Unified eXchange Platform(UXP)
White Paper
UXP-WP-TOP

Version 1.5
15.06.2023

Table of Contents
1. Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. Overview of UXP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. Basic Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Peer to Peer Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

3. Advanced Topics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1. Working with Physical Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.2. Using Remote Hosting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3. Connecting UXP Infrastructures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.4. Scaling and Reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.5. Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.6. Publishing UXP Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4. Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.1. Simple Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.2. Complex Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

UXP-WP-TOP

1. Background
The Cybernetica UXP® (Unified eXchange Platform) is targeted at situations where several
parties wish to establish a standardized communication channel that provides confidentiality,
strong authentication and long-term proof value of the relayed messages. The model case forthis situation is a governmental data exchange infrastructure. Here the communicating
parties are governmental agencies, private companies and citizens who exchange data witheach other by calling services (service-oriented architecture).
When connecting existing organizations operating under existing laws, it is imperative thatthe service providers retain control over their systems and data. In UXP, the service provider
maintains and enforces an access control list for each service (the access control list handles
request authorization on an organizational level, see Section 3.1 for details). Before using aservice, the service client and service provider enter into an agreement that specifies theliabilities for both parties. On one side, the service provider agrees to provide a service with agiven Service Level Agreement. On the other side, the service client agrees to use the service
and process the received data according to the conditions defined by the service provider.
This system allows service providers to control how their data is processed and to fulfill theirlegal obligations (such as conformance to data protection laws).
In order to make connecting organizations simple and cost-efficient, a unified set ofstandards should be developed. This is cost-efficient because organizations do not have toimplement a different standard for each communication partner. By implementing support fora set of protocols, it is possible to communicate with any number partners who areconnected to the UXP infrastructure. In UXP, standardization happens on two levels. First, allcommunication is implemented as SOAP or REST web services. For SOAP, Web Services
Description Language (WSDL) is used to describe services. Using standard interfaces
ensures that adding another communication partner does not involve any major softwaredevelopment effort. However, the actual messages are defined by each specific application.
Second, organizations must implement a standardized security solution and a set of security
protocols. In order to ensure consistently high quality and a high degree of interoperability, all
the UXP members use standardized security components, called security servers, developedby the central authority. The standardized security components are deployed at the member
organizations and completely encapsulate security aspects of the UXP infrastructure. The
application developers can thus concentrate on implementing the application-level protocol
without getting involved with the security aspects of the communication.
The security requirements for this kind of communication are very high. The exchanges
typically contain personal information and are subject to regulation (for example, transmitting
medical information is highly regulated). The communication between members must use
end-to-end encryption so that private information is not revealed to any intermediaries. Sometransactions are high value, such as making a query to the social security database before
paying out a disability pension. The exchanged messages should be usable as evidence in acourt of law. Thus, there is a need for qualified signatures issued using hardware signature
creation devices and certificates from accredited certification service providers.
Given that business processes depend on the data exchange infrastructure, the availability

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
1 / 11UXP-WP-TOP

requirements are also rather high. In particular, there cannot be any component that could
potentially become a single point of failure or a global performance bottleneck. If two parties
in the system have established a communication context, then continuing the communication
should not depend on availability of other components (limited only by the expiration ofcached information). Additionally, it must be possible to use redundancy and load balancing
for critical components to ensure smooth functioning of the infrastructure.
With a governmental data exchange, the number of communicating parties can be quite large.
Coordinating this communication requires presence of a governing authority. In addition toestablishing standards for communication, the governing authority is needed to create andenforce standardized security policies and to provide technical support (such as
standardized gateway software or public key certificates) to members of the infrastructure.
In case of disputes, the governing authority may act as an arbiter.
If several countries deploy compatible data exchange infrastructures, cross-border services
become a possibility. This means that it is possible for a member of the infrastructure to call aservice of a member of another infrastructure. In order to accomplish this, the governing
authorities of the infrastructures must enter into an agreement to establish a trust
relationship between the infrastructures and mutually agree to trust the trust service
providers of the partner. When the agreement is made and the technical information is
propagated to the members, the members of different infrastructures can communicate
directly and securely.
The governmental data exchange infrastructure uses all the features of UXP. When scaled
down (with regard to both features and administration procedures), UXP can also be used toconnect organizations joined to form a community or consortium, or even to connect
separate information systems inside a single organization. In these cases, the policies andadministrative procedures (e.g., adding a new member to the infrastructure) can be
implemented in a simpler, faster manner or omitted altogether.

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
2 / 11UXP-WP-TOP

2. Overview of UXP
2.1. Basic Infrastructure
The UXP system provides a solution to the situations described in the previous chapter. Next,
we will describe how UXP works by building the solution step by step.
In the simplest case, the system has the following participants (see Figure 1):
Members
entities that wish to communicate with each other. The assumption is that each member
has an information system that will be connected with other members' systems.
Governing authority
coordinates communication activities, creates and distributes security policy, maintains
and distributes registry of members, distributes gateway software (see below).
Trust service providers
provide certification and time-stamping services. In the simple case, the trust services canbe provided by the governing authority.

Certification Service
Get Certificate

Time-Stamping Service

Approve Service

Approve Service

UXP Governing Authority

Use Service

Configuration

Configuration
Join UXP

Join UXPEnter Service Agreement

Member: Service Client

Member: Service Provider
USE SERVICE

Figure 1. Participants of the UXP system

In UXP, communication is organized as synchronous service calls. The service providers
design and implement services and make them available for service clients. Access to theservices is controlled by the service provider. In order to use a service, the service client andthe service provider enter into an agreement that specifies the terms of the service, theservice level agreement (SLA) offered by the provider and the security requirements that theclient must meet in order to use the service. After this is done, the service provider adds theclient to its access control list. The UXP system provides the technical means to manage theaccess rights of service clients. Different infrastructures can have different rules for providing

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
3 / 11UXP-WP-TOP

access to services (e.g. a lightweight informal process for a corporate infrastructure or pilot
environment in contrast to a formal process with formal service usage agreements that state
the service levels, conditions and obligations of the parties).
In the UXP system, members communicate directly without intermediaries. All the messages(requests and responses) are signed and time-stamped and sent over an encrypted andmutually authenticated channel.
The governing authority does not take part in the actual message exchange. Instead, it acts
as a coordinator and facilitates the communication by• defining a list of trusted certification service providers and time-stamp providers,• managing a member directory,• maintaining a directory of services offered by service providers (optional),• monitoring the system to help debug any problems and to collect monitoring data forplanning purposes,• maintaining and distributing the security server software.
In addition to the technical tasks, the governing authority is responsible for defining security
requirements that must be met by the members of the infrastructure, such as requirements touser authentication.

2.2. Peer to Peer Communication
The security-related functionality that the UXP members must implement is encapsulated into
reusable components called security servers. The governing authority distributes the security
server software that the infrastructure members install as a part of their information systems.
To the application software, the security server is an almost transparent gateway that
accepts standard SOAP or REST requests from the service client and forwards them to theservice (via the service provider’s security server). The application software does not need to
implement any part of UXP’s security protocol.
UXP members communicate directly with each other. The communication uses the Transport
Layer Security (TLS) protocol to establish a secure channel between the security servers.
The security channel uses mutual certificate-based authentication (both the server and client
must present a valid certificate). The authentication certificates are registered at the
governing authority and connected to security servers. Thus, when creating a connection, thesecurity server verifies that the partner’s security server presents a registered authentication
certificate and that the partner’s security server is indeed allowed to represent the partner.
The security server signs all the outgoing messages with the member’s signing key. It saves
all the signed messages to a log. The log is periodically time-stamped to ensure long-term
validity of the signatures. The time-stamped signatures can be extracted from the log andpresented to third parties for verification. Additionally, UXP uses blockchain technology(Merkle trees) to protect the message archives against tampering.
The members communicate directly with approved trust service providers. When joining theUnified eXchange Platform (UXP) White Paper
15.06.2023

1.5
4 / 11UXP-WP-TOP

communication infrastructure, each member must acquire a certificate for signing themessages and another certificate for transport security. The member must also select a timestamping service provider that will be used to provide long-term security to the exchanged
messages. During communication, the member interacts with service providers to acquirecertificate validity information and to time-stamp the signed messages.

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.55 / 11UXP-WP-TOP

3. Advanced Topics
3.1. Working with Physical Persons
UXP divides the authentication and access control to two levels/tasks. Inter-organizational
level is standardized and implemented in security servers. On that level, the service provider
and service client mutually authenticate themselves (as organizations). The requests andresponses are signed by the originating security server using a key issued to theorganization. On the service provider side, the security server enforces access control on theorganization level – the access control list contains information on whether a service client isallowed to access a given service. These access rules are based on service provisionagreements between service provider and service client.
The second level is the intra-organizational level, that concerns proceedings within theservice client organization. In UXP, authenticating the end users and applying suitable access
control policy is responsibility of the service client organization. When joining UXP, theorganization must prove that it has implemented user authentication and access control
procedures that are compliant with the security requirements established by the governing
authority. For example, a service provider can declare that a given service can only beaccessed by clients who have implemented an ISO 27001 compliant information security
management system.
The two-level approach used by UXP has two main benefits. First, the point of user
authentication and the enforcing of an access control policy is close to the source of user andaccess control information. If, for example, the end user access control would be performedby the service provider, there would be a need to create and maintain an up-to-date copy ofthe user database at the service provider. In the current solution, the access rights arechecked by the same organization that is responsible for assigning the access rights forusers. However, the identity of the end user who initiated the transaction is transmitted to theservice provider who can use it to enforce additional data-based access control rules (e.g.,allowing a doctor to only view patients she is currently treating).
Second, separating inter- and intra-organizational access control mechanisms avoids theneed to standardize end user authentication and access control across the whole
infrastructure. Instead, each organization can choose to implement this functionality in amanner that is optimal for their particular case. Additionally, there is no need to rewrite
existing systems – if the current authentication and access control scheme conforms torequirements set by the governing authority, then it is possible to keep using it.
Implementing services for private citizens imposes somewhat different requirements than
implementing services for government officials. The citizens do not have their own
information systems for accessing the services. To manage citizen access rights, a separate
information system called a citizen portal can be created and integrated with UXP. A typicalcitizen portal authenticates citizens using ID-cards, passwords or external authentication
services (e.g., banks). Once authenticated, a citizen has access to specifically designed
services for managing data about themselves. For example, they can query state registries
for personal data or submit applications (such as registering for child support). The citizen
Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
6 / 11UXP-WP-TOP

portal sends the citizen’s identifier to the back-end service which uses it to filter the query
results.

3.2. Using Remote Hosting
In the simplest case, each organization is responsible for installing a security server thatconnects its information system to UXP. This assumes that the organization has an IT
department capable of maintaining the information system and security server. Another very
common case, however, is a smaller organization that does not maintain its own information
system but instead uses hosting services offered by an application service provider (ASP). In
this case, it is reasonable to also use hosting services for the security server.
UXP has explicit support for hosted security servers. Each security server has an owner – anentity that is responsible for installing and maintaining the security server. The owner has
physical access to the security server and can, for example, upgrade hardware or back up
the system. In the simplest case, the owner is also the only user of the security server. In
addition to the owner, each security server can have one or more clients. The security server
client is an organization which uses the security server to access or provide services. For
signing messages, each client uses its own signing key that is stored on the security server(either in software or in a hardware security module, depending on the configuration).
The connection between a client and a security server is registered at the governing
authority and distributed to all the members of the infrastructure. The connection must be
separately approved by the client and the security server owner in order to prevent abusecases (e.g., when an owner adds a new client to their security server without the client’s
consent). When establishing a connection between two organizations, both security servers
check that the other server is authorized to represent the partner organization.
When using hosted security servers, one must pay attention to the fact that the security
servers have cleartext access to all the data that passes through them. This means that asecurity server is subject to the same security requirements that apply to an information
system that produces or consumes the data.

3.3. Connecting UXP Infrastructures
UXP allows for the connection of several infrastructures to create support for cross-borderservices. The requirements for cross-border services are the same as for regular services.
• The two members communicate directly with each other using end-to-end encryption.
There are no intermediaries that could see the data and neither is there any danger of acommunication bottleneck.
• Connection of two UXP infrastructures does not require manual distribution of securitycritical configuration to all the UXP members.
• The governing authority is responsible for defining the security policy of a UXP instance.
Before cross-border services can be used, the two UXP infrastructures must enter into afederation relationship.

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
7 / 11UXP-WP-TOP

1. The governing authorities of the UXP infrastructures sign a federation agreement. With
this agreement the governing authorities state that the security policies of both UXP
infrastructures are compatible. In particular, both parties agree to trust the certification
authorities used by the other party.
2. The governing authorities exchange technical data that is used to download and verify theconfiguration of their UXP infrastructure. This configuration contains a list of trusted
certification authorities, a list of members and their security servers as well as several
technical parameters used for exchanging the messages.
3. Both governing authorities enter the download parameters of the other UXP infrastructure
into configuration that is distributed to their members. This allows the members to
download and use the configuration of other UXP infrastructures without any special effort
in their part.
When participating in a cross-border service call, each party determines the UXP instance towhich their partner belongs to and downloads the corresponding configuration. After that, it
is possible to establish a secure channel with the other party and start exchanging messages.
When exchanging configuration between UXP infrastructures, the governing authorities canuse filtering to restrict the access to cross-border services. Filtering can be applied both forincoming and outgoing data. For example, if a governing authority filters outgoing
configuration to remove a class of members (e.g., private companies), these members will not
be able to communicate with members of the other infrastructures.

3.4. Scaling and Reliability
UXP is designed from the ground up to enable building scalable and reliable infrastructures.
The two central design principles are:1. there must be no single point of failure nor any central bottlenecks;
2. it must be possible to increase the reliability and performance of any component by adding
redundancy.
The primary method for achieving the first objective is the decentralized architecture of UXP.
The security servers communicate directly without any intermediary and thus avoid central
bottlenecks. The centralized services (central configuration and PKI services) are not queried
for every incoming message. Instead, they are queried once and the relevant information iscached. This prevents the security servers from overloading the centralized services andallows them to continue operating when the centralized services encounter minor downtime.
UXP supports implementing redundancy for all the components: the registry server, theservice client’s security server and the service provider’s security server. The redundancy
solution for the registry server uses an active-active system so that all the connected servers
can be used to make changes to the configuration. The registry servers can be distributed
between several locations. Security servers can be clustered on both the service client’s andthe service provider’s side. On the service client’s side, it is possible to install a load balancer
to distribute the load between several security servers. On the service provider’s side, adegree of load balancing is built into the UXP protocol. If the service provider has several

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
8 / 11UXP-WP-TOP

security servers, the service client’s security server targets provider’s security servers in turnto distribute the load.

3.5. Monitoring
Monitoring of UXP servers takes place on two levels. On the local level, the member
organization’s systems administrator monitors the security servers managed by theorganization. On the global level, the governing authority has overview of all the security
servers on UXP. This overview is needed to support members in diagnosing problems,
determining performance bottlenecks and measuring compliance with SLA. Global statistics
can also be used to guide further development of the ecosystem (such as which members
and services get the most traffic).
The UXP monitoring system processes three kinds of information. First, the monitoring
system collects information about the current system state, such as processor load, amountof free memory, etc. This is used to monitor the general health of the security servers.
Second, the monitoring system receives information about any faults that occur during
message processing. Especially on the global scale, it is important to know which parts of the
UXP system are working and which parts are not. Third, the monitoring system collects
statistical information about messages processed by security servers. This can be used todiagnose and predict performance bottlenecks (e.g., whether some service is growing more
popular and more resources must be added to support the increased load) and also to
discover any usage that does not conform to typical patterns and can therefore indicate
unauthorized use of the services.
The UXP monitoring system uses industry standard tools for processing and analyzing themonitoring information. Security server health data is pushed to Zabbix monitoring system
where it can be processed in the usual manner. The message exchange statistics are stored
in an Elasticsearch database where they can be analyzed using all the tools in the ELK stack.
It is also possible to develop plugins for additional backend systems.

3.6. Publishing UXP Infrastructure
Simply managing information in the registry server and the monitoring system is not enough –the UXP members as well as other stakeholders need a way to explore the system and to
discover the connected information systems and the services they provide. UXP Directory is
a component that collects information from the registry server and the security servers andmakes it all accessible over a user interface as well as an API. Depending on configuration,
the Directory allows the members also to publish additional information, such as technicalcontact data and documentation both for information systems and offered services. In orderto put the data into context, the Directory also pulls statistical information from the UXP
monitoring system and displays it alongside with other data. This makes it easy to discoverwhat is the most popular service offered by an information system or the most active client in
the UXP infrastructure. Subset of the statistical information can also be downloaded as open
data for further analysis and research.

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
9 / 11UXP-WP-TOP

4. Deployment
This chapter describes two cases of implementing UXP. The first case has minimal security
requirements and is suitable for a pilot environment or for communication between trusting
parties (e.g. departments inside one organization). The second case provides high security
and is suitable for governmental data exchange infrastructure.

4.1. Simple CaseIn the simple case, UXP can be set up in the following manner.
• The governing authority also provides certification and time-stamping services. The
certification policy is tailored to match specific security requirements. For example, thecertificates can be issued using fully automated procedures that make use of existingauthentication schemes (company-wide authentication system, digital signatures, etc.).
• The procedures for registering members and security servers are also fully electronic andrely on existing identities and authentication schemes.
• Software keys (stored on the hard disk of a security server) are used for authentication
between security servers and message signing.

4.2. Complex CaseIn the high-security case, UXP can be set up in the following manner.
• Officially recognized services are used for certification and time-stamping. The
certification policies and time-stamping policies are compliant with the requirements forlegal digital signatures.
• Signing keys are stored in secure signature creation devices (SSCD). Depending on theperformance requirements, either smart cards, USB tokens or hardware security modules
may be used.
• If necessary, the governing authority creates regulations that allow signed UXP messages
to be used as digital signatures or digital stamps.
• In addition to a high-security production environment where the signed messages carrylegal force, a pilot/test environment is set up, possibly according to the relaxed
requirements outlined in the previous section. This is used by service providers andservice clients to test new services before using them in production.
• High availability solutions are used both for centralized services and providers of criticalservices.
When setting up the infrastructure, the governing authority defines a security policy. The
security policy contains or references:• a list of approved certification services and time-stamping services;• any security requirements that must be fulfilled by organizations before they can join UXP;
Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
10 / 11UXP-WP-TOP• procedures for managing membership of UXP (joining, leaving, changing contact
information, etc.).
In addition to the security policy, the governing authority defines a template for service
provision contracts and service level agreements.
In order to ensure the smooth running of the infrastructure and respond quickly to errors, thegoverning authority sets up a global monitoring system to receive information about thestatus of security servers and any faults that occur in message processing.

Unified eXchange Platform (UXP) White Paper
15.06.2023

1.5
11 / 11