JP2006302299A - Image verification device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To verify whether image data generated by an image generating device such as a digital camera is altered or not while suppressing cost rise of the image generating device. <P>SOLUTION: The image generating device 10 generates the image data, a hash value of the image data and first verification data of the image data. A first verification device 30 performs verification whether or not the image data is altered using the hash value and the first verification data. When the image data is not altered, the first verification device 30 generates second verification data (a digital signature) of the image data. A second verification device 40 performs verification whether the image data is altered or not by using the image data and the second verification data. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an image verification system, an image verification apparatus, an image verification method, a program, and a recording medium for verifying whether image data generated by an image generation apparatus such as a digital camera has been altered.

In recent years, digital cameras that digitize and store optical images of subjects have been put into practical use.
While image data taken with a digital camera can be easily taken into a personal computer, there is a problem that it can be easily modified on the personal computer. Therefore, there is a problem that the reliability of the image data taken with the digital camera is lower than that of the silver salt photograph and the evidence ability is poor. Therefore, in recent years, a digital camera system having a function of adding a digital signature to image data taken by a digital camera has been proposed. A conventional digital camera system is disclosed in, for example, US Pat. No. 5,499,294 and Japanese Patent Laid-Open No. 9-2000730.

US Pat. No. 5,499,294 Japanese Patent Application Laid-Open No. 9-200730

A public key cryptosystem such as RSA cryptography is usually used for generating a digital signature. However, since public key cryptosystems such as RSA cryptography require power and remainder operations, high-speed processing is difficult, and processing times that are several hundred times to several thousand times that of common key cryptosystems such as DES are difficult. is necessary. For this reason, there is a problem that it is very difficult to generate a digital signature with the limited calculation resources of the conventional digital camera. There is also a method that greatly improves the performance of digital camera computing resources and makes it easy to generate a digital signature. However, this method is not preferable because the cost of the digital camera itself is greatly increased. .
The present invention has been made to solve the above-described problems, and can verify whether image data generated by an apparatus such as a digital camera has been modified while suppressing the cost of the image generation apparatus. An object of the present invention is to provide an image verification system, an image verification apparatus, an image verification method, a program, and a recording medium.

  An image verification system of the present invention is an image verification system having an image generation device, an information processing device, and a first image verification device, wherein the image generation device includes an image generation means for generating image data, A hash value generating means for generating a hash value; and a first verification data generating means for generating first verification data using the hash value and common information. And the first verification data to the first image verification device, wherein the first image verification device modifies the image data using the hash value, the first verification data, and the common information. First verification means for verifying whether or not the image data has been modified, and if the image data has not been modified, the hash value and secret information are used to Characterized in that it is a device having a second verification data generation means for generating a second verification data over data.

  The image verification apparatus according to the present invention uses the hash value of the image data generated by the image generation apparatus, the first verification data, and the common information to verify whether the image data has been altered. And verification data generation means for generating second verification data of the image data using the hash value and secret information when the image data is not altered.

  The image verification method of the present invention is a verification for verifying whether or not the image data has been modified using the hash value of the image data generated by the image generation device, the first verification data, and the common information. And a verification data generation step of generating second verification data of the image data using the hash value and secret information when the image data is not altered.

  The program of the present invention includes a verification procedure for verifying whether or not the image data has been modified using the hash value of the image data generated by the image generation device, the first verification data, and the common information. When the image data has not been modified, the computer executes a verification data generation procedure for generating second verification data of the image data using the hash value and secret information.

  The computer-readable recording medium of the present invention uses the hash value of the image data generated by the image generation device, the first verification data, and the common information to verify whether the image data has been altered. And a verification data generation procedure for generating a second verification data of the image data by using the hash value and secret information when the image data is not altered. Record.

  According to the present invention, it is possible to verify whether or not image data generated by an apparatus such as a digital camera has been modified while suppressing the cost of the image generating apparatus.

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram for explaining a configuration example of an image verification system according to the present embodiment.
The image generation apparatus 10 is an apparatus having a function of generating image data of a subject and a function of generating an image file with first verification data. The image file with first verification data is an image file including data such as image data, first verification data of the image data, additional information of the image data, and a unique ID of the image generation apparatus 10. The image generation apparatus 10 may be an imaging apparatus such as a digital camera, a digital video camera, or a scanner, or may be an apparatus having a camera unit. Further, the image generation apparatus 10 may be an apparatus such as a facsimile machine or a copying machine having an image reading unit.

  The information processing apparatus 20 is an apparatus having a function for causing the first verification apparatus 30 to verify an image file with first verification data and a function for generating an image file with second verification data. The image file with second verification data is an image file including data such as image data, second verification data of the image data, additional information of the image data, and a unique ID of the image generation apparatus 10. The information processing apparatus 20 may be an information processing apparatus such as a personal computer.

  The first verification device 30 is a device having a function of verifying whether image data has been altered using first verification data or the like. The first verification device 30 is also a device having a function of generating second verification data of image data when the image data is not altered. The first verification device 30 may be any device that is difficult to analyze and leak common information Kc and secret information Ks described later. Accordingly, the first verification device 30 may be, for example, an IC card (or a storage medium with a microprocessor) or a server computer having the information processing device 20 as a client. When the information processing apparatus 20 is a server computer, the first verification apparatus 30 and the information processing apparatus 20 are connected via a network such as a LAN, a wireless LAN, a WAN, or the Internet.

  The second verification device 40 is a device having a function of verifying whether image data has been altered using second verification data or the like. The second verification device 40 may be an information processing device such as a personal computer.

FIG. 2 is a block diagram illustrating a main functional configuration of the image generation apparatus 10 according to the present embodiment.
An image generation unit 201 includes an optical sensor such as a CCD (charge coupled device), a microprocessor, and the like, and generates image data I that is image data of a subject.
Reference numeral 203 denotes a memory for storing the common information Kc. This common information Kc is information corresponding to a common key in a common key cryptosystem (DES, Rinjdael, etc.).

Reference numeral 204 denotes an arithmetic unit that performs first and second arithmetic processing. The first calculation process is a calculation process that generates a hash value (also referred to as message digest or digest data) H11 of the image data I using the hash function HF1. The second calculation process is a calculation process for converting the hash value H11 generated in the first calculation process into the first verification data V11 using the common information Kc obtained from the memory 203. The first verification data V11 is data corresponding to the MAC (Message Authentication Code) of the image data I. The hash function HF1 may be any one of MD-2, MD-5, SHA-1, RIPEMD-128, and RIPEMD-160, or other hash functions.
Reference numeral 205 denotes a memory that stores a unique ID (for example, a manufacturing number or a serial number of the image generating apparatus 10) that is information unique to the image generating apparatus 10. This unique ID is added to the image file with the first verification data.

  Reference numeral 206 denotes an image file generation unit that generates an image file IF1 with first verification data. The image file IF1 with first verification data includes the image data I in the data portion, the hash value H11 of the image data I in the header portion, the first verification data V11 of the image data I, the additional information of the image data I, the image generation device It is an image file including data such as 10 unique IDs. Even if the file format of the image file IF1 with the first verification data is any one of JPEG (JPEG File Interchange Format), TIFF (Tagged Image File Format), and GIF (Graphics Interchange Format), it is an extension of them. Alternatively, other image file formats may be used.

Reference numeral 207 denotes a removable medium (detachable storage medium) such as a magnetic disk, an optical disk, or a memory card, and stores the image file IF1 with first verification data.
A media control unit 208 has a function of writing the first verification data-added image file IF1 to the removable medium 207 and a function of reading the first verification data-added image file IF1 from the removable medium 207.
An interface unit 209 transmits the image file IF1 with first verification data stored in the removable medium 207 to the information processing apparatus 20.
An operation unit 210 includes a switch for instructing generation, photographing, or reading of image data of a subject.
A control unit 211 includes a memory and a microcomputer that executes a control program stored in the memory, and controls operations of each unit of the image generation apparatus 10. In particular, the memory of the control unit 211 stores a program for controlling the processing procedure of the image generation apparatus 10 described in FIG.

FIG. 3 is a block diagram illustrating a main functional configuration of the information processing apparatus 20 according to the present embodiment.
A media control unit 301 reads the image file IF1 with first verification data from the removable medium 207.
Reference numeral 309 denotes an interface unit that receives the first verification data-added image file IF1 transmitted from the image generation apparatus 10.
A storage unit 302 stores the first verification data-added image file IF1 and the second verification data-added image file IF2.

A function 304 transmits the hash value H11, the first verification data V11, and the unique ID obtained from the image file IF1 with the first verification data to the first verification device 30, and the second verification transmitted from the first verification device 30. It is an interface unit having a function of receiving data V2 and a function of receiving a verification result of the first verification device 30. The second verification data V2 received by the interface unit 304 is added to the image file IF2 with second verification data.
Reference numeral 305 denotes an image file generation unit that generates the image file IF2 with the second verification data. The image file IF2 with the second verification data includes the image data I in the data portion, the hash value H11 of the image data I in the header portion, the second verification data V2 of the image data I, the additional information of the image data I, and the image generation It is an image file including data such as a unique ID of the device 10.

Reference numeral 306 denotes an interface unit having a function of outputting the image file IF2 with second verification data generated by the information processing apparatus 20 to an external device.
Reference numeral 307 denotes a display unit that displays information indicating the verification result of the first verification device 30.
A control unit 308 includes a memory and a microcomputer that executes a control program stored in the memory, and controls each function of the information processing apparatus 20. In particular, the memory of the control unit 308 stores a program for controlling the processing procedure of the information processing apparatus 20 described in FIG.

FIG. 4 is a block diagram illustrating a main functional configuration of the first verification device 30 in the present embodiment.
401 is a function of receiving the hash value H11, the first verification data V11 and the unique ID transmitted from the information processing apparatus 20, a function of transmitting the verification result of the first verification apparatus 30 to the information processing apparatus 20, and an information processing This is an interface unit having a function of transmitting the second verification data V2 generated by the device 20 to the information processing device 20.
Reference numeral 402 denotes a storage unit that stores the hash value H11, the first verification data V11, the unique ID, and the second verification data V2.

  Reference numeral 403 denotes a memory for storing the table T1. An example of this table T1 is shown in FIG. The table T1 is a management table that manages a plurality of unique IDs, common information Kc corresponding to each unique ID, and secret information Ks corresponding to each common information Kc. For example, when the unique ID is “001”, the common information Kc corresponding to this unique ID is “0x1111”, and the secret information Ks is “0x2222”. The common information Kc and the secret information Ks are information that is secretly managed by the first verification device 30 and are information that is not disclosed to the public. The secret information Ks is information corresponding to a secret key in a public key cryptosystem (such as RSA cryptography).

Reference numeral 404 denotes a first calculation unit that performs calculation processing for converting the hash value H11 into the first verification data V12 using the common information Kc.
Reference numeral 405 denotes an image verification unit that verifies whether the image data I has been altered using the first verification data V11 and the first verification data V12.
Reference numeral 406 denotes a second arithmetic unit that performs arithmetic processing for converting the hash value H11 into the second verification data V2 using the secret information Ks obtained from the memory 403. The second verification data V2 is data corresponding to the digital signature of the image data I.
Reference numeral 407 denotes a control unit that includes a memory and a microcomputer that executes a control program stored therein, and controls each function of the first verification device 30. In particular, the memory of the control unit 308 stores a program for controlling the processing procedure of the first verification device 30 described in FIG.

FIG. 5 is a block diagram illustrating a main functional configuration of the second verification device 40 according to the present embodiment.
Reference numeral 501 denotes an interface unit having a function of receiving the second verification data-added image file IF2 from an external device.
Reference numeral 502 denotes a storage unit that stores the second verification data-added image file IF2.
Reference numeral 503 denotes a memory for storing the table T2. An example of this table T2 is shown in FIG. The table T2 is a management table that manages a plurality of unique IDs and public information Kp corresponding to each unique ID. For example, when the unique ID is “001”, the public information Kp corresponding to this unique ID is “0x3333”. The public information Kp is information corresponding to the secret information Ks, and is information corresponding to a public key in a public key cryptosystem (such as RSA cipher).

Reference numeral 504 denotes an arithmetic unit that performs first and second arithmetic processing. The first calculation process is a calculation process for converting the second verification data V2 into the hash value H12 using the public information Kp. The second calculation process is a calculation process for generating the hash value H13 of the image data I using the hash function HF1.
Reference numeral 506 denotes an image verification unit that verifies whether the image data I has been altered using the hash value H12 and the hash value H13 obtained by the calculation unit 504.
Reference numeral 507 denotes a display unit that displays information indicating the verification result of the image verification unit 506.
Reference numeral 508 denotes a control unit that includes a memory and a microcomputer that executes a control program stored therein, and controls each function of the second verification device 40. In particular, the memory of the control unit 508 stores a program for controlling the processing procedure of the first verification device 30 described in FIG.

FIG. 6 is a diagram for explaining the processing procedure of the image verification system in the present embodiment.
Step S601: The image generation unit 201 generates image data I that is image data of a subject in accordance with an instruction from a user.
Step S602: The computing unit 204 generates a hash value H11 of the image data I using the hash function HF1.

Step S603: The computing unit 204 converts the hash value H11 into the first verification data V11 using the common information Kc obtained from the memory 203. The first verification data V11 is data corresponding to the MAC of the image data I.
Step S604: The image file generation unit 206 includes an image file with first verification data including data such as image data I, hash value H11, first verification data V11, additional information of the image data I, and a unique ID of the image generation device 10. IF1 is generated. The media control unit 208 writes the image file IF1 to the removable medium 207.

  Step S605: The user inputs the image file IF1 stored in the removable medium 207 to the information processing apparatus 20 via the removable medium 207 or the interface unit 209. When inputting via the removable medium 207, the media control unit 301 reads the image file IF1 from the removable medium 207 and stores it in the storage unit 302. On the other hand, when inputting via the interface unit 209, the interface unit 309 receives the image file IF 1 transmitted from the image generation apparatus 10 to the information processing apparatus 20 and stores it in the storage unit 302.

Step S606: When the first verification device 30 verifies the image file with the first verification data, the interface unit 304 transmits the hash value H11, the first verification data V11, and the unique ID to the first verification device 30. The interface unit 401 receives these data and stores them in the storage unit 402.
Step S607: The first calculation unit 404 refers to the table T1 in the memory 403, and acquires common information Kc corresponding to the unique ID obtained from the image file IF1.

Step S608: The first calculation unit 404 converts the hash value H11 into the first verification data V12 using the common information Kc obtained from the memory 403.
Step S609: The image verification unit 405 compares the first verification data V11 and the first verification data V12, and verifies whether or not the image data I has been altered.

  When the two first verification data match (that is, when the integrity of the image data can be verified), the image verification unit 405 detects that the image data I has not been altered. Further, the image verification unit 405 detects that the image data I is generated by the image generation apparatus 10. Then, the first verification device 30 notifies the information processing device 20 that the image data I has not been altered, and starts generating second verification data.

  On the other hand, when the two first verification data do not match (that is, when the integrity of the image data cannot be verified), the image verification unit 405 detects that the image data I is altered. To do. Then, the first verification device 30 notifies the information processing device 20 that the image data I has been altered, and prohibits the generation of the second verification data. In other words, the first verification device 30 prohibits the processes after step S610.

Step S610: When it is detected that the image data I has not been altered, the second calculation unit 406 refers to the table T1 in the memory 403 and acquires the secret information Ks corresponding to the unique ID.
Step S611: The second calculation unit 406 converts the hash value H11 into the second verification data V2 using the secret information Ks obtained from the memory 403. The second verification data V2 is data corresponding to the digital signature of the image data I. The second verification data V <b> 2 generated by the second calculation unit 406 is stored in the storage unit 402.
Step S612: The interface unit 401 transmits the second verification data V2 to the information processing apparatus 20. The interface unit 304 receives the second verification data V2 and supplies it to the file generation unit 305.

Step S613: The image file generation unit 305 generates an image file IF2 with second verification data including data such as image data I, second verification data V2, additional information of the image data I, and unique ID. The image file IF2 generated by the image file generation unit 305 is stored in the storage unit 302.
Step S614: The interface unit 306 outputs the image file IF2 generated by the file generation unit 305 to an external device. On the other hand, the interface unit 501 receives the image file IF2 from an external device and stores it in the storage unit 502.
Step S615: The computing unit 504 refers to the table T2 in the memory 503, and acquires the public information Kp corresponding to the unique ID obtained from the image file IF2.

Step S616: The calculation unit 504 converts the second verification data V2 into the hash value H12 using the public information Kp obtained from the memory 503.
Step S617: The calculation unit 504 generates a hash value H13 of the image data I obtained from the storage unit 502 using the hash function HF1.
Step S618: The image verification unit 506 compares the hash value H12 obtained in step S616 with the hash value H13 obtained in step S617, and verifies whether the image data I has been altered.

  When the two hash values match (that is, when the integrity of the image data can be verified), the image verification unit 506 detects that the image data I has not been altered. In addition, the image verification unit 506 detects that the image data I is generated by the image generation apparatus 10. Then, the second verification device 40 causes the display unit 507 to display information indicating that the image data I has not been altered.

  On the other hand, when the two hash values do not match (that is, when the integrity of the image data cannot be verified), the image verification unit 506 detects that the image data I has been altered. Then, the second verification device 40 causes the display unit 507 to display information indicating that the image data I has been altered.

As described above, according to the image verification system in the present embodiment, it is possible to reliably detect whether or not the image data generated by the image generation apparatus 10 has been altered.
Further, according to the image verification system in the present embodiment, it is not necessary to significantly improve the performance of the calculation resource of the image generation apparatus 10, and therefore the cost for the image generation apparatus 10 can be reduced.

Further, according to the first verification device 30 of the image verification system in the present embodiment, it is verified whether the image data has been altered using the common information Kc obtained from the unique ID of the image generation device 10. Whether or not the image data is generated by the image generation apparatus 10 can be confirmed.
Further, according to the second verification device 40 of the image verification system in the present embodiment, whether or not the image data has been modified using the secret information Ks and the public information Kp obtained from the unique ID of the image generation device 10. Therefore, it is possible to confirm whether or not the image data is generated by the image generation apparatus 10.
Further, according to the image verification system in the present embodiment, by realizing the first verification device 30 with an IC card (or a storage medium with a microprocessor) or a server computer with the information processing device 20 as a client, Analysis and leakage of the common information Kc and secret information Ks can be made difficult, and the security of these data can be improved.

In addition, according to the image verification system in the present embodiment, not the image data but the hash value of the image data (the data size is much smaller than the image data) is transmitted from the information processing apparatus 20 to the first verification apparatus 30. Therefore, the traffic between the information processing apparatus 20 and the first verification apparatus 30 can be reduced, the memory size required for the first verification apparatus 30 can be reduced, and the processing time in the first verification apparatus 30 can be greatly shortened. Can do.
In addition, according to the image verification system in the present embodiment, the generation of the image file with the second verification data is performed not in the first verification device 30 but in the information processing device 20. Can be reduced, and the cost of the first verification device 30 can be reduced.

This embodiment can be realized by a computer executing a program. Further, means for supplying a program to a computer, for example, a recording medium such as a CD-ROM in which such a program is recorded, or a transmission medium such as the Internet that transmits such a program can also be applied as an embodiment of the present invention. The above program, recording medium, and transmission medium are included in the scope of the present invention. As the recording medium, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.
It should be noted that each of the above-described embodiments is merely an example of a specific embodiment for carrying out the present invention, and the technical scope of the present invention should not be construed as being limited thereto. It is. That is, the present invention can be implemented in various forms without departing from the technical idea or the main features thereof.

It is a figure explaining the example of 1 composition of the image verification system in this embodiment. It is a block diagram explaining the main function structures of the image generation apparatus 10 in this Embodiment. It is a block diagram explaining the main function structures of the information processing apparatus 20 in this Embodiment. It is a block diagram explaining the main functional structures of the 1st verification apparatus 30 in this Embodiment. It is a block diagram explaining the main functional structures of the 2nd verification apparatus 40 in this Embodiment. It is a figure explaining the process sequence of the image verification system in this Embodiment. It is a figure which shows an example of table T1 and table T2.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Image generation apparatus 20 Information processing apparatus 30 1st verification apparatus 40 2nd verification apparatus

Claims (23)

An image verification system having an image generation device, an information processing device, and a first image verification device,
The image generation device includes:
Image generation means for generating image data;
Hash value generation means for generating a hash value of the image data;
A first verification data generation unit configured to generate first verification data using the hash value and the common information;
The information processing apparatus includes:
An apparatus for transmitting the hash value and the first verification data to the first image verification apparatus;
The first image verification device includes:
First verification means for verifying whether the image data has been modified using the hash value, the first verification data, and the common information;
When the image data is not altered, the image verification is characterized in that the apparatus has second verification data generation means for generating second verification data of the image data using the hash value and secret information. system.   The image verification system according to claim 1, wherein the common information is information corresponding to a common key in a common key cryptosystem.   The image verification system according to claim 1, wherein the secret information is information corresponding to a secret key in a public key cryptosystem.   4. The image verification system according to claim 1, wherein when the image data is altered, the second verification data generation unit prohibits generation of the second verification data. 5. . The image verification system further includes a second image verification device,
The second image verification device includes:
5. The apparatus according to claim 1, wherein the image data, the second verification data, and public information are used to verify whether or not the image data has been modified. 5. The image verification system according to any one of claims.   The image verification system according to claim 5, wherein the public information is information corresponding to a public key in a public key cryptosystem.   The image verification system according to claim 1, wherein the image generation apparatus is a digital camera, a digital video camera, a scanner, a facsimile apparatus, or a copying machine.   The image verification system according to claim 1, wherein the first image verification device is an IC card or a storage medium with a microprocessor.   The image verification system according to claim 1, wherein the first image verification apparatus is a server computer that uses the information processing apparatus as a client. Verification means for verifying whether or not the image data has been modified using the hash value of the image data generated by the image generation device, the first verification data, and the common information;
An image verification apparatus, comprising: verification data generation means for generating second verification data of the image data using the hash value and secret information when the image data is not modified.   The image verification apparatus according to claim 10, wherein the common information is information corresponding to a common key in a common key cryptosystem.   The image verification apparatus according to claim 10 or 11, wherein the secret information is information corresponding to a secret key in a public key cryptosystem.   The image verification apparatus according to claim 10, wherein when the image data is altered, the verification data generation unit prohibits generation of the second verification data.   The image verification apparatus according to claim 10, wherein the image verification apparatus is an IC card or a storage medium with a microprocessor.   The image verification apparatus according to claim 10, wherein the image generation apparatus is a digital camera, a digital video camera, a scanner, a facsimile apparatus, or a copying machine. A verification step of verifying whether the image data has been modified using the hash value of the image data generated by the image generation device, the first verification data, and the common information;
And a verification data generation step of generating second verification data of the image data using the hash value and secret information when the image data is not altered.   The image verification method according to claim 16, wherein the common information is information corresponding to a common key in a common key cryptosystem.   The image verification method according to claim 16, wherein the secret information is information corresponding to a secret key in a public key cryptosystem.   19. The image verification method according to claim 16, wherein, when the image data is altered, the verification data generation step prohibits generation of the second verification data. 19.   The image verification method according to claim 16, wherein the image verification method is executed by an IC card or a storage medium with a microprocessor.   21. The image verification method according to claim 16, wherein the image generation apparatus is a digital camera, a digital video camera, a scanner, a facsimile apparatus, or a copying machine. A verification procedure for verifying whether the image data has been modified using the hash value of the image data generated by the image generation device, the first verification data, and the common information;
A program for causing a computer to execute a verification data generation procedure for generating second verification data of the image data using the hash value and secret information when the image data is not modified. A verification procedure for verifying whether the image data has been modified using the hash value of the image data generated by the image generation device, the first verification data, and the common information;
If the image data has not been modified, a computer-readable recording of a program for causing a computer to execute a verification data generation procedure for generating second verification data of the image data using the hash value and secret information Recording medium.

Images