GePG - Launch of Government of India’s ePayment system
The Electronic Payments juggernaut has started rolling and now Government of India has jumped into it.
A close look, at the growth of ePayments in India shows that the Government of India, was a major contributor in the growth of ePayments.
Taking one more step forward, Finance Minister Pranab Mukherjee, inaugurated Government of India’s ePayment system on 31/10/2011
The fully secured ePayment system, has been developed by Controller General of Accounts (CGA) of the Finance Ministry.
The ePayment system, will enable direct credit of dues into the accounts of beneficiaries, electronically, and eliminate the need for transactions through cheques.
The Government Electronic Payment Gateway (GePG), interacts with the Banks CBS for enabling the payments.
The GePG can be scaled up, depending on the volumes.
The best part of GePG is that it can not only be used by the PAOs(Pay and Accounts Office’s) under the CGA’s(Controller General of Accounts) umbrella, but also other sister organizations in railways, defence, posts and telecommunication and yes, by the state governments too.
All inter-government advices for transfer to States can also be routed through this gateway mechanism.
The GePG will most probably use the NEFT (National Electronic Funds Transfer) mode for credit to the ultimate beneficiary though new channels might be added in future.
However, as the Post Office Saving Banks accounts are not yet on the CBS or NEFT/RTGS channels, not sure how the Post Office Saving Bank accounts will be credited.
The majority of Co-operative Banks are also still not on the RTGS/NEFT platform, and a new approach is required to bring them under the ambit of ePayments.
GePG was soft launched in June 2011,
http://cga.nic.in/pdf/Revised_Operating_Procedure_of_e_Payment.pdf and the outer target to roll-out to the GePG in all pay and accounts offices of civil ministries is 31/03/2012.
The necessary Hardware,Software and the Digital Signature in all the PAO’s have to be in place by 01/01/2012.
This will enable that sufficient time is there for training and testing of GePG before the final roll-out by 31/01/2012 in 74 PAO’s.
Government of India Secretary(Expenditure), will be reviewing the progress on a regular basis.
As GePG is bank neutral, the PAO’s need not shift their banking accounts. The respective banks have to integrate the GePG with their CBS in their own interest, otherwise the PAO’s may be forced to look around for alternatives.
The GePG has been developed by CGA in close co-ordination with NIC and Banks.
Cheers to all the participants in making GePG live.
.
While this is an applaudable step and in the right direction, I wonder if there are discrepancies in the published Operating Procedure.
ReplyDeletei. Refer to point#6 on page#5. It states “…..and the public key will be made available for download…..” Is NIC CA generating the key-pair at its end and then downloading into the token? Isn’t that violating the CCA guidelines that requires the Public/Private Key Pairs for all the Class-II certificates to be generated inside the FIPS compliant hardware devices that are under the control of the respective users?
ii. Refer to point# 7 on page#5. It states “…..he will have to initialize the USB I-Key 2032 Token and download the public key from the site into the token…..” Is it the public key that is downloaded onto the token or actually registered with NIC site and corresponding Digital Signing Certificate is downloaded on to the token? But then if the NIC CA is fundamentally following the procedure of generating the Public/Private Key-pair at its end then downloading the same into the token afterwards then it in itself is a security breach in contradiction to CCA guidelines.
iii. Point#8 on page#6 states “…..the NIC-CA will provide the private key (of the key pair) for download within 1 working day….” I am obviously appalled at this procedure as this puts the very Root of Trust for individual’s Digital Identity at risk. The Private Key must never be exposed outside the secure confines of a FIPS compliant hardware token.
iv. I don’t see any step within the Operating Procedure for initializing the i-Key 2032 token that requires the user to change the token PIN. So, how will the PIN for one user be different from that of another user? And if all the i-Key2032 tokens have the same PIN then isn’t one user’s Digital Identity accessible to any other user who has the access to this i-Key2032 token?
Rana