JP7833630B2 - Authentication and certification system - Google Patents

Description

This invention relates to an authentication and certification system for products requiring authentication and certification, such as bags, handbags, clothing, watches, works of art and crafts, automobiles, communication equipment, and digital products (hereinafter also referred to as "products requiring authentication").

Authentication-required products such as bags, purses, clothing, watches, arts and crafts, automobiles, communication equipment, and digital products typically follow a complex distribution route, being manufactured by the manufacturer, creator, or copyright holder, and then sold to consumers through distributors such as logistics companies, wholesalers, and retailers. During the manufacturing and distribution process, consumers are required to provide proof of authenticity—that is, proof that the item is genuine and not a counterfeit, or proof of ownership and quality. Furthermore, in recent years, authentication-required products are frequently sold to consumers via the internet, and similarly, used authentication-required products (including secondary, tertiary, and other secondary markets) are also sold to consumers online. Additionally, transactions between consumers are becoming more common, increasing the need for more comprehensive authentication and certification of these authentication-required products.

Products requiring authentication are typically issued with a certificate (hereinafter also referred to as a "guarantee card") to prove and guarantee their authenticity. The guarantee card contains information about the product, such as the product name, model number, manufacturer/author, place of manufacture, and date of manufacture (hereinafter also referred to as "product information"). Patent Document 1 discloses a technique for authenticating products requiring authentication using this guarantee card.

Patent Document 1 discloses a product to which a small recording medium containing information including a secret key and product information is attached or incorporated, and a technology for performing authentication using a guarantee card to which a small recording medium containing information including a secret key and product information is attached or incorporated.

Patent No. 6894033

Meanwhile, the Trusted Web Promotion Council, in its "Trusted Web White Paper Ver2.0," describes four functions, for example, to realize the Trusted Web, which aims to create new value by diverse stakeholders by overlaying the Trust mechanism onto the existing internet and web.

The Identifier management function allows each entity to issue identifiers independently of a specific service, and to link them to various attributes (data). This makes it possible to reduce privacy and identification risks by issuing numerous identifiers on a case-by-case basis.

The Trustable Communication function allows each entity to manage a combination of identifiers and their associated attributes (data), enabling mutual verification of each other's attributes (data) without having to directly contact the attribute (data) issuer each time. This allows for the management of attributes (data) linked to identifiers, and the selection of disclosure scope and usage period. Furthermore, attributes such as attributes from trust anchors, third-party review results, and positive/negative lists are written to the sender and attribute (data) issuer, allowing the recipient to refer to this information and confirm the degree of trust in the attributes (data) sent by the sender.

The Dynamic Consent function allows for detailed condition setting regarding the handling of attributes (data) exchanged during the agreement process. This means that an agreement is reached when both parties agree on the conditions.

The Trace function allows for confirmation of agreement (confirmation of intent at each stage of the process). Based on the choices made during the agreement process, it is possible to select and record sufficient information necessary for verification of whether the agreed-upon conditions have been fulfilled after the agreement was reached (tracing), enabling verification. Furthermore, if the conditions have not been fulfilled, the agreement can be revoked as necessary. In addition, regarding attributes (data), even when they are "transferred" to a third party, the original conditions (excluding those already fulfilled) can be traced, enabling verification and a mechanism for controlling agreement revocation, etc., based on the conditions set.

However, the technology disclosed in Patent Document 1 lacked sufficient mention of technologies for realizing the Trusted Web in the supply chain field. For example, in the technology disclosed in Patent Document 1, the possessor holds a guarantee card to prove the authenticity of the product requiring authentication. Therefore, other businesses that do not possess a guarantee card cannot prove the authenticity of the product or disclose information to third parties. Consequently, the technology in Patent Document 1 has the problem of not being able to realize functions such as the Trustable Communication function and Trace function mentioned above.

Therefore, the present invention was devised in view of the above-mentioned problems, and its objective is to provide an appraisal and certification system that realizes the Trusted Web described above and is capable of proving authenticity.

The authentication and certification system according to the first invention further comprises: a dedicated platform that records possessor information relating to the possessory rights of a product requiring authentication , including a communication device or digital product equipped with software , in a database, distributed storage, or blockchain, and outputs a hash value generated thereon; a first acquisition means for acquiring first identification information for identifying the product requiring authentication; and a recording means for recording elements of authentication and certification based on the hash value output by the dedicated platform and the first identification information acquired by the first acquisition means in a database, distributed storage, or blockchain, wherein the first acquisition means acquires first product information including an SBM (Software-Bill Of Materials) indicating the software configuration of the product requiring authentication and the software update history; the recording means records the first identification information and the first product information linked together; a second acquisition means for acquiring second product information including an SBM indicating the software configuration of the product requiring authentication and the software update history; and an authentication and certification means that performs authenticity certification of the product requiring authentication based on the first product information linked to the first identification information recorded by the recording means and the second product information acquired by the second acquisition means .

The appraisal and certification system according to the second invention is characterized in that, in the first invention, it further comprises a possessor certification means that acquires appraisal and certification information relating to an appraisal and certification person who appraises the product requiring appraisal, and certifies the possessor of the product requiring appraisal based on the acquired appraisal and certification information and possessor information.

The appraisal and certification system according to the third invention is characterized in that, in the first invention, the recording means further comprises: a second acquisition means for linking the first identification information and the possessor information, acquiring appraisal and certification information relating to the appraisal and certification person who appraises the product to be appraised, and a second identification information for identifying the newly acquired product to be appraised; a third acquisition means for acquiring the possessor information linked by the recording means to the second identification information acquired by the second acquisition means; and a possessor certification means for certifying the possessor of the product to be appraised based on the possessor information acquired by the third acquisition means and the appraisal and certification information acquired by the second acquisition means.

The appraisal and certification system according to the fourth invention is characterized in that, in the first invention, the recording means records on the blockchain the elements of the appraisal and certification that are linked to one or more of the following: origin information relating to the origin of the product or parts of the product to be appraised; quality information relating to the quality of the product or parts of the product to be appraised; supply chain information relating to the transaction of the product or parts of the product to be appraised; determination information for determining threats to the security of the product to be appraised; and evaluation information indicating the evaluation of the elements of the appraisal and certification.

The appraisal and certification system according to the fifth invention is characterized in that, in the first invention, the dedicated platform acquires second possessor information concerning the new possessor of the product requiring appraisal, and records the acquired second possessor information in a database, distributed storage, or blockchain.

The appraisal and certification system according to the sixth invention is characterized in that, in the first invention, the dedicated platform records the possessor information on a blockchain, and the recording means records the elements of the appraisal and certification on a blockchain.

The authentication and certification system according to the seventh invention is characterized in that, in the first invention, the recording means records the elements of the authentication and certification linked to security information of the product to be authenticated or the parts of the product to be authenticated on a blockchain . The authentication and certification system according to the eighth invention is characterized in that, in the first invention, the authentication and certification means determines whether the type and version of each software included in the second product information matches the update history of the first product information, and performs authentication of the authenticity of the product to be authenticated. The authentication and certification system according to the ninth invention is characterized in that, in the first invention, the authentication and certification means matches the second product information with a vulnerability database linked to software and security vulnerabilities, and determines judgment information indicating the presence or absence of the security threat. The authentication and certification system according to the tenth invention is characterized in that, in the ninth invention, the recording means records the elements of the authentication and certification linked to the judgment information in a database, distributed storage, or blockchain. The authentication certification system according to the 11th invention is characterized in that, in the 9th invention, the vulnerability database includes at least one of CVE, NVD, or JVN, and the determination information indicates a security vulnerability. The authentication certification system according to the 12th invention is characterized in that, in the 9th invention, the elements of the authentication certification are an authentication certification NFT based on the hash value, the first identification information, the first product information, and the determination information.

According to the first invention, the authentication and certification system records elements of authentication and certification, such as authentication and certification NFTs, based on hash information and first identification information. This makes it possible to digitize a guarantee card indicating the possession of a product requiring authentication, for example, as a logical guarantee NFT. Therefore, since logical guarantee NFTs can be issued by any entity without relying on a specific service or company, an Identifier management function can be realized, and authenticity can be proven even on the Trusted Web.

According to the second invention, the possessor of the product requiring appraisal is certified based on the appraisal certifier information and the possessor information. This makes it possible to certify the possessor without directly contacting the issuer of the attributes or data each time, thus enabling the realization of a Trustable Communication function.

According to the third invention, the possessor of the product requiring appraisal is certified based on the possessor information and appraisal certifier information obtained by the third acquisition means. This makes it possible to select possessor information suitable for the second identification information, thus enabling certification of possessor at a lower cost and in a shorter time.

According to the fourth invention, elements of an appraisal certificate linked to one or more of the following—origin information, quality information, supply chain information, judgment information, and evaluation information—are recorded on the blockchain. This makes it possible to manage information such as origin, quality, the history of products requiring appraisal, and the presence or absence of security threats.

According to the fifth invention, the acquired second possessor information is recorded on the blockchain. This allows for verification even when the possessor of a product requiring appraisal changes, by tracing the initial conditions. This enables control, such as the cancellation of agreements, based on the conditions, thus realizing a more accurate trace function.

According to the sixth invention, possessor information is recorded on the blockchain, and the elements of the appraisal certificate are also recorded on the blockchain. This allows for decentralized management of possessor information and appraisal certificate elements, enabling appraisal certificates compatible with Web 3.0.

Furthermore, according to the first invention, the authenticity of the product requiring authentication is verified based on the first product information and the second product information. This makes it possible to verify the authenticity of, for example, information on the type and version of the hardware and software of the product requiring authentication, or information on the security of the software.

Figure 1 is a schematic diagram showing the system configuration of an appraisal and certification system to which the present invention is applied. Figure 2 is a schematic diagram showing the configuration of the terminal. Figure 3 is a flowchart illustrating how the authentication system records the authentication NFT on the blockchain. Figure 4 is a schematic diagram illustrating how the authentication system records authentication NFTs on the blockchain. Figure 5 is a flowchart showing the operation of the authentication and certification system in which it proves authenticity. Figure 6 is a schematic diagram illustrating the operation of the authentication and certification system in which it proves authenticity.

The following describes in detail the appraisal and certification system to which the present invention is applied, with reference to the drawings.

Figure 1 shows the system configuration of the appraisal and certification system 1 to which the present invention is applied. The appraisal and certification system 1 consists of terminals 6 for operation by manufacturers (vendors), producers, authors, etc., of the product requiring appraisal 12, as well as logistics companies, wholesalers, retailers, system integrators (SIers) that develop and operate the product requiring appraisal 12, and public interest corporations (hereinafter collectively referred to as "various businesses, etc."), terminals 7 for operation by consumers who operate the product requiring appraisal 12, an API (Application Programming Interface) server 2, an RDB (Relational Database) server 3, and a distributed file server 5, all connected via a public communication network 4, including the Internet. This public communication network 4 constitutes a dedicated platform 10.

Terminal 6 is comprised of electronic devices such as personal computers (PCs), but may also be represented by any other electronic devices, including mobile phones, smartphones, tablet devices, and wearable devices. Terminal 6 is an electronic device operated by various businesses and other entities to perform various tasks for managing the products requiring appraisal 12.

Similarly, Terminal 7 is composed of electronic devices such as PCs, but it may also be embodied in any other electronic device, such as mobile phones, smartphones, tablet devices, or wearable devices. Terminal 7 is an electronic device operated by a consumer, who is a business operator managing the product requiring authentication 12, to attempt to authenticate the product requiring authentication 12.

The distributed file server 5 is a distributed file system intended to connect terminals 6 and 7 to the same file system. It is composed of, but is not limited to, a so-called IPFS (Interplanetary File System). Various businesses accessing the public communication network 4 via terminals 6 and 7 provide data to the distributed file server 5, and consumers can request this data in a P2P (Peer to Peer) format. The distributed file server 5 is a storage location for all digital content requiring authentication certification, such as digital images, digital audio, digital music, and digital video of the product requiring authentication 12. Simultaneously with this storage, a multi-digit string called an identifier is generated, as described later. Furthermore, the distributed file server 5 is not limited to a distributed file system; it may be any recording medium, such as a database.

The dedicated platform 10 references blockchains 10a and 10b. Blockchains 10a and 10b can utilize blockchains with P2P networks, such as distributed ledgers. On blockchain 10a, possessor information regarding the possession rights of the product requiring authentication 12, or logical guarantee NFTs (Non-fungible tokens) linked to the possessor information, are recorded. On blockchain 10b, authentication certificate NFTs, etc., for proving the authenticity of the product requiring authentication 12, are recorded. Blockchains 10a and 10b may be the same or different.

The API server 2 is a file system for connecting the various components, such as the dedicated platform 10, terminal 6, and terminal 7. The API server 2 may, for example, perform relay processing for communication between terminal 7 and the dedicated platform 10.

RDB Server 3 is a database for recording various pieces of information. RDB Server 3 may be, for example, a relational database.

The product requiring authentication 12 is a product that will be authenticated using the authentication certification system 1. The product requiring authentication 12 can be broadly classified into analog goods and digital goods. For example, analog goods include all products requiring authentication certification, such as bags, purses, clothing, watches, works of art and crafts, automobiles, and communication equipment. Digital goods include all digital content requiring authentication certification, such as digital images, digital audio, digital music, and digital video. The product requiring authentication 12 includes not only new products but also used products (secondary, tertiary, and other nth-tier markets). The product requiring authentication 12 may be equipped with a memory (not shown) on which product information related to the product 12 is recorded. Furthermore, the product requiring authentication 12 may be provided with a small recording medium 11 on which identification information is recorded. Furthermore, the product requiring authentication 12 may be equipped with an antenna (not shown) for reading the information recorded on the small recording medium 11.

The small recording medium 11 is a recording medium from which information can be read using contactless automatic recognition that reads information via radio waves. The small recording medium 11 is, for example, a recording medium such as an RFID (Radio Frequency Identification) tag that records a unique ID. RFID is a contactless automatic recognition technology that reads information via radio waves from a small recording medium in the form of a tag or card, which incorporates an IC and a small antenna. For RFID, international standard communication protocols such as NFC (Near Field Communication) may be used.

Figure 2 is a schematic diagram showing the configuration of terminal 7. Terminal 7, as shown in Figure 2, comprises a housing 111, a CPU (Central Processing Unit) 101, a ROM (Read Only Memory) 102, a RAM (Random Access Memory) 103, a storage unit 104, and I/Fs 105-107. The CPU 101, ROM 102, RAM 103, storage unit 104, and I/Fs 105-107 are connected by an internal bus 110.

The CPU 101 controls the entire terminal 7. The ROM 102 stores the operation code for the CPU 101. The RAM 103 is a working area used when the CPU 101 is operating. The storage unit 104 stores various types of information. The storage unit 104 can be a data storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or SD card. Note that the terminal 7 may also have a GPU (Graphics Processing Unit), which is not shown in the diagram.

I/F 105 is an interface for sending and receiving various types of information via the public communication network 4. I/F 106 is an interface for sending and receiving information with the input unit 108. For example, a keyboard is used as the input unit 108, and consumers using the terminal 7 input various types of information or control commands for the terminal 7 via the input unit 108. I/F 107 is an interface for sending and receiving various types of information with the display unit 109. The display unit 109 outputs various types of information stored in the storage unit 104, or the processing status of the appraisal certification system 1, etc. A display is used as the display unit 109, and for example, a touch panel type may be used.

Furthermore, the API server 2, the distributed file server 5, the terminal 6, and the product requiring authentication 12 may have a configuration similar to that of terminal 7, or a configuration that includes a part of that of terminal 7.

The operation of the Authentication Certification System 1 will be explained below using diagrams. Figure 3 is a flowchart showing how the Authentication Certification System 1 records elements of authentication certification, such as authentication certification NFTs, on the blockchain. Figure 4 is a schematic diagram showing how the Authentication Certification System 1 records authentication certification NFTs on the blockchain.

First, in step S1, the vendor or other business operator transmits serial number information regarding the manufacturing number of the product requiring authentication 12 to the terminal 6 operated by the public interest corporation. The manufacturing number is a unique string of characters assigned to each product requiring authentication 12.

Next, in step S2, the public interest corporation generates a logical guarantee NFT (Non-fungible token) linked to possessor information regarding the possession rights of the product requiring appraisal 12 via terminal 6, records the generated logical guarantee NFT on blockchain 10a, and outputs the generated hash information. Alternatively, in step S2, the public interest corporation may, for example, record possessor information for the product requiring appraisal 12 on blockchain 10a and output the generated hash information. The output of this hash information and the recording of the logical guarantee NFT or possessor information on blockchain 10a may be performed via a dedicated platform 10. By recording the logical guarantee NFT as blockchain data on such blockchain 10a, it is possible to completely prevent the logical guarantee NFT from being tampered with. That is, each block in blockchain 10a contains a timestamp and a link (hash value) to the previous block, making it impossible to retroactively change the data within a block.

Furthermore, in step S2, the public interest corporation may, in addition to the above, record the possessor information of the product requiring appraisal 12 on an arbitrary database or distributed storage, and output the generated hash information. The distributed storage is, for example, storage managed by a distributed file server 5 that applies a distributed file system.

Hash information is, for example, a hash value. Furthermore, hash information may include an electronic signature obtained by encrypting the hash value using a private key. Hash information can also include, for example, a transaction hash, a DID (Decentralized Identifier), and a blockchain address. A transaction hash is, for example, a string used to identify an NFT, and in the case of Ethereum, it is represented by a string of approximately 64 characters. As an alternative to this transaction hash, a combination of a contract address and a token ID may be used. In such a case, the contract address is the unique address on the blockchain where the contract is deployed. The token ID is the NFT identified by the contract address. The DID and blockchain address may be generated, for example, based on a public key used to decrypt the electronic signature, which is paired with the private key used to encrypt the hash value into an electronic signature.

Here, "private key" refers to information necessary to perform authentication and certification of the product requiring authentication 12. For example, the integrity of the "private key" itself may be determined during the authentication and certification process. The "private key" represents information that only a specific user can know. It may be recorded, for example, on a small recording medium 11, or within a configuration used in the authentication and certification system 1, such as terminals 6 and 7, or a dedicated platform 10. Furthermore, the private key may also be identification information.

Furthermore, a "public key" may be generated as a pair with a "private key," for example. In this case, known encryption and digital signature technologies can be implemented using the "private key" and "public key." Also, during authentication and certification, whether or not a "public key" was generated as a pair with a "private key" may be considered as consistency and used for determination. The "public key" can be recorded, for example, on a small recording medium 11, or arbitrarily recorded in a configuration used in the authentication and certification system 1, such as terminals 6 and 7, or a dedicated platform 10, depending on the application. Furthermore, the "private key" and "public key" can be generated using known technologies, and can be arbitrarily generated depending on the application using a configuration used in the authentication and certification system 1, such as a dedicated platform 10 or a distributed file server 5.

Possessor information is information regarding the right of possession of the product requiring authentication 12. Possessor information may also be information such as the name and ID of the possessor who possesses the product requiring authentication 12. Possessor information may also be, for example, DID (Decentralized Identity, or Decentralized Identifier), SSI (Self-Sovereign Identity), or DIW (Digital Identity Wallet). Furthermore, possessor information may also be "verifiable credentials (VC)" certified by national governments or public institutions, such as "gBizID" or "My Number (individual number)" in Japan. Possessor information may also be information regarding the account of the possessor who possesses the product requiring authentication 12. Possessor information may also be information about a possessor who previously possessed the product requiring authentication 12. The account ID may be generated based on a private key possessed by each business operator. Furthermore, the possessor information may be an identifier based on information regarding the possessory rights of the product requiring authentication 12. Possessory rights include ownership of the product requiring authentication 12, the right to manufacture, sell, and distribute the product requiring authentication 12, or the right to lend or borrow the product requiring authentication 12. The possessor information may also be information of the possessor converted into an electronic signature using a private key. The possessor includes the owner, the person who manufactures, sells, and distributes the product, and the person who lends or borrows it. The possessor information may also include rental information indicating the information of the person who rented the product requiring authentication 12. Rental information may include, for example, the name or ID of the person who rented the product requiring authentication 12. The electronic signature converted using a private key may be decrypted back to the original information using the public key corresponding to the private key.

A logical guarantee NFT is, for example, an NFT generated based on possessor information. The logical guarantee NFT may also include a digital signature converted from the NFT using a private key. Furthermore, the logical guarantee NFT may be generated based on one or more of the following: origin information relating to the origin of product 12 or its components; quality information relating to the quality of product 12 or its components; supply chain information relating to the transaction of product 12 or its components; determination information for determining threats to the security of product 12; and evaluation information indicating the evaluation of the authentication certificate NFT. In such a case, the logical guarantee NFT may be a unique NFT generated from a unique identifier of information linked to one or more of the origin information, quality information, supply chain information, determination information, and evaluation information. The logical guarantee NFT may also be an NFT generated from zero. Furthermore, the logical guarantee NFT may be an NFT generated based on unique information for each product requiring authentication 12. This unique information may include, for example, the name, number, and date of the contract exchanged when the product requiring authentication 12 was traded. It may also include related information such as an image of the product requiring authentication 12. Additionally, the logical guarantee NFT may be linked to the possessor's account. The logical guarantee NFT is recorded in conjunction with the possessor information.

The origin information refers to the origin of the product requiring authentication 12 or its components. The origin information may also indicate the origin of each component of the product requiring authentication 12. Alternatively, the origin information may indicate the country of origin where the product requiring authentication 12 or its components were produced.

Quality information is information regarding the quality of the product requiring appraisal 12 or its components. Quality information may be, for example, the HBOM (Hardware-Bill of Materials) of the product requiring appraisal 12, or the bill of materials for the product requiring appraisal 12. Quality information may also include, for example, information indicating the presence or absence of scratches on the product requiring appraisal 12 or its components. Furthermore, quality information may include information indicating the years of service for the product requiring appraisal 12 or its components. Quality information may also include information indicating the specifications and operating specifications of the product requiring appraisal 12 or its components. Quality information may also include information indicating compliance with environmental standards, environmental criteria, or CO2 emissions for the product requiring appraisal 12 or its components. Quality information may also include information regarding the security of the product requiring appraisal 12. Security information may include, for example, information regarding the security vulnerabilities of the product requiring appraisal 12. The security vulnerability status refers to the matching of information such as the model number of the IC chip embedded in the product requiring appraisal 12, the OSS and basic OS and version of the software of product requiring appraisal 12, and vulnerability information indicating the IC chip or software that has been identified as vulnerable. Alternatively, the security vulnerability status may also be the presence or absence of security vulnerabilities and threats based on the aforementioned matching. Vulnerability information may be information recorded in, for example, Common Vulnerabilities and Exposures (CVE), National Vulnerability Database (NVD), Japan Vulnerability Notes (JVN), etc. The judgment information is information that determines or identifies the presence or absence of security threats to product requiring appraisal 12, and may be, for example, vulnerability information or information regarding the security vulnerability status of product requiring appraisal 12.

Supply chain information is information regarding transactions of product 12 requiring authentication or parts of product 12 requiring authentication. Supply chain information may also be information regarding the provenance of product 12 or parts of product 12 requiring authentication. Supply chain information may also be information regarding past possessors of product 12 or parts of product 12 requiring authentication. Supply chain information may also be information regarding the manufacturer or system integrator (SIer) of product 12 or parts of product 12 requiring authentication. Supply chain information may also be, for example, information regarding sales contracts for product 12 requiring authentication. Supply chain information may also be, for example, information regarding maintenance contracts for product 12 requiring authentication. Supply chain information may also be, for example, information regarding the maintenance history of product 12 requiring authentication. Supply chain information may also be, for example, information regarding the possession history of the manufacturer, implementing company, and operating company of product 12 requiring authentication.

The evaluation information is information that indicates the evaluation of the elements of the appraisal certificate. The evaluation information may, for example, be information indicating the credibility of the appraisal certificate NFT. The evaluation information may also be information evaluated by, for example, a public interest corporation.

In step S2, the public interest corporation generates further identification information via terminal 6. This identification information is unique and unique for identifying the product requiring appraisal 12. The identification information may, for example, be a unique ID assigned to the product requiring appraisal 12. Alternatively, the identification information may be a hash of the serial number of the product requiring appraisal 12. The public interest corporation sends the outputted hash information and the small recording medium 11 containing the identification information to the vendor or a terminal 6 managed by the vendor.

Next, in step S3, the vendor transmits to the API server 2 the identification information recorded on the small recording medium 11, the serial number information of the product requiring authentication 12, the hash information generated in step S2, and product information including information about the product requiring authentication 12.

Product information refers to information about the product requiring authentication 12. Product information may include, for example, information about the product itself, such as the product name, model number, manufacturer/author, place of manufacture, and date of manufacture. Product information may also include hardware information related to the hardware of product requiring authentication 12. Product information may also include software information related to the software of product requiring authentication 12. Software information may include, for example, the SBM (Software-Bill of Materials) of the software of product requiring authentication 12, or a software list. Software information may also include, for example, the software type indicating the type of software for product requiring authentication 12, the software version indicating the software version, and a software hash obtained by hashing the software information. Furthermore, software information may include information on the software's update history.

In step S3, the vendor may obtain product information recorded on the product requiring appraisal 12, for example, via local communication. Alternatively, in step S3, the vendor may obtain product information recorded on any server via the public communication network 4.

In step S3, the API server 2 may acquire the transmitted product information, identification information, and serial number information as first product information, first identification information, and first serial number information, respectively. The first product information, first identification information, and first serial number information are the product information, identification information, and serial number information to be recorded in the blockchain 10b, respectively.

Next, in step S4, the API server 2 transmits the acquired first product information to the distributed file server 5, generates an identifier based on the first product information, and retrieves the generated identifier. The identifier may be, for example, a CID (Character Identifier).

Next, in step S5, the API server 2 records the authentication certificate NFT based on the hash information obtained in step S3 and the first identification information on the blockchain 10b. Alternatively, in step S5, the API server 2 may also record the authentication certificate NFT based on the hash information obtained in step S3 and the first identification information on the blockchain 10b, linked to the identifier generated in step S4. By recording the authentication certificate NFT as blockchain data on such a blockchain 10b, it is possible to completely prevent the authentication certificate NFT from being tampered with. That is, each block in the blockchain 10b contains a timestamp and a link (hash value) to the previous block, making it impossible to retrospectively modify the data within a block.

Furthermore, in step S5, if the API server 2 is handling a product group 13 consisting of multiple products requiring authentication 12, it may record an authentication certificate NFT on the blockchain 10b based on the hash information for each product requiring authentication 12 obtained in step S3 and the first identification information. The product group 13 may be, for example, a server rack or a box containing multiple products requiring authentication 12.

Furthermore, in step S5, the API server 2 may record the elements of the authentication certificate, based on the hash information and first identification information obtained in step S3, in any database or distributed storage. The elements of the authentication certificate are information that can be used for authentication. These elements may include, for example, an authentication certificate NFT, hash information, serial number information, identification information, etc.

Furthermore, in step S5, the API server 2 may record a correspondence table linking user information and publicly available information for each business operator accessing blockchain 10a and blockchain 10b.

A certified NFT is a unique NFT generated from a unique identifier derived from information based on hash information and a first identification information. Alternatively, a certified NFT may be generated based on hash information, a first identification information, and a first serial number information. Furthermore, a certified NFT may include a digital signature converted from the NFT using a private key.

Furthermore, in step S6, the first identification information transmitted via terminal 6, etc., and the hash information may be linked and recorded in the RDB server 3. Alternatively, in step S6, the first identification information transmitted via terminal 6, etc., the first serial number information, the hash information, and the first product information may be linked and recorded in the RDB server 3. Furthermore, in step S6, the first identification information transmitted via terminal 6, etc., and the occupant information may be linked and recorded in the RDB server 3.

Next, in step S7, the product requiring authentication 12 is sent from the vendor to the SIer. In this case, terminal 6 acquires second-party possessor information regarding the new possessor of the product requiring authentication 12, links the acquired second-party possessor information, records the logical guarantee NFT on the blockchain 10a, and outputs the generated hash information. In this case, the history of possessor information previously linked to the logical guarantee NFT is retained and newly recorded linked to the second-party possessor information. The second-party possessor information is information about the possessor who has newly acquired the right to possess the product requiring authentication 12. The API server 2 may use the outputted hash information to perform the operations in steps S3 to S5, thereby recording the authentication certificate NFT again.

Next, in step S8, the product requiring authentication 12 is sent from the SIer to the consumer. In this case, similar to step S7, new possessor information is acquired, the acquired possessor information is linked, and a logical guarantee NFT is recorded on the blockchain 10a, along with the output of generated hash information. The consumer may also manage a product group 13, which may consist of multiple products requiring authentication 12 grouped together. The product group 13 may include multiple products requiring authentication 12 and a small recording medium 11 attached to the product group 13. Furthermore, when newly recording possessor information for a product requiring authentication 12, the possessor of the product requiring authentication 12 is verified in step S14 (described later), and the system may be configured so that only authenticaters whose possessor status has been verified can perform the verification. This allows for verification even when the possessor of a product requiring authentication 12 changes, by tracing the initial condition settings, and enables control such as cancellation of agreements based on the condition settings, thus realizing a more accurate trace function.

Furthermore, in step S8, the product requiring authentication 12 may be rented. In this case, new rental information is obtained, the acquired rental information is linked, and the logical guarantee NFT is recorded on the blockchain 10a, along with the output of the generated hash information. This makes it possible to implement the Trace function even when the product requiring authentication 12 is lent or borrowed.

Furthermore, if the software of the product requiring authentication 12 is updated, the API server 2 may acquire new first product information including the updated software information, generate an identifier based on the newly acquired first product information in step S4, and record the generated identifier linked to the authentication certificate NFT in step S5. This makes it possible to manage the authenticity of the software of the product requiring authentication 12 even after it has been transferred to a consumer.

By performing the steps described above, the authentication system 1 completes the process of recording authentication elements, such as authentication NFTs, on the blockchain. The authentication system 1 then performs authentication operations using the authentication NFTs recorded in the steps described above. This makes it possible, for example, to digitize a guarantee card indicating the possession of the product requiring authentication 12 as a logical guarantee NFT. Therefore, since logical guarantee NFTs can be issued by any entity without relying on specific services or companies, an Identifier management function can be realized, and authenticity can be proven even on the Trusted Web.

Next, we will explain the operation of the authentication and certification system 1 in proving authenticity. Figure 5 is a flowchart of the operation of the authentication and certification system 1 in proving authenticity. Figure 6 is a schematic diagram of the operation of the authentication and certification system 1 in proving authenticity.

First, in step S10, the appraiser performing the appraisal logs into the account via terminal 7. Also in step S10, the API server 2 may refer to a pre-recorded correspondence table showing the relationship between the appraiser information of the appraiser and the account, and obtain the appraiser information for the entered account. Furthermore, in step S10, the login history may be recorded on blockchain 10b.

Next, in step S11, the appraiser may obtain the second identification information and the second serial number information by entering a command into terminal 7. Alternatively, in step S11, the appraiser may obtain the second product information by entering a command into terminal 7. In such cases, for example, terminal 7 may obtain the second product information and the second serial number information recorded in RDB server 3 via public communication network 4. Terminal 7 may also obtain the second serial number information and the second product information from the product requiring appraisal 12 via local communication, etc. Furthermore, terminal 7 may obtain the second identification information from the small recording medium 11 attached to the product requiring appraisal 12 using RFID, etc.

The second identification information, second serial number information, and second product information are, respectively, newly acquired identification information, serial number information, and product information for the purpose of proving the authenticity of product 12 requiring authentication.

Next, in step S12, the second identification information and second serial number information obtained in step S11 are sent to the API server 2. Alternatively, in step S12, the second identification information, second serial number information, and second product information obtained in step S11 may also be sent to the API server 2.

Next, in step S13, the API server 2 acquires the occupant information associated with the second identification information transmitted in step S12. The API server 2 may also acquire a logical guarantee NFT associated with the second identification information, the second serial number information, and the second product information. Alternatively, in step S13, the API server 2 may acquire a logical guarantee NFT associated with one or more of the second identification information and second product information transmitted in step S12, and recorded in step S6. In this case, the API server 2 may acquire the occupant information associated with the acquired logical guarantee NFT.

Next, in step S14, the possessor of the product requiring appraisal 12 is certified based on the possessor information associated with the logical guarantee NFT obtained in step S13 and the appraisal certifier information obtained in step S11. In this case, for example, in step S14, the possessor of the product requiring appraisal 12 is certified by determining the consistency between the possessor information associated with the logical guarantee NFT obtained in step S13 and the appraisal certifier information obtained in step S11. If the possessor information and the appraisal certifier information are identical in step S14, the process proceeds to step S15. Alternatively, if the possessor information includes the appraisal certifier information, the process may proceed to step S15. Furthermore, if the possessor is certified in step S14, this history may be recorded.

Next, in step S15, the API server 2 certifies the authenticity of the product 12 requiring authentication by determining the consistency between the authentication certificate NFT recorded in step S5, the second identification information obtained in step S11, and the hash information of the logical guarantee NFT obtained in step S13. In this case, the API server 2 may also certify the authenticity of the product 12 requiring authentication by determining the consistency between the authentication certificate NFT recorded in step S5, the second identification information obtained in step S11, the second serial number information, and the hash information of the logical guarantee NFT obtained in step S13. Furthermore, if authenticity is certified in step S15, this history may be recorded.

Furthermore, in step S14, the consistency between the expert information obtained in step S11 and the user information recorded in step S5 may be determined. In such a case, in step S15, the publicly available information recorded in step S5 in conjunction with the user information may be disclosed to the expert. This makes it possible to manage attributes or data linked to identifiers and to select the scope of disclosure and usage period for disclosure.

Furthermore, in step S14, when dealing with product group 13, the consistency between the appraisal certifier information obtained in step S11 and the user information corresponding to each product 12 requiring appraisal within product group 13, recorded in step S5, may be determined. In such a case, for example, multi-signature authentication can be employed, where possession verification is established if at least two pieces of user information corresponding to each product 12 requiring appraisal are available, thereby making the appraisal accuracy more reliable.

Next, in step S16, the API server 2 certifies the authenticity of the product requiring authentication by determining the consistency between the first product information indicated by the identifier associated with the authentication certificate NFT recorded in step S5 and the second product information obtained in step S11. In this case, authenticity may also be certified by determining the consistency of the software hash, software type, and software version contained in the first and second product information, respectively. Furthermore, if authenticity is certified in step S16, this history may be recorded.

Furthermore, in step S16, if the API server 2 is handling product group 13, it may perform authenticity verification of each product requiring verification 12 included in product group 13 by determining the consistency between the first product information indicated by the identifier associated with the verification certificate NFT recorded in step S5 and the second product information obtained in step S11. In such a case, for example, multi-signature authentication can be employed, where verification is valid if at least two pieces of product information corresponding to each product requiring verification 12 are available, thereby making the verification accuracy more reliable.

Furthermore, if the product requiring appraisal 12 has multiple small recording media 11, the operation of steps S10 to S16 may be repeated for each small recording media 11.

By performing the steps described above, the process of verifying the authenticity of the authentication system 1 is completed. This makes it possible to verify authenticity on the Trusted Web without relying on specific services or companies. Furthermore, an insurance system may be applied to the authentication system 1 to pay compensation in the event of errors in the various information recorded on blockchain 10a, or if the product requiring authentication 12 is found to be counterfeit.

1 Authentication and certification system 2 API server 3 RDB server 4 Public communication network 5 Distributed file server 6 Terminal 7 Terminal 10 Dedicated platform 10a, 10b Blockchain 11 Small recording medium 12 Products requiring authentication 13 Product group 101 CPU
102 ROM
103 RAM
104 Storage section 105 I/F
106 I/F
107 I/F
108 Input unit 109 Display unit 110 Internal bus 111 Enclosure

Claims (12)

A dedicated platform that records possessor information regarding the possession rights of products requiring authentication , including communication devices or digital products equipped with software, in a database, distributed storage, or blockchain, and outputs the generated hash value.
A first acquisition means for acquiring first identification information for identifying the product requiring appraisal,
The system includes recording means for recording elements of authentication certificates based on the hash value output by the dedicated platform and the first identification information obtained by the first acquisition means in a database, distributed storage, or blockchain .
The first acquisition means acquires first product information including an SBM (Software-Bill Of Materials) showing the software configuration of the product to be appraised and the update history of the software,
The recording means records the first identification information and the first product information in association,
A second acquisition means for acquiring second product information including an SBOM showing the software configuration of the product requiring appraisal and a software update history,
The system further includes an authentication means for verifying the authenticity of the product requiring authentication, based on the first product information linked to the first identification information recorded by the recording means and the second product information acquired by the second acquisition means.
A certification system characterized by the following features. The appraisal and certification system according to claim 1, further comprising: an appraisal and certification means for obtaining appraisal and certification information relating to an appraisal and certification person who appraises the aforementioned product requiring appraisal; and an possessor certification means for certifying the possessor of the aforementioned product requiring appraisal based on the obtained appraisal and certification information and possessor information. The recording means links the first identification information with the occupant information,
A second acquisition means for acquiring appraisal information relating to an appraisal appraiser who appraises the aforementioned product requiring appraisal, and second identification information for identifying the newly acquired product requiring appraisal,
A third acquisition means for acquiring the occupant information linked to the second identification information acquired by the second acquisition means by the recording means,
The appraisal and certification system according to claim 1, further comprising an possessor certification means for certifying the possessor of the product requiring appraisal based on possessor information obtained by the third acquisition means and appraisal and certification information obtained by the second acquisition means. The authentication system according to claim 1, characterized in that the recording means records on a blockchain the elements of the authentication that are linked to one or more of the following: origin information relating to the origin of the product or parts of the product to be authenticated; quality information relating to the quality of the product or parts of the product to be authenticated; supply chain information relating to the transaction of the product or parts of the product to be authenticated; determination information for determining threats to the security of the product to be authenticated; and evaluation information indicating the evaluation of the elements of the authentication. The appraisal and certification system according to claim 1, characterized in that the dedicated platform acquires second possessor information relating to a new possessor of the product requiring appraisal, and records the acquired second possessor information in a database, distributed storage, or blockchain. The dedicated platform records the occupant information on the blockchain,
The authentication certificate system according to claim 1, characterized in that the recording means records the elements of the authentication certificate on a blockchain. The authentication certification system according to claim 1, characterized in that the recording means records on a blockchain elements of the authentication certification linked to information regarding the security of the product requiring authentication or the parts of the product requiring authentication . The authentication and certification means determines whether the type and version of each software included in the second product information matches the update history of the first product information, and certifies the authenticity of the product requiring authentication.
The appraisal and certification system according to claim 1, characterized by the following: The aforementioned appraisal and certification means matches a vulnerability database, which links software and security vulnerabilities, with the second product information, and determines the presence or absence of the security threat.
The appraisal and certification system according to claim 1, characterized by the following: The recording means records the elements of the appraisal certificate in a database, distributed storage, or blockchain, linked to the judgment information.
The appraisal and certification system according to claim 9, characterized by the following: The vulnerability database includes at least one of CVE, NVD, or JVN,
The aforementioned determination information indicates a security vulnerability.
The appraisal and certification system according to claim 9, characterized by the following: The elements of the authentication certificate are an authentication certificate NFT based on the hash value, the first identification information, the first product information, and the determination information.
The appraisal and certification system according to claim 9, characterized by the following: