Data processing device, data processing method, and program

Abstract

To prevent a failure in sensing presence / absence of falsification on image data due to deletion of an electronic signature for sensing the presence / absence of falsification on the image data from the image data.SOLUTION: A hash value of captured image data (metadata) is computed, and the computed hash value is encrypted by a secret key to generate an electronic signature. Then, the generated electronic signature is stored in a SEI frame supported by H.264 or H.265, and image data storing the electronic signature is saved in an external nonvolatile memory, while the electronic signature is also saved in an access-limited, non-detachable nonvolatile memory.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a data processing device, a data processing method, and a program. [Background technology]

[0002] In recent years, it has become easy to edit and falsify (hereinafter simply referred to as falsification) image data using smartphones, personal computers, etc., resulting in a finish that is so natural that it is impossible to tell with the human eye whether the image data has been falsified. Therefore, in use cases or situations where the evidentiary value of image data is in question, it is becoming increasingly important to technically guarantee that the image data has not been falsified, starting from a state in which it has been captured by a reliable camera with guaranteed security.

[0003] Furthermore, when adding a function to detect falsification of image data captured and saved by a camera, it is impossible to eliminate the possibility that falsification may occur between the time the image data is saved and the time the falsification detection function is added. In such a case, it becomes technically impossible to prove that the image data has not been falsified since it was captured by the camera. Therefore, it is very important to add a function to the camera that detects falsification of image data at the stage when the image data is captured by the camera.

[0004] For example, there is known a technology for providing evidential properties to image data within a camera. Patent Document 1 discloses a technology for generating an electronic signature within a camera to verify whether image data has been tampered with, and transmitting the image data together with the electronic signature. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2017-41841 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the conventional technology disclosed in Patent Document 1, the process of protecting the electronic signature is not performed within the camera, so if a third party deletes the electronic signature from the image data, the image data cannot be used as evidence, and it becomes impossible to detect whether the image data has been tampered with.

[0007] In view of the above-mentioned problems, the present invention aims to prevent a situation in which it becomes impossible to detect whether or not image data has been tampered with due to the electronic signature for detecting whether or not image data has been tampered with being deleted from the image data. [Means for solving the problem]

[0008] The data processing device of the present invention is characterized by having a generation means for generating an electronic signature from image data output from an imaging means for detecting whether or not the image data has been tampered with, and a storage means for storing the electronic signature generated by the generation means and the image data in a first storage means, and for storing the electronic signature in a second storage means having access restrictions. Effect of the Invention

[0009] According to the present invention, it is possible to prevent a situation in which it becomes impossible to detect whether or not image data has been tampered with due to the digital signature for detecting whether or not image data has been tampered with being deleted from the image data. [Brief description of the drawings]

[0010] [Figure 1] 1 is a block diagram showing an example of the internal configuration of a wearable camera according to an embodiment. FIG. [Diagram 2] 5 is a flowchart illustrating an example of a processing procedure for generating a digital signature and storing it in a non-volatile memory in the first embodiment. [Diagram 3]13 is a flowchart illustrating an example of a processing procedure for generating a digital signature and storing it in a non-volatile memory in the second embodiment. [Figure 4] 13 is a flowchart illustrating an example of a processing procedure for generating a digital signature and storing it in a non-volatile memory in the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings. In the following embodiments, as an example, a hash value of captured image data (metadata) is calculated to generate an electronic signature, and the electronic signature is stored as an SEI message of H.264 or H.265. In addition, in a wearable camera as an example of a data processing device, an example will be described in which an electronic signature is also stored in a memory area with access restrictions in the wearable camera. Note that the wearable camera is just one example, and other cameras may be used.

[0012] (First embodiment) Fig. 1 is a block diagram showing an example of the internal configuration of wearable camera 100 according to this embodiment. Hereinafter, wearable camera 100 according to this embodiment will be described with reference to Fig. 1. In wearable camera 100 according to this embodiment, image data is transferred from imaging unit 110 to controller unit 120, and the image data is stored in external non-volatile memory 123.

[0013] The imaging section 110 of the wearable camera 100 includes an optical lens 111, an imaging element 112, a signal processing circuit 113, an imaging control circuit 114, and a memory transfer circuit 115. The imaging element 112 converts light imaged through the optical lens 111 into an electric charge to generate an imaging signal. The signal processing circuit 113 inputs the imaging signal generated by the imaging element 112, digitizes it, and generates image data. The signal processing circuit 113 also performs encoding on the digitized image data in accordance with, for example, H.264 or H.265.

[0014] The imaging control circuit 114 controls the imaging element 112 at the same cycle as the output cycle of the image data. When the accumulation time is longer than the output cycle of the image data, the imaging control circuit 114 controls the signal processing circuit 113 to hold the image data in the frame memory of the signal processing circuit 113 during the period when the imaging element 112 cannot output an imaging signal. The memory transfer circuit 115 transfers the image data digitized by the signal processing circuit 113 to the memory 122 in the controller unit 120.

[0015] Controller unit 120 of wearable camera 100 includes CPU 121, memory 122, external non-volatile memory 123, and non-volatile memory 124. External non-volatile memory 123 is a removable memory such as an SD card or USB memory. Non-volatile memory 124 is a memory with access restrictions, and is connected to a board and cannot be removed.

[0016] CPU 121 calculates a hash value for image data in memory 122, and generates an electronic signature using a private key (not shown) of wearable camera 100. In this embodiment, the calculation of the hash value and the generation of the electronic signature are executed by CPU 121, but a module separate from CPU 121 may be provided to calculate the hash value and generate the electronic signature. CPU 121 then stores the image data and the electronic signature in external non-volatile memory 123, which is a first storage means. In addition to external non-volatile memory 123, CPU 121 also stores the electronic signature in non-volatile memory 124, which is a second storage means and has access restrictions. Docking I / F 125 is an interface for communicating with an external device.

[0017] Docking station 200 communicates with wearable camera 100 via docking I / F 125. Furthermore, information processing device 300 communicates with wearable camera 100 via docking station 200. Examples of information processing device 300 include a personal computer (PC) that stores image data and other computer equipment.

[0018] Fig. 2 is a flowchart showing an example of a process for generating an electronic signature and storing it in non-volatile memory in this embodiment. In the process shown in Fig. 2, an electronic signature used to detect whether image data has been tampered with is generated within wearable camera 100 and stored in non-volatile memory 124. The process in this embodiment will be described below with reference to Fig. 2.

[0019] Processing begins when wearable camera 100 is powered on and begins capturing video. First, in S201, memory transfer circuit 115 sequentially transfers image data captured by imaging unit 110 and digitized and encoded by signal processing circuit 113 to memory 122 in controller unit 120. Next, in S202, CPU 121 checks whether a function for detecting tampering with the image data is enabled.

[0020] If it is determined in step S202 that the function for detecting tampering with the image data is valid, the process proceeds to step S203. In step S203, the CPU 121 calculates a hash value of the image data transferred to the memory 122. This hash value calculation may be performed on a frame-by-frame basis, or may be performed on a GOP (Group Of Pictures) basis, for example.

[0021] Next, in S204, CPU 121 encrypts the hash value calculated in S203 with a private key stored in wearable camera 100 to generate a digital signature. Then, in S205, CPU 121 stores the digital signature generated in S204 in, for example, an SEI (Supplemental Enhancement Information) frame supported by H.264 or H.265.

[0022] Next, in S206, CPU 121 also stores the electronic signature generated in S204 in the access-restricted non-volatile memory 124. Then, in S207, CPU 121 stores the image data with the electronic signature stored in the SEI frame in external non-volatile memory 123, and ends the process. Note that, if the result of the check in S202 shows that the function for detecting tampering with the image data is invalid, in S207, CPU 121 stores the image data transferred to memory 122 as is in external non-volatile memory 123.

[0023] Here, if external non-volatile memory 123 is illegally seized by a third party, the stored electronic signature can be easily modified or deleted by the third party. On the other hand, the electronic signature stored in non-volatile memory 124, which has access restrictions, cannot be accessed without special authority, and therefore cannot be modified or deleted even if wearable camera 100 is illegally seized by a third party.

[0024] In this embodiment, the electronic signature is stored doubly in the external non-volatile memory 123 and the non-volatile memory 124 with access restrictions by the procedure shown in Fig. 2. Since the electronic signature stored in the external non-volatile memory 123 may be illegally modified or deleted by a third party, it is preferable to use the electronic signature stored in the non-volatile memory 124 with access restrictions when verifying tampering of image data. Therefore, the docking station 200 overwrites the electronic signature stored in the SEI frame of the image data stored in the external non-volatile memory 123 with the electronic signature stored in the non-volatile memory 124 with access restrictions. Then, the image data including the overwritten electronic signature is transferred to the information processing device 300.

[0025] Information processing device 300 has previously acquired from wearable camera 100 a public key corresponding to the private key used when generating the electronic signature, and can decrypt the electronic signature included in the image data. Information processing device 300 directly calculates a hash value from the acquired image data, and determines whether the calculation result matches the hash value decrypted from the electronic signature. If the hash values ​​do not match, it can be detected that the image data stored in external non-volatile memory 123 has been tampered with by a third party.

[0026] As described above, according to this embodiment, a hash value of image data is calculated to generate an electronic signature, and the electronic signature is stored in a non-volatile memory with access restrictions. As a result, even if a third party modifies or deletes the electronic signature included in the image data, it can be overwritten using the electronic signature stored in the non-volatile memory with access restrictions. As a result, an information processing device that acquires image data can correctly detect whether the image data has been tampered with by using the overwritten electronic signature.

[0027] Second Embodiment In this embodiment, an example will be described in which an electronic signature used to detect tampering with metadata of image data is generated in a wearable camera and stored in a non-volatile memory. Note that the internal configuration of the wearable camera according to this embodiment is the same as that shown in FIG. 1, so a description thereof will be omitted. Only the points different from the first embodiment will be described below.

[0028] 3 is a flowchart showing an example of a processing procedure for generating a digital signature and storing it in a non-volatile memory in this embodiment. The processing in this embodiment will be described below with reference to FIG.

[0029] The process of S300 is the same as S201 in Fig. 2. Then, in S301, CPU 121 checks whether or not a function for detecting that metadata of image data has been tampered with is enabled. If the result of the check in S301 shows that the function for detecting that metadata of image data has been tampered with is enabled, the process proceeds to S302. Then, in S302, CPU 121 generates metadata related to the image data transferred to memory 122. Examples of the metadata generated here are assumed to be additional information such as the shooting date and time, the shooting location, and an identifier unique to the camera.

[0030] Next, in S303, CPU 121 calculates a hash value of the generated metadata. Then, in S304, CPU 121 encrypts the hash value calculated in S303 with a private key stored in wearable camera 100 to generate an electronic signature. At this time, an electronic signature may be generated individually for each type of metadata such as the shooting date and time, the shooting location, and the camera's unique identifier, or one electronic signature may be generated for all the metadata. Although generating an electronic signature individually for each metadata requires a processing load, it is possible to detect which metadata has been modified or tampered with in more detail. In addition, by using an electronic signature of the camera's unique identifier, it is also possible to determine which camera the image data was taken with. The processes of S305 to S307 are the same as S205 to S207 in FIG. 2, respectively. In addition, even if the result of the check in S301 indicates that the function for detecting tampering with the metadata of the image data is disabled, in S307, the CPU 121 stores the image data transferred to the memory 122 as is in the external non-volatile memory 123.

[0031] Similarly, in this embodiment, the electronic signature stored in access-restricted non-volatile memory 124 cannot be accessed without special authority, and therefore cannot be modified or deleted even if wearable camera 100 is illegally stolen by a third party. Therefore, docking station 200 overwrites the electronic signature stored in the SEI frame of image data stored in external non-volatile memory 123 with the electronic signature stored in access-restricted non-volatile memory 124. Then, the image data including the overwritten electronic signature is transferred to information processing device 300.

[0032] As described above, according to this embodiment, a hash value of metadata of image data is calculated to generate an electronic signature, and the electronic signature is stored in a non-volatile memory with access restrictions. As a result, even if a third party modifies or deletes the electronic signature included in the image data, it can be overwritten using the electronic signature stored in the non-volatile memory with access restrictions. As a result, an information processing device that acquires image data can correctly detect whether the metadata of the image data has been tampered with by using the overwritten electronic signature.

[0033] (Third embodiment) In this embodiment, an example will be described in which electronic signatures used to detect tampering with image data are generated for different image units in a wearable camera and stored in a non-volatile memory. Note that the internal configuration of the wearable camera according to this embodiment is the same as that shown in FIG. 1, so a description thereof will be omitted. Only differences from the first embodiment will be described below.

[0034] 4 is a flowchart showing an example of a processing procedure for generating a digital signature and storing it in a non-volatile memory in this embodiment. The processing in this embodiment will be described below with reference to FIG.

[0035] The processes of S401 and S402 are respectively similar to S201 and S202 in Fig. 2. In S403, the CPU 121 calculates a hash value for each frame of the image data transferred to the memory 122. Then, in S404, the CPU 121 calculates a hash value for each GOP.

[0036] Next, in S405, CPU 121 encrypts the hash value for each image frame calculated in S403 with a private key stored in wearable camera 100, and generates a digital signature for each frame. Then, in S406, CPU 121 encrypts the hash value for each GOP calculated in S404 with a private key stored in wearable camera 100, and generates a digital signature for each GOP.

[0037] Next, in S407, the CPU 121 stores the electronic signature for each GOP generated in S406 in an SEI frame supported by, for example, H.264 or H.265. Then, in S408, the CPU 121 saves the electronic signature for each frame generated in S405 in the non-volatile memory 124 with access restrictions. Here, it can be confirmed by using, for example, a GOP counter or frame number that the electronic signature for each frame corresponds to the electronic signature for each GOP. Alternatively, the correspondence may be established by a method such as naming the electronic signatures according to a rule that makes the correspondence clear.

[0038] Next, in S409, CPU 121 stores the image data in which the electronic signature for each GOP is stored in the SEI frame in external non-volatile memory 123, and ends the process. Note that even if the result of checking in S402 shows that the function for detecting editing and tampering of the image data is invalid, CPU 121 stores the image data transferred to memory 122 as is in external non-volatile memory 123 in S409.

[0039] Similarly, in this embodiment, the electronic signature for each frame stored in non-volatile memory 124 with access restrictions cannot be accessed without special authority. Therefore, even if wearable camera 100 is illegally taken by a third party, the electronic signature cannot be modified or deleted. Therefore, docking station 200 transfers to information processing device 300 the electronic signature for each GOP stored in external non-volatile memory 123 and the electronic signature for each image frame stored in non-volatile memory 124 with access restrictions.

[0040] In the information processing device 300, since the electronic signature for each image frame is an unmodified electronic signature, if it corresponds to the electronic signature for each GOP, it is highly likely that the electronic signature for each GOP has not been modified by a third party. Calculating a hash value for each frame to detect tampering of image data requires a large processing load and time. In such a case, the information processing device 300 may calculate a hash value for each GOP to detect whether or not the image data has been tampered. On the other hand, if the electronic signature for each image frame does not correspond to the electronic signature for each GOP, there is a possibility that the electronic signature for each GOP has been modified by a third party. In such a case, the information processing device 300 calculates a hash value for each frame to detect whether or not the image data has been tampered.

[0041] As described above, according to this embodiment, a hash value of image data is calculated to generate digital signatures for each frame and each GOP, and the digital signatures for each frame are stored in a non-volatile memory with access restrictions. As a result, even if a third party modifies or deletes the digital signatures for each GOP included in the image data, it is possible to correctly detect whether the image data has been tampered with by using the digital signatures stored in the non-volatile memory with access restrictions.

[0042] (Other embodiments) Although the preferred embodiments of the present invention have been described above, the present invention is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of the present invention. The present invention can also be realized by supplying a program that realizes one or more functions of the above-mentioned embodiments to a system or device via a network or a storage medium, and having one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0043] The disclosure of this embodiment includes the following configuration, method, and program.

[0044] (Configuration 1) a generation means for generating an electronic signature for detecting whether or not the image data has been tampered with from the image data output from the imaging means; a storage means for storing the digital signature generated by the generation means and the image data in a first storage means, and storing the digital signature in a second storage means having access restrictions; A data processing device comprising: (Configuration 2) 2. The data processing device according to configuration 1, wherein the generating means calculates a hash value of the image data, and encrypts the calculated hash value to generate the digital signature. (Configuration 3) the generating means calculates a hash value of the image data in units of a frame and in units of a GOP (Group Of Pictures), and generates a digital signature by encrypting the hash value calculated in units of the frame, and a digital signature by encrypting the hash value calculated in units of the GOP; 3. The data processing device according to claim 1, wherein the storage means stores an electronic signature generated from a hash value of the GOP unit in the first storage means, and stores an electronic signature generated from a hash value of the frame unit in the second storage means.

[0045] (Configuration 4) 2. The data processing device according to configuration 1, wherein the generating means calculates a hash value of metadata of the image data, and encrypts the calculated hash value to generate the digital signature. (Configuration 5) 5. The data processing device according to configuration 4, wherein the generating means generates the digital signature for each type of metadata of the image data. (Configuration 6) 6. The data processing device according to configuration 5, wherein the generating means generates, as the type of the metadata, at least a digital signature related to a unique identifier of a device that generated the image data. (Configuration 7) 7. The data processing device according to any one of configurations 1 to 6, wherein the first storage means is a removable non-volatile memory, and the second storage means is a non-removable non-volatile memory.

[0046] (method) a generating step of generating an electronic signature for detecting whether or not the image data has been tampered with from the image data output from the imaging means; a storage step of storing the digital signature generated in the generation step and the image data in a first storage means, and storing the digital signature in a second storage means having access restrictions; 13. A data processing method comprising:

[0047] (program) a generating step of generating an electronic signature for detecting whether or not the image data has been tampered with from the image data output from the imaging means; a storage step of storing the digital signature generated in the generation step and the image data in a first storage means, and storing the digital signature in a second storage means having access restrictions; A program for causing a computer to execute the following. [Explanation of symbols]

[0048] 121 CPU, 123 external non-volatile memory, 124 non-volatile memory

Claims

1. a generation means for generating an electronic signature for detecting whether or not the image data has been tampered with from the image data output from the imaging means; a storage means for storing the digital signature generated by the generation means and the image data in a first storage means, and storing the digital signature in a second storage means having access restrictions; A data processing device comprising:

2. 2. The data processing apparatus according to claim 1, wherein said generating means calculates a hash value of said image data, and encrypts said calculated hash value to generate said electronic signature.

3. the generating means calculates hash values ​​of the image data in units of frames and in units of GOPs (Group Of Pictures), and generates an electronic signature by encrypting the hash values ​​calculated in units of the frames and an electronic signature by encrypting the hash values ​​calculated in units of the GOP; 2. The data processing device according to claim 1, wherein the storage means stores an electronic signature generated from a hash value of the GOP unit in the first storage means, and stores an electronic signature generated from a hash value of the frame unit in the second storage means.

4. 2. The data processing apparatus according to claim 1, wherein said generating means calculates a hash value of the metadata of said image data, and encrypts said calculated hash value to generate said digital signature.

5. 5. The data processing apparatus according to claim 4, wherein said generating means generates said digital signature for each type of metadata of said image data.

6. 6. The data processing apparatus according to claim 5, wherein said generating means generates, as one type of said metadata, at least a digital signature related to a unique identifier of a device that generated said image data.

7. 7. The data processing apparatus according to claim 1, wherein the first storage means is a removable non-volatile memory, and the second storage means is a non-removable non-volatile memory.

8. a generating step of generating an electronic signature for detecting whether or not the image data has been tampered with from the image data output from the imaging means; a storage step of storing the digital signature generated in the generating step and the image data in a first storage means, and storing the digital signature in a second storage means having access restrictions; 13. A data processing method comprising:

9. a generating step of generating an electronic signature for detecting whether or not the image data has been tampered with from the image data output from the imaging means; a storage step of storing the digital signature generated in the generating step and the image data in a first storage means, and storing the digital signature in a second storage means having access restrictions; A program for causing a computer to execute the following.

Images