Under the patronage of H.E. Said bin Hamdoon Al Harthy, Undersecretary of the Ministry of Transport and Communications for Ports and Maritime Affairs and ITA Board Member, the Information Technology Authority (ITA) launched the National Digital Certification Center at the Crown Plaza Hotel, Muscat, yesterday. First of its kind at the Middle East, The launch comes as the second phase to the actual project operation which is the authorized eSignature via smart phones in which signing certificates are issued to corporates and individuals.
The ceremony has started with a welcoming speech followed by ITA’s speech delivered by Mr. Yaqoob bin Dur Mohammed Al Bulushi, Deputy CEO for infrastructure and eServices. Mr. Al Bulushi stressed on the importance of this project in term of easing up all eServices for businesses, government and individuals to have them more secured, trusted and integrated.
The guest of honor was invited on stage to launch the center followed by a video clip featuring three main features of the PKI which are authentication, confidentiality and data integrity. ITA and Nawras signed an agreement to incorporate and integrate the PKI technology via smart phones and same goes with Omantel to be announced soon.
The PKI comes to offer solutions to various challenges faced in providing services over the internet, some of these challenges are:
– Service providers were not able to identify and authenticate online users without face to face verification.
– Service providers were not able to provide 24/7 service availability to carry on business process without allocating additional human resources.
– Online users were not able to sign documents without physical existence at service providers’ locations.
Therefore, with PKI, the online services providers are empowered to overtake the above challenges utilizing the different types of digital certificates with authentication, confidentiality, integrity and non-repudiation features.
Public key infrastructure (PKI) is a system of policies, procedures, people, hardware, software and services that support the use of public key cryptography to obtain secure communication. PKI technology is used to maintain a more secure environment. It provides an increased level of confidence for exchanging information over an increasingly insecure Internet. PKI typically involves usage of digital certificates (also known as public key certificates) which are generated securely by ITA as the trusted Root Certificate Authority (RCA) in Oman PKI Center. A digital certificate provides an electronic means of proving identity in order to securely conduct business online.
Digital certificates empower you to:
– Identify yourself in electronic transactions when utilizing online services.
– Digitally sign information to provide assurance to the recipient that it has not been changed in transit.
– Encrypt information so that only the intended recipient can read it.
– Protect information through encryption so your organization safe guards confidential data that may be shared over unsecure networks.
– Authenticate users connecting to your business.
– Validate the integrity of information by using a hash function. This allows the sender/receiver of a message to have confidence that the data has not been tampered with.
– Non-repudiation, through digital signatures allows users to virtually sign documents eliminating the need for paper based documents.
PKI in Oman:
In Oman, Information Technology Authority (ITA) by National Digital Certification Center’s PKI is the legal trusted authority known as Root Certificate Authority (RCA) provides PKI services to enable users of the Internet to securely and privately exchange data and money through the use of public and private cryptographic key pairs which obtained and shared by ITA. PKI leverage Data protection as it is compliant with local and international e-transaction laws and regulations.
The digital certificates that National Digital Certification Center’s PKI is able to issue are as following:
– Authentication and Signing Certificates used to protect online services and transactions against identity fraud. Such certificates are automatically imbedded in the eID Card by integration with ROP. They are also provided in PKI enabled SIM cards supplied by Omantel and Nawras and can also be provided in secured tokens or smart cards supplies by ITA.
– Encryption certificates which use strong encryption mechanism (public and private keys).
– VPN and SSL certificates for devices.
Additionally, ITA provides the following services:
– SSO services (Single Sign On) through Electronic Identity Gateway (IDP)
– Open Certificate Status Protocol (OCSP)
– Certification revocation list (CRL)
PKI has already been implemented in eOman portal and the Ministry of Commerce and Industry (MOCI) by integration with the Electronic Identity Gateway that performs the authentication and signature services. Citizens and Residents will be authenticated in eOman portal and MOCI online services by using their eID cards or PKI enabled SIM cards provided by Omantel and Nawras.
Some other government entities currently work to integrate their services with Electronic Identity Gateway to get advantage to use eID Card for authentication, signing and SSO services. As well as a number of commercial entities will soon deliver some of their services using the Mobile PKI such as Bank of Dhofar.
The launching ceremony concluded with two workshops on the basic infrastructure of the public keys and the eAuthentication of mobile phones.