPY v2004 rel. 3 U (http://www.xmlspy.com) by
      Kathleen Moriarty (MIT Lincoln Laboratory) -->
<xs:schema xmlns:iodef-rid="draft-ietf-inch-iodef-rid-05.xsd" xmlns:iodef="draft-ietf-inch-iodef-042.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ns1="draft-ietf-inch-iodef-rid-05.xsd" targetNamespace="draft-ietf-inch-iodef-rid-05.xsd" elementFormDefault="qualified" attributeFormDefault="unqualified">
	<xs:import namespace="draft-ietf-inch-iodef-042.xsd" schemaLocation="draft-ietf-inch-iodef-042.xsd"/>
	<xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>
	<!-- ******************************************************************** ********************************************************************
 *** Incident Object Description and Exchange Format XML Schema   ***
 ***               Version 02,   April 2005                         ***
******************************************************************
 ***  Extension for Real-time Inter-network Defense - RID       ***
***    Namespace - iodef-rid                                      ***
***   The namespace is defined to support transport of IODEF     ***
***     documents for exchanging incident information     ***
 ********************************************************************
-->
	<!--RID acts as an envelope for IODEF documents to support the exchange of messages-->
	<!--
 ====== Real-Time Inter-network Defense - RID ======
 ====  Suggested definition for RID messaging
  -->
	<xs:annotation>
		<xs:documentation>XML Schema wrapper for IODEF</xs:documentation>
	</xs:annotation>
	<xs:element name="RID" type="iodef-rid:RIDType"/>
	<xs:complexType name="RIDType">
		<xs:sequence>
			<xs:element ref="iodef-rid:IPPacket"/>
			<xs:element ref="iodef-rid:NPPath" maxOccurs="unbounded"/>
			<xs:element ref="iodef-rid:TraceStatus"/>
			<xs:element ref="iodef-rid:IncidentSource" minOccurs="0"/>
			<xs:element ref="iodef-rid:RIDPolicy"/>
		</xs:sequence>
		<xs:attribute ref="iodef:dtype" use="required"/>
		<xs:attribute name="meaning" type="xs:string"/>
	</xs:complexType>
	<!--The IP Packet to be traced with RID-->
	<xs:element name="IPPacket" type="iodef-rid:IPPacketType"/>
	<xs:complexType name="IPPacketType">
		<xs:sequence>
			<xs:element name="IPVersion" type="xs:string" default="IPv4"/>
			<xs:element name="HexPacket" type="xs:hexBinary"/>
			<xs:element ref="iodef-rid:IPPacket" minOccurs="0" maxOccurs="unbounded"/>
		</xs:sequence>
		<xs:attribute ref="iodef:restriction" default="default"/>
	</xs:complexType>
	<xs:element name="IPVersion"/>
	<xs:element name="HexPacket"/>
	<!--Path of the RID trace includes information on each NP
            involved in the upstream trace-->
	<xs:element name="NPPath" type="iodef-rid:NPPathType"/>
	<xs:complexType name="NPPathType">
		<xs:sequence>
			<xs:element ref="iodef:name" minOccurs="0"/>
			<xs:element ref="iodef:RegistryHandle" minOccurs="0" maxOccurs="unbounded"/>
			<xs:element ref="iodef:Email" minOccurs="0" maxOccurs="unbounded"/>
			<xs:element ref="iodef:Telephone" minOccurs="0" maxOccurs="unbounded"/>
			<xs:element ref="iodef:Fax" minOccurs="0"/>
			<xs:element ref="iodef:TimeZone" minOccurs="0"/>
			<xs:element ref="iodef-rid:NPPath" maxOccurs="unbounded"/>
		</xs:sequence>
		<xs:attribute name="restriction" type="xs:NMTOKEN"/>
		<xs:attribute name="NPPath" type="xs:NMTOKEN" use="required"/>
	</xs:complexType>
	<xs:element name="TimeZone"/>
	<!--Used in Trace Authorization Message for RID-->
	<xs:element name="TraceStatus" type="iodef-rid:TraceStatusType"/>
	<xs:complexType name="TraceStatusType">
		<xs:sequence>
			<xs:element name="AuthorizationStatus" default="Approved">
				<xs:simpleType>
					<xs:restriction base="xs:string">
						<xs:whiteSpace value="collapse"/>
						<xs:enumeration value="Approved"/>
						<xs:enumeration value="Denied"/>
						<xs:enumeration value="Pending"/>
					</xs:restriction>
				</xs:simpleType>
			</xs:element>
		</xs:sequence>
		<xs:attribute name="restriction" type="xs:NMTOKEN"/>
	</xs:complexType>
	<xs:element name="AuthorizationStatus" type="xs:decimal"/>
	<!--Values for the NPPath.type attribute-->
	<xs:attribute name="NPPath" type="xs:NMTOKEN"/>
	<xs:attribute name="vlan-name" type="xs:string"/>
	<xs:attribute name="vlan-num" type="xs:string"/>
	<!--Incident Source Information for Result Message-->
	<xs:element name="IncidentSource" type="iodef-rid:IncidentSourceType"/>
	<xs:complexType name="IncidentSourceType">
		<xs:sequence>
			<xs:element ref="iodef-rid:SourceFound"/>
			<xs:element ref="iodef:Node" minOccurs="0" maxOccurs="unbounded"/>
		</xs:sequence>
	</xs:complexType>
	<xs:element name="SourceFound" type="xs:boolean"/>
	<!--
 ====== Real-Time Inter-network Defense Policy - RIDPolicy ======
 ====  Suggested definition for RIDPolicy for messaging
  -->
	<xs:annotation>
		<xs:documentation>RID Policy used in SOAP header for transport of messages</xs:documentation>
	</xs:annotation>
	<!-- RidPolicy information with valid settings listed in RID
           extension documentation -->
	<xs:element name="RIDPolicy" type="iodef-rid:RIDPolicyType"/>
	<xs:complexType name="RIDPolicyType">
		<xs:sequence>
			<xs:element ref="iodef-rid:MsgType"/>
			<xs:element ref="iodef-rid:MsgDestination"/>
			<xs:element ref="iodef:Node"/>
			<xs:element ref="iodef-rid:PolicyRegion" maxOccurs="unbounded"/>
			<xs:element ref="iodef-rid:TrafficType" maxOccurs="unbounded"/>
			<xs:element ref="iodef:IncidentID"/>
		</xs:sequence>
		<xs:attribute ref="iodef:dtype" use="required"/>
	</xs:complexType>
	<xs:element name="MsgType" default="Report">
		<xs:simpleType>
			<xs:restriction base="xs:string">
				<xs:whiteSpace value="collapse"/>
				<xs:enumeration value="TraceRequest"/>
				<xs:enumeration value="TraceAuthorization"/>
				<xs:enumeration value="Result"/>
				<xs:enumeration value="Investigation"/>
				<xs:enumeration value="Report"/>
				<xs:enumeration value="IncidentQuery"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:element>
	<xs:element name="MsgDestination" default="RIDSystem">
		<xs:simpleType>
			<xs:restriction base="xs:string">
				<xs:whiteSpace value="collapse"/>
				<xs:enumeration value="RIDSystem"/>
				<xs:enumeration value="SourceOfIncident"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:element>
	<xs:element name="PolicyRegion">
		<xs:simpleType>
			<xs:restriction base="xs:string">
				<xs:whiteSpace value="collapse"/>
				<xs:enumeration value="ClientToNP"/>
				<xs:enumeration value="NPToClient"/>
				<xs:enumeration value="InterConsortium"/>
				<xs:enumeration value="PeerToPeer"/>
				<xs:enumeration value="BetweenConsortiums"/>
				<xs:enumeration value="AcrossNationalBoundaries"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:element>
	<xs:element name="TrafficType" default="Attack">
		<xs:simpleType>
			<xs:restriction base="xs:string">
				<xs:whiteSpace value="collapse"/>
				<xs:enumeration value="Attack"/>
				<xs:enumeration value="Network"/>
				<xs:enumeration value="Content"/>
				<xs:enumeration value="OfficialBusiness"/>
				<xs:enumeration value="Other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:element>
</xs:schema>