Manufacturer EPCIS 2.0 Resolver for DSCSA Phase 3 Unit-of-Use Verification
The dose is already tagged. What is missing is the parent it came from.
Hospital pharmacies have been putting RFID tags on individual vials and syringes for over a decade. Kit and tray management systems do it every day: a technician tags an item as it enters inventory, and from then on the shelf reads itself. That problem is solved, and it is solved by more than one vendor. Anyone who tells you unit-of-use items are unserialized has not looked inside a hospital pharmacy recently.
What none of that establishes is where the vial came from. A tag applied downstream carries an identity the hospital invented. It ties the vial to the hospital's own record. It does not tie the vial to the manufacturer's, because there is no aggregation event connecting the two - and there is no aggregation event because the sealed box the vial came out of, the unit of sale that DSCSA actually serializes, arrives carrying a printed 2D barcode and, in almost every case, no RFID tag at all.
The gap is not that unit-of-use is unserialized. Unit-of-use is serialized all over the country.
The gap is that unit-of-use is unaggregated, and it is unaggregated because the unit of sale carries no RFID parent for the child to point at. No parent tag at the manufacturer means no manufacturer-published parent-child record, which means nothing survives the moment the box is opened.
Downstream tagging tells you what is on your shelf. Manufacturer aggregation tells you what the manufacturer put in the box. Only the second one is provenance.
The patient safety case for unit-of-use tracking is real, and it is routinely overstated. It is worth being precise, because an evaluator who catches the overstatement discounts everything else on the page.
The figure usually quoted alongside that - that roughly one in ten manually prepared IV medications involves an error - comes from a five-hospital observational study of 1,679 doses published by Flynn, Pearson, and Barker in 1997. It is correctly sourced. It is also nearly three decades old, predating widespread barcode verification at the point of preparation and modern IV workflow management systems, and it needs two more qualifications before it means anything for RFID:
So the honest claim is narrow and it is still worth making. Unit-of-use RFID addresses the wrong-item-selected subset, not the wrong-volume-drawn majority. Within that subset it does something no other control does: it checks identity in bulk, contactlessly, without orientation or line of sight, and against the manufacturer's own aggregation record rather than against a label printed downstream.
ECRI recommends gravimetric verification, and we agree with them. Gravimetrics and unit-of-use identity verification are complementary controls addressing different halves of the same problem. Anyone presenting one as a substitute for the other is selling.
A hospital pharmacy receives a shipment of injectable medication: 20 boxes, 10 syringes per box, 200 doses. Under DSCSA the 20 box serials are verified against the advance ship notice. Verification passes. The boxes go to the shelf.
Over the following week, technicians open boxes as needed and place individual syringes into dispensing bins. By mid-week the shelf holds loose syringes drawn from a dozen different boxes. If one of those boxes was compromised in transit - tampered with, temperature-excursioned, or substituted - those ten syringes are now indistinguishable from the 190 legitimate ones. No gravimetric check catches that, because the volume is correct. No downstream-applied tag catches it, because the tag says only what the hospital said about it.
With a manufacturer-established parent, every syringe resolves to the aggregation record for the box it was packed in. The ten items from the suspect box are identified by which parent they belong to, not by which shelf they ended up on.
The pharmaceutical industry has relied on barcodes for decades. GS1's Sunrise 2027 Initiative is focused on retail and grocery, moving from one-dimensional to two-dimensional barcodes at the point of sale. It does not address pharmaceutical packaging or unit-of-use drug tracking. For pharma, barcodes face limitations that RFID does not.
| Capability | 2D Barcode | RFID (TDS 2.3) |
|---|---|---|
| Serialized identity per item | Possible, but rarely done on syringes or vials | Yes |
| Lot number and expiry in the carrier | Possible, but rarely done on syringes or vials | Yes |
| Read without line of sight | No - must see the label | Yes - reads through packaging |
| Bulk read (entire box at once) | No - one at a time | Yes - hundreds of items per second |
| Manufacturer resolver hostname in the carrier | No - requires a directory lookup | Yes - SGTIN++ embeds the domain |
| Works on small-form items (syringe barrel) | Difficult - label space required | Yes - tag embeds in cap or barrel |
| Readable during sterile compounding | Requires handling and orientation | Yes - no contact, no orientation needed |
For pharmacy IV preparation, this is the difference between a workflow and a bottleneck. A technician pulling five syringes for a compounding order can have all five checked against the manufacturer's aggregation record before touching any of them. No scanning, no orienting labels, no one-at-a-time handling.
In DSCSA Phase 2, an SGTIN-96 tag contains a GTIN and a serial number and no indication of where to verify the item. To look up aggregation data you need a central directory or prior knowledge of the manufacturer's systems. That is a bottleneck and a single point of failure.
GS1 TDS 2.3 SGTIN++ tags embed the manufacturer's resolver hostname directly in EPC memory. When a pharmacy scans a tagged box, the tag itself says "resolve me at epcis.cc." Another manufacturer's tag says "resolve me at dosetrace.org." No directory. No intermediary. The tag is the directory.
This mirrors how the internet itself works: decentralized, manufacturer-owned endpoints that any party can query directly. It is what makes multi-manufacturer, unit-of-use verification scalable.
It also creates a problem that has to be named. If the tag says where to verify it, the tag nominates its own auditor. An adversary who controls both the tag contents and a web host does not need to defeat anything else on this page: they encode a hostname they operate, publish whatever record they like at it, and a conforming reader dutifully reports a clean verification. Handling that is covered further down, under trust anchoring.
The registry key is gs1:epcisRepository, per the GS1 Web Vocabulary. Earlier revisions of this page and of the accompanying disclosure used gs1:epcis, which is not a conformant link type. This resolver accepts the request regardless of the value supplied.
Click the URL below to retrieve a real EPCIS aggregation for one of the demo boxes. The link is a working GS1 Digital Link - the same URL pattern that scanpads and RFID readers use against this resolver.
https://epcis.cc/01/30376045223300/21/17724760500010655?linkType=gs1:epcisRepositoryIn a functioning DSCSA Phase 3 supply chain, no single entity controls all product data. Each manufacturer hosts their own EPCIS resolver. The SGTIN++ tag tells every reader in the supply chain exactly where to look.
This resolver serves products whose tags encode epcis.cc as their hostname. Other manufacturers' products resolve to their own domains - for example, dosetrace.org. A distributor or pharmacy receiving a mixed shipment from multiple manufacturers can verify every item seamlessly: each tag self-directs to the correct resolver. No central registry, no single point of failure, no dependency on a third-party data broker.
This is how pharmaceutical traceability should work: manufacturer-owned data, universally accessible, verified at every step from the production line to the patient's bedside.
Every RFID chip carries two distinct identifiers. The EPC - the GTIN and serial number you have seen all over this page - is programmed into the tag. It is the logical identity, the part DSCSA tracks. The chip also carries a TID, a per-chip serial number written into the silicon during semiconductor fabrication. On the production-grade parts a supply chain actually buys, the TID is locked at the factory and an ordinary field programmer cannot rewrite it.
This resolver's EPCIS aggregation records publish the TID alongside each child item:
When a scanpad, conveyor, or bedside reader sees a tag, it reads both values, looks up the manufacturer's record, and compares the TID.
Comparing a value read off a tag against a value fetched from a server is a plaintext equality check. Nothing in the exchange is secret and nothing is challenged, so the check cannot distinguish the chip that legitimately holds the value from any device willing to report the same string. It is not authentication, and this page does not claim it is.
Real cryptographic tag authentication exists and looks different. ISO/IEC 29167 defines air-interface security services for RFID. EPC Gen2v2 defines the Authenticate and Challenge commands. Products like NXP UCODE DNA implement challenge-response against a key that never leaves the chip and never crosses the air. That proves possession of a secret. A TID comparison proves that something in front of the antenna is willing to repeat a number the manufacturer published on the public internet.
Gen2 parts advertising a writable TID bank are also offered for sale by specialty vendors in single quantities with a matching writer, at roughly ten dollars, in at least one case marketed explicitly for anti-counterfeiting bypass analysis. We cite those as vendor listings, not as something we have tested ourselves. The logical point above does not depend on them: an emulator that simply reports the expected TID was always sufficient.
Because the attack stops amortizing, and attacks that do not amortize do not pay.
Supply chain "decommissioning" exists to stop counterfeiters from reusing valid serial numbers. The logic: if a real item with serial X has already been consumed, a later scan claiming serial X must be a clone - but you only catch the clone by maintaining a centralized "decommissioned" list and checking it on every scan. Every reader, every pharmacy, every distributor phones home.
Publishing TIDs alongside EPCs changes what that registry has to be for. The volume attack it was built to stop - one stolen serial, reproduced ten thousand times - now fails on the first read without consulting anyone, because the counterfeiter cannot produce ten thousand correct TIDs. What is left for a central registry is the targeted case, and a central registry was never a good answer to that one either.
In practice the pharmacy fetches the manufacturer's EPCIS record once, when the box arrives at the dock, and caches it. Every scan after that, including the bedside check, is a local comparison. No network round trip, no waiting on someone else's API while a nurse holds a syringe. That property comes from manufacturer-published aggregation and a resolver the tag can name, not from anything about the TID, and it holds regardless of how the TID discussion above resolves.
The weakness named earlier is the sharper one: the tag nominates its own auditor. An adversary who controls the tag contents and a web host skips the TID question entirely. Three measures answer it, and any serious deployment needs at least one:
.well-known endpoint and trusted because it was found there proves only that the host agrees with itself.The signature establishes who wrote the record. The directory establishes who was entitled to write it. Together they are what turns this resolver pattern from a convenience into a control.
The combination described above - RFID TID pairing, an EPCIS 2.0 aggregation extension that publishes TIDs alongside child EPCs, GS1 Digital Link resolution via manufacturer-encoded hostnames on SGTIN++ and SSCC++ tags, local caching at the receiving party, and point-of-administration verification - was published as a defensive technical disclosure on June 30, 2026.
A version 2 erratum was published on July 27, 2026. It withdraws the original document's claim that a counterfeiter "cannot produce a tag with an arbitrary TID," restates TID pairing as the economics control described above, adds the self-nominated-resolver problem and its trust-anchoring answers, and corrects the GS1 link type. No disclosed method was withdrawn or narrowed; the prior-art dedication stands as published on June 30, 2026. The original version remains archived at the anchors below.
The full disclosure, including the erratum, is available at:
The methods, systems, and combinations described in the disclosure are dedicated to the public technical record. Any party in the pharmaceutical supply chain, or any other supply chain where item-level verification matters, is free to implement, deploy, and use the described techniques without seeking permission or paying a license fee. The disclosure exists specifically to prevent any party from obtaining patent rights that would block industry adoption of the pattern this resolver helps demonstrate.
Independent date verification