Everything You Need To Know About Aadhaar Data Vault
The Aadhaar project is the government of India’s national identity project. As citizens use such an identity to access various government and private service providers, the main benefit of Aadhaar is expected to be better decision making through the use of modern analytics.; this necessitates the creation of a massive database with necessary information on citizens, such as id to biometric mapping. As a result, such a store should be thoroughly created and analyzed.
Challenges with Aadhaar:
However, there are significant concerns associated with maintaining a massive database of all citizens’ biometric data. A large centralized database is a problem in and of itself, because a breach would result in the data of a significant number of citizens being leaked. This information can be exploited for a variety of harmful objectives, including identity theft, financial fraud, and individual tracking. Due to privacy and security issues, the Aadhaar project has been and continues to be heavily discussed.
Due to sensitivity of the Aadhar number and the potential consequences of having one’s Aadhar number compromised, UIDAI issued a notification in July 2018 mandating that all Aadhar and Aadhar-related data be encrypted and stored separately in a secure, access-controlled data repository known as the Aadhar Data Vault. Aadhar numbers should not be stored in any business database where they are used for any purpose. Aadhar data consists of Aadhar numbers and related data collected by the AUA/KUAs/Sub-AUAs or any other agencies such as banks, telecommunications, government departments, the Income Tax Department, the private sector, and so on for specific purposes under the Aadhaar Act and Regulations, 2016.
What is Adhaar Data Vault?
Aadhaar Data Vault is a secure encrypted centralized storage for all Aadhaar numbers collected for specific purposes under the Aadhaar Act by AUAs/KUAs/Sub-AUAs/or any other agency.
Who requires an Aadhaar Data Vault?
In order to regulate the storage of Aadhaar numbers in databases, the UIDAI divided AUAs (and KUAs, when it’s applicable) into two categories: Global AUAs and Local AUAs.
All banks were classified as global AUAs, including commercial banks, payment banks, regional banks, rural banks, cooperative banks, and small finance banks, as well as life insurance firms and India’s National Payments Corporation. PPIs, NBFCs, telcos and non-life insurance companies were among those classified as local AUAs.
All agencies with an Aadhaar Number, whether they are global AUAs/KUAs/Sub-AUAs, are required to use an Aadhaar Data Vault. However, these agencies could be organizations that have Aadhaar Numbers for internal identification purposes, such as the attendance management system or linking with the PF Account, and so on. Agencies that have stored Aadhaar Numbers in structured and electronic form, such as a database, must have an Aadhaar Data Vault.
What is the purpose of an Aadhaar data vault?
According to the UIDAI, the purpose of the Aadhaar data vault is to minimize the footprint of Aadhaar numbers within an organization’s systems and environment, lowering the risk of unauthorized access. According to the UIDAI circular, all Aadhaar-related data must be encrypted with a Reference Key and stored in the Aadhaar Data Vault. As a result, an Aadhaar Data Vault should be the only place where Aadhaar-related data can be stored. The Aadhaar Data Vault will be accessible only to internal systems, and all businesses will be required to use Reference Keys for all transactions.
What exactly are reference keys?
Each Aadhaar number will be referred to by an additional key called the Reference Key in order to minimize the footprint of Aadhaar numbers in the ecosystem. In the organization’s ecosystem, these keys will replace Aadhaar numbers, and a mapping of reference key and Aadhaar number will be kept in the Aadhaar Data Vault.
Read more: How do you keep your Data Safe and Secure?
When establishing an Aadhaar Data Vault, there are a few things to keep in mind
- Many solutions on the market keep the encryption keys in the software itself. This is a dangerous idea from a security compliance standpoint. All encryption keys, not just the root of the Master Key, should be kept in intrusion-resistant HSM devices.
- To achieve the maximum level of data security and protection, these HSM devices should be FIPS-140 Level 3 certified.
- Automatic key rotation with no downtime should be set up using pre-defined schedules.
- IP whitelisting on the HSM devices, rather than the software, should be used for secure key management.
Benefits of Aadhaar Data Vault:
- Through middleware, keep track of your activities.
- Providing the desired output while enforcing appropriate access controls
- Accommodation of centralized modifications in Aadhaar-based transactions without requiring alternate application updates
- Compliant with UIDAI’s requirements.
- Information is only available on a need-to-know basis.
- Supports UIDAI / NPCI APIs and integrates them within specified timeframes. Scope for changes/enhancement
About Us:
JISASoftech is a software development firm specializing in authentication, public key infrastructure (PKI), and cryptography. We provide a variety of PKI and cryptography solutions to assist their customers’ essential business operations. Encryption, Aadhaar Data Vault, authentication Solutions, hardware security modules, Tokenization, and advanced Know Your Customer (KYC) solutions for preventing fraud in financial transactions are among the many products and solutions available.
To know more about our Aadhaar Data Vault solution contact us:
Website: www.jisasoftech.com
Email: sales@jisasoftech.com
Phone: +91-9619222553
