Description: Decision-makers are shaking up supply chains using reliable sensor data. In this guide, we've pulled together five great architecture patterns that mix IoT telemetry with blockchain. We're sticking to the most recent standards (think EPCIS 2.0, W3C VC 2.0, and IETF RATS/EAT) along with some exciting platform updates coming in 2024-2025 (like Ethereum Dencun/EIP-4844 and 5G RedCap). Oh, and we’ve thrown in some useful implementation checklists and a few common traps to avoid along the way.

Combining SCM Blockchain with IoT Sensors: Architecture Patterns

If you tried this out three years ago and faced problems like high costs, scaling difficulties, or trust issues--trust me, you’re not alone. A ton has changed since that time:

• Ethereum's Dencun upgrade on March 13, 2024, made waves by slashing Layer-2 data costs thanks to blob transactions (EIP‑4844). This tweak finally made it affordable to adopt strategies like “hash every pallet” or “anchor every batch” on a bigger scale. Want to dive deeper? Check it out on ethereum.org.
• On May 15, 2025, Verifiable Credentials 2.0 officially hit the status of a W3C Recommendation. This new update brings a cool way to handle compliance, track chain-of-custody, and verify devices across various ecosystems. It's definitely a game-changer! For all the details, take a look at w3.org.
• GS1 EPCIS 2.0 is now all the rage for managing event-level supply-chain data. It comes loaded with features like JSON‑LD, REST APIs, and built-in sensor extensions, making it super helpful for connecting telemetry to business events. If you want to learn more, head over to gs1.org.
• With 5G RedCap (Release 17, also called “NR‑Light”), you can enjoy mid-bandwidth, budget-friendly IoT connectivity that has a longer battery life. The first industrial trials on private 5G kicked off in 2025, and they're proving to be incredibly useful for factories and logistics hubs. Get the lowdown at 3gpp.org.
• Just a heads up! Regulatory timelines are on the horizon. Starting February 18, 2027, EU Battery Passports will be mandatory for electric vehicles, light-duty transport, and industrial setups over 2kWh. Meanwhile, the U.S. is rolling out DSCSA interoperability enforcement in phases, which will continue up until late 2025-2026. For the full scoop, check out batteryregulation.eu.

Here’s a quick rundown of the key components and five deployable patterns, along with all the details you can share with your architects.

The modern building blocks (2025-ready)

1) Device identity and trustworthy telemetry

• The IETF RATS architecture sets the stage for remote attestation with a few important players: the Attester, Verifier, and Relying Party. On top of that, the EAT (RFC 9711, April 2025) standard makes it super easy for devices to sign claims--think firmware hashes and keys-in-TEE--using CBOR/JSON tokens. This method really helps to connect sensor readings to the device's current state. If you're curious to dive deeper, check it out here.
• If you’re exploring SIM-based roots of trust, take a look at GSMA's IoT SAFE. It allows you to use (e)SIM/iSIM as the on-device HSM for mutual TLS and key protection. This is a great fit for those wide-area devices that come packed with carrier modules. You can learn more about it here.
• From a consumer or retail point of view, Matter devices have these cool Device Attestation Certificates that are tied to the CSA Distributed Compliance Ledger (DCL). Think of it as a blockchain-powered registry that you can check out in gateways or clouds. If you want to dive deeper into it, you can read more here.

Practical tip: It’s smart for gateways to check the EAT as soon as they get data. Create a short-lived Verifiable Credential that states, “this reading came from a device in a known-good state,” and then discard the raw EAT to minimize the risk of exposing any personally identifiable information (PII).

2) Event semantics that business systems understand

• GS1 EPCIS 2.0 provides a great framework that covers the essentials: the “what/when/where/why/how” of supply chain events, including things like ObjectEvent and AggregationEvent. It even allows for sensor measurements to be included right within the events, plus it supports JSON‑LD, GS1 Digital Link URIs, and a REST API for capturing and querying data. This really helps transform telemetry into meaningful supply-chain events. You can dive into it here: (gs1.org)
• And don’t forget to grab the GS1 artifacts like OpenAPI, JSON Schema, and SHACL. These will help your developers validate those payloads before they join the chain. Check them out here: (ref.gs1.org)

3) Integrity and credentialing

• Take a look at W3C Verifiable Credentials 2.0! It's a game-changer for bundling all kinds of attestations, like temperature compliance certificates, operator SOP compliance documents, machine calibration proofs, and even device health statuses. What’s really cool is that VC 2.0 has officially been recognized as a W3C Recommendation, which means we now have standardized Data Integrity/JWT/COSE cryptosuites. If you want to dive deeper, check out the details here.

4) Ledgers and data planes that fit the job

• Public/EVM stack: We’re diving into the Ethereum mainnet for settling transactions, using Layer‑2 rollups to ramp up our throughput. We’ll also tap into decentralized availability layers like Celestia, which is set to launch on October 31, 2023, to keep data costs low for those rollups. On top of that, we’ll be implementing blob transactions (EIP‑4844) to bundle up groups of hashes or merkle roots, holding onto those blobs for around 18 days. You can find more details on this here.
• Enterprise/consortium: When it comes to sharing regulated data, we really prefer Hyperledger Fabric 2.5 LTS since it comes packed with features like private data collections and the PurgePrivateData API. However, if we’re looking for EVM privacy groups or permissioned EVM networks, we turn to Hyperledger Besu (with QBFT) and Tessera. You can find all the details here.
• Cross‑chain: We're leveraging Chainlink CCIP for bridging tokens and messages, and it comes packed with some impressive safety measures--think Rate Limiting and a Risk Management Network that can quickly hit pause when something seems off. Plus, you can set limits based on each lane for smarter throttling. Check out the full scoop here.

5) Connectivity choices

• When it comes to mobile assets and industrial campuses, 5G RedCap makes things a lot easier. With its single-antenna design, you can expect less complexity in devices and some pretty solid data rates. For example, in Release 17, you're looking at around ~226/120 Mbps for download and upload speeds. And with Release 18's eRedCap, they're aiming for even more wallet-friendly options, hitting about ~10/10 Mbps. There have already been some cool private 5G RedCap trials in auto factories. If you're curious, you can check it out here.

Five deployable architecture patterns

Pattern 1 -- Cold-chain: sensor→EPCIS→VC→L2 anchor (for DSCSA/food/pharma)

When to Use

This approach is definitely worth considering if you’re looking for event-level traceability and dependable condition monitoring. It’s especially helpful when you want to keep things private or avoid the hefty costs of throwing all that raw data on-chain.

• Edge: The sensor node quickly signs an EAT using its device readings and firmware claims. After that, the gateway comes in to verify everything and converts this info into EPCIS 2.0 ObjectEvents, including sensor details like temperature or shock. (ietf.org)
• Credentialization: The gateway takes on the role of the Issuer and churns out a VC 2.0 “Temperature Compliance” credential for every batch or shipment. So, it could read something like “8±2°C maintained from SGLN X to Y,” tying back to those EPCIS event IDs. (w3.org)
• Chain anchoring:
  • Start by calculating the Merkle root using the EPCIS event digests and VC hashes from that day.
  • Next, submit that root to an L2, and make sure to use an EIP‑4844 blob to keep those fees nice and low. You'll want to store your EPCIS and VC payloads in an off‑chain bucket like S3, IPFS, or an EPCIS repository. Just a little tip: blobs get pruned after about 18 days, but don’t worry, your receipt stays official thanks to the transaction. (ethereum.org)
• Verification: Trading partners can snag the VC, verify the signature and status list, pull the associated EPCIS IDs through the API, and then re-hash everything to make sure it lines up with the on-chain root.

Why This Works Now

Alright, here’s the scoop: thanks to the new fee profiles after Dencun, it’s now actually doable to set up daily anchors for each route or 3PL. This really lines up well with the FDA's DSCSA, which is all about making electronic tracing as smooth as possible. And the best part? A lot of partners have deadlines that stretch all the way until 2025. You can find out more details about it here.

Implementation Notes:

• Be sure to use GS1’s OpenAPI/JSON Schema to weed out any poorly formatted EPCIS as they come in.
• When it comes to Fabric deployments, keeping private info, like customer PII, off the ledger is super crucial. Only store hashes instead. And don’t skip using PurgePrivateData to stick with data minimization practices. (hyperledger-fabric.readthedocs.io)

Pattern 2 -- EU Battery Passport/DPP pipeline

When to use: It's time to start gearing up for the EU’s 2027 battery passport and the broader Digital Product Passport (DPP) rollout. Or perhaps you’re interested in creating a strong transparency narrative, just like Volvo has done. (reuters.com)

• Identity: Assign GS1 Digital Link URIs to battery packs and all their parts, and keep tabs on them by dispatching EPCIS events throughout the stages of assembly, testing, shipping, and recycling. You can learn more about it here: (gs1.org).
• Credentials: Use VC 2.0 for tracking stuff like carbon footprints, recycled materials, and origins. Don’t forget to keep the revocation info fresh with a Bitstring Status List. If you want more info, check this out: (w3.org).
• Consumer/regulator views: How about generating a QR code that gives access to both a public view (no personal info involved) and a regulator view (with all the details)? Volvo's initial estimate for rolling out the battery passport is about $10 per car, which sounds like a reasonable starting point for budgeting. Take a look here: (reuters.com).
• Chain strategy:
  • Implement an enterprise chain like Fabric or Besu to facilitate data sharing between OEMs and their suppliers.
  • Regularly establish a public L2 anchor to provide tamper-evidence and assist with verification across various ecosystems.

Key Dates: Get ready! The battery passport is set to become a must-have starting February 18, 2027, for electric vehicles, light mobility solutions, and industrial uses with more than 2 kWh. It's a good idea to work your way back from your product's start of production (SOP) and try to launch at least one pilot project by mid-2026. Check out more details on this at (batteryregulation.eu).

Pattern 3 -- High‑volume telemetry rollups with DA offload

When to Use

If you’re working with high-rate sensors--like those that track vibrations, capture visual events, or use edge ML flags--and you want to set up auditable pipelines without breaking the bank on L1 costs, you’ve come to the right place.

• Ingest: First off, gather those gateway batch telemetry and crunch the numbers to calculate those rolling Merkle roots for each time window.
• Data availability: Next up, send batches over to a rollup that taps into Celestia for data availability. Celestia’s mainnet officially launched on October 31, 2023, and it’s really shaking things up for a lot of chains by providing budget-friendly DA. The network is already handling more throughput than it did at launch and is working smoothly with Arbitrum Orbit. Check out more details here.
• Settlement: Make sure to regularly set up checkpoints to Ethereum L1 (or you can go for a permissioned EVM if you want to keep your data private).
• Query: Finally, your app needs to gather up proofs from the DA data and double-check that everything matches with the L1/L2 commitment.

Why This Works

Thanks to the mix of DA decoupling and EIP‑4844, we're seeing a nice drop in the “cost per audit-proof.” This allows you to keep those hefty raw sensor blobs away from the execution chains while still making sure everything can be verified. For more info, head over to ethereum.org.

Pattern 4 -- Consortium EVM with scoped privacy + controlled public exposure

When to Use

So, here's the scoop: when you've got a bunch of companies teaming up but want to keep your trade secrets close to the vest, it's still really crucial to give public attestations for regulators and consumers.

• Network: We're all about Hyperledger Besu and QBFT in a Permissioned Access (PoA) setup, plus those cool Tessera privacy groups. This combo really helps us manage transactions between parties or smaller groups, allowing us to set specific price terms and tailor process parameters. If you want to dive deeper, take a look at the Hyperledger Besu documentation.
• Exposure:
  • Public: We keep it simple by sharing just hashes of EPCIS events, credential IDs, and a bit of metadata to avoid any bloat.
  • Cross-chain messages: We send out summaries to L2/mainnet via CCIP, but don’t worry--we’ve set some rate limits to keep the value-at-risk under control. Plus, there's a dedicated Risk Management Network that can step in and pause things if anything seems off. Curious to learn more? Check out the Chainlink docs.

Ops Guardrails:

• Go ahead and set the token and USD rate-limit settings for each lane. Don't forget to check the refill rates every three months to keep everything running smoothly.
• Make sure to log all cross-chain “curse/pause” events in your SIEM. You’ll want these handy for your incident response playbooks. (docs.chain.link)

Pattern 5 -- Attestation‑gated ingestion on private 5G/RedCap

When to Use: Campus Factories/Ports with Private 5G Want Device Health Checks at Line Rate

If you're hanging out in a campus factory or a port with private 5G, you're probably keen on tracking how your devices are doing in real time. That's where device health checks at line rate really come in handy:

• Continuous Monitoring: Private 5G lets you keep an eye on your device health all the time. This way, you can catch any issues early on before they snowball into bigger headaches.
• High-Speed Data Transfer: With a blazing fast connection like 5G, health checks can happen in a snap. This means you get instant feedback, so any necessary tweaks can be made right away.
• Low Latency Requirements: When your operations depend on quick responses, line rate health checks are the way to go. They’ll provide the low latency you need to keep everything running like clockwork.
• Scalability: When you start adding more devices to your network, having the ability to do real-time health checks is super handy. It helps you keep an eye on performance and makes sure everything runs smoothly and efficiently.

Simply put, if you're running private 5G at your campus factory or port, doing device health checks at line rate is a clever way to keep everything running smoothly and stay on top of your operations!

• Radio: Equip machines or pallet trackers with RedCap modems. Occasionally, or whenever they connect, these gadgets shoot out an EAT along with TEE/SE claims. The private 5G core makes sure everything runs smoothly: only devices labeled as “verified-good” can access the MQTT/Kafka topics. (3gpp.org)
• Data plane: After we’ve got those verified readings, they turn into EPCIS events. The gateway then whips up a VC, which proves that the data was “ingested from a verified device at time T.”
• Chain: Every hour, we batch-anchor each cell or line to L2 blobs. If a device fails its attestation or ends up getting quarantined later, we pull that VC.

Why This Works

RedCap makes everything much easier by reducing module costs and cutting down on complexity, and it also improves battery life when compared to full NR. Plus, EAT gives auditors a strong piece of evidence about the device's state for every reading. For more info, take a look at this link: 3gpp.org.

Implementation checklist (cut‑and‑paste for your PRD)

1) Identity and Attestation

• First things first, let's choose your attestation profile. Are we rolling with EAT JWT or CWT? It’s important to get those minimal claims sorted out, like the model, firmware hash, key provenance, secure boot status, and location (if needed). You can dive deeper into the details here.
• Now, let’s dive into the root of trust. Are we going with TPM/SE or (e)SIM through GSMA IoT SAFE? Don't forget to jot down the key provisioning process while it’s still at the factory. For more info, give this link a look: gsma.com.

2) Event modeling

• Stick with EPCIS 2.0 and use the ObjectEvent/AggregationEvent combo. Make sure to publish GS1 Digital Link URIs for your items, cases, and pallets. Don't forget to verify everything with the GS1 JSON Schema/SHACL. Lastly, set up your REST capture endpoints. (ref.gs1.org)

3) Credentials

• We're rolling out VC 2.0 to make sure we have batch-level compliance and operational attestations in place. Plus, we’re putting together a plan for status lists, including revocation and suspension. You can check it out here: (w3.org)

4) Choosing the Right Ledger

• If you're in a multi-party setup with sensitive info, definitely check out Fabric 2.5 LTS. It’s important to use private data collections, which are automatically created for each organization--think “votes/approvals.” And don't forget about PurgePrivateData to help you manage retention. You can dive into the details here.
• Need EVM support? Go for Besu! It uses QBFT paired with Tessera for those privacy groups. You can get all the specifics here.
• Want public audit trails? L2 with EIP‑4844 blobs is your best bet. And if you’re into rollups, consider using DA offloading through Celestia. There’s more info waiting for you here.

1. Cross-chain movement

• Take advantage of CCIP messages for stuff like “evidence summaries” and tokenized incentives. Also, don’t forget to set up per-lane rate limits and keep an eye on everything using the Risk Management Network. Check it out here: (docs.chain.link)

6) Connectivity

• In mobile and industrial environments, we're zooming in on 5G RedCap modules. We’ll also break down the entire eUICC/eSIM lifecycle (don’t forget to check out SGP.32) and explain how carrier onboarding comes into play. If you want to dig even deeper into the specs, head over to gsma.com.

7) Compliance Timing

• EU Battery Passport: We're looking at a pilot launching around mid-2026, with full production aimed for late 2026. This is all to hit that February 18, 2027 deadline.
• DSCSA: Make sure your pharma operations are aligned with the FDA’s phased exemptions rolling out between November 27, 2025, and November 27, 2026. The specifics will vary based on your company’s role and size, so keep that in mind. Plus, don’t forget to set aside some time to budget for that interoperable electronic exchange. You can find more info on the FDA website.

• Ingest:
  • The device shoots over data to the EAT (CWT), and then the Gateway does a quick check with the RATS Verifier to ensure everything's in order.
  • After that, the Gateway creates an EPCIS 2.0 ObjectEvent, which includes the sensor data. It also adds some JSON-LD context and double-checks that it aligns with the GS1 schema. (ref.gs1.org)
• Credential:
  • The issuer handles signing a VC 2.0 for “Shipment Temp Compliance,” which includes EPCIS URIs and a link to a Bitstring Status List. (w3.org)
• Anchor:
  • First up, calculate the Merkle root using those EPCIS+VC digests.
  • Next, send it over to L2 along with a blob (this is a cost-effective option, and it usually gets pruned after around 18 days); don't forget to pin those EPCIS files in your EPCIS repository and your data lake. (ethereum.org)
• Verify (partner/regulator):
  • First off, get that VC; take a look at the signature and status; tap into the EPCIS Query API; recalculate those hashes; confirm the L2 commitment; and if you want to keep things transparent, remember to post a brief recap on the mainnet every month.

Code Sketch (Hash/Anchor Loop):

Here's a quick rundown on how to set up a hash/anchor loop in your code. This trick can be super useful for managing different sections of your webpage or app.

Basic Structure

You could kick things off with something like this:

const anchors = document.querySelectorAll('a[name]');
anchors.forEach(anchor => {
  anchor.addEventListener('click', () => {
    const targetId = anchor.getAttribute('href').substring(1);
    const targetElement = document.getElementById(targetId);
    if (targetElement) {
      targetElement.scrollIntoView({ behavior: 'smooth' });
    }
  });
});

How It Works

1. Picking Anchors: We pull in all the tags that have a name attribute. This way, we end up with a nice list of possible anchors to use.
2. Adding Event Listeners: We’re going to attach a click event listener to each anchor. This means that whenever someone clicks on an anchor, we can respond to that action.
3. Finding the Target Element: When you click on an anchor, we grab the href value, chop off the #, and then use that to locate the matching element on the page.
4. Smooth Scrolling: Once we've confirmed that the target element is there, we gently scroll to it. This adds a pleasant touch to the user experience.

<a name="section1">Section 1</a>
<div id="section1">Content for Section 1</div>

<a name="section2">Section 2</a>
<div id="section2">Content for Section 2</div>

# 1) Validate EPCIS
epcis-validate --schema epcis-json-schema.json shipment-2025-07-21.json

# 2) Hash artifacts
jq -cS . shipment-2025-07-21.json | openssl sha256 > hashes.txt
jq -cS . vc-temp-compliance.json | openssl sha256 >> hashes.txt

# 3) Build Merkle root
merkleroot hashes.txt > root.txt

# 4) Post to L2 with blob (example CLI/pseudocode)
ethsend --to AnchorContract --blob "$(cat hashes.txt)" --root "$(cat root.txt)"

• Following Dencun, blobs are now operating on their own market, and it's great to see a bunch of Layer 2 solutions benefiting from some seriously reduced fees as we kick off 2024. This change makes daily or even hourly anchoring a lot more reliable compared to the chaotic swings we experienced back in the calldata days. So, it might be a good idea to plan your budget in batches or by day, instead of going event by event. (ethereum.org)
• RedCap is seriously a game changer! It provides solid cellular connectivity without breaking the bank on a full-NR modem BOM. There’s already been some impressive testing--Hyundai and Samsung ran trials on private 5G using RedCap for their factory and yard operations back in February 2025. Keep this in mind when you're having those chats with OT teams about negotiations. (samsung.com)
• Volvo shared that the costs for their battery passport operations are roughly $10 per vehicle when it comes to data management and operations. Keep this figure in mind as a top-end benchmark while you're fine-tuning your EPCIS automation. (reuters.com)

Security traps (and how to avoid them)

• “Signed junk” problem: Just a heads up--signed data is only as trustworthy as the device it’s coming from. It’s a good idea to enforce EAT verification at the gateway. If a device doesn't make the cut during attestation, put it in quarantine. And don’t forget to link every VC/Event to a verified EAT session ID to keep things organized. You can dive deeper into this topic here.
• Oversharing on-chain: It’s a good idea to steer clear of putting personally identifiable information (PII) and specific sensor values onto public chains. When using Fabric, make sure to treat those sensitive fields as private data. Only keep hashes on-chain. And if you ever need to clean things up, you can easily do that with PurgePrivateData. Curious to learn more? Check out the details here.
• Bridge risk: If you ever find yourself needing to move assets or messages between chains, it’s a smart move to use CCIP with those per-lane rate limits. Leverage the ARM/Risk Management Network to hit pause if anything seems off, and make sure you log those “curse”/pause events in your SOC. You can dive deeper into this here.
• Schema drift: To deal with schema drift effectively, make sure to secure your EPCIS contexts and versions. It's really important to validate everything using the GS1 JSON Schema/SHACL as soon as it comes in. You can check out the guidelines here.
• Credential sprawl: Consider publishing a Status List for revocations and make it a habit to rotate your keys regularly, all while keeping your DID/VC governance nice and clear.

Emerging best practices we recommend in 2025

• EPCIS first, chain second: Before you jump into anchoring, it’s crucial to normalize all telemetry as EPCIS 2.0 events. Picture the chain as an integrity plane instead of just a data warehouse. You can learn more about it here.
• VC 2.0 everywhere: Say goodbye to those old paper PDFs and endless vendor emails. It's time to transform them into signed Verifiable Credentials (VCs) for calibration, QA, and sustainability. With this shift, you can verify audits with just a click! Check out more details here.
• DA offload for heavy streams: If you’re diving into video or vision projects, don’t forget to use rollups with DA layers such as Celestia. Keep your attention on checkpoints. For more info, take a look at the blog here.
• Permissioned EVM for Collaboration: To make teamwork a breeze, consider using a permissioned EVM paired with occasional public L2 anchors for a touch of transparency. You can set up Besu QBFT and Tessera privacy groups to maintain confidentiality while still allowing for collaboration. Dive into the details here.
• 5G RedCap in plants/ports: When dealing with deep indoor and low-throughput scenarios, it's smart to leverage NB-IoT and LoRaWAN. Remember, not every situation needs a one-size-fits-all radio. And for RedCap, it’s crucial to sync up with your eUICC/eSIM (SGP.32) operations right from the get-go. You can find more details here.

A 90‑day rollout plan (what to do next quarter)

• Weeks 1-2: First things first, pick a pilot lane -- you know, one supplier to a plant to a distribution center. Get the GS1 Digital Link scheme up and running, and start crafting the EPCIS 2.0 event catalog.
• Weeks 3-6: Time to get that EAT moving on around 10 to 50 devices. Build yourself a nifty gateway verifier, set up the EPCIS Repository and get the REST capture going, and don’t forget to roll out that first VC 2.0. (ref.gs1.org)
• Weeks 7-10: Let’s kick off L2 anchoring with those EIP‑4844 blobs. Connect up those status lists and launch a verification portal for our partners to use. (ethereum.org)
• Weeks 11-13: If it’s needed, bring in the CCIP path with some rate limits; run a red-team tabletop to cover “pause/cursing” scenarios, and draft those SOPs so we know what to do. (docs.chain.link)
• Parallel: For products headed to the EU, it’s time to start on those DPP/Battery Passport data fields and QR flows. And for U.S. pharma, make sure to double-check those DSCSA data exchange milestones and see if our partners are all set. (batteryregulation.eu)

Final thought

There's no need to connect every single reading. Just focus on the main standards like EPCIS 2.0, VC 2.0, and RATS/EAT to make sure your data is easy to verify. When it comes to the integrity layer, it's best to use up-to-date chains like L2 + blobs, DA layers, and Fabric/Besu when it fits your needs. Thanks to tools like RedCap and DA, along with the costs after Dencun, these setups are now really effective for real supply chains, balancing both performance and budget nicely.

If you want to tailor these patterns to fit your specific lanes and regulatory needs, 7Block Labs is ready to help you launch a low-risk pilot in just 90 days. Plus, you'll get measurable ROI to see exactly how it’s working for you!