Information processing device, information processing method, and program

Abstract

To provide a technology capable of collecting information about traceability over the entire supply chain while securing secrecy.SOLUTION: A control part of an information processing device acquires product information of each of one or more inclusion products included in an object product, the production information including traceability related information of the inclusion product encrypted by a public key of an authentication station on the basis of association information showing an association relation of products of each company included in a supply chain. The control part acquires an integration result of the traceability related information in an encrypted state by operating encrypted traceability related information by a secret calculation. The control part decrypts the integration result of the traceability related information in an encrypted state through the authentication station.SELECTED DRAWING: Figure 17

Description

[Technical Field]

[0001] This disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Systems for sharing information among multiple companies that make up a supply chain are known. In this regard, for example, Patent Document 1 discloses a system for sharing product information among adjacent suppliers. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2004-171146 [Overview of the project] [Problems that the invention aims to solve]

[0004] The purpose of this disclosure is to provide a technology that can collect traceability information across the entire supply chain while ensuring confidentiality. [Means for solving the problem]

[0005] One aspect of this disclosure is, To obtain linking information that shows the relationships between products of each company included in the supply chain, Based on the aforementioned linking information, product information is obtained for each of the one or more included products contained within the target product, including traceability-related information of the included product encrypted with the certification authority's public key. The encrypted traceability-related information is computed using secure computation to obtain the integrated result of the encrypted traceability-related information, Sending a request to the certification authority to decrypt the integrated result of the encrypted traceability-related information, Receiving the integrated result of the decrypted traceability-related information from the certification authority, This is an information processing device comprising a control unit configured to perform the following:

[0006] Another aspect of this disclosure is, Computers To obtain linking information that shows the relationships between products of each company included in the supply chain, Based on the aforementioned linking information, product information is obtained for each of the one or more included products contained within the target product, including traceability-related information of the included product encrypted with the certification authority's public key. The encrypted traceability-related information is computed using secure computation to obtain the integrated result of the encrypted traceability-related information, Sending a request to the certification authority to decrypt the integrated result of the encrypted traceability-related information, Receiving the integrated result of the decrypted traceability-related information from the certification authority, This is an information processing method that performs the following:

[0007] Another aspect of this disclosure is, On the computer, To obtain linking information that shows the relationships between products of each company included in the supply chain, Based on the aforementioned linking information, product information is obtained for each of the one or more included products contained within the target product, including traceability-related information of the included product encrypted with the certification authority's public key. The encrypted traceability-related information is computed using secure computation to obtain the integrated result of the encrypted traceability-related information, Sending a request to the certification authority to decrypt the integrated result of the encrypted traceability-related information, Receiving the integrated result of the decrypted traceability-related information from the certification authority, is a program for causing execution of the above.

[0008] Furthermore, another aspect of the present disclosure may be a non-transitory storage medium storing the above program.

Effects of the Invention

[0009] According to the present disclosure, a technique capable of collecting traceability information across the entire supply chain while ensuring confidentiality can be provided.

Brief Description of Drawings

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a supply chain according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a relationship between products supplied through a supply chain. [Figure 3] FIG. 3 is a diagram showing an outline of processing performed between a company terminal and a server device. [Figure 4] FIG. 4 is a hardware configuration diagram of a server device according to an embodiment. [Figure 5] FIG. 5 is a hardware configuration diagram of a company terminal according to an embodiment. [Figure 6] FIG. 6 is a software configuration diagram of a server device according to an embodiment. [Figure 7] FIG. 7 is a software configuration diagram of a company terminal according to an embodiment. [Figure 8] FIG. 8 is a diagram showing an example of product information generated by a product information generation unit. [Figure 9] FIG. 9 is a diagram showing an example of a user interface output by an authority setting unit. [Figure 10] FIG. 10 is a diagram showing an example of permission information generated by the authority setting unit based on input information. [Figure 11] FIG. 11 is a diagram showing an example of a user interface including a list of products that are candidates for association destinations. [Figure 12] FIG. 12 is a diagram showing an example of a flow of processing executed by the server device. [Figure 13]A sequence diagram illustrating the processes performed by the server device and enterprise terminals in the first to third phases. [Figure 14] A sequence diagram illustrating the processing performed by the server device and enterprise terminals in the fourth phase. [Figure 15] A diagram illustrating an example of information processing for integrating traceability-related information. [Figure 16] A sequence diagram illustrating the processes performed by the system when integrating traceability-related information. [Figure 17] In this embodiment, a flowchart shows an example of the processing flow performed by the server device when integrating traceability-related information. [Figure 18] A flowchart illustrating an example of the processing flow performed by the server device when integrating traceability-related information in a modified example. [Modes for carrying out the invention]

[0011] The carbon footprint of products (CFP) refers to the raw materials used in a product. This system converts greenhouse gas emissions throughout the entire lifecycle, from procurement to disposal and recycling, into CO2 equivalents and displays them on the product. To implement CFP, traceability is crucial, requiring records of each supplier involved from raw material procurement to disposal and recycling, and making the history traversable.

[0012] The inventors of this case have identified the following problems with the conventional system described above. Specifically, in order to ensure the traceability of information such as CFP, it is necessary to collect such information not only between adjacent companies but also across the entire supply chain. However, the conventional system can only share information between adjacent companies. Furthermore, because it includes confidential information about upstream companies' products (e.g., CFP values ​​of included products, usage amounts of included products, etc.), it is undesirable to disclose it to the entire supply chain. In other words, there was a problem in that it was difficult to collect traceability information across the entire supply chain while ensuring confidentiality.

[0013] Furthermore, the above problem is not limited to situations where CFPs are collected. For example, this problem can occur in any situation where any information related to a product is collected, such as other traceability-related information (e.g., raw material recycling rates, due diligence information, etc.) or other product-related information (e.g., components, identification information, etc.).

[0014] Therefore, an information processing device, which is one aspect of the present disclosure, acquires linking information indicating the linking relationships of products of each company included in the supply chain; acquires product information for each of the one or more included products included in the target product, based on the linking information, which includes traceability-related information of the included products encrypted with the public key of the certification authority; performs calculations on the encrypted traceability-related information using secure computation to obtain an integrated result of the encrypted traceability-related information; sends a request to the certification authority to decrypt the integrated result of the encrypted traceability-related information; and receives the decrypted integrated result of the traceability-related information from the certification authority. The system now includes a control unit configured to perform the following actions:

[0015] The information processing device relating to this disclosure may be a server that manages product information of products from each company included in the supply chain, or it may be a terminal of a company included in the supply chain. In such an information processing device, the control unit acquires linking information that indicates the relationship between products from each company included in the supply chain. The linking information is information that links product information to each other. For example, the linking information may be information that links the product information of a target product with the product information of a contained product. A contained product is a product included in the target product and used in the manufacturing process of the target product.

[0016] The control unit acquires product information for each of the one or more included products contained within the target product, based on the acquired linking information. The product information in this disclosure includes information encrypted with the public key of a certification authority regarding the traceability of the included products. Traceability-related information is information necessary to ensure traceability. For example, traceability-related information may be information used to calculate greenhouse gas emissions, raw material recycling rates, or due diligence scores.

[0017] The control unit obtains the integrated result of encrypted traceability-related information by performing calculations on the encrypted traceability-related information using secure computation. In one example, the secure computation may be performed using a fully homomorphic encryption scheme. Alternatively, the secure computation may be performed using a combination of additive homomorphic encryption and multiplicative homomorphic encryption. The method of secure computation can be appropriately changed depending on the embodiment.

[0018] The control unit sends a request to the certification authority to decrypt the result of the integration of encrypted traceability-related information. In this case, the certification authority decrypts the result of the integration of encrypted traceability-related information using the private key corresponding to the public key. The certification authority then sends the decrypted result of the integration of traceability-related information to the information processing device. As a result, the control unit of the information processing device can receive the decrypted result of the integration of traceability-related information.

[0019] According to this disclosure, traceability-related information included in product information can be encrypted using the public key of a certification authority. Furthermore, the encrypted traceability-related information can be integrated using secure computation. The result of the integration of the encrypted traceability-related information is then decrypted by the certification authority and provided to the information processing device. Therefore, traceability-related information can be collected throughout the entire supply chain while ensuring the confidentiality of the traceability-related information of products from each company included in the supply chain.

[0020] Furthermore, the integrated result of the decrypted traceability-related information may be transmitted from the certification authority to the information processing device in a form encrypted in a way that can be decrypted by the control unit of the information processing device. Encryption in a way that can be decrypted by the control unit means converting the data from a state where only the certification authority can decrypt it to a state where the information processing device can also decrypt it. For example, the data may be decrypted using a key held by the certification authority (e.g., a private key), and then encrypted again using a key accessible by the information processing device (e.g., a key shared between the information processing device and the certification authority). This helps to prevent the integrated result of the decrypted traceability-related information from being identified by a third party.

[0021] Furthermore, traceability-related information may include greenhouse gas emissions. In that case, the control unit can obtain the total greenhouse gas emissions related to the manufacturing activities up to the point where the target product is manufactured, as a result of integrating the decoded traceability-related information.

[0022] Furthermore, the traceability-related information may include the recycling rate for a given raw material. In that case, the control unit can obtain the overall recycling rate of the given raw material in the target product as a result of integrating the decoded traceability-related information.

[0023] Furthermore, traceability-related information may include due diligence scores. In that case, the control unit can obtain an overall due diligence score for the target product as a result of integrating the decoded traceability-related information.

[0024] Here, the target product may be a battery. In that case, the included product may be a product used in the manufacture of batteries. This ensures traceability related to the battery.

[0025] The following describes specific embodiments of this disclosure with reference to the drawings. Unless otherwise specified, the hardware configurations, module configurations, functional configurations, etc., described in each embodiment are not intended to limit the technical scope of the disclosure to those configurations alone.

[0026] <Embodiment> The information processing system according to this embodiment is a system that provides information about products supplied by a supply chain that includes multiple companies. Product information is typically traceability information. The companies belonging to the supply chain may be determined as appropriate according to the attributes of the products, etc.

[0027] First, let's explain the structure of the supply chain. Figure 1 shows the supply chain according to this embodiment. This diagram illustrates an example of a supply chain. The supply chain shown in Figure 1 consists of an OEM company and multiple supplier companies. In the example in Figure 1, we assume a supply chain that manufactures, for example, the automobile itself and automobile-related products such as batteries. The OEM company assembles the final product. Multiple supplier companies (companies A to C) supply parts, materials, assemblies, etc., to manufacture the final product. Each of the multiple supplier companies manufactures one or more products and delivers them to companies located one level down in the chain. Multiple companies repeat this process until the final product is obtained at the final stage (i.e., the OEM company).

[0028] In this embodiment, at each level of the supply chain, the side that supplies products is referred to as the upstream side, and the side that procures those products and manufactures new products is referred to as the downstream side. In this specification, companies located on the upstream side are referred to as upstream companies, and companies located on the downstream side are referred to as downstream companies. Furthermore, products manufactured by upstream companies are referred to as upstream products, and products manufactured by downstream companies are referred to as downstream products. Upstream products are encompassed within downstream products (i.e., upstream products are used in the manufacturing process of downstream products). Also in this embodiment, the levels included in the supply chain are referred to as Tiers. Tier 0 is the lowest level, where the final product is assembled (corresponding to OEM companies). As you progress through Tier 1, 2, and 3, you move towards the upstream side. Depending on the tier you focus on, downstream companies may be upstream. They can also change from being a downstream company to a downstream company. For example, company B, which is located in Tier 2, is a downstream company in relation to Tier 3, but an upstream company in relation to Tier 1. In this way, upstream companies and downstream companies The definition can change depending on the hierarchy.

[0029] Figure 2 illustrates the relationships between products supplied by a supply chain. Here, the supply relationships of the multiple products that make up the final product X are represented by a tree diagram. In this example, the final product X is manufactured by assembling products A1, B1, C1, D1, etc. Product A1 is manufactured by assembling products A11, A12, A13, etc. In this way, the relationships between the multiple products that make up the final product can be represented by a tree diagram in which each product is a node. Hereafter, a tree diagram relating to a specific final product will be referred to as a product tree.

[0030] The server device 1 according to this embodiment collects information about the products manufactured by each company (hereinafter referred to as "product information") and information for linking the product information from terminals (corporate terminals 2) corresponding to each company, and generates a product tree based on these. In addition, the product information includes traceability-related information (for example, information on greenhouse gas emissions), and by following the product tree, it is possible to track carbon footprints and the like.

[0031] In this embodiment, traceability-related information included in the product information is encrypted using the public key of the certification authority 3 (hereinafter sometimes referred to as "public key A"). Server device 1 integrates the encrypted traceability-related information using secure computation. Server device 1 requests certification authority 3 to decrypt the result of the integration of the encrypted traceability-related information.

[0032] Certification Authority 3 decrypts the integrated result of the encrypted traceability-related information using the private key corresponding to the public key A used to encrypt the traceability-related information (hereinafter sometimes referred to as "private key A"). Certification Authority 3 encrypts the decrypted integrated result of the traceability-related information in a way that Server Device 1 can decrypt, and provides the encrypted integrated result to Server Device 1. Certification Authority 3 is a third-party organization that processes information related to authentication, such as issuing electronic certificates to companies.

[0033] Encrypting the data in a way that allows server device 1 to decrypt it means converting the data from a state where only certification authority 3 can decrypt it to a state where server device 1 can also decrypt it. For example, the unified result decrypted with the secret key A held by certification authority 3 is then decrypted with the secret key (hereinafter referred to as "secret key B") held by server device 1. It may also be written as ". ) may be encrypted with the corresponding public key (hereinafter sometimes referred to as "public key B").

[0034] Server device 1 decrypts the encrypted integration result provided by the certification authority 3 using the private key B held by server device 1. Server device 1 outputs the integration result decrypted with private key B. Outputting the decrypted integration result may include the process of providing the integration result decrypted with private key B to the OEM company's enterprise terminal 2.

[0035] As shown in Figure 1, the information processing system according to this embodiment includes a server device 1 and a plurality of corporate terminals 2.

[0036] Enterprise terminal 2 is a terminal corresponding to each of the multiple companies that make up the supply chain. The number of terminals corresponding to each company may be arbitrary. In addition, terminals corresponding to the target company may include terminals of companies that perform operations related to the target company (for example, a proxy company).

[0037] Server device 1 collects information for generating a product tree from each of the multiple corporate terminals 2, and generates the product tree based on the collected information. Furthermore, server device 1 can perform traceability-related processing (typically, processing to calculate carbon dioxide (CO2) emissions, etc.) based on the generated product tree. It can also transmit the results of the processing to the corporate terminals 2.

[0038] Next, we will explain the overview of the process by which server device 1 generates a product tree using Figure 3. Figure 3 is a diagram showing the overview of the process that takes place between enterprise terminal 2 and server device 1. In the example in Figure 3, it is assumed that there are downstream companies, company A and upstream companies, company B, at any given hierarchy. It is assumed that company B manufactures product B and delivers it to company A, and company A uses product B to manufacture product A. In other words, in the example in Figure 3, product B becomes a child node of product A in the product tree.

[0039] To generate a product tree, each company's corresponding company terminal 2 transmits information about the products it manufactures to the server device 1. In this example, company terminal 2 corresponding to company A transmits product information about product A (referred to as product information A) to the server device 1. Similarly, company terminal 2 corresponding to company B transmits product information about product B (referred to as product information B) to the server device 1. The product information for each company is stored in the server device 1.

[0040] The operation to link product information stored in server device 1 is performed by corporate terminal 2. In one example, a representative from a downstream company logs into server device 1 from corporate terminal 2 using the downstream company's account and selects the upstream product to which the downstream product (their own company's product) will be linked. In this way, the linking of product information is performed from downstream products to upstream products. Server device 1 links the product information based on the selection.

[0041] However, if all products included in the supply chain and information about those products are presented as options when users are asked to select a product to link, the confidentiality of information about the companies that make up the supply chain, and the products that those companies manufacture, would be compromised. Furthermore, it may not always be appropriate to disclose the entire product tree to a single supplier.

[0042] Therefore, in accordance with this embodiment, the server device 1 grants the downstream company access rights to the product information of the upstream product in advance, in response to a request from the upstream company. Then, the server device 1 allows the downstream company to access the information within the scope of the granted rights.

[0043] In the example shown in Figure 3, enterprise terminal 2, which corresponds to the upstream company B, sends a request (information) to server device 1 instructing it to "grant company A access rights to product information B." When server device 1 receives a linking request from enterprise terminal 2, which corresponds to company A, it provides only a list of product information for which company A has access rights, allowing company A to select it as the linking destination. Furthermore, when enterprise terminal 2, which corresponds to company A, requests to refer to the product tree, server device 1 provides enterprise terminal 2 with a product tree in which information other than that for which company A has access rights is kept secret. This makes it possible to keep information about unrelated companies and products secret.

[0044] [Hardware configuration] Next, the hardware configuration of each device constituting the system will be described. Figure 4 is a schematic diagram showing an example of the hardware configuration of server device 1 according to this embodiment. Server device 1 is configured as a computer having a control unit 11, a storage unit 12, a communication module 13, and an input / output device 14.

[0045] Server device 1 can be configured as a computer having a processor (CPU, GPU, etc.), main memory (RAM, ROM, etc.), and auxiliary storage (EPROM, hard disk drive, removable media, etc.). The auxiliary storage contains an operating system (OS), various programs, various tables, etc., and by executing the programs stored therein, various functions (software modules) that match a predetermined purpose, as described later, can be realized. However, some or all of the functions may be realized as hardware modules by hardware circuits such as ASICs and FPGAs.

[0046] The control unit 11 is a computing unit that realizes various functions of the server device 1 by executing a predetermined program. The control unit 11 can be realized by a hardware processor such as a CPU. The control unit 11 may also be configured to include RAM, ROM (Read Only Memory), cache memory, etc.

[0047] The storage unit 12 stores information. The storage unit 12 is composed of a storage medium such as RAM, a magnetic disk, or flash memory. The storage unit 12 stores programs executed by the control unit 11, data used by those programs, and so on. In addition, a database is constructed in the storage unit 12, and this database stores product information collected from multiple corporate terminals 2, as well as account information related to the companies. Furthermore, the storage unit 12 stores the private key B corresponding to the public key B held by the certification authority 3. Details of the storage unit 12 will be described later.

[0048] The communication module 13 is a communication interface for connecting the server device 1 to a network. The communication module 13 may be configured to include, for example, a network interface board, a wireless communication interface for wireless communication, etc. The server device 1 can communicate data with other computers (for example, each corporate terminal 2) via the communication module 13.

[0049] The input / output device 14 receives input operations performed by the operator and presents information to the operator. Specifically, the input / output device 14 includes devices for input such as a mouse and keyboard, and devices for output such as a display and speakers. The input / output device may be integrated with, for example, a touch panel display.

[0050] The specific hardware configuration of server device 1 will vary depending on the embodiment. Basic elements can be omitted, replaced, and added. For example, the control unit 11 may include multiple hardware processors. The hardware processors may consist of microprocessors, FPGAs, GPUs, etc. The input / output device 14 may be omitted, or other input / output devices (e.g., optical drives) may be added. Also, the server device 1 may consist of multiple computers. In this case, the hardware configuration of each computer may or may not be the same.

[0051] Figure 5 is a schematic diagram showing an example of the hardware configuration of the enterprise terminal 2 according to this embodiment. The enterprise terminal 2 is configured as a computer having a control unit 21, a storage unit 22, a communication module 23, and an input / output device 24.

[0052] The enterprise terminal 2 can be configured as a computer having a processor (CPU, GPU, etc.), main memory (RAM, ROM, etc.), and auxiliary memory (EPROM, hard disk drive, removable media, etc.), similar to the server device 1. However, some or all of the functions (software modules) may be implemented as hardware modules by hardware circuits such as ASICs and FPGAs.

[0053] The control unit 21 is a computing unit that implements various functions (software modules) of the enterprise terminal 2 by executing a predetermined program. The control unit 11 can be implemented by a hardware processor such as a CPU. The control unit 21 may also be configured to include RAM, ROM (Read Only Memory), cache memory, etc.

[0054] The storage unit 22 stores information. The storage unit 22 is composed of storage media such as RAM, magnetic disks, and / or flash memory. The storage unit 22 stores programs executed by the control unit 21, data used by those programs, etc. The storage unit 22 also stores the public key A issued by the certification authority 3.

[0055] The communication module 23 is a communication interface for connecting the enterprise terminal 2 to a network. The communication module 23 may be configured to include, for example, a network interface board, a wireless communication interface for wireless communication, etc. The enterprise terminal 2 can communicate data with other computers (for example, server device 1) via the communication module 23.

[0056] The input / output device 24 is a means of receiving input operations performed by the operator and presenting information to the operator. Specifically, the input / output device 24 includes devices for input such as a mouse and keyboard, and devices for output such as a display and speakers. The input / output device may be integrated with, for example, a touch panel display.

[0057] Furthermore, the specific hardware configuration of the enterprise terminal 2 can be modified as appropriate, depending on the embodiment, by omitting, substituting, or adding components, similar to the server device 1.

[0058] [Software Configuration] Next, the software configuration of each device constituting the system will be described. Figure 6 is a schematic diagram showing the software configuration of the server device 1 according to this embodiment. In this embodiment, the control unit 11 is configured to have four software modules: an information collection unit 111, an authorization setting unit 112, a linking unit 113, and an information provision unit 114. Each software module may be realized by the control unit 11 (CPU) executing a program stored in the storage unit 12. Note that the information processing performed by the information collection unit 111, authorization setting unit 112, linking unit 113, and information provision unit 114 described below is synonymous with the information processing performed by the control unit 11.

[0059] The information collection unit 111 is configured to receive product information transmitted from the corporate terminal 2 and to store the product information in the storage unit 12. The authorization setting unit 112 is configured to receive information (hereinafter referred to as authorization information) from the corporate terminal 2 for setting access permissions to the product information. Furthermore, the authorization setting unit 112 is configured to perform a process to set access permissions to the product information stored in the storage unit 12 based on the received information.

[0060] The linking unit 113 is configured to interact with the enterprise terminal 2 and obtain information from the enterprise terminal 2 for linking product information together. Furthermore, the linking unit 113 is configured to perform a process of writing information representing the linking relationship to the product information stored in the storage unit 12 based on the obtained information. The linking unit 113 is also configured to receive a request to add termination information and, in response, perform a process of adding termination information to the product information stored in the storage unit 12. A product tree is generated by reflecting the linking and termination additions. That is, generating a product tree is performed by saving the linking information and termination information in the storage unit 12. The linking unit 113 is configured to generate a product tree according to the results of the linking and termination additions.

[0061] The information provision unit 114 is configured to perform information processing related to the product tree and to output the results of the information processing. Outputting the results of the information processing may include providing information about the generated product tree to the enterprise terminal 2. In one example, the information provision unit 114 is configured to generate information about the product tree and to output information about the generated product tree.

[0062] Furthermore, the information provision unit 114 performs information processing to integrate traceability-related information based on the generated product tree. In one example, the information provision unit 114 repeatedly integrates traceability-related information by tracing the relationships between product information based on the product tree, thereby obtaining the result of integrating traceability-related information (for example, total CO2 emissions) that corresponds to all processes until the final product is manufactured.

[0063] In this embodiment, traceability-related information included in the product information is encrypted using the public key A of the certification authority 3. Therefore, the information provision unit 114 is configured to perform information processing to integrate the encrypted traceability-related information using secure computation. The result of integrating the encrypted traceability-related information is transmitted from the server device 1 to the certification authority 3 and decrypted using the private key A held by the certification authority 3. The integrated result decrypted with private key A is encrypted using the public key B corresponding to the private key B held by the server device 1 and transmitted from the certification authority 3 to the server device 1. The integrated result transmitted from the certification authority 3 to the server device 1 is decrypted using the private key B held by the server device 1, and the decrypted integrated result is output. Details of the information processing for integrating traceability-related information will be described later.

[0064] In this embodiment, the storage unit 12 is configured to include multiple logical storage areas. Each of the multiple storage areas can be configured with different access permissions, such as an area where access is granted to company A, an area where access is granted to company B, or an area where access is granted to both company A and B. The permission setting unit 112 sets access permissions by storing product information received from the company terminal 2 in the appropriate storage area. The specific processing method will be described later.

[0065] Furthermore, account information is stored in the storage unit 12. In this embodiment, interaction between the server device 1 and the corporate terminal 2 occurs when an operator from each company logs in to the server device 1 using the corresponding company's account via the corporate terminal 2. The account information is information about the account corresponding to each company that makes up the supply chain. Note that logging in using an account is one example of accessing server device 1 as a corresponding company. However, the method of accessing server device 1 is not limited to this example and may be appropriately selected depending on the embodiment. Furthermore, the storage unit 12 stores a secret key B for decrypting the integrated result of traceability-related information encrypted with the public key B held by the certification authority 3.

[0066] Figure 7 is a schematic diagram showing the software configuration of the enterprise terminal 2 according to this embodiment. In this embodiment, the control unit 21 is configured with four software modules: a product information generation unit 211, an authorization setting unit 212, a linking request unit 213, and an information acquisition unit 214. Each software module may be implemented by the control unit 21 (CPU) executing a program stored in the storage unit 22. The information processing performed by the product information generation unit 211, authorization setting unit 212, linking request unit 213, and information acquisition unit 214 described below is synonymous with the information processing performed by the control unit 21.

[0067] The product information generation unit 211 is configured to generate information (product information) about the company's products corresponding to the company terminal 2. Figure 8 shows an example of product information generated by the product information generation unit 211. The product information may also be input via the device operator. In this embodiment, the product information is configured to have the following fields: company ID, company name, product ID, and product name. The company ID and company name are the identifier and name of the company that manufactures the target product (i.e., the company using the company terminal 2). The product ID and product name are the identifier and name of the target product.

[0068] Furthermore, the product information is configured to include linking-related information. Linking-related information is information for identifying the upstream product that is linked to the target product. In this embodiment, the linking-related information includes the fields "upstream product information," "termination flag," and "linking completion flag."

[0069] The upstream product information field is configured to store information for identifying product information corresponding to upstream products associated with the target product (i.e., products used in the manufacturing process of the target product (products that constitute the target product)). The upstream product information field is used when the server device 1 links products together. Basically, at the stage when the product information is generated, the target product is not associated with an upstream product, so the upstream product information field does not need to store a value indicating an upstream product.

[0070] The termination flag field is configured to store a flag indicating whether the target product is a leaf node, i.e., the node located at the very top (end) of the product tree. In this embodiment, since multiple corporate terminals 2 transmit product information, this flag is used to determine whether further products are linked upstream of a product in the product tree, or whether no further linking occurs (i.e., whether the target product is located at the top). In other words, the termination flag field is used when the server device 1 confirms the linking of products. Basically, at the stage when product information is generated, the linking relationships of the target products are not yet determined, so the termination flag field may store "0 (not currently the end)". Finally, in order to generate the product tree, the product information of each company stored in the server device 1 is set to one of the following states: "Linking with upstream products has been performed" and "The termination flag is set to "1".

[0071] The linking completion flag field is configured to store a flag indicating whether or not the linking of the target product with an upstream product has been completed. In this embodiment, a product in the product tree may be linked to multiple upstream products. For example, product C may be manufactured using products A and B as components. If the target product is located in an intermediate node rather than a leaf node, the mere presence or absence of a product to which it is linked is not sufficient to determine whether the linking is complete or if another product is linked. It is difficult to determine whether further linking will occur. If this cannot be determined, the product tree cannot be finalized. The linking completion flag is used to identify this. In other words, the linking completion flag is status information that indicates whether all linking is complete or not. The linking completion flag field is used by server device 1 when confirming the linking of products. Basically, at the stage when product information is generated, the linking relationships of the target products are not yet determined, so the linking completion field may contain "0 (further linking may occur)".

[0072] For product information located at leaf nodes, the termination flag can be used to determine whether the product information is finalized. For product information located at intermediate nodes, the linking completion flag can be used to determine whether the product information is finalized. The flag stored in the termination flag field (termination flag) is an example of "termination information".

[0073] Furthermore, the product information is configured to include traceability-related information encrypted with public key A issued by certification authority 3. In other words, the product information generation unit 211 is configured to encrypt the traceability-related information with public key A of certification authority 3 and generate product information including the encrypted traceability-related information. In this embodiment, public key A issued by certification authority 3 is generated to have complete homomorphism. That is, public key A used for encrypting traceability-related information is generated such that both addition and multiplication of multiple pieces of information encrypted with the public key A can be performed securely while they remain encrypted.

[0074] In the examples shown in Figures 5 and 7, the public key A used for encrypting traceability-related information is stored in the storage unit 22, but it may also be obtained from the certification authority 3 when the product information generation unit 211 generates the product information.

[0075] Furthermore, for example, traceability-related information included in product information may include the amount of material (e.g., upstream product) used per unit of product manufactured, information on the recycling rate of a given raw material, greenhouse gas emissions during the manufacturing of the product, due diligence-related information, or a combination thereof. The given raw material may be, for example, lithium, nickel, cobalt, lead, graphite, etc. The recycling rate may be expressed directly or indirectly, such as a combination of total usage and recycled material usage. These values ​​correspond to the processes involved in manufacturing the product in question.

[0076] In the example shown in Figure 8, the traceability-related information included in product information A includes information encrypted with the public key A of certification authority 3, such as the amount of upstream product used (amount of upstream product used per unit of product A manufactured) and the company's measured CFP value (amount of CO2 emitted during the manufacturing activities of product A). Note that the traceability-related information included in product information A does not include information about the processes leading up to the manufacture of the upstream product (for example, the amount of greenhouse gases emitted before the upstream product is manufactured).

[0077] Furthermore, traceability-related information may be appropriately selected depending on the embodiment. In one example, greenhouse gas emissions (CFP) may include Scope 1, Scope 2, and Scope 3 emissions. Scope 1 may be direct greenhouse gas emissions by the company itself. Scope 2 may be indirect emissions resulting from the use of electricity, heat, and steam supplied by other companies. Scope 3 may be indirect emissions other than Scope 1 and Scope 3. In another example, due diligence-related information may include technical documentation showing the amount of raw materials contained in the product and whether the company is fulfilling its obligations for responsible mineral sourcing, such as that of a smelter, for products containing the target raw materials (e.g., cobalt, natural graphite, lithium, nickel, etc.). In yet another example, due diligence-related information may include a score indicating the degree to which the above obligations are being fulfilled.

[0078] The product information generation unit 211 is configured to acquire such information via the operator of the corporate terminal 2 and transmit it to the server device 1 at any time.

[0079] The authorization setting unit 212 is configured to specify which downstream companies are permitted to access product information sent from the corporate terminal 2 to the server device 1. Figure 9 is an example of a screen output by the authorization setting unit 212. As shown in Figure 9, the authorization setting unit 212 is configured to accept the specification of downstream companies permitted to access any company product. Figure 10 is an example of permission information generated by the authorization setting unit 212 based on the input information. The authorization setting unit 212 is configured to send the permission information to the server device 1 at any time. The permission information is an example of an "authorization command". Access permissions may be set on a per-product information basis, or on an item basis included in the product information ("permitted items" in the figure). This makes it possible to handle partial disclosure, for example, by disclosing the existence of a product, but not disclosing specific information such as the materials used or the amount used.

[0080] The list of companies displayed on the screen in Figure 9 can be a list of companies with which the company has had past transactions. For this reason, the server device 1 may store data on past transactions (transaction data) for each company and generate a list of companies based on this transaction data. The transaction data may include, for example, the identifier of the target product, the identifier of the company that manufactured the product, and the transaction date.

[0081] The linking request unit 213 is configured to request the server device 1 to link the company's product information, which it has sent to the server device 1, with upstream products. In one example, the linking request unit 213 first sends the company's corporate ID and product ID to the server device 1 and requests the linking of product information corresponding to the product ID. In response, the server device 1 generates a user interface that includes a list of product information that the target company is permitted to access (i.e., candidate linking destinations) and provides the generated user interface to the corporate terminal 2. Figure 11 is an example of a user interface that includes a list of products that the target company is permitted to access.

[0082] The product list shown in Figure 11 can be a list of products with which the company has a history of transactions. Server device 1 may generate this list based on stored transaction data.

[0083] Next, the linking request unit 213 is configured to allow the operator to select the upstream product to be linked from the list. Furthermore, the linking request unit 213 is configured to send the identifier of the product to be linked (downstream product) and the identifier of the upstream product to be linked as a pair to the server device 1. The server device 1 can then link the product information accordingly.

[0084] If there is no upstream product associated with the target product, this can be explicitly indicated by checking the checkbox indicated by reference numeral 1001 in Figure 11. In this case, no linking of product information is performed, and the server device 1 sets the termination flag of the corresponding product information to "1". If an upstream product associated with the target product already exists, that is, if the node corresponding to the target product is not a leaf node, this check operation is prohibited.

[0085] Furthermore, if no further linking is performed for the target product, this can be clearly indicated by checking the checkbox indicated by reference numeral 1002 in Figure 11. In this case, the server device 1 sets the flag indicating that the linking of the corresponding product information is complete to "1". This will result in the product being excluded from the linking process if the termination flag is set to "1". In this case, the handling of the linking completion flag is optional. For example, if the termination flag is set to "1", the linking completion flag may also be set to "1". In another example, if the termination flag is set to "1", the linking completion flag may remain at "0" and be ignored.

[0086] Thus, the linking request unit 213 is configured to issue either (1) a request to link the target product with an upstream product, or (2) a request to assign a termination flag indicating that the target product is at the end of the supply chain. When declaring the completion of linking, the linking request may include a request to assign a linking completion flag indicating that no further linking will occur for the target product. This allows the server device 1 to determine the state of the product tree.

[0087] The information acquisition unit 214 is configured to request the server device 1 to provide a product tree and to output the information transmitted from the server device 1. In addition, at the OEM company's enterprise terminal 2, the information acquisition unit 214 is configured to request the server device 1 to provide the integrated results of traceability-related information (integrated results of traceability-related information corresponding to all processes until the final product is manufactured) and to output the integrated results provided by the server device 1.

[0088] [Details of the information processing that generates the product tree] Next, we will explain the specific processes performed by Server Device 1 and Enterprise Terminal 2 in generating the product tree. Figure 12 shows an example of the processing flow executed by Server Device 1 based on a request from Enterprise Terminal 2. The processing performed by server device 1 can be broadly divided into the following four phases. (1) The first phase involves receiving product information transmitted from the enterprise terminal 2 and storing the received product information. (2) The second phase involves receiving permission information transmitted from the corporate terminal 2 and setting access rights to product information according to the received permission information. (3) The third phase involves linking product information by interacting with the enterprise terminal 2. (4) A fourth phase in which information about the product tree is provided based on the results of the linking.

[0089] In the example in Figure 12, Company A is a downstream company and Company B is an upstream company. The product manufactured by Company A is designated as Product A, and the product manufactured by Company B is designated as Product B. Furthermore, the product information corresponding to Product A is designated as Product Information A, and the product information corresponding to Product B is designated as Product Information B.

[0090] In the first phase, the information collection unit 111 of the server device 1 acquires product information from the product information generation unit 211 of the corporate terminal 2. In the example in Figure 12, the server device 1 acquires product information A from corporate terminal 2 corresponding to company A and product information B from corporate terminal 2 corresponding to company B. The information collection unit 111 stores product information A in a storage area (hereinafter referred to as storage area A) to which access rights are granted only to company A. The information collection unit 111 also stores product information B in a storage area (hereinafter referred to as storage area B) to which access rights are granted only to company B. In this way, the information collection unit 111 stores product information transmitted from any company in a dedicated storage area to which access rights are granted only to that company.

[0091] In the second phase, the authorization setting unit 112 of the server device 1 receives authorization information from the authorization setting unit 212 of the corporate terminal 2, and sets access permissions for product information according to the received authorization information. As shown in Figure 10, the authorization information associates a product with a company that is permitted to access the product information of that product.

[0092] In the example shown in Figure 12, it is assumed that the authorization setting unit 112 has received authorization information granting access to product information B of the upstream company from company A, which is a downstream company. In this case, the authorization setting unit 112 copies product information B, which is stored in storage area B, to storage area AB, which is granted access rights to both companies A and B. As a result, product information B becomes accessible to both companies A and B. If access rights are not set for a specific item included in the product information, that item is excluded from being copied to storage area AB.

[0093] In the following explanation, a storage area to which access rights are granted only to a specific company will be referred to as a "dedicated storage area," and a storage area to which access rights are granted to multiple companies will be referred to as a "shared storage area."

[0094] Thus, the copying of product information is performed by the server device 1 in response to receiving authorization information from the corporate terminal 2. In other words, the corporate terminal 2 transmits authorization information to the server device 1, thereby causing the server device 1 to copy the product information identified by that authorization information from the target company's dedicated storage area to a shared storage area accessible by downstream companies.

[0095] In the third phase, the linking unit 113 of the server device 1 receives a linking request from the linking request unit 213 of the corporate terminal 2, and links the product information based on the received linking request.

[0096] First, the linking unit 113 receives a linking request from the corporate terminal 2. The linking request is sent from the corporate terminal 2 of a downstream company. In the example in Figure 12, it is assumed that the corporate terminal 2 of company A sent the linking request. The linking request includes the company ID and the product ID of the target product. The linking unit 113 retrieves the product information stored in the memory area accessible from that company and generates a list of the retrieved product information. In the example in Figure 11, company A can access product information B stored in memory area AB. Therefore, product information B becomes selectable as the linking destination on the corporate terminal 2 of company A.

[0097] The linking request unit 213 of the enterprise terminal 2 presents a list to the operator and allows the operator to select the products to be linked. In this example, products A and B are the products to be linked to each other. For example, the operator inputs information indicating that product B is the upstream product for product A via the input / output device 24. The linking request unit 213 sends data (linking data) to link the upstream product (product B) and the downstream product (product A) to the linking unit 113.

[0098] As illustrated in Figure 8, the product information includes fields related to the linked product (linking-related information). Based on the aforementioned linking data, the linking unit 113 stores information corresponding to product information B (i.e., the upstream product) in the linking-related information of product information A. For example, the linking-related information may include an identifier for the upstream product, an identifier for the company that manufactures the upstream product, and so on.

[0099] Furthermore, the linking-related information may include pointers to the product information to which the linking is made. The pointers indicate the address of the product information corresponding to the upstream product. Through the process described above, a part of a tree structure is formed in which the product information of the downstream product is the parent node and the product information of the upstream product is the child node.

[0100] Furthermore, no further linking is performed at the end of the product tree. In this case, instead of sending linking data, the linking request unit 213 will not send the linking data, as the product is at the end of the tree. Data indicating this is sent. In the example in Figure 11, checking the checkbox indicated by reference numeral 1001 sends data indicating that the product is at the end of the tree. When the linking unit 113 receives this data, it sets the end flag field of the corresponding product information to "1".

[0101] Furthermore, if it is clear that no further linking will occur for the target product, the linking request unit 213 sends data to explicitly indicate this fact, which is included in the linking data. In the example in Figure 11, checking the checkbox indicated by reference numeral 1002 sends data indicating that no further linking will occur for that product. Upon receiving this data, the linking unit 113 sets "1" in the linking completion flag field of the corresponding product information. Note that if the termination flag is set, both flags may be set to "1".

[0102] In other words, in the third phase, the linking request unit 213 is (A) "Request to specify the upstream product to which the linking is to be performed (including requests to set the linking completion flag)" (B) "Request to set the termination flag" One of the following is issued to Server Device 1. The product tree of the final product is completed when linking or termination flagging is completed for all companies belonging to the supply chain. The process of generating this product tree may be arbitrary. In one example, each company may execute the above third phase in a disorderly manner (referred to as the shotgun method). With this method, management of the execution of the third phase is unnecessary, and thus the processing load on Server Device 1 can be reduced. In another example, the above third phase may be executed sequentially from the upstream company (referred to as the bucket brigade method). In this case, the server device will be notified when linking at Tier N-1 is completed. After that, you may allow linking in TierN or setting the termination flag. According to this method, The completion of the product tree can be easily managed.

[0103] In the fourth phase, the information provision unit 114 of the server device 1 generates information about the product tree based on the stored product information and outputs the information about the product tree. Generating information about the product tree refers to the process of generating various information about the product (for example, an image representing the link relationships between products using a tree diagram) after links between nodes have been formed by linking the product information together. This process of generating information about the product tree is an example of information processing about the product tree. In order to generate information about the product tree, all linking of the product information must be completed, and the termination flag of all leaf nodes must be set to "1". The information provision unit 114 can appropriately generate the information when these conditions are met.

[0104] The product tree in this embodiment, as described with reference to Figure 2, represents the supply relationships between product information in the supply chain using a tree diagram. The information provision unit 114 can generate an image representing the tree diagram based on the product information. The generated product tree may be stored in the storage unit 12 of the server device 1.

[0105] The information provision unit 114 may output the generated product tree in image format. The information provision unit 114 may also provide the generated product tree to the corporate terminal 2 (information acquisition unit 214) upon request from that terminal. However, disclosing the entire product tree to a specific company may not be appropriate in some cases. Therefore, when providing the product tree to a corporate terminal 2 corresponding to a particular company, the information provision unit 114 may perform a process to keep confidential the portion of the product tree that the company does not have access rights to.

[0106] [Processing flow] Next, we will explain the flow of processing performed by the server device 1 and the corporate terminal 2 when the corporate terminal 2 registers its own product information, referring to Figures 14 and 15. Figure 14 is a sequence diagram corresponding to the first to third phases described above.

[0107] In one example, the interaction between server device 1 and corporate terminal 2 begins when an operator from each company logs into server device 1 via corporate terminal 2 using the corresponding company's account. In this example, it is assumed that each company's operator logs into server device 1 using their own company's account.

[0108] First, in step S11, the product information generation unit 211 of the corporate terminal 2 acquires the company's product information entered by the operator. The product information generation unit 211 encrypts the traceability-related information from the entered product information using the public key A of the certification authority 3. The product information generation unit 211 then transmits the product information, including the encrypted traceability-related information, to the server device 1 (step S12).

[0109] Product information transmitted from the corporate terminal 2 is received by the server device 1 (information collection unit 111) and stored in the storage unit 12 (step S13). At this time, the information collection unit 111 stores the product information in a dedicated storage area to which access rights are granted only to companies that manufacture the corresponding product.

[0110] Next, in step S14, the authorization setting unit 212 of the corporate terminal 2 receives input (authorization information) via the operator, specifying the downstream companies that are permitted to access the product information transmitted in step S12. In this step, a user interface as described with reference to Figure 9 may be provided, allowing the user to specify any combination of product and the downstream companies that are permitted to access the product information. The input authorization information is transmitted to the server device 1.

[0111] In step S15, the authorization setting unit 112 of the server device 1 grants access rights to the target product information based on the received authorization information. In this step, as explained with reference to Figure 12, the authorization setting unit 112 grants access rights to any product information to any company by copying the target product information to a shared storage area to which access rights have been granted to multiple companies. If there is no storage area with appropriate access rights, a new storage area may be created and access rights granted to the appropriate company.

[0112] Next, in step S16, the linking request unit 213 of the corporate terminal 2 sends data (linking request) to the server device 1 requesting that the product information sent to the server device 1 be linked to the upstream product. This linking request includes the company's corporate ID and the product ID of the target product.

[0113] In step S17, the server device 1 (linking unit 113) generates a list of product information that the target company is permitted to access, and provides the corporate terminal 2 with a user interface containing this list. In this step, the server device 1 may provide the corporate terminal 2 with a user interface as described with reference to Figure 11, allowing the user to specify any product and the upstream product associated with that product.

[0114] In step S18, the linking request unit 213 of the enterprise terminal 2 receives a specification from the operator regarding the combination of the target product and the upstream product associated with that product. The linking request unit 213 generates data (linking data) indicating the association between the upstream product and the downstream product, and sends the generated linking data to the server device 1.

[0115] In step S19, the linking unit 113 of the server device 1 updates the stored product information based on the linking data, reflecting the linking between the product information. The linking of product information may also be performed by storing information about the upstream product (identifier, pointer, etc.) in the linking-related information contained in the product information of the downstream product.

[0116] If no downstream companies exist, steps S14 to S15 may be omitted. Similarly, if no upstream companies exist (i.e., no linked product exists), instead of requesting the linking of product information, the process of setting the termination flag described above may be executed. In this case, steps S16 to S19 described above are omitted.

[0117] Figure 14 is a sequence diagram corresponding to the fourth phase described above. First, in step S21, the information acquisition unit 214 of the enterprise terminal 2 requests the server device 1 to provide a product tree. This request includes, for example, the identifier of the target product. The target product may be the final product or other products (intermediate products).

[0118] Upon receiving the request, the server device 1 (information provision unit 114) generates a product tree using the process described above (step S22). In step S23, the server device 1 performs a process to conceal information for which access rights have not been granted, based on the access rights held by the target company. For example, if the existence of product information of other companies is not made public for a certain company, the server device 1 may perform a process to conceal the existence of such product information. Also, if only specific items included in the product information are not made public, the server device 1 may perform a process to conceal the contents of those items. The concealed product tree is provided to the company terminal 2 (information acquisition unit 214) and output (step S24).

[0119] [Details of the information processing for integrating traceability-related information] Next, we will explain the specific details of the information processing for integrating traceability-related information. In one example, the process of integrating traceability-related information may be triggered when the product tree is generated. In another example, the process of integrating traceability-related information may be performed after the product tree has been generated, triggered by receiving a request from a company terminal 2 of a company included in the supply chain (e.g., an OEM company). Note that the process of integrating traceability-related information may be performed at any time.

[0120] Figure 15 shows an example of information processing for integrating traceability-related information. Here, CFP value (CO2 emissions) is used as an example of the target of integration. In the example shown in Figure 15, product B of company B belonging to Tier N is the target product, product C of company C belonging to Tier N+1 is the upstream product of the target product (product used in the manufacturing process of the target product (included product)), and Tier N-1... Let product A of company A be a downstream product of the target product (a product that contains the target product). Also, let product information corresponding to product B be product information B, product information corresponding to product C be product information C, and product information corresponding to product A be product information A.

[0121] In the example shown in Figure 15, the information provision unit 114 of the server device 1 accesses product information B stored in a dedicated storage area (storage area B in Figure 15) to which only company B has access rights, and obtains encrypted "company-measured CFP value" and "upstream product usage (usage of product C)". In addition, the information provision unit 114 accesses a shared storage area (storage area BC in Figure 15) to which both company B and company C have access rights, and obtains encrypted "Tier N+1 CFP value".

[0122] Here, the "CFP value of Tier N+1" is the CFP value in the manufacturing activities from the upstream product to product C. This is the result of integrating FP values ​​(i.e., the total amount of CO2 emitted from manufacturing activities from the upstream product to product C). The encrypted "Tier N+1 CFP value" is calculated from the upstream product to product C. This is the result of integrating the encrypted CFP values ​​contained in the product information of each of the one or more products up to C using secure computation. The encrypted "CFP value for Tier N+1" is obtained using the encryption described below. It is calculated using the same method as the "TierN CFP value". Note that product C is the upstream product. If company C is the upstream company, the encrypted "TierN CFP value" is product information C This will be the encrypted "Company-Measured CFP Value" included in the data.

[0123] The information provision unit 114 uses the information obtained above to determine the "Tier N+1 CFP value" and manufacturing The CFP values ​​included in product information B are integrated using secure computation. In this embodiment, the "company-measured CFP values" and "usage amount of upstream products" included in product information B are encrypted with a public key A that has complete homogeneity, as illustrated in Figure 8. Therefore, "Tier N+1 C The "FP value," "in-house measured CFP value," and "usage amount of upstream products" can be secretly calculated by both addition and multiplication while remaining encrypted. Therefore, the information provision unit 114 of this embodiment calculates the encrypted integrated result (the "CFP value of TierN" in its encrypted state using public key A) by performing the following calculation using secret calculation. "Tier N CFP value" = "Tier N internally measured CFP value" + "Tier N+1 CFP value" × "manufacturing Product C usage amount”

[0124] It should be noted that there may be cases where the target product includes multiple products. For example, in the example shown in Figure 2, Tier 2 product A12 includes three Tier 3 products A121, A121, and A123. In this case, for each of the three products A121, A121, and A123, "Tier N+1 The calculation is performed by multiplying the CFP value by the amount of upstream product used (amount used in Tier N), and the results of these calculations are then calculated. It is necessary to calculate the sum. Therefore, the information provision unit 114 may calculate the encrypted integrated result (the "CFP value of TierN" in its encrypted state with public key A) by performing the following calculation using secure computation. "TierN's CFP value" = "TierN's internally measured CFP value" + Σ k ("C of company k (Tier N+1)") FP value × Usage amount in Tier N k )

[0125] In the above formula, k represents the number of companies that manufacture the products (Tier N+1 products) included in the target product (Tier N product). For example, if the target product is product A12 (Tier 2 product) as exemplified in Figure 2, In one case, three products A121, A121, and A123, manufactured by three different companies, become the included products (Tier 3 products), so k=3. Also, the target product is product A, as exemplified in Figure 2. If it is an 11 (Tier 2 product), it includes one product A111 manufactured by one company. Since it becomes a product (Tier 3 product), k=1.

[0126] Once the "TierN CFP value" remains encrypted through the above secure computation, Information provision unit 114 provides the encrypted "TierN CFP value" to company A and company The data is stored in a shared storage area (storage area A and B in Figure 15) to which both B and B are granted access rights.

[0127] After the "TierN CFP value" is calculated in its encrypted state, the information provision department 114 This involves shifting the target product to the next downstream product (in the example shown in Figure 15, product A at Tier N-1), The encrypted "TierN-1 CFP value" is calculated. In that case, the information provision unit 114 performs the above calculation. Integrated results (encrypted "TierN CFP value"), encrypted " included in product information A The confidential calculation is performed using the "Company-measured CFP value" and "Upstream product usage." The information provision unit 114 performs calculations from the product one step downstream from the upstream product until the final product (Tier 0 product). By repeating this process sequentially, the "Tier 0" data remains encrypted with public key A. The CFP value (total amount of CO2 emitted from manufacturing activities from the upstream product to the final product) can be obtained.

[0128] Information provision unit 114 requests decryption of the "Tier0 CFP value" which remains encrypted. The request is sent to Certificate Authority 3. Upon receiving the request, Certificate Authority 3 uses its private key A (the private key corresponding to public key A used to encrypt the traceability-related information contained in the product information) to decrypt the encrypted "Tier0 CFP value". Then, Certificate Authority 3 receives the decrypted "Tier0 CFP value" and public key B (which Server Device 1 holds). The data is encrypted using the public key corresponding to the private key B held by the certificate authority. The "Tier0 CFP value" encrypted with public key B is sent from certificate authority 3 to server device 1.

[0129] Upon receiving the "Tier0 CFP value" encrypted with public key B, server device 1 receives the information The information provision unit 114 uses the secret key B held by the server device 1 to decrypt the "Tier 0 CFP value" encrypted with the public key B. The information provision unit 114 outputs the decrypted "Tier 0 CFP value". In one example, the information provision unit 114 outputs the decrypted "Tier 0 CFP value" to the The data is sent to the downstream company's (OEM company's) terminal 2. This allows the final downstream company (OEM company) to understand the total amount of CO2 emitted throughout the entire process until its product (final product) is manufactured.

[0130] Furthermore, the process of calculating the encrypted "TierN CFP value" using secure computation is handled by Product Tree. - Before it is generated, the linking of product information from the top-level product to Tier N products It may be executed once it is complete.

[0131] Furthermore, the information provision unit 114 may be configured to decrypt the encrypted "TierN CFP value" through the certification authority 3 in response to a request from company B's corporate terminal 2, and then transmit the decrypted "TierN CFP value" to company B's corporate terminal 2.

[0132] In this manner, the information provision unit 114 repeatedly performs a process of sequentially integrating the traceability-related information defined in each product information from the upstream to the downstream. In the above explanation, CFP value (CO2 emissions) was used as an example of the target of integration, but the traceability-related information to be integrated may also be the recycling rate for a given raw material, due diligence scores, etc. If the traceability-related information is numerical, the integration may be performed by numerical calculation, and if the traceability-related information is not numerical (for example, due diligence-related information, etc.), the integration may be simply information collection.

[0133] Figure 16 shows the sequence of processes performed by the system of this embodiment when integrating traceability-related information. Here, as with the example explained using Figure 15, CFP values ​​(CO2 emissions) will be used as an example of the data to be integrated.

[0134] In the example shown in Figure 16, first, in step S31, the information provision unit 114 of the server device 1 traces the links between product information from the upstream product (Tier N product) to the final product (Tier 0 product) based on the product tree, and integrates the CFP values ​​included in the product information from Tier N products to Tier 0 products. In this embodiment, the CFP values ​​included in the product information from Tier N products to Tier 0 products (the "company-measured CFP value" and "usage amount of upstream product" exemplified in Figure 8) are encrypted with a public key A that has complete homogeneity. Therefore, the information provision unit 114 of this embodiment calculates the above formula ("Tier N CFP value" = "Tier N company-measured CFP value" + Σ k ("Company k (TierN+1) CFP value" × "Usage amount in TierN u") k By performing secure computation on the encrypted "TierN", the integrated result (the encrypted "TierN" The CFP value is calculated. The information provision unit 114 sequentially repeats this process from the product one step downstream of the upstream product until it becomes the final product (Tier 0 product), thereby encrypting the data. The final integrated result in its original state (the encrypted "Tier0 CFP value (upstream)" The total amount of CO2 emitted from manufacturing activities from product to final product can be obtained. The information provision unit 114 then sends a request (decryption request) to the certification authority 3 to decrypt the final integrated result (the "Tier0 CFP value" in its encrypted state). (Step S32).

[0135] Upon receiving the decryption request, Certificate Authority 3 uses its private key A to decrypt the unencrypted result (the unencrypted "TierN CFP value") (Step S33). Next, the Certificate Authority 3 encrypts the decrypted integrated result ("TierN CFP value") using the public key B corresponding to the private key B held by the server device 1. (Step S34). The decryption result encrypted with public key B (the "TierN CFP value" encrypted with public key B) is sent from certification authority 3 to server device 1 (Step S35). ).

[0136] Integration result encrypted with public key B ( "TierN's CFP" encrypted with public key B Upon receiving the value ("TierN"), the server device 1, using the private key B held by the server device 1, uses the integrated result (encrypted with the public key B) received from the certification authority 3 to obtain the integrated result ("TierN") The CFP value of (Step S36) is decoded. Subsequently, the information provision unit 114 outputs the decoded integrated result ("CFP value of TierN") (Step S37). In one example, the decoded Outputting the integrated result ("Tier N CFP value") means that the integrated result ("Tier N CFP value") is sent from Server Device 1 to the enterprise terminal of Tier 0 companies (OEM companies that manufacture the final product). This may include sending to 2.

[0137] [Processing flow] Figure 17 is a flowchart showing the processing flow executed by server device 1 when integrating traceability-related information (an example of the specific processing steps S31-S32 and S35-S37 in Figure 16). In one example, the processing flow shown in Figure 17 may be triggered when the product tree is generated. In another example, the processing flow shown in Figure 17 may be executed after the product tree has been generated and a request has been received from a Tier 0 company (OEM company). It may be executed as a trigger upon receiving an order.

[0138] The execution entity in the processing flow shown in Figure 17 is the processor of server device 1, but the explanation will be given using the software module of server device 1 as the execution entity.

[0139] In the processing flow shown in Figure 17, when a triggering event occurs (for example, the generation of a product tree or the acceptance of a request from a Tier 0 company), the information provision unit 11 of the server device 1 processes the information. Step 4 retrieves the product tree corresponding to the Tier 0 product (step S101). In one example, Acquiring the product tree may be an information processing step that generates a product tree, as explained using Figures 12-14. In another example, acquiring the product tree may be an information processing step that accesses a generated product tree stored in the storage unit 12. After the product information generation unit 211 has finished executing the process in step S101, it executes the processes from step S102 onward.

[0140] Here, in the processing from step S102 onwards in Figure 17, the products that are subject to the processing in steps S102 to S105 (Tier N products) are one level below the top-level product in the product tree. This ranges from the upstream products (products that include the upstream products) to the final products (Tier 0 products).

[0141] In step S102, the information provision unit 114 obtains the encrypted "Tier N+1 CFP value" of the product one level upstream (Tier N+1) from the target product (Tier N product). Specifically, the information provision unit 1 14 accesses a shared storage area to which both the company that manufactures the target product (TierN product) and the company that manufactures the product containing the target product (TierN+1 product) have been granted access rights. Then, retrieve the encrypted "TierN+1 CFP value" stored in the shared storage area. However, if the product containing the target product (TierN+1 product) is the upstream product, the information provision unit 114 will store the above shared storage area (or the product containing the product (TierN+1 product) in the upstream storage area). Access the dedicated storage area of ​​the manufacturing company and include the product information of the included products (Tier N+1 products). The encrypted "Company-Measured CFP Value" is obtained as the "Tier N+1 CFP Value".

[0142] If there are multiple products (TierN+1 products) included in the target product (TierN product), the information provision unit 114 obtains the "TierN+1 CFP value" corresponding to each of the multiple included products (TierN+1 products).

[0143] After completing the process in step S102, the information provision unit 114 executes the process in step S103. In step S103, the information provision unit 114 provides information on the target product (Tier N product). Access the dedicated storage area of ​​the company that manufactures the product and include the product information of the target product (TierN product). Encrypted "Company-measured CFP values" and "Usage of upstream products (Usage in TierN)" Obtain it.

[0144] If the target product (Tier N product) has multiple contained products (Tier N+1 products), the information provision unit 114 obtains the "upstream product usage amount (usage amount in Tier N)" corresponding to each of the multiple contained products (Tier N+1 products).

[0145] After completing the process in step S103, the information providing unit 114 executes the process in step S104. In step S104, the information providing unit 114 uses the information obtained in steps S102 to S103 to perform the following calculation using secure computation. "TierN's CFP value" = "TierN's internally measured CFP value" + Σ k ("C of company k (Tier N+1)") FP value × Usage amount in Tier N k )

[0146] After completing the process in step S104, the information provision unit 114 executes the process in step S105. In step S105, the information provision unit 114 stores the calculation result from step S104 (the "TierN CFP value" in its encrypted state) in a shared storage area to which both the company that manufactures the target product (TierN product) and the company that manufactures the downstream product (TierN-1 product) of the target product (TierN product) are granted access rights. After completing the process in step S105, the information provision unit 114 executes the process in step S106.

[0147] In step S106, the information provision unit 114 determines whether the target product (Tier N product) is the final product (Tier 0 product) (Tier N = Tier 0). If the target product (Tier N product) is not the final product (Tier 0 product), the information provision unit 114 executes the process in step S107.

[0148] In step S107, the information provision unit 114 provides information on the target product (Tier N product) to the next downstream manufacturer. The product is shifted. After the information provision unit 114 has finished executing step S107, it executes the processes of steps S102 to S105 for the target product after the shift. Then, the processes of steps S102 to S105 are performed for each product in the product tree from the product one level downstream from the top-level product (a product that includes the top-level product) to the final product (Tier 0 product). If this is executed, a positive determination is made in step S106. If a positive determination is made in step S106, the information providing unit 114 executes the processes in steps S108 to S111.

[0149] First, in step S108, the information provision unit 114 requests decryption of the final integration result (the "Tier0 CFP value" in its encrypted state). The request is sent to Certificate Authority 3. In this case, Certificate Authority 3 receives the decryption result (the "Tier 0 CFP" in its encrypted state) using the private key A held by Certificate Authority 3. The value is decrypted. Furthermore, the Certificate Authority 3 corresponds to the secret key B held by Server Device 1. The decrypted unified result ("Tier0 CFP value") is encrypted using public key B. Then, the integrated result encrypted with public key B (the "Tier0 C" encrypted with public key B) The FP value is sent from the certification authority 3 to the server device 1.

[0150] Decryption result encrypted with public key B ("Tier0 CFP" encrypted with public key B) When the value is sent from the certification authority 3 to the server device 1, the information provision unit 114 of the server device 1 receives the information through the communication module 13 (step S109). After the information provision unit 114 has finished executing the process in step S109, it executes the process in step S110.

[0151] In step S110, the information provision unit 114 uses the secret key B held by the server device 1 to obtain the integrated result encrypted with the public key B (the "Tier0 C" encrypted with the public key B). The FP value is decoded. After the information provision unit 114 has finished executing the process in step S110, it executes the process in step S111.

[0152] In step S111, the information providing unit 114 outputs the integrated result ("Tier0 CFP value") decoded in step S110. In one example, the information providing unit 114 outputs the decoded integrated The result ("Tier 0 CFP value") is sent to the OEM company's enterprise terminal 2. Information Provision Department 114 Once the process in step S111 is completed, the processing flow shown in Figure 17 is finished.

[0153] As described above, in this embodiment, in a system that collects product information from corporate terminals 2 of companies belonging to the supply chain and generates a product tree, traceability-related information included in the product information is encrypted with the public key A of the certification authority 3. This makes it possible to prevent the decryption of the encrypted traceability-related information by anyone other than the certification authority 3, which holds the private key A corresponding to the public key A. As a result, the confidentiality of traceability-related information for products supplied by the supply chain can be ensured.

[0154] Furthermore, in this embodiment, public key A, generated by the certification authority 3 to have full homogeneity, is used as the public key for encrypting the traceability-related information. This allows the server device 1 to integrate the encrypted traceability-related information by performing a secure computation on the encrypted traceability-related information. Moreover, by having the certification authority 3 decrypt the result of the secure computation (the integrated result of the encrypted traceability-related information), only the integrated result of the traceability-related information can be provided to the company (e.g., an OEM company) in plaintext.

[0155] Furthermore, in this embodiment, the integrated result of the traceability-related information decrypted by the certification authority 3 is transmitted from the certification authority 3 to the server device 1 in an encrypted form that can be decrypted by the server device 1. In one example, the integrated result of the traceability-related information is transmitted from the certification authority 3 to the server device 1 in a state encrypted with the public key B corresponding to the private key B held by the server device 1. This also helps to prevent the decrypted integrated result of the traceability-related information from being identified by a third party.

[0156] Therefore, according to this embodiment, traceability-related information can be collected and integrated throughout the entire supply chain while ensuring the confidentiality of traceability-related information for products supplied by the supply chain.

[0157] (Modified examples of the embodiment) In the above embodiment, an example was described in which traceability-related information contained in product information is encrypted with a public key A having complete homogeneity. In contrast, in this modified example, traceability-related information contained in product information is encrypted with a public key having multiplicative homogeneity and a public key having additive homogeneity. An example of encryption using public keys is described below. In the following, a public key with multiplicative homogeneity will be referred to as public key A1, and a public key with additive homogeneity will be referred to as public key A2. These public keys A1 and A2 are generated by the Certificate Authority 3. The private key A1 corresponding to public key A1 and the private key A2 corresponding to public key A2 are held only by the Certificate Authority 3. Accordingly, the storage unit 22 of the enterprise terminal 2 stores public keys A1 and A2 instead of public key A.

[0158] In the above embodiment, as illustrated by Figure 15, both the "company-measured CFP value" and the "amount of upstream product usage" included in the product information were encrypted with public key A, which has complete homogeneity. In contrast, in this modified example, the "company-measured CFP value" included in the product information is encrypted with public key A2, and the "amount of upstream product usage" included in the product information is encrypted with public key A1. That is, in this modified example, the product information generation unit 211 of the enterprise terminal 2 is configured to generate product information by encrypting the "company-measured CFP value" with public key A2 and the "amount of upstream product usage" with public key A1. However, for the enterprise terminal 2 of the upstream enterprise, the product information generation unit 211 is configured to generate product information by encrypting the "company-measured CFP value" with public key A1.

[0159] Furthermore, in this modified example, the information provision unit 114 of the server device 1 is configured to perform the following information processing when integrating traceability-related information.

[0160] First, the information provision unit 114 receives the "TierN+1 CFP value" encrypted with public key A1 and Then, using "Usage in Tier N", the sum of "CFP value in Tier N+1" × "Usage in Tier N" is calculated. The formula is calculated using secure computation. This secure computation is included in the target product (Tier N product). This process is performed for all products (Tier N+1 products). For example, if a target product (Tier N product) has k contained products (Tier N+1 products), the above secret computation will be performed for each of the k contained products (Tier N+1 products).

[0161] Furthermore, the "Tier N+1 CFP value" used in the above secure computation is publicly available with multiplicative homogeneity. The company and the product that manufactures the target product (TierN product) are encrypted with key A1. The data is stored in a shared storage area, which is accessible to both the companies that manufacture the TierN+1 products that comprise the TierN products.

[0162] Next, the information provision unit 114 sends a request to the certification authority 3 to convert the calculation result of the above secure computation (the "TierN+1 CFP value" × "usage amount in TierN" in its encrypted state with public key A1) into a state encrypted with public key A2 (hereinafter sometimes referred to as the "first conversion request"). At that time, if there are k inclusion products (TierN+1 products), the calculation results for k products are included. The first conversion request is sent from server device 1 to certification authority 3.

[0163] Upon receiving the first conversion request, Certificate Authority 3 decrypts the calculation result (the "CFP value at TierN+1" × "usage at TierN" in its encrypted state using public key A1) using the private key A1 corresponding to public key A1. Furthermore, Certificate Authority 3 encrypts the decrypted calculation result ("CFP value at TierN+1" × "usage at TierN") using public key A2. The calculation result encrypted with public key A2 (the "CFP value at TierN+1" × "usage at TierN" encrypted with public key A2) is then sent from Certificate Authority 3 to Server Device 1.

[0164] In the server device 1 that has received the calculation result encrypted with public key A2 ("the CFP value of Tier N+1" × "usage amount in Tier N") encrypted with public key A2, the information providing unit 114 calculates an integration result in a state still encrypted with public key A2 ("CFP value of Tier N" in a state still encrypted with public key A2) by performing computation on the following calculation formula through secure computation . "CFP value of Tier N" = "in-house measured CFP value of Tier N" + Σ k ( "C of company k (Tier N+1) FP value" × "usage amount u in Tier N k ")

[0165] Furthermore, the calculation of Σ k ( "CFP value of company k (Tier N+1)" × "usage amount u in Tier N k ") may be performed by the certificate authority 3. That is, after the certificate authority 3 decrypts k calculation results in a state still encrypted with public key A1 using private key A1, the certificate authority 3 may calculate the sum (Σ k ( "CFP value of company k (Tier N+1)" × "usage amount u in Tier N k ")) of the decrypted k calculation results. Then, the certificate authority 3 may encrypt the above sum (Σ k ( "CFP value of company k (Tier N+1)" × "usage amount u in Tier N k ")) with public key A2 and transmit the encrypted sum to the server device 1.

[0166] When the integration result ("CFP value of Tier N") in a state still encrypted with public key A2 is calculated through the above secure computation, the information providing unit 114 transmits a request for converting the integration result into a state encrypted with public key A1 (hereinafter may be referred to as "second conversion request") to the certificate authority 3.

[0167] In the certificate authority 3 that has received the second conversion request, the integration result ("CFP value of Tier N") in a state still encrypted with public key A2 is decrypted with private key A2. Further, in the certificate authority 3, the dec The resulting integration result ("TierN CFP value") is encrypted using public key A1. The encrypted integration result ("TierN CFP value") is sent from Certificate Authority 3 to Server Device 1. It will be sent.

[0168] Server device that received the unified result ("TierN CFP value") encrypted with public key A1. In step 1, the information provision unit 114 receives the integrated result encrypted with public key A1 ("TierN's CFP"). The value is stored in a shared storage area that is accessible to both the company that manufactures the target product (TierN product) and the company that manufactures the downstream product (TierN-1 product) of the target product (TierN product). To make someone do it.

[0169] Information provision unit 114 provides information on products ranging from the product one step downstream from the upstream product to the final product (Tier 0 The above process is repeated sequentially until the final integrated result (the "Tier 0 CFP" remains encrypted with public key A2) is obtained. The value (total amount of CO2 emitted from manufacturing activities from the upstream product to the final product) can be obtained.

[0170] [Processing flow] Figure 18 is a flowchart showing the processing flow executed by the server device 1 when integrating traceability-related information in this modified example. In the processing flow shown in Figure 18, the same reference numerals are used for processes that are the same as those shown in the processing flow shown in Figure 17.

[0171] In the processing flow shown in Figure 18, steps S201 to S205 are executed instead of steps S102 to S103 of the processing flow shown in Figure 17, and steps S206 to S208 are executed instead of step S105 of the processing flow shown in Figure 17.

[0172] First, in step S201, the information provision unit 114 manufactures the target product (Tier N product) The system accesses a shared storage area to which both the target company and the company that manufactures the included product (TierN+1 product) of the target product (TierN product) have been granted access rights, and retrieves the "TierN+1 CFP value" encrypted with public key A1. However, if the included product (TierN+1 product) is the upstream product, the information provision unit 114 does not access the above shared storage area or the manufacturing of the included product (TierN+1 product). Access to product information of included products (Tier N+1 products) stored in the dedicated memory area of ​​the manufacturing company. The "Company-Measured CFP Value," encrypted using public key A1, is then used for "Tier N+1 CFP" The P-value is obtained. When the information provision unit 114 finishes executing the process in step S201, Then, the process in step S202 is executed.

[0173] In step S202, the information provision unit 114 provides information to the company that manufactures the target product (Tier N product). Access and publish the product information of the target product (TierN product) stored in its dedicated storage area. The "Company-measured CFP value" encrypted with key A2 and the "Usage of upstream products (Usage at Tier N)" encrypted with public key A1 are obtained. Information provision unit 114: After completing the process in step S202, the process in step S203 is executed.

[0174] In step S203, the information provision unit 114 uses the "CFP value for TierN+1" and the "usage amount in TierN," which are encrypted with the public key A1, to perform the following calculation using secure computation. "CFP value in Tier N+1" × "Amount used in Tier N"

[0175] The process in step S203 is performed for all products (Tier N+1 products) included in the target product (Tier N product). That is, if the target product (Tier N product) has k included products (Tier N+1 products), then step S20 is performed for each of the k included products (Tier N+1 products). The process in step 3 is executed. After the information provision unit 114 has finished executing the process in step S203, it executes the process in step S204.

[0176] In step S204, the information provision unit 114 sends a request to the certification authority 3 to convert the calculation result from step S203 into a state encrypted with public key A2 (first conversion request). Upon receiving the first conversion request, the certification authority 3 decrypts the calculation result ("CFP value for TierN+1" × "usage amount in TierN"), which remains encrypted with public key A1, using the private key A1 corresponding to public key A1. Furthermore, the certification authority 3 converts the decrypted calculation result ("CFP value for TierN+1") The value (x) (usage in TierN) is encrypted using public key A2. The encrypted calculation result ("CFP value for TierN+1" × "Usage in TierN") is sent from Certificate Authority 3 to Server Device 1.

[0177] When the calculation result ("CFP value for TierN+1" × "usage amount in TierN") encrypted with public key A2 is sent from the certification authority 3 to the server device 1, the information provision unit 114 of the server device 1 receives the information via the communication module 13 (step S204). After completing the process in step S204, the information provision unit 114 executes the process in step S104.

[0178] In step S104, the information provision unit 114 is encrypted with public key A2 in the TierN Using the "Company-Measured CFP Value" and the above calculation result ("Tier N+1 CFP Value" × "Usage in Tier N"), the following formula is calculated using secure computation, and the integrated result (the "Tier N CFP Value" in its encrypted state with public key A2) is obtained. Calculate the "FP value". "TierN's CFP value" = "TierN's internally measured CFP value" + Σ k ("C of company k (Tier N+1)") FP value × Usage amount in Tier N k ) After completing the process in step S104, the information provision unit 114 executes the process in step S206.

[0179] In step S206, the information provision unit 114 publicly provides the integrated result (the "TierN CFP value" in its encrypted state using public key A2). A request to convert the data back to its encrypted state using the open key A1 (second conversion request) is sent to Certificate Authority 3. Upon receiving the second conversion request, Certificate Authority 3 receives the result of the integration (the "TierN CFP value" in its encrypted state using public key A2) and the private key A It is decrypted by 2. Furthermore, Certificate Authority 3 receives the decrypted integrated result ("TierN CFP value"). The result of the unified process (public key) is encrypted using public key A1. The "TierN CFP value" encrypted by A1 is sent from Certificate Authority 3 to Server Device 1. It can be done.

[0180] The unified result ("TierN's CFP value") encrypted with public key A1 is sent from Certificate Authority 3 to the server When the information is transmitted to device 1, the information provision unit 114 of server device 1 receives the information through the communication module 13 (step S207). After completing the process in step S207, the information provision unit 114 executes the process in step S208.

[0181] In step S208, the information provision unit 114 stores the integration result (the "TierN CFP value" encrypted with public key A1) encrypted with public key A1 in a shared storage area to which both the company that manufactures the target product (TierN product) and the company that manufactures the downstream product (TierN-1 product) of the target product (TierN product) are granted access rights. After completing the process in step S208, the information provision unit 114 executes the processes in steps S106 to S111.

[0182] According to this modified version, traceability-related information can be integrated while remaining encrypted using secure multiplication homomorphisms and secure addition homomorphisms. This reduces the computational load of the secure computation.

[0183] <Other Embodiments> The embodiments described above are merely examples, and this disclosure may be modified as appropriate without departing from its essence. For example, the configurations and processes described in this disclosure can be freely combined and implemented as long as no technical inconsistencies arise.

[0184] Furthermore, in the description of the embodiment, the server device 1 stores product information in a database, but product information may be stored by means other than a database.

[0185] Furthermore, while the description of the embodiment illustrates a configuration in which the server device 1 completes the product tree by executing the first to fourth phases, the role of the server device 1 may be distributed among multiple corporate terminals 2. For example, product information may be stored in a distributed database using a blockchain platform. In this case, the product information database may be composed of multiple corporate terminals 2. In this case, smart contracts may be used to execute the processing of each of the aforementioned phases. For example, the processing in the second phase may be triggered when an account of a certain company writes permission information to the database. Alternatively, the processing in the third phase may be triggered when an account of a certain company writes a linking request to the database.

[0186] Furthermore, while the description of the embodiment illustrates a configuration in which the server device 1 performs information processing for the integration of traceability-related information, the company that manufactures the final product (Tier 0 product) (OEM company) Enterprise terminal 2 may perform the information processing for the integration of traceability-related information. Alternatively, the information processing for the integration of traceability-related information may be performed by multiple enterprise terminals 2 in a relay system, where it is passed from an upstream enterprise terminal 2 in the product tree to a downstream enterprise terminal 2. Then, enterprise terminal 2 of the OEM company that manufactures the final product (Tier 0 product) may perform the encryption You may also request Certificate Authority 3 to decrypt the final integrated result in its original, unprocessed state.

[0187] Furthermore, while the description of the embodiment illustrates a configuration in which each product's information is stored in the storage unit of the server device 1, it may also be stored in a distributed manner across multiple corporate terminals 2. In that case, the dedicated storage area may be located only within the corporate terminal 2 of the corresponding company. Also, the shared storage area may be distributed across multiple corporate terminals 2 involved in the sharing. In another example, metadata of the product information (for example, information to identify the product) is held by the server device 1, and each company's product The information may be stored on each company's corporate terminal 2.

[0188] Furthermore, while the description of the embodiment included an example of granting access to arbitrary product information to adjacent companies in the supply chain, companies that are not adjacent in the supply chain may also share product information. For example, if information sharing between companies is necessary for purposes such as legal compliance, companies that do not have a direct business relationship may share specific product information. Even in this case, as in the first embodiment, a shared storage area with access rights granted to each company is provided, and the necessary data is copied there. This shared storage area can be generated based on the permission of the company whose product information is being referenced. Private keys may be used for access control of the dedicated storage area and the shared storage area. In this case, electronic authentication of access control may be performed using a public key authentication infrastructure. If a blockchain infrastructure is used for each storage area, this access control may be executed by smart contracts.

[0189] Furthermore, in the description of the embodiment, the second phase was initiated by sending permission information from the upstream company's terminal 2 to the server device 1, but the second phase may also be initiated from the downstream company's terminal 2. In this case, information requesting the granting of access rights to the upstream product (permission request) may be sent from the downstream company's terminal 2 to the server device 1, and the upstream company's terminal 2 may generate permission information in response. Moreover, the downstream company's terminal 2 may send the permission request and the linking data to the server device 1 simultaneously. If the product to be linked can be identified by the downstream company (by part number, etc.), the downstream company may also send the linking data prior to granting access rights.

[0190] Furthermore, the setting of access rights to the storage area may be implemented by the operating system of server device 1, or by other authentication methods. For example, public-key cryptography can be used. Also, when implementing the system using a blockchain platform, access rights may be granted using electronic keys.

[0191] Furthermore, although the description of the embodiment separates the phase in which the server device 1 receives product information about upstream products and the phase in which the server device 1 receives authorization information corresponding to said product information, both may be received simultaneously. Similarly, although the description of the embodiment separates the phase in which the server device 1 receives product information about downstream products and the phase in which the server device 1 receives a linking request corresponding to said product information, both may be received simultaneously.

[0192] Furthermore, in the above embodiment, the multiple companies included in the supply chain were described as companies that manufacture products. However, the companies included in the supply chain do not necessarily have to be companies that manufacture products. For example, companies that transport, import, store, or wholesale products may also be included in the companies that make up the supply chain. For example, some of the multiple companies may be companies that do not perform the manufacturing process, such as trading companies, sales agents, or import agents, and may receive products from companies located one level up (upstream companies) and deliver products to companies located one level down (downstream companies).

[0193] Furthermore, in the above embodiment, a supply chain for products related to automobiles was assumed, and OEM manufacturers were described as the lowest-level companies, while companies supplying parts, materials, assemblies, etc., were described as suppliers. However, the companies belonging to the supply chain are not necessarily limited to these. The companies at each stage may be determined as appropriate depending on the product, etc. Also, the manufacturing activities carried out by each company until the final product is obtained may be determined as appropriate depending on the embodiment, and may include, for example, all activities that can be carried out until the final product is obtained, such as excavation, processing, assembly, transportation, and storage. The products are not limited to those related to automobiles, etc. The appropriate form may be selected depending on the circumstances. For example, the product may be a battery used for purposes other than automobiles.

[0194] Furthermore, in the above embodiment, access control for each company is achieved by providing dedicated storage areas and shared storage areas. However, the method of achieving access control is not limited to this example. Any method may be used for access control. In another example, the shared storage area provided between companies sharing information in the above embodiment may be omitted. In this case, the company requesting the information (Company 1) may issue a key (without permission to view) indicating write rights to its dedicated storage area to the requesting company (Company 2). Company 2 may use the key issued to Company 1 to write the target data to Company 1's dedicated storage area. With this configuration, information sharing becomes possible without providing a shared storage area (although it may be provided if necessary), thus simplifying the management of storage areas.

[0195] Furthermore, in the description of the embodiment, an example was given in which the upstream company grants the downstream company access rights to product information (second phase), followed by the downstream company requesting the server device 1 to link the product information together (third phase). However, these processes may be executed sequentially based on requests from the downstream company.

[0196] Furthermore, in the description of the embodiments, it was assumed that upstream companies and downstream companies are different companies, that is, that upstream products and downstream products are manufactured by different companies. However, in the above embodiments, the upstream company can be in the position of an upstream company, and the downstream company can be in the position of a downstream company. Companies other than the upstream and downstream companies can be in the position of both upstream and downstream companies. Therefore, in the second phase described above, each company's enterprise terminal 2 may send an authorization command to the server device 1, designating itself as an upstream company, which includes specifying its downstream companies that are permitted to access product information relating to its own products. Its own products are an example of the target company's first target products, and the product information relating to its own products is an example of first product information relating to the first target products. Accordingly, the server device 1 may perform the above access permission setting. Furthermore, in the third phase described above, each company's enterprise terminal 2 may send an authorization request or termination flag setting request to the server device 1, designating itself as a downstream company, which includes selecting product information to link to product information relating to its own products from among the product information that it has been permitted to access from its upstream company. In this scenario, the user's own product is an example of the target company's second target product, and the product information relating to the user's own product is an example of the second product information relating to the second target product. Accordingly, server device 1 may perform linking or termination flag processing. Note that the first target product (the target of access permission) and the second target product (the target of linking or termination flag assignment) may be the same or different. If the first and second target products are the same, the first product information and the second product information may be the same; if the first and second target products are different, the first product information and the second product information may be different.

[0197] Furthermore, in the above embodiment, the server device 1 may perform calculations of the recycling rate and due diligence (score) together with or instead of calculating the CO2 emissions (CFP value). The recycling rate may be calculated by performing the following calculation using secure computation. "(Recycling rate for Tier N-1 products for the target substance) = {(Total amount used in Tier N-1) × (Recycling rate in Tier N-1) + Σ k(Total usage at company k (Tier N) × Recycling rate at company k (Tier N) × Usage at Tier N-1 u) k )}÷{Total usage in Tier N-1 + Σ k ( Total usage at company k (Tier N) × Usage at Tier N-1 u k )} = {Amount of recycled materials used in Tier N-1} +Σ k (Amount of recycled material used at company k (Tier N) × Amount used at Tier N-1 u k )}÷{Total in Tier N-1 Total usage +Σ k (Total usage at company k (Tier N) × Usage at Tier N-1 u k )}" The recycled material utilization rate indicates the amount of recycled material used for the target substance. Similar to the CFP value, it is calculated sequentially from the upstream company (end company) to determine the amount of recycled material used in the final product for the target substance. The recycling rate can be calculated. Furthermore, the due diligence score (DD score) can be integrated by calculating it using secure computation, similar to the CFP value and recycling rate described above. For example, by replacing the CFP value with the DD score and calculating it sequentially from the upstream company (end company), the DD score (integrated result) for the final product can be obtained.

[0198] Furthermore, in the above embodiment, it was assumed that each company places an order with one company for a certain material. However, in the above embodiment, the ordering format of each company is not limited to this example. At least some of the companies belonging to the supply chain may place orders with multiple upstream companies for the same product and selectively use the obtained upstream products in their own products. For example, in the example in Figure 2 above, Tier 1 product A1 may selectively use Tier 2 products A11_1, A11_2, or A11_3. In this case, the server device 1 will determine the pattern to be used. A linking relationship may be maintained for each unit. In the example above, server device 1 is linked to product A1 of Tier 1. Therefore, Pattern 1 is "Tier 2 product A11_1, ...", and Pattern 2 is "product A11_2, ...". And linking information may be stored as in Pattern 3 "Product A11_3, ...". The server device 1 may perform the above-mentioned calculation (integration) of traceability-related information for each pattern. In this case, in one example, the server device 1 may output the calculation results for each pattern. In another example, the server device 1 may calculate statistical quantities such as the maximum value, minimum value, mean, variance, standard deviation, and median from the calculation results and output the calculated statistical quantities.

[0199] Furthermore, in the above embodiment, the traceability-related information (in particular, CFP values) may consist of primary data or secondary data (inventory data). Primary data are measured values, and secondary data are reference values ​​used when measured values ​​are not available. In this case, the calculation (integration) of the traceability-related information may include calculating the primary data ratio of the traceability-related information obtained for the final product. The primary data ratio may be calculated by a simple ratio calculation, or it may be calculated by a weighting calculation in which the CFP value in the calculation formula for the CFP value is replaced with the primary data ratio of each company and calculated sequentially from the upstream company.

[0200] Furthermore, a process described as being performed by a single device may be divided and executed by multiple devices. Conversely, a process described as being performed by different devices may be executed by a single device. In a computer system, the hardware configuration (server configuration) by which each function is implemented can be flexibly changed.

[0201] The present disclosure can also be realized by supplying a computer program implementing the functions described in the embodiments above to a computer, and having one or more processors in the computer read and execute the program. Such a computer program may be provided to the computer by a non-temporary computer-readable storage medium that can be connected to the computer's system bus, or it may be provided to the computer via a network. Non-temporary computer-readable storage mediums include, for example, any type of disk such as magnetic disks (floppy disks, hard disk drives (HDDs), etc.), optical disks (CD-ROMs, DVDs, Blu-ray discs, etc.), read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards, flash memory, optical cards, and any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0202] 1 Server device 11 Control Unit 111 Information Gathering Department 112 Permissions Setting Section 113 String attachment part 114 Information Provision Department 12 Storage section 13. Communication Module 14 Input / Output Devices 2. Enterprise terminals 21 Control Unit 22 Memory section 23 Communication Module 24 Input / Output Devices 3. Certificate Authority

Claims

1. To obtain linking information that shows the relationships between products of each company included in the supply chain, Based on the aforementioned linking information, product information is obtained for each of the one or more included products contained within the target product, including traceability-related information, which is necessary to ensure the traceability of the included products, encrypted with the public key of the certification authority. The encrypted traceability-related information is integrated using secure computation, and the result of the integration is obtained. A request to decrypt the aforementioned integration result, wherein the request including the aforementioned integration result is transmitted to the certification authority. Receiving the decrypted integration result from the certification authority, A control unit configured to perform the following: Information processing device.

2. The decrypted integration result is transmitted from the certification authority in an encrypted form that can be decrypted by the control unit. The information processing apparatus according to claim 1.

3. The aforementioned traceability-related information includes greenhouse gas emissions, The decoded integrated result includes the total greenhouse gas emissions associated with the manufacturing activities leading up to the production of the product in question, The information processing apparatus according to claim 1.

4. The aforementioned traceability-related information includes the recycling rate for a given raw material. The decoded integrated result includes the overall recycling rate of the predetermined raw materials in the target product, The information processing apparatus according to claim 1.

5. The aforementioned traceability-related information includes due diligence scores, The decoded integrated results include an overall due diligence score for the product in question, The information processing apparatus according to claim 1.

6. The aforementioned product is a battery, The aforementioned included product is a product used in the manufacture of the battery. The information processing apparatus according to claim 1.

7. Computers To obtain linking information that shows the relationships between products of each company included in the supply chain, Based on the aforementioned linking information, product information is obtained for each of the one or more included products contained within the target product, including traceability-related information, which is necessary to ensure the traceability of the included products, encrypted with the public key of the certification authority. The encrypted traceability-related information is integrated using secure computation, and the result of the integration is obtained. A request to decrypt the aforementioned integration result, wherein the request including the aforementioned integration result is transmitted to the certification authority. Receiving the decrypted integration result from the certification authority, An information processing method that performs the following.

8. The decrypted integration result is transmitted from the certification authority in an encrypted form that can be decrypted by the computer. The information processing method according to claim 7.

9. The aforementioned traceability-related information includes greenhouse gas emissions, The decoded integrated result includes the total greenhouse gas emissions associated with the manufacturing activities leading up to the production of the product in question, The information processing method according to claim 7.

10. The aforementioned traceability-related information includes the recycling rate for a given raw material. The decoded integrated result includes the overall recycling rate of the predetermined raw materials in the target product, The information processing method according to claim 7.

11. The aforementioned traceability-related information includes due diligence scores, The decoded integrated results include an overall due diligence score for the product in question, The information processing method according to claim 7.

12. The aforementioned product is a battery, The aforementioned inclusion product is used in the manufacture of the battery. The information processing method according to claim 7.

13. On the computer, To obtain linking information that shows the relationships between products of each company included in the supply chain, Based on the aforementioned linking information, the product information of each of the one or more included products included in the target product This involves obtaining product information that includes traceability-related information, which is necessary to ensure the traceability of the aforementioned included products, encrypted with the public key of a certification authority, and The encrypted traceability-related information is integrated using secure computation, and the result of the integration is obtained. A request to decrypt the aforementioned integration result, wherein the request including the aforementioned integration result is transmitted to the certification authority. Receiving the decrypted integration result from the certification authority, A program to execute.

14. The decrypted integration result is transmitted from the certification authority in an encrypted form that can be decrypted by the computer. The program according to claim 13.

15. The aforementioned traceability-related information includes greenhouse gas emissions, The decoded integrated result includes the total greenhouse gas emissions associated with the manufacturing activities leading up to the production of the product in question, The program according to claim 13.

16. The aforementioned traceability-related information includes the recycling rate for a given raw material. The decoded integrated result includes the overall recycling rate of the predetermined raw materials in the target product, The program according to claim 13.

17. The aforementioned traceability-related information includes due diligence scores, The decoded integrated results include an overall due diligence score for the product in question, The program according to claim 13.

18. The aforementioned product is a battery, The aforementioned inclusion product is used in the manufacture of the battery. The program according to claim 13.

Images