Cloud Security Perspectives and Insights

How Blockchain-based Identity Management is Disrupting Supply Chains

With Halloween approaching rapidly, a bit of trivia on US candy consumption is worth noting. Americans purchase a whopping 600 million pounds of chocolate each year during Halloween1. But that’s a fraction of the total US consumption of chocolate each year, which happens to be about 22 pounds per American. Clearly, the US towers over many other countries in its sheer appetite for chocolate. But did you know that two-thirds of the world’s cocoa production –so essential for chocolate production – comes from West Africa?  An estimated 2 million children2 are employed in the cocoa industry in West Africa – kids ranging between 5 and 15 years of age.

If I’ve just killed your Halloween appetite, maybe join forces with us and invent a modern solution to this problem. Enterprises worldwide are struggling to gain insights into their supplier networks to find answers to these sorts of questions – how many of their suppliers honor ethical child labor laws? Which suppliers comply to local environment regulations? Which suppliers can companies rely on to honor anti-bribery laws with local governments?

So far, the answers to these questions have been really hard to get for most companies, not because of lack of intent, but because of sheer complexity of today’s supply chain networks. Many industries rely on complex multi-tier networks with several suppliers in each tier, distributed across large geographical regions. Tracking and verifying the latest status of certifications and regulatory compliance for each supplier is an onerous and expensive task. Even if such data is painstakingly aggregated, it tends to go stale rapidly since many of these certifications are designed to expire every few years.

Today, many companies are exploring blockchain as a potential solution to build modern supply chain networks that are transparent to manage across multiple organizations. Blockchain technology particularly excels at allowing organizations who may not have an explicit trust relationship between them, to mutually share information in a reliable manner. This could help in storing information about suppliers, including their various industry accreditations or certifications, all duly verified and endorsed by various validating authorities. Such a decentralized network would require suppliers, validating authorities, and relying parties that depend on the certifications to share information between each other.

For Identity Management professionals, such decentralized applications pose several implementation challenges. Traditional protocols like Federation are not designed to exchange decentralized sets of attributes, attestations and entitlements between untrusted organizations. Instead, a new set of Identity Management protocols and data exchanges are required to exchange shared identities, while at the same time storing sensitive information off-ledger, protected by appropriate cryptographic keys and key management.

A decentralized Identity Management implementation will help organizations with the following:

  • Allow suppliers to manage the accuracy of their identities stored on and off-ledger in a local identity “wallet”. When information about them changes, they own the responsibility of updating the necessary information.
  • Enable industry authorities to digitally attest the validity of supplier identities and corresponding accreditations and certifications. This would serve as proof of the certification claims to all participants authorized to read the information.
  • Allow organizations to query the decentralized network for accurate information about suppliers meeting their desired criteria, like geographical location, size or type.

Here at Oracle, we are working with several customers to build decentralized identity management on Oracle Cloud for such applications. At Oracle Open World 2018, we’ll demonstrate one such application built by a global healthcare company for their procurement risk management needs and its underlying architecture. If you are responsible for managing identities for traditional supply chain networks and would like to explore new blockchain-based solutions, be sure to come check out our session (Architecting Decentralized Identity Networks Using Blockchain on Oracle Cloud) on Wednesday, Oct 24 at 4:45 pm.

Subbu Iyer, Sr. Director of Product Management for Oracle Cloud Security, and Prateek Mishra, Architect and creator of the SAML standard, will talk about architecting blockchain-based decentralized Identity Management.


1: https://visual.ly/community/infographic/food/how-much-candy-do-we-eat-halloween
2: https://ilpi.org/wp-content/uploads/2015/11/20151126-Child-labour-in-the-West-African-Cocoa-Sector-ILPI.pdf

Join the discussion

Comments ( 1 )
  • Thirumani Tuesday, October 23, 2018
    Good one Subbu... looking forward to the demo...
Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.