Index: fedd/abac-src/rtml/schemas/CVS/Entries
===================================================================
--- fedd/abac-src/rtml/schemas/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/rtml/schemas/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,4 @@
+/RTMLv1.0q.xsd/1.2/Fri Apr 11 19:28:24 2003//
+/SystemSpec.xml/1.2/Fri Apr 11 19:28:24 2003//
+/xmldsig-core-schema.xsd/1.1/Fri Apr 11 19:28:24 2003//
+D
Index: fedd/abac-src/rtml/schemas/CVS/Repository
===================================================================
--- fedd/abac-src/rtml/schemas/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/rtml/schemas/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+rtml/schemas
Index: fedd/abac-src/rtml/schemas/CVS/Root
===================================================================
--- fedd/abac-src/rtml/schemas/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/rtml/schemas/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+:ext:jjacobs@src.columbia.sparta.com/cvs/abac
Index: fedd/abac-src/rtml/schemas/RTMLv1.0q.xsd
===================================================================
--- fedd/abac-src/rtml/schemas/RTMLv1.0q.xsd	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/rtml/schemas/RTMLv1.0q.xsd	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,637 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- edited with XML Spy v4.3 U (http://www.xmlspy.com) by Kangshi (Kangshi) -->
+<xs:schema targetNamespace="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" elementFormDefault="qualified">
+	<!--xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/-->
+        <xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="file:///var/tomcat4/webapps/demo/WEB-INF/xmldsig-core-schema.xsd"/>
+	<xs:element name="CredentialStore">
+		<xs:complexType>
+			<xs:sequence>
+				<xs:element name="DefaultPrincipal" type="Principal" minOccurs="0"/>
+				<xs:element ref="ApplicationDomainSpecification" minOccurs="0" maxOccurs="unbounded"/>
+				<xs:element name="PrincipalInfo" type="PrincipalInfo" minOccurs="0" maxOccurs="unbounded"/>
+				<xs:element ref="Credential" minOccurs="0" maxOccurs="unbounded"/>
+			</xs:sequence>
+		</xs:complexType>
+	</xs:element>
+	<xs:element name="ApplicationDomainSpecification">
+		<xs:annotation>
+			<xs:documentation>This specifies data types and role names used in one application domain.		</xs:documentation>
+		</xs:annotation>
+		<xs:complexType>
+			<xs:sequence>
+				<xs:element name="ImportDomain" type="ImportDomain" minOccurs="0" maxOccurs="unbounded"/>
+				<xs:choice minOccurs="0" maxOccurs="unbounded">
+					<xs:element name="IntegerType" type="IntegerTypeDeclaration"/>
+					<xs:element name="DecimalType" type="DecimalTypeDeclaration"/>
+					<xs:element name="EnumType" type="EnumTypeDeclaration"/>
+					<xs:element name="StringType" type="StringTypeDeclaration"/>
+					<xs:element name="RecordType" type="RecordTypeDeclaration"/>
+					<xs:element name="TreeType" type="TreeTypeDeclaration"/>
+				</xs:choice>
+				<xs:element name="PrincipalType" type="PrincipalTypeDeclaration" minOccurs="0"/>
+				<xs:element name="RoleDeclaration" type="RoleDeclaration" minOccurs="0" maxOccurs="unbounded"/>
+			</xs:sequence>
+			<xs:attribute name="uri" type="xs:anyURI" use="required"/>
+			<xs:attribute name="id" type="HashID"/>
+		</xs:complexType>
+	</xs:element>
+	<xs:complexType name="ImportDomain">
+		<xs:sequence>
+			<xs:element name="Location" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded"/>
+		</xs:sequence>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="idref" type="HashID" use="required"/>
+		<xs:attribute name="uri" type="xs:anyURI"/>
+	</xs:complexType>
+	<xs:complexType name="IntegerTypeDeclaration">
+		<xs:annotation>
+			<xs:documentation>It is required that base  is between min and max.  A legal value is between min and max, and satisfies (v-base) % step = 0.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="min" type="xs:long" use="required"/>
+		<xs:attribute name="includeMin" type="xs:boolean" default="true"/>
+		<xs:attribute name="max" type="xs:long" use="required"/>
+		<xs:attribute name="includeMax" type="xs:boolean" default="true"/>
+		<xs:attribute name="step" type="xs:long" default="1"/>
+		<xs:attribute name="base" type="xs:long" default="0"/>
+	</xs:complexType>
+	<xs:complexType name="DecimalTypeDeclaration">
+		<xs:annotation>
+			<xs:documentation>Similar to IntType.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="min" type="xs:decimal" use="required"/>
+		<xs:attribute name="includeMin" type="xs:boolean"/>
+		<xs:attribute name="max" type="xs:decimal" use="required"/>
+		<xs:attribute name="includeMax" type="xs:boolean"/>
+		<xs:attribute name="step" type="xs:decimal" default="1"/>
+		<xs:attribute name="base" type="xs:decimal" default="0"/>
+	</xs:complexType>
+	<xs:complexType name="EnumTypeDeclaration">
+		<xs:sequence>
+			<xs:element name="EnumValue" type="Enum" maxOccurs="unbounded"/>
+		</xs:sequence>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="ignoreCase" type="xs:boolean" default="false"/>
+		<xs:attribute name="ordered" type="xs:boolean" default="false"/>
+		<xs:attribute name="size" type="xs:int"/>
+	</xs:complexType>
+	<xs:complexType name="StringTypeDeclaration">
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="ignoreCase" type="xs:boolean" default="false"/>
+		<xs:attribute name="ordered" type="xs:boolean" default="false"/>
+	</xs:complexType>
+	<xs:complexType name="TreeTypeDeclaration">
+		<xs:annotation>
+			<xs:documentation>The three attributes rootsymbol, separator, and rootFirst determine how a constant of a tree type looks like.</xs:documentation>
+		</xs:annotation>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="separator" type="xs:string" use="required"/>
+		<xs:attribute name="order" type="TreeValueOrderType" use="required"/>
+	</xs:complexType>
+	<xs:simpleType name="TreeValueOrderType">
+		<xs:restriction base="xs:string">
+			<xs:enumeration value="rootFirst"/>
+			<xs:enumeration value="rootLast"/>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:complexType name="RecordTypeDeclaration">
+		<xs:sequence>
+			<xs:element name="Field" maxOccurs="unbounded">
+				<xs:complexType>
+					<xs:sequence>
+						<xs:element name="Type" type="NameRef"/>
+					</xs:sequence>
+					<xs:attribute name="name" type="Identifier" use="required"/>
+				</xs:complexType>
+			</xs:element>
+		</xs:sequence>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+	</xs:complexType>
+	<xs:attributeGroup name="NameRef">
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="domain" type="Identifier"/>
+	</xs:attributeGroup>
+	<xs:complexType name="NameRef">
+		<xs:attributeGroup ref="NameRef"/>
+	</xs:complexType>
+	<xs:complexType name="PrincipalTypeDeclaration">
+		<xs:sequence>
+			<xs:element name="Type" type="NameRef"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="RoleDeclaration">
+		<xs:sequence>
+			<xs:element name="Description" minOccurs="0" maxOccurs="unbounded"/>
+			<xs:choice minOccurs="0">
+				<xs:element name="Restriction">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="BaseRole" type="NameRef"/>
+							<xs:element name="Parameter" minOccurs="0" maxOccurs="unbounded">
+								<xs:complexType>
+									<xs:sequence>
+										<xs:element name="Type" type="NameRef"/>
+									</xs:sequence>
+									<xs:attribute name="name" type="Identifier" use="required"/>
+									<xs:attribute name="requireSafety" type="xs:boolean" default="false"/>
+								</xs:complexType>
+							</xs:element>
+						</xs:sequence>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="Extension">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="BaseRole" type="NameRef"/>
+							<xs:element name="Parameter" minOccurs="0" maxOccurs="unbounded">
+								<xs:complexType>
+									<xs:sequence>
+										<xs:element name="Type" type="NameRef"/>
+									</xs:sequence>
+									<xs:attribute name="name" type="Identifier" use="required"/>
+									<xs:attribute name="requireSafety" type="xs:boolean" default="false"/>
+								</xs:complexType>
+							</xs:element>
+						</xs:sequence>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="Projection">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="BaseRole"/>
+							<xs:element name="Parameter" minOccurs="0" maxOccurs="unbounded">
+								<xs:complexType>
+									<xs:attribute name="name" type="Identifier" use="required"/>
+								</xs:complexType>
+							</xs:element>
+						</xs:sequence>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="Plain">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="Identity" minOccurs="0">
+								<xs:complexType>
+									<xs:sequence>
+										<xs:element name="BaseRole" type="NameRef"/>
+									</xs:sequence>
+								</xs:complexType>
+							</xs:element>
+							<xs:element name="Parameter" minOccurs="0" maxOccurs="unbounded">
+								<xs:complexType>
+									<xs:sequence>
+										<xs:element name="Type" type="NameRef"/>
+									</xs:sequence>
+									<xs:attribute name="name" type="Identifier" use="required"/>
+									<xs:attribute name="requireSafety" type="xs:boolean" default="false"/>
+								</xs:complexType>
+							</xs:element>
+						</xs:sequence>
+						<xs:attribute name="dimension" type="xs:int" default="1"/>
+						<xs:attribute name="issuerTraces" type="IssuerTracesType" default="rule"/>
+						<xs:attribute name="subjectTraces" type="SubjectTracesType" default="fact"/>
+					</xs:complexType>
+				</xs:element>
+			</xs:choice>
+		</xs:sequence>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="isIdentity" type="xs:boolean" default="false"/>
+	</xs:complexType>
+	<xs:simpleType name="IssuerTracesType">
+		<xs:restriction base="xs:token">
+			<xs:enumeration value="all"/>
+			<xs:enumeration value="def"/>
+			<xs:enumeration value="rule"/>
+			<xs:enumeration value="none"/>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:simpleType name="SubjectTracesType">
+		<xs:restriction base="xs:token">
+			<xs:enumeration value="all"/>
+			<xs:enumeration value="fact"/>
+			<xs:enumeration value="none"/>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:element name="Credential">
+		<xs:complexType>
+			<xs:sequence>
+				<xs:element name="Preamble" type="Preamble"/>
+				<xs:element name="Issuer">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:group ref="PrincipalValue"/>
+						</xs:sequence>
+					</xs:complexType>
+				</xs:element>
+				<xs:group ref="Definition" maxOccurs="unbounded"/>
+				<xs:element name="ValidityTime" type="ValidityTime"/>
+				<xs:element name="ValidityRule" type="ValidityRule" minOccurs="0" maxOccurs="unbounded"/>
+				<xs:choice minOccurs="0">
+					<xs:element ref="ds:Signature"/>
+					<xs:element ref="ds:X509Data"/>
+				</xs:choice>
+			</xs:sequence>
+			<xs:attribute name="id" type="HashID"/>
+		</xs:complexType>
+		<xs:unique name="principalShortName">
+			<xs:selector xpath=".//Principal"/>
+			<xs:field xpath="@shortName"/>
+		</xs:unique>
+		<xs:keyref name="principalShortNameRef" refer="principalShortName">
+			<xs:selector xpath=".//PrincipaRef"/>
+			<xs:field xpath="@shortName"/>
+		</xs:keyref>
+	</xs:element>
+	<xs:element name="LocalStatement">
+		<xs:complexType>
+			<xs:sequence>
+				<xs:element name="Preamble" type="Preamble"/>
+				<xs:element name="RuleIdentifier" type="xs:token" minOccurs="0"/>
+				<xs:group ref="Definition" maxOccurs="unbounded"/>
+				<xs:element name="ValidityTime" type="ValidityTime"/>
+			</xs:sequence>
+		</xs:complexType>
+	</xs:element>
+	<xs:complexType name="Preamble">
+		<xs:sequence>
+			<xs:element name="ImportDomain" type="ImportDomain" minOccurs="0" maxOccurs="unbounded"/>
+			<xs:element name="Principal" type="Principal" minOccurs="0" maxOccurs="unbounded"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="ValidityTime">
+		<xs:sequence>
+			<xs:element name="IssueTime" type="xs:dateTime"/>
+			<xs:element name="NotBefore" type="xs:dateTime" minOccurs="0"/>
+			<xs:element name="NotAfter" type="xs:dateTime" minOccurs="0"/>
+			<xs:element name="LifeTime" type="xs:duration" minOccurs="0"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="CRLLocator">
+		<xs:sequence>
+			<xs:group ref="PrincipalValue"/>
+		</xs:sequence>
+		<xs:attribute name="frequency" type="xs:duration"/>
+		<xs:attribute name="uri" type="xs:anyURI"/>
+	</xs:complexType>
+	<xs:complexType name="ValidityRule">
+		<xs:sequence>
+			<xs:any/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:group name="VerificationRecord">
+		<xs:sequence/>
+	</xs:group>
+	<xs:complexType name="RoleTerm">
+		<xs:sequence>
+			<xs:element name="Parameter" type="Field" minOccurs="0" maxOccurs="unbounded"/>
+		</xs:sequence>
+		<xs:attributeGroup ref="NameRef"/>
+	</xs:complexType>
+	<xs:group name="Role">
+		<xs:choice>
+			<xs:element name="RoleTerm" type="RoleTerm"/>
+			<xs:element name="ExternalRole">
+				<xs:complexType>
+					<xs:sequence>
+						<xs:group ref="PrincipalValue"/>
+						<xs:element name="RoleTerm" type="RoleTerm"/>
+					</xs:sequence>
+				</xs:complexType>
+			</xs:element>
+		</xs:choice>
+	</xs:group>
+	<xs:complexType name="Field">
+		<xs:group ref="Constraint" minOccurs="0"/>
+		<xs:attribute name="name" type="Identifier" use="required"/>
+		<xs:attribute name="id" type="xs:ID"/>
+	</xs:complexType>
+	<xs:complexType name="Record">
+		<xs:sequence>
+			<xs:element name="Field" type="Field" maxOccurs="unbounded"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:simpleType name="SpecialPrincipalType">
+		<xs:restriction base="xs:token">
+			<xs:enumeration value="this"/>
+			<xs:enumeration value="issuer"/>
+		</xs:restriction>
+	</xs:simpleType>
+	<xs:group name="Constraint">
+		<xs:choice>
+			<xs:element name="IntegerValue" type="Integer"/>
+			<xs:element name="DecimalValue" type="Decimal"/>
+			<xs:element name="StringValue" type="String"/>
+			<xs:element name="EnumValue" type="Enum"/>
+			<xs:element name="TimeValue" type="Time"/>
+			<xs:element name="TreeValue" type="Tree"/>
+			<xs:element name="Record" type="Record"/>
+			<xs:group ref="PrincipalValue"/>
+			<xs:element name="SpecialPrincipal"/>
+			<xs:element name="Interval" type="Interval"/>
+			<xs:element name="Set" type="Set"/>
+			<xs:element name="Equals">
+				<xs:complexType>
+					<xs:attribute name="ref" type="xs:IDREF"/>
+				</xs:complexType>
+			</xs:element>
+		</xs:choice>
+	</xs:group>
+	<xs:group name="Definition">
+		<xs:choice>
+			<xs:element name="SimpleMember" type="SimpleMember"/>
+			<xs:element name="SimpleContainment" type="SimpleContainment"/>
+			<xs:element name="LinkedContainment" type="LinkingContainment"/>
+			<xs:element name="IntersectionContainment" type="IntersectionContainment"/>
+			<xs:element name="ProductContainment" type="ProductContainment"/>
+			<xs:element name="ExclusiveProductContainment" type="ExclusiveProductContainment"/>
+			<xs:element name="SimpleDelegation" type="SimpleDelegation"/>
+			<xs:element name="AdvancedDelegation" type="AdvancedDelegation"/>
+		</xs:choice>
+	</xs:group>
+	<xs:complexType name="RoleSequence">
+		<xs:sequence>
+			<xs:group ref="Role" minOccurs="2" maxOccurs="unbounded"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="DefinitionBase" abstract="true">
+		<xs:sequence>
+			<xs:element name="HeadRoleTerm" type="RoleTerm"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:complexType name="SimpleMember">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:group ref="PrincipalValue"/>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="SimpleContainment">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:group ref="Role"/>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="IntersectionContainment">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:element name="Intersection" type="RoleSequence"/>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="LinkingContainment">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:element name="LinkedRole">
+						<xs:complexType>
+							<xs:sequence>
+								<xs:element name="RoleTerm" type="RoleTerm"/>
+								<xs:element name="RoleTerm" type="RoleTerm"/>
+							</xs:sequence>
+						</xs:complexType>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="ProductContainment">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:element name="Product" type="RoleSequence"/>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="ExclusiveProductContainment">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:element name="ExclusiveProduct" type="RoleSequence"/>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="SimpleDelegation">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:element name="DelegateTo">
+						<xs:complexType>
+							<xs:sequence>
+								<xs:group ref="PrincipalValue"/>
+							</xs:sequence>
+						</xs:complexType>
+					</xs:element>
+					<xs:element name="Control" minOccurs="0">
+						<xs:complexType>
+							<xs:sequence>
+								<xs:group ref="Role"/>
+							</xs:sequence>
+						</xs:complexType>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:complexType name="AdvancedDelegation">
+		<xs:complexContent>
+			<xs:extension base="DefinitionBase">
+				<xs:sequence>
+					<xs:element name="DelegateTo">
+						<xs:complexType>
+							<xs:sequence>
+								<xs:element name="RoleTerm" type="RoleTerm"/>
+							</xs:sequence>
+						</xs:complexType>
+					</xs:element>
+					<xs:element name="Control" minOccurs="0">
+						<xs:complexType>
+							<xs:sequence>
+								<xs:group ref="Role"/>
+							</xs:sequence>
+						</xs:complexType>
+					</xs:element>
+				</xs:sequence>
+			</xs:extension>
+		</xs:complexContent>
+	</xs:complexType>
+	<xs:simpleType name="Identifier">
+		<xs:annotation>
+			<xs:documentation>The schema data type of identifier used for domain names, role names, type names, etc.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:token"/>
+	</xs:simpleType>
+	<xs:simpleType name="HashID">
+		<xs:restriction base="xs:base64Binary"/>
+	</xs:simpleType>
+	<xs:simpleType name="Integer">
+		<xs:annotation>
+			<xs:documentation>The schema data type for IntegerValue.  Although it is xs:long, the current xerces parser only allows int.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:long"/>
+	</xs:simpleType>
+	<xs:simpleType name="Decimal">
+		<xs:annotation>
+			<xs:documentation>The schema data type for DecimalValue.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:decimal"/>
+	</xs:simpleType>
+	<xs:simpleType name="String">
+		<xs:annotation>
+			<xs:documentation>The schema data type for the StringValue element in RTML credentials.  Now using token.</xs:documentation>
+		</xs:annotation>
+		<xs:restriction base="xs:token"/>
+	</xs:simpleType>
+	<xs:simpleType name="Enum">
+		<xs:restriction base="xs:token"/>
+	</xs:simpleType>
+	<xs:simpleType name="Time">
+		<xs:union memberTypes="xs:dateTime xs:date xs:time xs:gYear xs:gYearMonth xs:gMonth xs:gMonthDay xs:gDay"/>
+	</xs:simpleType>
+	<xs:complexType name="Tree">
+		<xs:annotation>
+			<xs:documentation>A tree value contains a string which consists of token values separated by a separator symbol, which is declared in TreeType.  The attributes determines whether the current node, children, and descendents are included.</xs:documentation>
+		</xs:annotation>
+		<xs:simpleContent>
+			<xs:extension base="xs:string">
+				<xs:attribute name="includeCurrent" type="xs:boolean" default="true"/>
+				<xs:attribute name="includeChildren" type="xs:boolean" default="false"/>
+				<xs:attribute name="includeDescendents" type="xs:boolean" default="false"/>
+			</xs:extension>
+		</xs:simpleContent>
+	</xs:complexType>
+	<xs:complexType name="Principal">
+		<xs:choice>
+			<xs:element name="KeyHash" type="HashID"/>
+			<xs:element name="IntegerValue" type="Integer"/>
+			<xs:element name="StringValue" type="String"/>
+		</xs:choice>
+		<xs:attribute name="shortName" type="Identifier"/>
+	</xs:complexType>
+	<xs:complexType name="PrincipalRef">
+		<xs:attribute name="shortName" type="Identifier"/>
+	</xs:complexType>
+	<xs:complexType name="PrincipalInfo">
+		<xs:sequence>
+			<xs:element ref="ds:KeyValue"/>
+		</xs:sequence>
+	</xs:complexType>
+	<xs:group name="PrincipalValue">
+		<xs:choice>
+			<xs:element name="Principal" type="Principal"/>
+			<xs:element name="PrincipalRef" type="PrincipalRef"/>
+		</xs:choice>
+	</xs:group>
+	<xs:complexType name="Interval">
+		<xs:choice>
+			<xs:sequence>
+				<xs:element name="From" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="IntegerValue" type="Integer"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="To" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="IntegerValue" type="Integer"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+			</xs:sequence>
+			<xs:sequence>
+				<xs:element name="From" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="DecimalValue" type="Decimal"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="To" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="DecimalValue" type="Decimal"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+			</xs:sequence>
+			<xs:sequence>
+				<xs:element name="From" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="EnumValue" type="Enum"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="To" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="EnumValue" type="Enum"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+			</xs:sequence>
+			<xs:sequence>
+				<xs:element name="From" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="StringValue" type="String"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="To" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="StringValue" type="String"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+			</xs:sequence>
+			<xs:sequence>
+				<xs:element name="From" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="TimeValue" type="Time"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+				<xs:element name="To" minOccurs="0">
+					<xs:complexType>
+						<xs:sequence>
+							<xs:element name="TimeValue" type="Time"/>
+						</xs:sequence>
+						<xs:attribute name="included" type="xs:boolean" default="true"/>
+					</xs:complexType>
+				</xs:element>
+			</xs:sequence>
+		</xs:choice>
+	</xs:complexType>
+	<xs:complexType name="Set">
+		<xs:choice>
+			<xs:element name="IntegerValue" type="Integer" maxOccurs="unbounded"/>
+			<xs:element name="DecimalValue" type="Decimal" maxOccurs="unbounded"/>
+			<xs:element name="StringValue" type="String" maxOccurs="unbounded"/>
+			<xs:element name="EnumValue" type="Enum" maxOccurs="unbounded"/>
+			<xs:group ref="PrincipalValue" maxOccurs="unbounded"/>
+		</xs:choice>
+	</xs:complexType>
+</xs:schema>
Index: fedd/abac-src/rtml/schemas/SystemSpec.xml
===================================================================
--- fedd/abac-src/rtml/schemas/SystemSpec.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/rtml/schemas/SystemSpec.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- edited with XML Spy v4.3 U (http://www.xmlspy.com) by Kangshi (Kangshi) -->
+<ApplicationDomainSpecification uri="systemDomain" id="fakeSystemHashID" xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demo/WEB-INF/RTMLv1.0q.xsd">
+	<IntegerType name="long" max="9223372036854775807" min="-9223372036854775808"/>
+	<IntegerType name="int" max="2147483647" min="-2147483648"/>
+	<IntegerType name="short" max="32767" min="-32768"/>
+	<IntegerType name="byte" max="127" min="-128"/>
+	<IntegerType name="bit" max="1" min="0"/>
+	<IntegerType name="unsigned int" max="4294967295" min="0"/>
+	<IntegerType name="unsigned short" max="65535" min="0"/>
+	<IntegerType name="unsigned byte" max="255" min="0"/>
+	<EnumType name="boolean">
+		<EnumValue>false</EnumValue>
+		<EnumValue>true</EnumValue>
+	</EnumType>
+	<StringType name="string"/>
+	<StringType name="case-insensitive string" ignoreCase="true"/>
+	<TreeType name="dns" separator="." order="rootLast"/>
+	<TreeType name="path" separator="/" order="rootFirst"/>
+	<RecordType name="email address">
+		<Field name="user name">
+			<Type name="string"/>
+		</Field>
+		<Field name="server">
+			<Type name="dns"/>
+		</Field>
+	</RecordType>
+	<RecordType name="person name">
+		<Field name="first name">
+			<Type name="string"/>
+		</Field>
+		<Field name="last name">
+			<Type name="string"/>
+		</Field>
+	</RecordType>
+	<RecordType name="distinguished name">
+		<Field name="CN">
+			<Type name="string"/>
+		</Field>
+		<Field name="OU">
+			<Type name="string"/>
+		</Field>
+		<Field name="O">
+			<Type name="string"/>
+		</Field>
+		<Field name="C">
+			<Type name="string"/>
+		</Field>
+	</RecordType>
+</ApplicationDomainSpecification>
Index: fedd/abac-src/rtml/schemas/xmldsig-core-schema.xsd
===================================================================
--- fedd/abac-src/rtml/schemas/xmldsig-core-schema.xsd	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/rtml/schemas/xmldsig-core-schema.xsd	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,318 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE schema
+  PUBLIC "-//W3C//DTD XMLSchema 200102//EN" "http://www.w3.org/2001/XMLSchema.dtd"
+ [
+   <!ATTLIST schema 
+     xmlns:ds CDATA #FIXED "http://www.w3.org/2000/09/xmldsig#">
+   <!ENTITY dsig 'http://www.w3.org/2000/09/xmldsig#'>
+   <!ENTITY % p ''>
+   <!ENTITY % s ''>
+  ]>
+
+<!-- Schema for XML Signatures
+    http://www.w3.org/2000/09/xmldsig#
+    $Revision: 1.1 $ on $Date: 2003/04/11 19:28:24 $ by $Author: jjacobs $
+
+    Copyright 2001 The Internet Society and W3C (Massachusetts Institute
+    of Technology, Institut National de Recherche en Informatique et en
+    Automatique, Keio University). All Rights Reserved.
+    http://www.w3.org/Consortium/Legal/
+
+    This document is governed by the W3C Software License [1] as described
+    in the FAQ [2].
+
+    [1] http://www.w3.org/Consortium/Legal/copyright-software-19980720
+    [2] http://www.w3.org/Consortium/Legal/IPR-FAQ-20000620.html#DTD
+-->
+
+
+<schema xmlns="http://www.w3.org/2001/XMLSchema"
+        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+        targetNamespace="http://www.w3.org/2000/09/xmldsig#"
+        version="0.1" elementFormDefault="qualified"> 
+
+<!-- Basic Types Defined for Signatures -->
+
+<simpleType name="CryptoBinary">
+  <restriction base="base64Binary">
+  </restriction>
+</simpleType>
+
+<!-- Start Signature -->
+
+<element name="Signature" type="ds:SignatureType"/>
+<complexType name="SignatureType">
+  <sequence> 
+    <element ref="ds:SignedInfo"/> 
+    <element ref="ds:SignatureValue"/> 
+    <element ref="ds:KeyInfo" minOccurs="0"/> 
+    <element ref="ds:Object" minOccurs="0" maxOccurs="unbounded"/> 
+  </sequence>  
+  <attribute name="Id" type="ID" use="optional"/>
+</complexType>
+
+  <element name="SignatureValue" type="ds:SignatureValueType"/> 
+  <complexType name="SignatureValueType">
+    <simpleContent>
+      <extension base="base64Binary">
+        <attribute name="Id" type="ID" use="optional"/>
+      </extension>
+    </simpleContent>
+  </complexType>
+
+<!-- Start SignedInfo -->
+
+<element name="SignedInfo" type="ds:SignedInfoType"/>
+<complexType name="SignedInfoType">
+  <sequence> 
+    <element ref="ds:CanonicalizationMethod"/> 
+    <element ref="ds:SignatureMethod"/> 
+    <element ref="ds:Reference" maxOccurs="unbounded"/> 
+  </sequence>  
+  <attribute name="Id" type="ID" use="optional"/> 
+</complexType>
+
+  <element name="CanonicalizationMethod" type="ds:CanonicalizationMethodType"/> 
+  <complexType name="CanonicalizationMethodType" mixed="true">
+    <sequence>
+      <any namespace="##any" minOccurs="0" maxOccurs="unbounded"/>
+      <!-- (0,unbounded) elements from (1,1) namespace -->
+    </sequence>
+    <attribute name="Algorithm" type="anyURI" use="required"/> 
+  </complexType>
+
+  <element name="SignatureMethod" type="ds:SignatureMethodType"/>
+  <complexType name="SignatureMethodType" mixed="true">
+    <sequence>
+      <element name="HMACOutputLength" minOccurs="0" type="ds:HMACOutputLengthType"/>
+      <any namespace="##other" minOccurs="0" maxOccurs="unbounded"/>
+      <!-- (0,unbounded) elements from (1,1) external namespace -->
+    </sequence>
+    <attribute name="Algorithm" type="anyURI" use="required"/> 
+  </complexType>
+
+<!-- Start Reference -->
+
+<element name="Reference" type="ds:ReferenceType"/>
+<complexType name="ReferenceType">
+  <sequence> 
+    <element ref="ds:Transforms" minOccurs="0"/> 
+    <element ref="ds:DigestMethod"/> 
+    <element ref="ds:DigestValue"/> 
+  </sequence>
+  <attribute name="Id" type="ID" use="optional"/> 
+  <attribute name="URI" type="anyURI" use="optional"/> 
+  <attribute name="Type" type="anyURI" use="optional"/> 
+</complexType>
+
+  <element name="Transforms" type="ds:TransformsType"/>
+  <complexType name="TransformsType">
+    <sequence>
+      <element ref="ds:Transform" maxOccurs="unbounded"/>  
+    </sequence>
+  </complexType>
+
+  <element name="Transform" type="ds:TransformType"/>
+  <complexType name="TransformType" mixed="true">
+    <choice minOccurs="0" maxOccurs="unbounded"> 
+      <any namespace="##other" processContents="lax"/>
+      <!-- (1,1) elements from (0,unbounded) namespaces -->
+      <element name="XPath" type="string"/> 
+    </choice>
+    <attribute name="Algorithm" type="anyURI" use="required"/> 
+  </complexType>
+
+<!-- End Reference -->
+
+<element name="DigestMethod" type="ds:DigestMethodType"/>
+<complexType name="DigestMethodType" mixed="true"> 
+  <sequence>
+    <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+  </sequence>    
+  <attribute name="Algorithm" type="anyURI" use="required"/> 
+</complexType>
+
+<element name="DigestValue" type="ds:DigestValueType"/>
+<simpleType name="DigestValueType">
+  <restriction base="base64Binary"/>
+</simpleType>
+
+<!-- End SignedInfo -->
+
+<!-- Start KeyInfo -->
+
+<element name="KeyInfo" type="ds:KeyInfoType"/> 
+<complexType name="KeyInfoType" mixed="true">
+  <choice maxOccurs="unbounded">     
+    <element ref="ds:KeyName"/> 
+    <element ref="ds:KeyValue"/> 
+    <element ref="ds:RetrievalMethod"/> 
+    <element ref="ds:X509Data"/> 
+    <element ref="ds:PGPData"/> 
+    <element ref="ds:SPKIData"/>
+    <element ref="ds:MgmtData"/>
+    <any processContents="lax" namespace="##other"/>
+    <!-- (1,1) elements from (0,unbounded) namespaces -->
+  </choice>
+  <attribute name="Id" type="ID" use="optional"/> 
+</complexType>
+
+  <element name="KeyName" type="string"/>
+  <element name="MgmtData" type="string"/>
+
+  <element name="KeyValue" type="ds:KeyValueType"/> 
+  <complexType name="KeyValueType" mixed="true">
+   <choice>
+     <element ref="ds:DSAKeyValue"/>
+     <element ref="ds:RSAKeyValue"/>
+     <any namespace="##other" processContents="lax"/>
+   </choice>
+  </complexType>
+
+  <element name="RetrievalMethod" type="ds:RetrievalMethodType"/> 
+  <complexType name="RetrievalMethodType">
+    <sequence>
+      <element ref="ds:Transforms" minOccurs="0"/> 
+    </sequence>  
+    <attribute name="URI" type="anyURI"/>
+    <attribute name="Type" type="anyURI" use="optional"/>
+  </complexType>
+
+<!-- Start X509Data -->
+
+<element name="X509Data" type="ds:X509DataType"/> 
+<complexType name="X509DataType">
+  <sequence maxOccurs="unbounded">
+    <choice>
+      <element name="X509IssuerSerial" type="ds:X509IssuerSerialType"/>
+      <element name="X509SKI" type="base64Binary"/>
+      <element name="X509SubjectName" type="string"/>
+      <element name="X509Certificate" type="base64Binary"/>
+      <element name="X509CRL" type="base64Binary"/>
+      <any namespace="##other" processContents="lax"/>
+    </choice>
+  </sequence>
+</complexType>
+
+<complexType name="X509IssuerSerialType"> 
+  <sequence> 
+    <element name="X509IssuerName" type="string"/> 
+    <element name="X509SerialNumber" type="integer"/> 
+  </sequence>
+</complexType>
+
+<!-- End X509Data -->
+
+<!-- Begin PGPData -->
+
+<element name="PGPData" type="ds:PGPDataType"/> 
+<complexType name="PGPDataType"> 
+  <choice>
+    <sequence>
+      <element name="PGPKeyID" type="base64Binary"/> 
+      <element name="PGPKeyPacket" type="base64Binary" minOccurs="0"/> 
+      <any namespace="##other" processContents="lax" minOccurs="0"
+       maxOccurs="unbounded"/>
+    </sequence>
+    <sequence>
+      <element name="PGPKeyPacket" type="base64Binary"/> 
+      <any namespace="##other" processContents="lax" minOccurs="0"
+       maxOccurs="unbounded"/>
+    </sequence>
+  </choice>
+</complexType>
+
+<!-- End PGPData -->
+
+<!-- Begin SPKIData -->
+
+<element name="SPKIData" type="ds:SPKIDataType"/> 
+<complexType name="SPKIDataType">
+  <sequence maxOccurs="unbounded">
+    <element name="SPKISexp" type="base64Binary"/>
+    <any namespace="##other" processContents="lax" minOccurs="0"/>
+  </sequence>
+</complexType> 
+
+<!-- End SPKIData -->
+
+<!-- End KeyInfo -->
+
+<!-- Start Object (Manifest, SignatureProperty) -->
+
+<element name="Object" type="ds:ObjectType"/> 
+<complexType name="ObjectType" mixed="true">
+  <sequence minOccurs="0" maxOccurs="unbounded">
+    <any namespace="##any" processContents="lax"/>
+  </sequence>
+  <attribute name="Id" type="ID" use="optional"/> 
+  <attribute name="MimeType" type="string" use="optional"/> <!-- add a grep facet -->
+  <attribute name="Encoding" type="anyURI" use="optional"/> 
+</complexType>
+
+<element name="Manifest" type="ds:ManifestType"/> 
+<complexType name="ManifestType">
+  <sequence>
+    <element ref="ds:Reference" maxOccurs="unbounded"/> 
+  </sequence>
+  <attribute name="Id" type="ID" use="optional"/> 
+</complexType>
+
+<element name="SignatureProperties" type="ds:SignaturePropertiesType"/> 
+<complexType name="SignaturePropertiesType">
+  <sequence>
+    <element ref="ds:SignatureProperty" maxOccurs="unbounded"/> 
+  </sequence>
+  <attribute name="Id" type="ID" use="optional"/> 
+</complexType>
+
+   <element name="SignatureProperty" type="ds:SignaturePropertyType"/> 
+   <complexType name="SignaturePropertyType" mixed="true">
+     <choice maxOccurs="unbounded">
+       <any namespace="##other" processContents="lax"/>
+       <!-- (1,1) elements from (1,unbounded) namespaces -->
+     </choice>
+     <attribute name="Target" type="anyURI" use="required"/> 
+     <attribute name="Id" type="ID" use="optional"/> 
+   </complexType>
+
+<!-- End Object (Manifest, SignatureProperty) -->
+
+<!-- Start Algorithm Parameters -->
+
+<simpleType name="HMACOutputLengthType">
+  <restriction base="integer"/>
+</simpleType>
+
+<!-- Start KeyValue Element-types -->
+
+<element name="DSAKeyValue" type="ds:DSAKeyValueType"/>
+<complexType name="DSAKeyValueType">
+  <sequence>
+    <sequence minOccurs="0">
+      <element name="P" type="ds:CryptoBinary"/>
+      <element name="Q" type="ds:CryptoBinary"/>
+    </sequence>
+    <element name="G" type="ds:CryptoBinary" minOccurs="0"/>
+    <element name="Y" type="ds:CryptoBinary"/>
+    <element name="J" type="ds:CryptoBinary" minOccurs="0"/>
+    <sequence minOccurs="0">
+      <element name="Seed" type="ds:CryptoBinary"/>
+      <element name="PgenCounter" type="ds:CryptoBinary"/>
+    </sequence>
+  </sequence>
+</complexType>
+
+<element name="RSAKeyValue" type="ds:RSAKeyValueType"/>
+<complexType name="RSAKeyValueType">
+  <sequence>
+    <element name="Modulus" type="ds:CryptoBinary"/> 
+    <element name="Exponent" type="ds:CryptoBinary"/> 
+  </sequence>
+</complexType> 
+
+<!-- End KeyValue Element-types -->
+
+<!-- End Signature -->
+
+</schema>
