Hyperledger Foundation Hyperledger Global Forum 2021, 11 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Trading Partner Authentication and Drug Verification in the US Pharmaceutical Supply... - Ben Taylor

Description

Trading Partner Authentication and Drug Verification in the US Pharmaceutical Supply Chain - Ben Taylor, LedgerDomain

In 2013 the Drug Supply Chain Security Act was signed into law to address the growing threat of counterfeit drugs and to ensure prescription drugs remain safe and effective. It also created new requirements for US pharmaceutical supply stakeholders, including an extended "know your customer" requirement. While larger Authorized Trading Partners (ATPs) have connectivity solutions in place, newer and smaller ATPs have not traditionally participated, including tens of thousands of dispensers. During this session, Ben Taylor will discuss the results of a peer-reviewed study that tested ATP authentication and enhanced verification in a real-world pharmacy with genuine drug packages. Participants from Genentech, Sanofi, Amgen, and UCLA Health tested enhanced verification workflows backed by Hyperledger Fabric, and were able to authenticate requests with secure verifiable credentials.

Sessions Details & Slides (if available)- https://sched.co/j3cn
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2021 #Blockchain

A

Perfect good morning, everybody gary. Thank you very much appreciate it for bearing with us, but we're going to try to move through this relatively rapidly and um I'm ben taylor from ledger domain. I'm joined by alex.

A

um You can see working on his iphone making all this happen and again apologize for uh this difficulty, but we're now here and we're ready to talk about atps if we can move forward alex so we're a longtime uh hyper ledger fabric user we've been members of linux foundation hyperledger for many years, you may have seen some of our work in past global fora, but today we're going to talk about how we're loading in identity and scaling our product.

A

When you talk about identity in the hyperledger universe, um there's a lot of complexity and there's a lot of choice, and I'm not going to tell you that we've made the right choices, but hopefully, by having this sort of fired side, chat approach to how we're doing things it might inform you on so how you might want to make some of your choices alex.

A

So we specialize in healthcare supply chain and healthcare, compliance and ucla health who's.

A

Also, a hyperledger member is a partner that we very much value and what we're going to talk about today is a project that we worked on with ucla health genentech, which is part of the roche group, the number two pharma company, sanofi or sanofi, depending on where you live in the world, uh which is a very large french, global healthcare company and amgen who's in california to test um authenticated identities, and this is what some people might call dids what some people might call verifiable credentials what some people might call distributed ids all these things are in the same family of decentralized technologies.

A

That blockchain is alex. Can we move on? So why is there a motivating use case here? uh There's a unique law in the u.s, that's about uh eight years old now called the dscsa, the drug supply chain, security act, and it says that the federal government is requiring thousands, meaning, thousands of manufacturers, hundreds of wholesalers and tens of thousands of pharmacies to work together to track just prescription, drugs and they're gonna. Do that with an interoperable system which is government.

A

Not endorsed not hosted, but there's government oversight, but they can't quite go all the way to hosting it themselves. It's an interesting accommodation that was made so it's called an industry supported interoperable framework and that's got to be up and running in about 28 months.

A

Okay, are we piloting? um The idea is that every single drug has its own unique serial number and that if you are an atp, an authorized partner that you should be able to perform certain operations, some of those operations might be called validation. Some are called verification, but either way, if you're one of 80 000 atps, you should be able to get a credential.

A

You should be able to make information requests of other atps and you should be able to go about your business and you have to document that you're checking and you have to document what you did. So if you checked a drug at ucla and you checked it with genentech, you should be able to verify that genentech really is genentech.

A

You should be able to verify that the drug really is a drug, even if you didn't buy it directly from genentech, but you bought it from somebody else, and you should be able to store that information in a readable form for the next six years and obviously, if you're a patient which most of us are.

A

You appreciate the fact that you know you can know that your dispenser, which you call your pharmacist, is checking all your drugs to know that they're really legit okay, so the fda came to us in 2019, asked for our help, and we were only too happy to jump in with our ledger domain tools that are based on hyperledger, alex.

A

So the thing to know is that the fda did an awesome job, awesome job of picking out a 2d barcode. That's a foundational building block for this process. Once you've got a unique identifier, then blockchain style tools are just natural. If you don't have a unique identifier, things are a lot dicey or you're going to see people promise you that they can use hyper ledger tools to do stuff. Let's be crystal clear: this is a classic garbage in garbage out issue, so you've got to have good data on the front end or you're.

A

Never going to get where you need to go.

A

Blockchain is all about creating usable data, creating actionable data and transacting with trust and again, if you don't trust the item or the asset and its unique identifier, you're falling down right out of the blocks, so fda picked gs1 standard, it's 144 countries and that's what they're going with and you can read the side of the box and know what its serial number was, who made it when it's expiring, everything you need to know alex so alex is going to show a short video next. This is our partner ucla, they are spectacular, uh jessica.

A

Jesus has been a great partner for us, and his 500, strong team has been with us through thick and thin. This project was led by the amazing gada oshkore, who heads up all her, the retail and specialty pharmacies, which is a large block of what they're doing, and she is fantastic, you're going to love this video alex.

B

This is gada from ucla. Here we are scanning some drugs with atp solutions. Whenever a drug is scanned, it goes green on the barcode. We just swipe the phone and it picks up the scanner after we scan it. We send it to the manufacturer for verification, we're working because we're trying to be ahead with the compliance requirements for the sdsa.

B

The system will also allow us to see if a medication is recalled, expired and we will be notified. So we can foreign, we receive a big load of medications every day we scan them in, and it would be nice to verify that these medications are coming from the right source. We decided to be part of the design process be able to be in connection with the manufacturers to be compliant with at the.

A

Sdsa, that's gotta and I think you'll agree that uh she's doing some amazing work there. So essentially for those of you that aren't in the healthcare world, you've probably been to a pharmacy and you've probably seen these little blue boxes and they call them totes and every day the pharmacy will get in a new tote that might have 20 might have 60 drugs. Some of the bigger pharmacies might get two totes and then obviously a huge pharmacy like ucla.

A

That's the size of a costco is getting uh truckloads every day, but either way you tend to break it down into totes and you're scanning 20 to 60 drugs at a time and you'll see that that's what we do. We maintain a local database which we call product master data and that checks with the barcode against recalls who made this drug. What's the medical guide that goes with it, that's up to the minute. All these things are right there and it stops.

A

The recalls, stops the expired drugs and has the potential to stop the short-dated drug, meaning somebody who only has a few days left before expiration all in one shot.

A

Then what it's doing- and this is where the blockchain really kicks in- is it then generates a verifiable credential and it enables you to contact that drugs manufacturer who is another atp, and that person in turn can verify the identity of ucla, and they can say. Yes, is this really your drug genentech genentech can say back to ucla yep. This is a drug number that we made, and we have no reason to believe that this isn't the first quality drug that you're expecting for your patient alex next.

A

So how does that work in terms of flow um for those of you that are accustomed to blockchain? This is a slightly different way of looking at it, but on the top there gotta is the xatp member. She is getting verified by a third party that she really is gada ashkar, that she really is the pharmacist in charge that then gets loaded up into fabric, ca, 1.4 and fabric ca keeps her public key. Let me be crystal clear on that. I said it before I'll say it again.

A

Default for many people in fabric would be that the fabric ca would hold the key pair in our implementation for privacy reasons.

A

We have kept the key pair separated so that the private key is only held by gada, and only the public key is exposed to fabric ca.

A

Then, when miraculous, which is our oracle-based service, sends out a verification request generated from the blockchain out to the manufacturer, they push yes or no, and then it goes back to gotta as a verified drug and then what you'll see here on the right is gotta can then generate if she needs to a verification report, either for a patient, because they'd like to know that they have real drug or for another wholesaler that is taking back drug, that is extra forgotta or another pharmacist that she's helping out by sending some drugs down the street because they've run out and their patient needs one badly.

A

There's a lot of that in the industry. People like to help each other out, but you want to make sure when you're helping somebody out that the cup of sugar you're getting from your neighbor really is real sugar and it's not something bad. Okay. Next alex we talk about this in blockchain and healthcare today.

A

This is a peer-reviewed journal um with all our partners in it, and you can dig down a little bit more and really get into the details and has a lot of technical information that, for those of you, are interested we'll get into a little bit more alex so again authorization structure of permission, blockchain, those of you that are familiar with hyperledger fabric, see it as a permission blockchain, that's critical, because the idea is that the 70 000 players, what are called atps, need to get accredited and need to get invited, and you need to be able to verify them every time they transact.

A

So that's nice. In addition, by having a much higher bar on authentication, you end up with less notarization load, and so we can run this at 100 transactions per second no problem and again all of the details can be kept within the participating organizations, the fda and the trade groups that are supporting this. Next, all right we're going to dig down for those of you that are a little bit more interested in how this all works and how you leverage this before I do that.

A

I want to talk a little bit about how we see this today and then we're going to finish on how we see things in the future.

A

I think the most important thing to understand is that in the blockchain world, there's a lot of command line interface, uh there's a lot of crypto bros and a lot of people who are comfortable using kind of a bare metally kind of uh blockchain implementation.

A

uh That's not super client friendly and certainly not something that a truck driver or a pharmacy tech would be comfortable leveraging themselves, and so what we do is we bring a lot of different expertise to work to build a system. That's got all the promises that hyperledger fabric and other decentralized tools use, but is presented to the user in a almost toy-like way.

A

So, if you look at our overall architecture, we're still using a lot of fabric out of the box, we're mostly fabric 1.4.x, which is where fabric is today on the ca side fabric, as you know, has moved on to the two dot series.

A

We have not felt the need to do that, yet the stable release in the one dot series works well for us, and the reason for that is that we make heavy use of off-chain private data to deliver on our promises, and we also, as I said, move the key management and the private key all the way to the client device.

A

And I think, when you do that, you're leveraging some of the more modern technologies that you're seeing in the other hyper ledger projects like indie and stuff like ursa and, at the same time we're leveraging the hyperledger fabric for the transaction side. So you know we basically do a little bit of mix and match to get where we're going and that's what makes our clients happy next alex.

A

So we started with hyper ledger. We add the four components: fabric devops toolkit- to get that to work. The way we wanted to spin it up big effort, I'm sure a lot of you have used related tools, but essentially we need to spin up our new instances very quickly and we need to make sure they're reliable. Then we use the salvage sdk to do all the um blockchain app backend.

A

uh We then use docuseal, which is our framework for this off chain file storage. One time this was based on hyper ledger.

A

um But that sort of tapped out for us and around 100 megs out of file size, we can now accommodate a five terabyte file, which is going to be good for genomics and some of the other healthcare applications.

A

But for those of you that have less of a need, the old private collection still works well, and then we invented oraculous for interoperability between fabric chain and the outside world, or what you might call the relational world, and so the idea is that araculus fishes information uh and pulls it into the blockchain on a more mechanical basis, which is critical. If you think about the multiple steps of blockchain, it can be a bit of a drag.

A

It cost about a dime to put a drug up on our blockchain and in order for as a manufacturer and then sort of essentially reload it as a distributor would be 20 cents, which is certainly affordable on a 10 000 drug. But a lot of drugs are not that expensive and we want to keep them inexpensive.

A

So, instead, what we do with miraculous is we have the distributor, enter it onto the blockchain and then use miraculous to check with the manufacturer that it's really working. We do all of this pretty much 100 in golang with a few pilot python scripts and that's what enables us to run at this hundred transaction per second level.

A

I will add for those of you who know this well, that even when you're in a pure golang environment on hyperledger fabric, there's still some tuning, that's required, at least in our case, to get the speeds and the multi-threading that you think ought to be automatic. It does require a little bit of fiddling I'll pass that, along for those that are maybe struggling, alex.

A

Okay. So that's what that one does so. We've added in all of our server side now um and now we're going to move on to if we could alex the next slide, which is the whole kit and caboodle so essentially we're mostly open source, which is great um a lot of visibility, a lot of transparency, a lot of credibility.

A

But what we've done in terms of performance is we monitor with splunk? There are some open source tools that at uh hyper ledger, but we are big, splunk fans. um As I mentioned, we have a third party accreditor, and then we vascularize everything with this master data, 240 000 different drug packages. You saw gotta pull up a few and you're reading them with that barcode. That's on the iphone and again the private key is kept on the iphone.

A

It doesn't go back to the fabric ca, and so we have what's called this trusted triangle between the employing pharmacy, the pharmacist in charge or their designate and um and the network. That's all sort of triangle, together with your third-party accreditation to say: gada really is gotta. Gotta really has a valid pharmacy license.

A

Ucla is a valid pharmacy. You can look it up on the web. That gotta is the pharmacist in charge at a particular ucla pharmacy, make it all work, okay, so it's complicated, but in fact we find there's good up time.

A

You know 50 millisecond latency is what we're seeing across the country total round trips, all in 200 milliseconds.

A

So for this application, it's great and now the fda after seeing this and uh again huge victory for the hyperledger community and for modern computing and for all the patients, the united states fda is now guiding to a one minute verification, as opposed to the 24 hours. That's in the law. So again, people are counting on us to deliver and we've got to make it happen, uh move on alex.

A

If you would so the road ahead, I'm going to finish and then hopefully have time for maybe one question apologize for the late start again: two track approach to identity and transactions, we're optimizing the fabric running gear for the transactions and we're leveraging other linux foundation, projects for identity over time, more rust-based, more ursa, more indie to get the identity side working and then using fabric for transactions and getting them to work together.

A

And the idea then, is to gain rapid regulatory compliance for our customers with this app so that we can bring value to these hard-working pharmacists by recalling expired and uh intercepting recall and expired drugs getting them to verify when they want to and grab those counterfeits and then. Finally, when you pull it all together at blockchain style, you're going to get insights into shortages over stocks aging and that big picture that only blockchain can bring cool thanks so much that was awesome. I appreciate it alex. Thank you very much.

A

Do we have time for one question.

A

I think gary's saying no he's pushing.

C

Us up, I mean there's one question in the q and a tab. If you want to click on it and go ahead and try to uh respond to them right and then you can close out.

A

So uh they're asking if we do other supply chains, so I would say that we absolutely are interested. As I said early on, we are not so interested in low value supply chains that don't have um you know unique serial numbers on their assets. I don't I've heard of ways to do that. We don't feel like it's.

A

That news is worth the squeeze, but if you're talking about aircraft parts, if you're talking about medical devices, if you're talking about louis vuitton trunks um anything uh product that can have a unique identifier, whether it's barcode or rf id yes, we're ready to go. We're ready to help and we'd welcome an inbound phone call.

A

um Hi joshie, I see about interoperability, um yeah, there's a lot of tackling on that, and so we have an article uh that we will steer you towards called zugman.com on where we think the long term is. We work very closely um with other participants in the industry. What I would say is that uh sap and severity work together with us on interoperability of verifiable credentials.

A

I would say that the chronicled guys have are have moved on to other areas outside of dscsa. They still style themselves, medi-ledger for certain things um and they have moved to a new platform. So I don't know that they've opened their apis yet, but in general I do see people opening up with verifiable credentials.

A

I see less of this blockchain to blockchain um sort of direct um and, as I said, the thing that we really tackled and one with on interoperability is this miraculous interoperability, where we go blockchain to relational again. 99.9 percent of the data today is in relational. If you can't work with those you're, not interoperable, um and but I think, over time, yeah verifiable credentials are the way people are going to interoperate and share information blockchain to blockchain.

A

That's going to be big, direct may end up being there as well, and so I think it's going to be an exciting area and josh would be happy to take this offline and drill down on exactly how it works in our space and where things are going. But it's a it's a hot topic thanks. So much for that question great question.

A

Gary are we getting kicked off stage.

C

That's pretty much. We ran a couple minutes over, but I don't see I don't hear anyone yelling yet so I think we're okay.

A

Fantastic that was awesome appreciate your time, send our best regards to the entire hyperledger team. Obviously, everybody's worked through this pandemic beautifully and with good spirit and appreciate the opportunity to chat today. Thanks.

C

For the presentation, very good, bye.