gov.br security: a dissertation evaluates additional authentication factors for Brazil's digital identity
Sandro Leite Furtado defended at UnB’s Applied Computing graduate program a dissertation identifying and evaluating additional security factors for the gov.br identity, implementing and testing Risk-Based Authentication (RBA) as a complementary layer.
Brasília, February 18, 2025
The gov.br identity is the doorway to dozens of Brazilian digital public services — and, for the same reason, the favored target of malicious agents willing to convert access into financial harm. The dissertation defended in February 2025 by Sandro Leite Furtado at UnB’s PPCA proposes raising the security of that doorway with additional authentication factors, under the advising of Prof. Dr. George Marsicano Corrêa .
The work combines a systematic literature review with a case study applied to the gov.br identity. Five promising factors emerge from the review: RBA (Risk-Based Authentication), Tripwire, login rituals, OTP, and OTP with Bluetooth. Among them, RBA was implemented and evaluated in a real context. Results showed concrete capability to detect atypical behaviors and block suspicious attempts — especially in access-location divergence situations, a classic pattern of compromised accounts.
The defense took place on February 18, 2025 in Brasília. The examining committee was chaired by the advisor, Prof. Dr. George Marsicano Corrêa (CIC/UnB), and composed of Prof. Dr. John Lenon Cardoso Gardenghi (FCTE/UnB) and Prof. Dr. Milton Vinicius Morais de Lima (CISSA/CESAR). Prof. Dr. Edna Dias Canedo, PPCA program coordinator, also attended the session.
By pairing cybersecurity with digital transformation of the Brazilian State, the dissertation offers a concrete basis for architectural decisions that directly affect millions of citizens — precisely where the security research community must carry its work to generate impact.
The dissertation agenda also appears in the paper Identification and Applicability of Additional Security Factors on the GOV.BR Digital Identity Platform, presented at the 19th CONTECSI. The paper consolidates the discussion on additional authentication factors applicable to Brazil’s digital identity.
The full text — written in Portuguese — is available at the UnB Institutional Repository.
About CEDIS: The Center for Studies, Development, and Innovation in Software (CEDIS), linked to the University of Brasília, researches and develops innovative software solutions.