Image processing apparatus and image processing method

An apparatus generates additional data used to check whether an encoded digital image is changed or not. The apparatus includes a calculation unit and a recording unit. The calculation unit (a) performs a predetermined calculation using the encoded digital image and confidential information and (b) generates the additional data by applying a one-way function to a result of the predetermined calculation. The recording unit records both the encoded digital image and the additional data on a recording medium. The confidential information includes (a) first information unique to the apparatus, and (b) second information unique to an external apparatus connected to the apparatus.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to image processing apparatuses and image processing methods, and more particularly, to a technology for protecting the copyright of digital image information.

2. Description of the Related Art

Image input apparatuses, such as digital cameras, for recording images in a recording medium as digital data, rather than in photographic paper or 8-mm film, have recently become commercially available.

In general, digital data can be easily processed, unlike analog data, and therefore can be readily modified, falsified, forged, or synthesized. Consequently, digital data has lower authentication than conventional film (silver halide) photographs and is difficult to be used as a proof.

To solve the foregoing problem, there has been proposed a technology for detecting modification, falsification, forgery, and synthesis of digital data. For example, a system employing a hash function and a public-key encryption method has been proposed.

A conventional system will be described below by referring toFIG. 1. The public-key encryption method uses a private key and a public key different from each other, makes the public key public, and maintains the private key confidential.

The structure and operation of a transmission side (output side) will be described first.

(1) Digital data M is compressed with the use of a hash function H to obtain a constant-length output h.

(2) Data h is processed with the use of a private key Ke to obtain an output s. This output s is called the digital signature data.

(3) An output circuit outputs the digital signature data s and the digital data M as a set.

The structure and operation of a receiving side (detection side) will be described next.

(4) The digital data M and the corresponding digital signature data s are input.

(5) The digital signature data s is processed with the use of the public key Kd corresponding to the private key Ke to obtain an output h″.

(6) The digital data M is compressed with the use of the same hash function H as that used in the transmission side to obtain an output h′.

(7) A comparison circuit compares the output h″ obtained in (5) with the output h′ obtained in (6). When they match, it is determined that the input digital data M is correct data to which illegitimate processing is not applied. If they do not match, it is determined that illegitimate processing has been applied to the input digital data M.

As described above, in the conventional system, modification, falsification, forgery, and synthesis of the digital data M are detected by the use of the digital signature data s, which is generated by the hash function H and the private key Ke.

This system, however, has the following drawbacks.

An encryption circuit and a decryption circuit used in the public-key cryptosystem have complicated circuit structures and are difficult to be made compact. In addition, a vast amount of calculations is required in the circuits and the processing time is long. Since the public-key encryption method needs calculations of powers and remainders, its calculations are more complicated and enormous than those required for the secret-key cryptosystem (an encryption method in which an encryption key is the same as a decryption key) and therefore it is very difficult to increase the processing speed. In other words, in the conventional system, it is difficult to achieve fast processing and to make the system compact.

To increase the processing speed, it is necessary to use a higher-performance central processing unit (CPU) and a larger-capacity memory to improve the performance of hardware. With such a structure, however, the entire system becomes large and its cost increases. A compact, inexpensive, high-speed system cannot be provided for the user.

SUMMARY OF THE INVENTION

Accordingly, an object of the present invention to solve the above-described drawbacks.

Another object of the present invention is to provide a technology which allows the copyright of digital data to be protected with a simple structure at low cost and safety.

As a preferred embodiment for such objects, the present invention discloses an image processing apparatus including calculation means for performing a predetermined calculation with the use of a digital image and confidential information; and generation means for generating signature data with the use of an output of the calculation means in order to detect illegitimate processing applied to the digital image.

As another preferred embodiment for such objects, the present invention discloses an image processing apparatus including input means for inputting a digital image and signature data used for detecting illegitimate processing applied to the digital image; calculation means for performing a predetermined calculation with the use of the digital image and confidential information; and detecting means for detecting illegitimate processing applied to the digital image, with the use of the signature data and a result of the predetermined calculation.

As still another embodiment for such objects, the present invention discloses an image processing method including the steps of performing a predetermined calculation with the use of a digital image and confidential information; and generating signature data with the use of a result of the predetermined calculation in order to detect illegitimate processing applied to the digital image.

As yet another embodiment for such objects, the present invention discloses an image processing method including the steps of inputting a digital image and signature data used for detecting illegitimate processing applied to the digital image; performing a predetermined calculation with the use of the digital image and confidential information; and detecting illegitimate processing applied to the digital image according to the signature data and a result of the predetermined calculation.

As still yet another embodiment for such objects, the present invention discloses an image processing method including the steps of performing a predetermined calculation with the use of a digital image and confidential information; generating signature data with the use of a result of the predetermined calculation in order to detect illegitimate processing applied to the digital image; externally outputting the digital image and the signature data; externally inputting the digital image and the signature data; performing the predetermined calculation with the use of the digital image and the confidential information; and detecting illegitimate processing applied to the digital image, with the use of the signature data and a result of the predetermined calculation.

As a further embodiment for such objects, the present invention discloses an image processing apparatus including calculation means for performing a predetermined calculation with the use of a digital image and confidential information; and generation means for generating signature data with the use of an output of the calculation means in order to determine whether the digital image has been modified.

As a still further embodiment for such objects, the present invention discloses an image processing apparatus including input means for inputting a digital image and signature data used for determining whether the digital image has been modified; calculation means for performing a predetermined calculation with the use of the digital image and confidential information; and detecting means for determining with the use of the signature data and an output of the calculation means whether the digital image has been modified.

As a yet further embodiment for such objects, the present invention discloses an image processing method including the steps of performing a predetermined calculation with the use of a digital image and confidential information; and generating signature data with the use of a result of the predetermined calculation in order to determine whether the digital image has been modified.

As a still yet further embodiment for such objects, the present invention discloses an image processing method including the steps of inputting a digital image and signature data used for determining whether the digital image has been modified; performing a predetermined calculation with the use of the digital image and confidential information; and determining according to the signature data and a result of the predetermined calculation whether the digital image has been modified.

As a still more further embodiment for such objects, the present invention discloses an image processing method including the steps of performing a predetermined calculation with the use of a digital image and confidential information; generating signature data with the use of a result of the predetermined calculation in order to determine whether the digital image has been modified; externally outputting the digital image and the signature data; externally inputting the digital image and the signature data; performing the predetermined calculation with the use of the digital image and the confidential information; and determining with the use of the signature data and a result of the predetermined calculation whether the digital image has been modified.

Still other objects of the present invention and advantages thereof will become fully apparent from the following detailed description of embodiments.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Preferred embodiments of the present invention will be described below in detail by referring to the accompanying drawings.

The basic structure and processing procedure of a digital image verification system common to all embodiments will be described below by referring toFIG. 2. This system is formed of a digital image input apparatus10for generating digital signature data from digital image data, and an image verification apparatus20for detecting, with the use of the digital signature data, illegitimate processing applied to the digital image data. The apparatuses are connected through a network, such as the Internet, a telephone line network, or a mobile communication network; an identical digital interface of each apparatus; and/or a removable storage medium, such as an optical disk, a magnetic disk, a magneto-optical disk, and a semiconductor memory.

InFIG. 2, the image input apparatus10and the image verification apparatus20share identical confidential information S12,22. The confidential information S12,22is recorded into a read-only recording medium, and controlled so as to be kept confidential.

The image input apparatus10generates digital signature data h13from digital image data P11and the confidential information S12. More specifically, the image input apparatus10applies a predetermined operation, such as addition, multiplication, or synthesis, to the digital image data P11with the use of the confidential information S12, applies a one-way function, for which it is difficult or impossible to generate an inverted function, such as a hash function, to the operation result, and generates the digital signature data h13from the function result. The digital signature data h13is temporarily recorded together with the corresponding digital image data P11, and output to the outside, if necessary.

The digital signature data h13, obtained by such processing, is information unique to the digital image data P11and the confidential information S12. Therefore, without knowing the confidential information S12and the predetermined operation, the digital signature data h13corresponding to the digital image data P11cannot be produced illegitimately. Therefore, the integrity of the digital image data P11can be verified according to the digital signature data h13in a safe condition. In addition, due to the nature of the one-way function, the original data, that is, the digital image data P11to which the predetermined operation has been applied with the use of the confidential data S12, cannot be obtained from the digital signature data h13. Therefore, the integrity of the digital image data P11can be verified according to the digital signature data h13in a safe condition.

The image verification apparatus20receives digital signature data h′23together with digital image data P′ 21 from the outside. The image verification apparatus20performs the same processing as the image input apparatus10with the use of the digital image data P′ 21 and confidential information S22(the same as the confidential information S12) to generate digital signature data h″24.

The digital signature data h″24is compared with the digital signature data h′23, which has been received together with the digital image data P′21. When they match, the image verification apparatus20determines that the digital image data P′21is data that has integrity. They do not match if illegitimate processing has been applied to the digital image data P′21before it is received. In this case, the image verification apparatus20determines that the digital image data P′21is illegitimately processed data.

With this procedure, the image verification apparatus20determines whether illegitimate processing, such as modification, falsification, forgery, or synthesis, has been applied to the digital image data P′21received from the outside.

As described above, according to the present invention, digital signature data is generated at a high speed with a small amount of calculations in a simple, inexpensive circuit structure, without using a complicated encryption technology, such as a public-key encryption method. The copyright of digital image data is protected by the use of digital signature data. Illegitimate processing, such as modification, falsification, forgery, or synthesis, applied to digital image data is positively detected.

The basic structures of the image input apparatus10and the image verification apparatus20will be described next in detail.

(1) Structure of the Image Input Apparatus

FIG. 3is a block diagram of the input image apparatus10. The image input apparatus10is an electronic unit having an image pickup function, such as a digital camera, a digital camcorder, or a scanner.

InFIG. 3, an image pickup section201includes a charge coupled device (CCD) and a lens. It converts an optical image of an object to an electric signal, and further converts the electric signal to digital image data having a predetermined format. A work memory202temporarily stores the digital image data, and is used for highly efficient encoding processing for the digital image data and for generating digital signature data, described later.

A recording and reproduction section203records the digital image data generated by the image pickup section201and encoded highly efficiently, and the corresponding digital signature data into a removable recording medium, such as an optical disk, a magnetic disk, a magneto-optical disk, or a semiconductor memory, as a set. A driving section204controls the mechanical operations of the image pickup section201and the recording and reproduction section203.

An external interface section205is a digital interface which can connect to a network, such as the Internet, a telephone line network, or a mobile communication network. It sends the digital image data to which the digital signature data is added to a predetermined external apparatus.

A control/calculation section206includes a control circuit210for controlling the operation of the entire image input apparatus10according to various programs stored in a ROM207, an image processing circuit211for applying highly efficient encoding (for example, variable-length encoding by quantizing digital image data DCT transformed or wavelet transformed) to the digital image data, a calculation circuit212for performing various types of calculation processing such as a hash-function calculation required to generate digital signature data, described later, a memory213for storing confidential information (for example, ID information for identifying the image input apparatus10) required for generating the digital signature data, and a random-number generation circuit214for generating random numbers necessary for the calculation circuit212.

The ROM207is a read-only memory and stores programs, such as a program for controlling the operation of the entire image input apparatus10, a program for controlling image processing, and a program for controlling the generation processing of digital signature data. An operation section208receives various instructions from the user and sends control signals corresponding to the instructions to the control/calculation section206.

(2) Structure of the Image Verification Apparatus

FIG. 4is a block diagram of the image verification apparatus20. The image verification apparatus20is an image processing apparatus, such as a personal computer or a workstation, or an extension board which can be connected thereto.

InFIG. 4, an external interface section301is a digital interface through which digital image data (which has been highly efficiently encoded) to which digital signature data is added is input from a network. The external interface section301can be connected to a removable recording medium. When connected, digital image data recorded in the recording medium is input together with digital signature data through the external interface section301.

A work memory302temporarily stores digital image data, and is used for decompression decoding processing of digital image data and for generating digital signature data, described later.

A control/calculation section303includes a control circuit310for controlling the operation of the entire image verification apparatus20according to various programs stored in a ROM305, an image processing circuit311for applying decompression decoding (for example, applying variable-length decoding, dequantization, and then inverted DCT transform or inverted wavelet transform) to digital image data, a calculation circuit312for performing a hash-function calculation required to generate digital signature data, described later, and for performing calculation processing for verifying the digital image data, a memory313for storing confidential information required to generate the digital signature data, and a random-number generation circuit314for generating random numbers required for the calculation circuit312.

The ROM305is a read-only memory and stores programs, such as a program for controlling the operation of the entire image verification apparatus20, a program for controlling image processing, and a program for controlling the verification processing of digital image data. An operation section306receives various instructions from the user and sends control signals corresponding to the instructions to the control/calculation section303.

In first to sixth embodiments described below, procedures for generating digital signature data according to digital image data and confidential information in the image input apparatus10shown inFIG. 3will be described in detail.

In seventh to twelfth embodiments described below, procedures for verifying the integrity of digital image data in the image verification apparatus20shown inFIG. 4according to digital signature data generated by the image input apparatus10will be described in detail.

First Embodiment

In a first embodiment, a procedure by which the image input apparatus10generates digital signature data h with the use of confidential information S unique to the apparatus and a hash function will be described. More specifically, a predetermined calculation is performed with the use of digital image data P and the confidential information S, a hash function is applied to the result of the predetermined calculation, and the result of this calculation serves as the digital signature data h corresponding to the digital image data P.

FIG. 5is a flowchart showing a processing procedure according to the first embodiment. A procedure for generating the digital signature data h will be described below by referring toFIG. 5.

In a step S401, the operation section208instructs that an optical image of an object be captured, or does not instruct anything. When image capturing is instructed, the control/calculation section206executes a step S402.

In the step S402, the image pickup section201converts an optical image of the object to an electric signal and further converts the electric signal to generate digital image data P having a predetermined format. The digital image data P is then stored in the working memory202.

In a step S403, the control/calculation section206(actually, the image processing circuit211included therein) applies highly efficient encoding to the digital image data P stored in the working memory202in units of screens of still pictures. To highly efficiently encode a still picture, a DCT transform method (specifically, DCT transform, quantization, and variable-length encoding are applied in units of blocks formed of a plurality of pixels), a wavelet transform method (specifically, wavelet transform, quantization, and variable-length encoding are applied in units of blocks formed of a plurality of pixels), a JPEG method, a JBIG method, an MH method, an MMR method, or an MPEG method may be used. In the present and following embodiments, the JPEG method is used for highly efficient encoding.

In a step S404, the control/calculation section206reads the confidential information S, which is in the image input apparatus10, from the memory213.

In a step S405, the control/calculation section206(actually, the calculation circuit212included therein) performs the predetermined calculation based on a rule specified in advance, with the use of the confidential information S and the digital image data P (hereinafter called JPEG data) highly efficiently encoded by the JPEG method.

The confidential information S and the predetermined calculation will be described below.

The confidential information S is information specified when the image input apparatus10is manufactured and is unique thereto, and is not made public. The confidential information S is placed inside the control/calculation section206so as not to be easily accessible from the outside. In the first embodiment, it is assumed that the confidential information S is set to “11111111.”

The predetermined calculation will be described below by referring toFIG. 6. In the predetermined calculation, byte data is selected at a predetermined position in a JPEG data string, and exclusive-OR is applied to the byte data and the confidential information S in units of bits to convert the byte data to other data. The predetermined position can be set to any position in the JPEG data string. In the first embodiment, it is set to the most significant byte.

In a step S406, the control/calculation section206(actually, the calculation circuit212included therein) applies a hash function to the JPEG data to which the predetermined calculation has been applied, to generate digital signature data h.

The hash function will be described below.

The hash function H generates an output h having a constant bit length from digital data M having a variable bit length. The output h is called a hash value (also called a digital signature, a message digest, or a digital fingerprint). In general, the hash function is required to be a one-way function and immune to collision. To be a one-way function means that, when a hash value h is given, it is difficult, in terms of the amount of calculations required, to calculate digital data M which satisfies h=H(M). Immunity to collision means that, when digital data M is given, it is difficult, in terms of the amount of calculations required, to calculate digital data M′ (M≠M′) which satisfies H(M)=H(M′) and it is also difficult, in terms of the amount of calculations required, to calculate digital data M and M′ which satisfies H(M)=H(M′) and M≠M′. MD-2, MD-4, MD-5, SHA-1, RIPEMD-128, and RIPEMD-160 are known as Hash functions. In the first embodiment, the MD-5 method is used. Digital signature data generated by the MD-5 method has a bit length of 128.

In a step S407, the recording and reproduction section203records the digital signature data generated by the control/calculation section206and the corresponding digital image data into a removable recording medium or outputs them to an apparatus through the network.

A program for controlling the processing procedure shown inFIG. 5is stored in the ROM207. This program is read by the control/calculation section206(actually, the control circuit210included therein) and activated every time the user instructs image capturing. Therefore, every time a digital image P is captured, the corresponding digital signature data h is generated.

As described above, in the first embodiment, the predetermined calculation is performed with the use of the highly efficiently encoded digital image data P and the confidential information S unique to the image input apparatus10, the hash function is applied to the result of the predetermined calculation to generate the digital signature data h. With this structure, highly reliable, highly safe digital signature data h is obtained with a structure much simpler than that of the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing than in the conventional system can also be achieved.

As a result, without obtaining the confidential information S and the predetermined calculation, the digital signature data h corresponding to the digital image data P cannot be generated illegitimately. Therefore, the integrity of the digital image data P is safely verified according to the digital signature data h. In addition, due to the nature of the one-way function, since the original data, that is, the digital image data P to which the predetermined calculation is applied with the use of the confidential data S, cannot be obtained from the digital signature data h, the integrity of the digital image data P is verified from the digital signature data h in a safe condition.

In the first embodiment, the confidential information S is specified when the image input apparatus10is manufactured. The present invention is not limited to this case. The confidential information S may be shared with the image verification apparatus20. Alternatively, the confidential information S may be a bit string generated by the random-number generation circuit214according to a predetermined algorithm.

In the first embodiment, exclusive-OR calculation of the confidential information and the byte data of the JPEG data is described as an example of the predetermined calculation. The present invention is not limited to this case. The predetermined calculation may be any calculation in which the confidential information S is added to, combined with, or multiplexed with a part of the highly-efficiently encoded digital image data and for which an inverted calculation is allowed.

In the first embodiment, the digital image data P and the digital signature data h are generated with the same timing. The present invention is not limited to this case. When the digital signature data h is always generated before the digital image data P is output from the image input apparatus10to the outside, the digital signature data h may be generated with any timing. When the digital image data P is output to the outside through the external interface section205, for example, the digital signature data h may be generated after the digital image data P is temporarily stored in a recording medium and before the digital image data P is output to the outside. When the digital image data P is stored in a removable recording medium, the digital signature data h is generated by the above-described procedure.

Second Embodiment

In a second embodiment, a procedure for generating safer digital signature data h than in the first embodiment will be described in detail.

FIG. 7is a flowchart showing a processing procedure in the second embodiment. The procedure for generating digital signature data h will be described below by referring toFIG. 7.

Since processes in steps S601to S603are the same as those in steps the S401to S403in the first embodiment, a description thereof will be omitted.

In a step S604, the control/calculation section206(actually, the random-number generation circuit214included therein) generates a random number R having a bit length of m according to predetermined information (for example, the amount of highly-efficiently-encoded digital image data P). This random number R serves as confidential information S in the second embodiment.

In steps S605to S606, a predetermined calculation is performed in the second embodiment.

Specifically, in the step S605, the control/calculation section206(actually, the calculation circuit212included therein) divides JPEG data of one image into blocks Di (i=1, 2, 3, . . . , n) each having a predetermined size (for example, a bit length of 128), as shown inFIG. 8. It is assumed that D1is the most significant block. When the total amount of the JPEG data is not a multiple of 128 bits, data is padded for the JPEG data so that it has a bit length of a multiple of 128. As shown inFIG. 8, for example, “000 . . . 000” is added to the last block.

In the step S606, the control/calculation section206(actually, the calculation circuit212included therein) performs calculation by a procedure described below with the use of the random number R and the n blocks.

The control/calculation section206sets the number of bits in the random number to n (the same as the number of blocks Di shown inFIG. 7), as shown inFIG. 9. When n is not larger than m, for example, a bit string from the most significant bit to the n-th bit is set effective and the other bits are discarded. When n is larger than m, “111 . . . 111” is added as data for padding the random number R.

The control/calculation section206performs a predetermined calculation with the use of each of the blocks D1to Dn and each bit of the random number R, R1to Rn, as shown inFIG. 10. Specifically, exclusive-OR calculation is applied to the bit Ri of the random number R and the least significant bit of the block Di, and this calculation is repeated for i=1 to n.

The calculation in the step S606is, as described above, exclusive-OR between the bit Ri of the random number R and the least significant bit of the block Di. The present invention is not limited to this case. The calculation can be any calculation in which confidential information (a part of the random number R having a bit length of m) is added to, combined with, or multiplexed with a part of each block Di and for which an inverted calculation is allowed.

In a step S607, the control/calculation section206(actually, the calculation circuit212included therein) applies a hash function to the output of the step S606to generate digital signature data h. In the second embodiment, the MD-5 hash function is used in the same way as in the first embodiment. Therefore, the bit length of the digital signature data h is 128.

An example of the calculation processing executed in the step S607will be described in detail.

The control/calculation section206selects one or a plurality of blocks among the output of the step S606. Then, the control/calculation section206applies a hash function to the selected block(s) to generate digital signature data h.

Another example of the calculation processing executed in the steps S605to S607will be described below in detail by referring toFIGS. 11 to 13.

The control/calculation section206selects any one of three operation modes, described later, or combines them to obtain a hash value. Especially in the first mode and the third mode, since the hash value is obtained while a calculation result for a block (having K bits) affects a calculation result for another block, safer digital signature data h is generated. In addition, since a calculation result for the current block affects a calculation result for the next block, the integrity of data can be checked in each block.

(1) First Operation Mode

A first operation mode will be described below by referring toFIG. 11.FIG. 11is a block diagram of a part of the control/calculation section206.

InFIG. 11, the calculation circuit212is formed of a hash-function circuit1001for performing a hash-function calculation in units of predetermined bits, a register1002for storing a part of the output h (K bits) of the hash-function circuit1001, a calculation circuit1003for dividing the JPEG data into blocks each having K bits, and a calculation circuit1004for applying exclusive-OR calculation to the output of the calculation circuit1003and the output of the register1002.

A part of the 128-bit hash value h (K bits), which is the output of the hash-function circuit1001, is input to the register1002. The register1002temporarily stores, for example, the higher 64 bits of the hash value h.

The K bits stored in the register1002are exclusive ORed with one block of the JPEG data, and the calculation result is sent to the hash-function circuit1001.

The above operation is repeated until a predetermined block is reached. The hash value obtained from the predetermined block is output as digital signature data.

In the first calculation, an initial value needs to be stored in the register1002. The lower 64 bits of the random number R, for example, can be used as an initial value, as shown inFIG. 14.

If the size of a block Di is not a multiple of K bits, the remaining bit string may be calculated, for example, in a combination of the first operation mode and a third operation mode, described later.

(2) Second Operation Mode

A second operation mode will be described below by referring toFIG. 12.FIG. 12is a block diagram of a part of the control/calculation section206.

InFIG. 12, the calculation circuit212is formed of a hash-function circuit1101for performing a hash-function calculation in units of predetermined bits, a register1102for sending a required input value to the hash-function circuit1101, a selector1103for outputting a part of the output h (K bits) of the hash-function circuit1101, a calculation circuit1104for dividing the JPEG data into blocks each having K bits, and a calculation circuit1105for applying an exclusive-OR calculation to the output of the selector1103and the output of the calculation circuit1104.

The hash-function circuit1101applies a hash function to the value held by the register1102, which has the confidential information (that is, the random number R) generated by the random-number generation circuit214as an initial value.

A 128-bit hash value h, which is the output of the hash-function circuit1101, is input to the selector1103. The selector1103outputs, for example, the lower K bits of the 128-bit hash value h. The K bits are stored in the register1102as data to which the hash-function is applied next.

The above operation is repeated until a predetermined block is reached. The hash value obtained from the predetermined block is output as digital signature data.

The lower K bits of the random number R, for example, can be used as an initial value required for the first hash-function calculation, as shown inFIG. 14.

(3) Third Operation Mode

A third operation mode will be described below by referring toFIG. 13.FIG. 13is a block diagram of a part of the control/calculation section206.

InFIG. 13, the calculation circuit212is formed of a hash-function circuit1201for performing a hash-function calculation in units of predetermined bits, a register1202for sending a required input value to the hash-function circuit1201, a selector1203for outputting a part of the output h (K bits) of the hash-function circuit1201, a calculation circuit1204for dividing the JPEG data into blocks each having K bits, and a calculation circuit1205for applying an exclusive-OR calculation to the output of the selector1203and the output of the calculation circuit1204.

The hash-function circuit1201applies a hash function to the value held by the register1202, which has the confidential information generated by the random-number generation circuit214as an initial value.

A 128-bit hash value h, which is the output of the hash-function circuit1201, is input to the selector1203. The selector1203outputs, for example, the lower K bits of the 128-bit hash value h. The K bits are exclusive-ORed with one block of the JPEG data, and a part of the calculation result is stored in the register1202.

The above operation is repeated until a predetermined block is reached. The hash value obtained from the predetermined block is output as digital signature data.

The lower K bits of the random number R, for example, can be used as an initial value required for the first hash-function calculation, as shown inFIG. 14.

In a step S608, the recording and reproduction section203records the digital signature data h generated by the control/calculation section206and the corresponding digital image data P into a removable recording medium or outputs them to an apparatus through the network.

A program for controlling the processing procedure shown inFIG. 7is stored in the ROM207. This program is read by the control/calculation section206(actually, the control circuit210included therein) and activated every time the user instructs image capturing.

As described above, in the second embodiment, the predetermined calculation is performed with the use of the highly-efficiently-encoded digital image data P and the confidential information S generated from the random number R having the predetermined length, and the hash function is applied to the result of the calculation to generate the digital signature data h. With these operations, the digital signature data h, which is safer and more reliable than that produced by the conventional system, is obtained with a simple structure in the second embodiment. In addition, a more inexpensive apparatus than in the conventional system can be implemented and higher-speed processing than in the conventional system can be achieved.

Since the hash-function calculation can be implemented by one of the above-described operation modes or by a combination thereof in the second embodiment, a safer digital-signature-data generation algorithm than in the first embodiment is provided.

In the second embodiment, an image input apparatus which captures the digital image data P can be identified with the use of the digital signature data h as in the first embodiment.

Third Embodiment

In the first and second embodiments, the procedures for generating digital signature data h with the use of the hash function have been described.

On the other hand, in a third embodiment, a procedure for generating digital signature data h with the use of, not a hash function but common-key encryption will be described in detail.

FIG. 15is a flowchart showing a processing procedure according to the third embodiment. The procedure for generating digital signature data h will be described below by referring toFIG. 15.

Since processes in steps S1401to S1403are the same as those in the steps S401to S403in the first embodiment, a description thereof will be omitted.

In a step S1404, the control/calculation section206reads confidential information S unique to the image input apparatus10from the memory213. In the third embodiment, it is assumed that the confidential information S is set to “1111 . . . . 1111.”

In a step S1405, the control/calculation section206(actually, the calculation circuit212included therein) encrypts JPEG data stored in the working memory202by a common-key encryption method. An encryption key used for encrypting the JPEG data by the common-key encryption method is generated from the confidential information S.

Various types of common-key encryption methods have been proposed. In the third embodiment, a DES method is used. Since the bit length of an encryption key is 56 in the DES method, the higher 56 bits of the confidential information S are used as an encryption key, as shown inFIG. 16. The bit length of an encryption key depends on the type of the common-key encryption method used. Therefore, when a FEAL-nX method, a MITSY method, or an IDEA method is used, since an encryption key has 128 bits, the higher 128 bits of the confidential information S are used as an encryption key. When a FEAL-n method or a MULTI2 method is used, since an encryption key has 64 bits, the higher 64 bits of the confidential information S are used as an encryption key.

Common-key encryption processing performed in the step S1405will be described below in detail.

The control/calculation section206encrypts the JPEG data by any one of three operation modes, a cipher block chaining (CBC) mode, a cipher feedback (CFB) mode, and an output feedback (OFB) mode, described later, or by a combination thereof. In any operation mode, since encryption is achieved while input data is disturbed, safer encryption processing is performed.

The CBC mode will be described below by referring toFIG. 17.FIG. 17is a block diagram of a part (the calculation circuit212) of the control/calculation section206.

InFIG. 17, the calculation circuit212is formed of an encryption circuit1601for performing encryption in units of 64 bits, a register1602for temporarily storing the output of the encryption circuit1601, and a calculation circuit1603for applying an exclusive-OR calculation to the JPEG data and the output of the register1602.

The encryption circuit1601encrypts the JPEG data in units of blocks each formed of 64 bits. The output of the encryption circuit1601is temporarily stored in the register1602. Data of 64 bits stored in the register1602is exclusive-ORed with the next block, and the result of the calculation is sent to the encryption circuit1601. Finally, the result obtained by encrypting all blocks is output as encrypted data. A part of this encrypted data serves as digital signature data h.

In the first block encryption, an initial value needs to be stored in the register1602. The lower 64 bits of the confidential information S, for example, can be used as an initial value, as shown inFIG. 16.

If the size of a block is not a multiple of 64 bits, the remaining bit string may be encrypted, for example, by a combination of the CBC mode and the OFB mode, described later.

The OFB mode will be described below by referring toFIG. 18.FIG. 18is a block diagram of a part (the calculation circuit212) of the control/calculation section206.

InFIG. 18, the calculation circuit212is formed of an encryption circuit1701for performing encryption in units of 64 bits, a register1702for sending a required input value to the encryption circuit1701, a selector1703for selectively outputting the output of the encryption circuit1701, and a calculation circuit1704for applying an exclusive-OR calculation to the JPEG data and the output of the selector1703.

The encryption circuit1701encrypts 64-bit data stored in the register1702. The output of the encryption circuit1701is input to the selector1703. The selector1703outputs, for example, the lower K bits. The K bits are stored in the register1702as data to be encrypted next. The K bits output from the selector1703are also exclusive-ORed with each block (one block comprises K bits) of JPEG data, and the result of the calculation is used as encrypted data. A part of this encrypted data serves as digital signature data h.

The lower 64 bits of the confidential information S, for example, can be used as an initial value required for the first encryption, as shown inFIG. 16.

The CFB mode will be described below by referring toFIG. 19.FIG. 19is a block diagram of a part (the calculation circuit212) of the control/calculation section206.

InFIG. 19, the calculation circuit212is formed of an encryption circuit1801for performing encryption in units of 64 bits, a register1802for sending a required input value to the encryption circuit1801, a selector1803for selectively outputting the output of the encryption circuit1801, and a calculation circuit1804for applying an exclusive-OR calculation to the JPEG data and the output of the selector1803.

The encryption circuit1801encrypts 64-bit data stored in the register1802. The output of the encryption circuit1801is input to the selector1803. The selector1803outputs, for example, the lower K bits. The K bits output from the selector1803are also exclusive-ORed with one block (K bits) of JPEG data, and the result of the calculation is again stored in the register1802. Finally, the result obtained by processing all blocks is output as encrypted data. A part of this encrypted data serves as digital signature data h.

The lower 64 bits of the confidential information S, for example, can be used as an initial value required for the first encryption, as shown inFIG. 16.

In a step S1406, the control/calculation section206(actually, the calculation circuit212included therein) extracts a predetermined bit string from the encrypted data generated in the step S1405as digital signature data. The lower 128 bits of the encryption data is, for example, used as digital signature data.

In a step S1407, the recording and reproduction section203records the digital signature data h generated by the control/calculation section206(actually, the calculation circuit212included therein) and the corresponding digital image data P into a removable recording medium or outputs them to an apparatus through the network.

A program for controlling the processing procedure shown inFIG. 15is stored in the ROM207. This program is read by the control/calculation section206(actually, the control circuit210included therein) and activated every time the user instructs image capturing.

As described above, in the third embodiment, encryption is performed by the common-key encryption method with the use of the highly-efficiently-encoded digital image data P and the encryption key generated from a part of the confidential information S, and the digital signature data h is generated from the encrypted data. With these operations, the digital signature data h, which is safer and more reliable than that produced in the first and second embodiments, is obtained in the third embodiment. In addition, a more inexpensive apparatus than in the conventional system can be implemented and higher-speed processing than in the conventional system can be achieved.

In the third embodiment, an image input apparatus which has captured the digital image data can be identified with the use of the digital signature data h.

The confidential information S is set to “1111 . . . 1111” (128 bits long) in the third embodiment. The present invention is not limited to this case. The confidential information S can be set to a random number generated according to a predetermined algorithm by the random-number generation circuit214. In this case, the confidential information S is shared with the image verification apparatus20.

Fourth Embodiment

In the third embodiment, the procedure for generating digital signature data h with the use of, not a hash function but common-key encryption has been described.

On the other hand, in a fourth embodiment, a procedure for performing a predetermined calculation (such as a calculation, including bit insertion, for which an inverted calculation is allowed), for encrypting the result of the predetermined calculation by a common-key encryption method, and for generating digital signature data h from encrypted data will be described.

FIG. 20is a flowchart showing a processing procedure in the fourth embodiment. The procedure for generating digital signature data h will be described below by referring toFIG. 20.

Since processes in steps S1901to S1903are the same as those in the steps S401to S403in the first embodiment, a description thereof will be omitted.

Since processes in steps S1904to S1906are the same as those (exclusive-OR calculation by using the bit Ri of the random number R, which serves as confidential information, and the block Di of the JPEG data) in the steps S604to S606in the second embodiment, a description thereof will be omitted.

In the step S1906, an exclusive-OR calculation is performed between the bit Ri of the random number R and the least significant bit of the block Di in the same way as in the step S606. The present invention is not limited to this case. Any calculation may be used if at least a part of each block Di is added to, combined with, or multiplexed with a part of the confidential information S (random number R having a bit length m) and an inverted calculation of it is allowed.

In a step S1907, the control/calculation section206(actually, the calculation circuit212included therein) encrypts the output of the step S1906by a common-key encryption method. It is assumed that the control/calculation section206uses the DES method in the same way as in the third embodiment, and the higher 56 bits of the confidential information S generated in the step S1904are used as an encryption key, as shown inFIG. 21.

Encryption processing performed in the step S1907will be described below in detail.

The control/calculation section206sequentially encrypts the result obtained by applying an exclusive-OR to the bit Ri of the random number R and the block Di of the JPEG data by any one of the above-described three operation modes (the CBC mode, the CFB mode, and the OFB mode) or by a combination thereof. Since encryption is achieved while input data is disturbed in any operation mode, safer encryption is implemented.

In a step S1908, the control/calculation section206(actually, the calculation circuit212included therein) extracts a predetermined bit string as digital signature data h from encrypted data generated in the step S1907. The lower 128 bits of the encrypted data, for example, serve as digital signature data h.

In a step S1909, the recording and reproduction section203records the digital signature data h generated by the control/calculation section206(actually, the calculation circuit212included therein) and the corresponding digital image data P into a removable recording medium or outputs them to an apparatus through the network.

A program for controlling the processing procedure shown inFIG. 20is stored in the ROM207. This program is read by the control/calculation section206(actually, the control circuit210included therein) and activated every time the user instructs image capturing.

As described above, in the fourth embodiment, the predetermined calculation is performed with the use of the confidential information S generated from the random number R, and the highly-efficiently-encoded digital image data P, the result of the calculation is encrypted by the common-key encryption method, and the digital signature data h is generated from the encrypted data. With these operations, digital signature data which is safer and more reliable than that produced in the third embodiment is obtained in the fourth embodiment. In addition, a more inexpensive apparatus than in the conventional system can be implemented and higher-speed processing than in the conventional system can be achieved.

In the fourth embodiment, an image input apparatus which has captured the digital image data P can be identified with the use of the digital signature data h.

Fifth Embodiment

In the first to fourth embodiments, digital signature data h is generated according to confidential information S unique to the image input apparatus10. Therefore, an image input apparatus which has captured the digital image data P can be identified with the use of the digital signature data h.

On the other hand, in the fifth embodiment, an external apparatus, such as an IC card, is connected to the image input apparatus10and digital signature data h is generated according to confidential information S unique to the external apparatus. The confidential information S which the external apparatus has can, for example, be ID information for identifying the image input apparatus10, or ID information for identifying the user who uses the image input apparatus10. With such a structure, in the fifth embodiment, it can be determined by the use of the digital signature data h which image input apparatus connected to which external apparatus has captured digital image data or which user who instructed the image input apparatus to capture digital image data has captured the digital image data.

FIG. 22is a flowchart showing a processing procedure according to the fifth embodiment. A procedure for generating digital signature data h will be described below by referring toFIG. 22.

In a step S2101, the control/calculation section206of the image input apparatus10determines whether an external apparatus40is connected to the external interface section205.

In a step S2102, the image input apparatus10and the external apparatus40perform mutual authentication to check if they are legitimate to each other.

A mutual authentication process between the image input apparatus10and the external apparatus40will be described below by referring toFIG. 23.

The image input apparatus10generates a random number “a” for authentication by using the random-number generation circuit214, and sends the random number “a” to the external apparatus40through the external interface section205.

An encryption circuit43in the external apparatus40converts the random number “a” to data A with the use of an encryption key for authentication, and sends the encrypted data A to the image input apparatus10through an external interface section41.

An encryption circuit2201in the image input apparatus10converts the random number “a” to data A′ with the use of an encryption key for authentication. A comparison circuit2202compares the encrypted data A′ with the encrypted data A sent from the external apparatus40, and authenticates the external apparatus40if they match.

In the same way, the external apparatus40generates a random number “b” for authentication by using a random-number generation circuit42, and sends the random number “b” to the image input apparatus10through the external interface section41.

The encryption circuit2201in the image input apparatus10converts the random number “b” to data B with the use of an encryption key for authentication, and sends the encrypted data B to the external apparatus40through the external interface section205.

The encryption circuit43in the external apparatus40converts the random number “b” to data B′ with the use of an encryption key for authentication. A comparison circuit44compares the encrypted data B′ with the encrypted data B sent from the image input apparatus10, and authenticates the image input apparatus10if they match.

When both sides are authenticated correctly, the external apparatus40sends confidential information S stored in a memory45to the image input apparatus10through the external interface section41.

Since processes in steps S2103to S2105are the same as those in the steps S401to S403in the first embodiment, a description thereof will be omitted.

In a step S2106, the control/calculation section206stores the confidential information S input through the external interface section205to the memory213.

In a step S2107, the control/calculation section206(actually, the calculation circuit212included therein) performs a predetermined calculation based on a rule determined in advance, by the use of the confidential information S and digital image data P (hereinafter called JPEG data) highly efficiently encoded by the JPEG method. The calculation circuit212executes the same calculation as that in the step S405in the first embodiment.

In a step S2108, the control/calculation section206(actually, the calculation circuit212included therein) applies a hash-function calculation to the calculation result obtained in the step S2107, and generates digital signature data h from the result of the hash-function calculation. The calculation circuit212executes the same calculation processing as that in the step S406in the first embodiment.

In a step S2109, the recording and reproduction section203records the digital signature data h generated by the control/calculation section206(actually, the calculation circuit212included therein) and the corresponding digital image data P into a removable recording medium or outputs them to an apparatus through the network.

A program for controlling the processing procedure shown inFIG. 22is stored in the ROM207. This program is read by the control/calculation section206(actually, the control circuit210included therein) and activated every time the user instructs image capturing. Therefore, every time a digital image is captured, the digital signature data h corresponding to the image is generated.

As described above, in the fifth embodiment, the predetermined calculation is performed with the use of the confidential information S which the external apparatus40has, and the highly-efficiently-encoded digital image data P, the result of the calculation is operated by the hash function, and the digital signature data h is generated from the result of the hash-function calculation. With these operations, digital signature data which is safer and more reliable than that produced in the conventional system is obtained in the fifth embodiment. In addition, a more inexpensive apparatus than in the conventional system can be implemented and higher-speed processing than in the conventional system can be achieved.

As a result, without obtaining the confidential information S of the external apparatus and the predetermined calculation, the digital signature data h corresponding to the digital image data P cannot generated illegitimately. Therefore, the integrity of the digital image data P is safely verified according to the digital signature data h. In addition, due to the nature of the one-way function, since the original data, that is, the digital image data P to which the predetermined calculation is applied with the use of the confidential data S, cannot be obtained from the digital signature data h, the integrity of the digital image data P is verified from the digital signature data h in a safe condition.

A user who has instructed to capture digital image data can be identified with the use of the digital signature data h.

In the fifth embodiment, the procedure for generating the digital signature data h is the same as that in the first embodiment. The present invention is not limited to this case. Any of the procedures for generating digital image data h used in the above second to fourth embodiments can also be applied.

Sixth Embodiment

In the fifth embodiment, the image input apparatus10is connected to the external apparatus40, and the digital signature data is generated according to the unique confidential information which the external apparatus40has.

On the other hand, in a sixth embodiment, the image input apparatus10is connected to the external apparatus40, and digital image data h is generated according to both confidential information S2unique to the external apparatus40and confidential information S1unique to the image input apparatus10. With such a structure, in the sixth embodiment, it can be determined by the use of digital signature data h which image input apparatus connected to which external apparatus has captured digital image data P or which user who instructed which image input apparatus to capture digital image data P has captured the digital image data.

A processing procedure used in the sixth embodiment will be described below in detail by referring toFIG. 22.

In a step S2101, the control/calculation section206of the image input apparatus10determines whether an external apparatus40is connected to the external interface section205.

In a step S2102, the image input apparatus10and the external apparatus40perform mutual authentication to check if they are legitimate to each other.

Since processes in steps S2103to S2105are the same as those in the steps S401to S403in the first embodiment, a description thereof will be omitted.

In a step S2106, the control/calculation section206reads the confidential information S1which the image input apparatus10has from the memory213, and receives the confidential information S2which the external apparatus40has through the external interface205. The control/calculation section206combines them to form new confidential information S.

Assuming that the confidential information S1of the image input apparatus10is “1111” and the confidential information S2of the external apparatus40is “0000,” for example, the confidential information S newly generated is, for example, “11110000.” In the sixth embodiment, the two confidential-information items are simply combined to form the new confidential information S. Any operation may be used if the confidential information S1and S2can be processed from the confidential information S.

In a step S2107, the control/calculation section206(actually, the calculation circuit212included therein) performs a predetermined calculation based on a rule determined in advance, by the use of the confidential information S and digital image data P (hereinafter called JPEG data) highly efficiently encoded by the JPEG method. The calculation circuit212executes the same calculation as that in the step S405in the first embodiment.

In a step S2108, the control/calculation section206(actually, the calculation circuit212included therein) applies a hash-function calculation to the calculation result obtained in the step S2107, and generates digital signature data h from the result of the hash-function calculation.

In a step S2109, the recording and reproduction section203records the digital signature data h generated by the control/calculation section206and the corresponding digital image data P into a removable recording medium or outputs them to an apparatus through the network.

A program for controlling the processing procedure shown inFIG. 22is stored in the ROM207. This program is read by the control/calculation section206(actually, the control circuit210included therein) and activated every time the user instructs image capturing. Therefore, every time a digital image is captured, the digital signature data corresponding to the image is generated.

As described above, in the sixth embodiment, the predetermined calculation is performed with the use of the confidential information S generated from the confidential information S1of the image input apparatus10and the confidential information S2of the external apparatus40and the highly-efficiently-encoded digital image data P, the result of the calculation is operated by the hash function, and the digital signature data h is generated from the result of the calculation. With these operations, digital signature data which is safer and more reliable than that produced in the conventional system is obtained in the sixth embodiment. In addition, a more inexpensive apparatus than in the conventional system can be implemented and higher-speed processing than in the conventional system can be achieved.

It can be determined by the use of digital signature data h which image input apparatus connected to which external apparatus has captured digital image data or which user who instructed which image input apparatus to capture digital image data has captured the digital image data.

In the sixth embodiment, the procedure for generating the digital signature data h is the same as that in the first embodiment. The present invention is not limited to this case. Any of the procedures for generating digital image data h used in the above second to fourth embodiments can also be applied.

Seventh Embodiment

In a seventh embodiment, an image verification apparatus20for checking the integrity of digital image data P with the use of the digital signature data h generated by the image input apparatus10according to the first embodiment will be described.

FIG. 24is a flowchart showing a processing procedure according to the seventh embodiment. A procedure for verifying digital image data P in the image verification apparatus20will be described below by referring toFIG. 24.

In a step S2301, the external interface section301inputs digital image data P and the corresponding digital signature data h generated by the image input apparatus10and stores them in the working memory302in the image verification apparatus20. The digital image data P (hereinafter just called JPEG data) has been highly efficiently encoded, for example, by the JPEG method.

In a step S2302, the operation section306determines whether the integrity of JPEG data is verified, according to a user's operation input. When verification is instructed, the control/calculation section303executes a step S2303.

In the step S2303, the control/calculation section303reads confidential information S from the memory313. The confidential information S is confidentially shared by the image input apparatus10according to the first embodiment and the image verification apparatus20according to the present embodiment. The confidential information S of the present embodiment is set to “11111111” in the same way as in the first embodiment. The confidential information S is stored in a read-only recording medium and it is managed such that it cannot be output to the outside.

In a step S2304, the control/calculation section303(actually, the calculation circuit312included therein) executes the same calculation as in the step S405in the first embodiment, with the use of the confidential information S and the JPEG data. The least significant byte of the JPEG data and the confidential information S are exclusive-ORed in units of bits.

In a step S2305, the control/calculation section303(actually, the calculation circuit312included therein) applies a hash-function calculation to the result of the calculation performed in the step S2304. The same hash function as that used in the first embodiment is used. The same process as in the step S406is used in this step.

In a step S2306, the control/calculation section303(actually, the calculation circuit312included therein) compares the result of the calculation performed in the step S2305with the digital signature data h of the selected JPEG data. When they match in the comparison, it is determined that the JPEG data is legitimate. If they do not match, it is determined that illegitimate processing (such as modification, falsification, forgery, or synthesis) has been applied to the JPEG data.

In a step S2307, the display section304shows an image or a message indicating that the selected JPEG data is legitimate and illegitimate processing is not applied, when the comparison result is affirmative in the step S2305. If the comparison result is negative, a warning image or a warning message indicating that illegitimate processing has been applied is shown. With the operation, it is visually easy for the user to recognize the integrity of the selected JPEG data.

A program for controlling the processing procedure shown inFIG. 24is stored in the ROM305. The program is read by the control/calculation section303(actually, the control circuit312included therein) and is activated every time the verification of a desired image is instructed.

According to the above procedure, if the integrity of the selected JPEG data is not verified, the control circuit310controls each processing circuit so as to discard the JPEG data.

As described above, in the seventh embodiment, the integrity of the digital image data P which was captured and highly efficiently encoded by the image input apparatus10according to the first embodiment is recognized with a simpler structure than in the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing can be achieved.

Eighth Embodiment

In an eighth embodiment, an image verification apparatus20for checking the integrity of digital image data P with the use of the digital signature data h generated by the image input apparatus10according to the second embodiment will be described.

FIG. 25is a flowchart showing a processing procedure according to the eighth embodiment. A procedure for verifying digital image data P in the image verification apparatus20will be described below by referring toFIG. 25.

Since processes in steps S2401and S2402are the same as those in the steps S2301and S2302in the seventh embodiment, a description thereof will be omitted.

In a step S2403, the control/calculation section303(actually, the random-number generation circuit included therein) generates a random number R (that is, confidential information S) having a bit length of m. A program for generating the random number R is stored in the ROM305. This program is the same as that held by the image input apparatus10according to the second embodiment. The random number R is the same as the random number R used in the second embodiment. The program and the random number R are managed so as not to be output to the outside.

In a step S2404, the control/calculation section303(actually, the calculation circuit312included therein) divides a selected JPEG data into blocks Di (i=1 to n) each having 128 bits, as shown inFIG. 7. A block having a data amount of less than 128 bits is padded with “000 . . . 000.” The process in the step S2404is the same as that performed in the step S605in the second embodiment.

In a step S2405, the control/calculation section303(actually, the calculation circuit312included therein) performs the same processing as in the step S606in the second embodiment, by the use of the random number R and n blocks. Specifically, the bit Ri of the random number R and the least significant bit of the block Di are exclusive-ORed for i=1 to n.

In a step S2406, the control/calculation section303(actually, the calculation circuit312included therein) applies a hash-function calculation to the result of the calculation performed in the step S2405. The same hash function as that used in the second embodiment is used. The same process as in the step S607is used in this step.

In a step S2407, the control/calculation section303(actually, the calculation circuit312included therein) compares the result of the calculation performed in the step S2406with the digital signature data h of the selected JPEG data. When they match in the comparison, it is determined that the JPEG data is legitimate. If they do not match, it is determined that illegitimate processing (such as modification, falsification, forgery, or synthesis) has been applied to the JPEG data.

In a step S2408, the display section304shows an image or a message indicating the comparison result. With this operation, it is visually easy for the user to recognize the integrity of the selected JPEG data.

A program for controlling the processing procedure shown inFIG. 25is stored in the ROM305. The program is read by the control/calculation section303(actually, the control circuit312included therein) and is activated every time the verification of a desired image is instructed.

According to the above procedure, if the integrity of the selected JPEG data is not verified, the control circuit310controls each processing circuit so as to discard the JPEG data.

As described above, in the eighth embodiment, the integrity of digital image data P which was captured and highly efficiently encoded by the image input apparatus10according to the second embodiment is recognized with a simpler structure than in the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing can be achieved.

Ninth Embodiment

In a ninth embodiment, an image verification apparatus20for checking the integrity of digital image data P with the use of digital signature data h generated by the image input apparatus10according to the third embodiment will be described.

FIG. 26is a flowchart showing a processing procedure according to the ninth embodiment. A procedure for verifying digital image data P in the image verification apparatus20will be described below by referring toFIG. 26.

Since processes in steps S2501and S2502are the same as those in the steps S2301and S2302in the seventh embodiment, a description thereof will be omitted.

In a step S2503, the control/calculation section303reads confidential information S from the memory313. The confidential information S is confidentially shared by the image input apparatus10according to the third embodiment and the image verification apparatus20according to the present embodiment. The confidential information S of the present embodiment is set to “11111111” in the same way as in the third embodiment. The confidential information S is stored in a read-only recording medium, and it is managed such that it cannot be output to the outside.

In a step S2504, the control/calculation section303(actually, the calculation circuit312included therein) encrypts a selected JPEG data by a common-key encryption method in the same way as in the step S1405in the third embodiment.

In a step S2505, the control/calculation section303(actually, the calculation circuit312included therein) extracts a predetermined bit string from the data encrypted in the step S2504. The lower 128 bits of the encrypted data, for example, is extracted in the same way as in the third embodiment.

In a step S2506, the control/calculation section303(actually, the calculation circuit312included therein) compares the result of the extraction performed in the step S2505with the digital signature data h of the selected JPEG data. When they match in the comparison, it is determined that the JPEG data is legitimate. If they do not match, it is determined that illegitimate processing (such as modification, falsification, forgery, or synthesis) has been applied to the JPEG data.

In a step S2507, the display section304shows an image or a message indicating the comparison result. With this operation, it is visually easy for the user to recognize the integrity of the selected JPEG data.

A program for controlling the processing procedure shown inFIG. 26is stored in the ROM305. The program is read by the control/calculation section303(actually, the control circuit312included therein) and is activated every time the verification of a desired image is instructed.

According to the above procedure, if the integrity of the selected JPEG data is not verified, the control circuit310controls each processing circuit so as to discard the JPEG data.

As described above, in the ninth embodiment, the integrity of digital image data P which was captured and highly efficiently encoded by the image input apparatus10according to the third embodiment is recognized with a simpler structure than in the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing can be achieved.

Tenth Embodiment

In a tenth embodiment, an image verification apparatus20for checking the integrity of digital image data P with the use of digital signature data h generated by the image input apparatus10according to the fourth embodiment will be described.

FIG. 27is a flowchart showing a processing procedure in the tenth embodiment. A procedure for verifying digital image data P in the image verification apparatus20will be described below by referring toFIG. 27.

Since processes in steps S2601and S2602are the same as those in the steps S2301and S2302in the seventh embodiment, a description thereof will be omitted.

Since processes in steps S2603to S2605are the same as those in the steps S2403to S2405in the eighth embodiment, a description thereof will be omitted.

In a step S2606, the control/calculation section303(actually, the calculation circuit312included therein) encrypts a selected JPEG data by a common-key encryption method in the same way as in the step S1907in the fourth embodiment.

In a step S2607, the control/calculation section303(actually, the calculation circuit312included therein) extracts a predetermined bit string from the data encrypted in the step S2606. The lower 128 bits of the encrypted data, for example, is extracted in the same way as in the third embodiment.

In a step S2608, the control/calculation section303(actually, the calculation circuit312included therein) compares the result of the extraction performed in the step S2607with the digital signature data h of the selected JPEG data. When they match in the comparison, it is determined that the JPEG data is legitimate. If they do not match, it is determined that illegitimate processing (such as modification, falsification, forgery, or synthesis) has been applied to the JPEG data.

In a step S2609, the display section304shows an image or a message indicating the comparison result. With this operation, it is visually easy for the user to recognize the integrity of the selected JPEG data.

A program for controlling the processing procedure shown inFIG. 27is stored in the ROM305. The program is read by the control/calculation section303(actually, the control circuit312included therein) and is activated every time the verification of a desired image is instructed.

According to the above procedure, if the integrity of the selected JPEG data is not verified, the control circuit310controls each processing circuit so as to discard the JPEG data.

As described above, in the tenth embodiment, the integrity of digital image data P which was captured and highly efficiently encoded by the image input apparatus10according to the fourth embodiment is recognized with a simpler structure than in the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing can be achieved.

Eleventh Embodiment

In an eleventh embodiment, an image verification apparatus20for checking the integrity of digital image data P with the use of the digital signature data h generated by the image input apparatus10according to the fifth embodiment will be described.

FIG. 28is a flowchart showing a processing procedure in the eleventh embodiment. A procedure for verifying digital image data P in the image verification apparatus20will be described below by referring toFIG. 28.

In a step S2701, the control/calculation section303of the image verification apparatus20determines whether an external apparatus40is connected to the external interface section301.

In a step S2702, the image verification apparatus20and the external apparatus40perform mutual authentication to check if they are legitimate to each other.

Since processes in steps S2703and S2704are the same as those in the steps S2301and S2302in the seventh embodiment, a description thereof will be omitted.

In a step S2705, the control/calculation section303stores confidential information S unique to the external apparatus40and input through the external interface section301, to the memory313and manages it.

In a step S2706, the control/calculation section303(actually, the calculation circuit312included therein) performs a predetermined calculation based on a rule determined in advance, by the use of the confidential information S and JPEG data. The calculation circuit312executes the same calculation as that in the step S2304in the seventh embodiment.

In a step S2707, the control/calculation section303(actually, the calculation circuit312included therein) applies a hash-function calculation to the calculation result obtained in the step S2706. The calculation circuit312executes the same calculation as that in the step S2305in the seventh embodiment.

In a step S2708, the control/calculation section303(actually, the calculation circuit312included therein) compares the result of the calculation performed in the step S2707with the digital signature data h of the selected JPEG data. When they match in the comparison, it is determined that the JPEG data is legitimate. If they do not match, it is determined that illegitimate processing (such as modification, falsification, forgery, or synthesis) has been applied to the JPEG data.

In a step S2709, the display section304shows an image or a message indicating the comparison result. With this operation, it is visually easy for the user to recognize the integrity of the selected JPEG data.

A program for controlling the processing procedure shown inFIG. 28is stored in the ROM305. The program is read by the control/calculation section303(actually, the control circuit312included therein) and is activated every time the verification of a desired image is instructed.

According to the above procedure, if the integrity of the selected JPEG data is not verified, the control circuit310controls each processing circuit so as to discard the JPEG data.

As described above, in the eleventh embodiment, the integrity of the digital image data P which was captured and highly efficiently encoded by the image input apparatus10according to the fifth embodiment is recognized with a simpler structure than in the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing can be achieved. Furthermore, with the use of digital signature data h, an external apparatus which has captured digital image data or a user who has instructed to capture digital image data can be identified.

Twelfth Embodiment

In a twelfth embodiment, an image verification apparatus20for checking the integrity of digital image data P with the use of the digital signature data h generated by the image input apparatus10according to the sixth embodiment will be described.

A processing procedure in the twelfth embodiment will be described below by referring toFIG. 28.

Since processes in steps S2701to S2704are the same as those in the eleventh embodiment, a description thereof will be omitted.

In a step S2705, the control/calculation section303reads confidential information S1unique to the image input apparatus10from the memory313and receives confidential information S2unique to an external apparatus40through the external interface301. Then, these confidential information items S1and S2are combined to form new confidential information S in the same way as in the sixth embodiment.

In a step S2706, the control/calculation section303(actually, the calculation circuit312included therein) performs a predetermined calculation based on a rule determined in advance, by the use of the confidential information S and JPEG data. The calculation circuit312executes the same calculation as that in the step S2304in the seventh embodiment.

In a step S2707, the control/calculation section303(actually, the calculation circuit312included therein) applies a hash-function calculation to the calculation result obtained in the step S2706. The calculation circuit312executes the same calculation as that in the step S2305in the seventh embodiment.

In a step S2708, the control/calculation section303(actually, the calculation circuit312included therein) compares the result of the calculation performed in the step S2707with the digital signature data h of the selected JPEG data. When they match in the comparison, it is determined that the JPEG data is legitimate. If they do not match, it is determined that illegitimate processing (such as modification, falsification, forgery, or synthesis) has been applied to the JPEG data.

In a step S2709, the display section304shows an image or a message indicating the comparison result. With the operation, it is visually easy for the user to recognize the integrity of the selected JPEG data.

A program for controlling the processing procedure shown inFIG. 28is stored in the ROM305. The program is read by the control/calculation section303(actually, the control circuit312included therein) and is activated every time the verification of a desired image is instructed.

According to the above procedure, if the integrity of the selected JPEG data is not verified, the control circuit310controls each processing circuit so as to discard the JPEG data.

As described above, in the twelfth embodiment, the integrity of the digital image data P which was captured and highly efficiently encoded by the image input apparatus10according to the sixth embodiment is recognized with a simpler structure than in the conventional system. In addition, a more inexpensive structure than in the conventional system can be implemented, and higher-speed processing can be achieved. Furthermore, it can be determined with the use of digital signature data h which image input apparatus connected to which external apparatus has captured digital image data or which image input apparatus used by which user has captured digital image data.

The present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof.

In the first to sixth embodiments, the image input apparatus10generates digital signature data. An external apparatus40connected to the image input apparatus10may generate digital signature data. In this case, after the apparatuses authenticate each other, a processing program required for generating digital signature data, and highly efficiently encoded digital image data are sent from the image input apparatus10to the external apparatus40, and digital signature data is generated.

In the first to sixth embodiments, it is also possible that calculation processing required for generating digital signature data is separated and performed by the image input apparatus10and the external apparatus40, and both apparatuses cooperatively generate digital signature data. In this case, after the apparatuses authenticate each other, only required portions of a processing program required for generating digital signature data, and highly efficiently encoded digital image data are sent from the image input apparatus10to the external apparatus40, and digital signature data is generated.

In the seventh to twelfth embodiments, the image verification apparatus20generates digital signature data with the use of externally input digital image data. An external apparatus40connected to the image verification apparatus20may generate digital signature data. In this case, after the apparatuses authenticate each other, a processing program required for generating digital signature data, and externally input digital image data are sent from the image verification apparatus20to the external apparatus40, and digital signature data is generated.

In the seventh to twelfth embodiments, it is also possible that calculation processing required for generating digital signature data is separated and performed by the image verification apparatus20and the external apparatus40, and both apparatuses cooperatively generate digital signature data. In this case, after the apparatuses authenticate each other, only required portions of a processing program required for generating digital signature data, and externally input digital image data are sent from the image verification apparatus20to the external apparatus40, and digital signature data is generated.

In the seventh to twelfth embodiments, the programs for controlling the processing procedures shown inFIGS. 24 to 28are activated every time the verification of a desired image is instructed. The programs may be automatically activated when a desired image is externally input.

The above-mentioned embodiments are merely examples in all respects and must not be construed to limit the present invention.

The scope of the present invention is defined by the scope of appended claims, and is not limited at all by the specific descriptions of this specification. Furthermore, all modifications and changes belonging to the equivalents of the claims are considered to fall within the scope of the present invention.