Rick Brouzes

1
Securing Electronic Transactions in Government
And Beyond

• Rick Brouzes
• Director
• Technology and Security Strategies
• Public Works and Government Services Canada

2
Public Key Infrastructure The Basics

• a security infrastructure comprising a
  combination of policies, procedures and
  technologies
• based on the use of public key cryptography and
  digital certificates
• Provides service to ensure the confidentiality
  and security of electronic transactions

3
PKI Provides

• Authentication
• to confirm the identity of participants in an
  electronic transaction
• Data Confidentiality
• to safeguard the privacy of information
• Data Integrity
• to ensure that data has not been modified
• Support for Non-repudiation
• to help ensure that transactions cannot credibly
  be denied and are auditable over time

4
Why PKI?

• Provides common infrastructure for authentication
  services
• Manages large volumes of user identities
• Permits differing levels of authentication for
  different service offerings
• Maintains data integrity and confidentiality of
  personal information
• Provides evidence for non-repudiation
• Provides secure e-signatures (a.k.a. digital
  signatures)

5
(No Transcript)
6
GoC PKI Milestones

• 1996 Electronic Authorization and
  Authentication Policy a digital signature must
  be used for electronic transactions
• 1999 GoC PKI Management Policy
• 2000 Protection of Personal Information and
  Electronic Documents Act, provides for the use of
  electronic alternatives for government
  communications or transactions and the
  recognition of secure electronic signatures
• 2000 Secure Channel development begins
• 2004 Government PKI Policy requirement
  preferred means of electronically authenticating
  the identity of individuals and of documents.

7
PKI Flexibility

• Adaptable to different policy, legal and
  procedural environments
• Certificate Policy captures the different aspects
  that will dictate the operations of the CA
• Multiple certificate policies in the GoC
• GoC identity-based
• GOL pseudo-anonymous
• Departmental CAs
• DND, RCMP, CSE, Industry Canada, Public Works,
  Foreign Affairs Canada, Canada Revenue Agency(2),
  Transport Canada, Statistics Canada
• Deployed the GOL CA that offers epass

8
Some Examples of Federal Departments PKI Usage

• Departmental uses
• Central Financial Management Reporting System
  (CFMRS)
• Secure Remote Access for GoC Employees
• General Secure Messaging
• External users
• Canada Education Savings Grants
• Spectrum Auction
• Export-Import Control Systems

9
Authentication Services Strategy (epass)

• Single PKI authentication service is optimal for
  conducting business with government
• More user-friendly and manageable
• Supports a range of functional and security needs
• Extensible, scalable and interoperable
• Simple, efficient registration process
• Economic and strategic
• On-line credentials must be secure and portable
• Browser is the clients preferred on-line tool
• Privacy principles are rigorously observed
• Started with CRA Address Change On-line, other
  programs to follow

10
Client Controls epass
11
Epass in the Federal Government

• epass-enabled GoC Services
• CRA Address Change On-line
• HRSD/SDC Record of Employment
• CRTC filings (applications)
• Census 2004 dress rehearsal (SEAL)
• Coming Soon
• Atlantic Canada Opportunities Agency
• Passport Office
• PWGSC My Services

12
Next Steps

• epass will be expanded to multiple programs over
  the next 12 months under Common Registration
  Services (CRS)
• Initial capability to be used by
• Veterans Affairs medical records system
• HCs Pesticide Management Regulatory Agency
  submissions service
• HRDC and CRA to migrate to CRS , including CRA
  expanding use of MyAccount
• Exploring models for shared authentication of
  businesses to support a business-centric view of
  government services

13
GoC PKI and the Provinces

• Proof of concept with Gouvernement du Québec
  using epass for on-line service delivery
• Other provincial initiatives
• Ontario
• Nova Scotia
• British Columbia

14
GoC PKI and the Rest of the World

• Cross-certification with USA
• Delegations from Australia, New Zealand, Japan
  this year visits to find out more about
  Canadas PKI implementation

15
Canada Number 1 for the Fourth Year in A Row

• 2004 Accenture Report
• Canadas e-government program continues to set
  the standard for the rest of the world
• the leader across all categories of e-government
  maturity
• Canada has identified and is addressing citizens
  security and privacy concerns with the launch of
  epass, the authentication component of its Secure
  Channel initiative

16
Coming Soon

• Common Business Registration
• Third-party delegation
• Privilege Management
• GoC PKI CA provision of CA services for
• inter-jurisdictional initiatives