A big challenge for any company who interacts with government IT systems is when the said department undertakes some form of upgrade or change. The downstream effects usually require significant modifications with little time available.

The IRD in New Zealand is one such government department that is currently in the midst of undergoing a major IT infrastructure and software overhaul. These changes are all part of their transformation program and mean interfacing with the IRD through IT channels is going to be completely different than ever before.

Tandem NZ was approached by Your Payroll to build a Payroll system that would integrate fully with the new IRD systems being put in place and provide its customers with an easy to use a browser-based interface to manage their payroll.

Challenge set: Work with the IRD to develop a way to manage the updates to IRD systems from Your Payroll system allowing employers to transfer their payday data in real time daily directly to the IRD as updates on the website were done. The new IRD payroll system would require a SOAP gateway to be fully developed as well as strict data encryption protocols to be put in place.

The integration work when completed would enable Your Payroll to fully automate the exchange of data between them and the IRD across over 120 different payroll scenarios. It would also open up other IRD services such as GST filing and tax refunds as well to them in the future.

Tandem NZ worked with the IRD team directly to develop the gateway requirements and security encryption needed. All communications with the IRD needed to be fully encrypted using TLS Mutual authentication (or two way SSL as it is sometimes called).  This form of encryption and data transfer is one of the most trusted systems available with both ends needing to authenticate both certificates at either end. Once authenticated the next level of security begins using authorisation tokens. This means that the complexity of the security is high and requires specialist knowledge to implement.

Once the connection with the IRD was established and tested with over 120 scenarios all complying and passing rigorous testing the system was then integrated back into our customer portal to create a seamless experience for the end user to manage their complete payroll quickly and easily.

The entire system was built on Microsoft technology using the latest .Net framework with ASP.NET MVC, SOAP web-service, C#, TLS 1.2, SHA-256 (as hashing algorithm), AES (as encryption mechanism)  and TLS mutual Authentication”.

Ever wondered what goes into integrating your systems with a government department. Below we outline some of the key technologies we employed to connect directly into the new Inland Revenue Department (IRD) systems in New Zealand.

The following outlines the various technologies employed to successfully connect with the IRD Digital Transformation system. Tandem NZ is well versed on what is required and how to implement a successful connection between any system and the IRD system.

PayDay Reporting Implementation

This document is intended to provide the technical details required to consume the IR gateway services such as Identity and Access/Authentication and Authorisation services, Employment services, and Return services offered by Inland Revenue Department(IRD).

Inland Revenue offers a set of external facing web services that facilitate secure and efficient business interactions between itself and its customers/service providers. IRD gateway services will allows its customers to submit and retrieve payroll obligation data electronically through this gateway.

Inland Revenue implemented the following suite of gateway services,

Identity and Access Services

Consumer Services

Identity and Access Services

Inland Revenue established a new set of Identity and Access Services that will provide its customers with authentication and authorization mechanisms for accessing IR’s new Gateway services.

End-User Authentication Mechanism

The OAuth 2.0, industry-standard protocol, the process is used to authenticate end-users using their IR user ID and password and grant 3rd party software consent to access their information.

Inland Revenue imposes its customers/service providers to implement and use OAuth 2.0 mechanism in the client application the end-user will be using.

End-User Authorisation Mechanism

IRD generates its own Authorization Token once the end-user is authenticated successfully to identify the service requested IR customers and determines whether the privileges should be granted to the requested customer to access a specific resource in IR system.

Secure Communication

The connection between the Inland Revenue and its customers is always secured strongly. The protocol set used for a secure layer is SSL/TLS, this will create an encrypted link between IR and its customers so that any interaction that takes place between these two parties will always be encrypted and secured.

The protocol used by IR to establish secured layer connection is TLS 2.0.

Following are the Mechanisms, Technologies, Protocols, and Standards used in SSL/TLS Communication,

Encryption Mechanism

RSA, 256-bit encryption is a data/file encryption technique that uses a 256-bit key to encrypt and decrypt data or files, is an algorithm used in IR SSL/TLS communication to encrypt and decrypt messages.

It is an Asymmetric Cryptographic Algorithm. Asymmetric means that there are two different keys. This is also called public key cryptography because one of them(public key) can be given to everyone/IR customers. The other key(private key) must be kept private with IR.

SSH Keys

IRD consumes the benefits facilitated by SSH keys. SSH, Secure Shell, is a cryptographic network protocol for operating network services securely over an unsecured network.

This mechanism is used in SFTP(Secure FTP) file transfers to identify the organisations sending/receiving files.

SSH keys need to be exchanged to authenticate both parties(IR and its customers).

Public Key Infrastructure(PKI)

IR Public Key Infrastructure (PKI) supports the distribution and identification of public encryption keys, enabling IR users and computers to both securely exchange data over networks such as the Internet and verify the identity of the other party.

PKI facilitates the secure electronic transfer of information for a range of network activities between IR and its customers.

Digital Certificate: X.509

IR uses X.509 digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the specific user, computer or service identity contained within the certificate.

An X.509 certificate contains information about the identity to which a certificate is issued and the identity that issued the certificate.

Consumer Services :

Inland Revenue has a set of services including ES(Employment Activities services) and EI(Return Filing services) that allows customers to submit and retrieve payroll obligation data electronically through the IR provided gateway services.

Technologies Used in Implementation of PayDay Reporting Application:

The Frameworks and Technologies that are used in the payday reporting application implementation as follows,

The latest version of Microsoft .NET Framework Platform

ASP .NET MVC Framework with MVVM Pattern Enabled

C# .NET, Microsoft highly recommended .NET Supported Language

SQL Server, Database

Bootstrap, CSS3, JQuery

UMBRACO, Content Management Services(CMS)

Mandrill, Email Services