JP2009219034A - Monitor system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable the result of alteration checking on monitor data to be surely confirmed at a terminal. <P>SOLUTION: In a client terminal 3, signature verification processing is conducted by a signature verification part 341 on the basis of image data and its signature ID sent from an image storage apparatus 2, to respectively determine, based on the verification result, the possibility that the signature is altered and that a public key is incorrect. Then, a message showing the determination result or a mark or symbol in place of the message is generated by a verification result display control module 343 and superimposed on the image data to be displayed on a display 36. Moreover, verification results of respective frames constituting one image data stream are stored in a storage module 32 by a storage control module 33, and the list of the stored verification results is displayed on the display 36 as a report dialog by the verification result display control module 343. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a monitoring system that remotely monitors the state of, for example, a facility or a river using a camera or the like.

In the remote monitoring system, for example, imaging devices such as network cameras are arranged at a plurality of sites to be monitored, and time-series monitoring video data captured by these imaging devices is received and stored by the video storage device. Then, in response to a distribution request from the client terminal, the video storage device reads out the corresponding monitoring video data, distributes it to the requesting client terminal, and reproduces the distributed monitoring video data at the client terminal. (For example, refer to Patent Document 1).
JP 2005-143016 A

  Recently, measures have been taken to add authentication information such as a signature and a message authentication code to the monitoring data in order to prevent falsification of the monitoring data and maintain its validity. At this time, as a method for adding authentication information, for example, a method described in a user data area of video data is used. However, depending on the monitoring data, writing of additional information to the user data area may be restricted. In such a case, authentication information cannot be added.

  In addition, when the client terminal is checked for falsification of the monitoring data, and the falsification is detected as a result or it is determined that the monitoring data is suspicious, the reproduction processing of the monitoring data is limited. However, when the monitoring data reproduction process is restricted in this way, there is no way for the user of the client terminal to know the reason.

  The present invention has been made paying attention to the above circumstances, and an object of the present invention is to provide a monitoring system that enables a client user to clearly check the result of checking tampering of monitoring data.

  In order to achieve the above object, one aspect of the present invention provides a monitoring data storage device that stores monitoring data, and a terminal device that receives and reproduces monitoring data distributed from the monitoring data storage device via a communication network. The monitoring data storage device adds authentication information generated by using the first key information to the monitoring data by the monitoring data storage device, and transmits the monitoring data to which the authentication information is added to the communication network. Is transmitted to the terminal device via. On the other hand, the terminal device receives the monitoring data to which the authentication information is added, transmitted from the monitoring data storage device, and acquires second key information corresponding to the first key information. Then, a verification process is performed on the authentication information added to the monitoring data based on the second key information, and whether there is a possibility that the monitoring data has been tampered with and whether the second key information is correct. The display information representing the determination result is displayed on a display device in association with the monitoring data to be reproduced.

  In the present invention, when the verification unit has a function of performing verification processing on the monitoring data for each predetermined unit to obtain the determination result, the determination result obtained for each unit is displayed in the list. It is also characterized by further comprising means for generating list display information for displaying and displaying the generated list display information on a display device.

  Therefore, according to one aspect of the present invention, in the terminal device, from the result of the verification processing of the authentication information added to the monitoring data sent from the monitoring data storage device, whether or not the monitoring data may be falsified, and It is determined whether or not there is a possibility that the second key information used in the verification process is incorrect, and display information representing the determination result is displayed in association with the monitoring data. Therefore, the user of the terminal device can clearly recognize the result of the tampering check by distinguishing whether the monitoring data has been tampered with or the key information is incorrect.

  When the monitoring data is composed of video data, for example, the verification result obtained for each frame is displayed as list information. Therefore, the user can confirm at a glance which frame in the video data has been tampered with.

  That is, according to one aspect of the present invention, it is possible to provide a monitoring system that enables a client user to clearly check the result of a check check of the monitoring data.

An embodiment of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a monitoring system according to an embodiment of the present invention. The monitoring system of this embodiment includes a network camera 1 installed at a monitoring location, a client terminal 3 used by a client, and a video storage device 2 in which these network camera 1 and client terminal 3 are connected via a network 4. And.

  The network camera 1 has a camera unit and a communication interface unit. Then, the monitoring target is imaged continuously or at regular intervals by the camera unit, the video signal is A / D converted, and further encoded and compressed by a predetermined encoding method, and then the network 4 is transmitted as monitoring data by the communication interface unit. Is transmitted to the video storage device 2. Examples of encoding methods include JPEG (Joint Photographic Experts Group), MPEG2 (Motion Picture Experts Group 2), MPEG4 (Motion Picture Experts Group 4), and H.264. H.264 is used.

  The video storage device 2 is composed of, for example, a server device having a storage / delivery function, and is configured as follows. That is, the video data Stream (i) (i = 1, 2, 3,...) Sent from the network camera 1 via the network 4 is received by the receiving unit 21 for each stream and stored in the storage unit 25. And is input to the signature generation unit 22. When the signature flag is set to ON, the signature generation unit 22 uses the private key S_key (i) for each stream of the received video data Stream (i) to sign the stream Stream_sig (i). Is generated. Then, the signature ID is created by combining the generated signature Stream_sig (i) and the fingerprint FP (i), which is a hash value of the public key paired with the secret key S_key (i). When the signature flag is on, the control unit 24 switches the switch 23 to the terminal A side. Therefore, the created signature ID is selected by the switch 23 and stored in the storage unit 25. On the other hand, when the signature flag of the video storage device is set to OFF, the control unit 24 switches the switch 23 to the terminal B side. Therefore, a dummy signature ID is selected by the switch 23 instead of the signature ID and stored in the storage unit 25.

  In addition, when a video data download request arrives from the client terminal 3, the video storage device 2 reads the video data Stream (i) designated by the download request and the corresponding signature ID from the storage unit 25, and these are read out. The data is transmitted from the distribution unit 26 to the requesting client terminal 3. At this time, the video data Stream (i) is stored in the body portion of the HTTP packet, and the signature ID is stored in the header portion of the HTTP packet.

  The client terminal 3 is composed of, for example, a personal computer and is configured as follows. FIG. 2 is a block diagram showing the configuration. That is, the client terminal 3 includes a communication unit 31, a storage medium 32, a storage control unit 33, and reproduction software 34, a digital / analog converter (D / A) 35, a display unit 36, and the like. The main control unit 37 and the input unit 38 are provided.

  Under the control of the main control unit 37, the communication unit 31 executes a communication processing operation for receiving HTTP packets with the video storage device 2 according to a protocol defined by the network 4. The storage medium 32 uses, for example, a hard disk and has an area for storing video data received from the video storage device 2 and a signature ID. Under the control of the main control unit 37, the storage control unit 33 extracts the video data Stream (i) from the body portion of the received HTTP packet, extracts the signature ID from the header portion of the HTTP packet, and extracts the extracted video image. A process of storing the data Stream (i) and the signature ID in the storage medium 32 is executed. At the same time, since the video data Stream (i) and the signature ID are associated with each other (so-called strings), the file name of the video data Stream (i) and the file name of the signature ID are assigned to each frame of the video data. Is described in a clip file of an XML (eXtensible Markup Language) document.

  The reproduction software 34 includes a signature verification unit 341, a video decompression unit 342, and a verification result display control unit 343. The signature verification unit 341 receives the video data Stream (i) received by the communication unit 31 in real time and when the video data Stream (i) stored in the storage medium 32 is read and played back. The signature verification for the signature ID corresponding to the data Stream (i) is executed.

  The video decompression unit 342 receives the video data Stream (i) received by the communication unit 31 and the video data read from the storage control unit 33 from the storage medium 32 regardless of the verification result of the signature verification unit 341. Stream (i) is decompressed and the digital video signal obtained by the decompression process is output. The digital video signal is converted into an analog signal by the D / A 35 and then supplied to the display unit 36 for display. The display unit 36 is composed of a liquid crystal display, for example.

The verification result display control unit 343 determines whether the public key hash value and the fingerprint FP (i) match each other by the signature verification unit 341 and the verification result of the signature Stream_sig (i). Display data indicating that the signature may be incorrect and display data indicating that the signature may have been altered are selectively generated, and the generated display data is supplied to the display unit 36 to Display it superimposed on the playback video.
The main control unit 37 comprehensively controls the operation of the client terminal 3. The input unit 38 includes, for example, a keyboard and a mouse, and is used by a user to input a video data download request, playback request, verification request, and the like.

Next, the operation of the monitoring system configured as described above will be described.
(1) Accumulation of Video Data and its Signature ID In the video accumulation device 2, for example, for each network camera 1, information indicating whether or not to perform a signature is designated and input in advance by an operator. Information indicating whether or not to perform the signature is stored in the memory in the apparatus 2 as a signature flag.

  In this state, it is assumed that the monitoring operation is started in the network camera 1, and the video data Stream (i) (i = 1, 2, 3,...) Of the monitoring target is transmitted. Then, the video data Stream (i) is received by the receiver 21 in the video storage device 2 and then stored in the storage unit 25. At the same time, in the signature generation unit 22 of the video storage device 2, when the signature flag is set to ON, the secret key S_key (i) for each frame of the received video data Stream (i). Based on the signature Stream_sig (i), and the generated signature Stream_sig (i) and the fingerprint FP (i) which is the hash value of the public key paired with the private key S_key (i) A signature ID is created. The created signature ID is selected by the switch 23 and stored in the storage unit 25 in association with the video data Stream (i). On the other hand, when the signature flag is set to OFF, a dummy signature ID is selected by the switch 23 in place of the signature ID, and this dummy signature ID is associated with the video data Stream (i). Stored in the storage unit 25.

(2) Download of video data and signature ID Now, in the client terminal 3, the user designates video data to be browsed based on the browse menu of the video storage device 2, and inputs a download request for the video data. Suppose that Then, a download request for video data is transmitted from the client terminal 3 to the video storage device 2. In the video storage device 2, when a download request for video data comes from the client terminal 3, the video data Stream (i) designated by the download request and the corresponding signature ID are read from the storage unit 25 for each frame. The read video data Stream (i) is stored in the body portion of the HTTP packet, and the signature ID is stored in the header portion of the HTTP packet. The HTTP packet is sent from the distribution unit 26 to the requesting client terminal 3. Sent to.
When the read signature ID is a dummy signature ID, the video data Stream (i) is stored in the body portion of the HTTP packet, but the dummy signature ID is not stored in the header portion of the HTTP packet. .

  In the client terminal 3, when an HTTP packet addressed to its own terminal is received by the communication unit 31, processing for storing the video data Stream (i) and signature ID inserted in the HTTP packet in the storage medium 332 is performed by the storage control unit. 33. That is, in the case of video data with a signature, video data Stream (i) and signature ID are extracted from the body part and header part of the received HTTP packet, respectively. The extracted video data Stream (i) and signature ID are stored in the storage medium 32 as a video file and a signature file, respectively. FIG. 3 shows a first example of the storage format. The video data and the signature ID are stored in the storage medium 32 as an independent video file and signature file for each frame.

  In the case of video data without a signature, the signature ID is not extracted from the header part of the received HTTP packet. Therefore, the storage control unit 33 reads a dummy signature ID stored in advance in a memory in the storage control unit 33 and stores the dummy signature ID in the storage medium 32 as a signature file.

In the client terminal 3, the storage control unit 33 describes the file name of the video data Stream (i) and the file name of the signature ID in the clip file of the XML document for each frame, and this clip file is stored in the storage medium 32. Is done. FIG. 4 shows a description example of this clip file. As shown in the figure, for each frame of video data, a video file and a signature file are described as elements and surrounded by a start tag <frame> and an end tag </ frame>. Between the start tag <frame> and end tag </ frame>, the attribute name “value” of the element “video file”, its attribute value “video file name”, and the attribute name of the element “signature file” “Value” and its attribute value “signature file name” are described.
By describing in this way, the video file and the signature file are associated with each other for each frame. If a dummy signature ID is stored in the signature ID file, the dummy signature ID file is included as an element between the start tag <frame> and the end tag </ frame> together with the video file element. It is described in.

The storage format for storing the video file and the signature file in the storage medium 34 in association with each other is not limited to the first example, and the following second and third examples are also considered. It is done.
First, in the second example, a plurality of video data storage files and signature ID storage files are prepared, and the video data and signature ID extracted from the HTTP packet are stored in the video data storage file and signature ID storage, respectively. A plurality of frames are stored together in a file.

  FIG. 5 is a diagram for explaining the storage format. As shown in the figure, a plurality of video data storage files Vfg1, Vfg2,..., Vfgn and a plurality of signature ID storage files Sfg1, Sfg2,. The The video data storage files Vfg1, Vfg2,..., Vfgn are assigned identification numbers obtained by removing the extension from the file name of the video file (for example, 0001 if the file name is 0001.jpg). On the other hand, each of the signature ID storage files Sfg1, Sfg2,..., Sfgn is assigned an identification number obtained by removing the extension from the file name of the signature file (for example, 0001 if the file name is 0001.sig).

  Each time the HTTP packet is received and the video data and the signature ID are extracted, the video data and the signature ID are added to the video data storage file Vfg1 and the signature ID storage file Sfg1, respectively. When 1024 pieces of video data and signature data are stored in the video data storage file Vfg1 and signature ID storage file Sfg1, respectively, the next video data storage file Vfg2 and signature ID storage file Sfg2 are selected. The video data and signature ID are sequentially added to these files Vfg2 and Sfg2, respectively. Similarly, every time 1024 video data and signature data are stored in one video data storage file and signature ID storage file, the next video data storage file and signature ID storage file are selected. Then, video data and signature data are stored in these.

  Each video data storage file Vfg1, Vfg2,..., Vfgn and signature ID storage file Sfg1, Sfg2,. In this main header, the type of data to be written to the file (JPEG, MPEG-4, H.264, signature, etc.) is written. An individual header is added to each video data and signature ID. In this individual header, the video data and the data length of the signature ID are written.

  Therefore, in this second example, 1024 video data and signature IDs are written in video data storage files Vfg1, Vfg2,..., Vfgn and signature ID storage files Sfg1, Sfg2,. The file names are associated with each other by identification numbers 0001, 0002,.

In the third example, the signature ID storage file describes the signature ID and the start address and data length of the corresponding video data described in the corresponding video data storage file together with the line feed code. is there.
FIG. 6 shows the storage format. As shown in the figure, 1024 pieces of video data are stored in the video data storage files Vfg1, Vfg2,..., Vfgn, respectively, as in FIG. Note that the main header is described in the video data storage files Vfg1, Vfg2,..., Vfgn, and that each video data is provided with an individual header as in FIG. On the other hand, in the signature ID storage files Sfg1, Sfg2,..., Sfgn, the signature ID of each video data described in the corresponding video data storage file Vfg1, Vfg2,. Data length and line feed code are described.

  Therefore, also in the third example, the video data and the signature ID are the file names assigned to the video data storage files Vfg1, Vfg2,..., Vfgn and the signature ID storage files Sfg1, Sfg2,. These are associated with each other by identification numbers 0001, 0002,.

(3) Signature verification accompanying reproduction of video data (3-1) When reproducing received video data in real time When an HTTP packet transmitted from the video storage device 2 is received by the communication unit 31, reproduction software A video decompression unit 342 34 decompresses the video data Stream (i) extracted from the body part of the HTTP packet. The digital video signal reproduced by this expansion processing is converted into an analog signal by the D / A 35 and displayed on the display unit 36.

  In parallel with the reproduction process of the video data Stream (i), the signature verification unit 341 of the reproduction software 34 executes the signature verification process for the signature ID extracted from the header part of the HTTP packet. FIG. 7 is a flowchart showing the processing procedure and processing contents.

  That is, first, the hash value of the public key acquired in advance from a management center (not shown) and stored in the main control unit 37 is calculated, and this hash value matches the fingerprint FP (i) included in the signature ID. It is determined whether or not to perform (step S61). If the result of this determination is that they do not match, it is determined in step S68 that the public key used for verification is not paired with the private key used for signature creation. In this case, in step S69, the verification result display control unit 343 generates a warning message indicating that the public key may be incorrect, and supplies the display data of the warning message to the display unit 36 shown in FIG. Display.

  On the other hand, if the hash value of the public key matches the fingerprint FP (i), the signature verification unit 341 calculates the hash value (value A) of the video data Stream (i) in step S62, and the signature ID in step S63. The signature Stream_sig (i) included in is expanded using the public key to obtain the B value. In step S64, the calculated A value and B value are compared to determine whether or not they match. As a result of the determination, if the A value and the B value match, it is determined in step S65 that the signature Stream_sig (i) is valid. If not, the signature Stream_sig (i) is determined invalid in step S66. To do. If it is determined that the signature Stream_sig (i) is invalid, the verification result display control unit 343 in FIG. 2 generates display data of a warning message indicating that the signature may have been tampered with in step S67. Is supplied to the display unit 36 for display.

  FIG. 8 shows a first display example of the signature verification result. In the figure, (a) is a display example of a video frame when there is no possibility that the signature has been tampered with, and in particular, a verification result message is not displayed. (B), (c), and (d) are display examples when there is a possibility of falsification, (b) displays “Caution” as a warning message, and (c) shows “Possibility of falsification” This is a case where a warning message “A video with a detected.” Is displayed. (D) displays a message indicating that there is a possibility of falsification by means of a dialog, and an “OK” button is displayed in this dialog. At this time, since the currently displayed video frame is in the real-time playback mode, it is updated to the next video frame, but the above dialog continues to be displayed until the user clicks the “OK” button. In this way, even in the playback mode in which the display of video frames is sequentially updated at regular time intervals, the user does not miss that a video frame that may have been altered has been found. Can be confirmed. (E) is a display example when the public key is not correct, and a warning message “There is a possibility that the public key may be incorrect. Set the correct public key.” Is displayed by a dialog. Also in this case, an “OK” button is displayed in the dialog, and the dialog continues to be displayed until the user clicks the “OK” button.

  Other examples of the display of the signature verification result when the video is reproduced in real time are as follows. FIG. 10 shows a second display example in which four video streams are displayed on a multi-screen, and a signature verification result is displayed on each screen in a manner similar to a traffic light. In the figure, the upper left and lower right are examples of video data display when there is no possibility that the signature has been tampered with, and the traffic light is lit in “blue”. The upper right is a display example when the signature may have been tampered with, and “red” lights up on the traffic light. At this time, since the currently displayed video frame is in the real-time playback mode, it is updated to the next video frame, but the above dialog continues to be displayed until the user clicks the “OK” button. In this way, even in the playback mode in which the display of video frames is sequentially updated at regular time intervals, the user does not miss that a video frame that may have been altered has been found. Can be confirmed. The lower left is a display example when the public key is incorrect, and the traffic light is lit yellow.

(3-2) When playing back video data stored in a storage medium It is assumed that a user inputs a playback request after specifying a desired video data stream stored in the storage medium 32 in the input unit 38. . Then, the storage control unit 33 sequentially reads out the corresponding video data and its signature ID from the storage medium 32 for each frame.
For example, if the storage format of the video data and the signature ID is as shown in FIG. 3, the storage control unit 33 first opens the clip file, and between the first start tag <frame> and the end tag </ frame>. It is determined whether or not the element “video file” is described. Then, if described, the attribute value “video file name” of the attribute “value” corresponding to the element “video file” and the attribute value “signature file name” of the attribute name “value” corresponding to the element “signature file” ”And a video file and a signature file are read based on the read attribute values. Thereafter, the reading process is repeated until all the pairs of the element “video file” and the element “signature file” described in the clip file are read.

  If the storage format of the video data and signature ID is as shown in FIG. 5, the storage control unit 33 stores the video data storage files Vfg1, Vfg2,..., Vfgn and the corresponding signature ID storage files Sfg1,. Sfg2,..., Sfgn are sequentially selected one by one, and the video data and signature ID are sequentially read out in units of frames based on the information of the individual headers from the selected video data storage file and the corresponding signature ID storage file.

  Further, when the storage format of the video data and the signature ID is as shown in FIG. 6, the storage control unit 33 first selects and selects the signature ID storage files Sfg1, Sfg2,. The signature ID of the video data, the head address of the video data, and the data length signature ID are read from the signature ID storage file. Based on the read head address and data length signature ID, the corresponding video data is read from the video data storage file. Thereafter, the signature ID and the like stored in one selected signature ID storage file are sequentially read, and the corresponding video data is sequentially read from the corresponding video data storage file. When all the signature IDs stored in one signature ID storage file have been read, the next signature ID storage file is selected and the same reading process is executed.

  The video decompression unit 342 of the reproduction software 34 decompresses video data of the video file each time one video file is read by the storage control unit 33. The digital video signal reproduced by this expansion processing is converted into an analog signal by the D / A 35 and displayed on the display unit 36. In parallel with the video data playback process, the signature verification unit 341 of the playback software 34 executes a signature verification process for the signature included in the read signature ID. The processing procedure and processing contents of this signature verification processing are the same as those described above with reference to FIG. That is, when it is determined that the signature is invalid, a message indicating that the signature may be falsified is displayed as shown in FIGS. 8B to 8D, or as shown in FIG. The traffic light turns red. If the public key is not correct, a message indicating that the public key may be incorrect is displayed as shown in FIG. 8E, or the traffic light is lit in yellow as shown in FIG.

  However, in the mode for reproducing the stored video data, if it is determined that the signature is invalid or the public key is not correct, the reproduction of the video data is stopped at that time. That is, when it is determined that the signature is invalid or the public key is not correct, the storage control unit 33 stops reading the next video file and signature file. This stop state is, for example, until the user clicks “OK” in the dialog shown in FIGS. 8D and 8E, or the user clicks the “red” display part and the “yellow” display part of the traffic light. Continue until

(4) When performing signature verification without playing back video data When the user designates a desired video data stream stored in the storage medium 32 and inputs the signature verification request in the input unit 38 To do. Then, the storage control unit 33 reads the first frame of the corresponding video data from the storage medium 32. The first frame of the video data is expanded by the video expansion unit 342 of the reproduction software 34 and further converted into an analog signal by the D / A 35 and then displayed on the display unit 36.

  Next, the storage control unit 33 reads the signature file of the video data stream designated by the verification request in the order of frames, and passes it to the signature verification unit 341 of the reproduction software 34. The signature file reading process is also performed by referring to the clip file as described above. The signature verification unit 341 executes the verification process every time the signature file is passed and stores the result. When the verification process for the signature files of all frames is completed, the stored verification results are collected and passed to the verification result display control unit 343. FIG. 9 shows a first example when the signature is verified separately from the video display.

  If all the verification results for all the received frames are valid, the verification result display control unit 343 generates a message indicating that tampering has occurred, and displays the message as shown in FIG. 9A, for example. Is displayed on top of the video. On the other hand, if at least one verification result that the signature is determined to be invalid is included in the verification results for all the frames that have been passed, a message indicating that the signature may have been altered is generated. Then, this is displayed as shown in FIGS. 9B to 9D in a state of being superimposed on the video. If the public key is not correct, a message indicating that the public key may be incorrect is generated and displayed as shown in FIG. 9E in a state where the message is superimposed on the video of the first frame. . The display result of the signature verification ends when a predetermined time elapses or when the user clicks “OK” in the dialog. As shown in FIGS. 9A and 9D, a progress bar may be displayed in the dialog, and the progress degree may be displayed on the progress bar during the verification process.

  Further, the display form is not limited to that shown in FIG. 9, and a display model similar to that shown in FIG. 10 may be used. In this case, in the initial state, the top frames of the four video data streams stored in the storage medium 32 are displayed on the multi-screen. In this state, when the user selects one or more of the four screens and clicks the “verify” button displayed on the screen, the selection is made by the recording control unit 33 and the reproduction software 34. The signature verification process is executed on the video data stream corresponding to the screen. Then, after the verification for the frame is completed, the result is displayed on the corresponding screen in the form of a traffic light.

(5) Management of Signature Verification Result The signature verification result for the video data stream obtained by the signature verification unit 341 of the playback software 34 is stored as a verification report in the storage medium 32 by the storage control unit 33. The verification report is displayed on the display unit 36 in a predetermined format when the user inputs a display request at the input unit 38.

  FIG. 11 shows a first example of the display format. In this example, in the report dialog, icons corresponding to a plurality of video files constituting one video stream are displayed in a tree together with file names (for example, 2007-07-06-27-10-57-30-000.JPG). Is displayed in association with the status. For a video file whose signature is determined to be invalid, a corresponding icon (an icon indicated as NG in the figure) is marked with a “!” Mark, and a video file whose public key is determined to be incorrect is determined. Is marked with a “?” Mark on the corresponding icon (the icon labeled ERROR in the figure). In this state, it is assumed that the user clicks, for example, an icon with the “!” Mark. Then, the corresponding image file is read from the storage medium 32 by the storage control unit 33, and this image file is expanded by the video expansion unit 342 of the reproduction software 34, and then by another dialog with a file name attached. Displayed on the display unit 36.

  FIG. 12 shows a second example of the display format of the verification report. In this example, in the report dialog, icons corresponding to a plurality of video files constituting one video stream are sequentially displayed so that a part thereof overlaps. For a video file for which the signature is determined to be invalid, the corresponding icon (icon indicated as NG in the figure) is colored “red” and the video file for which it is determined that the public key may be incorrect The corresponding icon (the icon labeled ERROR in the figure) is colored “yellow”. 11 and 12, the icon of the video file for which the signature is determined to be valid is colored “blue”. Further, in this state, when the user clicks the icon colored “red”, for example, the storage control unit 33 reads the corresponding image file from the storage medium 32, and this image file is stored in the playback software 34. After being decompressed by the video decompression unit 342, it is displayed on the display unit 36 by another dialog with a file name.

  FIG. 13 shows a third example of the display format of the verification report. In this example, a data file name display area E1 and an icon display area E2 are provided in the report dialog. In the data file name display area E1, file names of a plurality of video files constituting one video data stream are displayed together with symbols (OK, NG, ERR) indicating verification results. In the icon display area E2, icons of a plurality of video files constituting one video data stream are displayed in a matrix with file names. These icons are colored in different colors depending on the verification result. For example, an icon corresponding to a video file whose signature is determined to be valid is colored “blue”, an icon corresponding to a video file whose signature is determined to be invalid is colored “red”, and the public key may be incorrect. The icon corresponding to the video file determined to have the property is colored “yellow”. For example, when the user clicks on the icon colored “red”, the corresponding image file is read from the storage medium 32 by the storage control unit 33, and this image file is the video decompression unit of the reproduction software 34. After being decompressed by 342, it is displayed on the display unit 36 by another dialog with a file name.

  As described above, in this embodiment, the client terminal 3 performs the signature verification process based on the video data sent from the video storage device 2 and its signature ID, and the signature is generated based on the verification result. It is determined whether there is a possibility of falsification and whether there is a possibility that the public key is incorrect, and a message indicating the determination result or a mark (for example, traffic light color lighting) or symbol (for example, OK, NG, ERR) ) Is displayed superimposed on the video data. Therefore, the user of the client terminal 3 can clearly recognize the result of the falsification check by distinguishing whether the video data has been falsified or the public key is incorrect.

  Further, the verification results of each frame constituting one video data stream are displayed as a verification report with a mark or a symbol added to the report dialog. For this reason, the user can confirm at a glance which frame in the video data has been tampered with.

  Furthermore, in this embodiment, the file name of the video data and the file name of the signature ID are described for each frame in the clip file of the XML document. Therefore, even when writing of additional information to the user data area of video data is restricted, it is possible to clearly associate the video file and the signature file for each frame.

The present invention is not limited to the above embodiment. For example, in the above-described embodiment, the case where video data is distributed as monitoring data has been described as an example. However, the present invention is applicable not only when video data is distributed but also when sound data and text data are distributed. In the embodiment, the case where the signature is added to the video data and the downloaded video playback software and the verification is performed is described as an example. However, the verification is performed by adding the message authentication code (MAC). In addition, the present invention is applicable. In this case, however, a common key is used instead of the secret key and the public key.
In addition, the configuration of the monitoring data storage device and the terminal device, the processing procedure and processing contents, the signature verification method, the display form of the verification result, and the like can be variously modified and implemented without departing from the gist of the present invention.

  In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

It is a block diagram which shows the structure of the monitoring system concerning one Embodiment of this invention. It is a block diagram which shows the structure of the client terminal of the monitoring system shown in FIG. FIG. 2 is a diagram for explaining a first example in the case where video data with a signature is downloaded from a video storage device to a client terminal in the monitoring system shown in FIG. 1. It is a figure which shows the structure of the clip file used in the 1st Example shown in FIG. FIG. 6 is a diagram for explaining a second example in the case where video data with a signature is downloaded from a video storage device to a client terminal in the system shown in FIG. 1. FIG. 8 is a diagram for explaining a third example in the case where video data with a signature is downloaded from a video storage device to a client terminal in the system shown in FIG. 1. It is a flowchart which shows the procedure and processing content of the signature verification process in the client terminal shown in FIG. FIG. 8 is a diagram illustrating a first display example of a verification result when signature verification is performed simultaneously with video display by the signature verification processing illustrated in FIG. 7. FIG. 8 is a diagram illustrating a first display example of a verification result when signature verification is performed separately from video display by the signature verification processing illustrated in FIG. 7. It is a figure which shows the 2nd example of a display of a verification result when signature verification is performed simultaneously with the display of an image | video by the signature verification process shown in FIG. FIG. 8 is a diagram illustrating a first example of a report dialog that displays a list of verification results obtained by the signature verification processing illustrated in FIG. 7. It is a figure which shows the 2nd example of the report dialog which displays the verification result obtained by the signature verification process shown in FIG. 7 as a list. It is a figure which shows the 3rd example of the report dialog which displays the verification result obtained by the signature verification process shown in FIG. 7 as a list.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Network camera, 2 ... Video storage device, 3 ... Client terminal, 4 ... Network, 21 ... Reception part, 22 ... Signature generation part, 23 ... Switch, 24 ... Control part, 25 ... Storage part, 26 ... Distribution part, DESCRIPTION OF SYMBOLS 31 ... Communication part, 32 ... Storage medium, 33 ... Storage control part, 34 ... Software for reproduction | regeneration, 35 ... Digital / analog conversion part (D / A), 36 ... Display part, 37 ... Main control part, 38 ... Input 341 ... Signature verification unit, 342 ... Video decompression unit, 343 ... Verification result display control unit.

Claims (2)

A monitoring system comprising: a monitoring data storage device that stores monitoring data; and a terminal device that receives and reproduces monitoring data distributed from the monitoring data storage device via a communication network,
The monitoring data storage device includes:
Means for adding authentication information generated using first key information to the monitoring data;
Means for transmitting the monitoring data to which the authentication information is added to the terminal device via the communication network,
The terminal device
Means for receiving monitoring data to which the authentication information is added, transmitted from the monitoring data storage device;
Means for obtaining second key information corresponding to the first key information;
A verification process is performed on the authentication information added to the received monitoring data based on the second key information, and whether there is a possibility that the monitoring data has been tampered with, and whether the second key information is Means for determining whether there is a possibility of being incorrect,
A monitoring system comprising: means for generating display information representing the determination result, and displaying the generated display information in association with the reproduction target monitoring data on a display device.   When the verification unit performs verification processing on the monitoring data for each predetermined unit to obtain the determination result, it generates list display information for displaying the determination result obtained for each unit. The monitoring system according to claim 1, further comprising means for displaying the generated list display information on a display device.

Images