JP6759818B2 - Data generators, data recording systems and programs - Google Patents

Description

The present invention relates to a data generator, a data recording system and a program.

Conventionally, a data generation device such as an imaging device and a data storage device (server device or the like) that receives and stores time-series data (moving image data or the like) generated by the data generation device are combined. Data recording systems are known. In the data recording system, a signature may be added to the time series data in order to guarantee the authenticity of the data.

Here, in the data recording system, as a method of adding a signature to time-series data, for example, a method of adding a signature on the data storage device side and a method of adding a signature on the data generation device side can be mentioned. Of these, in the case of the method of adding a signature on the data storage device side, the possibility that the time series data stored in the data storage device before adding the signature is read out and falsified cannot be excluded. Therefore, in order to guarantee the authenticity of the data, it is desirable to add a signature on the data generation device side and store the data in the data storage device (see Patent Document 1 and the like below).

However, when the data generator is configured to add a signature, when the data storage device receives the signed data, if even one data loss occurs, the data storage device signs the signature. There is a problem that verification cannot be performed. In this case, even if the data that is not missing is the data that has not been tampered with, the authenticity of the data cannot be guaranteed.

For this reason, in the above data recording system, when adding a signature on the data generation device side, the resistance to data loss is improved, and even if a data loss occurs, the signature verification is performed on the data storage device side. It is desirable to configure it so that

The present invention has been made in view of the above problems, and an object of the present invention is to improve resistance to data loss in signature verification.

The data generation device according to each embodiment of the present invention has, for example, the following configuration. That is,
From the time series data, n (2 or more integers) of data included in a predetermined interval are sequentially acquired, and based on the acquired data, k (k is an integer of 1 or more and less than n) disorder. A calculation means for calculating parameter information that satisfies the (k-1) -order polynomial containing numerical values, and
An output means for associating the acquired data with the parameter information calculated based on the acquired data and outputting the data.
A signature is added to the secret information based on the secret sharing protocol, which can be calculated by collecting k sets of the acquired data and the parameter information output in association with the acquired data, and output. and the first signature means,
A first transmission in which the acquired data and the parameter information output in association with the acquired data are transmitted, and the secret information output with the signature added by the first signature means is transmitted. Means and
A second signature means for adding a signature to the hash value of the acquired data and outputting the data,
It has a second transmission means for transmitting the hash value of the acquired data and the hash value output by the second signature means with a signature added .

According to each embodiment of the present invention, resistance to data loss in signature verification can be improved.

It is a figure which shows an example of the system configuration of a data recording system. It is a figure for demonstrating the secret sharing protocol. It is a figure for demonstrating the secret sharing protocol. It is a figure which shows the hardware configuration of the image pickup apparatus and the server apparatus in 1st Embodiment. It is a figure which shows the functional structure of the image pickup apparatus in the 1st Embodiment. It is a figure which showed typically the operation of each part of the image pickup apparatus in 1st Embodiment. It is a flowchart which shows the flow of secret distribution data generation processing. It is a figure which shows the functional structure of a server device. It is a flowchart which shows the flow of the data verification process. It is a figure which shows the application example of a data recording system. It is a figure which shows the functional structure of the image pickup apparatus in the 2nd Embodiment. It is a figure which shows an example of the setting parameter information held in the setting parameter storage part. It is a figure which shows the hardware configuration of the image pickup apparatus in the 3rd Embodiment. It is a figure which shows the functional structure of the image pickup apparatus in the 3rd Embodiment. It is a figure which shows the application example of the image pickup apparatus in 3rd Embodiment. It is a figure which shows the functional structure of the image pickup apparatus in 4th Embodiment. It is a figure which showed typically the operation of each part of the image pickup apparatus in 4th Embodiment. It is a flowchart which shows the flow of secret distribution data generation processing. It is a flowchart which shows the flow of the data verification process. It is a figure which shows the application example of a data recording system. It is a flowchart which shows the flow of secret distribution data generation processing. It is a flowchart which shows the flow of secret distribution data generation processing. It is a flowchart which shows the flow of secret distribution data generation processing. It is a flowchart which shows the flow of secret distribution data generation processing. It is a flowchart which shows the flow of secret distribution data generation processing. It is a figure which shows an example of the system configuration of a data recording system. It is a figure which shows the functional structure of the image pickup apparatus in 8th Embodiment. It is a figure which showed typically the operation of each part of the image pickup apparatus in 8th Embodiment. It is a flowchart which shows the flow of secret distribution data generation processing. It is a figure which shows the functional structure of a server device. It is a flowchart which shows the flow of data verification processing (counterfeiting, falsification). It is a figure which shows an example of the system configuration of a data recording system. It is a flowchart which shows the flow of a signature process. It is a figure which shows an example of the system configuration of a data recording system. It is a flowchart which shows the flow of a signature process. It is a flowchart which shows the flow of data verification processing (counterfeiting, falsification). It is a flowchart which shows the flow of data verification processing (counterfeiting, falsification). It is a figure which shows an example of the system configuration of a data recording system.

Hereinafter, each embodiment of the present invention will be described with reference to the accompanying drawings. In the description of the specification and the drawings according to each embodiment, the components having substantially the same functional configuration are designated by the same reference numerals to omit duplicate explanations.

[First Embodiment]
<1. Data recording system configuration>
First, the overall configuration of the data recording system will be described. FIG. 1 is a diagram showing an example of a system configuration of a data recording system.

As shown in FIG. 1, the data recording system 100 includes a data generation device 110 and a data storage device 120. In the first embodiment, the data generation device 110 and the data storage device 120 are communicably connected via a network.

The data generation device 110 is a device that generates time-series data. In the first embodiment, the data generation device 110 will be described below as an imaging device that generates moving image data. A secret distribution data generation program is installed in the image pickup apparatus 110, and when the program is executed, the imaging apparatus 110 functions as the secret distribution data generation unit 111.

The secret distribution data generation unit 111 generates secret distribution data by associating the generated moving image data with parameter information based on the secret distribution protocol, and streams and transmits the secret distribution data to the data storage device 120. Further, the secret sharing data generation unit 111 adds a signature to the secret information used when the data storage device 120 performs signature verification on the secret distribution data, and transmits the signed secret information to the data storage device 120 as a signature value. To do.

The data storage device 120 is a device that stores various data transmitted from the data generation device 110. In the present embodiment, the data storage device 120 will be described below as a server device that stores secretly distributed data and signature values. A data verification program is installed in the server device 120, and when the program is executed, the server device 120 functions as a data verification unit 121.

The data verification unit 121 receives the secret distribution data and the signature value transmitted from the image pickup apparatus 110 and stores them in the data storage unit 122. Further, the data verification unit 121 performs signature verification using the secret information calculated based on the secret distribution data stored in the data storage unit 122 and the secret information calculated based on the signature value stored in the data storage unit 122. Do.

Note that the data verification unit 121 can perform signature verification even when some of the secret sharing data streamed and transmitted from the image pickup apparatus 110 is missing. This is because the secret sharing data generated by using the secret sharing protocol is highly resistant to data loss in signature verification.

<2. Description of secret sharing protocol>
Next, the secret sharing protocol used when generating secret sharing data having high resistance to data loss in signature verification will be briefly described with reference to FIGS. 2 and 3. 2 and 3 are diagrams for explaining a secret sharing protocol.

(1) Overview In general, a polynomial of degree (k-1) can be uniquely determined if there are k independent solutions, and for solutions of degree (k-1) or less, order (k-1) Polynomial of is not uniquely defined. FIG. 2A uniquely defines a first-order polynomial (y = α ₁ x + α ₀ ) based on two independent solutions ((x ₁ , y ₁ ), (x ₂ , y ₂ )). It shows how it looks. In addition, FIG. 2 (b) is a quadratic polynomial (y) based on three independent solutions ((x ₁ , y ₁ ), (x ₂ , y ₂ ), (x ₃ , y ₃ )). = Α ₂ x ² + α ₁ x + α ₀ ) is uniquely defined.

Further, FIG. 3A is based on (k−) based on k independent solutions ((x ₁ , y ₁ ), (x ₂ , y ₂ ), ... (X _k , y _k )). 1) The following polynomial (y = α _k-1 x ^k-1 + α _k-2 x ^k-2 + ... α ₁ x + α ₀ ) is uniquely defined.

Secret sharing protocols take advantage of this relationship between polynomials and their solutions. As shown in FIG. 3B, when the secret sharing protocol is used, the data generator that generates the secret information puts the generated secret information into the 0th-order term (α ₀ ) of the polynomial of the (k-1) order. While embedding, multiple solutions of the (k-1) -order polynomial are generated, and each solution is held separately. As a result, even if a part of the solutions is leaked, the secret information (α ₀ ) is not restored. That is, the secret sharing protocol has a characteristic of being highly resistant to leakage.

In addition, as shown in FIG. 3 (b), according to the secret sharing protocol, if the data user obtains k solutions out of a plurality of solutions from the data generator, the secret information (α ₀ ) Can be restored. This is because the (k-1) -order polynomial can be uniquely determined by using k solutions. That is, the secret sharing protocol also has a characteristic of being highly resistant to data loss.

The first embodiment focuses on the characteristic of being highly resistant to data loss, and applies a secret sharing protocol to time-series data.

(2) Application of Secret Sharing Protocol to Time Series Data In the imaging device 110 in the first embodiment, data loss in signature verification is performed by applying the secret sharing protocol to moving image data which is time series data. Achieves improved resistance to. A specific description will be given with reference to FIG. 3 (c).

First, the image pickup apparatus 110 acquires n unit data (n is an integer of 2 or more) from the moving image data which is time series data. Here, the "unit data" refers to data of a predetermined unit constituting moving image data. The predetermined unit of data is, for example, when the image pickup apparatus 110 executes processing in frame units, each frame becomes data in a predetermined unit. Further, for example, when the image pickup apparatus 110 executes processing in packet units, each packet becomes data in a predetermined unit. In the following, the i-th unit data among the n unit data will be referred to as " _Di ".

Subsequently, the image pickup apparatus 110 generates n solutions of the (k-1) -order polynomial based on the n unit data ( _Di ). At this time, random values are set in the parameters (α _k-1 , α _k-2 , ... α ₀ ) of k (k is an integer greater than or equal to 1 and less than n) of the (k-1) order polynomial. Use. In the present embodiment, a hash value is used when substituting n unit data (D _i ) into the variable x, and the n variables y calculated by substituting Hash (D _i ). Among the values, the i-th value is represented by the parameter information " _Wi ". W _i can be calculated based on the following equation.

この結果、撮像装置１１０では、ｎ個の単位データから、（ｋ−１）次の多項式（ｙ＝α_ｋ−１ｘ^ｋ−１＋α_ｋ−２ｘ^ｋ−２＋・・・α_１ｘ＋α_０）のｎ個の解（Ｄ_ｉ，Ｗ_ｉ）を算出することができる。撮像装置１１０では、算出したｎ個の解（Ｄ_ｉ，Ｗ_ｉ）を秘密分散データとして、サーバ装置１２０に送信する。つまり、秘密分散データは、単位データと、該単位データに対応付けられたパラメータ情報との組である。

As a result, in the image pickup apparatus 110, from the n unit data, the polynomial of the order (k-1) (y = α _k-1 x ^k-1 + α _k-2 x ^k-2 + ... α ₁ x + α ₀ ) N solutions (D _i , _Wi ) can be calculated. The image pickup apparatus 110 transmits the calculated n solutions ( _Di , _Wi ) as secretly distributed data to the server apparatus 120. That is, the secret sharing data is a set of unit data and parameter information associated with the unit data.

In the server device 120, even if a part of the secret distribution data ( _Di , _Wi ) is lost, if k secret distribution data are collected, the parameters (α _k-1 , α _k-2 , ... α ₀ ) can be calculated.

Here, it is assumed that k secretly distributed data have not been tampered with. In this case, the parameters (α _k-1 , α _k-2 , ... α ₀ ) calculated by the server device 120 based on the k secret distribution data are such that the image pickup device 110 generates n solutions. It should match the parameters of the polynomial of order (k-1) used in the case (α _k-1 , α _k-2 , ... α ₀ ). On the other hand, when k secretly distributed data are falsified, they do not match. In other words, signature verification can be performed by determining whether or not these match, and if they match (if the signature verification is successful), the authenticity of the secret distribution data (secret distribution data has been tampered with). No) can be guaranteed.

In the present embodiment, the server device 120 determines that the signature verification of the secret sharing data ( _Di , _Wi ) is successful when one of the parameters (α ₀ ) matches. That is, in the present embodiment, the parameter (α ₀ ) is the secret information (the secret information can be defined as the information that can be calculated by collecting k secret distribution data). In order to enable the server device 120 to determine the success or failure of the signature verification, the image pickup device 110 adds a signature to the secret information (α ₀ ) by using the Sign algorithm as shown in the following equation to add a signature value. (S) is calculated and transmitted to the server device 120.

なお、式２において、ｓｋ_ｃａｍとは、撮像装置１１０において生成される署名鍵を指す。

In Equation 2, sk _cam refers to the signature key generated by the image pickup apparatus 110.

The server device 120 that has received the signature value (S) calculates the secret information (α ₀ ) based on the verification key by using the Vrfy algorithm corresponding to the Sign algorithm. The determining, in the server apparatus 120, the secret information calculated from k pieces of secret shared data (alpha _0), whether the secret information (alpha ₀₎ and match calculated from the signature value (S). Then, if the secret information matches, the server device 120 determines that the signature verification has succeeded, and if the secret information does not match, the server device 120 determines that the signature verification has failed.

In the following description, information for associating the unit data ( _Di ) and the parameter information ( _Wi ) as the first set with each of the n secretly distributed data transmitted from the image pickup apparatus 110. Is added. Further, it is assumed that the signature value (S) transmitted from the image pickup apparatus 110 is added with information for associating with n secretly distributed data.

<3. Data recording system hardware configuration>
Next, the hardware configurations of the image pickup apparatus 110 and the server apparatus 120 that constitute the data recording system 100 will be described. FIG. 4 is a diagram showing a hardware configuration of an imaging device and a server device according to the first embodiment.

As shown in FIG. 4A, the image pickup apparatus 110 includes an image pickup sensor 401 and a CPU (Central Processing Unit) 402. Further, the image pickup apparatus 110 has a ROM (Read Only Memory) 403, a RAM (Random Access Memory) 404, and an I / F (Interface) 405. The hardware constituting the image pickup apparatus 110 is connected to each other via the bus 406.

The image pickup sensor 401 converts the received light into an electric signal to generate moving image data. The CPU 402 is a computer that executes various programs (for example, a secret sharing data generation program) stored in the ROM 403.

The ROM 403 stores various programs executed by the CPU 402, and stores other programs and data used when the CPU 402 executes various programs. The RAM 404 provides a work area for the CPU 402 to execute various programs.

The I / F 405 is connected to a network and transmits / receives data to / from the server device 120 via the network.

As shown in FIG. 4B, the server device 120 includes a CPU 411, a ROM 412, a RAM 413, a storage device 414, and an I / F 415. The hardware constituting the server device 120 is connected to each other via the bus 416.

Since the hardware configuration of the server device 120 is substantially the same as the hardware configuration of the imaging device 110, only the differences will be described here. The difference from the hardware configuration of the image pickup device 110 is that it does not have the image pickup sensor 401 and has a storage device 414.

The storage device 414 stores a data verification program as a program executed by the CPU 411. In the case of the server device 120, it is assumed that the data verification program is stored in the storage device 414, and the ROM 412 stores other programs used by the CPU 411 to execute the data verification program. The storage device 414 realizes the data storage unit 122.

<4. Functional configuration of imaging device>
Next, a detailed functional configuration of the secretly distributed data generation unit 111 realized by the image pickup apparatus 110 will be described. FIG. 5 is a diagram showing a functional configuration of the image pickup apparatus according to the first embodiment.

As shown in FIG. 5, the secret distribution data generation unit 111 includes a data input unit 501, a compression unit 502, a data buffer unit 503, a data counter unit 504, and a signature parameter generation unit 505. Further, the secret distribution data generation unit 111 includes a hash generation unit 506, a parameter information generation unit 507, a stream packet generation unit 508, a signature unit 509, and a data transmission unit 510.

The data input unit 501 acquires the moving image data generated by the image pickup sensor 401. The compression unit 502 compresses the acquired moving image data and generates unit data. In the compression unit 502, MPEG or H.I. The moving image data is compressed by an arbitrary compression format such as 264 to generate unit data.

The data buffer unit 503 temporarily stores the unit data generated by the compression unit 502. The data counter unit 504 counts the number of unit data stored in the data buffer unit 503, and when the predetermined number (n) is reached, notifies the signature parameter generation unit 505 and the signature unit 509.

The signature parameter generator 505 has a random number generator, and when notified by the data counter unit 504 that a predetermined number (n) has been counted, k random number values generated by the random number generator are used as parameters. It is acquired as (α _k-1 , α _k-2 , ... α ₀ ). Further, the signature parameter generation unit 505 notifies the parameter information generation unit 507 of the acquired parameters (α _k-1 , α _k-2 , ... α ₀ ). Further, the signature parameter generation unit 505 notifies the signature unit 509 of the parameter (α ₀ ) as confidential information.

The hash generation unit 506 sequentially acquires the unit data (D _i ) from the unit data stored in the data buffer unit 503, and calculates the hash value (Hash (D _i )). The hash generation unit 506 calculates the hash value of the unit data ( _Di ) in order to reduce the processing load on the image pickup apparatus 110.

Parameter information generation unit 507 is an example of a calculation unit, a hash value calculated at the hash generator 506 and _{(Hash (D} i)), the parameters obtained in the signature parameter generation unit 505 (α _k-1, α _k-2 , ... α ₀ ) and are acquired. Further, the parameter information generation unit 507 calculates the parameter information ( _Wi ) using the equation 1 based on the acquired hash value and the parameter.

Stream packet generating portion 508 is an example of an output unit, by associating unit data and (D _i) and a parameter information (W _i), acquires secret sharing data. The stream packet generation unit 508 packetizes the acquired secret distribution data ( _Di , _Wi ) and outputs the packet. The packet format for packetizing secretly distributed data is determined by the transmission format, and when the transmission format is the network interface format, the packet format is the RTSP format or the UDP format. When the transmission format is the USB interface format, the packet format is the isochronous format.

The signature unit 509 is an example of the first signature means, and when the data counter unit 504 notifies that a predetermined number (n) has been counted, the secret information (α) output from the signature parameter generation unit 505. _The signature value (S) is calculated using ₀ ). In the present embodiment, the signature value (S) is calculated using the Sign algorithm, but the signature algorithm used for calculating the signature value (S) is not limited to the Sign algorithm. For example, the RSA algorithm, the RSASSA-PSS algorithm may be used, or the ElGamal algorithm may be used.

The data transmission unit 510 is an example of the first transmission means, and is the secret distribution data ( _Di , _Wi ) packetized by the stream packet generation unit 508 and the signature value calculated by the signature parameter generation unit 505 ( _Di , _Wi ). S) and is transmitted. In the data transmission unit 510, packetized secret distributed data ( _Di , _Wi ) is streamed and transmitted in a connectionless manner. Further, the signature value (S) is transmitted by the connection method.

FIG. 6 is a diagram schematically showing the operation of each unit (data buffer unit 503, hash generation unit 506, parameter information generation unit 507, signature unit 509) of the image pickup apparatus according to the first embodiment. In the example of FIG. 6, the predetermined number n is set to "10".

As shown in FIG. 6, when the hash generation unit 506 acquires the unit data (D ₁ ) accumulated in the data buffer unit 503, the hash generation unit 506 calculates the hash value (Hash (D ₁ )).

Further, the parameter information generation unit 507 includes a hash value (Hash (D ₁ )) calculated by the hash generation unit 506 and parameters (α ₉ , α ₈ , ... α ₀ ) output from the signature parameter generation unit 505. ) And get. Further, the parameter information generation unit 507 calculates and outputs the parameter information (W ₁ ) based on the hash value (Hash (D ₁ )) and the parameters (α ₉ , α ₈ , ... α ₀ ).

Similarly, the other unit data (D ₂ , D ₃ , ... D ₁₀ ) stored in the data buffer unit 503 is also processed, and the parameter information (W) is output from the parameter information generation unit 507. ₂ , W ₃ , ... W ₁₀ ) is output.

The unit data (D ₁ , D ₂ , ... D ₁₀ ) stored in the data buffer unit 503 and the parameter information (W ₁ , W ₂ , ... W ₁₀ ) output from the parameter information generation unit 507. Is associated with the stream packet generation unit 508. As a result, the stream packet generation unit 508 acquires secretly distributed data ((D ₁ , W ₁ ), (D ₂ , W ₂ ), ... (D ₁₀ , W ₁₀ )).

On the other hand, the signature unit 509 calculates the signature value (S) using the secret information (α ₀ ) output from the signature parameter generation unit 505.

By operating each part of the image pickup apparatus 110 in this way, it is possible to output the secret distribution data and the signature value based on the generated moving image data.

<5. Processing by the secret sharing data generator>
Next, the flow of the secret distribution data generation process by the secret distribution data generation unit 111 will be described. FIG. 7 is a flowchart showing the flow of the secret sharing data generation process. When the image pickup sensor 401 starts to generate moving image data, the secret distribution data generation unit 111 executes the flowchart shown in FIG. 7.

In step S701, the data input unit 501 acquires the moving image data generated by the image sensor 401. Further, the compression unit 502 compresses the acquired moving image data to generate unit data, and stores the acquired moving image data in the data buffer unit 503.

In step S702, the hash generation unit 506 acquires the unit data (D _i ) from the data buffer unit 503 and calculates the hash value (Hash (D _i )).

In step S703, the data counter unit 504 determines whether or not a predetermined number (n) of unit data has been accumulated in the data buffer unit 503. If the unit data of the predetermined number (n) is not accumulated in step S703, it is determined that the hash generation unit 506 has not calculated the hash value for the unit data of the predetermined number (n), and the process returns to step S701. .. On the other hand, when a predetermined number (n) of unit data is accumulated in step S703, it is determined that the hash generation unit 506 has calculated the hash value for the predetermined number (n) of unit data, and the process proceeds to step S704.

In step S704, the signature parameter generation unit 505 acquires _k random number values generated by the random number generator as parameters (α _k-1 , α _k-2 , ... α ₀ ).

In step S705, the parameter information generation unit 507 includes a predetermined number (n) of hash values (Hash (D _i )) and k parameters (α _k-1 , α _k-2 , ... α ₀ ). To get. Further, the parameter information generation unit 507 calculates n parameter information ( _Wi ) by using the acquired hash values of a predetermined number (n) and k parameters.

In step S706, the signature unit 509 acquires the parameter (α ₀ ) acquired by the signature parameter generation unit 505 as secret information, and adds a signature to the acquired secret information (α ₀ ). As a result, the signature unit 509 calculates and outputs the signature value (S) based on the acquired secret information (α ₀ ).

In step S707, the stream packet generating unit 508, by associating the unit data stored in the data buffer section 503 _{(D i)} and the parameter information output from the parameter information generating unit 507 _{(W i),} a secret sharing data To get. In addition, the stream packet generation unit 508 packetizes the acquired secret distribution data and outputs it. Further, the data transmission unit 510 streams the secret sharing data output from the parameter information generation unit 507 to the server device 120 via the network.

In step S708, the data transmission unit 510 transmits the signature value (S) output from the signature unit 509 to the server device 120 via the network.

In step S709, the data input unit 501 determines whether or not to end the secret sharing data generation process. If the input of the moving image data generated by the image pickup sensor 401 is continued, the process returns to step S701 without ending the secret distribution data generation process. On the other hand, when it is determined that the input of the moving image data has stopped, the secret distribution data generation process is terminated.

<6. Functional configuration of server device>
Next, the detailed functional configuration of the data verification unit 121 realized by the server device 120 will be described. FIG. 8 is a diagram showing a functional configuration of the server device.

As shown in FIG. 8, the data verification unit 121 includes a data reception unit 801, a storage processing unit 802, a signature value calculation unit 803, and a signature value verification unit 804.

Data receiving section 801 is an example of a receiving means, transmitted from the imaging device 110, a set of a secret distributed data (unit data (D _i), and the parameter information associated with the unit data (W _i) ) And the signature value (S).

The storage processing unit 802 stores the secret distribution data received by the data reception unit 801 and the signature value in the data storage unit 122.

The signature value calculation unit 803 is an example of the first falsification determination means. The signature value calculation unit 803 determines whether or not k or more secret distribution data are stored in the data storage unit 122 as the success or failure of the signature verification, and if it is determined that the number is less than k, the signature verification fails. It is determined that it has been done.

Further, when the signature value calculation unit 803 determines that k or more secret distribution data are stored, the signature value calculation unit 803 reads out k secret distribution data from the data storage unit 122. The signature value calculation unit 803 calculates the secret information (α ₀ ) using the following equation based on the k secret distribution data read out.

署名値検証部８０４は、データ格納部１２２に格納された署名値（Ｓ）を読み出し、ｖｒｆｙアルゴリズムを用いて、検証鍵ｖｋ_ｃａｍに基づき秘密情報（α_０）を算出する。

The signature value verification unit 804 reads the signature value (S) stored in the data storage unit 122, and calculates the secret information (α ₀ ) based on the verification key vk _cam using the vrfy algorithm.

なお、署名値検証部８０４は、第２の改竄判定手段の一例である。署名値検証部８０４は、署名検証の成否として、署名値演算部８０３において算出された秘密情報（α_０）と、署名値（Ｓ）に基づいてｖｒｆｙアルゴリズムを用いて算出した秘密情報（α_０）とを比較する。比較の結果、両者が一致していれば、署名値検証部８０４では、署名検証に成功した（秘密分散データが改竄されていない）と判定する。一方、両者が一致していなければ、署名値検証部８０４では、署名検証に失敗した（秘密分散データが改竄されている）と判定する。

The signature value verification unit 804 is an example of the second falsification determination means. Signature value verification unit 804, a success of the signature verification, the secret information calculated in the signature value calculating section 803 and the (alpha _0), the secret information calculated using vrfy algorithm based on the signature value (S) (α ₀ ) And compare. As a result of the comparison, if the two match, the signature value verification unit 804 determines that the signature verification is successful (the secret distribution data has not been tampered with). On the other hand, if the two do not match, the signature value verification unit 804 determines that the signature verification has failed (the secret distribution data has been tampered with).

The signature verification determination results of the signature value calculation unit 803 and the signature value verification unit 804 may be stored in, for example, the data storage unit 122. As a result, the server device 120 can stream-transmit only the unit data included in the secret sharing data determined to have succeeded in the signature verification to the external terminal. As a result, an external terminal (for example, an information terminal connected via a network) can reproduce only the moving image data whose authenticity is guaranteed.

<7. Processing by the data verification department>
Next, the flow of the data verification process by the data verification unit 121 will be described. FIG. 9 is a flowchart showing the flow of data verification processing. When the server device 120 is communicably connected to the image pickup device 110, the flowchart shown in FIG. 9 is executed.

In step S901, the data receiving unit 801 receives the secret distribution data and the signature value transmitted from the image pickup apparatus 110. Further, the storage processing unit 802 stores the secret distribution data received by the data reception unit 801 and the signature value in the data storage unit 122.

In step S902, the data receiving unit 801 determines whether or not the predetermined time has elapsed. If it is determined in step S902 that the predetermined time has not elapsed, the process waits until the predetermined time elapses.

On the other hand, if it is determined in step S902 that the predetermined time has elapsed, the process proceeds to step S903. In step S903, the signature value calculation unit 803 determines whether or not k or more secret sharing data are stored in the data storage unit 122.

If it is determined in step S903 that k or more secret sharing data are not stored, the process proceeds to step S907, and the signature value calculation unit 803 determines that the signature verification has failed.

On the other hand, if it is determined in step S903 that k or more secret sharing data are stored, the process proceeds to step S904. In step S904, the signature value calculation unit 803 reads out k secret distribution data from the data storage unit 122, and calculates the secret information (α ₀ ) using the equation 3.

In step S905, the signature value verification unit 804 reads the signature value (S) stored in the data storage unit 122, and uses the vrfy algorithm to calculate the secret information (α ₀ ) based on the verification key vk _cam .

In step S906, the signature value verification unit 804, a secret information calculated in the signature value calculating section 803 (alpha _0), the signature value and the secret information calculated using vrfy algorithm based on (S) (α ₀₎ To compare. As a result of the comparison, if they do not match, the process proceeds to step S907, and it is determined that the signature verification has failed (the secret sharing data has been tampered with).

On the other hand, as a result of comparison in step S906, if they match, the process proceeds to step S908, and it is determined that the signature verification is successful (the secret sharing data has not been tampered with).

In step S909, the data receiving unit 801 determines whether or not the communication with the image pickup apparatus 110 is continuing, and if it is determined that the communication is continuing, the process returns to step S901. On the other hand, when it is determined that the communication is disconnected, the signature value calculation unit 803 or the signature value verification unit 804 signs the unprocessed secret distribution data among the secret distribution data already stored in the data storage unit 122. After performing verification, the data verification process ends.

<8. Application example>
Next, an application example of the data recording system 100 will be described. FIG. 10 is a diagram showing an application example of a data recording system. The example of FIG. 10 shows a state in which the imaging device 110 according to the first embodiment is installed in an important facility such as a nuclear power plant, and the server device 120 is installed in a plurality of companies (Companies A to C). There is.

In the case of an important facility such as a nuclear power plant, since it operates for 24 hours, the imaging device installed in the facility needs to continuously transmit moving image data whose authenticity is guaranteed for 24 hours.

On the other hand, in the case of the image pickup apparatus 110 in the first embodiment, since the processing load in the image pickup apparatus 110 is low, it is possible to meet the above needs. This is because, in the case of the image pickup apparatus 110 according to the first embodiment, the signature is not added to the unit data, but the signature is added to the secret information (α ₀ ), so that the processing load required for adding the signature is low. Further, in the case of the image pickup apparatus 110 in the first embodiment, since the unit data is hashed to generate the parameter information, the processing load required for processing the unit data is also low.

As shown in FIG. 10, by transmitting the secret sharing data and the signature value, even if a data loss occurs, each company can perform signature verification and guarantee the authenticity of the moving image data. Can be done. In addition, since the broadcast is transmitted to a plurality of companies, it is possible to avoid a situation in which a specific company hides moving image data whose authenticity is guaranteed.

<9. Summary>
As is clear from the above description, in the data recording system according to the present embodiment,
-The imaging device sequentially acquires n unit data (D _i ) from the generated moving image data, and based on the acquired unit data ( _Di ), k random values (1 ≦ k <n). (K-1) The parameter information ( _Wi ) that satisfies the following polynomial is calculated.
-The image pickup apparatus transmits n secretly distributed data in which the acquired unit data ( _Di ) and the parameter information ( _Wi ) are associated with each other to the server apparatus.
-The imaging device calculates the signature value (S) by adding a signature to the secret information that can be calculated by collecting k pieces of secret distribution data, and transmits the calculated signature value to the server device.

As a result, in the server device, if k of the n secret sharing data transmitted by the imaging device are received, the secret information can be calculated based on the k secret sharing data. ((Nk) data loss is allowed). Then, by comparing with the secret information calculated from the signature value transmitted by the image pickup apparatus, the signature can be verified and the authenticity of the secret distributed data can be guaranteed. That is, in the server device, even if a part of the secretly distributed data transmitted by the imaging device is lost, the signature verification can be performed and the authenticity of the secretly distributed data can be guaranteed.

As a result, according to the first embodiment, resistance to data loss in signature verification can be improved.

[Second Embodiment]
In the first embodiment, each unit of the secret sharing data generation unit 111 has been described as performing a predetermined operation. However, each unit of the secret sharing data generation unit 111 may be configured to change its operation according to a condition input from the outside. Hereinafter, the second embodiment will be described focusing on the differences from the first embodiment.

FIG. 11 is a diagram showing a functional configuration of the image pickup apparatus according to the second embodiment. Of the components of the functional configuration of the imaging device 110 shown in FIG. 11, the same components as those of the functional configuration of the imaging device 110 shown in FIG. 5 are designated by the same reference numerals and will be described here. Is omitted.

The difference from FIG. 5 is that the secret distribution data generation unit 1100 has a setting parameter input unit 1101 and a setting parameter storage unit 1102.

The setting parameter input unit 1101 is an example of the setting means, and receives the input of the setting parameter. The setting parameter defines the conditions under which each unit of the secret distribution data generation unit 1100 operates. Each unit of the compression unit 502, the data buffer unit 503, the data counter unit 504, the hash generation unit 506, the stream packet generation unit 508, and the signature unit 509 operates according to the setting parameters input by the setting parameter input unit 1101.

The setting parameter storage unit 1102 holds the setting parameter for which the setting parameter input unit 1101 has received the input as the setting parameter information.

FIG. 12 is a diagram showing an example of setting parameter information held in the setting parameter storage unit. As shown in FIG. 12, the setting parameter information 1200 includes "setting parameter type" and "setting content" as information items.

The type of setting parameter is stored in "setting parameter type". In the case of setting parameter information 1200, "buffering information", "stream packet generation information", "compression format information", "hash information", "signature information", and "threshold information" are held in the "setting parameter type". Has been done.

The contents of the setting parameters corresponding to the types of the setting parameters are held in the "setting contents". In the case of the setting parameter information 1200, "information about the buffer unit" (packet size, number of frames, etc.) is held corresponding to the "buffering information".

Further, in the case of the setting parameter information 1200, "information about the protocol" (RPP (Real-time Transport Protocol), UDP (User Datagram Protocol), etc.) is held corresponding to the "stream packet generation information". Further, in the case of the setting parameter information 1200, "information on the compression format" (H.264, MPEG (Moving Picture Experts Group), etc.) is held corresponding to the "compression format information". Further, in the case of the setting parameter information 1200, "information about the hash algorithm" (SHA (Secure Hash Algorithm) 1, SHA256, etc.) is held corresponding to the "hash information".

Further, in the case of the setting parameter information 1200, "information about the signature algorithm" (RSA (Rivest Shamir Adleman) algorithm, ElGamal algorithm, etc.) is held corresponding to the "signature information". Further, in the case of the setting parameter information 1200, "threshold information" (n, k, etc.) is held corresponding to the "threshold information".

Each unit of the secret sharing data generation unit 1100 identifies the corresponding "setting parameter type", reads out the "setting content" corresponding to the identified "setting parameter type", and performs an operation according to the "setting content". Do.

As described above, according to the data recording system in the second embodiment, each unit of the secret distribution data generation unit 1100 can be operated based on the setting parameters input from the outside.

[Third Embodiment]
In the first and second embodiments, the image pickup apparatus 110 is configured to packetize secretly distributed data ( _Di , _Wi ) and stream them to an external server apparatus 120 via a network. However, the secret distributed data does not necessarily have to be streamed to the external server device 120 via the network, and an auxiliary storage device may be provided inside the image pickup device 110 and stored in the auxiliary storage device. Hereinafter, the third embodiment will be described focusing on the differences from the first embodiment.

<1. Hardware configuration of image pickup device>
FIG. 13 is a diagram showing a hardware configuration of the image pickup apparatus according to the third embodiment. The difference from the hardware configuration of the image pickup device 110 shown in FIG. 4A is that the image pickup device 1300 of FIG. 13 has an auxiliary storage device 1301. The auxiliary storage device 1301 is an example of the storage means, and is assumed to have a capacity for storing secretly distributed data and signature values for a predetermined period. Further, the data stored in the auxiliary storage device 1301 can be read out from the outside of the image pickup device 1300 via the I / F 405. The auxiliary storage device 1301 may be a removable recording medium such as an SD (Secure Digital) card.

<2. Functional configuration of imaging device>
FIG. 14 is a diagram showing a functional configuration of the image pickup apparatus according to the third embodiment. The difference from the functional configuration shown in FIG. 5 is that the secretly distributed data generation unit 1400 of FIG. 14 has a data coupling unit 1401 instead of the stream packet generation unit 508 and a storage control unit 1402. Is.

Data coupling unit 1401 is an example of an output means, the secret shared data _{(D i, W} i) by associating unit data and _{(D i)} and a parameter information _{(W i)} acquires, to the storage control unit 1402 Output. The storage control unit 1402 stores the secret distribution data ( _Di , _Wi ) output from the data combination unit 1401 and the signature value (S) output from the signature unit 509 in the auxiliary storage device 1301. Further, when the storage control unit 1402 receives a read request from the outside of the image pickup device 1300 via the data transmission unit 510, the storage control unit 1402 and the secret distributed data ( _Di , _Wi ) stored in the auxiliary storage device 1301 Read the signature value (S). Further, the data transmission unit 510 outputs the secretly distributed data ( _Di , _Wi ) read by the storage control unit 1402 and the signature value (S) to the outside via the data transmission unit 510.

<3. Application example>
FIG. 15 is a diagram showing an application example of the imaging device according to the third embodiment. The example of FIG. 15 shows a case where the image pickup apparatus 1300 is installed in the vehicle 1500 as a drive recorder. In FIG. 15, the image pickup apparatus 1300 records the generated secret distribution data and the signature value in the auxiliary storage device 1301 inside the image pickup apparatus 1300. Thereby, for example, when an accident or the like occurs in the vehicle 1500, the secret sharing data and the signature value at the time of the accident or the like can be taken out, and the signature verification can be performed on the secret sharing data. Further, even if the secret distributed data taken out at this time has a data loss, the authenticity can be guaranteed.

In the third embodiment, the auxiliary storage device 1301 is provided inside the image pickup device 110. However, the image pickup device 110 is provided with an external auxiliary storage device, and the secret distributed data ( _Di , _Wi ) is provided. May be configured to be stored in the auxiliary storage device.

[Fourth Embodiment]
In the first to third embodiments, the secret distribution data generating unit, for one unit data (D _i), and configured to associate the one parameter information (W _i). However, the unit data ( _Di ) also includes unit data of high importance, and it is desirable to further improve the resistance to data loss for such unit data of high importance. Therefore, in the fourth embodiment, according to the importance of the unit data (D _i), change the number of parameter information (W _i) to be associated, in the high unit data importance (D _i), more by associating the parameter information (W _i), to improve the resistance to data loss. Hereinafter, the fourth embodiment will be described focusing on the differences from the first embodiment.

<1. Functional configuration of imaging device>
FIG. 16 is a diagram showing a functional configuration of the image pickup apparatus according to the fourth embodiment. Of the components of the functional configuration of the imaging device 110 shown in FIG. 16, the same components as those of the functional configuration of the imaging device 110 shown in FIG. 5 are designated by the same reference numerals and will be described here. Is omitted.

The difference from FIG. 5 is that in the case of the secret distribution data generation unit 1600 of FIG. 16, the importance determination unit 1601 is provided, and the functions of the hash generation unit 1602 and the parameter information generation unit 1603 are the hash generation unit 506 of FIG. And the function of the parameter information generation unit 507 is different.

The importance determination unit 1601 is an example of the determination means, and determines the importance of the unit data ( _Di ). In this embodiment, the importance of the unit data (D _i ) is expressed as " _pi ". The importance determination unit 1601 sequentially acquires unit data (D _i ) from the unit data accumulated in the data buffer unit 503, and notifies the hash generation unit 1602 together with the determined importance ( _pi ).

The hash generation unit 1602 calculates a hash value of the unit data ( _Di ) notified by the importance determination unit 1601 based on the following equation.

ただし、ｊ＝１〜ｐ_ｉ
ハッシュ生成部１６０２では、生成したハッシュ値（Ｈａｓｈ（Ｄ_ｉｊ））をパラメータ情報生成部１６０３に通知する。

However, j = 1~p _i
The hash generation unit 1602 notifies the parameter information generation unit 1603 of the generated hash value (Hash ( _Dij )).

The parameter information generation unit 1603 includes the hash value (Hash ( _Dij )) calculated by the hash generation unit 1602 and the parameters (α _k-1 , α _k-2 , .....) acquired by the signature parameter generation unit 505. α ₀ ) and is acquired. Further, the parameter information generation unit 1603 calculates the parameter information ( _{Wi_j} ) based on the acquired hash value and the parameter by using the following equation.

図１７は、第４の実施形態における撮像装置の各部（データバッファ部５０３、重要度決定部１６０１、ハッシュ生成部１６０２、パラメータ情報生成部１６０３、署名部５０９）の動作を模式的に示した図である。図１７の例では、所定数ｎを"１０"としている。

FIG. 17 is a diagram schematically showing the operation of each unit (data buffer unit 503, importance determination unit 1601, hash generation unit 1602, parameter information generation unit 1603, signature unit 509) of the imaging apparatus according to the fourth embodiment. Is. In the example of FIG. 17, the predetermined number n is set to "10".

As shown in FIG. 17, when the importance determination unit 1601 acquires the unit data (D ₁ ) accumulated in the data buffer unit 503, the importance determination unit 1601 determines the importance (p ₁ ) of the unit data (D ₁ ). ) Is determined (here, it is assumed that p ₁ = 3 is determined).

When the hash generation unit 1602 acquires the unit data (D ₁ ) and the importance (p ₁ ) from the importance determination unit 1601, the hash value (Hash (D _ij )) is calculated. When p ₁ = 3, the hash generation unit 1602 calculates Hash (D ₁ ) ¹ , Hash (D ₁ ) ² , and Hash (D ₁ ) ³ as hash values.

The parameter information generation unit 1603 includes hash values (Hash (D ₁ ) ¹ , Hash (D ₁ ) ² , Hash (D ₁ ) ³ ) calculated by the hash generation unit 1602, and parameters (α ₉ , α ₈ , ...・ ・ Calculate parameter information based on α ₀ ).

Specifically, the parameter information generating unit 1603, as the parameter information, _{W 1_1, W 1_2,} to calculate the _{W 1_3.}

Similarly, the other unit data (D ₂ , D ₃ , ... D ₁₀ ) stored in the data buffer unit 503 is also processed, and the parameter information (W) is output from the parameter information generation unit 1603. _{2_1, W 2_2, ··· W 10_1} , ··· W 10_5) is output.

The unit data (D ₁ , D ₂ , ... D ₁₀ ) stored in the data buffer unit 503 and the parameter information (W _{2_1} , W _{2_2} , ... W _{10_5} ) output from the parameter information generation unit 507. Is associated with the stream packet generation unit 508. Thus, the stream packet generating unit 508, the secret sharing data to obtain the _{((D 1, W 1_1)} , (D 1, W 1_2), ··· (D 10, W 10_5)).

As described above, according to the present embodiment, the higher the importance of the unit data ( _Di ), the more secretly distributed data is generated. As a result, the more important the unit data, the better the resistance to data loss.

<2. Processing by the secret sharing data generator>
Next, the flow of the secret distribution data generation process by the secret distribution data generation unit 1600 will be described. FIG. 18 is a flowchart showing the flow of the secret sharing data generation process. Here, the differences from the secret sharing data generation processing shown in FIG. 7 will be mainly described. The difference from the secret distribution data generation process shown in FIG. 7 is steps S1801 to S1804.

In step S1801, the importance determining unit 1601 determines the importance of the unit data _{(D i)} to _{(p i).} In step S1802, the hash generation unit 1602 calculates a number of hash values (Hash (D _ij )) according to the importance.

In step S1803, the parameter information generation unit 1603 calculates a number of parameter information ( _{Wi_j} ) according to the importance. In step S1804, the stream packet generating unit 508, by associating the unit data stored in the data buffer section 503 _{(D i)} and the parameter information output from the parameter information generating section _{1603 (W} i_j), secret sharing data To get. In addition, the stream packet generation unit 508 packetizes the acquired secret distribution data and outputs it. Further, the data transmission unit 510 streams the secretly distributed data output from the stream packet generation unit 508 to the server device 120 via the network.

<3. Processing by the data verification department>
Next, the flow of the data verification process by the data verification unit 121 of the server device 120 in this embodiment will be described. FIG. 19 is a flowchart showing the flow of data verification processing. Here, the differences from the data verification process shown in FIG. 9 will be mainly described. The difference from the data verification process shown in FIG. 9 is steps S1901 and S1902.

In step S1901, the signature value calculating section 803 determines the number of unit data _{(D i)} to the associated parameter information _(W i_j) is whether the data storage unit 122 is more than a predetermined number.

If it is determined in step S1901 that the number is less than the predetermined number, the process proceeds to step S907, and it is determined that the signature verification has failed.

On the other hand, if it is determined in step S1901 that there are a predetermined number or more, the process proceeds to step S903.

Further, in step S1902, the signature value calculation unit 803 reads out k secret distribution data from the data storage unit 122, and calculates the secret information (α ₀ ) using the following equation.

このように、本実施形態におけるサーバ装置１２０では、秘密分散データの数に加え、それぞれの単位データ（Ｄ_ｉ）に対応付けられたパラメータ情報（Ｗ_{ｉ_ｊ}）の数も、署名検証の成否の判定に用いる。

Thus, in the server apparatus 120 in the present embodiment, in addition to the number of secret sharing data, the number of each of the unit data parameter information associated with the _{(D i)} (W _{i_j)} also determines the success or failure of signature verification Used for.

<4. Application example>
Next, an application example of the data recording system 100 in the fourth embodiment will be described. FIG. 20 is a diagram showing an application example of a data recording system. Of these, FIG. 20A shows a case where the image pickup apparatus 110 is used as a fixed point camera. When the image pickup device 110 is used as a fixed point camera, the importance determination unit 1601 determines the importance according to, for example, whether or not a specific object (person, vehicle, etc.) is detected from the unit data ( _Di ). .. Alternatively, the importance determination unit 1601 calculates the difference between the unit data ( _Di ) and the background image, and determines the importance according to the magnitude of the difference. Alternatively, the importance determination unit 1601 determines the importance according to whether or not a moving object is detected from the unit data ( _Di ).

FIG. 20B shows a case where a sound collecting microphone is added to the image pickup device 110 and used as a surveillance camera. When a sound collecting microphone is added to the image pickup device 110, the importance determination unit 1601 determines the importance according to, for example, the sound detected by the sound collecting microphone.

FIG. 20 (c) shows a case where an acceleration sensor is added to the image pickup device 110 and used as a vehicle drive recorder. When an acceleration sensor is added to the image pickup apparatus 110, the importance determination unit 1601 determines the importance depending on, for example, whether or not the acceleration sensor detects abnormal vibration or impact.

As described above, according to the data recording system according to the fourth embodiment, it is possible to further improve the resistance to data loss for highly important unit data.

[Fifth Embodiment]
In the fourth embodiment, the importance is determined for each unit data ( _Di ), and the higher the importance of the unit data, the better the resistance to data loss. On the other hand, in the fifth embodiment, the secret sharing data and the signature value are separately generated for the highly important unit data. This makes it possible to distinguish and receive the secret distribution data and the signature value generated based on the unit data of high importance. As a result, signature verification can be efficiently performed on the secret sharing data generated based on the unit data of high importance. Hereinafter, the fifth embodiment will be described focusing on the differences from the fourth embodiment.

21 and 22 are flowcharts showing the flow of secret sharing data generation processing. The flowchart of the secret distribution data generation process shown in FIG. 21 is the same as the flowchart shown in FIG. 18, except for step S2101. Therefore, the description of the processing other than step S2101 will be omitted.

In step S2101, the hash generating unit 1602, the importance determined in importance degree determination unit 1601 _{(p i)} is equal to or greater than a predetermined value. If it is determined in step S2101 that the value is less than the predetermined value, the process proceeds to step S1802.

On the other hand, if it is determined in step S2101 that the value is equal to or greater than a predetermined value, the process proceeds to FIG.

As shown in FIG. 22, when it is determined that the importance is equal to or higher than a predetermined value, the secret distribution data generation unit 1600 in the present embodiment executes two types of processing in parallel. The first process is the same process as when it is determined that the importance is less than a predetermined value. That is, in step S2201 of FIG. 22A, the hash generation unit 1602 calculates a number of hash values according to the importance, and then returns to step S703 of FIG.

The second process is a process of separately generating secret sharing data for the unit data stored in the data buffer unit 503 when it is determined that the importance is equal to or higher than a predetermined value.

Specifically, in step S2211, the hash generation unit 1602 calculates a number of hash values according to the importance of each unit data stored in the data buffer unit 503.

In step S2212, the signature parameter generation unit 505 uses k random number values (second random number values) generated by the random number generator as parameters (α _k-1 , α _k-2 , ... α ₀ ). get. In step S2213, the parameter information generation unit 1603 calculates a number of parameter information ( _{Wi_j} ) according to the importance of each hash value calculated in step S2211 (second parameter information).

In step S2214, the signature unit 509 acquires the parameter (α ₀ ) acquired by the signature parameter generation unit 505 in step S2212 as secret information, and adds a signature to the acquired secret information (α ₀ ). As a result, the signature unit 509 calculates and outputs the signature value (S) based on the acquired secret information (α ₀ ).

In step S2215, the stream packet generating unit 508, by associating the unit data stored in the data buffer section 503 _{(D i)} and the parameter information output from the parameter information generating section _{1603 (W} i_j), secret sharing data To get. In addition, the stream packet generation unit 508 packetizes the acquired secret distribution data and outputs it. Further, the data transmission unit 510 streams the secretly distributed data output from the stream packet generation unit 508 via the network.

In step S2216, the data transmission unit 510 transmits the signature value (S) output from the signature unit 509 via the network. After that, the process returns to step S709 of FIG.

The destination for transmitting the secret distribution data and the signature value in steps S2215 and S2216, respectively, is different from the destination for transmitting the secret distribution data and the signature value in steps S1804 and S708, respectively. .. Alternatively, even if the transmission destinations are the same, it is assumed that both are identified and received by the server device 120.

As described above, in the fifth embodiment, when it is determined that the importance of the unit data is equal to or higher than the predetermined value, the unit data stored in the data buffer unit 503 is separately secretly distributed data and the signature value. To generate.

This makes it possible to distinguish the secret distribution data and the signature value generated based on the highly important unit data from the secret distribution data and the signature value generated based on the other unit data. As a result, signature verification can be efficiently performed on the secretly distributed data generated based on the unit data of high importance.

[Sixth Embodiment]
In the fifth embodiment, when it is determined that the importance of the unit data is equal to or higher than a predetermined value, the secret distribution data and the signature value are separately generated for the unit data stored in the data buffer unit. And said. On the other hand, in the sixth embodiment, when it is determined that the importance of the unit data is equal to or higher than a predetermined value, the secret sharing data generated based on the unit data is streamed and transmitted a plurality of times. Thereby, according to the sixth embodiment, the possibility of data loss can be reduced for the secretly distributed data generated based on the unit data of high importance.

FIG. 23 is a flowchart showing the flow of the secret sharing data generation process. The difference from the flowchart of the secret sharing data generation process shown in FIG. 21 is steps S2301 to S2305.

In step S2101, the importance _{(p i)} is determined to be equal to or larger than a predetermined value, in the present embodiment, the process proceeds to step S2301. In step S2301, the stream packet generation unit 508 transmits the secret distribution data generated based on the unit data (D _i ) determined to have the importance ( _pi ) of a predetermined value or more a plurality of times (for example,). Set to (2 times).

In step S2302, the stream packet generating unit 508, by associating the unit data stored in the data buffer section 503 _{(D i)} and the parameter information output from the parameter information generating section _{1603 (W} i_j), secret sharing data To get. In addition, the stream packet generation unit 508 packetizes the acquired secret distribution data and outputs it.

In step S2303, the data transmission unit 510 determines whether or not the number of transmissions of the secret distribution data output from the stream packet generation unit 508 is set to a plurality of times. If it is determined in step S2303 that the settings are not set a plurality of times, the process proceeds to step S2304, and the secret sharing data is streamed to the server device 120 via the network. On the other hand, if it is determined in step S2303 that it is set a plurality of times, the process proceeds to step S2305.

In step S2305, the data transmission unit 510 streams the secret distributed data to the server device 120 a plurality of times via the network.

As described above, according to the sixth embodiment, when it is determined that the importance of the unit data is equal to or higher than a predetermined value, the secret sharing data generated based on the unit data is transmitted a plurality of times. Thereby, according to the sixth embodiment, the possibility of data loss can be reduced for the secretly distributed data generated based on the unit data of high importance.

[7th Embodiment]
In the sixth embodiment, the secret sharing data generated based on the unit data for which the importance of the unit data is determined to be equal to or higher than a predetermined value is streamed and transmitted a plurality of times. On the other hand, in the seventh embodiment, the secret sharing data generated based on the unit data for which the importance of the unit data is determined to be equal to or higher than a predetermined value is temporarily held. This is because, in the seventh embodiment, when there is a retransmission request from the destination server device 120 after the streaming transmission, the retransmission can be performed, and the possibility of data loss can be reduced. ..

24 and 25 are flowcharts showing the flow of secret sharing data generation processing. The differences from the flowchart of the secret distribution data generation process shown in FIG. 21 are steps S2401 to S2402 and steps S2501 to S2505.

In step S2101, the importance _{(p i)} is determined to be equal to or larger than a predetermined value, in the present embodiment, the process proceeds to step S2401. In step S2401, the stream packet generation unit 508 sets the secret distribution data generated based on the unit data ( _Di ) determined to have the importance ( _pi ) of a predetermined value or more as the storage target.

In step S2402, the stream packet generating unit 508, by associating the unit data stored in the data buffer section 503 _{(D i)} and the parameter information output from the parameter information generating section _{1603 (W} i_j), secret sharing data To get. In addition, the stream packet generation unit 508 packetizes the acquired secret distribution data and outputs it.

In step S2501 of FIG. 25, the data transmission unit 510 determines whether or not the secret sharing data output in step S2402 is set as a storage target. If it is determined in step S2501 that the storage target is not set, the process proceeds to step S2503. On the other hand, if it is determined in step S2501 that the storage target is set, the process proceeds to step S2502.

In step S2502, the data transmission unit 510 temporarily holds the secret distribution data output in step S2402 in the RAM 404. In this case, the RAM 404 functions as a holding means for temporarily holding the packetized secret distribution data.

In step S2503, the data transmission unit 510 streams the secretly distributed data output from the stream packet generation unit 508 to the server device 120 via the network.

In step S2504, the data transmission unit 510 determines whether or not a retransmission request has been received from the server device 120. If it is determined in step S2504 that the retransmission request has been received, the process proceeds to step S2505.

In step S2505, the data transmission unit 510 reads the secretly distributed data for which the retransmission request has been made from the RAM 404 and transmits the streaming again.

As described above, in the seventh embodiment, the secret distribution data generated based on the unit data for which the importance of the unit data is determined to be equal to or higher than the predetermined value is temporarily held. As a result, according to the seventh embodiment, the secretly distributed data can be retransmitted when the server device 120 requests retransmission. As a result, according to the seventh embodiment, it is possible to reduce the possibility of data loss with respect to the secretly distributed data generated based on the unit data of high importance.

[8th Embodiment]
In the first to seventh embodiments, the authenticity of the secret sharing data (the secret sharing data has not been tampered with) can be guaranteed even if data loss occurs by applying the secret sharing protocol. explained. However, in the case of the first to seventh embodiments, once the signature verification is successful in the server device 120, the (k-1) _-order polynomial (y = α _k− ) used for the signature verification is performed. ₁ x ^k-1 + α _k-2 x ^k-2 + ... α ₁ x + α ₀ ) will be revealed.

Therefore, the server device 120 can generate new secret sharing data (D _{n + 1} , W _{n + 1,} etc.) by using the found polynomial of the (k-1) order. This is because new secret distribution data satisfying the (k-1) next polynomial can be generated by calculating the variable y by putting an arbitrary value in the variable x of the (k-1) next polynomial. .. This means that the server device 120 can forge new secret shared data.

Therefore, in the following embodiments, a function for preventing forgery of secretly distributed data in the server device 120 will be described.

<1. Data recording system configuration>
First, the overall configuration of the data recording system according to the eighth embodiment will be described. FIG. 26 is a diagram showing an example of the system configuration of the data recording system according to the eighth embodiment.

The difference from the data recording system 100 shown in FIG. 1 is that in the case of the data recording system 2600 of FIG. 26, the secret distribution data generation unit 2610 adds the secret distribution data and the signature value (S), as well as the digest and the signature value. The point is to transmit the set (T) (second set).

"Digest" is a concatenation of hash values (Hash (D _i )) of unit data (D _i ) included in secret distribution data, and is expressed by the following equation.

また、署名値（Ｔ）は、下式に示すＳｉｇｎアルゴリズムを用いて、Ｄｉｇｅｓｔに署名を付加することで算出される値である。

The signature value (T) is a value calculated by adding a signature to the Digist using the Sign algorithm shown in the following equation.

更に、図２６において、図１に示したデータ記録システム１００との相違点は、データ検証部２６２０の機能が、データ検証部１２１の機能とは異なる点である。具体的には、データ検証部２６２０が、データ検証部１２１の機能に加え、署名値（Ｔ）を用いて、Ｄｉｇｅｓｔに含まれるハッシュ値（Ｈａｓｈ（Ｄ_ｉ））について署名検証を行う機能を有する点である。

Further, in FIG. 26, the difference from the data recording system 100 shown in FIG. 1 is that the function of the data verification unit 2620 is different from the function of the data verification unit 121. Specifically, the data verification unit 2620, in addition to the function of the data verifying unit 121, using a signature value (T), has a function of performing signature verification on the hash value contained in the Digest _{(Hash (D} i)) It is a point.

Before verifying the authenticity of the secret distribution data (that the secret distribution data has not been tampered with), the data verification unit 2620 first uses the signature value (T) to perform a hash value (Hash (D)) included in the Digist. Perform signature verification for _i )). Then, the data verification unit 2620, the signature successful hash value verification using (Hash _(D i)), authenticity (unit data _{(D i)} is forged of unit data included in the secret distribution data _{(D i)} (Not done) is verified. After that, the authenticity of the secret sharing data (the secret sharing data has not been tampered with) is verified.

In this way, the data verification unit 2620 verifies that the data is not forged and that the data has not been tampered with as the authenticity of the data.

<2. Functional configuration of imaging device>
FIG. 27 is a diagram showing a functional configuration of the image pickup apparatus according to the eighth embodiment. Of the components of the functional configuration of the imaging device 110 shown in FIG. 27, the same components as those of the functional configuration of the imaging device 110 shown in FIG. 5 are designated by the same reference numerals and will be described here. Is omitted.

The difference from FIG. 5, when the secret distribution data generating unit 2610 of FIG. 27, the hash generating unit 506 generates the Digest of the hash value _{(Hash (D} i)), notifies the data transmission unit 510 and the signature 2701 It is a point to do.

Further, the difference from FIG. 5 is that the secret distribution data generation unit 2610 of FIG. 27 has a signature unit 2701. Signature unit 2701 is an example of a second signature means, from the hash generator 506 receives the Digest hash value (Hash _(D i)), using the above equation (9), a signed Digest By adding it, the signature value (T) is generated. Further, the signature unit 2701 notifies the data transmission unit 510 of the generated signature value (T).

Further, the difference from FIG. 5 is that in the case of the secret distribution data generation unit 2610 of FIG. 27, the data transmission unit 510 functions as a second transmission means and signs the secret distribution data ( _Di , _Wi ). In addition to the value (S), the data and the signature value (T) are transmitted.

FIG. 28 is a diagram schematically showing the operation of each unit (data buffer unit 503, hash generation unit 506, parameter information generation unit 507, signature unit 509, signature unit 2701) of the image pickup apparatus according to the eighth embodiment. .. In the example of FIG. 28, the predetermined number n is set to "10".

As shown in FIG. 28, the hash generating unit 506 outputs the generated hash value by concatenating the _{(Hash (D} i)) to generate a Digest.

Signature unit 2701 acquires the Digest of generated hash value in the hash generator _{506 (Hash (D i))} , adds the signature using the Sign Algorithm, calculates the signature value (T).

<3. Processing by the secret sharing data generator>
Next, the flow of the secret distribution data generation process by the secret distribution data generation unit 2610 of the imaging device 110 will be described. FIG. 29 is a flowchart showing the flow of the secret sharing data generation process. Here, the differences from the secret sharing data generation processing shown in FIG. 7 will be mainly described. The difference from the secret distribution data generation process shown in FIG. 7 is steps S2901 and S2902.

In step S2901, the hash generating unit 506 generates the Digest of the hash value _{(Hash (D} i)), the signature unit 2701, based on the Digest, calculates the signature value (T).

In step S2902, the data transmission unit 510, and Digest of the notified hash value from the hash generator _{506 (Hash (D i))} , notified signature value from the signature unit 2701 and a (T), the server device 120 Send.

<4. Functional configuration of server device>
Next, the detailed functional configuration of the data verification unit 2620 realized by the server device 120 will be described. FIG. 30 is a diagram showing a functional configuration of the server device.

The difference from the functional configuration shown in FIG. 8 is that, in the case of FIG. 30, it has an authenticity signature value verification unit 3001 and a data authenticity verification unit 3002.

The authenticity signature value verification unit 3001 reads the signature and the signature value (T) transmitted from the secret distribution data generation unit 2610 and stored in the data storage unit 122. Further, the authenticity signature value verification unit 3001 calculates the _Digist based on the verification key vk _cam by using the vrfy algorithm shown in the following equation.

更に、真正性署名値検証部３００１は、データ格納部１２２より読み出されたＤｉｇｅｓｔと、上式（式１０）に示すｖｒｆｙアルゴリズムを用いて算出したＤｉｇｅｓｔとを比較する。比較の結果、両者が一致していれば、真正性署名値検証部３００１は、データ格納部１２２より読み出したＤｉｇｅｓｔについて、署名検証に成功した（Ｄｉｇｅｓｔに含まれるハッシュ値（Ｈａｓｈ（Ｄ_ｉ））が正しい）と判定する。一方、両者が一致していなければ、真正性署名値検証部３００１は、署名検証に失敗した（Ｄｉｇｅｓｔに含まれるハッシュ値（Ｈａｓｈ（Ｄ_ｉ）が正しくない）と判定する。

Further, the authenticity signature value verification unit 3001 compares the Digist read from the data storage unit 122 with the Digist calculated by using the vrfy algorithm shown in the above equation (Equation 10). As a result of the comparison, if the two match, the authenticity signature value verification unit 3001 succeeds in signature verification of the Digist read from the data storage unit 122 (hash value included in the Digist (Hash (D _i ))). Is correct). On the other hand, if the two do not match, the authenticity signature value verification unit 3001 determines that the signature verification has failed (the hash value (Hash (D _i )) included in the Digist is incorrect).

When the authenticity signature value verification unit 3001 determines that the signature verification is successful, the authenticity signature value verification unit 3001 notifies the data authenticity verification unit 3002 of the determination result.

The data authenticity verification unit 3002 is an example of a forgery determination means. When the data authenticity verification unit 3002 receives the determination result that the signature verification is successful from the authenticity signature value verification unit 3001, the data authenticity verification unit 3002 receives the unit data ( _Di ) included in the secret distribution data stored in the data storage unit 122. reading, and calculates a hash value _{(hash (D} i)).

Further, the data authenticity verification unit 3002 includes the calculated hash value (Hash (D _i )) and the hash value (Hash (D _i )) included in the Digist that succeeded in signature verification in the authenticity signature value verification unit 3001. To compare. Result of the comparison, the calculated hash value (Hash _(D i)) are all, if included in the Digest, data authenticity verifying unit 3002, the unit data included successful signature verification (the secret sharing data (D _It is determined that _i ) is not forged). On the other hand, the calculated hash value (Hash _(D i)), when there is a hash value that is not included in the Digest, the data authenticity verifying unit 3002 includes signature verification fails (the secret sharing data The unit data ( _Di ) is forged).

Thus, the data authenticity verifying unit 3002, guarantees the authenticity of the unit data included in the secret sharing data read from the data storage unit 122 (D _i) (the unit data (D _i) is not forged) can do.

<5. Data verification processing by the data verification department>
Next, the flow of the data verification process (counterfeiting, falsification) by the data verification unit 2620 of the server device 120 in the present embodiment will be described. FIG. 31 is a flowchart showing the flow of data verification processing (counterfeiting, falsification). Here, the differences from the data verification process shown in FIG. 9 will be mainly described. The difference from the data verification process shown in FIG. 9 is steps S3101 to S3105.

In step S3101, the data receiving unit 801 receives the Digist and the signature value (T) transmitted from the image pickup apparatus 110. Further, the storage processing unit 802 stores the Digist received by the data reception unit 801 and the signature value (T) in the data storage unit 122.

In step S3102, the authenticity signature value verification unit 3001 uses the signature value (T) stored in the data storage unit 122 to perform signature verification on the Digist stored in the data storage unit 122. Specifically, the authenticity signature value verification unit 3001 determines whether or not the Digist calculated by using the vrfy algorithm for the signature value (T) matches the Digist stored in the data storage unit 122. As a result, the authenticity signature value verification unit 3001 determines whether or not the Digist stored in the data storage unit 122 is correct.

As a result of the determination, if it is determined that the Digist stored in the data storage unit 122 is incorrect (No in step S3102), the process proceeds to step S907. In this case, the authenticity signature value verification unit 3001 determines that the signature verification has failed for the Digist read from the data storage unit 122.

On the other hand, if it is determined as a result of the determination that the Digist stored in the data storage unit 122 is correct (Yes in step S3102), the process proceeds to step S3103.

In step S3103, the data authenticity verification unit 3002 reads out the unit data (D _i ) included in the secret distribution data stored in the data storage unit 122, and calculates the hash value (Hash (D _i )).

In step S3104, the data authenticity verifying unit 3002, the calculated hash value _{(Hash (D} i)), the hash value included in the Digest successful signature verification in authenticity signature value verifying unit 3001 _{(Hash (D} i) ) And compare. Result of the comparison, in the calculated hash value _{(Hash (D} i)), if there is a hash value that is not included in the Digest (in the case of No in step S3104), the process proceeds to step S907. In this case, the data authenticity verifying unit 3002, the unit data included in the secret sharing data read from the data storage unit 122 (D _i), signature verification fails (unit data included in the secret distribution data (D _i) Is forged).

On the other hand, when the calculated hash value (Hash _(D i)) was all contained in the Digest is (in case of Yes in step S3104 is), the data authenticity verifying unit 3002, the process advances to step S903.

In step S3105, the data authenticity verifying unit 3002 determines that it has succeeded in signature verification (unit data included in the secret distribution data (D _i) is not forged).

If it is determined in step S3105 that the signature verification is successful, the process proceeds to step S903, and thereafter, signature verification is performed to see if the secret sharing data has been tampered with. If the signature verification is successful as a result of the signature verification, in step S908, it is determined that the secret sharing data has not been tampered with.

As is clear from the above description, in the data recording system according to the eighth embodiment,
-The imaging device transfers the Hash value Digist of the unit data ( _Di ) included in the secret distribution data and the signature value (T) calculated by adding a signature to the Digist using the Sign algorithm. Send to the device.
-The server device verifies the signature of the Digist using the signature value (T) received from the image pickup device 110.
-When the signature verification of the Digist is successful, the server device uses the Digist that has succeeded in the signature verification of the unit data ( _Di ) included in the secret sharing data received from the image pickup device 110 to determine the authenticity (unit data (unit data (unit data)). D _i) to verify that) that I have not been forged.

As a result, according to the data recording system according to the eighth embodiment, forgery of secretly distributed data can be prevented.

[9th Embodiment]
In the eighth embodiment, in order to prevent the forgery of the secretly distributed data, the image pickup apparatus 110 generates the Digist and the signature value (T) and transmits the signature value (T) to the server apparatus 120. On the other hand, in the ninth embodiment, an authenticity guarantee server is separately arranged, and the authenticity guarantee server generates a Digist and a signature value (T) and transmits them to the server device 120. Hereinafter, the ninth embodiment will be described.

<1. Data recording system configuration>
First, the overall configuration of the data recording system according to the ninth embodiment will be described. FIG. 32 is a diagram showing an example of the system configuration of the data recording system.

The difference from the data recording system 100 shown in FIG. 1 is that in the case of the data recording system 3200 of FIG. 32, the authenticity guarantee server 3210 is provided and communicates with the data generation device 110 and the server device 120 via the network. It is a point that is connected as possible. Further, in the case of the data recording system 3200 of FIG. 32, the secret sharing data generation unit 111 broadcasts the secret sharing data and the signature value (S) to the server device 120 and the authenticity guarantee server 3210. Further, the authenticity guarantee server 3210 transmits a set of the Digist and the signature value (T) (the second set) to the server device 120.

The authenticity guarantee server 3210 has the same hardware configuration as the server device 120 (see FIG. 4B). A data verification program and a signing program are installed on the authenticity guarantee server 3210, and when the program is executed, the authenticity guarantee server 3210 functions as a data verification unit 121 and a signature unit 3211.

Since the function of the data verification unit 121 is the same as the function of the data verification unit 121 of the server device 120 shown in FIG. 8, description thereof will be omitted here.

The signature unit 3211 is another example of the second signature means, and performs the signature process. Specifically, when the signature unit 3211 succeeds in verifying the authenticity of the secret distribution data (that the secret distribution data has not been tampered with) in the data verification process by the data verification unit 121, it is included in the secret distribution data. Calculate the hash value of the unit data ( _Di ).

Also, the signature 3211, by connecting the calculated hash value _{(Hash (D} i)), to generate a Digest. Further, the signature unit 3211 generates a signature value (T) by adding a signature to the generated Digist by using the Sign algorithm shown in the following equation.

更に、署名部３２１１は、第２の送信手段としても機能し、生成したＤｉｇｅｓｔと署名値（Ｔ）の組（第２の組）を、サーバ装置１２０に送信する。

Further, the signature unit 3211 also functions as a second transmission means, and transmits a set (second set) of the generated Digist and the signature value (T) to the server device 120.

In the above description, the secret distribution data generation unit 111 has been described as broadcasting the secret distribution data and the signature value (S), but only the secret distribution data may be broadcast. In this case, the authenticity assurance server 3210 does not perform the data verification process by the data verification unit 121, but only the signature process by the signature unit 3211.

<2. Signature processing by authenticity assurance server>
Next, the flow of signature processing by the authenticity guarantee server 3210 will be described. FIG. 33 is a flowchart showing the flow of the signature process. When the authenticity guarantee server 3210 is communicably connected to the image pickup apparatus 110 and the server apparatus 120, the flowchart shown in FIG. 33 is executed.

In step S3301, the data verification unit 121 receives the secret sharing data and the signature value (S) transmitted from the image pickup apparatus 110.

In step S3302, the data verification unit 121 performs data verification processing. Since the details of the data verification process have already been explained with reference to FIG. 9, the description thereof will be omitted here. Further, here, it is assumed that the authenticity of the secretly distributed data received in step S3301 has been successfully verified.

In step S3303, the signature unit 3211 calculates a hash value (Hash (D _i )) for the unit data (D _i ) included in the secret distribution data.

In step S3304, the signature unit 3211 concatenates the calculated hash value _{(Hash (D} i)), to generate a Digest.

In step S3305, the signature unit 3211 generates a signature value (T) by adding a signature to the generated Digist by using the Sign algorithm.

In step S3306, the signature unit 3211 transmits the generated set of the Digist and the signature value (T) to the server device 120.

As a result, in the data verification unit 2620 of the server device 120, the authenticity signature value verification unit 3001 can perform signature verification on the Digist using the signature value (T) received from the authenticity guarantee server 3210.

Further, when the signature verification of the Digist is successful, the data authenticity verification unit 3002 can function as a forgery determination means in the data verification unit 2620. Specifically, the data authenticity verification unit 3002 uses the Digist that has succeeded in signature verification for the unit data ( _Di ) included in the secret distribution data received from the image pickup apparatus 110, and uses the authenticity (unit data (D)). It can be verified that _i ) is not forged).

<3. Summary>
As is clear from the above description, in the data recording system according to the ninth embodiment,
-The authenticity guarantee server generates a Digest of the hash value of the unit data ( _Di ) included in the secret distribution data, and also generates a signature value (T) by adding a signature to the generated Digist.
-The authenticity guarantee server transmits the generated Digist and signature value (T) to the server device.

As a result, according to the data recording system in the ninth embodiment, forgery of secretly distributed data can be prevented as in the eighth embodiment. Further, according to the data recording system according to the ninth embodiment, the processing load of the image pickup apparatus 110 can be reduced as compared with the data recording system according to the eighth embodiment.

[10th Embodiment]
In the first 9 embodiment, arranged authenticity assurance server 3210, the unit data included in the secret distribution data (D _i), the server device 120, authenticity (unit data (D _i) has not been forged The configuration is such that it can be verified.

In contrast, in the tenth embodiment, the server device 120, both of the unit data (D _i) and the parameter information included in the secret distribution data (W _i), a configuration in which authenticity can be verified. Hereinafter, the tenth embodiment will be described focusing on the differences from the ninth embodiment.

<1. Data recording system configuration>
FIG. 34 is a diagram showing an example of the system configuration of the data recording system. The difference from the data recording system 3200 shown in FIG. 32 is the signature unit 3411 and the data verification unit 3420.

In the data recording system 3400, the signature unit 3411 also functions as a third signature means in addition to the second signature means.

Specifically, when functioning as the second signature means, the signature unit 3411 uses the hash value (Hash (D _i )) of the unit data (D _i ) included in the secret distribution data transmitted from the image pickup apparatus 110. calculate. Also, the signature 3411, by connecting the calculated hash value _{(Hash (D} i)), to generate a digest1, by the generated digest1 adding a signature to generate a signature value (T).

When functioning as a third signature means, the signature unit 3411 acquires the parameter information ( _Wi ) included in the secret distribution data transmitted from the image pickup apparatus 110, and concatenates the acquired parameter information ( _Wi ). By doing so, Digist2 is generated. Further, the signature unit 3411 generates a signature value (U) by adding a signature to the generated Digist2.

Further, the signature unit 3411 also functions as a third transmission means in addition to the second transmission means. Specifically, when functioning as the second transmission means, the signature unit 3411 transmits the second set (Digest 1 and signature value (T)) to the server device 120. Further, when functioning as a third transmission means, the signature unit 3411 transmits the third set (Digest 2 and signature value (U)) to the server device 120.

In the data recording system 3400, the data verification unit 3420, in addition to the unit data _{(D i)} included in the secret sharing data, authenticity of parameter information _{(W i)} (parameter information _{(W i)} is not forged It has a function to verify.

Specifically, the authenticity signature value verification unit 3001 of the data verification unit 3420 performs signature verification on Digist2 using the signature value (U) received from the authenticity guarantee server 3410.

Also, if successful signature verification for Digest2, the data verification unit 3420, the data authenticity verifying unit 3002, the parameter information included in the secret distribution data _{(W i),} authenticity using Digest2 successful signature verification To verify.

Thus, the data verifying unit 3420 may verify the authenticity of the parameter information included in the secret distribution data (W _i) (the parameter information (W _i) is not forged).

<2. Signature processing by the signature department>
Next, the flow of the signature process by the signature unit 3411 of the authenticity guarantee server 3410 will be described. FIG. 35 is a flowchart showing the flow of the signature process. The difference from the flowchart of FIG. 33 is steps S3501 to S3503.

In step S3501, the signature 3411 on the basis of the parameter information included in the secret distribution data _{(W i),} generates a Digest2.

In step S3502, the signature unit 3411 generates a signature value (U) by adding a signature to the generated Digist2.

In step S3503, the signature unit 3411 transmits the Desist 1 and the signature value (T) generated in steps S3304 and S3305, and the Digist 2 and the signature value (U) generated in steps S3502 and S3503 to the server device 120.

<3. Data verification processing by the data verification department (counterfeiting, falsification)>
Next, in the present embodiment, the flow of the data verification process (counterfeiting, falsification) by the data verification unit 3420 will be described. FIG. 36 is a flowchart showing the flow of data verification processing (counterfeiting, falsification). Here, the differences from the data verification process (counterfeiting, falsification) shown in FIG. 31 will be mainly described. The difference from the data verification process (counterfeiting, falsification) shown in FIG. 31 is step S3601 and steps S3602 to S3606.

In step S3601, the data receiving unit 801 receives the Digist 1, the signature value (T), the Digist 2, and the signature value (U) transmitted from the authenticity guarantee server 3210. Further, the storage processing unit 802 stores the Digist 1, the signature value (T), the signature 2, and the signature value (U) received by the data reception unit 801 in the data storage unit 122.

In step S3602, the authenticity signature value verification unit 3001 performs signature verification on the Digist 1 stored in the data storage unit 122 by using the signature value (T) stored in the data storage unit 122. Specifically, the authenticity signature value verification unit 3001 determines whether or not the Digist 1 calculated by using the vrfy algorithm for the signature value (T) matches the Digist 1 stored in the data storage unit 122. As a result, the authenticity signature value verification unit 3001 determines whether or not the Digist 1 stored in the data storage unit 122 is correct.

As a result of the determination, if it is determined that the Digist 1 stored in the data storage unit 122 is incorrect (No in step S3602), the process proceeds to step S907 in FIG. 37. In this case, the authenticity signature value verification unit 3001 determines that the signature verification of the Digist 1 read from the data storage unit 122 has failed.

On the other hand, if it is determined as a result of the determination that the Digist 1 stored in the data storage unit 122 is correct (Yes in step S3602), the process proceeds to step S3603.

In step S3603, the data authenticity verification unit 3002 reads out the unit data (D _i ) included in the secret distribution data stored in the data storage unit 122, and calculates the hash value (Hash (D _i )).

In step S3604, the data authenticity verifying unit 3002, the calculated hash value _{(Hash (D} i)) and the hash value included in Digest1 successful signature verification in authenticity signature value verifying unit 3001 _{(Hash (D} i) ) And compare. Result of the comparison, in the calculated hash value _{(Hash (D i)),} ( in the case of No in step S3604). If there is a hash value that is not included in digest1, the step S907 of FIG. 37 move on. In this case, the data authenticity verifying unit 3002, the unit data included in the secret sharing data read from the data storage unit 122 (D _i), signature verification fails (unit data included in the secret distribution data (D _i) Is forged).

On the other hand, when the calculated hash value (Hash _(D i)) is included all Digest1 is (in case of Yes in step S3604 is), the data authenticity verifying unit 3002 proceeds to step S3605.

In step S3605, the authenticity signature value verification unit 3001 uses the signature value (U) stored in the data storage unit 122 to perform signature verification on the Digist 2 stored in the data storage unit 122. Specifically, the authenticity signature value verification unit 3001 determines whether or not the Digist 2 calculated by using the vrfy algorithm for the signature value (U) matches the Digist 2 stored in the data storage unit 122. As a result, the authenticity signature value verification unit 3001 determines whether or not the Digist 2 stored in the data storage unit 122 is correct.

As a result of the determination, if it is determined that the Digist 2 stored in the data storage unit 122 is incorrect (No in step S3605), the process proceeds to step S907 in FIG. 37. In this case, the authenticity signature value verification unit 3001 determines that the signature verification has failed for the Digist 2 read from the data storage unit 122.

On the other hand, if it is determined as a result of the determination that the Digist 2 stored in the data storage unit 122 is correct (Yes in step S3605), the process proceeds to step S3606.

In step S3606, the data authenticity verifying unit 3002 reads the unit data _{(W i)} included in the secret sharing data stored in the data storage unit 122, and Digest2 successful signature verification in authenticity signature value verifying unit 3001 Compare.

Result of the comparison, in the read unit data _{(W i),} (in the case of No in step S3606). If there is parameter information that is not included in Digest2, the process proceeds to step S907 in FIG. 37. In this case, the data authenticity verifying unit 3002, the parameter information included in the secret sharing data read from the data storage unit 122 (W _i), signature verification fails (parameter information included in the secret distribution data (W _i) Is forged).

On the other hand, if the read parameter information _{(W i)} is included in all Digest2 (in the case of Yes in step S3606 is), the data authenticity verifying unit 3002 proceeds to step S3607.

In step S3607, the data authenticity verifying unit 3002 determines that it has succeeded in signature verification (either as a unit data included in the secret distribution data (D _i) parameter information (W _i) is not forged).

If it is determined in step S3607 that the signature verification is successful, the process proceeds to step S903 of FIG. 37, and thereafter, signature verification is performed to see if the secret sharing data has been tampered with. If the signature verification is successful as a result of the signature verification, in step S908, the signature value verification unit 804 determines that the secret sharing data has not been tampered with.

Thus, according to the tenth embodiment, the server apparatus 120, the unit data included in the secret distribution data (D _i) for both parameter information (W _i), and can verify the authenticity Become.

In the description of FIG. 36, the authenticity of all the unit data ( _Di ) included in the secret sharing data is verified, and then the authenticity of the parameter information ( _Wi ) is started. However, the order of authenticity verification is not limited to this, and the authenticity of all the parameter information ( _Wi ) is verified before the authenticity verification of the unit data ( _Di ) is started. May be good. Alternatively, the authenticity verification of the unit data (D _i ) and the authenticity verification of the parameter information ( _Wi ) may be alternately performed.

[11th Embodiment]
In the ninth and tenth embodiments, the case where the image pickup apparatus 110 broadcasts the secret distribution data and the signature value (S) has been described. On the other hand, in the eleventh embodiment, the router device is arranged, and the router device broadcasts the secret sharing data and the signature value (S). Hereinafter, the eleventh embodiment will be described.

FIG. 38 is a diagram showing an example of the system configuration of the data recording system. The difference from the data recording system 3400 shown in FIG. 34 is that it has a router device 3810.

The router device 3810 is connected to the image pickup device 110, and broadcasts the secret sharing data and the signature value (S) transmitted from the image pickup device 110 to the server device 120 and the authenticity guarantee server 3410 connected via the network. To do.

By arranging the router device 3810 in this way, the transmission load of the image pickup device 110 can be reduced.

[Other Embodiments]
In the first to eleventh embodiments described above, a case where the secret sharing protocol is applied to the moving image data generated by the image pickup apparatus 110 has been described. However, the target to which the secret sharing protocol is applied is not limited to moving image data. It can be applied to any time series data such as voice data and temperature data.

Further, in the above-described first to eleventh embodiment, arranged data counter section 504, for each unit data of a predetermined number _(n) (D i), and configured to calculate a signature value (S). However, the timing for calculating the signature value may not be every unit data (D _i) of the predetermined number (n). For example, the signature value may be calculated for each unit data ( _Di ) for a predetermined time. That is, the signature value (S) may be calculated for the unit data of a predetermined section of the time series data.

Further, in the first to eleventh embodiments, the hash generation unit 506 calculates the hash value of the unit data ( _Di ), and the parameter information generation unit 507 is based on the hash value calculated by the hash generation unit 506. Therefore, the parameter information ( _Wi ) is calculated. However, the parameter information generation unit 507 may be configured to directly calculate the parameter information ( _Wi ) based on the unit data ( _Di ).

Further, in the first to eleventh embodiments described above, the CPU 402 executes the secret sharing data generation program to realize the secret sharing data generation unit. However, the secret sharing data generation unit may be realized by using, for example, a GPU (Graphics Processing Unit).

Further, in the eighth embodiment, the secret sharing data generation unit 2610 is configured to transmit the Digist and the signature value (T). However, as in the tenth embodiment, the Digist 1 and the signature value (T) are transmitted. ), Digest2 and the signature value (U) may be transmitted. In this case, the signature unit 2701 functions as the second and third signature means, and the data transmission unit 510 functions as the first to third transmission means.

The present invention is not limited to the configurations shown here, such as combinations with other elements in the configurations and the like described in the above embodiments. These points can be changed without departing from the spirit of the present invention, and can be appropriately determined according to the application form thereof.

100: Data recording system 110: Data generator (imaging device)
111: Secret distributed data generation unit 120: Data storage device (server device)
121: Data verification unit 122: Data storage unit 501: Data input unit 502: Compression unit 503: Data buffer unit 504: Data counter unit 505: Signature parameter generation unit 506: Hash generation unit 507: Parameter information generation unit 508: Stream packet Generation unit 509: Signature unit 510: Data transmission unit 801: Data reception unit 802: Storage processing unit 803: Sign value calculation unit 804: Sign value verification unit 1101: Setting parameter input unit 1102: Setting parameter storage unit 1200: Setting parameter information 1301: Auxiliary storage device 1401: Data coupling unit 1402: Storage control unit 1601: Importance determination unit 2610: Secret distribution data generation unit 2620: Data verification unit 2701: Signature unit 3001: Authenticity Signature value verification unit 3002: Data authenticity Verification unit 3210: Authenticity guarantee server 3211: Signature unit 3411: Signature unit 3420: Data verification unit

JP-A-2015-088555

Claims (13)

From the time series data, n (2 or more integers) of data included in a predetermined interval are sequentially acquired, and based on the acquired data, k (k is an integer of 1 or more and less than n) disorder. A calculation means for calculating parameter information that satisfies the (k-1) -order polynomial containing numerical values, and
An output means for associating the acquired data with the parameter information calculated based on the acquired data and outputting the data.
A signature is added to the secret information based on the secret sharing protocol, which can be calculated by collecting k sets of the acquired data and the parameter information output in association with the acquired data, and output. and the first signature means,
A first transmission in which the acquired data and the parameter information output in association with the acquired data are transmitted, and the secret information output with the signature added by the first signature means is transmitted. Means and
A second signature means for adding a signature to the hash value of the acquired data and outputting the data,
A data generation device comprising: a second transmission means for transmitting a hash value of the acquired data and a hash value output by the second signature means with a signature added . The data generation device according to claim 1, wherein the calculation means calculates the parameter information based on the hash value of the acquired data. The data generation device according to claim 1 or 2, wherein the calculation means further includes a setting means for setting a condition for calculating the parameter information. In addition to storing the acquired data and the parameter information output in association with the acquired data, a storage means for storing the secret information output by adding a signature to the first signature means is further provided. The data generation device according to any one of claims 1 to 3, wherein the data generation device has. Further having a determination means for determining the importance of the acquired data,
The data generation device according to claim 1 , wherein the calculation means calculates a number of the parameter information according to the importance determined by the determination means based on the acquired data. The first transmission means is
The data according to claim 5 , wherein when the importance is equal to or higher than a predetermined value, the acquired data and the parameter information output in association with the acquired data are transmitted a plurality of times. Generator. When the importance is equal to or higher than a predetermined value, it further has a holding means for holding the acquired data and the parameter information output in association with the acquired data.
The first transmission means is
The acquired data held in the holding means when a retransmission request is received from the transmission destination after transmitting the acquired data and the parameter information output in association with the acquired data. The data generation device according to claim 5 , wherein the data generation device and the parameter information output in association with the acquired data are transmitted. A data recording system having a data generation device and a data storage device connected to the data generation device.
The data generator is
From the time series data, n (2 or more integers) of data included in a predetermined interval are sequentially acquired, and based on the acquired data, k (k is an integer of 1 or more and less than n) disorder. A calculation means for calculating parameter information that satisfies the (k-1) -order polynomial containing numerical values, and
An output means for associating the acquired data with the parameter information calculated based on the acquired data and outputting the data.
A signature is added to the secret information based on the secret sharing protocol, which can be calculated by collecting k sets of the acquired data and the parameter information output in association with the acquired data, and output. and the first signature means,
The first set of the acquired data and the parameter information output in association with the acquired data is transmitted, and the secret information output with the signature added by the first signature means is transmitted. The first means of transmission and
A second signature means for adding a signature to the hash value of the acquired data and outputting the data,
A data recording system characterized by having a second transmission means for transmitting a second set of a hash value of the acquired data and a hash value output by the second signature means with a signature added. .. The data storage device is
And data the acquired, receiving means for receiving said first set of said parameter information is outputted in association with the data the acquired,
The data record according to claim 8 , further comprising a first falsification determination means for determining the success or failure of signature verification based on whether or not the number of the first set received is k or more. system. The receiving means further receives the signed confidential information.
The data storage device is
When k or more are determined by the first falsification determination means, the secret information calculated based on the k first set is compared with the secret information received by the receiving means. The data recording system according to claim 9 , further comprising a second falsification determination means for determining the success or failure of signature verification. The receiving means further receives the second set transmitted by the second transmitting means.
The data storage device further
When the received signature verification of the second set is successful, the signature verification is performed on the acquired data included in the received first set using the second set in which the signature verification is successful. The data recording system according to claim 9 , further comprising a counterfeit determination means for determining the success or failure of the above. The counterfeit determination means is
By comparing the hash value of the acquired data included in the received first set with the hash value of the acquired data included in the received second set, the received first set The data recording system according to claim 11 , wherein the success or failure of the acquired data included in the set of 1 is determined. From the time series data, n (2 or more integers) of data included in a predetermined interval are sequentially acquired, and based on the acquired data, k (k is an integer of 1 or more and less than n) disorder A calculation process for calculating parameter information that satisfies the (k-1) -order polynomial containing numerical values, and
An output process for associating the acquired data with the parameter information calculated based on the acquired data and outputting the data.
A signature is added to the secret information based on the secret sharing protocol, which can be calculated by collecting k sets of the acquired data and the parameter information output in association with the acquired data, and output. and the first of the signature process,
A first transmission in which the acquired data and the parameter information output in association with the acquired data are transmitted, and the secret information output with a signature added in the first signature step is transmitted. Process and
A second signature step of adding a signature to the hash value of the acquired data and outputting it, and
A program for causing a computer to execute a second transmission step of transmitting a hash value of the acquired data and a hash value output with a signature added in the second signature step .

Images