Data generation apparatus, data recording system, and program product

A data generation apparatus includes a processor that executes a process including obtaining target data sequentially from time-series data, the target data including n (n being an integer greater than or equal to 2) data items in a predetermined section of the time-series data, calculating parameter information satisfying a (k−1) order polynomial based on the target data, the (k−1) order polynomial including k random values, k being an integer greater than or equal to 1 and less than n, associating the target data to the parameter information, outputting the target data and the parameter information associated to the target data, attaching a signature to secret information based on a secret distributed protocol. The secret information is calculable by using k pairs of data including the target data and the parameter information associated to the target data, and outputting the secret information attached with the signature.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a data generation apparatus, a data recording system, and a program product.

2. Description of the Related Art

As a known data recording system, there is a data recording system including a combination of a data generation apparatus (e.g., imaging device) and a data storage apparatus that receives temporal order data generated by the data generation apparatus and stores the received data. According to the data recording system, a signature may be attached to the temporal order data for guaranteeing the authenticity of the data.

However, in a case where the attachment of the signature is performed on the side of the data generation apparatus, the side of the data storage apparatus that receives the signature-attached data cannot verify the authenticity of the signature if a piece of data is missing from the received data. In such a case, the authenticity of the data cannot be guaranteed even if the remaining received data has not been falsified (or forged).

SUMMARY OF THE INVENTION

The present invention may provide a data generation apparatus, a data recording system, and a program product that substantially obviates one or more of the problems caused by the limitations and disadvantages of the related art.

To achieve these and other advantages and in accordance with the purpose of the invention, as embodied and broadly described herein, an embodiment of the present invention provides a data generation apparatus including a processor, and a memory containing instructions that cause the processor to execute a data generation process that includes obtaining target data sequentially from time-series data, the target data including n (n being an integer greater than or equal to 2) data items in a predetermined section of the time-series data, calculating parameter information that satisfies a (k−1) order polynomial based on the target data, the (k−1) order polynomial including k random values, k being an integer greater than or equal to 1 and less than n, associating the target data to the parameter information, outputting the target data and the parameter information associated to the target data, attaching a signature to secret information based on a secret distributed protocol, the secret information being calculable by using k pairs of data including the target data and the parameter information associated to the target data, and outputting the secret information attached with the signature.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Next, embodiments of the present invention are described with reference to the accompanying drawings. Throughout the description of the embodiments and the drawings, like parts and components are denoted with like reference numerals and are not redundantly explained.

First Embodiment

<1. Configuration of Data Recording System>

First, an overall configuration of a data recording system100is described.FIG. 1is a schematic diagram illustrating a configuration of the data recording system100according to an embodiment of the present invention.

As illustrated inFIG. 1, the data recording system100includes a data generation apparatus110and a data storage apparatus120. According to the first embodiment, the data generation apparatus110and the data storage apparatus120are connected to communicate with each other via a network.

The data generation apparatus110is an apparatus that generates time-series data (data arranged in temporal order). In the first embodiment, an imaging apparatus that generates motion image data is hereinafter described as an example of the data generation apparatus110. A secret distributed data generation program is installed in the imaging apparatus110. By executing the secret distributed data generation program, the data generation apparatus (in this embodiment, imaging apparatus)110functions as a secret distributed data generation unit111.

The secret distributed data generation unit111generates secret distributed data and transmits the secret distributed data to the data storage apparatus120by way of streaming transmission. The secret distributed data generation unit111generates the secret distributed data by associating parameter information to generation motion image data. The parameter information is based on a secret distributed protocol (described in detail below). Further, the secret distributed data generation unit111attaches a signature to secret information and transmits the secret information attached with the signature to the data storage apparatus120. The secret information is used when the data storage apparatus120performs signature verification on the secret distributed information. The secret distributed data generation unit111transmits the secret information as a signature value to the data storage apparatus120.

The data storage apparatus120is a storage apparatus that stores various data transmitted from the data generation apparatus110. In the first embodiment, a server apparatus that stores secret distributed data and signature values is described as an example of the data storage apparatus120. A data verification program is installed in the data storage apparatus (in this embodiment, server apparatus)120. By executing the data verification program, the server apparatus120functions as a data verification unit121.

The data verification unit121receives the secret distributed data and the signature value transmitted from the imaging apparatus110and stores the received data in the data storage unit122. Further, the data verification unit121performs signature verification by using secret information that is calculated based on the secret distributed data stored in the data storage unit122and another secret information that is calculated based on the signature value stored in the data storage unit122.

Note that the data verification unit121can perform signature verification even in a case where one or more secret distributed data included in the secret distributed data transmitted from the imaging apparatus110by streaming is missing (lost). This is because the secret distributed data generated by using the secret distributed protocol has high tolerance (integrity) against data loss during signature verification.

<2. Description of Secret Distributed Protocol>

Next, secret distributed protocol having high tolerance (integrity) with respect to data loss during signature verification is described with reference toFIGS. 2A to 3C.FIGS. 2A-3Care schematic diagrams for explaining the secret distributed protocol.

Typically, a (k−1) order polynomial can be uniquely defined if k independent solutions exist whereas the (k−1) order polynomial cannot be uniquely defined if the number of solutions is less than or equal to (k−1).FIG. 2Aillustrates a case where a first order polynomial (y=α1x+α0) is uniquely defined based on two independent solutions ((x1, y1), (x2, y2)).FIG. 2Billustrates a case where a second order polynomial (y=α2x2α1xα0) is uniquely defined based on three independent solutions ((x1, y1), (x2, y2), (x3, y3)).

The secret distributed protocol utilizes the above-described relationship between a polynomial and the solution of the polynomial. In a case of using the secret distributed protocol, an entity that generates secret information (data generator) embeds generated secret information into a 0 order term (α0) of a (k−1) order polynomial as illustrated inFIG. 3B. Further, the data generator generates multiple solutions of the (k−1) order polynomial, divides the solutions, and retains the divided solutions. Accordingly, even in a case where one or more of the multiple solutions are leaked, the secret information (α0) cannot be restored. That is, the secret distributed protocol has a characteristic of high tolerance against information leakage.

Further, the user of data (data user) can recover the secret information (α0) as long as the data user can obtain k solutions of the multiple solutions generated by the data generator by using the secret distributed protocol as illustrated inFIG. 3B. This is because the (k−1) order polynomial can be uniquely determined by using the k solutions obtained. That is, the secret distributed protocol also has a characteristic of high tolerance against data loss.

In light of the characteristic of high tolerance against data loss, the first embodiment applies the secret distributed protocol to time-series data.

(2) Applying Secret Distributed Protocol to Time-Series Data

The imaging apparatus110of the first embodiment achieves improvement of tolerance against data loss during signature verification by applying the secret distributed protocol to time-series data (in this embodiment, motion image data). The imaging apparatus110of the first embodiment is described with reference toFIG. 3C.

First, the imaging apparatus110obtains n (“n” being an integer greater than or equal to 2) data units from motion image data arranged in time-series. The term “data unit(s)” refers to a predetermined unit of data that constitutes the motion image data. For example, in a case where the imaging apparatus110processes the motion image data in units of frames (frame-by-frame), the “predetermined unit of data” is each frame of the motion image data. Further, in a case where the imaging apparatus110processes the motion image data in units of packets (packet-by-packet), the “predetermined unit of data” is each packet of the motion image data. In the following description of the embodiments, the ithdata unit among n data units is indicated as “Di”.

Then, the imaging apparatus110generates n solutions of a (k−1) order polynomial based on n data units (Di). In generating the solutions of (k−1) order polynomial, “k” is an integer greater than or equal to 1 and less than n, and a random value is used for the k parameters (αk-1, αk-2, . . . α0) of the (k−1) order polynomial. According to the first embodiment, a hash value is used in substituting n data units (Di) to a variable x. Further, among the values of the n variables y that are calculated by the substitution of Hash (Di), the ithvalue is indicated as parameter information “Wi”. The parameter information “Wi” is calculated based on the following formula.
[Formula 1]
Wi=Σ(t=0˜k-1)αt×Hash(Di)t(Formula 1)

As a result, the imaging device110can calculate n solutions (Di, Wi) of the (k−1) order polynomial (y=αk-1xk-1+αk-2xk-2+ . . . α1x+α0) based on n data units. Then, the imaging device110transmits the calculated n solutions (Di, Wi) as secret distributed data. The secret distributed data that is transmitted includes a pair of a data unit and parameter information associated to the data unit.

Even in a case where a part of the secret distributed data (Di, Wi) is lost, the server apparatus120can calculate the parameters (αk-1, αk-2, . . . α0) as long as k secret distributed data can be gathered.

In a case of assuming that k secret distributed data are not falsified, the parameters (αk-1, αk-2, . . . α0) that are calculated by the server apparatus120based on k secret distributed data would match with the parameters (αk-1, αk-2, . . . α0) of the (k−1) order polynomial that is used by the imaging apparatus110for generating n solutions. On the other hand, the parameters would not match if k secret distributed data are falsified. In other words, signature verification can be performed by determining whether the parameters match. In a case where the parameters match (success of signature verification), the authenticity of the secret distributed data (i.e., secret distributed data not being falsified) can be guaranteed.

According to the first embodiment, the server apparatus120determines that the signature verification of the secret distributed data (Di, Wi) has succeeded when there is a match of one parameter (α0) That is, according to the first embodiment, the parameter (α0) serves as the secret information. The secret information can be defined as information that can be calculated by gathering k secret distributed data. Note that the imaging apparatus110calculates a signature value (S) and transmits the calculated signature value (S) to the server apparatus120, so that the server apparatus can determine the success/failure of the signature verification. The imaging apparatus110calculates the signature value (S) by attaching a signature to the secret information by using the following Sign algorithm.
[Formula 2]
S=Sign(α0,skcam)  (Formula 2)

In the [Formula 2], “Skcam,” refers to a signature key generated by the imaging apparatus110.

The server apparatus120that has received the signature value (S) calculates the secret information (α0) based on a verification key by using a Vrfy algorithm corresponding to the Sign algorithm. Further, the server apparatus120determines whether the secret information (α0) calculated by the k secret distributed data matches the secret information (α0) calculated by the signature value (S). In a case where the secret information match, the server apparatus120determines that the signature verification has succeeded. In a case where the secret information do not match, the server apparatus120determines that the signature verification has failed.

In the following description of the embodiments, each of the n secret distributed data transmitted from the imaging apparatus110is assumed to be attached with association information. The association information is associated to a first pair of data including a data unit (Di) and parameter information (Wi). Further, the signature value (S) transmitted from the imaging apparatus110is also assumed to be attached with association information. The association information attached to the signature value (S) is associated to the n secret distributed data.

<3. Hardware Configuration of Data Recording System>

Next, the hardware configurations of the imaging apparatus110and the server apparatus120included in the data recording system100are described.FIG. 4Ais a schematic diagram illustrating a hardware configuration of the imaging apparatus110according to the first embodiment of the present invention.FIG. 4Bis a schematic diagram illustrating a hardware configuration of the server apparatus120according to the first embodiment of the present invention.

As illustrated inFIG. 4A, the imaging apparatus110includes an imaging sensor401, a CPU (Central Processing Unit)402, a ROM (Read Only Memory)403, a RAM (Random Access Memory)404, and an interface (I/F)405. The hardware components included in the imaging apparatus110are connected to each other with a bus406.

The imaging sensor404converts received light into electric signals and generates motion image data according to the electric signals. The CPU402is a computer that executes various programs (e.g., secret distributed data generation program) stored in the ROM403.

The ROM403stores various programs to be executed by the CPU402. The ROM403also stores other programs and data that are to be used when the CPU402executes the various programs. The RAM404provides a work area for the CPU402when the CPU402executes the various programs.

The I/F405is connected to a network. The I/F405performs data communication (transmission and reception of data) with respect to the server apparatus120.

As illustrated inFIG. 4B, the server apparatus120includes a CPU411, a ROM412, a RAM413, a storage device414, and an I/F415. The hardware components included in the server apparatus120are connected to each other with a bus416.

Because the hardware configuration of the server apparatus120is substantially the same as the hardware configuration of the imaging apparatus110, the difference between the server apparatus110and the imaging device110are described. Namely, the server apparatus120does not include the imaging sensor401. Further, the server apparatus120includes the storage device414.

The storage device414stores a data verification program which is one of the various programs to be executed by the CPU411. The ROM412stores other programs and data that are to be used when the CPU402executes, for example, the data verification program. Note that the storage device414implements the above-described data storage unit122.

<4. Functional Configuration of Imaging Apparatus>

Next, there is described a functional configuration of the secret distributed data generation unit111implemented by the imaging apparatus110.FIG. 5is a schematic diagram illustrating the functional configuration of the imaging apparatus110according to the first embodiment of the present invention.

As illustrated inFIG. 5, the secret distributed data generation unit111includes a data input part501, a compression part502, a data buffer part503, a data counting part504, a signature parameter generation part505, a hash generation part506, a parameter information generation part507, a stream packet generation part508, a signature part509, and a data transmission part510.

The data input part501obtains motion image data generated by the imaging sensor401. The compression part502generates data units by compressing the obtained motion image data. The compression part502compresses the motion image data by using an arbitrary compression format (e.g., MPEG, H.264) and generates data units from the compressed motion image data.

The data buffer part503temporarily stores the data units generated by the compression part502. The data counting part504counts the number of data units stored in the data buffer part503. In a case where the counted number of data items reaches a predetermined number (n), the data counting part504reports to the signature parameter generation part505and the signature part509that the counted number of data items has reached a predetermined number (n).

The hash generation part506sequentially obtains data units (Di) from the data units stored in the data buffer part503and calculates the hash values (Hash (Di)) of the data units. Note that the reason that the hash values of the data units (Di) are calculated by the hash generation part506is for reducing the work load of the imaging apparatus110.

The stream packet generation part508is an example of an output unit. The stream packet generation part508obtains secret distributed data (Di, Wi) by obtaining the data units (Di) and the parameter information (Wi) and associating the data units (Di) and the parameter information (Wi) to each other. The stream packet generation part508forms the obtained secret distributed data into packets and outputs the secret distributed data as packets. Note that the format for forming the secret distributed data into packets is determined according to the method used for transmitting the secret distributed data. For example, in a case where the transmission method is a network interface type, the packets are transmitted by using RTSP (Real Time Streaming Protocol) or UDP (User Datagram Protocol). In a case where the transmission method is a USB (Universal Serial Bus) type, the packets are transmitted by using an isochronouos transmission method.

The signature part509is an example of a first signature unit. When the signature part509receives the report indicating that the counted number of data items has reached a predetermined number (n) from the data counting part504, the signature part509calculates a signature value (S) by using the secret information (α0) output from the signature parameter generation part505. According to the first embodiment, a Sign algorithm is used for calculating the signature value (S). However, signature algorithm used for calculating the signature value (S) is not limited to the Sign algorithm. For example, an RSA algorithm, an RSASSA-PSS algorithm, or an ElGamal algorithm may be used for calculating the signature value (S).

The data transmission part510is an example of a first transmission unit. The data transmission part510transmits the secret distributed data (Di, Wi) formed into packets by the stream packet generation part508and the signature value (S) calculated by the signature parameter generation part505. The data transmission part510transmits the packets of the secret distributed data (Di, Wi) by using a connectionless type streaming transmission method. Further, the data transmission part510transmits the signature value (S) by using a connection type transmission method.

FIG. 6is a schematic diagram illustrating the operations (actions) of the data buffer part503, the hash generation part506, the parameter information generation part507, and the signature part509included in the imaging apparatus110of the first embodiment. In the example illustrated inFIG. 6, the predetermined number “n” is 10.

As illustrated inFIG. 6, the hash generation part506calculates the hash value (Hash (D1)) when the hash generation part506obtains the data unit (D1) stored in the data buffer part503.

Further, the parameter information generation part507obtains the hash value (Hash (D1)) calculated by the hash generation part and the parameters (α9, α8, . . . α0) output by the signature parameter generation part505. Further, the parameter information generation part507calculates the parameter information (W1) based on the hash value (Hash (D1)) and the parameters (α9, α8, . . . α9) and outputs the calculated parameter information (W1).

The stream packet generation part508associates the data units (D1, D2, . . . D10) stored in the data buffer part503to the parameter information (W1, W2, . . . W10) output by the parameter information generation part507. Thereby, the stream packet generation part508obtains the secret distributed data ((D1, W1), (D2, W2), . . . D10, W10)).

Meanwhile, the signature part509calculates the signature value (S) by using the secret information (α0) output by the signature parameter generation part505.

Thus, owing to the above-described actions of each of the parts of the imaging apparatus110, the secret distributed data and the signature value based on the generated motion image data can be output.

<5. Processes of Secret Distributed Data Generation Part>

Next, the flow of the secret distributed data generation process by the secret distributed data generation unit111is described.FIG. 7is a flowchart illustrating the flow of the secret distributed data generation process. When the imaging sensor401starts the generation of motion image data, the secret distributed data generation unit111starts the processes illustrated inFIG. 7.

In Step S701, the data input part501obtains motion image data generated by the imaging sensor401. Further, the compression part502compresses the obtained motion image data and generates data units with the compressed motion image data. Then, the compression part502stores the data units in the data buffer part503.

In Step S702, the hash generation part506obtains the data unit (Di) from the data buffer part503and calculates the hash value (Hash (Di)) of the obtained data unit (Di).

In Step S703, the data counting part504determines whether the predetermined number n of data units have been stored in the data buffer part503. In a case where the predetermined number n of data units have been stored in the data buffer part503(No in Step S703), the hash generation part506determines that hash values for the predetermined number n of data items have not yet been calculated. In this case, the secret distributed data generation process returns to Step S703. On the other hand, in a case where the predetermined number n of data units have been stored in the data buffer part503(Yes in Step S703), the hash generation part506determines that hash values for the predetermined number n of data items have been calculated. Accordingly, the secret distributed data generation process proceeds to Step S704.

In Step S704, the signature parameter generation part505obtains k random values generated by the random number generator as the parameters (αk-1, αk-2, . . . α0).

In Step S705, the parameter information generation part507obtains the predetermined number of hash values (Hash Di)) and k parameters (αk-1, αk-2, . . . α0). Further, the parameter information generation part507calculates n parameter information (Wi) by using the obtained the predetermined number n of hash values and k parameters.

In Step S706, the signature part509obtains the parameter (α0) as the secret information from the signature parameter generation part505and adds a signature to the obtained secret information (α0). Thereby, the signature part509calculates the signature value (S) based on the secret information (α0) and outputs the calculated signature value (S).

In Step S707, the stream packet generation part508obtains the secret distributed data by associating the data unit (Di) stored in the data buffer part503to the parameter information (Wi) output by the parameter information generation part507. Further, the stream packet generation part508outputs the secret distributed data in the form of packets. Further, the data transmission part510performs streaming transmission to transmit the secret distributed data output from the parameter information generation part507to the server apparatus120via the network.

In Step S708, the data transmission part510transmits the signature value (S) output from the signature part509to the server apparatus120via the network.

In Step S709, the data input part501determines whether to end the secret distributed data generation process. In a case where the input of the motion image data generated by the imaging sensor401is continuing (No in Step S709), the secret distributed data generation process returns to Step S701. In a case where the input of the motion image data generated by the imaging sensor401has stopped (Yes in Step S709), the secret distributed data generation process is terminated.

<6. Functional Configuration of Server Apparatus>

Next, a functional configuration of the data verification part121implemented by the server apparatus120is described.FIG. 8is a schematic diagram illustrating the functional configuration of the server apparatus120.

As illustrated inFIG. 8, the data verification unit121includes a data reception part801, a storage process part802, a signature value calculation part803, and a signature value verification part804.

The data reception part801is an example of a reception unit. The data reception part801receives the secret distributed data (a pair of the data unit (D1) and parameter information (W1) associated to the data unit) and the signature value (S) transmitted from the imaging apparatus110. The storage process part802stores the secret distributed data and the signature value received by the data reception unit801in the data storage unit122.

The signature value calculation part803is an example of a first falsification determination unit. The signature value calculation part803determines whether signature verification is a success or a failure. For example, the signature value calculation part803determines whether k or more secret distributed data are stored in the data storage unit122. In a case where less than k secret distributed data is stored in the data storage unit122, the signature value calculation part803determines that the signature verification has failed.

In a case where k or more secret distributed data are stored in the data storage unit122, the signature value calculation part803determines that the signature verification is a success, and reads out the k secret distributed data from the data storage unit122. The signature value calculation part803calculates secret information (α0) based on the read out k secret distributed data by using the following formula.
[Formula 3]
α0=Σ(p=1˜k)WipΠ(0≤q≤k,q≠p)Hash(Diq)/(Hash(Diq)−Hash(Dip))   (Formula 3)

The signature value verification part804reads out the signature value (S) stored in the data storage unit122and uses the vrfy algorithm to calculate the secret information (α0) based on the verification key vkcam.
[Formula 4]
Vrfy(S,vkcam)=α0(Formula 4)

The signature value verification part804is an example of a second falsification determination unit. The signature value verification part804determines whether signature verification is a success. For example, the signature value verification part804compares the secret information (α0) calculated by the signature value calculation part803and the secret information (α0) calculated by using the vrfy algorithm based on the signature value (S). In a case where both of the secret information match as a result of the comparison, the signature value verification part804determines that the signature verification is a success (i.e., secret distributed data is not falsified). On the other hand, in a case where the secret information do not match as a result of the comparison, the signature value verification part804determines that the signature verification is a failure (i.e., secret distributed data is falsified).

The results of determining the signature verification by the signature value calculation part803and the signature value verification part804may be stored in, for example, the data storage unit122. Thereby, the server apparatus120can perform streaming transmission with an external terminal in which only the data unit included in the secret distributed data determined to have succeeded in the signature verification is transmitted. As a result, the external terminal (e.g., information terminal connected to the network) can reproduce only the motion image data whose authenticity is guaranteed.

<7. Process of Data Verification Part>

Next, the flow of the data verification process by the data verification unit121is described.FIG. 9is a flowchart illustrating the flow of the data verification process. The processes illustrated inFIG. 9are implemented by communicably connecting the server apparatus120to the imaging apparatus110.

In Step S901, the data reception part801receives the secret distributed data and the signature value transmitted from the imaging apparatus110. Further, the storage process part802stores the secret distributed data and the signature value received from the data reception part801in the data storage unit122.

In Step S902, the data reception part801determines whether a predetermined time has elapsed. In Step S902, the data reception part801waits until the predetermined time elapses in a case where the data reception part801determines that the predetermined time has not elapsed.

On the other hand, the data verification process proceeds to Step S903in a case where the data reception part801determines that the predetermined time has elapsed. In Step S903, the signature value calculation part803determines whether k or more secret distributed data are stored in the data storage unit122.

In Step S903, the signature value calculation part803determines that the signature verification is a failure in a case where the signature value calculation part803determines that k or more secret distributed data are not stored in the data storage unit122. In this case, the data verification process proceeds to Step S907.

On the other hand, in a case where the signature value calculation part803determines that k or more secret distributed data are stored in the data storage unit122, the data verification process proceeds to Step S904. In Step S904, the signature value calculation part803reads out k secret distributed data from the data storage unit122and calculates the secret information (α0) by using Formula 3.

In Step905, the signature value verification part804reads out the signature value (S) stored in the data storage unit122and uses the vrfy algorithm to calculate the secret information (α0) d based on the verification key vkcam.

In Step S906, the signature value verification part804compares the secret information (α0) calculated by the signature value calculation part803and the secret information (α0) calculated by using the vrfy algorithm based on the signature value (S). In a case where the secret information do not match as a result of the comparison of Step S906, the signature value verification part804determines that the signature verification is a failure (i.e., secret distributed data is falsified). In this case, the data verification process proceeds to Step S907.

On the other hand, in a case where the secret information match as a result of the comparison of Step S906, the signature value verification part804determines that the signature verification is a success failure (i.e., secret distributed data is not falsified).

In Step S909, the data reception part801determines whether communication with the imaging apparatus110is continuing. In a case where the data reception part801determines that communication with the imaging apparatus110is continuing, the data verification process returns to Step S901. On the other hand, in a case where the data reception part801determines that communication with the imaging apparatus110is disconnected, the signature value calculation part803or the signature value verification part804performs signature verification on the secret distributed data that are already stored in the data storage unit122but have not yet been processed. After performing the signature verification, the data verification process is terminated.

Next, an applied example of the data recording system100is described.FIG. 10is a schematic diagram illustrating an applied example of the data recording system100. The example ofFIG. 10illustrates the imaging apparatus110of the first embodiment being placed in an important installation (e.g., nuclear power plant) and the server apparatus120being placed in multiple companies (companies A to C).

Because an important installation such as a nuclear power plant) runs 24 hours, there is a need for the imaging apparatus placed in the installation to perform streaming transmission of authentic motion image data (motion image data whose authenticity is guaranteed) consecutively 24 hours a day.

The imaging apparatus110of the first embodiment can fulfill such need because the process load of the imaging apparatus110is light. This is because the process load for the imaging apparatus110to attach a signature is light. That is, according to the imaging apparatus110of the first embodiment, the imaging apparatus110attaches a signature to the secret information (α0) instead of attaching a signature to a data unit. Accordingly, the process load for the imaging apparatus110to attach a signature is light. Further, according to the imaging apparatus110of the first embodiment, the load for processing the data unit is light because the imaging apparatus110generates the parameter information by performing a hash process on the data unit.

As illustrated inFIG. 10, each company can perform signature verification with the transmitted secret distributed data and the signature value even in a case of loss of transmitted data. Accordingly, the authenticity of motion image data can be guaranteed. Because the same data can be transmitted to multiple companies, authentic motion image data can be prevented from being concealed by a particular company of the multiple companies.

Hence, according to the above-described data recording system of the first embodiment, the imaging apparatus sequentially obtains n data units (Di) from the generated motion image data and calculates, based on the obtained data units (Di), the parameter information (Wi) satisfying the (k−1) order polynomial including k (1≤k<) random numbers. Further, the imaging apparatus transmits n secret distributed data (having the obtained data units (Di) associated to the parameter information (Wi)) to the server apparatus. Further, the imaging apparatus calculates the signature value (S) by attaching a signature to secret information that can be calculated by gathering k secret distributed data. Then, the imaging apparatus transmits the calculated signature value to the server apparatus.

Thereby, in a case where the server apparatus receives k secret distributed data of the n secret distributed data transmitted from the imaging apparatus, the server apparatus can calculate the secret information based on the k secret distributed data (calculation possible even if (n−k) data is missing). Then, the server apparatus performs signature verification by comparing the calculated secret information with the secret information calculated from the signature value transmitted from the imaging apparatus. Thereby, the authenticity of the secret distributed data can be guaranteed. That is, even in a case where a part of the secret distributed data transmitted from the imaging apparatus is missing, the server apparatus can perform signature verification, so that the authenticity of the secret distributed data can be guaranteed.

Hence, according to the first embodiment of the present invention, tolerance against data loss during signature verification can be improved.

Second Embodiment

In the above-described first embodiment, each part of the secret distributed data generation unit111performs a process that is set beforehand. Alternatively, the secret distributed data generation unit111may be configured to change a process performed by each part of the secret distributed data generation unit111according to conditions input from an external device or the like. Next, the second embodiment of the present invention is described mainly on the differences with respect to the first embodiment.

FIG. 11is a schematic diagram illustrating a functional diagram of the imaging apparatus110according to the second embodiment of the present invention. Among the components of the functional configuration of the imaging apparatus110ofFIG. 11, like components and parts are denoted with like reference numerals as the reference numerals of the components of the functional configuration of the imaging apparatus110ofFIG. 5and are not further explained.

The difference between the imaging apparatus110ofFIG. 11and the imaging apparatus110ofFIG. 5is that the imaging apparatus110ofFIG. 11includes a secret distributed data generation unit1100including a setting parameter input part1101and a setting parameter storage part1102.

The setting parameter storage part1102stores the setting parameter input to the setting parameter input part1101as setting parameter information.

Information pertaining to the setting parameter is stored in the information item “setting content” in correspondence with the type of setting parameter. According to the example of the setting parameter information1200illustrated inFIG. 12, “information pertaining to protocol” (e.g., RTP (Real-time Transport Protocol), UDP (User Datagram Protocol)) is stored in correspondence with the “stream packet generation information”. Further, “information pertaining to compression type” (e.g., H.264, MPEG (Moving Pictures Experts Group)) is stored in correspondence with the “compression type information”. Further, “information pertaining to hash algorithm” (SHA (Secure Hash Algorithm) 1, SHA 256) is stored in correspondence with “hash information”.

Each part of the secret distributed data generation unit1100identifies a corresponding “setting parameter type”, reads out the “setting content” corresponding to the identified “setting parameter type”, and operates according to the “setting content”.

Hence, according to the data recording system of the second embodiment, each part of the secret distributed data generation unit1100can operate based on the setting parameter input from an external device or the like.

Third Embodiment

The imaging apparatus110of the first and second embodiments forms the secret distributed data (Di, Wi) into packets and transmits the packets, by way of streaming transmission via a network, to the server apparatus120provided outside of the imaging apparatus110. However, the secret distributed data do not necessarily need to be transmitted, by way of streaming transmission via a network, to the server apparatus120provided outside of the imaging apparatus110. Alternatively, an auxiliary storage device may be provided inside of the imaging apparatus110, so that the secret distributed data is stored in the auxiliary storage device. Next, the third embodiment of the present invention is described mainly on the differences with respect to the first embodiment.

<1. Hardware Configuration of Imaging Apparatus>

FIG. 13is a schematic diagram illustrating a hardware configuration of an imaging apparatus1300according to the third embodiment of the present invention. The difference between the hardware configuration of the imaging apparatus110ofFIG. 4Aand the imaging apparatus1300of the third embodiment ofFIG. 13is that an auxiliary storage device1301is included in the imaging apparatus1300of the third embodiment ofFIG. 13. The auxiliary storage device1301is an example of a storage unit. The auxiliary storage device1301has a storage capacity capable of storing the secret distributed data of a predetermined period of time and the signature value of the predetermined period of time. Further, the data stored in the auxiliary storage device1301can be read out from outside of the imaging apparatus1300via the I/F405. Note that the auxiliary storage device1301may be a removable recording medium such as a SD (Secure Digital) card.

<2. Functional Configuration of Imaging Apparatus>

FIG. 14is a schematic diagram illustrating a functional configuration of the imaging apparatus1300according to the third embodiment of the present invention. The difference between the imaging apparatus1300ofFIG. 13and the imaging apparatus110ofFIG. 5is that imaging apparatus1300ofFIG. 13includes a secret distributed data generation unit1400including a data combining part1401(instead of the stream packet generation part508) and a storage control part1402.

The data combining part1401is an example of an output unit. The data combining part1401obtains secret distributed data (Di, Wi) by associating a data unit (Di) to parameter information (Wi) and outputs the obtained secret distributed data to the storage control part1402. The storage control part1402stores the secret distributed data (Di, Wi) output from the data combining part1401and the signature value (S) output from the signature part509in the auxiliary storage device1301. Further, in a case where the storage control part1402receives a request for reading out data from the outside of the imaging apparatus1300via the data transmission part510, the storage control part1402reads out the secret distributed data (Di, Wi) and the signature value (S) stored in the auxiliary storage device1301. Further, the data transmission part510outputs the secret distributed data (Di, Wi) and the signature value (S) read out by the storage control part1402to the outside of the imaging apparatus1300.

FIG. 15is a schematic diagram illustrating an applied example of the imaging apparatus1300of the third embodiment. In the applied example ofFIG. 15, the imaging apparatus1300is a drive recorder placed inside of a vehicle1500. InFIG. 15, the imaging apparatus1300records the generated secret distributed data and the signature value to the auxiliary storage device1301provided inside the imaging apparatus1300. Thereby, in a case where the vehicle150is in an accident or the like, the secret distributed data and the signature value during the occurrence of the accident can be extracted from the auxiliary storage device1301, so that signature verification can be performed on the secret distributed data. Further, even in a case where a part of the extracted secret distributed data is missing, the authenticity of the secret distributed data can be guaranteed.

According to the third embodiment, the auxiliary storage device1301is provided inside of the imaging apparatus110. Alternatively, the auxiliary storage device1301may be attached to the outside of the imaging apparatus110, and the secret distributed data (Di, Wi) may be stored in the externally attached auxiliary storage device1301.

Fourth Embodiment

According to the first to third embodiments, the secret distributed data generation unit is configured to associate a single parameter information (Wi) to a single data unit (Di). However, it preferable that a data unit having higher importance than other data units (Di) to be more tolerant against data loss. Therefore, according to the fourth embodiment, the number of parameter information (Wi) to be associated to the data unit (Di) is changed according to the importance of the data unit (Di). That is, more parameter information (Wi) are associated the higher the importance of the data unit (Di) becomes. Thereby, tolerance against data loss can be improved. Next, the fourth embodiment of the present invention is described mainly on the differences with respect to the first embodiment.

<1. Functional Configuration of Imaging Apparatus>

FIG. 16is a schematic diagram illustrating a functional configuration of the imaging apparatus according to the fourth embodiment of the present invention. Among the components of the functional configuration of the imaging apparatus110ofFIG. 16, like components and parts are denoted with like reference numerals as the reference numerals of the components of the functional configuration of the imaging apparatus110ofFIG. 5and are not further explained.

The difference between the imaging apparatus110ofFIG. 16and the imaging apparatus110ofFIG. 5is that the imaging apparatus110ofFIG. 16includes a secret distributed data generation unit1600including an importance determination part1601. Further, the functions of a hash generation part1602and a parameter information generation part1603are different from the functions of the hash generation part506and the parameter information generation part507ofFIG. 5.

The importance determination part1601is an example of a determination unit. The importance determination part1601determines the importance of a data unit (Di). In the fourth embodiment, the importance of a data unit (Di) is indicated as “pi”. The importance determination part1601sequentially obtains data units (Di) from the data units stored in the data buffer part503and determines the importance of each of the obtained data units (Di). Then, the importance determination part1601reports the obtained data units (Di) along with their determined importance (pi) to the hash generation part1602.

The hash generation part1602calculates the hash values of the data units (Di) reported from the importance determination part1601based on the following formula.
[Formula 5]
Hash(Dij)=Hash(Di)j(Formula 5)

It is, however, to be noted that “j”=1˜pi. The hash generation part1602reports the calculated hash value (Hash (Dij)) to the parameter information generation part1603.

The parameter information generation part1603obtains the hash value (Hash (Dij)) calculated by the hash generation part1602and the parameters (αk-1, αk-2, . . . α0) obtained by the signature parameter generation part505. Further, the parameter information generation part1603calculates the parameter information (Wi_j) based on the obtained hash value and the parameters by using the following formula.
[Formula 6]
Wi_j=Σ(t=0˜k-1)αtHash(Dij)t(Formula 6)

FIG. 17is a schematic diagram illustrating the operations (actions) of the data buffer part503, the importance determination part1601, the hash generation part1602, the parameter information generation part1603, and the signature part509included in the imaging apparatus110of the fourth embodiment. In the example illustrated inFIG. 17, the predetermined number “n” is 10.

As illustrated inFIG. 17, the importance determination part1601determines the importance (p1) of the data unit (D1) when the importance determination part1601obtains the data unit (D1) stored in the data buffer part503. In this example, the value of the importance (p1) of the data unit (D1) is determined to be 3 (p1=3).

The hash generation part1602calculates the hash value (Hash (Dij)) when the hash generation part1602obtains the data unit (D1) and the corresponding importance (p1) from the importance determination part1601. In a case where the importance is p1=3, the hash generation part1602calculates hash values Hash (D1)1, Hash (D1)2, and Hash (D1)3.

According to the fourth embodiment, more secret distributed data are generated the higher the importance of the data unit (Di) becomes. As a result, tolerance against data loss is improved as the importance of the data unit becomes higher.

<2. Processes of Secret Distributed Data Generation Part>

Next, the flow of the secret distributed data generation process by the secret distributed data generation part1600is described.FIG. 18is a flowchart illustrating the flow of the secret distributed data generation process according to the fourth embodiment of the present invention. Next, the secret distributed data generation process ofFIG. 18is described mainly on the differences with respect to the secret distributed data generation process ofFIG. 7. The differences with respect to the secret distributed data generation process ofFIG. 7are the below-described processes of Steps S1801to S1804.

In Step S1801, the importance determination part1601determines the importance (pi) of the data unit (Di). In Step S1802, the hash generation part1602calculates the hash value (Hash (Dij)) according to the value of the determined importance.

<3. Processes of Data Verification Unit>

Next, the flow of the data verification process of the data verification unit121of the server apparatus120of the fourth embodiment is described.FIG. 19is a flowchart illustrating the flow of the data verification process according to the fourth embodiment of the present invention. Note that the data verification process ofFIG. 19is described mainly on the differences with respect to the data verification process ofFIG. 9. The differences with respect to the verification process ofFIG. 9are the below-described processes of Steps S1901and S1902.

In Step S1901, the signature value calculation part803determines whether the parameter information (Wi_j) associated to the data unit (Di) is stored in the data storage part122in a number greater than or equal to a predetermined number.

In a case where the number of the parameter information (Wi_j) stored in the data storage part122is less than the predetermined number (No in Step S1901), the signature value calculation part803determines that signature verification has failed. Thereby, the data verification process proceeds to Step S907.

On the other hand, in a case where the number of the parameter information (Wi_j) stored in the data storage part122is greater than or equal to the predetermined number (Yes in Step S1901), the data verification process proceeds to Step S903.

In Step S1902, the signature value calculation part803reads out k secret distributed data from the data storage part122and calculates the secret information (α0) by using the following formula.
[Formula 7]
α0=Σ(p=1˜k)Wi_jpΠ(0≤q≤k,q≠p)Hash(Dijq)/(Hash(Dijq)−Hash(Dijp))   (Formula 7)

Hence, according to the server apparatus120of the fourth embodiment, not only can the number of secret distributed data be used for determining the success of the signature verification but also the number of the parameter information (Wi_j) associated to each data unit (Di) can also be used for determining the success of the signature verification.

Next, applied examples of the data recording system100of the fourth embodiment are described.FIGS. 20A to 20Care schematic diagrams illustrating the applied examples of the data recording system100.FIG. 20Aillustrates a case where the imaging apparatus110is used as a fixed-point camera. In the case where the imaging apparatus110is used as a fixed-point camera, the importance determination part1601determines the importance of the data unit (Di) depending on whether a specific object (e.g., a person or a vehicle) is detected from the data unit (Di). Alternatively, the importance determination part1601may calculate the difference between the data unit (Di) and a background image and determine the importance of the data unit (Di) depending on the amount of the difference. Alternatively, the importance determination part1601may determine the importance of the data unit (Di) depending on whether a moving object is detected from the data unit (Di).

FIG. 20Billustrates a case where the imaging apparatus110is attached with a sound collecting microphone2001and used as a surveillance camera. In the case where the imaging apparatus110is attached with a sound collecting microphone2001, the importance determination part1601determines the importance of the data unit depending on the sound detected by the sound collecting microphone2001.

FIG. 20Cillustrates a case where the imaging apparatus110is attached with an acceleration sensor2002and used as a drive recorder. In the case where the imaging apparatus110is attached with the acceleration sensor2002, the importance determination part1601determines the importance of the data unit depending on whether an abnormal vibration or shock is detected by the acceleration sensor2002.

According to the data recording system of the fourth embodiment, the tolerance against data loss can be improved with respect to a data unit having high importance.

Fifth Embodiment

According to the above-described fourth embodiment, the importance of each data unit (Di) is determined, so that the tolerance against data loss improves as the importance of the data unit becomes higher. According to the fifth embodiment, secret distributed data and a signature value for a data item having high importance are generated separate from the other data items. Thereby, the secret distributed data and the signature value that are generated based on the data item having high importance can be received separately from the secret distributed data and the signature values that are generated based on the other data items. As a result, signature verification can be efficiently performed on the secret distributed data that is generated based on the data item having high importance. Next, the fifth embodiment of the present invention is described mainly on the differences with respect to the fourth embodiment.

FIGS. 21 and 22are flowcharts illustrating the flow of the secret distributed data generation process according to the fifth embodiment of the present invention. Note that the flowchart of the secret distributed data generation process illustrated inFIG. 21is the same as the flowchart illustrated inFIG. 18except for the process of Step S2101. Therefore, the description of the processes ofFIG. 21is omitted except for Step S2101.

In Step S2101, the hash generation unit1602determines whether the importance (pi) determined by the importance determination part1601is greater than or equal to a predetermined value. In a case where the importance (pi) is less than the predetermined value, the secret distributed data generation process of the fifth embodiment proceeds to Step S1802.

On the other hand, in a case where the importance (pi) is greater than or equal to the predetermined value, the secret distributed data generation process of the fifth embodiment proceeds to the processes illustrated inFIGS. 22A and 22B.

As illustrated inFIGS. 22A and 22B, the secret distributed data generation process of the fifth embodiment performs two processes in parallel in the case where the importance (pi) is greater than or equal to the predetermined value. The first process is the same as the process performed when the importance (pi) is determined to be greater than or equal to the predetermined value. That is, hash values are calculated according to the value of the importance in Step S22A. After the calculation of the hash values, the secret distributed data generation process of the fifth embodiment returns to Step S703ofFIG. 21.

In the second process, secret distributed data are generated separately from the secret distributed data generated for other data units stored in the data buffer part503when the importance is determined to be greater than or equal to the predetermined value.

More specifically, in Step S2211, the hash generation part1602calculates hash values according to the importance with respect to each data unit stored in the data buffer part503.

In Step S2214, the signature part509obtains the parameter (α0) obtained by the signature parameter generation part505in Step S2212. The obtained parameter (α0) serves as the secret information to which a signature is attached. Thereby, the signature part509calculates the signature value (S) based on the obtained secret information (α0) and outputs the calculated signature value (S).

In Step S2215, the stream packet generation part508obtains secret distributed data by associating the data unit (Di) stored in the data buffer part503to the parameter information (Wi_j) output by the parameter information generation part1603. Further, the stream packet generation part508forms the obtained secret distributed data into packets and outputs the packets. Further, the data transmission part510transmits, by way of streaming transmission via a network, the secret distributed data output by the stream packet generation part508.

In Step S2216, the data transmission part510transmits the signature value (S) output from the signature part509via the network. Then, the secret distributed data generation process of the fifth embodiment returns to Step S709ofFIG. 21.

Note that the destination of the secret distributed data and the signature value transmitted during Steps S2215and S2216are assumed to be different from the destination of the secret distributed data and the signature value transmitted during Step S1804and S708. Alternatively, even in a case where the destination of the secret distributed data and the signature value transmitted during Steps S2215and S2216are the same as the destination of the secret distributed data and the signature value transmitted during Step S1804and S708, the secret distributed data and the signature value transmitted during Steps S2215and S2216are to be received separate from the secret distributed data and the signature value transmitted during Step S1804and S708by the server apparatus120.

According to the fifth embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data and the signature value for the data item having high importance are generated separately from the secret distributed data and the signature values for the other data items stored in the data buffer part503.

Thereby, the secret distributed data and the signature value that are generated based on the data item having high importance can be distinguished from the secret distributed data and the signature values that are generated based on the other data items. As a result, signature verification can be efficiently performed on the secret distributed data that is generated based on the data unit having high importance.

Sixth Embodiment

According to the above-described fifth embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data and the signature value for the data item having high importance are generated separately from the secret distributed data and the signature values for the other data items stored in the data buffer part. According to the sixth embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data that is generated based on the data unit having high importance is transmitted multiple times by way of streaming transmission. Thus, according to the sixth embodiment, the possibility of data loss can be reduced for the secret distributed data that is generated based on the data unit having high importance.

FIG. 23is a flowchart illustrating a secret distributed data generation process according to the sixth embodiment of the present invention. The flowchart ofFIG. 23is different from the flowchart ofFIG. 21in that the secret distributed data generation process includes Step S2301to S2305.

In Step S2101, the secret distributed data generation process of the sixth embodiment proceeds to Step S2301when the importance (pi) is determined to be greater than or equal to a predetermined value. In Step S2301, the stream packet generation part508sets the number times for transmitting the secret distributed data generated based on the data unit (Di) determined to have an importance (pi) greater than or equal to a predetermined value, so that the secret distributed data can be transmitted multiple times (e.g., two times).

In Step S2302, the stream packet generation part508obtains the secret distributed data by associating the data unit (Di) stored in the data buffer part503to the parameter information (Wi_j) output by the parameter information generation part1603. Further, the stream packet generation part508forms the obtained secret distributed data into packets and outputs the packets.

In Step S2303, the data transmission part510determines whether the number of times of transmitting the secret distributed data output by the stream packet generation part508is set to a multiple number of times. In a case where the number of times of transmitting the secret distributed data is not set to multiple times, the secret distributed data generation process of the sixth embodiment proceeds to Step S2304. In Step S2304, the secret distributed data is transmitted to the server apparatus120by way of streaming transmission via a network. On the other hand, in a case where the number of times of transmitting the secret distributed data is set to multiple times, the secret distributed data generation process of the sixth embodiment proceeds to Step S2305.

In Step S2305, the data transmission part510transmits the secret distributed data to the server apparatus120by way of streaming transmission for a multiple number of times.

According to the sixth embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data that is generated based on the data unit having high importance is transmitted multiple times. Thus, according to the sixth embodiment, the possibility of data loss can be reduced for the secret distributed data that is generated based on the data unit having high importance.

Seventh Embodiment

According to the above-described sixth embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data that is generated based on the data unit having high importance is transmitted multiple times by way of streaming transmission. According to the seventh embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data that is generated based on the data unit having high importance is temporarily stored. Thus, according to the seventh embodiment, in a case where the server apparatus (transmission destination)120requests the imaging apparatus110to re-transmit the secret distributed data after performing streaming transmission of the secret distributed data, the imaging apparatus110can re-transmit the secret distributed data, and the possibility of data loss can be reduced for the secret distributed data.

FIGS. 24 and 25are flowcharts illustrating the secret distributed data generation process according to the seventh embodiment of the present invention. The flowcharts ofFIGS. 24 and 25are different from the flowchart ofFIG. 21in that the secret distributed data generation process of the seventh embodiment includes Steps S2401to S2402and Steps S2501to S2505.

In Step S2101, the secret distributed data generation process of the seventh embodiment proceeds to Step S2401when the importance (pi) is determined to be greater than or equal to a predetermined value. In Step S2401, the stream packet generation part508sets a storage target. More specifically, the secret distributed data generated based on the data unit (Di) determined to have an importance (pi) greater than or equal to a predetermined value is set to be the storage target.

In Step S2402, the stream packet generation part508obtains the secret distributed data by associating the data unit (Di) stored in the data buffer part503to the parameter information (Wi_j) output by the parameter information generation part1603. Further, the stream packet generation part508forms the obtained secret distributed data into packets and outputs the packets.

In Step S2501ofFIG. 25, the data transmission part510determines whether the secret distributed data output in Step S2402is set to be the storage target. In a case where the secret distributed data is not set to be the storage target, the secret distributed data generation process of the seventh embodiment proceeds to Step S2503. On the other hand, in Step S2501, the secret distributed data generation process of the seventh embodiment proceeds to Step S2502.

In Step S2502, the data transmission part510temporarily stores the secret distributed data output in Step S2402into the RAM404. In this embodiment, the RAM404functions as a storage unit that temporarily stores the packets of the secret distributed data.

In Step S2503, the data transmission part510transmits, by way of streaming transmission via a network, the secret distributed data that is output by the stream packet generation part508to the server apparatus120.

In Step S2504, the data transmission part510determines whether a re-transmission request from the server apparatus120is received. In a case where the data transmission part510determines that the re-transmission request is received, the secret distribution data generation process of the seventh embodiment proceeds to Step S2505.

In Step S2505, the data transmission part510reads out the secret distributed data from the RAM404and transmits the secret distributed data requested to be transmitted by way of streaming transmission again (re-transmission).

According to the seventh embodiment, in a case where a data item is determined to have an importance greater than or equal to a predetermined value, the secret distributed data that is generated based on the data unit having high importance is temporarily stored. Thus, according to the seventh embodiment, in a case where the server apparatus (transmission destination)120requests the imaging apparatus110to re-transmit the secret distributed data after performing streaming transmission of the secret distributed data, the imaging apparatus110can re-transmit the secret distributed data, and the possibility of data loss can be reduced for the secret distributed data.

Eighth Embodiment

According to the first to seventh embodiments, the authenticity of secret distributed data (i.e., secret distributed data not being falsified) can be guaranteed by using the above-described secret distributed protocols even in a case where data loss has occurred. However, according to the first to seventh embodiments, once the signature verification is determined as a success by the server apparatus120, the (k−1) order polynomial (y=αk-1xk-1+αk-2xk-2+ . . . α1xα0) used for performing the signature verification is revealed.

Accordingly, the server apparatus120can generate new secret distributed data (e.g., Dn+1, Wn+1) by using the revealed (k−1) order polynomial. This is because new secret distributed data that satisfies the (k−1) order polynomial can be generated by adding an arbitrary number to the variable x of the (k−1) order polynomial and calculating the variable y of the (k−1) order polynomial. Thus, it becomes possible for the server apparatus120to falsify the new secret distributed data.

Hence, according to the below-described embodiments, a function for preventing falsification of the secret distributed data of the server apparatus120is described.

<1. Configuration of Data Recording System>

First, an overall configuration of a data recording system2600according to the eighth embodiment of the present invention is described.FIG. 26is a schematic diagram illustrating a configuration of the data recording system2600according to the eighth embodiment of the present invention.

The data recording system2600ofFIG. 26is different from the data recording system100ofFIG. 1in that a secret distributed data generation unit2610transmits a pair of a Digest and a signature value (T) in addition to secret distributed data and a signature value (S).

The term “Digest” refers to data in which the hash values of the data units (Di) included in the secret distributed data are coupled (connected) to each other. The Digest is expressed by the following formula.
[Formula 8]
Digest=Hash(D1)|Hash(D2)| . . . |Hash(Dn)  (Formula 8)

Further, the signature value (T) is a value that is calculated by attaching a signature to the Digest by using a Sign algorithm expressed as follows.
[Formula 9]
T=Sign(Digest,skcam)  (Formula 9)

Further, the data recording system2600ofFIG. 26is different from the data recording system100ofFIG. 1in that the function of a data verification unit2620is different from the function of the data verification unit121. More specifically, the data verification unit2620not only has a function of the data verification unit121but also has a function of performing signature verification on the hash value (Hash (Di)) included in the Digest by using the signature value (T).

Before the data verification unit2620verifies the authenticity of the secret distributed data (i.e., determines whether the secret distributed data is falsified), the data verification unit2620performs signature verification on the hash value (Hash (Di)) included in the Digest by using the signature value (T). Then, in a case where the signature verification on the hash value (Hash (DiDi)) has succeeded, the data verification unit2620uses the hash value (Hash (Di)) to verify the authenticity of the data unit (Di) included in the secret distributed data (i.e., determines whether the data unit (Di) is falsified). Then, the data verification unit2620determines the authenticity of the secret distributed data (i.e., determines whether the secret distributed data is falsified).

Accordingly, the data verification unit2620verifies the authenticity of data by determining whether the data has been forged and by determining whether the data has been falsified.

<2. Functional Configuration of Imaging Apparatus>

FIG. 27is a schematic diagram illustrating a functional configuration of the imaging apparatus110according to the eighth embodiment of the present invention. Among the components of the functional configuration of the imaging apparatus110ofFIG. 27, like components and parts are denoted with like reference numerals as the reference numerals of the components of the functional configuration of the imaging apparatus110ofFIG. 5and are not further explained.

The secret distributed data generation unit2610ofFIG. 27is different from the secret distributed data generation unit111ofFIG. 5in that the hash generation part506generates the Digest of the hash value (Hash (Di)) and reports the generated Digest to the data transmission part510and a signature part2701.

Further, the secret distributed data generation unit2610ofFIG. 27is different from the secret distributed data generation unit111ofFIG. 5in that the secret distributed data generation unit2610ofFIG. 27includes the signature part2701. The signature part2701is an example of a second signature unit. When the signature part2701receives the Digest of the hash value (Hash (Di)) from the hash generation part506, the signature part2701generates the signature value (T) by attaching a signature to the Digest. The signature part2701attaches the signature to the Digest by using the above-described [Formula 9]. Further, the signature part2701reports the generated signature value (T) to the data transmission part510.

Further, the secret distributed data generation unit2610ofFIG. 27is different from the secret distributed data generation unit111ofFIG. 5in that the data transmission part510functions as a second transmission unit. The data transmission part510not only transmits the secret distributed data (Di, Wi) and the signature value (S) but also transmits the Digest and the signature value (T).

FIG. 28is a schematic diagram illustrating the operations (actions) of the data buffer part503, the hash generation part506, the parameter information generation part507, the signature part509, and the signature part2701included in the imaging apparatus110of the eighth embodiment. In the example illustrated inFIG. 28, the predetermined number “n” is 10.

As illustrated inFIG. 28, the hash generation part506generates the Digest by coupling the generated hash values (Hash (Di)).

When the signature part2701obtains the Digest of the hash values (Hash (Di)) generated by the hash generation part506, the signature part2701attaches a signature to the Digest by using the Sign algorithm and calculates the signature value (T).

<3. Processes of Secret Distributed Data Generation Unit>

Next, the flow of the secret distributed data generation process performed by the secret distributed data generation unit2610of the imaging apparatus110is described.FIG. 29is a flowchart illustrating the flow of the secret distributed data generation process according to the eighth embodiment of the present invention. The secret distributed data generation process ofFIG. 29is described mainly on the differences with respect to the secret distributed data generation process ofFIG. 7. The differences with respect to the secret distributed data generation process ofFIG. 7are the below-described processes of Steps S2901and S2902.

In Step S2901, the hash generation part506generates the Digest of the hash values (Hash (Di)). Then, the signature part2701calculates the signature value (T) based on the generated Digest.

In Step S2902, the data transmission part510transmits the Digest of the hash values (Hash (Di)) reported from the hash generation part506and the signature value (T) reported from the signature part2701to the server apparatus120.

<4. Functional Configuration of Server Apparatus>

Next, a functional configuration of the data verification unit2620implemented by the server apparatus120is described.FIG. 30is a schematic diagram illustrating the functional configuration of the server apparatus120according to the eighth embodiment of the present invention.

The functional configuration of the data verification unit2620ofFIG. 30is different from the data verification unit121ofFIG. 8in that the data verification unit2620includes an authenticity signature value verification part3001and a data authenticity verification part3002.

The authenticity signature value verification part3001reads out the Digest and the signature value (T) that are transmitted from the secret distributed data generation part2610and stored in the data storage unit122. Further, the authenticity signature value verification part3001uses the below-described vrfy algorithm and calculates the Digest based on a verification key vkcam.
[Formula 10]
Vrfy(T,vkcam)=Digest  (Formula 10)

Further, the authenticity signature value verification part3001compares the Digest read out from the data storage unit122with the Digest calculated by using the vrfy algorithm illustrated in [Formula 10]. In a case where the Digests match as a result of the comparison, the authenticity signature value verification part3001determines that the signature verification of the Digest read out from the data storage unit122is a success (i.e., determines that the hash value (Hash (Di)) included in the Digest is correct). On the other hand, in a case where the Digests do not match as a result of the comparison, the authenticity signature value verification part3001determines that the signature verification of the Digest read out from the data storage unit122is a failure (i.e., determines that the hash value (Hash (Di)) included in the Digest is incorrect).

Note the authenticity signature value verification part3001reports the determination results to the data authenticity verification part3002in a case where the signature verification is determined to be a success.

The data authenticity verification part3002is an example of a forgery determination unit. When the data authenticity verification part3002receives determination results indicating the success of signature verification from the authenticity signature value verification part3001, the data authenticity verification part3002reads out the data unit (Di) included in the secret distributed data stored in the data storage unit122and calculates the hash value (Hash (Di)) of the data unit (Di).

Further, the data authenticity verification part3002compares the calculated hash value (Hash (Di)) with the hash value (Hash (Di)) included in the Digest whose signature verification is determined as a success by the authenticity signature value verification part3001. If all of the calculated hash values (Hash (Di)) are included in the digest as a result of the comparison, the data authenticity verification part3002determines that the signature verification is a success (i.e., determines that the data unit (Di) included in the secret distributed data is not forged). On the other hand, if there is a calculated hash value (Hash (Di)) that is not included in the digest as a result of the comparison, the data authenticity verification part3002determines that the signature verification is a failure (i.e., determines that the data unit (Di) included in the secret distributed data is forged).

Accordingly, the data authenticity verification part3002can guarantee the authenticity of the data unit (Di) included in the secret distributed data read out from the data storage unit122(i.e., guarantee that the data unit (Di) is not forged).

<5. Data Verification Process of Data Verification Unit>

Next, the flow of a data verification process (verification of forgery and falsification) by the data verification unit2620of the server apparatus120of the eighth embodiment is described.FIG. 31is a flowchart illustrating the data verification process (verification of forgery and falsification) according to the eighth embodiment of the present invention. The data verification process ofFIG. 31is described mainly on the differences with respect to the data verification process ofFIG. 9. The differences with respect to the data verification process ofFIG. 9are the below-described processes of Steps S3101to S3105.

In Step S3101, the data reception part801receives the Digest and the signature value (T) transmitted from the imaging apparatus110. Further, the storage process part802stores the Digest and the signature value (T) received by the data reception part801in the data storage unit122.

In Step S3102, the authenticity signature value verification part3001performs signature verification on the Digest stored in the data storage unit122by using the signature value (T) stored in the data storage unit122. More specifically, the authenticity signature value verification part3001determines whether the Digest calculated by using the vrfy algorithm with the signature value (T) matches the Digest stored in the data storage unit122. Thereby, the authenticity signature value verification part3001determines whether the Digest stored in the data storage unit122is correct.

In a case where the Digest stored in the data storage unit122is determined to be incorrect as a result of the determination (No in Step S3102), the verification process of the eighth embodiment proceeds to Step S907. In this case, the authenticity signature value verification part3001determines that signature verification of the Digest read out from the data storage unit122is a failure.

On the other hand, in a case where the Digest stored in the data storage unit122is determined to be correct as a result of the determination (Yes in Step S3102), the verification process of the eighth embodiment proceeds to Step S3103.

In Step S3103, the data authenticity verification part3002reads out the data unit (Di) included in the secret distributed data stored in the data storage unit122and calculates the hash value (Hash (Di)) of the data unit (Di).

In Step S3104, the data authenticity verification part3002compares the calculated hash value (Hash (Di)) with the hash value (Hash (Di)) included in the Digest whose signature verification is determined as a success by the authenticity signature value verification part3001. In a case where a hash value (Hash (Di) that is not included in the Digest is included in the calculated hash value (Hash (Di)) (No in Step S3104) as a result of the comparison, the verification process of the eighth embodiment proceeds to Step S907. In this case, the data authenticity verification part3002determines that signature verification of the data unit (Di) included in the secret distributed data read out from the data storage unit122is a failure (i.e., determines that the data unit (Di) included in the secret distributed data is forged).

On the other hand, in a case where all of the calculated hash values (Hash (Di) are included in the Digest (Yes in Step S3104) as a result of the comparison, the data authenticity verification part3002proceeds to Step S903.

In Step S3105, the data authenticity verification part3002determines that signature verification is a success (i.e., determines that the data unit (Di) included in the secret distributed data is not forged).

In the case where signature verification is determined as a success in Step S3105, the verification process proceeds to Step S903. After Step S903, signature verification is performed by determining whether the secret distributed data is falsified. In a case where signature verification is determined as a success as a result of the signature verification, the secret distributed data is determined as not being falsified.

Hence, according to the data recording system of the eighth embodiment, the imaging apparatus110transmits the Digest of the hash values of the data units (Di) included in the secret distributed data to the server apparatus120. The imaging apparatus110also transmits the signature value (T) calculated by adding a signature to the Digest with the Sign algorithm to the server apparatus120.

Further, the server apparatus120performs signature verification of the Digest by using the signature value (T) received from the imaging apparatus110.

Further, in a case where the signature verification of the Digest is a success, the server apparatus120verifies the authenticity of the data unit (Di) included in the secret distributed data received from the imaging apparatus110(i.e., determines whether the data unit (Di) is forged). The server apparatus120performs the verification by using the Digest whose signature verification is determined as a success.

Thus, according to the data recording system of the eighth embodiment, forgery of secret distributed data can be prevented.

Ninth Embodiment

According to the above-described eighth embodiment, the imaging apparatus110generates the Digest and the signature value (T) and transmits the generated Digest and signature value (T) to the server apparatus120for preventing forgery of secret distributed data. According to the ninth embodiment, an authenticity guarantee server that is separate from the imaging apparatus110and the server apparatus120is provided in the data recording system, so that the authenticity guarantee server generates the Digest and the signature value (T) and transmits the generated Digest and signature value (T) to the server apparatus120. Next, the ninth embodiment is described.

<1. Configuration of Data Recording System

First, an overall configuration of the data recording system3200according to the ninth embodiment of the present invention is described.FIG. 32is a schematic diagram illustrating a configuration of the data recording system3200according to the ninth embodiment of the present invention.

The data recording system3200ofFIG. 32is different from the data recording system100ofFIG. 1in that the data recording system3200includes an authenticity guarantee server3210that is communicably connected to the data generation apparatus110and the server apparatus120via a network. Further, according to the data recording system3200ofFIG. 32, the secret distributed data generation unit111transmits the secret distributed data and the signature value (S) to the server apparatus120and the authenticity guarantee server3210by way of broadcast transmission. Further, the authenticity guarantee server3210transmits a pair of the Digest and the signature value (T) (second pair) to the server apparatus120.

The authenticity guarantee server3210has the same hardware configuration as the hardware configuration of the server apparatus120(seeFIG. 4B). A data verification program and a signature program are installed in the authenticity guarantee server3210. Accordingly, the authenticity guarantee server3210functions as the data verification unit121and a signature unit3211by executing the data verification program and the signature program.

The functions of the data verification unit121of the authenticity guarantee server3210is the same as the functions of the data verification unit121of the server apparatus120ofFIG. 8. Therefore, further description of the functions of the data verification unit121of the authenticity guarantee server3210is omitted.

The signature unit3211is an example of a second signature unit. The signature unit3211performs a signature process. More specifically, in a case where verification of the authenticity of the secret distributed data is a success according to the data verification by the data verification unit121(i.e., secret distributed data not being falsified), the signature unit3211calculates the hash value of the data unit (Di) included in the secret distributed data.

Further, the signature unit3211generates the Digest by coupling the calculated hash values (Hash (Di)). Further, the signature unit3211generates the signature value (T) by attaching a signature to the generated Digest by using the Sign algorithm illustrated in [Formula 11].
[Formula 11]
T=Sign(Digest,skserv)  (Formula 11)

Further, the signature unit3211functions as a second transmission unit. The signature unit11transmits a pair of the Digest and the signature value (T) (second pair) to the server apparatus120.

Note that, although the secret distributed data generation unit111of the ninth embodiment is described to broadcast both the secret distributed data and the signature value (S), the secret distributed data generation unit111of the ninth embodiment may broadcast only the secret distributed data. In this case, the authenticity guarantee server3210does not perform the data verification process with the data verification unit121and performs only the signature process with the signature unit3211.

<2. Signature Process of Authenticity Guarantee Server>

Next, the flow of the signature process of the authenticity guarantee server3210is described.FIG. 33is a flowchart illustrating the flow of the signature process according to the ninth embodiment of the present invention. The processes illustrated inFIG. 33are implemented by communicably connecting the authenticity guarantee server3210to the server apparatus120and the imaging apparatus110.

In Step S3301, the data verification unit121receives the secret distributed data and the signature value (S) transmitted from the imaging apparatus110.

In Step S3302, the data verification unit121performs the data verification process. Because the data verification process by the data verification unit121is described above with reference toFIG. 9, further description of the data verification process is omitted. The signature process ofFIG. 33is described assuming that verification of the authenticity of the secret distributed data received in Step S3301is a success.

In Step S3303, the signature unit3211calculates the hash value (Hash (Di)) of the data unit (Di) included in the secret distributed data.

In Step S3304, the signature unit3211generates the Digest by coupling the calculated hash values (Hash (Di)).

In Step S3305, the signature unit3211generates the signature value (T) by attaching a signature to the generated Digest by using the Sign algorithm.

In Step S3306, the signature unit3211transmits a pair of the generated Digest and the signature value (T) to the server apparatus120.

Hence, according to the data verification unit2620of the server apparatus120, the authenticity signature value verification part3001can perform signature verification on the Digest by using the signature value (T) received from the authenticity guarantee server3210.

Further, in a case where the signature verification of the Digest is a success, the data authenticity verification part3002of the data verification unit2620can function as a forgery determination unit. More specifically, the data authenticity verification part3002can verify the authenticity of the data unit (Di) included in the secret distributed data received from the imaging apparatus110(i.e., determine whether the data unit (Di) is forged) by using the Digest whose signature verification is a success.

Hence, according to the data recording system3200of the ninth embodiment, the authenticity guarantee server generates the Digest of the hash values of the data units (Di) included in the secret distributed data along with generating the signature value (T) by adding a signature to the generated Digest. Further, the authenticity guarantee server transmits the generated Digest and signature value (T) to the server apparatus.

Thus, similar to the above-described eighth embodiment, the data recording system of the ninth embodiment can also prevent forgery of the secret distributed data. Further, according to the data recording system of the ninth embodiment, the process load of the imaging apparatus110can be reduced compared to the data recording system of the eighth embodiment.

Tenth Embodiment

According to the above-described ninth embodiment, the authenticity guarantee server3210is provided in the data recording system3200, and the server apparatus120verifies the authenticity of the data unit (Di) included in the secret distributed data (determine that the data unit (Di) is not forged).

However, according to the tenth embodiment, the server apparatus120determines the authenticity of both the data unit (Di) included in the secret distributed data and the parameter information (Wi). Next, the tenth embodiment is described mainly on the difference with respect to the ninth embodiment.

<1. Configuration of Data Recording System>

FIG. 34is a schematic diagram illustrating a configuration of a data recording system3400according to the tenth embodiment of the present invention. The data recording system3400ofFIG. 34is different from the data recording system3200ofFIG. 32in that authenticity guarantee server includes a signature unit3411and a data verification unit3420.

According to the data recording system3400, the signature unit3411not only functions as a second signature unit but also functions as a third signature unit.

More specifically, in a case where the signature unit3411functions as the second signature unit, the signature unit3411calculates the hash value (Hash (Di)) of the data unit (Di) included in the secret distributed data transmitted from the imaging apparatus110. Further, the signature unit3411generates a Digest1 by coupling the calculated hash values (Hash (Di)). Further, the signature unit3411generates the signature value (T) by adding a signature to the generated Digest1.

In a case where the signature unit3411functions as the third signature unit, the signature unit3411obtains the parameter information (Wi) included in the secret distributed data transmitted from the imaging apparatus110. Further, the signature unit3411generates a Digest2 by coupling the obtained parameter information (Wi). Further, the signature unit3411generates a signature value (U) by adding a signature to the generated Digest2.

In addition, the signature unit3411not only functions as a second transmission unit but also functions as a third transmission unit. More specifically, in a case where the signature unit3411functions as the second transmission unit, the signature unit3411transmits a second pair of data (including the Digest1 and the signature value (T)) to the server apparatus120. Further, in a case where the signature unit3411functions as the third transmission unit, the signature unit3411transmits a third pair of data (including the Digest2 and the signature value (U)) to the server apparatus120.

Further, according to the data recording system3400, the data verification unit3420not only functions to verify the authenticity of the data unit (Di) included in the secret distributed data but also verify the authenticity of the parameter information (Wi) (i.e., determine whether the parameter information (Wi) is forged).

More specifically, the authenticity signature value verification part3001of the data verification unit3420performs signature verification on the Digest2 by using the signature value (U) received from the authenticity guarantee server3410.

Further, in a case where the signature verification of the Digest2 is a success, the data authenticity verification part3002of the data verification unit3420verifies the authenticity of the parameter information (Wi) included in the secret distributed data by using the Digest2 whose signature verification is determined as a success.

Thereby, the signature verification unit3420can verify the authenticity of the parameter information (Wi) included in the secret distributed data (determine that the parameter information (Wi) is not forged).

<2. Signature Process of Signature Unit>

Next, the flow of a signature process of the signature unit3411of the authenticity guarantee server3410is described.FIG. 35is a flowchart illustrating the signature process according to the tenth embodiment of the present invention. The flowchart ofFIG. 35is different from the flowchart ofFIG. 33in that the signature process ofFIG. 35includes the processes of Steps S3501to S3503.

In Step S3501, the signature unit3411generates the Digest2 based on the parameter information (Wi) included in the secret distributed data.

In Step S3502, the signature unit3411generates the signature value (U) by adding a signature to the generated Digest2.

In Step S3503, the signature unit3411transmits the pair of data including the Digest1 and the signature value (T) generated in Steps S3304and S3305and the pair of data including the Digest2 and the signature value (U) generated in Steps S3502and S3503to the server apparatus120.

<3. Data Verification Process (Verification of Forgery and Falsification) of Data Verification Unit>

Next, the flow of a data verification process (verification of forgery and falsification) of the data verification unit3420is described.FIG. 36is a flowchart illustrating the flow of a data verification process (verification of forgery and falsification) according to the tenth embodiment of the present invention. The data verification process of the tenth embodiment is described mainly on the differences with the data verification process ofFIG. 31. The data verification process ofFIG. 36is different from the data verification process ofFIG. 31in that data verification process ofFIG. 36includes the below-described processes of Steps S3602to S3606.

In Step S3601, the data reception part801receives the pair of data including the Digest1 and signature value (T) and the pair of data including the Digest2 and the signature value (U) transmitted from the authenticity guarantee server3210. Further, the storage process part802stores the received pair of data including the Digest1 and signature value (T) and pair of data including the Digest2 and the signature value (U) in the data storage unit122.

In Step S3602, the authenticity signature value verification part3001performs signature verification on the Digest1 stored in the data storage unit122by using the signature value (T) stored in the storage part122. More specifically, the authenticity signature value verification part3001determines whether the Digest1 calculated by using the vrfy algorithm with the signature value (T) matches the Digest1 stored in the data storage unit122. Thereby, the authenticity signature value verification part3001determines whether the Digest1 stored in the data storage unit122is correct.

In a case where the Digest1 stored in the data storage unit122is incorrect according to the determination results (No in Step S3602), the data verification process of the tenth embodiment proceeds to Step S907ofFIG. 37. In this case, the authenticity signature value verification part3001determines that the signature verification of the Digest1 read out from the data storage unit122is a failure.

On the other hand, in a case where the Digest1 stored in the data storage unit122is correct according to the determination results (Yes in Step S3602), the data verification process of the tenth embodiment proceeds to Step S3603ofFIG. 36.

In Step S3604, the data authenticity verification part3002compares the calculated hash value (Hash (Di)) with the hash value (Hash (Di)) included in the Digest1 whose signature verification is determined as a success by the authenticity signature value verification part3001. In a case where a hash value included in the calculated hash values (Hash (Di)) is not included in the Digest1 (No in Step S3604), the data verification process proceeds to Step S907ofFIG. 37. In this case, the data authenticity verification part3002determines that signature verification of the data unit (Di) included in the secret distributed data read out from the data storage unit122has failed (i.e., determines that the data unit (Di) included in the secret distributed data is forged).

On the other hand, in a case where all of the calculated hash values (Hash (Di)) are included in the Digest1 (Yes in Step S3604), the data authenticity verification part3002proceeds to Step S3605.

In Step S3605, the authenticity signature data verification part3001performs signature verification on the Digest2 stored in the data storage unit122by using the signature value (U) stored in the data storage unit122. More specifically, the authenticity signature value verification part3001determines whether the Digest2 calculated by using the vrfy algorithm with the signature value (U) matches the Digest2 stored in the data storage unit122. Thereby, the authenticity signature value verification part3001determines whether the Digest2 stored in the data storage unit122is correct.

In a case where the authenticity signature value verification part3001determines that the Digest2 stored in the data storage unit122is incorrect as a result of the determination (No in Step S3605), the data verification process proceeds to Step S907ofFIG. 37. In this case, the authenticity signature value verification part3001determines that signature verification of the Digest2 read out from the data storage unit122has failed.

On the other hand, in a case where the authenticity signature value verification part3001determines that the Digest2 stored in the data storage unit122is correct as a result of the determination (Yes in Step S3605), the data verification process proceeds to Step S3606.

In Step S3606, the data authenticity verification part3002reads out the parameter information (Wi) included in the secret distributed data stored in the data storage unit122, and compares the parameter information with the Digest2 whose signature verification is determined as a success by the authenticity signature value verification part3001.

In a case where parameter information (Wi) included in the read out parameter information (Wi) is not included in the Digest2 as a result of the comparison (No in Step S3606), the data verification process proceeds to Step S907ofFIG. 37. In this case, the data authenticity verification part3002determines that signature verification of the parameter information (Wi) included in the secret distributed data read out from the data storage unit122has failed (i.e., determines that the parameter information (Wi) included in the secret distributed data is forged).

On the other hand, in a case where all of the read out parameter information (Wi) are included in the Digest2 (Yes in Step S3606), the data authenticity verification part3002proceeds to Step S3607.

In Step S3607, the data authenticity verification part3002determines that signature verification is a success (i.e., determines that neither the data unit (Di) included in the secret distributed data nor the parameter information (Wi) are forged).

In the case where signature verification is determined as a success in Step S3607, the data verification process proceeds to Step S903ofFIG. 37. After Step S903, a signature verification process is performed for determining whether the secret distributed data is falsified. In a case where the signature verification is a success, the signature value verification part804determines that the secret distributed data has not been falsified in Step S908.

Hence, according to the tenth embodiment, the server apparatus120can verify the authenticity of both the data unit (Di) included in the secret distributed data and the parameter information (Wi).

In the example illustrated inFIG. 36, the verification of the authenticity of the parameter information (Wi) is started after verifying the authenticity of all of the data units (Di) included in the secret distributed data. However, the order for performing the verification of authenticity is not limited to the order of the example illustrated inFIG. 36. For example, the verification of the authenticity of the data units (Di) may be started after verifying the authenticity of all of the parameter information (Wi). Alternatively, the verification of authenticity of the data units (Di) and the verification of authenticity of parameter information (Wi) may be performed alternately.

Eleventh Embodiment

In the above-described ninth and tenth embodiments, the secret distributed data and the signature value (S) are broadcast by the imaging apparatus110. According to the eleventh embodiment, a router apparatus is provided in the data recording system, so that the router apparatus can broadcast the secret distributed data and the signature value (S). Next, the eleventh embodiment is described.

FIG. 38is a schematic diagram illustrating a configuration of the data recording system3800according to the eleventh embodiment of the present invention. The data recording system3800ofFIG. 38is different from the data recording system3400in that the data recording system3800ofFIG. 38includes a router apparatus3810.

The router apparatus3810is connected to the imaging apparatus110. The router apparatus3810broadcasts the secret distributed data and the signature value (S) transmitted from the imaging apparatus110to the server apparatus120and the authenticity guarantee server3410that are connected to a network.

Accordingly, the transmission load of the imaging apparatus110can be reduced by providing the router apparatus3810in the data recording system3800.

Other Embodiments

According to the above-described first to eleventh embodiments, a secret distributed protocol is applied to motion image data generated in the imaging apparatus110. However, the object to which the secret distributed protocol is applied is not limited to motion image data. For example, the secret distributed protocol may be applied to an arbitrary time-series data such as audio data or temperature data.

According to the above-described first to eleventh embodiments, the data counting part504is provided in the secret distributed data generation unit, so that the signature value (S) can be calculated with respect to each of a predetermined number (n) of data units (Di). However, the timing for calculating the signature value (S) is not limited to the predetermined number (n) of data units (Di). For example, the signature value (S) may be calculated with respect to a data unit (Di) equivalent to a predetermined period of time. That is, calculation of the signature value (S) may be performed with respect to a data unit (Di) of a predetermined time period of a given times-series data.

According to the above-described first to eleventh embodiments, the hash generation part506calculates the hash value of the data unit (Di), and parameter information generation part507calculates the parameter information (Wi) based on the hash value calculated by the hash generation part506. Alternatively, the parameter information generation part507may calculate the parameter information (Wi) directly from the data unit (Di).

According to the above-described first to eleventh embodiments, the secret distributed data generation unit is implemented by executing the secret distribution data generation program with the CPU402. Alternatively, the secret distributed data generation unit may be implemented by using, for example, a GPU (Graphic Processing Unit).

According to the above-described eighth embodiment, the secret distributed data generation unit2610transmits the Digest and the signature value (T). However, similar to the tenth embodiment, the secret distributed data generation unit2610may transmit the Digest 1 and the signature value (T) along with the Digest 2 and the signature value (U). In this case, the signature unit2701functions as second and third signature units, and the data transmission unit510functions as the first to third transmission units.

The present application is based on and claims the benefit of priority Japanese Priority Application Nos. 2016-049491 and 2016-150750 filed on Mar. 14, 2016 and Jul. 29, 2016, respectively, with the Japanese Patent Office, the entire contents of which are hereby incorporated by reference.