Critical Infrastructure Security , Next-Generation Technologies & Secure Development

NPCI Calls Reports of Blockchain Project Completion 'Premature'

No Timeline Yet for Release of System, Which Remains in Development
NPCI Calls Reports of Blockchain Project Completion 'Premature'

The National Payments Corp. of India is labeling as "premature" news reports that it's launching a blockchain-based system called "Vajra" to secure online payments. NPCI says the system remains in development with no timeline for release.

See Also: Deception Technology: Making the Case

Dr. N. Rajendran, NPCI's chief technology officer, tells Information Security Media Group: "The product is not ready, and the aforesaid 'Vajra' is a mission under which NPCI is planning several innovations. Any digital innovation will take several years, and we are not yet ready with the blockchain-based solution to secure online payments as there are several technological challenges."

NPCI has not created a timeline for rolling out the product because it's in the nascent stage and the organization is still experimenting with how it will work, he adds. Meanwhile, NPCI has removed from its website all information related to the project.

A Work in Progress

Last April, NPCI announced it was considering using blockchain technology to make digital payments more robust and planned to develop a resilient, real-time and highly scalable blockchain solution, using an open-source technology or framework or solution.

That project remains a work in progress, Rajendran stresses.

"It's a huge task and has to be tested on various platforms and needs to be integrated with various technologies and may take a few years also for all the payments organizations and banks to be able to use. It's premature to talk about it."

In a separate effort called "Bankchain," a consortium of 30 banks established last year is working on developing proof-of-concept application to run a pilot program called Trade Chain.

That project presents technological challenges as well, says Sharat Chandra, president of the Government Blockchain Association.

Distributed ledger technology, such as blockchain, holds great potential to support highly secure tamper-evident transactions that can be stored in a distributed, immutable database and is versatile enough to be adapted to various cases, Chandra says.

The challenge for security practitioners, he says, is to understand the security and privacy of nodes involved and how to integrate them with the banking infrastructure. Those nodes include clearinghouse node, or NPCI; participant nodes, including banks' ASP/PPI/PSP; and UIDAI (notary) node.

"NPCI and the banks are facing the real-time challenge of bringing about interoperability between the legacy system and blockchain protocols," Chandra notes.

Prasanna Lohar, head of IT and digital innovations at DCB Bank, says blockchain eventually could play an important role in the fight against fraud.

"Blockchain helps in the traceability of a financial transaction if needed," he says. "This will automatically reduce banking fraud. Under the current system, when money is transferred between banks and payment gateways there are multiple servers involved, which [leads to the possibility of a] man-in-the-middle kind of attack. With blockchain, this problem will be solved. There will be a single source of data to store events, ownership and activities, and there will be no use of separate systems and databases. This will have less manual intervention and less fraud."

Ongoing Experiments

The financial industry has been attempting to experiment with blockchain by replicating existing asset transactions on the blockchain, which creates challenges, says Vishal Anand Kanvaty, NPCI's senior vice president, innovation and product in a blog post.

"In infrastructure terms, the blockchain is open-source software that is built to support the transfer of digital assets amongst market participants in real-time," he says. "Using any preferred blockchain's APIs, one can showcase a dramatic reduction in asset transfer costs and timelines. Most bank implementations are focused on this aspect. But while scaling proof of concept into a real-world scenario, financial institutions end up implementing the same application layer that exists currently with all the current checks and balances."

India's largest bank, State Bank of India rolled out a beta version of blockchain-enabled smart cards two years ago, and sources say that the cards are being enabled for "know your customer" application.

In another initative, ICICI Bank is the first bank in the country to exchange and authenticate remittance transaction messages as well as original international trade documents related to purchase orders, invoices, shipping and insurance, among others, on a blockchain in real time.

ICICI Bank executed these pilot transactions via its blockchain network with Emirates NBD on a custom-made blockchain application, co-created with EdgeVerve Systems, a subsidiary of Infosys.

IBM's blockchain leader for India and South Asia, Jitan Chandanani, tells First Post that blockchain technology has piqued the interest of many banks in India.

For example, 11 of India's largest banks - HDFC Bank, ICICI Bank, Yes Bank, Axis Bank, Kotak Mahindra Bank, Standard Chartered Bank, RBL Bank and South Indian Bank - have launched blockchain-linked loan system for small and medium enterprises. State Bank of India, Bank of Baroda and IndusInd Bank are also involved in this consortium as outside members. In the first phase of this network, the banks set up a live system for supply-chain vendors across India to register themselves and digitally record all their transactions.

Securing Transactions

Although some banks have been leveraging the distributed ledger technology for business innovations, NPCI is attempting to develop a payment platform to secure online transactions and prevent fraud through blockchain, which raises new challenges.

Any blockchain platform would use cryptography for data security, and only authorized parties would be allowed to join the network, Chandra explains. Validating nodes would gain access to the proposed platform only after passing security authentication, for example, through the validation of a registered digital signature.

A blockchain payment platform would be accessed by multiple payment entities for performing transactions via web interfaces, Chandra says. The bank nodes would receive requests from APIs and process them on the payment platform. The system would have self-executing contracts containing business rules. After successful processing of the claims, the on-chain data - hashes of the transactions - would be added to the ledger. Each participant node in the network would maintains a ledger of their own. An on-chain database would be used to store information that is not published on the platform (transaction data that doesn't uniquely define the transaction). This data will be accessible only to the node.

NPCI's Kanvaty, says distributed ledger technology is fundamentally an open network designed for peer to peer, censor-free interaction. The peer can be an enterprise or an individual. A technology that is built for network enablement requires participants to think about the entire ecosystem and the value chain, he notes.


About the Author

Geetha Nandikotkur

Geetha Nandikotkur

Managing Editor, Asia & the Middle East, ISMG

Nandikotkur is an award-winning journalist with over 20 years' experience in newspapers, audio-visual media, magazines and research. She has an understanding of technology and business journalism, and has moderated several roundtables and conferences, in addition to leading mentoring programs for the IT community. Prior to joining ISMG, Nandikotkur worked for 9.9 Media as a Group Editor for CIO & Leader, IT Next and CSO Forum.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.in, you agree to our use of cookies.