## 3 Related Work
Once it is identified, a new block is uploaded to the blockchain, the tag's identification is modified, and the hash of the new identification is uploaded to the blockchain. At the end, the final user can identify the tag using the blockchain and trace its origin and path back. However, anyone with access to the tag can extract the secret credentials and clone it, not only the only authorized entities, because the tag answer is only protected with a random bitwise rotation between 0 and 96. Nevertheless, the problem of [PERSON] et al. [17] is resolved in the solution presented by [PERSON] et al., LBRAPS [16]. Their protocol achieved mutual authentication and alsothe establishment of a session key between the tags (Ts) and the supply chain node (S). The work is quite novel because the tags themselves can authenticate S and the reader (R). Additionally, the solution is secure against diverse attacks like replay attacks. To achieve this, the tag stores its secret IDt, unique for each tag and the identifications of the reader and of the supply chain node, IDr and IDs, respectively. Also, the tag compares each received message's timestamp with the current time to avoid a replay attack. The solution is presented in the scenario of a single organization (department), a single reader, a single supply chain node, and a single tag. Finally, the authors claim that LBRAPS can also be applied in a distributed system, i.e., for various departments, similar to [PERSON] et al. 's protocol [17] without giving further details. However, LBRAPS has key differences with [PERSON] et al. 's protocol [17] that make it not applicable in the same way in distributed systems. LBRAPS requires the tags to know the IDs and IDr of all the S and R in the system, which is unfeasible and risky for a reduced memory tag. Also, in LBRAPS, the readers need to know the secret IDt of all tags that they are going to communicate with beforehand, which requires a delicate system to distribute these sensible data. These two facts make the solution of [PERSON]. [16] hardly applicable to distributed systems. On the other side, standard QR codes provide virtually no protection against copying. Efforts have been made to enhance these structures with anti-cloning features such as adding digital watermarks in QR code [34] or including copy detection patterns [35], but all these techniques present an accuracy that varies highly based on printing and scanning calibration, which makes them hard to implement in a real-world scenario. Another possible solution to enhance the link between a physical object and its cyber representation is the usage of physical characteristics that can uniquely identify an item. For example, DustIdentity [36], which proposes a Diamond Unclonable Security Tag, is a coating made out of diamond nanocrystals that can be registered as a unique fingerprint and thus used as an item identifier. This type of solution provides strong identification guarantees but lacks embedded computational capabilities to enhance the supply chain security. Our research presents a different technological approach to this problem, creating an easy-to-operate and easy-to-implement solution that avoids the need to trust stakeholders or external parties for authentication. In our approach, the tags use high-performance asymmetric cryptography ECDSA, which avoids the possibility of cloning the assets. Also, every ownership transference of the asset is not just recorded in the blockchain but also the blockchain itself verifies the package and the new owner before performing the digital change in ownership, which detects any misuse. This provides complete transparency and highly increases trust in blockchain information. Finally, we implement our solution in a real privacy-preserving blockchain that avoids stakeholders accessing information that is not relevant to them.