1 of 20

DNS doesn’t need to be evil (not that evil anyway)

Decentralized resolution of identifiers with HTTPS

Phil Archer, Paul Dietrich, Gena Morgan

IIW 30, April 2020

2 of 20

Resolving GS1 identifiers

GS1 system of identifiers encoded in barcodes dates back to 1974
Massively implemented everywhere
Not going to break it
But we can make barcodes resolvable…

3 of 20

Resolution/dereferencing?

3

4 of 20

GS Who?

4

5 of 20

Key industries served

5

Transport & Logistics

Technical Industries

Healthcare

Retail

Marketplaces

Apparel

Fresh Foods

General Merchandise

CPG

6 of 20

Our management board

6

7 of 20

Global partner organisations

7

8 of 20

GS1 Digital Link

Making barcodes resolvable and linkable (sic)

8

9 of 20

Really complicated syntax…

9

506000

134369

https://example.com/gtin/

10 of 20

Any set of GS1 IDs can exist as a URI

10

GTIN:

Batch/lot:

Serial no:

Expiry:

09506000134376

ABC

123456

2021-12-31

https://example.com/gtin/09506000134376/lot/ABC/ser/123456?exp=211231

11 of 20

GS1 conformant resolvers

11

Resolves the identifier(s) and forwards the request to the correct destination

Resolver

TV ad, other related video

Product information page

Patient Information Leaflet

GTIN: 09507000009060

Clinical info

Instructions, recipes

Recall status

12 of 20

https://id.gs1.org/gtin/09506000134352

https://dalgiardino.com/risotto-rice-with-mushrooms/

13 of 20

id.gs1.org/01/09506000134352?linkType=gs1:recipeInfo

14 of 20

linkType=all is our DID Doc

14

[ { "href" : "https://example.com/product/ingredients",

"anchor" : "https://example.com/gtin/614141123452",

"rel" : [ "https://gs1.org/voc/ingredientsInfo" ],

"title" : "Ingredients (Ingrédients)",

"type" : "application/ld+json",

"hreflang" : [ "en" , "fr" ] },

{ "href" : "https://example.com/product/pip",

"anchor" : "https://example.com/gtin/614141123452",

"rel" : [ "https://gs1.org/voc/pip",

"https://gs1.org/voc/instructions"],

"title" : "Manufacturer's description",

"type" : "text/html",

"hreflang" : [ "en" ] },

Draft (we’re finalizing this)

15 of 20

At the network level

15

curl -I https://id.gs1.org/01/9506000134352

HTTP/1.1 307 Temporary Redirect

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS

X-Resolver-ProcessTimeMS: 23

Link: <https://dalgiardino.com/where-to-buy/>; rel="gs1:hasRetailers"; type="text/html"; hreflang="en"; title=“Where to buy Dal Giardino",

<https://dalgiardino.com/where-to-buy/index.html.es>; rel="gs1:hasRetailers"; type="text/html"; hreflang="es"; title="Donde comprar Dal Giardino",

<https://dalgiardino.com/where-to-buy/index.html.vi>; rel="gs1:hasRetailers"; type="text/html"; hreflang="vi"; ...

Location: https://dalgiardino.com/risotto-rice-with-mushrooms/

16 of 20

So we can connect barcodes to credentials & more

16

9

506000

134369

Organic

Gluten Free

Vegan

Can resolve to…

Consumer info

Supply chain info

17 of 20

It uses HTTP(s)

Already massively implemented
Learning curve for developers is minimal
HTTP URIs can be managed subject to a persistence policy
Of course we recognize:

Resolution depends on DNS, but the identifiers don’t
Policy of persistence can be broken

17

18 of 20

On resolvers…

Anyone can run a GS1 conformant resolver (code on GitHub, test suite etc. see https://github.com/gs1/)
Resolvers are sovereign (don’t expect identical links from different resolvers)
GS1-operated resolvers will link to brand-authorized information (that’s the trust model)
Defined in GS1 Digital Link standard (https://www.gs1.org/standards/gs1-digital-link)

18

19 of 20

Example VC

19

// An identifier for the credential

"id": "https://certification.example/coeliac/123456",

// The credential type. It's verifiable and a Nutritional Claim

"type": ["VerifiableCredential", "NutritionalClaim"],

// The entity that issued the credential - we'll use a GS1 Global Location ID for this

// This follows the GS1 Digital Link syntax

// Could be replaced with a DID directly or could resolve to a DID

"issuer": "https://id.gs1.org/gln/9521234567899",

// When the credential was issued

"issuanceDate": "2020-04-22T11:36:24Z",

// The subject of the claim is identified using a GS1 Digital Link URI

// The claim is provided using our extension to schema.org

"credentialSubject": {

"id": "https://id.gs1.org/gtin/9506000134352",

"nutritionalClaim": {

"id": "https://www.gs1.org/voc/NutritionalClaimTypeCode-FREE_FROM_GLUTEN"

}

20 of 20

Some questions…

How much less secure is a VC that only uses GS1 Digital Link URIs than one that uses DIDs?
If significant, where should we use the DID?
Industry is usually slow to move and highly sceptical – what’s the best approach?

20