JP2009003643A - Electronic data authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make it unnecessary to perform communication in the pre-stage of the request of authentication to an authentication station, and to authenticate the generation date of electronic data. <P>SOLUTION: This electronic data authentication system is provided with a user device 1 which converts date data showing the generation date of electronic data and the electronic data by using uni-directional hash functions using sealed key data, and an authentication device 2 converts the date data and electronic data stored in the user device 1 by using the uni-directional hash functions which are the same as the uni-directional hash functions to be used by the user device 1 as the uni-directional hash functions using the same key data as the above key data, and collates the converted data of the date data and electronic data with the converted data stored in the user device 1. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an electronic data authentication system that authenticates the authenticity, existence, and fact of photographing of electronic data and electronic video to be photographed.

In a conventional electronic data authentication system, for example, in order to prevent falsification of a video shot by a client terminal that is a user device, the client terminal transmits electronic video data to the server device of the certificate authority.
Upon receiving the video electronic data from the client terminal, the certificate authority server device synthesizes the date and time data indicating the date and time with the electronic data, and uses a one-way hash function that is confidential to the user to Calculate the hash value of the composite data. However, the date and time indicated by the date and time data is the current date and time, not the date and time when the video was shot.

Here, the one-way hash function is a function that obtains, for example, a 256-bit hash value by degenerating an enormous amount of data such as video. The one-way hash function is a function that cannot calculate input data from an output, and is also a function that cannot create an input that matches a hash value.
Therefore, if a part of the input is changed, different hash values are output, so the results do not match and it is impossible to match the hash values by forgery.
One-way hash functions include SHA-1 and SHA256, and SHA256 obtains a 256-bit hash value.

When the server device of the certificate authority calculates the hash value of the combined data, it transmits the hash value and date / time data to the client terminal.
When the client terminal receives the hash value and the date / time data from the server device of the certificate authority, the client terminal stores the hash value and the date / time data and also stores the electronic data of the video.

When the user wishes to authenticate the video stored in the client terminal, the electronic data, date / time data, and hash value of the video stored in the client terminal are transmitted to the server device of the certificate authority.
When the server device of the certificate authority receives the electronic data, date / time data, and hash value from the client terminal, the electronic data and the date / time data are combined, and the electronic device uses the one-way hash function that is the same as the one-way hash function. Calculate the hash value of the combined data of the data and date / time data.

When the certificate authority server device calculates the hash value of the combined data, the hash value and the hash value transmitted from the client terminal are compared, and if the two match, the video electronic data and date / time data have been altered. Authenticate that there is no.
That is, if the hash values match, the certificate authority server device authenticates that video electronic data exists at the date and time indicated by the date and time data.
On the other hand, if the hash values do not match, it is not authenticated that electronic video data exists at the date and time indicated by the date and time data (see, for example, Patent Document 1).

JP-A-11-175512 (paragraph number [0006], FIG. 1)

Since the conventional electronic data authentication system is configured as described above, it is possible to authenticate that video electronic data exists at the date and time indicated by the date and time data, but the video electronic data was generated. There was a problem that the date and time could not be authenticated.
In addition, if the client terminal transmits electronic data of the video to the server device of the certificate authority and receives and stores the hash value calculated by the server device in advance, the authentication of the video will be performed at a later date. You can request the server device, but even before the client terminal requests the certificate authority server device to authenticate the video, it communicates with the certificate authority server device to obtain the electronic video data, hash value, etc. There were problems such as having to send and receive.

  The present invention has been made to solve the above-described problems. Electronic data authentication that can eliminate the need for communication prior to requesting the certificate authority for authentication and can authenticate the generation date and time of electronic data. The purpose is to obtain a system.

  The electronic data authentication system according to the present invention uses a one-way function that uses sealed key data that cannot be read by the user, and converts the date and time data indicating the generation date and time of the electronic data and the electronic data. A user device that stores data and conversion data of electronic data and also stores the date / time data and electronic data is provided, and the authentication device uses a one-way function that uses the same key data as the key data. Using the same one-way function as the directional function, the date / time data and electronic data stored in the user device are converted, and the converted date / time data and electronic data are compared with the conversion data stored in the user device. It is what you do.

  According to the present invention, the date / time data and the electronic data indicating the generation date / time of the electronic data are converted using the one-way function using the sealed key data which cannot be read by the user, and the date / time data and the electronic data are converted. A user device for storing the date / time data and electronic data is provided, and the authentication device uses the same key data as the key data as the one-way function used by the user device. The date and time data and electronic data stored in the user device are converted using a one-way function, and the converted date and time and electronic data are compared with the converted data stored in the user device. As a result, it is possible to eliminate the need for communication in the previous stage of requesting certification from the certification authority and to authenticate the date and time of electronic data generation. There is that effect.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing an electronic data authentication system according to Embodiment 1 of the present invention. In FIG. 1, a user device 1 is a terminal used by a user, calculates a hash value of electronic data, and the electronic data When the electronic data is requested to be authenticated, the electronic data, the hash value, etc. are transmitted to the authentication device 2.
The authentication device 2 is a certificate authority device that performs electronic data authentication processing. When authenticating the electronic data, the authentication device 2 calculates a hash value of the electronic data and compares the hash value with the hash value transmitted from the user device 1. To do.

The electronic data generation unit 11 of the user device 1 corresponds to, for example, a camera or a word processor, and performs processing for generating electronic data such as video and documents.
The clock 12 is a clock that cannot be set by the user.
The key data storage unit 13 is a memory that stores key data in a sealed state so that the user cannot read the key data. The key data is, for example, unique data corresponding to the serial number of the user device 1 and is unknown to the user because it is not generally disclosed.
The key data storage unit 13 constitutes key data storage means.

When the electronic data generation unit 11 generates electronic data, the hash function calculation unit 14 acquires date / time data indicating the generation date / time of the electronic data from the clock 12, synthesizes the electronic data and date / time data, and generates a key data storage unit 13. Using the one-way hash function (one-way function) that uses the key data stored in, a process of calculating a hash value (conversion data) of the combined data of the electronic data and date / time data is performed.
Note that the hash function calculation unit 14 constitutes a multiplexing unit and a data conversion unit.

The data storage unit 15 has a memory function and a communication function, and stores the electronic data generated by the electronic data generation unit 11, the date / time data output from the clock 12, and the hash value calculated by the hash function calculation unit 14. When the user wishes to authenticate electronic data and date / time data, a process of transmitting the electronic data, date / time data and hash value to the authentication device 2 is performed.
The data storage unit 15 constitutes storage means.

The key data storage unit 21 of the authentication device 2 is a memory that stores the same key data as the key data stored in the key data storage unit 13 of all the user devices 1. The key data storage unit 21 constitutes key data storage means.
When the hash function calculation unit 22 receives the electronic data and the date / time data transmitted from the user device 1, the hash function calculation unit 22 combines the electronic data and the date / time data and uses the one-way hash function using the key data stored in the key data storage unit 21. As the (one-way function), the same one-way hash function as the one-way hash function used by the hash function calculation unit 14 of the user device 1 is used, and the hash value (conversion data) of the combined data of the electronic data and the date / time data ) Is calculated.
The hash function calculation unit 22 constitutes data conversion means.

The hash value comparison unit 23 compares the hash value calculated by the hash function calculation unit 22 with the hash value transmitted from the user device 1 and performs authentication processing of electronic data and date / time data.
The hash value comparison unit 23 constitutes a data collating unit.

  In FIG. 1, the electronic data generation unit 11 and the hash function calculation unit 14 that are components of the user device 1 are each configured by dedicated hardware (for example, a semiconductor integrated circuit board on which an MPU is mounted). Assuming that the user device 1 is configured by a computer, a program indicating the processing contents of the electronic data generation unit 11 and the hash function calculation unit 14 is stored in the memory of the computer, and the CPU of the computer stores the program in the memory. You may make it run the program currently performed.

  In FIG. 1, the hash function calculation unit 22 and the hash value comparison unit 23 that are components of the authentication device 2 are each configured by dedicated hardware (for example, a semiconductor integrated circuit board on which an MPU is mounted). In the case where the authentication device 2 is configured by a computer, a program indicating the processing contents of the hash function calculation unit 22 and the hash value comparison unit 23 is stored in the memory of the computer, and the CPU of the computer stores the memory. The program stored in the program may be executed.

Next, the operation will be described.
For example, when the electronic data generation unit 11 of the user device 1 generates electronic data of a video, the electronic data is output to the hash function calculation unit 14 and the data storage unit 15.

When the electronic data generation unit 11 generates electronic data, the hash function calculation unit 14 of the user device 1 acquires date / time data indicating the generation date / time of the electronic data from the clock 12 and synthesizes the electronic data and the date / time data.
Further, the hash function calculation unit 14 calculates a hash value of the combined data of the electronic data and the date / time data by using a one-way hash function using the key data stored in the key data storage unit 13.

The data storage unit 15 of the user device 1 stores the electronic data generated by the electronic data generation unit 11, the date / time data output from the clock 12, and the hash value calculated by the hash function calculation unit 14.
When the user desires authentication of electronic data and date / time data, the data storage unit 15 transmits the stored electronic data, date / time data, and hash value to the authentication device 2.

When the hash function calculation unit 22 of the authentication device 2 receives the electronic data and date / time data transmitted from the user device 1, the hash function calculation unit 22 combines the electronic data and date / time data.
Also, the hash function calculation unit 22 uses a one-way hash function that uses key data stored in the key data storage unit 21 (the same key data as the key data stored in the key data storage unit 13 of the user device 1). Then, using the same one-way hash function as the one-way hash function used by the hash function calculation unit 14 of the user device 1, the hash value of the combined data of the electronic data and the date / time data is calculated.

When the hash function calculation unit 22 calculates the hash value of the composite data, the hash value comparison unit 23 of the authentication device 2 compares the hash value with the hash value transmitted from the user device 1 to obtain the electronic data and date / time data. Perform authentication processing.
If the hash values match, the hash value comparison unit 23 authenticates that the video electronic data and date / time data have not been tampered with.
That is, if the hash values match, the hash value comparison unit 23 authenticates that video electronic data is generated at the date and time indicated by the date and time data.
On the other hand, if the hash values do not match, it is not authenticated that video electronic data is generated at the date and time indicated by the date and time data.

  As apparent from the above, according to the first embodiment, the date data and the electronic data indicating the generation date and time of the electronic data using the one-way hash function using the sealed key data that cannot be read by the user. A user device 1 that converts data, stores the date / time data and conversion data of the electronic data, and stores the date / time data and electronic data is provided, and the authentication device 2 uses the same key data as the key data. Using the same one-way hash function as the one-way hash function used by the user device 1 as the hash function, the date / time data and electronic data stored in the user device 1 are converted, and the date / time data and electronic data Since the configuration is such that the conversion data and the conversion data stored in the user device 1 are collated, before the authentication authority is requested Communication with can be made unnecessary in the present embodiment offers an advantage of being able to authenticate the generation date and time of electronic data.

That is, if the electronic data generation unit 11, the clock 12, and the key data storage unit 13 of the user device 1 are sealed by hardware or other methods, the electronic data generated by the electronic data generation unit 11 is definitely the date / time data. It is possible to authenticate that the user apparatus 1 has been sealed at the date and time indicated by.
Although the hardware-like seal may be broken, if the user apparatus 1 is investigated later and it is proved that there is no scratch when it is broken or the seal seal is not opened, it should be proved completely. Can do.

  In the first embodiment, the hash function calculation unit 14 has acquired the date / time data indicating the generation date / time of the electronic data from the clock 12, but the clock 12 is not necessarily a normal clock. For example, a radio timepiece may be used. Further, instead of the date and time data obtained from the clock 12 by the hash function calculation unit 14, information having only the date and time such as a natural phenomenon may be obtained.

Embodiment 2. FIG.
2 is a block diagram showing a user apparatus 1 of an electronic data authentication system according to Embodiment 2 of the present invention. In the figure, the same reference numerals as those in FIG.
The camera 31 corresponds to the electronic data generation unit 11 in FIG. 1, and performs a process of shooting a video and outputting image data that is electronic video data to the data multiplexing unit 33.
The accompanying information setting unit 32 performs processing for outputting accompanying information such as character information that the user desires to authenticate to the data multiplexing unit 33, for example.

The data multiplexing unit 33 receives the image data output from the camera 31, the date / time data output from the clock 12 (date / time data indicating the date and time when the video was captured by the camera 31), and the accompanying information output from the accompanying information setting unit 32. A process of multiplexing and outputting the multiplexed data to the hash function computing unit 34 and the hash value multiplexing unit 35 is performed. The data multiplexing unit 33 constitutes multiplexing means.
The hash function calculation unit 34 is a calculation unit corresponding to the hash function calculation unit 14 in FIG. 1, and uses a one-way hash function that uses key data stored in the key data storage unit 13, and uses the one-way hash function. A process of calculating a hash value of the output multiplexed data is performed.
The hash function calculation unit 34 constitutes data conversion means.

The hash value multiplexing unit 35 multiplexes the hash value calculated by the hash function calculation unit 34 and the multiplexed data output from the data multiplexing unit 33, and records the hash value multiplexed data as the multiplexed data in the storage medium 36. Perform the process.
The storage medium 36 is a medium such as a memory for recording hash value multiplexed data.
The hash value multiplexing unit 35 and the storage medium 36 constitute storage means.

FIG. 3 is a block diagram showing an authentication apparatus 2 of an electronic data authentication system according to Embodiment 2 of the present invention. In the figure, the same reference numerals as those in FIG.
The storage medium 41 is a medium corresponding to the storage medium 36 sent from the user when the user desires authentication, and has hash value multiplexed data recorded therein.

The hash value separation unit 42 reads the hash value multiplexed data recorded in the storage medium 41, separates the hash value multiplexed data, and sends the hash value included in the hash value multiplexed data to the hash value comparison unit 23. A process of outputting the multiplexed data (image data, date / time data, accompanying information) included in the hash value multiplexed data to the hash function computing unit 43 is performed.
The hash function calculation unit 43 is a calculation unit corresponding to the hash function calculation unit 22 of FIG. 1, and is a hash function calculation unit of the user device 1 as a one-way hash function using the key data stored in the key data storage unit 21. Using the same one-way hash function as the one-way hash function used by 34, a process of calculating the hash value of the multiplexed data output from the hash value separation unit 42 is performed.
The hash function calculation unit 43 constitutes data conversion means.

Next, the operation will be described.
The camera 31 of the user device 1 captures a video and outputs image data that is electronic data of the video to the data multiplexing unit 33.
The accompanying information setting unit 32 of the user device 1 outputs, for example, accompanying information such as character information that the user desires to authenticate to the data multiplexing unit 33.

  When the data multiplexing unit 33 of the user apparatus 1 receives the image data of the video from the camera 31 and receives the accompanying information from the accompanying information setting unit 32, the data multiplexing unit 33 receives the date / time data from the clock 12 (date and time indicating the date and time when the video was captured by the camera 31). Data), the image data, the date / time data, and the accompanying information are multiplexed, and the multiplexed data is output to the hash function calculation unit 34 and the hash value multiplexing unit 35.

When receiving the multiplexed data from the data multiplexing unit 33, the hash function calculation unit 34 of the user device 1 uses the one-way hash function that uses the key data stored in the key data storage unit 13 and uses the multiplexed data. Compute the hash value of.
When the hash function calculation unit 34 calculates the hash value of the multiplexed data, the hash value multiplexing unit 35 of the user device 1 multiplexes the hash value and the multiplexed data output from the data multiplexing unit 33, and the multiplexed data. Is stored in the storage medium 36.
When the user wishes to authenticate video or the like, the user sends the storage medium 36 to the authentication device 2 of the certificate authority.

When the storage medium 36 (= storage medium 41) is sent, the hash value separation unit 42 of the authentication device 2 reads the hash value multiplexed data recorded in the storage medium 41 and separates the hash value multiplexed data. .
That is, the hash value separation unit 42 outputs the hash value included in the hash value multiplexed data to the hash value comparison unit 23, and the multiplexed data (image data, date / time data included in the hash value multiplexed data). , Accompanying information) is output to the hash function calculation unit 43.

  When receiving the multiplexed data from the hash value separation unit 42, the hash function calculation unit 43 of the authentication device 2 receives the key data stored in the key data storage unit 21 (the key data stored in the key data storage unit 13 and the key data stored in the key data storage unit 13). Using the same one-way hash function as the one-way hash function used by the hash function calculation unit 34 of the user device 1 as the one-way hash function using the same key data), the hash value of the multiplexed data is calculated. To do.

When the hash function calculation unit 43 calculates the hash value of the multiplexed data, the hash value comparison unit 23 of the authentication device 2 compares the hash value and the hash value output from the hash value separation unit 42 to obtain the multiplexed data. Authentication processing of (image data, date / time data, accompanying information) is performed.
If the hash values match, the hash value comparison unit 23 authenticates that the image data, date / time data, and accompanying information have not been tampered with.
That is, if the hash values match, the hash value comparison unit 23 authenticates that the image data is the video imaged by the camera 31 at the date and time indicated by the date and time data.
On the other hand, if the hash values do not match, it is not authenticated that the image data is the video imaged by the camera 31 at the date and time indicated by the date and time data.

As is apparent from the above, according to the second embodiment, the camera 31, the clock 12, the accompanying information setting unit 32, and the key data storage unit 13 of the user device 1 are sealed by hardware or other methods. It is possible to authenticate that the image data and accompanying information output from 31 are definitely sealed by the user device 1 at the date and time indicated by the date and time data.
Although the hardware-like seal may be broken, if the user apparatus 1 is investigated later and it is proved that there is no scratch when it is broken or the seal seal is not opened, it should be proved completely. Can do.

Embodiment 3 FIG.
FIG. 4 is a block diagram showing the user apparatus 1 of the electronic data authentication system according to the third embodiment of the present invention. In the figure, the same reference numerals as those in FIG.
The radio clock 51 outputs date and time data indicating the date and time when the video was captured by the camera 31 to the data multiplexing unit 33.
The GPS positioning unit 52 receives a GPS signal transmitted from a GPS satellite, measures the current position with reference to the GPS signal, and outputs position data (accompanying information) indicating the current position to the data multiplexing unit 33. carry out.

  In the second embodiment, the data multiplexing unit 33 of the user device 1 multiplexes the image data output from the camera 31, the date / time data output from the clock 12, and the accompanying information output from the accompanying information setting unit 32. And the multiplexed data is output to the hash function computing unit 34 and the hash value multiplexing unit 35. As shown in FIG. 4, the data multiplexing unit 33 of the user device 1 is output from the camera 31. The image data, the date / time data output from the radio clock 51, and the position data output from the GPS positioning unit 52 are multiplexed, and the multiplexed data is output to the hash function calculation unit 34 and the hash value multiplexing unit 35. You may do it.

Thus, by multiplexing the date and time data output from the radio clock 51 instead of the date and time data output from the clock 12, more accurate authentication of the photographing time becomes possible.
Further, by multiplexing the position data output from the GPS positioning unit 52 as accompanying information, it is possible to authenticate the shooting location of the video by the camera 31.
The authentication device 2 of the certificate authority is the same as the authentication device 2 of FIG.

Embodiment 4 FIG.
FIG. 5 is a block diagram showing a user apparatus 1 of an electronic data authentication system according to Embodiment 4 of the present invention. In the figure, the same reference numerals as those in FIG.
The camera setting unit 53 performs processing for outputting camera setting information (accompanying information) indicating the zoom, aperture, focus, and the like of the camera 31 to the data multiplexing unit 33.

  In the third embodiment, the data multiplexing unit 33 of the user device 1 multiplexes the image data output from the camera 31, the date / time data output from the radio clock 51, and the position data output from the GPS positioning unit 52. In the above description, the multiplexed data is output to the hash function computing unit 34 and the hash value multiplexing unit 35. However, the camera setting information output from the camera setting unit 53 may also be multiplexed. .

Here, FIG. 6 is an explanatory view showing a forgery method for re-photographing.
When forging a video, it is usually easy to create a forged video, store it in a VTR, etc., copy the forged video to a display, and re-shoot it with a camera.
However, since settings such as zoom, aperture, and focus are different between actual shooting and re-shooting using the forgery method, re-shooting is possible if the camera setting information indicating the zoom, aperture, and focus of the camera 31 is multiplexed and authenticated. It can also authenticate that it is not forgery.

BRIEF DESCRIPTION OF THE DRAWINGS It is a block diagram which shows the electronic data authentication system by Embodiment 1 of this invention. It is a block diagram which shows the user apparatus of the electronic data authentication system by Embodiment 2 of this invention. It is a block diagram which shows the authentication apparatus of the electronic data authentication system by Embodiment 2 of this invention. It is a block diagram which shows the user apparatus of the electronic data authentication system by Embodiment 3 of this invention. It is a block diagram which shows the user apparatus of the electronic data authentication system by Embodiment 4 of this invention. It is explanatory drawing which shows the forgery method of re-photographing.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 User apparatus, 2 Authentication apparatus, 11 Electronic data generation part, 12 Clock, 13 Key data preservation | save part (key data preservation | save means), 14 Hash function calculating part (multiplexing means, data conversion means), 15 Data preservation | save part (accumulation) Means), 21 key data storage unit (key data storage unit), 22, 34, 43 hash function calculation unit (data conversion unit), 23 hash value comparison unit (data verification unit), 31 camera, 32 associated information setting unit, 33 Data multiplexing unit (multiplexing unit), 35 Hash value multiplexing unit (storage unit), 36 Storage medium (storage unit), 41 Storage medium, 42 Hash value separation unit, 51 Radio clock, 52 GPS positioning unit, 53 Camera setting Department.

Claims (6)

  Using a one-way function using sealed key data that cannot be read by the user, the date and time data indicating the generation date and time of the electronic data and the electronic data are converted, and the date and time data and the converted data of the electronic data are stored. In addition, as the one-way function that uses the same key data as the key data and the user device that stores the date and time data and the electronic data, the same one-way function as the one used by the user device is used. Electronic data authentication comprising: an authentication device that converts date / time data and electronic data stored in the user device and collates the converted data of the date / time data and electronic data with the conversion data stored in the user device system.   The electronic data authentication system according to claim 1, wherein the user device converts image data of a video photographed by the camera as electronic data.   The user device includes: image data of a video captured by the camera; date / time data indicating the date / time when the video was captured by the camera; and multiplexing means for multiplexing the associated information and outputting multiplexed data; Using the one-way function using the key data storage means for storing data and the key data stored in the key data storage means, the multiplexed data output from the multiplexing means is converted, and the multiplexing is performed Data conversion means for outputting data conversion data, multiplexed data output from the multiplexing means, and storage means for storing the conversion data output from the data conversion means The electronic data authentication system according to claim 2.   The authentication device includes a key data storage unit that stores the same key data as the key data stored in the key data storage unit of the user device, and a one-way function that uses the key data stored in the key data storage unit. The multiplexed data stored in the storage means of the user device is converted using the same one-way function as the one-way function used by the data conversion means of the user device, and the converted data of the multiplexed data is converted. And a data collating unit that collates the converted data output from the data converting unit and the converted data stored in the storing unit of the user device. Item 4. The electronic data authentication system according to Item 3.   The multiplexing means of the user device multiplexes the date / time data output from the radio clock as date / time data indicating the date / time when the video was taken by the camera, and indicates the current position measured using the GPS signal as accompanying information. 4. The electronic data authentication system according to claim 3, wherein the position data is multiplexed.   The multiplexing means of the user device multiplexes the date / time data output from the radio clock as date / time data indicating the date / time when the video was taken by the camera, and indicates the current position measured using the GPS signal as accompanying information. 4. The electronic data authentication system according to claim 3, wherein position data and setting information of the camera are multiplexed.

Images