InfoMagic Standards 1994 January

home *** CD-ROM | disk | FTP | other *** search

/ InfoMagic Standards 1994 January / InfoMagic Standards - January 1994.iso / iso / 10021_11.asc next >

Wrap

Text File | 1992-12-23 | 87KB | 1,776 lines

The drawings contained in this Recommendation have been done in Autocad. Recommendation X.4001) MESSAGE HANDLING SYSTEM AND SERVICE OVERVIEW The establishment in various countries of telematic services and computer based store and forward messaging services in association with public networks creates a need to produce standards to facilitate international message exchange between subscribers to such services. The CCITT, considering (a) the need for message handling systems; (b) the need to transfer and store messages of different types; (c) that Recommendation X.200 defines the reference model of open systems interconnection for CCITT applications; (d) that Recommendations X.208, X.217, X.218 and X.219 provide the foundation for CCITT applications; (e) that the X.500-Series Recommendations define directory systems; (f) that message handling systems are defined in a series of Recommendations: X.400, X.402, X.403, X.407, X.408, X.411, X.413 and X.419; (g) that interpersonal message is defined in Recommendation X.420 and T.330; (h) that several F-Series Recommendations describe public message handling services: F.400, F.401, F.410 and F.420; (i) that several F-Series Recommendations describe intercommunication between public message handling services and other services: F.421, F.415 and F.422, unanimously declares the view that the overall system and service overview of message handling is defined in this Recommendation. CONTENTS PART 1 - Introduction 0 Introduction 1 Scope 2 References 3 Definitions 4 Abbreviations 5 Conventions PART 2 - General description of MHS 6 Purpose 7 Functional model of MHS 7.1 Description of the MHS model 7.2 Structure of messages 7.3 Application of the MHS model 7.4 Message store 8 Message transfer service 8.1 Submission and delivery 8.2 Transfer 8.3 Notifications 8.4 User agent 8.5 Message store 8.6 Access unit 8.7 Use of the MTS in the provision of public services 9 IPM service 9.1 IPM service functional model 9.2 Structure of IP-messages 9.3 IP-notifications 10 Intercommunication with physical delivery services 10.1 Introduction 10.2 Organizational configurations 11 Specialized access 11.1 Introduction 11.2 Teletex access 11.3 Telex access PART 3 - Capabilities of MHS 12 Naming and addressing 1) Recommendation F.400 is identical to X.400. Fascicle VIII.7 - Rec. X.400 PAGE1 12.1 Introduction 12.2 Directory names 12.3 O/R names 12.4 O/R addresses 13 MHS use of directory 13.1 Introduction 13.2 Functional model 13.3 Physical configurations 14 Distribution lists in MHS 14.1 Introduction 14.2 Properties of a DL 14.3 Submission 14.4 DL use of a directory 14.5 DL expansion 14.6 Nesting 14.7 Recursion control 14.8 Delivery 14.9 Routing loop control 14.10 Notifications 14.11 DL handling policy 15 Security capabilities of MHS 15.1 Introduction 15.2 MHS security threats 15.3 Security model 15.4 MHS security features 15.5 Security management 16 Conversion in MHS 17 Use of the MHS in provision of public services PART 4 - Elements of service 18 Purpose 19 Classification 19.1 Purpose of classification 19.2 Basic message transfer service 19.3 MT service optional user facilities 19.4 Base MH/PD service intercommunication 19.5 Optional user facilities for MH/PD service intercommunication 19.6 Base message store 19.7 MS optional user facilities 19.8 Basic interpersonal messaging service 19.9 IPM service optional user facilities Annex A - Glossary of terms Annex B - Definitions of elements of service Annex C - Elements of service modifications with respect to the 1984 version Annex D - Differences between CCITT Recommendation F.400 and ISO Standard 10021-1 PART 1 - INTRODUCTION 0 Introduction This Recommendation is one of a set of Recommendations for message handling. The entire set provides a comprehensive specification for message handling comprising any number of cooperating open-systems. Message handling systems and services enable users to exchange messages on a store-and-forward basis. A message submitted by one user, the originator, is conveyed by the message transfer system (MTS), the principal component of a larger message handling system (MHS), and is subsequently delivered to one or more additional users, the message's recipients. An MHS comprises a variety of interconnected functional entities. Message transfer agents (MTAs) cooperate to perform the store-and-forward message transfer function. Message stores (MSs) provide storage for messages and enable their submission, retrieval and management. User agents (UAs) help users access MHS. Access units (AUs) provide links to other communication systems and services of various kinds (e.g. other telematic services, postal services). This Recommendation specifies the overall system and service description of message handling capabilities. 1 Scope This Recommendation defines the overall system and service of an MHS and PAGE22 Fascicle VIII.7 - Rec. X.400 serves as a general overview of MHS. Other aspects of message handling systems and services are defined in other Recommendations. The layout of Recommendations defining the message handling system and services is shown in Table 1/X.400. The public services built on MHS, as well as access to and from the MHS for public services are defined in the F.400-Series of Recommendations. The technical aspects of MHS are defined in the X.400-Series of Recommendations. The overall system architecture of MHS is defined in Recommendation X.402. TABLE 1/X.400 Structure of MHS Recommendations Name of Joint MHS Joint support CCITT only Recommendation/Standard CCITT ISO CCITT ISO System Service MHS:System and service X.400 10021-1 F.400 overview MHS:Overall architecture X.402 10021-2 MHS:Conformance testing X.403 Fascicle VIII.7 - Rec. X.400 PAGE1 MHS:Abstract service X.407 10021-3 definition conventions MHS:Encoded information type X.408 conversion rules MHS:MTS: Abstract service X.411 10021-4 definition and procedures MHS:MS:Abstract service X.413 10021-5 definition MHS:Protocol specifications X.419 10021-6 PAGE22 Fascicle VIII.7 - Rec. X.400 MHS:Interpersonal messaging X.420 10021-7 system Telematic access to IPMS T.330 MHS:Naming and addressing F.401 for public MH services MHS:The public message F.410 transfer service MHS:Intercommunication with public physical delivery services Fascicle VIII.7 - Rec. X.400 PAGE1 F.415 MHS:The public IPM service F.420 MHS:Intercommunication F.421 between IPM service and telex MHS:Intercommunication F.422 between IPM service and teletex OSI:Basic reference model X.200 7498 PAGE22 Fascicle VIII.7 - Rec. X.400 OSI:Specification of X.208 8824 abstract syntax notation one (ASN.1) OSI:Specification of basic X.209 8825 encoding rules for abstract syntax notation one (ASN.1) OSI:Association control: X.217 8649 service definition OSI:Reliable transfer: model X.218 9066-1 and service definition OSI:Remote operations: X.219 9072-1 model, notation and service definition Fascicle VIII.7 - Rec. X.400 PAGE1 OSI:Association control: X.227 8650 protocol specification OSI:Reliable transfer: X.228 9066-2 protocol specification OSI:Remote operations: X.229 9072-2 protocol specification PAGE22 Fascicle VIII.7 - Rec. X.400 2 References This Recommendation cites the documents listed below: Recommendation F.60 Operational provisions for the international telex service Recommendation F.69 Plan for the telex destination codes Recommendation F.72 International telex store-and-forward - General principles and operational aspects Recommendation F.160 General operational provisions for the international public fascimile services Recommendation F.200 Teletex service Recommendation F.300 Videotex service Recommendation F.400 Message handling - System and service overview (see also ISO 10021-1) Recommendation F.401 Message handling services - Naming and addressing for public message handling services Recommendation F.410 Message handling services - The public message transfer service Recommendation F.415 Message handling services - Intercommunication with public physical delivery services Recommendation F.420 Message handling services - The public interpersonal messaging service Recommendation F.421 Message handling services - Intercommunication between the IPM service and the telex service Recommendation F.422 Message handling services - Intercommunication between the IPM service and the teletex service Recommendation T.61 Character repertoire and coded character sets for the international teletex service Recommendation T.330 Telematic access to IPMS Recommendation U.80 International teletex store-and-forward - Access from telex Recommendation U.204 Interworking between the telex service and the public interpersonal messaging service Recommendation X.200 Reference model of open systems interconnection for CCITT applications (see also ISO 7498) Recommendation X.208 Specification of abstract syntax notation one (ASN.1) (see also ISO 8824) Recommendation X.209 Specification of basic encoding rules for abstract syntax notation one (ASN.1) (see also ISO 8825) Recommendation X.217 Association control: Service definitions (see also ISO 8649) Recommendation X.218 Reliable transfer model: Service definition (see also ISO/IEC 9066-1) Recommendation X.219 Remote operations model: Notation and service definition (see also ISO/IEC 9072-1) Recommendation X.400 Message handling - System and service overview (see also ISO/IEC 10021-1) Recommendation X.402 Message handling systems - Overall architecture (see also ISO/IEC 10021-2) Recommendation X.403 Message handling systems - Conformance testing Recommendation X.407 Message handling systems - Abstract service definition conventions (see also ISO/IEC 10021-3) Recommendation X.408 Message handling systems - Encoded information type convention rules Recommendation X.411 Message handling systems - Message transfer system: Abstract service definition and procedures (see also ISO/IEC 10021-4) Recommendation X.413 Message handling systems - Message store: Abstract service definition (see also ISO/IEC 10021-5) Recommendation X.419 Message handling systems - Protocol specifications (see also ISO/IEC 10021-6) Recommendation X.420 Message handling systems - Interpersonal messaging system (see also ISO/IEC 10021-7) Recommendation X.500 Directory - Overview (see also ISO/IEC 9594-1) Recommendation X.501 Directory - Models (see also ISO/IEC 9594-2) Recommendation X.509 Directory - Authentication (see also ISO/IEC 9594-8) Fascicle VIII.7 - Rec. X.400 PAGE1 Recommendation X.511 Directory - Abstract service definition (see also ISO/IEC 9594-3) Recommendation X.518 Directory - Procedures for distributed operations (see also ISO/IEC 9594-4) Recommendation X.519 Directory - Protocol specifications (see also ISO/IEC 9594-5) Recommendation X.520 Directory - Selected attribute types (see also ISO/IEC 9594-6) Recommendation X.521 Directory - Selected object classes (see also ISO/IEC 9594-7) 3 Definitions This Recommendation uses the terms listed below, and those defined in Annex A. Definitions of the elements of service applicable to MHS are contained in Annex B. 3.1 Open systems interconnection This Recommendation uses the following terms defined in Recommendation X.200: a) Application layer; b) Application-process; c) Open systems interconnection; d) OSI reference model. 3.2 Directory systems This Recommendation uses the following terms defined in Recommendation X.500: a) directory entry; b) directory system agent; c) directory system; d) directory user agent. This Recommendation uses the following terms defined in Recommendation X.501: e) attribute; f) group; g) member; h) name. 4 Abbreviations A Additional ADMD Administration management domain AU Access unit CA Contractual agreement DL Distribution list DSA Directory system agent DUA Directory user agent E Essential EIT Encoded information type I/O Input/output IP Interpersonal IPM Interpersonal messaging IPMS Interpersonal messaging system MD Management domain MH Message handling MHS Message handling system MS Message store MT Message transfer MTA Message transfer agent MTS Message transfer system N/A Not applicable O/R Originator/recipient OSI Open system interconnection PD Physical delivery PDAU Physical delivery access unit PDS Physical delivery system PM Per-message PR Per-recipient PRMD Private management domain PAGE22 Fascicle VIII.7 - Rec. X.400 PTLXAU Public telex access unit TLMA Telematic agent TLXAU Telex access unit TTX Teletex UA User agent 5 Conventions In this Recommendation the expression "Administration" is used for shortness to indicate a telecommunication Administration, a recognized private operating agency, and, in the case of intercommunication with public delivery service, a postal Administration. Note - This Recommendation is identical to Recommendation F.400. Because of the desired alignment with ISO, the conventions of ISO standards have been adopted for the structure of this text. These conventions differ from the CCITT style. The other Recommendations of the X.400-Series are in accordance with CCITT conventions. Fascicle VIII.7 - Rec. X.400 PAGE1 PART 2 - GENERAL DESCRIPTION OF MHS 6 Purpose This Recommendation is one of a set of Recommendations and describes the system model and elements of service of the message handling system (MHS) and services. This Recommendation overviews the capabilities of an MHS that are used by Administrations for the provision of public MH services to enable users to exchange messages on a store-and-forward basis. The message handling system is designed in accordance with the principles of the reference model of open systems interconnection (OSI reference model) for CCITT applications (Recommendation X.200) and uses the presentation layer services and services offered by other, more general, application service elements. An MHS can be constructed using any network fitting in the scope of OSI. The message transfer service provided by the MTS is application independent. An example of a standardized application is the IPM service. End systems can use the MT service for specific applications that are defined bilaterally. Message handling services provided by Administrations belong to the group of telematic services defined in F-Series Recommendations. Various other telematic services and telex (Recommendations F.60, F.160, F.200, F.300, etc.), data transmission services (X.1), or physical delivery services (F.415) gain access to, and intercommunicate with, the IPM service or intercommunicate with each other, via access units. Elements of service are the service features provided through the application processes. The elements of service are considered to be components of the services provided to users and are either elements of a basic service or they are optional user facilities, classified either as essential optional user facilities, or as additional optional user facilities. 7 Functional model of MHS The MHS functional model serves as a tool to aid in the development of Recommendations for MHS, and aids in describing the basic concepts that can be depicted graphically. It comprises several different functional components that work together to provide MH services. The model can be applied to a number of different physical and organizational configurations. 7.1 Description of the MHS model A functional view of the MHS model is shown in Figure 1/X.400. In this model, a user is either a person or a computer process. Users are either direct users (i.e. engage in message handling by direct use of MHS), or are indirect users (i.e. engage in message handling through another communication system (e.g. a physical delivery system) that is linked to MHS). A user is referred to as either an originator (when sending a message) or a recipient (when receiving a message). Message handling elements of service define the set of message types and the capabilities that enable an originator to transfer messages of those types to one or more recipients. An originator prepares messages with the assistance of his user agent. A user agent (UA) is an application process that interacts with the message transfer system (MTS) or a message store (MS), to submit messages on behalf of a single user. The MTS delivers the messages submitted to it, to one or more recipient UAs, access units (AUs), or MSs, and can return notifications to the originator. Functions performed solely by the UA and not standardized as part of the message handling elements of service are called local functions. A UA can accept delivery of messages directly from the MTS, or it can use the capabilities of an MS to receive delivered messages for subsequent retrieval by the UA. The MTS comprises a number of message transfer agents (MTAs). Operating together, in a store-and-forward manner, the MTAs transfer messages and deliver them to the intended recipients. Access by indirect users of MHS is accomplished by AUs. Delivery to indirect users of MHS is accomplished by AUs, such as in the case of physical delivery, by the physical delivery access unit (PDAU). The message store (MS) is an optional general purpose capability of MHS that acts as an intermediary between the UA and the MTA. The MS is depicted in the MHS functional model shown in Figure 1/X.400. The MS is a functional entity whose primary purpose is to store and permit retrieval of delivered messages. The MS also allows for submission from, and alerting to the UA. The collection of UAs, MSs, AUs and MTAs is called the message handling system (MHS). Figure 1/X.400 - CCITT - 0100311-88 PAGE22 Fascicle VIII.7 - Rec. X.400 7.2 Structure of messages The basic structure of messages conveyed by the MTS is shown in Figure 2/X.400. A message is made up of an envelope and a content. The envelope carries information that is used by the MTS when transferring the message within the MTS. The content is the piece of information that the originating UA wishes delivered to one or more recipient UAs. The MTS neither modifies or examines the content, except for conversion (see S 16). Figure 2/X.400 - CCITT - 0100580-88 7.3 Application of the MHS model 7.3.1 Physical mapping Users access UAs for message processing purposes, for example, to create, present, or file messages. A user can interact with a UA via an input/output device or process (e.g. keyboard, display, printer, etc.). A UA can be implemented as a (set of) computer process(es) in an intelligent terminal. A UA and MTA can be co-located in the same system, or a UA/MS can be implemented in physically separate systems. In the first case the UA accesses the MT elements of service by interacting directly with the MTA in the same system. In the second case, the UA/MS will communicate with the MTA via standardized protocols specified for MHS. It is also possible for an MTA to be implemented in a system without UAs or MSs. Some possible physical configurations are shown in Figures 3/X.400 and 4/X.400. The different physical systems can be connected by means of dedicated lines or switched network connections. Figure 3/X.400- CCITT - 0100590 Figure 4/X.400 - CCITT - 0100600-88 7.3.2 Organizational mapping An Administration or organization can play various roles in providing message handling services. An organization in this context can be a company or a non-commercial enterprise. The collection of at least one MTA, zero or more UAs, zero or more MSs, and zero or more AUs operated by an Administration or organization constitutes a management domain (MD). An MD managed by an Administration is called an Administration management domain (ADMD). An MD managed by an organization other than an Administration is called a private management domain (PRMD). An MD provides message handling services in accordance with the classification of elements of service as described in S 19. The relationships between management domains is shown in Figure 5/X.400. Figure 5/X.400 - CCITT - 0100321 -88 Note 1 - It should be recognized that the provision of support of private messaging systems by CCITT members falls within the framework of national regulations. Thus the possibilities mentioned in this paragraph may or may not be offered by an Administration which provides message handling services. In addition, the UAs depicted in Figure 5/X.400 do not imply that UAs belonging to an MD must be exclusively located in the same country as their MDs. Note 2 - Direct interactions between PRMDs and internal interactions within an MD are outside the scope of this Recommendation. Note 3 - An Administration, in the context of CCITT, that manages an ADMD, is understood as being a member of ITU or a recognized private operating agency (RPOA), registered by a country with the ITU. 7.3.3 Administration management domain In one country one or more ADMDs can exist. An ADMD is characterized by its provision of relaying functions between other management domains and the provision of message transfer service for the applications provided within the ADMD. An Administration can provide access for its users to the ADMD in one or more of the following ways: - users to Administration provided UA - private UA to Administration MTA - private UA to Administration MS - private UA to Administration MTA Fascicle VIII.7 - Rec. X.400 PAGE1 - user to Administration provided UA. See also the examples of configurations shown in Figure 3/X.400 and Figure 4/X.400. Administration provided UAs can exist as part of an intelligent terminal that the user can use to access MHS. They can also exist as part of Administration resident equipment being part of MHS, in which case the user obtains access to the UA via an I/O device. In the case of a private UA, the user has a private stand-alone UA which interacts with the Administration provided MTA or MS, using submission, delivery and retrieval functions. A private, stand-alone UA can be associated with one or more MDs, provided that the required naming conventions are preserved. A private MTA as part of an PRMD can access one or more ADMDs in a country, following national regulations. Access can also be provided by Administration provided AUs described in SS 10 and 11. 7.3.4 Private management domain An organization other than an Administration can have one or more MTA(s), and zero or more UAs, AUs and MSs forming a PRMD which can interact with an ADMD on an MD to MD (MTA to MTA) basis. A PRMD is characterized by the provision of messaging functions within that management domain. A PRMD is considered to exist entirely within one country. Within that country, the PRMD can have access to one or more ADMDs as shown in Figure 5/X.400. However, in the case of a specific interaction between a PRMD and an ADMD (such as when a message is transferred between MDs), the PRMD is considered to be associated only with that ADMD. A PRMD will not act as a relay between two ADMDs. In the interaction between a PRMD and an ADMD, the ADMD takes responsibility for the actions of the PRMD which are related to the interaction. In addition to ensuring that the PRMD properly provides the message transfer service, the ADMD is responsible for ensuring that the accounting, logging, quality of service, uniqueness of names, and related operations of the PRMD are correctly performed. As a national matter, the name of a PRMD can be either nationally unique or relative to the associated ADMD. If a PRMD is associated with more than one ADMD, the PRMD can have more than one name. 7.4 Message store Because UAs can be implemented on a wide variety of equipment, including personal computers, the MS can complement a UA implemented, for example, on a personal computer by providing a more secure, continuously available storage mechanism to take delivery of messages on the user agent's behalf. The MS retrieval capability provides users who subscribe to an MS with basic message retrieval capabilities potentially applicable to messages of all types. Figure 6/X.400 shows the delivery, and subsequent retrieval of messages that are delivered to an MS, and the indirect submission of messages via the MS. Figure 6/X.400 - CCITT - 0100610-88 One MS acts on behalf of only one user (one O/R address), i.e. it does not provide a common or shared MS capability to several users (see also PRMD3 of Figure 5/X.400). When subscribing to an MS, all messages destined for the UA are delivered to the MS only. The UA, if on line, can receive alerts when certain messages are delivered to the MS. Messages delivered to an MS are considered delivered from the MTS perspective. When a UA submits a message through the MS, the MS is in general transparent and submits it to the MTA before confirming the success of the submission to the UA. However, the MS can expand the message if the UA requests the forwarding of messages that exist in the MS. Users are also provided with the capability to request the MS to forward selected messages automatically upon delivery. The elements of service describing the features of the MS are defined in Annex B and classified in S 19. Users are provided with the capability based on various criteria, to get counts and lists of messages, to fetch messages, and to delete messages, currently held in the MS. 7.4.1 Physical configurations The MS can be physically located with respect to the MTA in a number of ways. The MS can be co-located with the UA, co-located with the MTA, or PAGE22 Fascicle VIII.7 - Rec. X.400 stand-alone. From an external point of view, a co-located UA and MS are indistinguishable from a stand-alone UA. Co-locating the MS with the MTA offers significant advantages which will probably make it the predominant configuration. 7.4.2 Organizational configurations Either ADMDs or PRMDs can operate MSs. In the case of Administration supplied MSs, the subscriber either provides his own UA or makes use of an Administration supplied UA via an I/O device. In either case, all the subscriber's messages are delivered to the MS for subsequent retrieval. The physical and organizational configurations described above are examples only and other equally cases can exist. 8 Message transfer service The MTS provides the general, application independent, store-and-forward message transfer service. The elements of service describing the features of the MT service are defined in Annex B and classified in S 19. Provision of public message transfer service by Administrations is described in Recommendation F.410. 8.1 Submission and delivery The MTS provides the means by which UAs exchange messages. There are two basic interactions between MTAs and UAs and/or MSs: 1) The submission interaction is the means by which an originating UA or MS transfers to an MTA the content of a message and the submission envelope. The submission envelope contains the information that the MTS requires to provide the requested elements of service. 2) The delivery interaction is the means by which the MTA transfers to a recipient UA or MS the content of a message plus the delivery envelope. The delivery envelope contains information related to delivery of the message. In the submission and delivery interactions, responsibility for the message is passed between the MTA and the UA or MS. 8.2 Transfer Starting at the originator's MTA, each MTA transfers the message to another MTA until the message reaches the recipient's MTA, which then delivers it to the recipient UA or MS using the delivery interaction. The transfer interaction is the means by which one MTA transfers to another MTA the content of a message plus the transfer envelope. The transfer envelope contains the information related to the operation of the MTS plus information that the MTS requires to provide elements of service requested by the originating UA. MTAs transfer messages containing any type of binary coded information. MTAs neither interpret not alter the content of messages except when performing a conversion. 8.3 Notifications Notifications in the MT service comprise the delivery and non-delivery notifications. When a message, or probe, cannot be delivered by the MTS, a non-delivery notification is generated and returned to the originator in a report signifying this. In addition, an originator can specifically ask for acknowledgement of successful delivery through use of the delivery notification element of service on submission. 8.4 User agent The UA uses the MT service provided by the MTS. A UA is a functional entity by means of which a single direct user engages in message handling. UAs are grouped into classes based on the type of content of messages they can handle. The MTS provides a UA with the ability to identify its class when sending messages to other UAs. UAs within a given class are referred to as cooperating UAs since they cooperate with each other to enhance the communication amongst their respective users. Note - A UA can support more than one type of message content, and hence belong to several UA classes. 8.5 Message store The message store (MS) uses the MT service provided by the MTS. An MS is a functional entity associated with a user's UA. The user can submit messages through it, and retrieve messages that have been delivered to the MS. 8.6 Access unit An access unit (AU) uses the MT service provided by the MTS. An AU is a functional entity associated with an MTA to provide for intercommunication between MHS and another system or service. Fascicle VIII.7 - Rec. X.400 PAGE1 8.7 Use of the MTS in the provision of various services The MTS is used by application specific services for the provision of message handling services of various types. The interpersonal messaging service, described in S 9, is one example of this. Other services can be built on the foundation of the MTS, either with corresponding recommendations or as private applications. 9 IPM service The interpersonal message service (IPM service) provides a user with features to assist in communicating with other IPM service users. The IPM service uses the capabilities of the MT service for sending and receiving interpersonal messages. The elements of service describing the features of the IPM service are defined in Annex B and classified in S 19. The provision of public interpersonal messaging service by Administrations is described in Recommendation F.420. 9.1 IPM service functional model Figure 7/X.400 shows the functional model of the IPM service. The UAs used in the IPM service (IPM-UAs) comprise a specific class of cooperating UAs. The optional access units shown (TLMA, PTLXAU) allow for teletex and telex users to intercommunicate with the IPM service. The optional access unit (TLMA) also allows for teletex users to participate in the IPM service (see also S 11). The optional physical delivery access unit (PDAU) allows IPM users to send messages to users outside the IPM service who have no access to MHS. The message store can optionally be used by IPM users to take delivery of messages on their behalf. 9.2 Structure of IP-messages The IP class of UAs create messages containing a content specific to the IPM. The specific content that is sent from one IPM UA to another is a result of an originator composing and sending a message, called an IP-message. The structure of an IP-message as it release to the basic message structure of MHS is shown in Figure 8/X.400. The IP-message is conveyed with an envelope when being transferred through the MTS. Figure 9/X.400 shows an analogy between a typical office memo, and the corresponding IP-message structure. The IP-message contains information (e.g., to, cc, subject) provided by the user which is transformed by the IPM UA into the heading of the IP-message. The main information that the user wishes to communicate (the body of the memo) is contained within the body of the IP-message. In the example shown, the body contains two types of encoded information: text and facsimile, which form what are called body parts. In general, an IP-message body can consist of a number of body parts, each which can be of a different encoded information type, such as voice, text, facsimile and graphics. Figure 7/X.400 -CCITT - 0100341-88 Figure 8/X.400 - CCITT - 0100351-88 Figure 9/X.400 - CCITT - 0100361-88 9.3 IP-notifications In the IPM service a user can request a notification of receipt or non-receipt of a message by a recipient. These notifications are requested by an originator and are generated as a result of some (such as reading/not reading the message) recipient action. In certain cases the non-receipt notification is generated automatically by the recipient's UA. 10 Intercommunication with physical delivery services 10.1 Introduction The value of message handling systems can be increased by connecting them to physical delivery (PD) systems such as the traditional postal service. This will allow for the physical (e.g., hardcopy) delivery of messages originated within MHS to recipients outside of MHS, and in some cases will allow for the return of notifications from the PD service to an MHS originator. The ability for origination of messages in the PD service for submission to MHS through the PDAU is for further study. The capability of intercommunication between PD and MH services is an optional capability of MHS, and is applicable to any application such as IPM. All users of MHS will have the ability to generate messages for subsequent physical delivery. Figure 10/X.400 shows the functional model of this interworking. Provision of intercommunication between public message handling services offered by Administrations and PD services is described in PAGE22 Fascicle VIII.7 - Rec. X.400 Recommendation F.415. The elements of service describing the features of this intercommunication are defined in Annex B and classified in S 19. Figure 10/X.400 - CCITT - 0100371-88 A physical delivery system is a system, operated by a management domain, that transports and delivers physical messages. A physical message is a physical object comprising a relaying envelope and its content. An example of a PDS is the postal service. An example of a physical message is a paper letter and its enclosing paper envelope. A physical delivery access unit (PDAU) converts an MH user's message to physical form, a process called physical rendition. An example of this is the printing of a message and its automatic enclosure in a paper envelope. The PDAU passes the physically rendered message to a PDS for further relaying and eventual physical delivery. A PDAU can be viewed as a set of UAs, each UA being identified by a postal address. To perform its functions, a PDAU must support submission (notifications) and delivery interactions with the MTS, and also cooperate with other UAs. MH/PD service intercommunication is thus provided as part of the message transfer service. To enable MH users to address messages, to be delivered physically by a PDS, an address form appropriate for this exists and is described in S 12. 10.2 Organizational configurations Possible organizational mappings of the functional model described above are shown in Figure 11/X.400. In each model (A & B), the term PD domain denotes the domain of responsibility of an organization providing a PD service. In A, the PD domain comprises an MD and a PDS. The boundary between the PD domain and the rest of MHS is a boundary between MDs. In B, the PD domain comprises only the PDS; the PDAU is not part of the PD domain. The boundary between the PD domain and MHS lies at the point where the PDAU passes physical messages to the PDS. 11 Specialized access 11.1 Introduction The functional model of MHS (Figure 1/X.400) contains access units (AUs) to allow access between MHS and other communication systems and services. The model shows a generic access unit between MHS and telematic services. Also shown in a physical delivery access unit to allow for physical delivery of MHS messages to recipients without the need for terminal access to MHS. The access to physical delivery services is available to any application carried by the MTS, through a PDU described in S 10. Other forms of access are described below. Figure 11/X.400 - CCITT - 0100380-87 11.2 Teletex access 11.2.1 Registered access to the IPM service The specialized access unit defined for telematic access - telematic agent (TLMA) caters specially for teletex (TTX) terminals. This TLMA provides for teletex access to the IPM service as shown in Figure 7/X.400. The technical provisions of this access are defined in Recommendation T.330. The TLMA enables users of teletex terminals to participate fully in the IPM service. 11.2.2 Non-registered (public) access to the IPM service The specialized access unit defined for telematic access - telematic agent (TLMA) also provides for public access to the IPM service for TTX users who are not registered users of the IPM service. This is shown in Figure 7/X.400. The technical provisions of this access are defined in Recommendation T.330. The intercommunication between the IPM service and the teletex service is defined in Recommendation F.422. 11.3 Telex access 11.3.1 Registered access to the IPM service A telex access unit (TLXAU) is defined in the technical Recommendations to allow the intercommunication between IPM users and telex users. To provide a service with this type of AU is a national matter. 11.3.2 Non-registered (public) access to the IPM service A specialized access unit is defined to allow the intercommunication between IPM users and telex users. This AU provides for public access to the IPM service for telex users who are not registered users of the IPM service, and is called a public telex access unit (PTLXAU). This is shown in Figure 7/X.400. The Fascicle VIII.7 - Rec. X.400 PAGE1 telex users are not subscribers to the IPM service, but use some of the features of the IPM service to pass messages to IPM users. IPM users can also send messages to telex users via this AU. The intercommunication between the IPM service and the telex service is defined in Recommendation F.421. Note - Other types of access units are for further study (e.g., facsimile, videotex, etc.). PART 3 - CAPABILITIES OF MHS 12 Naming and addressing 12.1 Introduction In an MHS, the principal entity that requires naming is the user (the originator and recipient of messages). In addition, distribution lists (DLs) have names for use in MHS. Users of MHS and DLs are identified by O/R names. O/R names are comprised of directory names and/or addresses, all of which are described in this clause. 12.2 Directory names Users of the MH service, and DLs, can be identified by a name, called a directory name. A directory name must be looked up in a directory to find out the corresponding O/R address. The structure and components of directory names are described in the X.500-Series of Recommendations. A user can access a directory system directly to find out the O/R address of a user, or O/R addresses of the members of a DL (both of which are outside the scope of these Recommendations). As an alternative, a user can use the directory name and have MHS access a directory to resolve the corresponding O/R address or addresses automatically as described in S 14. An MH user or DL will not necessarily have a directory name, unless they are registered in a directory. As directories become more prevalent, it is expected that directory names will be the preferred method of identifying MHS users to each other. 12.3 O/R names Every MH user or DL will have one or more O/R name(s). An O/R name comprises a directory name, and O/R address, or both. Either or both components of an O/R name can be used on submission of a message. If only the directory name is present, MHS will access a directory to attempt to determine the O/R address, which it will then use to route and deliver the message. If a directory name is absent, it will use the O/R address as given. When both are given on submission, MHS will use the O/R address, but will carry the directory name and present both to the recipient. If the O/R address is invalid, it will then attempt to use the directory name as above. 12.4 O/R addresses An O/R address contains information that enables MHS to uniquely identify a user to deliver a message or return a notification to him. (The prefix "O/R" recognizes the fact that the user can be acting as either the originator or recipient of the message or notification in question.) An O/R address is a collection of information called attributes. Recommendation X.402 specifies a set of standard attributes from which O/R addresses can be constructed. Standard attributes mean that their syntax and semantics are defined in Recommendation X.402. In addition to standard attributes, and to cater for existing messaging systems, there are domain defined attributes whose syntax and semantics are defined by management domains. Various forms of O/R addresses are defined, each serving their own purpose. These forms and their purpose are as follows: - Mnemonic O/R address: Provides a user-friendly means of identifying users in the absence of a directory. It is also used for identifying a distribution list. - Terminal O/R address: Provides a means of identifying users with terminals belonging to various networks. - Numeric O/R address: Provides a means of identifying users by means of numeric keypads. - Postal O/R address: Provides a means of identifying originators and recipients of physical messages. 13 MHS use of directory 13.1 Introduction The directory defined by the X.500-Series of Recommendations provides capabilities useful in the use and provision of a variety of telecommunication services. This clause describes how a directory can be used in messages handling. PAGE22 Fascicle VIII.7 - Rec. X.400 Details can be found in other X.400 Recommendations. The directory capabilities used in message handling fall into the following four categories: a) User-friendly naming: The originator or recipient of a message can be identified by means of his directory name, rather than his machine oriented O/R address. At any time MHS can obtain the latter from the former by consulting the directory. b) Distribution lists (DLs): A group whose membership is stored in the directory can be used as a DL. The originator simply supplies the name of the list. At the DL's expansion point MHS can obtain the directory names (and then the O/R addresses) of the individual recipients by consulting the directory. c) Recipient UA capabilities: MHS capabilities of a recipient (or originator) can be stored in his directory entry. At any time MHS can obtain (and then act upon) those capabilities by consulting the directory. d) Authentication: Before two MHS functional entities (two MTAs, or a UA and an MTA) communicate with one another, each establishes the identity of the other. This can be done by using authentication capabilities of MHS based on information stored in the directory. Besides the above, one user can directly access the directory, for example, to determine the O/R address or MHS capabilities of another. The recipient's directory name is supplied to the directory, which returns the requested information. 13.2 Functional model Both UAs and MTAs can use the directory. A UA can present the directory with the directory name of the intended recipient, and obtain from the directory the recipient's O/R address. The UA can then supply both the directory name and the O/R address to the MTS. Another UA can supply just the recipient's directory name to the MTS. The MTS would then itself ask the directory for the recipient's O/R address and add it to the envelope. The originating MTA normally carries out the name to O/R address look up. A functional model depicting the above is shown in Figure 12/X.400. Figure 12/X.400 - CCITT - 0100422-88 13.3 Physical configurations Some possible physical configurations of the above functional model are shown in Figure 13/X.400. Where a directory user agent (DUA) and directory system agent (DSA) reside in physically separate systems, a standard directory protocol, defined in the X.500-Series of Recommendations, governs their interactions. It will often be desirable to physically co-locate a UA or MTA with a DUA/DSA. However, other physical configurations are also possible. Figure 13/X.400 - CCITT - 0100431-88 14 Distribution lists in MHS 14.1 Introduction The ability to make use of a distribution list (DL) is an optional capability of MHS provided through the MT service. DL expansion allows a sender to have a message transmitted to a group of recipients, by naming the group instead of having to enumerate each of the final recipients. 14.2 Properties of a DL The properties of a DL can be described as follows: - DL members: Users and other DLs that will receive messages addressed to the DL. - DL submit permission: A list of users and other DLs which are allowed to make use of the DL to send messages to the DL's members. - DL expansion point: Each DL has an unambiguous O/R address. This O/R address identifies the expansion point, which is the domain or MTA where the names of the members of the DL are added to the recipient list. The message is transported to the expansion point before expansion as shown in Figure 14/X.400. - DL owner: A user who is responsible for the management of a DL. 14.3 Submission Submission of a message to a DL is similar to the submission of a message to a user. The originator can include in the DL's O/R name, the directory name, Fascicle VIII.7 - Rec. X.400 PAGE1 the O/R address, or both (see S 12 for details). The originator need not be aware that the O/R name used is that of a DL. The originator can, however, through use of the element of service, DL expansion prohibited, prohibit the MTS from expanding a message unknowingly addressed to a DL. 14.4 DL use of a directory A directory may or may not be used to store information about the properties of a DL. Among the information that can be stored are the following: DL members, DL owner, DL submit permission and the DL expansion point. 14.5 DL expansion At the expansion point, the MTA responsible for expanding the DL will: a) Look up the information about the DL, e.g. in the directory, using access rights granted to the MTA. (Note - Since this is done by the MTA at the expansion point, support of DLs in MHS does not require a globally interconnected directory). b) Verify whether expansion is allowed by checking the identity of the sender against the DL's submit permission. c) If expansion is allowed, add the members of the DL to the list of recipients of the message and transmit the message to them. Figure 14/X.400 - CCITT - 0706800-89 14.6 Nesting A member of a DL can be another DL as shown in Figure 14/X.400. In this case the message is forwarded from the expansion point of the parent DL to the expansion point of the member DL for further expansion. Thus during each expansion, only the members of a single DL are added to the message. During expansion of a nested DL, the identity of the parent DL (e.g., DL1 in Figure 14/X.400) rather than that of the message originator, is compared against the submit permission of the member DL (e.g., DL2 in Figure 14/X.400). Note - DL structures can be defined which reference a particular nested DL more than once at different levels of the nesting. Submission to such a parent DL can cause a recipient to receive multiple copies of the same message. The same result can occur if a message is addressed to multiple DLs which contain a common member. Correlation of such copies can be done at the recipient's UA, and/or in the MS. 14.7 Recursion control If a certain DL is directly or indirectly a member of itself (a situation which can validly arise), or when DLs are combined with redirection, then a message might get back to the same list and potentially circulate infinitely. This is detected by the MTS and prevented from occurring. 14.8 Delivery On delivery of the message, the recipient will find out that he received the message as a member of a DL, and through which DL, or chain or DLs he got the message. 14.9 Routing loop control A message can be originated in one domain/MTA, expanded in a second domain/MTA, and then sent back to a DL member in the first domain/MTA. The MTS will not treat this as a routing loop error. 14.10 Notifications Delivery and non-delivery notifications can be generated both at the DL expansion point (e.g. if submit permission is denied), and at delivery to the ultimate recipient. When a message coming from a DL generates a notification, this notification is sent to the DL from which the message came. The DL will then, depending on the policy of the list, forward the notification to the owner of the list, to the DL or originator from which it got the message, or both, as shown in Figure 15/X.400. Figure 15/X.400 - CCITT 0706810-89 Note - When notifications are sent to the originator after DL expansion, the originator can receive many delivery/non-delivery notifications for one originator specified recipient (the DL itself). The originator can even receive more than one notification from an ultimate recipient, if that recipient received the message more than once via different lists. 14.11 DL handling policy An MTA may or may not provide different policies on DL handling. Such PAGE22 Fascicle VIII.7 - Rec. X.400 policies will control whether notifications generated at delivery to DL members should be propagated back through the previous DL, or to the originator if no such previous DL, and/or to this list owner. If the policy is such that notifications are to be sent only to the list owner, then the originator will receive notifications if requested, only during expansion of that DL. In order to accomplish this restriction, the MTS will, while performing the expansion, reset the notification requests according to the policy for the list. 15 Security capabilities of MHS 15.1 Introduction The distributed nature of MHS makes it desirable that mechanisms are available to protect against various security threats that can arise. The nature of these threats and the capabilities to counter them are highlighted below. 15.2 MHS security threats 15.2.1 Access threats Invalid user access into MHS is one of the prime security threats to the system. If invalid users can be prevented from using the system, then the subsequent security threat to the system is greatly reduced. 15.2.2 Inter-message threats Inter-message threats arise from unauthorized agents who are external to the message communication, and can manifest themselves in the following ways; - Masquerade: A user who does not have proof of whom he is talking to can be easily misled by an imposer into revealing sensitive information. - Message modification: A genuine message which has been modified by an unauthorized agent while it was transferred through the system can mislead the message recipient. - Replay: Messages whose originators and contents are genuine can be monitored by an unauthorized agent and could be recorded to be replayed to the message's intended recipient at a later date. This could be done in order to either extract more information from the intended recipient or to confuse him. - Traffic analysis: Analysis of message traffic between MH users can reveal to an eavesdropper how much data (if any) is being sent between users and how often. Even if the eavesdropper cannot determine the actual contents of the messages, he can still deduce a certain amount of information from the rate of traffic flow (e.g. continuous, burst, sporadic or none). 15.2.3 Intra-message threats Intra-message threats are those performed by the actual message communication participants themselves, and can manifest themselves in the following ways: - Repudiation of messages: One of the actual communication participants can deny involvement in the communication. This could have serious implications if financial transactions were being performed via MHS. - Security level violation: If a management domain within MHS employs different security clearance levels (e.g. public, personal, private and company confidential) then users must be prevented from sending or receiving any messages for which they have an inadequate security clearance level if the management domain's security is not to be compromised. 15.2.4 Data store threats An MHS has a number of data stores within it that must be protected from the following threats: - Modification of routing information: Unauthorized modification of the directory's contents could lead to messages being mis-routed or even lost while unauthorized modification to the deferred delivery data store or the hold for delivery data store could mislead or confuse the intended recipient. - Preplay: An unauthorized agent could make a copy of a deferred delivery message and send this copy to the intended recipient while the original was still being held for delivery in the MTA. This could fool the message recipient into replying to the message originator before the originator was expecting a reply or simply mislead or confuse the original intended message recipient. 15.3 Security model Security features can be provided by extending the capabilities of the Fascicle VIII.7 - Rec. X.400 PAGE1 components in the message handling system to include various security mechanisms. There are two aspects to security in message handling: secure access management and administration, and secure messaging. 15.3.1 Secure access management and administration The capabilities in this section cover the establishment of an authenticated association between adjacent components, and the setting up of security parameters for the association. This can be applied to any pair of components in the message handling system: UA/MTA, MTA/MTA, MS/MTA, etc. 15.3.2 Secure messaging The capabilities in this section cover the application of security features to protect messages in the message handling system in accordance with a defined security policy. This includes elements of service enabling various components to verify the origin of messages and the integrity of their content, and elements of service to prevent unauthorized disclosure of the message content. The capabilities in this section cover the application of security features to protect messages directly submitted to the message transfer system by a user agent, message store, or an access unit. They do not cover the application of security features to protect communication between users and the message handling system, or MH user-to-MH user communication (a large part of MH user-to-MH user communication is protected between two UAs). Thus they do not apply, for example, to communication between a remote user's terminal and its UA, or to communication between these users' terminal equipment and other users in the MHS. Security capabilities to protect MH user-to-MH user communication are for further study. Many of the secure messaging elements of service provide an originator to recipient capability, and require the use of user agents with security capabilities. They do not require the use of a message transfer system with security features. (As an example, content confidentiality can be applied by enciphering the message content by the originator, and deciphering by the recipient, with various security parameters transferred within the message envelope. Such a message can be transferred by an MTS which can handle the format of the content (unformatted octets), and transparently handle the security fields in the envelope.) Some of the secure messaging elements of service involve an interaction with the message transfer system, and require the use of message transfer agents with security capabilities. (As an example, non-repudiation of submission requires the MTA, to which the message is submitted, to contain mechanisms to generate a proof of submission field.) Some of the secure messaging elements of service apply to the MS as well as UAs and MTAs, such as message security labelling. In general, however, the MS is transparent to security features that apply between the originators' and the recipients' UAs. The scope of the secure messaging elements of service is given in Table 2/X.400. This describes the elements of service in terms of which MHS component is the "provider" or which is the "user" of the security service. For example, probe origin authentication is provided by the originating UA, and can be used by the MTAs through which the probe passes. This Recommendation describes the use of security services by the UA, and the MTA. How these features are applied to access units is for further study. 15.4 MHS security capabilities The elements of service describing the security features of MHS are defined in Annex B, and classified in S 19. An overview of these capabilities is as follows: - Message origin authentication: Enables the recipient, or any MTA through which the message passes, to authenticate the identity of the originator of a message. - Report origin authentication: Allows the originator to authenticate the origin of a delivery/non-delivery report. - Probe origin authentication: Enables any MTA through which the probe passes, to authenticate the origin of the probe. - Proof of delivery: Enables the originator of a message to authenticate the delivered message and its content, and the identity of the recipient(s). - Proof of submission: Enables the originator of a message to PAGE22 Fascicle VIII.7 - Rec. X.400 authenticate that the message was submitted to the MTS for delivery to the originally specified recipient(s). - Secure access management: Provides for authentication between adjacent components, and the setting up of the security context. - Content integrity: Enables the recipient to verify that the original content of a message has not been modified. - Content confidentiality: Prevents the unauthorized disclosure of the content of a message to a party other than the intended recipient. - Message flow confidentiality: Allows the originator of a message to conceal the message flow through MHS. - Message sequence integrity: Allows the originator to provide to a recipient proof that the sequence of messages has been preserved. - Non-repudiation of origin: Provides the recipient(s) of a message with proof of origin of the message and its content which will protect against any attempt by the originator to falsely deny sending the message or its content. - Non-repudiation of delivery: Provides the originator of a message with proof of delivery of the message which will protect against any attempt by the recipient(s) to falsely deny receiving the message of its content. - Non-repudiation of submission: Provides the originator of a message with proof of submission of the message, which will protect against any attempt by the MTS to falsely deny that the message was submitted for delivery to the originally specified recipient(s). - Message security labelling: Provides a capability to categorize a message, indicating its sensitivity, which determines the handling of a message in line with the security policy in force. TABLE 2/X.400 Provision and use of secure messaging elements of service by MHS components Elements of service Originating MTS Recipient MTS user MTS user Message origin authentication P U U Report origin authentication U P - Probe origin authentication P U - Proof of delivery U - P Proof of submission U Fascicle VIII.7 - Rec. X.400 PAGE1 P - Secure access management P U P Content integrity P - U Content confidentiality P - U Message flow confidentiality P - U Message sequence integrity P - U Non-repudiation of origin P - U Non-repudiation of submission U P - Non-repudiation of delivery U - PAGE22 Fascicle VIII.7 - Rec. X.400 P Message security labelling P U U P The MHS component is a provider of the service U The MHS component is a user of the service. 15.5 Security management Aspects of an asymmetric key management scheme to support the above features are provided by the directory system authentication framework, described in Recommendation X.509. The directory stores certified copies of public keys for MHS users which can be used to provide authentication and to facilitate key exchange for use in data confidentiality and data integrity mechanisms. The certificates can be read from the directory using the directory access protocol described in Recommendation X.519. Recommendations for other types of key management schemes, including symmetric encryption, to support the security features are for further study. 16 Conversion in MHS The MTS provides conversion functions to allow users to input messages in one or more encoded formats, called encoded information types (EITs), and have them delivered in other EITs to cater to users with various UA capabilities and terminal types. This capability is inherent in the MTS and increases the possibility of delivery by tailoring the message to the recipient's terminal capabilities. The EITs standardized in MHS are listed in Recommendation X.411. Conversions and the use of the elements of service relating to conversion are available for EITs not defined in Recommendation X.411, but supported by certain domains, either bilaterally between these domains or within a domain itself. MHS users have some control over the conversion process through various elements of service as described in Annex B. These include the ability for a user to explicitly request the conversion required or as a default to let the MTS determine the need for conversion, and the type of conversion performed. Users also have the ability to request that conversion not be performed or that conversion not be performed if loss of information will result. When the MTS performs conversion on a message it informs the UA to whom the message is delivered that conversion took place and what the original EITs were. The conversion process for IP-messages can be performed on body parts of specific types if they are present in a message. The general aspects of conversion and the specific conversion rules for conversion between different EITs are detailed in Recommendation X.408. Recommendation X.408 deals with conversion for the following: telex, IA5 text, teletex, G3fax, G4 Class1, videotex, voice, and mixed mode. 17 Use of the MHS in provision of public services The message handling system is used in the provision of public MH services that are offered by Administrations for use by their subscribers. These public MH services are defined in the F.400-Series Recommendations and include: - the public message transfer service (Rec. F.410); - the public interpersonal messaging service (Rec. F.420). In addition complementary public services are offered by Administrations to allow for the intercommunication between CCITT services and the public MH services mentioned above, as follows: - intercommunication with public physical delivery services (Rec. F.415). - intercommunication between the IPM service and the telex service (Rec. F.421); - intercommunication between the IPM service and the teletex service (Rec. F.422); Recommendation F.401 describes the naming and addressing aspects for public MH services. Fascicle VIII.7 - Rec. X.400 PAGE1