CyphrAuth's CERA (MVP Overview)

flowchart TD ORDER_DONE --> LOGISTICS_CHECK LOGISTICS_CHECK{Does Client have Logistics Support Enabled?} -- Yes --> LOGISTICS_START LOGISTICS_CHECK -- No --> STEP_SELECTION STEP_SELECTION@{ shape: hex, label: "Which action would the user like to do?" } STEP_SELECTION -- User would like to attempt to claim a product --> INITIAL_ACQUISITION STEP_SELECTION -- User would like to attempt to verify a product owner --> VERIFY_OWNER_START STEP_SELECTION -- User would like to attempt to transfer a product --> TRANSFER_ENABLED_CHECK STEP_SELECTION -- User would like to attempt to verify a product --> VERIFY_START subgraph Handling Order ORDER[Client Places Order] --> NEW_CODE[Unique Private Code is for one product generated] NEW_CODE -->NEW_PRODUCT_ID[Product ID is generated using Client specific Info as well as a unique random ID i.e. similar to Snowflake-ID] NEW_PRODUCT_ID -->PASSWORD{Password Support Enabled?} PASSWORD -- Yes -->PASSWORD_START[Unique Random Password is generated] PASSWORD_START-->PASSWORD_WHICH@{ shape: hex, label: "What is Encrypted by Password?" } %% TODO show handle different cases PASSWORD_WHICH -- Product -->PASSWORD_EXPORT["Password is saved by CyphrAuth, a client owned system or physically stored (e.g. on paper, saved to a USB, etc)"] PASSWORD_WHICH -- Code -->PASSWORD_CODE_ENCRYPT[Private Code is Encrypted] PASSWORD_CODE_ENCRYPT -->PASSWORD_EXPORT PASSWORD_EXPORT -->TYPE_WHICH@{ shape: hex, label: "How is Private Code retrieved?" } TYPE_PRIVATE_PRINT -->PRODUCT_ID_PRINT[Print Product ID in machine readable format] TYPE_WHICH -- Regristration ID -->TYPE_REGISTRATION[Unique Registration ID is generated] TYPE_REGISTRATION -->TYPE_REGISTRATION_PRINT[Registration ID is printed to machine readable format and hidden using tamper-evident method] TYPE_REGISTRATION_PRINT -->PRODUCT_ID_PRINT TYPE_WHICH -- Immediately -->TYPE_PRIVATE_PRINT[Private Code is printed to machine readable format and hidden using tamper-evident method] PASSWORD -- No -->TYPE_PRIVATE_PRINT PRODUCT_ID_PRINT --> PRODUCT_DESCRIBE[Associate information about Product with Product ID] PRODUCT_DESCRIBE --> PRODUCT_HASH[Private key, public key, product and client specific data are used to create a unique initial claim code] PRODUCT_HASH --> PRODUCT_HASH_STORAGE["Initial claim code is associated with client and product, and are stored by CyphrAuth"] PRODUCT_HASH_STORAGE --> PRODUCT_ID_AFFIX[Optional: Affix or physically bind printed Product ID to Product] PRODUCT_ID_AFFIX --> PRODUCT_REPEAT{All Products covered?} PRODUCT_REPEAT -- No --> NEW_CODE PRODUCT_REPEAT -- Yes --> ORDER_DONE[Order Complete] end subgraph Logistics LOGISTICS_START[Associate One or More Product IDs to a Logistics Tracking Code] --> LOGISTICS_SETUP_CONDITIONS[Client selects algorithm conditions e.g. time based condition, geographical condition, public key of transporters/companies, etc] LOGISTICS_SETUP_CONDITIONS --> LOGISTICS_DEVICE_CHECK{Does Transport Operator/Logistics Company have CyphrAuth Device/App which supports Logistics Checks?} LOGISTICS_DEVICE_CHECK -- No --> LOGISTICS_PROVIDE[Provide Transport Operator/Logisics Company with CyphrAuth Device/App] LOGISTICS_DEVICE_CHECK -- Yes -->LOGISTICS_SETUP_DRIVER[Associate each secret and the selected conditions to the relevant transportation operator's/logistics company's device/app and a specific section of the logistics route] LOGISTICS_PROVIDE -->LOGISTICS_SETUP_DRIVER LOGISTICS_SETUP_DRIVER -->LOGISTICS_COMPLETE_CHECK{Is delivery complete?} LOGISTICS_COMPLETE_CHECK -- No --> LOGISTICS_HANDOFF_RUN[Generate temporary code based off of relevant secret and selected conditions] LOGISTICS_HANDOFF_RUN --> LOGISITICS_DRIVER_CHECK{Is The current transportation operator's code the same as the next transportation operator?} LOGISITICS_DRIVER_CHECK -- No --> LOGISTICS_FAIL_AUDIT[CyphrAuth saves information for future auditing] LOGISTICS_FAIL_AUDIT --> LOGISTICS_FAIL[Assume one or both transportation operators are not who they claim to be.] LOGISTICS_FAIL --> LOGISTICS_FAIL_ADD[Additional Client specific steps are taken to address potential issue.] LOGISITICS_DRIVER_CHECK -- Yes --> LOGISTICS_SUCCESS_AUDIT[CyphrAuth saves information for future auditing] LOGISTICS_SUCCESS_AUDIT --> LOGISTICS_SUCCESS[Assume both operators are who they claim to be and handoff cargo to next transporation operator] LOGISTICS_SUCCESS --> LOGISTICS_COMPLETE_CHECK end subgraph First Claim INITIAL_ACQUISITION[Initial owner purchases/receives/acquires product] INITIAL_DEVICE_CHECK{Does initial owner have a CyphrAuth supported Device or App?} INITIAL_DEVICE_PROVIDE[Initial owner receives or purchases CyphrAuth supported Device or App] %% TODO handle how keypair is stored INITIAL_DEVICE_SETUP[Initial owner sets up their account and generates at least one keypair] INITIAL_REVEAL[Initial owner removes tamper-evident covering to reveal private/registration code] INITIAL_ID_SCAN[Initial owner scans or enters product ID using CyphrAuth supported Device or App] %% TODO handle registration logic INITIAL_PRIVATE_SCAN[Initial owner scans private/registration code] INITIAL_PASSWORD_CHECK{Password Support Enabled?} %% TODO explain different storage INITIAL_PASSWORD_RECEIVE[Initial owner is provided with the password] INITIAL_PASSWORD_ENTER[Initial owner enters password into CyphrAuth supported Device or App] INITIAL_HASH[CyphrAuth supported Device or App uses provided information, client info and product info to generate intial claim code] INITIAL_COMPARE[CpyhrAuth supported Device or App sends request to CyphrAuth Service] INITIAL_COMPARE_CHECK{Are the stored intial claim code and the generated initial claim code the same?} INITIAL_FAIL[Fail response is sent back] INITIAL_FAIL_AUDIT[Attempt is stored for future auditing] INITIAL_CLAIMED_CHECK{Has product already been claimed?} INTIAIL_CLAIMED_NO[Claim and product are associated to provided Keypair in CyphrAuth Service] INITIAL_ACQUISITION --> INITIAL_DEVICE_CHECK INITIAL_DEVICE_CHECK -- Yes --> INITIAL_REVEAL INITIAL_DEVICE_CHECK -- No --> INITIAL_DEVICE_PROVIDE INITIAL_DEVICE_PROVIDE --> INITIAL_DEVICE_SETUP INITIAL_DEVICE_SETUP --> INITIAL_REVEAL INITIAL_REVEAL --> INITIAL_ID_SCAN INITIAL_ID_SCAN --> INITIAL_PRIVATE_SCAN INITIAL_PRIVATE_SCAN -->INITIAL_PASSWORD_CHECK INITIAL_PASSWORD_CHECK -- Yes --> INITIAL_PASSWORD_RECEIVE INITIAL_PASSWORD_CHECK -- No --> INITIAL_HASH INITIAL_PASSWORD_RECEIVE --> INITIAL_PASSWORD_ENTER INITIAL_PASSWORD_ENTER --> INITIAL_HASH INITIAL_HASH --> INITIAL_COMPARE INITIAL_COMPARE -->INITIAL_COMPARE_CHECK INITIAL_COMPARE_CHECK -- No --> INITIAL_FAIL INITIAL_COMPARE_CHECK -- Yes --> INITIAL_CLAIMED_CHECK INITIAL_FAIL --> INITIAL_FAIL_AUDIT INITIAL_CLAIMED_CHECK -- Yes --> INITIAL_FAIL INITIAL_CLAIMED_CHECK -- No -->INTIAIL_CLAIMED_NO end subgraph Verify Product VERIFY_START[Product ID is scanned or read via CyphrAuth supported device or app] VERIFY_RECORD[Product information is sent to device or app] %% TODO handle cases of how verification is done VERIFY_COMPARE["Product information is used to verify product. This can be done physically via a human or using a third party app (e.g. a computer vision based app which compares provided product info with bitmap produced by the app when scanning the product) "] VERIFY_CHECK{Does User or third-party app verify the product?} VERIFY_CHECK_YES[Product is considered verified.] VERIFY_YES_AUDIT[Verification record is stored for future auditing] VERIFY_CHECK_NO[Counterfeit assertion is made and stored for future auditing] VERIFY_NO_ASSERTION[Depending on Client and CyphrAuth settings, a product with enough counterfeit assertions will be marked for true verification. The client or the current owner of the product can request appeals to the assertion ] %% TODO handle cases where client or owner appeal VERIFY_START --> VERIFY_RECORD VERIFY_RECORD --> VERIFY_COMPARE VERIFY_COMPARE --> VERIFY_CHECK VERIFY_CHECK -- Yes --> VERIFY_CHECK_YES VERIFY_CHECK -- No --> VERIFY_CHECK_NO VERIFY_CHECK_YES --> VERIFY_YES_AUDIT VERIFY_CHECK_NO --> VERIFY_NO_ASSERTION end subgraph Verify owner VERIFY_OWNER_START["Product verification is run (see Verify Product)"] VERIFY_PRODUCT_CHECK{Was product verified?} VERIFY_PRODUCT_YES[User claiming to be owner provides their public key associated to product] VERIFY_PRODUCT_NO[Ownership cannot be verified] VERIFY_REQUEST[Verification Request is sent to ownership system] VERIFY_OWNERSHIP[Ownership System checks if claimed owner key is associated to product] VERIFY_OWNERSHIP_CHECK{Is provided claimed owner key currently associated to selected product in ownership system?} VERIFY_OWNERSHIP_YES[Ownership systems sends verification code to requestee and owner] VERIFY_HASH_CODE[Requestee and claimed owner use keypair to hash verification code] VERIFY_HASH_SEND[Requestee and claimed owner send hashes to ownership system] VERIFY_HASH_COMPARE[Ownership system uses hashes and provided keypairs to verify users] VERIFY_HASH_CHECK{Could the ownerhsip system verify the users?} VERIFY_HASH_YES[It can be assumed that the user claiming to be the owner is the owner] VERIFY_AUDIT[Request is saved for future auditing] VERIFY_OWNER_START --> VERIFY_PRODUCT_CHECK VERIFY_PRODUCT_CHECK -- Yes --> VERIFY_PRODUCT_YES VERIFY_PRODUCT_CHECK -- No --> VERIFY_PRODUCT_NO VERIFY_PRODUCT_NO --> VERIFY_AUDIT VERIFY_PRODUCT_YES --> VERIFY_REQUEST VERIFY_REQUEST --> VERIFY_OWNERSHIP VERIFY_OWNERSHIP --> VERIFY_OWNERSHIP_CHECK VERIFY_OWNERSHIP_CHECK -- Yes --> VERIFY_OWNERSHIP_YES VERIFY_OWNERSHIP_CHECK -- No --> VERIFY_PRODUCT_NO VERIFY_OWNERSHIP_YES --> VERIFY_HASH_CODE VERIFY_HASH_CODE --> VERIFY_HASH_SEND VERIFY_HASH_SEND --> VERIFY_HASH_COMPARE VERIFY_HASH_COMPARE --> VERIFY_HASH_CHECK VERIFY_HASH_CHECK -- Yes --> VERIFY_HASH_YES VERIFY_HASH_CHECK -- No --> VERIFY_PRODUCT_NO end subgraph Transfer Product TRANSFER_ENABLED_CHECK{Is the Product publically available for transfer?} TRANSFER_PRIVATE_CHECK{Does user privately know owner?} TRANSFER_PRIVATE_NO[Other user is unknown, request cannot be started] TRANSFER_PRIVATE_YES[User scans product id and public key of claimed owner] TRANSFER_SENT[The user sends a transfer request] TRANSFER_ACCEPTED_CHECK{Does claimed owner accept the transfer request?} TRANSFER_PRIVATE_REJECTED[Other user rejects request, requests will not start] TRANSFER_START["Ownership is verified (See Verify Owner)"] TRANSFER_OWNER_CHECK{Could ownership be verified?} TRANSFER_OWNER_NO[Ownership could not be verified. Transfer request will cancelled.] TRANSFER_CONFIRM_CHECK{Both users have verified the transfer before timeout?} TRANSFER_CONFIRM_YES[Ownership system is notified by both users and ownership is transfered] TRANSFER_CONFIRM_NO[Transfer request has timed out or was rejected.] TRANSFER_ENABLED_CHECK -- No --> TRANSFER_PRIVATE_CHECK TRANSFER_ENABLED_CHECK -- Yes --> TRANSFER_SENT TRANSFER_SENT --> TRANSFER_ACCEPTED_CHECK TRANSFER_ACCEPTED_CHECK -- Yes --> TRANSFER_START TRANSFER_ACCEPTED_CHECK -- No --> TRANSFER_PRIVATE_REJECTED TRANSFER_PRIVATE_CHECK -- No --> TRANSFER_PRIVATE_NO TRANSFER_PRIVATE_CHECK -- Yes --> TRANSFER_PRIVATE_YES TRANSFER_PRIVATE_YES --> TRANSFER_START TRANSFER_START --> TRANSFER_OWNER_CHECK TRANSFER_OWNER_CHECK -- No --> TRANSFER_OWNER_NO TRANSFER_OWNER_CHECK -- Yes -->TRANSFER_CONFIRM_CHECK TRANSFER_CONFIRM_CHECK -- No -->TRANSFER_CONFIRM_NO TRANSFER_CONFIRM_CHECK -- Yes -->TRANSFER_CONFIRM_YES end LOGISTICS_COMPLETE_CHECK -- Yes -->STEP_SELECTION GENERAL_END[Additional information may be stored for future auditing] INITIAL_FAIL_AUDIT --> GENERAL_END INTIAIL_CLAIMED_NO --> GENERAL_END VERIFY_NO_ASSERTION --> GENERAL_END VERIFY_HASH_YES --> GENERAL_END VERIFY_AUDIT --> GENERAL_END TRANSFER_OWNER_NO --> GENERAL_END TRANSFER_PRIVATE_NO --> GENERAL_END TRANSFER_PRIVATE_REJECTED --> GENERAL_END TRANSFER_CONFIRM_NO --> GENERAL_END TRANSFER_CONFIRM_YES --> GENERAL_END GENERAL_END --> STEP_SELECTION