System and method for digital evidence anchoring using iota tangle for copyright-infringement investigation

Abstract

An IOTA Tangle-based digital evidence anchoring system and method for investigating copyright infringement are disclosed. The system comprises: an original evidence collection module for collecting original evidence for each case; an original evidence hash value generation module for generating an original evidence hash value of the original evidence collected by the original evidence collection module; an original evidence metadata generation module for generating original evidence metadata of the original evidence collected by the original evidence collection module; an original evidence encryption module for encrypting the original evidence collected by the original evidence collection module; and an IOTA Tangle anchoring module for anchoring the original evidence hash value generated by the original evidence hash value generation module, the original evidence encrypted by the original evidence encryption module, and the original evidence metadata generated by the original evidence metadata generation module to an IOTA Tangle network for each case.

Description

Technology Field

[0001] The present invention relates to a digital evidence anchoring system and method, and more specifically, to an IOTA tangle-based digital evidence anchoring system and method for copyright infringement investigation. Background Technology

[0003] In modern society, as the creation and sharing of digital content have increased rapidly, copyright infringement cases are also occurring more frequently. Consequently, investigative agencies collect various forms of digital evidence, such as CCTV footage, smartphone recordings, social media screenshots, and log files. However, existing centralized digital forensic management systems often rely on storing evidence on a single server or database, or recording only simple metadata. Under such structures, it is difficult to fully verify the entire process from the creation of evidence to its final storage, and the system is vulnerable to threats such as manipulation or deletion by insiders or external hacking.

[0004] Furthermore, when international cooperation is required, it is difficult to maintain consistency in verifying the authenticity of identical evidence because storage methods, encryption techniques, and data formats vary by country or agency. This can lead to a situation where evidence stored in one institution is not trusted by other countries or agencies. In addition, since personal information, location data, and recording metadata contained in digital evidence are legally and ethically sensitive, disclosing the original files or storing them on a central server raises concerns regarding personal data protection and privacy.

[0005] Furthermore, the network at an investigation site may not always be stable. In particular, in overseas locations, disaster zones, and military areas, internet connections are frequently unstable or disconnected; in such cases, it is impossible to immediately transmit and store on-site footage on a central server. In these offline investigation environments, there is a risk that evidence may remain locally or be altered or lost during the subsequent transmission process.

[0006] Finally, existing evidence management systems often rely on manual operations for each stage—such as collection, storage, access, viewing, and verification—which poses a high risk of human error and makes systematic auditing or tracking of change history difficult. Consequently, it can be challenging to objectively prove the integrity and reliability of evidence when submitted to court. Prior art literature

[0008] Patent Publication No. 10-2019-0083295 Patent Registration No. 10-2153845 The problem to be solved

[0009] The objective of the present invention is to provide an IOTA Tangle-based digital evidence anchoring system for copyright infringement investigations.

[0010] Another objective of the present invention is to provide an IOTA Tangle-based digital evidence anchoring method for copyright infringement investigations. means of solving the problem

[0012] An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation according to the purpose of the present invention described above may be configured to include an original evidence collection module for collecting original evidence; and an original evidence hash value generation module for generating an original evidence hash value of the original evidence collected by the original evidence collection module.

[0013] Here, the original evidence encryption module can be configured to encrypt the original evidence collected by the original evidence collection module.

[0014] In addition, it may be configured to further include an original evidence storage module in which the original evidence hash value generated by the original evidence hash value generation module is stored.

[0015] And the original evidence storage module can be configured to store the original evidence encrypted by the original evidence encryption module.

[0016] In addition, the original evidence storage module described above can be configured so that the original evidence hash value and the encrypted original evidence are stored in an interconnected manner for each case.

[0017] An IOTA Tangle-based digital evidence anchoring method for copyright infringement investigation according to another purpose of the present invention described above may be configured to include the step of an original evidence collection module collecting original evidence; and the step of an original evidence hash value generation module generating an original evidence hash value of the original evidence collected by the original evidence collection module.

[0018] Here, the original evidence encryption module may be configured to further include a step of encrypting the original evidence collected by the original evidence collection module.

[0019] In addition, the original evidence hash value generation module and the original evidence encryption module may be configured to further include a step of interconnecting the generated original evidence hash value and the encrypted original evidence on a case-by-case basis and storing them in the original evidence storage module.

[0020] And the step of the original evidence collection module collecting original evidence can be configured to collect documents, video, images, audio, and data as original evidence.

[0021] In addition, the step of the original evidence encryption module encrypting the original evidence collected from the original evidence collection module may be configured to encrypt the original evidence using the AES algorithm or the RSA algorithm. Effects of the invention

[0023] According to the aforementioned IOTA Tangle-based digital evidence anchoring system and method for copyright infringement investigation, by anchoring the original hash and metadata of digital evidence to the IOTA Tangle distributed ledger, it is possible to independently and irreversibly verify whether the evidence has been tampered with at any point in time after its creation. In addition, through on-device encryption and a local queue storage mechanism, it is possible to safely collect and store evidence without loss or tampering even at investigation sites where the network is unstable.

[0024] Meanwhile, even if the storage or encryption methods used between countries or agencies differ, the same hash-based verification system can be used to ensure legal credibility regarding the integrity and authenticity of evidence in international cooperative investigations. Brief explanation of the drawing

[0026] FIG. 1 is a block diagram of an IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation according to one embodiment of the present invention. FIG. 2 is a flowchart of an IOTA Tangle-based digital evidence anchoring method for copyright infringement investigation according to one embodiment of the present invention. Specific details for implementing the invention

[0027] The present invention is susceptible to various modifications and may have various embodiments; therefore, specific embodiments are illustrated in the drawings and described in detail in the specific details for carrying out the invention. However, this is not intended to limit the invention to specific embodiments, and it should be understood that the invention includes all modifications, equivalents, and substitutions that fall within the spirit and scope of the invention. Similar reference numerals have been used for similar components in the description of each drawing.

[0028] Terms such as first, second, A, B, etc., may be used to describe various components, but said components should not be limited by said terms. These terms are used solely for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be named the second component, and similarly, the second component may be named the first component. The term "and / or" includes a combination of a plurality of related described items or any of a plurality of related described items.

[0029] When it is stated that one component is "connected" or "connected" to another component, it should be understood that while it may be directly connected or connected to that other component, there may also be other components in between. On the other hand, when it is stated that one component is "directly connected" or "directly connected" to another component, it should be understood that there are no other components in between.

[0030] The terms used in this application are used merely to describe specific embodiments and are not intended to limit the invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this application, terms such as "comprising" or "having" are intended to indicate the presence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0031] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by those skilled in the art to which the present invention pertains. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in this application.

[0032] Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the attached drawings.

[0033] FIG. 1 is a block diagram of an IOTA tangle-based digital evidence anchoring system according to one embodiment of the present invention.

[0034] Referring to FIG. 1, a system (100) according to one embodiment of the present invention comprises an original evidence collection module (101), a deepfake video pre-detection module (102), a deepfake video pre-filtering module (103), an original evidence acceptance decision module (104), an original evidence hash value generation module (105), an original evidence metadata generation module (106), an original evidence encryption module (107), a video frame-specific hash value generation control module (108), an original evidence storage module (109), a local queue generation module (110), an IOTA tangle anchoring control module (111), an IOTA tangle anchoring module (112), an evidence reception module (113), an evidence storage module (114), an evidence verification control module (115), an evidence hash value generation module (116), a video frame-specific hash value generation module (117), and an evidence verification module (118). It may be configured to include a hash value-based evidence duplicate detection module (119), an evidence duplicate storage prevention module (120), a case-specific Merkle tree generation / update module (121), a Merkle tree storage module (122), a metadata-based Merkle tree additional generation / update module (123), a Merkle tree analysis module (124), an original evidence interrelationship determination module (125), an IOTA Tangle hash value search module (126), a case interrelationship determination module (127), and an interrelationship output module (128).

[0035] The detailed composition is explained below.

[0036] First, we will explain the process of recording the original evidence into the IOTA Tangle network.

[0037] The original evidence collection module (101) can be configured to collect original evidence for each case.

[0038] Additionally, the original evidence collection module (101) may be configured to collect various forms of original evidence that can be secured during the investigation of copyright infringement. For example, it may be configured to include materials that can be used directly or indirectly to determine whether copyright infringement has occurred, such as video files, image files, audio recordings, text-based documents, software files, streaming log data, and web service access records. Therefore, the module has the effect of flexibly collecting evidence with different formats and structures depending on the characteristics of the case, and utilizing them for subsequent analysis and verification of authenticity.

[0039] The deepfake video pre-detection module (102) can be configured to pre-detect whether the original evidence collected by the original evidence collection module (101) for each case is a video.

[0040] The deepfake video pre-detection module (102) can be configured to detect traces of synthesis, such as face replacement, voice synthesis, and frame distortion within the video, through feature-based analysis or a learning-based model. Through this, obvious synthetic videos can be identified at an early stage and excluded from investigation or classified separately, and the reliability of evidence can be determined in advance even in cases where original videos and modified videos are mixed. Therefore, there is an advantage of reducing unnecessary verification costs and improving processing efficiency in the subsequent hash value generation and anchoring stages.

[0041] The deepfake video pre-detection module (102) can be configured to detect whether it is a deepfake by analyzing synthetic features such as traces of face replacement within the video frame, unnatural eye blinking patterns, discrepancies between mouth shape and voice, and blurring of the frame boundaries. For example, if a specific person's face shows disharmony with another person's facial expression movements or if the lighting direction does not match the surrounding environment, this can be determined as a sign of synthesis.

[0042] In addition, voice-based deepfakes can be configured to distinguish between real and synthesized speech by analyzing the speaker's breathing patterns, intonation changes, frequency spectrum imbalances, and consonant-vowel transition characteristics. For instance, if the same sound value appears repeatedly in a specific word or if natural vocal tremor is lacking, the likelihood of it being synthesized speech can be estimated. Through this, the level of authenticity of evidence containing video or audio can be rapidly evaluated at a preliminary stage, thereby increasing the accuracy of subsequent hash value generation and anchoring processing.

[0043] The deepfake video pre-filtering module (103) can be configured to pre-filter the deepfake video detected in advance by the deepfake video pre-detection module (102) and classify it as a deepfake video.

[0044] The deepfake video pre-filtering module (103) can be configured to pre-filter deepfake videos detected by the deepfake video pre-detection module (102) and classify them as deepfake videos. This allows synthetic videos that are difficult to adopt as actual evidence to be filtered out at an initial stage, and has the effect of reducing errors in subsequent processing.

[0045] The original evidence adoption decision module (104) may be configured to decide whether to adopt a deepfake video classified by the deepfake video pre-filtering module (103) as original evidence based on user input and to feed back to the original evidence collection module (101).

[0046] The original evidence acceptance decision module (104) may be configured to decide whether to accept a deepfake video classified by the deepfake video pre-filtering module (103) as original evidence based on user input and to feed back to the original evidence collection module (101). Since deepfake videos are manipulated videos, they may be difficult to use as general evidence; however, in cases where deepfake itself is directly related to copyright infringement, such synthetic videos can actually serve as key evidence. Therefore, they cannot be uniformly excluded based solely on whether they are deepfake, and a process is required to allow the user to determine whether to accept them depending on the nature of the case.

[0047] The original evidence hash value generation module (105) may be configured to generate a hash value of the original evidence collected by the original evidence collection module (101). At this time, if the original evidence is a deepfake video, it may be configured to generate an original evidence hash value of the deepfake video adopted by the original evidence adoption decision module (104).

[0048] The original evidence metadata generation module (106) may be configured to generate metadata for the original evidence collected by the original evidence collection module (101). In this case, if the original evidence is a deepfake video, the metadata may be generated by adding information indicating that the original evidence is a deepfake video.

[0049] The original evidence metadata generation module (106) may be configured to generate metadata for the original evidence collected by the original evidence collection module (101). The metadata generated here is information describing the original evidence and may include creation metadata, file metadata, and investigation system metadata such as the time of shooting or creation, file size, shooting device information, GPS location information, case number, and submitter information. Additionally, by storing integrity-related metadata such as a transaction ID, anchoring time, and anchoring hash value anchored to the IOTA Tangle network, it is possible to clearly track when and in what state the collected evidence was secured. Meanwhile, if the original evidence is a deepfake video, metadata may be generated by adding flag information indicating that the video is a deepfake video, thereby supporting the deepfake evidence to be treated separately during subsequent verification or identification processes. Such a configuration can improve the reliability and accuracy of the investigation process by clearly recording the state and attributes of the video in preparation for cases where the deepfake video may serve as key evidence depending on the nature of the case.

[0050] The original evidence encryption module (107) may be configured to encrypt the original evidence collected by the original evidence collection module (101). In this case, if the original evidence is a deepfake video, it may be configured to generate the original evidence hash value of the deepfake video adopted by the original evidence adoption decision module (104).

[0051] The original evidence encryption module (107) may be configured to encrypt the original evidence collected by the original evidence collection module (101). At this time, various encryption techniques such as a symmetric-key based AES algorithm, a public-key based RSA algorithm, and an ECC-based algorithm may be applied to prevent external leakage or alteration during the storage or transmission of the original evidence. The AES method is advantageous for protecting large files such as video and images because it can process large amounts of data at high speed, and the RSA method is effective for the secure distribution of encryption keys, so it can be utilized in environments where evidence is exchanged between multiple investigative agencies. Additionally, if necessary, a hybrid encryption method may be applied to simultaneously secure the speed of symmetric-key encryption and the security of public-key encryption. This configuration can contribute to securing the reliability of digital evidence by maintaining confidentiality and preventing illegal manipulation or alteration throughout the entire process of storing the original evidence or transmitting it to another investigative agency.

[0052] The video frame-by-frame hash value generation control module (108) can control the original evidence hash value generation module (105) to additionally generate original evidence video frame-by-frame hash values ​​when the original evidence collected by the original evidence collection module (101) is a video.

[0053] The original evidence storage module (109) can be configured to store the original evidence hash value and original evidence video frame-specific hash value generated by the original evidence hash value generation module (105), the original evidence metadata generated by the original evidence metadata generation module (106), and the original evidence encrypted by the original evidence encryption module (107) in a mutually linked manner for each case.

[0054] In this case, each data element is grouped and stored according to the same case identifier, allowing for the systematic management of relationships between evidence. Furthermore, since hash values, metadata, and encrypted original data are combined and stored as a single continuous record, the origin, integrity, and encryption status of the evidence can be consistently traced during subsequent verification processes. Consequently, the management of evidence at the case level is structured, and the possibility of falsification or alteration of stored information is reduced, thereby enhancing the reliability of the digital evidence system.

[0055] The local queue generation module (110) can be configured to generate a local queue for storing original evidence hash values, original evidence video frame hash values, and original evidence metadata stored in the original evidence storage module (109).

[0056] In this case, the local queue functions as a buffer to temporarily store evidence-related data regardless of network connection status, thereby configuring the system so that the evidence recording process is not interrupted even when network connectivity is unstable in the field environment. Additionally, as data is managed in a queue structure, stored hash values ​​and metadata can be sequentially transmitted to the IOTA Tangle network, which can improve the processing efficiency and stability of the anchoring operation. This configuration can contribute to continuously maintaining evidence integrity and ensuring the reliability of subsequent anchoring processes even in offline-based evidence collection environments.

[0057] The IOTA Tangle anchoring control module (111) can control the original evidence hash value, the original evidence video frame hash value, and the original evidence metadata to be sequentially output from the local queue generated by the local queue generation module (110) when a communication connection is established, so that they are stored in the IOTA Tangle network.

[0058] At this time, since each data can be controlled to be discharged sequentially from the queue, data omission or order errors can be prevented during the anchoring process. In addition, since queue-based output can be maintained even in the event of network delay or instability, the integrity recording procedure can be reliably performed even in a discontinuous communication environment at the field terminal. Accordingly, all hash values ​​and metadata related to the original evidence can be recorded in the IOTA Tangle network in chronological order, and a foundation can be established to clearly reconstruct the circumstances of how the original evidence was obtained during the subsequent verification process.

[0059] The IOTA Tangle anchoring module (112) can be configured to anchor the original evidence hash value, the original evidence video frame hash value, and the original evidence metadata to the IOTA Tangle network under the control of the IOTA Tangle anchoring control module (111).

[0060] Next, the following describes the process of verifying whether evidence received from other investigative agencies is original evidence during international cooperation in copyright investigations.

[0061] The evidence receiving module (113) may be configured to receive evidence from another investigative agency terminal (not shown).

[0062] At this time, the evidence receiving module (113) can be designed to reliably receive various types of digital evidence transmitted in response to requests for joint investigation or data sharing between investigative agencies. Additionally, it can be configured to perform basic integrity checks or record receiving metadata to verify whether there are transmission errors or data corruption that may occur during the reception process. Through this, the evidence transmitted between agencies can be provided to subsequent processing stages while maintaining its originality and reliability.

[0063] The evidence storage module (114) can be configured to store evidence received from the evidence receiving module (113).

[0064] At this time, the evidence storage module (114) may be configured with an internal storage area structured so that the received digital evidence can be managed by type and case. In addition, it may be designed to check for data corruption during the storage process or to record basic storage-related metadata such as the storage time and case ID.

[0065] The evidence verification control module (115) can control the verification of evidence stored in the evidence storage module (114). At this time, the evidence verification control module (115) can determine the timing of the occurrence of a verification request for each piece of evidence, the type of verification target, and the necessary verification procedure, and perform step-by-step control to ensure that an appropriate verification flow is performed. Additionally, it may be configured to trigger a procedure to compare whether a hash value or metadata generated during the verification process matches a previously stored value, or, in the case of video, to call a frame-unit hash verification procedure.

[0066] The evidence hash value generation module (116) may be configured to generate a hash value of the evidence stored in the evidence storage module (114) and store it in the evidence storage module (114) under the control of the evidence verification control module (115).

[0067] The video frame-by-frame hash value generation module (117) may be configured to additionally generate a hash value for each video frame of the evidence stored in the evidence storage module (114) and store it in the evidence storage module (114) when the evidence stored in the evidence storage module (114) is a video.

[0068] At this time, since the video consists of multiple frame images, there may be a problem in that it is difficult to determine whether detailed manipulation has occurred based solely on a single hash value for the entire video unit. Accordingly, the video frame-specific hash value generation module (117) can be designed with a structure that can precisely detect even when there is fine editing or tampering at the frame level by separating each frame of the video into a certain unit and calculating an independent hash value for each individual frame. In addition, by accumulating and storing the video frame-specific hash values, the point, range, and timing of the manipulation can be identified more specifically during the subsequent verification process.

[0069] The evidence verification module (118) can be configured to verify the evidence hash value and the video frame hash value stored in the evidence storage module (114) by comparing them with the original evidence hash value and the original evidence video frame hash value stored in the IOTA Tangle network, respectively. That is, it can be configured to quickly determine whether the evidence has been altered on an event-by-event basis by comparing whether it matches each hash value of the original evidence. In particular, by using the video frame hash value, even minute alterations occurring in specific frames rather than the entire video can be detected, thereby enabling more precise integrity verification.

[0070] The hash value-based evidence duplication detection module (119) can be configured to detect duplicate storage of evidence by comparing each evidence hash value stored in the evidence storage module (114) or by comparing each evidence video frame hash value.

[0071] The evidence duplicate storage prevention module (120) can be configured to prevent duplicate storage of evidence by deleting the corresponding duplicate stored evidence based on the detection result of the hash value-based evidence duplicate detection module (119). That is, it can automatically identify cases where evidence with the same content is repeatedly submitted or shared between cases, thereby preventing inefficiency in storage space. This function is necessary because, in the case of copyright-related evidence, the data size of images, text, etc., is often vast, making the management of local storage capacity very important.

[0072] The case-specific Merkle tree generation / update module (121) may be configured to generate or update a case-specific Merkle tree for the original evidence hash value, original evidence video frame hash value, original evidence metadata, and encrypted original evidence stored in the original evidence storage module (109).

[0073] Furthermore, it can be configured to represent the integrity of the entire evidence set of a case as a single value by generating a case-unit Merkle root through the hierarchical arrangement of the hash values ​​of each piece of evidence. In addition, it can be configured to efficiently update the Merkle tree structure without regenerating the entire tree by updating only the relevant branch when new evidence is added or some evidence is modified.

[0074] The Merkle tree storage module (122) can be configured to store the event-specific Merkle tree generated or updated by the event-specific Merkle tree generation / update module (121).

[0075] The metadata-based Merkle tree additional creation / update module (123) may be configured to analyze the original evidence metadata of the case-specific Merkle tree stored in the Merkle tree storage module (122) to additionally create or update a metadata-based Merkle tree and store it in the Merkle tree storage module (122).

[0076] Furthermore, it can be configured to construct a separate metadata-centric Merkle tree by automatically forming a new group structure based on similarity and metadata characteristics, such as the creation time, location information, submitter information, and file attributes of the evidence. In addition, relationships between cases or various types of evidence can be identified based on metadata, allowing related evidence to be rearranged into a new hierarchical structure. The rearrangement of the Merkle tree can be highly useful for identifying relationships between original evidence from different cases.

[0077] The Merkle tree analysis module (124) can be configured to analyze the event-specific Merkle tree and metadata-based Merkle tree stored in the Merkle tree storage module (122).

[0078] In addition, it can be configured to evaluate the associations between hash nodes of each Merkle tree or to identify relationships between evidence by tracking the location, hierarchical structure, and inclusion relationships of specific evidence.

[0079] The original evidence interrelationship determination module (125) may be configured to determine the interrelationship between original evidence stored in the original evidence storage module (109) based on the analysis results of the Merkle tree analysis module (124).

[0080] In addition, it can be configured to estimate the flow or sequence of occurrence of related evidence within the same event by comparing the hash value of the original evidence, the hash value per video frame, and the similarity and inclusion relationships of metadata.

[0081] In addition, it can be configured to systematically derive the correlation of evidence by determining whether different original evidence has been altered, whether there is partial agreement, and the possibility that it was generated on the same device or in the same environment.

[0082] The IOTA Tangle hash value search module (126) can be configured to search for original evidence hash values ​​and original evidence video frame-by-frame hash values ​​stored in the IOTA Tangle network.

[0083] In addition, it can be configured to query relevant identification information regarding when, at which node, and through which transaction the evidence was recorded based on the searched hash value.

[0084] The event interrelationship determination module (127) can be configured to determine the interrelationship between events based on the search results of the IOTA Tangle hash value search module (126).

[0085] In addition, if there are matching or similar values ​​among the hash values ​​recorded in different events or the hash values ​​per video frame, it can be configured to infer the possibility that the evidence was shared between events or derived from the same source.

[0086] In addition, it can be configured to determine cross-correlation between cases, whether the same actor was involved, and the existence of common evidence by comprehensively analyzing the recording time, metadata characteristics, and hash value structure of each case.

[0087] The interrelationship output module (128) can be configured to output in real time the interrelationship between original evidence determined by the original evidence interrelationship determination module (125) and the interrelationship between events determined by the event interrelationship determination module (127).

[0088] In addition, the aforementioned interrelationships can be visually distinguished or sorted by importance so that investigators can verify them immediately. Furthermore, the output interrelationship information can be linked with storage or transmission functions so that it can be utilized in conjunction during the process of creating case analysis records or investigation reports.

[0089] FIG. 2 is a flowchart of an IOTA Tangle-based digital evidence anchoring method for copyright infringement investigation according to one embodiment of the present invention.

[0090] Referring to FIG. 6, the original evidence collection module (101) collects the original evidence (S101).

[0091] Here, the original evidence collection module (101) may be configured to collect documents, video, images, audio, and data as original evidence.

[0092] Next, the original evidence hash value generation module (105) generates the original evidence hash value of the original evidence collected by the original evidence collection module (101) (S102).

[0093] Next, the original evidence encryption module (107) encrypts the original evidence collected from the original evidence collection module (101) (S103).

[0094] Next, the original evidence hash value generation module (105) and the original evidence encryption module (107) mutually link the generated original evidence hash value and the encrypted original evidence by case and store them in the original evidence storage module (109) (S104).

[0095] At this time, the original evidence encryption module (107) may be configured to encrypt the original evidence collected from the original evidence collection module (101) using the AES (Advanced Encryption Standard) algorithm or the RSA algorithm.

[0096] Although the invention has been described with reference to the above embodiments, those skilled in the art will understand that various modifications and changes can be made to the invention without departing from the spirit and scope of the invention as set forth in the following claims. Explanation of the symbols

[0098] 101: Original Evidence Collection Module 102: Deepfake Video Pre-detection Module 103: Deepfake Video Pre-filtering Module 104: Original Evidence Adoption Decision Module 105: Original Evidence Hash Generation Module 106: Original Evidence Metadata Generation Module 107: Original Evidence Encryption Module 108: Control module for generating hash values ​​per video frame 109: Original Evidence Storage Module 110: Local queue creation module 111: IOTA Tangle Anchoring Control Module 112: IOTA Tangle Anchoring Module 113: Evidence receiving module 114: Evidence Storage Module 115: Evidence Verification Control Module 116: Evidence Hash Generation Module 117: Module for generating hash values ​​per video frame 118: Evidence Verification Module 119: Hash-based evidence duplicate detection module 120: Evidence Duplicate Storage Prevention Module 121: Event-based Merkle Tree Generation / Update Module 122: Merkle Tree Storage Module 123: Metadata-based Merkle Tree Addition / Update Module 124: Merkle Tree Analysis Module 125: Original Evidence Interrelevance Determination Module 126: IOTA Tangle Hash Value Search Module 127: Event Interrelationship Determination Module 128: Interrelationship Output Module

Claims

Claim 1 An original evidence collection module for collecting original evidence by case; an original evidence hash value generation module for generating an original evidence hash value of the original evidence collected by the original evidence collection module; an original evidence metadata generation module for generating original evidence metadata of the original evidence collected by the original evidence collection module; an original evidence encryption module for encrypting the original evidence collected by the original evidence collection module; a video frame hash value generation control module that controls the original evidence hash value generation module to additionally generate original evidence video frame hash values ​​when the original evidence collected by the original evidence collection module is video; an original evidence storage module in which the original evidence hash value and original evidence video frame hash value generated by the original evidence hash value generation module, the original evidence metadata generated by the original evidence metadata generation module, and the original evidence encrypted by the original evidence encryption module are stored in an interconnected manner by case; a local queue generation module for generating a local queue to store the original evidence hash value, original evidence video frame hash value, and original evidence metadata stored in the original evidence storage module; communication An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation comprising: an IOTA Tangle anchoring control module that controls the sequential output of original evidence hash values, original evidence video frame hash values, and original evidence metadata from a local queue generated by the local queue generation module upon connection, and stores them in an IOTA Tangle network; and an IOTA Tangle anchoring module that anchors the original evidence hash values, original evidence video frame hash values, and original evidence metadata to an IOTA Tangle network according to the control of the IOTA Tangle anchoring control module. Claim 2 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation according to claim 1, further comprising: a deepfake video pre-detection module that pre-detects whether a video is a deepfake video when the original evidence collected by the original evidence collection module for each case is a video; a deepfake video pre-filtering module that pre-filters the deepfake video pre-detected by the deepfake video pre-detecting module and classifies it as a deepfake video; and an original evidence adoption decision module that determines, based on user input, whether to adopt the deepfake video classified by the deepfake video pre-filtering module as original evidence and feeds back to the original evidence collection module. Claim 3 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation, characterized in that, in paragraph 2, the original evidence hash value generation module is configured to generate the original evidence hash value of a deepfake video adopted by the original evidence adoption decision module when the original evidence is a deepfake video. Claim 4 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation, characterized in that, in paragraph 3, the original evidence metadata generation module is configured to generate metadata by adding information indicating that the original evidence is a deepfake video when the original evidence is a deepfake video. Claim 5 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation according to claim 4, characterized in that the original evidence encryption module is configured to generate metadata by adding information indicating that the original evidence is a deepfake video when the original evidence is a deepfake video. Claim 6 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation comprising: an evidence receiving module for receiving evidence from a terminal of another investigative agency; an evidence storage module for storing evidence received from the evidence receiving module; an evidence verification control module for controlling verification of evidence stored in the evidence storage module; an evidence hash value generation module for generating an evidence hash value for the evidence stored in the evidence storage module according to the control of the evidence verification control module and storing it in the evidence storage module; a video frame hash value generation module for additionally generating an evidence video frame hash value for the video and storing it in the evidence storage module when the evidence stored in the evidence storage module is a video; and an evidence verification module for verifying the evidence hash value and the evidence video frame hash value stored in the evidence storage module by comparing them with the original evidence hash value and the original evidence video frame hash value already stored in the IOTA Tangle network, respectively. Claim 7 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation, characterized in that, in claim 6, it is further configured to include a hash value-based evidence duplication detection module that detects duplicate storage of evidence by comparing each evidence hash value stored in the evidence storage module or comparing each evidence video frame hash value stored in the evidence storage module. Claim 8 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation, characterized in that, in claim 7, it is configured to further include an evidence duplicate storage prevention module that prevents duplicate storage of said evidence by deleting duplicate stored evidence based on the detection result of the hash value-based evidence duplicate detection module. Claim 9 An IOTA Tangle-based digital evidence anchoring system for copyright infringement investigation, characterized in that, in claim 8, the original evidence is configured to include video, images, data, and audio. Claim 10 delete

Images