System and method for authenticating digital content

A system and method for authenticating digital content is described. In one implementation, digital content recorded by a recording device is stored in a secure section of a memory device. A control system is configured to block access to the digital content stored in the secure section except to permit one or more portions of the digital content to be transmitted to a certification and validation authority where the one or more portions of the digital content is maintained in a secure repository in the event the authenticity of the digital content is questioned.

TECHNICAL FIELD

The present invention relates to authentication of digital content.

BACKGROUND

Digital content (photographs, audio recordings, etc.) produced by recording devices, such as cameras, audio recorders, digital evidence collection devices such as disk copiers and the like, are often “insecure” and are therefore “not trusted.” As a result use of content from digital recording devices are not supported in evidentiary fields, such as law enforcement, medical, insurance, and other related fields. Currently, many civil and criminal courts in the United States refuse to admit digital content from recording devices into evidence, because the digital content can be manipulated and is, therefore, not considered reliable. That is, digital content is easily manipulated through digital manipulation software. Thus, a user generally has full access to the digital content after they are recorded by a recording device, which provides the opportunity to tamper with and manipulate the digital content.

Detecting whether digital content has been tampered with is extremely difficult and expensive. Either an image tamper detection system or an expert witness is needed to examine the digital content and attempt to deduce whether the images are original or have been altered. However, many image tamper systems and experts are unable to confirm whether digital content has, in fact, been tampered with. Moreover, the need to use tamper detection systems and expert witnesses is expensive, typically nullifying any efficiency cost savings gained by using digital recording devices.

Many in professional fields that require trusted evidence, such as law enforcement, insurance, medical and other related fields, have invested in digital equipment, because they purported to offer (i) instant imagery (the big advantage of digital cameras is that making photos is both inexpensive and fast because there is no film processing), (ii) convenient means of reproducing copies of digital content, and (iii) less expense over time. In reality, the conveniences associated with digital equipment are of no worth in evidentiary professional fields, because of the ease by which digital evidence is mutable, and therefore, unsustainable before most evidentiary entities.

SUMMARY

A system and method for authenticating digital content is described. In one implementation, digital content recorded by a recording device is stored in a secure section of a memory device. A control system is configured to block access to the digital content stored in the secure section except to permit one or more portions of the digital content to be transmitted to a certification and validation authority where the one or more portions of the digital content is maintained in a secure repository in the event the authenticity of the digital content is challenged.

DETAILED DESCRIPTION

Exemplary Digital Content Authenticity System

FIG. 1is a block diagram that illustrates various components of an exemplary system100for authenticating digital content106recorded by a recording device104. It is expected that the various components of the authentication system100can be used in law enforcement, medicine, law, insurance industries and other areas.

In this example, the recording device104represents digital camera, but can include one or more other digital recording devices, such as an audio recorder, multifunctional digital/audio recorders, handheld devices or other related recording devices. Recording device104records digital content106of a physical medium102. The digital content106forms digital representation of a physical medium102.

Once the digital content106(e.g., photograph, voice recording, etc.) of a physical medium102is recorded by recording device104, the digital content106of the physical medium102is stored in a memory device108. In the exemplary implementation, memory device108represents a smart media card that is compatible with standard recording devices used with conventional smart media cards. Alternatively, the memory device108may represent other memory components, including a flash media card, random access memory (RAM), flash RAM, hard disk, floppy disk and other current and future various forms of storage media used in connection with recording devices104.

Memory device108contains two primary storage sections: a public section110and a secure section112. Information stored in the public section110can generally be downloaded freely to a host device connected to memory device108, such as recording device104or a host device116. The public section110can also be accessed in a normal capacity by a host device (such as a camera, computer, portable computer, etc.). As a result, most off-the-shelf products such as a camera, computer, or portable computer can be used with memory device108.

The second primary storage area, secure section112is cordoned-off through a control system114that can operate within the memory device108or in conjunction with logic in memory device108and/or logic/software operating in another device, such as host device116. When digital content106is recorded into memory device108, a mirror image of the digital content from the public section110is retrieved and stored in secure section112. Secure section112is configured to store encrypted data copied from the public section110through a memory system interface (to be described in greater detail below.)

Once stored in the secure section112, control system114operating as logic in the memory device108and/or in conjunction with software and/or logic operating on one or more host devices116(that can include recording device104), blocks access to the digital content106stored in the secure section112. Through encryption and logic layers (to be described), the secure section112remains locked and off-limits to any device attempting to gain access to the information stored therein, other than through a special communication protocol established with a certification and verification authority (CVA)118(to be described in more detail). Information stored in the public section110, however, can be retrieved, manipulated, written-to, and erased freely through the host device116(which can also serve as a docking station or in conjunction with a docking station). Digital content may be retrieved through the public section; however, such content is not certified by the CVA. As mentioned above, control system114uses a communication protocol through host device116to convey information stored in the secure section112to the CVA118. The information that can be conveyed to CVA118can include the contents of the digital content106stored in secure section112or metadata or information associated with digital content106. The metadata can include checksum data, header information such as date, time and location of the digital content, watermarks, and other indicia. The contents and/or the metadata can be used as a basis to compare whether digital content purporting to be an original copy of digital content (and possibly its associated metadata) is in fact identical to the contents and/or metadata retrieved from the secure section112.

Control system114permits one or more portions of the digital content to be read and/or deleted from the secure section112of memory device108, by an entity (such as host116or recording device104), when the control system114receives an authorization reply from the CVA118acknowledging that the one or more portions of the digital content106were received. As used herein, one or more portions of the digital content and/or one or more portions of information/metadata associated with the digital content106. As shall be explained in more detail, this can also include manifest data.

CVA118is an independent third party that provides a secure repository120for digital content received. CVA118generally keeps a permanent record of each transaction with a memory device108(via host devices if necessary). The repository120can be a secure database where digital content is stored in files that are indexed for possible retrieval at a subsequent date. Accordingly, CVA118maintains the one or more portions of the digital content106in a secure database, and if requested, is organized to produce the one or more portions of the digital content for evidentiary purposes in the event authenticity of particular digital content is questioned. The CVA118could establish a chain of custody from the time digital content is recorded until it is received and stored in the repository120. The idea is to show that the digital content (or information associated with the digital content like checksum indicia) was “locked-up” and remained off-limits from the time it was recorded until the time it is stored in the repository120. That way, if the authenticity of the digital content is challenged, the one or more portions of the digital content stored in the repository can be used to check whether the “purported original digital content” is identical to the one or more portions of the digital content maintained by the CVA.

In one implementation, in the event digital content must be validated, such as in the case of a court proceeding to challenge the integrity of the digital content, the CVA118can be contacted and a report containing secure checksum information can be obtained. If the CVA118also has the digital content or other evidence on record, it can be sent as part of the digital report.

Alternatively, it is also possible that the CVA118could send a human representative to testify as to the chain of custody of the one or more portions of the digital content maintained by the CVA118. Additionally, the CVA representative aided by digital report or computer system could quickly compare a purported original digital content, to information maintained by the CVA to determine whether the purported original digital content was altered subsequent to its being recorded by the recording device104.

FIG. 2is a flow diagram that illustrates a method200for authenticating digital content. Method200is performed by system100(or some portion thereof). This methodological implementation may be performed in software, hardware, or a combination thereof.

At a block202, digital content106and/or information associated with digital content is stored in secure section112of memory device108. As used herein, information associated with the digital content can include checksum data, and metadata (such as date, time, and global position of where the digital content was obtained, etc.). This associated information provides additional proof appurtenant to the digital content.

At a block204, control system114blocks access to the digital content106and/or associated information stored in secure section112. At a block206, the digital content and/or associated information is transmitted to CVA118via a host device116. Control system114recognizes the host device116and permits the host device116to perform a read only operation when attempting to convey the digital content106or associated information to the CVA118. The communication channel117used between the memory device108(via host116) and CVA118can use strong encryption (preferably at least 128 bit encryption) to ensure security of the data being transferred.

At a block208, control system114waits for the CVA118to send a response acknowledging receipt of the digital content106and/or associated information. If at block208, the control system114does not receive an acknowledgement from the CVA118, the control system continues to block a host from gaining access (other than to resend the digital content/information to the CVA) to the digital content106and/or information. If at block208, the control system114receives a message from CVA118acknowledging receipt of the digital content and/or associated information, then at a block210, control system114permits read and/or delete only access to that specific digital content and/or information received by the CVA118.

At a block212, the CVA118maintains the digital content and/or associated information in a secure repository120. The database is inaccessible to the public. The CVA118is organized to produce the digital content106and/or associated information for a questioning body (e.g. a court, law enforcement agency, insurance agency, etc.), in the event that the authenticity of digital content, purporting to be unaltered, is questioned.

Detailed Authentication System Implementation

FIG. 3shows various components of another exemplary authentication system300. System300is similar to system100described with reference toFIGS. 1 and 2. System300includes a recording device input/output interface302, a memory device304, a trusted interface system326, and a CVA repository338. Authentication system300ensures that digital content106recorded by a recording device can be certified as authentic.

Memory device304includes a device I/O manager (or management control system stage one (MCS stage-one))306that is used to interface with a device I/O302of a recording device. The device I/O and MCS306interact with each other in a normal state, unaware that this memory device304includes multi-sections and layers. A memory storage system (MSS) (stage-one)308is completely host control interface readable and writeable. Through MCS-stage one306, MSS308interacts with the recording device I/O302in a fully readable and writeable format. However, all interaction with MSS stage-one308is logged in a manifest314, and rename, delete, or erase functions are obfuscated through the use of dummy files.

In the event that MSS-stage-one308receives a delete file request from a host device, the file is erased in MSS stage-one; however, a dummy file of the same size is immediately re-written to MSS stage-one308and the memory manifest314is updated. This dummy file serves as a “place holder” for unsecured files that are stored in MSS stage two312and cannot be erased until it is approved for deletion by the CVA118. In the event that MSS stage-one308receives a rename command, the file in memory is renamed and the rename command is recorded in a secure manifest320.

A second memory storage layer, MSS stage-two322, is writable through a memory control system (MCS) stage-two312and MCS stage-three316. Through the MCS312and MCS316, any digital content placed in MSS stage-one308is automatically moved into MSS stage-two322. When this transfer occurs, information associated with digital content is recorded as metadata in a manifest320. The information can include a date and time from recording device, date and time in the memory device304, location information obtained through a global positioning system (not shown), digital content size, digital content name, strong checksum such as Message-Digest Algorithm version five (MD5) of the non-encrypted digital content in the public section, and a strong checksum of the encrypted digital content.

Exemplary Encryption & Checksum Engine

In one implementation of memory device304, at least a 128-bit encryption is used to encrypt data from MSS stage-one308for storage in an encrypted form with MSS stage-two322. Encryption is used to ensure secure storage and communication within the memory device304in the event the memory device304is compromised. Furthermore, a strong checksum engine318is used for providing checksum for data in MSS stage-one308and MSS stage-two322. These checksums are stored as part of the manifest320. A strong checksum technology, such as MD5 is used to check the data contained in the two MSS stages308and322.

Exemplary Memory Control System

MCS306, MCS312and MCS316obfuscates the secure nature of the device304as described above by hiding MCS stage-two312. MCS stage-one306is responsible for interactions solely with the device I/O302and is logically removed from MCS stage-two312to prevent a means for user intrusion into MSS stage-two312. However, a simple communication channel311is maintained between MCS stage-one306and MCS stage-two312for the communication of file sizes upon request from MCS stage-one308.

In MCS stage-two312movement of digital content from MSS stage-one308to MSS stage-two322is managed as well as the interaction with the checksum engine318and manifests314and320within an encrypted environment. The MCS stage-two312has read-only access to MSS stage-one308. MSS stage-one308issues read requests to MCS stage-two312so that it may obtain the digital content contained within MSS stage-one for writing into MSS stage-two322. MCS stage-two312has full write access to MSS stage-two322. As mentioned above, MCS stage-two312is not logically connected to MCS stage-one308beyond a simple communication channel311for the communication of file sizes in the event that a delete command is issued through the host control interface302for deletion of digital stored in MSS stage-one308.

MCS stage-three316controls movement of digital content from MSS stage-two322to the CVA host control interface324of the memory device for communication to the CVA control interface at the docking device326. MCS stage-three316is not logically connected to either the MCS stage-one306or MCS stage-two312beyond a simple communication channel to MCS stage-two312for the communication of digital content delete requests to MCS stage-two312.

Both the MCS stage-two312and MCS stage-three316operate within an encrypted environment of at least 128-bit encryption so that the software and communication channels within these components cannot be observed or changed by unauthorized users.

Secure Manifest

Secure manifests314and320are proprietary data files that contain metadata pertaining to the interactions of the system300. Manifest320contains information such as digital content type, file name, non-encrypted size, encrypted size, non-encrypted checksum, encrypted checksum, number of delete attempts, intrusion detection data, and any other information that may be necessary as part of the digital content authentication process. Other data such as the inclusion of location information at the time the digital content was captured by the recording device could also be supplied through an onboard Global Positioning System (GPS) (not shown) (either in the memory device304or recording device).

The manifests314and320are managed in two stages. The manifest controlled by MCS stage two interfaces with MCS stage-one306for the writing of data. MCS stage-one306does not have delete privileges to the manifest controlled by MCS stage-two. All data within The MCS stage-one manifest is transferred to manifest320through the use of MCS stage-three316to logically separate the manifest used by MCS stage-two from the manifest used by MCS stage-three320. The data within manifest used by MCS stage-two is moved to the manifest used by MCS stage-three at the termination of a write command as notified by MCS stage-two to MCS stage-three. Any data changes that occur as the result of a delete issuance recorded in the MCS stage-two manifest is recorded in the MCS stage-three manifest320through appending the manifest with the update information contained within the MCS stage-two manifest314. Once again, delete commands by MCS stage-two312in this implementation are not performed to either manifest. Manifest320interfaces with MCS stage-three316for the write of the final metadata generated by the MCS stage-three process as well as for the deletion of the data contained within manifest320. Manifests contained within314and320operate within in an encrypted environment of 128-bit encryption or more, so that the software and communication channels within these components cannot be observed or changed by unauthorized users.

Date Time System

A date time system (not shown) consists of a clock that is set by the CVA118through CVA interface332at the time that memory device304is synchronized with the CVA repository338. Alternatively, if used with a packet network or GPS system, the data and time can be synchronized with such services; however, time acquired through such services would be stored as a secondary time metadata entry in the manifest320to avoid external tampering with the time system through the use of GPS or packet network transmission devices.

Intrusion Detection System

An intrusion detection system344can be implemented within the encrypted sections310of memory device304or in combination with a host device. The intrusion detection system344monitors communication channels in a read-only manner and is designed to detect abnormalities and pass these to manifest320through a communication channel346.

Certification and Validation Authority Interface (CVAI)

A CVAI memory device324interfaces with MCS stage-three316and host device326. A base station328is used to ensure that a secure interface is achieved between memory device324and base station328. Base station328communicates in a read-only and delete-only mode with MCS stage-three316. Any data or evidence in MSS stage-two322is transferred through the base station328to the host device326. The host device326uses CVA software336, which connects to the CVA repository338for transfer of secure checksum and/or the digital content. At a point when the information associated with the digital content (e.g., checksum, etc.), and/or the digital content itself are transferred to the CVA repository338, base station328instructs the CVA software336to write the content from MSS stage-two322to the host device326that will contain a record of the information and issues a delete require to MCS stage-three316after the digital content or associated information is written and successfully check-summed on the host device326. Host device326can use an optional network connection such as 10/base-T for communication with the CVA to secure the transfer protocol.

Certification and Validation Authority

The CVA is a trusted third-party that maintains a record or secure checksums, manifests and/or digital content. As part of initializing the CVA software336on host device326, a user registers with the CVA118. This registration includes the transfer of the internal serial number of the memory device, the recording of the user information such as name, address and payment information. The CVA would likely as part of their business model charge a monthly fee which could be flat-rate or based on the amount of evidence that is certified. The CVA maintains a private key collection that is tied to the individual serial numbers of each of the memory devices304, so that every memory device304has a unique private key to avoid the pitfalls associated with the possibility of the discovery of a single key.

The CVA can also flash the internal software/logic contained in the memory device304, base station328or update the software336contained with the host device326. Processor(s)330executing logic or CVA software336transferred through some type of I/O334provide the functionality for host device326.

Based on the forgoing exemplary implementations, professional fields that require trusted evidence can use digital technologies, which are as secure or more secure than existing methods of evidence storage such as cassette tape or traditional photographs. There is no need to use special security devices for the collection of data. Standard off-the shelf equipment can be used.

Additionally, the foregoing implementations provide a trusted source for validation of forensic evidence that is relatively inexpensive as compared to the traditional use of an expert witnesses trained in fraud diction. To validate the forensics, digital content is presented exactly it was collected, by having a questioning body (attorneys in court proceedings, agencies, law enforcement, etc.) request a written or digital report form the CVA. The CVA information could either prove or disprove the validity of the digital content purported to be original (unmodified). The information would either prove or disprove the validity of the purported digital content through checksums of that purported original.