ChipTech

Physical identity,
proven at the silicon.

A purpose-built secure element for physical products. Every GeBeCert identity is bound to a hardware tag that cannot be cloned, rewritten, or replayed.

Our ChipTech platform is built on NXP 13.56 MHz HF, ISO 14443-compliant secure elements. The chip is not a passive identifier — it is a stateful credential that participates in a challenge-response exchange with our verification infrastructure on every single scan.

Hardware specification

NXP · ISO 14443

Parameter	Specification
Manufacturer	NXP Semiconductors
Operating frequency	13.56 MHz
Standard	ISO 14443 compliant secure element
Form factor	NTAG215 (504 bytes user memory) and NTAG216 (888 bytes user memory)
Access control	Password-locked user memory — 32-bit password, 32-bit pack, AUTH0 lock configuration
Payload	NDEF URL record for public routing, plus a rotating credential held in protected user memory
Credential lifetime	Single-use. Rotated on every successful verification, valid for 60 seconds
Reader compatibility	Native read on iOS and Android handsets — no proprietary reader or companion app required for the public layer

Embedded form factor

Physical layer

GeBeCert microchip embedded in a branded product container, labelled for in-app authentication — **Sealed product**The tag is integrated at manufacture and carries no visible surface markings that would invite tampering. Authentication is performed by the brand’s application on any supported handset.

Macro photograph of a GeBeCert chip with a concealed antenna coil under a peel-back label — **Concealed antenna**The tag sits beneath a surface layer with the antenna coil laminated into the substrate. The credential itself never leaves protected memory, so physical access to the coil yields nothing.

The rotating credential

Core mechanism

A static identifier can be copied. A rotating credential cannot be copied, because the copy is wrong by the time it is presented. Our architecture replaces the stored secret on every successful verification, so a captured value has a sixty-second window and no reuse.

Public layer read

The NDEF record resolves a unique product route, for example https://brand.com/v/7f3a2b. This layer is public and intended to be read — it identifies the product, but it proves nothing on its own.

Protected layer read

The application reads the current credential from password-locked user memory. Access requires the tag’s password, so the value cannot be harvested by a passive reader.

Server challenge

The credential is submitted to our verification endpoint together with the product identifier. The server compares it against the value currently held for that tag.

Rotation and re-write

On a valid match the server issues a successor credential and the application writes it back to the tag. Tag and server are now synchronised, and the previous value is permanently dead.

State transition

The tag advances through manufactured → activated → verified → flagged. The final state is entered when scan velocity, geography, or count exceeds the configured threshold — a pattern consistent with a cloned tag being fielded in multiple markets.

Why a clone fails. A counterfeit tag carries a credential that was valid at some earlier point. Because the credential rotates on every verification, the counterfeit is already stale when it is presented. Recovering a live credential would require reading the genuine article in real time — which is indistinguishable from simply using the genuine product.

Threat model

Attack → control

Cloning

Copy the tag onto a counterfeit

The credential rotates on every verification, so the copy is stale within seconds. Cloning is not merely difficult — it is unprofitable, because the attacker must read the genuine tag to stay current.

Rewriting

Overwrite the payload on a new tag

User memory is password-locked and the lock byte is configured at manufacture. A new tag cannot be programmed to impersonate an issued identity.

Identifier forgery

Program a counterfeit UID

The UID is never treated as an authenticator. The NDEF route and the rotating credential are the authority, so a programmed UID confers no access.

Replay

Re-present a captured credential

Credentials are single-use and expire in sixty seconds. A recorded value cannot be replayed into a second acceptance.

Surveillance

Read the tag without the application

The credential lives in protected memory, so a passive reader sees only the public NDEF record. There is nothing valuable to harvest from the wire.

Parallel deployment

Field one tag in two markets

Scan counts and geography are tracked per tag. Divergent scans raise the tag into the flagged state, where the brand is notified before the counterfeit reaches consumers.

Integration surface

Developer interface

Brands integrate the ChipTech stack without implementing radio handling or state management. The surface is deliberately small: read the tag, verify the credential, write the successor. Three calls, and the server owns the lifecycle.

scan()

Reads the public route and the protected credential from the tag. Returns the product identifier and the current credential value.

verify()

Submits the credential for validation. Returns authenticity, product metadata, scan timestamp, and the successor credential.

rotate()

Writes the successor credential back to the tag, completing the rotation and synchronising tag and server state.

Deployment paths. Established brands integrate through the SDK across iOS and Android, which keeps the credential write inside the native radio stack. Brands without a native application can deploy a white-label web client, which supports the full read-and-verify path on the public layer.

Request a chip specificationResponse within 1 business day