Requirements and Challenges

Progress in the development of e-Government extranets remains slow due to the following challenges:

• High development cost

E-Government extranets that offer basic government services require sufficient funding to expand. Typically, these networks are constructed with limited funds and often duplicate development and investments made in other e-Government extranets. Because funds are limited, departments that provide basic services need integrated multi-functional devices that deliver network access services at low cost.



• Difficult access from remote sites

Remote sites provide unique challenges: Network infrastructures in remote sites are weak and optical fiber may be difficult to install due to terrain, cost, or other considerations. Remote sites can, however, access the e-Government extranet through Internet or wireless networks. Personnel who travel to rural towns and remote sites also need access to e-Government extranets to perform service processing, which highlights the need for Internet or 3G network access to e-Government extranets.



• High security risks

To perform basic government services, the e-Government extranet must allow access to large numbers of new users, which brings considerable security risks to social security and other basic services. Outdated network security devices, difficult routine maintenance and monitoring, and lack of professional network security personnel, make the e-Government extranet especially prone to network attacks, with potential huge impacts on the information security of these services.



• Lack of professional network operation, maintenance, and management personnel

Low-level government administrations are limited in the number of professional network operation, maintenance, and management personnel available to support routine operations from sophisticated devices and to restore services when network faults occur. Basic government entities need a solution that features easy and automated operations to lower the technical requirements on network operation and maintenance personnel.

Solution Description

Figure 1:Secure Access Solution architecture

To help develop and deploy basic government services to remote areas, the Secure Access Solution from Huawei offers the following features:

Low investment costs

Governments can deploy the multi-service secure gateway Secospace USG series products to enable access to the network and to deliver basic services. This product integrates multiple functions, such as the router, switch, firewall, VPN, IPS, antivirus, DDoS protection, URL filtering, and access control. Compared with typical device-stacking solutions, the Secure Access Solution from Huawei can lower device procurement and development costs by 50% and reduce the number of failure points, ensuring that citizens and network support personnel both benefit from high-quality service delivery.

Multiple access

The solution enables low-level government entities in different regions with different networks in various stages of development to access the e-Government extranet, which ensures complete coverage. The solution also deploys VPN gateways in upper-level e-Government extranet egresses to enable departments to use Internet VPNs to access the e-Government extranet. Regions that support 3G wireless access enable users in remote areas that cannot accommodate network cabling to easily access the e-Government extranet.

Secure connection with the e-Government backbone network

As a public network that delivers services for all government departments, the e-Government extranet requires high network security. Huawei's secure access solution uses the Secospace USG series products to isolate services of different departments from each other. The solution uses the Virtual Customer Environment (VCE) function to enable the mapping and secure interconnection between Internet VPNs and e-Government extranet backbone network MPLS VPNs.

Government departments can access the e-Government extranet in IPSec VPN mode, and employees that work in mobile office mode can access the e-Government extranet in SSL VPN mode. The SM1 cryptographic algorithm is used to encrypt service data, ensure service security, and enable seamless integration with MPLS VPNs.

Terminal security authentication

Huawei provides secure network access control mechanisms, enabling the system to perform strict authentication and security checks before allowing access to the extranet. These mechanisms also enforce user authorization policies. By leveraging proven access control mechanisms, the Secure Access Solution ensures the security of the e-Government extranet.

Unified security management and control

Huawei's secure access solution uses a unified security management and control platform to perform live network device management, which enables operation and management support staff to easily locate and rectify faults when the extranet is not running properly. The unified security management and control platform is comprised of multiple advanced modules, such as security device management, security event collection, event association analysis, status monitoring, and report generation.

Figure 2:iSOC unified security management platform

Solution Highlights

The solution has the following highlights:

• Incorporates AR G3 routers that support multiple network access modes and backup links to facilitate network connection and reliability.
• Supports National extranet certificate, confirming the legal identity of websites before access.
• Uses VPN devices that support SM1 cryptographic algorithm, ensuring service data security.
• Employs IPSec VPN and SSL VPN encryption technologies to ensure secure access to government departments and mobile office terminals.
• Provides internal control components such as unified security management and control, and security event association analysis (incident warning, and incident audit units).

Customer Benefits

The Secure Access Solution from Huawei provides the following customer benefits:

• Convenient user role and rights management
• Automatic connection with the e-Government backbone network for access to other government administrations or ministries
• SM1 cryptographic algorithm for enhanced service and data security
• Easy maintenance, which lowers technical support requirements on network maintenance personnel and associated costs