Welcome to a new minicycle dedicated to the e-Estonia project, the unprecedented computerization of this small country. In this episode, I will describe the principals that stand on the basis of the construction of solutions used in e-Estonia, followed by the X-tee system, which is the bureaucracy's connectivity system and in the next episode the KSI blockchain used in part of the state databases.
Main principles of e-Estonia
Here I will describe the IT principals that determine the uniqueness of e-Estonia:
transparency - The code for the main solutions used in Estonia's public administration is published on Github under an open source license, and the formats of the documentation flowing through the state's IT network are published at https://x-tee.ee/service-catalog.
the principle of a one-year request for information - This principle dictates that a particular person is forced to provide unique information to public institutions only once. Accordingly, each institution is to acquire the necessary data mainly by querying databases. Similar information also applies to other entities and objects.... of course, then the ultimate source of information becomes the custodian or owner.
the principle of decentralization of government information resources -The rule prohibits public institutions from collecting information in their databases that falls outside the domain of their responsibility.
interoperability - The rule states that databases managed by public administrations are to be capable of peer-to-peer information exchange.
principle of access to data about oneself - The rule states that any adult not under guardianship (in short, it's incapacitation) has the right to inspect the full information resource processed by public institutions about him.
The principle of registration of communication between public administration databases - The so-called security servers that are the gateways between the individual public's IT system and the X-tee's communications system record, after being secured with cryptographic processing, of course, the content of all communications passing through them for the purpose of enabling autdits.
Upon closer inspection, it should become clear that each of the above principles for the rest of the world is revolutionary even in this day and age.
X-Tee, the communications backbone of Estonia's public administration
X-Tee is an Estonian implementation of the X-Road protocol, in which public administration databases exchange information in peer-to-peer mode. The system is managed by RIA (Rigii Infosüsteem Amet), whose role is to manage and/or monitor the databases, the services they provide, including maintaining a website with an inventory of them, and the IT infrastructure working for X-Tee.
The structure of X-Tee and the role of the various parts of the system:
Centrum - This functionality is performed by the RIA: State Information System Authority unit and has the following roles:
- admission of new members
- issuing access certificates
- defines the X-Tee Code of Conduct
- monitors actual behavior patterns by auditing logs downloaded from security servers
Members/Participant - These are legal entities, including private entrepreneurs, whose application for membership has been approved by the Center. These members provide and/or obtain resources from members as approved by relevant legal agreements.
Trust Service Providers - There are cryptographic services mainly certificates and timestamping, through which security servers carry out security of logged logs.
The role of security servers in the X-Tee system
Security servers act as a gateway between members' information systems and the actual communication channel of the X-Tee system, in short it traces (From a tehnical point of view, this role is analogous to that of DNS on the Internet) the other databases, encrypts the communication between the databases and records it in logs.
Members for security servers can be connected in the following configurations:
Organizations with large numbers in the style of a ministry or an inquiry corporation can connect several security servers to their IT network to balance communication channels.
Small organizations in the style of village-type local government units can rent servers from other units, such as companies set up specifically to provide such services.
X-Tee usage patterns
A consumer or customer is a person or organization that is limited to passively querying the records handled by the X-Tee system. Consumers enter the information systems and fill out prefabricated applications there. Such completed applications are sent to the security server to which the institution's information system has been connected. The request sent to the security server is in the form of a POST request: security_server/requested_database_data/service?proper_request_object.
The identifiers of the parties involved in a given communication otherwise known as an interaction, which are written to the logs of the security servers through which the interaction passes, are constructed by providing numeric identifiers, which, depending on the sensitivity of the data, can be supplemented with the results of additional verifications. The earliest form of verification is the attestation of the identity of a person, such as a police officer, requesting by providing Isikukood (a person's identification number) or eID (the European Union's digital identity standard. Unfortunately not introduced by all member countries).
Data providers are the entities that coopt X-Tee to respond to requests and process data. The IT systems of these entities include an Adapter Server that communicates the security server with the relevant database to which access has been granted.
The Adapter Server, upon receiving the security server's request, first validates the request against the requested WSDL file, then translates the request from a Data Exchange Layer X-tee compliant form into a query that the database understands, and finally sends back a response.
