⛓ Decentralized Drug Provenance Track-and-Trace Map

Where a Medicine Actually Begins — Anchoring API Origin on the Ledger

Roughly 80% of active pharmaceutical ingredients sold in the United States are manufactured or sourced overseas, often through multi-tier chemical supply chains that are opaque even to the branded drug maker. Provenance tracking starts at the earliest verifiable point: the fine-chemical or fermentation plant producing the API itself, where a GS1-standard identifier and a hashed Certificate of Analysis become the permanent, unfalsifiable root of everything downstream.

• ~80%: US API import share (FDA, primarily India & China)
• GTIN + Lot: GS1 identifier (Global Trade Item Number)
• SHA-256: CoA hash algorithm (certificate of analysis fingerprint)
• EPCIS ObjectEvent: Root event type (commissioning of the lot)

GS1 identification and the EPCIS commissioning event

Every trackable object in the GS1 standard ecosystem is identified, not merely described:

GTIN (Global Trade Item Number): a 14-digit code identifying the product itself (e.g., "Metformin HCl API, USP grade") — the same GTIN applies to every unit of that specific product from that specific manufacturer.

Lot/Batch number: identifies a specific production run of that GTIN — critical because pharmaceutical quality events (contamination, potency drift) are almost always lot-specific, not product-wide.

SGTIN (Serialized GTIN): once the API is formulated into finished, saleable units downstream, each individual package additionally receives a unique serial number — GTIN + serial = one specific, physical box traceable to one specific patient dispensation.

The commissioning ObjectEvent (GS1 EPCIS 2.0 standard): { "type": "ObjectEvent", "action": "ADD", "bizStep": "commissioning", "epcList": ["urn:epc:id:sgtin:series.APImfr.LOT2026-0417"], "eventTime": "2026-04-17T08:12:00Z", "bizLocation": "urn:epc:id:sgln:plant.Hyderabad.IN", "extension": { "coaHash": "9f3a...e21", "supplierID": "DUNS-860214477" } }

This event — hashed and submitted as a blockchain transaction to the API manufacturer's private ledger node — is the provenance root. No later event in the chain can be verified as authentic without ultimately tracing back to a valid, hash-matched commissioning event at origin. If a counterfeiter fabricates a mid-chain shipment record, it will fail because it cannot reference a genuine, cryptographically-anchored root event.

From Bulk API to Serialized Package — Chain-of-Custody Through Manufacturing Tiers

A finished drug product typically passes through three to five distinct manufacturing entities before it is ready to ship: the API producer, a drug-product formulator who blends and tablets/fills, a fill-finish site for injectables, and a serialization/packaging line that applies the final unique identifier. Each transformation is a discrete, auditable event — GS1 EPCIS models exactly this with AggregationEvent and TransformationEvent types.

• 3–5: Typical mfg tiers (API → formulate → fill → package)
• Item→Case→Pallet: Aggregation levels (hierarchical EPCIS parent-child)
• Nov 2023: DSCSA serialization deadline (US, full traceability enforcement)
• 2019: EU FMD unique identifier (Falsified Medicines Directive, Art. 54a)

AggregationEvent and TransformationEvent — modeling physical custody changes

Two EPCIS event types capture what physically happens on a packaging line:

TransformationEvent — inputs consumed, new outputs created: { "type": "TransformationEvent", "inputEPCList": ["urn:epc:id:sgtin:...LOT2026-0417-API"], "outputEPCList": ["urn:epc:id:sgtin:...LOT2026-0501-TABLET x 50000"], "bizStep": "formulating", "eventTime": "2026-05-01T14:00:00Z" } This models the irreversible fact that 12kg of bulk API became 50,000 finished tablets — the input lot is consumed and a new, distinct output lot is born, with a recorded genealogical link back to the parent.

AggregationEvent — physical nesting of already-serialized units: { "type": "AggregationEvent", "action": "ADD", "parentID": "urn:epc:id:sscc:case.88291047", "childEPCs": ["sgtin:...unit001", "sgtin:...unit002", "... x144"], "bizStep": "packing" } This captures 144 individually serialized cartons being packed into one case (SSCC — Serial Shipping Container Code), then cases aggregated onto a pallet — a three-level hierarchy (item→case→pallet) that lets a single pallet scan at a warehouse dock instantly resolve to all 20,000+ individual serialized units it contains, without manually scanning each one.

Each of these events, hashed, becomes a transaction on the manufacturer's permissioned ledger node. Because inputEPCList genealogically links a finished lot back to its consumed raw-material lot (which itself links back to the origin commissioning event from Stage 1), a full "who touched this exact box of pills and in what order" query becomes a single graph traversal rather than a multi-week paper-trail reconciliation across five separate companies' internal ERP systems.

The Physical Route — GPS, IoT Cold Chain, and Custody Handoffs

Once packaged, a drug shipment enters the physical distribution network: third-party logistics (3PL) warehouses, national wholesalers, regional distribution hubs, and finally the dispensing pharmacy or hospital. Geographic track-and-trace layers real-world location and condition data — GPS coordinates, IoT temperature/humidity sensors — onto the same EPCIS event stream, so the digital custody chain and the physical route can be cross-verified against each other.

• ~$35B/yr: Cold-chain excursion cost (global pharma spoilage estimate)
• 1–5 min: IoT logger read interval (temperature/humidity telemetry)
• shipping/receiving: Custody handoff event (EPCIS bizStep pair per transfer)
• 4–7: Typical route hops (plant → 3PL → wholesaler → pharmacy)

Geotagged custody events and cold-chain integrity proofs

Every physical handoff generates a matched pair of EPCIS events — one bizStep:"shipping" from the sender, one bizStep:"receiving" from the receiver, both referencing the identical EPC list and a location code (GS1 SGLN — Serialized Global Location Number):

Ship event (Distributor A, Newark hub): { "bizStep":"shipping", "bizLocation":"sgln:hub.Newark.US", "eventTime":"2026-06-02T03:14Z", "epcList":["sscc:case.88291047"] }

Receive event (Wholesaler B, Columbus): { "bizStep":"receiving", "bizLocation":"sgln:wholesaler.Columbus.US", "eventTime":"2026-06-03T11:02Z", "epcList":["sscc:case.88291047"] }

Because both events reference the same case-level EPC and are independently submitted by two different organizations to two different ledger nodes (later reconciled via the cross-network bridge in Stage 4), a mismatch — receiving without a corresponding prior shipping event, or a shipping event with no matching receipt anywhere on the network — is immediately visible as a chain-of-custody gap, a classic early signal of diversion.

Cold-chain telemetry integration: Many biologics and vaccines require 2–8°C storage throughout transit. IoT data loggers (e.g., Bluetooth/LoRaWAN temperature tags inside the shipping case) stream readings every 1–5 minutes. Rather than writing every raw reading on-chain (impractically high volume), the logger's full temperature curve is hashed and the digest anchored to the corresponding shipping/receiving event pair — an SensorEvent extension in EPCIS 2.0. Anyone with the original logger export can verify it matches the hash and hasn't been edited after the fact to hide an excursion; nobody needs to trust the carrier's word alone that "cold chain was maintained."

Geographic plausibility check: Because every event carries a location and timestamp, the system can flag physically impossible routes — e.g., the same serialized case "received" in Columbus at 11:02 and "shipped" from a facility in Mumbai forty minutes later. This kind of geotemporal impossibility is one of the strongest, most automatable diversion signals available (developed further in Stage 5).

Interoperability Without a Single Shared Database — Bridging Private Ledgers

No manufacturer, distributor, or regulator will put its full commercial transaction history on one shared blockchain controlled by a competitor. The practical architecture — pioneered by consortiums like the MediLedger Network — is a federation of independent private/permissioned chains, one per organization or organization-type, connected by a thin interoperability layer that exchanges only standardized GS1 EPCIS event hashes and zero-knowledge-style existence proofs, never full commercial data.

• MediLedger Network: Reference model (Chronicled; pharma consortium, since 2017)
• GS1 EPCIS 2.0: Interop standard (plus CBV — Core Business Vocabulary)
• Hashes only: What crosses the bridge (not pricing, contracts, or volumes)
• Zero-knowledge proof: Verification model ("valid product" without revealing chain)

How a relay/bridge node lets independent chains verify each other

The bridging problem: Manufacturer M runs Chain A. Wholesaler W runs Chain B. Regulator R runs Chain C (often a lighter-weight repository, not a full blockchain — the FDA's DSCSA pilot systems are one example). When W receives a shipment from M, W needs to verify "was this exact serialized unit legitimately produced and shipped by M?" without M granting W direct read access to its entire private ledger (which would leak competitor pricing, volumes, and other partners).

Bridge/relay architecture: 1. Each organization runs a relay node that subscribes to a shared, standards-only "verification network" — not a blockchain itself, but a routing layer that knows which chain holds which EPC's history. 2. When W's system needs to verify a unit, it submits a verification request (product GTIN + serial + expected origin) through its relay node. 3. M's relay node receives the request, checks its own private ledger for a matching, valid commissioning + custody chain, and returns a cryptographic attestation — a signed yes/no plus the relevant event hashes — without exposing M's full ledger contents. 4. W's system checks the attestation signature against M's known public organizational identity (established via a shared PKI / GS1 Global Location Number registry) and, if valid, proceeds with receiving.

Why hashes, not raw data, cross the bridge: This architecture satisfies two competing requirements simultaneously — competitive data sovereignty (M never has to reveal its supplier costs or production volumes to W) and regulatory/patient-safety verifiability (anyone in the network can cryptographically confirm a product's legitimacy). It mirrors how DSCSA envisions the "interoperable, electronic" system mandated for November 2023: not one government mega-database, but a federated verification network where trading partners can query each other in near real time.

Practical result: a pharmacist scanning a suspicious bottle can trigger an automated verification request that traverses three or four independent private ledgers in under a second and returns a definitive "genuine, full custody chain intact" or "unable to verify — do not dispense" response.

Catching the Gray Market — Automated Diversion and Counterfeit Detection

Drug diversion — genuine product illegally rerouted outside its authorized distribution channel, often to gray-market resellers or across borders to exploit price differentials — and outright counterfeiting both leave a specific fingerprint in the event data: serial numbers appearing where they should not, custody chains with gaps, or the same identifier scanned as "sold" more than once. A blockchain-anchored, geotagged event stream makes these patterns automatically and continuously detectable rather than something discovered only after a patient harm report.

• ~1 in 10: WHO substandard/falsified est. (medicines in low/middle-income countries)
• required 2023+: DSCSA saleable-return verify (wholesaler must verify before resale)
• at dispense: EU FMD decommissioning (unique identifier retired in EMVS)
• seconds–minutes: Detection latency (networked) (vs. weeks/months paper-based)

Automated anomaly classes and the verification workflow

Four detection patterns run continuously against the event graph:

1. Duplicate-scan / clone detection: The same serial number (SGTIN) is decommissioned (dispensed/sold) in two different, geographically distant locations within an implausible timeframe. This is the classic signature of a counterfeiter cloning a legitimate serial number onto fake product — the real unit and the fake unit both eventually get scanned as "sold." Rule: flag if decommissioning events for one EPC occur >2 in its lifetime, or in locations >500km apart within <24h.

2. Custody chain gap: A "receiving" event exists with no matching upstream "shipping" event anywhere on the federated network, or vice versa — product materializing without a traceable legitimate source, or vanishing from the authorized chain (likely diverted to an unauthorized reseller) before reappearing later at an unexpected node.

3. Geotemporal implausibility: Sequential events for the same EPC imply a travel speed exceeding any real transport mode (e.g., 6,000 km in 3 hours by truck) — nearly always indicates either a fraudulent event injection or two different physical objects sharing one (cloned) serial number.

4. Channel-deviation / gray-market routing: Product commissioned for one authorized market (e.g., a lower-price national tender) reappears in the custody chain of a distributor serving a different, higher-price market — parallel importation that may violate distribution agreements and, more importantly, bypasses that second market's own pharmacovigilance and cold-chain assurance.

Regulatory-mandated verification points: DSCSA (US) requires wholesalers to verify product identifiers on any saleable return before it can be redistributed — exactly the "hasValidCustodyChain(serial)" query the bridge network in Stage 4 enables in real time. EU FMD requires the unique identifier be checked against the European Medicines Verification System (EMVS) and decommissioned at the point of dispense — functionally the same pattern, standardized region-wide since 2019.

Alert workflow: a flagged anomaly generates a case in the regulator's and manufacturer's shared alert queue, referencing the specific EPC, the conflicting event hashes, and the two implicated network locations — giving investigators a cryptographically-grounded starting point instead of a consumer complaint and a guess.

The most powerful anti-diversion property is architectural, not just algorithmic: because every custody event is hashed and cross-referenced across independently-operated ledgers, an actor would need to compromise multiple organizations' systems simultaneously to inject a fully consistent fraudulent chain — vastly harder than falsifying one company's internal paper or spreadsheet records, which remains the dominant failure mode in pre-blockchain pharmaceutical supply chains.