Auditing system for misuse of an image information

• US 8,781,296 B2
• Filed: 12/08/2011
• Issued: 07/15/2014
• Est. Priority Date: 12/14/2010
• Status: Active Grant

• Current Assignee: 4dream Company Limited
• Original Assignee: 4dream Company Limited
• Inventors: Kim, Won-Kug, Shin, Jin-Kyo
• Primary Examiner(s): Tran, Thai
• Assistant Examiner(s): Tran, William
• Application Number:
  US13/994,037
• Publication Number:
  US 20130279880A1
• Time in Patent Office: 950 Days
• Field of Search: 386/239
• US Class Current: 386/239
• CPC Class Codes: G11B 27/105 of operating discs
• CPC Class Codes: H04N 21/44236 Monitoring of piracy processes or activities protecting computer platforms against harmful, malicious or unexpected behaviour or activities using intrusion detection and counter measures G06F21/566; computer virus detection and handling G06F21/56
• CPC Class Codes: H04N 21/6582 Data stored in the client, e.g. viewing habits, hardware capabilities, credit card number arrangements where receivers interact with the broadcast H04H20/38
• CPC Class Codes: H04N 9/79 Processing of colour television signals in connection with recording

Abstract

The present invention relates to a system for auditing misuse of an image information, and more particularly, to a system for auditing misuse of an image information, which stores the image information recorded by an image recording device as a file; transmits a log which is related to suspected misuse to the stored file to an auditing server in order to determine whether the stored file was misused; transmits information as to whether a user'"'"'s access log to the stored file, an image deletion log, an image copy log, and an image view log have been modified to the auditing server; determine whether misuse occurred in view of a misuse behavior pattern; and in a case that misuse occurs generates misuse alarm data thereby notifying a user'"'"'s terminal of such misuse.

Claims

1. An auditing system of misuse of an image information comprising:

a first image recording device recording the image information, and storing the recorded image information as a file,

a second image recording device recording an image of a person who approaches toward the first image recording device in order to determine whether the person is authorized to access to the first image recording device, wherein the image of the person captured by the second image recording device is transmitted to an auditing server,

an agent located in the first image recording device, said agent is configured to check a change of a hash value of the image information, a change of a size of the file, and a change of the file content without changing the size of the file, and said agent generates a modification data if any one of changes to the hash value, the size of the file, and the file content is detected, and the agent monitors a plurality of behaviors to detect misuse and generates an image information log including an event data that records any detected misuse behavior to the stored image information; and

the auditing server comprising,

a receiving unit receiving the modification data and the image information log;

a storing unit storing the modification data and the image information log;

a misuse condition database storing the predetermined misuse condition data whether the misuse occurs by a comparison with the image information log can be determined; and

a control unit being operative to compare the event data with the predetermined misuse condition data,

generating the misuse alarm data if the event data included in the image information log is compared with and corresponds to the predetermined misuse condition data, further including information of such misuse occurrence in the image information log, and storing the image information log with the information of such misuse occurrence, or

if the event data does not corresponds to the predetermined misuse condition data, including information that the misuse comparison has been conducted in the image information log, and storing the image information log in the storing unit,

the auditing server receiving the modification data from the image recording device, generating a misuse alarm data when the modification occurs, receiving the image information log, generating the misuse alarm data when the event data that records the misuse behavior in the image information log is compared with all of predetermined misuse condition data, and a portion of the image information log corresponds to the predetermined misuse condition data, the predetermined misuse condition data includes the following cases;

an attempt to watch the image information in which a storage period for the image information expires;

an unauthorized attempt to copy the image information;

an attempt to remotely transmit the file; and

a transmission of a number of the image information that is greater than a predetermined number of transmission made within a predetermined time,

wherein the auditing server stores the modification data and image information log in a Write Once Read Many (WORM) format so that misuse can be detected if there are any change to at least one of modification data and image information log.

2. The auditing system according to claim 1, further comprising a standard time interlock module so that each of the modification data and the image information log from a plurality of the image recording devices is received at a reference time which is applied to the plurality of the image recording devices, since each of the plurality of the image recording devices may have a different time set in the process of receipt for the modification data and the image information log from the plurality of the image recording devices.

3. The auditing system according to claim 1, wherein the control unit comprises a search module in order for file search when the file having the image information log continuously received at real time from the image recording device becomes a large volume, wherein the search module analyzes the image information log included in the searched file, and further searches the image information log determined as the misuse of the image information.

4. The auditing system according to claim 1, wherein the agent is installed in either a Digital Video Recorder (DVR) or a Network Video Recorder (NVR).

5. The auditing system according to claim 1, wherein the predetermined misuse condition data comprises an access to the image recording device not within working hours.

6. The auditing system according to claim 1, wherein the predetermined misuse condition data comprises a deletion of a basis of a log record for image auditing.

7. An auditing system of misuse of an image information comprising:

a first image recording device recording the image information, and storing the recorded image information as a file,

a second image recording device recording an image of a person who approaches toward the first image recording device in order to determine whether the person is authorized to access to the first image recording device, wherein the image of the person captured by the second image recording device is transmitted to an auditing server,

an agent located in the first image recording device, said agent is configured to check a change of a hash value of the image information, a change of a size of the file, and a change of the file content without changing the size of the file, and said agent generates a modification data if any one of changes to the hash value, the size of the file, and the file content is detected, and the agent monitors a plurality of behaviors to detect misuse and generates an image information log including an event data that records any detected misuse behavior to the stored image information; and

the auditing server comprising,

a receiving unit receiving the modification data and the image information log;

a storing unit storing the modification data and the image information log;

a misuse condition database storing the predetermined misuse condition data whether the misuse occurs by a comparison with the image information log can be determined; and

a control unit being operative to compare the event data with the predetermined misuse condition data,

generating the misuse alarm data if the event data included in the image information log is compared with and corresponds to the predetermined misuse condition data, further including information of such misuse occurrence in the image information log, and storing the image information log with the information of such misuse occurrence, or

if the event data does not corresponds to the predetermined misuse condition data, including information that the misuse comparison has been conducted in the image information log, and storing the image information log in the storing unit,

the auditing server receiving the modification data from the image recording device, generating a misuse alarm data when the modification occurs, receiving the image information log, generating the misuse alarm data when the event data that records the misuse behavior in the image information log is compared with all of predetermined misuse condition data, and a portion of the image information log corresponds to the predetermined misuse condition data, the predetermined misuse condition data includes the following cases;

an attempt to watch the image information in which a storage period for the image information expires;

an unauthorized attempt to copy the image information;

an attempt to remotely transmit the file; and

a transmission of a number of the image information that is greater than a predetermined number of transmission made within a predetermined time,

wherein the auditing server stores the modification data and image information log in a Write Once Read Many (WORM) format so that misuse can be detected if there are any change to at least one of modification data and image information log,

wherein the auditing system comprises a standard time interlock module so that each of the modification data and the image information log from a plurality of the image recording devices is received at a reference time which is applied to the plurality of the image recording devices, since each of the plurality of the image recording devices may have a different time set in the process of receipt for the modification data and the image information log from the plurality of the image recording devices,

wherein the control unit comprises a search module in order for a file search when the file having the image information log continuously received at real time from the image recording device becomes a large volume, wherein the search module analyzes the image information log included in the searched file, and further searches the image information log determined as the misuse of the image information,

wherein the agent is installed in either a Digital Video Recorder (DVR) or a Network Video Recorder (NVR),

wherein the auditing server transmits the misuse alarm data to a user'"'"'s terminal device via a SMS message, and

wherein the control unit is configured to generate an auditing report.