By Rajeev Deshpande & Mahendra Singh , TNN | 14 Oct, 2015, 10.38AM IST
At the central data centre, the encryption processes are repeated while
storing the details, making attempts to access and use the data very
difficult.
NEW DELHI: The Aadhaar system's data collection and storage is
strongly protected by sophisticated encryption processes to ensure biometric data
does not leak either through private contractors running enrollment centres or
at the central data servers that store the details.
The unique identity authority of
India's processes are intended to allay fears that biometric data collected by
private contractors might be vulnerable to falling in unauthorised hands as the
biometric detail is encrypted using the highest available public key
cryptography encryption.
Even if the data is stolen or lost
the encryption prevents access to the biometrics as it will require the most
powerful computers literally eons to crack the code. Similarly at the central
data centre, the encryption processes are repeated while storing the details,
making attempts to access and use the data very difficult.
The government hopes that the lack
of human interface in storing the data and procedures such as data collectors
being required to authenticate every entry though their own biometric verification
will help convince the Supreme Court that privacy concerns have been addressed by the
UIDAI.
The UIDAI programme's success is
indicated by lack of any credible complaints or proof of misuse of data since
it started the ambitious scheme almost five year ago. This is partly due to the
processes that make even loss of a recording machine or copying on a flash
drive a futile exercise.
The data are being collected on
software--Enrollment Client (EC) Software--written, maintained and provided by
the UIDAI and is encrypted to prevent leaks at the enrollment centres managed
by private vendors and in transit. The private agencies on ground use the EC
Software which ensures that only authentic and approved person can sign-in for
the purpose of enrolling people.
The enrollment client software used
by private vendors strongly encrypts individual electronic files containing
demographic and biometric details (enrollment data packets) of residents at the
time of enrollment and even before the data is saved in any hard disk.
The encryption uses highest
available public key cryptography encryption (PKI-2048 and AES-256) with each
data record having a built-in mechanism to detect any tampering.
The e-data packages are always
stored on disk in PKI encrypted form and is never decrypted or modified during
transit making it completely inaccessible to any system or person.
Source:The Economic Times
