JP3773471B2 - Falsification position detection method, falsification position detection program, and recording medium recording the program - Google Patents

Description

【００１４】
上式の計算は、Ｐを法とする剰余数系ですべての演算が可能なため、丸め誤差を一切生じない。よって、電子透かしへの応用を考えたとき、Ｐを秘匿しておけば、数論変換の性質から、第三者は期待する変換結果を得ることができないため、Ｐは変換における鍵情報として利用できる。
【００１５】
数論変換を用いた電子透かしの従来手法には、我々が提案した文献［１４］の手法があるが、Ｐにはフェルマー数を用いたものであった。フェルマー数とは、ｔを正の整数とすると、
Ｐ＝２^ｂ＋１、ｂ＝２^ｔ （３）
で表されるため、Ｐの選択には厳しい制限があり、鍵情報として用いるのには必ずしも不適当でない場合があった。そこでＰが素数のべき乗による任意の合成数でも可能である手法を紹介する［１２］。
【００１６】
ｐ_iを素数としてＰ＝ｐ_１ ^ｒ１ｐ_２ ^ｒ２…ｐ_ｉ ^ｒｉで表されるとする。まず、位数をＮ｜ＧＣＤ［（ｐ_１−１）、（ｐ_２−１）、…、（ｐ_ｉ−１）］を満たす正の整数から選択し、ｐ_ｉを法とする位数Ｎの根ｇ_１、ｉを計算する。次に、ｐ_ｉ ^ｒｉを法とする位数Ｎの根ｇ_２、ｉを次のように求める。
【００１７】
【数３】

【００１８】
続いて、中国剰余定理により、Ｐを法とする位数Ｎの根αをｇ_２、ｉより求める。数論変換は以上より算出したパラメータにより実行する。
【００１９】
一般に、剰余系で演算を行う場合取扱える数の範囲を広げるため、異なる法の剰余系の組を用い、演算結果は法ごとの結果の組となる場合がある。中国剰余定理（Chinese remainder theorem）は、この組からある進数で唯一に定まる数を求めるもので次のように表わせる。（青木由直「波動信号処理」、森北出版株式会社、１９８６年４月３日、参照）
【００２０】
［定理］ 法ｍ_ｉ（ｉ＝１、２、・・・、ｌ）を互いに素な正整数に選びＭ＝ｍ_１ｍ_２・・・ｍ_ｌとすると
＜ａ＞_ｍｉ＝ｒ_ｉ （ｉ＝１、２、・・・、ｌ）
（ここに、ｒ_ｉは法ｍ_ｉに関するａの剰余である。）
を満足する正整数ａ（０＜ａ≦Ｍ−１）は次式で唯一に与えられる。
ａ＝Σｄ_ｉｄ_ｉ ^−１ｒ_ｉ （ｍｏｄ Ｍ）
ここで、
Σは、ｉ＝１〜ｌの和
ｄ_ｉ＝Ｍ／ｍ_ｉ 、
ｄ_ｉ ^−１＝（＜ｄ_ｉ＞_ｍｉ）^−１ （ｍｏｄ ｍ_ｉ）
（なお、（＜ｄ_ｉ＞_ｍｉ）^−１は法ｍ_ｉでの乗法逆元。）
【００２１】
１−２．例
例えば、Ｐ＝６１００９＝１３^２×１９^２による数論変換を考える。まず、ＧＣＤ［１２、１８］＝６より、ＮをＮ｜６＝［１、２、３、６］から選択する。ここではＮ＝３を採用する。次に１３と１９を法とする位数３の根を計算する。それぞれをｇ_１、１、ｇ_１、２とすると、ｇ_１、１＝３、ｇ_１、２＝７である。よって、１３^２と１９^２を法とする位数３の根をｇ_２、１、ｇ_２、２とすると、次のようになる。
【００２２】
【数４】

【００２３】
続いて、よく知られた中国剰余定理により、６１００９を法とする位数３の根はα＝６５３と求まる。
【００２４】
図１に、素数１３のｙ^ｘ（ｍｏｄ １３）の説明図を示す。
例えば、１３を法とする位数３の根の見つけ方を考える。ｙが縦、ｘが横である。１が出る周期がＮである時、ｙを１３を法とした位数Ｎ（ここだと３）である。ｙ＝３、９の時、３つおきに“３”が出ているため、３、９が根である。ここでは、例えば、複数の根のうち最小のものを選択することとすると、根＝３となる。なお、数論の全般的なことについては、http://fox.zero.ad.jp/~zat25960/math/number/index.htm等参照。
【００２５】
ここで、一例として、以上に基づき、Ｎ＝３の系列ｘ＝［１０、２０、３０］^Ｔの数論変換を考える。式（１）、（２）は行列表示すると次のようになる。
Ｘ＝［Ｔ］ｘ （４）
ｘ＝［Ｔ］^−１Ｘ （５）
ただし、
Ｘ＝［Ｘ（０）、Ｘ（１）、Ｘ（２）］^Ｔ
ｘ＝［ｘ（０）、ｘ（１）、ｘ（２）］^Ｔ
である。変換行列［Ｔ］は、
【００２６】
【数５】

【００２７】
となり、逆変換行列［Ｔ］^−１は
【００２８】
【数６】

【００２９】
となる。ｘを数論変換すると、
【００３０】
【数７】

【００３１】
となり、［Ｔ］^−１を用いて逆変換すると、
ｘ＝［Ｔ］^−１Ｘ＝［１０、２０、３０］^Ｔ（ｍｏｄ ６１００９）
が得られる。
【００３２】
ここで、例えば、変換後の系列Ｘ＝［６０、５４４５９、６５２０］^ＴがＸ’＝［６１、５４４５９、６５２１］^Ｔに改ざんされたとする。逆変換後の出力ｘ’は、
ｘ’＝［Ｔ］^−１Ｘ’＝［１１、２３８、４０４８５］^Ｔ（ｍｏｄ ６１００９）
となり、ｘとは全く異なる。この結果は、丸め誤差の生じない数論変換の性質から得られるもので、改ざん検出に有効であるといえる。
【００３３】
２．ハードウェア
図２に、システム構成の概略図を示す。このシステムでは、送信者用コンピュータ１０、受信者用コンピュータ２０、認証機関用コンピュータ３０を備える。送信者コンピュータ１０から受信者用コンピュータ２０へは署名情報が電子透かしで埋め込まれた画像情報ｅが伝達される。なお、署名データＳは送信者用コンピュータ１０から受信者用コンピュータ２０との間で予め決定されている。送信者用コンピュータ１０から認証機関用コンピュータ３０は主鍵情報Ｐ、位数Ｎ及び副鍵情報Ｋが送られる。受信者用コンピュータ２０は認証機関用コンピュータ３０からこれら鍵情報Ｐ及びＫを取得する。
【００３４】
送信者から受信者へのｅ、Ｐ、Ｋの伝送手段は、例えば、次のような手段がある。ここで、ｅは公開してもかまわないため、受信者用コンピュータ２０は送信者用コンピュータ１０からｅ−ｍａｉｌで直接送信しても特に問題ないが、鍵情報Ｐ、Ｋは秘密鍵のため、送信者用コンピュータ１０から認証機関コンピュータ３０に送信する場合にはセキュリティの観点から、ＲＳＡなどの暗号化を施した後に送信するべきである。例えば、ディジタルカメラでの運用を考えた場合、カメラから直接認証機関に送信されることが一案である。この場合はｅ−ｍａｉｌではなく、暗号化ファイルを直接パケット交換や回線交換で送信することもできる。これら鍵情報を認証機関コンピュータ３０から送信者用コンピュータ１０が受信する場合も同様である。
【００３５】
図３は、送信者・受信者用コンピュータのハードウェアの構成図である。
このハードウェアは、中央処理装置（ＣＰＵ）である処理部１、入力部２、出力部３、表示部４、記憶部５、インターフェース６を有する。また、処理部１、入力部２、出力部３、表示部４及び記憶部５は、スター又はバス等の適宜の接続手段で接続されている。記憶部５は、パラメータファイル５１、画像ファイル５２を含む。インターフェース６は、インターネット、移動体通信網等の各種ネットワークと接続され、他のコンピュータと情報の送受を無線、又は有線で行う。
【００３６】
３．改ざん位置検出
３−１．埋め込み処理
図４に、埋め込み処理のフローチャートを示す。また、図５は、Ｎ＝２の場合の、一つのブロックに対する埋め込み処理の概念図である。
【００３７】
埋め込み処理を行う送信者用コンピュータ１０は、まず数論変換のパラメータとなる主鍵情報Ｐを決定し、処理部１は、数論変換のための主鍵情報Ｐを、入力部２からの入力又は記憶部５のパラメータファイル５１から読み出すことで設定し、Ｐに基づき位数Ｎ及びＰを法とする位数Ｎの根α等の各種パラメータを設定する（Ｓ１０１）。例えば、Ｐは、記憶部５のパラメータファイル５１に予め素数のべき乗の積による形式で記憶されていてもよいし、入力部２により素数ｐ_ｉ乗数ｒ_iを所望の数に組合せて入力して作成するようにしてもよい。ここでＰは任意の合成数でよいが、１または偶数である場合には数論の性質により、Ｎは１に限定される［１３］。ゆえに、Ｐは３以上の奇数とする。また、画像の画素値の最大値をｏ_ｍａｘとすると、後述の「３−３」で述べる改ざん位置検出処理を考慮して、Ｐ＞＞ｏ_ｍａｘであることが望ましい。
【００３８】
また、処理部１は前述したＮ｜ＧＣＤ［（ｐ_１−１）、（ｐ_２−１）、…、（ｐ_ｉ−１）］から位数Ｎを求める。Ｐを決定すると、一般に、Ｎの候補が複数出てくる。Ｎがユーザで指定又は処理部１が自動設定すると、αは自動的に計算により決定される（計算については前述の具体的例を参照）。複数のＮの候補が求められた場合、Ｎをユーザが入力部により適宜指定・採用することができる。また、処理部１が予め定めた範囲で選択するようにしてもよい。Ｎはブロックサイズと等価であることから、Ｎは小さければ小さいほど検出の精度は高くなるが、Ｎ＝１では数論変換の意味が無くなってしまうため、２以上を選択する。Ｎが大きいほど、一つのブロックに対する鍵情報Ｋ_ｘｙのビット数が大きくなるためよりセキュアになるものの、検出の精度は低くなる。検出の精度とセキュリティの高さはトレードオフの関係にあるといえる。
【００３９】
さらに、処理部１はＰとＮから前述のようにαを求める。処理部１は得られた数論変換のパラメータＰ、Ｎ、αをパラメータファイルに記憶してもよい。
【００４０】
つぎに、処理部１は、ｗＮ×ｈＮ画素の原画像ｏを表した原画像データを記憶部５の画像ファイル５２から読み取る又は入力部２から入力する。（Ｓ１０３）ｏはｗＮ×ｈＮ画素とする。さらに、ｏをＮ×Ｎ画素の原画像のブロックに分割し、この一つの原画像ブロックをｏ_ｘｙ（ｘ＝０、…、ｗ−１、ｙ＝０、…、ｈ−１）とする。また、ｏ_ｘｙの各画素値をｏ_ｉｊ（ｉ、ｊ＝０、…、Ｎ−１）で表す。次に、処理部１は、Ｐに基づきｏ_ｘｙに埋め込む署名情報をｓ_ｘｙとして作成する（Ｓ１０５）。処理部１は、ｏ_ｘｙとｓ_ｘｙの差分を取ることで署名情報を埋め込んだ埋め込み画像ブロックｅ_ｘｙを得る（Ｓ１０７）。つまり、ｅ_ｘｙの各画素値をｅ_ｉｊ、ｓ_ｘｙの各要素値をｓ_ｉｊとすると、
ｅ_ｉｊ＝ｏ_ｉｊ−ｓ_ｉｊ （８）
となる。なお、ここではｓ_ｘｙは、Ｐ、ｘ、ｙ、ｉ、ｊのいずれか又は所定の複数を用いて、適宜の演算により決定することができる。たとえば、εを埋め込み強度を決定する正の整数とすると、
ｓ_ｉｊ＝Ｐ（ｘ＋ｙ＋ｉ＋ｊ）（ｍｏｄε） （９）
又は、
ｓ_ｉｊ＝Ｐ（ｘ・ｙ・ｉ・ｊ）（ｍｏｄε）
等で決定することができる。この関数はあらかじめ送信者と受信者の間で決定しておく。さらに、処理部１は、「１．数論変換」で述べたように、ｅ_ｘｙの数論変換係数Ｅ_ｘｙとｏ_ｘｙ数論変換係数Ｏ_ｘｙを求める（Ｓ１０９、Ｓ１１１）。つぎに、処理部１は、ｏ_ｘｙとｅ_ｘｙから、このブロックに対応する副鍵情報のブロックＫ_ｘｙを生成する（Ｓ１１３）。Ｋ_ｘｙはｅ_ｘｙの数論変換係数とｏ_ｘｙの数論変換係数の逆元の積で得られる。つまり、ｏ_ｘｙとｅ_ｘｙの数論変換係数をそれぞれＯ_ｘｙ、Ｅ_ｘｙとし、Ｏ_ｘｙ、Ｅ_ｘｙ、Ｋ_ｘｙの各要素値をそれぞれＯ_ｉｊ、Ｅ_ｉｊ、Ｋ_ｉｊとすると、
Ｋ_ｉｊ＝Ｅ_ｉｊＯ^−１ _ｉｊ（ｍｏｄＰ） （１０）
となる。
【００４１】
処理部１は、以上の処理をｗ×ｈ個の全ブロックに対して行い、各埋め込み画像ブロックｅ_ｘｙを含む埋め込み画像ｅと、各副鍵情報ブロックＫ_ｘｙを含む副鍵情報Ｋを得て、処理部１は得られたｅ、Ｋを記憶部５の画像ファイル及びパラメータファイルに記憶する（Ｓ１１５）。
【００４２】
送信者用コンピュータ１０の処理部１は、ｅ、Ｐ、Ｎ、Ｋを記憶部５から吸収し、受信者用コンピュータ２０に対してｅ、認証機関用コンピュータ３０にＰ、Ｎ、Ｋを送信する（Ｓ１１７）。ここでは、正規の受信者のみが認証機関から鍵情報を取得することができるものとする。
【００４３】
３−２．抽出処理
図６に、抽出処理のフローチャートを示す。また、図７は、Ｎ＝２の場合の、一つのブロックに対する抽出処理の概念図である。
【００４４】
処理部１は、署名情報を埋め込んだ受信画像のブロックｅ’_ｘｙ（ｘ＝０、…、ｗ−１、 ｙ＝０、…、ｈ−１）に分割し、この各画素値ｅ’_ｉｊ（ｉ、ｊ＝０、…、Ｎ−１）を設定し、その受信画像ｅ’を記憶部５の画像ファイル５２に記憶する（Ｓ２０１）。処理部１は、認証機関用コンピュータ３０から予め取得した主鍵情報Ｐ、位数Ｎ、副鍵情報Ｋ、を記憶部５のパラメータファイル５１から読み取る又は認証機関用コンピュータ３０から受信することで設定する（Ｓ２０２）。処理部１は、Ｐを法とする位数Ｎの根α等のパラメータを計算する（Ｓ２０３）。
【００４５】
処理部１は、各受信画像ブロックｅ’_ｘｙを、読み込み（Ｓ２０４）、予め取得したＰに基づき上述のように数論変換係数Ｅ’_ｘｙに数論変換する（Ｓ２０５）。処理部１は、Ｅ’_ｘｙとＫ_ｘｙの逆元との積をとり受信画像ｅ’に基づく受信原画像ｏ’_ｘｙの数論変換係数Ｏ’_ｘｙを計算する（Ｓ２０７）。
【００４６】
Ｅ’_ｉｊＫ^−１ _ｉｊ＝Ｏ’_ｉｊ（ｍｏｄＰ） （１１）
（ここに、Ｏ’_ｉｊ、Ｅ’_ｉｊ、Ｋ_ｉｊは、Ｏ’_ｘｙ、Ｅ’ _ｘｙ、Ｋ_ｘｙの各要素値をそれぞれ示す。）
【００４７】
処理部１は、得られたＯ’_ｘｙを逆数論変換したものをｏ’_ｘｙとして求める（Ｓ２０９）。処理部１は、署名情報を抽出するため、式（８）に基づき、ｏ’_ｘｙとｅ’_ｘｙとの差をとる（Ｓ２１１）。つまり、差をｓ’_ｘｙとし、ｏ’_ｘｙ、ｓ’_ｘｙの各要素値をｏ’_ｉｊ、ｓ’_ｉｊとすると、
ｏ’_ｉｊ−ｅ’_ｉｊ＝ｓ’_ｉｊ （１２）
となる。処理部は、各前記ステップの処理をｗ×ｈ個の受信画像ブロックに対して行い、Ｓ’_ｘｙとＯ’_ｘｙを得て、記憶部に記憶する（Ｓ２１３）。
【００４８】
３−３．改ざん検出処理
図８に改ざん検出処理のフローチャートを示す。図は一つのブロックに対する検出処理の過程を表したものである。なお本手法では、改ざんがなければ受信側で原画像を復元できる利点がある。処理部１は、記憶部５の画像ファイル５２から受信画像に基づく受信原画像ｏ’_ｘｙの検出対象ブロックを読み込む（Ｓ３０１）。
【００４９】
ここで、ｅ’_ｘｙに改ざんがなければｅ’_ｘｙ＝ｅ_ｘｙである。この場合は、式（８）、式（１０）および数論変換の性質から、ｏ’_ｘｙ＝ｏ_ｘｙ、ｓ’_ｘｙ＝ｓ_ｘｙとなる。一方で、これらの式が成立しない場合は改ざんがあったと見なす。本手法では、例えば、ｏ’_ｘｙおよびｓ’_ｘｙが以下に示す条件を一つでも満たせば（Ｓ３０３、Ｓ３０５、Ｓ３０７）、ｅ’_ｘｙは改ざんされているとする（Ｓ３１１）。一方、処理部１は、全ての条件をクリアすれば改ざんされていないとする。（Ｓ３１３）
条件１（Ｓ３０３） ｏ’_ｉｊ＞ｏ_ｍａｘである。
条件２（Ｓ３０５） 式（９）から署名情報を生成し、ｓ’_ｘｙと一致しない。
条件３（Ｓ３０７） ｏ’_ｘｙ、ｓ’_ｘｙ、式（８）および式（１０）より副鍵情報を生成し、受信したＫ_ｘｙと一致しない。
【００５０】
条件１は、ｏ’_ｘｙが画像としての要件を満たしていない場合は改ざんと見なすものである。Ｐ＞＞ｏ_ｍａｘである場合に、この条件は有効である。条件２と条件３については、ｏ’_ｘｙ＝ｏ_ｘｙ、ｓ’_ｘｙ＝ｓ_ｘｙであれば、ｏ’_ｘｙやｓ’_ｘｙから署名情報や副鍵情報を生成したものと、受信した署名情報や副鍵情報は一致するはずである。もし一致しない場合は、改ざんされていると見なせる。なお、これら条件１〜３のうち例えば条件３のみでも判定可能である。また、条件３の処理をすべてに行うと処理に時間を要するため、比較的処理が複雑ではない条件１及び２を用いることで検出処理時間を短縮することもできる。その他、適宜の条件及びその組み合わせを用いることができる。
【００５１】
４．改ざん訂正
図９は、改ざん訂正についてのフローチャートである。ステップＳ３０１〜Ｓ３１３は改ざん検出処理の各ステップの処理と同様であり、改ざんを検出する処理である。
【００５２】
３−３で述べたすべての条件を満たさないブロックは、改ざんされていない正規ブロックの場合のみである（Ｓ３１３）。ゆえにそのようなブロックを全数探索すればよい。ただ、全数探索では多大な計算時間を必要とするため、工夫が必要である。
【００５３】
改ざんがされている場合（Ｓ３１１）、処理部１は、初めての改ざん検出処理か判断する（Ｓ４０１）。処理部１は、初めての改ざん検出の場合は、探索パターンのための初期値を周囲のブロックに基づき設定する（Ｓ４０３）。
【０００５４】
処理部１は、改ざんされたと判断された対象ブロックの各画素に、初期値又は初期値から派生する複数値の任意の組合わせを当てはめた探索パターンを作成する（Ｓ４０５）。処理部１は、作成された探索パターンに基づき判断するステップＳ３０３〜Ｓ３０７で改ざんされていないと判断されるまで、探索パターンを作成するステップＳ４０５及び判断するステップＳ３０３〜Ｓ３１１を繰り返し、該当する探索パターンを求める。処理部１は、求めた探索パターンを記憶部５の画像ファイル５２に記憶する（Ｓ４０７）。
【００５５】
図１０に、改ざん訂正のスキャンについての説明図を示す。また、図１１に、改ざん訂正における検索を開始する初期値の算出と検索についての説明図を示す。
【００５６】
今、ｅ’_ｘｙに改ざんが検出されたとする。図に示す方向にスキャンして改ざん訂正を行うとすると、隣接する二つのブロックであるｅ’_{ｘ（ｙ−１）}とｅ’_{（ｘ−１）ｙ}は正規のブロックである。自然画像は画素値の変化が小さいという特徴があるため、ｅ’_{ｘ（ｙ−１）}とｅ’_{（ｘ−１）ｙ}の各画素値の平均は、ｅ’_ｘｙの真値に近いと予測できる。よって、この予測値を初期値として探索を開始することで、探索にかかる時間を短縮できる。
【００５７】
図１２に、改ざん訂正における探索パターン作成についての説明図を示す。
図の具体例で説明すると、例えば、一段目の探索ではすべて１０７のパターンを作ってテストする。二段目では１０６、１０７、１０８の三つの数字を使ったすべてのＮ×Ｎのパターンについてテストする。（この例では３^４＝８１通り）さらに、三段目では５^４＝６２５通りとなる。このように、テストするパターンを生成する ための数字の数をだんだん増やしていき、真値が見つかるまで幅を広げながら探索する。
【００５８】
５．シミュレーション実験
図１３に、実験に用いたパラメータの説明図を示す。図１４、図１５に、シミュレーション実験の結果についての説明図（１）、（２）を示す。
本手法を図１４（ａ）に示す標準画像ＬＥＮＡに適用し、有効性を検証した。ＬＥＮＡは２５６×２５６画素、８ｂｉｔ階調の白黒画像である。
【００５９】
５−１．改ざん位置検出実験
埋め込み処理を行った結果が図１４（ｂ）である。ＳＮＲは４３．１ｄＢとなり、署名情報の埋め込み強度が小さいことから、埋め込みによる劣化はほとんど目立たなかった。ただし、ＳＮＲは以下の式で算出した。
【００６０】
【数８】

【００６１】
ここで、ｏｒｇ_ｉｊは原画像の画素値、ｅｍｂ_ｉｊは埋め込み画像の画素値である。
【００６２】
次に、図１４（ｂ）を図１４（ｃ）のように改ざんを行った。これは図１４（ｂ）において２０×２０画素の矩形領域内を輝度値２００で塗りつぶしたものである。図１４（ｄ）が本手法による改ざん検出結果である。変色した箇所が、改ざんと判定された箇所である。変色箇所と実際の改ざん箇所は一致していることから、提案手法が有効であることがわかった。
【００６３】
５−２．改ざん訂正実験
様々な箇所に前節と同様の改ざんを行い、提案手法による改ざん訂正を行った。図１５（ａ）は、図１４（ｃ）のような画素値の変化が小さい箇所に改ざんを行った場合の改ざん訂正結果である。一方、図１５（ｃ）は、図１５（ｂ）のような画素値の変化が大きな箇所に改ざんを行った場合の改ざん訂正結果である。いずれの場合も改ざん前の画像と全く同じものが得られ、提案手法が有効であることがわかった。
【００６４】
なお図１６は、改ざん箇所における隣接画素の差分値の標準偏差を横軸に、改ざん訂正処理に要した時間を縦軸にしたグラフである。標準偏差が大きいほど時間がかかることがわかった。
【００６５】
６．考察
シミュレーション実験の結果、提案手法ではブロック単位での位置検出が可能であることがわかった。ゆえに、ブロックサイズＮは小さいほど正確な位置検出が可能であるが、一方でＫ_ｘｙのビット数が小さくなるため、全数探索に対する安全性は低下する。この問題を改善するために、法Ｐをできるだけ大きな整数の中から選ぶことを考える。例えば、Ｎ＝２、Ｐは３２ｂｉｔで表すことのできる整数の中から選ぶとすると、一つのブロックは３２×２×２＝１２８ｂｉｔのＫ_ｘｙを持つことになり、全数探索によってＫ_ｘｙを同定することが非常に困難となるので、安全性を高めることができる。また、標準偏差が大きいほど改ざん訂正処理に時間が増大している。これは、本発明による改ざん訂正は付近の画素からの予測値を初期値として真値の探索を始めるが、エッジ部分のような標準偏差が大きな箇所に改ざんが行われた場合、その予測値と真値の誤差が大きくなるからだと考えられる。
【００６６】
７．むすび
本発明では、数論変換による脆弱型電子透かしを用いた改ざん位置の検出と訂正について検討した。シミュレーション実験を通じて提案手法の有効性について検討し、良好な結果を得た。
【００６７】
本発明の改ざん位置検出方法・改ざん訂正方法又は改ざん位置検出・改ざん訂正の装置・システムは、その各手順をコンピュータに実行させるための改ざん位置検出プログラム・改ざん訂正プログラム、改ざん位置検出プログラム・改ざん訂正プログラムを記録したコンピュータ読み取り可能な記録媒体、改ざん位置検出プログラム・改ざん訂正プログラムを含みコンピュータの内部メモリにロード可能なプログラム製品、そのプログラムを含むサーバ等のコンピュータ、等により提供されることができる。
【００６８】
８．文献
［１］ＮＴＴデータ経営研究所（編著）、電子文書署名、ＮＴＴ出版株式会社、東京、２００１．
［２］遠藤直樹、小出昭夫、“コンテンツ配信と不正コピー防止、”信学会誌、Vol.83,No.2、pp.117-121,Feb.2000.
［３］小野束（著）、電子透かしとコンテンツ保護、オーム社、東京、２００１．
［４］P. S. L. M. Barreto, H.Y.Kim,and V.Rijmen, “Toward A Secure Public-Key Blockwise Fragile Authentication Watermarking,” Proc. IEEE Int. Conf. Image Processing, vol.2, pp.494-497, 2001.
［５］P. W. Wong, “A Public Key Watermarking of Image Verification and Authentication、” Proc. IEEE Int. Conf. Image Processing, vol.1, MA11.07, 1998.
［６］岩村恵市、林純一、桜井幸一、今井秀樹、“安全な改ざん位置検出用電子透かしに関する考察と提案、”コンピュータセキュリティシンポジウム、pp.283-288, Oct. 2001.
［７］小野束、“電子文書改竄検出方法およびその装置、”公開特許広報、特開２００２−４４４２９、日本国特許庁、Ｆｅｂ．２００２.
［８］H. Tamori, N. Aoki, and T. Yamamoto, “A Fragile Digital Watermarking Technique by Number Theoretic Transform,” IEICE Trans. Fundamentals, Aug.2002. (to be published)
［９］J. H. McClellan, and C. M. Rader, “Number Theory in Digital Signal Processing,” Prentice-Hall, New Jersey, 1979.
［１０］電子情報通信学会（編）、ディジタル信号処理ハンドブック、オーム社、東京、１９９３.
［１１］Ｓ．Ｃ．Ｃｏｕｔｉｎｈｏ（著）、林彬（訳）、暗号の数学的基礎、シュプリンガー・フェアラーク東京株式会社、東京、２００１．
［１２］Ｈ．Ｊ．Ｎｕｓｓｂａｕｍｅｒ（著）、佐川雅彦、本間仁志（訳）、高速フーリエ変換のアルゴリズム、科学技術出版社、東京、１９８９．
［１３］谷荻隆嗣（著）、ディジタル信号処理ライブラリー４ アルゴリズムと並列処理、コロナ社、東京、２０００．
［１４］田森秀明、青木直史、山本強、“数論変換を用いた改ざん検出可能な電子透かし方式、”信学技報IE2001-33,pp.105-110, Jul. 2001.
［１５］J. Fridrich and M. Goljan, “Protection of Digital Images Using Self-Embedding,” Symposium on Content Security and Data Hiding in Digital Media, New Jersey Institute of Technology, May 1999.
［１６］J. Fridrich and M. Goljan, “Images with Self-Correcting Capabilities,” ICIP’99, Kobe, Japan, Oct. 1999.
【００６９】
【発明の効果】
本発明によると、以上のように、数論変換（ＮＴＴ：Number Theoretic Transform）による脆弱型電子透かしを用いた改ざん位置検出手法を提供することができる。さらに、本発明によると、数論変換に基づく新たな手法により、改ざんの位置検出だけでなく、数論変換の性質から、改ざん訂正手法を提供することができる。
【００７０】
本発明によると、受信者は透かし情報が埋め込まれた画像を受け取った後、認証機関から取得した鍵情報を用いて原本性を確認する。この過程で送信者は、原本そのものを受信者あるいは認証機関に伝送する必要がなく、原本を第三者に見せることなく保護することができる。
【００７１】
また、本発明は、インターネット回線を利用した画像を含む公文書の伝送、ディジタルカメラやスキャナ等によって取得された画像の原本性保証、画像に施された各種修正や特殊効果の同定と除去等に利用できると考えられる。
【図面の簡単な説明】
【図１】素数１３のｙ^ｘ（ｍｏｄ １３）の説明図。
【図２】システム構成の概略図。
【図３】送信者・受信者用コンピュータのハードウェアの構成図。
【図４】埋め込み処理のフローチャート。
【図５】Ｎ＝２の場合の、一つのブロックに対する埋め込み処理の概念図。
【図６】抽出処理のフローチャート。
【図７】Ｎ＝２の場合の、一つのブロックに対する抽出処理の概念図。
【図８】改ざん検出処理のフローチャート。
【図９】改ざん訂正についてのフローチャート。
【図１０】改ざん訂正のスキャンについての説明図
【図１１】改ざん訂正における検索を開始する初期値の算出と検索についての説明図。
【図１２】改ざん訂正における探索パターン作成についての説明図。
【図１３】実験に用いたパラメータの説明図。
【図１４】シミュレーション実験の結果についての説明図（１）。
【図１５】シミュレーション実験の結果についての説明図（２）。
【図１６】改ざん箇所における隣接画素の差分値の標準偏差を横軸に、改ざん訂正処理に要した時間を縦軸にしたグラフ。
【符号の説明】
１０ 送信者用コンピュータ
２０ 受信者用コンピュータ
３０ 認証機関用コンピュータ[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a falsification position detection method, a falsification position detection program, and a recording medium on which the program is recorded, and more particularly to a falsification position detection technique and a falsification correction technique for a still image using a fragile digital watermark by number theory conversion.
[0002]
[Prior art]
In general, images used for official documents such as evidence photographs are required to have sufficient originality, but digital images can be easily tampered with to eliminate unnaturalness. There is a need for tamper detection technology. Conventionally, an electronic signature using a hash function has been studied as a method for realizing these purposes [1]. (Hereinafter, [] indicates the documents described later.) However, such an electronic signature is not intended to detect the position of tampering, which is one of the various modern requirements.
[0003]
As one method for enabling this, an application of digital watermark has been studied [2] [3]. In the target digital content, a weak digital watermark that is intentionally fragile to a specific attack is repeatedly embedded in the entire content in small blocks. In the alteration detection processing stage, the destroyed digital watermark is identified, and the location of the alteration is specified.
[0004]
Conventionally, as a conventional method for detecting a falsification position by digital watermark, a method of embedding a hash value or a parity value obtained from digital contents in an LSB (Least Significant Bit) of a bit plane has been mainly [4]- [7].
[0005]
[Problems to be solved by the invention]
Digital watermarks as copyright protection technology are attracting attention from the viewpoint of tampering detection. This is because digital watermarks that are vulnerable to specific processing can be used for tampering detection. However, in detecting the falsification position of a still image, a technique that does not require an original image and can detect any falsification is ideal. Also, considering algorithm disclosure, it is desirable to consider the use of key information. Further, the conventional method of falsification position submission by digital watermark as described above does not consider the correction of the falsified position.
[0006]
The present invention has been made in view of the above points, and an object thereof is to provide a falsification position detection method using a fragile digital watermark by number theoretic transform (NTT). Furthermore, an object of the present invention is to provide a falsification correction method based on the nature of number theoretic conversion as well as the position detection of falsification by a new method based on number theoretic conversion [8].
[0007]
In the present invention, the sender receives the image in which the watermark information is embedded, and then confirms the originality by using the key information acquired from the certification authority. It is an object of the present invention to provide a tampering position detection / correction method that can protect an original without showing it to a third party.
[0008]
In addition, the present invention can be used for transmission of public documents including images using the Internet line, guaranteeing the originality of images obtained by digital cameras, scanners, etc., and identifying and removing various modifications and special effects applied to images. An object of the present invention is to provide a tampering position detection method that can be used.
[0009]
[Means for Solving the Problems]
According to the first solution of the present invention,
The processing unit sets the main key information P for number theory conversion by reading from the input unit or reading from the storage unit, and obtains the order α and the root α of the order N modulo P based on P. Steps,
The processing unit has a plurality of original image blocks o representing the original image o of wN × hN pixels._xyEach pixel value o (x = 0,..., W−1, y = 0,..., H−1)_ijReading (i, j = 0,..., N−1) from the storage unit or inputting from the input unit;
The processing unit calculates each pixel value o based on P._xySignature information embedded in_xyThe steps of creating
The processing unit is o_xyAnd s_xyEmbedded image block with signature information embedded by taking the difference between_xyAnd getting the steps
The processing unit is e_xyNumber conversion factor E_xyAnd o_xyNumber conversion factor O_xyA step of seeking
The processing unit calculates the block K of the sub key information corresponding to each block by the following equation:_xyA step of generating
K_ij= E_ijO^-1 _ij(ModP)
(Here, O_ij, E_ij, K_ijIs O_xy, E_xy, K_xyEach element value of is shown. O^-1 _ijIs O_ijIs the inverse of )
The processing unit performs processing of each of the above steps by w × h original pixel blocks o_xyEmbedded image block e_xySub key information block K_xyObtaining and storing in the storage unit;
The processing unit is e_xy, P, N, K_xyA step of sending
And a computer-readable recording medium on which a falsification position detection program for causing a computer to execute each step is recorded.
[0010]
According to the second solution of the present invention,
The processing unit converts the received image in which the signature information is embedded into the received image block e ′._xy(X = 0,..., W−1, y = 0,..., H−1), and each pixel value e ′_ij(I, j = 0,..., N−1) is set, and the received image block e ′_xyStoring in the storage unit;
The processing unit includes main key information P, order N, and sub key information K._xyReading or receiving from the storage unit, and
The processing unit calculates the root α of the order N modulo P;
The processing unit receives each received image block e ′._xyBased on the previously obtained P, the order N, and the root α of the order N modulo P._xyTransforming the number theory into
The processing unit obtains the received image block e ′ by the following equation:_xyReceived original image based on_xyNumber theory conversion coefficient O '_xyA step of calculating
E ’_ijK^-1 _ij= O ’_ij(ModP)
(Here O ’_ij, E ’_ij, K_ijIs O ’_xy, E ’ _xy, K_xyEach element value of is shown. K^-1 _ijIs K_ijIs the inverse of )
The processing unit obtains the O '_xyO ’_xyA step of calculating
The processing unit is o ’_xyAnd e ’_xyBy taking the difference between the signature information s'_xyExtracting the
The processing unit performs the process of each step on w × h received image blocks, and s ′_xyAnd o ’_xyObtaining and storing in the storage unit;
And a computer-readable recording medium on which a falsification position detection program for causing a computer to execute each step is recorded.
[0011]
DETAILED DESCRIPTION OF THE INVENTION
In the present embodiment, an overview of number-theoretic conversion and a falsification position detection method and falsification correction method using a fragile digital watermark using number-theoretic conversion will be described. In addition, the effectiveness will be described through a simulation experiment for the present embodiment.
[0012]
1. Number theory conversion
1-1. Overview
First, number theory conversion will be described [8]-[13]. Parameters P, α, u are positive integers, N is α^N= 1 (modP) is the smallest positive integer. Here, φ (P) is an Euler function, and if α is an integer number smaller than P and relatively prime to P, α satisfying N = φ (P) is called a primitive root of order N, and N <Α of φ (P) is simply called the root of the order N. Uu^-1= 1 (modP)^-1Is called the inverse of N modulo P.
Here, consider the following conversion pair using α.
[0013]
[Expression 2]

[0014]
The calculation of the above formula does not cause any rounding error because all operations can be performed in a residue number system modulo P. Therefore, when considering application to digital watermarking, if P is concealed, the conversion result expected by a third party cannot be obtained due to the nature of number theoretic conversion, so P is used as key information in the conversion. it can.
[0015]
The conventional method of digital watermarking using number theoretic transformation is the method of the literature [14] that we have proposed, but P uses the Fermat number. Fermat's number means that t is a positive integer.
P = 2^b+1, b = 2^t        (3)
Therefore, there are severe restrictions on the selection of P, which may not always be appropriate for use as key information. Therefore, we introduce a method in which P can be any composite number that is a power of a prime number [12].
[0016]
p_iIs a prime number P = p₁ ^r1p₂ ^r2... p_i ^riIt is assumed that First, the order is represented by N | GCD [(p₁-1), (p₂-1), ..., (p_i-1)] is selected from positive integers, and p_iRoot of order N modulo_{1, i}Calculate Then p_i ^riRoot of order N modulo_{2, i}Is obtained as follows.
[0017]
[Equation 3]

[0018]
Subsequently, the root α of the order N modulo P is given by the Chinese remainder theorem as g_{2, i}Ask more. Arithmetic conversion is performed using the parameters calculated above.
[0019]
In general, in order to expand the range of numbers that can be handled when performing operations in a residue system, a set of residue systems of different moduli is used, and the operation result may be a set of results for each method. The Chinese remainder theorem seeks a number that is uniquely determined from a certain decimal number from this set and can be expressed as follows. (Refer to Yoshinao Aoki “Wave Signal Processing”, Morikita Publishing Co., Ltd., April 3, 1986)
[0020]
[Theorem] Modal m_i(I = 1, 2,..., L) are chosen as prime prime integers, and M = m₁m₂... m_lIf
<a>_mi= R_i  (I = 1, 2,..., L)
(Where r_iIs the modulo m_iIs the remainder of a. )
A positive integer a that satisfies (0 <a ≦ M−1) is uniquely given by the following equation.
a = Σd_id_i ^-1r_i  (Mod M)
here,
Σ is the sum of i = 1 to l
d_i= M / m_i  ,
d_i ^-1= (<D_i>_mi)^-1  (Mod m_i)
(Note that (<d_i>_mi)^-1Is the modulo m_iMultiplicative inverse in )
[0021]
1-2. Example
For example, P = 61009 = 13²× 19²Consider the number theoretic transformation. First, from GCD [12, 18] = 6, N is selected from N | 6 = [1, 2, 3, 6]. Here, N = 3 is adopted. Next, the root of order 3 modulo 13 and 19 is calculated. G for each_{1, 1}, G_{1, 2}Then g_{1, 1}= 3, g_{1, 2}= 7. Therefore, 13²And 19²The root of order 3 modulo_{2, 1}, G_{2, 2}Then, it becomes as follows.
[0022]
[Expression 4]

[0023]
Subsequently, according to the well-known Chinese remainder theorem, the root of order 3 modulo 61010 is obtained as α = 653.
[0024]
In FIG.^xAn explanatory view of (mod 13) is shown.
For example, consider how to find the root of order 3 modulo 13. y is vertical and x is horizontal. When the period in which 1 appears is N, y is an order N modulo 13 (here, 3). When y = 3 and 9, “3” appears every third, so 3 and 9 are roots. Here, for example, if the smallest one of a plurality of roots is selected, root = 3. For general information on number theory, see http://fox.zero.ad.jp/~zat25960/math/number/index.htm.
[0025]
Here, as an example, based on the above, N = 3 series x = [10, 20, 30]^TConsider the number theoretic transformation. Expressions (1) and (2) are expressed as follows in matrix form.
X = [T] x (4)
x = [T]^-1X (5)
However,
X = [X (0), X (1), X (2)]^T
x = [x (0), x (1), x (2)]^T
It is. The transformation matrix [T] is
[0026]
[Equation 5]

[0027]
And the inverse transformation matrix [T]^-1Is
[0028]
[Formula 6]

[0029]
It becomes. If x is converted to number theory,
[0030]
[Expression 7]

[0031]
[T]^-1When inversely transformed using
x = [T]^-1X = [10, 20, 30]^T(Mod 61090)
Is obtained.
[0032]
Here, for example, the converted sequence X = [60, 54459, 6520].^TX ′ = [61, 54459, 6521]^TSuppose it has been tampered with. The output x ′ after the inverse transformation is
x ′ = [T]^-1X '= [11,238, 40485]^T(Mod 61090)
And is completely different from x. This result is obtained from the nature of the number theoretic transformation that does not cause rounding errors, and can be said to be effective for tamper detection.
[0033]
2. hardware
FIG. 2 shows a schematic diagram of the system configuration. This system includes a sender computer 10, a recipient computer 20, and a certificate authority computer 30. Image information e in which signature information is embedded with a digital watermark is transmitted from the sender computer 10 to the receiver computer 20. The signature data S is determined in advance between the sender computer 10 and the receiver computer 20. The main key information P, the order N, and the sub key information K are sent from the sender computer 10 to the certification authority computer 30. The recipient computer 20 acquires the key information P and K from the certification authority computer 30.
[0034]
Examples of means for transmitting e, P, and K from the sender to the receiver include the following means. Here, since e may be disclosed, there is no particular problem even if the recipient computer 20 directly transmits from the sender computer 10 by e-mail. However, since the key information P and K are secret keys, In the case of transmission from the sender computer 10 to the certification authority computer 30, it should be transmitted after encryption such as RSA is performed from the viewpoint of security. For example, when considering operation with a digital camera, it is one idea to transmit directly from the camera to the certification authority. In this case, instead of e-mail, the encrypted file can be transmitted directly by packet switching or circuit switching. The same applies when the sender computer 10 receives the key information from the certification authority computer 30.
[0035]
FIG. 3 is a hardware configuration diagram of the sender / receiver computer.
This hardware includes a processing unit 1, which is a central processing unit (CPU), an input unit 2, an output unit 3, a display unit 4, a storage unit 5, and an interface 6. Further, the processing unit 1, the input unit 2, the output unit 3, the display unit 4, and the storage unit 5 are connected by appropriate connection means such as a star or a bus. The storage unit 5 includes a parameter file 51 and an image file 52. The interface 6 is connected to various networks such as the Internet and a mobile communication network, and transmits and receives information to and from other computers wirelessly or by wire.
[0036]
3. Tamper detection
3-1. Embedding process
FIG. 4 shows a flowchart of the embedding process. FIG. 5 is a conceptual diagram of the embedding process for one block when N = 2.
[0037]
The sender computer 10 that performs the embedding process first determines the main key information P that is a parameter for the number theoretic conversion, and the processing unit 1 inputs or stores the main key information P for the number theoretic conversion from the input unit 2. Various parameters such as the order α and the root α of the order N modulo P are set based on P and set by reading from the parameter file 51 of the unit 5 (S101). For example, P may be stored in advance in the parameter file 51 of the storage unit 5 in the form of a product of the powers of prime numbers, or the prime number p by the input unit 2._iMultiplier r_iIt is also possible to create them by inputting them in a desired number. Here, P may be any composite number, but if it is 1 or even, N is limited to 1 due to the nature of number theory [13]. Therefore, P is an odd number of 3 or more. Also, the maximum pixel value of the image is set to o_maxThen, considering the falsification position detection process described in “3-3” described later, P >> o_maxIt is desirable that
[0038]
Further, the processing unit 1 uses the above-described N | GCD [(p₁-1), (p₂-1), ..., (p_i-1)] to obtain the order N. When P is determined, generally, a plurality of N candidates appear. When N is specified by the user or automatically set by the processing unit 1, α is automatically determined by calculation (refer to the specific example described above for calculation). When a plurality of N candidates are obtained, the user can appropriately designate and adopt N by the input unit. Further, the processing unit 1 may make a selection within a predetermined range. Since N is equivalent to the block size, the smaller N is, the higher the accuracy of detection is. However, when N = 1, the meaning of number-theoretic conversion is lost, so 2 or more is selected. The larger N is, the key information K for one block_xySince the number of bits increases, the accuracy of detection is reduced, although it is more secure. It can be said that there is a trade-off between detection accuracy and security.
[0039]
Further, the processing unit 1 obtains α from P and N as described above. The processing unit 1 may store the obtained number theoretic transformation parameters P, N, and α in a parameter file.
[0040]
Next, the processing unit 1 reads original image data representing the original image o of wN × hN pixels from the image file 52 of the storage unit 5 or inputs it from the input unit 2. (S103) o is a wN × hN pixel. Further, o is divided into N × N pixel original image blocks, and this one original image block is divided into o._xy(X = 0,..., W−1, y = 0,..., H−1). Also o_xyEach pixel value of o_ij(I, j = 0,..., N−1). Next, the processing unit 1 performs o based on P._xyThe signature information to be embedded in_xy(S105). The processing unit 1 is o_xyAnd s_xyEmbedded image block with signature information embedded by taking the difference between_xyIs obtained (S107). That is, e_xyFor each pixel value of e_ij, S_xyEach element value of s_ijThen,
e_ij= O_ij-S_ij          (8)
It becomes. Here, s_xyCan be determined by an appropriate calculation using any one of P, x, y, i, j, or a predetermined plurality. For example, if ε is a positive integer that determines the embedding strength,
s_ij= P (x + y + i + j) (modε) (9)
Or
s_ij= P (x.y.i.j) (mod.epsilon)
Etc. can be determined. This function is determined in advance between the sender and the receiver. Further, as described in “1. Arithmetic Conversion”, the processing unit 1 e_xyNumber conversion factor E_xyAnd o_xyArithmetic conversion coefficient O_xyIs obtained (S109, S111). Next, the processing unit 1_xyAnd e_xyTo the subkey information block K corresponding to this block._xyIs generated (S113). K_xyIs e_xyNumber theory conversion coefficient and o_xyIs obtained by the product of the inverse elements of That is, o_xyAnd e_xyThe number theory conversion coefficient of O_xy, E_xyAnd O_xy, E_xy, K_xyEach element value of O_ij, E_ij, K_ijThen,
K_ij= E_ijO^-1 _ij(ModP) (10)
It becomes.
[0041]
The processing unit 1 performs the above processing on all w × h blocks, and each embedded image block e_xyEmbedded image e including each subkey information block K_xyIs obtained, and the processing unit 1 stores the obtained e and K in the image file and parameter file of the storage unit 5 (S115).
[0042]
The processing unit 1 of the sender computer 10 absorbs e, P, N, and K from the storage unit 5 and transmits e to the receiver computer 20 and P, N, and K to the certification authority computer 30. (S117). Here, it is assumed that only legitimate recipients can obtain key information from the certification authority.
[0043]
3-2. Extraction process
FIG. 6 shows a flowchart of the extraction process. FIG. 7 is a conceptual diagram of extraction processing for one block when N = 2.
[0044]
The processing unit 1 receives the block e ′ of the received image in which the signature information is embedded._xy(X = 0,..., W−1, y = 0,..., H−1), and each pixel value e ′_ij(I, j = 0,..., N−1) is set, and the received image e ′ is stored in the image file 52 of the storage unit 5 (S201). The processing unit 1 sets the main key information P, the order N, and the sub key information K acquired in advance from the certification authority computer 30 by reading from the parameter file 51 of the storage unit 5 or receiving from the certification authority computer 30. (S202). The processing unit 1 calculates parameters such as the root α of the order N modulo P (S203).
[0045]
The processing unit 1 receives each received image block e ′_xyIs read (S204) and based on the previously acquired P, the number conversion coefficient E '_xyThe number theory is converted into (S205). The processing unit 1 uses E ′_xyAnd K_xyReceived original image o 'based on the received image e'_xyNumber theory conversion coefficient O '_xyIs calculated (S207).
[0046]
E ’_ijK^-1 _ij= O ’_ij(ModP) (11)
(Here O ’_ij, E ’_ij, K_ijIs O ’_xy, E ’ _xy, K_xyEach element value of is shown. )
[0047]
The processing unit 1 obtains the O ′ obtained_xyO '_xy(S209). In order to extract the signature information, the processing unit 1 extracts o ′ based on Expression (8)._xyAnd e ’_xy(S211). In other words, the difference is s ’_xyAnd o ’_xy, S ’_xyEach element value of o ’_ij, S ’_ijThen,
o ’_ij-E ’_ij= S ’_ij        (12)
It becomes. The processing unit performs the processing of each step on w × h received image blocks, and S ′_xyAnd O ’_xyAnd stored in the storage unit (S213).
[0048]
3-3. Tamper detection processing
FIG. 8 shows a flowchart of falsification detection processing. The figure shows the process of detection processing for one block. Note that this method has an advantage that the original image can be restored on the receiving side if there is no alteration. The processing unit 1 receives the received original image o ′ based on the received image from the image file 52 in the storage unit 5._xyThe detection target block is read (S301).
[0049]
Where e ’_xyIf there is no tampering with e ’_xy= E_xyIt is. In this case, from the properties of Equation (8), Equation (10) and number conversion, o ′_xy= O_xy, S ’_xy= S_xyIt becomes. On the other hand, if these formulas do not hold, it is considered that there has been falsification. In this method, for example, o ′_xyAnd s ’_xyIf at least one of the following conditions is satisfied (S303, S305, S307), e '_xyIs assumed to have been tampered with (S311). On the other hand, it is assumed that the processing unit 1 has not been tampered with if all the conditions are cleared. (S313)
Condition 1 (S303) o ′_ij> O_maxIt is.
Condition 2 (S305) Signature information is generated from Expression (9), and s'_xyDoes not match.
Condition 3 (S307) o '_xy, S ’_xySubkey information is generated from Equation (8) and Equation (10) and received K_xyDoes not match.
[0050]
Condition 1 is o ’_xyIs considered tampering if it does not meet the image requirements. P >> o_maxThis condition is valid if For conditions 2 and 3, o ’_xy= O_xy, S ’_xy= S_xyThen o ’_xyOr s ’_xyThe signature information and subkey information generated from the signature information and the received signature information and subkey information should match. If they do not match, it can be assumed that they have been tampered with. Of these conditions 1 to 3, for example, only condition 3 can be determined. Further, since the processing takes time when all the processing of condition 3 is performed, the detection processing time can be shortened by using conditions 1 and 2 that are relatively uncomplicated. In addition, appropriate conditions and combinations thereof can be used.
[0051]
4). Tampering correction
FIG. 9 is a flowchart for tampering correction. Steps S301 to S313 are the same as the processing of each step of the falsification detection process, and are processes for detecting falsification.
[0052]
Blocks that do not satisfy all the conditions described in 3-3 are only regular blocks that have not been tampered with (S313). Therefore, it is sufficient to search all such blocks. However, since exhaustive search requires a great amount of calculation time, it needs to be devised.
[0053]
If tampering has been performed (S311), the processing unit 1 determines whether it is the first tampering detection process (S401). In the case of the first alteration detection, the processing unit 1 sets an initial value for the search pattern based on the surrounding blocks (S403).
[00054]
The processing unit 1 creates a search pattern in which an initial value or an arbitrary combination of a plurality of values derived from the initial value is applied to each pixel of the target block determined to have been tampered with (S405). The processing unit 1 repeats Step S405 for creating a search pattern and Steps S303 to S311 for judging until it is judged that it has not been falsified in Steps S303 to S307 for judging based on the created search pattern. Ask for. The processing unit 1 stores the obtained search pattern in the image file 52 of the storage unit 5 (S407).
[0055]
FIG. 10 is an explanatory diagram for scanning for falsification correction. FIG. 11 shows an explanatory diagram of calculation and search of initial values for starting search in falsification correction.
[0056]
E ’now_xySuppose that tampering is detected. If tampering correction is performed by scanning in the direction shown in the figure, two adjacent blocks e ′_{x (y-1)}And e ’_{(X-1) y}Is a regular block. Since natural images are characterized by small changes in pixel values, e ′_{x (y-1)}And e ’_{(X-1) y}The average of the pixel values of_xyIt can be predicted that it is close to the true value of. Therefore, the search time can be shortened by starting the search using the predicted value as an initial value.
[0057]
FIG. 12 is an explanatory diagram for creating a search pattern in tampering correction.
For example, in the first stage search, all 107 patterns are created and tested. In the second stage, all N × N patterns using three numbers 106, 107 and 108 are tested. (In this example, 3⁴= 81 ways) Furthermore, in the third stage, 5⁴= 625 ways. In this way, the number of numbers used to generate the pattern to be tested is gradually increased, and the search is performed while increasing the range until a true value is found.
[0058]
5). Simulation experiment
FIG. 13 is an explanatory diagram of parameters used in the experiment. 14 and 15 are explanatory diagrams (1) and (2) for the results of the simulation experiment.
This method was applied to the standard image LENA shown in FIG. 14A to verify the effectiveness. LENA is a monochrome image of 256 × 256 pixels and 8-bit gradation.
[0059]
5-1. Tamper detection experiment
FIG. 14B shows the result of the embedding process. Since the SNR was 43.1 dB and the embedding strength of the signature information was small, the deterioration due to embedding was hardly noticeable. However, SNR was calculated by the following formula.
[0060]
[Equation 8]

[0061]
Where org_ijIs the pixel value of the original image, emb_ijIs the pixel value of the embedded image.
[0062]
Next, FIG. 14B was falsified as shown in FIG. In FIG. 14B, a rectangular area of 20 × 20 pixels is filled with a luminance value 200. FIG. 14D shows the falsification detection result by this method. The discolored portion is a portion determined to be falsified. Since the discoloration part and the actual falsification part coincided, it was found that the proposed method is effective.
[0063]
5-2. Tampering correction experiment
The same alterations as in the previous section were performed at various locations, and the alterations were corrected using the proposed method. FIG. 15A shows a tampering correction result when tampering is performed at a location where the change in pixel value is small as shown in FIG. On the other hand, FIG. 15C shows a tampering correction result when tampering is performed at a location where the change in the pixel value is large as shown in FIG. In all cases, the same image as before the alteration was obtained, and it was found that the proposed method was effective.
[0064]
FIG. 16 is a graph in which the horizontal axis represents the standard deviation of the difference values of adjacent pixels at the tampered location, and the vertical axis represents the time required for tampering correction processing. It was found that the larger the standard deviation, the longer it takes.
[0065]
6). Consideration
As a result of simulation experiments, it was found that the proposed method can detect the position of each block. Therefore, the smaller the block size N, the more accurate position detection is possible._xySince the number of bits is small, the safety against exhaustive search is reduced. To remedy this problem, consider choosing the modulus P from the largest possible integers. For example, if N = 2 and P is selected from integers that can be represented by 32 bits, one block is K of 32 × 2 × 2 = 128 bits._xyAnd K by exhaustive search_xyTherefore, it is very difficult to identify, so that safety can be improved. Moreover, the time for the tampering correction process increases as the standard deviation increases. This is because the falsification correction according to the present invention starts searching for a true value using a predicted value from a neighboring pixel as an initial value, but if the falsification is performed at a location where the standard deviation is large such as an edge portion, This is thought to be because the true value error increases.
[0066]
7. Conclusion
In the present invention, the detection and correction of a falsification position using a fragile digital watermark by number theory conversion was studied. The effectiveness of the proposed method was examined through simulation experiments, and good results were obtained.
[0067]
The falsification position detection method / falsification correction method or falsification position detection / falsification correction apparatus / system of the present invention is a falsification position detection program / falsification correction program / falsification position detection program / falsification correction for causing a computer to execute each procedure. The program can be provided by a computer-readable recording medium that records the program, a program product that includes a falsification position detection program / falsification correction program, and can be loaded into the internal memory of the computer, a computer such as a server that includes the program, and the like.
[0068]
8). Literature
[1] NTT Data Management Laboratory (edited), electronic document signature, NTT Publishing Co., Tokyo, 2001.
[2] Naoki Endo and Akio Koide, “Content Distribution and Unauthorized Copying Protection,” Journal of the IEICE, Vol.83, No.2, pp.117-121, Feb.2000.
[3] Onozuka (Author), digital watermarking and content protection, Ohmsha, Tokyo, 2001.
[4] P. S. L. M. Barreto, H.Y. Kim, and V. Rijmen, “Toward A Secure Public-Key Blockwise Fragile Authentication Watermarking,” Proc. IEEE Int. Conf. Image Processing, vol.2, pp.494-497, 2001.
[5] P. W. Wong, “A Public Key Watermarking of Image Verification and Authentication,” Proc. IEEE Int. Conf. Image Processing, vol.1, MA11.07, 1998.
[6] Megumi Iwamura, Junichi Hayashi, Koichi Sakurai, Hideki Imai, “Study and Proposal on Digital Watermark for Secure Tampering Detection,” Computer Security Symposium, pp.283-288, Oct. 2001.
[7] Onozuka, “Electronic document falsification detection method and apparatus,” published patent publication, JP 2002-44429, Japan Patent Office, Feb. 2002.
[8] H. Tamori, N. Aoki, and T. Yamamoto, “A Fragile Digital Watermarking Technique by Number Theoretic Transform,” IEICE Trans. Fundamentals, Aug. 2002. (to be published)
[9] J. H. McClellan, and C. M. Rader, “Number Theory in Digital Signal Processing,” Prentice-Hall, New Jersey, 1979.
[10] IEICE (ed.), Digital Signal Processing Handbook, Ohmsha, Tokyo, 1993.
[11] S.M. C. Coutinho (Author), Hayashi Hayashi (translation), Mathematical Foundations of Cryptography, Springer Fairlark Tokyo Co., Tokyo, 2001.
[12] H.M. J. et al. Nussbaumer (Author), Masahiko Sagawa, Hitoshi Honma (translation), Algorithm for Fast Fourier Transform, Science and Technology Publishers, Tokyo, 1989.
[13] Takashi Tanizaki (Author), Digital Signal Processing Library 4 Algorithm and Parallel Processing, Corona, Tokyo, 2000.
[14] Hideaki Tamori, Naofumi Aoki, Tsuyoshi Yamamoto, “A digital watermarking method that can detect tampering using number conversion,” IEICE Technical Report IE2001-33, pp.105-110, Jul. 2001.
[15] J. Fridrich and M. Goljan, “Protection of Digital Images Using Self-Embedding,” Symposium on Content Security and Data Hiding in Digital Media, New Jersey Institute of Technology, May 1999.
[16] J. Fridrich and M. Goljan, “Images with Self-Correcting Capabilities,” ICIP’99, Kobe, Japan, Oct. 1999.
[0069]
【The invention's effect】
According to the present invention, as described above, it is possible to provide a falsification position detection method using a fragile digital watermark by number theoretic transform (NTT). Furthermore, according to the present invention, a new technique based on number theoretic conversion can provide a tampering correction technique not only from the position of tampering but also from the nature of number theoretic conversion.
[0070]
According to the present invention, after receiving the image in which the watermark information is embedded, the recipient confirms the originality by using the key information acquired from the certification authority. In this process, the sender does not need to transmit the original itself to the receiver or the certification body, and can protect the original without showing it to a third party.
[0071]
In addition, the present invention can be used for transmission of public documents including images using the Internet line, guaranteeing the originality of images obtained by digital cameras, scanners, etc., identifying and removing various modifications and special effects applied to images, etc. It is considered that it can be used.
[Brief description of the drawings]
FIG. 1 y of prime number 13^xExplanatory drawing of (mod 13).
FIG. 2 is a schematic diagram of a system configuration.
FIG. 3 is a hardware configuration diagram of a sender / receiver computer.
FIG. 4 is a flowchart of an embedding process.
FIG. 5 is a conceptual diagram of an embedding process for one block when N = 2.
FIG. 6 is a flowchart of extraction processing.
FIG. 7 is a conceptual diagram of extraction processing for one block when N = 2.
FIG. 8 is a flowchart of falsification detection processing.
FIG. 9 is a flowchart for tampering correction.
FIG. 10 is an explanatory diagram of tampering correction scanning.
FIG. 11 is an explanatory diagram of calculation and search of an initial value for starting a search in falsification correction.
FIG. 12 is an explanatory diagram of search pattern creation in tampering correction.
FIG. 13 is an explanatory diagram of parameters used in the experiment.
FIG. 14 is an explanatory diagram (1) about the result of a simulation experiment.
FIG. 15 is an explanatory diagram (2) about the result of a simulation experiment.
FIG. 16 is a graph in which the horizontal axis represents the standard deviation of the difference value between adjacent pixels at the alteration location, and the vertical axis represents the time required for the alteration correction processing.
[Explanation of symbols]
10 Sender computer
20 Recipient computer
30 Certificate Authority Computer

Claims (13)

Setting primary key information P for number theory conversion by reading from an input unit or reading from a storage unit, and obtaining a root α of order N modulo N and P based on P;
Each pixel value o _ij (i, j =) of a plurality of original image blocks o _xy (x = 0,..., w−1, y = 0,..., h−1) representing the original image o of wN × hN pixels. Reading 0,..., N-1) from the storage unit or inputting from the input unit;
Creating signature information s _xy to be embedded in each pixel value o _xy based on P;
obtaining an embedded image block e _xy with embedded signature information by taking the difference between o _xy and s _xy ;
By converting Number Theory based on the main key information P and the obtained N and alpha, determining a number theoretic transform coefficients O _xy number theoretic transform coefficients E _xy and o _xy of e _xy,
Generating a sub-key information block K _xy corresponding to each block according to the following equation:
K _ij = E _ij O ⁻¹ _ij (modP)
(Here, O _ij , E _ij , and K _ij indicate element values of O _xy , E _xy , and K _xy , respectively, and O ⁻¹ _ij is an inverse element of O _ij .)
Performs processing of each of the steps for w × h pieces of the original pixel block o _xy, embedding image block e _xy, the steps of obtaining a sub-key information block K _xy, stored in the storage unit,
sending e _xy , P, N, K _xy ;
Tampering position detection method including The received image in which the signature information is embedded is divided into received image blocks e ′ _xy (x = 0,..., W−1, y = 0,..., H−1), and each pixel value e ′ _ij (i, j = 0,..., N−1) and storing the received image block e ′ _xy in the storage unit;
Setting the main key information P, the order N, and the sub key information K _xy by reading or receiving from the storage unit;
Determining a root α of order N modulo P,
Transforming each received image block e ′ _xy into a number-theoretic transform coefficient E ′ _xy based on a pre-acquired P, the order N and the root α of the order N modulo P;
Calculating a number transformation coefficient O ′ _xy of the received original image o ′ _xy based on the received image block e ′ _{xy according} to the following equation:
E ′ _ij K ⁻¹ _ij = O ′ _ij (modP)
(Here, O ′ _ij , E ′ _ij , and K _ij are O ′ _xy , E ′ Respective element values of _xy and _Kxy are shown. )
Calculating o ′ _xy obtained by reciprocal transformation of the obtained O ′ _xy ,
extracting signature information s ′ _xy by taking the difference between o ′ _xy and e ′ _xy ;
Performing each of the above steps on w × h received image blocks to obtain s ′ _xy and o ′ _xy and storing them in a storage unit;
Tampering position detection method including Setting primary key information P for number theory conversion by reading from an input unit or reading from a storage unit, and obtaining a root α of order N modulo N and P based on P;
Each pixel value o _ij (i, j =) of a plurality of original image blocks o _xy (x = 0,..., w−1, y = 0,..., h−1) representing the original image o of wN × hN pixels. Reading 0,..., N-1) from the storage unit or inputting from the input unit;
Creating signature information s _xy to be embedded in each pixel value o _xy based on P;
obtaining an embedded image block e _xy with embedded signature information by taking the difference between o _xy and s _xy ;
By converting Number Theory based on the main key information P and the obtained N and alpha, determining a number theoretic transform coefficients O _xy number theoretic transform coefficients E _xy and o _xy of e _xy,
Generating a sub-key information block K _xy corresponding to each block according to the following equation:
K _ij = E _ij O ⁻¹ _ij (modP)
(Here, O _ij , E _ij , and K _ij indicate element values of O _xy , E _xy , and K _xy , respectively, and O ⁻¹ _ij is an inverse element of O _ij .)
Performs processing of each of the steps for w × h pieces of the original pixel block o _xy, embedding image block e _xy, the steps of obtaining a sub-key information block K _xy, stored in the storage unit,
sending e _xy , P, N, K _xy ;
The received image in which the signature information is embedded is divided into received image blocks e ′ _xy (x = 0,..., W−1, y = 0,..., H−1), and each pixel value e ′ _ij (i, j = 0,..., N−1) and storing the received image block e ′ _xy in the storage unit;
Setting the main key information P, the order N, and the sub key information K _xy by reading or receiving from the storage unit;
Determining a root α of order N modulo P,
Transforming each received image block e ′ _xy into a number-theoretic transform coefficient E ′ _xy based on a pre-acquired P, the order N and the root α of the order N modulo P;
Calculating a number transformation coefficient O ′ _xy of the received original image o ′ _xy based on the received image block e ′ _{xy according} to the following equation:
E ′ _ij K ⁻¹ _ij = O ′ _ij (modP)
(Here, O ′ _ij , E ′ _ij , and K _ij are O ′ _xy , E ′ Respective element values of _xy and _Kxy are shown. K ^-1 _ij is an inverse element of K _ij . )
Calculating o ′ _xy obtained by reciprocal transformation of the obtained O ′ _xy ,
extracting signature information s ′ _xy by taking the difference between o ′ _xy and e ′ _xy ;
Performing each of the above steps on w × h received image blocks to obtain s ′ _xy and o ′ _xy and storing them in a storage unit;
Tampering position detection method including _Reading the detection target block of the received original image block o ′ _xy based on the received image from the storage unit;
When either the first condition that o ′ _ij is not larger than a predetermined maximum value or the second condition that the signature information s _ij generated based on P does not match s ′ _xy is satisfied, A step of determining that the image has been tampered with;
The tampering position detection method according to claim 1, further comprising: _Reading the detection target block of the received original image block o ′ _xy based on the received image from the storage unit;
Sub key information K ′ _xy is generated based on o ′ _xy and s ′ _xy read from the storage unit, and when the third condition that the received key does not match K _xy is satisfied, the step of determining that tampering has occurred; ,
The tampering position detection method according to claim 1, further comprising: _Reading the detection target block of the received original image block o ′ _xy based on the received image from the storage unit;
Determining whether the block to be detected has been tampered with;
Setting initial values for the search pattern based on surrounding blocks;
Creating a search pattern in which an initial value or any combination of a plurality of values derived from the initial value is applied to each pixel of the target block determined to be falsified;
Repeating the step of creating the search pattern and the step of determining until it is determined that it has not been falsified in the step of determining based on the generated search pattern, and obtaining the corresponding search pattern;
Storing the obtained search pattern in the storage unit;
The tampering position detection method according to claim 1, further comprising: The step of obtaining the root α of the order includes
P is defined as P = p ₁ ^r1 p ₂ ^r2 ... p _i ^ri, where p _i is a prime number, r _i is a positive integer,
The order N is selected from positive integers satisfying N | GCD [(p ₁ −1), (p ₂ −1),..., (P _i −1)] or read from the storage unit,
calculate the roots g _{1 and i} of the order N modulo p _i ,
^Obtain roots g _{2 and i} of order N modulo p _i ^ri from g _{1 and i} ,
4. The falsification position detection method according to claim 1, wherein the root α of the order N modulo P is obtained from g _{2 and i} by the Chinese remainder theorem. The step of _obtaining the number theoretic conversion coefficient E _xy of the e _xy and the number theoretic conversion coefficient O _xy of the o _xy and the step of _performing the number theoretic conversion include:
The tampering position detection according to any one of claims 1 to 3, wherein a number-theoretic transformation between x (n) and X (k) is performed using P, N, and α according to the following equation. Method.

(Where P is an arbitrary composite number that is a power of a prime number), α, (is a positive integer, N is the smallest positive integer such that α ^N = 1 (modP))
X = [T] x
x = [T] ⁻¹ X
([T]: transformation matrix, [T] ⁻¹ : inverse transformation matrix) The step of creating the signature information s _xy includes:
If P, x, y, i, and j are determined in advance between the sender computer and the receiver computer, and ε is a positive integer that determines the embedding strength, s _xy is
s _ij = P (x + y + i + j) (modε)
Or
s _ij = P (x · y · i · j) (modε)
The tampering position detection method according to claim 1, wherein the tampering position detection method is obtained by: Setting primary key information P for number theory conversion by reading from an input unit or reading from a storage unit, and obtaining a root α of order N modulo N and P based on P;
Each pixel value o _ij (i, j =) of a plurality of original image blocks o _xy (x = 0,..., w−1, y = 0,..., h−1) representing the original image o of wN × hN pixels. Reading 0,..., N-1) from the storage unit or inputting from the input unit;
Creating signature information s _xy to be embedded in each pixel value o _xy based on P;
obtaining an embedded image block e _xy with embedded signature information by taking the difference between o _xy and s _xy ;
By converting Number Theory based on the main key information P and the obtained N and alpha, determining a number theoretic transform coefficients O _xy number theoretic transform coefficients E _xy and o _xy of e _xy,
Generating a sub-key information block K _xy corresponding to each block according to the following equation:
K _ij = E _ij O ⁻¹ _ij (modP)
(Here, O _ij , E _ij , and K _ij indicate element values of O _xy , E _xy , and K _xy , respectively, and O ⁻¹ _ij is an inverse element of O _ij .)
Performs processing of each of the steps for w × h pieces of the original pixel block o _xy, embedding image block e _xy, the steps of obtaining a sub-key information block K _xy, stored in the storage unit,
sending e _xy , P, N, K _xy ;
A falsification position detection program for causing a computer to execute. The received image in which the signature information is embedded is divided into received image blocks e ′ _xy (x = 0,..., W−1, y = 0,..., H−1), and each pixel value e ′ _ij (i, j = 0,..., N−1) and storing the received image block e ′ _xy in the storage unit;
Setting the main key information P, the order N, and the sub key information K _xy by reading or receiving from the storage unit;
Determining a root α of order N modulo P,
Transforming each received image block e ′ _xy into a number-theoretic transform coefficient E ′ _xy based on a pre-acquired P, the order N and the root α of the order N modulo P;
Calculating a number transformation coefficient O ′ _xy of the received original image o ′ _xy based on the received image block e ′ _{xy according} to the following equation:
E ′ _ij K ⁻¹ _ij = O ′ _ij (modP)
(Here, O ′ _ij , E ′ _ij , and K _ij are O ′ _xy , E ′ Respective element values of _xy and _Kxy are shown. K ^-1 _ij is an inverse element of K _ij . )
Calculating o ′ _xy obtained by reciprocal transformation of the obtained O ′ _xy ,
extracting signature information s ′ _xy by taking the difference between o ′ _xy and e ′ _xy ;
Performing each of the above steps on w × h received image blocks to obtain s ′ _xy and o ′ _xy and storing them in a storage unit;
A falsification position detection program for causing a computer to execute. Setting primary key information P for number theory conversion by reading from an input unit or reading from a storage unit, and obtaining a root α of order N modulo N and P based on P;
Each pixel value o _ij (i, j =) of a plurality of original image blocks o _xy (x = 0,..., w−1, y = 0,..., h−1) representing the original image o of wN × hN pixels. Reading 0,..., N-1) from the storage unit or inputting from the input unit;
Creating signature information s _xy to be embedded in each pixel value o _xy based on P;
obtaining an embedded image block e _xy with embedded signature information by taking the difference between o _xy and s _xy ;
By converting Number Theory based on the main key information P and the obtained N and alpha, determining a number theoretic transform coefficients O _xy number theoretic transform coefficients E _xy and o _xy of e _xy,
Generating a sub-key information block K _xy corresponding to each block according to the following equation:
K _ij = E _ij O ⁻¹ _ij (modP)
(Here, O _ij , E _ij , and K _ij indicate element values of O _xy , E _xy , and K _xy , respectively, and O ⁻¹ _ij is an inverse element of O _ij .)
Performs processing of each of the steps for w × h pieces of the original pixel block o _xy, embedding image block e _xy, the steps of obtaining a sub-key information block K _xy, stored in the storage unit,
A computer-readable recording medium recording a falsification position detection program for causing a computer to execute the steps of transmitting e _xy , P, N, and K _xy . The received image in which the signature information is embedded is divided into received image blocks e ′ _xy (x = 0,..., W−1, y = 0,..., H−1), and each pixel value e ′ _ij (i, j = 0,..., N−1) and storing the received image block e ′ _xy in the storage unit;
Setting the main key information P, the order N, and the sub key information K _xy by reading or receiving from the storage unit;
Determining a root α of order N modulo P,
Transforming each received image block e ′ _xy into a number-theoretic transform coefficient E ′ _xy based on a pre-acquired P, the order N and the root α of the order N modulo P;
Calculating a number transformation coefficient O ′ _xy of the received original image o ′ _xy based on the received image block e ′ _{xy according} to the following equation:
E ′ _ij K ⁻¹ _ij = O ′ _ij (modP)
(Here, O ′ _ij , E ′ _ij , and K _ij are O ′ _xy , E ′ Respective element values of _xy and _Kxy are shown. K ^-1 _ij is an inverse element of K _ij . )
Calculating o ′ _xy obtained by reciprocal transformation of the obtained O ′ _xy ,
extracting signature information s ′ _xy by taking the difference between o ′ _xy and e ′ _xy ;
Performing each of the above steps on w × h received image blocks to obtain s ′ _xy and o ′ _xy and storing them in a storage unit;
A computer-readable recording medium on which a falsification position detection program for causing a computer to execute is recorded.

Images