The Dual Ownership Model: Using Organizational Relationships for Access Control in Safety Supply Chains

Abstract

Counterfeits and contaminated drugs are recognized as a threat to consumer safety. To fight counterfeiting and protect consumers, public health institutions such as the US FDA demand organizations to electronically document the pedigrees of prescription drugs [3]. As the documentation process involves joint collaborations of multiple organizations along the supply chain on electronic pedigrees for billions of individual goods, new and scalable access control models are needed. Therefore, this paper presents a novel concept, which leverages existing organizational relationships to manage access control based on physical possession. The concept is evaluated against other existing models and discussed.

The impact of perceived privacy risks on organizations’ willingness to share item-level event data across the supply chain

“…Although it is understood that the reluctance to share fine-granular data might hamper the adoption of tracking infrastructures and tracking based applications, only few possible explanations for the reluctance to share item-level event data exist. Privacy risks were identified as a main factor affecting companies' willingness to share item-level data [11,18,19]. The willingness to share data is lower the more expected negative consequences of a potential risk are realized.…”

“…This is partly due to the fact that the infrastructure needed to capture and distribute item-level data has not been fully developed yet. Additionally, it is reported that companies are reluctant to share itemlevel data with their business partners, competitors and organizations unknown to them [8,11]. Particularly privacy risks, which go along with shared event data, are suited to restrain enterprises' willingness to share item-level event data across the supply chain.…”

Object circles

“…In the context of RFID in supply-chains, Dual ownership [3] suggests to link access to data of physical goods to the actual physical flow of those. Thus, whoever holds the products in her hands proves the ownership of a product by RFID or barcode and gets access granted to the corresponding data of the product.…”

Protecting Sensitive Business Information While Sharing Serial-Level Data

“…In the business world, such sensitive information is described as the knowledge that can provide competitive advantages, and therefore must be protected [23]. Sensitive business information can be any information that [1,3,14]: releases strategic information (e.g., information that can be used during negotiation phases, like volumes, prices, etc. ), reconstructs strategic connections (i.e., it reveals strategic relationships of a company, and helps to identify its important partners and channels), uncovers unfair behaviors or inefficiencies (from the point of view of the cheater), and helps to identify distribution channels (i.e., identification of the most important supply routes, or the exact locations of high-value consignments).…”

“…However, partners are reluctant to easily share information related to observations of serial-level-tagged goods (i.e., serial-level data); they have concerns about the possible misuses of this information [3], and in particular, they fear that serial-level data can be used to infer sensitive business information [14]. That is, they fear that sharing serial-level data can cause a leakage of sensitive business information.…”