Chemical Product Passport for Emissions Data

Abstract

An apparatus for generating a chemical product passport is disclosed, the apparatus comprising one or more computing nodes and one or more computer readable media having computer executable instructions configured, when executed by the one or more computing nodes, to cause the apparatus to perform the following steps: receiving a request to provide emission data and a non-central identifier associated with a data owner, in response to the request, generating a chemical product passport including the non-central identifier and data related to the emission data, and providing the chemical product passport for access by a data consumption service under control by a data providing service associated with the data owner.

Description

[Technical field]

[0001] Technical Field The present disclosure relates to an apparatus for generating a chemical product passport, a computer implemented method for generating a chemical product passport, a method and computer program elements for using a chemical product passport. [Background technology]

[0002] Technology background The supply of chemical products must meet many regulatory requirements that vary depending on the chemical product. For example, in the automotive supply chain, chemical companies provide standardized information using the International Materials Data System (IMDS). Such a system makes it possible to collect data along the entire moving vehicle supply chain. Participants in the automotive supply chain register with the IMDS service and keep product entries in a central database provided and hosted by a third-party provider.

[0003] Systems like IMDS are static in terms of data, prone to errors, and cumbersome to handle or maintain. Due to the high specificity and centralized setup of such systems, exchanging and sharing chemical data is a daunting task. Therefore, there is a need to simplify the exchange and sharing of chemical data. Summary of the Invention [Means for solving the problem]

[0004] Summary of the Invention In one aspect, an apparatus for generating a chemical product passport is disclosed, the apparatus comprising one or more computing nodes and one or more computer readable media that, when executed by the one or more computing nodes, causes the apparatus to perform the following steps: receiving a request providing a non-central identifier associated with the data owner and the emission data; generating, in response to the request, a chemical product passport including the non-central identifier and data related to the emissions data; providing the chemical product passport for access by a data consuming service under the control of a data providing service associated with the data owner; one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0005] In one aspect, an apparatus for generating a chemical product passport is disclosed, the apparatus comprising one or more computing nodes and one or more computer readable media that, when executed by the one or more computing nodes, causes the apparatus to perform the following steps: receiving a request to provide a non-central identifier and emission data associated with a data owner; in response to the request, providing the non-central identifier and generating a chemical product passport that includes data relating to the non-central identifier and the emissions data; providing the chemical product passport for access by a data consuming service under the control of or controlled by a data providing service associated with the data owner; one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0006] In one aspect, an apparatus for generating a chemical product passport is disclosed, the apparatus comprising one or more computing nodes and one or more computer readable media that, when executed by the one or more computing nodes, causes the apparatus to perform the following steps: providing a data owner with associated non-central identifiers and emission data; generating a chemical product passport comprising data relating to the non-central identifier and the emissions data; providing the chemical product passport for access by a data consuming service controlled by a data providing service associated with the data owner; one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0007] In one aspect, an apparatus for generating a chemical product passport including a decentralized identifier and data related to emission data, in particular a digital representation of the emission data, is disclosed, the apparatus comprising: one or more computing nodes; and one or more computer-readable media that, when executed by the one or more computing nodes, causes an apparatus to perform the following steps: receiving a request to provide emission data and a non-central identifier associated with a data owner, in particular the data owner controls access to the emission data, e.g. by data consumption services; in response to the request, providing the non-central identifier and generating a chemical product passport that includes data relating to the non-central identifier and the emissions data; providing the chemical product passport for access by a data consuming service controlled by or under the control of a data providing service associated with the data owner; one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0008] In one aspect, an apparatus for generating a chemical product passport including a decentralized identifier and data related to emission data, in particular a digital representation of the emission data, is disclosed, the apparatus comprising: one or more computing nodes; and one or more computer-readable media that, when executed by the one or more computing nodes, causes an apparatus to perform the following steps: providing emission data and a non-central identifier associated with a data owner, in particular the data owner controlling access to the emission data, for example by data consumption services; generating a chemical product passport comprising data relating to the non-central identifier and the emissions data; providing the chemical product passport for access by a data consuming service controlled by or under the control of a data providing service associated with the data owner; one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0009] In one aspect, an apparatus for generating a chemical product passport including data relating, inter alia, to a non-central identifier and emission data is disclosed, the apparatus comprising: one or more computing nodes; and one or more computer-readable media that, when executed by the one or more computing nodes, causes an apparatus to perform the following steps: receiving a request to provide emission data and a non-central identifier associated with a data owner; in response to the request, providing the non-central identifier and generating a chemical product passport that includes data relating to the non-central identifier and the emissions data; Providing a chemical product passport for access by a data consuming service controlled or under the control of a data providing service associated with the data owner, in particular the data providing service including computer executable instructions for providing and / or processing emission data associated with the data owner, for example for access and / or processing by the data consuming service. one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0010] In one aspect, an apparatus for generating a chemical product passport including, inter alia, data relating to a non-central identifier and emission data is disclosed, the apparatus comprising: one or more computing nodes; and one or more computer-readable media that, when executed by the one or more computing nodes, causes an apparatus to perform the following steps: providing a decentralized identifier associated with the emissions data and the data owner; generating a chemical product passport comprising data relating to the non-central identifier and the emissions data; Providing a chemical product passport for access by a data consuming service controlled or under the control of a data providing service associated with the data owner, in particular the data providing service including computer executable instructions for providing and / or processing emission data associated with the data owner, for example for access and / or processing by the data consuming service. one or more computer-readable media having computer-executable instructions configured to cause a Equipped with.

[0011] In another aspect, a computer-implemented method for generating a chemical product passport is disclosed, the method comprising: receiving a request providing a non-central identifier associated with a data owner and emission data; generating, in response to the request, a chemical product passport including the non-central identifier and data related to the emissions data; providing a chemical product passport for access by a data consuming service controlled by a data providing service associated with the data owner; Includes.

[0012] In one aspect, a computer-implemented method for generating a chemical product passport is disclosed, the method comprising: providing a decentralized identifier associated with the data owner and the emission data; generating a chemical product passport including data relating to the non-central identifier and the emissions data; providing a chemical product passport for access by a data consuming service controlled by a data providing service associated with the data owner; Includes.

[0013] In another aspect, a computer-implemented method for generating a chemical product passport including a non-central identifier and data related to emission data, in particular a digital representation of the emission data, is disclosed, the method comprising: receiving a request to provide emission data and a non-central identifier associated with a data owner, in particular the data owner controls access to the emission data, e.g. by a data consumption service; in response to the request, providing a non-central identifier and generating a chemical product passport including data relating to the non-central identifier and the emissions data; providing the chemical product passport for access by a data consuming service controlled by or under the control of a data providing service associated with the data owner; Includes.

[0014] In another aspect, a computer-implemented method for generating a chemical product passport including a non-central identifier and data related to emission data, in particular a digital representation of the emission data, is disclosed, the method comprising: providing a non-central identifier associated with the emission data and a data owner, in particular the data owner controlling access to the emission data, for example by a data consumption service; generating a chemical product passport including data relating to the non-central identifier and the emissions data; providing the chemical product passport for access by a data consuming service controlled by or under the control of a data providing service associated with the data owner; Includes.

[0015] In another aspect, a computer-implemented method for generating a chemical product passport including a non-central identifier and data related to emission data, in particular a digital representation of the emission data, is disclosed, the method comprising: receiving a request to provide a non-central identifier associated with the emission and the data owner; generating, in response to the request, a chemical product passport including the non-central identifier and data related to the emissions data; Providing a chemical product passport for access by a data consuming service controlled or under the control of a data providing service associated with the data owner, in particular the data providing service including computer executable instructions for providing and / or processing emission data associated with the data owner, for example for access and / or processing by the data consuming service. Includes.

[0016] In another aspect, a computer-implemented method for generating a chemical product passport including a non-central identifier and data related to emission data, in particular a digital representation of the emission data, is disclosed, the method comprising: providing a decentralized identifier associated with the emission and the data owner; generating a chemical product passport comprising data relating to the non-central identifier and the emissions data; Providing a chemical product passport for access by a data consuming service controlled or under the control of a data providing service associated with the data owner, in particular the data providing service including computer executable instructions for providing and / or processing emission data associated with the data owner, for example for access and / or processing by the data consuming service. Includes.

[0017] In yet another aspect, a computer implemented method is disclosed that preferably uses a chemical product passport for further processing of a chemical product associated with the chemical product passport, the method comprising: receiving a request to access emissions data associated with a non-central identifier of a chemical product passport generated according to the methods disclosed herein or by the apparatus disclosed herein; Optionally, authenticating and / or authorizing requests to access the emissions data; - optionally based on authentication and / or authorization, providing access to the emissions data associated with the non-central identifier of the chemical product passport; Includes.

[0018] Use of a chemical product passport generated according to the methods described herein or by the apparatus described herein for a chemical product for further processing of a chemical product associated with the chemical product passport.

[0019] In yet another aspect, a chemical product associated with a chemical product passport is disclosed, wherein a chemical product passport including a non-central identifier and data related to emission data is generated for the chemical product according to the methods described herein or by the apparatus described herein.

[0020] In yet another aspect, a system is disclosed that includes a chemical product associated with a chemical product passport, where a chemical product passport including a non-central identifier and data related to emission data is generated for the chemical product according to a method described herein or by an apparatus described herein.

[0021] In yet another aspect, a chemical product passport is disclosed that includes a non-central identifier and data related to emission data, the chemical product passport being generated for a chemical product according to the methods described herein or by the apparatus described herein.

[0022] In yet another aspect, a computer element, particularly a computer program product or computer readable medium, is disclosed having instructions configured, when executed on one or more computing devices, to cause any of the steps of the methods disclosed herein or to be performed by the devices disclosed herein.

[0023] Any disclosures and embodiments described herein relate to methods, devices, systems, chemical products, chemical product passports, uses, computer elements as described above or below and vice versa. Benefits provided by any of the embodiments and examples apply equally to all other embodiments and examples.

[0024] As used herein, "determining" also includes "initiating or causing a determination," "generating" also includes "initiating or causing a generation," and "providing" also includes "initiating or causing a determination, generation, selection, transmission, and / or reception." "Initiating or causing the execution of an action" includes any processing signal that triggers a computing node or device to perform the respective action.

[0025] The methods, devices, and computer elements disclosed herein provide an efficient, secure, and robust way of sharing or exchanging data across different participant nodes in the chemical value chain. In particular, by a) attaching a non-central identifier to the data owner and the associated emission data, and b) providing access by data consumption services operated by data providing services associated with the data owner, data can be securely exchanged and shared under the sovereignty of the data owner. Thus, the data owner may control access to the chemical product data by the participant nodes or data consumption services of the non-central network. This allows for simplified and customized data sharing or exchange from the chemical industry to the chemical supply chain participants. In this way, more reliable and efficient further processing of the supplied chemical products by the upstream participants of the chemical supply chain can be achieved, while the data remains within the ownership of the chemical supplier supplying the upstream participant. By directly combining the data related to the chemicals with the non-central identifier and optionally with one or more authentication mechanisms, more reliable and secure data sharing and exchange can be provided. By further including one or more authorization mechanisms, data sharing or exchange can be made more flexible, with multiple data consumption services from different participants of the chemical supply chain having access to the emission data.

[0026] The term "non-centralized identifier" should be understood broadly in this case. A non-centralized identifier may include any unique identifier that is uniquely associated with a data owner and chemical data, particularly emissions data. A non-centralized identifier may include one or more universally unique identifiers (UUIDs) or digital identifiers (DIDs). A non-centralized identifier may be issued by a central or non-centralized identity issuer. A non-centralized identifier may include authentication information. Through a non-centralized identifier and its unique association with a data owner and chemical data, particularly emissions data, access to the chemical data, particularly emissions data, can be controlled by the data owner. This is in contrast to a centralized authorization scheme, where an identifier is provided by such a central authorization authority and access to the data is controlled by such a central authorization authority. Non-centralized in this context refers to the use of an identifier in an embodiment controlled by the data owner.

[0027] The non-central identifier may include one or more identifiers used in the non-central network to enable data exchange over the non-central network. Data exchange may include discovery of the non-central identifier of a participant node of the non-central network, authentication of the participant node of the non-central network, and / or authorization of data transfer via peer-to-peer communication between the participant nodes of the non-central network. The non-central identifier may be associated with any participant of the supply chain, including a raw chemical supplier, an intermediate chemical manufacturer, an intermediate manufacturer, a component manufacturer, a component assembly manufacturer, or an end product manufacturer. The non-central identifier may be associated with a machine, system, or device, or a collection of such machines, devices, and / or systems, used to manufacture a raw material, a base material, a chemical product, an intermediate product, a component, a component assembly, or an end product.

[0028] The term "chemical product passport" should be understood in the broad sense in this case. The chemical product passport may include data related to a chemical product. The chemical product passport may include a digital representation of chemical product data related to a chemical product. The chemical product passport may include or be associated with a digital representation of chemical product data, in particular emission data. The chemical product data may be associated with a chemical product. The digital representation of the chemical product data may be provided to a data consumption service. The digital representation of the chemical product data may be provided by a non-central network database, a database associated with the data consumption, a data provision service associated with the data owner, or a combination thereof. The digital representation may include a representation for accessing the chemical product data, in particular emission data, or a part thereof. The digital representation may include a representation of the chemical product data, in particular emission data, or a part thereof. The chemical product passport may include data related to the chemical product data, in particular emission data, a public key, and a non-central identifier. The data related to the chemical product data, in particular emission data, may include a digital representation of the chemical product data, in particular emission data.

[0029] The term "chemical product" should be understood broadly in this case. Chemical products may include chemical products resulting from chemical reactions and natural chemical products. Natural chemical products encompass any naturally occurring chemicals, i.e., any unprocessed chemicals found in nature, such as chemicals from plants, microorganisms, animals, earth, and sea, or any chemicals found in nature and extracted using a process that does not change any chemical composition. Natural chemical products may include biological products such as enzymes and naturally occurring inorganic or organic chemical products. Natural chemical products may be separated and purified prior to use or may be used in unseparated and / or unpurified form. Chemical products resulting from chemical reactions may be any inorganic or organic chemical products resulting from the reaction of inorganic and / or organic chemical reactions. The inorganic and organic chemical reactants may be naturally occurring chemical products or may be chemical products resulting from chemical reactions. Chemical reactions may include any chemical reaction generally known in the art in which reactants are converted into one or more different chemical products. Chemical reactions may include the use of catalysts, enzymes, bacteria, etc. to achieve a chemical reaction between reactants.

[0030] The term "chemical product data" should be understood broadly in this case. Chemical product data may be associated with a chemical product. Chemical product data may include data related to the properties of the chemical product and / or data related to the use of the chemical product. Such properties may be static properties or dynamic properties. Static properties may be properties that remain constant over time, e.g. melting point, boiling point, density, hardness, flammability, etc. Dynamic properties may be properties that change over time, e.g. shelf life, pH value, color, reactivity. Chemical product properties may include chemical properties such as performance properties, flammability, toxicity, acidity, reactivity, heat of combustion, and / or physical properties such as density, color, hardness, melting point and boiling point, electrical conductivity, etc. Data related to the use of the chemical product may include data related to the further processing of the chemical product, e.g. by using the chemical product as a reactant in a further chemical reaction and / or data related to the use of the chemical product, e.g. data related to the use of the chemical product in a treatment process and / or within a manufacturing process. The chemical product data may include chemical substance data, emissions data, recycle content, biobased content, and / or production data.

[0031] The term "physical entity" should be understood broadly in this case. The physical entity may relate to the physical embodiment of a product. The physical entity may be any product in the chemical supply chain. The physical entity of a product may be a raw material or base substance, a chemical product, a chemical material, a chemical composition, a chemical mixture, a component, a component assembly, a final product, or a combination thereof.

[0032] The term "recycled content data and / or biobased content data" should be understood broadly in this case. Recycled content data and / or biobased content data may include any data related to the recycle content or biobased content used to provide or manufacture a physical entity or product at any stage in the chemical supply chain, such as a raw material or base substance, a chemical product or chemical material, a component, a component assembly, or a final product.

[0033] The term "emission data" should be understood broadly in this case. Emission data may include any data related to an environmental footprint. An environmental footprint may refer to an entity and its associated environmental footprint. An environmental footprint may be entity specific. For example, an environmental footprint may relate to a product, a company, a process such as a manufacturing process, a raw material or base substance, a chemical product or material, a component, a component assembly, a final product, a combination thereof, or additional entity specific relationships. Emission data may include data related to a carbon footprint of a chemical product or a product carbon footprint (PCF). Emission data may include, for example, data related to greenhouse gas emissions released in the manufacture of a chemical product. Emission data may include data related to greenhouse gas emissions. Greenhouse gas emissions can include emissions such as carbon dioxide (CO2) emissions, methane (CH4) emissions, nitrous oxide (N2O) emissions, hydrofluorocarbon (HFC) emissions, perfluorocarbon (PFC) emissions, sulfur hexafluoride (SF6) emissions, nitrogen trifluoride (NF3) emissions, combinations thereof, and additional emissions.

[0034] Emissions data may include data related to the greenhouse gas emissions of an entity or company's own operations (manufacturing, electricity, factories, and waste incineration). Scope 2 may include emissions from externally supplied energy production. Scope 3 may include all other emissions along the value chain. Specifically, this may include the greenhouse gas emissions of raw materials obtained from suppliers. A product carbon footprint (PCF) may sum up the greenhouse gas emissions and removals from successive interlinked processes related to a particular product. A cradle-to-gate PCF may sum up the greenhouse gas emissions based on selected process steps, from resource extraction to the factory gate where the product leaves the company. Such a PCF may be referred to as a partial PCF. To achieve such aggregation, each company offering any product may provide a scope 1 and scope 2 contribution to the PCF of each product.

[0035] The term "manufacturing data" should be understood broadly in this case. The manufacturing data may include any data related to the manufacturing of a product at any stage in the chemical supply chain. Preferably, the manufacturing data includes chemical manufacturing data from the manufacturing of a chemical product. The manufacturing data may include monitoring and / or control data related to the manufacturing of a product such as a raw material or base substance, a chemical material or product, a component, a component assembly, a final product, or a combination thereof. The manufacturing data may include measurement data related to product quality, preferably a chemical product, at any stage in the chemical supply chain.

[0036] The term "data owner" should be understood broadly in this case. The data owner includes any entity that generates data, in particular chemical product data or emissions data. The generating node may be linked to an entity that is the source of the data, in particular chemical product data or emissions data, or that owns the physical product to which the data, in particular chemical product data or recyclate content data and / or bio-based content data, pertains. The data may be generated by a third party entity on behalf of the entity that is the source of the data or that owns the physical product to which the generated data pertains. The data owner may be a chemical manufacturer. Access to the chemical product data may be controlled by the data owner via a non-central identifier and a unique association between the data owner and the chemical product data. The chemical product data may be accessible to the data owner. Thus, the data owner may directly or indirectly own the chemical product data. The chemical product data may be stored in a database of the data owner or a database associated with the data owner. The chemical product data may be stored in a database accessible to the data owner. The data owner may control access to the chemical product data via the data owner's data provision service. The data owner may control access to the chemical product data. The chemical product data may be associated with the data owner. The data owner may be the owner of the chemical data or the chemical data owner. The chemical data may be stored in the data owner's database or under the control of the data owner. In this sense, the data owner should be broadly interpreted as an entity that has access to the chemical data and that controls access by decentralized network data consuming services to the chemical data. The data owner may be a chemical manufacturer.

[0037] The term "data consumption service" should be understood broadly in this case: a data consumption service may include computer-executable instructions for accessing and / or processing data, such as chemical product data, particularly emissions data, associated with a data owner.

[0038] The term "data providing service" should be understood broadly in this case: a data providing service may include computer-executable instructions for providing and / or processing data, such as chemical product data, particularly emissions data, associated with a data owner for access and / or processing by a data consuming service.

[0039] The term "digital representation pointing to product data or a part thereof" should be understood broadly in this case. The digital representation pointing to product data or a part thereof includes at least one interface to a data providing service. The digital representation pointing to product data or a part thereof may further include at least one interface to a data consuming service. The digital representation pointing to product data or a part thereof may include data exchange or sharing endpoints (resource endpoints) or service interaction endpoints (service endpoints) that are uniquely identified via a communication protocol. Thus, the digital representation pointing to product data or a part thereof may be uniquely associated with a non-central identifier.

[0040] In one embodiment, the request to provide a non-central identifier includes data related to chemical data, particularly emissions data, and an owner identifier associated with a chemical data owner, particularly the owner of the emissions data. The owner identifier may be a string identifier associated with the data owner's name. The owner identifier or product identifier may be provided by a physical identifier provider, such as a barcode or tag, such as an RFID tag or a QR code. Such communication may also be completed via ad-hoc WIFI, BLE beacon, and / or NFC. Communication between wallet apps may be performed via any available communication channel, including but not limited to a web server, ad-hoc WIFI, BLE beacon signal, NFC, barcode, or QR code scanning, etc.

[0041] Through the owner identifier, the generated chemical passport can be associated with a chemical data owner, in particular an owner of emission data, by including the owner identifier. The owner identifier can be used for data transactions, such as sharing or exchanging chemical data, in particular emission data. The owner identifier can be provided to a transaction manager. Providing the decentralized identifier and the owner identifier of the data owner to a transaction manager or data consumption service can simplify tracking of data transactions. Any transaction in the data ecosystem can be associated with, for example, the unambiguous name of the data owner.

[0042] In one or more embodiments, the non-centralized identifier is provided by a central node or by one or more non-centralized nodes. The non-centralized identifier generated by a central node or by one or more non-centralized nodes may be provided to the node generating the chemical passport and preferably to at least one authenticated data registry node accessible by the data providing service and / or the data consuming service. This allows for the sharing or exchange of customized data regarding the chemical products and the chemical supply chain in which the chemical products are supplied. In particular, the data providing service and / or the data consuming service may customize a data sharing or exchange protocol based on associating the non-centralized identifier with the chemical product data, in particular the emission data.

[0043] The authenticated data registry node may be a central registry node, such as a central file system, a centrally managed distributed database, and / or a centrally managed peer-to-peer network. A central configuration allows for more control and standardization via the central node. The authenticated data registry node may be a non-central registry, such as a distributed ledger, a non-central file system, a distributed database, and / or a peer-to-peer network. A non-central configuration allows for more efficient use of computing resources and allows for greater control by data owners. Additionally, a non-central configuration is independent of central management, thus increasing the reliability and flexibility of the system.

[0044] In one embodiment, the generation of a chemical product passport includes providing a non-centralized identifier associated with a physical entity of a product. In this regard, the physical entity may relate to a physical product associated with a non-centralized identifier. The physical entity may be any entity in the chemical supply chain. The physical entity may relate to a raw material such as crude oil, a chemical product such as polyols and diisocyanates or polyurethane intermediates made from polyols and diisocyanates, a component such as a foam part or beat, a component assembly such as a car seat or shoe sole, and / or a final product such as a car.

[0045] The non-central identifier may be associated with a physical entity to which the chemical product data, in particular the emission data, is related. The non-central identifier may be associated with a chemical product to which the chemical product data, in particular the emission data, is related. For example, the non-central identifier may be associated with a physical entity such as a base substance, a raw material, a chemical material, a chemical mixture, a chemical composition, etc. The non-central identifier may be associated with a physical entity to which the chemical product is supplied and to which the chemical product data, in particular the emission data, is related. For example, the non-central identifier may be associated with a physical entity such as a component, a component assembly, a final product, etc. The non-central identifier may be associated with two or more physical entities to which the chemical product is supplied and to which the chemical product data, in particular the emission data, is related. For example, the non-central identifier may be associated with a physical entity of a component, a component assembly, and a final product. By associating the non-central identifier with different physical entity stages in the chemical supply chain, it becomes possible to virtually trace the chemical product supplied in the supply chain. In this way, the chemical product to which the chemical product data, in particular the emission data, is associated can be traced, for example, until the end of the life of the final product.

[0046] In one embodiment, the chemical passport includes one or more authentication mechanisms associated with the non-central identifier and data associated with the chemical data, in particular the emission data. The authentication mechanisms may be directly or indirectly associated with the non-central identifier and data associated with the chemical data. In one example of an indirect association, the authentication mechanism may be associated with a certificate mechanism. For example, a dynamic access token may be generated in the certificate mechanism upon an access request by the data consuming service. Such a dynamic access token may be used to open a peer-to-peer communication channel between the data consuming service and the data providing service. The authentication mechanism may include tokens such as private key and public key infrastructure, certificate mechanisms, or biometric mechanisms such as fingerprint, face recognition, or voice recognition. One common public key certificate is, for example, an X.509 certificate. Through the authentication mechanisms, data access by the data consuming service can be securely controlled and the integrity of the data providing service can be guaranteed. This allows for a more reliable, controlled, and secure data exchange or sharing.

[0047] One or more authentication mechanisms associated with non-centralized identifiers generated by one central node or one or more non-centralized nodes can provide chemical product passports to at least one non-centralized authenticated data registry accessible by the generating node or preferably by a data providing service and / or a data consuming service. The authenticated data registry can be a central registry such as a central file system, a centrally managed distributed database, and / or a centrally managed peer-to-peer network. The central configuration allows for a higher degree of control and standardization via the control node. The authenticated data registry can be a non-central registry such as a distributed ledger, a non-centralized file system, a distributed database, and / or a peer-to-peer network. The non-central configuration allows for a more efficient use of computational resources and enhances control by the data owner.

[0048] In one embodiment, the chemical passport is associated with or includes one or more authorization mechanisms associated with the decentralized identifiers and data related to chemical data, particularly emissions data. The authorization mechanisms may include authorization rules including data transaction instructions or protocols, such as data usage policies, smart data contracts, or more complex data processing instructions associated with the data providing and / or data consuming services. Through the authentication mechanisms, data access and data usage by the data consuming services can be securely controlled.

[0049] One or more authentication mechanisms associated with a non-central identifier generated by the data central node or one or more non-central nodes may be provided to the nodes generating or processing chemical passports or to the nodes accessing data relating to chemical data, in particular emission data. Additionally or alternatively, one or more authorization mechanisms may be provided in at least one central or non-central authorized data registry, preferably accessible by the data providing service and / or the data consuming service.

[0050] In one embodiment, one or more authorization mechanisms associated with the non-centralized identifiers generated by one or more non-centralized nodes may be provided to at least one of a central file system, a centrally managed distributed database, a centrally managed peer-to-peer network, a distributed ledger, a non-centralized file system, a distributed database, and / or a peer-to-peer network accessible by the nodes generating or processing the chemical passports and preferably by the data providing service and / or the data consuming service.

[0051] In one embodiment, the data relating to chemical data, particularly emissions data, comprises chemical data, particularly chemical data, particularly emissions data, or a portion thereof. In one embodiment, the data relating to chemical data, particularly emissions data, comprises one or more digital representations pointing to the chemical data, particularly emissions data, or a portion thereof. In this context, pointing to means any network representation or address suitable for accessing the chemical data, particularly emissions data. The data relating to chemical data, particularly emissions data, may comprise multiple digital representations pointing to separate portions of the chemical data, particularly emissions data. The data relating to chemical data, particularly emissions data, may comprise multiple digital representations pointing to different portions of the chemical data, particularly emissions data. Such different portions may overlap at some data points. The representations may comprise access points to the chemical data, particularly emissions data, links for accessing the chemical data, particularly emissions data, endpoints for accessing the chemical data, particularly emissions data, or service endpoints for accessing the chemical data, particularly emissions data. In this way, the chemical data, particularly emissions data, may be maintained and controlled by the data owner. Since there is no need to check and control access to multiple distributed data points, access can be provided via representations of access points that simplify data validation, integrity checks, or quality checks and access control. The chemical data, particularly the emission data, can be stored in a database of the data owner or a database associated with the data owner. The chemical data, particularly the emission data, can be stored in a database accessible to the data owner. The chemical data, particularly the emission data, or a digital representation pointing to a portion thereof, can be associated or related to any such database associated with or accessible by the data owner. For added security, the chemical data, particularly the emission data, or a digital representation pointing to a portion thereof, can be indirectly related to any such database associated with or accessible by the data owner.

[0052] In one embodiment, the chemical passport includes and is associated with data related to one or more classes of chemical data, particularly emissions data. For example, the data related to the chemical data, particularly emissions data, includes one or more digital representations that refer to different classes of chemical data, particularly emissions data. In one embodiment, the chemical passport includes data related to different classes of chemical data, particularly emissions data. For example, the data related to the chemical data includes multiple digital representations that refer to different classes of chemical data, particularly emissions data.

[0053] In one embodiment, at least one class of chemical product data is associated with or includes chemical substance data, e.g., a representation of data required by chemical substance regulations or regulatory data. The chemical product passport may include data related to chemical substance data. The chemical substance data may include chemical product declaration data associated with a physical entity of a chemical product, a product made from a chemical product or a product, such as a raw material, a chemical product, a component, a component assembly, or a final product and / or combinations thereof. The chemical product declaration data may be by associated with two or more raw materials or chemical products, such as used to manufacture a component. The chemical product declaration data may be associated with two or more raw materials or chemical products, such as used to manufacture multiple components to assemble a component assembly or final product.

[0054] In one embodiment, the chemical data includes chemical product safety data related to the hazards of substances or mixtures of a physical entity of a product, such as a raw material, a chemical product, a component, a component assembly, or an end product and / or combinations thereof. The chemical product safety data may be associated with two or more raw materials or chemical products, such as those used to manufacture a component. The chemical product safety data may be associated with two or more raw materials or chemical products, such as those used to manufacture multiple components to assemble a component assembly or end product.

[0055] In one embodiment, the chemical data includes certificates of analytical data associated with laboratory measurement data obtained from samples of raw materials, chemical products, components, component assemblies, or end products and / or combinations thereof. The certificates of analytical data may be associated with two or more raw materials or chemical products, such as those used to manufacture a component. The certificates of analytical data may be associated with two or more raw materials or chemical products, such as those used to manufacture multiple components to assemble a component assembly or end product.

[0056] In one embodiment, at least one class of chemical data includes emissions data, recyclable content data, biobased content data, and / or production data associated with a physical entity of a product, such as a raw material, a chemical product, a component, a component assembly, a final product, and / or combinations thereof. The chemical product passport may include data related to the emissions data, the recyclable content data, the biobased content data, and / or production data. The emissions data, the recyclable content data, the biobased content data, and / or production data may be associated with two or more raw materials or chemical products, such as those used to manufacture a component. The emissions data, the recyclable content data, the biobased content data, and / or production data may be associated with two or more raw materials or chemical products, such as those used to manufacture multiple components to assemble a component assembly or final product.

[0057] In one embodiment, at least one class of chemical data, particularly emissions data, includes restricted access chemical data, particularly emissions data, associated with a product physical entity, such as a raw material, a chemical product, a component, a component assembly, a final product, and / or combinations thereof. For example, the emissions data, the recycle content data, the biobased content data, the production data, or combinations thereof, may be restricted access. Such access restrictions may be provided by an authorization mechanism. For example, the authorization mechanism may include rules that specify which data consuming services may access under which conditions.

[0058] In one embodiment, at least one class of chemical data includes unrestricted chemical data associated with a product physical entity, such as a raw material, a chemical, a component, a component assembly, a final product, and / or combinations thereof. For example, chemical declaration data, chemical safety data, and / or certificate of analysis data associated with a product physical entity, such as a raw material, a chemical, a component, a component assembly, or a final product and / or combinations thereof, may be unrestricted or non-restricted. Such access may be provided by an authorization mechanism. For example, the authorization mechanism may include rules that specify that certain regulatory data of a chemical substance is accessible.

[0059] BRIEF DESCRIPTION OF THE DRAWINGS Hereinafter, the present disclosure will be further explained in relation to the accompanying drawings. [Brief description of the drawings]

[0060] [Figure 1a] 1 illustrates an example embodiment of a centralized and non-centralized computing environment having computing nodes. [Figure 1b] 1 illustrates an example embodiment of a centralized and non-centralized computing environment having computing nodes. [Figure 1c] 1 illustrates an example embodiment of a decentralized computing environment. [Diagram 2] 1 shows an example of a chemical product passport that includes DID owner data, DID document data, and a non-central identification infrastructure. [Diagram 3] 1 shows an example of a chemical product passport that includes ID-based data, passport data, and a non-central identification infrastructure. [Figure 4] An example of a method for generating a chemical product passport is given below. [Diagram 5] 1 illustrates an example of how a chemical product passport can be used for further processing of a chemical product associated with the chemical product passport. [Figure 6a] 1 shows an example of an authentication protocol. [Figure 6b] 1 shows an example of an authentication protocol. [Figure 7a] Illustrate the principles of cryptographic signatures. [Figure 7b] Illustrate the principles of cryptographic signatures. [Figure 8] An example of how access to chemical product data, particularly emissions data, may be granted is given. [Figure 9] 1 shows a schematic diagram of providing a data consuming service with access to a product passport of a data providing service within an International Data Space (IDS) architecture. [Figure 10] A schematic diagram of the authentication process between two IDS connectors is shown. [Figure 11] 1 shows a schematic diagram of usage-controlled data flow within an IDS architecture. [Figure 12] SUMMARY OF THE DISCLOSURE An example of an apparatus and associated method for generating a product passport in association with a chemical product produced by a chemical manufacturing network is presented. [Figure 13] 1 shows different configurations of a product passport based on a digital identifier. [Figure 14] 1 shows different configurations of a product passport based on a digital identifier. [Figure 15] 1 shows different configurations of a product passport based on a digital identifier. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0061] 1a-1c show different computing environments: centralized, decentralized and distributed. The disclosed method, device, system, passport, computer element may be implemented in a decentralized or at least partially decentralized computing environment. In particular, for data sharing or exchange in a multi-player ecosystem, different problems exist. Data sovereignty can be seen as a core issue. Data sovereignty can be defined as the ability of natural persons or business entities to be totally self-determined with respect to their data. To enable this particular ability, related aspects including the requirement to exchange data securely and reliably in a business ecosystem may be implemented across the chemical value chain. In particular, the chemical industry needs tailor-made solutions to deliver chemical products more sustainably by using digital ecosystems.

[0062] FIG. 1a illustrates an example embodiment of a central computing system 100 that includes a central computing node 101 (solid circle at the center) and several peripheral computing nodes 101.1-101.n (shown as solid circles around the periphery). The term "computing system" may include one or more computing nodes, a system of nodes, or a combination thereof. The term "computing node" may refer to any device or system that includes at least one physical, tangible processor and a physical, tangible memory capable of having computer-executable instructions executed by the processor. Computing nodes are now increasingly taking a variety of forms. Computing nodes may be, for example, handheld devices, manufacturing facilities, sensors, monitoring systems, control systems, home appliances, laptop computers, desktop computers, mainframes, data centers, or devices that have not traditionally been considered computing nodes, such as wearables (e.g., glasses, watches, etc.). Memory may take any form and may depend on the nature and form of the computing node.

[0063] In this example, the peripheral computing nodes 101.1-101.n may be connected to one central computing system (or server). In another example, the peripheral computing nodes 101.1-101.n may be attached to the central computing node, for example, via a terminal server (not shown). Most of the functions may be performed by or obtained from the central computing node (also called a remote central location). One peripheral computing node 101.n is enlarged to provide a complete view of the components present in the peripheral computing nodes. The central computing node 101 may comprise the same components as described in relation to the peripheral computing nodes 101.n.

[0064] Each computing node 101, 101.1-101.n may comprise at least one hardware processor 102 and memory 104. The term "processor" may refer to any logic circuitry configured to perform basic operations of a computer or system and / or generally to a device configured to perform calculations or logical operations. In particular, a processor or computer processor may be configured to process basic instructions that run a computer or system. It may be a semiconductor-based processor, a quantum processor, or any other type of processor configured to process instructions. As an example, a processor may include at least one arithmetic logic unit ("ALU"), at least one floating point unit ("FPU"), such as a numeric coprocessor or numeric coprocessor, a number of registers, particularly registers configured to supply operands to the ALU and store results of operations, and memory, such as L1 and L2 cache memories. In particular, a processor may be a multi-core processor. In particular, a processor may be or comprise a central processing unit ("CPU"). The processor may be a graphics processing unit ("GPU"), a tensor processing unit ("TPU"), a complex instruction set computing ("CISC") microprocessor, a reduced instruction set computing ("RISC") microprocessor, a very long instruction word ("VLIW") microprocessor, a processor implementing other instruction sets, or a processor implementing a combination of instruction sets. The processing means may also be one or more special-purpose processing devices, such as an application specific integrated circuit ("ASIC"), a field programmable gate array ("FPGA"), a complex programmable logic device ("CPLD"), a digital signal processor ("DSP"), a network processor, or the like. The methods, apparatus, systems, and devices described herein may be implemented as software in a DSP, a microcontroller, or any other side processor, or as hardware circuitry in an ASIC, CPLD, or FPGA.It should be understood that the term processor may also refer to one or more processing devices, such as a distributed system of processing devices located across multiple computer systems (e.g., cloud computing), and is not limited to a single device unless otherwise specified.

[0065] Memory 104 may refer to physical system memory, which may be volatile, non-volatile, or a combination thereof. Memory may include non-volatile mass storage devices such as physical storage media. Memory may be computer readable storage media such as RAM, ROM, EEPROM, CD-ROM, or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other physical, tangible storage media that can be used to store desired program code means in the form of computer executable instructions or data structures and that can be accessed by a computing system. Furthermore, memory may be a computer readable medium (also called a transmission medium) having computer executable instructions. Furthermore, program code means in the form of computer executable instructions or data structures may be automatically transferred from a transmission medium to a storage medium (or vice versa) when reaching various computing system components. For example, computer executable instructions or data structures received over a network or data link may be buffered in a RAM in a network interface module (e.g., a "NIC") and eventually transferred to the RAM of the computing system and / or to a less volatile storage medium in the computing system. Thus, it should be understood that storage media can be included in computing components that also (or primarily) utilize transmission media.

[0066] Computing nodes 101, 101.1,..., 101.n may include a number of structures 106, often referred to as "executable components or computer-executable instructions." For example, memory 104 of computing nodes 101, 101.1,..., 101.n may be depicted as including executable components 106. The term "executable components" may refer to structures that are software, hardware, or a combination thereof, or that are well understood by those skilled in the computing arts as structures that can be implemented in software, hardware, or a combination thereof. For example, when implemented in software, those skilled in the art will understand that the executable components structures include software objects, routines, methods, etc. that are executable on computing nodes 101, 101.1,..., 101.n, regardless of whether such executable components reside on multiple computing nodes 101, 101.1,..., 101.n, or whether the executable components reside on computer-readable storage media. In such cases, those skilled in the art will recognize that the structure of the executable components resides on a computer-readable medium such that, when interpreted by one or more processors of the computing node 101 (e.g., by processor threads), the computing nodes 101, 101.1, ..., 101.n perform functions. Such structures may be directly computer readable by the processor (as if the executable components were binary). Alternatively, the structures may be structured to be interpretable and / or compiled (whether in one or more stages) to generate binary that is directly interpretable by the processor. Such understanding of examples of the structure of executable components is well within the understanding of those skilled in the computing arts when using the term "executable components." Examples of executable components implemented in hardware include hard-coded or hard-wired logic gates implemented exclusively or substantially exclusively in hardware, such as in a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or any other dedicated circuit.In this description, the terms "component," "agent," "manager," "service," "engine," "module," "virtual machine," and the like are used synonymously with the term "executable component."

[0067] The processor 102 of each computing node 101, 101.1, ..., 101.n may direct the operation of each computing node 101, 101.1, ..., 101.n in response to executing computer-executable instructions that make up the executable components. For example, such computer-executable instructions may be embodied on one or more computer-readable media forming a computer program product. The computer-executable instructions may be stored in the memory 104 of each computing node 101, 101.1, ..., 101.n. The computer-executable instructions may include, for example, instructions and data that, when executed by the processor 101, cause a general-purpose computing node 101, 101.1, ..., 101.n, a special-purpose computing node 101, 101.1, ..., 101.n, or a special-purpose processing device to perform a particular function or group of functions. Alternatively or additionally, computer-executable instructions may configure the computing nodes 101, 101.1, ..., 101.n to perform a particular function or group of functions. The computer-executable instructions may be binaries or instructions that undergo some translation (e.g., compilation) before being executed directly by a processor, such as intermediate format instructions such as assembly language or source code.

[0068] Each computing node 101, 101.1,..., 101.n may include a communication channel 108 that allows each computing node 101.1,..., 101.n to communicate with a central computing node 101, e.g., a network (shown as solid lines between the peripheral computing nodes and the central computing node in FIG. 1a). A "network" may be defined as one or more data links that enable the transmission of electronic data between the computing nodes 101, 101.1,..., 101.n, modules, and / or other electronic devices. When information is transferred or provided to the computing nodes 101, 101.1,..., 101.n via a network or another communication connection (either hardwired, wireless, or a combination of hardwired and wireless), the computing nodes 101, 101.1,..., 101.n may consider the connection as a transmission medium. A transmission medium may be used to carry desired program code means in the form of computer-executable instructions or data structures and may include a network and / or data links accessible by general-purpose or special-purpose computing nodes 101, 101.1, ..., 101.n. Combinations of the above may also be included within the scope of computer-readable media.

[0069] Computing nodes 101, 101.1-101.n may further comprise a user interface system 110 used to interface with a user. User interface system 110 may include an output mechanism 110A and an input mechanism 110B. The principles described herein are not limited to the precise output mechanism 110A or input mechanism 110B, as such will depend on the nature of the device. However, output mechanism 110A may include, for example, a display, a speaker, a display, a haptic output, a hologram, etc. Examples of input mechanism 110B may include, for example, a microphone, a touch screen, a hologram, a camera, a keyboard, a mouse or other pointer input, any type of sensor.

[0070] FIG. 1b illustrates an example embodiment of a non-centralized computing environment 100' with several computing nodes 101.1'-101.n' shown as solid circles. In contrast to the central computing environment 100 illustrated in FIG. 1a, the computing nodes 101.1'-101.n' of the non-centralized computing environment are not connected to the central computing node 101 and are therefore not under the control of the central computing node. Instead, both hardware and software resources may be allocated to each individual computing node 101.1',...,101.n' (local or remote computing system) and data may be distributed among the various computing nodes 101.1',...,101.n' for task execution. Thus, in a non-centralized system environment, program modules may be located in both local and remote memory storage devices. One computing node 101' is enlarged to provide an overall view of the components present in the computing node 101'. In this example, the computing node 101' comprises the same components as those described in relation to FIG. 1a.

[0071] FIG. 1c illustrates an example embodiment of a distributed computing environment 103. In this description, "distributed computing" may refer to any computing that utilizes multiple computing resources. Such use may be realized through virtualization of physical computing resources. One example of distributed computing is cloud computing. "Cloud computing" may refer to a model that enables on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services). When distributed, a cloud computing environment may be distributed internally within an organization and / or across multiple organizations. In this example, the distributed cloud computing environment 103 may include the following computing resources: mobile devices 114, applications 116, databases 118, data storage 120, and servers 122. The cloud computing environment 103 may be deployed as a public cloud 124, a private cloud 126, or a hybrid cloud 128. The private cloud 124 may be owned by an organization, and only members of the organization with appropriate access may use the private cloud 126, keeping the data in the private cloud at least confidential. In contrast, data stored in the public cloud 126 may be open to anyone via the Internet. A hybrid cloud 128 may be a combination of a private cloud 124 and a public cloud 126, allowing some data to be kept private while other data may be public.

[0072] FIG. 2 shows an example of ID-based owner data, ID-based passport data, and a non-central identity manager.

[0073] The ID may be a Decentralized ID (DID). The ID-based passport device may be a DID document associated with the DID. The ID-based owner data may include an ID associated with a subject, such as product data, chemical product data, or emission data, and may include an authentication mechanism. The ID-based owner data may include owner data that is electronically owned and controlled by the DID owner. In this regard, electronically owned may refer to data stored in an owner repository or wallet. Such data may be securely stored and / or managed on an organized server or client device. The ID-based owner data may include a DID, a private key, and a public key. The ID-based owner may own and control the DID, which represents an identity associated with the DID subject, and the private and public keys associated with the DID. A DID may be understood as an identifier and authentication information associated or uniquely linked to the identifier.

[0074] A DID subject may be a raw material, base material, chemical product, intermediate product, component, component assembly, or final product. A DID subject may be a machine, system, or device or a collection of such machines, devices, and / or systems used to manufacture a raw material, base material, chemical product, intermediate product, component, component assembly, or final product. A DID owner may be a supply chain actor or a manufacturer, such as a chemical manufacturer that manufactures a chemical. A DID owner may be an upstream actor in the supply chain of a chemical manufacturer, such as a supplier that supplies a raw material product or a precursor to manufacture a chemical. A DID owner may be a downstream actor in the supply chain of a chemical manufacturer, such as a customer that consumes a chemical to manufacture an intermediate product, component, component assembly, or final product. A DID owner may be any actor in the supply chain, including a chemical feedstock product supplier, an intermediate chemical product manufacturer, an intermediate manufacturer, a component manufacturer, a component assembly manufacturer, or a final product manufacturer.

[0075] A DID can be any identifier associated with a DID subject and / or a DID owner. Preferably, the identifier is unique to the DID subject and / or the DID owner. The identifier can be unique at least to the extent that the DID is expected to be in use. The identifier can be a locally or globally unique identification of any actor in the supply chain, including a raw material, a base substance, a chemical product, an intermediate product, a component, a component assembly, a final product, or a collection thereof; a machine, a system, or a device, or a collection of such machines, devices, and / or systems, used to manufacture a raw material, a base substance, a chemical product, an intermediate product, a component, a component assembly, or a final product; a chemical manufacturer that produces a chemical substance, an upstream actor in the supply chain of a chemical manufacturer, a downstream actor in the supply chain of a chemical manufacturer, or a collection thereof; a raw material product supplier, an intermediate chemical product manufacturer, an intermediate manufacturer, a component manufacturer, a component assembly manufacturer, or a final product manufacturer, or a collection thereof.

[0076] A DID may be a Uniform Resource Identifier (URI), such as a Uniform Resource Locator (URL). A DID may be an Internationalized Resource Identifier (IRI). A DID may be a random string of numbers and letters to increase security. In one embodiment, a DID may be a string of 128 letters and numbers following the scheme did:method name:method specific did, such as did:example:ebfeb1f712ebc6f1c276e12ec21. DIDs may be decentralized, independent of any central third party management system, and under the control of the DID owner.

[0077] The DID document 16 may be associated with a DID. Thus, the DID document 16 may include a reference to a DID that may be associated with the DID subject described by the DID document. The DID document 16 may include authentication information, such as a public key. The public key may be used by a third party entity that is authorized by the DID owner / subject 14 to access information and data owned by the DID owner / subject 14. The public key may be used to verify that the DID owner 14 actually owns or controls the DID. The DID document 16 may include authentication information, authorization information, for example, to authorize the reading of the DID document or certain parts of the DID document 16 by a third party entity, for example, without giving the third party the right to prove ownership of the DID.

[0078] A DID document 16 may include one or more representations that are digitally linked to product or chemical data, for example by a service endpoint. A service endpoint may include a network address at which a service acts on behalf of the DID owner. In particular, a service endpoint may point to a service of the DID owner that provides access to the product or chemical data. Such services may include services that read or analyze the product or chemical data. The chemical data may include chemical product declaration data, chemical product safety data, certificate of analysis data, emissions data, product carbon footprint data, product environmental footprint data, chemical product specification data, product information, technical application data, manufacturing data, or a combination thereof.

[0079] DID documents 16 may include various other information, such as metadata that specifies when the DID document 16 was created, when it was last modified, and / or when it expires.

[0080] The DIDs and DID documents may be associated with a non-centralized data service system or a data registry node, such as a distributed ledger or blockchain 10. Possible blockchain systems include Quorum, Hyperledger, Fabric, etc. The distributed ledger or blockchain 10 may be used to store a representation of the DID 14 that points to the DID document 16. The representation of the DID may be stored in distributed computing nodes of the distributed ledger or blockchain 10. For example, a DID hash may be stored in multiple computing nodes of the distributed ledger 10 and may point to the location of the DID document 16. In some embodiments, the DID document 16 may be stored in the distributed ledger. Alternatively, in other embodiments, the DID document 16 may be stored in a data storage (not shown) associated with the distributed ledger or blockchain 10.

[0081] The distributed ledger or blockchain 10 may be any decentralized network that includes various computing nodes that communicate with each other. For example, the distributed ledger 10 may include a first distributed computing node 12.1, a second distributed computing node 12.2, a third distributed computing node 12.3, and any number of additional distributed computing nodes as shown by 12.4, 12.5. The distributed ledger or blockchain 10 may operate according to any standard or method known for distributed ledgers. Examples of conventional distributed ledgers that correspond to the distributed ledger or blockchain 10 include, but are not limited to, Bitcoin [BTC], Ethereum, and Litecoin.

[0082] FIG. 3 shows an example of ID-based certificate data, ID-based passport data, and an identity manager.

[0083] In contrast to the example of FIG. 2, the example of FIG. 3 is certificate-based. The identity-based certificate data may include authentication data of the certificate owner and the certificate issuer. For example, a cryptographic signature from the issuer may bind the data owner's public key to the identity. The identity may be a unique ID (such as a UID) as described in connection with the DID of FIG. 2. The certificate may be an X.509 certificate, such as X509v3. The identity-based passport data may be associated with a data source of the data owner. The identity-based passport data may include an identity, authentication data, and an endpoint associated with product data or chemical product data, particularly emission data. Such an endpoint may include any digital representation that connects to a data source. The data source may provide product data and / or chemical product data, particularly emission data.

[0084] In this certificate-based example, the identity-based passport data may include one or more certificates associated with the data owner. The certificates may be associated with an identity manager, including, for example, a certificate issuing service and / or a dynamic provisioning service that provides dynamic attribute tokens (e.g., OAuth access tokens). The information required for the validation of the certificates may be provided via an authentication registry associated with the certificate issuing service and / or the dynamic provisioning service. For example, in the IDSA Reference Architecture Model, Version 3.0 of April 2019, prior to the execution of the data exchange (not shown), connectors associated with the data owner, a certificate authority (CA), a dynamic attribute provisioning service (DAPS), and connectors associated with the data consumption service are used to validate the identity. For this purpose, such connectors may include one or more certificates, such as an X.509 certificate. Thus, the connector possesses a unique identifier embedded in an X.509 certificate that identifies the connector instance.

[0085] FIG. 4 shows an example of a method for generating a chemical product passport. In the case of chemical passport generation, a request may be provided to provide a non-centralized identifier associated with the data owner and chemical data, in particular emission data. A computing node (acting as a management module, user agent, ID hub, and / or certificate issuer for the DID owner) may receive instructions to generate a non-centralized identifier. The instructions may include providing at least one authentication mechanism or selecting at least one of a plurality of authentication mechanisms.

[0086] In response to the request, a chemical passport may be generated that includes a non-central identifier and data related to the chemical data, in particular the emissions data. An authentication mechanism may be selected or provided. The non-central identifier and data related to the authentication mechanism may be generated or provided. A digital representation connected to the chemical data, in particular the emissions data, may be provided. A chemical passport may be generated based on the non-central identifier, the data related to the authentication mechanism, and the digital representation connected to the chemical data, in particular the emissions data.

[0087] The chemical passport may be provided for access by a data consuming service controlled by a data providing service associated with the data owner. The chemical passport may include at least (1) data related to a decentralized identifier and (2) data related to at least one authentication mechanism. At least a portion of the data included in the chemical passport may then be communicated to an authentication data registry, such as a distributed ledger. The chemical passport may further include data related to chemical data, in particular emissions data.

[0088] FIG. 5 illustrates an example of how a chemical product passport can be used for further processing of a chemical product associated with the chemical product passport.

[0089] To use the chemical passport, instructions may be received to access chemical data, in particular emissions data, associated with a non-central identifier in the chemical passport. The chemical passport may be structured as described in Figures 2 and 3. The chemical passport may be generated as described in Figure 5.

[0090] Before access to the chemical product data, in particular the emissions data, can be provided, the request may be authenticated. In particular, a data consuming service requesting access to the chemical process data and / or a data providing service providing access to the chemical process data may be authenticated.

[0091] Such authentication may be based on data related to a non-centralized identity and authentication mechanism. Authentication may be performed through different communication patterns detailed in FIG.

[0092] If the authentication fails, access to the chemical data, especially the emission data, may be denied. If the authentication is valid, an authorization step may follow. Such authorization may be based on data related to non-central identities and authorization rules. Authorization may be performed through different communication patterns detailed by Figs. 7 and 11.

[0093] In case of authorization failure, access to the chemical data, in particular the emission data, may be denied or the access may be adapted. In particular, the requested authorization may be adapted to comply with the applicable authorization rules. If the authorization is valid, access to the chemical data, in particular the emission data, may be granted as required in accordance with the authorization rules. Such access to chemical data, in particular the emission data, associated with non-central identifiers may be provided using representations embodied in the chemical passport.

[0094] FIG. 6 illustrates an example of an authentication method for accessing chemical product data, particularly emissions data.

[0095] During the authentication process, various communication patterns may be implemented to verify identity. Figure 6a shows an example of a communication pattern that may take place between a data providing service and a data consuming service. In this case, the data providing service may act as a verifying entity and a separate service may not be used for authentication.

[0096] The data consuming service may request a service from the data providing service. The request may include a decentralized identifier of the data consuming service, such as a DID.

[0097] In response to the request, the data providing service may access a registry, such as a central or non-central authentication registry, to retrieve data related to the authentication mechanism associated with the identity. For example, a central authentication registry may provide data related to the authentication mechanism via an authentication service that issues an access token. Further, for example, a non-central authentication registry may provide data related to the authentication mechanism by generating a request token. The data related to the authentication mechanism may include the public key of the data consuming service.

[0098] Based on the retrieved data related to the authentication mechanism, the data providing service may generate an authentication request (e.g., corresponding to an authentication request token or a dynamic attribute token). The authentication request may be generated based on the data consumption service's public key and / or the data providing service's private key. The generated authentication request may be sent to the data consumption service.

[0099] Based on the received authentication request, the data consumption service may generate authentication data in response to the authentication request, and may transmit the generated authentication data to the data providing service.

[0100] Upon receiving a response from the data consuming service that includes the authentication information, the data providing service may then verify the validity of the authentication data, and in response to verifying the validity, the data providing service may approve or deny the service request of the data consuming service.

[0101] FIG. 6b illustrates yet another communication pattern that may occur between a data providing service, an authentication service, and a data consuming service.

[0102] First, a data consuming service may request a service or initiate communication with a data providing service. The request may include a decentralized identifier, such as the DID, of the data consuming service.

[0103] Upon receiving the request, the data provisioning service may access the distributed ledger and retrieve one or more authentication mechanisms associated with the identity. Based on the retrieved authentication mechanisms, the service provider may generate an authentication request.

[0104] Here, at least one of the authentication mechanisms retrieved via the authentication service may be provided. Thus, in some embodiments, the generated authentication request may be sent directly to the authentication service. Upon receiving the authentication request from the data-providing service, the authentication service may generate authentication data.

[0105] The authentication data generated by the authentication service may be transmitted to the data consuming service. The data consuming service may then pass the authentication data to the data providing service. Upon receiving the authentication data, the data providing service may then validate the authentication data. In response to the validation, the data providing service may grant or deny the service request of the data consuming service.

[0106] Alternatively, in some embodiments, after the data providing service can generate the authentication request, the data providing service can send the authentication request to the data consuming service, which can pass the authentication request to the authentication service.

[0107] Furthermore, after the authentication service is able to generate the authentication data, in some embodiments the authentication service simply contacts the data consuming service to acknowledge receipt of the authentication request and obtain consent. Once the data consuming service receives the acknowledgement, it may consent and send consent to the authentication service. Upon receiving consent, the authentication service may then send the authentication data directly to the data providing service.

[0108] Finally, in many transactions, authentication may be performed mutually by both parties. In such mutual authentication situations, each party involved may be both the subject entity and the verifying entity. The data consuming service and the data providing service may control their respective identities. First, the services exchange their respective identities. Then, each of the services may access the distributed ledger to obtain each other's authentication mechanisms. Each service may then generate its own authentication request based on the authentication method of the other's identity. The generated authentication data may then be sent to the other service. Upon receiving each other's authentication data, each service may validate the received authentication data. Based on the validation result, the services may then perform additional communications, for example, one service may approve or deny the other service's service request.

[0109] 6a and 6b merely illustrate an example of an authentication protocol, and although the communication arrows are discussed in a particular order or shown in a sequence of communications, unless specifically noted, no particular order is required or may be required because a communication is dependent on another communication being completed before that communication can be sent.

[0110] 7a and 7b illustrate the principle of cryptographic signatures as they can be used for example for authentication mechanisms based on private and public key pairs. Such processes include cryptographic mechanisms using key pairs and / or hash functions.

[0111] Figure 7a shows an example of a cryptographic process. In a first step, subject data such as a JWT request token may be provided. Such data may include the recipient's public key. Additionally, the sender's private key may be provided.

[0112] In a second step, the data or a part of the data may be transformed through a hash function. A hash function may map multiple inputs to exactly one output. Known hash functions are, for example, SHA256, MD5, Bcyrpt, or RIPEMD.

[0113] In a third step, the hashed data or hash can be encrypted with the sender's private key. Such encryption of the data or hashed data ensures that the data is provided by the sender as its legitimate owner and not an unauthorized third party. This encryption process with the sender's private key is sometimes called signing. The additional use of a hash function can reduce the size of the data package sent over the network.

[0114] In a fourth step, the data and the encrypted hash can be encrypted with the recipient's public key, and in a fifth step, the encrypted data package including the data and the signature can be provided to the sender for transmission.

[0115] Figure 7b shows an example of a decryption process for the encrypted data package of figure 7a. In a first step, the encrypted data package may be provided. Furthermore, the sender's public key and the receiver's private key may be provided.

[0116] In a second step, the data package can be decrypted using the recipient's private key, thus ensuring the confidentiality of the data transmission.

[0117] In a third step, the hash of the decrypted data package can be decrypted using the sender's public key, thus resolving the sender's signature and ensuring the authenticity of the sender.

[0118] In a fourth step, the decrypted data may be hashed from the decrypted data. In a fifth step, the decrypted hash and the hash from the decrypted data may be compared. If the hashes match, the data was transmitted in confidence and is not corrupted. If the hashes do not match, the data has been corrupted.

[0119] 7a and 7b merely illustrate the principle of the authentication mechanism based on cryptographic signatures. Several different authentication mechanisms exist and several variations can be implemented. Further examples of authentication mechanisms include biometric authentication such as Touch ID or Face ID, FIDO security keys, push authentication, biometric and device binding mechanisms, magic links, any combination thereof, or any other passwordless authentication mechanism known to those skilled in the art.

[0120] FIG. 8 illustrates an example of a method for authorizing access to chemical product or emission data. In the following, references to chemical product data may be used synonymously with references to emissions data as a specific embodiment or chemical product data.

[0121] In a first step, a set of authorization rules for the first non-central identifier and the chemical data associated with the first non-central identifier may be provided. The set of authorization rules may include usage instructions that specify a usage policy for an entity accessing the chemical data associated with the non-central identifier. The set of rules may include one or more local rules that are specific to a particular location. The one or more local rules may be based on the location where the non-central identifier was generated, the location where the data providing service was implemented, the location where the data consuming service was implemented, or a combination thereof.

[0122] The one or more sets of local rules may be based on a location or a data providing service provided by a data providing service. The location may refer to a jurisdiction and the local rules may relate to legal requirements related to the supply of chemicals or chemical materials. For example, access to chemical data may be provided via authorization rules, which may include legal rules or local rules. The chemical data may include attestations of analytical data associated with laboratory measurement data obtained from samples of raw materials, chemical products, components, component assemblies, or end products and / or combinations thereof. The attestations of analytical data may be associated with two or more raw materials or chemical products, such as those used to manufacture a component. The attestations of analytical data may be associated with two or more raw materials or chemical products, such as those used to manufacture a plurality of components to assemble a component assembly or end product. The chemical data includes chemical product safety data associated with hazards of mixtures of physical entities of substances or products, such as raw materials, chemical products, components, component assemblies, or end products and / or combinations thereof. The chemical product safety data may be associated with two or more raw materials or chemical products, such as those used to manufacture a component. The chemical product safety data may be associated with two or more raw materials or chemical products, such as those used to manufacture a plurality of components to assemble a component assembly or end product. The chemical data may include chemical product declaration data associated with a physical entity of a product, such as a raw material, a chemical product, a component, a component assembly, or an end product and / or combinations thereof. The chemical product declaration data may relate to two or more raw materials or chemical products, such as those used to manufacture a component. The chemical product declaration data may relate to two or more raw materials or chemical products, such as those used to manufacture multiple components to assemble a component assembly or end product.

[0123] In a second step, data related to the second non-central identifier or the second non-central identifier of the accessing entity may be provided. Based on the second non-central identifier or the second non-central identifier of the accessing entity, an authorization rule for the chemical data associated with the first non-central identifier may be selected. The authorization rule may include computer executable instructions for permitting, rejecting, or modifying the chemical data. The authorization rule may be associated with each data point of the chemical data or a set or class of chemical data. The selected authorization rule may be stored for application to the chemical data. Such authorization rules may be applied before or at the time of a data transaction. The selected authorization rule may be bound to the chemical data, individual data points or classes of chemical data for application to the chemical data. The product data may include data related to different classes of product data, such as chemical data. For example, the chemical data may itself include different classes of chemical data. In one embodiment, at least one class of chemical data includes chemical data, such as data required by regulation or regulatory data of chemicals.

[0124] The selected authorization rule may be applied to the chemical data associated with the first non-central identifier. The selected authorization rule may be applied prior to accessing the chemical data. The selected authorization rule may be applied during run-time when accessing the chemical data.

[0125] The chemical associated with the first non-central identifier may be provided according to the selected authorization rule. The authorization rule may include, for example, a local rule specific to a particular location, the location being associated with a jurisdiction, the local rule for the location being associated with a legal requirement related to the supply of the chemical. The set of authorization rules may include at least one regulatory instruction configured to provide access to the chemical data related to a regulatory requirement for supplying the chemical. The set of authorization rules provided may be associated with a non-central identifier of the accessing entity, and the authorization rule may include computer executable instructions to allow access to the chemical data associated with the first non-central identifier, deny access to the chemical data associated with the first non-central identifier, modify access to the chemical data associated with the first non-central identifier, or modify the chemical data associated with the first non-central identifier. The authorization rule may be associated with each data point of the chemical data or a class of chemical data, and the selected authorization rule may be bound to the chemical data, a class of chemical data, an individual data point, or a combination thereof. The set of authorization rules may include one or more prescribed rules associated with obligations of the data consumption service associated with the second non-central identifier. The set of authorization rules may include one or more prescribed rules associated with discharge data, production data, recycle content data, biobased content data, origin data, working condition data, or combinations thereof. The set of authorization rules may include one or more processing rules related to processing of the discharge data, production data, recycle content data, biobased content data, origin data, working condition data, or combinations thereof by the data consumption service associated with the non-central identifier of the accessing entity. The set of authorization rules may include one or more aggregation rules related to an invoice for material data provided by a supplier data provision service or an invoice for raw material data provided by a supplier data provision service.

[0126] FIG. 9 shows a schematic diagram of providing a chemical product passport from a data provisioning service via an IDS architecture.

[0127] In the following, references to chemical product data may be used synonymously with references to emissions data as a specific embodiment or chemical product data.

[0128] The data providing service may provide chemical product data to the data consuming service. The following IDS components may be executable components in the "IDS infrastructure" shown in FIG. 8: data connector, app store, identity provider, vocabulary provider, broker, clearinghouse. Data may be exchanged between the data owner's fest data user's interface via the data providing service and the data consuming service. The data providing service and the data consuming service may each be connected to a data connector to enable secure and reliable data exchange. The data provided by the data owner's interface may be associated with an authorization mechanism, such as a usage policy that specifies authorization rules, such as data usage rules. The exchange or sharing of data may be performed according to the prescribed authorization mechanism, as described in relation to FIG. 7. The data provided by the data owner's interface via the data providing service may be accessed by the data user's interface according to the usage policy associated with the data provided by the data owner's interface.

[0129] A participant acting as a data owner may take on the role of a data provider. However, there may be cases where the data provider does not coincide with the data owner (e.g., when the data is technically controlled by an entity other than the data owner, such as when an enterprise uses external services to provide the data, or when data management activities are handed over to a data fiduciary). If the data owner does not simultaneously act as a data provider, the only activity of the data owner may be to authorize the data provider to make the data available for use by the data consumer interface.

[0130] The data provisioning interface may make data available for sharing or exchange between data owners and data consumers. To facilitate data requests from the data consumer interface, the data provisioning interface may provide metadata to a broker service provider (described below) describing the dataset, e.g., syntax, serialization, and / or semantics of the data source, provider description, consumer description, etc. The broker service provider is not necessarily required for the data consumer interface and data provisioning interface to establish a connection.

[0131] Exchanging or providing data to a data consumer interface may not necessarily be the sole activity of a data provider. A data providing interface may record details of successful (or unsuccessful) completion of a transaction in a clearinghouse (see below). A data providing interface may facilitate billing or dispute resolution. Additionally, a data providing interface may use data apps to check, enrich or transform the data.

[0132] The data consuming interface may receive data from the data providing interface. The data consumer interface may be a mirror entity of the data providing interface. The executable components of the data providing interface may be mirrored by the data consumer interface. Before a connection to the data providing interface can be established, the data consumer may search for existing data sets by querying the broker service provider. The broker service provider may provide metadata required by the data consumer interface to connect to the data provider. Such metadata may include the identity and / or authentication mechanism of the data providing interface. Alternatively or in addition, the data consumer interface may establish a connection to the data providing interface (i.e. with or without the involvement of the broker service provider). Where the information to connect with the data providing interface may already be known to the data consumer interface, the data consumer interface may request data (and corresponding metadata) directly from the data providing interface. Like the data providing interface, the data consumer interface may also log details of the success (or failure) of the data exchange transaction in a clearinghouse, use a data app to check, enrich, transform, etc. the received data, or use a service provider interface to connect to the international data space (if it has not deployed the technology infrastructure to participate itself).

[0133] Just as a data owner is a legal entity that has legal control over its data, a data user is a legal entity that has the legal right to use the data owner's data as specified by a usage policy. In most cases, a data user is the same as a data consumer. However, there may be situations where these roles are assumed by different participants.

[0134] The identity provider may act as an agent. It may include services named Certification Authority (managing digital certificates of participants in the international data space), Dynamic Attribute Provisioning Service (DAPS, managing dynamic attributes of participants), Dynamic Trust Monitoring (DTM, continuous monitoring of network security and behavior). The identity provider may be in charge of issuing technical identities to parties approved to become participants in the international data space. The identity provider may be instructed to issue identities based on approved roles (see below). The identity provider may also manage the PKI deployment. There are two separate PKI hierarchies: one for software signing (software signing root CA) and one for IDS connectors (service root CA). Entities are assigned either final certificates or sub / root CA certificates. The identity provider may act as an authentication and / or authorization service by incorporating DAPS.

[0135] Each IDS Connector may run different services and communicate with other IDS Connectors. Using PKI, the IDS Connector secures persistent storage of services and communication with other IDS Connectors. To verify PKI signatures (e.g., for authentication, authorization, or downloaded data apps), the IDS Connector stores trusted root certificates (Service Root CA and Software Signing Root CA) so that their integrity is preserved.

[0136] An app store may provide data apps that can run inside an isolated container of an IDS connector. There are applications that can be deployed in an IDS connector to perform tasks such as data transformation, aggregation, or analysis. An app store can be provided by an IDS member and must be separately certified under the IDS standard. An app store has a service sub-CA. The International Data Spaces Association signs a Certificate Signing Request (CSR) to authorize an app or app store. The CSR identifies the app store and allows it to sign a service CSR from an IDS connector requesting an app. The IDS connector creates a key pair for every app it downloads. The private key protects the app's persistent data. When an app is downloaded from an app store, the IDS connector uses the public key to create a CSR. The app store signs the CSR and issues a certificate. The IDS connector uses this certificate to verify that the app is running and valid.

[0137] Vocabulary Providers may manage and provide "vocabularies" (including ontologies, reference data models, and metadata elements) that can be used to annotate and describe datasets. Vocabulary Providers provide these (domain-specific) vocabularies and their references to the IDS Information Model, which is the basis for describing data sources.

[0138] Brokers may be used as intermediaries that store and manage information about data sources available in the international data space. The role of a broker is central but non-exclusive, so that multiple brokers (e.g., of different application domains) may exist around at the same time. An organization that provides broker services in the international data space may simultaneously play other intermediary roles (e.g., clearinghouse or identity provider, see below). Broker activities may include receiving and providing metadata. Brokers must provide an interface to data providing interfaces to transmit metadata. The metadata may be stored in a structured manner in an internal repository that is queried by data consumers. The core of the metadata model may be specified by the international data space, but brokers may extend the metadata model to manage additional metadata elements. After a broker provides metadata about a particular data providing interface to a data consuming interface, its job is completed (i.e., it is not involved in the subsequent data exchange process).

[0139] A clearinghouse may be an intermediary that provides settlement and settlement services for financial and data sharing or exchange transactions. In the international data space, settlement activities are separated from broker services because these activities are technically different from maintaining metadata repositories. As already mentioned above, it may still be possible for the two roles of "clearinghouse" and "broker" to be performed by the same organization, since both roles of the clearinghouse and broker are required to act as a trusted intermediary between the data providing interface and the data consumer interface. The clearinghouse and broker may include a distributed ledger to record metadata from the data services. The clearinghouse records the activities performed in the course of the data exchange. After the data exchange or part of it is completed, both the data providing interface and the data consumer interface confirm the data transfer by recording the transaction details in the clearinghouse. Based on this recorded information, the transaction may be checked or charged. The recorded information may also be used for conflict resolution (e.g. to clarify whether a data package has been received by the data consumer or not). The clearinghouse may provide reports on the performed (recorded) transactions, such as charges, conflict resolution, etc.

[0140] FIG. 10 shows a schematic diagram of the authentication process between an IDS connector 1 residing in an IDS data provider domain and an IDS connector 2 residing in an IDS data consumer domain.

[0141] Hereinafter, references to chemical product data may be used synonymously with references to emissions data as a particular embodiment or chemical product data.

[0142] In a typical scenario, Connector 2 is associated with a third party that wants to access chemical data associated with the chemical data owner's Connector 1. To provide data from an IDS Connector in an IDS Data Provider domain to an IDS Connector 2 residing in an IDS Data Consumer domain, the following authentication protocol can be applied:

[0143] A connector may be associated with a certificate issued by a device CA. This certificate may act as a root of identity. A connector may include multiple authentication mechanisms or identity tokens, for example, a device certificate (X.509v3), a TLS connection certificate (X.509v3), and a "dynamic attribute token" (OAuth access token).

[0144] If the IDS Connector 2 may access data in the data service of the IDS Connector 1, an access token may be presented by the IDS Connector 2. To this end, the IDS Connector 2 may present an X.509 device certificate to a DAPS (Dynamic Attribute Provisioning Service) in the IDS substrate to receive a Dynamic Attribute Token (DAT). The "Dynamic Attribute Token" may include an OAuth access token signed by the Dynamic Attribute Provisioning Service (DAPS). The DAT may be implemented as a JSON Web Token (JWT) containing a cryptographic signature of the DAPS and / or an indication of the verified or unverified identity attributes of the Connector 2. Dynamic in this context refers to a short-lived token containing attributes possessed by the IDS Connector 2. Such a short-lived token may be valid only for a limited number of transactions, e.g., one transaction. The DAPS may validate the device certificate with the Device Sub-CA prior to issuing the DAT.

[0145] The following steps may be performed by Connector 2 to receive the DAT. A: Call the token endpoint DAPS using a client certificate (X.509 certificate). B: Issue JWT-1{attribute_list,client_id,aud:idsAS:*}.

[0146] After receiving the DAT, the TLS tunnel may be established by using the same X.509 device certificate to request a TLS connection certificate, which may be requested automatically by IDS Connector 2 by interacting with an ACME server that may be integrated into a TLS sub-CA present in the IDS infrastructure (not shown).

[0147] In one example, an identity token may be requested by Connector 2 using an authorization service of Connector 1. This step may be optional. An identity token may be requested, for example, if some access token (At) is used. To request an identity token, Connector 2 may submit a DAT at the authorization service of Connector 1 and request an identity token. The authorization service in IDS Connector 1 may use a database or a rules engine to determine whether an identity token should be provided to Connector 2.

[0148] The following steps may be performed by Connector 2: Submit JWT-1 to the Connector 1 authentication service.

[0149] Request JWT-2{scope:C1 / PS}. Use the rules engine for access decisions and issue JWT-2{aud:C1} at Connector 1.

[0150] Provide JWT-2 to Connector 2. Connector 1 may provide an identity token to Connector 2. Connector 2 may submit the identity token and optionally a DAT requesting access via IDSCP (IDS communication protocol) to data in the data service of IDS Connector 1. If an identity token needs to be requested, Connector 2 may submit a DAT to Connector 1 to request access via IDSCP (IDS communication protocol) to data in the data service of Connector 1.

[0151] Connector 1 may validate the DAT and provide access to the data. 11 illustrates an example implementation of an authorization mechanism using usage control data flows. Such an example may be implemented in the International Data Space (IDS) framework described in FIG.

[0152] After access to the IDS connector associated with the data providing service is granted according to the procedure described in relation to Fig. 9, authorization may follow based on authorization rules. For authentication, a non-centralized identifier or data related to the non-centralized identifier of the accessing entity is provided to the connector IDS connector.

[0153] Usage control data flow is a way of enforcing authorization rules or usage policies on data exchanges or provisioning. Usage control can be achieved by binding usage policies to the data being exchanged and subsequently controlling how the data is processed, aggregated, or forwarded to other endpoints.

[0154] To enforce usage policies, data flows may be monitored and potentially intercepted by control points. Intercepted data flows may be passed to a decision engine to request permission, denial, or modification of the data flow. Decisions may be based on evaluation of usage policies by the decision engine. Data usage transactions may trigger interception and evaluation.

[0155] A usage policy may be provided to the decision engine by a policy manager to provide a set of authorization rules for the chemical data associated with the non-central identifiers of the IDS connector. The usage policy may be stored independently of the data. The policy manager may reside in the IDS connector and / or in the clearinghouse to enforce the usage policy.

[0156] Based on the non-central identifier of the accessing entity or the data associated with the non-central identifier, authorization rules for chemical product data associated with the non-central identifier may be selected for enforcement. Enforcement mechanisms may work differently (e.g., affect different system actions) in different systems or technologies. Abstract policies may have different instantiations. Usage policies may be instantiated in target systems. In another example (not shown), usage policies may be attached to data (also called sticky policies). Sticky policies are one way to address the distribution of usage restrictions. In this approach, machine-readable usage policies may be attached to data when the data is exchanged. Different realization possibilities also exist. For example, data may be encrypted and can only be decrypted if adherence to usage restrictions is guaranteed.

[0157] The usage policy may include additional information provided, for example, by a policy information registry, such as previous data usage or geographic location of the entity, pre- or post-conditions that must be maintained before (e.g., integrity checks) and after (e.g., data item is deleted after usage) decision making, and on-conditions that must be maintained during usage (e.g., only during business hours).

[0158] If the decision depends on additional information, the decision engine or control point may request the additional information from the policy information registry. The policy information registry information may provide the requested additional information. In addition, the policy information registry may be used to obtain status information of or about the intercepted system action (e.g., data flow information, geolocation of the requesting device). For example, the policy information registry may be used to resolve a supplier's ID to a postal address, and a postal address to GPS coordinates.

[0159] The policy enforcer may be used to perform additional actions based on policy rules, such as sending notifications via email when data is used or writing to a system log. Actions may be triggered, for example, by sending instructions related to the desired additional action from the control point to the policy enforcer after the control point receives the additional information from the policy information system. The policy enforcer may perform the indicated action and confirm to the decision engine that the action was successful.

[0160] After receiving confirmation from the policy enforcer, the decision engine may forward the decision to the requesting control point. The decision may include allowing the data flow, denying the data flow, or modifying the data flow. The decision may be implemented by the control point. The selected authorization rule may be applied to the chemical product data associated with the non-central identifier. The chemical product data associated with the non-central identifier according to the selected authorization rule may be provided.

[0161] Usage control enforcement may be implemented in an IDS connector. At runtime, usage control enforcement may, for example, prevent an IDS connector from handling personal data in an undesirable manner by forwarding the data to a public endpoint. The application of a usage policy associated with a usage enforcement control in a data providing connector or a data consuming connector may depend on the usage policy. In a data providing connector, the usage policy may specify how often and when the data can be accessed (e.g., only during business hours), or that the data may be filtered or masked before leaving the enterprise. The usage policy in a data providing connector may include obligations to the data consumer. The technical enforcement may be handled by a control point or a policy enforcer depending on the usage restrictions. For example, limiting data flow to a specific target system to ensure correct usage purposes may be handled by a control point, while deleting data in a storage infrastructure external to the connector may be handled by a policy enforcer.

[0162] Usage control enforcement may be implemented in the storage infrastructure. The storage infrastructure may be any kind of storage for persistent data, such as a file system or a database. The storage infrastructure may be used without modification, but any use of the data may be handled by the IDS connector. In certain cases, this may lead to a bottleneck. Usage control may be enforced by encrypting the data in an IDS connector connected to the storage infrastructure before transferring the data to the storage infrastructure. Use of the data may be possible by decrypting the data using the IDS connector. Any use may therefore be controlled by the IDS connector. In such cases, usage restrictions such as lifetime or time constraints on the data may be enforced by deleting cryptographic keying material. Additionally or alternatively, the storage infrastructure may include a usage control enforcement component that monitors and / or controls the use of the data.

[0163] Usage control enforcement may be implemented within an application such that data flow within the application is controlled and adheres to usage policies. Similar to the storage infrastructure, control points may be integrated into the application to control data flow.

[0164] The implementation of the above usage controls in an IDS makes it possible to achieve the following security requirements, which cannot be achieved using traditional access controls: - Confidentiality: Classified data must not be transferred to nodes that do not have the appropriate clearance.

[0165] - Integrity: Critical data should not be modified by untrusted nodes, because otherwise the integrity of the critical data cannot be guaranteed.

[0166] - Lifetime: A prerequisite for persistent data is that it must be deleted from storage after a given period of time.

[0167] - Anonymization by aggregation: Personal data must only be made available to untrusted parties in the aggregate. A sufficient number of separate records must be aggregated to avoid personal identification of each individual record.

[0168] - Anonymisation by substitution: Data that allows the identification of an individual (e.g. faces in camera images) must be replaced with appropriate substitutes (e.g. blurred) to ensure that an individual cannot be identified from the data.

[0169] - Separation of duties: Two data sets from competing companies (e.g. two chemical industries) should never be aggregated or processed by the same service.

[0170] - Scope of use: Data may only serve as input for data pipes within the connector, but should never leave the connector towards an external endpoint.

[0171] FIG. 12 illustrates an example apparatus and associated method for generating a product passport in association with a chemical product produced by a chemical manufacturing network.

[0172] The chemical manufacturing network 1000 may produce at least one chemical product 1004 from one or more raw materials 1002. The raw materials 1002 may enter a system boundary 1001 of the chemical manufacturing network 1000. The chemical product 1004 may be produced using the raw materials 1002. The chemical product 1004 may exit the system boundary 1001 of the chemical manufacturing network 1000.

[0173] A chemical passport may be generated when the chemical product 1004 is manufactured or when the chemical product 1004 leaves the chemical manufacturing network 1000. The device 1010 may be configured to generate the chemical passport. The requester 1008 may be configured to provide a non-central identifier. The requester may be configured to generate a request for a non-central identifier. Such a request may be triggered by a labeling system, such as a QR code generator. The request to provide a non-central identifier may be provided to a non-central identifier generator 1012 configured to generate a non-central identifier. The non-central identifier generator 1012 may provide the non-central identifier to a non-central identifier provider 1014. The non-central identifier provider 1014 may provide the non-central identifier to the requester 1008 configured to associate the non-central identifier with the chemical product. Such association may include encoding the non-central identifier into a QR code and providing the QR code for labeling the chemical product. In this manner, a physical identifier may be provided that associates the non-central identifier with the physical entity of the chemical product.

[0174] The non-central identifier generator 1012 may provide the non-central identifier to a passport generator 1016 configured to generate a chemical passport. The passport generator 1016 may generate the chemical passport, for example, as described with respect to Figures 2-4. The chemical passport may include the non-central identifier and data related to the chemical data. The data related to the chemical data may include one or more digital representations that refer to the chemical data or a portion thereof. The chemical passport may include or be associated with one or more authentication mechanisms associated with the non-central identifier and data related to the chemical data. The authentication mechanisms may be used, for example, as described with respect to Figures 5-11. The chemical passport may be associated with one or more authorization mechanisms associated with the non-central identifier and data related to the chemical data. The authorization mechanisms may be used, for example, as described with respect to Figures 5-11.

[0175] The chemical passport may be provided to a chemical passport provider 1018. The chemical passport provider 10018 may be configured to provide the chemical passport for access by a data consumption service 1020 under control of a data providing service associated with the data owner. The chemical passport may be used to access the chemical data, for example, as described with respect to Figures 5-11.

[0176] 13 to 15 show different configuration examples of product passports based on digital identifiers. The configurations include different parent, child, grandchild, etc. relationships of product passports generated in the chemical value chain up to the final product.

[0177] FIG. 13 shows the individual configurations of different product passports generated in the chemical value chain. Individual product passports can be generated for multiple product stages in the chemical value chain. The generation of the product passport can include providing a non-central identifier and authentication mechanism for each of the multiple product stages. The product passports for multiple product stages can be based on cryptographic signatures. For example, the product passports for multiple product stages can be linked through hash values ​​based on different data sets. As shown in FIG. 13, hash 1 can be based on data in the raw material passport, hash 2 can be based on data in the chemical product passport, and hash 3 can be based on data in the raw material passport + data in the chemical product passport. Further linking can be done for other combinations of product passports up to hash n, which can link the product passports up to the final product passport. Linking through hashes of cryptographic signatures is just one example of linking. Other examples include aggregation permissions with different ranges of data that can be embedded in child passports, public key aggregation with different cryptographic signatures, or service endpoint aggregation with different links.

[0178] FIG. 14 shows another configuration of different product passports generated in the chemical value chain. For a final product, a final product passport may be generated. For multiple further product stages in the chemical value chain, individual product passports may be generated and embedded or linked to the final product passport. The generation of the product passport may include providing a non-central identifier and authentication mechanism for each of the multiple product stages. The product passports of the multiple product stages may be based on cryptographic signatures. For example, the product passports of the multiple further product stages may be linked through hash values ​​based on different data sets. As shown in FIG. 14, hash 1 may be based on data in the raw material passport, hash 2 may be based on data in the chemical product passport, and hash 3 may be based on data in the raw material passport + data in the chemical product passport. Further linking may be done for other combinations of product passports up to hash n, which may link the product passports up to the final product passport. Linking through hashes of cryptographic signatures is just one example of linking. Other examples include aggregation permissions with different ranges of data that may be embedded in child passports, public key aggregation with different cryptographic signatures, or service endpoint aggregation with different links.

[0179] FIG. 15 shows a fully embedded configuration of different product passports generated in a chemical value chain. For multiple product stages in the chemical value chain, individual product passports may be generated. The generation of the product passport may include providing a non-central identifier and authentication mechanism for each of the multiple product stages. The product passports of the multiple product stages may be based on cryptographic signatures. For example, the product passports of the multiple product stages may be linked through hash values ​​based on different data sets. As shown in FIG. 15, hash 1 may be based on data in the raw material passport. Hash 2 may be based on data in the raw material passport and the chemical product passport. Further linking may be done for other combinations of product passports up to hash n, which may link the product passports up to the final product passport. Linking through hashes of cryptographic signatures is only one example of linking. Other examples include aggregation permissions with different ranges of data that may be embedded in child passports, public key aggregation with different cryptographic signatures, or service endpoint aggregation with different links.

[0180] The configurations shown in Figures 13 to 15 relate to product passports generated in the chemical value chain up to the final product. Similarly, product passports generated in the recycling chain from the final product to the recycler can also be linked. Furthermore, similarly, product passports generated in the chemical value chain up to the final product and in the recycling chain from the final product to the recycler can also be linked. In this way, the circularity of products, especially materials, can be virtually represented and tracked.

[0181] The present disclosure has been described by way of example in conjunction with the preferred embodiment. However, by studying the drawings, the disclosure, and the claims, other variations can be understood and implemented by those skilled in the art by practicing the claimed invention. In particular, any steps specifically presented may be performed in any order, i.e., the invention is not limited to a particular order of these steps. Furthermore, it is not required that different steps are performed at a particular location or at one node of a distributed system. In other words, each of the steps may be performed at different nodes using different equipment / data processing units.

[0182] In the claims and in this specification, the word "comprising" does not exclude other elements or steps, and the indefinite articles "a" or "an" do not exclude a plurality. "Can" or "may" refer to optional features. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used in an advantageous implementation.

[0183] The disclosure has been described in conjunction with embodiments and examples as well. However, other variations can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure, and the claims.

[0184] Any steps presented herein may be performed in any order. The methods disclosed herein are not limited to a particular order of these steps. It is also not required that different steps be performed at a particular location or at a particular node of a distributed system, i.e., each of the steps may be performed at a different computing node using different equipment / data processing.

[0185] As used herein, "determining" also includes "initiating or causing a decision," "generating" also includes "initiating generation and / or causing generation," and "providing" also includes "initiating or causing the determination, generation, selection, transmission, and / or reception." "Initiating or causing the execution of an action" includes any processing signal that triggers a computing node or device to perform the respective action.

[0186] In the claims and in this specification, the word "comprising" does not exclude other elements or steps, and the indefinite articles "a" or "an" do not exclude a plurality. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used in an advantageous implementation.

[0187] All terms and definitions used herein are to be understood broadly and have their ordinary meaning.

Claims

1. 1. An apparatus for generating a chemical product passport, comprising: one or more computing nodes; and one or more computer-readable media that, when executed by the one or more computing nodes, cause the apparatus to: receiving a request to provide a non-central identifier associated with the data owner and the emission data; generating, in response to the request, the chemical product passport including data related to the decentralized identifier and the emissions data; and one or more computer-readable media having computer-executable instructions configured to cause the chemical product passport to be provided for access by a data consumption service under the control of a data provision service associated with the data owner.

2. The apparatus of claim 1 , wherein the non-centralized identifier is provided by a central node or by one or more non-centralized nodes.

3. 3. The device according to claim 1 or 2, wherein the non-centralized identifier is provided to the node that generates the chemical product passport and preferably to at least one authenticated data registry accessible by the data providing service and / or system data consuming service.

4. The apparatus of claim 1 , wherein generating the chemical product passport comprises providing the non-centralized identifier associated with a physical entity of the product.

5. The apparatus of claim 1 , wherein the chemical product passport includes one or more authentication mechanisms associated with the decentralized identifier and data related to emissions data.

6. The apparatus of claim 1 , wherein the chemical product passport is associated with one or more authentication mechanisms associated with data related to the decentralized identifier and the emissions data.

7. The apparatus of claim 1 , wherein the data related to emissions data includes one or more digital representations that refer to emissions data or portions thereof.

8. 10. The apparatus of claim 1, wherein the emissions data includes data related to an environmental footprint, the environmental footprint related to a product, a company, a process such as a manufacturing process, a raw material, a chemical product, a component, a component assembly, a final product, or a combination thereof.

9. The apparatus of claim 1 , wherein the emissions data includes data related to a carbon footprint of a chemical product.

10. The apparatus of claim 1 , wherein the chemical product passport is associated with emissions data, including access-restricted emissions data associated with a physical entity of the product.

11. 1. A computer-implemented method for generating a chemical product passport, comprising: receiving a request to provide emission data and a non-central identifier associated with a data owner; generating, in response to the request, the chemical product passport including data related to the decentralized identifier and the emissions data; providing the chemical product passport for access by a data consuming service under the control of a data providing service associated with the data owner.

12. Use of a chemical product passport generated according to the method of claim 11 or by the device of claim 1 for further processing of a chemical product associated with said chemical product passport.

13. A chemical product associated with said chemical product passport, comprising data relating to a non-central identifier and emission data, generated according to the method of claim 11 or by the device of claim 1.

14. A chemical product passport comprising data relating to a non-central identifier and emissions data, said chemical product passport being generated according to the method of claim 11 or by the apparatus of claim 1.

15. 12. A computer program comprising instructions, the instructions being configured, when executed on one or more computing nodes, to perform the steps of the method of claim 11 or to be performed by the apparatus of claim 1.

Images