UIDAI’s Latest Steps To Solve Aadhaar Related Security Concern

The Unique Identification Authority of India (UIDAI) stated in a circular that it has classified AUAs (and KUAs, wherever it’s applicable) into two categories namely Global AUAs and Local AUAs.

This is being done to ensure the security of Aadhaar numbers. The circular also clarified that Virtual ID and UID Token can be used instead of Aadhaar number in most cases as they are aliases of the 12-digit unique identity number.

Only Global AUAs will have access to full e-KYC along with Aadhaar numbers whereas Local AUAs will have access to Limited e-KYC and will not be permitted to store Aadhaar numbers.

Categorizing of AUAs Leads to Enhanced Security of Aadhaar Numbers

As of now, residents are required to share their Aadhaar number in order to authenticate their identity so as to avail various services.

With the implementation of VID or Virtual ID, an Aadhaar holder need not share their Aadhaar number at the time of authentication of identity while availing a service.

The provision of one’s VID instead of their Aadhaar number prevents the collection of Aadhaar numbers by various agencies which result in heightened security, according to the UIDAI.

The Authority also said that it will re-evaluate the list of Global and Local AUAs from time-to-time in order to ensure the security of the Aadhaar numbers.

The Two Types of Authentication User Agencies (AUAs)

An AUA or Authentication User Agency is a requesting entity that submits Aadhaar number and either demographic or biometric information of an individual to the Central Identities Data Repository (CIDR) for authentication.

The CIDR confirms whether the information submitted by the AUA is true or false without giving out any information related to the person’s identity.

There are certain AUAs like banking institutions, financial institutions, etc, that are bound by specific laws to authenticate their customers with the help of their Aadhaar numbers.

However, some AUAs do not have the required security system in place to ensure safe usage and storage of Aadhaar numbers.

This is why the AUAs are categorized into Global and Local AUAs.

Top Features of Global AUAs

• Global AUAs are the entities that are required to authenticate customers using Aadhaar number
• These AUAs are allowed to store Aadhaar numbers in their database provided it is done only through data vaults
• Have the provision to accept Aadhaar numbers as well as VID and UID Token
• They have the ability to determine which applications don’t require the Aadhaar number and are required to only use VID with UID Token in such cases

Top Features of Local AUAs

• Local AUAs are not permitted to verify a client using Aadhaar number but are only allowed to use VID for OTP based authentication
• They are permitted to use Aadhaar number for biometric authentication
• They are not allowed to store Aadhaar numbers in their databases

What Changes Must AUAs Incorporate to Retain Their Authentication Services?

In order to enhance the security of the Aadhaar number and incorporate the necessary changes in the system, Virtual ID, UID Token, and Limited e-KYC will be used. According to the UIDAI, all AUAs are required to make the following changes in their authentication systems and switch to the new system by July 1, 2018.

• All AUAs/KUAs must ensure that Aadhaar numbers or VIDs should not be stored while sending authentication or e-KYC requests to the CIDR.
• All Local AUAs/KUAs shall capture the UID Token and Global AUAs shall capture the Aadhaar number or UID Token as sent by the UIDAI in response to the authentication/e-KYC request in their database.
• All Local AUAs/KUAs must make sure to replace Aadhaar numbers with UID Tokens and delete all Aadhaar number from their database by August 31, 2018. This also includes transaction logs.
• All KUAs need to ensure that their application, as well as backend system, are designed in a manner that if there’s a requirement in the future to restrict some of the demographic fields as part of the Limited e-KYC response, the change must be incorporated without any changes in their system.

Failing to comply with these new norms by July 1st would result in the suspension of authentication services and the imposition of monetary fines.

The UIDAI had mentioned that it would share updated API/technical documents, guidelines, and conduct workshops or training sessions for the AUAs and KUAs to make sure that the process of implementation can take place in a smooth and timely manner.

Accordingly, the new APIs —Authentication API 2.5 and OTP Request API 2.5— can be found on the UIDAI Authentication Portal.

All the AUAs/KUAs need to submit a compliance report to the UIDAI as soon as they update their systems the new APIs.

List of Global & Local AUAs as on May 16, 2018

The UIDAI so far has classified 141 Global AUAs and 23 Local AUAs. The AUAs that have been already been classified into the two categories are mentioned at the end of this article.

In order for the other AUAs to be classified as Global AUAs or Local AUAs, they are required to submit a form containing certain information to the UIDAI through the form attached below.

After evaluating the information submitted these AUAs will be categorized. The information required to be submitted is:

• Name of the AUA
• Date of appointment as AUA
• Date of appointment as KUA
• Purpose of using the authentication service
• Purpose of using e-KYC service
• Modality-wise authentication transaction details
• Modality-wise e-KYC transaction details; and
• A copy of the specific laws or regulations that require the AUA to authenticate their customers with Aadhaar number

List of Global AUAs (as on May 16, 2018)

Global AUAs consist of Scheduled Commercial Banks, Payment Banks, Regional Rural Banks, Co-operative Banks, Small Finance Banks, Insurance Companies (only Life Insurance), Retail Payments and Settlement Systems.

i) Scheduled Commercial Banks – Regulated by RBI

ii) Payment Banks – Regulated by RBI

iii) Regional Rural Banks – Regulated by RBI

iv) Co-operative Banks – Regulated by RBI

v) Small Finance Banks – Regulated by RBI

vi) Insurance Companies (only Life Insurance) – Regulated by IRDA

vii) Retail Payments and Settlement System

List of Local AUAs (as on May 16, 2018)

Local AUAs consist of Telecom Operators, Financial Corporations that are controlled by the National Housing Bank, Pre-paid Payment Instruments, Certifying Authority, Digital Locker Providers, e-Sign Providers, Insurance Companies (Non-Life Insurance), and Non-Banking Financial Companies.

i) Telecom Operators

ii) Regulated by National Housing Bank

iii) Pre-paid Payment Instruments (PPI) – Regulated by RBI

iv) Certifying Authority, Digital Locker Providers, e-Sign Providers – Regulated by CCA

v) Insurance Companies (Non-Life Insurance) – Regulated by IRDA

vi) Non-Banking Financial Companies – Regulated by RBI