Wei Lian, Director of Certification Management Division of Government Extranet of National Information Center
The 14th Five Year Plan for National Economic and Social Development and the Vision 2035 put forward that it is necessary to build a digital government, strengthen the opening and sharing of public data, promote the co construction and sharing of government informatization, and improve the efficiency of digital government services. The construction and operation of digital government needs to build a trust system with credible identity, data and behavior. Commercial password is the key core technology to ensure the confidentiality and authenticity of information, data integrity, and non repudiation of behavior. It is the cornerstone of establishing and transferring network trust and maintaining the order of cyberspace. The newly revised Regulation on the Administration of Commercial Passwords (hereinafter referred to as the Regulation) further clarifies the access requirements and business rules of e-government electronic authentication services, actively promotes mutual trust and recognition of electronic authentication services, and will strongly promote the construction of digital government trust system.
1、 Digital government is inseparable from the establishment and transmission of digital trust
Building and delivering trust is a fundamental key link to maintain cyberspace order and ensure the prosperity of the digital economy and social stability. Building an online trust system, continuously optimizing online trust technologies and services, and actively strengthening the formulation, implementation and supervision of relevant policies are important parts of the process of building a digital government and a strong support for the security and smoothness of the digital economy.
On the one hand, the construction of digital government needs to build a manageable digital trust system. Digital trust is a new trust relationship among government, individuals, enterprises and society in the Internet era, and an efficient reconstruction of the traditional social trust model. Digital government is the strategic support to promote the modernization of national governance system and governance capability. The key to building a digital government is to optimize the governance system and strengthen governance capability by using digital technology. Building a digital trust system, establishing and transferring credible digital identities, and promoting mutual trust and recognition within the government and with enterprises, citizens, and society will ensure the credibility of identity, data, and behavior in the process of digital government governance, ensure data security, and promote the facilitation of government services, digital social governance, and scientific management and decision-making, Finally, the application efficiency of "compliance, safety, convenience, ease of use and service" will be achieved.
On the other hand, the digital trust system of mutual trust and mutual recognition will provide core support and security cornerstone for digital government business collaboration and government data circulation. The digital trust system can effectively promote the orderly sharing, opening, circulation and utilization of government data, enhance the credibility of the government, improve administrative efficiency and service level, help to realize the collaborative management and service of digital government across levels, regions, systems, departments and businesses, and promote the integration of government data and social data resources, Improve the social value and economic value of data elements, and effectively exert the efficiency of data production factors. The data element circulation rules built on the basis of digital trust can effectively support the embodiment of the rights and interests of the relevant subjects of data elements, the clarification of the transaction conditions of data element circulation, and the guarantee of network trust capabilities such as digital identity, electronic signature, privacy protection, responsibility identification, so as to provide a healthy and reliable development environment for "data resource confirmation, opening, circulation, and transaction".
2、 E-government e-authentication is the core of building digital government trust system
Cryptography is the safest, most effective, most economical and most reliable means to solve the problems such as the authenticity of various network subjects' identities, the credibility of network behaviors, the integrity and confidentiality of network data information under the digital condition, and it is also the basis of electronic authentication services.
The national e-government extranet network trust system takes the electronic authentication service as the core, and provides security services such as identity authentication, access authorization and responsibility identification for e-government extranets and various government applications at all levels, providing support and guarantee for cross departmental and cross regional business collaboration. Since 2006, an e-government e-certification service system covering the whole country has been formed, and a registration service agency has been established in 19 central departments and 29 provincial e-government extranet management and use units. It is providing e-certification services for more than 500 important business applications of government departments at the central, provincial, municipal and county levels, and the issuance of annual certificates has continued to grow rapidly.
In recent years, the National E-government Extranet Management Center has actively improved its service level and explored new service models to find ways and means to support the construction of digital government trust system. First, to expand the application of digital certificates in mobile terminals, it has made application docking in four typical application scenarios, including government office and talent employment, The mobile digital certificate provides security services such as identity authentication and electronic signature for the application system, and effectively supports the rapid development of "Internet+government services". Second, in order to further standardize the management of electronic authentication mutual recognition and mutual trust, the "National Public Resources Transaction CA Mutual Recognition Phase I" will be completed in 2019, and the docking work with pilot provinces such as Guizhou, Hainan, Hubei, Yunnan, Guangdong, Jiangxi will be completed. The mutual recognition of certificates, signatures and seals on the pilot trading platform will be realized, and market entities can conduct cross regional transactions, It is the first time to realize mutual trust and mutual recognition in technology in the field of cross provincial public resource transactions, effectively solving the pain points and difficulties of cross regional transactions in the existing industry. Third, in order to further promote the compliance and orderly circulation of government data, in 2021, the national e-government extranet built the data authorization, circulation and trust service infrastructure (DTS) based on commercial passwords and centered on electronic authentication service capabilities, and carried out pilot operations in the field of employment and talent recruitment in Hainan and Fujian. Comprehensive use of trusted identity authentication, reliable electronic signature, controllable privacy protection technology, whole process traceability certificate preservation and other security measures and services, under the joint authorization of data management institutions and data related individuals, the compliance authorization flow of social security information and other public data resources to social applications has been realized, It has better solved the credit problems involved in the process of verifying the identity and resume of applicants, and also provided solutions to the problems such as the difficulty of opening government data, the difficulty of people's participation in data circulation, and the difficulty of using enterprise organization data. In the future, we will actively carry out pilot projects in financial credit reporting, public resource trading, dual carbon economy and other fields to protect the healthy development of the digital economy.
3、 The revision and implementation of the Regulations will further promote the standardized development of e-government electronic authentication services and digital trust systems
In accordance with the Password Law of the People's Republic of China and the Law of the People's Republic of China on Electronic Signatures, the Regulations further clarify the requirements, norms and rules for the use of passwords in electronic authentication services, the construction of electronic authentication trust systems, the requirements and procedures for the qualification application of e-government electronic authentication services, and the requirements for foreign investment, Electronic authentication services in government affairs activities will strongly promote the ability of electronic authentication service institutions, the application of electronic authentication services, and the construction of national digital trust system.
The Regulations require that the provision of electronic authentication services should have places, equipment and facilities, professionals, professional capabilities and management systems appropriate to the use of passwords, and obtain the certification documents issued by the national password management department to approve the use of passwords according to law, which clearly defines the access conditions for electronic authentication services to use passwords, It puts forward comprehensive requirements for the professionalism and standardization of electronic certification bodies. On the one hand, e-government e-certification service institutions should actively enhance their professional technical capabilities, carry out technology integration innovation and certification application innovation; On the other hand, we should optimize the authentication workflow, implement personal information protection and data security measures, strictly abide by the technical specifications and rules of e-government electronic authentication services, and improve the management ability of authentication work in the new situation.
The Regulations specify that e-government electronic authentication service institutions shall provide e-government electronic authentication services within the approved scope in accordance with laws, regulations and technical specifications and rules of e-government electronic authentication services; The password management department, together with relevant departments, is responsible for the management of electronic signatures and data messages used in government affairs activities. Therefore, in the process of providing authentication services, service agencies need to strictly abide by the rules and specifications of e-government electronic authentication business formulated by the national password management department, standardize products, technical requirements and service processes, and carry out the electronic authentication service support of electronic official documents, electronic seals, and electronic licenses in government affairs activities in accordance with laws and regulations. The Regulations implement the requirements of the Password Law of the People's Republic of China on the security assessment of password applications, and provide strong support for comprehensively promoting the wide application of commercial passwords in the field of government affairs.
The Regulations specify that the country will establish a unified electronic trust mechanism to promote mutual recognition and trust in electronic authentication services, which provides a clear direction for further promoting the depth and breadth of digital certificate applications. In recent years, the national e-government extranet has actively promoted the application of digital certificates, and promoted the use of digital certificates based on commercial passwords in government information systems, which has achieved remarkable results. The release of the Regulations will further promote the comprehensive application of digital certificates in the field of government affairs, give play to the core value of cryptography technology, improve the security guarantee of "Internet+government services", effectively promote the development of government services for the convenience of people and enterprises, and promote business collaboration with cryptography technology.
Under the leadership of relevant national competent departments, the National E-government Extranet Management Center will thoroughly implement the relevant provisions of the newly revised Regulations, coordinate the promotion of commercial password applications, promote the construction of the national E-government extranet trust system and password security infrastructure, and continue to strengthen personal certificates, institutional certificates Equipment certificates and other certificates are applied and innovated in the field of e-government, promoting the application of digital certificates in the scenarios of government cloud, government big data and integrated government service platform, promoting the efficient sharing and circulation of government data, and effectively ensuring the security of national government data.
Related links: