Zero-trust tag design
A tag that reveals less—and verifies more.
BAG-DNA separates the public routing surface from protected identity and continuously validates that tag, seal, journey, and physical bag still agree.
Public routing layer
Encrypted internal identity
BD-7A92-1184 · TOKEN 48S
Layered controls
Identity security architecture
Visible public layer
Flight number and operational routing only. No passenger name is exposed on the tag.
Encrypted identity layer
Passenger reference, itinerary, internal tracking, and security attestations protected by role-based access.
Rotating QR validation
A time-limited validation token prevents copied photographs from acting as durable credentials.
RFID / NFC verification
Machine-readable custody identity supports automated handoffs and smart-seal integrity checks.
Mismatch detection
Visual, weight, route, tag, and seal identities are reconciled at every critical checkpoint.
Physical DNA binding
The tag is continuously compared to the bag’s enrolled visual fingerprint and dimensions.