BS ISO IEC 9594 — OSI The Directory (X.500 Series) Standard Series

📇 BS ISO/IEC 9594 (BSI catalogue reference BS ISO IEC 09594) is the British Standard series implementing the ISO/IEC 9594 International Standards (technically identical to the ITU-T X.500-series Recommendations) for the Open Systems Interconnection (OSI) Directory, prepared under Technical Committee IST/6 (Data communications), classified under ICS 35.100.70 (application layer). The series defines the concepts, models, services, protocols, data schema and security framework of a distributed directory service (a global “telephone-directory-style” lookup service), most famously the X.500 directory information tree (DIT) model, the Directory Access Protocol (DAP), and the X.509 public-key certificate framework derived from it and widely used on the Internet. X.509 certificates are the foundation of PKI, TLS/HTTPS and electronic signatures.

1. Series Overview 📌

The series is derived from the ISO/IEC 9594 standards jointly prepared by ISO/IEC JTC 1/SC 6 and ITU-T and adopted identically as BS ISO/IEC parts in the UK. Each part corresponds one-to-one with an ITU-T X.500-series Recommendation (e.g. 9594-1 ↔ X.500, 9594-8 ↔ X.509). The series covers everything from concepts, models and service definitions to protocols and replication, forming a complete directory service system:

• Concept layer: Part 1 overview of concepts, models and services.
• Model layer: Part 2 directory information model (DIB/DIT, entries, attributes and aliases).
• Service layer: Part 3 abstract service definition (read, search, modify, add, delete, etc.).
• Protocol and data layer: Part 4 distributed operation, Part 5 protocol specifications (DAP, etc.), Part 6 attribute types, Part 7 object classes.
• Security and replication layer: Part 8 public-key and attribute certificate framework (X.509), Part 9 replication.

2. Series Structure and Technical Points 🧩

3. Key Technical Requirements 🔧

Directory information model (Part 2)

The Directory organises objects into a Directory Information Tree (DIT). Each entry consists of attributes, each attribute comprising a type and values; alias entries provide redirection. The naming model (distinguished name DN and relative distinguished name RDN) gives each entry a globally unique identifier.

Abstract services (Part 3)

Defines the directory abstract services, including read, compare, search, modify, add and delete. Clients establish a session by binding, then perform queries and updates; the search service supports filters and scope control and is the most commonly used capability.

Protocol specifications (Part 5)

Specifies the data encoding (ASN.1 BER/DER) and interaction rules of protocols such as the Directory Access Protocol (DAP), enabling communication between directory clients, directory server agents (DSA) and shadow copies (DSA replication).

Public-key certificate framework (Part 8)

X.509 defines the format of public-key certificates (subject, public key, issuer, validity, signature algorithm and signature) as well as certificate revocation lists (CRL), attribute certificates and the certification path validation process — the cornerstone of PKI and TLS trust chains.

Replication (Part 9)

Specifies the mechanism for replicating (shadowing) directory content across multiple directory server agents (DSA), improving availability and performance with configurable levels and periods.

4. Engineering Practice 🛠️

• 🔐 PKI and TLS: use 9594-8 (X.509) to issue and verify server/client certificates, securing HTTPS, electronic signatures and authentication.
• 📂 Enterprise directories: build enterprise unified directories on the X.500 model (LDAP naming and schema design directly inherit from X.500).
• 🏛️ Government and industry directories: provide unified object lookup and discovery in e-government, carrier and cross-organisation scenarios.
• 🔄 High-availability directories: configure directory replication per Part 9 to improve query performance and disaster recovery.

5. Frequently Asked Questions ❓