The distributed nature of the MHS makes it vulnerable to various types of
security threats.  This chapter describes the nature of these threats, and
concludes with a table that correlates each threat with the MHS security
service that counters it.  
\vspace{5 mm}

The principal threats to the MHS can be divided into two categories,
inter-message threats and intra-message threats.  Inter-message threats
arise from parties external to the message communication, and include:
masquerade, message modification, message sequencing threats, and leakage of 
information.
\vspace{5 mm}

Masquerade occurs when an entity successfully pretends to be a different
entity.  The following examples illustrate two types of masquerade to
which the MHS is vulnerable.  First, an unauthorized UA may impersonate an 
authorized UA to gain access to an MTA.  Once access is gained, the 
unauthorized UA can falsely originate messages, falsely acknowledge receipt 
of messages, or simply discard messages.  Second, an unauthorized MTA can 
impersonate an authorized MTA to misroute messages, or discard messages 
submitted for delivery.  
\vspace{5 mm}

Message modification occurs when a message is changed by an unauthorized
party.  Unauthorized changes apply to the message content, addressing
information, security labels, and other message attributes.  This threat 
also includes the destruction of an entire message.
\vspace{5 mm}

Message sequencing threats jeopardize the ordering of messages.  They include
the reordering, time-shifting (i.e., delaying or pre-playing), and replaying 
of messages.  
\vspace{5 mm}

Leakage of information occurs when an unauthorized party gains information
by monitoring transmissions.  The unauthorized party can learn of the
content of messages, or of the parties involved in the message transfers.
An unauthorized party can also gain information by analyzing the message 
traffic between two users.  
\vspace{5 mm}

The second category of threats is intra-message threats.  Intra-message
threats are those performed by the parties involved in the message
communication.  Intra-message threats include repudiation and security 
level violations.  
\vspace{5 mm}

Repudiation occurs when an MTA or MTS user (i.e., a User Agent, Message Store, 
or Access Unit) denies performing a specific action.  Repudiation threats 
include an MTS user denying the origination or delivery of a message, and 
an MTA denying the submission of a message.
\vspace{5 mm}

Security level violations are threats relating to security labels.  
Security labels are data structures which permit the classification of a
message, or a communicating party within the MHS, in terms of a security
level (e.g., 'Secret').  An example of a security level violation is an 
originator submitting a message with a security label that it is not 
authorized to generate.
\vspace{5 mm}

The threats described above are reproduced below in tabular format.
Associated with each threat is the MHS security service or services which 
counter it.  These services are described in detail in 
Chapter \ref{x400-services}.
\vspace{5 mm}

\begin{tabular}{|l|l|}	\hline
{\em Masquerade} 			& \\
Impersonation and misuse of the MTS	& Message origin authentication \\
					& Secure access management \\
Falsely acknowledge receipt		& Proof of delivery \\
Falsely claim to originate a message	& Message origin authentication \\
Impersonation of an MTA to an MTS user	& Proof of submission \\
					& Report origin authentication \\
					& Secure access management \\ \hline

{\em Message Sequencing} 		& \\
Replay of messages			& Message sequence integrity \\
Reordering of messages			& Message sequence integrity \\
Pre-play of messages 			& \\
Delay of messages    			& \\ \hline

{\em Modification of information} 	& \\
Modification of messages		& Content Integrity \\
Destruction of messages			& Message sequence integrity \\ \hline

{\em Leakage of information} 		& \\
Loss of confidentiality			& Content confidentiality \\
Loss of anonymity			& Message flow confidentiality \\
Traffic analysis			& Message flow confidentiality \\ \hline

{\em Repudiation} 			& \\
Denial of origin			& Non-repudiation of origin \\
Denial of submission			& Non-repudiation of submission \\
Denial of delivery			& Non-repudiation of delivery \\ \hline

{\em Security level violations} 	& \\
Originator not cleared for security label	& Secure access management \\
					& Message security labelling \\
MTA/MTS user not cleared for security context	& Secure access management \\
Misrouting				& Secure access management \\
					& Message security labelling \\ \hline
\end{tabular}
