Central Board of Indirect Taxes and Customs

International Message Exchange

1. Introduction
CBIC has a plan for international data exchange with various countries e.g. Russia, Nepal,
Korea, BENELUX (Belgium, Netherlands and Luxembourg) etc.

This document provides the process flow of data exchange with Russia and other
countries as proposed by application team (ICEGATE) and Infrastructure required for
carrying out the Data Exchange.

There are two ways in which the data exchange is expected to happen - either through
SFTP or through API. However, in both the case the security controls will as be below:

2. Security controls

 Separate IME (International Message Exchange) zone will be created and SFTP and
Endpoint API server will be placed in this zone.
 IME zone will be placed behind IPS and Firewall
 Sandboxing will be enabled to scan the International messages
 Antivirus will be installed on all servers and real time scanning will be enabled to
scan data
 Restricted access will be given on the servers and auditing will be enabled
 Read only access will be given on SFTP servers to Russia Custom
 Logs will be forwarded to SIEM solution, which will be monitored 24*7 by SoC
team
Both the methods of the data exchange are described below:

3. Data Exchange through SFTP

Site-to-Site IPsec VPN Tunnels will be used to allow the secure transmission of data
between Russia Customs and CBIC. The VPN tunnel will be created over the Internet
public network and encrypted using a number of advanced encryption algorithms to
provide confidentiality of the data transmitted between the two countries. This
communication channel will be followed with all other countries who will exchange data
through SFTP.

a. Connectivity for Data exchange between Russia Customs and India customs will be
established through site-to-site VPN tunnel.
b. Russian Customs shall share data of the exports from Russia to India, in the agreed XML
format. Each file shall contain 130 fields. Files shall be shared on the SFTP path

Internal
 Central Board of Indirect Taxes and Customs

c. Russia Customs will be allowed to upload xml files only with max size of 10kb (to be
verified by application team)
d. Sandboxing will be performed before passing data to application.
e. All data fields from validated files shall be first inserted in a Unicode supported database
and further passed on to ICES database for processing through an internal SFTP channel
f. First level of validations pertaining to field level checks and compliances shall be done by
ICEGATE. Corresponding error codes and acknowledgement files shall be accordingly
generated and intimated to Russian Customs
g. This data shall be further consumed by RMCC application to conduct business level
validation checks with the documents filed by Indian EXIM
h. RMCC application shall process only those records that contain a Unique Consignment
Reference (UCR) number
i. Same process flow will be followed for exports to Russia from India

It was proposed that separate infrastructure – servers and chassis will be provisioned for
data exchange of this nature. The proposed flow for the requisite data exchange between
India and Russia is depicted in the diagram below.

Figure-1

Internal
 Central Board of Indirect Taxes and Customs

Figure 2

Internal
 Central Board of Indirect Taxes and Customs

Figure-3

Internal
 Central Board of Indirect Taxes and Customs

4. Data Exchange through API

a. Nepal, Korea, BENELUX (Belgium, Netherlands and Luxembourg) etc. shall share export
data with India Customs, in the agreed XML format.
b. International countries will send messages in the xml format to ICEGATE. Data exchange
will be done through API’s.
c. Sandboxing will be done before sending data to ICEGATE.
d. ICEGATE will consume API’s exposed by the respective countries to pull the data in xml
format from the identified application server. API gateway will not be used during this
communication.
e. First level of validations pertaining to field level checks and compliances shall be done by
ICEGATE. Corresponding error codes and acknowledgement messages shall be
accordingly generated and intimated to international countries.
f. All data fields from validated files shall be first inserted in a respective application
database.
g. This data shall be further consumed by RMCC application to conduct business level
validation checks.

CBIC will consume International countries API’s for exchanging data with them. Request for
data exchange will be land on their endpoint API’s.

Figure 4

Internal
 Central Board of Indirect Taxes and Customs

Other countries will land on CBIC API gateway for getting message data from CBIC.
International message exchange will happen as per the diagram given in Figure 5.

Figure 5

Internal
 Central Board of Indirect Taxes and Customs

Figure-6

5. Following table provides mandatory requirements towards enabling data exchange with
CBIC:

S.No Parameter Modality for SFTP Modality for API

1 Connectivity  Message exchange with International  Message exchange with various

Partner’s Customs who does not support, countries e.g. Nepal, Korea,

Internal
 Central Board of Indirect Taxes and Customs
S.No Parameter Modality for SFTP
API will be done through SFTP. SFTP
Server deployed for message exchange
with these countries shall maintain two
separate designated directories
(Inbound & Outbound), File will be
downloaded from the International
Partner’s server to CBIC’s Inbound
Folder and International Partners will
download their respective file from
CBIC’s Outbound Folder. Outbound
Folder permission to International
Partners would be restricted to Read-
Only. No access permission would be
granted to International Partner for
Inbound folder.
 These servers shall be isolated from the
servers hosting production applications
 No direct connectivity to CBIC’s
production servers shall be allowed
 Servers for International message
exchange shall be placed in an isolated
network i.e. IME zone from the existing
production systems
2 Network  Isolation/Segregation of network for
Connectivity each International Partners and the
transmission of the data shall be carried
out in specific agreed time windows for
different entities depending on the data
volume.
 Whenever there is a data transfer
between an external entity and CBIC’s
server, the communication to CBICs
production systems shall be restricted
 The communication should be over
secure ftp protocol
 The traffic for the international entities
shall be strictly isolated from domestic
traffic from an Availability and
Confidentiality
Internal
Modality for API
BENELUX (Belgium, Netherlands
and Luxembourg) etc. will be done
through Endpoint API’s.
 These servers shall be isolated from
the servers hosting production
applications
 No direct connectivity to CBIC’s
production servers shall be allowed
Servers for International message
exchange shall be placed in an
isolated network i.e. IME zone from
the existing production systems
 Isolation/Segregation of network
for each of the International
Partners and the transmission of
the data shall be carried out in
specific agreed time windows for
different entities depending on the
data volume.
 Whenever there is a data transfer
between an external entity and
CBIC’s server, the communication
to CBICs production systems shall
be restricted
 The communication should be over
endpoint API’s.
 The traffic for the international
entities shall be strictly isolated
 Central Board of Indirect Taxes and Customs

S.No Parameter Modality for SFTP Modality for API

from domestic traffic from an

Availability and Confidentiality

3 Network Port Only specified ports shall be opened for Only specified ports shall be opened
for incoming communication for communication
data

4 Authenticatio a. Digital signature based authentication Authentication mechanism for using

n using Class III digital certificates from a API’s to pull xml will be provided by
mutually agreed Certifying Authority respective countries
approved by the Governments of India
and the International agency.

b. Digital Certificate must be kept under

secured manner e.g. inside HSM

c. The passwords used for authentication

shall be hashed or encrypted while at
rest.

5 Encryption ISAKMP (Internet Security Association and Communication through API’s will be
Key Management Protocol); AES encrypted through SSL
(Minimum 256 Bits); AS2; SHA2 for Digital
Signatures.

6 File type XML formats XML formats

7 File Backup For integrity check, the backup of XML file the backup of XML file will be
must be maintained. maintained

8 Max File Size  Only one file shall be accepted for each  Only one file shall be accepted for
transaction. One transaction shall each transaction. One transaction
comprise one transmission complete shall comprise one transmission
with its header and footer; a file may complete with its header and
contain single or multiple footer; a file may contain single or
entries/records multiple entries/records

 The maximum permissible size of such  The maximum permissible size of

file shall be 10KB. Files exceeding this such file shall be 10KB. Files
limit would be rejected with error code exceeding this limit would be
rejected with error code

9 Hash a. Hashing shall be implemented to Not Applicable

Function check integrity of the files being
exchanged - SHA –2 Hashing
algorithm through SFTP
b. Endpoint API connectivity will be
done through two way SSL.

Internal
 Central Board of Indirect Taxes and Customs
S.No Parameter Modality for SFTP
10 Perfect Forward secrecy is used so that an
Forward encrypted communications and sessions
Secrecy (PFS) recorded in the past cannot be retrieved and
decrypted should long-term secret keys or
passwords be compromised in the future,
even if the adversary actively interfered.
Diffie-Hellman Group 5 has to be used.
11 Non- An agency connecting to CBIC’s IT Systems
Disclosure will execute a mutually agreed agreement
and or for non-disclosure and/or acceptable use of
Acceptable CBIC’s data, including its storage and
Use archival.
Agreement
12 Audit Logs  In the event of an incident, it may be
necessary for system logs to be shared
by both the parties
 Both the parties shall agree on a
universally accepted format for
maintenance of such logs and their
duration without compromising their
evidentiary value
 In audit Logs IP (source &
destination), Destination port, Time
stamp must be recorded
 The system clock shall be synched to a
common time source so that its
timestamp will match those generated
by other systems
 A globally acceptable forensics
investigator / auditor, mutually
agreeable to both parties may be
allowed to examine the logs in the
event of any incident.
13 Other Tools that do not support logging or
establishing forensic trails (including but
not limited to Winscp) shall not be used by
either party.
Internal
Modality for API
NA
An agency connecting to CBIC’s IT
Systems will execute a mutually
agreed agreement for non-disclosure
and/or acceptable use of CBIC’s data,
including its storage and archival.
 In the event of an incident, it may
be necessary for system logs to be
shared by both the parties
 Both the parties shall agree on a
universally accepted format for
maintenance of such logs and
their duration without
compromising their evidentiary
value
 In audit Logs IP (source &
destination), Destination port,
Time stamp must be recorded
 The system clock shall be synched
to a common time source so that
its timestamp will match those
generated by other systems
 An acceptable forensics
investigator / auditor, mutually
agreeable to both parties may be
allowed to examine the logs in the
event of any incident.
Tools that do not support logging or
establishing forensic trails (including
but not limited to Winscp) shall not be
used by either party.