JP2000132513A - Method and system for detection of additional information - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and a system capable of safely detecting the additional information electronically embedded, at many and unspecified places. SOLUTION: A server reads the data where the additional information is embedded and then asks an anti-tamper device including a secret key to judge the embedding of the additional information. At the same time, the server reads a mask pattern out of the mask data, calculates the inner product of the mask pattern and the data including the embedded additional information and sends this inner product to the anti-tamper device. The anti-tamper device adds the inner product value sent from the server at the time of judging the embedding of the additional information and judges the threshold using the secret key. When the threshold is judged, a detecting mask pattern is produced from the secret key included in the anti-tamper device and the embedding of the additional information is judged based on the inner product value of the detecting mask pattern and the data received form the server.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for detecting electronically embedded additional information, and more particularly, to a method in which additional information embedded in data (for example, image data, etc.) by a digital watermark is inserted into a smart card and a computer (server, etc.). The present invention relates to a system, a method, and a medium including a program for detecting safely and efficiently by a combination of the methods.

[0002]

2. Description of the Related Art In order for digital watermarking technology to become widespread and used by general users, it is desired that electronically embedded additional information (watermark) can be safely detected in an unspecified number of places. . However, in the conventional digital watermarking technique, a symmetric key method is used in which the key for embedding and the key for detection are the same, so that the secret key used when embedding the additional information is stolen from a detection device that detects the additional information. There was a danger that it would be. Therefore, the secret key is physically tamper-resistant (tampering-resistant) while maintaining the detection efficiency of the additional information.
There is a need for a method and a system for holding the device in the device.

At present, one of the most prominent devices having tamper resistance is a smart card. A smart card is an intelligent card type device having a CPU and a memory in the card. The information stored inside is protected by a password or the like, and the mechanism (tamper proof) prevents the information inside from being read or rewritten by an unauthorized method. Therefore, the user can securely store private data. Consumer personal information (such as a card number and a consumer's secret key) is generally stored in a smart card to ensure security and portability. However, the calculation speed and the memory capacity are limited due to the size and shape characteristics of the smart card. Therefore, there is a need for a method and system for safely and efficiently detecting additional information while covering the limitations of smart card processing capabilities and storage capacity.

[0004]

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide a method and a system which can detect electronically embedded additional information safely in an unspecified number of places. . Still another object is to provide a method and a system for detecting additional information by cooperative operation of a tamper-resistant device and a server. Yet another object is to provide a method and system for safely and efficiently detecting additional information while covering the limitations of the processing capacity and storage capacity of a tamper-resistant device. Another object is to provide a method and a system for detecting additional information safely and efficiently by performing high-security calculations with a tamper-resistant device and performing other calculations with a server. Another issue is that the minimum necessary calculation for extracting additional information is performed by a tamper-resistant device, and more than the inner product calculation server is used to maintain security, so that additional information can be detected safely and efficiently. To provide a method and system for doing so.

[0005]

In order to solve the above-mentioned problem, first, a server reads data in which additional information is embedded, and determines whether to embed the additional information from the server to a tamper-resistant device including a secret key. Configure to ask. At this time, the server reads the mask pattern from the mask data, calculates the inner product of the mask pattern and the data in which the additional information is embedded, and transmits the calculation result of the inner product to the tamper-resistant device. In the tamper-resistant device, the value of the inner product transmitted from the server is added when the additional information is embedded, and the threshold is determined using the secret key. With this configuration, the inner product operation of the data and the mask pattern can be left to the server having a higher calculation speed, and the tamper-resistant device can perform only the addition processing and the threshold determination with high security. Can be. This means that the tamper-resistant device performs the minimum necessary inner product calculation for extracting additional information (message), and the server performs more redundant inner product calculation than necessary to maintain security. This provides a method and system that can safely detect electronically embedded additional information in an unspecified number of locations.

FIG. 1 shows a conceptual diagram of the present invention. In a secure environment, additional information (message) embedded in data 110 (in this case, image data) using a secret key is
When transmitted to the general user side (in an unsecured environment) through the Internet provider 120, the server 1
30 causes only the calculation in which the secret key is not used for the data in which the additional information is embedded. Then, the calculation for embedding determination using the secret key is requested to the tamper-resistant device (in this case, the smart card 140) connected to the tamper-resistant device reader (in this case, the smart card reader 150). I do.

[0007]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Before describing embodiments of the present invention, a digital watermark which is a basic technique of the present invention will be described. This digital watermarking technology is disclosed in Japanese Patent Application No. 8-345.
568 and Japanese Patent Application No. 8-348426.
This will be briefly described below.

It is assumed that the image content data is composed of N × N pixels. Assuming that the size of the pixel block to be masked is kxk, the image data is IS = (N / k) ²
Block. This is Ii (i = 0,1, .., IS-1)
And Next, a mask pattern having an element m∈ {-1,0,1} and a size kxk is prepared. This condition requires that the sum of the elements is 0 and the patterns are orthogonal to each other. A sign-inverted pattern, which is obtained by multiplying each element of the pattern thus created by -1, is also added. For example, the following 4 × 4 pattern can be considered.
There are three patterns Mp (p = 0, 1, .., 7).

(Equation 1) Here, the message embedding operation is performed as follows. B that replaces 0 in the message bit string with -1
j∈ {-1,1}, (j = 0,1, .., J-1). Let K be the total number of patterns. Let ri be the result of a random number generator with a seed.

Ii '= Ii + Mp * Bj, where p = ri mod
K, j = ri mod J

In addition, the detection of the message at the bit position q is as follows. For a random number sequence ri generated from the same seed as the embedding, the sum of the inner products of Ii and Mp is obtained as follows for i where ri mod J = q. To calculate

Sq = Σ (Ii ′, Mp) where p = ri mod
K, j = ri mod J

If Sq ≧ T, Bq = 1 if Sq ≦ -T, Bq = 0

If -T <Sq <T, it is determined that there is no embedding.

That is, in the digital watermarking which is a basic technique of the present invention, it is an important security point that a certain block is embedded with which mask pattern and which bit corresponds to a message. Also, since 1-bit information is embedded in a plurality of blocks by different mask patterns, even if noise similar to a certain mask pattern is applied to the entire surface, the bit information cannot be erased. In the present invention, attention is paid to the fact that the correspondence between a mask pattern and a block position is a point of security, this association is performed in a smart card, and calculation of an inner product of data and a mask pattern is left to a server. At this time, by calculating the inner product with a mask pattern not related to the server (not necessary for the embedding determination), the information of the association is prevented from being leaked. FIG. 2 shows an outline of the stem configuration of the present invention. As shown in FIG. 2, the server calculates an inner product of the image data and the mask pattern read from the mask data, and transmits the result to a smart card which is a tamper-resistant device. On the other hand, on the smart card side, the transmitted inner product data is distributed and added using the included secret key, and then the threshold is determined, thereby determining whether the additional information is embedded (message extraction).

The calculation at the server will be described in more detail. The mask pattern given to the server is given by a linear combination of the mask patterns used for embedding. The set of mask patterns used for embedding is {M ₀ , M ₁ , .., M _K-1 , -M ₀ ,
-M ₁ , .., -M _K-1 }, the inverted pattern is assumed to be the same because the inner product is only negative, and a new pattern is formed by linear transformation of a K-dimensional vector. That is, [M ₀ , M ₁ , ..,
M _K-1 ] is a K-dimensional column vector, and P is a regular K-order square matrix.

[M ' ₀ , M' ₁ , .., M ' _K-1 ] ^T = P [M ₀ , M ₁ , .., M _K-1 ] ^T

Is given by For example, the mask pattern Mp
Against

(Equation 2) {M ' ₀ , M' ₁ , .., M ' ₃ } as a result of the above conversion is as follows.

(Equation 3) The server calculates the inner product with the image using the given {M ' ₀ , M' ₁ , .., M ' _K-1 }. First, write the inner product of the M _'0 and the image blocks, calculated for the entire image on the smart card. This is repeated while sequentially changing the mask pattern. That is, the data string sent to the smart card is as follows.

(Equation 4)

FIG. 4 shows a calculation flowchart in the server. First, the internal variables i and j are initialized to 0. Next, at step 410, the mask pattern Mi 'is replaced with the mask data Mk'.
Read from. Then, in step 420, image block I
j is read from the image data, and the inner product of Mi 'and Ij is calculated in step 430. The calculation result is transmitted to a smart card reader connected to the smart card reader.
Next, j is incremented in step 440 to determine whether or not all the image blocks have been completed. If so, in step 450, i is incremented to determine whether all mask patterns have been applied, and so on. If there is, the process ends.

Next, calculation in a smart card which is a tamper-resistant device will be described in more detail. FIG. 3 supports an operation conceptual diagram in the smart card. As shown in FIG. 3, the contained private key (corresponding to a random number seed in this case)
, A random number is generated, and the input data string is distributed and added as a bit string memory using the random number. If the result exceeds a certain threshold, it is determined that additional information (message) is embedded. More specifically, a restoration function is created from the secret key and the mask pattern conversion matrix included in the tamper-resistant device, and embedding determination is performed by giving data transmitted from the server to the restoration function. Note that the result of the restoration function is equivalent to the inner product of the mask pattern and data (such as image data) when the additional information (message) is embedded.

In the smart card, the data string DS = {ds _0,0 , ds _0, sequentially transmitted to the memory array mj (j = 0,..., J-1) prepared for the message bit length J. ₁ , .., d
s _{K-1, IS-1} } (L = K * IS) is distributed, weighted and added.
First, ds _{k, i} is distributed by using a random number sequence r _i (the random number period is assumed to be IS) generated from the same seed as the embedding, and j =
Select the message memory mj specified by ri mod J.
Next, weighting, the mask pattern for embedding is q
= ri mod K must be detected by Mq, but since the detection pattern is transformed by the transformation matrix P, the inverse matrix P ⁻¹ of the mask pattern transformation matrix P (=
{p _ij })

Mq = _Σpqj * Mj '

[0022] _So, ds _k, for _i adding the ds _{k, i} * p _qk. For example, P _-1 is as follows.

(Equation 5) Therefore, what is embedded in the pattern M ₀ is 1/2 M ' ₀ +
It can be detected by ₁ / 2M '1. Therefore, if the i-th pixel block has been filled with M _0, i-th data sequence ds
_{A value obtained by multiplying 0 and i} by 1/2 is added, and a value obtained by multiplying i is added to the (i + IS) th data string ds _{1, i} .

FIG. 5 shows a calculation flowchart for the tamper-resistant device (smart card) of the present invention. First, in step 510, the internal variable k is initialized to 0.
At step 20, a random number seed, which is a secret key, is read, and an internal variable i
= 0 is the value of the random number r ₀ . In step 530, the inner product data string ds is read from an external interface such as a serial port of the server. Next, at step 540, the index j of the message memory is calculated, and at step 550, the index q of the mask pattern for detection is calculated. At step 560, the mask pattern conversion matrix P ^-1 is calculated.
, _And calculate the weight of the extracted pattern. In step 570, the message memory is updated, and in step 580, the internal variable i is incremented to determine the end. If not, the process returns to step 53
Return to 0. If it is completed, the internal variable k is determined in step 590.
Is incremented to determine the end. If not, the process returns to step 520. When the processing is completed, the extraction of the additional information (message) ends with the contents of the message memory.

Finally, in the test and extraction of the additional information (message), if | min (mj) | ≧ T with respect to the threshold T, it is determined that the message is embedded, and in that case, each message memory mj For

If mj ≧ 0, Bj = 1 if mj <0, Bj = 0

The message bit string is constructed as follows.

FIG. 7 shows an embodiment of a hardware configuration of a server used in the present invention. The system 100 includes a central processing unit (CPU) 1 and a memory 4. The CPU 1 and the memory 4 are connected via a bus 2 to a hard disk device 13 (or a storage medium drive such as an MO, a CD-ROM 23, a DVD, etc.) as an auxiliary storage device via an IDE controller 25. Similarly, the CPU 1 and the memory 4 are connected via the bus 2 to the hard disk device 30 (or M
O28, CD-ROM 23, storage medium drive such as DVD, etc.) via a SCSI controller 27. The floppy disk device 20 is connected to the bus 2 via a floppy disk controller 19.

A floppy disk is inserted into the floppy disk device 20, and the floppy disk or the like or the hard disk device 13 (or MO, CD-ROM,
A storage medium such as a DVD) and a ROM 14 can cooperate with an operating system to give instructions to a CPU and the like, and record computer program codes or data for implementing the present invention. It is performed by being done. Preferably, the hard disk device 13 stores mask data for calculating the inner product. The code of the computer program can be compressed or divided into a plurality of pieces and recorded on a plurality of media.

The system 100 further includes user interface hardware and a pointing device (mouse, joystick, etc.) for inputting.
7 or a keyboard 6 and a display 12 for presenting visual data to the user. The display 12 may display the result of the embedding determination of the additional information by the tamper-resistant device. Further, it is possible to connect a printer via the parallel port 16 and to connect a modem via the serial port 15. The system 100 can connect to a network via a serial port 15 and a modem or a communication adapter 18 (Ethernet or token ring card) or the like, and can communicate with another computer or the like. It is also possible to connect a remote transmission / reception device to the serial port 15 or the parallel port 16 to transmit / receive data by infrared rays or radio waves.
As shown in FIG. 8, a tamper-resistant device reader 810 is connected to the serial port 15 or the communication adapter 18 of the system 100 to transmit and receive data to and from a tamper-resistant device such as a smart card. Although the tamper-resistant device reader 810 is externally connected in FIG. 8, an embodiment in which the tamper-resistant device reader 810 is built in the system 100 can be similarly implemented without departing from the essence of the present invention.

The speaker 23 of the system 100 receives the audio signal that has been D / A (digital / analog converted) by the audio controller 21 via the amplifier 22 and outputs it as audio. Also, the audio controller 21 performs A / D (analog / digital) conversion of audio information received from the microphone 24, and enables audio information external to the system to be taken into the system.

As described above, the server of the present invention can be used for a general personal computer (PC), a workstation,
Notebook PCs, palmtop PCs, network computers, various home appliances such as televisions with built-in computers, game machines having communication functions, telephones, faxes, mobile phones, PHS, electronic organizers, etc., communication terminals having communication functions, Alternatively, it can be easily understood that the present invention can be implemented by a combination of these. However, these components are merely examples, and not all of them are essential components of the present invention.

FIG. 6 shows a comparison table of required memory when the additional information is detected only by the PC and when the smart card and the server cooperate. FIG. 6 shows an example in which the image data size (image size) is 512 × 512 (upper row) and 1024 × 1024 (lower row). In a smart card, a minimum required inner product calculation for extracting additional information (message) is performed, and in a server, a redundant inner product calculation is performed more than necessary to maintain security.

[0033]

According to the present invention, the tamper-resistant device and the server are operated in cooperation with each other, and the additional information can be detected safely and efficiently. According to the detection system of the present invention, it is possible to safely detect electronically embedded additional information in an unspecified number of places.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram of the present invention.

FIG. 2 is a diagram showing an outline of a system configuration of the present invention.

FIG. 3 is a conceptual diagram of an operation in a tamper-resistant device (smart card).

FIG. 4 is a calculation flowchart in a server.

FIG. 5 is a calculation flowchart in the tamper-resistant device (smart card) of the present invention.

FIG. 6 is a diagram showing a required memory comparison table for detecting additional information.

FIG. 7 is a diagram showing one embodiment of a hardware configuration of a server used in the present invention.

FIG. 8 is a schematic view of a server to which a tamper-resistant device reader is connected.

 ──────────────────────────────────────────────────の Continuing on the front page (72) Inventor Masayuki Numao 1623-14 Shimotsuruma, Yamato City, Kanagawa Prefecture Inside the Tokyo Research Laboratory, IBM Japan, Ltd. (72) Inventor Shuichi Shimizu Shimotsuruma, Yamato City, Kanagawa Prefecture 1623 No. 14 IBM Japan, Ltd. Tokyo Basic Research Laboratory F-term (reference) 5B085 AE09 AE13 BG07 5D044 CC08 DE17 FG18 GK17

Claims (12)

[Claims] 1. A system for detecting additional information embedded in data using a tamper-resistant device and a server, the system comprising: (1) means for a server to read data embedded with additional information (2) means for requesting the tamper-resistant device connected to the server to determine whether to embed additional information from the server, and (3)
An additional information detection system, characterized in that the tamper-resistant device has means for performing embedding determination of additional information by using a secret key included in the tamper-resistant device. 2. The means (2) for requesting the embedding judgment of the additional information, wherein the server reads a mask pattern, calculates an inner product of the mask pattern and data in which the additional information is embedded, and calculates the inner product of the inner product. The system according to claim 1, wherein the system is means for transmitting a calculation result to the tamper-resistant device. 3. The system of claim 1, wherein the tamper-resistant device is connected to the server by a tamper-resistant device reader. 4. A method according to claim 3, wherein said means for determining whether to embed the additional information distributes and adds the inner product value transmitted from said server using said secret key, and then performs a threshold value determination. 3. The system of claim 2, wherein 5. The system according to claim 2, wherein the data is image data, and an inner product of the data and the mask pattern is an inner product of the image data and the mask pattern. 6. The system according to claim 2, wherein the inner product calculation between the mask pattern and the data in which the additional information is embedded includes a redundant inner product calculation that is not necessary for the embedding determination. 7. The system of claim 3, wherein said tamper-resistant device is a smart card and said tamper-resistant device reader is a smart card reader. 8. A tamper-resistant device for detecting additional information embedded in a data string, (1) means for reading a secret key included in the tamper-resistant device, and (2) a data string from outside. A tamper-resistant device comprising: means for reading; and (3) means for calculating additional information from the data string using the secret key. 9. A server for requesting a tamper-resistant device to determine whether additional information is embedded in data, (1) means for reading a mask pattern, and (2)
Means for reading data in which additional information is embedded,
(3) means for calculating an inner product of the data and the mask pattern and transmitting the value to a tamper-resistant device. 10. A method for detecting additional information embedded in a data string in a tamper-resistant device, comprising: (1) reading a secret key included in the tamper-resistant device; Reading columns from outside; (4)
Calculating additional information from the data sequence using the secret key. 11. A method in which a server requests a tamper-resistant device to determine whether or not additional information is embedded in data, the method comprising: (1) reading a mask pattern; Reading the embedded data; and (3) calculating an inner product of the data and the mask pattern and transmitting the value to a tamper-resistant device. 12. A medium including a program for requesting a tamper-resistant device to determine whether additional information is embedded in data from a server, wherein the program reads (1) a mask pattern. Features and
(2) a function of reading data in which additional information is embedded, and (3) a function of calculating an inner product of the data and the mask pattern and transmitting the value to a tamper-resistant device. Medium containing the program.