Ga naar inhoud

ADR-0033: The source gateway decrypts its own value after the allow, and only the Inway reaches it

Context and problem statement

Under a consent, the query of the consumer names the citizen with a placeholder (ADR-0032). The source API needs a BSN, or the own pseudonym of the source for the citizen. A component must replace the placeholder, under three conditions:

  • Only after the PDP allowed the request (REQ-04).
  • Inside the boundary of the source, with the keys of the source, and without a central party in the query path (REQ-21).
  • Without a BSNk call, because BSNk transforms only while the citizen is logged in (BSNK-04).

A transformation after the decision is a gateway task. It is not a policy task (F-37).

Decision

A gateway that the source owns (bron-sidecar) sits between the source Inway and the source API. The gateway works as follows:

  • The evidence decides. If a consent token is present, the subject comes from the token. Without a token, the request passes through unchanged (PID regime, ADR-0031). Grant properties play no part.
  • Only the own value of the source counts. The gateway takes encrypted_subject[<own OIN>] from the proof: the VI for consent:identity, and the VP for consent:pseudonym. The own decryption component of the source reads the value with the keys of the source.
  • The recipient must match. The decrypted value must name the own OIN of the source as recipient, or the gateway does not accept it. The key in the proof is not evidence. The value that BSNk signed is the evidence.
  • Three cases lead to a refusal, and the request then goes no further:
    • A form is missing, for example no VI for a source that is not on the BSN authorization list.
    • The value is for another recipient.
    • The query has a literal subject under a consent proof.
  • The gateway does not verify the proof again. The PDP verified it on the same request, and the gateway runs only after the allow.
  • Isolation is the control:
    • Only the source Inways reach the gateway (network source-gateways).
    • The gateway reaches only what serves the source (network sources).
    • The gateway publishes no port.
    • The gateway accepts only the request shape that the PDP judged: POST, one path, a JSON body, and no query string.

Considered options

  1. The source gateway decrypts after the allow (chosen).
  2. BSN resolution in the PEP (ADR-0010). The PEP becomes a middlebox that transforms data in shared infrastructure, with a BSNk call in the query path.
  3. The source gateway calls BSNk Transform per request (ADR-0011). BSNk transforms only while the citizen is logged in, and a query comes later.
  4. Transformation in the PDP. Policy is not a data pipeline (F-37). With this option, the PDP holds BSN authority.
  5. The gateway verifies the proof again. This option adds no protection, because a consumer holds real proofs. The protection is that no request reaches the gateway without the allow of the PDP (F-79).

Consequences

  • The query path has no central party and no BSNk. Only the source holds BSN authority, as P-10 requires.
  • "After the decision" holds only while nothing other than the Inway reaches the gateway (REQ-81). The compose networks do this. A Kubernetes deployment needs a NetworkPolicy or an equivalent. In demo v0.9.0, the Helm chart has no such policy.
  • A nonce does not bind a value to one consent. That binding is not built (F-79).
  • A source keeps the decryption keys of an older key version while proofs for that version are valid (AV-09).
  • A source must get its keys in advance, as a step of admission (BSNK-09, onboarding keys, #467).
  • The gateway is a processing. It writes LDV records for the decryption and the forward (ADR-0026).
  • In the demo, the three sources share one OIN and one decryption component. The mock does not encrypt. Production needs one decryption component per source.
  • Two parts are not built: a source API that answers on a pseudonym (#474), and a pseudonym for the consumer itself (#478, Q-01).
  • The gateway is separate from the HTTP handler. For this reason, the gateway can move into an Inway plugin later.

Traceability