# DBIS AS4 Settlement Threat Model & Control Catalog

**Date**: 2026-01-19  
**Version**: 1.0.0

---

## 1. Threat Model

### 1.1 Threat Categories

#### 1.1.1 Replay Attacks
- **Threat**: Attacker replays valid messages
- **Impact**: Duplicate settlements, financial loss
- **Likelihood**: Medium
- **Severity**: High

#### 1.1.2 Message Substitution
- **Threat**: Attacker modifies messages in transit
- **Impact**: Unauthorized settlements, fraud
- **Likelihood**: Low (with encryption)
- **Severity**: Critical

#### 1.1.3 Key Compromise
- **Threat**: Private keys stolen or leaked
- **Impact**: Unauthorized message signing, fraud
- **Likelihood**: Low
- **Severity**: Critical

#### 1.1.4 Insider Manipulation
- **Threat**: Authorized user performs unauthorized actions
- **Impact**: Fraud, data manipulation
- **Likelihood**: Low
- **Severity**: High

#### 1.1.5 Endpoint Spoofing
- **Threat**: Attacker impersonates member endpoint
- **Impact**: Unauthorized access, fraud
- **Likelihood**: Medium
- **Severity**: High

#### 1.1.6 Denial of Service
- **Threat**: Attacker floods system with requests
- **Impact**: Service unavailability
- **Likelihood**: Medium
- **Severity**: Medium

#### 1.1.7 Man-in-the-Middle
- **Threat**: Attacker intercepts and modifies traffic
- **Impact**: Message tampering, fraud
- **Likelihood**: Low (with mTLS)
- **Severity**: Critical

## 2. Security Controls

### 2.1 Transport Security

#### 2.1.1 Mutual TLS (mTLS)
- **Control**: Require mutual TLS for all AS4 connections
- **Mitigates**: Endpoint spoofing, man-in-the-middle
- **Implementation**: TLS 1.3, certificate pinning
- **Status**: Required

#### 2.1.2 Certificate Pinning
- **Control**: Validate certificate fingerprints
- **Mitigates**: Certificate authority compromise
- **Implementation**: SHA-256 fingerprint matching
- **Status**: Required

#### 2.1.3 TLS Configuration
- **Control**: Strong cipher suites, perfect forward secrecy
- **Mitigates**: Traffic decryption
- **Implementation**: TLS 1.3, restricted cipher suites
- **Status**: Required

### 2.2 Message Security

#### 2.2.1 Message Signing
- **Control**: XMLDSig or JWS signatures on all messages
- **Mitigates**: Message substitution, tampering
- **Implementation**: RSA 2048 or ECDSA P-256
- **Status**: Required

#### 2.2.2 Message Encryption
- **Control**: XML Encryption or JWE for sensitive data
- **Mitigates**: Message interception, data leakage
- **Implementation**: AES-256-GCM or ChaCha20-Poly1305
- **Status**: Required for sensitive messages

#### 2.2.3 Non-Repudiation
- **Control**: Non-repudiation of origin and receipt (NRO/NRR)
- **Mitigates**: Dispute resolution, audit
- **Implementation**: AS4 receipts with signatures
- **Status**: Required

### 2.3 Anti-Replay Protection

#### 2.3.1 Replay Nonce
- **Control**: Unique nonce per message
- **Mitigates**: Replay attacks
- **Implementation**: UUIDv7 or cryptographic nonce
- **Status**: Required

#### 2.3.2 Time Window Validation
- **Control**: Reject messages outside time window
- **Mitigates**: Replay attacks
- **Implementation**: ±5 minute window
- **Status**: Required

#### 2.3.3 Nonce Tracking
- **Control**: Track used nonces in Redis
- **Mitigates**: Replay attacks
- **Implementation**: Redis with TTL
- **Status**: Required

### 2.4 Key Management

#### 2.4.1 HSM Integration
- **Control**: HSM-backed keys for signing
- **Mitigates**: Key compromise
- **Implementation**: Hardware security module
- **Status**: Required for production

#### 2.4.2 Key Rotation
- **Control**: Regular key rotation
- **Mitigates**: Key compromise
- **Implementation**: 30-day rotation window
- **Status**: Required

#### 2.4.3 Key Custody
- **Control**: Separation of duties, multi-person authorization
- **Mitigates**: Insider manipulation
- **Implementation**: Role-based access, approvals
- **Status**: Required

### 2.5 Access Control

#### 2.5.1 Authentication
- **Control**: Strong authentication for all access
- **Mitigates**: Unauthorized access
- **Implementation**: mTLS, JWT tokens
- **Status**: Required

#### 2.5.2 Authorization
- **Control**: Role-based access control (RBAC)
- **Mitigates**: Unauthorized actions
- **Implementation**: Policy engine, entitlements
- **Status**: Required

#### 2.5.3 Audit Logging
- **Control**: Comprehensive audit trail
- **Mitigates**: Insider manipulation, disputes
- **Implementation**: Immutable WORM storage
- **Status**: Required

### 2.6 Network Security

#### 2.6.1 Rate Limiting
- **Control**: Rate limits per member
- **Mitigates**: Denial of service
- **Implementation**: Gateway-level rate limiting
- **Status**: Required

#### 2.6.2 DDoS Protection
- **Control**: DDoS mitigation at gateway
- **Mitigates**: Denial of service
- **Implementation**: CloudFlare or similar
- **Status**: Required

#### 2.6.3 Network Segmentation
- **Control**: DMZ for gateway, internal network for core
- **Mitigates**: Lateral movement
- **Implementation**: Firewall rules, VLANs
- **Status**: Required

### 2.7 Application Security

#### 2.7.1 Input Validation
- **Control**: Strict schema validation
- **Mitigates**: Injection attacks, malformed messages
- **Implementation**: JSON Schema, XML Schema
- **Status**: Required

#### 2.7.2 Idempotency
- **Control**: Idempotent operations
- **Mitigates**: Duplicate processing
- **Implementation**: Instruction ID + Member ID key
- **Status**: Required

#### 2.7.3 Error Handling
- **Control**: Secure error messages
- **Mitigates**: Information leakage
- **Implementation**: Generic error messages, detailed logs
- **Status**: Required

### 2.8 Monitoring and Detection

#### 2.8.1 Security Monitoring
- **Control**: SIEM integration
- **Mitigates**: Attack detection
- **Implementation**: Centralized logging, alerting
- **Status**: Required

#### 2.8.2 Anomaly Detection
- **Control**: Detect unusual patterns
- **Mitigates**: Fraud, attacks
- **Implementation**: ML-based anomaly detection
- **Status**: Recommended

#### 2.8.3 Incident Response
- **Control**: Incident response procedures
- **Mitigates**: Attack impact
- **Implementation**: Runbooks, escalation
- **Status**: Required

## 3. Control Effectiveness Matrix

| Threat | Primary Control | Secondary Control | Effectiveness |
|--------|----------------|------------------|--------------|
| Replay Attacks | Replay Nonce + Time Window | Nonce Tracking | High |
| Message Substitution | Message Signing | Message Encryption | High |
| Key Compromise | HSM Integration | Key Rotation | High |
| Insider Manipulation | RBAC + Audit Logging | Separation of Duties | Medium |
| Endpoint Spoofing | mTLS + Certificate Pinning | Directory Validation | High |
| Denial of Service | Rate Limiting | DDoS Protection | Medium |
| Man-in-the-Middle | mTLS + Certificate Pinning | Message Encryption | High |

## 4. Compliance Controls

### 4.1 Regulatory Compliance
- AML/CTF checks
- Sanctions screening
- KYC/KYB requirements
- Reporting obligations

### 4.2 Audit Requirements
- Immutable audit trail
- Evidence storage (WORM)
- Compliance package references
- Regulatory reporting

## 5. Residual Risks

### 5.1 Accepted Risks
- Low-probability, low-impact risks
- Risks with compensating controls
- Risks within risk appetite

### 5.2 Risk Mitigation
- Regular security assessments
- Penetration testing
- Security training
- Continuous improvement

---

**End of Document**
