What is CARO?

About this document

Here we explain some basic concepts about our CARO app, Spherity's Credentialing Service for Authorized Trading Partners(ATP), to help you understand its purpose and main functionalities.

If you are looking for a high-level overview of CARO, download our info brochure or visit the website.

What are identifiers & credentials in CARO?

Identifiers & credentials are stored in your CARO digital wallet. They provide the basis for all of CARO's services to you.

You may have one or more Enterprise Identifiers. These are, in fact, so-called decentralized identifiers (DID). Each is unique and assigned to a specific enterprise of yours that has registered with CARO. Each identifier holds its own set of credentials, more specifically, these are so-called verifiable credentials that enable automated information exchange between you and your counterparty, i.e. the trading partner with whom you are in business.

To satisfy DSCSA ATP requirements, you require two credentials:

1. The Identity Credential identifies your enterprise (not you as a person!).
2. The DSCSA ATP Credential represents your enterprise's ATP status as defined by DSCSA.

Both of these credentials are assigned to the same Enterprise Identifier because the ATP Credential depends on the presence of a valid Identity Credential. Underlying this is basically a 2-step due diligence process per Enterprise Identifier.

Download a brief overview of the information needed to obtain these credentials.

So, what does my CARO Enterprise Account do for me?

Your CARO Enterprise Account is your gateway to pass credential details to your VRS provider. Your VRS will then present these details to your counterparty for verification. Even though only ATP credential information is exchanged in VRS interactions, both credentials (Identity and ATP) must be valid for a VRS transaction to be successful. All this happens behind the scenes without any need for you to intervene. CARO's system is based on the concept of the trust triangle.

For example, imagine you want to find out whether you can sell a returned box of drugs. This means you will need to enquire with the manufacturer whether the box has really been produced by them. To do so, you must prove to the manufacturer that you are allowed to trade pharmaceuticals, that is, you must demonstrate your valid ATP status as defined by DSCSA. CARO, in collaboration with your VRS, allows you to do this in a fully automated manner once registered with us. The manufacturer, in turn, will need to prove to you that they are indeed a legitimate manufacturer. They use the same mechanism as you to do so by sending their valid ATP status through their VRS to you.

What are VRS Events in CARO?

A full successful VRS messaging roundtrip for a product enquiry, i.e. Product Identifier (PI) verification, involves:

1. you transmitting PI information to your VRS (for example through a product scanning app);
2. your VRS sending this PI information in combination with your ATP status (as recorded in CARO) to the manufacturer's VRS;
3. the manufacturer transmitting the response to their VRS essentially confirming or denying that the product stems from them;
4. the manufacturer's VRS sending this response in combination with their ATP status (as recorded in CARO or another compatible service) to your VRS
5. you receiving the PI verification response

The illustration above roughly depicts this flow.

It is important to understand that in this information exchange CARO is solely involved in providing the ATP status. Thus, what we call VRS Events in CARO refers only to the success or failure of the credential processing between CARO and your VRS, not the entire VRS messaging roundtrip.

What do the VRS Event statuses mean?

Note that this overview focuses on the status of the VRS Events in your own CARO Enterprise Account. See below for explanations of the counterparty status.

What are VRS Reports in CARO?

We bundle CARO's VRS Events to VRS Reports. This is possible because VRS Events that belong to the same messaging roundtrip are assigned the same unique identifier, a so-called correlation UUID. Thus, CARO VRS Reports make it easier for you to trace all interactions of your CARO Enterprise Account with your VRS that belong to a specific product enquiry.

What do the VRS Report statuses mean?

Glossary

A

B

C

D

E

J

O

P

T

Term

What is it?

Trust Triangle

There are three entities in a Verifiable Credential (VC) ecosystem: Issuer, Holder, and Verifier. The issuer generates and bestows the credential; the holder is the entity about and/or for whom the credential is issued; and the verifier checks claims within a credential. The latter trusts the legitimacy of the issuer but does not need to trust the holder thanks to the verifiability of the holder's VC. Dive Deeper - W3C Ecosystem

U

V

Term	What is it?
Verifiable Credential (VC)	Credentials are sets of claims that identify a particular entity or verify a specific attribute or qualifications such as driver's license, enterprise ID, and university degrees. W3C Verifiable Credentials provide a mechanism to express these sorts of credentials on the web in a cryptographically secure, privacy-respecting, and machine-verifiable way. Dive Deeper - W3C VC Use Cases
Verifiable Data Registry (VDR)	A system or network that facilitates the creation, verification, updating, and/or deactivation of DIDs and DID documents, and even verifiable credentials. Examples for VDRs include distributed ledgers, decentralized file systems, databases of any kind, peer-to-peer networks, and other forms of trusted data storage.
Verifiable Presentation (VP)	A digital presentation is created from VC data in order to be shared with a verifier. A VP is a tamper-evident digital presentation that can be cryptographically verified to ascertain the trustworthiness of the presented data. Certain VP types might contain data that is synthesized from, but does not contain, the original verifiable credentials (for example zero-knowledge proofs). Dive Deeper - W3C VC Data Model - VP
Verification Router Service (VRS)	VRS refers to a third-party routing system to send product information back and forth between pharmaceutical supply chain actors. Generally, the manufacturer holds all the required product identifier information. Upon information requests from downstream supply chain partners, e.g. dispensers or wholesalers, the manufacturer releases the requested information. This exchange is facilitated by VRS. Hence, within CARO a VRS can act on behalf of the VC holder (when generating a verifiable presentation) or the verifier (when verifying a verifiable presentation). Dive Deeper - HDA Saleable Returns Pilot

W