FY 2022

Supply Chain Trust Issues
and Recommendations
Ver2.0MARCH 2023
JDTF SUPPLY CHAIN REFORM COMMITTEE

Change log
No
1
2

Date
July 1, 2022
Feb 24, 2023

Version
1.0
2.0

Changes
Initial release
Chapter I.
Added assumed audience in the last paragraph; explained differences
between White Paper 1.0 and White Paper 2.0.
Chapter II.
Clarified the wording of the scope in contrast to [METI '19].
Added a scope diagram.
Section V-3.
Added section V-3-2; added the concept for realization.
Revised section V-3-3; clarified the overall picture of how to achieve
this.
Revised section V-3-4; clarified the meanings of “Trust Stores” and“Digital Evidence.”
Section V-4.
Added new information items:- “Trustworthiness Information,”- “Digital Evidence,” and- “Linkage Information.”
Section V-5.
Newly added images of the realization of the target image.
Explained that the information items added to Section V-4 canachieve the goals in Section V-1.
Chapter VI.
Separated from the former Section V-4 and upgraded to Chapter VI.
Clarified how to realize use cases.
Chapter VIII.
Additional updates added since the White Paper 1.0 version.

1
Copyright 2022, 2023 Japan Digital Trust ForumContents
I.

Introduction .....................................................................................................................3

II. Scope: supply chain trust for safety and security..............................................................7
III. Changes in environmental conditions/circumstances ......................................................9
IV. Issues to resolve ..............................................................................................................14
V. Measures to resolve the issues ........................................................................................16
1.

Goals of supply chain trust .........................................................................................16

2.

Requirements..............................................................................................................17

3.

Implementation methods ............................................................................................18

4.

5.

3-1.

Classification of the trust formed in supply chains..............................................18

3-2.

Concepts for realization ......................................................................................193-3.

Overall picture of the realization methods ..........................................................21

3-4.

Trust Store and Digital Evidence Store ...............................................................23

3-5.

Trust as a Service (TaaS) ....................................................................................26

3-6.

Base Registry .......................................................................................................27

Information items handled with the supply chain trust ..............................................28
4-1.

“Trustworthiness Information” items..................................................................28

4-2.

“Digital Evidence” items .....................................................................................30

4-3.

“Linkage Information” Items ...............................................................................31

Visualization of the goals to be realized......................................................................32
5-1.

Visualization of Goal 1 ........................................................................................32

5-2.

Visualization of Goal 2 ........................................................................................33

5-3.

Visualization of Goal 3 ........................................................................................34

5-4.

Visualization of Goal 4 ........................................................................................35

VI. Use cases ...................................................................................................................... 37
1 Mechanisms to ensure the trustworthiness of data coming out of the equipment .....37
2 Efforts to reduce carbon emissions throughout the supply chain ...............................46
3 Identifying security measures throughout the manufacturing supply chain ...............54
4 Usage scenarios and effects of Trust as a Service (TaaS) ...........................................59
VII. Recommendations ..........................................................................................................61
VIII. Conclusions ...................................................................................................................632
Copyright 2022, 2023 Japan Digital Trust ForumI.

Introduction
To address the various challenges faced by the international community in pursuingsustainable development goals, the Japanese government advocates the realization of Society
5.0,1 a society that balances economic development with the resolution of social issues by
incorporating digital technologies such as AI (Artificial Intelligence), 5G (5th Generation),and IoT (Internet of Things) into all industries and social life.
To realize Society 5.0, it is beneficial for various stakeholders to cooperate in establishingmechanisms that ensure trustworthiness through harmonization among countries, such as theEuropean eIDAS (Electronic Identification, Authentication and Trust Services) Regulation,2
to achieve international distribution of data. The Government of Japan has addressed the two
key points of free and open data distribution and data security and safety as Data Free Flowwith Trust.3
To realize the safe and secure society that Society 5.0 aims for, not only data, but also the
supply chains that provide products and services to that society must be safe and secure. A
supply chain is a set of resources and processes to which orders are directed; it includes
vendors, manufacturing facilities, logistics providers, internal distribution centers,
distributors, wholesalers, and others involved in the manufacturing, supply, processing,handling, delivery, and provision of goods and related services. To make the supply chainssafe and secure, the processes of providing products and services to consumers must also besafe and secure.
This white paper focuses on ensuring supply chain security and safety (supply chain trust)and describes the relevant challenges and recommendations.
The previous version of this document, White Paper Version 1.0, summarized the concepts
and implementation methods for original equipment manufacturers (OEMs) and suppliers tomake their supply chains safe and secure. This White Paper Version 2.0 fleshes out therealization methods.
Table I-1 lists the references and labels to which we refer in this paper.

1

https://www8.cao.go.jp/cstp/society5_0/

2

Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 onelectronic identification and trust services for electronic transactions in the internal market and repealing
Directive 1999/93/EC, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2014.257.01.0073.01.ENG
3“New IT Policy Framework for the Digital Age,” Comprehensive IT Strategy Headquarters, decided onJune 7, 2019, available at: https://cio.go.jp/node/2534

3
Copyright 2022, 2023 Japan Digital Trust ForumTable I-1 References
No

AuthorDocument title

1

World Economic Forum[WEF '21]

2

Industrial Internet
Consortium

3“IIoT Value Chain Security - Chain of Trust for
Organizations and Products” (2022.05.30)[RRI '22]

5

Robot Revolution &Industrial IoT
International
Symposium (RRI),
Plattform Industrie 4.0,
Germany
Robot Revolution &Industrial IoT
International
Symposium (RRI),
Plattform Industrie 4.0,
Germany
METI“Rebuilding Trust and Governance: Towards Data
Free Flow with Trust (DFFT) White Paper” (2021.3)“Trustworthiness” (January 18, 2018)(https://www.iiconsortium.org/pdf/201712_4Q17_report_Trustworthiness_Final.pdf)“IIoT Value Chain Security - The Role ofTrustworthiness” (September 23, 2020)[METI '19].

6

ISO

7

Japan External Trade
Organization (JETRO)

8

ENISA

9

Industrial Internet
Consortium

10

JDTF Rule Formation
Committee

11

Cabinet Office“Toward Ensuring the Trustworthiness of New Supply
Chains (Value Creation Processes) in the Cyber andPhysical Security Framework Society 5.0 Version 1.0”
(April 18, 2019)“Security Management Systems for the Supply Chain Best Practices for Implementing Supply Chain
Security, Assessments and Plans - Requirements andGuidance” (2007)“Trade and Investment Consultation Q&A Differences
between OEM and License Agreements: Japan”(2017.8) (https://www.jetro.go.jp/world/qa/04A011247.html)“Understanding the increase in Supply Chain Security
Attacks” (July 29, 2021)(https://www.enisa.europa.eu/news/enisanews/understanding-the- increase-in-supply-chainsecurity-attacks)“The Industrial Internet of Things Trustworthiness
Framework Foundations, Version V1.00” (July 15,
2021)“Digital Trust Council, Rule Formation Committee,
White Paper, Version 1” (2021.12.07)(https://jdtf.jp/report/rm-com)“Priority Plan for the Digital Society, Appendix,
Comprehensive Data Strategy” (June 18, 2021.

12

Cabinet Office

13

Ministry of theEnvironment

4“Society 5.0.”(https://www8.cao.go.jp/cstp/society5_0/index.html)
Cited from Green Value Chain Platform: Getting
Started with Supply Chain Emissions Calculation(env.go.jp)(http://www.env.go.jp/earth/ondanka/supply_chain/gvc/supply_chain.html#no01)

Label[IIC'18][RRI '20][ISO 28001 '07]

[JETRO '17]

[ENISA '21]

[IIC '21][TaaS WP '21]

[Comprehensive
Data Strategy'21][Society 5.0]
[Ministry of theEnvironment
Supply Chain
Emissions
Calculation]

4
Copyright 2022, 2023 Japan Digital Trust ForumTable I-2 provides a glossary of terms used in this paper.
Table I-2 Glossary of Terms
N oEnglish term

1

Trust Chain

24Structuring a
Trust Chain
Value Creation
Process
Trust

5

Trustworthiness

6

Prove, Proof

7

8

Original
Equipment
Manufacturer
Supply Chain

9

Procedure10

DX: Digital
Transformation

11

Mobility as aService3

Description
A chain of trust connections built through repeated creation and proof of trust
Definition in this document: a chain of “information that demonstrates trust”
by showing conformity
Creating a chain of trust using “information that demonstrates trust” and“information that demonstrates connection”
Value-added creation activities that straddle both cyber and physical spaces andare composed of various objects and data that are dynamically connected
A credible expectation held by a user or other stakeholder that a product,system, or service will deliver value as intended; trustworthiness-based
expectations
A system’s ability to meet the expectations of its stakeholders through security,
privacy, safety, reliability, resilience, and so on
Reference: ISO/IEC JTC1/WG13“For supply/value chain security and risk management, the term
‘Trustworthiness’ corresponds to the supplier’s ability to meet the expectationsof the potential contract partner in a verifiable way.”
Third-party confirmation that the necessary regulations for the six aspects ofthe value creation process (organization, people, things, data, systems, andprocedures) have been met
A manufacturer that produces or produces products under the consignor's
brand.
A series of resources and processes that are order-directed, beginning with theprocurement of raw materials and continuing through the manufacturing,processing, and delivery of products and services to the consumer
Note: Supply chain actors may include vendors, manufacturing facilities,
logistics providers, internal distribution centers, distributors, wholesalers, andothers involved in the manufacturing, supply, processing, handling, delivery,
and provision of goods and related services.
[METI '19].
Procedures for a series of activities to achieve a defined objective[TaaS WP '21]
Represents a series of interrelated or interacting activities or procedures forachieving an objective in an industrial activity, service, procedure, and so on
The process of enabling companies to respond to disruptive changes in theirexternal ecosystem (customers, markets) while driving change in their internal
ecosystem (organization, culture, employees), using a third platform (cloud,mobility, big data/analytics, social technologies) to create new products andservices, create value, and establish a competitive advantage by transforming
the customer experience, both online and in the real world, through new
business models
Mobility as a Service (MaaS) is a service that provides search, reservation,
payment, and others in a single package by optimally combining multiple public
transportation and other transportation services to meet the trip-basedtransportation needs of individual local residents and travelers. It is an
important means of improving the convenience of transportation andcontributing to solving local issues by coordinating with non-transportation
services such as sightseeing and medical services at the destination.

5
Copyright 2022, 2023 Japan Digital Trust ForumN oEnglish term

12

Trust Store

13

Trust as aService

14

Base Registry

15

Trust Service

16“Digital
Evidence”
Digital Evidence
Store

17

Description
For every organization in a trustworthy supply chain, “Digital Evidence” (in thispaper, implementation verification results) is published by each organization’s
system in a shared information system called a Trust Store. The Trust Storekeeps data on trustworthiness and makes them available to participants.
TaaS refers to the functionality to achieve the trust required in cyberspace todigitize procedures in a physical space, such as functions for counterparty trustlevel confirmation, remote type data integrity, remote type procedure andsystem validity, verification by any third party, and a mechanism to reduce theburden on the user (UX). This is provided as a service.
A database with 51 types of basic social data on people, corporations, land,buildings, qualifications, and others that is registered and published by publicorganizations and referred to in various situations. This database makes up thefoundation for a society to have ensured accuracy and up-to-dateness.
A mechanism to check the legitimacy of people, organizations, data, and otherson the Internet and prevent falsification, spoofing of transmission sources, andso on.
Reference: Ministry of Internal Affairs and Communications, “Final Report of
the Study Group on Platform Services,”
https://www.soumu.go.jp/main_content/000668595.pdf
Information that provides evidence of the reliability of six aspects, namely,organization, people, things, data, systems, and procedures.
Database for storing, tamper-proofing, and retrieving “Digital Evidence”

6
Copyright 2022, 2023 Japan Digital Trust ForumII.

Scope: supply chain trust for safety and security
As the Internet has come to permeate our economy and life in recent years, we see thearrival of Society 5.0, meaning a digital society led by data, including cloud services, AI, and
IoT. Society 5.0 is a human-centered society that balances economic development and theresolution of social issues through a system that highly integrates cyberspace and physicalspace [Society 5.0].
In this regard, the Framework for Cyber and Physical Security Measures, formulated by the
Ministry of Economy, Trade and Industry, states that in Society 5.0, supply chains willtransform from being a routine and linear configuration in which a series of activities aredeveloped in a fixed and stable sequence to becoming value-added activities in which various
goods and data are dynamically connected across both cyber space and physical space[METI'19].
The scope of this white paper is to ensure trust as follows in “Society 5.0 supply chains,”
which consist of various goods and data dynamically connected across both cyber and physicalspace:(Scope 1)

The processes of value creation (products, services, data, etc.) in the supply
chains are in line with expectations,(Scope 2)

The values (products, services, data, etc.) created in the supply chains are inline with expectations, and(Scope 3)

Continuous provision of value (products, services, data, etc.), including aftersales services, through the supply chains are in line with expectations.

The “Society 5.0 supply chains” covered by Scopes 1–3 are shown in Figure II-1.

7
Copyright 2022, 2023 Japan Digital Trust ForumCompany A
Parts

Organization

Company D
Parts

Organization

Product
ServiceCompany B
Organization

Product Company C Product
Service
Service
Org.

Product
Service：Supply route：Connections between
products/services(Scope 1) Product manufacturing process and service provision process ofCompany A, Company B, Company C, and Company D(Scope 2) Products and services created by Company A, Company B,
Company C, and Company D(Scope 3) Connections between products and services created byCompany A, Company B, Company C, and Company D

Figure II-1 “Society 5.0 supply chains” covered by Scopes 1–3

8
Copyright 2022, 2023 Japan Digital Trust ForumIII. Changes in environmental conditions/circumstances
Based on the scope described in the previous section, changes in environmental
conditions/circumstances regarding supply chains are summarized in Trends 1–4 below.
(Trend 1) Digitization of supply chains and after-sales services
Organizations in supply chains are increasingly digitizing business-to-business (Businessto-Business, BtoB) transactions, the manufacturing and delivery processes of products andservices, maintenance, and after-sales services, including remote monitoring. New services
such as operation, maintenance, and upkeep of facilities using data obtained from equipment,
sensors, and other devices are also being offered at an accelerated pace.
(Case 1-1) Digitization of manufacturing processes
Machine tool manufacturers are increasingly digitizing their manufacturing processes,
sharing data for machining and prototyping customer products, and conducting test
machining and prototyping in a three-dimensional virtual space. Efforts are underway toincrease business opportunities by connecting with customers through machining andprototyping in this virtual space.4(Case 1-2) Digitization of business-to-business transactions
In 2019, the market size of BtoB e-commerce in Japan was 353 trillion yen, expanding
2.5% from the previous year. The ratio of the e-commerce market size to the value ofcommercial transactions (commercial transaction market size) is also on the rise, and thedigitization of commercial transactions continues to progress.5(Case 1-3) Digitization of after-sales services
Businesses based on industrial data collected from equipment and others are
expanding. “i-Construction”—the process of accumulating and analyzing various data
(e.g., work performance information from ICT construction equipment at construction
sites and 3D measurement information of the topography of work sites from drones)
systems that enable real-time management of the construction status and the sharing of4

DMG Mori Seiki to Digitalize 80% of its Processes: Prototyping Parts in Virtual Space: Nihon Keizai

Shimbun (nikkei.com)
https://www.nikkei.com/article/DGXZQOFD0834A0Y1A800C2000000/
5

Ministry of Economy, Trade and Industry (METI) Compilation of the results of a market survey on e-commerce. https://www.meti.go.jp/press/2020/07/20200722003/20200722003.html

9
Copyright 2022, 2023 Japan Digital Trust Forumprogress—is being introduced, and the introduction of systems that enable real-time
management of construction status and sharing of progress is advancing.6
Moreover, industrial and energy companies in the petroleum, chemical, and electric
power and gas industries, as well as related providers of infrastructure such as elevatorsand buildings, are facing long-term human resource shortages and a decline in theirability to pass on technology and skills because of the aging of their facilities andpersonnel. In addition to these problems, recent years have seen increasingly severe
disasters in Japan, and companies are faced with the demand for facilities with high safety
features to cope with disasters. Services that use digital technology are being introduced
to automate the diagnosis and monitoring of the necessary repair or replacement ofequipment, using data from sensors in infrastructure-related equipment to ensure a highlevel of safety while saving manpower.7(Trend 2) Continuous supply of product and service value in response to diversifying needs
and changing external conditions
Various efforts are being made by organizations that make up supply chains to respondflexibly and quickly to diversifying consumer needs, external conditions, and other changes,
and ensure the continuous supply of value in products and services.
(Case 2-1) Continuous supply of products and services that meet diversifying consumer
needs
Business computers are highly customizable in terms of CPU, memory, HDD, andother components. To meet specific consumer requirements, business computer
suppliers have established supply chains that accept detailed customization requests via
purchase websites and assemble business computers one by one at a factory to meet suchrequirements.8(Case 2-2) Continuous supply of products and services in response to changing external
conditions
When the Great East Japan Earthquake struck, parts manufacturers in the Tohoku
region were also hit, and automakers were unable to secure the parts they needed. It was

6

Data Utilization Case Studies: Case03 Platformer①

https://www.meti.go.jp/policy/economy/chizai/chiteki/pdf/data_jireisyu.pdf
7

Basic Policy for Smart Security Guidelines, Ministry of Economy, Trade and Industry 2020

https://www.meti.go.jp/shingikai/safety_security/smart_hoan/pdf/kihon_hoshin.pdf
8monodukuri.com What is "BTO"? https://www.monodukuri.com/gihou/article_list/125/BTO

10Copyright 2022, 2023 Japan Digital Trust Forumdiscovered at that time that the supply chain structure was not conventionally composedof affiliated suppliers with the OEM at the top, but rather single supplier belonging tomultiple affiliates. 9 The automakers began to visualize the total supply chains, avoid
regional risks, and monitor the status of facilities at partner plants to diversify risk so thatthe supply chains would not be disrupted in a crisis.
(Case 2-3) Utilization of open-source software as software components
In the field of software development, open-source software is increasingly being used
for its functionality and convenience. In recent years, products traditionally provided assoftware products have increasingly become replaced by open-source software to respondflexibly and quickly to needs.
(Trend 3) Changes in the structure of supply chains, diversification of industries in which
suppliers participate, and increased complexity of supply routes for products and services
In the supply chains, suppliers are entering diverse industries and supply routes for
products, and services are becoming increasingly complex.
(Case 3-1) From a pyramid structure to a diamond structure
In some cases, automobile manufacturers have concentrated the supply ofsemiconductor chips, which are core components, to specific suppliers outside their owngroup as a result of their efforts to promote greater efficiency and lower costs in the
supply of components. In such cases, the supply chain structure is a diamond structurewith a horizontal division of labor, where one supplier belongs to multiple affiliates.9(Case 3-2) A diamond structure including different industries and services
Telematics insurance services are being offered to reduce insurance claims for safe
drivers by acquiring data from in-vehicle devices in automobile insurance. These services
are not limited to traditional suppliers such as car manufacturers and insurancecompanies, but new suppliers have entered the market, and supply routes for products
and services have become more complex.10

9Ministry of Economy, Trade and Industry (METI) “Manufacturing White Paper 2019 Part 1: Current

State and Issues of Fundamental Manufacturing Technologies, Chapter 1: Manufacturing Industry in the
Heisei Era and Changes in the Manufacturing White Paper”
https://www.meti.go.jp/report/whitepaper/mono/2019/honbun_pdf/index. html
10

Ministry of Land, Infrastructure, Transport and Tourism, Promotion of the Japanese Version of MaaS:

11
Copyright 2022, 2023 Japan Digital Trust Forum(Trend 4) Acceleration of rule formation that requires compliance throughout the supply
chain
While compliance with the rules at individual OEMs is a given, in recent years, all of the
suppliers that make up the supply chain are now asked to account for their compliance withthe rules. These rules are being formed one after another globally.
(Case 4-1) Personal data protection under General Data Protection Regulation
The General Data Protection Regulation (GDPR) has been in effect in the European
Union since 2018; it is designed to give individuals back their right to control theirpersonal data and to consolidate rules within the European Union. The GDPR also tasks
data managers with accountability for GDPR compliance in processing data even in thecase of an outsourcee processing personal data. Companies that violate the GDPR are
subject to huge fines.11 When companies are accountable for GDPR compliance, theymust hold their suppliers accountable as well, and failure to do so across the board
increases the risk of fines.
(Case 4-2) World Forum for Harmonization of Vehicle Regulations
Security requirements for self-driving vehicles were developed at the World Forum for
Harmonization of Vehicle Regulations (WP29), where the participants agreed uponsecurity requirements that automakers should include when designing, developing, andmanufacturing self-driving vehicles.12 Automakers need to explain that their products
meet these security requirements. If the manufacturer’s suppliers cannot explain how
their products meet the security requirements of the WP29, the type designationnecessary to reduce the man-hours required for inspections of mass-produced products
may be revoked, or the mass production of vehicles may be prevented.

Formation of the MaaS Model
https://www.mlit.go.jp/sogoseisaku/japanmaas/promotion/model/index.html
11

JETRO Business Brief, Two years after the start of GDPR application, clarifying the scope of

extraterritorial application, https://www.jetro.go.jp/biznews/2020/06/c81164d22cfa1274.html
12

Ministry of Land, Infrastructure, Transport and Tourism Press Release “Introduction of International

Standards for Automated Driving Technology, etc.: Partial Revision of Safety Standards for Road Vehicles,
etc., and Notifications, etc., that Specify Details of Safety Standards” (Japanese only)
https://www.mlit.go.jp/report/press/jidosha10_hh_000242.html

12
Copyright 2022, 2023 Japan Digital Trust Forum(Case 4-3) Sustainable Development Goals
The Sustainable Development Goals (SDGs), which are international development
goals to be achieved by 2030, were adopted by the United Nations in 2015. They consistof 17 goals and 169 targets to be achieved, and companies are encouraged to set, disclose,
and continuously work toward the targets for these goals.13 It is becoming increasingly
important for companies to explain their commitment to the SDGs to demonstrate theirsocial corporate value. To explain their commitment to the SDGs, OEMs must not only
explain their own commitment to the SDGs, but also their suppliers’ commitment to the
SDGs throughout their supply chains.
(Case 4-4) Environment, Society, and GovernanceIn recent years, attention has gathered around “ESG investment,” 14 which means
making investments by analyzing companies from three perspectives: the environment,
society, and governance (ESG). When receiving investments, it is becoming increasingly
important for companies to explain their ESG initiatives as an indication of their future
corporate value, through examples of ESG initiatives such as the use of materials andenergy with low environmental impact and the reduction of environmental impact in thedisposal process. Not only the OEMs, but also all suppliers and the entire supply chains,must explain their ESG initiatives.

13

Ministry of Economy, Trade and Industry SDGs https://www.meti.go.jp/policy/trade_policy/sdgs/

14

Ministry of Economy, Trade and Industry ESG Investment

https://www.meti.go.jp/policy/energy_environment/global_warming/esg_investment.html

13
Copyright 2022, 2023 Japan Digital Trust ForumIV. Issues to resolve
The previous chapter described the following four trends and changes in supply chains:(Trend 1)

Digitization of supply chains and after-sales services;(Trend 2)

Continuous supply of products and services of value in response todiversifying needs and changing external conditions;(Trend 3)

Changes in the structure of supply chains, diversification of industries inwhich suppliers participate, and increased complexity of supply routes for
products and services; and(Trend 4)

Acceleration of rule formation that requires compliance throughout the
supply chain.

To ensure supply chain trust in this context, this chapter describes Issues 1–4 that need tobe resolved.
(Issue 1) Data security threats associated with digitization
Among organizations that make up the supply chain, factories and plants are expected tohandle large amounts of data autonomously, and the trustworthiness of manufacturing anddata-based services will become highly dependent on the “trustworthiness of data.” Digitizeddata are constantly exposed to security threats, and it is difficult to confirm the date, time,
place, and origin of data generation, or to confirm that the data have not been tampered withor replaced during the course of exchanges. Furthermore, as services become digitized, thedata used in the process are also exposed to threats, and it is difficult to confirm the source,date, and time of data generation, and that the data have not been tampered with or replaced.
Design data and process data generated in the process of manufacturing products andproviding services, BtoB transaction data, and infrastructure facility data are closely related
to real-world products and services, BtoB transactions, and facility operating conditions.
Therefore, ensuring the trustworthiness of data affects the trustworthiness of real-world
products and services, BtoB transactions, and facility operations. However, because there isno consensus standard or guideline for what constitutes “trustworthy data” in Japan, there isa risk that some services may operate under inappropriate standards compared withinternational and technological trends.
(Issue 2) Difficulty of reconfiguring suppliers to meet diversifying customer needs andchanging external conditions
In order for the organizations in supply chains to respond to new needs and changing
external conditions, supply chains must be reconfigured to incorporate new suppliers. To
14
Copyright 2022, 2023 Japan Digital Trust Forumdetermine whether a supplier’s products or services can meet new needs or changing external
conditions, it is necessary to check the supplier’s track record, capabilities, and whether it isproperly managed, which is a time-consuming and costly process. Even if a new supplier
claims to be able to provide a product or service with better functionality or convenience, it istime-consuming and costly to verify whether the claim is true.
(Issue 3) Increasing complexity of supply chains, which makes it difficult to identify the causes
and scope of impact when problems occur
As the industries of suppliers become more diverse and supply routes more complex, it
becomes difficult for organizations in the supply chain to identify where in the supply chain
the causes lie when a problem is discovered with a final product or service. Furthermore, it isdifficult to determine properly whether the causes of the problem affect other products orservices (scope of impact). If it takes time to identify the causes of the problem and tounderstand and specify the scope of impact, product provision and service restoration will bedelayed and potentially lead to loss of business opportunities and damage to the corporate
image.
(Issue 4) Explanation of the status of compliance with rules and new value created throughout
the supply chains
Organizations in a supply chain must follow the relevant rules imposed on the entire supply
chain, as they are formed one after another. To comply with these rules, OEMs must develop
their own rules that apply to their supply chains, and their suppliers must follow these rulesin their business activities. Failure to account for compliance throughout the supply chain canlead to lost business opportunities and penalties.
Furthermore, to achieve sustainable growth for society, companies must take the initiative
to enhance new social and environmental values such as SDGs and ESG. To enhance theircorporate image and corporate value, companies must be able to explain appropriately thatthey are working to improve social and environmental values by formulating their own rules
and regulations applicable to their supply chains, and are accommodating the aforementioned
rules.
In this white paper, the term “regulations” refers to all rules, procedures, and rules thatmust be followed in a supply chain, manufacturing process, or service provision process; it is
not limited to any specific subject or scope.
Measures to address these issues are described in the next chapter.

15
Copyright 2022, 2023 Japan Digital Trust ForumV. Measures to resolve the issues
1.

Goals of supply chain trust
Considering the issues described in the previous chapter, the following is a descriptionof what establishing trust aims to achieve in a supply chain.
(Goal 1) Easily verify the trustworthiness of data generated and exchanged throughout
the supply chain
This means that organizations in a supply chain could easily verify the origin of thedata and subsequently confirm that no tampering has occurred, as with the data used forservices, as well as the trustworthiness of real-world products and services that areprovided based on the data.
(Goal 2) Be able to select appropriate suppliers in response to changes in needs and theexternal environment
This means that organizations in a supply chain could check the performance andcapabilities of new suppliers and whether they are managing production and sales
appropriately, without spending too much time and money. This would allow
organizations to select suppliers appropriately and easily reconfigure their supply chainsto include new suppliers. This way, the company could respond to diverse needs andchanges in the external environment.
(Goal 3) Easily understand the structure of the supply chain
This means that even though suppliers come from diverse industries, and supply routes
are becoming more complex, organizations in a supply chain could easily identify wherein the supply chain the causes of a problem lie when one is discovered in a final productor service. Furthermore, it could be easily and appropriately determined whether thecauses of the problem affect other products or services (scope of impact). Easily
identifying the causes of the problem and the scope of impact makes it possible to resume
product supply and restore services quickly, thus helping to avoid lost business
opportunities and damage to the corporate image.
(Goal 4) Be able to explain compliance with rules throughout the supply chain
This means that organizations in a supply chain could explain their compliance withthe rules that are imposed on the entire supply chain as they are formed one after another.
They could avoid lost business opportunities and penalties by establishing their own rules
16
Copyright 2022, 2023 Japan Digital Trust Forumthat apply to their supply chains and conducting their business activities in accordancewith these rules.
Furthermore, the company could explain its efforts to improve new social andenvironmental values, such as SDGs and ESG, for the sustainable growth of society. To
enhance corporate image and corporate value, the company could develop higher goals
applicable to the supply chain as a regulation, implement the regulation, and explain how
the higher goals have been achieved.
The aforementioned mechanisms for ensuring data trustworthiness throughout supply
chains and easily demonstrating the trustworthiness and legitimacy of businessactivities without loss of time or costs would further provide the following values.
Value 1: Strengthening the competitiveness of the industry
In the increasingly diverse and complex supply chains of Society 5.0, ensuring thetrustworthiness of data exchanged among organizations and companies, and visualizing
the trustworthiness and legitimacy of business activities would enhance global
competitiveness, with trust as a strength and the differentiating factor in the industry.
Value 2: Creating new innovations
The reduction of insecurity, distrust, and risk in business activities would enhance thevalue creation, transactions, and integration of companies within the supply chains aswell as accelerate innovation creation across different organizations, companies, andindustries.
2.

Requirements
In the previous section, we described supply chain trust goals. In this section, we
describe requirements 1–3 to achieve goals 1–4.
(Requirement 1) Easily verify the trustworthiness of data exchanged in the supply chain(Requirement 1-1)

It is easy to verify the date, time, location, and source of data
generated and exchanged in the supply chain, and that thedata have not been tampered with or switched.

(Requirement 1-2)

The trustworthiness of the source of the data can be verified.
For example, it is easy to verify that the organization, person,
or component generating the data is not fraudulent.

(Requirement 1-3)

It can be confirmed that the data existed at a certain point in
17
Copyright 2022, 2023 Japan Digital Trust Forumtime.
(Requirement 2) Be able to check easily the regulations imposed on the processes ofmanufacturing products and providing services, and that the processes have been
implemented in accordance with the regulations(Requirement 2-1)

The regulations imposed on the process of manufacturing
products and providing services can be easily identified.

(Requirement 2-2)

It is easy to verify that the processes have been implemented inaccordance with the regulations.

(Requirement 3) Easily see the connections among the organizations, products, andservices that make up the supply chain(Requirement 3-1)

The connections among the organizations that make up the
supply chain can be easily identified.

(Requirement 3-2)

The generation and supply routes for products and services canbe easily identified.

3. Implementation methods
3-1. Classification of the trust formed in supply chains
The extent to which trust is formed in a supply chain depends on “the extent to which
it can verify the ability to meet expectations.” The scope of trust formation can beclassified into (1) and (2) below, depending on the scope of the entity (organization or
person) performing the verification.
(1) Private trust
This refers to the trust formed by being able to verify the ability to meet expectations
among entities within a specific limited scope. Examples are the relationships within
an organization, between organizations (e.g., client–order taker), and industry
associations, especially those with a participation/withdrawal process.
(2) Public trust
This refers to the trust formed by being able to verify the ability to meet an entity’s
expectations without limiting the scope. Examples are national, international, andother levels that are public in nature and have no explicit participation/withdrawal
process.

18
Copyright 2022, 2023 Japan Digital Trust Forum3-2. Concepts for realization
The Cyber Physical Security Countermeasures Framework [METI '19] realizes trust in
supply chains through the following ways:
・ Decomposing the process of manufacturing products and providing services into
six elements: “organization,” “people,” “components,” “data,” “procedures,” and“systems”;
・ Confirming with “Digital Evidence” that each of the six elements is “as expected,”
that is, “implemented in accordance with regulations”; and・ Ensuring that confirmation results can be queried and shared within the supply
chain.
In this white paper, based on the requirements presented in section V-2, the following
items must be implemented to realize trust in the supply chain (Figure V-1):(1) Verify that each aspect has been implemented in accordance with the various
regulations,(Note)(2) Make it possible for a third party to query the results of (1) and the “Digital
Evidence,” and(3) Make it possible to create connections with and trace item (2) above.
(Note: The “regulations” here are assumed to be appropriate and correct, and agreed upon
to the extent that they form trust.)

In this white paper, not only the process of manufacturing products and providing
services, but also their outputs, products and services, are assumed to consist of the six
elements.

Parts

Company A

Company B

Company C

Organization

Organization

Org.

People Things

Product
Service

People Things

Procedures

Procedures

Data Systems

Data Systems

Product
Service

Product
Service：Six elements：Connections of products/services

Figure V-1 Visualization of a supply chain consisting of six elements
19
Copyright 2022, 2023 Japan Digital Trust ForumConcrete examples of the six elements that make up the supply chain “as expected” and“implemented according to regulations” (see Figure V-1)are presented below.
(Examples)
Organization, people:

Companies and individuals qualified and authorized toperform work or operations

Components, systems:

Components that are calibrated and inspected, systems thatare authorized

Data:

Data (manufacturing schematics, transaction data, etc.) thathave not been falsified

Procedures:

A series of tasks and operations that are performed according
to predefined procedures

Scopes 1–3, presented in Chapter II, are explained again below in terms of theaforementioned six elements.
(Scope 1) The process of value creation in the supply chain is in line with expectations⇒ Implement the six elements that make up the process of manufacturing products
and providing services, indicated by the red box (dashed lines) in Figure V-2, in
accordance with the regulations, and allow verification that they have been
implemented so.
(Scope 2) The value created in the supply chain is in line with expectations⇒ The products and services generated in the supply chain, indicated by the green
box (dashed lines) in Figure V-2, function according to specifications, and thedefined quality is ensured or can be confirmed.
(Scope 3) Ensure that value continues to be delivered as expected throughout the supply
chain⇒ The linkage of products and services, indicated by the purple box (dashed lines) in
Figure V-2, and the relationship between supply and demand are maintained, andproducts and services continue to be provided.

20
Copyright 2022, 2023 Japan Digital Trust ForumPartsCompany A

Company B

Organization

Organization

People Things

Product
Service

People Things

Procedures

Procedures

Data Systems

Data Systems

Company C
Org.
Product
Service

Product
Service：Range of (Scope 1)：Range of (Scope 2)：Range of (Scope 3)

Figure V-2 Ranges of Scopes 1–3
3-3. Overall picture of the realization methods
Table V-1 shows the information required to realize Requirements 1–3 as described in
Section V-2.
Table V-1 Information required to realize Requirements 1–3
Information

Role“TrustworthinessThis refers to information indicating that a product or service has been

Information”

implemented in accordance with regulations in the productmanufacturing or service provision process. This information isdisclosed to the supply chain members.

“DigitalThis refers to information providing evidence that the relevant rules

Evidence”

have been implemented accordingly. This information can be foundunder “Trustworthiness Information.”“LinkageThis refers to configuration information that shows the connection

Information”

between products and services provided by OEMs, suppliers, service
providers, and others, and the parts and services that make them up.
The composition of products and services can be traced throughout the
supply chain.

Next, the overall structure of trust in a supply chain is shown in Figure V-3 and thevarious elements are shown in Table V-2. The overall configuration consists of a “TrustStore,” “Digital Evidence Store,” “Trust as a Service (TaaS),” and “Base Registry,” andis realized as follows.


Organizations in the supply chain record information showing evidence that
21
Copyright 2022, 2023 Japan Digital Trust Forumproducts and services have been manufactured and provided in accordance withthe regulations, which constitutes “Digital Evidence,” and store suchinformation in a Digital Evidence Store.
“Trustworthiness Information,” which indicates that the product/service was
manufactured and provided in accordance with the regulations, and “Linkage
Information,” which indicates the composition of the product/service, arestored in the Trust Store.



By sending and receiving data to and from each other through TaaS, theauthenticity and integrity of the data, as well as the existence of the person,organization, person, or product from which the data were generated, could beverified.



In addition, the Base Registry would be used to ensure the accuracy and up-todateness of highly reusable data that are registered and published by publicorganizations and referenced in a variety of situations.

Supply chain

Organizations, people, components,
data, procedures, systems

Digital Evidence Store
Digital Evidence

Trust Store

Trust as a Service (TaaS)

BaseRegistry

Figure V-3 Overall structure of trust in a supply chain

22
Copyright 2022, 2023 Japan Digital Trust ForumTable V-2 Elements of trust in a supply chain
Element
Trust

FeaturesThis stores the “Trustworthiness Information” of organizations, people,

Store

components, data, procedures, and systems required for manufacturing andproviding products and services, as well as the “Linkage Information” ofproducts and services.
The “Trustworthiness Information” in the supply chain can be searched bytracing the “Linkage Information.”
In principle, the stored information would be made publicly available to those
involved in the supply chain but may be kept private depending on the use
case.

DigitalThis stores information (“Digital Evidence”) that serves as the basis for

Evidence

confirming the implementation results in accordance with previouslyStoreagreed-upon rules and regulations.
This could be referred to by following the “Trustworthiness Information.”
In principle, the stored information is not public, but it may be disclosed to
the requester upon request.

TaaS

This connotes being able to verify the authenticity and integrity of the data
and being able to verify the existence of organizations, people, andproducts.

Base

Data that are registered and published by public organizations and reusable

Registryin a variety of situations are stored here.
The accuracy and up-to-dateness of the stored data is ensured.

3-4. Trust Store and Digital Evidence StoreThe Trust Store and Digital Evidence Store in the realization methods shown in theprevious section are similarly described in an existing document [IIC '21] as a way toachieve trust in a supply chain. The contents are presented below.
(1) Outline
An overview of the supply chain trust realization methods described in the existing
document [IIC '21] is shown in Figure V-4. The Trust Store and Digital Evidence Store
described in the previous section are synonymous with the Trust Store and “Digital
Evidence” in [IIC '21].

23
Copyright 2022, 2023 Japan Digital Trust ForumFigure V-4 Overview of Trust Store and Digital Evidence Store [IIC '21] Figure 4-8
Note: “Digital Evidence” is referred to as Digital Evidence Store in the text.
According to [IIC '21], a supply chain is constructed over the life cycle of a product orservice, including its manufacturing and delivery processes, BtoB transactions, andmaintenance and servicing. The Trust Store stores certificates (Certificate in the figure)indicating that the organizations comprising the supply chain (Organizations A, B, andC in the figure) provide products or services (Products A, B, and C in the figure) as
output in line with expectations. In addition, the Trust Store stores “Linkage Information”(Linkage Information in the figure) that shows the linkage of transactions between
organizations, of components and materials of products, and of supply and demand ofservices, and traces the linkage of certificates for organizations, products, and services.
The Digital Evidence Store stores “Digital Evidence” (Digital Evidence in the figure) thatprovides evidence that the product manufacturing and service provision processes werecarried out as expected.
(2) Realization methods
Specific ways to achieve trust in a supply chain based on (1) above are shown in Figure
V-5. For simplicity, this figure shows only a portion of the supply chain.
In the figure, each organization confirms with the log recorded in the manufacturing
process that it has been implemented in accordance with the regulations and stores the“Digital Evidence.” Then, “Trustworthiness Information,” which is the information
showing that the product/service was implemented in accordance with the regulations in
the product manufacturing or service provision process, and “Linkage Information,”24
Copyright 2022, 2023 Japan Digital Trust Forumwhich shows the composition of the parts/products confirmed in the implementation
check, are stored in the Trust Store. The “Trustworthiness Information” of theparts/products manufactured by each organization is linked with the “Linkage
Information.” In addition, “Digital Evidence” that supports the “TrustworthinessInformation” is traceable from the “Trustworthiness Information.”In this way, it is possible to confirm with the “Trustworthiness Information” that eachorganization has followed the regulations, and have “Digital Evidence” that is the basisof the “Trustworthiness Information.” Then, by tracing the “Linkage Information,” it ispossible to confirm that the entire supply chain has followed the regulations.
The Trust Store manages and makes searchable the linkage of the “TrustworthinessInformation” based on the “Linkage Information” that indicates the composition of eachcomponent and product. This Trust Store allows the user to trace the connections
upstream and downstream in the supply chain.

Supply chain

Organizations, people, components, data, procedures, systems
Product A

Product B

Org. A

Product C
Org. C

Org. B
Data A

Rules
Implementation
verification

Log

Implementation
verification

Implementation
verification

Inquiry

Linkage worthinessInformation Information

BOM of
Part APart A

BOM: Bill of Materials

デジタルエビデンス
デジタルエビデンス
Digital Evidence

Evidence

Evidence

Trust-

Rules
Log

デジタルエビデンス
デジタルエビデンス
Digital Evidence
デジタルエビデンス

デジタルエビデンス
デジタルエビデンス
Digital Evidence

Data C

Data B
Rules

Log

SearchResultUser

TrustLinkage
Information worthinessInformation

BOM of
Part B

Inquiry
SearchResultPart B

Evidence

TrustLinkage
Information worthinessInformation

BOM of
Part C

SearchResultInquiry

Part C

Trust Store

Figure V-5 How to use the Trust Store ([IIC '21] Additions to Figure 4-8)
In addition, Figure V-4 and Figure V-5 describe a single Trust Store, but a Trust Store
25
Copyright 2022, 2023 Japan Digital Trust Forummay be composed of multiple entities, such as a company unit or industry unit, and not
limited to this implementation form. Even in such a case, it must be possible to achieve
the same thing as above across companies and industries.
3-5. Trust as a Service (TaaS)(1) Outline
In the “White Paper Version 1 (2021.12.7)” [TaaS WP '21] issued by the Rule
Formation Committee of the Digital Trust Council, the following paragraph defines TaaS
as shown in Figure V-6.
TaaS is built on top of trust services such as electronic authentication, digital signatures,
remote signatures, eSeals, and time stamps that enable trust of data in cyberspace. Trust
services support the institutional effectiveness of the digitization of documents and seals.
In addition, TaaS has an ease-of-use function that enables organizations, people,
components, and systems that use TaaS to realize remote services and other ease-of-use
functions, thereby achieving robustness. The ease-of-use function is linked to the trust
service to realize robustness supported by institutional effectiveness. In addition, it has atrust application service, which provides services related to specific operations such as
electronic contracts and e-procurement. This trust application service, in conjunction
with the trust service or the ease-of-use function, achieves accuracy and certainty
supported by institutional effectiveness with respect to specific operations targeted by
the trust application. This TaaS can be used to ensure authenticity, i.e., that the data has
not been switched, integrity, i.e., that the data has not been tampered with, and realism,
i.e., that the counterparty is real.

26
Copyright 2022, 2023 Japan Digital Trust ForumEntity B

Entity A

Functions known atpresent

Functions whose details
Functions whose details will
will
be considered
be consideredin futurein
onthe
the
futurebasisonof thetheir bases
needs oftheir needs

Authentication/ Authorization
Authentication/authorization

TaaS
Functions to maketrust accessible⑤ Adjustment ofpolicyTrust Application
ServiceElectronic
contract① Elec. auth. ① e-delivery
Trust Service
トラストアプリケーションサービス① Websiteauth.

⑤ Interoperability⑤ Mitigation of
burden on users

Electronic
invoice③ Validity ofprocedure/System② Elec. sign.

② Remotesign.

② E-seal② Remote
e-seal

② Timestamp

Rules(Trust Application Service)④ Sign. ver.
service

Rules(common standards/particularrequirements)

SystemDigital system
Trust Application Service: Service with applied trust service
Trust Service: Electronic authentication, electronic signature, remote signature, electronic seal, timestamp, e-delivery,and so on
website authentication and signature verification service, etc.
Applications
Functions to make trust accessible: Auxiliary functions to make trust services accessible from theTrustTrust
Application
Service,services,
system services, and actual space according to intended purpose
TaaS: Trust as a Service
Elec. auth.: Electronic authentication
Sign. ver.: Signature verification

Figure V-6 How Trust as a Service works (adapted from [TaaS WP '21] Figure 15)(2) Realization methods
Requirement 1, described in the previous section on supply chain trust, is realizedusing TaaS. Organizations and consumers in the supply chain use TaaS to verify theauthenticity and integrity of data generated and exchanged in the supply chain, data
emitted from components, and the “Trustworthiness Information” stored in the TrustStore. In addition, TaaS is used to verify the existence of the organizations, people, andcomponents that generate the data. In this way, TaaS can be used to verify easily theauthenticity of data exchanged in the supply chain and the source of data generation.
3-6. Base Registry(1) Outline
Base Registry is defined in the “Comprehensive Data Strategy” [Comprehensive Data
Strategy '21] as “a database of society’s basic data on people, corporations, land, buildings,
qualifications, etc., registered and published by public organizations and referred to invarious situations, with ensured accuracy and up-to-dateness, which is the foundation ofsociety.”(2) Method of use
Figure V-7 shows how to use the Base Registry to achieve trust in a supply chain. The
Base Registry is used by organizations and consumers in the supply chain via TaaS. For
27
Copyright 2022, 2023 Japan Digital Trust Forumexample, by checking the Base Registry of a corporation, it is possible to check accurate
and up-to-date information, especially highly reusable data such as the existence oftrading partners, attribute information such as privacy marks, and data used in thepurchasing process.

that corporate• Confirmation
Confirmation of checkof corporateactivities
activities have been verifiedTo
the trust
infrastructurerefer
to opendata (privacy
To enable
achieve trust
infrastructure
to referto
open
attributedataattribute(privacy mark,ISO 9000, mark,ISO
ISO 9000, ISO 14000, etc.), data used for purchasing and other procedures are
14000,etc.),
data
used
for
purchasing
procedure,etc.
inadditiontoconfirmationofnecessary, in addition to confirming the existence of clients through coordinationwiththe corporate
registry.
existenceof client by basecoordination
with corporate base registry.

Corporate base registry

Infrastructure by
TaaS

CompanyA

Company
B
Distributor

Supplier

CompanyC
Distributor

Manufacturer

CompanyD
Distributor

Distributor

Wholesaler

CompanyE

RetailerEnd-user

Figure V-7 How to use a Base Registry to achieve trust in the supply chain (adaptedfrom [TaaS WP '21] Figure 25)
4. Information items handled with the supply chain trust
This section presents specific items of the “Trustworthiness Information,” “Digital
Evidence,” and “Linkage Information” that are necessary to realize trust in the supply chain.
These items, listed in V-2, are necessary to fulfill the requirements indicated in Section V2, and it is from this list that items should be selected for use, depending on the use case.
4-1. “Trustworthiness Information” items
The “Trustworthiness Information” items are shown in Table V-3.

28
Copyright 2022, 2023 Japan Digital Trust ForumTable V-3 “Trustworthiness Information”
No(Data) Item

R1

R2

(a)

Object identifier

〇

〇

(b)

Generation date
information

〇

〇

(c)

Generated locationand source
information

〇

〇

(d)

Information
confirming that data
have not beenfalsified or switched

〇

〇

(e)

Information verifyingthat the originator is
not fraudulent
Information
confirming that thedata existed at a
certain point in time
Regulation reference
information

〇

〇

〇

〇

(f)

(g)

(h)

Reference
information for
information as
evidence of conduct
in accordance withthe regulations

〇

〇

R3

Description- Information identifying the object of the“Trustworthiness Information”- The date and time when the “TrustworthinessInformation” was generated after the originator
confirmed that the product or service was
manufactured and provided in accordance with theregulations- The originator may be the organization that
manufactured or provided the product, or it may be
a third-party organization.
- Information identifying the organization, person,
or component from which the “TrustworthinessInformation” originates- For example, if the source is a third-party
organization, this refers to information identifying
the organization or person in the third-party
organization.
- Information confirming that the data in the“Trustworthiness Information” have remained
original and unaltered by anyone from the date andtime these were generated to the date and timethese were verified- Information confirming that there is no
fraudulent origin of the “TrustworthinessInformation”- Information confirming the existence of“Trustworthiness Information” at the date and timeof generation- Information that identifies the regulations to befollowed in the supply chain for products andservices- Information identifying the “Digital Evidence”
that serves as the basis for the implementation inaccordance with the regulations- This information includes information that
identifies the organizations, people, andcomponents that manufactured and provided
products and services in accordance with theregulations.
29
Copyright 2022, 2023 Japan Digital Trust Forum

(Legend) R1: Requirement 1, 〇: Items to be selected according to the requirements to be
fulfilled for each use case
4-2. “Digital Evidence” items“Digital Evidence” items are shown in Table V-4.
Table V-4 “Digital Evidence” items
No(a)(Data) Item
Object identifier

R1
〇

R2
〇

(b)

Generation date
information

〇

〇

(c)

Generated locationand source
information

〇

〇

(d)

Information
confirming thatthe data have notbeen falsified or
switched
Information
verifying that theoriginator is not
fraudulent
Information
confirming thatthe data existed ata certain point in
time
Regulationreference
information

〇

〇

〇

〇

〇

〇

- Information confirming the existence of “Digital
Evidence” at the date and time of generation〇- Information identifying the regulations to befollowed in the supply chain for products andservices

(e)

(f)

(g)

R3

Description- Information identifying the object of the “Digital
Evidence”- The date and time when the “Digital Evidence”
was generated after the originator confirmed thatthe product was manufactured or the service
provided in accordance with the regulations- The originator may be the organization that
manufactured or provided the product, or it may be
a third-party organization.
- Information identifying the organization, person,
or component from which the “Digital Evidence”
originated- For example, if the source is a third-party
organization, this refers to information that
identifies the organization or person in the thirdparty organization.
- Information confirming that the data in the“Digital Evidence” have remained original andunaltered by anyone from the date and time thesewere generated to the date and time these wereverified- Information confirming that there is no
fraudulent origin of the “Digital Evidence”

30
Copyright 2022, 2023 Japan Digital Trust Forum(i)Reference
information for
information as
evidence ofconduct inaccordance withthe regulations〇- Information providing the basis for the productmanufacturing or service provision process that has
been carried out in accordance with regulations(Legend) R1: Requirement 1, 〇: Items to be selected according to the requirements to be
fulfilled for each use case
4-3. “Linkage Information” Items“Linkage Information” items are shown in Table V-5.
Table V-5 “Linkage Information” items
No(a)(Data) Item
Object identifier

R1
〇

(b)

Generation date
information

〇

〇

(c)

Generated locationand source
information

〇

〇

(d)

Information
confirming thatdata have not beenfalsified or
switched
Information
verifying that theoriginator is not
fraudulent

〇

〇

(e)

〇

R2

〇

R3
〇

Description- Information identifying the object of the “Linkage
Information”- The date and time when the “Linkage
Information” was generated after the originator
confirmed that the product or service was
manufactured and provided in accordance with theregulations- The originator may be the organization that
manufactured or provided the product, or it may be
a third-party organization.
- Information identifying the organization, person,
or component from which the “Linkage
Information” originated- For example, if the source is a third-party
organization, this refers to information that
identifies the organization or person in the thirdparty organization.
- Information confirming that the data in the“Linkage Information” have remained original andunaltered by anyone from the date and time thesewere generated to the date and time these wereverified- Information confirming that there is no
fraudulent origin of the “Linkage Information”

31
Copyright 2022, 2023 Japan Digital Trust Forum

(f)

(j)

(k)

Information
confirming thatthe data existed ata certain point intime
Information
showing
connection to theorganization
Information
indicating supply
routes for products
and services〇〇

Information confirming the existence of the“Linkage Information” at the date and time ofgeneration〇- Information indicating the relationship between
the organizations with which one does business〇- Information indicating what parts, materials,
services, and others a product or service consists of,and where parts, materials, services, and others aresupplied from and to(Legend) R1: Requirement 1, 〇: Items to be selected according to the requirements to be
fulfilled for each use caseIn addition, in Table V-3 to V-5, (a) Object identification information is information that
identifies the object of each piece of information. For example, it may be information that
identifies “product/service (red dashed line)” itself in Table V-2 and the “process (green
dashed line)” that manufactures/provides the product/service.
5. Visualization of the goals to be realized
This section presents concrete images for realizing Goals 1–4 described in section V-1,
namely,(Goal 1)

Easily verify the trustworthiness of data generated and exchanged
throughout the supply chain,(Goal 2)Be able to select appropriate suppliers in response to changing needs andexternal environment,(Goal 3)

Easily understand the structure of the supply chain, and(Goal 4)Be able to explain compliance with rules throughout the supply chain.

5-1. Visualization of Goal 1
Goal 1 is achieved by assigning digital signatures to data and verifying the assigned
digital signatures. The granting and verification of digital signatures is realized using
TaaS. The trustworthiness of the data, as follows, can be easily verified: No tampering occurred after Supplier A generated the data, The source of the data is Supplier A, and The data existed at a certain point in time.
32
Copyright 2022, 2023 Japan Digital Trust ForumSpecifically, these are achieved through the following items of information:(d)Information confirming that the data have not been falsified or switched,(e)Information verifying that the originator is not fraudulent, and(f)

Information confirming that the data existed at a certain point in time.

How to check the trustworthiness of data using TaaS is explained in Figure V-8 (1)–(3).
(1) Supplier A provides a digital signature to the data.
(2) Supplier A sends the data and digital signature to Supplier B.
(3) Supplier B verifies that the digital signature is that of Supplier A.

Supply chain
Supplier A PartsＡ

Supplier B

attachData
Digital signature

Data

(2)

verify TaaS verification result: Successful
data originated by Supplier A:
Digital signature- No tampering from data generation- Data existed at a point in time
Data

Trust Store

(1)

(3)

Trust as a Service (TaaS)

BaseRegistry

Figure V-8 Visualization of the realization of Goal 1
5-2. Visualization of Goal 2
Goal 2 is to realize that the products manufactured by suppliers and the services they
provide have been implemented in accordance with the regulations, including the productmanufacturing and service provision process, by confirming the “Digital Evidence.”
Specifically, “Digital Evidence” is evidence that can be verified by the following items:(g)Regulation reference information and(i)Reference information for information as evidence of conduct in accordance withthe regulations.

How the supplier’s product manufacturing and service provision processes can be verified
by the “Digital Evidence” is explained in Figure V-9 items (1) through (2). The assumption
is that Supplier B is familiar with the product manufacturing and service provision
processes of Supplier A with whom it has already done business.
33
Copyright 2022, 2023 Japan Digital Trust Forum(1) Supplier B traces and obtains Digital Evidence D from Supplier D’s“Trustworthiness Information D” in order to check that Supplier D is able toimplement the same processes as Supplier A does in accordance with the regulations.
(2) Supplier B can confirm through Digital Evidence D that Supplier D’s processes canbe performed in accordance with the regulations.
The items above allow Supplier B to select Supplier D in response to changes in its needs
and the external environment.

Supply chain
OEM C

Supplier B

Supplier A
Part APart B

Product C
Part B
Part APart B

Product C
Part B
Part D

Supplier D

Rules

Part D

log
Execution
confirmation

Digital Evidence D(g) Regulationreference information(i) Reference
Confirm
information for
information as
evidence of conduct inaccordance with theregulations

Rules

(2)

log
Execution
confirmation

デジタルエビデンス
デジタルエビデンス
Digital
Evidence A

デジタルエビデンス
デジタルエビデンス
Digital
Evidence D

refer

refer

Digital Evidence D(1)
Trust Store

TrustworthinessInformation D

TrustworthinessInformation A

Trust as a Service (TaaS)

BaseRegistry

Figure V-9 Visualization of the realization of Goal 2
5-3. Visualization of Goal 3
Goal 3 is achieved by narrowing down the scope of influence of the cause of a problem inthe supply chain by tracing the supply route of the parts or services that caused the problem.
Specifically, the following items of the “Linkage Information” are used to narrow down thescope of influence:(j)

Information showing connection to the organization and(k)

Information indicating the supply routes for products and services.
34
Copyright 2022, 2023 Japan Digital Trust ForumThe “Linkage Information” allows us to narrow down the scope of impact. Figure
V-10 : Explanation of the “Linkage Information” illustrates how the scope of influencecan be narrowed down. Assume that a problem occurs in product C manufactured by
OEM C, and that the cause of the problem has been identified as component A.
The problem is caused by component A.
(1) OEM C queries the Trust Store for the part that uses part A. From the “Linkage
Information E,” OEM C confirms that supplier E’s part E uses part A.
(2) OEM C queries the Trust Store for products that use part E. From the “Linkage
Information F,” OEM C confirms that OEM C’s product F uses part E, that is, part A.
The items above confirm that OEM C’s Product F uses part A and that the problem withpart A spills over to product F.

Supply chain
Supp. Part B
BPart A

Supplier A
Part A

Cause

OEM
C

Supp. Part E
Part AE

Product C
Part B
Part A
Product F
Part EPart A

ProblemTrust Store
Linkage
Information A(j) Information
indicating connection
to the organization(k) Information
indicating supply
routes for products
and services

Linkage
Information C

Linkage
Information B(1)
Confirm

Narrowing down
the scope of impact

Linkage
Information E(2)

Confirm

Linkage
Information F

Trust as a Service (TaaS)

BaseRegistry

Figure V-10 Visualization of the realization of Goal 3
5-4. Visualization of Goal 4
Goal 4 is achieved by tracing the supply route of each product or service, to confirm
that it has been implemented in accordance with the regulations in the productmanufacturing and service provision processes of the entire supply chain. Specifically,“Trustworthiness Information,” “Linkage Information,” and “Digital Evidence” are used
to confirm that the entire supply chain has been implemented in accordance with theregulations in the product manufacturing and service provision processes.
35
Copyright 2022, 2023 Japan Digital Trust ForumHow the entire supply chain can confirm that the regulations have been implemented
in accordance with the regulations is explained in Figure V-11 items (1) through (2) andbelow. The assumption is that there are rules and guidelines that apply to the entire
supply chain, and that OEM C is familiar with the fact that its manufacturing and supply
processes follow these rules and guidelines.
(1) To understand the upstream suppliers, OEM C first traces “Linkage Information
C” to “Trustworthiness Information B” and then to Digital Evidence B to confirm thebasis on which Supplier B manufactured products according to the regulations.
(2) OEM C traces the information from “Linkage Information B” to “TrustworthinessInformation A” and further to Digital Evidence A, and confirms the evidence that
Supplier A manufactured the product in accordance with the regulations. Thereafter,
the confirmation is repeated in the same manner.
Rules/Guidelines

Supply chain

Supplier A

Rules

Supplier B

Digital
Evidence A
Confirm

Trust Store(2)Refer

Rules

Part A

Digital
Evidence B
Confirm

(1)

Refer

OEM C

Rules
Part B

User

Product C
Digital
Evidence C

Refer

TrustworthinessInformation A

TrustworthinessInformation B

TrustworthinessInformation C

Linkage Information
A

Linkage
Information B

Linkage
Information C

Trust as a Service (TaaS)

BaseRegistry

Figure V-11 Visualization of the realization of Goal 4
For example, if the visualization above is applied for the use case of carbon dioxide
emissions calculation, the “Trustworthiness Information” can confirm that the carbon
dioxide emissions are from Suppliers A and B and that they have not been falsified. The
correctness of the carbon dioxide emission values can also be verified with the “Digital
Evidence” from Suppliers A and B.

36
Copyright 2022, 2023 Japan Digital Trust ForumVI. Use cases
Use cases are described below.
1

Mechanisms to ensure the trustworthiness of data coming out of the equipment
Overview of Trust
In recent years, social infrastructure such as oil, electric power, and gas, as well asbuildings and factories, have been increasingly applying new technologies such as IoT
and AI to monitor and diagnose the status of component and facilities constantly fromremote locations to improve safety and efficiency. For example, manufacturers deliver
their products to businesses and have a predictive detection system that remotely
monitors the products and analyzes the data emitted from the products to detect
abnormalities at a predictive stage. This predictive detection system helps prevent
failures and accidents before they occur and identifies maintenance and tune-up services,
thereby allowing an accurate prediction of the remaining life of a component and theimplementation of repairs and replacements at the appropriate time. In such cases, if thedestination of data acquisition, timing of data acquisition, or data generated from theproduct is incorrect, the diagnosis results would also be incorrect. If an inappropriate
response based on incorrect diagnostic results causes a work stoppage, trust in themaintenance and tune-up services would also be lost. Therefore, it is important for
manufacturers to ensure the trustworthiness of the data produced by their products.
Before (issues)
Manufacturers are unable to confirm or verify whether data obtained from products
used by their businesses are trustworthy data. For example, in providing the maintenanceand tune-up services indicated above, there are currently no standards or guidelines todetermine what aspects or requirements must be met for data to be considered
trustworthy, or what level of trustworthiness is required. In addition, manufacturers
cannot demonstrate or verify to third parties that the services they provide based on thedata obtained from their products are supported by trustworthy data. Hence, there is arisk that some services may be operating under standards that are inappropriatecompared with international and technological trends.
After (goals)
Manufacturers and businesses can show or verify to third parties, based on guidelines
37
Copyright 2022, 2023 Japan Digital Trust Forumissued by governments and other organizations, that the work or services they perform
according to data obtained from the products they use are supported by trustworthy data.
The guidelines present the level of trustworthiness required according to the industry
sector and business type, and specify the requirements and standards necessary for eachlevel, so that companies can provide services whose trustworthiness is ensured.
Realization methods
An illustration of the realization of “trustworthy data” is shown below using the case ofmaintenance service. Figure VI-1 shows how to realize “Trustworthy Data” in the Trust
realization methods using TaaS in the supply chain shown in Figure V-3.

Supply chain

Organizations, people, components,
data, procedures, systems
Digital Evidence

Trust Store
Trust as a Service (TaaS)

BaseRegistry

Figure VI-1 How supply chain trust is realized in this use case
The aspects necessary for the trustworthiness of the data coming out of the equipment
are defined, and a use case is presented below in which the service provider provides aservice that satisfies these aspects.
Manufacturer A delivers Product A' manufactured by itself to Business Operator B,
remotely monitors Product A', and provides maintenance services based on the data
emitted from Product A'. Business Operator B defines and implements the aspects
necessary for trustworthiness of the data from Product A' equipment. The aspects
necessary for trustworthiness are items (i) and (ii) below.
(i) Definition of the aspects necessary for the trustworthiness of the data coming out of
equipment
38
Copyright 2022, 2023 Japan Digital Trust ForumThe existing document [Comprehensive Data Strategy '21] describes “aspects of datatrust” to replace physical space with data in the cyber world. In the section on “Aspectsof Data Trust,” it is mentioned that the components of physical space, such as who(subject/intention), what (facts/information), and when (time), must be correctly
reproduced as “aspects of trust” in cyberspace as well.
Therefore, to ensure trust by replacing data from a piece of “equipment” in physicalspace with data in the cyber world, trust in the details regarding (a) who, (b) what, and(c) when with respect to the equipment, as described below, are considered necessary.
(a) The user (organization) of the equipment is correct.
The “organization” using the equipment is correct (ensuring the trustworthinessof the entity using the equipment).
Example) Use of electronic signatures.

(b) The equipment is correct, as determined through:

Confirmation of the existence of the equipment and assurance of thetrustworthiness of the equipment,

Assurance by the manufacturing vendor who produced the equipment (that thecomponent

specifications[including

security],

manufacturing

process,versions/updates, and so on are valid),Trustworthiness of the products, that is,(α) Products are made by trustworthy manufacturers and(β) Products contain a private key corresponding to a certificate that can only
be produced by a trusted manufacturer.
Example)Key for data is set on a secure chip or other component using
a key for activation that is embedded prior to shipment by atrusted manufacturer

Example)Use of eSeals (to be listed in the extended area of the digital
certificate for eSeals)*The entity issuing the ID of the equipment depends on theuse case and the level of trust required (see below).

(c) “Existence and time,” which refers to the correct time of data generated by theequipment.
Proof that it existed at a certain point in time and has not been tampered withsince.
Example)Time-stamping
39
Copyright 2022, 2023 Japan Digital Trust ForumData from each sensor is time-stamped using TaaS.
(ii) Trust models according to the level of trust required to ensure trustworthiness
Regarding the mechanism for ensuring trust in the “components” and the mechanism
for ensuring trust, which is necessary to ensure the trustworthiness of data from a pieceof equipment as described in (1) above, trust is classified into two categories: (1) private
trust and (2) public trust, as described in Section V-3.
Private trust in (1) can be classified into the following four types, including public trust,depending on whether it is secured within an organization, between organizations, or at
the community level, such as industry associations (with participation and withdrawal
procedures) for shipping, medical care, and so on.
(a) Local private trust
Trust is secured through certificates issued by the company’s own certification
authority (CA) for products manufactured by the company.
(b) Peer trust
Trust is ensured between two parties: the business that manufactures the
product and the business that uses the product.
(c) Community trust
Trust is secured through certificates from the community, such as tradeassociations to which the company manufacturing the product belongs.
(d) Public trust
Trust is secured through a certificate from an official body.
Following are Cases 1 and 2 regarding ensuring trustworthiness.
(Case 1)(a) Example of local private trust
Step 1: Issuance of certificates
Concrete examples of the items of information to be generated in Step 1 are shownin Table VI-1.

40
Copyright 2022, 2023 Japan Digital Trust ForumTable VI-1 Concrete examples of items of information to be generated in Step 1
No

Information items

1“Trustworthiness Information”

2

Concrete examples
Certificate for Services(e) Information confirming that

Identifiable name of thethe originator is not fraudulent

private certification authority(CA) that issued thecertificate for the service

Currently, many institutions use their own CA. The use of manufacturer A’s own CA(hereinafter, “private CA”) operated by manufacturer A improves the trust for remotemonitoring and remote maintenance. Manufacturer A’s private CA holds the private CA’s
certificate and corresponding private key, and issues certificates for activation(certificates used for license authentication when activating product features) and forservices (certificates used to verify digital signatures granted to data generated byservices provided by the product).
Step 2: Digitally sign the data
Concrete examples of the items of information to be generated in Step 2 are shownin Table VI-2.
Table VI-2 Concrete examples of items of information to be generated in Step 2
No

Information items

1“Trustworthiness Information”

Concrete examples
Digital signature

2(a) Object identification information

Product A'

3(b) Generation date and time

Output date and time of

information

events, logs, and alerts(c) Location of generation and source

Business B

4

information
5(d) Information confirming that the

Digital signature withdata have not been falsified orcertificate for service

switched
6(e) Information confirming that theN/Aoriginator is not fraudulent
7(f) Information confirming that the

N/Adata existed at a certain point in time

41
Copyright 2022, 2023 Japan Digital Trust ForumWhen Manufacturer A manufactures Product A' using parts procured from suppliers
whose manufacturing processes and so on are trustworthy, and further installs ProductA' at Operator B and collects data from Product A', it does the following:
1.

Manufacturer A incorporates the certificate for activation issued by the private CA
and the corresponding private key into product A';

2.

Manufacturer A installs Product A' at Service Provider B and performs the activation
process using the private CA certificate and the certificate for activation. If theactivation process is successful, the certificate for service and the corresponding
private key issued by the private CA are incorporated into Product A'; and3.

Product A' digitally signs its own output data, such as events, logs, and alerts, withthe private key corresponding to the certificate for service and sends it to
manufacturer A.
Step 3: Digital signature verification
Concrete examples of the items of information to be generated in step 3 are shownin Table VI-3.
Table VI-3 Concrete examples of items of information to be generated in Step 3
No

Information items

1“Trustworthiness Information”

Concrete examples
Digital signature withcertificate for service2(d) Information confirming that

Digital signature verification

the data have not been falsified or

resultsswitched
Manufacturer A verifies the digital signature assigned to the output data using thecertificate for service assigned to product A'. If the verification result of the digital
signature is successful (i.e., the feature value of the output data and the signature value
match), the output data is accepted as trustworthy and used for the remote maintenanceservice. If the verification result is not successful, the output data is assumed to be
untrustworthy and is not used for the remote maintenance service, and a log of theacceptance of the untrustworthy output data is recorded.
Steps 1 through 3 describe (a) the case for ensuring trustworthiness in private trust.
Note that (a) if only private trust is valid, this means that business operator B does nottrust the certificate issued by manufacturer A’s private CA. Therefore, with the method
42
Copyright 2022, 2023 Japan Digital Trust Forumdescribed above, there is an issue that business entity B cannot technically verify thetrustworthiness of the data. However, it can be said that sufficient trust is ensured whenmanufacturer A limits the purpose to maintenance and so on, of the products it has
manufactured.
(b) If peer trust is valid, then business operator B can trust the certificate issued bymanufacturer A's private CA. Therefore, in the manner described above, business B canalso technically verify the trustworthiness of its products and data. However, individual
verification, contracts, and so on are required to confirm that the private CA istrustworthy.

Manufacturing process
Devices （manufacturer）
Private CA

In addition, check the credentials and activate→ Provision credentials for service

Devices（Owner/user/management
right holder）

Organization （manufacturer）
Products （devices when shipped）

Manufacturer A
Supplier

shipping

Private CA

Manufacturing, assembly

Organization (right holder)
Components （activated devices)
Data
Shipping,
installation,
activation

Embedding ofcertificates for
activation

Sensors, parts

Remote monitoring/
maintenance

StaticEvent, log, alert

Dynamic

Company B operating Product A’

Product A’（manufactured by A）

Manufacturing management,
equipment maintenanceOperation Data

Sensing data,
commands

Service certificate
Private key
Utilization data

Data utilization/analysis

Sharing

Other products
Remote maintenance

Figure VI-2 Examples of peer trust application (current status)
By additionally verifying the certainty of the data generation process, it is also possible
to demonstrate the correctness of the particular data, which can contribute to improving
the quality of maintenance and tune-up services.
(Case 2) (d) Example of public trust
Step 1: Issuance of certificate
Concrete examples of the items of information to be generated in Step 1 are shownin Table VI-4.

43
Copyright 2022, 2023 Japan Digital Trust ForumTable VI-4 Concrete examples of information items to be generated in Step 1
No

Information items

1“Trustworthiness Information”

2

Concrete examples
Certificate for Services(e) Information confirming that

Identifiable name of thethe originator is not fraudulent

third-party CA that issued
the certificate for the service

It is expected that in the future there will be cases of using third-party trust services.
The use of an intermediate CA operated by manufacturer A improves trust for remotemonitoring and remote maintenance. Manufacturer A is assigned the intermediate CA’s
certificate and corresponding private key, and the intermediate CA is assigned the root
CA and corresponding private key. The intermediate CA issues a certificate for activation
and a certificate for service.
Step 2: Digitally sign the data
Concrete examples of the items of information to be generated in Step 2 are shownin Table VI-5.
Table VI-5 Concrete examples of items of information to be generated in Step 2
No

Information items

1“Trustworthiness Information”

Concrete examples
Digital signature

2(a) Object identification information

Product A'

3(b) Generation date and time

Output date and time of

information

events, logs, and alerts(c) Location of generation and source

Business B

4

information
5(d) Information confirming that the

Digital signature withdata have not been falsified orcertificate for service

switched
6(e) Information confirming that theeSeal

originator is not fraudulent
7(f) Information confirming that theTime-stamping

data existed at a certain point in time
The remaining steps are the same as in Step 2 of (Case 1).

44
Copyright 2022, 2023 Japan Digital Trust ForumStep 3: Digital signature verification
Same as step 3 in (Case 1).
Steps 1–3 describe item (d) use of public trust to ensure trustworthiness.
If (c) community trust within a community, such as an industry association, isestablished, manufacturer B can trust the intermediate CA operated by manufacturer A
through the root CA if manufacturer A and operator B belong to the same community.
Furthermore, if (d) public trust is established, manufacturer B can trust theintermediate CA operated by manufacturer A through the root CA, even if manufacturer
A and operator B do not belong to the same community. Therefore, it can be expectedthat barriers to services using products and data will be lowered, thus encouraging the
emergence of new services.

Root CA

E-SealManufacturing process

Timestamp

Devices （manufacturer）

Public CA
Organization (right holder)
Components （activated devices)
Data

Organization (manufacturer)
Products (devices when shipped)

In addition, check the credentials and activate→ Provision of credentials for service

Device（Owner/user/management
right holder）

Root Certificate

shipping

Dynamic

Company B operating Product A’

Manufacturer A
Supplier
Intermediate CA

Staticshipping, installation,
activation

Product A’（manufactured by A）

Manufacturing
management,
equipment maintenanceOperation Data

Manufacturing, assembly

Embedding ofcertificates
for activation

Sensing data,
commands

Utilization data

Sensors, parts

Service certificate
Private key

Remote monitoring/
Maintenance

Event, log, alert

Sharing

Data utilization/analysis

Other products
Remote maintenance

Figure VI-3 Examples of public trust application
Which type of trust model out of (a), (b), (c), and (d) to use should be flexible, as thelevel of trust required depends on the business type, scale, and field.
For (i)-(a) “correctness of the user (organization) of the component (proof of theorganizations of service providers A and B)” in Cases 1 and 2 above, it is possible to use
an eSeal issued to service provider B by the root CA and so on (to be listed in the extended
area of the digital certificate for eSeal). In addition, for (i)-(c) “existence and time,” atime stamp may be used to verify that the information on time of data generated by the45
Copyright 2022, 2023 Japan Digital Trust Forumcomponent is correct. Moreover, it is necessary to consider the development of a systemthat encourages business operators A and B to use external (third-party) trust services
such as eSeals and time stamps (trust services being one of the components of TaaS),
and incentives such as subsidies for the CA operating costs of CA certification authorities.
Furthermore, it is necessary to consider various measures, such as entering into theframework of businesses that have already achieved peer trust, so that small and mediumsized enterprises (SMEs) and other entities that have difficulty establishing private CAs
will not be left behind in this mechanism.
By applying the realization methods discussed above, it can be easily verified that thecomponent indicated by the data from the product actually exists and that it is not
fraudulent, which can be used to diagnose the timing of maintenance and servicing. In
addition, by additionally verifying the certainty of the data generation process, it ispossible to demonstrate the correctness of the particular data, which can contribute toimproving the quality of maintenance services.
2

Efforts to reduce carbon emissions throughout the supply chain
Overview of TrustThis use case describes the situation of a vehicle manufacturer that illustrates theresults of a calculation of carbon dioxide emissions throughout the supply chain of a
product to demonstrate to society its efforts to reduce to zero the carbon dioxide
emissions in its supply chain.
To combat global warming, companies have a social responsibility to decarbonize theiroperations. Carbon dioxide emissions are measured by the Green House Gas Protocol(GHG Protocol),15 and as shown in Figure VI-4, supply chain emissions are defined as
Scope 1 (direct emissions), Scope 2 (indirect emissions), and Scope 3 (emissions otherthan Scopes 1 and 2 under 1-15 in Figure VI-4). Emissions are calculated by multiplying
the activity amount by the emissions intensity. The amount of activity is the amountrelated to the scale of the business’s activities, for example, the amount of fuel burned by
the business in Scope 1, the amount of electricity used by the business in Scope 2, andthe amount of cargo transported and waste disposed of in Scope 3. When considering theamount of fuel or electricity used by the company, it is sufficient to measure theconsumption of fuel or electricity. However, when considering the amount of activity

15

Greenhouse Gas Protocol, URL=https://ghgprotocol.org/
46
Copyright 2022, 2023 Japan Digital Trust Forumrelated to the transportation and delivery of cargo at other companies, it is necessary to
grasp the fuel consumption and loading capacity of transportation trucks as well, and thecalculation process must be confirmed along with the values of these activity quantities.
With regard to the calculation of such emissions, there is a movement in Europe
called the Life Cycle Assessment LCA Regulation,16 which evaluates the environmental
impact throughout the product life cycle, and it is expected that businesses operating inEurope will need to take action, including third-party certification.

Upstream

In-house

Scope 3

Scope 1 Scope 2

1. Purchased products
and services
2. Capital goods
3. Fuel and energy
activities not includedin Scopes 1 or 2
4. Transportation,delivery (upstream)
5. Waste from operations
6. Business trips
7. Employee commutes
8. Leased assets(upstream)

DirectIndirect
emissionsemissions(fuel(electricity
combustion)use)

Downstream

Scope 3
9. Transportation,delivery
10.Processing of soldproducts
11.Use of sold products
12.Disposal of soldproducts
13.Leased assets(downstream)
14.Franchise
15.Investments

Figure VI-4 Classification of supply chain emissions into Scopes 1–3 (figure taken from the
Ministry of the Environment Supply Chain Emissions Calculation)
Before (issues)
According to the Ministry of the Environment’s guidelines, 17 in addition to theconventional supply chain activities, it is necessary in Scope 3 to ascertain the amount ofactivities specific to the calculation of emissions, such as the amount of cargo transported
and waste treated; this is time-consuming and labor-intensive. In the future, theemissions calculation process is expected to require third-party certification and moreaccurate emissions values than in the past, owing to LCA regulations and other factors.
To comply with these requirements, businesses must accurately calculate emissions, anda third party must confirm with evidence the calculation of emissions for the entire supply

16

European Platform on Life Cycle Assessment (LCA),

URL=https://ec.europa.eu/environment/ipp/lca.htm
17

Ministry of the Environment, Green Value Chain Platform: For those starting to calculate

supply chain emissions (env.go.jp)
http://www.env.go.jp/earth/ondanka/supply_chain/gvc/supply_chain.html
47
Copyright 2022, 2023 Japan Digital Trust Forumchain, which requires time and man-hours for the calculation process. If the measurement
method, conditions, or data falsification of the data used for the calculation is evenpartially suspected, it will be difficult to ascertain and explain the actual situation.
After (goals)
Organizations in the supply chain can achieve the following by establishing regulations
for the processes involved in determining the amount of activity to calculate carbon
dioxide emissions, and by keeping records of implementation in accordance with thoseregulations:

Make it easy to confirm that the calculation process of activity amounts istrustworthy by collecting implementation records,

Be able to maintain records that can be verified for tampering with theimplementation records,

Easily and remotely explain with evidence the process of calculating the carbon
footprint of the entire supply chain and use it for third-party certification, and

Depending on the level of confidence required for the amount of activity,
establish a system that enables not only verification of the process and its
implementation records, but also verification of measurement components andmeasurements, and the presentation of data to ensure a higher level of confidence.

Realization methods
The realization methods are explained while showing the information items for thisuse case in Section V-4.
Step 1: Prepare regulations
Concrete examples of the items of information to be generated in Step 1 are shownin Table VI-6.
The vehicle module manufacturer shall define the manufacturing process of theElectronic Control Unit (ECU) in advance as module manufacturing regulations. The
manufacturing regulation shall include the calculation of carbon dioxide emissions
associated with the manufacturing activities. In the following sections, the rules arereferred to in (g) Reference information to rules.

48
Copyright 2022, 2023 Japan Digital Trust ForumTable VI-6 Concrete examples of items to be generated in Step 1
No

Information items

Concrete examples

1“Trustworthiness Information”

CO2 reduction certificate

2(g) Reference information toDocument number

regulations

corresponding to the module
manufacturing regulations to
reduce carbon dioxide
emissions to the prescribedtargetStep 2: Generate “Digital Evidence”
Concrete examples of the items of information to be generated in Step 2 are shownin Table VI-7.
Table VI-7 Concrete examples of items of information to be generated in Step 2
No
1

Information items“Digital Evidence”

Concrete examples
Implementation
Confirmation Result

2(g) Regulation reference

Document number to module

information

manufacturing regulations to
reduce carbon dioxide
emissions to the prescribedtarget3(i) Reference information for

Verified module

information as evidence of

manufacturingconduct in accordance with theimplementation records

regulations
As shown in Figure VI-5, modules are manufactured in accordance with theregulations, and the actual amount of various types of activity and the amount of carbon
dioxide emissions calculated by multiplying the amount of activity by the emission unit
are recorded as the implementation record. The module manufacturing regulations
and the module manufacturing implementation records are compared to confirm thatthe module manufacturing was carried out in accordance with the regulations. This
verification process shall be performed by the vehicle module manufacturer or a third
party. Once it has been confirmed that the module has been implemented in49
Copyright 2022, 2023 Japan Digital Trust Forumaccordance with the regulations, items (g) and (i) shall be recorded as “Digital
Evidence” for in-house verification.

Vehicle module supplierParts
purchasing

MCU

Scopes1 and 2

Vehicle modules
ECU

Modulemanufacturing process
ModuleModulemanufacturing manufacturing
Implementationlog
regulations

Memory：ECU：Engine Control Unit
MCU：Micro Control Unit

Activity
measurement
process(Fuel combustion+
power
consumption)

Activity
record(Fuel combustion+
power
consumption)

Trustworthinessinformation

Trust Store

Carbondioxideemissionscalculation
process

Digital
Evidence
Implementation
verification

Figure VI-5 Generating “Digital Evidence”

50
Copyright 2022, 2023 Japan Digital Trust ForumStep 3: Generate “Trustworthiness Information”
Concrete examples of the items of information to be generated in step 3 are shownin Table VI-8.
Table VI-8 Concrete examples of items to be generated in Step 3
No
1
2
3
4
5

6
7

8

9

Information items“Trustworthiness Information”(a) Object identification
information(b) Generation date and time
information(c) Location of generation andsource information(d) Information confirming thatthe data have not been falsified or
switched(e) Information confirming thatthe originator is not fraudulent(f) Information confirming thatthe data existed at a certain point
in time(g) Regulation reference
information(h) Reference information for
information as evidence ofconduct in accordance with theregulations

Concrete examples
CO2 reduction certificate
ECU Serial Number
Date of ECU production
Vehicle Module Supplier
Factory Name
Digital signature by a person
who has verified theimplementation
eSeal
Time-stamping

Document number to module
manufacturing regulations to
reduce carbon dioxide
emissions to the prescribedtargetDocument number to berecorded in the verified
module manufacturing
implementation record

The “Trustworthiness Information” is information that indicates the accuracy of the
carbon dioxide emissions emitted during the manufacturing process of the vehicle
module ECU. Items (a), (b), and (c) represent information that identifies the target
ECU, the date and time the “Trustworthiness Information” was generated, and theorganization that generated the “Trustworthiness Information,” respectively. To
indicate the accuracy of the carbon dioxide emissions, “Digital Evidence” is madeavailable for reference by items (g) and (h). The trustworthiness of these data isensured by items (d), (e), and (f).

51
Copyright 2022, 2023 Japan Digital Trust ForumStep 4: Generate “Linkage Information” (Bill of Materials, BOM of ECU) and store
it in the Trust StoreA Concrete example of the items of information to be generated in step 4 is shownin Table VI-9.
Table VI-9 Concrete examples of items to be generated in Step 4No(Data) items

1“Linkage Information”

2

Concrete examples
ECU Parts List(j) Information

N/A

showing connections
to the organization
3(k) Information

CO2 reduction certificate number forindicating supply

each ECU component

routes for products andservices
Figure VI-6To be able to calculate the carbon dioxide emissions extended to theentire supply chain as shown in Figure VI-6, items (j) and (k) are added and stored in
the Trust Store along with the “Trustworthiness Information.”
Step 1–4 above allow the accuracy of Scopes 1 and 2 of carbon dioxide emissions to
be demonstrated, as well as the accuracy of Scope 3 of carbon dioxide emissions for theentire supply chain. The “Trustworthiness Information” and “Linkage Information”
stored in the Trust Store allow for easy remote verification with evidence and are also
compatible with third-party certification.

52
Copyright 2022, 2023 Japan Digital Trust Forum

Trust Store

Parts
Material
Vehicle module
Vehicle OEM
supplier
manufacturer manufacturer
Linkage Information

Digital Evidence

Linkage Information

Digital Evidence

Linkage Information

Digital Evidence

Vehicle user

Disposer

Linkage Information

Linkage Information

Linkage Information

Digital Evidence

Digital Evidence

Digital Evidence

Carbon dioxide emissions Carbon dioxide emissions Carbon dioxide emissions Carbon dioxide emissions Carbon dioxide emissions Carbon dioxide emissions

Implementation
verification

Implementation
verification

Implementation
verification

Implementation
verification

Implementation
verification

Implementation
verification

Implementation log Implementation log Implementation log Implementation log Implementation log Implementation log
Production process(Activity measurement
process)
Manufacturing
implementation record(Activity record)

Production process(Activity measurement
process)
Manufacturing
implementation record(Activity record)

Scope 3

Production process(Activity measurement
process)
Manufacturing
implementation record(Activity record)

Scopes1 and 2

Production process(Activity measurement
process)
Manufacturing
implementation record(Activity record)

Production process(Activity measurement
process)
Manufacturing
implementation record(Activity record)

Production process(Activity measurement
process)
Manufacturing
implementation record(Activity record)

Scope 3Figure VI-6 Managing carbon emissions throughout the supply chain
As a supplement to the “Digital Evidence” in Step 2, it is also expected that there will
be cases where organizations in the supply chain will be required to have higher levels oftrustworthiness depending on the type of business and level of trustworthiness requiredby the application case and the level of trustworthiness required by the regulations.
For example, in ascertaining the amount of activity, digital data measured using
trustworthy sensors is more trustworthy than data collected visually by humans, in thesense that it is free from human error. Furthermore, the trustworthiness can be further
enhanced by guaranteeing that the “activity amount” (data) itself measured using sensors
has not been tampered with.
In other words, in use case (VI-1), a mechanism to ensure the trustworthiness of thedata coming out of the component and a mechanism to guarantee the “activity figures”
by establishing criteria for trusting the figures output by the sensors can be confirmed to
improve the trustworthiness further. Such a guarantee mechanism can be easily andinexpensively implemented through the use of TaaS. It is then desirable to be able toselect the appropriate means and level of trustworthiness depending on the nature of the
supply chain.

53
Copyright 2022, 2023 Japan Digital Trust Forum3

Identifying security measures throughout the manufacturing supply chain
Overview of TrustThis use case is an example of checking the security of the entire manufacturing supply
chain. Based on contracts with product suppliers, organizations in the supply chain are
obligated to deliver products with the contracted quality, delivery date, and price (the socalled QCD). In addition to QCD, the supply chain organization is also required, forexample, to implement security measures in the manufacturing process of the product.
In the case of the automotive manufacturing industry, an example is that German
automakers require organizations in the manufacturing supply chain to take security
measures to ensure that prototype vehicle design information is not leaked fromcontractors.
Before (issues)
To confirm that organizations in the manufacturing supply chain have implemented
security measures in the manufacturing process, it is necessary to check the
manufacturing regulations against what has been implemented based on thoseregulations, and it takes a lot of time and man-hours to confirm that the security measures
are appropriate. It then takes even more time and man-hours to confirm that the security
measures implemented throughout the entire manufacturing supply chain areappropriate.
After (goals)
The processes related to security that should be implemented by organizations
comprising the manufacturing supply chain should be defined as regulations; records of
implementation according to the regulations should be kept, and by collecting the records,
it can be easily verified that security measures have been implemented according to theregulations. In addition, the records of the implementation results should be managed
from the time they are recorded so that they can be later verified for tampering. This
makes it easy to confirm remotely, without spending time and man-hours, that security
measures implemented throughout the manufacturing supply chain have been carriedout in accordance with the regulations.
Realization methods
The realization methods are explained while showing the information items for this use
case in Section V-4.
54
Copyright 2022, 2023 Japan Digital Trust ForumStep 1: Prepare regulations
Concrete examples of the items of information to be generated in Step 1 are shownin Table VI-10.
Table VI-10 Information to be generated in Step 1
No

Information items

Concrete examples

1“Trustworthiness Information”

Manufacturing supply chain security
certificates2(g) Regulation

Document numbers to security

reference information

checklists to be implemented in the
manufacturing supply chain

The vehicle module manufacturer defines the manufacturing process of the vehicle
module in advance as module manufacturing regulations. The manufacturing rules
include security rules for the manufacturing process. The rules are referred to in (g)Reference information to rules in the following sections. The security rules include alist of daily security checks during the manufacturing process.
Step 2: Generate “Digital Evidence” (checklist results verified by a third party)
Concrete examples of the items of information to be generated in Step 2 are shownin Table VI-11.
Table VI-11 Information to be generated in Step 2
No
1
2

Information items

Concrete examples“Digital Evidence”

Checklist results verified by a third party(g) Regulation

Document numbers corresponding toreference information

security checklists performed daily inthe manufacturing supply chain

3(i) Reference

Checklist results

information for
information as evidenceof conduct inaccordance with theregulations

55
Copyright 2022, 2023 Japan Digital Trust ForumAs shown in Figure VI-7, modules are manufactured according to the regulations,and the results of security checks conducted in the module manufacturing process arerecorded as the implementation records. By comparing the module security regulations
with the module manufacturing implementation records, security checks are
conducted in accordance with the security regulations. The vehicle module
manufacturer or a third party shall confirm the implementation of the security check.
Once it is confirmed that the security checks have been conducted in accordance withthe regulations, item (g)(i) should be recorded as “Digital Evidence” so that it can bechecked in-house.

Vehicle module supplier

Vehicle modules

Parts
purchasing

MCU

MemoryMCU：Micro Control Unit

Manufacturing process
ModuleModulemanufacturing
manufacturing
regulations
Implementation log

Security
regulations

Security
verification
results

Trust Store

Security
implementation
records：
Digital
Evidence
Implementation
verification

Figure VI-7 Generating “Digital Evidence”
Step 3: Generate “Trustworthiness Information” (security certificates for the
manufacturing supply chain)
Concrete examples of the items of information to be generated in step 3 are shownin Table VI-12.

56
Copyright 2022, 2023 Japan Digital Trust ForumTable VI-12 Information to be generated in Step 3
No
1

Information items“Trustworthiness Information”

2(a) Object
identification
information(b) Generation date
and time information(c) Location ofgeneration and source
information(d) Information
confirming that the data
have not been falsified
or switched(e) Information
confirming that theoriginator is not
fraudulent(f) Information
confirming that the data
existed at a certain
point in time(g) Regulationreference information

3
4

5

6

7

8

9

(h) Reference
information for
information as evidenceof conduct inaccordance with theregulations

Concrete examples
Manufacturing supply chain security
certificates
ECU Serial Number

Date of ECU production
Vehicle Module Supplier Factory Name

Digital signature by a person who has
verified the implementation

eSeal

Time-stamping

Document numbers to security
checklists performed daily during the
manufacturing process
Reference information to confirmed
security checklist results

The “Trust Indication Information” is information indicating that security checks
have been correctly performed during the manufacturing process of a particular vehicle
module. Items (a), (b), and (c) are respectively the identification of the target vehicle
module, the date and time of generation of the “Trustworthiness Information,” and theorganization that generated the “Trustworthiness Information.” The “Digital Evidence”
in items (g) and (h) shall be available for reference to indicate that the security check
was performed correctly. The trustworthiness of these data is ensured in items (d), (e),and (f).

57
Copyright 2022, 2023 Japan Digital Trust ForumStep 4: Generate “Linkage Information” (list of trading partners in the supply chain)and store it in the Trust Store
Concrete examples of the items of information to be generated in step 4 are shownin Table VI-13.
Table VI-13 Information to be generated in Step 4
No
1
2

Information items

Concrete examples“Linkage Information”

List of supply chain trading partners(j) Information showing

Trading partners of each component

connections to theorganization
3(k) Information

N/A

indicating supply routes
for products andservices
As shown in Figure VI-8, items (j) and (k) should be added and stored in the TrustStore along with the “Trustworthiness Information” to enable confirmation that
security measures have been implemented throughout the supply chain.
Steps 1–4 above enable vehicle manufacturers to confirm the correctness of security
measures implemented in the manufacturing process, not only at the manufacturing
process of the vehicle module manufacturer from whom the vehicle manufacturer
receives supplies, but also at the upstream parts and component suppliers. With the“Trustworthiness Information” and “Linkage Information” stored in the Trust Store,
it is easy to confirm remotely that the security measures implemented throughout the
manufacturing supply chain are in compliance with the regulations, without spending
so much time and man-hours.

58
Copyright 2022, 2023 Japan Digital Trust ForumFigure VI-8 Managing security measures throughout the manufacturing supply chain
4

Usage scenarios and effects of Trust as a Service (TaaS)
Table VI-14 shows the effects of having TaaS in the use case (section VI-2).
Table VI-14 Use cases from having Trust as a Service (TaaS, section VI-2)
The Role of TaaS
Sender confirmation

Remote type data
integrity (digital
signature/remotesignature)

Usage scenarios in use cases,(Scope 3)
Used to identify registeredcompanies when registering
carbon dioxide emissions datawith the Trust Store

Used to record carbon dioxide
emissions data and its
confirmation results in the
Trust Store

Effects
Identification that the company
in question is the same
company that issued the
procurement contract/invoice(e.g., statement, invoice, anddelivery note)
After recording, one can seethat the data have not beenrewritten.

59
Copyright 2022, 2023 Japan Digital Trust ForumLegitimacy of theprocedure system(e.g., digital
signature, remotesignature, and timestamp)

Used to confirm the activity
measurement process in the
manufacturing supply chain
and the activity volume results
based on that process

Verification

Carbon emissions data
recorded in the Trust Store isused by organizations in the
supply chain for verification.
Used to build a system to takecharge of the activity
measurement process

User burden
reduction(ease ofimplementation andoperation)

The activity results of othercompanies used to calculate
carbon dioxide emissions arecalculated based on the correct
process, and the order ofactivities in the supply chain
can be traced.
Results of third-party
verification of carbon dioxide
emissions can be reused byother third parties.
For System Engineers invarious sites and processes inthe supply chain, it is possible
to establish an activity
measurement process with lesstime and man-hours, even
without expertise in digital
signatures and signature
verification.

Trust services do not guarantee the correctness of the data, but rather the authenticity ofthe organization, person, or thing that issued the data, the non-falsifiability of the data after
it is issued, and the non-repudiation that the data was issued by the originator. To estimate
whether the data are correct, it is important to show the attributes and context information of
the organization, person, thing, procedures, or systems from which the data originatedaccording to the purpose, to facilitate the evaluation of the trustworthiness of the originator.
For example, even if data that differ from the actual data are intentionally generated at thetime of data generation and protected by a trust service, the data user will not know whether
the contents of the data are incorrect, but by issuing the data through a checking mechanism
using correct procedures, incorrect operations on the data can be prevented. Such othermeans are necessary to evaluate the correctness of data contents; using “Digital Evidence”
and a Trust Store, listed under the realization methods in section V-3, are examples of suchmethods. It is also desirable to consider a platform that can combine such attribute proofing
services with conventional trust services and provide them as an integrated TaaS.

60
Copyright 2022, 2023 Japan Digital Trust Forum

VII. Recommendations
To establish the mechanism to realize trust in supply chains, which are widely used in society,we provide recommendations in terms of consensus building with various stakeholders anddissemination of the system.
Recommendation: Building consensus and ensuring international consistency to achieve
supply chain trustWhat society expects from supply chains include contributions to society and theenvironment, such as SDGs and ESG, and compliance with globally formed regulations
and rules. To meet society’s expectations and demands, we should actively promote
efforts such as setting up a forum to embody the following points and reach a consensus
as an industry group:-Rules and regulations imposed on the entire organization comprising the supply chainsas well as standards and guidelines to determine how far to go in implementing them;-The level of trustworthiness required for each industry and business type, and theconcept of trust formation;-Standards and guidelines to demonstrate to third parties the trustworthiness of dataexchanged along the supply chains;-Standards and guidelines to ensure the trustworthiness of data coming out of
equipment; and-Standards and guidelines for the smooth establishment of private trust.

Considering the global spread of supply chains in the product manufacturing and service
provision processes, the three requirements, arrangements for trust formation andconfirmation, and ideas presented under Section V. “Measures to resolve the issues” inthis white paper must be internationally accepted in the future. Therefore, Japan shouldtake the lead in ensuring international consistency among the relevant standardization
bodies and industry associations involved in industrial IoT.

Recommendations: Institutional support for the diffusion of supply chain trust and theformation of ecosystems


Achieving supply chain trust will increase costs for organizations in the supply chain,especially SMEs. Furthermore, even if only some organizations implement the system,
trust for the entire supply chain will not be realized. To solve these issues, it is necessary

61
Copyright 2022, 2023 Japan Digital Trust Forumto materialize benefits that are commensurate with the costs and incentives for allorganizations in the supply chain to work together.
In addition, to sustain trust, it is necessary to modernize the realization mechanisms
and ensure that they operate continuously. Specifically, it is important to form an
ecosystem in which the organizations that make up the supply chain invest on their own
to achieve benefits that exceed their own investments and grow their respective
businesses.
To materialize such incentives and create an ecosystem, there should be a forum to
discuss and formulate specific milestones and roadmaps, and examine what institutional
support and measures are possible in the short, medium, and long terms.


In realizing a supply chain-wide initiative, it is necessary to examine the technicalfeasibility and consistency across the various organizations and industries that comprisethe supply chain, and embody the value and effectiveness of the supply chain trust. To
this end, reference implementation of various functions should be conducted, and aforum should be created where various industries can collaborate to verify anddemonstrate the technology and value, and put them to practical use throughdemonstrations.

62
Copyright 2022, 2023 Japan Digital Trust ForumVIII. Conclusions
This document builds on the previous version, White Paper Version 1.0, by concretizing
the items of information handled in the supply chain and illustrating how these items areapplied in specific use cases.
To realize trust in supply chains, it will be necessary to define use cases and target industries,
and flesh out the contents and technical specifications of this white paper, such as:Shared descriptions of regulations and expectations, and details of implementation
checks;

Information to evaluate trustworthiness and how much risk of trust is acceptable;Concrete specifications for Trust Store and “Digital Evidence” utilization interface;Interface specifications for coordination between Trust Stores to enable multiple TrustStores to function together;Concrete specifications for overall coordination technology, including TaaS and BaseRegistry;Management technology for public key certificates for equipment, including ID
management methods for equipment; and

Secure key management technology for equipment.

63
Copyright 2022, 2023 Japan Digital Trust Forum