Indian Authorities Take Tokenization Approach to Aadhaar Authentication with Virtual ID System

“The move comes in the wake of reports suggesting that the Aadhaar database has been compromised repeatedly via unauthorized access, due to security loopholes that allow for relatively easy administrative access to the system’s back end.”

The Unique Identification Authority of India has announced a new Virtual ID system that will allow users to authenticate their Aadhaar credentials without the need to share their actual Aadhaar numbers.

The system operates in a process similar to the kind of tokenization security used by Visa and Mastercard, which replaces users’ payment information with encrypted codes that are useless to hackers. For authentication with Aadhaar, India’s national biometric ID system, Virtual ID will generate a temporary credential that allows third party access to information like the subject’s name and address, and that credential can expire and be replaced for the next authentication session.

The move comes in the wake of reports suggesting that the Aadhaar database has been compromised repeatedly via unauthorized access, due to security loopholes that allow for relatively easy administrative access to the system’s back end. The Virtual ID system doesn’t appear to offer address that issue specifically, but could help to reassure citizens about the security of their Aadhaar data nevertheless.

Of course, there will be situations in which a Virtual ID is not sufficient for third parties’ needs: An agency seeking to eliminate duplicate accounts, for example, would need actual Aadhaar ID numbers to do so. But for many other applications, such as tracking Amazon packages, Virtual IDs should provide a quick and easy means of user authentication.

The UIDAI plans to launch the Virtual ID program on March 1st, and authorized electronic KYC agencies will be required to support Virtual IDs starting June 1st.

Sources: NDTV, The Economic Times

–

January 10, 2018 – by Alex Perala