Twin of Things is a solution for securing the ownership and provenance of everyday objects by using blockchain technology in combination with crypto NFC tags and an Android App.
The Twin of Things App is a user-friendly solution that makes blockchain technology comprehensible to non-experts. It works in the following way.
RIDDLE&CODE uses its patented technology to produce chips in a form of adhesive non-removable inlay NFC tags that users/customers can stick to objects of their choice. After manufacturing the chip, it gets further equipped with public keys and metadata. Public keys, metadata and signatures are then turned into blockchain certificates. The ready chip is sent to the customer.
The Android app is used for three purposes:
- Provisioning the tags
- Creating blockchain transactions (attestation), and
- Validation of the data embedded into tags and blockchain transactions
By using elliptic curve PKI, NFC tags, that act as microcomputers with autonomous public key generating function, once attached to the object, embed all the trust and security of blockchain into their transporter. In simple terms, that means that the object with the RIDDLE&CODE crypto chip attached to it has a unique, tamper-proof identity which allows it to securely and autonomously interact with the blockchain and with other connected devices on the blockchain platform.
We implement an extended system for our tags. In addition to the existing functionality we need the capability to combine the multikey related transaction with metadata.
These metadata will also come from the Android App. During the validation process these metadata will be processed and displayed using the app.
What are the metadata we are talking about:
- A brand name for the tagged object: input field Android App
- A product name for the tagged object: input field Android App
- Timestamp: date field auto-generated Android App
- A name / ID for the Owner / User: input field Android App
- A serial ID of the product: input field Android App
- Material of product: multiline or comma separated list field Android App
- Colour of the product: multiline or comma separated list field Android App
- Comments for the tagged object. Limited to 255 characters: input field Android App
- If possible there is also an image for the product available
- An application ID: and invisible text field Android App. Defining app for internal use
Mifare Desfire EV1 Tags
Mifare Desfire EV1 tags are used. They are based on AES and RSA instead of ECC.As the tags will be already equipped with a public key they will also be already attested within the blockchain by multi-signature transactions written to a public ledger. This means that the second multi-signature transaction, including the new metadata, has to be created. As the Mifare Desfire EV1 is not creating on-demand signatures, a signature for every tag has to be pre-produced. Therefore a special provisioning hardware and software was developed.
It works a follows:
- For every tag a randomised challenge gets calculated
- ECC secret key gets created using a program on the provisioning hardware
- The secret key gets AES encrypted and written to the tag's EEPROM. It is never readable to the outside world.
The encryption enables storage of all information on the tag. Only a valid RIDDLE&CODE reader built as an Android App can read and interpret it. Android App stores specific crypto key that is used for encryption and decryption. For that the app utilizes either bouncy castle or secure hardware module within the android phones.