Enforcement of Constraints on XML Streams

可扩展标记语言(XML)已成为交换数据的普遍格式。来自金融、医疗保健和基因组学等不同行业的企业数据通常以XML的形式进行交换。许多这种XML编码的信息必须在到达时被动态查询--也就是作为一个XML流。例如，新闻和事件信息以XML提要的形式提供；对这些事件做出反应的应用程序必须以流的方式处理提要。通信和消息传递协议也使用XML，因此相应的协议处理程序也是XML流处理器。处理任何形式的数据的一个关键方面是验证：在使数据对应用程序可用之前，它必须处于正常的状态。在通过网络交换数据的环境中，数据损坏是无处不在的，因为消息是从不可信的甚至未知的一方接收的。事实上，发送到Web可访问的应用程序服务器的许多甚至大多数数据可能来自恶意或受危害的主机。XML社区已经开发了用于描述对XML文档结构的约束的标准化方法。一方面，存在基于模式的约束，例如文档类型定义(DTD)，它对文档中可以出现的标记进行了限制。XML查询语言XPath中的限定符为添加特定于应用程序的约束提供了更灵活的方法。但是，防火墙如何才能有效地对大量并行提要实施这些限制呢？无论XML流是表示信令消息、事件提要还是Web服务调用，这都是一个关键问题。该项目将研究哪些约束可以有效实施，哪些约束不能有效实施，并将提供工具和技术来有效地监控XML流，以确定是否违反了模式约束和特定于应用程序的约束。

The eXtensible Markup Language (XML) has become a ubiquitous format for exchanging data. Enterprise data from industries as diverse as finance, healthcare, and genomics are routinely exchanged as XML. Much of this XML-encoded information has to be queried on-the-fly as it arrives -- that is, as an XML stream. News and event information, for example, is available in the form of XML feeds; applications that react to these events must process the feeds in streaming fashion. Communication and messaging protocols also make use of XML, and the corresponding protocol handlers are thus also XML stream-processors.A crucial aspect of processing any form of data is validation: before data is made available to applications, it must be in a sane'' state. In the context of data being exchanged over networks data corruption is ubiquitous, because messages are received from untrusted or even unknown parties. Indeed, many or even most of the data being sent to web-accessible application servers may be from malicious or compromised hosts.The XML community has already developed standardized means for describing constraints on the structure of XML documents. On the one hand, there are schema-based constraints, such as Document Type Definitions (DTDs) giving limitations on the tags that can occur within a document. Qualifiers in the XML query language XPath provide a more flexible method for adding application-specific constraints. But how can a firewall enforce these constraints efficiently on large collections of parallel feeds? This is a critical issue, whether the XML streams represent signalling messages, event feeds, or web service calls. This project will study which constraints can and cannot be enforced efficiently, and will provide tools and technologies to effectively monitor XML streams for violation of both schema constraints and application-specific constraints.