IoT service contract

Working draft 1, v1.0

How a provider and a consumer agree a paid Internet-of-Things service and how it is recorded: what was agreed, what was used and what is owed, verifiable by anyone without relying on the provider.

At a glance

Services	Paid device services: a door lock for a hotel guest or a tenant, a vehicle charger, a machine rented by the hour
Payment models	A fixed amount for a fixed term, or an amount per unit of use up to an agreed maximum
Payment	Made outside the blockchain in this version, in ordinary money or by any other means; the provider records it
Consumer	Signs with a key held on the consumer's own device; needs no account on the blockchain
Transaction fee	Paid by the provider, who submits every record
Usage reports	Signed by the device with its own key, or by the provider for a device that does not sign
Contract interface	Not yet specified; the draft defines scope, terminology and participants

Purpose

Connected devices are routinely offered as paid services. Today the record of such a service lives in the provider's own systems, and the consumer, and anyone else with an interest in the service, has to take that record on trust.

What the blockchain contributes is the record. The agreement is signed by the consumer with a key the provider does not hold. Usage can be signed by the device itself. The amount owed is computed from those signed inputs by published rules, and once recorded none of it can be changed. This is of use wherever someone who does not control the record has to rely on it: the owner of a property managed by another company, a platform that lists many providers, an auditor, or a consumer in a dispute.

The consumer pays the provider as for any other service, and the provider carries the cost and the mechanics of the blockchain.

How a service runs

The provider registers a device and publishes an offer with its terms.
The consumer reviews the terms in an application on their own device and signs the acceptance with the consumer key.
The provider submits the signed acceptance, and the service agreement is recorded.
During the service window the entitlement is in force: the gateway operates the device for the consumer after reading the entitlement from the record and checking that the requester controls the consumer key. For metered services, signed usage reports are recorded.
The agreement is closed and the amount owed is fixed. The provider records the payment and any refund.

Examples

A hotel door lock. A hotel registers the lock of a room and publishes an offer: 100 euros a night, half refunded if cancelled less than 24 hours before arrival. A guest chooses three nights, and the guest's application shows the terms and signs the acceptance. The hotel submits it and the agreement is recorded. The guest pays the hotel by card, and the hotel records that it was paid. On arrival the guest's phone asks the gateway to open the door; the gateway checks that the phone holds the guest's key, looks up the entitlement in the record and opens the lock. After the third night the entitlement ends, the agreement is closed, and the record shows 300 euros owed and paid.

A charger. A provider registers a charger with the charger's own public key and publishes an offer: 0.40 euros per kilowatt-hour, at most 30 euros. A driver accepts. The charger signs its meter reading at the start, 1,000 kWh, and again as the session proceeds; the last reading is 1,012 kWh. The agreement is closed with 4.80 euros owed. Anyone can check the charger's signature on the readings and recompute the amount.

Participants

Providers register devices, publish and withdraw offers, and provide the service. A provider submits every validly signed consumer message without delay, whatever its content, and is accountable for delivering the service on the agreed terms and for the truth of what it records.
Devices deliver the service. A device that signs usage reports holds its own device key and signs only readings taken from its own meter; a device that does not sign is represented by the provider.
Gateways are operated by the provider and operate the devices. A gateway establishes an entitlement by reading recorded state before it operates a device for a consumer.
Consumers accept an offer and use the service. A consumer is identified by a consumer key, needs no account on the blockchain and is accountable for payment of the amount owed.
Applications act for one consumer: they generate the consumer key on the consumer's own device, never disclose its private part, and present the complete terms before signing.
Relying parties are anyone who verifies the record of a service without controlling it. They hold no key and have no authority under the protocol.

What the record does not prove

The identity of a provider or a consumer, or the existence or condition of a device.
That the service was delivered, or what a gateway did: a relying party sees the record, not the operation of the device.
That a reading is correct. The protocol verifies the device's signature on a reading, not the reading itself.
That a payment or refund stated by the provider took place. The protocol records the obligation to pay and does not enforce it.

Out of scope in this version

The communication between a gateway and a device, such as Zigbee, and the internal design of a gateway.
The payment itself, which takes place outside the blockchain.
Operation without access to the blockchain; internet connectivity is assumed.
Adjudication of disputes and enforcement of what is owed.

Protocol document

Streembit IoT Service Protocol

Version 1.0, Working draft 1. This page summarises the document; the document is the normative text.

Download Markdown All documents