Building the
New Economy of Movement

FINANCE,
SECURITIZATION, &SMART CONTRACTSTECHNICAL SPECIFICATIONS
June 2021

MOBI FSSC0002/TS/2021
Version 1.1

INTRODUCTION
MOBI is a global, multi-stakeholder project working toco-design standards based on distributed ledger technology
for connected mobility ecosystems. The project engages
stakeholders across the transportation value chain, including
vehicle manufacturers, technology solution providers,
governmental, and non-governmental entities. This report isbased on numerous discussions, workshops, and research.
Opinions expressed herein do not necessarily reflect the viewsof individual members or the companies with which they areaffiliated.
Some of the elements of this document may be the subject ofintellectual property rights. In accordance with MOBI IPLR
policy, a 60 day review period is provided to the MOBI
community to disclose any and all IP matters pertaining to thisstandard. MOBI shall not be held responsible for identifying any
or all such rights. Details of any IP rights identified during thedevelopment of this document will be contained within the
Introduction upon public release of this standard.
Any trade name used in this document is provided for theconvenience of users and does not constitute an endorsement.
The working group responsible for this document is the Finance,
Securitization, and Smart Contracts (FSSC) Working Group.
Sincere thanks are extended to those who contributed theirunique insights to this report.

Authors
Griffin Haskins, MOBI
Rajat Rajbhandari, MOBIFSSC Working Group Co-Chairs
Howard Altarescu, Orrick
Anthony Salamone, RouteOne

FSSC Working Group Team Members
Toby Box, Quant Network
Joe Bannon, KAR Global
Anne-Sophie Cartray, ConsenSys
Michelle Corson, On the Road Lending
David Eddy, D.E. Consulting
Josh Fodale, Ford Credit
Don Ho, Quantstamp
Tu Le, USAA
Phil Masi, BMW Bank

S. Chris Min, OrrickCharlie Moore, Global Debt Registry
Daniela Novaro, Reply
Eric Pilat, Altaventure
Dan Simerman, IOTA
Andrew Smith, TQ Tezos
Jamie Solomon, Accenture
Michele Tellarini, Reply
David Wattebled, Quant Network

MOBI Team
Chris Ballinger, Co-director + FounderTram Vo, Co-director + FounderMarguerite Watanabe, Working Group Lead
Robin Piling, Technical Lead

Griffin Haskins, Fellow
Kelly Clark, Communications Manager
Grace Pulliam, Communications Associate

01

Executive Summary

03

Scope

05

Glossary of Terms

11

System Overview

18

69

49

52

FSSC Processes
1. Infrastructure Subsystem Processes
2. Misc. Sub Processes

76

Use Case - Floor Plan Audit

96

FSSC Schemas
1. Loan Risk Assessment
2. Reputation Risk Assessment
3. Contract Creation and Discounting
4. Loan Administration
5. Servicing
6. Loan Bundling
7. Special Purpose Vehicle (SPV)
8. Securitization
9. Lease Information

Actors and Identity
1. Decentralized Identifiers Framework
2. EIDs
2.1. Common Entity Certificate (EC) Structure
2.2. User
2.3. Physical Assets
2.4. Service Providers
2.5. Data Hosts
2.6. Trust Anchors

TABLE OFCONTENTSFSSC Extensions of Infrastructure
1. FSSC Entity Certificate
2. Communication Bootstrapping

Infrastructure Subsystems
1. Identity Subsystem
2. Data Subsystem
3. Permissioning Subsystem
3.1 Permissioning Subsystem Program Flow

39

65

Registering Data

107

Appendix A: Certificate Structures

1. Data Writes

108

Appendix B: End-to-End Encryption

Permissioned Access
1. Data Host Bootstrapping Certificate (DBC)
2. Access Session Setup (Unlock)2.1. Session Request Packet (Unlock Request)
2.2. Session Rejection (Unlock Response)
2.3. Session Acceptance (Unlock Response)
3. Groups
4. Allow Lists
4.1. Access Certificates (ACs)
5. Block Lists

111 Bibliography

Executive
Summary

Advances in distributed
ledger technologies andtelematics have widespread
implications for the various
multi-party processes
involved in vehicle finance.

With advances in data exchange, distributed ledgers, andtelematics, the vehicle finance ecosystem is primed for
adopting new blockchain use cases. For example, telematics
data about geolocation is able to replace traditional floorplan
auditing, reducing manpower costs and cutting the timerequired for an audit. Lenders and other organizations thatengage in multi-party processes such as waterfall payments orloan servicings would benefit greatly from the ability tofrictionlessly exchange data.
MOBI working group members believe that blockchain anddistributed ledger technologies play a significant role inensuring the secure, privacy-preserving exchange of data.
MOBI working group members believe that the use ofblockchain/DLT would not scale without coherent andstandardized methods adopted and implemented by theindustry stakeholders who manufacture and service thevehicles. The lack of interoperability in the absence of industry
standards becomes problematic at scale.

The FSSC Standards leverage
distributed ledger
technologies to create a trust
layer for transactions anddata exchange within a shareddigital ecosystem.

The Finance, Securitization, and Smart Contracts (FSSC)
standards provide blockchain/DLT as a trust layer fortransactions and data exchanges between entities in a shareddigital ecosystem. This standard prescribes referencearchitecture, data schemas, certificates, etc., for entities in thevehicle finance ecosystem to exchange data by leveraging
blockchain/DLT.

© 2021 MOBI — FSSC Technical Specifications

2

FSSC TECH. SPEC. SCOPE
The FSSC standard specifies
high-level system design,reference architecture, multiparty processes, and FSSCspecific data that is usedthroughout the ecosystem.

The FSSC Standard specifies the high-level system design,reference architecture, multi-party processes, and FSSC
specific data structures that are utilized throughout theecosystem. Finally, this document provides guidance to theimplementation of the FSSC Standard, covering three primaryuse cases and their process flows.
With the systems for identity, data, and permissioning
referenced above, it is possible to outline a variety of use cases.
Each use case is broken down into two main categories: Crediton the Blockchain and Securitization. In all of these use cases,
an entity (representing an organization like a lender) canconnect to devices (like vehicles) or other entities (like fellow
lenders, dealers, or the obligors of loans) through a single,
shared network. These entities are able to authenticate eachother’s identities, securely share data, and safely record
transactions. Their ability to communicate well enables a richarray of functionality.

The FSSC Standard
prescribes a digital
ecosystem where entities areable to securely authenticate
each others’ identities, sharedata, and record transactions.

Note that while this standard references certain underlying
technologies, it provides no opinion on what specifictechnologies are to be used. Such details are left as an option
at implementation. In particular, the following underlying
systems choices are not covered:Communication protocols
Link layer protocols (WiFi, 5G, etc.)
Transport layer and above protocols (REST, gRPC, etc.)
Trusted key-value store
Ethereum, Distributed Hash Tables, DNS, etc.
Cryptography/Security
TLS, SSL, Hashing/MACs, Signatures, etc.
Best practices such as recommended key lengths ordeprecated protocols
Bootstrapping trigger
Triggers for creating a new entity, certificate, data
source, or other should be handled by the implementer,not the standard.
User interfaces
Users are assumed to have Entity IDs (EIDs) and caninteract with the system. This standard provides no
opinion on how an interface is abstracted away. In many
situations, users may interact with a system through an
intuitive user interface without knowledge of theunderlying system and its technical details.

Blockchains/DLT Protocols
Ethereum, Bitcoin, Hyperledger, IOTA, Corda, etc.
Settlement mechanisms (Ethereum, Bitcoin, PayPal, wiretransfer, etc.)
Usage of layer 2 technologies such as side-chains or statechannels3 © 2021 MOBI — FSSC Technical Specifications© 2021 MOBI — FSSC Technical Specifications 4

Glossary of Terms
AC

Accessor

Access Certificates (ACs) are documents that enable aparticular entity to access a particular endpoint in the network’s
data layer.
An entity is an Accessor if it attempts to access a resource’s URI
endpoint. An Accessor may need to go through security andauthentication processes in order to access said endpoint.
A list that specifies entities that are allowed to access aparticular resource.

Allow List

A list that specifies entities that are allowed to access aparticular resource.

Block List

A list that specifies entities that are not allowed to access aparticular resource.

Blockchain

Data Host

Data Owner

DBC

A growing list of records, called blocks, that are linked using
cryptography. Each block contains a cryptographic hash of theprevious block, a timestamp, and transaction data (generally
represented as a cryptographically secure tree structure suchas a Merkle tree). Examples of blockchain software platforms
include Ethereum and Hyperledger.

DBC (Cont.)

Host) is allowed to serve a particular type of data from a
specific URI.

DID

W3C Decentralized Identifier (DID) represents a globally unique
identifier that can be resolved to a DID Document, or dereferenced on a specific distributed ledger network, much like a
URL on the Internet.

DID Document

A DID Document is a simple text document that describes how
to use a specific DID. Each DID Document may contain at least
three things: proof purposes, verification methods, and service
endpoints. A DID Document can specify that a particularverification method, such as a cryptographic public key or apseudonymous biometric protocol, can be used to verify a proof
that was created for the purpose of authentication. Service
endpoints enable trusted interactions with the DID controller.
This document specifies a common data model, format, andoperations that all DIDs support.

DLT

A Data Host is an entity that stores data and is trusted withauthenticating requests to access and distribute the data as
needed.
The Data Owner is the owner of a particular piece of data. Thisowner is usually the same entity that generated said data
(referred to as the Data Generator).

Data Bucket

Distributed Ledger Technology (DLT) enables consensus
regarding the state of replicated, shared, and synchronizeddigital data widely spread across multiple sites, countries, andinstitutions. A peer-to-peer network is required as well as
consensus algorithms to ensure replication across all nodes isachieved. Blockchains are the most common and well-known
example of DLT. General practical byzantine fault tolerantsystems fall under this category as well.
A logical data abstraction for a persistent data store. Data
written to a Data Bucket can be used repeatedly over time.

The Data Host Bootstrap Certificate (DBC) is a certificate
providing cryptographic proof that a particular entity, or Data

5 © 2021 MOBI — FSSC Technical Specifications© 2021 MOBI — FSSC Technical Specifications 6

Glossary of Terms
Data Stream

EC

EID

A logical data abstraction for data buffers. Acts as an
ephemeral “stream” of data and persists for a set period oftime in the network until it is purged within the online systems.
Afterwards, it is moved to nearline data systems, then ultimately
sent to offline data systems.
An Entity Certificate (EC) is the certificate that represents all ofa particular entity’s network-level information and metadata.
This includes, but is not limited to, identifiers about who they
are, the URIs to delegate trust to, and their public keys. An EC isalways paired with a corresponding EID.

ISO
Identity

KV Store

An Entity Identifier (EID) is a unique alphanumeric string thatuniquely identifies any entity within the system’s network
described in this document.
KYC

EntityFloorplan Audit

Floorplan
Lending/Financing

GPC

An entity such as a vehicle, corporation, or individual, is a
network participant that interacts with the system byreading/writing data, enforcing permissioning, or otherwise
supporting the network in a particular manner. An entity isidentified using an entity certificate anchored within a
distributed ledger.
The primary purpose of a floorplan audit is to reconcile theinventory used as collateral for the floorplan financing to
reduce the lender’s risk.
Floor plan financing is a revolving line of credit that allows theborrower to obtain financing for retail goods. These loans are
made against a specific piece of collateral (a vehicle or otherasset, for example).
Group Permission Change Certificates (GPCs) are certificatessigned by a data owner, prompting a Data Host to change thepermissioning information of the group.

7 © 2021 MOBI — FSSC Technical Specifications

Network

Node

Obligor/Obligee

International Organization for Standardization.
Identity is a combination of one or more unique identifiers
having metadata associated with them. Identity metadata
consists of certificates such as verifiable credentials (per theW3C definition) and other non-verifiable data objects
associated with the unique identifier(s).
A Key-Value Store (KV Store) is a system that stores key- value
pairs. The key is used to obtain access to the value in a specificway. Distributed KV stores are KV stores spread across multiple
machines and can effectively maintain a consistent global
state.
Know Your Customer (KYC) is the process of verifying theidentity, risks, and other pertinent information associated with acustomer before initiating a business relationship.
A group of entities that all participate in a digital system with a
specific goal in mind. For example, a group of entities thatparticipate in a distributed ledger such as Ethereum would beconsidered a network.
A node is a computer connected to other computers which
follows rules and shares information. A large number of nodes ismeant to provide network availability and prevent collusion
attacks.
An obligor is a person or entity who is bound to another bycontract or other legal procedure. Conversely, an obligee is aperson or entity to whom another is bound by contract or otherlegal procedure.

© 2021 MOBI — FSSC Technical Specifications

8

Glossary of Terms
OEM

Personally Identifiable
Information (PII)

RC

Role

SSL

TLS

Trust Anchor

UUID

An Original Equipment Manufacturer (OEM) is an organizationthat makes devices from component parts either madeinternally or sourced from other organizations. In the context of
this document, this is generally a vehicle manufacturer.
PII is any information that (1) identifies or can be used to
identify, contact, or locate the person to whom suchinformation pertains, (2) has identification or contact
information of an individual that can be derived, or (3) is or
might be directly or indirectly linked to a human being.
[ISO/IEC 29100:-1]
Revocation Certificates (RC) revoke AC permissions if the AC
has not expired automatically.
Roles regulate creation of and access to data contained within
the network.
(Secure Sockets Layer) is the standard security technology forestablishing an encrypted link between a web server and abrowser. This link ensures that all data passed between the web
server and browsers remain private and integral.

URI

URL
Verifiable Credential

Waterfall Structure

Uniform Resource Identifiers (URIs) ensure that a named URI will
always point to the same resource it was assigned to. This
example is similar to the addressing system on many blockchain
platforms and represents one way to implement a URI.
A specific type of URI referencing web resources.
A verifiable credential is a tamper-evident credential that has
authorship that can be cryptographically verified. Verifiable
credentials can be used to build verifiable presentations, which
can also be cryptographically verified. The claims in a credential
can be about different subjects.
Waterfall payment structures require that higher-tiered creditors
receive interest and principal payments, while the lower-tiered
creditors receive principal payments after the higher-tiered
creditors are paid back in full. Debtors typically structure theseschemes into such tranches to prioritize the highest-principalloans first because they are also likely the most expensive.

The Transport Layer Security protocol is the successor of SSL
and aims primarily to provide privacy and data integrity
between two or more communicating computer applications.
Administrator for users and roles. On/Off-boarding of entities isfacilitated by the network governance in Section 6.
Universally Unique Identifiers (UUIDs) are unique identifiers thatare associated with pieces of digital information and can beused to address and identify each one.

9 © 2021 MOBI — FSSC Technical Specifications© 2021 MOBI — FSSC Technical Specifications

10

Full access to this Standard and other MOBI Standards are available to MOBI members.
If you are not part of the MOBI community and would like to become a member, please fill out our"Membership Inquiry Form" at dlt.mobi/join.
Members gain access to standards, working groups, and many other benefits. Join us in building
the New Economy of Movement!
If you have any questions regarding the MOBI FSSC working group, please email FSSC@dlt.mobi.

dlt.MOBI@dltMOBI

MOBI@dltMOBIFSSC@dlt.MOBI