38.5 Pedi and EDIM structures classified as authentication, data integrity and confidentiality. A fourth threat to any network is of course availability, however this is generally left to lower level protocols to handle. Much thought has been given to security in Pcdi' and indeed X.400 Internal topologies 1988 is also much improved in this area. The concept of different levels of security in a network is allowed for and specific elements The one thing the X.400 and X.435 standards do not specify is how of the protocol allow a message to be configured for the particular they should be implemented. This leads to a variety of possible type of security required. solutions, each best suited to a particular business scenario. Security in EDI is obtained by the use of keys and encryption. Five possible models are listed below but this is by no means an Keys can be of two types, symmetric where the same key is used at exhaustive list and many combinations of scenarios may be applic- both ends and asymmetric where the key used to unlock is different able to larger firms. The protocol contains elements in support from the key used to lock but has exactly the same effect. One type of all the following: of asymmetric key algorithm (the RSA) is given in annex to the X.509 standard. 1. The EDI UA is linked to a single EDI application Authentication is about ensuring that the message originates from 2. The EDI UA is a 'corporate gateway', i.e. a sophisticated piece who it purports to. This is essential where instructions for payment of software capable of audit trails, translations of data format are being issued. and may onward transmit via proprietary protocols. In this case Authentication relies on the application to a message of an asym- the gateway may take responsibility for returning notifications metric private key known only to the sender. It works in the follow- of delivery. ing manner. Global VAN topologies 38/7 The message being sent is put through a hashing function and A more up to date method, in line with curren