D-CERT: Engineering a Digital Diploma Issuance & Tamper-Proof Verification Platform via Ethereum Smart Contracts and AI RAG Assistant

2. Overall Distributed System Architecture

D-CERT is engineered using a decoupled microservices architecture, establishing strict separation of concerns between client presentations, business orchestration, isolated AI vector inference microservices, and decentralized cryptographic persistence on Ethereum Sepolia.

🔍 Click to expand

Figure 1. Figure 1. Architectural blueprint of D-CERT combining client web applications, core Node.js backend services, isolated FastAPI AI microservices, local Qwen 2.5 14B inference, FAISS vector repository, and Ethereum Sepolia smart contracts.

8-Stage Pipeline Execution Breakdown:

1. Stage 01: Document Hash Pipeline: Certificate PDF → SHA-256 Hash → bytes32 → Smart Contract on Ethereum Sepolia
2. Stage 02: RAG Pipeline: Institutional PDF → PyMuPDF → Semantic Chunking → BKAI Bi-Encoder Embeddings → FAISS Vector Store
3. Stage 03: Inference Flow: User Question → Semantic Vector Query → FAISS Retrieval → Prompt Augmentation → Qwen 2.5 14B (Ollama) → Verified Answer + Sources

3. Cryptographic & Smart Contract Subsystem

A primary engineering breakthrough of this thesis is the on-chain gas optimization strategy. Rather than storing string representations on the EVM (which consumes 80,000 to 120,000 gas per issuance), D-CERT calculates a 256-bit SHA-256 digest from the raw PDF and stores it directly as bytes32 on the Solidity smart contract.

🔍 Click to expand

Figure 2. Figure 2. Object-oriented class hierarchy of the Blockchain Service module, detailing Ethereum provider bindings, signer wallet credential handlers, and ABI contract interfaces for cryptographic on-chain operations.

🔍 Click to expand

Figure 3. Figure 3. Sequence execution flow illustrating administrator issuance approval, SHA-256 certificate hashing, byte32 conversion, and transaction commitment to Ethereum Sepolia via Alchemy RPC.

🔍 Click to expand

Figure 4. Figure 4. On-chain revocation workflow validating authorized university authority signatures, calling revokeCertificate() smart contract method, and updating global verification state.

🔍 Click to expand

Figure 5. Figure 5. Real-world transaction receipt on Sepolia testnet validating block inclusion, gas consumption, and irreversible SHA-256 document fingerprint commitment.

4. AI RAG Academic Assistant

To resolve model hallucinations—a critical vulnerability when querying strict legal and academic bylaws—D-CERT employs a dual-branch Retrieval-Augmented Generation (AI RAG) architecture:

• Offline Document Ingestion: PDF bylaws are parsed with PyMuPDF, segmented into 500-token chunks with 100-token sliding overlap, transformed into semantic vector embeddings via BKAI Bi-Encoder, and cataloged into a FAISS IndexFlatL2 vector index.
• Online Semantic Inference: Upon query arrival, the query is vectorized, top-k chunks with minimum Euclidean distance are retrieved from FAISS in <150ms, structured into a grounded prompt context, and fed to local Qwen 2.5 14B under strict citation mandates.

🔍 Click to expand

Figure 6. Figure 6. Dual-branch RAG pipeline detailing offline document ingestion (PyMuPDF parsing, 500-token chunking with 100 overlap, BKAI embedding extraction, FAISS vector indexing) and real-time inference (cosine/L2 similarity search, dynamic context synthesis, and grounded local Qwen 2.5 14B inference).

🔍 Click to expand

Figure 7. Figure 7. End-to-end execution flow from user query ingestion, semantic vector retrieval via FAISS, prompt grounding constraints, to synthesized response output with page-specific academic citations.

🔍 Click to expand

Figure 8. Figure 8. Production user interface of the academic AI assistant displaying suggested prompt chips, conversation threads, and query formulation guidance.

🔍 Click to expand

Figure 9. Figure 9. Live production response showcasing hallucination-free output: the LLM provides an accurate answer directly attributed to specific regulatory document articles and page numbers.

5. Core Backend & Database Design

The Core Backend is structured under a clean 3-tier architecture (Controller, Service, Repository), ensuring modularity and unit testability. MongoDB document storage was selected for flexible schema evolution across student credentials, audit trails, and knowledge chunks.

🔍 Click to expand

Figure 10. Figure 10. Entity-Relationship model mapping system actors, document schema, vector knowledge chunks, audit logs, and on-chain transaction hashes.

🔍 Click to expand

Figure 11. Figure 11. Separation of concerns pattern across Controller (HTTP handling & validation), Service (business logic & crypto orchestration), and Repository (database persistence) layers.

6. Experimental Validation & Live Production Portal

The complete D-CERT system was deployed to live production environments and stress-tested with real-world credential batches, examining positive verification, cryptographic forgery detection, and full-lifecycle university registrar workflows.

6.1. Public Verification Portal

Figure 12. Figure 12. Public-facing verification gateway allowing employers and third parties to drag-and-drop any PDF diploma to verify cryptographic authenticity without an account.

Figure 13. Figure 13. System validation screen showing matching on-chain cryptographic hash, university issuer digital signature, student metadata, degree classification, and block timestamp.

Figure 14. Figure 14. Real-time cryptographic rejection displaying critical warning when an uploaded document's calculated SHA-256 hash fails to match the immutable on-chain record.

6.2. Registrar Administrative Operations

Figure 15. Figure 15. University administrative module for managing published academic regulations, cataloging training bylaws, and initiating RAG vectorization jobs.

Figure 16. Figure 16. Ingestion modal handling university PDF uploads with automatic page extraction, text sanitization, and semantic chunking triggers.

Figure 17. Figure 17. Multi-step credential staging form capturing graduate student details, graduation decision numbers, and academic honors prior to final issuance.

Figure 18. Figure 18. Secure review interface where authorized registrars inspect diploma metadata, review generated PDF previews, and trigger smart contract minting.

Figure 19. Figure 19. Administrative dashboard providing comprehensive search, status tracking (Draft, Issued, Revoked), and cryptographic audit trails for all university degrees.

Figure 20. Figure 20. Comprehensive degree dossier displaying issued credential serial numbers, major specializations, digital seal signatures, and timestamped audit logs.

Figure 21. Figure 21. Permanent credential view confirming active blockchain status, verified transaction hash link to Sepolia explorer, and tamper-proof protection status.

7. Benchmarks & System Evaluation

The evaluation table below summarizes empirical measurements obtained during system benchmarking and stress-testing on production infrastructure:

8. Conclusions & Personal Engineering Contributions

The D-CERT Capstone Thesis accomplished its engineering goals, demonstrating the architectural viability and performance gains of combining Blockchain immutability with Semantic AI RAG in higher education credentialing at Da Nang University of Science and Technology (DUT).