Systems and methods for implementing supply chain visibility policies

• US 9,159,046 B2
• Filed: 06/29/2009
• Issued: 10/13/2015
• Est. Priority Date: 06/29/2009
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Kerschbaum, Florian
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US12/493,650
• Publication Number:
  US 20100329464A1
• Time in Patent Office: 2,297 Days
• Field of Search: 380/45, 380/279, 713/168, 713/70, 713/176, 713/170, 713/45, 713/279
• US Class Current: 1/1
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06F 3/1204 resulting in reduced user or operator actions, e.g. presetting, automatic actions, using hardware token storing data
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders

Abstract

Methods, storage medium and systems for implementing visibility policies within a supply chain include storing event data on a computer-readable storage medium of a first partner, the event data corresponding to at least one event associated with an item while the item was in possession of the first partner, the item having traveled through the supply chain, transferring evidence of possession between the plurality of partners as the item travels through the supply chain, and requesting access to the event data by a second partner. Implementations further include determining that the item traveled through a portion of the supply chain based on the evidence, authenticating an identity of the second partner, and authorizing the second partner to access the first event data, when it is determined that the item traveled through the portion of the supply chain and when the identity of the second party is authenticated.

Claims

1. A method for implementing visibility policies within a supply chain that includes a plurality of partners, the method being performed by one or more processors and comprising:

storing, by the one or more processors, event data on a non-transitory computer-readable storage medium of a first partner, the event data corresponding to at least one event associated with an item while the item was in possession of the first partner;

transferring, by the one or more processors, the item and a first proof of possession from the first partner to another partner in the supply chain;

receiving, by the one or more processors, a request for access to the event data by a second partner in the supply chain, the request being received from the second partner and including a set of proofs of possession and a set of chaining tokens, the set of proofs of possession comprising a second proof of possession of the second partner and one or more proofs of possession of any intermediate partners between the first partner and the second partner in the supply chain, the set of chaining tokens comprising a first chaining token indicating that the second partner received the item in the supply chain, and at least two chaining tokens associated with any intermediate partners between the first partner and the second partner indicating that the intermediate partners received the item from and sent the item to specific partners in the supply chain, wherein at least one of the first proof of possession corresponding to the first partner and the second proof of possession corresponding to the second partner is provided as one of a signature-based proof of possession a shared secret proof of possession, a token-based proof of possession and a time-based proof of possession, an evidence comprising the proof of possession;

determining, by the one or more processors, that the item traveled through a portion of the supply chain associated with at least the first partner and the second partner, based on the set of proofs of possession;

authenticating, by the one or more processors, the identity of the second partner based on the set of chaining tokens and the set of proofs of possession; and

authorizing, by the one or more processors, the second partner to access the first event data from the computer-readable storage medium of the first partner, in response to determining that the item traveled through the portion of the supply chain and the identity of the second party being authenticated.

2. The method of claim 1, wherein the shared secret proof of possession and the time-based proof of possession are generated based on communication between the second partner and a trusted third party.

3. The method of claim 1, wherein the signature-based proof of possession is generated based on a signature generated by a tag associated with the item, the shared secret proof of possession is generated based on a secret that is shared between a tag associated with the item and a first trusted third party, and the time-based proof of possession is generated based on a random challenge sent to a second trusted third party and a timestamp issued by the second trusted third party.

4. The method of claim 1, further comprising:

encrypting, by the one or more processors, the event data by the first partner;

obtaining, by the one or more processors, a decryption key from a trusted third party based on the set of proofs of possession and the set of chaining tokens; and

decrypting, by the one or more processors, the event data using the decryption key by the second partner.

5. The method of claim 1, wherein authenticating the identity of the second partner is further based on a sent chaining token indicating that the first partner sent the item to another partner in the supply chain, the sent chaining token being possessed by the first partner.

6. A non-transitory, computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

storing, by the one or more processors, event data on the non-transitory computer-readable storage medium of a first partner, the event data corresponding to at least one event associated with an item while the item was in possession of the first partner;

transferring, by the one or more processors, the item and a first proof of possession from the first partner to another partner in the supply chain;

receiving, by the one or more processors, a request for access to the event data by a second partner in the supply chain, the request being received from the second partner and including a set of proofs of possession and a set of chaining tokens, the set of proofs of possession comprising a second proof of possession of the second partner and one or more proofs of possession of any intermediate partners between the first partner and the second partner in the supply chain, the set of chaining tokens comprising a first chaining token indicating that the second partner received the item in the supply chain, and at least two chaining tokens associated with any intermediate partners between the first partner and the second partner indicating that the intermediate partners received the item from and sent the item to specific partners in the supply chain, wherein at least one of the first proof of possession corresponding to the first partner and the second proof of possession corresponding to the second partner is provided as one of a signature-based proof of possession, a shared secret proof of possession, a token-based proof of possession and a time-based proof of possession, an evidence comprising the proof of possession;

determining, by the one or more processors, that the item traveled through a portion of the supply chain associated with at least the first partner and the second partner, based on the set of proofs of possession;

authenticating, by the one or more processors, the identity of the second partner based on the set of chaining tokens and the set of proofs of possession; and

authorizing, by the one or more processors, the second partner to access the first event data from the computer-readable storage medium of the first partner, in response to determining that the item traveled through the portion of the supply chain and the identity of the second party being authenticated.

7. The storage medium of claim 6, wherein the shared secret proof of possession and the time-based proof of possession are generated based on communication between the second partner and a trusted third party.

8. The storage medium of claim 6, wherein the signature-based proof of possession is generated based on a signature generated by a tag associated with the item, the shared secret proof of possession is generated based on a secret that is shared between a tag associated with the item and a first trusted third party, and the time-based proof of possession is generated based on a random challenge sent to a second trusted third party and a timestamp issued by the second trusted third party.

9. The storage medium of claim 6, further comprising:

encrypting the event data by the first partner;

obtaining a decryption key from a trusted third party based on the set of proofs of possession and the set of chaining tokens; and

decrypting the event data using the decryption key by the second partner.

10. The storage medium of claim 6, wherein authenticating the identity of the second partner is further based on a sent chaining token indicating that the first partner sent the item to another partner in the supply chain, the sent chaining token being possessed by the first partner.

11. A system for implementing visibility policies within a supply chain that includes a plurality of partners, comprising:

one or more processors; and

a non-transitory computer-readable storage medium coupled to the one or more processors having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

storing, by the one or more processors, event data on a computer-readable storage medium of a first partner, the event data corresponding to at least one event associated with an item while the item was in possession of the first partner;

transferring, by the one or more processors, the item and a first proof of possession from the first partner to another partner in the supply chain;

receiving, by the one or more processors, a request for access to the event data by a second partner in the supply chain, the request being received from the second partner and including a set of proofs of possession and a set of chaining tokens, the set of proofs of possession comprising a second proof of possession of the second partner and one or more proofs of possession of any intermediate partners between the first partner and the second partner in the supply chain, the set of chaining tokens comprising a first chaining token indicating that the second partner received the item in the supply chain, and at least two chaining tokens associated with any intermediate partners between the first partner and the second partner indicating that the intermediate partners received the item from and sent the item to specific partners in the supply chain, wherein at least one of the first proof of possession corresponding to the first partner and the second proof of possession corresponding to the second partner is provided as one of a signature-based proof of possession, a shared secret proof of possession, a token-based proof of possession and a time-based proof of possession, an evidence comprising the proof of possession;

determining, by the one or more processors, that the item traveled through a portion of the supply chain associated with at least the first partner and the second partner, based on the set of proofs of possession;

authenticating, by the one or more processors, the identity of the second partner based on the set of chaining tokens and the set of proofs of possession; and

authorizing, by the one or more processors, the second partner to access the first event data from the computer-readable storage medium, in response to determining that the item traveled through the portion of the supply chain and the identity of the second party being authenticated.

12. The system of claim 11, wherein the shared secret proof of possession and the time-based proof of possession are generated based on communication between the second partner and a trusted third party.

13. The system of claim 11, wherein the signature-based proof of possession is generated based on a signature generated by a tag associated with the item, the shared secret proof of possession is generated based on a secret that is shared between a tag associated with the item and a first trusted third party, and the time-based proof of possession is generated based on a random challenge sent to a second trusted third party and a timestamp issued by the second trusted third party.

14. The system of claim 11, wherein authenticating the identity of the second partner is further based on a sent chaining token indicating that the first partner sent the item to another partner in the supply chain, the sent chaining token being possessed by the first partner.