xxx
However, blockchain technology offers a solution to this challenge. Blockchain – in combination with technologies like Near-Field Communications (NFC) and Internet of Things (IoT) – provides an indisputable record of the truth that is uniquely capable of showing Millennial consumers that the goods they buy benefit everyone involved in their production.
From Can blockchain help legacy fashion brands win over Millennial and Gen Z consumers? | Luxury Adviser.
xxx
Customers will have access to the lifetime history of a product – including when and where it was designed, from where the raw materials were sourced and whether it has been previously owned – before they make a purchase.
xxx
By fitting garments with NFC tags and using blockchain to seamlessly record all activities related to those garments on an immutable ledger, fashion brands will be able to build a secure and permanent record of each clothing item.
From Can blockchain help legacy fashion brands win over Millennial and Gen Z consumers? | Luxury Adviser.
xxx
xxx
Some two-thirds of consumers worldwide say they would switch, avoid, or boycott brands based on their stance on controversial issues.
From The influence of Gen Z on fashion | McKinsey.
xxx
For planning purposes, then, we can assume that a few years from now all items will have EPCs
on them and anyone will be able to read those EPCs. If I see a Gucci handbag on sale in a shop,
I will be able to point my Bluetooth EPC-reading pen at it1 and read the EPC. My mobile phone
can then tell me that the handbag is Gucci product 999, serial number 888. This information is,
by itself, of little use to me. I could go onto the Gucci-lovers web site and find out that product
999 is a particular kind of handbag, but nothing more: yet I need to know more to make a
decision about whether to buy the bag or not. I may know that the tag is “valid”, but that
doesn’t tell much about the bag. For that, I need more data.
The EPC network architecture defines the infrastructure for finding that data. Organisations that
read EPCs (eg, a retail chain) will have networks of servers that collect the tag data and turn it
into meangingful information2. These servers (called “savants”) can then use this information to
query corporate databases: these databases can then query other databases. There’s an XML
schema, known as “physical markup language” (PML) that they can use to talk to each other.
If I wanted to know if the handbag is real or fake, then I need to have access to its provenance
(known by that savant network) as well as its product details. The provenance may be
distributed quite widely across the network. The retailer’s database knows which distributor the
bag came from, the distributor’s database knows which factory the bag came from and Gucci’s
1 These are already on sale.
2 They actually turn it into a pointer to meaningful information but it’s logically the same thing.
mkt.046/50/1
© Hyperion Systems Limited (2004) Page 3 of 5 (28/10/04)
RFID Product and Brand Protection
by Dave Birch
database should know all of this. I need access to this data to get the data I need to decide
whether the bad is real or fake.
All well and good, but why would the retailer, the distributor or Gucci tell me? How do they
know whether I am a retailer, one of their best customers, one of their own “brand police”, a
counterfeiter (who would love to know which tags are in which shops and so on) or a law
enforcement officer with a warrant?
The technology to solve that problem already exists: smart cards and digital signatures. A Gucci
brand policeman might have a Bluetooth pen tag reader connected to a PDA with a smart card
and a GPRS connection. They could then point the pen at a bag and fire off a query: the query
would have a digital signature attached (from the smart card) and the Gucci savant could check
that signature before processing the query. Gucci could then send a digitally-signed and
encrypted query to the distributor’s savant which would then send back a digitally-signed and
encrypted response to be passed back to the brand policeman: “no we’ve never heard of this
bag” or “we shipped this bag to retailer X on this date” or “we’ve just been queried on this bag
in Australia” or something similar.
The central security issue for brand protection is therefore the protection of (and access to) the
provenance data. It is this area that demands industry attention. The foundation of the “privacy
settlement” between government, business and the public must be open: every stakeholder must
understand how, why and when savants will be allowed to answer queries and under what
circumstances they will send a result (and who they will tell they sent the result to, for later
auditing).
Looking Forward
The purpose of this article is not to reiterate the widely-expressed concerns about security and
privacy in the EPC world, but to point out that if the world of product and brand security is to
capitalise on the worldwide deployment of EPC it will have to tackle these issues in an open way
to find a privacy settlement that works. Many of the questions that need to be answered to reach
this settlement are not much to do with technology and almost nothing to do with tags. Should
customers have the right of access to the provenance of their purchases? Should retailers have
access only to the provenance of the finished product they are selling or all of its components?
Should there be one tag or many? This last question is important. Since EPCs are not (in
themselves) secure, the future may see the use of multiple tags. One could envisage high-value
or controlled goods having both a simple EPC tag for tracing (linked to savants) and a
microprocessor tag (perhaps even one that can remember where it’s been, what the temperature
was and so forth) linked to private databases.
Finally, it is important to note that the primary purpose of EPCs is not and has never been brand
protection and they are not the “silver bullet” for brand protection that companies such as
Procter & Gamble are looking for [11]. Having said that, there is no doubt that brand protection
can be significantly enhanced by exploiting EPCs stored in RFID chips in the right way and that
organisations should begin developing their strategy for that exploitation.
While flicking through British Vogue magazine for some moisturising tips, I came across a mention of digital identity! I was surprised and delighted that (just as has happened another of my obsessions, Dungeons and Dragons) what was once the province of nerds and outsiders has become fashionable and cool. Hurrah! Vogue says that secure digital identities for luxury goods are crucial, which is great! I could not agree more. Digital identities are not only for people! I have been writing about the need for digital identities for things for many years, and not only for high fashion (a field where, oddly, I have some experience in the use of NFC applications. On mobile phones to scan designer clothes – but that’s another story).
#IDIoT
Some years ago I asked if “the blockchain” (put to one side what this might mean for a moment) might be a way to tackle the issue of “ID for the Internet of Things” (#IDIoT). I said at the the time that I had a suspicion that despite some of the nonsense going on, there might be something there. My reason for thinking that is that there is a relationship between blockchain technology and IoT technology, because we need a means to ensure that virtual representations of things in the mundane cannot be duplicated in the virtual. As I saw it, there were three ways to do this: a database, tamper-resistant hardware or some form of shared ledger (which would in practice be unlikely to be a public blockchain, but that’s not important to the discussion).
If we look at the database idea first, I explored this more than a decade ago using the example of luxury goods such as watches and asking how would you tell a fake Rolex from a real one. You might say just put a hologram in it, or a chip that can’t be forged or something. And these might be good starting points but it’s a much more complicated problem than it seems at first. For example: why would Rolex care? I can’t afford a Rolex, so if I buy one at a car boot sale or in China, Rolex isn’t losing a sale. But by wearing the fake, I’m presumably advertising the desirability of a Rolex. So surely they should be happy that people want to wear fakes? And if I did have a real Rolex, would I want to wear it in dangerous places where expensive watches get stolen in broad daylight by muggers (eg, London) or where I might just lose it?
Anyway, regardless of the reasons for it, let’s think about how to tell the real thing from the fake thing using new technology. Suppose RFID is used to implement some kinds of Electronic Product Codes (EPCs) for luxury goods. If I see a Gucci handbag on sale in a shop, I will be able to wave my mobile phone over it and read the EPC. My mobile phone can decode the number and then tell me that the handbag is Gucci product 999, serial number 888. This information is, by itself, of little use to me. I could go onto the Gucci-lovers website and find out that product 999 is a particular kind of handbag, but nothing more: I may know that the EPC label is ‘valid’, but that doesn’t tell much about the bag. For all I know, a bunch tags might have been taken off of real products and attached to fake products.
To know if something is real or not, I need more data. If I wanted to know if the handbag were real or fake, then I would need to obtain its provenance as well as its product details. The provenance might be distributed quite widely. The retailer’s database would know from which distributor the bag came; the distributor’s database would know from which factory the bag came and Gucci’s database should know all of this. I would need access to these data to get the data I would need to decide whether the bag is real or fake.
This is a critical point. The key to all of this is not the product itself but the provenance. A database of provenance (for example) is the core of a system to tell real from fake at scale.
Who should control this database, and who should have access to it, is rather complicated. Even if I could read some identifier from the product, why would the retailer, the distributor or Gucci tell me any about the provenance? How would they know whether I were a retailer, one of their best customers, one of their own ‘brand police’, a counterfeiter (who would love to know which tags are in which shops and so on) or a law enforcement officer with a warrant?
This is where the need for a digital identity comes into the picture. A Gucci brand policeman might wave their phone over a bag and fire off a query: the query would have a digital signature attached (from the SIM or SE) and the Gucci savant could check that signature before processing the query. Gucci could then send a digitally signed and encrypted query to the distributor’s savant which would then send back a digitally signed and encrypted response to be passed back to the brand policeman: ‘No we’ve never heard of this bag’ or ‘We shipped this bag to retailer X on this date’ or ‘We’ve just been queried on this bag in Australia’ or something similar.
The central security issue for brand protection is therefore the protection of (and access to) the provenance data, and this needs a digital identity infrastructure to work properly. If it adds £20 to the price of a Rolex to implement this infrastructure, so what? The kind of people who pay £5,000 for a Rolex wouldn’t hesitate to pay £5,020 for a Rolex that can prove that it is real.
A small brand premium might be rather popular with people who like brands. Imagine the horror of being the host of a dinner party when one of the guests glances at their phone and says “you know those jeans aren’t real Gucci, don’t you?”. Wouldn’t you pay £20 for the satisfaction of knowing that your snooping guest’s app is steadfastly attesting to all concerned that your Marlboro, Paracetamol and Police sunglasses are all real? Of course you would.
#Tag
For some goods, we might want to add tamper resistant hardware to the product. If the EPC is stored in a tamper-resistant chip, a tag, then it can be read using the NFC interface in my iPhone or Android device to interrogate the tag through its RFID (ie, contactless) interface.
I have long been interested in the use of low-cost RFID chips in this context. An example I looked at some years ago was the problem in Korea with the production of counterfeit whiskey. The authentic whiskey producers decided to add an RFID chip to the bottle caps. This chip was coded with a URL and an identifier. When a customer, or a shopkeeper, or a policeman, or in fact anyone else wants to check whether the whiskey is real or not, they touch the cap with their phone and the URL launches a web site that knows the provenance of the identifier and can tell you when and where it was bottled as well as some other information. When a customer opens the bottle, the tag is broken and can no longer be read. That seems to be a cost-effective solution, although it again relies on the provenance database to make it work (otherwise the counterfeiters would just find a way steal the chips).
The mass market IoT, however, amplifier that problem of permission. I have always tried to illustrate this for people in a fun way by using the case study of underwear. It’s one thing for dinner guests to scan my wine bottle to see that it is a real Romanée-Conti and another for them to scan my Rolex to check that it is indeed a first-class far-eastern knock-off, but it’s quite another for them to be able scan my underpants and determine that they date from 1983. How do we turn tags on and off? How do we grant and revoke privileges? How do we allow or deny requests for product or provenance? Once again, we must conclude that not simply digital identity but a full digital infrastructure is needed.
The third approach that I thought worth exploring was that of some form of blockchain. It seemed to me that by using the blockchain to maintain uniqueness, we might find a way to make the IoT a transactional environment. Just as you can’t copy the physical object, but you can transfer it from one owner to another, so you can’t copy a token on a shared ledger, only transfer it from one owner to another. Thus, if you can bind a token to a physical object, you can greatly reduce the cost of managing that object. Hence I was rather interested to read in that Vogue article that Luis Vuitton, Microsoft and Consensus have developed a platform called “Aura” to manage provenance to provide proof of origin and prevent counterfeits using a blockchain. The basic idea is to represent luxury goods as ERC-721 tokens on a private permissioned Quorum blockchain.
Obviously, I don’t have any details about how this will actually work, but LVMH seem to imply that at the time of purchase of one of their brands’ product, the customer can use the brand’s application to receive an “AURA certificate” containing all product information. I assume that if you sell your handbag (or whatever) to a charity shop, you can transfer the certificate to the charity shop’s application. Underlying all of this, there is the token on the blockchain moving from the retailer’s wallet, to your wallet, to the charity shop wallet.
If this works, and it’s simple and convenient for consumers, some sort of app presumably, it will generate an amazing amount of valuable data for brand owners. They will know exactly who has their stuff and how much of it they’ve got. If the app records “fails” as well, then they’ll also know who has the knock-offs too.
[Dave Birch] How would you tell a fake Rolex from a real one? I have no idea, since it’s not a position I ever expect to be in. It doesn’t really matter to me, but it clearly does matter to some people. One such group might be people buying Rolex’s on eBay. Fortunately, a German court has come to their aid by demanding that eBay tell real Rolex watches from fakes. Now, it’s clearly a problem to luxury brands that people are selling bent copies on eBay (although, frankly, if someone is flogging a Rolex for £50, you’d think the buyer would know what they are getting). The brands try to sue eBay rather than the actual seller because… actually, I don’t know why but I’m not a lawyer. Anyway a German court has agreed with the brands. Lawyers, eh? I agree with Techdirt: I don’t understand why this is a problem of the market. As they point out, you’ve been able to buy fake Rolexes on the streets of New York City, but Rolex doesn’t sue the New York City government for letting this happen. It recognizes that most people know that the Rolex you buy from a street vendor probably isn’t real and has introduced programs to designate legitimate Rolexes on eBay already — so this seems like the type of “problem” that could work itself out without making eBay liable, but apparently it’s too late for that. But I’m not sure why they care: I can’t afford a Rolex, so if I buy one at a car boot sale or in China, Rolex isn’t losing a sale. But by wearing the fake, I’m presumably advertising the desirability of a Rolex.
Technorati Tags: identity
There’s a problem in Korea with the production of counterfeit whiskey, so the legitimate whiskey producers have an application in the Korea Telecom service. When the whiskey is bottled, the caps have an RFID tag added to them. This is coded with a URL and an identifier. When a customer, or a shopkeeper, or a policeman, or in fact anyone else wants to check whether the whiskey is real or not, they touch the cap with their phone and the URL launches a web site that knows the provenance of the identifier and can tell you when and where it was bottled as well as some other information. When the customer opens the bottle, the tag is broken and can no longer be read.
Suppose RFID is used to implement Electronic Product Codes (EPCs) for luxury goods. If I see a Gucci handbag on sale in a shop, I will be able to point my Bluetooth EPC-reading pen (these already exist) at it and read the EPC, which is just a number. My mobile phone can decode the number and then tell me that the handbag is Gucci product 999, serial number 888. This information is, by itself, of little use to me. I could go onto the Gucci-lovers website and find out that product 999 is a particular kind of handbag, but nothing more: I may know that the tag is ‘valid’, but that doesn’t tell much about the bag. For that, I need more data. If I wanted to know if the handbag were real or fake, then I would need to obtain its provenance as well as its product details. The provenance might be distributed quite widely. The retailer’s database would know from which distributor the bag came; the distributor’s database would know from which factory the bag came and Gucci’s database should know all of this. I would need access to these data to get the data I would need to decide whether the bag is real or fake.
But why would the retailer, the distributor or Gucci tell me? How would they know whether I were a retailer, one of their best customers, one of their own ‘brand police’, a counterfeiter (who would love to know which tags are in which shops and so on) or a law enforcement officer with a warrant? This is where digital identity comes into the picture. A Gucci brand policeman might have a Bluetooth pen tag reader connected to a mobile. They could then point the pen at a bag and fire off a query: the query would have a digital signature attached (from the SIM) and the Gucci savant could check that signature before processing the query. Gucci could then send a digitally signed and encrypted query to the distributor’s savant which would then send back a digitally signed and encrypted response to be passed back to the brand policeman: ‘No we’ve never heard of this bag’ or ‘We shipped this bag to retailer X on this date’ or ‘We’ve just been queried on this bag in Australia’ or something similar. The central security issue for brand protection is therefore the protection of (and access to) the provenance data, and this needs a digital identity infrastructure to work properly.
If it adds £20 to the price of a Rolex to implement this infrastructure, so what? The kind of people who pay £5,000 for a Rolex wouldn’t hesitate to pay £5,020 for a Rolex that can prove that it is real. Imagine the horror of being the host of a dinner party when one of the guests glances at their phone and says “you know those jeans aren’t real Gucci, don’t you?”. Wouldn’t you pay £20 for the satisfaction of knowing that your snooping guest’s Bluetooth pen is steadfastly attesting to all concerned that your Marlboro, Paracetamol and Police sunglasses are all real.
So if you’re at a boring party and you’re wondering whether the hostesses dress is a real Chanel or a knock-off, you can find out from across the room. Or if you want to snoop around a neighbour’s house but can’t actually be bothered to go into other rooms, it’s ideal. But, as I pointed out some time ago,
Suppose RFID is used to implement Electronic Product Codes (EPCs) for luxury goods. If I see a Gucci handbag on sale in a shop, I will be able to point my Bluetooth EPC-reading pen (these already exist) at it and read the EPC, which is just a number. My mobile phone can decode the number and then tell me that the handbag is Gucci product 999, serial number 888. This information is, by itself, of little use to me
[From Digital Identity: The Rolex premium]
Indeed. There has to be a database to establish provenance, and it is that database that is at the core of the Korea Telecom business model.
consumer, privacy, rfid
The counterfeiters will inevitably shift their attention to attacking the database. If I were a counterfeiter, I’d put chips in my whiskey that linked to a URL that displayed something that looks like the official Korea Telecom page but says “Sorry, the service is currently down, please try again later” or perhaps even “Sorry, the service is down, please call this number for more information” followed by the number for a reverse-charge premium-rate call to Surinam at $199 per minute. Just as with smart posters and so on, unless the chip carries a digital signature, you don’t know whether the URL is real or not, so nothing it directs you to can be trusted. There’s no need for a URL here: just have the chip store a digitally-signed identifier and let the “provenance infrastructure” do the rest. Better still, have the chip store a digitally-signed and encrypted identifier so that only the database owner can decrypt it, ensuring that all provenance request have to go through them.
Without an infrastructure that includes end-to-end digital signatures there’s no way round this. The phone needs to know the chip is authentic. The database needs to know who is asking, and the consumer needs to know who is answering.
xxx
The possibility of such a trust dynamic shows that the current discourse of Blockchain replacing trust by means of technology, is too simplistic. At best it will replace some forms of trust by other forms of trust
From Frontiers | Blockchain Applications and Institutional Trust | Blockchain.
xxx
Snippings 