Aadhaar security enhanced with Virtual ID

NEWDELHI: The Unique Identification Authority of India (UIDAI) said on Saturday that its Virtual identification (VID) system is now operational with telecom operators and e-sign providers.

The randomised 16-digit VID can be produced by any user, and map it with his or her biometrics, and provide access to limited demographic data such as name, address and gender. A user can generate any number of VIDS, but only one will be active at one time. VIDS help increase user Aadhaar privacy as agencies cannot collect actual Aadhaar numbers. The VID cannot be traced back to the Aadhaar number.

Agencies have been given a grace period until 31 August to migrate to VID and UID Token, said UIDAI. “We are requesting with these agencies to fully migrate to production environment by the stipulated date,” Ajay Bhushan Pandey, chief executive of UIDAI said in a statement. It said it will impose disincentives or terminate licenses for non-complying agencies.

It would levy a fee per transaction for agencies that have not migrated to the updated communication protocols, dubbed API 2.5 and E-KYC API 2.5, after 30 June.

However, it said the fee, which is ~0.20 per transaction, will be waived off if agencies migrate completely to VID by 31 July.

The initial deadline set for these agencies was 31 May, which UIDAI extended by a month as the agencies were still preparing for the shift.

UIDAI categorised telecom operators and e-sign providers among other agencies as ‘local’ Authentication Agencies (AUAS) in January. Local AUAS can use only the VID for authentication, while global AUAS can ask for the actual 12-digit Aadhaar number and access full demographic data of the user. Banks fall into this category.

UIDAI also said it was in the process of reviewing classification of Global and Local AUAS based on the security and risk assessment of the authentication process of the AUAS. Pending this review, AUAS which were not classified earlier are now being provisionally classified.

Pandey said that UIDAI proposes to introduce other forms of data verification in the ‘near future’, and the same may be provided to AUAS for identity verification in lieu of global or local.

AGENCIES HAVE BEEN GIVEN A GRACE PERIOD UNTIL 31 AUGUST TO MIGRATE TO VID AND UID TOKEN, SAID UIDAI