JP5221288B2 - Image transmission device - Google Patents

Description

  The present invention relates to an image transmission apparatus that transmits an image, and in particular, for example, an image that divides one screen into a plurality of areas, operates image processing in parallel, and adds a MAC (Message Authentication Code) value. The present invention relates to a transmission apparatus.

In recent years, the number of pixels (= data amount) to be processed by image processing has increased with the trend toward higher pixel count as represented by the transition from NTSC to high vision. For this reason, when processing image data of one screen, it has become difficult to process within a unit time of image display. Here, the unit time of image display is the reciprocal of the frame rate, and in the case of NTSC, it is the reciprocal of 29.97 frames / second, which is about 33 milliseconds.
If the image processing is not completed within the unit time of image display, the frame rate cannot be maintained, and the frame is lost. However, there are systems in which frames are not lost if image processing is completed within a unit time of image display on average over a long time.

  Also, in image transmission equipment for surveillance purposes, it is common to perform compression processing on images in order to reduce the amount of moving image data and still image data (hereinafter collectively referred to as image data). . As the image compression method, the MPEG method is often used for the moving image compression method, and the JPEG method is often used for the still image compression method. Furthermore, with the advent of a new image compression method capable of higher compression, the compression processing load per screen is larger than before.

  When image data is transmitted using a public infrastructure such as the Internet with an image transmission device, there is a possibility that a malicious third party may tamper with the data. It is necessary to detect tampering. The processing load is further increased by the MAC processing for adding the MAC value for performing the alteration detection.

Here, the MAC processing and the MAC value will be described.
The MAC processing is a technique used for tampering detection that confirms that input data has not been rewritten and performs authentication. Data input to perform this MAC processing is called a message. A MAC value of a fixed length is acquired by performing MAC processing on the message.
In the MAC processing, the data content of the message is not rewritten, and when data is transferred to the receiving side that performs the falsification detection processing, the message and the MAC value are passed from the transmitting side to the receiving side. On the receiving side, the same MAC processing as that on the transmitting side is performed on the received message to obtain the MAC value, and the MAC value obtained as a result of this processing is compared with the MAC value received together with the message. If it is the value of, it is determined that the message has not been tampered with.

Cryptographic technology is used for a part of the MAC processing, and unless a pair of a transmitting side and a receiving side having a common encryption key is used, a correct MAC value cannot be calculated. It cannot be generated. Therefore, even if a third party falsifies a message, the MAC value of the message cannot be generated, so that falsification can be prevented.
(Detailed description of the MAC processing will be described later with reference to FIGS. 9 and 10.)

In order to solve the problem of such a large processing load, it is conceivable to make the processing structure parallel processing. For example, in the case of image data, one screen may be divided into a plurality of areas, and image processing such as compression or processing for adding a MAC value may be executed for each divided screen.
FIG. 6 shows an example of a temporal flow of such processing (screen division and parallel processing).
In this example, image compression processing is performed as image processing.
(Note that in all the following explanations, it is assumed that image compression processing is performed as image processing.)

In the example of FIG. 6, a state in which one screen is divided into four from (1) to (4) for parallel processing is shown in the upper left of FIG. For each of the divided screens, compression processing and MAC processing are executed, and compressed data with a MAC value is transmitted.
In this example, a screen configured by sequential scanning is divided into four in the vertical direction. Normally, the image data of the sequential scanning as mentioned in this example starts from the upper left and proceeds in the horizontal direction for each line and ends at the lower right. Therefore, in order to capture the image data of (1) and (2), the capture of the image data of (2) starts after all of the image data of (1) has been captured. For this reason, the start times of the image data compression process (1) ((1) compression process) and the image data compression process (2) ((2) compression process) in (1) start later in (2). . Similarly, the compression process (3) and the compression process (4) are delayed.

After the compression process (1), the MAC process (1) is executed, and the compressed data with the MAC value is transmitted by (1) transmission. Similarly, for the divided screens (2) to (4), compression processing and MAC processing are executed and transmitted. However, the transmission of (2) cannot be performed unless the transmission of (1) is completed. This is because the compressed data is transmitted (concatenated) as a single stream. The reason why there is a time gap between the MAC processing of (2) and the transmission of (2) is that it waits for the transmission of (1) to end. Therefore, transmission is performed in the order of (1) transmission, (2) transmission, (3) transmission, and (4) transmission. The time from the start of the compression process (1) to the start of the next compression process (1) is the unit time for image display (= 1 frame display time).
Regarding the parallel processing of (1), (2), (3), and (4), only transmission is sequentially processed, but other compression processing and MAC processing are (1), (2), (3) , (4) are independent of each other, and there may be an overlapping time at the processing timing of each other. Parallel processing has such a processing time flow.

FIG. 7 shows a configuration example of the image compression device on the transmission side that constitutes the image transmission device for realizing the parallel processing as described above.
The image compression apparatus of this example includes a frame memory 101, three slave processing units 103a, 103b, and 103c, one master processing unit 103d, and a frame memory 102.
Each of the slave processing units 103a to 103c includes compression processing units 111a to 111c and MAC processing units 112a to 112c.
The master processing unit 103d includes a compression processing unit 111d, a MAC processing unit 112d, and an overall control processing unit 113.

The main configuration is that the input image data d1 enters the frame memory 101, from which four parallel processing units (1), (2), (3), (4) (three in this example) The image data is distributed to the slave processing units 103a to 103c and one master processing unit 103d). Each parallel processing unit writes the compressed data with the MAC value in the frame memory 102 after executing the compression process and the MAC process. The frame memory 102 outputs the compressed data d2 with the MAC value as one stream.
Of the four parallel processing units, (4) includes an overall control processing unit 113, which controls (4) and the remaining (1), (2), and (3). For this reason, in this example, (4) is defined as the master processing unit 103d, and the others are defined as the slave processing units 103a to 103c.

Processing in the image compression apparatus shown in FIG. 7 will be described in more detail.
The image data d1 is input and stored in the frame memory 101. In order to divide the image data d1 into four in this example, control for reading from the frame memory 101 is performed by a memory control signal d4 output from the overall control processing unit 113 of the master processing unit 103d. In addition, the three slave processing units 103a to 103c are controlled by the slave control signal d3 output from the overall control processing unit 113, so that each parallel processing unit captures an image area as a target of the divided image data. .
The internal configurations of the slave processing units 103a to 103c in (1), (2), and (3) are the same. From the compression processing units 111a to 111c that perform compression processing and the MAC processing units 112a to 112c that perform MAC processing. Become. The input is image data output from the frame memory 101, and after processing, compressed data with a MAC value is output to the frame memory 102.

  The internal configuration of the master processing unit 103d in (4) is almost the same as that of the slave processing units 103a to 103c, and the compression processing unit 111d and the MAC processing unit 112d are respectively the compression processing units 111a of the slave processing units 103a to 103c. To 111c and the same processing as the MAC processing units 112a to 112c. Similarly to the slave processing units 103a to 103c, the input is image data and the output is compressed data with a MAC value.

The compression processing units 111a to 111c and the compression processing unit 111d perform image compression processing on the input image data. For example, when the input data is a still image, the JPEG method is used, and when the input data is a moving image, an image represented by MPEG such as MPEG-2 or MPEG-4 is used. Compress and output compressed data.
The compressed data with MAC values output by the four parallel processing units are collected in the frame memory 102, and are sequentially output as compressed data d2 with MAC values by the memory control signal d5 output by the overall control processing unit 113.

FIG. 8 shows an example of the structure of compressed data to which a MAC value is added.
The data output from the four parallel processing units (1 to 4) (three slave processing units 103a to 103c and one master processing unit 103d in this example) are immediately after the image compression data. With MAC value. This MAC value is uniquely generated from the compressed data, and another MAC value is generated for the other compressed data. Furthermore, the MAC value is cryptographically processed, and a third party who does not know the value of the encryption key cannot generate the same MAC value. Moreover, the generation source compressed data cannot be derived from the MAC value.
From the above characteristics, the receiving side generates a MAC value from the compressed data and compares it with the transmitted MAC value to determine whether or not the pair of the compressed data and the MAC value is correct. To do. If a third party falsifies the compressed data, it is different from the MAC value generated on the receiving side, and therefore tampering can be detected.

  The four compressed data and MAC value pairs (1) to (4) are stored in the frame memory 102, and the compressed data and MAC values (1) to (4) are connected to form one stream. Is output to the outside as compressed data d2 with MAC value. The connection method at this time has a structure that matches the application of the apparatus. For example, as shown in the lower side of FIG. 8, the storage method in the frame memory is divided into “data structure 1” of the frame memory 102 and “data structure 2” of the frame memory 102. Two are possible.

In the data structure 1, only the compressed data (1) to (4) are concatenated to the frame memory 102, and immediately after that, the MAC values (1) to (4) are concatenated, and all the data are sequentially MACed. Output as compressed data with value d2. This structure can be used in applications such as wireless transmission, for example.
In the data structure 2, the compressed data and the MAC value are separately stored and output separately. This structure can be used, for example, in an application using a network line that transmits data in units of packets.

Next, a MAC process for adding a MAC value for performing falsification detection to compressed data will be described.
FIG. 9 shows a configuration example of the MAC processing units 112a to 112c in the slave processing units 103a to 103c. First, processing (slave processing) by the slave processing units 103a to 103c will be described.
In this process, the MAC value for the input compressed data is calculated and output together with the compressed data. In this example, a message authentication code is generated by a combination of a one-way hash function and cryptographic processing. However, as another configuration example, any one of many methods such as a scheme using block cipher may be used.
The main components of the MAC processing units (slave) 112a to 112c include a memory 121, a one-way hash function unit 122, a common key unit 123, an encryption processing unit 124, a memory 125, and a control processing unit 126.

  The input compressed data e1 is temporarily stored in the memory 121. In the memory 121, the read timing in accordance with the process of the one-way hash function unit 122 is controlled by the compressed data read control signal e 6 from the control processing unit 126. The output data from the memory 121 is input to the one-way hash function unit 122 as a message e2. There is no difference between the data contents of the compressed data e1 and the message e2, and the name of the input data is simply changed to “message” in accordance with the falsification detection technology. Simultaneously with the output to the one-way hash function unit 122, the same data (message e2) is output to the memory 125.

  The one-way hash function unit 122 is controlled by the hash value output control signal e7 from the control processing unit 126, calculates a hash value e3 for the input message e2 using the one-way hash function, and performs cryptographic processing. To the unit 124. The one-way hash function includes (feature 1) outputting a fixed-length hash value from an arbitrary-length message, (feature 2) a hash value is different if the message is different, and (feature 3) having one-way characteristics. Has characteristics.

In (Characteristic 1), the data length of the hash value is constant regardless of whether the data length of the input data (in this case, the compressed data) is long or short. Outputs the hash value of. Due to this property, if a message of an arbitrary length is processed with a hash value, it can be dealt with with a fixed process.
In (Feature 2), if the message changes even by 1 bit, the hash value becomes a different value with a very high probability. The probability of inputting different messages and outputting the same hash value depends on the length of the hash value, but the longer it is, the lower the probability that it will be the same, and it is generally defined that the same hash value cannot be found if it is 20 bytes. . This property makes it possible to confirm the uniqueness of the message.
In (Characteristic 3), since the message cannot be calculated backward from the hash value, it is called one-way. This property is important in that a message with the same hash value cannot be derived by calculation even if tampered.

The common key unit 123 holds the common key in the memory and outputs it to the encryption processing unit 124.
The encryption processing unit 124 inputs the hash value e3 and the common key, executes encryption processing on the message e2, and outputs the result to the memory 125 as the MAC value e4. As a method of encryption processing, any method may be used as long as the original data is obtained by decrypting the encrypted data on the receiving side using the same method on the transmitting side and the receiving side. The common key held in the common key unit 123 is key data determined by restrictions such as a bit length attached to the encryption method, and is used in common on the transmission side and the reception side. This key value is secret to third parties.

  The memory 125 temporarily stores the message e2 output from the memory 121 and the MAC value e4 output from the encryption processing unit 124. As a processing order, the message e2 (= compressed data e1) from the memory 121 is stored in the memory 125, and after the compressed data having a fixed amount of data is read from the memory 121, the calculated MAC value e4 is stored in the memory 125. To do. This is because in the calculation of the MAC value e4, the MAC value e4 as a calculation result cannot be output unless all the compressed data having a certain data amount is processed. Then, the memory 125 outputs the data as the compressed data e5 with the MAC value. The storage timing of the MAC value e4 and the message e2 and the output timing of the compressed data with MAC value e5 are controlled by the MAC value storage control signal e8 output from the control processing unit 126.

  The control processing unit 126 controls data input / output timing for the memory 121, the one-way hash function unit 122, and the memory 125. Further, the control processing unit 126 performs timing coordination with the overall control processing unit 113 (details will be described later) mounted on the external master processing unit 103d by inputting and outputting the slave control signal d3. With this control signal, the master processing unit 103d and the plurality of slave processing units 103a to 103d adjust the processing timing.

FIG. 10 shows a configuration example of the MAC processing unit 112d and the overall control processing unit 113 in the master processing unit 103d.
As a configuration of the master processing unit 103d, generally, an overall control processing unit 113 is added outside the compression processing unit 111d and the MAC processing unit 112d similar to the slave processing units 103a to 103c. .
Here, in this example, the overall control processing unit 113 is arranged outside the MAC processing unit 112d. However, for example, the circuits may be physically grouped so as to be arranged on the same substrate. It is sufficient that at least one MAC processing unit exists for the overall control processing unit 113. For this reason, the master processing unit 103d is specially distinguished from the other slave processing units 103a to 103c.

  The MAC processing unit 112d of the master processing unit 103d is exactly the same as the MAC processing units 112a to 112c of the slave processing units 103a to 103c, and includes a memory 131, a one-way hash function unit 132, a common key unit 133, an encryption unit The processing unit 134, the memory 135, and the control processing unit 136, and the signals connecting them, are compressed data f 1, message f 2, hash value f 3, MAC value f 4, compressed data with MAC value f 5, compressed data read control signal f 6, hash It consists of a value output control signal f7 and a MAC value storage control signal f8.

  In the MAC processing unit 112d of the master processing unit 103d, the message processing operation is the same as the processing by the MAC processing units 112a to 112c of the slave processing units 103a to 103c. Specifically, after executing the one-way hash function processing of the one-way hash function unit 132 and the encryption processing of the encryption processing unit 134 using the common key of the common key unit 133 as a key for the input compressed data f1 The MAC value f4, which is output data, is stored in the memory 135, and is output to the outside as compressed data f5 with a MAC value together with the separately stored message f2. The timing of these operations by the control processing unit 136 is also the same as that of the slave processing units 103a to 103c.

  The overall control processing unit 113 performs overall control of the apparatus such as timing between master processing and slave processing. As already described with reference to FIG. 7, the frame memory 101 is controlled by the memory control signal d4, and the frame memory 102 is controlled by the memory control signal d5. In addition, the slave processing units 103a to 103c other than the master processing unit 103d are controlled by the slave control signal d3.

  As the timing control, as described with reference to FIG. 6, the divided image data when the data of one screen input to the frame memory 101 is divided and output to the slave processing units 103 a to 103 c and the master processing unit 103 d, respectively. Delay time adjustment (timing control), and output data from each of the slave processing units 103a to 103c and the master processing unit 103d are input to the frame memory 102, and collectively output as compressed data d2 with a MAC value And timing control for processing each of the slave processing units 103a to 103c and the master processing unit 103d with a delay.

JP 2005-217598 A JP 2006-229800 A JP 2008-22372 A Japanese Patent Laid-Open No. 11-196392 JP 2008-22373 A JP 2007-288514 A JP 2006-39206 A JP 2005-292482 A Japanese Patent Laid-Open No. 2005-210464 JP 2007-27920 A JP 2003-131922 A

  With the above configuration, an image compression apparatus (image transmission apparatus) that calculates and adds a MAC value corresponding to compressed data can be realized. In this device, if a part of the compressed data is altered, for example, a mismatch with the corresponding MAC value occurs, and the alteration can be detected.

However, in the above configuration, when a third party who tries to tamper with data replaces the compressed data and the MAC value in pairs, tampering cannot be detected.
FIG. 11 shows an example of such a situation.
In the upper half of FIG. 11, in the same manner as described with reference to FIG. 8, the compressed data and the MAC value output by each of (1) processing, (2) processing, (3) processing, and (4) processing are displayed. Are shown as a single compressed data with a MAC value.

  Here, it is assumed that a third party prepares a pair of different compressed data X and a MAC value X calculated from the compressed data X. For example, this data pair can be obtained by extracting a pair of past compressed data and a MAC value from the transmission path. Assume that the pair of data is exchanged so that compressed data X is used instead of compressed data (3) and MAC value X is used instead of MAC value (3), as shown in the lower half of FIG. In this case, since the compressed data X and the MAC value X are a regular pair, they cannot be detected by the falsification detection process. That is, in the case where one screen described with reference to FIG. 6 is divided into four, the image data in the area corresponding to (3) is all rewritten to different data, for example, past image data. Tampering cannot be detected.

  In this way, for example, in an apparatus that divides one screen into a plurality of areas and performs image transmission processing by division processing that can be executed in parallel, a third party who tries to tamper with image data in a certain image area is different. When a pair of image data and a MAC value calculated from the image data is prepared and replaced instead of a pair of normal image data and MAC value, the image data and MAC value replaced by a third party are normal. Since it is a pair, falsification could not be detected by the falsification detection processing on the receiving side.

  The present invention has been made in view of such conventional circumstances. When transmitting an image, for example, one screen is divided into a plurality of areas, image processing is operated in parallel, and a MAC value is added. An object of the present invention is to provide an image transmission apparatus capable of effectively performing the above.

In order to achieve the above object, according to the present invention, an image transmission apparatus for transmitting image data has the following configuration.
In other words, the dividing unit divides a predetermined unit of image data into a plurality of pieces. The first MAC value acquisition unit acquires the MAC value of the divided image data for each of the plurality of pieces of divided image data obtained by the dividing unit. The second MAC value acquisition means is a data composed of the divided image data and the MAC value acquired by the first MAC value acquisition means for the one of the plurality of divided image data obtained by the division means. Get the MAC value. The transmission means transmits the plurality of divided image data obtained by the dividing means, the MAC value obtained by the first MAC value obtaining means, and the MAC value obtained by the second MAC value obtaining means (for example, ,Send.
Therefore, when transmitting an image, for example, one screen can be divided into a plurality of areas, image processing can be performed in parallel, and a MAC value can be effectively added. Can be improved.

Here, various types of image data such as still image data and moving image data may be used.
Further, as the image data, for example, data that has been subjected to arbitrary processing such as compression processing may be used, or arbitrary processing such as compression processing may be performed on the image data after being divided (divided image data). MAC value acquisition processing may be performed after the above.
As the image transmission apparatus, for example, a transmission-side apparatus may be used, or an apparatus having both a transmission-side apparatus and a reception-side apparatus may be used.
Various units may be used as the predetermined unit of image data to be divided. For example, a unit of one frame (one screen) may be used.
In addition, various numbers may be used as the number for dividing the image data.

Various methods of dividing the image data may be used. For example, a method of dividing each of the plurality of regions may be used.
Various methods may be used for acquiring the MAC value of the data (divided image data). For example, a method of acquiring the MAC value by a process of applying a one-way hash function to the data is used. In addition, an encryption process may be used.
Various methods may be used for transmitting the plurality of divided image data and the plurality of MAC values (data). For example, a method of transmitting all these data collectively may be used. Alternatively, a method of separately transmitting the divided image data and the MAC value may be used.

  As described above, according to the image transmission apparatus of the present invention, when transmitting an image, for example, it is advantageous to divide one screen into a plurality of areas, operate image processing in parallel, and add a MAC value. Therefore, the accuracy of tampering detection on the receiving side can be improved.

Embodiments according to the present invention will be described with reference to the drawings.
FIG. 1 shows a configuration example of an image compression device on the transmission side constituting an image transmission device according to an embodiment of the present invention.
The image compression apparatus of this example includes a frame memory 1, three slave processing units 3a, 3b, 3c, one master processing unit 3d, and a frame memory 2.
Each of the slave processing units 3a to 3c includes compression processing units 11a to 11c and MAC processing units 12a to 12c.
The master processing unit 3d includes a compression processing unit 11d, a MAC processing unit 12d, and an overall control processing unit 13.
Further, as data, image data a1, compressed data with MAC value a2, slave control signal a3, MAC value a4, memory control signal a5, and memory control signal a6 are shown.

Here, the configuration and operation of the image compression apparatus of this example are substantially the same as, for example, the image compression apparatus shown in FIG. 7, but the difference of this example is that the MACs of the slave processing units 3a to 3c are different. The MAC value calculated by the processing units 12a to 12c is input to the MAC processing unit 12d of the master processing unit 3d. Therefore, the MAC value a4 can be transferred between the MAC processing units 12a to 12c in the slave processing units 3a to 3c and the MAC processing unit 12d in the master processing unit 3d.
In this example, since the MAC value output from the MAC processing unit 12d of the master processing unit 3d is different from the conventional one (for example, the configuration shown in FIG. 7), the compressed data a2 with MAC value output from the apparatus is also conventional ( For example, it is different from the configuration shown in FIG. The other parts are the same as the conventional configuration (for example, the configuration shown in FIG. 7) and perform the same operation.

FIG. 2 shows a configuration example of the MAC processing units 12a to 12c of the slave processing units 3a to 3c.
The MAC processing units 12a to 12c of the slave processing units 3a to 3c in this example include a memory 21, a one-way hash function unit 22, a common key unit 23, an encryption processing unit 24, a latch unit 25, a memory 26, and a control processing unit 27. I have.
Further, as signals, compressed data b1, message b2, hash value b3, MAC value b4, compressed data with MAC value b5, compressed data read control signal b6, hash value output control signal b7, latch control signal b8, MAC value storage control A signal b9 and a MAC value b10 are shown.

  In the MAC processing units 12a to 12c of the slave processing units 3a to 3c of this example, a latch unit that holds the MAC value b4 output from the cryptographic processing unit 24 as compared with the conventional configuration (for example, the configuration shown in FIG. 9). 25 is added. The latch unit 25 outputs the held MAC value b4 (b10) to the MAC processing unit 12d of the master processing unit 3d. Further, the control processing unit 27 outputs a latch control signal b <b> 8 for controlling the timing at which the latch unit 25 holds the MAC value to the latch unit 25. Other portions are the same as the conventional configuration (for example, the configuration shown in FIG. 9) and perform the same operation.

  As the operation related to the latch unit 25 described above, the control processing unit 27 that controls the data output timing from the memory 21 and the calculation start timing of the one-way hash function unit 22 latches at the timing when the cryptographic processing unit 24 outputs the MAC value. The control signal b8 is output and the latch unit 25 holds the MAC value b4. The latch unit 25 continues to output the stored data (MAC value b4) as the MAC value b10 to the MAC processing unit 12d of the master processing unit 3d, and at least the same period is obtained until the master processing unit 3d captures the MAC value b10. Keep holding. Alternatively, the latch control signal b8 may be controlled so as to keep the same value until the next MAC value b10 is calculated. For other parts, the same operation as in the prior art (for example, one shown in FIG. 9) is performed.

  Here, since the reason why the latch unit 25 is provided in this example is to hold the MAC value b4, as another configuration example, the MAC value b4 stored and held in the memory 26 is read as the MAC value b10. A configuration may be used. In this case, the latch control signal b8 is integrated with the MAC value storage control signal b9 and input to the memory 26.

FIG. 3 shows a configuration example of the MAC processing unit 12d and the overall control unit 13 of the master processing unit 3d.
The MAC processing unit 12d of the master processing unit 3d in this example includes a memory 31, a one-way hash function unit 32, a common key unit 33, an encryption processing unit 34, a memory 35, and a control processing unit 36.
Further, as signals, compressed data c1, MAC value c2 (MAC value a4 in FIG. 1, same as MAC value b10 from all slave processing units 3a to 3c in FIG. 2), message c3, hash value c4, MAC value c5 , Compressed data c6 with MAC value, compressed data control signal c7, hash value output control signal c8, and MAC value storage control signal c9 are shown.

  In the MAC processing unit 12d of the master processing unit 3d of this example, the MAC value c2 input from the MAC processing units 12a to 12c of the slave processing units 3a to 3c is compared with the conventional configuration (for example, the configuration illustrated in FIG. 10). Is stored in the memory 31. Thereby, conventionally, only the compressed data is the target data for the MAC value calculation. In this example, the MAC value c2 output from the slave processing units 3a to 3c is also added to the target for the MAC value calculation. Therefore, the message c3 includes both the compressed data c1 and the MAC value c2, and the one-way hash function unit 32 performs the one-way hash function unit 32 on the data (message c3) and the data (message c3). The MAC value c5 obtained by further performing encryption processing by the encryption processing unit 34 on the hash value is input to the memory 35 as data different from the conventional one.

The compressed data c6 with the MAC value output from the memory 35 is compressed data with the MAC value calculated including the MAC values output from the slave processing units 3a to 3c, which is a feature of this example, unlike the conventional case. .
Further, the control processing unit 36 takes the compressed data c1 and the MAC value c2 from the slave processing units 3a to 3c into the memory 31, concatenates the compressed data c1 and the MAC value c2, and outputs the compressed data as the message c3. Controls the control signal c7.

FIG. 4 shows an example of a flow of generating compressed data with a MAC value.
With reference to FIG. 4, how the compressed data c1 and the MAC value c2 are connected to output the compressed data c6 with the MAC value will be described.
The upper half of FIG. 4 shows the processing (master processing) of the master processing unit 3d, and shows how the MAC value (4) is calculated from the input compressed data (4) from left to right. Shown in the flow. In addition, on the left side of the lower half of FIG. 4, input of compressed data (1) to (3) and MAC values (1) to (3) output by the slave processing units 3a to 3c are shown. Values (1) to (3) are also input to the master processing unit 3d. In the lowermost part of FIG. 4, a state in which all data is connected as the compressed data a2 with the MAC value is shown.

  In the master processing unit 3d, the MAC value (1), the MAC value (2), and the MAC value obtained by the processing (slave processing) of each of the slave processing units 3a to 3c after the compressed data (4) stored in the memory 31. Connect (3). This is output from the memory 31 as one data, and the MAC value (4) is calculated through the one-way hash function unit 32 and the cryptographic processing unit 34. Then, in the memory 35, the compressed data (4) and the MAC value (4) are connected and output. Here, in the past (for example, the configuration shown in FIG. 10), the compressed data with the MAC value output from the MAC processing unit includes the data (message) input to the one-way hash function unit, the MAC value of the calculation result, In this example, the MAC value (1), the MAC value (2), and the MAC value (3) input to the one-way hash function unit 32 are added with the MAC value from the master processing unit 3d. When outputting as compressed data c6, it is deleted. This is because the MAC value (1), the MAC value (2), and the MAC value (3) are obtained from the data output from the slave processing units 3a to 3c, and thus avoiding redundant addition. .

Here, it is assumed that data has been tampered with on the transmission path between the transmission side and the reception side.
First, it is assumed that only the compressed data (1) has been tampered with. In this case, since the MAC value (1) does not match the MAC value calculated from the tampered compressed data (1), the receiving side can detect tampering.
Next, it is assumed that a tampering process is performed in which the pair of the compressed data (1) and the MAC value (1) is replaced with, for example, past data. In this case, on the receiving side, the MAC value calculated from the compressed data (1) and the MAC value (1) match the calculation result, but the MAC value (4) is the compressed data (4), and the altered MAC Since it is different from the MAC value calculated from the value (1), the MAC value (2), and the MAC value (3), tampering can be detected.
Further, even when the compressed data (4) and the MAC value (4) are tampered with, the tampering can be detected because the calculation results of the MAC value (4) and the MAC value are similarly different.
As described above, in this example, it is possible to realize an image transmission apparatus that can detect falsification on the receiving side even when image data and a MAC value of a certain area obtained by dividing one screen are falsified in pairs. .

FIGS. 5A and 5B show examples of screen division.
FIG. 5A shows an example in which image data of one screen is divided into four in the vertical (vertical) direction, and FIG. 5B shows image data of one screen divided into two in the vertical (vertical) direction. An example is shown in which it is divided into two in the horizontal (horizontal) direction, for a total of four.
Here, as a dividing method of the input image data, there is a dividing method as shown in FIG. 5B, for example, in addition to the dividing method shown in FIG. 5A, which is always used in the description of this example. There is no need to use a dividing method, and the area may be divided into any shape.

  In addition, with regard to the portion described as compression processing and compressed data in the above description, the main technique of the present proposal is established regardless of whether or not compression processing is performed on image data. The compressed data may be read as image data. The image processing in this case does not indicate a specific technique, and may be any processing, for example, filter processing for performing noise removal or image size conversion on the input image data, or input processing For example, the image data may be processed without any processing, and the data is input as a message to the MAC processing unit.

  As described above, in the image transmission apparatus of this example, one screen is divided into a plurality of areas, and image processing and MAC processing are performed in parallel on the divided image data of each area, and a plurality of images When processing output data and output MAC values are concatenated and output to a transmission line, the master processing unit 3d includes at least one slave processing unit 3a to 3c, and the master processing unit 3d includes all slave processing units. The MAC values output by 3a to 3c are captured, and a new MAC value is output from the image processing data and the MAC values output by all the slave processing units 3a to 3c.

  Further, in the image transmission apparatus of this example, the slave processing units 3a to 3c continue to output the MAC value at least until the master processing unit 3d captures the MAC value, and the master processing unit 3d used for the MAC processing. For the MAC values fetched from the slave processing units 3a to 3c, only the input image processing data and the processing result MAC values are output without being added to the output data.

  In this way, in this example, in the division process consisting of one master process and at least one slave process, the slave process transfers each calculated MAC value to the master process, and holds the MAC value until the master process takes it in. to continue. The master process can detect the alteration of the combination of the image data output by the master process and the slave process by calculating the MAC value that is the target of the alteration detection including the MAC value received from the slave process. At this time, the MAC value transferred from each slave process becomes the target data for the MAC value calculation in the master process. In this example, the MAC value output from the slave process is added again to the data output from the master process. Don't do it.

  In this example, information input in a time series having a unit structure (for example, one screen) is divided into n pieces for each unit structure, and (n-1) pieces of divided information are respectively MAC-related. Processing (for example, processing of signature, hash, digest, etc.) is performed, and for the remaining one, the processed (n−1) MAC values are combined with the division information to perform the MAC processing. In this example, parallel processing is also performed.

  In the image transmission apparatus (image compression apparatus) of this example, a dividing unit is configured by a function of dividing the image data a1 into a plurality of pieces in the frame memory 1, and the MAC processing units 12a to 12c of the slave processing units 3a to 3c. In 12c, the first MAC value is acquired by the function of acquiring the MAC value of the divided image data (in this example, the message b2 corresponding to the compressed data b1) by the one-way hash function unit 22, the common key unit 23, and the encryption processing unit 24. In the MAC processing unit 12d of the master processing unit 3d, the one-way hash function unit 32, the common key unit 33, and the cryptographic processing unit 34 use the divided image data (in this example, the message c3 corresponding to the compressed data c1). ) And the second MAC value by the function of acquiring the MAC value of the data composed of the MAC values from the slave processing units 3a to 3c. The resulting unit is configured, the transmission means is constituted by the function of transmitting (sending) a plurality of divided image data and a plurality of the MAC values in the frame memory 2.

Here, the configuration of the system and apparatus according to the present invention is not necessarily limited to the configuration described above, and various configurations may be used. The present invention can also be provided as, for example, a method or method for executing the processing according to the present invention, a program for realizing such a method or method, or a recording medium for recording the program. It is also possible to provide various systems and devices.
The application field of the present invention is not necessarily limited to the above-described fields, and the present invention can be applied to various fields.
In addition, as various processes performed in the system and apparatus according to the present invention, for example, the processor executes a control program stored in a ROM (Read Only Memory) in hardware resources including a processor and a memory. A controlled configuration may be used, and for example, each functional unit for executing the processing may be configured as an independent hardware circuit.
The present invention can also be understood as a computer-readable recording medium such as a floppy (registered trademark) disk or a CD (Compact Disc) -ROM storing the control program, and the program (itself). The processing according to the present invention can be performed by inputting the program from the recording medium to the computer and causing the processor to execute the program.

It is a figure which shows the structural example of the image compression apparatus which comprises the image transmission apparatus which concerns on one Example of this invention. It is a figure which shows the structural example of the MAC process part (slave) which concerns on one Example of this invention. It is a figure which shows the structural example of the MAC process part (master) and the whole control process part which concern on one Example of this invention. It is a figure which shows an example of the production | generation flow of the compressed data with a MAC value which concerns on one Example of this invention. (A) And (b) is a figure which shows the example of the screen division based on one Example of this invention. It is a figure which shows an example of the time chart of a screen division | segmentation and parallel processing. It is a figure which shows the structural example of the image compression apparatus which comprises an image transmission apparatus. It is a figure which shows the example of the structure of compressed data. It is a figure which shows the structural example of a MAC process part (slave). It is a figure which shows the structural example of a MAC process part (master) and a whole control process part. It is a figure which shows an example of the data alteration by a compression process unit.

Explanation of symbols

  1, 2, 101, 102 ··· Frame memory, 3a to 3c, 103a to 103c ··· Slave, 3d, 103d ··· Master, 11a to 11d, 111a to 111d · · Compression processing unit, 12a to 12d, 112a to 112d · · MAC processing unit, 13, 113 · · Overall control processing unit, 21, 26, 31, 35, 121, 125, 131, 135 · · Memory, 22, 32, 122, 132 · · one-way hash function unit, 23, 33, 123, 133 .. Common key part, 24, 34, 124, 134 .. Cryptographic processing part, 25 .. Latch part, 27, 36, 126, 136 .. Control processing part,

Claims (1)

In an image transmission device for transmitting image data,
A dividing means for dividing a predetermined unit of image data into a plurality of pieces;
First MAC value acquisition means for acquiring the MAC value of the divided image data for each of a plurality of divided image data other than one of the plurality of divided image data obtained by the dividing means;
A second value for acquiring a MAC value of data composed of the divided image data and the MAC value obtained by the first MAC value obtaining means for the one of the plurality of divided image data obtained by the dividing means. MAC value acquisition means;
Transmission means for transmitting a plurality of divided image data obtained by the dividing means, a MAC value obtained by the first MAC value obtaining means, and a MAC value obtained by the second MAC value obtaining means;
An image transmission apparatus comprising:

Images