## 5 Proposed Solution
### Change Ownership Detailed  
The smart= part has its identity properly enrolled in the blockchain, so its SE can be used to validate transactions in the system issued by anyone with NFC access to the part. For this reason, the physical owner has to confirm all the transactions performed by the smart part with their own identity. The ownership change of a smart part is the following: the receiving organization employs the SE to propose the ownership change that must be confirmed through a second transaction in the SCM. Therefore, an ownership change is considered valid if (1) it is signed with the part secret key, providing proof of the physical presence of the specific part, and (2) it is confirmed by the receiving organization, providing non-repudiation guarantees on the future owner of the part.  
Here follows a detailed explanation of the two-step transaction, which is illustrated in Figure 2. Each part has the following security variables associated:  
* Owner: represents the organization in the supply chain currently holding the part.
* Owner-proposed: represents the partner that has to confirm with a second transaction to become the new owner of the part.
* Challenge: random number.
* Challenge-proposed: next random challenge number.  
These variables are required to ensure a secure ownership exchange of the part between authorized SCM organizations, avoiding prediction attacks and delay attacks defined in Section 7.2. When a new actor wants to acquire ownership of a part in the supply chain, they proceed by proposing an ownership change as follows (orange arrows in Figure 2):  
1. The new owner generates a new secret random number (Secret) to be used as \"Challenge-proposed\".
2. The actor prepares a non-signed transaction (raw transaction), proposing a change in ownership, ProposedOwnershipChange. The raw transaction contains the part ID, the future owner, the current challenge \"Challenge\", and the secret random number as the proposed challenge.
3. The raw transaction is sent to the part through NFC and is signed by the SE, which requires physical access to the smart part.
4. The signed transaction is published on the blockchain. The signature confirms that this action was prompted by the current owner of the part. Another consequence of this is that the proposed challenge is publicly disclosed and is not secret any more.
5. The blockchain system validates the transaction by checking (i) that the current challenge number corresponds to the last challenge stored in the SCM for that specific part, \"Challenge\", and (ii) that the part signature is authentic.
6. Once the transaction is validated, the security variables \"Owner-proposed\" and \"Challenge-proposed\" are updated.  
At this point, any supply chain partner with access to the part could have submitted this transaction. Therefore, the changes produced in the system so far are not binding and must be validated by the receiving organization to have guarantees of robustness and non-repudiation in ownership change. Consequently, the next actor in the supply chain, which is indicated as \"owner-proposed\" in the security variables, accepts the ownership change with the following steps (blue arrow in Figure 2):  
The new owner creates a blockchain transaction, AcceptOwnershipChange, attaching the part ID and newly published value currently labeled as \"Challenge-proposed\".  
The blockchain verifies (i) that the trigger is a member of the organization currently stored as \"Owner-proposed\" and (ii) that the \"Challenge\" value in the transaction corresponds to what is stored as \"Challenge-proposed\".  
Once the transaction is accepted, the security variables are updated to store the proposed values as Owner and Challenge.  
The steps presented to propose and accept an ownership are repeated every time the part is sent/received by a partner in the supply chain. With this chain of events, the system can guarantee proper traceability of the part and non-repudiation of the physical ownership by the supply partners.