JP2006279244A - Data transmission apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To shorten a processing time required for encrypting a data stream. <P>SOLUTION: A header detection section 38 detects a header part from the data stream captured in a buffer 37 under the control of a control section 31 of the data transmission apparatus 3. When the header part is detected, the control section 31 allows a random number generator 33 to select an encryption key from a key storage section 35 and the random number generator 33 generates a random number by using an initial vector generated by an initial vector generating section 36 and the selected encryption key. Then an arithmetic unit 34 uses the produced random number to encrypt the detected header part and a communication I/F 32 transmits the encrypted header part. On the other hand, when the header detection section 38 detects a non-header part, the communication I/F 32 transmits the detected non-header part without executing the encryption processing. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a data transmission device that transmits video data captured by a network camera or the like to a data reception device connected via a communication network, for example.

  2. Description of the Related Art In recent years, systems are widely provided in which video is digitally encoded (compressed) to create a video stream, and the created video stream is distributed from a server to a terminal device. Furthermore, when the video stream is distributed, partial viewing is performed in which the video is distributed only to a limited number of terminals. In order to realize this partial viewing, there is a method of encrypting a non-header portion (that is, a data portion) of a video stream with an encryption key (see, for example, Patent Document 1). As a result, the terminal device having the encryption key can reproduce the original video, and the terminal device not having the encryption key can reproduce a partial video or a video with degraded image quality.

JP 2004-138933 A

  However, in the above-described prior art, when performing partial viewing of a video, all the non-header portions of the video stream must be encrypted with the encryption key, so that the encryption process takes time. In addition, when a data stream in which only the non-header part is encrypted is distributed as in the past, the encryption key may be leaked and decrypted.

  Accordingly, the present invention has been made paying attention to the above circumstances, and a first object thereof is to provide a data transmission apparatus that shortens the processing time required for encryption of a data stream. A second object is to provide a data transmission device that can improve the confidentiality of a distributed data stream.

In order to achieve the above object, a data transmitting apparatus according to the present invention comprises means for obtaining a data stream having a header portion and means for storing a plurality of encryption keys. The header portion is detected from the data stream, an encryption key is selected from the plurality of encryption keys, and the detected header portion is encrypted with the selected encryption key. Then, the header part included in the data stream is replaced with the encrypted header part to generate an encrypted data stream, and the generated encrypted data stream is transmitted.
Thereby, compared with the conventional case where the non-header part (that is, the data part) is encrypted, the amount of data to be encrypted is reduced, so that the time required for the encryption process can be shortened.

The present invention is also characterized by having the following configuration.
Means for generating an initial vector, means for generating a key stream using the initial vector, and means for encrypting a non-header part included in the data stream by the key stream. And a means for storing a plurality of encryption keys and a means for selecting an encryption key from among the plurality of encryption keys. The initial vector is encrypted with the selected encryption key, and the encrypted initial The vector is added to the data stream in which the non-header part is encrypted. Then, the data stream to which the encrypted initial vector is added is transmitted.

  With this configuration, when restoring the transmitted data stream, it is necessary to perform a restoration process in duplicate with the decoding of the initial vector and the restoration of the non-header part (that is, the data part). The confidentiality of the distributed data stream can be improved.

  Therefore, according to the present invention, it is possible to provide a data transmitting apparatus that can shorten the processing time required for encrypting a data stream, and a data transmitting apparatus that can improve the confidentiality of a distributed data stream. Can do.

FIG. 1 is a schematic configuration diagram of a video distribution system using a network camera provided with a data transmission apparatus according to an embodiment of the present invention.
This video distribution system enables connection between the network camera 100 and terminal devices TA, TB, and TC used by a user via a communication network NW. The communication network NW is configured by, for example, a WAN (Wide Area Network) including the Internet. The terminal devices TA, TB, and TC are configured by, for example, a personal computer provided with a decoder.

  The network camera 100 is configured by, for example, a web camera installed for monitoring, and the captured video stream is encrypted by selectively using encryption keys 1 to N (N is a natural number of 2 or more). Streams are distributed to the terminal devices TA, TB, and TC, respectively. Since the terminal apparatus TA has the encryption keys 1 to N, all the encrypted streams distributed by the network camera 100 can be decrypted. On the other hand, the terminal device TB has the encryption key 1 and the encryption key 2, and the terminal device TC has only the encryption key 1. Therefore, in the terminal device TB and the terminal device TC, only a part corresponding to the encryption key held by each of the encrypted streams distributed by the network camera 100 can be restored (that is, partial viewing).

FIG. 2 is a block diagram showing a functional configuration of this video distribution system. Since the terminal devices TB and TC have the same configuration as the terminal device TA, the description thereof will be omitted, and the terminal device TA will be described with reference to FIG.
The network camera 100 includes an imaging unit 1, an encoder 2, and a data transmission device 3. The imaging unit 1 is composed of, for example, a CCD (Charge Coupled Devices) as an imaging device. The encoder 2 compresses and encodes the video signal output from the imaging unit 1 to generate a stream. For example, M-JPEG (Motion-Joint Photographic Experts Group) or MPEG (Motion Picture Experts Group) can be used as the compression encoding method.

  The data transmission device 3 includes a control unit 31 and a communication interface (communication I / F) 32. The control part 31 is comprised from a central processing unit (CPU: Central Processing Unit), for example, and controls each part. The communication I / F 32 transmits / receives data to / from the terminal device TA under the control of the control unit 31. Further, the data transmission device 3 includes a random number generator 33, a calculator 34, a key storage unit 35, an initial vector generation unit 36, a buffer 37, a header detection unit 38, Is provided.

  The buffer 37 is configured by a storage device such as a RAM, and stores a video stream output from the encoder 2. The header detection unit 38 detects the header part from the video stream stored in the buffer 37 under the control of the control unit 31. The key storage unit 35 stores a plurality of encryption keys used for stream encryption. The initial vector generation unit 36 generates and outputs different initial vector values each time. The random number generator 33 generates a random number (key stream) using the initial vector value output from the initial vector generation unit 36 and the encryption key selected from the key storage unit 35. The computing unit 34 calculates an exclusive OR of the detected header part and the random number output from the random number generator 33, and encrypts the header part.

  On the other hand, the terminal device TA includes a data receiving device 4, a decoder 5, and a display device 6. The data receiving device 4 decrypts the encrypted stream received via the communication network NW, and outputs the decrypted stream to the decoder 5. The decoder 5 decompresses the stream output from the data receiving device 4 to generate a video signal and outputs it to the display device 6. As the display device 6, for example, a liquid crystal display (LCD) or a television monitor is used, and an image is displayed based on a video signal output from the decoder 5.

  The data receiving device 4 includes a control unit 41, a communication interface (communication I / F) 42, a random number generator 43, a computing unit 44, a key storage unit 45, an initial vector storage unit 46, buffers 47 and 48, The header determination unit 49 is provided. The control part 41 is comprised from CPU and controls each part. The communication I / F 42 transmits / receives data to / from the network camera 100 under the control of the control unit 41.

  The buffer 47 stores the encrypted stream received by the communication I / F 42. The control unit 41 reads an initial vector from the encrypted stream stored in the buffer 47 and stores the read initial vector in the initial vector storage unit 46. The random number generation unit 43 generates a random number using the encryption key stored in the key storage unit 45 and the initial vector. Then, the control unit 41 decrypts the header part of the encrypted stream with the generated random number in the arithmetic unit 44, and the decrypted header part is stored in the buffer 48. Under the control of the control unit 41, the header determination unit 49 determines whether the decoded header unit stored in the buffer 48 has been restored to the original header unit.

  Next, the operation of the video distribution system configured as described above will be described. FIG. 3 is a flowchart showing the procedure of the encryption process in the data transmission device 3 and its contents. FIG. 4 is a flowchart showing the procedure of the decryption process in the data receiving apparatus 4 and its contents. FIG. 5 is a diagram showing an example of the data structure of a stream handled by this video distribution system. As shown in FIG. 5, the stream is composed of a collection of data units including a header part, a GOV (Group Of VOP), a user data area, and a plurality of VOPs (Video Object Planes). The user data area is an area for storing arbitrary data designated by the user following the GOV, and the VOP is an area for storing a data portion in the stream. The data transmission device 3 encrypts the header portion of the stream configured in this manner using different encryption keys.

  That is, the control unit 31 of the data transmission device 3 reads the stream input from the encoder 2 into the buffer 37 in step S3a. In step S <b> 3 b, the control unit 31 detects the header part in the stream read into the buffer 37 by the header detection unit 38. When the header part is detected in step S3b, the process proceeds to step S3c, and the control unit 31 causes the random number generator 33 to select the encryption key to be used from the key storage unit 35.

  Next, in step S3d, the control unit 31 causes the random number generator 33 to generate a random number using the initial vector generated by the initial vector generation unit 36 and the selected encryption key. In step S3e, the control unit 31 causes the computing unit 34 to calculate an exclusive OR using the random number generated by the random number generator 33, and encrypts the detected header part. And by step S3f, the control part 31 transmits the said encrypted header part to the terminal device TA by communication I / F32.

  On the other hand, when the non-header part is detected by the header detection unit 38 in step S3b, the control unit 31 stops the random number generator 33 and does not perform the encryption process by the computing unit 34. Thereafter, the process proceeds to step S3f, and the control unit 31 transmits a non-header part that has not been subjected to encryption processing to the terminal device TA by the communication I / F 32.

  Thus, the control unit 31 of the data transmission device 3 transmits the encrypted stream in which only the header portion is encrypted to the terminal device TA by the communication I / F 32. In step S3c, a plurality of encryption keys are stored in the key storage unit 35. For example, as shown in FIG. 5, the random number generator 33 selects a different encryption key for each header portion. Then, encryption is performed using the selected encryption key.

  Next, decryption processing of the encrypted stream in the data reception device 4 will be described with reference to FIG. The control unit 41 of the data receiving device 4 receives the encrypted stream transmitted from the data transmitting device 100 by the communication I / F 42 via the communication network NW. In step S4a, the control unit 41 reads the encrypted stream received by the communication I / F 42 into the buffer 47.

  First, in step S4b, the control unit 41 causes the random number generator 33 to select an encryption key (for example, encryption key 1) from the encryption key storage unit 45. Further, the initial vector is detected from the buffer 47 and stored in the initial vector storage unit 46. Next, in step S4c, the control unit 41 generates a random number using the initial vector stored in the initial vector storage unit 46 by the random number generator 33 and the selected encryption key. In step S <b> 4 d, the control unit 41 uses the arithmetic unit 44 to decode the header portion stored in the buffer 47 using the generated random number and store the decrypted header portion in the buffer 48.

  In step S4e, the control unit 41 determines whether the header determination unit 49 has restored the header stored in the buffer 48 to the original header. This determination is performed, for example, using a start code in the header part. Since this start code is a fixed value such as (00000101) h, for example, it can be determined whether or not the restoration is possible. When the header part can be restored by the determination in step S4e, the control unit 41 outputs the header part restored from the buffer 48 to the decoder 5 in step S4g.

  On the other hand, when the header part cannot be restored by the determination in step S4e, the process proceeds to step S4f, and the control unit 41 determines whether or not all the encryption keys stored in the key storage unit 45 have been selected. In this example, since the terminal device TA stores the encryption keys 1 to N in the key storage unit 45, the terminal device TA shifts to step S4b and causes the random number generator 43 to select another encryption key (for example, encryption key 2). Thus, the decoding process is performed. In the determination in step S4f, if restoration cannot be performed even if all the encryption keys are used, the process is terminated without outputting the header part to the decoder 5.

  In step S4g, when the restored header part is output from the decoder 5, the control part 41 stops the random number generator 43 and decrypts the non-header part (data part) related to the header part. The data is output to the decoder 5 without performing processing. Thus, the decoder 5 converts the input restored stream into a video signal and outputs the converted video signal to the display device 6. A video is displayed on the display device 6 based on this video signal.

  As described above, the control unit 31 of the data transmission device 3 detects the header part from the stream taken into the buffer 37 by the header detection unit 38. When the header portion is detected, the control unit 31 causes the random number generator 33 to select an encryption key from the key storage unit 35, and the initial vector generated by the initial vector generation unit 36 and the selected encryption key Generate random numbers using. Then, the computing unit 34 encrypts the detected header part with the generated random number, and transmits the encrypted header part via the communication I / F 32. On the other hand, when the header detection unit 38 detects a non-header part, the non-header part detected by the communication I / F 32 is transmitted without performing the encryption process.

  Therefore, according to this embodiment, since the amount of data to be encrypted is reduced as compared with the conventional case where the non-header part (that is, the data part) is encrypted, the time required for the encryption process is shortened. be able to. For example, it is assumed that a stream as shown in FIG. 7 is input by the encoder of the network camera 100 and that this stream is partially viewed. In the figure, the header portion is represented as VOH and the data portion is represented as VOP. FIG. 8 shows an example in which the stream shown in FIG. 7 is encrypted by the data transmission device 3 of the above embodiment. FIG. 9 is a diagram illustrating a data configuration of a video stream in which a non-header part is encrypted when partial viewing is performed according to the conventional technology.

  In FIG. 8, since the VOH header is encrypted with different encryption keys, the client A can view all the VOP data in the terminal device TA having all the encryption keys. On the other hand, the client B can view the VOP data belonging to the VOH header encrypted with the respective encryption keys at the terminal device TB having the encryption keys 1 and 2. The client C can view only the VOP data belonging to the VOH header encrypted with the encryption key 1 in the terminal device TC having only the encryption key 1. In this way, the data transmission device 3 acquires attribute information (including encryption key information) possessed by each terminal device, and encrypts the data stream according to the attribute information. As a result, by transmitting the same encrypted data stream, it is possible to perform partial viewing according to the viewing authority possessed by a plurality of clients.

  On the other hand, in the prior art, as shown in FIG. 9, when partial viewing of video is performed, VOP data is collectively encrypted with each encryption key. 8 and 9, it can be seen that the amount of VOH data is smaller than the amount of VOP data, so that the time required for the encryption process can be shortened according to the embodiment of the present invention.

  The present invention is not limited to the above embodiment. For example, in the above embodiment, the encryption is performed using the initial vector generated by the initial vector generation unit 36 and the encryption key selected from the key storage unit 35, but the initial vector generation unit 36 is deleted. It can also be configured. In this case, the header portion is encrypted using only the encryption key selected from the key storage portion 35.

  Moreover, in the said embodiment, although comprised so that all the header parts were encrypted, it is not restricted to this, What is necessary is just to comprise so that only the terminal device which has an encryption key can decompress | restore a data part. You may comprise so that a part may be encrypted. In addition, the following configuration is also possible. In the data transmitting device 3, the data portion (VOP) is encrypted by using the key and the initial vector shared by the terminal device, and an encrypted stream is generated. Further, the initial vector is encrypted with the encryption keys 1 to N, the encrypted initial vector is stored in the header portion of the encrypted stream, and is sent to the terminal device.

  An example of encrypting the initial vector in this way is shown in FIG. The initial vector is a value that is different for each header, for example, inserted into the user data area for encryption / decryption. When the initial vector is used when encrypting the data part (VOP) using a certain key (a common key held by the person to whom the encrypted stream is distributed), the initial vector is not the common key described above but the encryption key. By encrypting using 1 to N, only the terminal device having the corresponding encryption key can decrypt the initial vector and restore the data part. Even with this configuration, partial viewing of the video can be realized. Compared to the case where the data part (VOP) is simply encrypted and distributed, the data transmission apparatus 3 needs to perform the restoration process twice, ie, the initial vector decryption and the data part (VOP) restoration. The confidentiality of the data stream to be transmitted can be improved.

  In the above embodiment, the decryption process of the data reception device 4 is configured to try in order using the encryption key of the terminal device. However, the data transmission device 3 receives the encrypted stream to which the encryption key information is added. You may make it transmit to the apparatus 4. For example, an index is assigned to each encryption key, and the data transmission device 3 adds this index to the encrypted stream and transmits it to the terminal device. Then, the terminal device selects the encryption key based on the index extracted from the received encrypted stream and performs the decryption process.

  The stream used in the present invention is not limited to a video stream, and may be, for example, an audio stream, an image stream, or a stream in which these are multiplexed. In addition, the data transmission device 3 of the present invention may be arranged inside the network camera 100 as in the above embodiment, or in addition, for example, a stream arranged inside the database device and stored in the database Can also be encrypted. In addition, the configuration of the data transmission device 3, the processing procedure of each unit, and the processing content thereof can be variously modified and implemented without departing from the gist of the present invention.

  In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

1 is a schematic diagram of a video distribution system using a network camera equipped with a data transmission apparatus according to an embodiment of the present invention. The block diagram which shows the function structure of the video delivery system shown in FIG. The flowchart which shows the procedure and the content of the encryption process of the data transmitter shown in FIG. The flowchart which shows the procedure of the decoding process of the data receiver shown in FIG. 2, and its content. The data block diagram which shows a mode that a header part is encrypted. The data block diagram which shows a mode that an initial vector is encrypted. The figure which shows the data structure of a general video stream. The figure which shows the data structure of the video stream by which the header part was encrypted. The figure which shows the data structure of the video stream by which the non-header part was encrypted.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Network camera, TA, TB, TC ... Terminal device, NW ... Communication network, 1 ... Imaging unit, 2 ... Encoder, 3 ... Data transmission device, 4 ... Data reception device, 5 ... Decoder, 6 ... Display device, 31 ... Control unit, 32 ... Communication I / F, 33 ... Random number generator, 34 ... Calculator, 35 ... Key storage unit, 36 ... Initial vector generation unit, 37 ... Buffer, 38 ... Header detection unit, 41 ... Control unit, 42 ... Communication I / F, 43 ... Random number generator, 44 ... Calculator, 45 ... Key storage unit, 46 ... Initial vector storage unit, 47, 48 ... Buffer, 49 ... Header determination unit.

Claims (2)

Means for obtaining a data stream having a header portion;
Means for storing a plurality of encryption keys;
Means for detecting the header portion from the data stream;
Means for selecting an encryption key from the plurality of encryption keys;
Means for encrypting the detected header portion with the selected encryption key;
Means for generating an encrypted data stream by replacing the header part included in the data stream with the encrypted header part;
Means for transmitting the generated encrypted data stream. Means for generating an initial vector;
Means for generating a key stream using the initial vector;
Means for encrypting a non-header part included in a data stream by the key stream;
Means for storing a plurality of encryption keys;
Means for selecting an encryption key from the plurality of encryption keys;
Means for encrypting the initial vector with the selected encryption key;
Means for appending the encrypted initial vector to the data stream with the non-header portion encrypted;
Means for transmitting a data stream to which the encrypted initial vector is added.

Images