Abstract:
An image generation apparatus (e.g., digital camera) is provided which has a calculation unit for executing a calculation process of generating verification data (digital signature or message authentication code (MAC)) of image data and a calculation process of generating verification data (digital signature or MAC) of addition information of the image data, and a function of creating one of first to third image files, the first image file containing verification data of the image data, the second image file containing verification data of the addition information, and the third image file containing verification data of the image data and verification data of the addition information. With the provision of such an image generation apparatus, it becomes possible to independently detect falsification of the image data and addition information.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    The present invention relates to an image generation apparatus, an image file generation method, an image verification apparatus, an image verification method and the like, capable of verifying whether addition information of an image data was falsified.  
           [0003]    2. Related Background Art  
           [0004]    Digital cameras are in practical use nowadays to digitalize an optical image of a subject and storing it.  
           [0005]    Although image data photographed with a digital camera can be easily loaded in a personal computer, there is a problem that the image data can also be falsified easily on the personal computer. Reliability of image data photographed with a digital camera is therefore lower than that of a silver salt photograph, resulting in an insufficient admissibility. To avoid this, a digital camera system has recently been proposed which has the function of adding a digital signature to image data photographed with a digital camera. Conventional digital camera systems are disclosed, e.g., in U.S. Pat. No. 5,499,294 and Japanese Patent Application Laid-Open No. 9-200730.  
           [0006]    A conventional digital camera system is, however, associated with a problem that a digital signature or Message Authentication Codes (MAC) of image data cannot be created independently from a digital signature or MAC of addition information of image data. It is therefore impossible to independently verify whether image data was falsified and whether addition information was falsified. A user cannot distinguish among whether image data was falsified, whether addition information of image data was falsified, and whether the image data and addition information were falsified.  
         SUMMARY OF THE INVENTION  
         [0007]    An object of the invention is to solve the above-described problems.  
           [0008]    Another object of the present invention solving the above-described problems is to provide an image generation apparatus, an image file generation method, a verification apparatus, an image verification method, a program and a storage medium, capable of independently verifying verification data (digital signature, MAC or the like) of image data and addition information of the image data to identify which data or information was falsified.  
           [0009]    An image generation apparatus according to a preferred embodiment of the invention comprises: image generating means for generating image data; verification data generating means for generating first verification data necessary for verifying whether the image data was falsified and second verification data necessary for verifying whether addition information of the image data was falsified; and image file generating means for generating an image file which contains the image data, the addition information, the first verification data and the second verification data.  
           [0010]    An image file generating method according to a preferred embodiment of the invention, comprises steps of: generating image data; generating first verification data necessary for verifying whether the image data was falsified and second verification data necessary for verifying whether addition information of the image data was falsified; and generating an image file which contains the image data, the addition information, the first verification data and the second verification data.  
           [0011]    An image verification apparatus according to a preferred embodiment of the invention, comprises: verifying means including a function of verifying whether image data was falsified, by using first verification data necessary for verifying whether the image data was modified and a function of verifying whether addition information of the image data was falsified, by using second verification data necessary for verifying whether the addition information of the image data was modified.  
           [0012]    An image verification method according to a preferred embodiment of the invention, comprises: a first verifying step of verifying whether image data was falsified, by using first verification data necessary for verifying whether the image data was modified; and a second step of verifying whether addition information of the image data was falsified, by using second verification data necessary for verifying whether the addition information of the image data was modified.  
           [0013]    Still other objects of the present invention, and the advantages thereof, will become fully apparent from the following detailed description of the embodiments. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0014]    [0014]FIG. 1 is a diagram illustrating an example of the structure of an image verification system according to an embodiment.  
         [0015]    [0015]FIG. 2 is a block diagram illustrating the main functional structure of an image generation apparatus  10  of the embodiment.  
         [0016]    [0016]FIG. 3 is a block diagram illustrating the main functional structure of a verification apparatus  20  of the embodiment.  
         [0017]    [0017]FIG. 4 is a block diagram illustrating the procedure to be performed by the image verification system of the embodiment. 
     
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0018]    Preferred embodiments of the invention will be described with reference to the accompanying drawing.  
         [0019]    [0019]FIG. 1 is a diagram illustrating an example of the structure of an image verification system according to a first embodiment. In the first embodiment, a digital signature of image data is used as verification data necessary for verifying whether image data was falsified.  
         [0020]    An image generation apparatus  10  has a function of generating image data of a subject and a function of executing a signature mode A, B or C.  
         [0021]    In the signature mode A, an image file having a digital signature of a first type is generated (hereinafter called an image file A). An image file A contains data such as image data, addition information of the image data, a digital signature for the image data and a peculiar ID of the image generation apparatus  10 .  
         [0022]    In the signature mode B, an image file having a digital signature of a second type is generated (hereinafter called an image file B). An image file B contains data such as image data, addition information of the image data, a digital signature for the addition information and the peculiar ID of the image generation apparatus  10 .  
         [0023]    In the signature mode C, an image file having a digital signature of a third type is generated (hereinafter called an image file C). An image file C contains data such as image data, addition information of the image data, a digital signature for the image data, a digital signature of the addition information and the peculiar ID of the image generation apparatus  10 .  
         [0024]    The image generation apparatus  10  may be an image pickup apparatus such as a digital camera, a digital video camera and a scanner, or an apparatus with a camera unit. Alternatively, it may be an apparatus such as a facsimile apparatus and a copy apparatus with an image reading unit.  
         [0025]    A verification apparatus  20  has a function of executing a verification mode A, B or C.  
         [0026]    In the verification mode A, it is verified whether image data was falsified. In the verification mode A, the verification apparatus  20  can verify image data of the image file A or C.  
         [0027]    In the verification mode B, it is verified whether addition information of the image data was falsified. In the verification mode B, the verification apparatus  20  can verify addition information of the image file B or C.  
         [0028]    In the verification mode C, it is verified whether image data was falsified and whether addition information of the image data was falsified. In the verification mode C, the verification apparatus  20  can verify image data and addition information of the image file C.  
         [0029]    The verification apparatus  20  may be an information processing apparatus such as a personal computer.  
         [0030]    [0030]FIG. 2 is a block diagram illustrating the main functional structure of the image generation apparatus  10  of the embodiment.  
         [0031]    In FIG. 2, reference numeral  201  represents an image generation unit for generating image data I of a subject, the image generation unit having a micro processor and the like for controlling an optical system and an optical sensor such as charge coupled devices (CCDs).  
         [0032]    Reference numeral  202  represents an addition information generation unit for generating addition information to be added to the image data I. This addition information contains information on the image data I and/or information on the image generation apparatus  10 . Specifically, the addition information includes a date (year, month, day and time) when the image data I is generated, a data size of image data, a contrast, a distance to the subject, a shutter speed, an aperture value, a manufacture number, information on a lens unit, presence/absence of an electronic flush, a photometry method, an exposure control method, an owner, a version of firmware, and the like.  
         [0033]    Reference numeral  203  represents a memory for storing secret information Ks. This secret information Ks corresponds to information on a secret key of a public key cryptographic scheme (such as RSA cryptographic scheme).  
         [0034]    Reference numeral  204  represents a calculation unit which executes first and second calculation processes. The first calculation process generates a Hash value (also called a message digest or digest data) H 11  of image data I by using a Hash function HF. The second calculation process converts the Hash value H 11  generated by the first calculation process into a digital signature A, by using secret information Ks read from the memory  203 . The first and second calculation processes are executed while the image generation apparatus  10  is in the signature mode A or C.  
         [0035]    The calculation unit  204  also executes third and fourth calculation processes. The third calculation process generates a Hash value H 21  of addition information of the image data I by using the Hash function HF. The fourth calculation process converts the Hash value H 21  generated by the third calculation process into a digital signature B, by using the secret information Ks read from the memory  203 . The third and fourth calculation processes are executed while the image generation apparatus  10  is in the signature mode B or C.  
         [0036]    The Hash function HF may be any one of MD-2, MD-5, SHA-1, RIPEMD-128 and RIPEMD-160 or another Hash function.  
         [0037]    Reference numeral  205  represents a memory for storing the peculiar ID (such as a manufacture number and a serial number of the image generation apparatus  10 ) which is information specific to the image generation apparatus.  
         [0038]    Reference numeral  206  represents an image file generation unit for generating the image file A, B or C. The file format of each image file may be any one of a JPEG File Interchange Format (JFIF), a Tagged Image File Format (TIFF) and a Graphics Interchange Format (GIF) or another image file format.  
         [0039]    Reference numeral  207  represents a removable storage medium for storing the image files A, B and C. The removable storage medium  207  may be a magnetic disk, an optical disk, a memory card or the like.  
         [0040]    Reference numeral  208  represents a media control unit having a function of writing the image file A, B or C into the removable medium  207  and a function of reading the image file A, B or C from the removable medium  207 .  
         [0041]    Reference numeral  209  represents an interface unit having a function of transmitting the image file A, B or C stored in the removable medium  207  to the verification apparatus  20 .  
         [0042]    Reference numeral  210  represents an operation unit having switches for instructing to generate image data of a subject, photograph the subject, and read the image data, selection switches for selecting one of the signature modes A, B and C and the like. The selection switches may be realized by a graphical user interface such as a menu screen  
         [0043]    Reference numeral  211  represents a control unit for controlling the operation of each portion of the image generation apparatus  10 . The control unit  211  has a memory and a micro computer for executing a control program stored in the memory. The memory of the control unit  211  stores the control program to control the procedure to be executed by the image generation apparatus  10  to be described with reference to FIG. 4.  
         [0044]    [0044]FIG. 3 is a block diagram illustrating the main functional structure of a verification apparatus  20  of the embodiment.  
         [0045]    Reference numeral  301  represents a media control unit having a function of reading the image file A, B or C from the removable medium  207 .  
         [0046]    Reference numeral  309  represents an interface unit having a function of receiving the image file A, B or C transmitted from the image generation apparatus  10 .  
         [0047]    Reference numeral  302  represents a storage unit for storing the image file A, B or C supplied from the media control unit  301  or interface unit  309 .  
         [0048]    Reference numeral  304  represents a memory for storing a plurality of peculiar IDs and public information Kp corresponding to each peculiar ID. The public information Kp corresponds to the secret information Ks and to the public ky of the public key cryptographic scheme (such as RSA cryptographic scheme).  
         [0049]    Reference numeral  305  represents a calculation unit which executes first and second calculation processes. The first calculation process converts the digital signature A into a Hash value H 12  by using the public information Kp. The second calculation process generates a Hash value H 13  of the image data I by using the Hash function HF. The first and second calculation processes are executed while the verification apparatus  20  is in the signature mode A or C.  
         [0050]    The calculation unit  305  also executes third and fourth calculation processes. The third calculation process converts the digital signature B into a Hash value H 22  by using the public information Kp. The fourth calculation process generates a Hash value H 23  of addition information of the image data I by using the Hash function HF. The third and fourth calculation processes are executed while the verification apparatus  20  is in the signature mode B or C.  
         [0051]    Reference numeral  306  represents a verification unit having a function of verifying image data I and/or addition information of the image data I. In the verification mode A of the verification apparatus  20 , the verification unit  306  verifies the image data I contained in the image file A or C. In the verification mode B of the verification apparatus  20 , the verification unit  306  verifies addition information of the image data I contained in the image file B or C. In the verification mode C of the verification apparatus  20 , the verification unit  306  verifies independently the image data contained in the image file I and the addition information of the image data I.  
         [0052]    Reference numeral  307  represents a display unit for displaying information representative of verification results given by the verification unit  306 .  
         [0053]    Reference numeral  308  represents a control unit for controlling the operation of each portion of the verification apparatus  20 . The control unit  308  has a memory and a micro computer for executing a control program stored in the memory. The memory of the control unit  308  stores the control program to control the procedure to be executed by the verification apparatus  20  to be described with reference to FIG. 4.  
         [0054]    [0054]FIG. 4 is a block diagram illustrating the procedure to be performed by the image verification system of the embodiment.  
         [0055]    Step S 401 : In response to a user operation, the image generation unit  201  generates image data I of a subject. If the image generation apparatus  10  is in the signature mode A or C, the image data I is supplied to the calculation unit  204  and image file generation unit  206 . If the image generation apparatus  10  is in the signature mode B, the image data I is supplied to the image file generation unit  206 .  
         [0056]    Step S 402 : The calculation unit  204  generates the Hash value H 11  of the image data I by using the Hash function HF. This Step is not executed if the image generation apparatus  10  is in the signature mode B.  
         [0057]    Step S 403 : The calculation unit  204  converts the Hash value H 11  into the digital signature A by using the secret information Ks stored in the memory  203 . The calculation unit  204  supplies the digital signature A to the image file generation unit  206 . This Step is not executed if the image generation apparatus  10  is in the signature mode B.  
         [0058]    Step S 404 : The addition information generation unit  202  generates addition information of the image data I. If the image generation apparatus  10  is in the signature mode A, the addition information of the image data I is supplied to the image file generation unit  206 . If the image generation apparatus  10  is in the signature mode B or C, the addition information of the image data I is supplied to the calculation unit  204  and image file generation unit  206 .  
         [0059]    Step S 405 : The calculation unit  204  generates the Hash value H 21  of the image data I by using the Hash function HF. This Step is not executed if the image generation apparatus  10  is in the signature mode A.  
         [0060]    Step S 406 : The calculation unit  204  converts the Hash value H 21  into the digital signature B by using the secret information Ks stored in the memory  203 . This Step is not executed if the image generation apparatus  10  is in the signature mode A.  
         [0061]    Step S 407 : The image file generation unit  206  generates the image file A, B or C. If the image generation apparatus  10  is in the signature mode A, the image file generation unit  206  generates the image file A. This image file A contains data such as the image data I, digital signature A, addition information of the image data I and peculiar ID of the image generation apparatus  10 . If the image generation apparatus  10  is in the signature mode B, the image file generation unit  206  generates the image file B. This image file B contains data such as the image data I, digital signature B, addition information of the image data I and peculiar ID of the image generation apparatus  10 . If the image generation apparatus  10  is in the signature mode C, the image file generation unit  206  generates the image file C. This image file C contains data such as the image data I, digital signature A, addition information of the image data I, digital signature B and peculiar ID of the image generation apparatus  10 . The image file A, B or C generated by the image file generation unit  206  is written in the removable medium  207 .  
         [0062]    Step S 408 : The user inputs the image file A, B or C stored in the removable medium  207  to the verification apparatus  20  via the removable medium  207  or interface unit  209 . If the image file is to be input via the removal medium  207 , the media control unit  301  reads the image file A, B or C from the removable medium  207  and stores it in the storage unit  302 . If the image file is to be input via the interface unit  209 , the interface unit  209  receives the image file A, B or C transmitted from the image generation apparatus  10  and stores it in the storage unit  302 .  
         [0063]    Step S 409 : If the verification apparatus  20  is in the verification mode A or C, the verification apparatus  20  executes the processes from Step S 409  to Step S 411 . First, the calculation unit  305  derives the image data I, peculiar ID and digital signature A from the image file A or C, and acquires the public information Kp corresponding to the peculiar ID from the memory  304 . Next, the calculation unit  305  converts the digital signature A into the Hash value H 12  by using the public information Kp acquired from the memory  304 .  
         [0064]    Step S 410 : The calculation unit  305  generates the Hash value H 13  of the image data I by using the Hash function HF.  
         [0065]    Step S 411 : The verification unit  306  compares the Hash value H 12  obtained at Step S 409  with the Hash value H 13  obtained at Step S 410  to thereby verify whether the image data I was falsified.  
         [0066]    If the two Hash values are equal (i.e., perfectness of the image data I can be verified correctly), the verification unit  306  detects that the image data I was not falsified. At the same time, the verification unit  306  detects that the image data I was generated at the image generation apparatus  10 . The verification apparatus  20  displays on the display unit  307  the information representative of that the image data I was not falsified.  
         [0067]    If the two Hash values are not equal (i.e., perfectness of the image data I cannot be verified correctly), the verification unit  306  detects that the image data I was falsified. The verification apparatus  20  displays on the display unit  307  the information representative of that the image data I was falsified.  
         [0068]    Step S 412 : If the verification apparatus  20  is in the verification mode B or C, the verification apparatus  20  executes the processes from Step S 412  to Step S 414 . First, the calculation unit  305  derives the addition information of the image data I, peculiar ID and digital signature B from the image file A or C, and acquires the public information Kp corresponding to the peculiar ID from the memory  304 . Next, the calculation unit  305  converts the digital signature B into the Hash value H 22  by using the public information Kp acquired from the memory  304 .  
         [0069]    Step S 413 : The calculation unit  305  generates the Hash value H 23  of the image data I by using the Hash function HF.  
         [0070]    Step S 414 : The verification unit  306  compares the Hash value H 22  obtained at Step S 412  with the Hash value H 23  obtained at Step S 413  to thereby verify whether the addition information of the image data I was falsified.  
         [0071]    If the two Hash values are equal (i.e., perfectness of the addition information of the image data I can be verified correctly), the verification unit  306  detects that the addition information of the image data I was not falsified. At the same time, the verification unit  306  detects that the addition information of the image data I was generated at the image generation apparatus  10 . The verification apparatus  20  displays on the display unit  307  the information representative of that the addition information of the image data I was not falsified.  
         [0072]    If the two Hash values are not equal (i.e., perfectness of the addition information of the image data I cannot be verified correctly), the verification unit  306  detects that the addition information of the image data I was falsified. The verification apparatus  20  displays on the display unit  307  the information representative of that the addition information of the image data I was falsified.  
         [0073]    As described above, according to the image verification system of this embodiment, it is possible to create the image file which contains the digital signature of image data and/or the digital signature of addition information. It is therefore possible to independently verify whether the image data was falsified and whether the addition information was falsified.  
         [0074]    Furthermore, according to the image verification system of this embodiment, it is possible to create the image file which contains the digital signature of image data and/or the digital signature of addition information. It is therefore possible to distinguish between whether the image data was falsified, whether the addition information was falsified and whether the image data and addition information were falsified.  
         [0075]    In this embodiment, the image verification system has been described which uses the digital signature of image data and/or the digital signature of addition information as the verification data of the image data and/or addition information. The invention is applicable to other different systems. For example, the invention is applicable to the system which uses MAC (Message Authentication Codes) of image data and/or MAC of addition information as the verification data of the image data and/or addition information. In this case, the secret information Ks corresponds to a common key of the common key cryptographic scheme which is necessary for generation and verification of MAC. Since calculations necessary for generation and verification of verification data become simple, the process speed of the system can be speeded up and the system cost can be lowered.  
         [0076]    The embodiment may be realized by making a computer to execute program codes providing the embodiment functions. Embodiments of the invention may include means for supplying such program codes to a computer, e.g., a storage medium such as a CD-ROM storing such program codes, a transmission medium such as the Internet transmitting such program codes, and the like. The program codes, recording media and transmission media are intended to fall within the scope of the invention. Storage media may be a flexible disk, a hard disk, an optical disk, a magneto optical disk, a CD-ROM, a magnetic tape, a non-volatile memory card, a ROM and the like.  
         [0077]    The above-described embodiments are merely exemplary of this invention, and are not be construed to limit the scope of the present invention.  
         [0078]    The scope of the present invention is defined by the scope of the appended claims, and is not limited to only the specific descriptions in this specification. Furthermore, all the modifications and changes belonging to equivalents of the claims are considered to fall within the scope of the present invention.