JP2010147749A - Moving image distribution module, moving-image receiving module, and moving-image transmission system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a moving image transmission system capable of performing encryption processing and distribution processing in real time while changing a key every moment when streaming distribution of an encrypted moving image signal and an audio signal. .
When a moving image is encrypted, a derived key is created by using a secret key and a derived parameter generated every unit time, the moving image data is encrypted in real time with the derived key, and the derived parameter is used as a digital watermark. By embedding in data, a moving image transmission system is realized that enables streaming distribution of encrypted moving image data while changing the key every unit time.
[Selection] Figure 8

Description

The present invention relates to a moving image distribution module, a moving image receiving module, and a moving image transmission system that use encryption / decryption technology when distributing moving images and sounds via a network such as a monitoring system.

The number of surveillance cameras for crime prevention and surveillance has increased to reflect the current world. In addition, installation locations that used to be enterprise-centric have spread from street corners to private homes, and there are a wide variety of subjects for surveillance cameras. The background of this spread is the expansion of demand and the advancement of digital signal processing technology and network technology. Streaming delivery, which distributes and plays back video and audio in real time via the network, is now common. It has become a technology. In addition, from the viewpoint of privacy protection and information leakage prevention, techniques such as encryption of video signals to be photographed are also regarded as important.

For example, Patent Document 1 proposes a mechanism for distributing a moving image to a personal computer or the like on a network while combining a small camera board having a network distribution function and an IC card, and encrypting the moving image in real time with the IC card. In order to play the distributed video on a personal computer, an IC card is also attached to the personal computer, and playback is performed while decrypting.
Patent Document 2 proposes a mechanism for encrypting a moving image portion or an audio portion when multimedia data in which digital data such as moving images or audio is integrated is distributed via a network. .
JP 2006-287858 A JP 2008-206097 A

In the above mechanism, since encryption is performed with an IC card, real-time encryption processing is realized assuming use of AES (Advanced Encryption Standard), which is a common key method advantageous in processing time. However, it is desirable to change the key from time to time in order to increase security when the usage is long, such as streaming distribution.

Generally, in payment processing using an IC card, a so-called session key method is used in which a derivative key is generated using a key in the IC card after power is turned on, and the payment processing is completed as one session. By using a new key for each session, threats such as theft are avoided. In such an application, the session key (derived key) ends only temporarily, whereas the surveillance camera or the like takes a particularly long time, so it is sometimes necessary to change the key from this point.

Therefore, an object of the present invention is to provide a moving image transmission system that enables encryption processing, distribution processing, and reception processing in real time while changing a key every time in streaming distribution of encrypted moving image data.

A first invention for solving the above problem is a moving image distribution module for distributing encrypted moving image data via a network,
The module is
A video input interface;
Moving image data processing means for converting a moving image signal from the input interface into moving image data having a format divided for each predetermined block;
Encryption means for encrypting each set of moving image data blocks divided into blocks from the moving image data processing means, with a minimum unit;
Decoding parameter embedding means for embedding a decryption parameter for decrypting video data encrypted for each set of predetermined blocks for each set of predetermined blocks in an audio data recording area attached to the video data;
It comprises encrypted video data and a network interface that distributes the decryption parameters to the outside via a network.
The decoding parameter is embedded as a digital watermark.
The encryption means is an encryption means mounted on an IC card or SIM.
Further, the encryption means is an encryption method using a derived key generated from a common key and a random number parameter.
The decryption parameter is the random parameter.

The gist of the second invention of the present application is that in the moving image receiving module for receiving and decrypting the encrypted moving image data distributed via the network from the moving image distribution module,
The module includes a network interface for receiving distribution data distributed over a network;
Decoding parameter extraction means for extracting decoding parameters embedded for each set of predetermined blocks in the audio data recording area of the received distribution data;
Decryption means for decrypting the encrypted video data for each set of predetermined blocks based on the extracted decryption parameters;
It comprises a moving image signal interface that outputs the decoded moving image data to the outside as a moving image signal.
The decoding parameter is embedded as a digital watermark.
The decoding means is a decoding means mounted on an IC card or SIM.
The decryption means is a decryption method using a derivation key generated from a common key and a random number parameter.
Further, the decryption parameter is the random parameter.

The gist of the third invention of the present application is a moving picture transmission system using the moving picture distribution module of the first invention and the moving picture receiving module of the second invention,
Supply the video signal to the video distribution module,
The supplied video signal is converted into video data of a predetermined format by the video data processing means,
The converted moving image data is encrypted by the encryption processing means, and the decryption parameters generated by the encryption processing means almost simultaneously are embedded in the audio data recording area attached to the moving image data by the decryption parameter embedding means in predetermined blocks. And
Deliver the encrypted video data and the distribution data including the decryption parameters over a network via a network interface,
On the other hand, the video receiving module receives the distribution data via a network interface,
Extract the decoding parameters embedded in the audio data recording area of the received distribution data,
Based on the extracted decryption parameters, the decryption means generates decrypted video data from the encrypted video data,
A moving image transmission system that outputs a moving image signal from a moving image output interface.

Digital watermarking is a technique for embedding specific data in image data or audio data at a level that is not normally detected, and is used for protecting the author of digital content. The technology for embedding a digital watermark in audio data has been studied from various aspects such as a method for avoiding deterioration of sound quality or a method for making it difficult to find a watermark. For example, in Patent Document 3, there is no deterioration in sound quality. A digital watermark that is difficult to delete is disclosed.
JP 2005-241796 A

According to the moving image distribution module, the moving image reception module, and the moving image distribution system of the present invention, streaming distribution and reception are performed while changing a key for encryption / decryption by putting a random number parameter as a digital watermark in an audio part. In addition, there is no need to separately prepare a parameter passing method (line, memory card, etc.).
Furthermore, by using an easily removable IC card (SIM) for encryption and random number generation, it becomes easy to change the encryption method and encryption key, so that a high security level can be maintained over a long period of time.

<Video distribution module>
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a functional block diagram of the moving image distribution module of the present invention.
Here, the moving image distribution module 1 has a moving image input interface 12 for capturing a signal from the imaging camera 11 and an audio input interface 14 for capturing a signal from the audio microphone 13. As an encryption means for executing encryption processing and random number generation, SIM is used. Hereinafter, in the description of the video distribution module, an example in which SIM is used will be described, but an IC card is used instead of SIM. You can also.
Note that a SIM (Subscriber Identity Module) is originally made with specifications specialized for security applications, and has an advanced calculation function suitable for cryptographic processing and a high-precision random number generation function. Therefore, the encryption means suitable for the embodiment of the present invention can be realized by using the SIM.

The SIM 15 is mounted in a SIM slot provided in the moving image distribution module 1 and exchanges signals through the interface SIMI / F 16.
The moving image data processing means 21 divides the moving image signal captured from the moving image input interface into blocks having a predetermined length.
The decoding parameter embedding unit 22 embeds a decoding parameter obtained by a procedure described later in a recording area of audio data attached to the segmented moving image data, and generates audio data with the decoding parameter.
The encryption unit 23 encrypts the compressed moving image data with a derived key generated from a secret key held by the SIM 15 and a random number (derived parameter) generated by the random number generation function of the SIM 15.

The network interface 25 converts the encrypted video data and the audio data with the decryption parameter into a format such as ASF (Advanced Streaming Format) which is a format suitable for streaming delivery, and uses RTP (Real-time Transport Protocol). It is distributed over the network via the interface LAN I / F 16 using such a network communication protocol.

In FIG. 1, the moving image distribution module 1, the imaging camera 11, and the audio microphone 13 are shown as independent forms, but the signal processing module 20 that is the core of the function of the moving image distribution module 1 can be made extremely small. Therefore, the moving image distribution module 1 is not limited to the present embodiment, and may be a form integrated with the imaging camera 11 and the audio microphone 13.
Since the moving image data processing means 21 and the decoding parameter embedding means 22 require high-speed arithmetic processing capability, it is desirable to use an arithmetic processing element such as a dedicated chip for the arithmetic processing portion or a DSP for realizing these means. Depending on the size and transmission rate, it can be realized by a combination of a general CPU and software.
Although not shown in the figure, it is also easy to record a moving image and sound as multimedia data on a small storage medium by attaching a small storage medium such as a removable SD memory card to the moving image distribution module 1. .

FIG. 2 is a block diagram of the SIM. In general, the SIM includes a CPU that controls the entire SIM, a ROM that is a nonvolatile memory, and an EEPROM that is an electrically rewritable nonvolatile memory, and has a communication interface for exchanging information with an external device. CP in ROM
A program, OS, etc. for operating U, and parameters, keys, etc. are stored in the EEPROM.
In the SIM 15 relating to the moving image distribution module of the present invention, programs such as communication control, random number generation, encryption / decryption processing, and the like are stored in the ROM 36 and data that may be rewritten such as a secret key is stored in the EEPROM 37. The RAM 38 is a volatile memory, and is used as a work area for the CPU 35 to perform arithmetic processing, a data buffer when communicating with the outside via the communication I / F 39, and the like.

FIG. 3 is a diagram showing the operation of each function of the moving image distribution module of the present invention. The operation of the moving image distribution module of the present invention will be described below together with the operation flow diagram of the moving image distribution module of FIG.
In streaming delivery, since it is normal to perform some data compression on both images and audio, FIGS. 3 and 4 have a flow including compression processing.

In the moving image distribution module 1, the moving image signal from the imaging camera 11 is divided into predetermined blocks (S 20), and the moving image data divided into batch blocks is subjected to moving image compression such as MPEG by the moving image compression means 21. The compressed moving image data 211 is generated in a batch format every predetermined time (S21). Subsequently, the compressed moving image data 211 is sent to the SIM 15 and subjected to encryption processing according to a procedure described later (S34).
At this time, in the SIM 15, a random number is first generated by the encryption means 23 (S32), and the obtained random number 32 is used as a derived parameter for the derived key generation (S33) and decrypted as described later. As a parameter, the decoding parameter embedding unit 22 embeds the parameter in the audio data (S22).

The derived key is a key generated from the secret key 31 and the random number 32 that the SIM originally has, but by generating the random number 31 for each set of predetermined blocks, the derived key can be changed for each set. Become. FIG. 5 schematically shows generation of a derived key, and shows a state in which a derived key 33 is generated from an exclusive OR of a secret key 31 that is a fixed value and a random number 32 that is different for each event.

The encryption processing of the compressed moving image data 211 is executed using an encryption algorithm such as AES or T-DES with the derived key (S34), and the encrypted moving image data 34 is generated.
The encrypted moving image data 34 and the random number 32 are sent from the SIM 15 to the moving image distribution module 1.

The audio signal from the audio microphone 13 is also divided into audio data of a predetermined block in synchronization with the moving image signal, and decoding parameters are embedded (S22). When embedding the decryption parameter, the present invention is characterized in that it is embedded in the form of a digital watermark from the viewpoint of ensuring higher security.
The parameterized audio data 221 generated in this way is further compressed by the audio compression means 24 (S24), and converted into compressed audio data 241 that is batched at a predetermined time interval.

The encrypted moving image data 34 and the parameterized compressed audio data 241 obtained from the SIM 15 are converted into a format such as the ASF format in the network interface 25 (S25a), and further distributed over the network 5 using a protocol such as RTP. (S25b).

The above is the operation flow in the predetermined block, and the moving image distribution module 1 repeats the operation flow by generating a new random number in units of the predetermined block or in units of a plurality of units. (S28).
In FIG. 3, the moving image distribution module 1 and the SIM 15 are described in a form separated for the sake of explanation, but actually, the moving image distribution module 1 and the SIM 15 are integrated to function as the moving image distribution module of the present invention. To fulfill.

<Video reception module>
The moving image receiving module for observing the moving image data distributed by the moving image distribution module of the present invention can restore the original moving image by a procedure that almost goes back to the operation of the moving image distribution module. In addition, since the calculation for reception is lighter than the calculation at the time of distribution, the video reception module can be easily used with a personal computer (PC) if it is a viewer function for observing the distributed video information. Can be built.
If a PC is used as the moving image receiving module, a SIM or IC card equivalent to the SIM in the moving image distribution module is attached to the PC. That is, the SIM of the moving image distribution module and the IC card of the moving image receiving module (PC) are equipped with the same encryption / decryption algorithm and have the same secret key (common key).

FIG. 6 is a functional block diagram of the moving image receiving module of the present invention.
The network interface 50 receives the moving image data distributed from the moving image distribution module via the network. The decoding parameter extraction unit 51 extracts decoding parameters embedded in the audio data recording area attached to the received moving image data.
The decryption means 53 is for decrypting the encrypted video data, and decrypts the video data with the decryption key using the decryption parameter extracted by the decryption parameter extraction means 51.
The example of FIG. 6 represents a form using the encryption / decryption function of an IC card as the decryption means 53, and the IC card is connected to the moving image receiving module 2 via an IC card interface (IC card I / F) 56. Send and receive signals.

The moving image restoration processing unit 52 reconstructs (restores) the moving image data for each block decoded by the decoding unit 53 into a continuous moving image. If the decoded moving image data is compressed data, the moving image restoration processing means 52 also performs decompression processing of the compressed data.
The moving image signal interface 54 outputs the restored moving image signal to the outside.
The moving image signal output in this way can be observed in real time on a display or the like, and can also be stored in a storage device or the like.
In the moving picture receiving module using the PC as described above, the decoding parameter extracting means 51 and the moving picture decoding processing means 52 can be realized by software operating on the PC.

FIG. 7 is an operation flowchart of the moving image receiving module.
Taking as an example the case where the moving image information distributed from the moving image distribution module 1 is played back on a PC, the PC (IC card mounted) connects to the moving image distribution module 1 via the LAN and receives the moving image data (S51).
The moving image data is moving image data that is divided and encrypted for each set of blocks, and decryption parameters are embedded in the audio recording area in the form of a digital watermark or the like. In many cases, the audio signal is compressed and recorded.

Therefore, the PC first restores the audio data with the decoding parameters from the compressed audio data. At this time, if the decoding parameter is embedded in the form of a digital watermark, the digital watermark is extracted from the audio data, and the decoding parameter (random number) is further extracted (S52).

Subsequently, the PC sends the moving image data and the decryption parameter to the IC card, and the IC card generates a derived key from the decryption parameter (random number) and its own secret key (S53). Since the secret key 31 of the SIM 15 of the moving image distribution module 1 and the secret key of the IC card of the PC are common, the derived key generated in the IC card is the same as the derived key 33 in the moving image distribution module 1. By decrypting the moving image data with this derived key, the IC card can restore the original moving image signal (S55).

The PC receives the restored moving image signal from the IC card and outputs it as a unit of moving image signal to a video device such as a display or a storage device (S56). The PC continues to capture the next moving image data until an end instruction is given (S58), and continues to restore the moving image data by repeating the above operation. In order to reproduce the segmented moving image as a continuous moving image, a method is generally used in which moving image data is linked according to time information added to each predetermined block of moving image data. Even when an audio signal is included, the moving image and the audio may be reproduced in synchronization with each other according to the time information.

<Video transmission system>
FIG. 8 is a functional block diagram of the moving picture transmission system.
The moving image transmission system of the present invention includes the moving image distribution module of the first invention and the moving image receiving module of the second invention, and is configured by connecting them via a network.
Due to the functions of the moving image distribution module and the moving image receiving module, the moving image transmission system of the present invention is highly effective in streaming distribution of encrypted moving image data. That is, the key for decrypting the video data is not directly exposed on the network, and the decryption parameter for generating the key is transmitted while changing the video data for each predetermined length. Even in such an open network environment, a streaming distribution mechanism with a high security level can be realized.

Functional block diagram of the video distribution module Configuration diagram of SIM Diagram showing the operation of each function of the video distribution module Operation flow diagram of video distribution module Diagram showing the generation process of the derived key Functional block diagram of video receiving module Operation flow diagram of video receiving module Block diagram of video transmission system

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Movie distribution module 2 Movie receiving module 5 Network 11 Imaging camera 12 Movie input interface 13 Audio microphone 14 Audio input interface 15 SIM
16 SIMI / F
21 video data processing means 22 decryption parameter embedding means 23 encryption means 24 audio compression means 25 network interface 31 secret key 32 random number 33 derived key 34 encrypted video data 50 network interface 51 decryption parameter extraction means 52 video restoration processing means 53 decryption means 54 Video signal interface 55 IC card 56 IC card interface 211 Compressed video data 221 Compressed audio data 241 Audio data with digital watermark

Claims (11)

In a video distribution module that distributes encrypted video data over a network,
The module is
A video input interface;
Moving image data processing means for converting a moving image signal from the input interface into moving image data having a format divided for each predetermined block;
Encryption means for encrypting each set of moving image data blocks divided into blocks from the moving image data processing means, with a minimum unit;
Decoding parameter embedding means for embedding a decryption parameter for decrypting video data encrypted for each set of predetermined blocks for each set of predetermined blocks in an audio data recording area attached to the video data;
A moving image distribution module comprising: encrypted moving image data; and a network interface that distributes the decryption parameter to the outside via a network.   The moving image distribution module according to claim 1, wherein the decoding parameter is embedded as a digital watermark.   3. The moving image distribution module according to claim 1, wherein the encryption unit is an encryption unit mounted on an IC card or a SIM.   4. The moving image distribution module according to claim 1, wherein the encryption unit is an encryption method using a derived key generated from a common key and a random number parameter.   The moving image distribution module according to any one of claims 1 to 4, wherein the decryption parameter is the random number parameter. In the moving image receiving module for receiving and decoding encrypted moving image data distributed via the network from the moving image distribution module according to any one of claims 1 to 5,
The module includes a network interface for receiving distribution data distributed over a network;
Decoding parameter extraction means for extracting decoding parameters embedded for each set of predetermined blocks in the audio data recording area of the received distribution data;
Decryption means for decrypting the encrypted video data for each set of predetermined blocks based on the extracted decryption parameters;
A moving picture receiving module comprising: a moving picture signal interface for outputting decoded moving picture data to the outside as a moving picture signal.   The moving image receiving module according to claim 6, wherein the decoding parameter is embedded as a digital watermark.   The moving image distribution module according to claim 6 or 7, wherein the decoding means is a decoding means mounted on an IC card or a SIM.   9. The moving image distribution module according to claim 6, wherein the decryption unit is a decryption method using a derivation key generated from a common key and a random number parameter.   The moving image distribution module according to claim 6, wherein the decryption parameter is the random number parameter. A video transmission system using the video distribution module according to any one of claims 1 to 5 and the video reception module according to any one of claims 6 to 10,
Supply the video signal to the video distribution module,
The supplied video signal is converted into video data of a predetermined format by the video data processing means,
The converted moving image data is encrypted by the encryption processing means, and the decryption parameters generated by the encryption processing means almost simultaneously are embedded in the audio data recording area attached to the moving image data by the decryption parameter embedding means in predetermined blocks. And
Deliver the encrypted video data and the distribution data including the decryption parameters over a network via a network interface,
On the other hand, the video receiving module receives the distribution data via a network interface,
The decryption parameter embedded in the audio data recording area of the received distribution data is extracted, and based on the extracted decryption parameter, the decryption means generates decrypted video data from the encrypted video data,
A moving image transmission system, wherein a moving image signal is output from a moving image output interface.

Images