Data interface operations and connectivity

1.1 Purpose

The purpose of this document is to provide detailed information on how to set up secure encrypted bi-directional telecommunications operations between organizations and the CESP.

1.2 Scope

This document describes the nature of and mechanisms for the transmission of information between organizations and CESP. The Data Interface and Connectivity document provides the following information:

• how to obtain access to the Public Key Infrastructure (PKI)
• how organizations connect and transmit information to CESP
• when organizations send and receive information
• who to contact for technical support concerning problems with information exchanges with the CESP system

This document does not cover general business requirements of organizations managing RESPs or business rules surrounding the CESP. Business issues are covered in other documents which include:

• Canada Education Savings Act
• Canada Education Savings Regulations
• Canada Education Savings Grant Interface Transaction Standards
• Trustee Agreement
• Promoter Agreement

2.1 Key players

Organization Business Contact: The Business Contact is the person responsible to inform the CESP of any organizational changes including all PKI granting/modifications related activities.

Certificate Custodian: The custodian is the person that assumes responsibility for the protection of any information following its decryption and must also protect the certificate and the password.

Local Registration Authority (LRA): Provides assistance to the Certificate Custodian of the External Device Certificate on behalf of Shared Services Canada (SSC).

Guarantor: Provides assistance to the LRA in the form of validating the identity of the Certificate Custodian in person.

2.2 Public Key Infrastructure (PKI) device certificate

Public Key Infrastructure (PKI) device certificate facilitates the transmission of secure, encrypted, and authenticated electronic mail over the Internet. PKI encrypted media ensures that no sensitive information is exposed during transmission between organizations and the CESP. All PKI transmissions receive acknowledgement in both directions.

The PKI device certificate and Managed Secure File Transfer (MSFT) account set-up must be completed prior to submitting any data files to the CESP. To obtain or make changes to an External Device Certificate, the request must be made by the organization’s business contact by sending an email to the CESP. An External Device, Application, Group & Role Certificate Administration Form will be sent directly to the Certificate Custodian for completion to obtain a device certificate.

Completed form must be sent to the CESP authorized LRA for processing. Each organization is limited to 2 External Device Certificates. One Certificate Custodian (user account) should be designated as primary, and the second Certificate Custodian as a back-up. Once the External Device Certificate becomes activated, reports already received through the primary certificate should be deleted. Reports not retrieved or deleted after 3 months will be cleared to reduce network congestion. The back-up account should be activated at least once a month to ensure that it is functioning properly.

If an organizational change occurs and a Certificate Custodian must be replaced, the organization’s business contact must advise the CESP that they wish to have the external device certificate revoked and name a replacement Certificate Custodian. The new Certificate Custodian must send the completed External Device Application, Group & Role Certificate Administration Form to the CESP for processing.

2.3 External device certificate application process

The LRA & Guarantor participates in the External Device Certificate application process in the following manner:

2.4 Contact information

If there is a problem, please contact the authorized LRA at the email address noted below.

Email: EDSC.NC.PCEE.TRANSFERT_SECURISE-SECURE_TRANSFER.CESP.NC.ESDC@hrsdc-rhdcc.gc.ca

For all technical support, please contact Shared Services Canada at the email address below.

Email: ssc.sftsupport-soutiensft.spc@canada.ca

3.1 Managed secure file transfer (MSFT) service

Organizations must use MSFT software to send data to the CESP via the Internet. MSFT is Entrust enabled, and is recognized by ESDC as a secure method of data encryption. MSFT is the only file transmission technology that CESP accepts.

MSFT software is provided free to organizations by CESP. MSFT software and installation instructions are sent to organizations by SSC as part of the PKI subscription process, however, the PKI certification process must be complete prior to installation and use of MSFT.

The benefits of using MSFT include the following:

• data compression
• non-repudiation (proof services)
• simple execution
• information protection
• management and change tracking

3.2 Configuration requirements

The MSFT Client software¹ works on any personal computer equipped with the following:

• at least 12 Mbytes of free disk space on the user’s hard disk for software. Additional space is required for logs
• at least 5 times the disk space estimated for data files being transferred (for example, A 10MB file requires 50MB of free disk space to process through MSFT agent)
• client requires Java Runtime Environment:
  • minimum version of Java is Java 6 update 7
  • recommended version of Java is Java 8
• network Card or Dial-up Modem
• operating system: Any Windows version

The MSFT client software is also available as a standalone Java application and is configurable to run as a Windows service. Organizations are to contact SSC to discuss this feature.

¹ This is a Java based application but is launched using a web browser. The web link that launches the application runs a JNLP file that uses Java Web Start. Pop-ups should be enabled for this site.

3.3 Network requirements

Organizations must have access to Internet service from the MSFT configured PC. Internet access enables the transmission of secure PKI Internet transmission to the SSC MSFT agent at one of the SSC Data Centers.

Note: Response time and service availability depends on the quality of the local Internet service acquired by the organization.