TRACEABILITY VERIFICATION SYSTEM, METHOD AND PROGRAM FOR THE SAME

• US 20100010933A1
• Filed: 08/05/2009
• Published: 01/14/2010
• Est. Priority Date: 07/01/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yuriyama, Madoka, Yoshizawa, Takeo, Watanabe, Yuji, Saito, Mika
• Granted Patent: US 8,463,712 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3255 using group based signatures, e.g. ring or threshold signatures
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

A system for enabling verification in traceability of a supply chain while maintaining confidentiality of private suppliers. A group signature is applied to an undisclosed supplier. The undisclosed supplier previously receives registration to the certificate authority device, and performs a group signature based on the certificate issued by the certificate authority device. A disclosed supplier and the undisclosed supplier sign and generate a signature chain when they ship parts. A verifier device receives a signature chain with products shipped from the supplier manager device, divides a signature of the disclosed supplier from a signature chain, and verifies the undisclosed supplier from the group signature. Identification of the undisclosed supplier is performed by a third-party auditor system requested to do so by the verifier device by using a group private key.

Claims

1. A traceability system for using a certificate issued by a certificate authority device to trace a supply chain by means of a signature chain, wherein in the supply chain a deliverer receives a supply of parts from disclosed suppliers and undisclosed private suppliers to the delivery destination and ships products;

comprising;

a disclosed supplier device for putting a signature to said signature chain;

a private supplier device for putting a signature to said signature chain based on a group certificate issued by said certificate authority device;

a supplier manager device for further signing said signature chain to generate a signature chain to be a verifier;

a verifier device for verifying said signature chain while maintaining confidentiality of said private suppliers, based on a group public key received from said certificate authority device; and

an auditor device for identifying said private suppliers.

2. The traceability system according to claim 1, comprising means, in said supplier manager device, for registering said private suppliers in said certificate authority device as a group.

3. The traceability system according to claim 1, further comprising:

means, in said verifier device, for verifying said supplier manager by using a public key of said supplier manager device from said signature chain; and

means, in said verifier device, for requesting said group public key of said private suppliers from said certificate authority device, for dividing signatures of a supplier manager device of said deliverer and a disclosed supplier device from said signature chain, and for verifying said private suppliers as a group by using said public key.

4. The traceability system according to claim 1, comprising means for identifying said private suppliers and a flow between said private suppliers from said signature chain by said auditor device using a group private key of said private suppliers in response to said verifier device requesting said auditor device to identify said private suppliers.

5. In a supply chain consisting of disclosed suppliers and private suppliers, an apparatus for verifying a signature chain generated by signing by a supplier manager device using a certificate of a supplier manager, a disclosed supplier device using a certificate of the disclosed suppliers, and the private suppliers using a group certificate issued by a certificate authority device, comprising:

means for verifying said supplier manager by using a public key of said supplier manager device from said signature chain;

means for requesting a group public key of said private suppliers from said certificate authority device; and

means for dividing signatures of said supplier manager device and disclosed supplier device from said signature chain, and for verifying said private suppliers as a group by using said group public key.