CN114374773A

CN114374773A - Method for encrypting image acquisition synchronization information and decrypting, restoring and recovering image acquisition synchronization information at using end

Info

Publication number: CN114374773A
Application number: CN202111617113.2A
Authority: CN
Inventors: 王文超; 李松懋
Original assignee: Shenzhen Ruide Bozhi Information Technology Co ltd
Current assignee: Shenzhen Ruide Bozhi Information Technology Co ltd
Priority date: 2021-12-27
Filing date: 2021-12-27
Publication date: 2022-04-19

Abstract

The invention provides a method for encrypting image acquisition synchronous information and decrypting, restoring and recovering a user terminal, wherein the method comprises the following steps: generating a group of random natural number sequences S according to the image encryption key; the length of the random natural number sequence is N, all values are positioned in a left closed and right open interval [0, N ], and N is the total number of pixel points in a target encryption region of the original image; calculating a value P '(i) of each encryption pixel point in a target encryption region of the original image to obtain an encrypted target encryption region image P'; the decryption restoration method of the user side comprises the following steps: generating a group of random natural number sequences S according to the image encryption key; and calculating the value P (i) of each original pixel point in the encryption area to obtain a decrypted original image P of the encryption area. The invention is beneficial to meeting the requirements of safety protection and reverse processing traceability aiming at the video image.

Description

Method for encrypting image acquisition synchronization information and decrypting, restoring and recovering image acquisition synchronization information at using end

Technical Field

The invention relates to the technical field of information data encryption, in particular to a method for encrypting image acquisition synchronization information and decrypting, restoring and recovering the image acquisition synchronization information by a user side.

Background

With the progress of technology and the need of public safety, various cameras and video monitoring devices are widely used in our lives. The monitoring of the public places such as the outdoor, the monitoring of the merchants in the indoor places such as supermarkets, restaurants, hotels and the like, and even the monitoring of the face access of the residential area and the private monitoring of our own homes. The computer and the smart phone can be used for shooting by self, storing mobile phone images in cloud and other data.

Most present make a video recording, photographic equipment and video monitoring equipment are in image acquisition, transmission, save and each link of using to and the overwhelming majority use individual image, video data's occasion, and image information's safeguard measure is not in place, has following several kinds of condition:

(1) no protective measures are adopted in all links of image acquisition, transmission, storage, use and the like, image data are easy to leak and steal, and once being illegally obtained, the image data can be unlawfully used by an acquirer.

(2) If the process of shooting and recording the image information (including static pictures or dynamic videos) or after the process is finished, mosaic processing is carried out on the sensitive information in the image. After the processing, the privacy information in the image can be protected and can not be correctly identified. However, the image after mosaic processing cannot be restored back to the original image, and sensitive information therein is permanently lost and cannot be restored when needed, so that the availability of traceable is lost, and the requirement of completely restoring information in image data in a specific scene cannot be met.

In the prior art, after the image data is collected, the image data is usually encrypted. A digitized image may need to undergo a series of processing steps in various stages of use, transmission, storage, etc. These image processing methods can be divided into two broad categories: reversible (lossless) or irreversible (lossy).

Reversible image processing methods generally include: rotation, magnification, reduction, displacement, etc. These image processes generally have corresponding inverse operations, i.e., the processed image data can be processed in reverse to obtain the original image data completely (when there is no pixel loss in forward processing) or partially (when there is pixel loss in forward processing).

Irreversible image manipulation generally includes: lossy compression, format conversion, video encoding, etc. Through these image processing procedures, the processed image looks almost exactly the same as the original image in human vision. But its digitized representation, i.e. the corresponding two-dimensional pixel array, may be completely different. Moreover, these image processing procedures are irreversible, that is, the processed image data only contains the information in the original image, and the data of the original image cannot be restored in percentage.

Therefore, there is a need for a new encryption algorithm that can decrypt the image after the encryption process even after the irreversible image processing process, and restore the information contained in the original image, that is, a technique that is visually identical to the original image in appearance.

Disclosure of Invention

Aiming at the technical problem that the image after the encryption processing can still be decrypted and reversely processed to restore the information contained in the original image even after the irreversible image processing process is carried out, the invention aims to provide a method for encrypting the image acquisition synchronization information and decrypting, restoring and restoring by using a user terminal.

The purpose of the invention is realized by adopting the following technical scheme:

in a first aspect, the present invention provides an image acquisition synchronization information encryption method, including:

SE1 generates a group of random natural number sequence S according to the image encryption key; the length of the random natural number sequence S is N, all values are positioned in a left closed and right open interval [0, N ], and N is the total number of pixel points in a target encryption region of the original image;

calculating the value P '(i) of each encrypted pixel point in the target encryption region of the original image to obtain an encrypted target encryption region image P', wherein the adopted calculation function is as follows:

P′(i)＝P(k),k＝S(i),i∈[0..N)

wherein P' (i) represents the ith pixel point of the encrypted target encryption region; p (k) represents the k pixel point in the target encryption region before encryption; (i) represents the ith number in the random natural number sequence S.

In one embodiment, in step SE1, generating a set of random natural number sequences S according to the image encryption key includes:

calling an algorithm e) to generate a random natural number sequence S according to the length N of the random natural number sequence S;

algorithm e): the random natural number sequence generation algorithm aiming at the random natural number sequence with the length of N comprises the following steps:

e1) if N < >256, calling algorithm c) or algorithm d) to calculate the random natural number sequence;

e2) if N is greater than 256, calculating K as N/256;

e3) if K is more than 256, recursively calling the algorithm e), and generating a random natural number sequence SEQ _ R with the length of K when N is equal to K;

e4) if K < >256, calling algorithm c) or algorithm d), generating a random natural number sequence with the length of K, SEQ _ R;

e5) generating K random natural number sequences with the length of 256, SEQ _ N;

e6) the target length N natural number generating sequence is denoted SEQ, with the ith number SEQ [ i ], i ═ 0.. N). Then each number SEQ [ i ] in SEQ satisfies the following formula:

SEQ [ i ] ═ SEQ _ R [ R ] + 256+ SEQ _ N [ m ], R ═ i/256, m ═ i% 256; wherein "/" represents a divide and round operation;

wherein, algorithm d): the random natural number sequence generation algorithm for a length N, 0< N < ═ 256, includes:

d1) if N is a multiple of 16, then the algorithm c) used generates the sequence of natural numbers required;

d2) if N is not a multiple of 16, calculating M, wherein M is N/16+1, and M < 256; calculating a random natural number sequence SEQ with the length of M x 16 according to an algorithm c);

d3) taking the first N numbers (including 0) smaller than N of SEQ to obtain a natural number random sequence with the length of N;

algorithm c): the random natural number sequence generation algorithm for a length of 16 × N, 1< N < ═ 16, includes:

c1) generating a group of random number sequences with the length of N according to the algorithm b), wherein the random number sequences are marked as SEQ _ R;

c2) according to the algorithm a), generating N groups of random number sequences with the length of 16, wherein each group of random number sequence is represented as SEQ _ N, and N is [0.. 16 ]);

c3) the target random number sequence to be obtained is denoted as SEQ, wherein the ith number is denoted as SEQ [ i ], and i ═ 0.. 256). Then each number SEQ [ i ] in SEQ satisfies the following formula:

SEQ[i]＝SEQ_R[r]*16+SEQ_N[m],r＝i/16,N＝r,m＝i％16。

wherein% represents the division remainder operation; SEQ _ R [ R ] represents the R-th number in the sequence SEQ _ R; SEQ _ N [ m ] denotes the mth number in the sequence SEQ _ N;

algorithm b) random natural number sequence generation algorithm of length N < 16:

b1) according to the algorithm a, a random natural number sequence SEQ with the length of 16 is generated

b2) Taking out all numbers smaller than N from SEQ in sequence to obtain a random natural number sequence with the length of N

Algorithm a): the random natural number sequence generation algorithm for the length N-16 includes:

a1) taking an image encryption key as an initial input value;

a2) calculating SHA256 hash value of the input value;

a3) the obtained hash value is a group of binary data with the length of 32 bytes;

a4) each byte is represented by two 16-system numbers, and the hash value is converted into a group of 16-system numbers with the length of 64;

a5) sequentially removing repeated digits from the group of 64 16-ary digits, wherein the obtained digit sequence is a random natural number sequence to be generated if the length is 16; if the length of the obtained digit sequence is less than 16, performing calculation processing to obtain new data based on the input value and the currently obtained hash value, and repeating the steps a2) -a4) by taking the new data as the input value until all 16 random digits are obtained.

In one embodiment, before step S1, the method further includes:

sb1 acquires an original image, wherein the original image is still image data;

sb2 obtains a target encryption area in an original image;

sb3 generates encryption area metadata from the acquired target encryption areas, wherein the encryption area metadata is used to describe location information of each target encryption area;

sb4 generates a random image encryption key.

In one embodiment, after step S1, the method further comprises:

sa1 acquires the metadata encryption key, and encrypts the encryption region metadata and the image encryption key using the metadata encryption key to generate metadata of the encrypted image;

sa2 outputs an encrypted image and metadata of the encrypted image.

In a second aspect, the present invention shows a method for restoring and recovering a file by using end decryption, including:

the SD1 generates a group of random natural number sequences S according to the image encryption key; the length of the random natural number sequence S is N, all values are positioned in a left closed and right open interval [0, N), and N is the total number of pixel points in an encrypted image encryption area;

calculating the value P (i) of each original pixel point in the encryption area to obtain a decrypted original image P of the encryption area, wherein the adopted calculation function is as follows:

P(i)＝P’(k),k＝S(i),i∈[0..N)

wherein P (i) represents the ith pixel point of the encrypted area of the decrypted original image; p' (k) represents the k-th pixel point in the encryption area before decryption; (i) represents the ith number in the random natural number sequence S.

In one embodiment, before step SD1, the method further comprises:

the SA1 extracts metadata of the encrypted image;

the SA2 applies for a decryption key according to the keyid in the metadata;

the SA3 decrypts the ciphertext data in the metadata using the decryption key, resulting in decrypted encrypted region metadata plaintext and image encryption key plaintext.

In a third aspect, the present invention shows an image capturing synchronization information encrypting apparatus, which is used to implement an image capturing synchronization information encrypting method as described in any one of the embodiments of the first aspect.

In a fourth aspect, the present invention shows a consumer-side decryption reduction recovery apparatus, which is configured to implement a consumer-side decryption reduction recovery method as described in any one of the embodiments of the second aspect.

The invention has the beneficial effects that: the invention provides an encryption and decryption method, which is characterized in that in the encryption process, pixel points in an image target area are encrypted, wherein only the coordinate values of the pixel points are changed, and the color values of the pixel points are not changed in the encryption process. However, in most irreversible image processing processes (such as lossy compression, format conversion, video coding, etc.), the color values of the pixels are changed, and the coordinate values of the pixels are generally not changed. Therefore, if the encrypted image is subjected to certain irreversible image processing, as long as the coordinate position of the pixel point in the new image is not changed, the image can be restored to the original image which can be identified by the image decryption method provided by the invention.

For the encrypted image after the reversible operation processing, the original image can be obtained by performing the inverse operation before decryption and then performing image decryption.

Drawings

The invention is further illustrated by means of the attached drawings, but the embodiments in the drawings do not constitute any limitation to the invention, and for a person skilled in the art, other drawings can be obtained on the basis of the following drawings without inventive effort.

FIG. 1 is a flowchart of an exemplary embodiment of a method for encrypting image capture synchronization information according to the present invention;

FIG. 2 is a flowchart of an exemplary embodiment of a method of step SE1 of FIG. 1;

fig. 3 is a diagram of an exemplary embodiment of a recovery method using end decryption and restoration according to the present invention.

Detailed Description

The invention is further described in connection with the following application scenarios.

Referring to fig. 1, it shows an image acquisition synchronization information encryption method, including:

sb1 acquires an original image, wherein the original image is still image data;

in one embodiment, an original image includes: one of the still picture or video images captured by the image, video capture device and software, one of the existing still picture images or video image data, or one of the frames of data in the video stream.

In the above embodiments, the source of the raw image data may be as follows: a still image is acquired by a still image and video image acquisition device and software; already existing still image or video image data; it is the image of a certain frame in the video for the video stream.

Corresponding to the above embodiment, in step Sb 1: acquiring a group of static pictures or dynamic video images acquired by an image, video acquisition equipment and software, and taking one of the static pictures or one of the dynamic video images as an original image;

or, a still picture in the storage device is acquired as an original image, or one of the frames of images in the video image data in the storage device is acquired as an original image.

Or, according to the acquired video stream data, taking one frame image in the video stream as an original image.

Sb2 obtains a target encryption area in an original image;

wherein the target encryption area comprises a sensitive information area or a private information area in the original image. The private information includes personal private information (such as telephone number, home address, etc.), and the sensitive information includes face information, etc.

In one embodiment, in step Sb2, an image recognition algorithm, such as a face detection algorithm, a license plate detection algorithm, or the like, is used to automatically recognize a sensitive information area or a private information area in an image, and obtain a target encryption area.

A fixed area in the image that needs encryption protection may also be designated as the target encryption area using a manual marking method.

One or more target encryption areas can be arranged in one image, and the target encryption areas are not overlapped with each other. And if the two target encryption areas have an overlapping area, combining the two target encryption areas into one target encryption area. An image may also have no target encryption area if the image does not contain sensitive, private information.

In addition, if one image does not contain sensitive and private information, the target encryption area may not be present, and if the target encryption area is absent, the process directly proceeds to step Sa 1.

in one embodiment, step Sb3 includes: generating encryption area metadata according to the acquired target encryption areas, wherein the encryption area metadata are data describing position information of all target encryption areas in the original image and are used for recording the position of each target encryption area in the image;

the encryption area metadata is data describing position information of all the target encryption areas in the previous step, and the exact position of each target encryption area in the image is recorded. The encryption area metadata can be represented in various ways, such as a scene, wherein the target encryption area is a circular area on the image described by the center point coordinates (x, y) and the radius length (r); according to the actual situation of the position of the target encryption area, the corresponding target encryption area can be represented by a digital tuple (x, y, r), and the encryption area metadata is an array consisting of one or more tuples (x, y, r); each tuple corresponds to a target encryption area, wherein x and y represent the coordinates of the center point of the target encryption area, and r represents the radius length of the target encryption area.

In addition, the target encrypted area may be represented by any meaningful and convenient shape.

Sb4 generates a random image encryption key;

wherein, the generated image encryption key should simultaneously satisfy the following requirements: the encryption key cannot be reversely deduced according to the encrypted image; the encryption key cannot be reversely deduced according to the time information; the encryption key of each image is different; the key rule can not be found out through a plurality of encrypted images;

to meet the above requirements, in one embodiment, step Sb4 includes:

performing SHA-256 Hash calculation on original image data A to obtain a first abstract value SHA256 (A);

generating a sequence [ SHA256(A), t, k ] according to the acquired first abstract value SHA256(A), the current time information t and a system generation random number k;

and performing SHA-256 hash calculation again according to the acquired sequence [ SHA256(A), t, k ] to obtain an image encryption key SHA256([ SHA256(A), t, k ]).

The above three elements involved in key generation: the original image data, the current time information (accurate to nanosecond ns) and the system random number all have the characteristics of instantaneity, unsuspectability and irretrievable:

once the original image data is processed and destroyed, the original image data cannot be stolen from the outside of the equipment; the currently processed accurate time information (systematic tick) is only known by the program itself, and is not stored after being used, so that the external part of the equipment cannot guess or steal the information; the random number generated by the system random number generator is a strong random number generator provided by an operating system, which is generally considered to meet the requirement of security encryption.

The image encryption key generated by the method has the following characteristics: the encryption key cannot be reversely deduced according to the encrypted image; the encryption key cannot be reversely deduced according to the time information; the encryption key of each image is different; the key rule can not be found out through a plurality of encrypted images, and the safety is high.

SE1 uses the image encryption key to encrypt all target encryption areas in the image through a reversible encryption algorithm to generate an encrypted image;

when the encryption algorithm is designed, a digital image is considered, and a series of processing may be required in each link of use, transmission, storage and the like. These image processing methods can be divided into two broad categories: reversible (lossless) or irreversible (lossy).

Reversible image processing methods generally include: rotation, displacement, etc. These image processes generally have corresponding inverse operations, i.e., the processed image data can be processed in reverse to obtain the original image data completely (when there is no pixel loss in forward processing) or partially (when there is pixel loss in forward processing).

Therefore, the encryption algorithm proposed by the present invention requires that the image after the encryption process can be decrypted even after the irreversible image processing process, and the information contained in the original image is restored, i.e. the image looks identical to the original image in visual effect.

In one embodiment, referring to fig. 2, step SE1 includes:

generating a group of random natural number sequences S according to the image encryption key; the length of the random natural number sequence S is N, all values are positioned in a left closed and right open interval [0, N ], and N is the total number of pixel points in a target encryption region of the original image;

P′(i)＝P(k),k＝S(i),i∈[0..N)

In one embodiment, in step SE1, generating a set of random natural number sequences S with a length N and values in an interval [0, N) according to an image encryption key includes:

a1) taking an image encryption key as an initial input value;

a2) calculating SHA256 hash value of the input value;

a5) finding 16 different numbers from the 64 16-ary numbers, namely sequentially removing repeated numbers from the 64 16-ary numbers to obtain a number sequence which is a random natural number sequence to be generated if the length is 16;

to further illustrate, if a 16-ary hash value of length 64 is denoted by SUM and SEQ is an array of length 16, the above algorithm can be implemented with the following pseudo code:

wherein SUM (i) not in SEQ is a judgment whether SUM (i) is already in SEQ; append (SEQ, SUM (i)) is the addition of SUM (i) to the end of SEQ;

wherein the method further comprises step a 6): if the length of the random number sequence found in step a4) is less than 16, a calculation process is performed based on the input value and the hash value obtained in the previous step (for example: input value + hash value or DES encryption value is calculated for the input value with the hash value as a key, etc.), to obtain a new data. With this new data as input, steps a2) -a4) are repeated until all 16 random numbers are obtained.

b1) generating a random natural number sequence SEQ with the length of 16 according to an algorithm a;

b2) taking out all numbers smaller than N from SEQ in sequence to obtain a random natural number sequence with the length of N; algorithm c): the random natural number sequence (length < 256) generation algorithm with the length of 16 × N and 1< N <16 includes:

SEQ[i]＝SEQ_R[r]*16+SEQ_N[m],r＝i/16,N＝r,m＝i％16。

wherein% represents the division remainder operation, i.e., the remainder, discarding the integer part of the quotient; the/represents the operation of dividing and rounding, namely the integer part of the quotient, and the remainder is discarded;

algorithm d): the random natural number sequence (length < 256) generation algorithm with the length of N, 0< N < 256 includes:

d1) if N is a multiple of 16, generating a required natural number sequence by using the algorithm of c);

d2) if N is not a multiple of 16, then M is calculated, M is N/16+1, and M < 256. Calculating a random natural number sequence SEQ with the length of M x 16 according to the algorithm of c);

d3) and taking the number of N before SEQ which is less than or equal to N to obtain a natural number random sequence with the length of N.

e) The random natural number sequence generation algorithm with the arbitrary length of N comprises the following steps:

e1) if N < >256, calculating a correlation sequence according to the algorithm of c) or d);

e2) if N is greater than 256, calculating K as N/256;

e4) if K < >256, calling algorithm c) or d), generating a random natural number sequence with the length of K, SEQ _ R;

SEQ[i]＝SEQ_R[r]*256+SEQ_N[m],r＝i/256,m＝i％256。

the random natural number sequence generated by the method can meet the requirements of different lengths N and each value in the sequence is positioned in a left closed right open interval [0, N ]; the random natural number sequence which meets the requirements is constructed through the hash function in the embodiment. The hash function algorithm selected here is SHA256, and other hash functions meeting the requirements may also be selected as needed.

In a computer, an image is digitally converted into a two-dimensional array of individual pixels. The two dimensions of the array are the coordinates (x, y) of the pixel points in the image respectively; each element of the array is a digital representation of the color of the corresponding pixel point, and the elements can be RGBA, YUV and the like according to different used color spaces.

The encryption of the image, i.e. the encryption of the data of such a two-dimensional array, is performed such that the value of each element (or a group of adjacent elements) in the encrypted two-dimensional array is significantly different from the value of the corresponding element before encryption, which should appear visually as if the information in the original image is completely unrecognizable in the new image.

In the invention, an algorithm for image encryption is provided. The algorithm achieves the purpose of encrypting the image by changing the position of each pixel point in the image pixel array.

In addition, because the only change in the algorithm is the coordinate value of the pixel point, and the color value of each pixel point is not changed in the encryption process. However, in most irreversible image processing processes (such as lossy compression, format conversion, video coding, etc.), the color values of the pixels are changed, and the coordinate values of the pixels are generally not changed. Therefore, if the encrypted image is subjected to certain irreversible image processing, as long as the coordinate position of the pixel point in the new image is not changed, the encrypted image can be restored to an identifiable original image (or the original image subjected to the same image processing process) through the image decryption process of the algorithm.

in one embodiment, in step Sa1, obtaining a metadata encryption key includes:

issuing a metadata encryption key request to a KMS (Key management service); acquiring a metadata encryption key and a corresponding identifier keyid returned by the KMS;

in the above embodiments, the KMS is a trusted key management service, provided by a securely authenticated organization department. Currently, mainstream cloud service providers provide reliable KMS services. The KMS can return the plaintext and the ciphertext of the encryption key (when a symmetric encryption mode is used) or return the plaintext of the encryption public key (when an asymmetric encryption mode is used). Each encryption key is identified by its identifier keyid. Through the keyid, a decryption key (a key plaintext or a private key plaintext) can be applied to the KMS; the KMS is responsible for managing the issued keys, which are only available to authorized personnel or applications when decryption keys (key plaintext or encrypted private keys) are required. All communication with the KMS service is encrypted, and cannot be stolen by a third party; all keys are destroyed immediately after use, and are not stored in the memory.

In another embodiment, in step S6, obtaining the metadata encryption key includes:

taking a public key in a preset digital certificate as a metadata encryption key, and taking a serial number of the preset digital certificate as an identifier keyid of the metadata encryption key;

in the above embodiments, the digital certificate is issued by an authoritative certificate authority. The private key of the digital certificate is maintained in a secure, trusted authority or organization and can only be used by authorized personnel. The digital certificate is pre-installed into the device or software. A separate certificate may be issued for each device or software or multiple devices or software may use the same certificate (e.g., as an organization or organization's certificate). The encryption is performed by using a public key in the digital certificate. The serial number of the certificate may be used as the identifier keyid of the key. The method is particularly suitable for encrypting real-time images and videos in such a way that the certificate is installed in advance and an encryption key does not need to be temporarily applied to the KMS.

In one embodiment, in step Sa1, obtaining a metadata encryption key includes: for point-to-point communication, the public key of the opposite end is used as the metadata encryption key. In the communication session handshake phase, both parties exchange respective public keys. In this manner, the keyid may be the user ID of the peer or other identifier that may identify the peer.

In one embodiment, in step Sa1, the method for generating metadata of an encrypted image by encrypting the metadata of the encryption area and the encryption key of the image using the encryption key of the metadata includes:

encrypting the metadata of the encryption area and the image encryption key by using the metadata encryption key to generate ciphertext data;

and (4) composing the generated ciphertext (including the ciphertext of the encryption region metadata and the ciphertext of the image encryption key) and the keyid of the metadata encryption key into the metadata of the encrypted image.

When the metadata encryption key is used for encrypting the metadata of the encryption area and the image encryption key, the specific encryption algorithm is not limited, and the encryption algorithm meets the cryptographic algorithm standard and the application specification thereof. The present application is not specifically limited herein.

Wherein, for the case that there is no target encryption area in step Sb2, step S6 includes:

for an original image that does not contain any encrypted area, a fixed special value is generated as metadata for the encrypted image.

In one scenario, for an image that does not contain any encrypted regions, the metadata may be a fixed special value, such as a fixed length of all-zero digits.

Sa2 outputs an encrypted image and metadata of the encrypted image.

Through the above steps Sb1 to Sa1, the following data are obtained after the original image is subjected to the encryption processing: 1) one encrypted still image (encrypted image): sensitive and private information in the image is protected and cannot be identified through a manual or computer program. 2) Metadata of the encrypted image, the metadata being used to perform a decryption operation on the encrypted image. The encrypted region metadata and the image encryption key in the metadata are stored in a ciphertext mode, and only an authorization organization and personnel can obtain the corresponding decryption key.

Further, in step Sa2, the output encrypted image and metadata of the encrypted image may be further processed, including:

the encrypted image metadata is saved.

In one embodiment, in step Sa2, embedding metadata of an encrypted image into the encrypted image in a digital watermark (blind watermark), specifically includes:

encoding the metadata into a two-dimensional code or a bar code graph; the two-dimensional code or the bar code graph is embedded into the encrypted image through the conversion technology of DCT/DWT/SVD and the like.

The digital watermarking technology has the characteristics of imperceptibility, robustness, attack resistance and the like, and is a mature technology at present. The image embedded with the blind watermark is basically consistent with the original image, and the difference between the image and the original image is difficult to distinguish by human eyes; the image embedded with the blind watermark can be subjected to format conversion, image compression or video coding, the processed image still contains the embedded blind watermark image, and the blind watermark image can be normally decoded to identify information in the blind watermark image; when the storage mode is used, original information in the image is not damaged, the use of the encrypted image and the video is not influenced, and a viewer can not perceive the existence of the metadata.

In another embodiment, in step Sa2, embedding metadata of the encrypted image in the form of a normal watermark includes:

encoding the metadata into a two-dimensional code or a bar code; a fixed area is superimposed on the encrypted image in the manner of a normal watermark. When the storage mode is used, a viewer can perceive the existence of the watermark, but the use of the image or the video is not influenced basically; however, the processing speed of the common watermark is faster than that of the digital watermark, and the method is suitable for occasions with special requirements on the processing speed.

Meanwhile, in step Sa2, the output metadata may be stored separately from the encrypted image, and the metadata may be stored separately from the encrypted image, for example: saved in a file, database, or object store;

the stored metadata should have a unique index, and the file, database or object storing the metadata can be stored, so that the corresponding metadata can be quickly found through the index. The index of the metadata may be generated by encrypting information of the image, such as an index having a digest value or a unique number of the encrypted image as the metadata; it is also possible to generate a unique index by the metadata itself or to directly generate a random number to be associated with the metadata. Such as indexing with the digest value of the encrypted metadata. In this case, since the index of the metadata cannot be obtained from the encrypted image itself, the index of the metadata should be embedded in the encrypted image as a digital watermark or a normal watermark.

The method has the fastest storage processing speed; and the size of the metadata is almost unlimited. The method is particularly suitable for occasions with a large number of encrypted areas in the ultra-large images. Since the metadata and the encrypted image file are separately stored, security can be further improved.

Wherein, the method also comprises: when the image encryption process is completed (after step S7 is completed), the original image data is destroyed immediately, and the image, video capture device and software use the encrypted image as the original captured image for subsequent processing (such as beautification, video encoding, output, display, storage, etc.).

Meanwhile, based on the image acquisition synchronization information encryption method proposed in the embodiment of fig. 1, the present invention further proposes an image acquisition synchronization information encryption apparatus, which is used to implement the image acquisition synchronization information encryption method shown in any one of the embodiments of fig. 1, and the description of the present application is not repeated here.

The invention provides a processing method and a device for image acquisition synchronous encryption privacy protection,

(1) a reversible encryption technology is provided, and encryption processing is carried out on sensitive and private information or designated areas in images and videos. The method has the advantages that non-sensitive information in the image and the video is kept while sensitive and private data in the image or the video are protected; and when needed, the encrypted area in the image and the video can be decrypted to obtain the original image without encryption.

(2) Sensitive and private information or a designated area in the encrypted image cannot be normally identified by a person or a computer program; in addition to this, other unprotected information in the encrypted image may be normally recognized by a person or computer program. Such as: the behaviors of vehicles, objects and characters, events and the like in the images or videos can be normally identified, but the identities of the characters or the license plate numbers of the vehicles cannot be identified, so that the basic use requirements of the image data in different scenes can be met while sensitive and private information is protected. The original purposes of collecting images and videos can be achieved, such as monitoring of people behaviors in the videos, and the effect of protecting sensitive information or privacy information in the images is achieved. Even if the encrypted image and video are leaked, an illegal acquirer cannot identify sensitive or private information in the video.

(3) When needed, authorized personnel can decrypt the encrypted image. The decrypted image and video contain all the information in the original image and video, and the person or computer program can identify and process the sensitive and private information in the image and video. Sensitive and private information in the image can be protected, and meanwhile, all information in the image is reserved, so that applications such as video monitoring and the like can play all functions.

Particularly, when the invention is used for monitoring equipment in public places, after the monitoring equipment is provided with the encrypted certificate issued by an organization uniformly, the personal image privacy data (information such as human faces, identities and the like) of citizens in all collected images and videos can be effectively protected. The original functions of video monitoring can be met, and the individual privacy of citizens is protected. Even if the monitoring video is leaked, the personal privacy data of citizens in the monitoring video cannot be leaked. The leakage channel of the sensitive information is blocked, and crimes caused by leakage and embezzlement of personal image privacy data are reduced. Moreover, when needed, the encrypted image and video data can be decrypted, and sensitive data in the original image can be identified and extracted, so that the requirement of solving a case can be met.

(4) The method can be applied to synchronous encryption processing during the acquisition of static picture and dynamic video data in real time, and the encryption is finished before the image data is transmitted or stored outside through a network. The method can be used as a software or hardware module to be embedded into image and video acquisition equipment or software for operation, and has wide application range and strong adaptability.

(5) The method can process the shot image or video, encrypt the existing image video data and protect the privacy information in the data. After encryption processing, only the encrypted image and video data need to be reserved, and the original unencrypted image and video data can be permanently deleted to eliminate the risk of sensitive and private data leakage.

(6) The above method can also be used in point-to-point image or video transmission and communication: locally acquired images or videos are encrypted using the public key of the opposite end. After the opposite end receives the encrypted image, if sensitive information in the encrypted image is not concerned or is in public places such as subways, internet cafes and other places where privacy cannot be guaranteed, the opposite end does not need to decrypt the video and does not need to worry about that the privacy of the opposite end is peeped by other observers. If sensitive information such as a face of the other party needs to be identified or the privacy can be ensured, the private key of the user can be used for decrypting the image data. So as to meet the information protection requirements under different scenes.

Corresponding to the image acquisition synchronization information encryption method proposed in the above embodiment, referring to fig. 2, the present invention also proposes a decryption, restoration and recovery method at the user end, including:

SB1 extracts the metadata of the encrypted image;

in one embodiment, the following steps are taken to extract the encrypted image metadata according to the form of metadata preservation:

when the metadata is embedded in the encrypted image in a digital watermark manner:

extracting a digital watermark image from the encrypted image through inverse DCT/DWT/SVD, and obtaining an encrypted image without a watermark and a watermark image; identifying two-dimensional code or bar code information in the watermark image; encrypted image metadata is obtained.

When the metadata is embedded in the encrypted image in the normal watermark manner:

intercepting a certain fixed area image on the encrypted image to obtain a watermark image; identifying two-dimensional code or bar code information in the watermark image; encrypted image metadata is obtained.

When the metadata is stored separately from the encrypted image:

extracting a metadata index:

when the metadata index is generated from the encrypted image, generating the metadata index from the encrypted image data using the same algorithm; if the metadata index is embedded into the encrypted image in a digital watermark or common watermark mode, extracting the watermark image and then identifying the metadata index in the watermark image;

the metadata is read from a metadata storage medium (e.g., a file, a database, an object store, etc.) based on the metadata index.

SB2 applies for a decryption key based on the keyid in the metadata;

in one embodiment, according to the way of key application, a decryption key is applied by:

applying for a decryption key from the KMS; or the like, or, alternatively,

applying for a certificate private key to an encrypted digital certificate holder, or carrying out decryption operation by the certificate holder; or the like, or, alternatively,

the key use authority needs to be strictly controlled and audited, and only authorized personnel or application can apply for using the decryption key; or the like, or, alternatively,

in the point-to-point communication, decryption is performed using its own encryption private key.

The SB3 decrypts the ciphertext data in the metadata by using the decryption key to obtain the decrypted metadata plaintext of the encryption area and the plaintext of the image encryption key;

the SD1 obtains the positions of all encrypted areas in the encrypted image from the decrypted encrypted area metadata, and performs a decryption operation on the image of each encrypted area using the image encryption key. Resulting in an unencrypted original image.

In one implementation, corresponding to the encryption method shown in the above SE1, in step SD1, the performing, by using the image encryption key, a decryption operation on the image in each encrypted area specifically includes:

generating a group of random natural number sequences S according to the image encryption key; the length of the random natural number sequence S is N, all values are positioned in a left closed and right open interval [0, N), and N is the total number of pixel points in an encrypted image encryption area;

P(k)＝P′(i),k＝S(i),i∈[0..N)

wherein P (k) represents the k-th pixel point of the decrypted original image encryption area; p' (i) represents the ith pixel point in the encryption area before decryption; (i) represents the ith number in the random natural number sequence S.

The encryption and decryption use the same random number sequence generation algorithm, and the random number sequences generated by the same encryption key are the same. The randomness in the "random natural number sequence S" mainly refers to the irregularity and disorder of the numbers in this sequence, i.e.: the subsequent numbers of the sequence cannot be guessed by the known numbers of the sequence parts. A random encryption key is generated during encryption. The randomness in this "random encryption key" refers to the randomness of the key generation, i.e., the key generated each time is different and cannot be guessed. This random encryption key is stored in the metadata in the form of a ciphertext. In decryption, the encryption key in the metadata is decrypted, and then the key is used to generate a random natural number sequence consistent with the encryption.

The corresponding relation of pixels is consistent between encryption and decryption, except that the value of P is given to P 'during encryption, and P' is given to P during decryption, but the mapping relation of the two is consistent.

In one embodiment, the decryption method further includes:

the SA1 performs the processing flow of SB1-SD1 for each frame of image in the video for the video data, and then video-encodes the decrypted image again to obtain the decrypted video.

Meanwhile, based on the decryption, restoration and recovery method of the user terminal proposed in the embodiment of fig. 3, the present invention further proposes a decryption, restoration and recovery device of the user terminal, which is used to implement the decryption, restoration and recovery device of the user terminal shown in any one of the embodiments of fig. 3, and the description of the present application is not repeated here.

It should be noted that, functional units/modules in the embodiments of the present invention may be integrated into one processing unit/module, or each unit/module may exist alone physically, or two or more units/modules are integrated into one unit/module. The integrated units/modules may be implemented in the form of hardware, or may be implemented in the form of software functional units/modules.

From the above description of embodiments, it is clear for a person skilled in the art that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code or any appropriate combination thereof. For a hardware implementation, a processor may be implemented in one or more of the following units: an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a processor, a controller, a microcontroller, a microprocessor, other electronic units designed to perform the functions described herein, or a combination thereof. For a software implementation, some or all of the procedures of an embodiment may be performed by a computer program instructing associated hardware. In practice, the program may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. Computer-readable media can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

Finally, it should be noted that the above embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the protection scope of the present invention, although the present invention is described in detail with reference to the preferred embodiments, it should be analyzed by those skilled in the art that modifications or equivalent substitutions can be made on the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An image acquisition synchronization information encryption method is characterized by comprising the following steps:

P'(i)＝P(k),k＝S(i),i∈[0..N)

2. The image capturing synchronization information encrypting method according to claim 1, wherein in step SE1, generating a set of random natural number sequence S according to the image encryption key specifically includes:

e2) if N is greater than 256, calculating K as N/256;

e3) if K is greater than 256, recursively calling an algorithm e), and generating a random natural number sequence SEQ _ R with the length of K when N is equal to K;

SEQ [ i ] ═ SEQ _ R [ R ] + 256+ SEQ _ N [ m ], R ═ i/256, m ═ i% 256; wherein/represents an integer division operation; % represents the modulo operation;

d3) taking the first N numbers smaller than N of SEQ to obtain a natural number random sequence with the length of N;

c3) let the sequence of the target random number to be obtained be SEQ, where the ith number is SEQ [ i ], i ═ 0.. 16 × N), then each number SEQ [ i ] in SEQ satisfies the following formula:

SEQ[i]＝SEQ_R[r]*16+SEQ_N[m],r＝i/16,N＝r,m＝i％16

wherein SEQ _ R [ R ] represents the R-th number in the sequence SEQ _ R; SEQ _ N [ m ] denotes the mth number in the sequence SEQ _ N;

b1) according to the algorithm a), generating a random natural number sequence SEQ with the length of 16;

b2) taking out all numbers smaller than N from SEQ in sequence to obtain a random natural number sequence with the length of N;

a1) taking an image encryption key as an initial input value;

a2) calculating SHA256 hash value of the input value;

3. The image capturing synchronization information encrypting method according to claim 1, wherein before step S1, the method further comprises:

sb1 acquires an original image, wherein the original image is still image data;

sb2 obtains a target encryption area in an original image;

sb4 generates a random image encryption key.

4. The image capturing synchronization information encrypting method according to claim 3, wherein after step S1, the method further comprises:

sa2 outputs an encrypted image and metadata of the encrypted image.

5. A decryption restoration method for a user side comprises the following steps:

P(k)＝P'(i),k＝S(i),i∈[0..N)

6. The method for recovering decryption at the client end according to claim 5, wherein before the step SD1, the method further comprises:

SB1 extracts the metadata of the encrypted image;

SB2 applies for a decryption key based on the keyid in the metadata;

the SB3 decrypts the ciphertext data in the metadata using the decryption key, resulting in decrypted encrypted region metadata plaintext and image encryption key plaintext.

7. An image acquisition synchronization information encryption apparatus, characterized in that the apparatus is used for implementing an image acquisition synchronization information encryption method according to any one of the preceding claims 1 to 4.

8. A consumer-side decryption-restoration apparatus, characterized in that the apparatus is used to implement a consumer-side decryption restoration method according to any one of the preceding claims 5 to 6.