Supply chain risk management device, supply chain risk management method and supply chain risk management system

Abstract

To provide supply chain risk management means that enables the verification of each entity and subject involved in transactions in a supply chain and the assessment of risk, thereby determining the specific risks that may arise concerning the relevant transactions and the measures to be taken against them.SOLUTION: A supply chain risk management device includes: a verification unit that obtains subject credential information of subjects traded in a supply chain and entity credential information of entities that handle the subjects, and verifies the subject credential information and the entity credential information against a block chain; and a risk management unit that generates and outputs risk management information that shows risk factors and risk countermeasures of entities and subjects based on entity transaction information that shows a past transaction history of entities, the subject credential information, and the entity credential information.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a supply chain risk management device, a supply chain risk management method, and a supply chain risk management system. [Background technology]

[0002] When a company promotes its business, it may form an inter-company network because the company cannot carry out the business alone. A typical example of such an inter-company network is the supply chain.

[0003] A supply chain is a network that consists of business entities such as suppliers, assemblers, manufacturers, resellers, and buyers that actually carry out commercial transactions, and in which procurement and shipping at each company are continuously linked, from the collection of raw materials to the sale of the final product. A supply chain can be understood as a single continuous system that includes physical goods such as manufactured goods, data related to services provided via the Internet, and the procurement, production management, development, logistics, distribution, and sales of raw materials. In a supply chain, supply chain management is a management method that uses computers to integrate and manage orders and deliveries with business partners and internal department operations.

[0004] In such a supply chain, problems may occur regarding the quality of products, compliance with regulations, security of services, etc. For example, deterioration of product quality, violation of environmental standards, leakage of confidential information, etc. may be considered. Therefore, in supply chain management, reliability of the supply chain is required to guarantee quality assurance, compliance with regulations, safety, security, etc.

[0005] There have been several proposals in the past for assessing risk based on the trustworthiness of entities with which transactions are conducted. For example, U.S. Patent Application Publication No. 2018 / 0005235 (Patent Document 1) describes a technology in which: "To obtain a comprehensive understanding of each party involved in a transaction, a transaction risk assessment system can collect and persist digital credentials of each entity involved in a requested electronic transaction. The transaction risk assessment system uses the entity's credentials to perform on-demand risk analysis of the requested electronic transaction based on previously collected transaction data involving the entity. The risk assessment system collects and evaluates information about the entities involved in the requested transaction. The transaction risk assessment system can quantify the trustworthiness of each entity based on an evaluation of the discovered information. The transaction risk assessment system can then quantify the risk of conducting the transaction by quantifying the trustworthiness of at least the entities involved." [Prior art documents] [Patent documents]

[0006] [Patent Document 1] US Patent Application Publication No. 2018 / 0005235 Summary of the Invention [Problem to be solved by the invention]

[0007] The above-mentioned Patent Document 1 describes a means for evaluating the reliability of an entity conducting a transaction based on credentials related to the entity and past transaction information.

[0008] However, to obtain a comprehensive risk assessment for transactions in the supply chain, it is desirable to consider a wider range of risk sources, including not only the trustworthiness of the entities participating in the transaction, such as suppliers and buyers, but also secondary entities related to the entities participating in the transaction (e.g., the institution that issued the credentials), the attributes of the cargo being traded, and the trustworthiness of entities that have previously verified the cargo. In addition, from the perspective of entities conducting transactions in a supply chain, there is a demand for means to grasp not only abstract indicators such as the reliability and risk level of a trading entity, but also specific risks that may occur in relation to a particular transaction and measures to deal with those risks. However, Patent Document 1 does not consider means for determining specific risks that may occur in a particular transaction and countermeasures for dealing with them, taking into account secondary entities related to the entities participating in the transaction and the attributes of the goods being traded.

[0009] Therefore, the present disclosure aims to provide a supply chain risk management means that can verify each of the entities and subjects involved in a transaction in a supply chain and perform risk assessment to determine specific risks that may occur in the transaction and countermeasures against those risks. [Means for solving the problem]

[0010] In order to solve the above problem, a representative supply chain risk management device of the present invention includes a processor and a memory, and the memory acquires first subject credential information on a first subject traded in a supply chain and first entity credential information on a first entity that handles the first subject in the supply chain, and compares first subject identification information included in the first subject credential information and identifying the first subject, and first entity identification information included in the first entity credential information and identifying the first entity, against a blockchain that stores identification information on subjects and entities in the supply chain. and a risk management unit that, when it is determined that the first subject credential information and the first entity credential information satisfy the predetermined reliability standard, generates and outputs risk management information indicating an entity risk factor by the first entity, a subject risk factor by the first subject, and risk countermeasures based on first entity transaction information indicating a history of past transactions regarding the first entity, the first subject credential information, and the first entity credential information. Effect of the Invention

[0011] According to the present disclosure, it is possible to provide a supply chain risk management means that can verify each of the entities and subjects involved in a transaction in a supply chain and perform a risk assessment to determine specific risks that may occur in the transaction and countermeasures against those risks. Other objects, configurations and effects will become apparent from the following description of the preferred embodiment of the invention. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 illustrates a computer system for implementing an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating an example of a configuration of a supply chain risk management system according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a supply chain configuration according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of a logical configuration of a supply chain risk management system according to an embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram showing a specific example of the operation in the supply chain risk management system according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram illustrating an example of a trust graph according to an embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram for explaining the concept of entity risk assessment according to an embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of a configuration of an entity information DB stored in the log server according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of the flow of a credential information verification process according to an embodiment of the present disclosure. [Figure 10] FIG. 10 is a diagram showing an example of the flow of a risk management process according to an embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram showing a specific example and a conventional example in which the supply chain risk management means according to an embodiment of the present disclosure is applied to cargo management. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiment. In addition, in the description of the drawings, the same parts are denoted by the same reference numerals.

[0014] In addition, terms such as "first," "second," and "third" may be used to describe various elements or components in this disclosure, but it will be understood that these elements or components should not be limited by these terms. These terms are used only to distinguish one element or component from another element or component. Thus, a first element or component discussed below can also be referred to as a second element or component without departing from the teachings of the inventive concept.

[0015] (Summary of the Disclosure) In the supply chain, many goods are traded, and it is important to evaluate the legitimacy of these goods and the reliability of the entities that handle the goods from the manufacturing stage to shipping and delivery. However, it is difficult to ensure the legitimacy of goods and the reliability of entities, and cargo information such as product names, product weights, and safety audit documents may be declared incorrectly or tampered with or counterfeited due to fraudulent activities. In this disclosure, "trustworthiness" refers to the degree of trust given by other entities or external observers to the information and actions of an entity in a supply chain. In principle, an entity that provides correct information, keeps its promises, and shows stability and predictability is more trustworthy. This trustworthiness is indicated by credential information issued by a third party, such as a certification authority or inspection organization.

[0016] Additionally, errors in cargo information due to the above-mentioned mistakes and fraudulent activities may result in cargo not being properly handled during transportation, leading to safety issues and accidents. For example, if the weight of a cargo is incorrectly declared, the ship carrying that cargo may become overloaded and sink, or if safety audit documents for a flammable cargo are falsified, the cargo may be delivered in a hot environment and catch fire.

[0017] Therefore, in order to ensure the quality, compliance with regulations, safety, etc. of goods traded in the supply chain and to prevent the problems described above, it is desirable to verify the trustworthiness of entities involved in transactions in the supply chain and the legitimacy of the goods being traded. In the past, there have been considered means for evaluating the trustworthiness of a transacting entity based on the entity's past transaction information; however, no means have been provided for proposing specific risks that may arise in a particular transaction and countermeasures against them, taking into account secondary entities related to the entities participating in the transaction (such as the institution that issued the credentials or the institution that verified the cargo) and the nature of the cargo being traded.

[0018] Therefore, the supply chain risk assessment means of an embodiment of the present disclosure verifies credential information (e.g., VC; Verified Credentials) regarding subjects (e.g., cargo) traded in the supply chain, credential information regarding entities handling the subjects, and credential information regarding secondary entities related to the entities (e.g., institutions that issued credential information to the entities), and then individually determines risk factors due to the entities and risk factors due to the subjects, generates risk management information indicating the determined risk factors and countermeasures therefor, and outputs it to a user such as a supply chain manager.

[0019] According to the supply chain risk assessment means of an embodiment of the present disclosure, it is possible to provide a supply chain risk management means that can verify each of the entities and subjects involved in a transaction in a supply chain and perform risk assessment to determine specific risks that may occur in the transaction and countermeasures therefor.

[0020] First, referring to Fig. 1, a computer system 100 for implementing an embodiment of the present disclosure will be described. The mechanisms and devices of the various embodiments disclosed herein may be applied to any suitable computing system. The main components of the computer system 100 include one or more processors 102, memory 104, a terminal interface 112, a storage interface 113, an I / O (input / output) device interface 114, and a network interface 115. These components may be interconnected via a memory bus 106, an I / O bus 108, a bus interface unit 109, and an I / O bus interface unit 110.

[0021] Computer system 100 may include one or more general purpose programmable central processing units (CPUs) 102A and 102B, collectively referred to as processors 102. In some embodiments, computer system 100 may include multiple processors, while in other embodiments, computer system 100 may be a single CPU system. Each processor 102 executes instructions stored in memory 104 and may include an on-board cache.

[0022] In one embodiment, memory 104 may include random access semiconductor memory, storage devices, or storage media (either volatile or non-volatile) for storing data and programs. Memory 104 may store all or a portion of the programs, modules, and data structures that implement the functions described herein. For example, memory 104 may store a supply chain risk management application 150. In one embodiment, supply chain risk management application 150 may include instructions or descriptions that execute on processor 102 the functions described below.

[0023] In some embodiments, the supply chain risk management application 150 may be implemented in hardware via semiconductor devices, chips, logic gates, circuits, circuit cards, and / or other physical hardware devices instead of or in addition to a processor-based system. In some embodiments, the supply chain risk management application 150 may include data other than instructions or descriptions. In some embodiments, cameras, sensors, or other data input devices (not shown) may be provided to communicate directly with the bus interface unit 109, the processor 102, or other hardware of the computer system 100.

[0024] Computer system 100 may include a bus interface unit 109 that provides communication between processor 102, memory 104, display system 124, and I / O bus interface unit 110. I / O bus interface unit 110 may couple to an I / O bus 108 for transferring data to and from various I / O units. I / O bus interface unit 110 may communicate via I / O bus 108 with multiple I / O interface units 112, 113, 114, and 115, also known as I / O processors (IOPs) or I / O adapters (IOAs).

[0025] Display system 124 may include a display controller, a display memory, or both. The display controller may provide video, audio, or both data to display device 126. Computer system 100 may also include one or more sensors or other devices configured to collect data and provide the data to processor 102.

[0026] For example, computer system 100 may include biometric sensors to collect heart rate data, stress level data, etc., environmental sensors to collect humidity data, temperature data, pressure data, etc., and motion sensors to collect acceleration data, movement data, etc. Other types of sensors may also be used. Display system 124 may be connected to a display device 126, such as a standalone display screen, a television, a tablet, or a handheld device.

[0027] The I / O interface unit provides the ability to communicate with various storage or I / O devices. For example, the terminal interface unit 112 may be attached to user I / O devices 116, such as user output devices, such as a video display, a television with speakers, and user input devices, such as a keyboard, a mouse, a keypad, a touchpad, a trackball, buttons, a light pen, or other pointing device. A user may use a user interface to enter input data or instructions to the user I / O devices 116 and the computer system 100, and receive output data from the computer system 100, by manipulating the user input devices. The user interface may be displayed on a display, played through speakers, or printed via a printer, for example, via the user I / O devices 116.

[0028] Storage interface 113 allows attachment of one or more disk drives or direct access storage device 117 (usually a magnetic disk drive storage device, but may be an array of disk drives or other storage devices configured to appear as a single disk drive). In some embodiments, storage device 117 may be implemented as any secondary storage device. Contents of memory 104 may be stored in storage device 117 and retrieved from storage device 117 as needed. I / O device interface 114 may provide an interface to other I / O devices such as printers, fax machines, etc. Network interface 115 may provide a communications path to allow computer system 100 and other devices to communicate with each other. This communications path may be, for example, network 130.

[0029] In one embodiment, computer system 100 may be a device that receives requests from other computer systems (clients) without a direct user interface, such as a multi-user mainframe computer system, a single-user system, or a server computer, etc. In other embodiments, computer system 100 may be a desktop computer, a portable computer, a laptop, a tablet computer, a pocket computer, a telephone, a smartphone, or any other suitable electronic device.

[0030] Next, a supply chain risk management system according to an embodiment of the present disclosure will be described with reference to FIG.

[0031] FIG. 2 is a diagram illustrating an example of a configuration of a supply chain risk management system 200 according to an embodiment of the present disclosure. The supply chain risk management system 200 is a system for verifying each of the entities and subjects involved in a transaction in a supply chain and performing risk assessment to determine specific risks that may occur in the transaction and measures therefor. As shown in FIG. 2, the supply chain risk management system 200 mainly includes a supply chain risk management device 210, a communication network 250, a user terminal 260, a blockchain 270, and a log server 280. In the supply chain risk management system 200, the supply chain risk management device 210, the user terminal 260, the blockchain 270, and the log server 280 may be connected to each other via the communication network 250. The supply chain risk management system 200 shown in FIG. 2 may be used in, for example, a supply chain 300 shown in FIG.

[0032] The supply chain risk management device 210 is a device for verifying each of the entities and subjects involved in a transaction in a supply chain and performing risk assessment to determine specific risks that may occur in the transaction and measures to deal with them. As shown in FIG. 2, the supply chain risk management device 210 mainly includes a memory 220, a storage unit 230, a processor 244, and an input / output unit 246. In one embodiment, the supply chain risk management device 210 may be implemented by the computer system 100 shown in FIG.

[0033] The memory 220 may be a memory for storing a supply chain risk management application 150 for implementing functions of a supply chain risk management measure according to an embodiment of the present disclosure. The supply chain risk management application 150 may include processing instructions for implementing functions of software modules such as a validation unit 222 and a risk management unit 224, as shown in FIG.

[0034] The verification unit 222 is a functional unit for acquiring subject credential information on a subject traded in a supply chain and entity credential information on an entity that handles the subject, and verifying the reliability of the acquired credential information. In the present disclosure, credential information is certification information that officially indicates attributes, authenticity, reliability, suitability, ability, assertion, etc., of a subject, such as qualifications, examination reports, careers, certifications, and letters of credential. In one embodiment, the credential information may be a credential issued by a credential issuing platform, such as VC (Verified Credentials). Note that the details of the operation of the verification unit 222 will be described with reference to, for example, FIG. 9, and therefore will not be described here.

[0035] In this disclosure, the term "subject" refers to an entity traded in a supply chain, and may include, but is not limited to, a specific part produced in a manufacturing industry, cargo or deliveries distributed in logistics, a specific service or data provided in a service industry, or a human or animal. In addition, in this disclosure, the expression "entity" includes an entity that handles a subject traded in a supply chain at various stages such as production, transportation, and sales, and an entity that has some relationship with an entity that directly handles the subject. In this disclosure, an entity that has some relationship with an entity that directly handles the subject may be referred to as a "secondary entity." More specifically, entities may include, for example, manufacturers, wholesalers, retailers, transporters, warehousers, consumers, certification authorities, standards management organizations, and the like.

[0036] The risk management unit 224 is a functional unit that uses the subject credential information and entity credential information verified by the verification unit 222 to determine risk factors by subjects and risk factors by entities, and generates and outputs risk management information indicating the determined risk factors and measures against these risk factors. The risk factors here refer to things that may cause loss or damage related to specific transactions carried out in the supply chain. Examples may include "flammable" or "supplier does not meet the reliability threshold." It should be noted that the details of the operation of the risk management unit 224 will be described with reference to, for example, FIG. 10, and therefore will not be described here.

[0037] The storage unit 230 is a storage area that accommodates a database (hereinafter, "DB") for storing various information according to an embodiment of the present disclosure, and may include an expert knowledge DB 232 as shown in FIG.

[0038] The expert knowledge DB 232 is a database that stores information used by the risk management unit 224 to determine countermeasures against the determined risk elements. The expert knowledge DB 232 may store, for example, various risk elements that have occurred in the past in association with effective countermeasures against these risk elements.

[0039] The processor 244 is a processing unit for executing processing instructions stored by the memory 220 that define the functionality of each functional unit of the supply chain risk management application 150 .

[0040] The input / output unit 246 is a functional unit for receiving information input to the supply chain risk management device 210 and outputting risk management information generated by the supply chain risk management device 210. In an embodiment, the input / output unit 246 may include, for example, a keyboard, a mouse, a display for displaying a GUI (Graphical User Interface), etc. In an embodiment, the input / output unit 246 may provide the user terminal 260 with a GUI for inputting and outputting various types of information.

[0041] Communications network 250 may include, for example, a local area network (LAN), a wide area network (WAN), a satellite network, a cable network, a WiFi network, or any combination thereof.

[0042] The user terminal 260 is a terminal device that can be used by a user of the supply chain risk management device 210. By using the user terminal 260, the user can request a risk assessment for the supply chain from the supply chain risk management device 210, input credential information, and check risk management information generated by the supply chain risk management device 210. As an example, the user terminal 260 may include, for example, a smartphone, a smart watch, a tablet, a personal computer, or the like of a user who manages the supply chain, and is not particularly limited. For ease of explanation, FIG. 2 illustrates an example of a configuration including one user terminal 260. However, the number of user terminals 260 is not limited, and a configuration including a plurality of user terminals 260 is also possible.

[0043] Blockchain 270 is an agreed upon data store that is replicated, shared, and synchronized across multiple geographic locations, countries, institutions, etc. Blockchain 270 may store information that supports the subject and entity credentials described above, and may be used to verify subject and entity credentials, as described below.

[0044] Log server 280 is an external server device that stores an entity information database that stores entity information that identifies and characterizes entities in the supply chain. In one embodiment, the entity information database stored in log server 280 may include entity transaction information, etc., that indicates a history of transactions that an entity has made in the past. As described below, this entity transaction information may be used by risk manager 224 to determine an entity risk factor by an entity.

[0045] According to the supply chain risk management system 200 described above, it becomes possible to determine specific risks that may occur in relation to a transaction and measures to deal with such risks.

[0046] Next, an example of a supply chain according to an embodiment of the present disclosure will be described with reference to FIG.

[0047] 3 is a diagram showing an example of the configuration of a supply chain 300 according to an embodiment of the present disclosure. As described above, a supply chain is generally composed of business entities such as suppliers, assemblers, manufacturers, resellers, and buyers that conduct commercial transactions, and is a network in which procurement and shipping at each company are continuously linked to proceed from raw material collection to the sale of final products. FIG. 3 shows the configuration of an exemplary supply chain 300, focusing on a warehouse 305 that uses the supply chain risk management system 200 according to an embodiment of the present disclosure.

[0048] 3, in a supply chain 300, a warehouse 305 using the supply chain risk management system 200 according to an embodiment of the present disclosure can transact with multiple entities 310, such as a first entity, a second entity, an nth entity, etc. These entities 310 may include, for example, traders who manufacture, assemble, ship, and deliver subjects such as cargo, and certificate authorities and issuing agencies that issue credential information indicating the trustworthiness of subjects and traders.

[0049] In general, warehouse 305 can perform a subject receiving step 315 for receiving a specific subject from entity 310, a subject identification step 320 for identifying the subject by a barcode, QR code, or the like, a warehousing step 325 for storing the subject in storage location 330, and, upon receiving a shipping instruction, a shipping preparation step 335 for retrieving the subject from storage location 330 and preparing it for shipping, and a shipping step 340 for shipping the subject to another entity, etc.

[0050] By using the supply chain risk management system 200 according to the embodiment of the present disclosure in the warehouse 305, it is possible to authenticate the credential information of the subjects transacted in the supply chain 300 and the entities 310 handling the subjects, determine specific risk factors of the subjects and entities, and determine effective measures for the determined risk factors. In this way, it is possible to improve quality assurance, regulatory compliance, safety, security, and the like, related to transactions conducted in supply chain management.

[0051] Next, with reference to FIG. 4, a logical configuration of the supply chain risk management system according to an embodiment of the present disclosure will be described.

[0052] FIG. 4 is a diagram illustrating an example of a logical configuration of the supply chain risk management system 200 according to an embodiment of the present disclosure.

[0053] First, the verification unit 222 in the supply chain risk management device 210 obtains, from the entity 405, entity credential information 415 that identifies the entity 405 and subject credential information 420 that identifies a subject 406 such as cargo handled by the entity 405. This entity credential information 415 may include information such as a name, address, decentralized identifier (DID) that identifies the entity 405, the issuing authority that issued the entity credential information 415, and the date and time the entity credential information 415 was issued. Similarly, the subject credential information 420 may include a product ID, product name, production date, manufacturer, quality standards, a decentralized identifier (DID), the issuing authority that issued the subject credential information 420, the date and time the subject credential information 420 was issued, etc., that identify the subject that the entity 405 is dealing with.

[0054] Next, the verification unit 222 extracts an entity identity identifying the entity 405 from the entity credential information 415, and a subject identity identifying the subject 406 from the subject credential information 420. In one embodiment, the entity identity and the subject identity may be a DID, which is a unique identifier generated using a distributed ledger technology such as the blockchain 270 shown in FIG. 2 and used to identify a digital identity. The DID is stored on a distributed ledger such as the blockchain and can identify information about an individual, an organization, or a product. In one embodiment, here, the verification unit 222 may obtain the identity of the entity 405 and the subject 406 as well as the identity of secondary entities such as the issuing authority or certificate authority that issued the entity credentials 415 and the subject credentials 420.

[0055] Next, the verification unit 222 verifies the entity credential information 415 and the subject credential information 420 by comparing the extracted entity identification information and subject identification information against the blockchain 270. Here, the expression "verifying the credential information" means confirming whether or not the information included in the credential information is legitimate information that satisfies a predetermined reliability standard, and may be performed by means based on a public key and a private key, for example.

[0056] Next, the risk manager 224 extracts entity attribute information indicating attributes characterizing the entity 405 from the verified entity credential information 415, and extracts subject attribute information indicating attributes characterizing the subject 406 from the subject credential information 420. The risk manager 224 may also obtain attribute information regarding secondary entities, such as the issuing authority or certificate authority that issued the entity credential information 415 and the subject credential information 420. Thereafter, the risk management unit 224 determines an entity risk element indicating a risk posed by the entity based on the entity attribute information and the entity transaction information acquired from the entity information DB stored in the log server 280 . The risk management unit 224 also determines a subject risk factor that indicates a risk posed by the subject 406 based on the subject attribute information.

[0057] The risk manager 224 then determines countermeasures for the determined entity and subject risk elements. These countermeasures may be determined, for example, by fuzzy logic means that derives effective countermeasures for the determined entity and subject risk elements based on information in the expert knowledge DB 232.

[0058] Next, the risk management unit 224 may output risk management information indicating the determined entity risk elements, subject risk elements, and countermeasures against the risks to, for example, the user terminal 260 (not shown in FIG. 4) shown in FIG. 2. If no risk elements due to the entity 405 and the subject 406 are identified, the risk management unit 224 may output a message to the effect that there is no risk due to the entity 405 and the subject 406 and the target transaction is safe as risk management information.

[0059] A user who receives the risk management information 430 may check the details of the risk factors and implement measures to minimize the risks of the transaction.

[0060] According to the supply chain risk management system 200 described above, it becomes possible to determine specific risks that may occur in relation to a transaction and measures to deal with such risks.

[0061] Next, a specific example of the operation of the supply chain risk management device 210 according to an embodiment of the present disclosure will be described with reference to FIG.

[0062] FIG. 5 is a diagram showing a specific example of the operation of the supply chain risk management device 210 according to an embodiment of the present disclosure.

[0063] First, as described above, the supply chain risk management device 210 obtains, from a specific entity 505 in the supply chain, entity credential information 515 that identifies the entity 505, and subject credential information 520 that identifies a subject 506, such as cargo, handled by the entity.

[0064] For example, as shown in FIG. 5, the entity credential information 515 may be Verified Credentials indicating identifiers such as the entity's 505 name, address, phone number, gender, date of birth, DID, etc., digital signature, credential issue date, credential authentication method, credential issuer ID, and credential issuer trust level. Similarly, the subject credential information 520 may be Verified Credentials indicating the subject's 506 product ID, product name, product type, manufacturing date, expiration date, manufacturer ID, quality certificate ID, digital signature, credential issue date, credential authentication method, credential issuer ID, and credential issuer trust level.

[0065] After verifying the validity of the entity credential information 515 and the subject credential information 520 against the blockchain 270, the supply chain risk management device 210 may output risk management information 530 indicating risk factors posed by the entity and subject based on the entity transaction information obtained from the log server 280 and attribute information extracted from the entity credential information 515 and the subject credential information 520.

[0066] In one embodiment, the risk management unit 224 in the supply chain risk management device 210 may include a subject risk determination unit for determining subject risk elements due to the subjects traded, an entity risk determination unit for determining entity risk elements due to entities related to the subjects traded in the supply chain, a risk model unit that analyzes the determined subject risk elements and entity risk elements together with the characteristics of the subject's delivery means and delivery destination using a neural network such as a multilayer perceptron and calculates the probability of occurrence of the risk elements, and a countermeasure determination unit that identifies effective countermeasures against the determined entity risk elements and subject risk elements using a fuzzy logic unit means that derives them based on information in the expert knowledge DB232.

[0067] 5, the risk management information 530 may include a risk vector that indicates the risk factor in a vector format, and information that indicates the content of the risk factor in natural language. As an example, the risk management information 530 may indicate "weight exceeds 100 tons" as a risk factor by subject 506, and may indicate "below a reliability threshold" as a risk factor by entity 505. In addition, in one embodiment, the supply chain risk management device 210 may include, in the risk management information 530, a probability distribution indicating the probability that each determined risk element will occur. Although not shown in FIG. 5, as described above, the risk management information 530 may include information on measures against the determined risks.

[0068] Next, a trust graph according to an embodiment of the present disclosure will be described with reference to FIG. 6. As described above, a subject such as a cargo traded in a supply chain may be handled by many entities from production to shipment, and these entities have credential information that asserts the reliability of the entity. This credential information is issued and managed by a secondary entity such as a certificate authority. In addition, the reliability of the certificate authority that issued this credential information may be supported by credential information issued by a higher-level institution. In this way, each entity in the supply chain is associated with a reliability level according to the reliability of the credential information of the entity, and the reliability level and hierarchical relationship of each entity in the supply chain can be expressed as a trust graph as shown in FIG. 6.

[0069] 6 is a diagram illustrating an example of a trust graph 600 according to an embodiment of the present disclosure. In general, in a trust graph related to a supply chain, entities related to a particular subject can be represented as nodes, and relationships between the nodes can be represented as directed edges. In addition, the entities represented as nodes are associated with entity identification information, such as DIDs, that uniquely identify the entities.

[0070] As an example, in the trust graph 600 shown in FIG. 6, a product 635, which is a subject traded in a supply chain, is manufactured by a manufacturer 630 and sold as a shipment 620. The shipment 620 has a security certificate issued by a trusted entity 615 and an invoice issued by a certificate authority 601. The shipment 620 is managed by a delivery manager 610 as a delivery item 625. The delivery manager 610 has credential information issued by a trusted entity 605, which has credential information issued by a trusted entity 602 belonging to a higher trust level. The delivery item 625 is delivered by a deliverer 645.

[0071] In assessing the risk related to the delivery 625, the supply chain risk management system 200 according to the embodiment of the present disclosure can determine risk factors of each entity by authenticating the credential information of all entities, including the trusted entity 615 that issued a safety guarantee for the shipment 620 delivered as the delivery 625, the certificate authority 601 that issued an invoice, the manufacturer 630 that manufactured the product 635 sold as the shipment 620, the deliverer 645 that delivered the delivery 625, the delivery manager 610 that manages the delivery 625, the trusted entity 605 that issued the credential information of the delivery manager 610, and the trusted entity 602 that issued the credential information of the trusted entity 605, in addition to the risk due to the delivery 625. This makes it possible to determine risk factors due to the subject product 635 and risk factors due to each entity directly or indirectly related to the product, and to determine specific risks that may occur in the transaction and countermeasures therefor.

[0072] Next, the concept of entity risk management according to an embodiment of the present disclosure will be described with reference to FIG.

[0073] 7 is a diagram for explaining the concept of entity risk assessment according to an embodiment of the present disclosure. As described above, in the supply chain risk management means according to an embodiment of the present disclosure, the risk of a transaction in a supply chain is determined based on risk factors due to a subject being traded and risk factors due to an entity directly or indirectly related to the subject. In this regard, "entities directly related to the subject" include entities such as companies that manufacture, assemble, pack, ship, inspect, and distribute the subject, while "entities indirectly related to the subject" include issuers such as certificate authorities that issue credential information to entities directly related to the subject.

[0074] More specifically, the risk factor of an entity may be determined based on the trustworthiness of entities such as manufacturers and distributors that directly handle the subject, trusted entities that issue credential information to entities that directly handle the subject, and higher-level issuers that issue credential information to these trusted entities. The "trusted entity" here is a highly reliable institution or organization that issues and manages credential information to entities with a lower trust level in the supply chain. As an example, the trusted entity may include a certificate authority or a certificate issuing authority. The trust level here is a level evaluated based on the reliability of the credential information held by a specific entity, and is determined according to the trust level of the issuer that issued the credential information to the entity. In this disclosure, a case where the closer the trust level is to "0", the higher the reliability is will be described as an example.

[0075] In one embodiment, the supply chain risk management device 210 according to an embodiment of the present disclosure may authenticate the credential information of each entity involved in a particular transaction in the supply chain, and then calculate a reliability score as a quantitative measure of the reliability of each entity, for example, using Equation 1 shown below.

number

[0076] To explain an example with reference to Figure 7, the supply chain risk management device 210 of an embodiment of the present disclosure may authenticate the credential information of each of the deliverer 720 who delivers a specific subject traded in the supply chain, the domestic trusted entity 715 that issued the credential information to the deliverer 720, the domestic trusted entity 710 that issued the credential information to the domestic trusted entity 715, the country of origin trusted entity 705 that issued the credential information to the domestic trusted entity 710, and the international trusted entity 701 that issued the credential information to the country of origin trusted entity 705, and then obtain entity transaction information indicating the past transaction history of each of these entities from the log server 280, and calculate a trust score for the transaction by aggregating the difference between the number of successful transactions and the number of failed transactions of entities belonging to each trust level using the above-mentioned formula 1. In this way, it becomes possible to perform a comprehensive risk assessment of entities that takes into account not only the risks posed by entities such as manufacturers and distributors that directly handle specific subjects traded in the supply chain, but also the risks posed by the issuing entities that issued credential information to these entities.

[0077] Next, with reference to FIG. 8, an entity information database stored in the log server according to the embodiment of the present disclosure will be described.

[0078] 8 is a diagram showing an example of the configuration of the entity information DB800 stored in the log server 280 according to the embodiment of the present disclosure. As described above, the entity information DB800 is a database for storing information about each entity in the supply chain. As shown in FIG. 8, the entity information DB800 may include information such as an entity ID, an entity category, a credential information issuance date and time, a country of origin, a trust level, a number of successful transactions, a number of failed transactions, an evaluation value, and a trust score.

[0079] The entity ID 805 is information that uniquely identifies a specific entity in the supply chain, and may be, for example, the above-mentioned DID. The entity category 810 is information that indicates the primary business or role of a particular entity in the supply chain. The credential issue date and time 815 is information indicating the date and time when the credential was issued by a predetermined trusted entity (such as a certificate authority) to a specific entity in the supply chain. The area of ​​activity 820 is information indicating the main area (such as a country) in which a particular entity in the supply chain operates. Trust level 825 is the trust level associated with a particular entity in the supply chain and is determined by the issuing trusted entity that issued the credential to the entity.

[0080] The number of successful transactions 830 is information indicating the number of transactions in which no reports or complaints have been reported among transactions conducted in the past by a specific entity in the supply chain. The number of failed transactions 835 is information indicating the number of transactions in which reports, complaints, etc. were reported among transactions conducted in the past by a specific entity in the supply chain. In this disclosure, the number of successful transactions 830 and the number of unsuccessful transactions 835 are collectively referred to as "entity transaction information." In this case, a "transaction" refers to an exchange of money, goods, or matters that has been conducted in the past by a specific entity in the supply chain based on a contract or agreement, and the specific content of the transaction may vary depending on the role and business type of the entity.

[0081] The reputation value 840 is a quantitative value that indicates the reputation of a particular entity in the supply chain, and may be calculated, for example, based on user feedback about that entity. The trust score 845 is a value that quantitatively indicates the trustworthiness of a particular entity in the supply chain and may be calculated according to Equation 1 based on entity transaction information and trust levels for each entity related to the entity, as described above.

[0082] Next, a credential information verification process according to an embodiment of the present disclosure will be described with reference to FIG.

[0083] 9 is a diagram showing an example of the flow of a credential information verification process 900 according to an embodiment of the present disclosure. The credential information verification process 900 is a process for obtaining subject credential information related to a subject traded in a supply chain and entity credential information related to an entity related to the subject, and verifying the reliability of the obtained credential information, and may be performed by the verification unit 222 shown in FIG. For ease of explanation, the following describes an example in which verification is performed for one subject and one entity; however, it should be noted that the present disclosure is not limited to this, and in practice, verification can be performed for multiple shipments and multiple entities (e.g., an entity that directly handles the subject and a secondary entity that has issued credential information to the entity).

[0084] First, in step S910, the verification unit 222 acquires first subject credential information regarding a first subject traded in a supply chain and first entity credential information regarding a first entity related to the first subject. The first subject here may be, for example, a cargo received at a warehouse using the supply chain risk management means according to an embodiment of the present disclosure, and the first entity may be a delivery company that delivers the cargo to the warehouse. The verification unit 222 may acquire the first subject credential information and the first entity credential information from the first entity. Additionally, in this disclosure, credential information is certification information that officially indicates attributes, authenticity, reliability, suitability, capabilities, claims, etc., of a subject or entity, such as qualifications, examination reports, career history, certifications, credentials, etc. In one embodiment, the credential information may be a credential issued by a credential issuing platform, such as VC (Verified Credentials).

[0085] In an embodiment, in step S910, the verification unit 222 may obtain not only first subject credential information about a first subject and first entity credential information about a first entity related to the first subject, but also credential information about multiple subjects and multiple entities. As an example, the verification unit 222 may obtain second entity credential information about a second entity related to the first entity (e.g., an issuer that issued the first entity credential information to the first entity) from the blockchain based on the first entity credential information.

[0086] Next, in step S920, the verification unit 222 obtains authentication permission for the first subject and the first entity from a predetermined authentication server 925. Here, the verification unit 222 may specify the authentication server 925 based on issuer information described in each of the first subject credential information and the first entity credential information. If entity credential information on a plurality of entities is acquired in step S910, the verification unit 222 may acquire authentication permission on each of the entities from the authentication server 925 in step S920.

[0087] Next, in step S930, the verification unit 222 obtains authentication permission for the first subject and the first entity from the authentication server 925, and then extracts first subject identification information for identifying the first subject from the first subject credential information, and extracts first entity identification information for identifying the first entity from the first entity credential information. The first subject identification information and the first entity identification information here are information for uniquely identifying the first subject and the first entity, respectively, and may be, for example, a DID included in the credential information. If entity credential information relating to a plurality of entities is acquired in step S910, then in step S920, the verification unit 222 may extract entity identification information such as a DID from each piece of entity credential information.

[0088] Next, in step S940, after obtaining authentication permission from the authentication server 925 in step S930, the verification unit 222 verifies the first subject identification information and the first entity identification information against the blockchain 270 and determines whether or not a predetermined reliability standard is satisfied. The reliability standard here is a standard that specifies whether a specific subject and entity are legitimate or not.

[0089] Here, the verification unit 222 uses the first subject identification information and the first entity identification information to identify records in the blockchain 270 corresponding to the first subject credential information and the first entity credential information acquired in step S910, respectively, and determines whether or not the information (credential issuance time, credential ID, public key, etc.) described in the blockchain 270 matches the first subject credential information and the first entity credential information acquired in step S910. If the information (credential issuance time, credential ID, public key, etc.) described in the blockchain 270 matches the first subject credential information and the first entity credential information acquired in step S910, the verification unit 222 determines that the first subject credential information and the first entity credential information satisfy a predetermined reliability standard. On the other hand, if the information recorded in the blockchain 270 (credential issuance time, credential ID, public key, etc.) does not match the first subject credential information and the first entity credential information acquired in step S910, the verification unit 222 determines that the first subject credential information and the first entity credential information satisfy a predetermined reliability standard.

[0090] More specifically, the verification unit 222 may use a so-called public key authentication means to compare the public keys corresponding to the first subject identification information and the first entity identification information, respectively, with the public keys recorded in the blockchain 270. If the respective public keys match, the verification unit 222 may determine that the first subject credential information and the first entity credential information acquired in step S910 satisfy a reliability criterion. In addition, if entity credential information regarding multiple entities is obtained in step S910, in step S920, the verification unit 222 may verify the entity identification information extracted from each entity credential information against the blockchain 270.

[0091] Next, in step S950, the verification unit 222 transfers the first subject credential information and the first entity credential information verified in step S940 to the risk management unit 224. Thereafter, the risk management unit 224 performs a risk management process 1000 shown in Fig. 10 based on the verified first subject credential information and first entity credential information.

[0092] According to the credential information verification process 900 shown in FIG. 9, it is possible to verify the reliability of the subjects transacted in the supply chain and the credential information of each of the entities related to the subjects.

[0093] Next, a risk management process according to an embodiment of the present disclosure will be described with reference to FIG.

[0094] 10 is a diagram showing an example of the flow of a risk management process 1000 according to an embodiment of the present disclosure. The risk management process 1000 is a process for determining risk factors of subjects traded in a supply chain and entities related to the subjects, and determining measures for the determined risk factors, and may be implemented by, for example, the risk management unit 224 shown in FIG.

[0095] First, in step S1010, the risk management unit 224 extracts first subject attribute information indicating attributes related to the first subject from the first subject credential information whose reliability has been verified by the above-described credential information verification process 900. This first subject attribute information is information indicating the characteristics, properties, interoperability with the external environment, and value that characterize the first subject, and may be described in the credential information. For example, the first subject attribute information may include information indicating the nature of the subject (liquid, solid, gas, fragile, "flammable", "toxic", etc.), information indicating interaction with the external environment ("unstable at high temperatures", etc.), value, product ID, product name, production date, manufacturer, quality standards, expiration date, delivery instructions (frozen delivery, caution fragile). In one embodiment, the risk management unit 224 may extract the first subject attribute information from the first subject credential information using a predetermined natural language processing means or text analysis means.

[0096] Next, in step S1020, the risk management unit 224 extracts first entity attribute information indicating attributes related to the first entity from the first entity credential information whose reliability has been verified by the above-described credential information verification process 900. This first entity attribute information is information indicating characteristics that characterize the first entity, and may be described in the credential information. For example, the first entity attribute information may include information such as the name of the entity, a category (delivery person, seller, etc.), an address, a telephone number, an identifier, a digital signature, a credential issuance date, a credential issuer ID, and a credential issuer trust level. In an embodiment, the risk management unit 224 may extract the first entity attribute information from the first entity credential information using a predetermined natural language processing means or a text analysis means. When the reliability of entity credential information related to a plurality of entities is verified in the above-described credential information verification process 900, in step S1020, the risk management unit 224 may extract entity attribute information from each entity credential information.

[0097] Next, in step S1030, the risk management unit 224 acquires entity transaction information related to the first entity from the log server 280. Here, the risk management unit 224 may access the entity information DB stored in the log server 280, identify a record corresponding to the first entity identification information such as a DID extracted from the first entity credential information, and acquire the number of successful transactions and the number of failed transactions of the identified record as the entity transaction information related to the first entity. In addition, if the reliability of entity credential information related to multiple entities is verified in the above-mentioned credential information verification process 900, in step S1030, the risk management unit 224 may obtain entity transaction information related to each entity from the log server 280.

[0098] Next, in step S1040, the risk management unit 224 determines an entity risk factor by the entity based on the first entity attribute information acquired in step S1020 and the entity transaction information acquired in step S1030. Here, the risk management unit 224 calculates the reliability score of the first entity based on the entity transaction information acquired in step S1030, based on the above-mentioned formula 1. If the calculated reliability score does not satisfy a predetermined reliability threshold, the risk management unit 224 may determine that the entity risk factor is "the entity does not satisfy the reliability threshold." In addition, the risk management unit 224 may determine the entity risk factor by the entity by analyzing the first entity attribute information acquired in step S1020 using a machine learning model or the like trained to detect risks related to the entity. If the validity of entity credential information relating to a plurality of entities is verified in the above-described credential information verification process 900, in step S1040, the risk management unit 224 may determine the entity risk factors of each entity.

[0099] Next, in step S1050, the risk management unit 224 may determine a subject risk element due to the first subject based on the first subject attribute information acquired in step S1010. Here, the risk management unit may determine the subject risk element by analyzing the first subject attribute information acquired in step S1010 using a machine learning model or the like trained to detect risks due to the subject. In this case, the machine learning model for determining the subject risk element may determine risk elements related to the nature of the subject described in the subject attribute information, mutual adoption with the external environment, and value. In one embodiment, the risk management unit 224 may compare the first subject attribute information with the subject attribute information recorded in the blockchain for the subject, and determine the difference between the first subject attribute information and the subject attribute information recorded in the blockchain as a risk factor. This makes it possible to avoid risks and accidents caused by discrepancies in subject attributes caused by, for example, mistakes or fraudulent acts.

[0100] For example, by performing a risk analysis based on the properties of a subject described in the subject attribute information, it is possible to determine subject risk elements such as "flammable," "toxic," "expired," and "fragile." Also, by performing a risk analysis based on the interaction of a subject with the external environment described in the subject attribute information, it is possible to determine subject risk elements such as "may corrode in a humid environment" and "may explode or melt in a high-temperature environment." Furthermore, by performing a risk analysis based on the value of a subject described in the subject attribute information, it is possible to determine subject risk elements such as "expensive, handle with care."

[0101] Next, in step S1060, the risk management unit 224 models the entity risk elements determined in step S1040 and the subject risk elements determined in step S1050 by a predetermined risk modeling means, and determines the occurrence probability of each risk element. Here, the risk management unit may use, for example, FMEA (Failure Mode and Effective Analysis), Monte Carlo Simulation (Monte Carlo Method), Bayesian Belief Network, or other existing methods as a means for modeling the risk elements and calculating the occurrence probability.

[0102] Next, in step S1070, the risk manager 224 determines countermeasures for the determined risk elements. More specifically, the risk manager 224 may determine effective countermeasures for the determined entity risk elements and subject risk elements by analyzing the entity risk elements determined in step S1040, the subject risk elements determined in step S1050, the occurrence probabilities of the risk elements determined in step S1060, and the expert knowledge stored in the expert knowledge DB 232 by a predetermined fuzzy logic means. In an embodiment, the risk manager 224 may use the fuzzy logic means to determine countermeasures whose predicted effectiveness meets a predetermined threshold value from among the candidate countermeasures stored in the expert knowledge DB 232 for each determined subject risk element and entity risk element. For example, the risk management unit 224 may determine a measure of "refrigerated delivery" for a subject risk element of "possibility of melting at high temperatures." In addition, the risk management unit 224 may determine a measure of "rejection of transaction" for an entity risk element of "not meeting the reliability threshold of the deliverer."

[0103] Next, in step S1080, the risk management unit 224 generates risk management information including the entity risk elements determined in step S1040, the subject risk elements determined in step S1050, the occurrence probability of the risk elements determined in step S1060, and the countermeasures determined in step S1070, and outputs it to the user of the user terminal 260 via the input / output unit 246 shown in Figure 2.

[0104] 10, it is possible to determine specific risks that may occur in a given transaction and measures to deal with them, and output them to a user. In this way, by determining and implementing measures to deal with and minimize risks in a specific transaction in a supply chain, it is possible to promote safe and efficient transactions in the supply chain.

[0105] Next, with reference to FIG. 11, a specific example and a conventional example in which the supply chain risk management means according to an embodiment of the present disclosure is applied to cargo management will be described.

[0106] FIG. 11 is a diagram showing a specific example and a conventional example in which the supply chain risk management means according to an embodiment of the present disclosure is applied to cargo management.

[0107] As shown in the conventional example 1110, first, cargo stored in a warehouse 1115 is loaded into a container 1120 and then delivered to a port 1130. After that, the container 1120 is formally inspected, but conventionally, there is no means to confirm the authenticity of the contents of the cargo in the container 1120, so cargo information such as the product name, product weight, and safety audit documents related to the cargo may be mistakenly declared or falsified or counterfeited due to fraud. As a result, the container 1120 is loaded onto a ship without risk management for risks due to the cargo in the container 1120 or the entity that handled the cargo in the supply chain. After that, accidents may occur due to changes in the state of the cargo (such as fire due to high temperature) or overloading that are not correctly declared due to mistake or fraud, leading to losses for the owner of the cargo, the shipper, etc.

[0108] On the other hand, as shown in a specific example 1150 in which the supply chain risk management means according to the embodiment of the present disclosure is applied, first, the supply chain risk management means according to the embodiment of the present disclosure is implemented for the cargo stored in the warehouse 1155, and risk management information indicating the risks due to the cargo itself, the risks due to the entity handling the cargo, and measures against these risks is generated, and output to the manager of the warehouse 1155, the person in charge of the ship, etc. As a result, measures can be taken to address and minimize the risks due to the cargo and the risks due to the entity before the container 1160 loaded with the cargo is loaded onto the ship at the port 1170. For example, if a discrepancy is found in the cargo information declared by the supply chain risk management means according to the embodiment of the present disclosure, the deliverer may take measures such as refusing to deliver the cargo or preparing a delivery environment that takes into account the nature of the cargo. In this way, by performing risk management for the cargo and the entity handling the cargo before loading the cargo onto the ship, it is possible to prevent accidents due to changes in the state of the cargo (such as fire due to high temperature) and overloading, and to avoid losses for the owner of the cargo, the deliverer, etc.

[0109] As described above, in the supply chain risk management means of an embodiment of the present disclosure, the credential information of each of the subjects traded in the supply chain and the entities related to the subjects is verified against the blockchain, and then the subject risk elements of the subjects and the entity risk elements of the entities are individually determined and evaluated.

[0110] Here, entities related to the subject may include entities that directly handle the subject, such as those that manufacture, assemble, pack, ship, inspect, and distribute the subject, as well as secondary entities that are indirectly related to the subject, such as certificate authorities that issue credential information to entities directly related to the subject. In this manner, determining the risk components by subject and each entity related to that subject allows for a comprehensive and comprehensive risk assessment of a particular transaction in the supply chain.

[0111] In addition, in the present disclosure, risk assessment for entities is performed based on information on past transactions of each entity and attribute information of each entity, and risk assessment for subjects is performed based on the nature of the subject described in the subject attribute information, mutual adoption with the external environment, and value, thereby making it possible to determine specific risk factors and countermeasures for each of the entities and subjects. For example, risk factors related to entities that do not meet the reliability standard and cargo that does not match the contents of the declared cargo information can be determined.

[0112] In this way, by determining specific risk factors for each of the entities and subjects and implementing recommended measures, it is possible to reduce risks and promote safe and efficient transactions in the supply chain. As an example, by using the supply chain risk management means according to the embodiment of the present disclosure to determine discrepancies in cargo information, such as product names, product weights, and safety audit documents, that occur due to mistakes or fraudulent acts as risk factors, it is possible to prevent accidents caused by such discrepancies (such as a ship sinking due to overloading).

[0113] Therefore, according to the supply chain risk management means of the embodiment of the present disclosure, it is possible to provide a supply chain risk management means that can verify each of the entities and subjects involved in a transaction in the supply chain and perform risk assessment to determine specific risks that may occur in the transaction and countermeasures therefor.

[0114] As described above, the supply chain risk management measures according to the embodiments of the present disclosure relate to the following aspects.

[0115] (Aspect 1) A supply chain risk management device, comprising: A processor and a memory, The memory includes: Obtaining first subject credential information on a first subject traded in a supply chain and first entity credential information on a first entity that handles the first subject in the supply chain; a verification unit that determines whether the first subject credential information and the first entity credential information satisfy a predetermined reliability standard by comparing first subject identification information included in the first subject credential information and identifying the first subject, and first entity identification information included in the first entity credential information and identifying the first entity, against a blockchain that stores identification information related to subjects and entities in the supply chain; if it is determined that the first subject credential and the first entity credential satisfy the predetermined reliability criterion; a risk management unit that generates and outputs risk management information indicating entity risk factors of the first entity, subject risk factors of the first subject, and risk countermeasures based on first entity transaction information indicating a history of past transactions related to the first entity, the first subject credential information, and the first entity credential information; The supply chain risk management device further comprises a processing instruction for causing the processor to function as a

[0116] (Aspect 2) The verification unit is obtaining second entity credential information from the blockchain regarding a second entity related to the first entity based on the first entity identification information; The risk management department obtaining, from an entity information database storing entity information characterizing entities in the supply chain, first entity transaction information indicating a history of past transactions regarding the first entity and second entity transaction information indicating a history of past transactions regarding the second entity; extracting first entity attribute information from the first entity credential information, the first entity attribute information indicating an attribute related to the first entity, and extracting second entity attribute information from the second entity credential information, the second entity attribute information indicating an attribute related to the second entity; determining a risk factor of the first entity and a risk factor of the second entity based on the first entity transaction information, the second entity transaction information, the first entity attribute information, and the second entity attribute information; 2. The supply chain risk management device according to claim 1,

[0117] (Aspect 3) The risk management department using the first entity transaction information and the second entity transaction information to calculate a first credibility score for the first entity and a second credibility score for the second entity based on a number of successful transactions, a number of unsuccessful transactions, and a confidence level of the first entity and the second entity, respectively; determining that an entity risk element exists due to the first entity or the second entity if the first trustworthiness score or the second trustworthiness score does not meet a predefined trustworthiness threshold; 3. The supply chain risk management device according to aspect 1 or 2.

[0118] (Aspect 4) The risk management department extracting first subject attribute information from the first subject credential information, the first subject's nature, value, and interoperability with an external environment; determining a subject risk factor of the first subject by analyzing the first subject attribute information by a predetermined machine learning means; 4. The supply chain risk management device according to any one of aspects 1 to 3.

[0119] (Aspect 5) The supply chain risk management device includes: Further including a specialized knowledge DB in which past risk factors that have occurred in the past are associated with effective measures against the past risk factors, The risk management department determining a probability of occurrence of said entity risk elements and said subject risk elements by modelling said entity risk elements and said subject risk elements using a predefined risk modelling means; Analyzing the entity risk elements, the subject risk elements, and the occurrence probabilities using a predetermined fuzzy logic means, and determining the risk countermeasures for the entity risk elements and the subject risk elements from the expert knowledge DB; The entity risk element, the subject risk element, the occurrence probability, and the risk countermeasure are generated as the risk management information, and output. 5. The supply chain risk management device according to any one of aspects 1 to 4.

[0120] (Aspect 6) the first subject credential information and the first entity credential information are credential information according to a Verifiable Credential method, The first subject identification information and the first entity identification information are identification information according to a Decentralized Identifier method. 6. The supply chain risk management device according to any one of aspects 1 to 5.

[0121] Although the embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and various modifications are possible without departing from the gist of the present invention. [Explanation of symbols]

[0122] 150 Supply Chain Risk Management Applications 200 Supply Chain Risk Management System 210 Supply Chain Risk Management Device 220 Memory 222 Verification Department 224 Risk Management Department 232 Expertise DB 244 processors 246 Input / output section 250 Communication Network 260 User Terminals 270 Blockchain 280 Log Server

Claims

1. A supply chain risk management device, comprising: A processor and a memory, The memory includes: Obtaining first subject credential information on a first subject traded in a supply chain and first entity credential information on a first entity that handles the first subject in the supply chain; a verification unit that determines whether the first subject credential information and the first entity credential information satisfy a predetermined reliability standard by comparing first subject identification information included in the first subject credential information and identifying the first subject, and first entity identification information included in the first entity credential information and identifying the first entity, against a blockchain that stores identification information regarding subjects and entities in the supply chain; if it is determined that the first subject credential and the first entity credential satisfy the predetermined trustworthiness criterion; a risk management unit that generates and outputs risk management information indicating entity risk factors of the first entity, subject risk factors of the first subject, and risk countermeasures based on first entity transaction information indicating a history of past transactions related to the first entity, the first subject credential information, and the first entity credential information; The supply chain risk management device further comprises a processing instruction for causing the processor to function as a

2. The verification unit is obtaining second entity credential information from the blockchain regarding a second entity related to the first entity based on the first entity identification information; The risk management department obtaining, from an entity information database storing entity information characterizing entities in the supply chain, first entity transaction information indicative of a history of past transactions relating to the first entity and second entity transaction information indicative of a history of past transactions relating to the second entity; extracting first entity attribute information from the first entity credential information, the first entity attribute information indicating an attribute related to the first entity, and extracting second entity attribute information from the second entity credential information, the second entity attribute information indicating an attribute related to the second entity; determining a risk component of the first entity and a risk component of the second entity based on the first entity transaction information, the second entity transaction information, the first entity attribute information, and the second entity attribute information; 2. The supply chain risk management device according to claim 1 .

3. The risk management department using the first entity transaction information and the second entity transaction information to calculate a first reliability score for the first entity and a second reliability score for the second entity based on a number of successful transactions, a number of unsuccessful transactions, and a confidence level of the first entity and the second entity, respectively; determining that an entity risk element exists due to the first entity or the second entity if the first reliability score or the second reliability score does not meet a predefined reliability threshold; 3. The supply chain risk management device according to claim 2.

4. The risk management department Extracting first subject attribute information from the first subject credential information, the first subject's nature, value, and interoperability with an external environment; Analyzing the first subject attribute information by a predetermined machine learning means to determine a subject risk element of the first subject; 2. The supply chain risk management device according to claim 1 .

5. The supply chain risk management device includes: The system further includes a specialized knowledge database in which past risk factors that have occurred in the past are associated with effective measures against the past risk factors, The risk management department determining a probability of occurrence of said entity risk elements and said subject risk elements by modelling said entity risk elements and said subject risk elements using a predefined risk modelling means; Analyzing the entity risk elements, the subject risk elements, and the occurrence probabilities using a predetermined fuzzy logic means, and determining the risk countermeasures for the entity risk elements and the subject risk elements from the expert knowledge DB; The entity risk element, the subject risk element, the occurrence probability, and the risk countermeasure are generated as the risk management information, and output.

2. The supply chain risk management device according to claim 1 .

6. the first subject credential information and the first entity credential information are credential information according to a Verifiable Credential method, The first subject identification information and the first entity identification information are identification information according to a Decentralized Identifier method.

2. The supply chain risk management device according to claim 1 .

7. A supply chain risk management method implemented in a supply chain risk management device, comprising: The supply chain risk management device includes: A processor and a memory, The memory includes: obtaining first subject credential information on a first subject traded in a supply chain and first entity credential information on a first entity that handles the first subject in the supply chain; extracting from the first subject credential information a first subject identity identifying the first subject; extracting first entity identification information from the first entity credential information that identifies the first entity; determining whether the first subject credential and the first entity credential meet a predetermined reliability standard by matching the first subject identity and the first entity identity against a blockchain that stores identity information regarding subjects and entities in the supply chain; if it is determined that the first subject credential and the first entity credential satisfy the predetermined trustworthiness criterion; extracting first subject attribute information from the first subject credential information, the first subject attribute information indicating attributes related to the first subject, and extracting first entity attribute information from the first entity credential information, the first entity attribute information indicating attributes related to the first entity; obtaining first entity transaction information indicating a history of past transactions related to the first entity from an entity information database storing entity information characterizing entities in the supply chain based on the first entity identification information; determining an entity risk factor for the first entity based on the first entity attribute information and the first entity transaction information; determining a subject risk factor of the first subject based on the first subject attribute information; determining a probability of occurrence of said entity risk elements and said subject risk elements by modelling said entity risk elements and said subject risk elements by predefined risk modelling means; A process of determining risk countermeasures for the entity risk elements and the subject risk elements from a specialized knowledge database in which past risk elements that have occurred in the past are associated with effective countermeasures for the past risk elements by analyzing the entity risk elements, the subject risk elements, and the occurrence probability using a predetermined fuzzy logic means; generating and outputting risk management information indicative of the entity risk factors, the subject risk factors, the occurrence probabilities, and the risk countermeasures; The supply chain risk management method according to claim 1, further comprising:

8. A supply chain risk management device for determining risks to transactions carried out in a supply chain; A user terminal; A supply chain risk management system including a blockchain, The supply chain risk management device includes: A processor and a memory, The memory includes: Obtaining first subject credential information on a first subject traded in the supply chain and first entity credential information on a first entity that handles the first subject in the supply chain; a verification unit that determines whether the first subject credential information and the first entity credential information satisfy a predetermined reliability standard by comparing first subject identification information included in the first subject credential information and identifying the first subject, and first entity identification information included in the first entity credential information and identifying the first entity, against the blockchain that stores identification information regarding subjects and entities in the supply chain; if it is determined that the first subject credential and the first entity credential satisfy the predetermined trustworthiness criterion; a risk management unit that generates risk management information indicating entity risk factors of the first entity, subject risk factors of the first subject, and risk countermeasures based on first entity transaction information indicating a history of past transactions related to the first entity, the first subject credential information, and the first entity credential information, and outputs the risk management information to the user terminal; and processing instructions for causing the processor to function as a supply chain risk management system.

Images