Data Exchange Layer & Enablement Layer

[dasunhegoda]

Hello everyone,

I would like to discuss the consideration of implementing a Data Exchange Layer (such as X-Road) versus allowing direct integrations between systems/components. This is a critical aspect of the integration specifications we are developing.

Implementing a Data Exchange Layer brings its own set of pros and cons regarding governance, integrations, technical implementation, and financial considerations.

In addition to the above, I propose the inclusion of an ‘Enablement Layer’ in our G2P Connect specifications. This layer would encompass elements like the network (government network or internet), cloud (government cloud or private cloud), and relevant laws, all serving as a foundation to empower our implementations in a country.

I look forward to the feedback.

[vvujjini]

@dasunhegoda To configure and use core attributes defined in g2p connect header (like send/receiver id, certificates, keys, etc.,) does require a governance and trust layer like x-road or equivalent frameworks to create the interoperable network effect.

For e.g., Social protection systems, foundational/functional registries, mapper, payment systems etc., play a role of a sender / receivers of this network and require to be onboarded, register with their encryption and digital signing verification certificates, etc., for effective data exchange.

Community members should demonstrate use of g2p connect's transport layer agnostic api specs by integrating to x-road or equivalent frameworks with multiple platforms/systems to create this network effect over point to point setups.

I do agree, as community we should document and provide reference implementations and templates for various governance, integration approaches and Information Technology, Cyber Security, Privacy, etc., laws as re-usable artefacts.

@ALL - Any thoughts and ideas on how to curate such a repository?

[dasunhegoda]

@vvujjini : I appreciate your perspective and it raises some pertinent considerations for our specifications. If we mandate the use of an X-Road or similar framework for governance, we'll be endorsing a centralized approach. However, should we also consider permitting a decentralized governance model? Despite its complexities and the lack of a central authority, it could offer more flexibility.

Additionally, should we permit point-to-point integrations? Should we lean towards a service mesh architecture?

These are complex decisions with far-reaching implications, and I'm keen to address these questions thoughtfully. I will share my perspective during our upcoming G2P call.

[pramodkvarma]

Data sharing and empowerment is an independent topic by itself. I wonder if we should complicate G2P blueprint with it or treat it as separate DPI block itself. Personal data, anonymised data, open data architectures and approaches are large by itself.

Is there anything specific G2P sub system will benefit and maybe we can tackle that?

Just sharing some thoughts.

[dasunhegoda]

Thank you for your insights. I agree, but these considerations could be relevant even within subsystems of G2P.

Take, for instance, the integration of a Social Protection Platform (SPP) with a Payment system. The question arises: should we facilitate this integration through a data exchange platform or not?

While SPP and Payment systems fall under the G2P-Connect umbrella, from a country's perspective, they are two distinct systems from separate domains, delivering different services to citizens.

Just wanted to share a few different thoughts and ideas, so that we can well articulate the G2P-Connect specs.

[pramodkvarma]

Yes @dasunhegoda. Such integration is important. For now, in/out APIs for data exchange for social protection system and civil registry is defined within G2P Connect. How that exchange is implemented via a gateway etc is left to implementation. But, a off channel consent mechanism is not handled, it's for now assumed consent is handled within the end point systems and then the API calls are made. @vvujjini please correct if I am wrong.

[dasunhegoda]

Thank you for your feedback and clarifications, @pramodkvarma!

[vvujjini]

@pramodkvarma That is right. In G2P Connect specs, consent is assumed to be handled by the the end point systems.

[dasunhegoda]

Noted with thanks @vvujjini

[euanmillar]

@dasunhegoda @vvujjini I think it would be really nice idea to include X-Road example reference implementation using G2PConnect APIs in a sandbox between our systems.