Directory services are a critical military component, used for tactical and strategic systems. Military directories, standardized in ACP 133, are used to provide information services, support of military messaging, and as supporting infrastructure for other applications such as PKI (Public Key Infrastructure).
Isode provides all of the servers and management tools needed to build a military directory.
Conformance is critical for military directories. The primary definition of military conformance is ACP (Allied Communication Publication) 133 "Common Directory Services and Procedures". ACP 133 is based on the ISO/ITU X.500 Directory Standard, and makes use of X.500 protocols for replication and directory management. LDAP, the Internet Standard Lightweight Directory Access Protocol is also based on X.500, and is generally the preferred protocol for military clients and military applications to read data from an ACP 133 directory. Data updates are usually done using X.500 DAP, as this offers additional security features.
Security features are an important element of ACP 133 directory. Strong authentication and related capabilities using digital signatures are central to directory security. All of the directory protocols used by M-Vault make use of digital signatures based on X.509 PKI (Public Key Infrastructure) to provide peer authentication and signed operations.
Complementing the PKI based authentication and signed operations, Isode provides a number of important security features including:
A key benefit of using a directory is that data can be highly distributed. In a commercial environment, distribution is primarily used to optimize performance and to avoid single point of failure. In a military environment, there are more stringent resilience requirements, and it is critical that local systems have minimum external dependencies. This leads to four key points about the structure of a military directory:
A simplistic interpretation of this approach would lead to all data in all servers. There are two reasons why this is not done in practice:
X.500 DISP provides capabilities, which make it straightforward to provide selective replication and meet these two requirements. This includes attribute filtering (to remove attributes not needed), and "chop", which enables entries and parts of the directory information tree to be selectively replicated. This is a powerful part of the X.500 architecture, which is useful for building a military directory, and is implemented in M-Vault.
Some military directory deployments have suggested use of directory synchronization products (meta-directories) to achieve complex replication scenarios. These techniques generally use LDIF (LDAP Data Interchange Format), which relies on common interpretation of string formats, which may not be standardized. Isode believes that this approach adds unnecessary complexity and will reduce robustness and security. Isode strongly recommends use of advanced X.500 DISP replication to build robust replicated directory deployment using open standards.
M-Vault provides a failover capability to provide live backup for a master directory.
Finally, M-Vault provides for a multi-master capability. This provides benefits in many scenarios.
While directory synchronization is not the best choice for core directory replication, it is an important part of many military directory deployments, due to the need to integrate data from multiple directories and to support LDAP directories that do not support open standard replication.
Where there is a need to share directory information with partner organizations, or to integrate information from systems that do not support ACP 133 and X.500 DISP, Sodium Sync provides flexible data sharing. This includes synchronization by email and over air gap.
Client protocol access to a military directory may use either X.500 DAP or LDAPv3. M-Vault supports both of these protocols. For applications that make updates to the directory, Isode recommends use of X.500 DAP, using strong authentication and signed operations. This approach, with its security benefits, is supported by all Isode tools that modify data in the directory.
LDAP is widely supported in many applications and LDAP provides good functionality to access the directory, provides data confidentiality (using Transport Layer Security (TLS)), and gives a range of authentication mechanisms, including strong authentication when used in conjunction with Simple Authentication and Security Layer (SASL). For applications that only read data from the directory, LDAP is generally a good choice.