JP4303733B2 - Recording apparatus and recording method - Google Patents

Description

  The present invention relates to a recording apparatus and a recording method, and for example, relates to an apparatus that proves a recording time and a recording position of recording.

When recording data to be recorded with a recording device, such as image data of accident vehicles for insurance assessment, volcano gas concentration measurement, noise measurement, air pollutant measurement, water quality inspection, earthquake measurement, civil engineering construction record image data, etc. In some cases, it is important to specify the time and place of recording.
In such data, when the recorded time and place are not specified, inaccurate, or falsified, processing using these data is greatly affected.

Therefore, a technique for proving the time and place at the time of data recording has been demanded. Among such requests, there is a technique disclosed in the following document as a technique for performing time certification.
JP 2001-297062 A

This technique attempts to prove the non-falsification of time information by associating time information with time-varying information (such as weather information) and combining it. The composite information is given to the product and used to prove the time information of the product.
As a service using this technology, there has been proposed a method for certifying time of image data by transmitting the image data to an authentication center and adding composite information to the image data at the authentication center.

  However, with this technology, there is a possibility of data falsification before the image data is transmitted to the authentication center.

  Accordingly, an object of the present invention is to be able to prove data acquisition time and the like.

In order to achieve the above object, the present invention is a recording apparatus used in a recording / collecting system configured using a recording apparatus that records information and a recording / collection server that collects recording data from the recording apparatus. A counter device that increases a numerical value by a predetermined amount at regular time intervals; a current position information acquisition unit that acquires current position information; a counter value of the counter device at each predetermined timing; and the acquired current position information Counter value position set storage means for storing a counter value position set consisting of a pair, secret key storage means for storing a secret key, and counter value transmission means for transmitting the counter value of the counter device to the record collection server Digital data acquisition means for acquiring information to be recorded as digital data, and when the digital data is acquired, If the position information acquisition means can acquire the current position information, generate the recording data including the acquired digital data, the counter value when the digital data is acquired, and the acquired current position information, When the current position information acquisition unit cannot acquire current position information when acquiring the digital data, the acquired digital data, a counter value when the digital data is acquired, and the counter value current A recording data generating means for generating recording data including a counter value position set stored in the value storing means; a signature means for digitally signing the generated recording data with the stored secret key; and the digitally signed recording data And a recording data transmitting means for transmitting the recording data to the recording / collecting server. Configuration).
In the first configuration, the predetermined timing may be generated periodically at a constant time interval (second configuration).
Further, the present invention is a recording method performed by a recording apparatus used in a recording apparatus configured using a recording apparatus that records information and a recording collection server that collects recording data from the recording apparatus, A recording apparatus includes a counter device that increases a numerical value by a predetermined amount at regular time intervals, a secret key storage unit that stores a secret key, a current position information acquisition unit, a counter value position set storage unit, and a counter value transmission unit A digital data acquisition unit, a recording data generation unit, a signature unit, and a recording data transmission unit, wherein the current position information acquisition unit acquires the current position information, and the counter A value position set storage means, a counter comprising a pair of a counter value of the counter device and the acquired current position information for each predetermined timing A counter value position set storing step for storing a position set; a counter value transmitting step for transmitting the counter value of the counter device to the recording / collecting server; and a digital data acquiring unit for storing a counter value. A digital data acquisition step of acquiring information as digital data; and when the digital data is acquired by the recording data generation means, if the current position information acquisition means can acquire current position information, the acquired digital Data, a counter value at the time of acquiring the digital data, and recording data including the acquired current position information is generated, and when the digital data is acquired, the current position information acquisition means If the digital data cannot be acquired, the acquired digital data and the digital data A recording data generation step for generating recording data including a counter value at the time of acquisition and a counter value position set stored in the counter value current value storage unit; and the recording unit generates the recording data generated in the signature unit A recording method comprising: a signature step of digitally signing with a secret key, and a recording data transmission step of transmitting the digitally signed recording data to the recording collection server by the recording data transmitting means. Provided (third configuration).

  According to the present invention, the data acquisition time and the like can be proved by the recording device giving the information specifying the time to the data and digitally signing it.

(1) Outline of Embodiment An outline of this embodiment will be described with reference to FIG. The center server 2 is a server device installed at the head office of an insurance company.
The camera 5 is a digital camera distributed from the headquarters to a branch office or an agency, and takes a picture necessary for insurance assessment according to the following procedure.

(1. Registration of start counter value)
The camera 5 includes a counter that counts the number at regular time intervals in a tamper-resistant chip that is extremely difficult to perform illegal operations from the outside.
When the person in charge takes the camera 5 to the shooting site, the camera 5 is connected to the center server 2 and the current counter value (start counter value) is transmitted to the center server 2 as shown in FIG. To do. The center server 2 stores the start counter value of the camera 5 in association with the current time (start time).

(2. Photographing)
After notifying the center server 2 of the start counter value, the camera 5 is disconnected from the network and goes offline. In this state, the person in charge takes the camera 5 to the shooting site and shoots the subject.
When the camera 5 records the subject as image data, it gives a current counter value, position information for specifying the current position (the camera 5 has a built-in GPS), and shooting information such as a distance to the subject and an aperture. Then, this is digitally signed with a device secret key stored in advance to generate shooting data. This signature processing is performed inside the tamper resistant chip. In this way, the shooting data 1 to n are stored in the camera 5.

(3. Transmission of shooting data)
When the person in charge finishes photographing, he takes the camera 5 home and connects to the center server 2. Then, the camera 5 transmits the current counter value (end counter value) to the center server 2. The center server 2 stores the end counter value in association with the current time (end time).
Further, the camera 5 combines the shooting data 1 to n into one data to generate transmission shooting data 40 (FIG. 4), and transmits this to the center server 2.
When the center server 2 receives the transmission shooting data 40, the center server 2 verifies the digital signatures of the shooting data 1 to n using the device public key stored in advance, and confirms that each shooting data has not been falsified.

Then, the center server 2 adds the start counter, the start time, the end counter, the end time, and the like to the transmission shooting data 40 to generate the storage shooting data 50 (FIG. 7A). The time stamp is issued by the stamp server, and the time-stamped shooting photographing data 51 (FIG. 7B) is generated.
The time-stamped shooting data 51 is stored in the center server 2 and downloaded to the user terminal for use when necessary.

(4. Time certification of image data)
The legitimacy of the time-stamped saved shooting data 51 can be confirmed by the time stamp. Further, the authenticity of each piece of shooting data included in the saved shooting data 51 with a time stamp is guaranteed by the center server 2.
Therefore, the image data, counter value, position information, and shooting information included in the shooting data are reliable.
The photographing time can be specified using a counter value. That is, since the counter value is incremented by a predetermined amount at fixed time intervals, the time at which the counter value is obtained is specified by calculation from the correspondence between the start counter value and the start time, and the end counter value and the end time. be able to.
As described above, in this embodiment, the time when the camera 5 captures image data, the capturing position, and the capturing information can be proved by a digital signature, a time stamp, or the like.

(2) Details of Embodiment FIG. 2 is a diagram illustrating a network configuration of an image data collection system according to an example of the present embodiment.
The image data collection system 1 is a system in which, for example, an insurance company collects image data for insurance assessment. It is important that the image data used for the insurance money assessment can prove the shooting time and shooting position and can confirm that the data has not been tampered with. The image data collection system 1 meets such a demand.

The image data collection system 1 is installed at the head office of an insurance company, and is installed at a center server 2 that collects image data from the camera 5, a branch office or an agency of the insurance company, and communicates with the center server 2 via the network 4. The terminal 3 is a camera 5 and the camera 5 is a camera that captures image data.
In the following, data obtained by converting a subject into electronic data is referred to as image data, and image data provided with various additional information such as a counter value and position information is referred to as imaging data.

The center server 2 manages the counter value of the photographing data transmitted from the camera 5 and checks the non-falsification of the photographing data, and requests the time stamp server (not shown) to issue a time stamp to the photographing data. .
The terminal 3 is a terminal device installed at a branch office where photography is requested from the head office or the like, and can communicate with the center server 2 via the network 4. The terminal 3 is used as an intermediary when connecting the camera 5 to the center server 2. The center server 2 functions as a record collection server.

The camera 5 is a digital image photographing device for photographing image data for insurance assessment (accident vehicle, accident scene, etc.), and is registered in advance with the center server 2 at the head office and distributed to each branch.
The camera 5 can communicate with the center server 2 via the terminal 3. The communication at this time is encrypted using a technology such as SSL (Secure Sockets Layer), for example, to ensure security.

When the camera 5 has a function of directly connecting to the network, the camera 5 can be directly connected to the network 4 without using the terminal 3.
Further, when the camera 5 has a wireless communication function, it is possible to directly connect to the center server 2 via the base station 8 without using the terminal 3.
The camera 5 is connected to the center server 2 through a predetermined procedure when it is taken out to the shooting site and when it is taken home, but can be freely used offline when shooting. The camera 5 functions as a recording device.

FIG. 3 is a block diagram for explaining an example of the hardware configuration of the camera 5.
The camera 5 includes a tamper resistant unit 20, a CPU (Central Processing Unit) 30, a ROM (Read Only Memory) 31, a RAM (Random Access Memory) 32, a camera unit 33, a GPS (Global Positioning Systems) unit 34, an operation unit 35, A storage unit 36, a communication unit 37, and the like are connected by a bus line.

  The tamper resistant unit 20 is a functional unit that performs information processing related to security such as device authentication and digital signature issuance. For example, the tamper resistant unit 20 is a tamper resistant module configured by an IC chip containing a tamper resistant integrated circuit.

The tamper-resistant specification means that the internal structure is automatically destroyed when trying to analyze the internal structure, such as falsification, duplication, and deciphering of the internal logical structure, etc. It is a specification.
Therefore, the tamper resistant unit 20 is a kind of black box that is extremely difficult to analyze from the outside, and can securely hold secret information such as a device secret key.
Note that tamper means that the device is tampered with, or that information is illegally changed, and tamper resistance means that resistance to these operations is maintained. To do.

  The tamper resistant unit 20 includes a CPU 21, a counter 22, a ROM 23, a RAM 24, an EEPROM (Electrically Erasable and Programmable ROM) 25, an internal clock (not shown), and the like connected by a bus line.

The CPU 21 is a central processing unit that performs various types of information processing according to programs stored in the EEPROM 25, the ROM 23, the RAM 24, and the like.
In the present embodiment, a pair of a device public key and a device private key is generated, a digital signature is performed on the captured image data, and a counter value is output.

The counter 22 is a counter device that increments a counter value (numerical value) by a predetermined amount and counts it at regular time intervals. The fixed time interval is measured by an internal clock.
Here, “increment” means to increase the numerical value by a specified size, and in the present embodiment, for example, the counter value is increased by one every predetermined time interval.
Note that the counter value is intended to specify the shooting time (that is, the counter value and the time only need to be uniquely associated), so the numerical value can be decremented at a predetermined time interval. .

Further, the counter value 22 changes its value only in one of positive and negative directions.
That is, when the counter 22 is incremented, the counter value cannot be decreased. When the counter 22 is decremented, the counter value cannot be increased.
Since the counter value is a value corresponding to the photographing time of the photograph, it is possible to prevent a back date of the photographing time by configuring the counter 22 to proceed to either one.

The ROM 23 is a read-only storage device (memory), and stores basic programs and parameters for driving the tamper resistant unit 20.
The RAM 24 is a readable / writable storage device and provides a working area when the CPU 21 performs various types of information processing.
An internal clock (not shown) drives the tamper resistant unit 20 and generates a clock for the counter 22 to measure a predetermined time interval. The internal clock 22 is synchronized with an external clock (not shown) that drives the CPU 30, and the CPU 21 and the CPU 30 can operate in synchronism with each other.
In this embodiment, the counter 22 is configured separately from the internal clock. However, the internal clock itself can be used as the counter 22. In this case, the time when the internal clock is output is used as the counter value.

The EEPROM 25 is a readable / writable nonvolatile storage device, and stores programs, data, and the like.
In this embodiment, as an example, a device ID, an asymmetric encryption key generation program, a device secret key, a device certificate, a center server public key certificate, a photographing data processing program, and a basic program for driving the CPU 21 are used. An OS (Operating System) and the like are stored.

The device ID is identification information uniquely assigned to the camera 5, and each camera 5 is identified by the device ID. The device ID is stored by the manufacturer when the camera 5 is manufactured.
The asymmetric encryption key generation program is a program for causing the CPU 21 to exhibit a function for generating an asymmetric encryption key pair (pair) of the device secret key and the device public key inside the tamper resistant unit 20. This program is executed before device registration. Preferably, the manufacturer of the camera 5 executes it before shipping.
The generated device secret key is stored in the EEPROM 25 so that the device secret key cannot be known from the outside. The EEPROM 25 functions as a secret key storage unit.
The device secret key is used, for example, for digitally signing shooting data. The authenticity of the digital signature can be verified with the device public key.

The device certificate is, for example, a certificate in which the center server 2 digitally signs a device public key, device ID, and other information with a certificate private key. The device certificate is used when the center server 2 performs device authentication of the camera 5.
The device certificate is, for example, “device ID is XXX. The device public key of this device is XXX. The prover is the center server 2.” For example, it is composed of a message composed of other date and time of certification and a digital signature obtained by encrypting a digest (for example, hash value) of the message with a certificate private key.

The validity of the device certificate is confirmed as follows. First, the digest is restored from the digital certificate using the certificate public key corresponding to the certificate private key. Then, a digest is generated from the message.
If the two match, it can be confirmed that the device certificate is certainly created by the center server 2.

In the present embodiment, the center server 2 is configured to create a device certificate. However, the present invention is not limited to this. For example, an appropriate CA (certificate authority) can be configured. In this case, the CA creates a device certificate by digitally signing with the CA private key.
In this case, the center server 2 stores the CA public key and confirms the validity of the device certificate using the CA public key.

Next, the center server public key certificate is a public key certificate of the center server public key corresponding to the center server private key, and is downloaded from the center server 2 at the time of device registration.
The center server public key certificate is created, for example, by digitally signing the center server public key with the CA private key.
In this case, if the CA public key is stored in the camera 5 in advance, the camera 5 can confirm the legitimacy when the center server public key certificate is downloaded.

  The center server public key is used, for example, when encrypting some data such as photographing data to the center server 2. Since the data encrypted with the center server public key can be decrypted only by the center server 2 having the center server private key, security can be improved.

  The shooting data processing program is a program for notifying the center server 2 of the counter value, performing a digital signature on the shooting data, and causing the CPU 21 to perform functions such as encrypting shooting data.

The CPU 30 is a central processing unit that performs various types of information processing according to programs stored in the storage unit 36, the ROM 31, the RAM 32, and the like.
The CPU 30 operates in cooperation with the CPU 21. For example, the CPU 30 sends image data captured by the camera unit 33, position information detected by the GPS unit 34, and the like to the tamper resistant unit 20 and outputs from the tamper resistant unit 20. For example, the counter value and photographing data that have been sent are transmitted to the center server 2.

The ROM 31 is a read-only storage device, and stores basic programs and parameters for driving the CPU 30.
The RAM 32 is a readable / writable storage device, and provides a working area when the CPU 30 performs various types of information processing.

The camera unit 33 includes an optical system such as a lens and a diaphragm, an adjustment mechanism that automatically adjusts the lens, a CCD (Charge Coupled Device) that converts a projection image projected by the lens into an electric signal, and the like. Yes. The camera unit 33 generates image data to be imaged.
The camera unit 33 functions as digital data acquisition means for acquiring information (image) of a recording target (subject) as digital data (image data).

The GPS unit 34 is a module that receives GPS signals transmitted by a plurality of GPS sanitations circulating around the earth, analyzes the current position of the camera 5 and outputs the signal as an electrical signal. The GPS unit 34 functions as current position information acquisition means.
The operation unit 35 includes operation buttons, shutter buttons, and the like for the person in charge to operate the camera 5. Although not shown, the CPU 30 is also connected to a liquid crystal display device for presenting various kinds of information to a person in charge, a sound generating device for generating a buzzer sound, and the like.

The storage unit 36 is configured by, for example, an EEPROM, and stores various programs and data.
By executing the program stored in the storage unit 36 with the CPU 30, it is possible to communicate with the center server 2 and to cause the camera 5 to function as a camera.
The image data digitally signed by the tamper resistant unit 20 is stored in the storage unit 36 and transmitted to the center server 2 when online with the center server 2.
The communication unit 37 constitutes an interface for connecting the camera 5 to the center server 2.
In the case of the camera 5 having a function of performing wireless communication with the base station 8 (FIG. 2), the communication unit 37 includes a wireless communication unit configured with an RF circuit, an antenna, and the like.

FIG. 4 is a diagram schematically showing a logical configuration of the transmission shooting data 40. The transmission photographic data 40 is obtained by collecting the photographic data 1 to n (n is a positive integer) into one data when the camera 5 transmits the photographic data 1 to n (n is a positive integer). In addition, it can also comprise so that imaging | photography data 1-n may be transmitted separately continuously.
The photographing data 1 to n are created from image data photographed by the camera 5 and are created and stored in the storage unit 36 every time the person in charge photographs a subject.

The shooting data 1 to n are image data obtained by converting a projection image of a subject into electronic data by a CCD, a counter value at the time of shooting, current position information at the time of shooting detected by the GPS unit 34 (latitude and longitude can be specified), shooting It includes shooting information made up of parameters related to the optical system of the camera unit 33, such as the focal length and aperture at the time, and a digital signature for proving the legitimacy of these data.
The shooting data corresponds to recording data including image data and a counter value. As described above, the camera 5 includes recording data generation means and signature means for digitally signing the recording data generation means.

The shooting information can be used to verify the situation when the image data is shot.
For example, in the case of image data obtained by taking a counterfeit photograph of an accident vehicle as a subject, the focal length may be shorter than the original value, and such counterfeit can be found by verifying the focal length.

The digital signature is obtained by encrypting a digest (for example, a hash value) of image data, counter value, position information, shooting information, and the like with the device secret key.
A person (such as the center server 2) who verifies the legitimacy of the photographing data (that is, whether it is not falsified or created by the camera 5) restores the digest with the device public key, and further The digest may be generated from the image data, the counter value, the position information, the shooting information, and the like to confirm the coincidence.

The transmission photographing data 40 is transmitted to the center server 2, and the center server 2 requests the time stamp to be issued.
In this way, by combining the shooting data into the shooting shooting data 40, the same effect as when the time stamp is issued to each shooting data can be obtained by one time stamp.
Note that the camera 5 may be configured such that the photographing data 1 to n are individually transmitted to the center server 2, and the center server 2 collects them into one data and issues a time stamp.
Alternatively, although the number of times of issuing the time stamp increases, the camera 5 may individually transmit the shooting data 1 to n to the center server 2 and the center server 2 may be configured to issue the time stamp to each shooting data. Good.

FIG. 5 is a block diagram for explaining an example of the hardware configuration of the center server 2.
The center server 2 includes a CPU 41, a ROM 42, a RAM 43, a clock 44, a communication unit 45, a storage unit 46, and the like connected by a bus line.
The CPU 41 operates in accordance with programs stored in the ROM 42, the RAM 43, the storage unit 46, and the like, and registers the device of the camera 5, manages the correspondence between the counter value and the time, and captures shooting data (stored shooting data 50 described later). Performs various processes such as issuing time stamps.

The ROM 42 is a read-only storage device, and stores basic programs and parameters for driving the CPU 41.
The RAM 43 is a readable / writable storage device and provides a working area when the CPU 41 performs various types of information processing.
The communication unit 45 is an interface that connects the center server 2 to the network 4.
The clock 44 is a clock device that functions as a time measuring unit, and measures the time corresponding to the start counter value and the end counter value, and provides a certification time when issuing a time stamp to the transmission photographing data 40.

The storage unit 46 is configured using, for example, a large-capacity storage medium such as a hard disk, and stores various programs and data as illustrated.
The device registration program is a program for issuing a device certificate to the camera 5 and registering the camera 5 in the device registration database.
The time stamp issuance request program is a program for issuing a time stamp to the transmission shooting data 40 received from the camera 5. In addition to issuing and acquiring a time stamp, the counter value of the camera 5 and the counter value are received. Various kinds of information processing such as acquisition of correspondence with the time of the day and confirmation of the digital signature of the shooting data are performed.

The device registration database is a database in which the device ID and device public key of the camera 5 are registered. The camera 5 is distributed to each branch or agency after being registered in the device registration database.
The imaging data database is a database in which the transmission imaging data 40 that has issued time stamps is accumulated. The transmission photographing data 40 stored here is used for insurance assessment and the like.
The counter value storage area is an area for temporarily storing the start counter value and the end counter value transmitted from the camera 5 in association with the start time and the end time, respectively. The correspondence relationship stored here is used to create storage image data to be described later.

The certificate private key is a private key for digitally signing the device certificate. Although not shown, the storage unit 46 also stores a certificate public key corresponding to the certificate private key, and the center server 2 can verify the device certificate using the certificate public key. it can.
The center server secret key is a secret key corresponding to the center server public key, and is used for decrypting the transmission shooting data 40 (encrypted with the center server public key) transmitted from the camera 5.

Next, the correspondence between the counter value and the time will be described with reference to FIG.
Assume that the start counter value transmitted from the camera 5 to the center server 2 is 1000, and the time when the center server 2 receives the start counter value from the camera 5 is 13:00.
Further, it is assumed that the end counter value transmitted from the camera 5 to the center server 2 is 6000, and the time when the center server 2 receives the end counter value from the camera 5 is 18:00.
When the counter value recorded in the photographing data is 3500, the photographing time of the image data recorded in the photographing data is calculated as follows and becomes 15:30.

It takes 18 hours to 13: 00 = 5 hours for the counter value to increase by 6000−1000 = 5000. That is, the counter value per hour increases by 5000 ÷ 5 = 1000.
Since the counter value is increased by 3500−1000 = 2500 at the photographing time, the photographing time is a time when 2500 ÷ 1000 = 2.5 hours have elapsed from the start time. That is, the photographing time is 15:30.
In this way, the user of the shooting data can calculate the time when the image data was shot from the counter value recorded in the shooting data, the start counter value and the start time, and the end counter value and the end time. .
Thus, since the counter value is associated with the time, the counter 22 functions as a clock device that measures the time while the camera 5 is offline.

In addition, as the counter value per unit time is larger, the photographing time can be specified more finely. The counter value per unit time of the counter 22 is secured to a value sufficient for the purpose of use of the image data (in this case, insurance assessment).
For example, if the counter 22 counts 1000 per unit time (per second), 1 count corresponds to 1 millisecond, and 100 counts corresponds to 10 millisecond.
If an accuracy of about 1 minute is sufficient, for example, about 1 count per 10 seconds is sufficient.
Thus, the count value per unit time of the counter 22 only needs to satisfy the required accuracy.
The center server 2 knows the count number per unit time of the camera 5 (for example, notified to the center server 2 from the camera 5 at the time of device registration), and the shooting time using the start time and the count number. Can also be calculated.

Next, information processing performed by the center server 2 on the transmission shooting data 40 will be described with reference to FIGS.
FIG. 7A is a schematic diagram illustrating a logical configuration of storage image data.
The storage image data 50 is obtained by adding the start counter value, the end counter value, the start time, the end time, the device ID, and other information to the transmission image data 40 (image data 1 to n) by the center server 2. .
The storage photographing data 50 is intermediate data for the center server 2 to issue a time stamp to the photographing data.

FIG. 7B is a schematic diagram showing a logical configuration of the time-stamped image data for storage.
The time-stamped saved shooting data 51 is obtained by issuing a time stamp to the saving shot data 50 by the center server 2.
That is, the center server 2 adds information such as a certification time and a time stamp issuer certified by the time stamp to the storage photographing data 50.
The legitimacy of the time-stamped shooting data 51 can be verified using a time stamp public key certificate.
In this way, the center server 2 can issue time stamps to the photographing data 1 to n at a time.

Next, the database etc. memorize | stored in the memory | storage part 46 of the center server 2 are demonstrated using each figure of FIG.
FIG. 8A is a diagram illustrating an example of a logical configuration of the device registration database.
The device registration database includes “device ID”, “device public key”, and other items.
“Device ID” is the device ID of the camera 5, and the camera 5 can be identified by this.
The “device public key” is a device public key acquired from the camera 5 and is stored in association with the device ID. Thus, the device registration database functions as public key storage means.
In addition to this, for example, the count number per unit time of the counter 22, the distribution destination of the camera 5, the distribution date and time, the model number, and other information can be stored in association with the device ID and used for management of the camera 5. .

FIG. 8B is a diagram illustrating an example of a logical configuration of the shooting data database.
In the photographic data database, time-stamped photographic data 51 for storage is stored in association with the device ID.
The stored photographing data 51 with a time stamp stored here is downloaded to an appropriate terminal and used for insurance assessment.

FIG. 8C is a diagram showing a logical example of the counter value storage area.
In this area, items such as “device ID”, “start count value”, “start time”, “end count value”, and “end time” can be secured.
When the start counter value is received from the camera 5, the device ID of the camera 5 is registered in the “device ID”, and the start counter value is registered in the “start counter value”. In the “start time”, the time when the start counter value is received is registered.
On the other hand, the end counter value received from the camera 5 is registered in the “end counter value”, and the time at that time is registered in the “end time”.
These pieces of information are used to generate the saved shooting data 50 from the transmission shooting data 40. These values may be deleted after use.

Next, a procedure in which the center server 2 registers the camera 5 as a device will be described using the flowchart of FIG.
First, the camera 5 is caused to execute an asymmetric encryption key generation program (FIG. 3) to generate a device private key / device public key pair in the tamper resistant unit 20 (step 10). This work is performed, for example, by the manufacturer of the camera 5, and then the camera 5 is shipped to an insurance company.

Upon receipt of the camera 5, the person in charge of the insurance company connects the camera 5 to the center server 2 and transmits the device ID, device public key, etc. of the camera 5 to the center server 2 (step 15).
The center server 2 receives the information from the camera 5, stores it in the device registration database, and registers the device (step 20).
Next, the center server 2 creates a device certificate by digitally signing the device public key, device ID, etc. with the certificate private key (step 25), and transmits it to the camera 5 together with the center server public key certificate (step 25). Step 30).
The camera 5 receives the device certificate and the center server public key certificate from the center server 2 and stores them in the tamper resistant unit 20 (step 35).
Through the above processing, the camera 5 is registered in the center server 2 and delivered to a branch office or the like.

Next, processing that is performed before the camera 5 is taken out will be described with reference to the flowchart of FIG. In addition, the process which the camera 5 performs below is performed by the tamper resistant unit 20.
First, the camera 5 is connected to the center server 2 via the terminal 3. After being connected to the center server 2, the camera 5 encrypts the device certificate with the center server public key and transmits it to the center server 2 (step 50).
In this embodiment, the camera 5 is device-authenticated by the device certificate, but other information may be used as long as the camera 5 can perform device authentication.

The center server 2 receives the device certificate from the camera 5 and performs device authentication using the device certificate (step 55).
This device authentication is performed by decrypting the device certificate with the center server private key and confirming the validity of the device certificate with the certificate public key.
In this way, the center server 2 authenticates the camera 5 by confirming that the camera 5 has the device certificate issued by itself.

As a modified example, a device ID or device certificate digitally signed with a device private key and encrypted with a center server public key can be used as device authentication information.
In this case, the center server 2 retrieves the device public key from the device registration database using the device ID after decrypting it with the center server private key. Then, after verifying the digital signature with the device public key, the device certificate is verified using the certificate public key.
In this example, the center server 2 can confirm that the camera 5 has a device secret key in addition to having a device certificate.

When the device authentication is successful as described above, the center server 2 notifies the camera 5 that the device authentication is successful.
When the device authentication is successful, the camera 5 transmits the current counter value as an initial counter value to the center server 2 (step 57). As described above, the camera 5 includes counter value transmission means (first counter value transmission means).
The center server 2 receives the initial counter value from the camera 5, and acquires it from the clock 44 (FIG. 3) with the current time at that time as the start time.
Then, the center server 2 stores the initial counter value and the start time in the counter value storage area in association with the device ID (step 60). As described above, the center server 2 includes correspondence relationship acquisition means for acquiring the correspondence between the counter value and the time.
Note that the start time may be determined by appropriate correction such as taking into account the delay of the network.

Next, the center server 2 generates expiration date information and transmits it to the camera 5 (step 65).
The expiration date information is information that defines a time limit during which the camera 5 can transmit the photographed data to the center server 2 and includes, for example, a date and time corresponding to the time limit.
The camera 5 receives the expiration date information from the center server 2 and stores it in the EEPROM 25 (step 70).
After passing through the above processing, the camera 5 ends connection with the center server 2 and goes offline, and can be used freely within the expiration date.

Next, processing when the subject is photographed by the camera 5 will be described using the flowchart of FIG.
The person in charge of photographing removes the camera 5 from the terminal 3 to go off-run and carries it to the photographing site. Then, the camera 5 is activated to make the camera 5 ready for photographing.
When the camera 5 is activated, the camera 5 refers to the expiration date information stored in the tamper resistant unit 20 and displays the expiration date on the display unit (step 105). Thereby, the person in charge of photographing can recognize that it is within the expiration date.
Note that the expiration date can be configured to be always displayed even when the camera 5 is not activated, or can be configured to issue an alarm when the expiration date approaches.

After confirming that the person in charge of shooting is within the expiration date, the person in charge of photographing performs photographing of the subject (step 110).
The shooting is performed by the camera unit 33 adjusting the focal length, the aperture, and the like to form a projected image of the subject on the CCD, and the camera unit 33 converting the image into image data.
The camera 5 acquires the image data in this way (step 115) and inputs it to the tamper resistant unit 20.

When acquiring the image data, the tamper resistant unit 20 acquires the counter value at that time from the counter 22 (step 120).
Next, the tamper resistant part 20 acquires position information specifying the current position from the GPS part 34 (step 125).
Further, the tamper resistant part 20 acquires shooting information when the image data is shot from the camera part 33 (step 130).

Next, the tamper resistant unit 20 adds the counter value, position information, shooting information, and the like to the image data to generate shooting data.
Next, the tamper resistant unit 20 generates a digest of the photographic data, for example, by calculating a hash value (step 135), and creates a digital signature by encrypting it with the device private key (step 135). 140).
Next, the tamper resistant unit 20 adds a digital signature to the photographed data and outputs it to the storage unit 36 (step 145).
When the person in charge of photographing continues to photograph, the camera 5 returns to step 110, and when the photographing ends, the photographing process is terminated.
As described above, the photographing data is accumulated in the storage unit 36.

Next, a procedure for transmitting photographing data to the center server 2 will be described using the flowchart of FIG.
When the person in charge of photographing finishes photographing and returns to the branch or the like, the camera 5 connects the camera 5 to the center server 2 via the terminal 3.
The camera 5 confirms that the current time is within the expiration date (step 205). If the expiration date has passed, the camera 5 interrupts the photographing data transmission process and, for example, issues an alarm to notify the person in charge of the expiration date.

If it is within the expiration date, the camera 5 transmits a device certificate to the center server 2 (step 210).
As described above, the recording data transmission means of the camera 5 transmits the recording data (transmission shooting data 40) within the effective period.
The center server 2 receives the device certificate from the camera 5 and performs device authentication (step 215). At this time, the center server 2 can also be configured to check the expiration date.
When the device authentication is successful, the center server 2 notifies the camera 5 that the device authentication is successful.

When the device authentication is successful, the camera 5 transmits the current counter value as the end counter value to the center server 2 (step 217). As described above, the camera 5 includes counter value transmission means (second counter value transmission means).
The center server 2 receives the end counter value from the camera 5 and acquires the current time at that time from the clock 44 as the end time. Then, the center server 2 stores the end counter value and the end time in the counter value storage area in association with the device ID (step 220). As described above, the center server 2 includes correspondence relationship acquisition means for receiving counter values before and after the camera 5 generates image data and acquiring the correspondence between these counter values and time.
Thus, the counter value storage area stores the start counter value, the start time, the end counter value, and the end time in association with the device ID.

After storing these data in the counter value storage area, the center server 2 checks whether or not the end counter value is appropriate as follows (step 223).
The center server 2 stores a count number per unit time of the counter 22.
Therefore, the value obtained by adding the initial counter value to the time difference between the end time and the start time multiplied by the count number per unit time [initial counter value + (end time−start time) × count number per unit time] is It should be equal to the end counter value (within the accuracy of counter 22).
The center server 2 stores a threshold value in consideration of the accuracy of the counter 22, and determines that the end counter value is appropriate when the difference between the end counter value and the calculated value is within the threshold value.

The center server 2 may store a preset value as a threshold value, or may calculate the threshold value from the time difference between the start time and the end time. In the latter case, the smaller the time difference is, the smaller the threshold value is calculated, and the end counter value can be checked more strictly.
By confirming the end counter value in this way, for example, when there is some trouble in the camera 5, such as when the counter 22 is out of order, the possibility that this can be detected increases.

When it is determined that the end counter value is appropriate, the center server 2 requests the camera 5 to transmit photographing data (step 225). If the end counter value is not appropriate, the center server 2 transmits an alarm to the camera 5 and interrupts the subsequent processing.
When the camera 5 is requested to transmit the shooting data from the center server 2, the camera 5 generates the shooting data 40 for transmission (FIG. 4) using the shooting data 1 to n, encrypts it with the center server public key, and the center server 2. (Step 230). As described above, the camera 5 includes recording data transmission means.

The center server 2 receives the transmission shooting data 40 from the camera 5, decrypts it with the Santa server private key, and temporarily stores it in the RAM 43 or the like. As described above, the center server 2 includes recording data receiving means.
Next, the center server 2 acquires the device public key of the camera 5 from the device registration database using the device ID of the camera 5, and uses each of the shooting data 1 to n included in the transmission shooting data 40 using the device public key. The digital signature is confirmed for (step 235). As described above, the center server 2 includes signature confirmation means.
When there is shooting data whose legitimacy cannot be proved by the digital signature, the center server 2 performs predetermined processing such as invalidating the shooting data or invalidating all the shooting data, for example. .

When the digital signatures of the photographing data 1 to n can be confirmed, the center server 2 uses the device ID of the camera 5 to read the initial counter value, start time, and end counter from the counter value storage area (FIG. 8C). Get value and end time.
Then, the center server 2 adds the searched data and the like to the transmission shooting data 40 to generate the storage shooting data 50 (FIG. 7A) (step 240).

Next, the center server 2 generates a digest by giving the current time to the archival data 50 as a certification time, and issues a time stamp issuance request to the time stamp issuing station or the time stamp server (step). 250).
As described above, the center server 2 includes a time stamp issuing unit, and requests the time stamp issuing unit to issue a time stamp (time stamp requesting unit) to cause the time stamp to be issued.
Then, the center server 2 stores the time-stamped saved shooting data 51 (FIG. 7B) in the shooting data database (step 255).
As described above, the center server 2 includes storage record data acquisition means for acquiring storage record data (storage image data 50) issued with a time stamp.

Next, a method of using the time-stamped shooting data 51 stored in the center server 2 will be described.
A user (for example, a person in charge of insurance assessment) accesses the center server 2 from an in-house user terminal or the like, and downloads desired shooting data 51 with a time stamp.
By storing the time stamp public key in the user terminal, the user can confirm the legitimacy of the time stamp of the time-stamped saved shooting data 51.

Since the authenticity of the shooting data 1 to n included in the storage data 51 with time stamp is already guaranteed by the center server 2, the user can set the desired shooting data with the storage data 51 with time stamp. Obtain from and use.
The user terminal can acquire image data, shooting location information, and shooting information from the shooting data.
As shown in FIG. 6, the user terminal calculates the shooting time from the start counter value, start time, end counter value, and end time described in the shooting data.
As described above, the user can obtain desired image data, a shooting time, a shooting position, and shooting information of the image data.

According to the embodiment described above, the following effects can be obtained.
(1) A digital signature can be performed by adding a shooting time, a shooting position, shooting information, and the like to image data shot by the camera 5. Thereby, the photographing time and photographing position of the image data can be proved. In addition, since the module for performing the digital signature is stored in the tamper-proof portion 20, it can be assured that these pieces of information have not been tampered with.
(2) Since the counter 22 is provided in the tamper-resistant portion 20, unauthorized operation of the counter 22 can be prevented.
(3) Since the photographing time is given by a counter value, time information can be given to the image data without correcting the time measured by the camera 5.
(4) Since the image data can be taken offline, the image can be taken even in an environment where the camera 5 cannot be connected to the network. In the case of taking pictures for insurance assessment, for example, there are many opportunities for taking pictures at sites where the network environment is inferior, such as in the mountains, remote islands, or at sea, so it is very effective to be able to use it offline.

In the present embodiment, the set of the start counter value and the start time and the set of the end counter value and the end time are recorded in the storage photographing data 50, but the count number per unit time of the counter is known. In some cases, either one of them may be recorded.
In this case, the reliability is lower than when both sets are recorded, but the shooting time can be specified.
For example, when the start counter value and the start time are recorded, the shooting time can be obtained by [start time + (start counter value−counter value at the time of shooting) ÷ count number per unit time].

In the present embodiment, the camera 5 is used as the recording device, and the image data is digital data of information to be recorded. However, the present embodiment is not limited to this, and the measurement of volcanic gas concentration and noise measurement are performed. Various items such as air pollutant measurement, water quality inspection, earthquake measurement, and civil engineering construction record image data can be targeted.
For example, when performing a water quality inspection of a lake, the inspection apparatus is provided with the tamper resistant unit 20 of the present embodiment, and a digital signature is made by adding an inspection time (counter value), an inspection position, etc. to the water quality inspection data. Can be configured.

Next, a modification of the present embodiment will be described.
In the above-described embodiment, the position information is acquired by the GPS unit 34 at the time of image data shooting. However, GPS signals cannot be received in, for example, tunnels, basements, high-rise buildings, valleys, and under water. Image data may be taken at a place.
Japanese Patent Application Laid-Open No. 2002-365356 proposes a technique for receiving a GPS signal in an area where the GPS signal does not reach.
This technique re-radiates a GPS signal in a place where the GPS signal does not reach.
However, it is not realistic to introduce re-radiation equipment to all facilities. Further, in the case of the camera 5, the shooting site is arbitrarily generated.
Therefore, in this modification, position information can be recorded even in places where GPS signals are difficult to receive.

FIG. 13 is a block diagram for explaining an example of the hardware configuration of the camera 5 according to the present modification.
The same components as those in FIG. 3 described in this embodiment are denoted by the same reference numerals, and the description will be simplified, and redundant description will be omitted.
The tamper resistant unit 20 of the camera 5 according to the present modification acquires position information from the GPS unit 34 at every predetermined timing, and further acquires a counter value at that time from the counter 22. Then, the tamper resistant unit 20 stores the counter value position set as a pair in a counter value position set storage area (counter value position set storage means) provided in the RAM 24.

The predetermined timing is generated periodically at regular time intervals, for example, once per second.
When the counter value position set is newly acquired at the next timing, the tamper resistant part 20 overwrites the counter value position set storage area.
That is, while the position information can be detected by the GPS unit 34, the latest counter value position set is always stored in the counter value position set storage area.

FIG. 14 is a diagram schematically illustrating a logical configuration of transmission image data 40 according to the present modification.
The tamper resistant unit 20 will be described in the present embodiment first when the GPS unit 34 can acquire the position information of the current position when shooting image data (that is, when shooting is performed at a location where GPS signals reach). Shooting data is generated in the same manner as described above.
On the other hand, when the position information of the current position cannot be acquired by the GPS unit 34 when the image data is captured (that is, when the image is captured in a place where the GPS signal does not reach), the tamper resistant unit 20 replaces the position information. In addition, the counter value position set of the RAM 24 is recorded in the photographing data. In FIG. 14, the counter value position set is described as “position information (counter value)”. As described above, the tamper resistant unit 20 includes a recording data generating unit.

As described above, when the position information is not obtained when the image data is captured, the camera 5 of the present modification example uses the counter value obtained when the image data is captured and the counter value position set obtained last. Record in shooting data.
From the difference between the counter value at the time of shooting and the counter value included in the counter value position set, the time difference from when the position information was last obtained until the image data was shot can be calculated.
Therefore, it can be seen that the image data was captured within a range that can move within the time difference from the point specified by the counter value position set. As a result, the user of the shooting data can narrow down the shooting location.
That is, the user of the image data can estimate the approximate shooting position by knowing the latest position information and counter value when the image data was shot.

Next, processing in the case of photographing a subject with the camera 5 of the present modification will be described using the flowchart of FIG. The same processes as those in FIG. 11 described above are denoted by the same step numbers, and the description will be simplified or omitted.
Although not shown in the flowchart, the camera 5 repeats the process of acquiring the counter value position set and overwriting the counter value position set storage area of the RAM 24 at predetermined timings.

The processing from step 105 to step 120 is the same as that in FIG.
In step 120, after obtaining the counter value, the tamper resistant part 20 checks whether or not position information can be obtained from the GPS part 34.
When position information cannot be acquired from the GPS unit 34 (step 123; N), the tamper resistant unit 20 reads the counter value position set from the counter value position set storage area of the RAM 24 (step 127).

On the other hand, when position information can be acquired from the GPS unit 34 (step 123; Y), the tamper resistant unit 20 acquires position information from the GPS unit 34 (step 125).
The subsequent processing from step 130 to step 150 is the same as that in FIG. Further, the generated shooting data is transmitted to the center server 2 as in the embodiment, and is processed and stored into the saving shooting data 51 with a time stamp.
The user of the shooting data can recognize that the shooting data was shot in a place where the GPS signal does not reach because the position information of the shooting data is the counter value position set.

As described above, when the camera 5 of the present modification can receive a GPS signal at the time of shooting, the camera 5 generates the same shooting data as in the above-described embodiment, and when the GPS signal cannot be received, Shooting data including the latest position information and a counter value from which the position information is acquired can be generated.
As a result, even if the image data is taken at a place where the GPS signal does not reach, the user can estimate the approximate place of photography.

It is a figure for demonstrating the outline | summary of this Embodiment. It is the figure which showed the network structure of the image data collection system. It is a figure for demonstrating the hardware-like structure of a camera. It is the figure which represented typically the logical structure of the imaging | photography data for transmission. It is a block diagram for demonstrating the hardware-like structure of a center server. It is a figure for demonstrating a response | compatibility with a counter value and time. It is a figure for demonstrating the information processing which a center server performs with respect to the imaging | photography data for transmission. It is a figure for demonstrating the database etc. which the center server memorize | stored. It is a flowchart for demonstrating the procedure in which a center server registers a camera as an apparatus. It is a flowchart for demonstrating the procedure in which a camera transmits a start counter value to a center server. It is a flowchart for demonstrating the process in the case of image | photographing a to-be-photographed object with a camera. It is a flowchart for demonstrating the process which a camera transmits imaging | photography data to a center server. It is a block diagram for demonstrating an example of the hardware structure of the camera which concerns on a modification. It is the figure which represented typically the logical structure of the imaging | photography data for transmission which concerns on a modification. It is a flowchart for demonstrating the process in the case of image | photographing a to-be-photographed object with the camera of a modification.

Explanation of symbols

1 image data collection system 2 center server 3 terminal 4 network 5 camera 6 base station

Claims (3)

A recording apparatus for recording information, and a recording apparatus for use in a recording and collecting system configured using a recording and collecting server that collects recording data from the recording apparatus,
A counter device for increasing a numerical value by a predetermined amount at regular time intervals;
Current position information acquisition means for acquiring current position information;
Counter value position set storage means for storing a counter value position set consisting of a pair of the counter value of the counter device and the acquired current position information for each predetermined timing;
A secret key storage means for storing the secret key;
Counter value transmission means for transmitting the counter value of the counter device to the record collection server;
Digital data acquisition means for acquiring information to be recorded as digital data;
When the current position information acquisition unit can acquire current position information when the digital data is acquired, the acquired digital data, a counter value when the digital data is acquired, and the acquired current position When the current position information acquisition unit cannot acquire the current position information when the recording data including the information is generated and the digital data is acquired, the acquired digital data and the digital data are acquired. Recording data generating means for generating recording data including the counter value at the time of the counter value and the counter value position set stored in the counter value current value storage means;
A signature means for digitally signing the generated recorded data with the stored secret key;
Recording data transmission means for transmitting the digitally signed recording data to the recording collection server;
A recording apparatus comprising:   The recording apparatus according to claim 1, wherein the predetermined timing is periodically generated at regular time intervals. A recording method performed by a recording apparatus for recording information and a recording apparatus used in a recording collection system configured using a recording collection server that collects recording data from the recording apparatus,
The recording apparatus includes a counter device that increments a numerical value by a predetermined amount at regular time intervals, a secret key storage unit that stores a secret key, a current position information acquisition unit, a counter value position set storage unit, and a counter value transmission Means, digital data acquisition means, recording data generation means, signature means, and recording data transmission means,
A current position information acquisition step of acquiring current position information by the current position information acquisition means;
In the counter value position set storage means, a counter value position set storage step for storing a counter value position set consisting of a pair of the counter value of the counter device and the acquired current position information for each predetermined timing;
A counter value transmitting step of transmitting the counter value of the counter device to the record collection server by the counter value transmitting means;
A digital data acquisition step of acquiring information to be recorded as digital data by the digital data acquisition means;
When the digital data is acquired by the recording data generation unit, if the current position information acquisition unit can acquire the current position information, the acquired digital data and a counter value when the digital data is acquired If the current position information acquisition unit cannot acquire the current position information when the recording data including the acquired current position information is generated and the digital data is acquired, the acquired digital data is acquired. A recording data generation step for generating recording data including the counter value at the time of acquiring the digital data and the counter value position set stored in the counter value current value storage unit;
A signature step of digitally signing the generated recording data with the stored secret key by the signing means;
A recording data transmitting step of transmitting the digitally signed recording data to the recording collection server by the recording data transmitting means;
A recording method comprising:

Images