Introdução da certificação digital na rede electrónica do governo

Abstract

Security in a computer network is related to the need to protect information and equipment against reading, writing or any type of unauthorized manipulation. With the use of the Internet in a corporate environment and the opening to the outside world, the concern and risk of intrusion into corporate systems increase. To guarantee the security of a computer network, it is necessary to apply several security mechanisms, such as: authentication, access control, intrusion detection systems, antivirus, firewall, information encryption and use of digital certificates. Public key cryptography effectively solves the problem of confidentiality of the information transmitted, but it does not meet the requirements of integrity, authenticity and leaves uncertainties about the acquisition, recognition, validity and distribution of the keys used (GOLDANI, 2000). As a way to remedy these inconveniences, a security structure was created, called Public Key Infrastructure (PKI), based on the use of digital certificates. The digital certificate is a document that contains the personal identity data and the public key of its holder, thus guaranteeing its correspondence. This work proposes a PKI model for the Government Electronic Network (GovNet) in order to enable the issuance, management and use of digital certificates in order to guarantee the confidentiality, authenticity, integrity and non-repudiation of the information issued. The proposed PKI model for GovNet consists of three entities: Managing Authority - whose function is to define, evaluate and approve policies and standards within the PKI; Certification Authority - whose function is to issue, distribute, revoke, renew and manage digital certificates and the Registration Authority - which acts as the PKI interface with the user and is responsible for identifying, registering PKI users and forwarding them to the Certification Authority registries for issuing certificates. To ensure PKI interoperability across different platforms and international acceptability, in addition to not binding to proprietary solutions, GovNet's PKI implementation must be based on standards and protocols used internationally and that make communication consistent. The introduction of digital certification on GovNet will be an important security mechanism for the provision of authentication and evidence generation services, in addition to guaranteeing the confidentiality, integrity and legal validity of electronic documents