X.500 Security Features

 Overview

The X.500 protocol, which was first approved in 1988 and then enhanced in 1993 with the support of the International Telecommunications Union (ITU). The goal of this protocol was to provide a global standard for directory systems. It consists of a client-server model design, and uses two other protocols, namely Directory Access Protocol (DAP), and Directory System Protocol (DSP), to communicate between the systems.

Security features

The X.500 protocol utilises the X.509 PKI (Public Key Infrastructure) specification as part of its security design.

X.509 is a standard when defining digital certificates. It functions as follows:

1. The client sends a message to the service which include his or her credentials signed with the private key that is paired with the public key in the client's X.509 certificate. The client then attaches a certificate identifier to the request which allows the service to withdraw the certificate from the  certificate repository and verify the message signature.
2. The service validates the certificate, by conducting checks such as verifying that the certificate is still valid. If not, it would not be approved and verifying the internal consistency of the certificate. The service also checks that the data in the certificate has not been tampered with by verifying the certificate contents against the signature of the issuing CA.
3. The service utilizes the public key in the client's X.509 certificate to verify the client's signature. This allows the service to authenticate the client and ensure the authenticity of the signed data even after the message was signed.
4. The service may  subsequently send a response back to the client.

references
http://msdn.microsoft.com/en-us/library/ff649801.aspx
http://www.collectionscanada.gc.ca/iso/ill/document/ill_directory/X_500andLDAP.pdf