Evaluation of Decentralized Verifiable Credentials to Authenticate Authorized Trading Partners and Verify Drug Provenance

Abstract

Summary: In 2013, the Drug Supply Chain Security Act (DSCSA) was signed into law to address the growing threat of counterfeit drugs and to ensure prescription drugs remain safe and effective for patients. As part of this law, US pharmaceutical supply chain stakeholders are required to confirm the authorized status of trading partners for transactions and information disclosures, even when there is no prior business relationship. While larger Authorized Trading Partners (ATPs) have connectivity solutions in place, newer and smaller ATPs have not traditionally participated, including tens of thousands of dispensers. To unlock the full potential of the interoperable system mandated by the DSCSA, the authors tested eXtended ATP (XATP), a blockchain-backed framework for ATP authentication and enhanced verification in a real-world pharmacy with genuine drug packages. The objective of this research study was to prove that electronic authentication and enhanced verification can be achieved between ATPs using a mobile-based solution. Moreover, we tested accurate reading of drug and associated electronic med guides, flagging of expired and recalled drugs, and correct generation of documentation to support saleable returns. Methods: This study involved two dispensers and three participating manufacturers. Dispensers were onboarded to a mobile application and used supporting documentation to authenticate their identities, and then scanned 2D drug barcodes to submit drug verification requests to manufacturers (including 11 additional, randomly selected manufacturers). Genuine and synthetic drug package barcodes were used to test workflows against genuine and synthetic manufacturer serialization data records. Manufacturers authenticated the identity of requesting dispensers with verifiable credentials and responded to verification requests. Results: Enhanced drug verification was achieved, with 100% of requests successfully delivered to participating manufacturers and 88% of requests being delivered to other manufacturers (based on the pharmacist selection of random packages from the pharmacy). Drug verification matching against synthetic serialization data records resulted in 86% accuracy, with the 14% error rate attributed to human factors. All barcodes were successfully scanned and provided package-accurate data, and 97% of randomly selected packages successfully generated drug package inserts. All synthetic recalls and expired drugs were successfully flagged. Four of the manufacturers contacted were among the top 15 pharmaceutical manufacturers globally; all four responded. Conclusions: The XATP framework provides a secure, reliable, and seamless remote method to conduct enhanced verification as required by law. Interoperability between manufacturers and dispensers with no prior business relationship can be achieved on ‘day zero’ using mobile devices that enable digital authentication and rapid barcode scanning. As users retain control of their own private keys, the framework also mitigates the single-point-of-attack risks associated with centrally managed systems.

A Proposal for Decentralized, Global, Verifiable Health Care Credential Standards Grounded in Pharmaceutical Authorized Trading Partners

“…Together they provide all parties with a 'single source of truth' to address challenges, such as master data management and counterfeit detection. 6 At a more fundamental level, ATPs must be able to identify other ATPs using VCs for compliant transactions and information disclosures; the same necessity motivated the development of the eXtended Authorized Trading Partner (XATP) framework (16,17).…”

“…14 The XATP application framework incorporates one potential workflow for an enhanced verification. Because this involves interaction between dispensers and manufacturers, particular emphasis has been placed on credentialing for those entity types (16,17). A credentialing model for dispensers is currently in place, with manufacturer credentialing on the roadmap.…”

“…We may assume that the higher the stakes, the more claims must be revealed in the presentation of the VC. 20 In the case of XATP, identity information is held on the user's mobile device instead of the service, and control over the identity lies with the keys stored in the device (16,17 Alternatively, a compact, binary encoding scheme (such as protobufs [30]) might be preferred in many machine-to-machine workflows, with JWT/JSON-LD employed for interoperability between organizations (29). 22 The schema for W3C VCs (32) specifies four digital signature schemes.…”

“…17 This would be less fragile for purposes of VC verification, but would still require a central authority (or consortium) to define the trust anchors.b. Choose your own trusted authorities where each organization defines its own trust anchors (perhaps based on some minimal as-needed whitelisting).…”