Танилцуулга / e-ID Mongolia

e-ID Mongolia integration

PayGrid identity / signing хариуцахгүй. Бүгд e-ID Mongolia v2-аас X-Road-аар хийгдэнэ. Estonia банкууд Smart-ID-аар ашигладаг pattern-аар verbatim — Монгол банкууд e-ID Mongolia-аар ашиглана. PayGrid зөвхөн routing + clearing-аар оролцоно.

1. Зарчим

PayGrid does NOT proxy user authentication. When User pays from Bank1 account: User authenticates to Bank1 via e-ID Mongolia — that call is Bank1 ↔ e-ID Mongolia DIRECTLY. PayGrid is not involved in the user-side SCA. PayGrid only sees the resulting pacs.008 from Bank1 with attestation embedded.

2. Хэн e-ID Mongolia-руу хандах вэ

3. PayGrid-ийн X-Road client setup

Client subsystem ID

MN/COM/<paygrid-reg-no>/PAYGRID-CLIENT

   "MN"               = X-Road instance (Mongolia)
   "COM"              = Member class (commercial)
   "<paygrid-reg-no>" = Mongolian business reg of PayGrid LLC
   "PAYGRID-CLIENT"   = Subsystem code

Registration:
   Apply at cs.gerege.mn (X-Road central server)
   Submit X-Road member application + cert request
   Wait for approval (~1-2 weeks)
   Receive Information System TLS certificate
   Configure X-Road security server

X-Road security server

ss.paygrid.mn:
   ─ Listen on internal network only
   ─ Connect to cs.gerege.mn for GlobalConf sync
   ─ mTLS to rp.gerege.mn
   ─ WireGuard / VPN tunnel
   ─ Audit log every X-Road call

Information System TLS Certificate:
   Issued by: X-Road Mongolia central CA
   Subject:   CN=paygrid-bff,O=PayGrid LLC,C=MN
   Pin:       cert SHA-256 in DB

Renewal: Annual (X-Road managed)

4. e-ID Mongolia endpoints PayGrid ашигладаг

PayGrid ашигладаг нь зөвхөн sign-svc:

POST /r1/MN/COM/<eidmongol-member>/eid-rp/sign/initiate
   Body: { national_id, document_hash, document_metadata, callback_uri }

GET /r1/MN/COM/<eidmongol-member>/eid-rp/sign/{session_id}
   Long-poll up to 120s.

PayGrid ашигладаггүй: auth-svc (хэрэглэгчийн authentication PayGrid-аар хэрэгцээгүй).

5. PayGrid-ийн signing use cases

5.1 Daily settlement instruction-ыг Mongolbank-руу sign

EOD batch-аар paygrid-clearing settlement instruction barina. PayGrid operator (designated authorized signer) e-ID Mongolia-аар sign хийнэ. Signed instruction Switch-руу submit. Audit log-д cert chain + TSA token хадгалагдана.

5.2 Regulator audit export-ыг sign

Regulator request-ээр paygrid-audit-export report барина. Authorized signer e-ID Mongolia-аар sign. Signed report regulator-руу (FIU, Mongolbank) илгээгдэнэ. Энэ нь legal evidence of integrity өгдөг.

5.3 Critical alert / incident report sign

Sanctions hit, fraud incident-аар auto-generated report. Operator PIN2-аар e-ID Mongolia signing хийнэ. Mongolian FIU-руу submit (24ц SAR window).

6. PayGrid does NOT do (with e-ID Mongolia)

• PayGrid does NOT proxy user authentication.
• PayGrid does NOT verify PSD2 SCA itself. Bank attests SCA was performed via signed pacs.008. PayGrid trusts bank's attestation (mTLS-authenticated + JWS-signed).
• PayGrid does NOT issue identities or certificates. e-ID Mongolia-ын exclusive role.
• PayGrid does NOT store user PII. Maximum: alias + IBAN + KYC level metadata. Real identity stays at PSP.

7. Яагаад тусгаарласан вэ

1. Liability clarity: User authentication failure → bank's responsibility. Routing failure → PayGrid's responsibility. Identity issuance → e-ID Mongolia's responsibility.
2. Regulatory clarity: PayGrid is a payment systems operator. e-ID Mongolia is a trust services provider (eIDAS-equivalent). Different regulators, different audits.
3. Scalability: PayGrid throughput nor bound by e-ID capacity. e-ID capacity not bound by PayGrid volume.
4. Security defense in depth: Compromise of one doesn't compromise the other.

8. PSP attestation in pacs.008

Bank1 PayGrid-руу pacs.008 явуулахдаа SCA хийгдсэнийг attestation-аар оруулна:

<Document xmlns="urn:iso:std:iso:20022:tech:xsd:pacs.008.001.10">
  <FIToFICstmrCdtTrf>
    <GrpHdr>...</GrpHdr>
    <CdtTrfTxInf>
      ...
      <SplmtryData>
        <PlcAndNm>PayGridSCAAttestation</PlcAndNm>
        <Envlp>
          <PayGridAttestation>
            <SCAMethod>EID_MONGOLIA_PIN2</SCAMethod>
            <SCATimestamp>2026-05-06T14:23:00Z</SCATimestamp>
            <EIDSessionId>sid-abc123</EIDSessionId>
            <CertSerialNumber>PNOMN-АА00000000</CertSerialNumber>
            <DynamicLinkingHash>SHA-512:...</DynamicLinkingHash>
            <BankAttestationJWS>eyJ...</BankAttestationJWS>
          </PayGridAttestation>
        </Envlp>
      </SplmtryData>
    </CdtTrfTxInf>
  </FIToFICstmrCdtTrf>
</Document>

PayGrid BankAttestationJWS-ыг bank-аар pinned signing key-ээр шалгаж pass болсныг batla.

9. SCA sequence — verbatim flow

1. Wallet → PayGrid

   POST /v1/payments/sepa-credit-transfers

2. PayGrid → Bank1 PISP

   Forward NextGenPSD2 request

3. Bank1 returns scaRedirect URL

4. User → Bank1 app

   Universal Link / App Link

5. Bank1 app → e-ID Mongolia

   X-Road sign initiate ← Bank's call, not PayGrid's

6. e-ID Mongolia push

   User-ын e-ID Mongolia app-руу APNs/FCM шифрлэгдсэн notification

7. User PIN2 + verification code

8. e-ID Mongolia threshold ECDSA-2P

   Device-side m_M + server-side m_S → signature = m_S × m_M (mod n)

9. Bank1 receives signed assertion

10. Bank1 verifies PSD2 Dynamic Linking

11. Bank1 → PayGrid (pacs.008 with attestation)

12. PayGrid clearing

    Routing + ledger entries + creditor PSP forward

13. 13–17: as in Estonia 17-step flow

    Архитектур §6 →

10. Integration testing

Test environment

e-ID Mongolia provides:
   DEMO_MODE=true:    in-process stub
   Sandbox:           ss.gerege.mn testbed (TBD when accessible)

PayGrid uses:
   DEMO_MODE for unit tests
   Sandbox for integration tests

Test cases (PLAN/13-TEST-VECTORS.md)

1. e-ID Mongolia available, sign succeeds → PayGrid forwards pacs.008 ✓
2. e-ID Mongolia available, user refuses → Bank rejects, no pacs.008 ✓
3. e-ID Mongolia timeout → Bank rejects after 120s ✓
4. e-ID Mongolia signature verify fail → Bank rejects, alert ✓
5. Replay attack (bank submits same signed payment twice) → idempotency catches ✓

11. Verbatim references

Эх сурвалж: PLAN/09-IDENTITY-EID.md. Дараагийн хуудас: QR Switch →