WO2020100704A1 - Camera system and method of driving camera system - Google Patents

Abstract

A camera system (10) according to the present invention comprises: a swallowable capsule (20) in which is installed a solid-state imaging device (21) that serves as a camera (CMR); and a receiving device (30) for receiving wirelessly transmitted video data captured by the capsule (20). The capsule (20) includes a device ID circuit (24) for transmitting a device ID to the receiving device (30). The receiving device (30) includes memory (32) for storing at least the device ID received as a preset. For example, when power is supplied to the camera (CMR) before the capsule (20) is swallowed, the capsule (20) transmits the device ID to the receiving device (30) at least once. As a result, it is possible to realize at least one of device authentication implementation, protection of data completeness and reliability, data encryption, and prevention of the exchange of erroneous data between the capsule and at least a receiver on the receiving device side.

Description

Camera system and method of driving camera system

The present invention relates to a camera system for transmitting video data captured by a solid-state imaging device mounted on a swallowable capsule to a receiving system and a driving method for the camera system.

A CCD (Charge Coupled Device) image sensor and a CMOS (Complementary Metal Oxide Semiconductor) image sensor have been put to practical use as a solid-state imaging device (image sensor) using a photoelectric conversion element that detects light and generates an electric charge.
CCD image sensors and CMOS image sensors are used as a part of various electronic devices such as digital cameras, video cameras, surveillance cameras, medical endoscopes, personal computers (PC), and mobile terminal devices (mobile devices) such as mobile phones. Widely applied.

As a camera system for a medical device equipped with such a solid-state imaging device, an in-vivo camera system has been proposed that transmits video data captured by the solid-state imaging device mounted in a swallowable capsule to a receiving device (for example, patents). Reference 1).
In this in-vivo camera system, raw video data is wirelessly transmitted to a receiving device and then image processed to minimize capsule size and power consumption.

Further, in this type of in-vivo camera system, a signal receiver can be provided on the capsule side (see, for example, Patent Document 2).
In this camera system, the capsule is configured to wirelessly receive a control signal from the receiving device (control device) and control the camera, the irradiation unit, and the like.

USP 5,604,531 JP, 2013-66694, A

However, in the above-described in-vivo camera system, the system is vulnerable to attacks such as interception and camouflage due to wireless transmission of raw data by the image sensor (solid-state imaging device).
As a result, in the above-mentioned in-vivo camera system, a security risk of personal information may occur.

In view of such a situation, in the in-vivo camera system, implementation of device authentication, protection of data integrity and reliability, data encryption, and incorrect data are provided between the capsule and at least the receiver of the receiving device. There is a strong demand for the realization of a function to prevent the exchange of information.

In recent years, a technology called PUF (Physically Unclonable Function) has attracted attention in recent years as an LSI security technology. PUF is a technique for extracting variations in semiconductors as physical characteristic amounts and obtaining an output unique to a device.
Further, in the semiconductor device, the PUF is a circuit that extracts a minute performance shift caused by variations in the threshold value of a transistor that occurs during manufacturing and outputs it as a unique ID.
Falsification of information can be prevented by authenticating the device using the unique ID generated by the PUF or adding a message authentication code (MAC) to the acquired data to ensure authenticity.

In such a situation, the CMOS image sensor PUF (which has a security function by extracting the pixel variation of the CIS and using it as the information peculiar to an individual without adding an extra circuit to the CMOS image sensor (CIS) CIS-PUF) has been proposed.

For example, Non-Patent Documents 1 and 2 describe a CMOS image sensor PUF (CIS-PUF) that generates a unique ID of a PUF from pixel variation information in a CMOS image sensor as a measure to prevent device authentication of the sensor and tampering with image data. Is proposed.

In these CIS-PUFs, when generating a PUF response, a digital value of a plurality of bits corresponding to the variation of pixel transistors is output, and a response of 1/0 is obtained from the magnitude relation of the threshold voltages of adjacent transistors.
If the difference between the values of the pixel transistors to be compared is large, the size relationship of the threshold voltages is not reversed even if environmental conditions such as noise and temperature / voltage change, so it can be determined that the bits are stable. ..

Note that the property of predicting a bit that is likely to be an error bit in a response when generating a PUF response has been proposed as a typical PUF in the past (see Non-Patent Documents 3 and 4).

By the way, as an application of PUF that uses the variation unique to each device for security, challenge and response authentication (Challenge & Response (CR authentication) or device authentication), data integrity authentication, data encryption (encryption key (unique key) generation ) Is available.

However, signal processing for advanced information security of the CMOS image sensor (CIS) such as authentication causes a reduction in the image data frame rate due to the processing time and an increase in the device cost due to the processing circuit.

The present invention realizes at least one of implementation of device authentication, protection of data integrity and reliability, data encryption, and prevention of erroneous data exchange between the capsule and at least the receiver on the receiver side. It is an object of the present invention to provide a camera system and a method for driving the camera system that can perform the above.

The present invention realizes at least one of implementation of device authentication, protection of data integrity and reliability, data encryption, and prevention of erroneous data exchange between the capsule and at least the receiver on the receiver side. A camera system and a camera system drive capable of reducing the image data frame rate due to the processing time of signal processing for information security and preventing an increase in device cost due to a processing circuit. To provide a method.

A camera system according to a first aspect of the present invention includes a swallowable capsule equipped with a solid-state imaging device as a camera, and a receiving device that receives video data captured by the capsule and wirelessly transmitted. The capsule includes a device ID circuit that transmits a device ID to the receiving device, and the receiving device includes at least a memory that stores the device ID received for presetting.

A second aspect of the present invention is to drive a camera system that includes a swallowable capsule equipped with a solid-state imaging device as a camera, and a receiving device that receives video data captured by the capsule and wirelessly transmitted. In the method, the capsule transmits the device ID to the receiving device at least once in response to a predetermined trigger, and the receiving device stores the received device ID in a memory for presetting. Then, for example, when the receiving device performs authentication, it sends an authentication request to the capsule, and the capsule sends a device ID generated by the device ID circuit in response to the authentication request from the receiving device. Then, the receiving device receives the device ID transmitted from the capsule in response to the authentication request, evaluates the received device ID and the device ID preset in the memory, and the both IDs are the same. In that case, the capsule is requested to transmit the video data, and the capsule transmits the video data captured by the camera to the receiving device in response to the transmission request from the receiving device.

According to the present invention, at least one of implementation of device authentication, protection of data integrity and reliability, data encryption, and prevention of erroneous data exchange between the capsule and at least the receiver on the receiving device side. Can be realized.
Further, according to the present invention, it is possible to prevent the image data frame rate from decreasing due to the processing time of signal processing for information security, and to prevent the increase in the device cost due to the processing circuit.

FIG. 1 is a block diagram showing a first configuration example of the in-vivo camera system according to the first embodiment of the present invention. FIG. 2 is a block diagram showing a second configuration example of the in-vivo camera system according to the first embodiment of the present invention. FIG. 3 is a diagram for explaining a device ID preset tail and a device authentication operation in the camera system according to the first embodiment. FIG. 4 is a diagram for explaining a device ID preset operation and a data integrity and reliability protection operation in the camera system according to the first embodiment. FIG. 5 is a diagram for explaining device ID presetting and encryption operations in the camera system according to the first embodiment. FIG. 6 is a block diagram showing a configuration example of the solid-state imaging device according to the embodiment of the present invention. FIG. 7 is a diagram for explaining the outline of the challenge and response authentication (Challenge & Response (CR authentication)) system. FIG. 8A and FIG. 8B are diagrams for explaining device authentication in the present embodiment. 9A and 9B are views for explaining the data integrity authentication in this embodiment. 10 (A) and 10 (B) are first diagrams for explaining the data encryption processing in the present embodiment. 11A to 11C are second diagrams for explaining the data encryption processing according to the present embodiment. FIG. 12 is a circuit diagram showing an example of the pixel according to the present embodiment. FIGS. 13A to 13C are diagrams for explaining a configuration example of a column output readout system of the pixel unit of the solid-state imaging device according to the embodiment of the present invention. FIG. 14 is a block diagram showing an overall outline of response data creation which is the encryption processing system according to the present embodiment. FIG. 15A to FIG. 15E are diagrams showing operation waveforms and the like of main parts in the normal operation mode and the response creation mode when the variation information of the threshold of the source follower transistor is adopted as the variation information of the pixel. Is. FIG. 16 is a diagram showing a pixel section according to the present embodiment, including an information acquisition section suitable for acquiring variation information forming a main part of a CMOS image sensor PUF (CIS-PUF), and column readout arranged for each column. It is a figure which shows the outline of a circuit. FIG. 17 is a diagram showing a state of PUF response generation using the pixel variation of the CIS-PUF of FIG. FIG. 18 is a diagram showing the reproducibility and uniqueness as the PUF performance obtained by the response generation method as shown in FIGS. FIG. 19 is a diagram showing FPR and FNR obtained from uniqueness and reproducibility. FIG. 20 is a block diagram showing a configuration example of an in-vivo camera system according to the second embodiment of the present invention. FIG. 21 is a block diagram showing a configuration example of an in-vivo camera system according to the third embodiment of the present invention.

10, 10A, 10B, 10C ... In-vivo camera system, 20, 20A, 20B ... Capsule, 21, 21A, 21B ... Solid-state imaging device, 22 ... Transmitter, 24 ... Device ID Circuit, 26 ... Power receiver, CMR ... Camera, 30 ... Receiving device, 31 ... Receiver, 32 ... Memory, 33 ... Transmitter, 35 ... Power transmitter , 220, 220A ... Pixel part, 230 ... Vertical scanning circuit, 240 ... Readout circuit, 244 ... Clip circuit, 250 ... Horizontal scanning circuit, 260 ... Timing control circuit, 270 ... ..Signal processing circuit, 710 ... Video I / F, 720 ... Multi-bit conversion unit, 280 ... Response data generation unit (encryption processing system), 281 ... Information acquisition unit, 282, 282A ... key generation unit, 283 ... image data generation unit, 284 ... identification data generation unit, 285 ... integrated unit, 286 ... memory, 290 ... read-out unit, 100 ... CR authentication system, 200 ... CIS-PUF chip, 300 ... Microcomputer.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 is a block diagram showing a first configuration example of the in-vivo camera system according to the first embodiment of the present invention.
FIG. 2 is a block diagram showing a second configuration example of the in-vivo camera system according to the first embodiment of the present invention.

The in-vivo camera system 10 is basically configured to include a swallowable capsule 20 and a receiving device 30 capable of wireless communication with the capsule 20.

In the camera system 10, the wireless transmission of raw data by the image sensor (solid-state imaging device) makes the system vulnerable to attacks such as eavesdropping and camouflage, which results in a security risk of personal information. May occur.
Therefore, in the in-vivo camera system 10 of the present embodiment, between the capsule 20 and at least the receiver on the side of the receiving device 30, implementation of device authentication, protection of data integrity and reliability, data encryption, and error. It is configured so that it is possible to realize at least one of prevention of exchange of data.

The capsule 20 of FIG. 1 has a solid-state imaging device 21 and an optical system (lens system) 22 that constitute a camera CMR, and a transmitter (TX) 23.
The capsule 20A in FIG. 2 further includes a receiver (RX) 25.

The solid-state imaging device 21 according to this embodiment is formed of, for example, a CMOS image sensor.

The solid-state imaging device 21 includes a CMOS image sensor having a function of a device ID circuit 24 that generates a PUF unique ID from pixel variations in the CMOS image sensor as a measure for preventing device authentication of the capsules 20 and 20A and falsification of image data. It is formed as a PUF (CIS-PUF).
In the CIS-PUF, the solid-state imaging device 21 is unique in association with at least one of pixel variation information and readout unit variation information when generating a PUF response (hereinafter, also referred to as PUF response). It is configured to be able to generate response data including a key.

Further, the solid-state imaging device 21 includes a signal processing circuit capable of information security signal processing including response data generation processing in a security mode different from the normal operation mode MDU for generating a normal image, as described later in detail. Composed of.
The information security signal processing performed by this signal processing circuit is at least one of response data generation processing, device authentication, data integrity and reliability protection (data integrity authentication), and data encryption.
Then, the information security signal processing includes, for example, an authentication processing in which the pixel address of the solid-state imaging device 21 is used as a challenge and the response data generated by a predetermined procedure is used as a response.

Optical system (lens etc.) 22 guides incident light to the pixel area of the CMOS image sensor (forms a subject image).

The transmitter 23 wirelessly transmits the device ID generated by the device ID circuit 24, the video data captured by the camera CMR, and the like to the receiving device 30 (30A).

The capsule 20 (20A) transmits the device ID generated by the device ID circuit 24 to the receiving device 30 (30A) at least once in response to a predetermined trigger. The method of generating the device ID will be described in detail later.
The device ID for preset needs to be transmitted in advance before the capsule 20 is swallowed (swallowed).

For example, when power is supplied to the camera CMR, the capsule 20 (20A) transmits the device ID generated by the device ID circuit 24 to the receiving device 30 at least once.

For example, the capsule 20 (20A) transmits the device ID generated by the device ID circuit 24 to the receiving device 30 at least once when the blue light is exposed to the camera CMR.
The blue light includes green light and cyan light.

For example, when the capsule 20 (20A) receives the preset request from the receiving device 30 (30A), it transmits the device ID generated by the device ID circuit 24 to the receiving device 30 at least once.

The device ID circuit 24 is formed by the fuse of the solid-state imaging device 21, the fuse of the transmission device, the PUF system circuit, or the PUF system circuit of the solid-state imaging device 21.

The receiving device 30 has a receiver 31 and a memory 32.
The receiving device 30A in FIG. 2 further includes a transmitter 33.

The receiver 31 receives the device ID generated by the device ID circuit 24, the video data captured by the camera CMR, and the like, which are wirelessly transmitted from the transmitter 23 of the capsule 20.

The memory 32 is formed of, for example, a non-volatile memory, and stores the preset device ID received by the receiver 31 under the control of the controller of the receiving device 30 (30A).

In the camera systems 10 and 10A of the present embodiment, as described above, the preset device ID needs to be set in advance before the capsule 20 is swallowed (swallowed).
The receiving device 30 (30A) stores the device ID to be preset in the secure memory 32.

The transmitter 33 wirelessly transmits an authentication request to the capsule 20 (20A) under the control of the controller of the receiving device 30 (30A).

In the camera system 10, between the capsule 20 (20A) and at least the receiver 31 on the receiving device 30 (30A) side, device authentication is implemented, data integrity and reliability protection, data encryption, and error It operates as follows to realize the prevention of the exchange of data.

(Device authentication)
FIG. 3 is a diagram for explaining device ID presetting and device authentication operations in the camera system according to the first embodiment. Note that FIG. 3 corresponds to the second configuration example of FIG. 2.

preset:
The receiving device 30A stores the received device ID transmitted from the capsule 20A in the secure memory 32. Note that, as described above, the device ID needs to be set in advance before the capsule 20A is swallowed (swallowed) in the living body.

Certification:
When the capsule 20A is in the living body, the receiving device 30A transmits an authentication request to the capsule 20A (ID request (Challenge): ST1 in FIG. 3).
The capsule 20A transmits the device ID generated by the device ID circuit 24 in response to the authentication request from the receiving device 30A (Response: ST2 in FIG. 3).
The reception device 30A evaluates (compares) the received device ID with the device ID preset in the memory 32. If both IDs are the same, the receiving device 30A requests the capsule 20A to transmit the video data (okay, ST3 in FIG. 3).
The capsule 20A transmits the video data captured by the camera CMR to the receiving device 30A in response to the transmission request from the receiving device 30A (video, ST4 in FIG. 3).
If the received device ID and the device ID preset in the memory 32 are not the same, the receiving device 30 outputs a warning signal without issuing a request to transmit video data to the capsule 20A.

Like this, challenge and response authentication are preferable for device authentication. Further, the capsule 20A needs to be equipped with a receiver (RX) or a power receiving device as shown in FIG.

(Protection of data integrity and reliability)
FIG. 4 is a diagram for explaining a device ID preset operation and a data integrity and reliability protection operation in the camera system according to the first embodiment. Note that FIG. 4 corresponds to the first configuration example of FIG. 1.

preset:
The receiving device 30 stores the received device ID transmitted from the capsule 20 in the secure memory 32. Note that, as described above, the device ID needs to be set in advance before the capsule 20 is swallowed (swallowed) in the living body.

Data protection:
The capsule 20 includes a key generation circuit 26 that generates a key KY based on the device ID, and transmits the video data VD and the encoded data using the key KY (ST11 in FIG. 4).
The receiving device 30 evaluates the video data and the key based on the device ID preset in the memory 32, and protects the integrity and reliability of the video data (ST12 in FIG. 4).
In this case, MAC (Message Authentication Code) can be used.

(encryption)
FIG. 5 is a diagram for explaining device ID presetting and encryption operations in the camera system according to the first embodiment. Note that FIG. 5 corresponds to the first configuration example of FIG. 1.

preset:
The receiving device 30 stores the received device ID transmitted from the capsule 20 in the secure memory 32. Note that, as described above, the device ID needs to be set in advance before the capsule 20 is swallowed (swallowed) in the living body.

encryption:
The capsule 20 includes a key generation circuit 26 that generates a key KY based on the device ID, and transmits the encrypted video data VD together with the key KY (ST21 in FIG. 5).
In order to protect the video data, the receiving device 30 decrypts the encrypted video data with a key based on the device ID preset in the memory 32 (ST22 in FIG. 5).
In this case, AES (Advanced Encryption Standard) can be used.

As described above, device authentication is implemented, data integrity and reliability are protected, data is encrypted, and erroneous data is exchanged between the capsule 20 (20A) and at least the receiver on the receiving device 30 (30A) side. The basic configurations and functions of the in- vivo camera systems 10 and 10A capable of realizing at least one of the above have been described.
At least one of implementation of device authentication, protection of data integrity and reliability, data encryption, and prevention of erroneous data exchange are realized between the capsule and at least the receiver on the receiving device side. In addition, it is possible to prevent a decrease in the image data frame rate due to the processing time of signal processing for information security, prevent an increase in the device cost due to the processing circuit, and require troublesome work. The specific configuration of the solid-state imaging device 21, which is formed as a CMOS image sensor PUF (CIS-PUF), which realizes a camera system capable of increasing the number of times of CR authentication while ensuring authentication accuracy, an authentication system, etc. explain.

(Example of configuration of solid-state imaging device 21)
FIG. 6 is a block diagram showing a configuration example of the solid-state imaging device according to the embodiment of the present invention.
In the present embodiment, the solid-state imaging device 21 is composed of, for example, a CMOS image sensor.

As shown in FIG. 6, the solid-state image pickup device 21 includes a pixel unit 220 as an image pickup unit, a vertical scanning circuit (row scanning circuit) 230, a reading circuit (column reading circuit) 240, and a horizontal scanning circuit (column scanning). Circuit) 250, a timing control circuit 260, and a signal processing circuit 270 as main constituent elements.
Of these components, for example, the vertical scanning circuit 230, the readout circuit 240, the horizontal scanning circuit 250, and the timing control circuit 260 constitute a pixel signal readout unit 290.

As described above, the solid-state imaging device 21 according to the present embodiment determines the PUF unique ID from the pixel variation in the CMOS image sensor as a measure for preventing device authentication of the sensor 20 (20A) and tampering with the image data. It is formed as a CMOS image sensor PUF (CIS-PUF) for generation.
In the CIS-PUF, the solid-state imaging device 21 is unique in association with at least one of pixel variation information and readout unit variation information when generating a PUF response (hereinafter, also referred to as PUF response). It is configured so that response data including a key can be generated.

As will be described later in detail, the solid-state imaging device 21 according to the present embodiment generates a plurality of bits corresponding to the variation information of the pixel transistors when generating the variation information of the pixels and the reading unit 290 which are PUF responses. The digital value (LSB value) is output, and the response data of 1/0 is acquired from the magnitude relation of the threshold voltages of the adjacent transistors.
In the solid-state imaging device 21, when the difference in digital value of the pixel transistors to be compared in magnitude is large, the magnitude relationship with the threshold voltage VTH is not reversed even if environmental conditions such as noise and temperature / voltage change. It can be judged that it is a stable bit.

Further, in the present embodiment, the CMOS image sensor PUF (CIS-PUF) is one in which at least one of the pixel variation of the CMOS image sensor and the variation information of the reading unit is extracted and applied to the PUF.
Originally, most of the pixel variations are removed by the CDS circuit, but the CIS-PUF has a normal imaging mode (normal operation mode) in which a correlated double sampling (CDS) circuit is operated to capture an image, and a CDS circuit. It has a security mode (PUF mode or response creation mode MDR) for shooting without operating.

Then, in the solid-state imaging device 21 according to the present embodiment, the signal processing circuit 270 is configured to include the response data generation unit 280, and the response data generation process is performed in the security mode different from the normal operation mode MDU that generates the normal image. Information security signal processing including is configured to be possible.
The signal processing circuit 270 of this embodiment has a wireless video interface (I / F) 710 capable of communicating with a microcomputer (hereinafter, referred to as a microcomputer) on the side of the receiving device 30 for authentication processing and the like. There is.
The signal processing circuit 270 performs the information security signal processing so that the image data frame rate can be prevented from lowering due to the processing time of the signal processing for information security and the increase in the device cost due to the processing circuit can be prevented. , Signal processing in the blanking period of image signal processing or signal processing for each row (line).

In the present embodiment, the information security signal processing performed by the signal processing circuit 270 is at least one of response data generation processing, device authentication, data integrity authentication, and data encryption.
The information security signal process includes an authentication process in which the pixel address is used as a challenge and the response data generated in a predetermined procedure is used as a response.

As will be described in detail later, the authentication accuracy to be ensured when performing authentication is the probability FPR () of recognizing a forgery as a genuine product as an index of the authentication accuracy based on the uniqueness and reproducibility data of information security signal processing. False Positive Rate) and a probability FNR (False Negative Rate) of recognizing a genuine article as a false article can be obtained, and evaluation (determination, selection) can be performed by the probability FPR and the probability FNR.

The CIS-PUF is a PUF that uses a pixel address as a challenge and 1/0 data generated by a predetermined procedure as a response.
Here, an outline of challenge and response authentication (Challenge & Response (CR authentication)) as an application of the PUF that uses the variation unique to each device for security will be described.
Then, each process of device authentication, data integrity authentication, and data encryption, which are one of the features of this embodiment, will be described.

(Outline of response authentication system)
FIG. 7 is a diagram for explaining an outline of a challenge and response authentication (Challenge & Response (CR authentication)) system.

The CR authentication system 100 of FIG. 7 is configured to include a CIS-PUF chip 200 on the capsule 20 (20A) side equipped with the solid-state imaging device 21 according to the present embodiment, and a microcomputer 300 on the receiving device 30 (30A) side. ing.
The CIS-PUF chip 200 has a video interface (Video I / F) 210 as the video interface 710 of FIG. 6, and the microcomputer 300 has a control interface (Control I / F) 310.

The CR authentication system 100 using CIS-PUF has a pre-registration mode and an authentication mode, and it is necessary to register (preset) the information of the CIS-PUF chip 200 in the microcomputer 300 side before performing authentication.
In the pre-registration mode, the IDs of all pixels are generated from the PUF mode side and stored in the memory 32, which is a safe area of the microcomputer 300.

In the CR authentication system 100 using this CIS-PUF, in the authentication mode, the microcomputer 300 on the authentication side first transmits a PUF mode command to the CIS-PUF chip 200 (step ST101).
In response to this, the CIS-PUF chip 200 captures images in the PUF mode and obtains a PUF mode image.
Next, the microcomputer 300 uses a random number generator (RNG) 301 to determine which pixel is used to generate an ID with a random number, and sends the address designation to the CIS-PUF chip 200 as challenge information (step ST102). ..
The CIS-PUF chip 200 cuts out the PUF mode image according to the received address designation and generates 1/0 data. The CIS-PUF chip 200 transmits this ID to the microcomputer 300 as a response to the challenge (step ST103).
The microcomputer 300 cuts out the ID of the specified address from the 1/0 data registered in advance and compares it with the ID received from the CIS-PUF chip 200. If the IDs match, the authentication is successful (step ST104).

In consideration of the communication processing of the CR authentication system 100, the signal processing circuit 270, which is a part of the CIS-PUF chip 200, and the microcomputer 300, which are one of the features of this embodiment, are device authentication, data integrity authentication, and Each process of data encryption will be described more specifically.

(Device authentication)
FIG. 8A and FIG. 8B are diagrams for explaining device authentication in the present embodiment.

In the device authentication, the signal processing circuit 270, which is a part of the CIS-PUF chip 200, receives the challenge of the pixel address XY from the microcomputer 300 as the control device on the receiving device 30 side during pixel reading, and the CIS-PUF chip receives the challenge. Write the received address to the register inside the chip.
Next, in the security mode (PUF mode), pixels are accessed according to the Y address received during the vertical blanking period PVB.
The pixel signal is processed during the vertical blanking period PVB to obtain a device ID with improved reproducibility and uniqueness.
Then, the device ID acquired during the vertical blanking period PVB or during the next pixel reading period is transmitted to the microcomputer 300 as a response to the challenge.
The microcomputer 300 checks the device ID for authentication.
In the case of streaming video data, the authentication is performed every one frame, one second, one minute, one hour, or one day.

(Data integrity certification)
9A and 9B are views for explaining the data integrity authentication in this embodiment.

In the data integrity authentication, the signal processing circuit 270, which is a part of the CIS-PUF chip 200, sets a pixel address for acquiring the device ID.
The device ID is acquired from the variation information of the pixel addressed during the vertical blanking period PVB.
Then, a row (line) pixel signal is read, and a message tag having a device ID as a unique key and a line pixel signal as a message is generated by a message authentication code (MAC) function.
Next, during the horizontal blanking period PHB via the video I / F 210 or the control I / F 310 or during the vertical blanking period PVB via the video I / F 210 or the control I / F 310, the pixel address, the line pixel signal, and The data tag is transferred to the side of the microcomputer 300 that is the control device of the receiving device 30 that performs the integrity authentication.
The microcomputer 300 on the receiving device 30 side executes the MAC process using the same key as that generated with the pixel address and the pixel data for the consistency verification.
The pixel address can be arbitrarily changed at any time.

(Data encryption)
10 (A) and 10 (B) are first diagrams for explaining the data encryption processing in the present embodiment.
11A to 11C are second diagrams for explaining the data encryption processing according to the present embodiment.

In the data encryption process, the signal processing circuit 270, which is a part of the CIS-PUF chip 200, sets the pixel address for acquiring the device ID.
The device ID is acquired from the variation information of the pixel addressed during the vertical blanking period PVB.
The pixel signal of the first row (Line1) is read from the pixel unit 220 and the pixel signal is stored in the internal line memory.
While the pixel signals of the second row (Line2) are being read from the pixel unit 220, the pixel signals of the first row (Line1) are encrypted with the key that is the device ID.
While the pixel signal of the third row (Line3) is being read from the pixel section 220, the encrypted pixel signal and pixel address of the first row (Line1) are used as a decryption process as the control device side ISP (Image Signal Processor). To the microcomputer 300.
The microcomputer 300 decrypts the encrypted pixel value of the first row (Line1) with the same key.

Note that the encryption can be applied to only a part of the line pixels, and need not be performed for the entire pixel array of the pixel portion.
The background encryption process takes more time, but does not need to be done during the one row read period.
CMOS image sensors (CIS) are usually equipped with several rows of memory, and by reusing this line memory, line-by-line encryption also realizes negligible circuit costs.

As described above, in the present embodiment, information security signal processing such as device authentication, data integrity authentication, and data encryption is performed as signal processing in the blanking period of image signal processing or signal processing for each row (line). Since the execution is performed, the image data frame rate can be prevented from lowering due to the processing time of the signal processing for information security, and the increase in the device cost due to the processing circuit can be prevented.

The processing of the authentication system has been described above.
Hereinafter, the outline of the configuration and function of each unit of the solid-state imaging device 21, particularly the configuration and function of the pixel unit 220 will be described.
After that, with regard to the characteristic configuration and function of the solid-state imaging device 21 of the present embodiment, a unique key is generated, and identification data including the unique key is integrated with image data to create response data, so-called encryption processing. The description will be centered on the response data creating process.

(Basic configuration of pixel and pixel portion 220)
In the pixel portion 220, a plurality of pixels including a photodiode (photoelectric conversion element) and an in-pixel amplifier are arranged in a two-dimensional matrix of n rows × m columns.

FIG. 12 is a circuit diagram showing an example of a pixel according to this embodiment.

The pixel PXL has, for example, a photodiode (PD) which is a photoelectric conversion element.
The photodiode PD has one transfer transistor TG-Tr, one reset transistor RST-Tr, one source follower transistor SF-Tr, and one selection transistor SEL-Tr.

The photodiode PD generates and accumulates signal charges (here, electrons) in an amount corresponding to the amount of incident light.
Hereinafter, the case where the signal charge is an electron and each transistor is an n-type transistor will be described, but the signal charge may be a hole or each transistor may be a p-type transistor.
In addition, in the present embodiment, as will be exemplified later, when the reset transistor RST-Tr, the source follower transistor SF-Tr, and the selection transistor SEL-Tr are shared by a plurality of photodiodes, Is also effective, and is also effective when a three-transistor (3Tr) pixel having no selection transistor is adopted.

The transfer transistor TG-Tr is connected between the photodiode PD and the floating diffusion FD (Floating Diffusion) and is controlled by the control signal TG.
The transfer transistor TG-Tr is selected when the control signal TG is at the high level (H) and becomes conductive, and transfers the electrons photoelectrically converted by the photodiode PD to the floating diffusion FD.

The reset transistor RST-Tr is connected between the power supply line VRst and the floating diffusion FD and controlled by the control signal RST.
The reset transistor RST-Tr may be connected between the power supply line VDD and the floating diffusion FD and controlled by the control signal RST.
The reset transistor RST-Tr is selected and rendered conductive while the control signal RST is at the H level, and resets the floating diffusion FD to the potential of the power supply line VRst (or VDD).

The source follower transistor SF-Tr and the selection transistor SEL-Tr are connected in series between the power supply line VDD and the vertical signal line LSGN.
A floating diffusion FD is connected to the gate of the source follower transistor SF-Tr, and the selection transistor SEL-Tr is controlled by the control signal SEL.
The selection transistor SEL-Tr is selected to be conductive when the control signal SEL is H. As a result, the source follower transistor SF-Tr outputs the column output analog signal VSL corresponding to the potential of the floating diffusion FD to the vertical signal line LSGN.
These operations are performed at the same time in parallel for each pixel for one row because, for example, the gates of the transfer transistor TG-Tr, the reset transistor RST-Tr, and the selection transistor SEL-Tr are connected in a row unit. Be seen.

Since the pixels PXL are arranged in n rows × m columns in the pixel section 220, there are n control lines for each control signal SEL, RST, and TG, and m vertical signal lines LSGN.
In FIG. 6, each control signal SEL, RST, TG is shown as one row scanning control line.

The vertical scanning circuit 230 drives the pixels through the row scanning control lines in the shutter row and the reading row under the control of the timing control circuit 260.
Further, the vertical scanning circuit 230 outputs a row selection signal of a row address of a read row for reading out a signal and a shutter row for resetting charges accumulated in the photodiode PD according to the address signal.

The readout circuit 240 includes a plurality of column signal processing circuits (not shown) arranged corresponding to each column output of the pixel section 220, and is configured such that column parallel processing can be performed by the plurality of column signal processing circuits. May be done.

The readout circuit 240 can be configured to include a correlated double sampling (CDS: Correlated Double Sampling) circuit, an ADC (analog-digital converter; AD converter), an amplifier (AMP, amplifier), a sample hold (S / H) circuit, and the like. Is.

As described above, the readout circuit 240 may be configured to include the ADC 241 that converts each column output analog signal VSL of the pixel section 220 into a digital signal, as shown in FIG. 13A, for example.
Alternatively, the readout circuit 240 may be provided with an amplifier (AMP) 242 that amplifies the column output analog signal VSL of the pixel section 220, as shown in FIG. 13B, for example.
In addition, the read circuit 240 may be provided with a sample hold (S / H) circuit 243 that samples and holds each column output analog signal VSL of the pixel section 220, as shown in FIG. 13C, for example.
Further, the read circuit 240 may be provided with an SRAM as a column memory that stores a signal obtained by performing a predetermined process on a pixel signal output from each column of the pixel unit 220.

The horizontal scanning circuit 250 scans the signals processed by a plurality of column signal processing circuits such as the ADC of the reading circuit 240, transfers the signals in the horizontal direction, and outputs the signals to the signal processing circuit 270.

The timing control circuit 260 generates a timing signal required for signal processing of the pixel section 220, the vertical scanning circuit 230, the reading circuit 240, the horizontal scanning circuit 250, and the like.

In the normal read mode MDU, the signal processing circuit 270 generates two-dimensional image data by performing predetermined signal processing on the read signal read by the read circuit 240 and subjected to predetermined processing.

As described above, in the solid-state imaging device (CMOS image sensor), electrons generated by photoelectric conversion with a slight amount of light are converted into a voltage with a minute capacitance, and further output using a source follower transistor SF-Tr having a minute area. is doing. Therefore, it is necessary to remove minute noise such as noise generated when resetting the capacitance and variations in transistor elements, and the difference between the reset level (VRST) and the brightness level (signal level: VSIG) of each pixel is output. ing.
As described above, in the CMOS image sensor, by outputting the difference between the reset level and the brightness level for each pixel, the reset noise and the threshold variation can be removed, and a signal of several electrons can be detected. The operation of detecting this difference is called CDS (correlated double sampling) and is a widely used technique. CDS reading is sequentially performed on all pixels arranged in an array, and one frame worth of data is read out. Normal 2D image data is output.

In the solid-state imaging device 21 of the present embodiment, the operation for generating this normal two-dimensional image data is configured to be operable in the normal operation mode MDU.

However, in the signal processing circuit 270 according to the present embodiment, in order to prevent unauthorized use, falsification, and fabrication of an image, the variation information specific to the solid-state imaging device 21 (variation in pixel and readout circuit). Information), a unique key is generated, and the unique key and the acquired data obtained from the solid-state imaging device 21 are combined to generate identification data. The identification data is integrated with the image data and output as response data RPD. The identification data cannot be created correctly when the information is not recognized.

In the solid-state imaging device 21 of this embodiment, the operation related to the generation of the unique key is configured to be operable in the response creation mode MDR (PUF mode, security mode).

In the response creation mode MDR of the present embodiment, a pixel variation pattern (variation information) unique to each chip that does not depend on peripheral brightness is output as a unique ID.
As described above, in the response creation mode MDR of the present embodiment, only the variation pattern for each pixel is output. Since the brightness level is not output, it is possible to output a pattern image that does not depend on the exposure condition of the image sensor. The output of each pixel includes FPN and thermal noise that fluctuates randomly for each frame. However, since the FPN in the response creation mode MDR is 10 times or more larger than the thermal noise, a stable fixed variation pattern is returned. It can be output as data RPD.

In the response creation mode MDR of this embodiment, when generating the unique key, the response data including the unique key is generated in association with at least one of the pixel variation information and the reading unit variation information.

The outline of the configuration and function of each unit of the solid-state imaging device 21, particularly the basic configuration and function of the pixel unit 220, has been described above.
Hereinafter, with regard to the characteristic configuration and function of the solid-state imaging device 21 of the present embodiment, a so-called encryption process in which a unique key is generated and response data is created by integrating identification data including the unique key and image data The response data creation process will be mainly described.

FIG. 14 is a block diagram showing an overall outline of response data creation which is the encryption processing system according to the present embodiment.

The response data creation unit 280, which is the encryption processing system in FIG. 14, includes an information acquisition unit 281, a key generation unit 282, an image data generation unit 283, an identification data generation unit 284, an integration unit 285, and a memory 286 as main components. Have as.
Although the information acquisition unit 281 and the key generation unit 282 are configured as separate functional blocks in the example of FIG. 14, the information acquisition unit 281 and the key generation unit 282 can be configured as one functional block. ..

The information acquisition unit 281 acquires at least one of the variation information PFLC of the pixel PXL and the variation information CFLC of the constituent circuits of the readout circuit 240, and supplies the obtained variation information to the key generation unit 282.

Here, an outline of the variation information PFLC of the pixel PXL will be described as an example.

(Threshold value of the source follower transistor SF)
The information acquisition unit 281 can employ the variation information of the threshold value VTH of the source follower transistor SF as the variation information of the pixel.

FIGS. 15A to 15E show operation waveforms of main parts in the normal operation mode and the response creation mode when the variation information of the threshold value VTH of the source follower transistor SF is adopted as the variation information of pixels. FIG.
15A is a circuit diagram of the readout system of the pixel PXL, FIG. 15B is an operation waveform in the normal operation mode MDU, FIG. 15C is an operation waveform in the response creation mode MDR, and FIG. D) shows a key pattern image in which the variation information is binarized, and FIG. 15E shows the relationship between the output signal, the number of pixels, and the threshold value VTH.
In the readout system of the pixel PXL in FIG. 15A, the CDS circuit 244 is connected to the vertical signal line LSGN via one terminal of the switch SW0. The other terminal of the switch SW0 is connected to the supply line of the reference voltage Vref.

In the normal operation mode MDU, as shown in FIG. 15 (B), the difference signal is used as the output signal of the pixel to eliminate the variation in the threshold value of the source follower transistor SF included in each pixel PXL.

In the response creation mode MDR, as shown in FIG. 15C, the rear circuit fetches the reference voltage level (Vref) at time t1 and the pixel reset voltage level at time t2.
By reading the difference between these signals, the variation in the reset voltage of each pixel PXL can be extracted.
In this example, this variation distribution is used as a key.
Since the variation is about 100 mV, it may be amplified by an amplifier or the like.

The key generation unit 282 (FIG. 14) generates a unique key using at least one of the pixel variation information acquired and supplied by the information acquisition unit 281 and the variation information of the readout circuit 240.
The key generation unit 282 supplies the generated unique key KY to the identification data generation unit 284.
The key generation unit 282 generates the unique key KY, for example, during a period (for example, a blanking period) other than when valid pixels of the pixel unit 220 are read.

The image data generation unit 283 in FIG. 14 generates the image data IMG by performing predetermined signal processing on the read signal read through the read circuit 240 and subjected to predetermined processing in the normal read mode.
The image data generation unit 283 supplies the generated image data IMG to the integration unit 285.

The image data generation unit 283 supplies the acquisition data AQD acquired from the solid-state imaging device 21 to the identification data generation unit 284.
Here, the acquired data AQD is the whole or a part of the image data.

The identification data generation unit 284 combines the unique key KY generated by the key generation unit 282 and the acquisition data AQD acquired by the solid-state imaging device 21 to generate the identification data DSCD.
The identification data generation unit 284 supplies the generated identification data DSCD to the integration unit 285.

As described above, the solid-state imaging device 21 according to the present embodiment, as a measure for preventing device authentication of the sensor and tampering with the image data, generates a unique ID of the PUF from the pixel variation in the CMOS image sensor. CIS-PUF).
Next, when a PUF response (hereinafter, also referred to as a PUF response) is generated, response data including a unique key is generated in association with at least one of pixel variation information and readout unit variation information. A preferred configuration example of the CIS-PUF capable of performing will be described.
After that, with regard to the characteristic configuration and function of the solid-state imaging device 21 of the present embodiment, so-called encryption processing in which a unique key is generated, and identification data including the unique key and image data are integrated to create response data. The description will be centered on the response data creating process.

FIG. 16 shows a pixel unit according to the present embodiment and a column readout arranged for each column, which includes an information acquisition unit suitable for acquiring variation information forming a main part of a CMOS image sensor PUF (CIS-PUF). It is a figure which shows the outline of a circuit.

The pixel unit 220A and the column readout circuit 240 of FIG. 16 determine the size (subtraction) between two vertical pixels (upper and lower in the figure) in order to improve the reproducibility of the variation signal and improve the uniqueness of the variation pattern. Etc.) and binarization can be performed.

The pixel portion 220A of FIG. 16 includes one floating diffusion FD, one source follower transistor SF-Tr as one source follower element, a reset transistor RST-Tr as one reset element, and a selection transistor SEL as one selection element. -Tr has a pixel sharing structure in which a plurality of (two in this example) photoelectric conversion elements photodiodes PD1 and PD2 and transfer transistors TG-Tr1 and TG-Tr2 as transfer elements are shared.

That is, the pixel PXLA of the CMOS image sensor of FIG. 16 is driven by the photodiodes PD1 and PD2, the transfer transistors TG-Tr1 and TG-Tr2 driven by the control signals TG1 and TG2 which are transfer clocks, and the control signal RST which is a reset clock. The reset transistor RST-Tr, a source follower (SF) transistor SF-Tr, and a selection transistor SEL-Tr driven by a control signal SEL which is a selection clock.
Here, the two photodiodes PD1 and PD2 share the reset transistor RST-Tr, the source follower (SF) transistor SF-Tr, and the selection transistor SEL-Tr.
This is a method widely used for fine pixels in recent years, and by sharing each transistor among PDs, the area of the PD is made larger than a predetermined prime size, and the photoelectrically convertible region is expanded. Therefore, the detection sensitivity to incident light is increased.

In the pixel in which the selection transistor SEL-Tr is turned on, the power supply line VDD of the power supply voltage Vdd, the source follower (SF) transistor SF-Tr, and the current source Id are connected in series to form a source follower circuit.
With this source follower circuit, the voltage of the floating diffusion FD is input to the ADC 241 via the AMP 242 of the read circuit 240, converted into a digital signal, and output to an interface circuit (not shown).
Further, the clip circuit 245 is arranged at the pixel array end, and the clip gate CG and the diode connection transistor M0 driven by the control signal CLIP which is the clip clock are arranged at the pixel array end, and by limiting the pixel output voltage amplitude, Used for stable operation.

(Outline of CIS-PUF in FIG. 16)
Here, an outline of the CIS-PUF of FIG. 16 will be described.
The CIS-PUF generates a PUF response (pixel variation information) unique to each device by utilizing the characteristic variation of each pixel of the CMOS image sensor. As described above, the characteristic variation includes fixed pattern noise (FPN: Fixed Pattern Noise) generated at a fixed position and random noise randomly generated regardless of the positions of pixels and the like.
In the normal operation mode MDU, the CMOS image sensor has a CDS (Correlated Double Sampling) which takes a difference between a reset potential (VRST) and a signal potential (VSIG) for each pixel in order to eliminate these characteristic variations. It is carried out.

On the other hand, the CIS-PUF has a response creation mode (PUF mode) MDR that is a signal read mode that does not operate the CDS in order to obtain variation information for the purpose of generating a PUF response. This PUF mode makes it possible to obtain an output in which pixel variations are dominant.

A solid-state image pickup device (CMOS image sensor) 21A as a CIS-PUF in FIG. 16 has an array structure of 1,920 × 1,080 (full HD) pixels.
This solid-state imaging device (CMOS image sensor) 21A shares a source follower transistor SF-Tr with two pixels adjacent in the vertical direction (upper and lower in the figure), and the number of source follower transistors SF-Tr is 1,920 × 540. is there.

In the PUF mode, the potential obtained from the clip circuit 245 existing in each column is used as a reference potential, and the difference from the reset potential of each pixel is calculated to extract the variation for each pixel.
In the PUF mode, the clip circuit 244 arranged in each column is first selected. At this time, the gate voltage of the diode-connected transistor M0 is VDD, and the voltage shifted by the offset voltage from the power supply voltage is held in the ADC 241 via the amplifier 242. Next, the target pixel is selected, and the reset transistor RST-Tr and the transfer transistor TG-Tr are turned on at the same time to discharge the charge accumulated in the photodiode PD. At this time, the potential of the floating diffusion FD, which is a minute capacitance, becomes VDD, and similarly, the voltage dropped by the offset voltage from the power supply voltage is held in the ADC 241.
In the ADC 41, the difference between these voltages is taken, so that the offset variation between the source follower transistor SF-Tr of the pixel and the transistor CG of the clip circuit 244 is highly reproducible fixed pattern noise, and this is used to generate an ID. To do.

(Generation of PUF response in CIS-PUF of FIG. 16)
Next, an outline of generation of a PUF response in the CIS-PUF of FIG. 16 will be described.
FIG. 17 is a diagram showing a state of PUF response generation using the pixel variation of the CIS-PUF of FIG.

The PUF response generation using the pixel variation of the CIS-PUF compares the output values (LSB values) of two source follower transistors SF-Tr adjacent in the vertical direction (up and down) to generate 1/0 data.
In the example of FIG. 17, the upper and lower output values are compared in magnitude, and when the upper output value is larger than the lower output value (upper> lower) “1”, the upper output value is smaller than the lower output value (Upper <Lower) Set to "0".

In this example, as described above, the source follower transistor SF-Tr is shared by the upper and lower two pixels. Therefore, first, an output value of one source follower transistor SF-Tr is obtained by averaging the outputs which are vertically adjacent to each other, and a map of the output of 540 × 1,920 is obtained.
Further, the outputs adjacent to each other in the vertical direction are compared in size to generate 1/0 data of 270 × 1,920.
As described above, the CIS-PUF is a PUF in which the pixel address is used as a challenge and the 1/0 data generated in the above procedure is used as a response.

(Evaluation of uniqueness and reproducibility)
Next, the evaluation results of uniqueness and reproducibility will be described.
FIG. 18 is a diagram showing reproducibility and uniqueness as PUF performance obtained by the response generation method shown in FIGS. 16 and 17.

Uniqueness and reproducibility were evaluated as performance evaluation of CIS-PUF.
Uniqueness is an index showing how different the IDs of two chips are when compared. Uniqueness is calculated by averaging 100 images on each chip, making 3,840 blocks of 128-bit length ID, calculating HD (stance in Hamming) between IDs generated by two different chips, and calculating the average value. It can be obtained.
When the ID length is L, the average of the uniqueness HD distribution is L / 2, and the standard deviation is √L / 2, which is an ideal value.

Reproducibility is an index that shows how stable an ID generated by a certain chip is, and makes 3,840 blocks of 128-bit length ID from an image obtained by averaging 100 images for each chip. It is obtained by calculating the HD of the reference ID and the ID made from each of the 100 images, and obtaining the average value.
When the output of the PUF is used for authentication, it is required that the ID be stably output. Therefore, the reproducible HD is ideally distributed in the vicinity of 0.

FIG. 18 shows the distribution of uniqueness and reproducibility when the five chips prepared were evaluated with an ID length of 128 bits.
The uniqueness HD has an average value μ = 63.9 and a standard deviation σ = 5.66, which are almost ideal values (μ = 64, σ = 5.66). The reproducibility HD has an average value μ = 1.49 and a standard deviation σ = 1.21, which indicates that the ID generated by CIS-PUF has high reproducibility.

(Authentication evaluation by FPR and FNR)
Next, the result of authentication evaluation based on FPR and FNR will be described.

As described above, in the CR authentication using the PUF, the authentication is performed by verifying whether the ID registered in advance on the microcomputer 300 side matches the ID generated by the PUF.
However, as can be seen from the above reproducibility evaluation results, the PUF does not output the exact same ID each time, and some bit inversion occurs. Therefore, it is necessary to allow some errors during authentication.

Here, in order to evaluate how much authentication accuracy can be achieved in CR authentication using CIS-PUF and how many bits of error should be set so as to be allowed to be recognized, uniqueness and reproducibility give false positive results. Two indicators, Rate (FPR) and False Negative Rate (FNR), were derived and evaluated.
FPR represents the probability of recognizing a genuine article as a genuine article, and FNR represents the probability of recognizing a genuine article as a genuine article. If the ID length used for authentication is L, the probability that uniqueness HD is M bits is Pu (M), and the probability that reproducibility HD is M bits is Ps (M), the error tolerable bit (threshold value) When T is set to T, FNR and FPR can be derived by Equations (1) and (2).

 

 

FIG. 19 is a diagram showing FPR and FNR obtained from uniqueness and reproducibility.
In FIG. 19, the horizontal axis represents the threshold value and the vertical axis represents the FPR and FNR values at that time.

The authentication accuracy that should be secured when performing authentication was determined by referring to the authentication accuracy of biometric authentication. The biometric authentication system currently in use has an authentication accuracy of 0.1 ppm or less. The target of biometric authentication is a human, and the total number thereof is about 7.5 billion. On the other hand, what is targeted for CR authentication using CIS-PUF is a sensor, and the total number thereof is estimated to be about 1 trillion.
Therefore, considering the difference in the number of objects, both FPR and FNR were set to 0.001 ppm or less as a reference. For example, the error rate can be reduced to 0.001 ppm or less by setting the number of error-allowable bits between 9 and 29 bits.

As described above, the camera systems 10 and 10A receive the swallowable capsules 20 and 20A in which the solid-state imaging device 21 as the camera CMR is mounted, and the video data captured by the capsules 20 and 20A and wirelessly transmitted. Receiving devices 30 and 30A, the capsules 20 and 20A include a device ID circuit 24 that transmits a device ID to the receiving devices 30 and 30A, and the receiving devices 30 and 30A receive at least the device received for presetting. It includes a memory 32 for storing the ID. For example, the capsule 20, 20A transmits the device ID to the receiving device 30, 30A at least once when the camera CMR is powered before being swallowed. Further, for example, when the capsule C20, 20A system light is exposed to the camera CMR, the device ID generated by the device ID circuit 24 is transmitted at least once to the receiving devices 30, 30A.
The receiving device 30 or 30A stores the device ID received from the capsule 20 or 20A and received in the secure memory 32. As described above, the device ID needs to be set in advance before the capsules 20 and 20A are swallowed (swallowed) in the living body.

For example, when the capsule 20 is in the living body, the receiving device 30 transmits an authentication request to the capsule 20 (ID request (Challenge) in FIG. 3).
The capsule 20 transmits the device ID generated by the device ID circuit 24 in response to the authentication request from the receiving device 30 (ResponseF2 in FIG. 3).
The receiving device 30 evaluates (compares) the received device ID with the device ID preset in the memory 32. If both IDs are the same, the receiving device 30 requests the capsule 20 to transmit the video data.
The capsule 20 transmits the video data captured by the camera CMR to the receiving device 30 in response to the transmission request from the receiving device 30.

Further, the capsule 20 includes a key generation circuit 26 that generates a key KY based on the device ID, and transmits the video data VD and the encoded data using the key KY.
The receiving device 30 evaluates the video data and the key based on the device ID preset in the memory 32, and protects the integrity and reliability of the video data.
The capsule 20 also includes a key generation circuit 26 that generates a key KY based on the device ID, and transmits the encrypted video data VD with the key KY.
The receiver 30 decrypts the encrypted video data with a key based on the device ID preset in the memory 32 in order to protect the video data.

As described above, according to the first embodiment, in the in- vivo camera systems 10 and 10A, between the capsule 20 and the receiver on the receiving device 30 side, implementation of device authentication, data integrity and reliability are performed. It is possible to realize protection of data, data encryption, and prevention of erroneous data exchange.

Further, according to the first embodiment, in any of response data generation processing, at least device authentication, data integrity authentication, and data encryption, a pixel address is used as a challenge and a predetermined The information security signal processing including the authentication processing in which the response data generated in the procedure is used as a response is executed as the signal processing in the blanking period of the image signal processing or the signal processing for each row (line).
As a result, it is possible to prevent the image data frame rate from decreasing due to the processing time of signal processing for information security, and to prevent an increase in the device cost due to the processing circuit.

As described above, according to the first embodiment, it is possible to prevent a decrease in the image data frame rate due to the processing time of signal processing for information security, and prevent an increase in the device cost due to the processing circuit. In addition, it is possible to increase the number of CR authentications while ensuring authentication accuracy without requiring complicated work, and it is possible to generate unique response data with high confidentiality, which in turn ensures image tampering and falsification. Can be prevented.

The above-described key generation unit 282 has described the example in which the unique keys are generated based on the variation information of the pixels or the reading circuit 240. However, the unique keys generated by the different variation information are operated to obtain the final unique keys. It can also be configured to obtain the key.
For example, the following configuration is also possible.

That is, the key generation unit 282 uses, for example, the variation information of the ADC 241, the amplifier (AMP) 242, or the S / H circuit 243 of the read circuit 240 to generate the first unique key, and the read circuit 240. A first unique key generated by the first function, and a second unique key generated by the second function, and a second function of generating a second unique key by using the output of the SRAM of the column memory 245. It is also possible to construct so as to generate the final unique key by calculating.

This configuration can be applied to pixel variation information as well.

The integration unit 285 may be configured to include a function of hierarchically masking an image portion using the integration key information.
Further, the unifying unit 285 may be configured to include a function of adding a digital watermark to an image using the unifying key information.

In this embodiment, it is possible to adopt a configuration in which each component of the solid-state imaging device 21 is mounted in the same package.

Also, in a SoC (System on Chip) equipped with an image sensor and a signal processing circuit, signal processing for generating a key and identification data is completed inside the chip, and identification is performed without outputting unique key data to the outside of the chip. A configuration capable of generating data can be adopted.

Further, as described above, the solid-state imaging device 21 of the present embodiment can be configured to have a drive timing for accumulating a leak current or the like for a long time, in addition to the normal read drive timing. Alternatively, the full-scale voltage of the analog amplifier, digital amplifier, or ADC may be reduced, and the accumulated voltage of the leak voltage may be emphasized and output. Further, the random noise component may be reduced by averaging or adding the data of a plurality of rows or a plurality of frames.

Further, regarding the variation information CFLC of the constituent circuits of the read circuit 240, the information acquisition unit 281 can employ the variation information of the ADC as the variation information CFLC of the constituent circuits of the read circuit 240.
Further, the information acquisition unit 281 can employ the variation information of the amplifier (AMP, amplifier) as the variation information CFLC of the constituent circuits of the read circuit 240.
Further, the information acquisition unit 281 can adopt the variation information of the S / H circuit as the variation information CFLC of the constituent circuits of the read circuit 240.
Further, the information acquisition unit 281 can adopt the output (variation) information of the SRAM of the column memory as the variation information CFLC of the constituent circuits of the read circuit 240.

(Second embodiment)
FIG. 20 is a block diagram showing a configuration example of an in-vivo camera system according to the second embodiment of the present invention.

The in-vivo camera system 10B according to the second embodiment is different from the in- vivo camera systems 10 and 10A in the first embodiment in the following points.
The in-vivo camera system 10B uses power line communication, the capsule 20B is provided with the power receiver 26, and the receiving device 30B side is provided with the power transmitter 35.

When the capsule 20B receives a preset request from the power transmitter 35 on the receiving device 30B side using power line communication, the capsule 20B transmits the device ID to the receiving device 30B at least once.

According to the second embodiment, it is possible to obtain the same effect as the effect of the first embodiment described above.

(Third Embodiment)
FIG. 21: is a block diagram which shows the structural example of the in-vivo camera system which concerns on the 3rd Embodiment of this invention.

The in-vivo camera system 10C according to the third embodiment is different from the in- vivo camera systems 10, 10A, 10B of the first and second embodiments in the following points.
In the camera system 10C of the third embodiment, the capsule data CPDT is embedded in the header HD of the video data VD so that erroneous data exchange can be prevented.

Claims (24)

1. A swallowable capsule equipped with a solid-state imaging device as a camera,
   A receiving device for receiving the video data captured by the capsule and wirelessly transmitted,
   The capsule is
   A device ID circuit for transmitting a device ID to the receiving device,
   The receiving device is
   A camera system including a memory that stores at least the device ID received for presetting.
2. The capsule is
   The camera system according to claim 1, wherein when power is supplied to the camera, the device ID is transmitted to the receiving device at least once.
3. The capsule is
   The camera system according to claim 1, wherein when blue-colored light is exposed to the camera, the device ID is transmitted to the receiving device at least once.
4. The capsule is
   The camera system according to claim 1, wherein when the preset request is received from the receiving device, the device ID is transmitted to the receiving device at least once.
5. The capsule is
   The camera system according to claim 1, wherein when a preset request is received from a power transmitter on the receiving device side using wireless power feeding communication, the device ID is transmitted to the receiving device at least once.
6. The capsule is
   In response to the authentication request by the receiving device, the device ID generated by the device ID circuit is transmitted,
   The receiving device is
   The device ID transmitted from the capsule as a response to the authentication request is received, the received device ID and the device ID preset in the memory are evaluated, and if both IDs are the same, it is transmitted from the capsule. The camera system according to claim 1, wherein the camera system receives a video data but outputs a warning signal if both IDs are not the same.
7. The receiving device is
   When performing authentication, an authentication request is sent to the capsule, the device ID sent from the capsule in response to the authentication request is received, and the received device ID and the device ID preset in the memory are received. If both IDs are the same, request the capsule to send the video data,
   The capsule is
   In response to the authentication request by the receiving device, the device ID generated by the device ID circuit is transmitted,
   The camera system according to claim 1, wherein the video data captured by the camera is transmitted to the receiving device in response to a transmission request from the receiving device.
8. The capsule is
   A key generation circuit for generating a key based on the device ID,
   When data protection is performed, video data and encoded data are transmitted to the receiving device by a key,
   The receiving device is
   The camera system according to claim 1, wherein the received video data and the key are evaluated based on a device ID preset in the memory to protect the integrity and reliability of the video data.
9. The capsule is
   A key generation circuit for generating a key based on the device ID,
   Sending encrypted video data to the receiving device with a key,
   The receiving device is
   The camera system according to claim 1, wherein in order to protect the video data, the received encrypted video data is decrypted with a key based on a device ID preset in the memory.
10. The device ID circuit is
    The camera system according to claim 1, which is formed by a fuse of the solid-state imaging device, a fuse of the transmission device, a PUF system circuit, or a PUF system circuit of the solid-state imaging device.
11. The PUF system circuit of the solid-state imaging device forming the device ID circuit is
    A pixel portion in which a plurality of pixels having a photoelectric conversion function are arranged in a matrix,
    A reading unit for reading a pixel signal from the pixel unit;
    Generating response data in a security mode different from the normal operation mode for generating a normal image, including a response data generation unit for generating response data in association with at least one of the pixel variation information and the readout unit variation information A signal processing circuit capable of information security signal processing including processing,
    The signal processing circuit,
    The camera system according to claim 10, wherein the information security signal processing is executed as signal processing in a blanking period of image signal processing or signal processing for each row.
12. The information security signal processing is
    The camera system according to claim 11, which is at least one of device authentication, data integrity authentication, and data encryption.
13. The information security signal processing is
    Pixel address as a challenge (Challenge), including the authentication process that makes the response data generated in a predetermined procedure the response (Response),
    The signal processing circuit,
    In the device authentication,
    Generate a pixel address challenge during pixel readout,
    In the security mode, the pixel is accessed according to the generated address during the vertical blanking period,
    During the vertical blanking period, the pixel signal is processed to obtain the device ID,
    The camera system according to claim 12, wherein the generated address is used as a challenge and the acquired device ID is transmitted as a response during the vertical blanking period or the next pixel reading period.
14. The information security signal processing is
    Pixel address as a challenge (Challenge), including the authentication process that makes the response data generated in a predetermined procedure the response (Response),
    The signal processing circuit,
    In the device authentication,
    Receiving a pixel address challenge from the controller during pixel readout,
    In security mode, access the pixel according to the received address during the vertical blanking period,
    During the vertical blanking period, the pixel signal is processed to obtain the device ID,
    The camera system according to claim 12, wherein the device ID acquired during the vertical blanking period or during the next pixel reading period is transmitted as a response to the challenge.
15. The signal processing circuit,
    In the data integrity authentication,
    Set the pixel address to get the device ID,
    The device ID is acquired from the variation information of the pixel addressed during the vertical blanking period,
    A line pixel signal is read, and a message authentication code (MAC) function is used to generate a data tag having a device ID as a unique key and a line pixel signal as a message.
    The camera system according to claim 12, wherein a pixel address, a line pixel signal, and a data tag are transferred to the receiving device side that performs integrity authentication during a horizontal blanking period or a vertical blanking period.
16. The signal processing circuit,
    In the data encryption,
    Set the pixel address to get the device ID,
    The device ID is acquired from the variation information of the pixel addressed during the vertical blanking period,
    Reading the pixel signal of the first row from the pixel section, storing the pixel signal in an internal line memory,
    While reading the pixel signals of the second row from the pixel unit, the pixel signals of the first row are encrypted with the key that is the device ID,
    The camera system according to claim 12, wherein the encrypted pixel signal and pixel address of the first row are transferred to the receiving device side that performs the decryption processing while the pixel signal of the third row is being read from the pixel unit.
17. The pixel is
    A photoelectric conversion element that accumulates charges generated by photoelectric conversion in the accumulation period,
    A transfer element capable of transferring the charge accumulated in the photoelectric conversion element during a transfer period,
    A floating diffusion to which the charges accumulated in the photoelectric conversion element are transferred through the transfer element,
    A source follower element for converting the electric charge of the floating diffusion into a voltage signal with a gain according to the amount of electric charge;
    The camera system according to claim 12, further comprising a reset element that resets the floating diffusion to a predetermined potential.
18. The pixel portion is
    18. The camera system according to claim 17, further comprising a pixel sharing structure in which one of the floating diffusions, one of the source follower elements, and one of the reset elements are shared by the plurality of photoelectric conversion elements and the transfer elements.
19. The camera system according to claim 18, wherein a clipping circuit that limits the pixel output voltage amplitude is arranged at the pixel array end.
20. A swallowable capsule equipped with a solid-state imaging device as a camera,
    A driving method of a camera system, comprising: a receiving device that receives video data captured by the capsule and wirelessly transmitted.
    The capsule transmits the device ID to the receiving device at least once in response to a predetermined trigger,
    A driving method of a camera system, wherein the receiving device stores the received device ID in a memory for presetting.
21. The capsule sends an authentication request, a device ID generated by the device ID circuit, and subsequently video data captured by a camera to the receiving device,
    The receiving device receives the authentication request and the device ID transmitted from the capsule, evaluates the device ID received in response to the authentication request and the device ID preset in the memory, and the both IDs are 21. The method for driving a camera system according to claim 20, wherein, if they are the same, the video data is received and processed.
22. When the receiving device performs authentication, it sends an authentication request to the capsule,
    The capsule transmits a device ID generated by the device ID circuit in response to an authentication request by the receiving device,
    The receiving device receives the device ID transmitted from the capsule in response to the authentication request, evaluates the received device ID and the device ID preset in the memory, and if both IDs are the same. Request the capsule to send video data,
    The driving method for a camera system according to claim 20, wherein the capsule transmits video data captured by a camera to the receiving device in response to a transmission request from the receiving device.
23. When performing data protection, the capsule sends video data and encoded data to the receiving device with a key,
    21. The driving method for a camera system according to claim 20, wherein the receiving device evaluates the received video data and the key based on a device ID preset in the memory to protect the integrity and reliability of the video data.
24. The capsule sends the encrypted video data to the receiving device with a key,
    The camera system driving method according to claim 20, wherein the receiving device decrypts the received encrypted video data with a key based on a device ID preset in the memory to protect the video data.
    

Images