Andrea Blasioli (accilium) and myself at Gaia-X’s market-x conference in Vienna
Software engineers, are you wondering what Gaia-X is? As more and more people talk about it, many of us may feel lost in the conversation without a good understanding of the big picture. Well, look no further! In this guide, we will review an engineer’s perspective on Gaia-X — from basic questions like “What exactly is it?” to exercises for grasping various technical aspects and complex features. We’ll also cover challenges that might arise when seeking best practice solutions with their respective recommendations and share tips & tricks from fellow software engineers who are already working with Gaia-X to help you get started.
Gaia-X is a European effort to improve the continent’s digital infrastructure, accessibility, and applications. It brings together businesses and organizations to promote data protection and trust, ensuring that all data flows between them are safe and secure. This initiative has become even more important since introducing the General Data Protection Regulation (GDPR) in May 2018, strengthening EU citizens’ rights over their personal data. Gaia-X will also reduce data manipulation risk by creating Europe-based marketplaces for data sets and digital services meant to standardize access protocols, further protecting user information and allowing users to understand the privacy level of each product before buying it. By doing so, it encourages key players in the European digital space to comply with strict regulations while staying competitive with global markets. In this way, Gaia-X will ensure that all European digital products remain compliant with GDPR within the framework and other data protection laws, safeguarding users’ privacy across the continent.
There are three important concepts at Gaia-X. Those concepts are federation, trust, and policies. While the Gaia-X CTO team’s and labs’ goal isn’t to run much themselves, they focus on specification, reference implementation, and labels to describe and implement these concepts. The specification describes what is meant by federation, trust, and policies. The code is open source and implements this specification, and labels are meant for service and data consumers to easily understand the level of compliance of services and data sets.
If you provide a service via an API or host data that is meant for participants to be accessible, you need to host a Gaia-X Service Catalogue, where these services and data sets are listed. There is no magic behind this Service Catalogue, Amazon, Google, Cisco, and others implementing the same concept. Data and APIs listed via a Service Catalogue can be labeled to indicate which norms, regulations, and complex compliance rules, such as GDPR, regional server location, or NISD, they adhere to. These labels get verified by Compliance Services, which makes a label’s proof accessible to all participants. Compliance Services are explained in the next paragraph. When building a Service Catalogue, there is an API to retrieve and display each data set’s label. This helps participants to decide if this data set or API can be used for their specific use case without having to consult a lawyer or desperately investigate all implications by themselves.
A Compliance Service is a specification, and there exists a NestJS implementation. The Compliance Service exposes APIs to verify a participant’s or a service offering’s self-description. A self-description could contain an address, a hosting location, or if your service is GDPR-compliant or not. The Compliance Service uses trust anchors to verify the self-description. Currently, there exist only a hand full trust anchors, such as issuers of Qualified Certificate for Electronic Signature as defined in eiDAS, Domain Validated Secure Socket Layer certificate issuers such as Mozilla’s default Certificate Authorities (CA), official issuer for Legal Entity Identifier (LEI), etc. Under the hood, it’s a public key infrastructure (PKI) with certificate chains and trusted CA, similar to issuers of TLS certificates who verify a company’s name, address, and domain.
Easy cooperation between multiple Gaia-X ecosystems is key to its success. Federation Services are a set of services for catalogue, identity, data, trust, and API federation between multiple Gaia-X-compliant ecosystems. To connect multiple Gaia-X-compliant ecosystems, a specification on top of the NIST 500–332 Cloud Federation Reference Architecture was defined. NIST 500–332 provides guidance on how to build a cloud federation that allows multiple cloud providers to work together seamlessly. The architecture describes a set of functions, interfaces, and protocols that enable interoperability between cloud providers, as well as a set of best practices for managing security, privacy, and governance across the federation. Key components of the architecture include a cloud broker, a cloud exchange, a cloud service catalogue, and a cloud service agreement framework. By following this reference architecture, organizations can create a flexible and scalable cloud federation that meets their specific needs. As an example, existing standards many of us know and use, such as OIDC/OAuth2, SAML, SPIFFEE/SPIRE can be used to federate Identity and Access Management between Gaia-X ecosystems.
Engineers face a variety of potential challenges when working with Gaia-X. Securing data and managing risk are common issues that must be addressed to achieve the full potential of a project hosted in Gaia-X ecosystems. Additionally, engineers must remember that there may be discrepancies between different versions of the same specifications, making it difficult to design components and maintain components while the specifications are still changing. Governance also needs to be taken into consideration when developing projects on Gaia-X since organizations need to agree on protocols for sharing data securely and protecting intellectual property. Lastly, since companies represented in Gaia-X vary in size, culture, and industry practices, demands may differ dramatically depending on who is involved in the project, requiring engineers to find ways to adapt their solutions, so they can satisfy everyone’s needs.
There is no doubt that the introduction of Gaia-X offers a unique opportunity for European countries to strengthen their data protection initiatives. By leveraging all the technical features — from its secure architecture, high-standard protocols, and coding standards — the platform provides a reliable service that can store and share data with speed and security. Despite all potential issues, Gaia-X could become a successful project if there’s a collaboration between different companies and engineers to ensure further specification development, implementation, and smooth platform operations. In any case, it remains to be seen whether or not it will deliver on its promise of offering even more robust data privacy measures for citizens in the EU. We’d love to hear if you think the Gaia-X initiative can take off or not in the comments below!
We at & are crafting, shipping, and running cloud-native software. I hope this blog post provided some insight, though if you’ve any questions, please let me know. :)