RU2826373C1 - Privacy-preserving image distribution - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: invention relates to a method, a system and a computer-readable data medium for distributing personalized images which preserve privacy to a plurality of users. Method comprises using a hardware processor of a privacy management server for: in response to reception of the encrypted initial image, decrypted using the administration key, performing segmentation of the initial image of the encrypted domain to obtain a plurality of user-specific encrypted private images, wherein: selected private image comprises a source image region selected to display a private element of a selected user from a plurality of users, and the other private image contains another area of the original image selected for displaying the private item of another user from the plurality of users; in response to image segmentation, performing the encrypted domain key modification procedure to obtain a plurality of user-specific re-encrypted images, wherein: selected re-encrypted image contains the result of conversion of the selected private image from decrypted using the administration key to the decrypted using the private key of the selected user, and the other re-encrypted image contains the result of converting another private image from the decrypted using the administration key to the decrypted using the private key of the other user; and transmitting a plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to recover the user-specific plaintext versions of the original image.

EFFECT: possibility of distributing data to multiple users with preservation of privacy of corresponding users.

21 cl, 20 dwg

Description

Related applications

[0001] This application claims priority to the filing date of U.S. Provisional Patent Application No. 62/705,604, filed July 7, 2020, entitled “Privacy Preserving Surveillance Systems and Methods,” the entire contents of which are incorporated herein by reference.

LEVEL OF TECHNOLOGY

[0002] The present invention relates to image processing and, in particular, to the use of cryptographic manipulations to distribute an image among a plurality of users in a manner that preserves the privacy of selected users.

[0003] Recent advances in imaging technology and artificial intelligence have led to an explosion in digital surveillance. Police have traditionally used CCTV systems in public places to prevent crime. Surveillance cameras are also increasingly used on private property, in stores, offices, and schools. The data collected by cameras is often further processed to extract various elements, such as a vehicle’s license plate or the identity of the person depicted in a particular image.

[0004] The widespread use of such technologies has raised some concerns. Pro-democracy activists have accused some governments of using surveillance to target political opponents, dissidents, and specific social and ethnic groups. In recent years, the public at large has also become less accepting of mass surveillance, increasingly viewing it as an invasion of privacy.

[0005] There is therefore considerable interest in developing privacy-preserving video surveillance systems and methods.

Disclosure of the essence of the invention

[0006] According to one aspect, a method for distributing personalized privacy-preserving images to a plurality of users comprises using at least one hardware processor of a privacy management server, in response to receiving an encrypted original image decryptable using an administration key, to perform segmentation of the original image of an encrypted domain to obtain a plurality of user-specific encrypted private images. The selected private image comprises an area of the original image selected to display a private element of the selected user from the plurality of users, and another private image comprises another area of the original image selected to display a private element of another user from the plurality of users. The method further comprises using at least one hardware processor of the privacy management server, in response to segmentation of the image, to perform a procedure for changing the key of the encrypted domain to obtain a plurality of user-specific re-encrypted images. The selected re-encrypted image comprises the result of converting the selected private image from being decryptable using the administration key to being decryptable using the private key of the selected user, and the other re-encrypted image comprises the result of converting the other private image from being decryptable using the administration key to being decryptable using the private key of another user. The method further comprises using at least one hardware processor of the privacy management server to transmit a plurality of user-specific re-encrypted images to the image distribution server for further distribution to client devices configured to restore user-specific plaintext versions of the original image.

[0007] According to another aspect, a computer system comprises a privacy management server configured, in response to receiving an encrypted source image decrypted using an administration key, to perform segmentation of the source image of the encrypted domain to obtain a plurality of user-specific private images. The selected private image comprises an area of the source image selected to display a private element of the selected user from the plurality of users, and another private image comprises another area of the source image selected to display a private element of another user from the plurality of users. The privacy management server is further configured, in response to the image segmentation, to perform a procedure for changing the key of the encrypted domain to obtain a plurality of user-specific re-encrypted images. The selected re-encrypted image comprises the result of converting the selected private image from being decryptable with the administration key to being decryptable with the private key of the selected user, and the other re-encrypted image comprises the result of converting the other private image from being decryptable with the administration key to being decryptable with the private key of another user. The privacy management server is further configured to transmit the plurality of user-specific re-encrypted images to the image distribution server for further distribution to client devices configured to recover the user-specific plaintext versions of the original image.

[0008] According to another aspect, a non-transitory computer-readable medium stores instructions that, when executed by at least one hardware processor of the privacy management server, cause the privacy management server, in response to receiving an encrypted source image decrypted using an administration key, to segment the source image of the encrypted domain to obtain a plurality of user-specific private images. The selected private image comprises an area of the source image selected to display a private element of the selected user from the plurality of users, and the other private image comprises another area of the source image selected to display a private element of another user from the plurality of users. The instructions further cause the privacy management server, in response to the image segmentation, to perform a procedure for changing the key of the encrypted domain to obtain a set of user-specific re-encrypted images. The selected re-encrypted image comprises the result of converting the selected private image from being decryptable with the administration key to being decryptable with the private key of the selected user, and the other re-encrypted image comprises the result of converting the other private image from being decryptable with the administration key to being decryptable with the private key of another user. The instructions further cause the privacy management server to transmit the plurality of user-specific re-encrypted images to the image distribution server for further distribution to client devices configured to recover user-specific plaintext versions of the original image.

Brief description of the drawings

[0009] The above mentioned aspects and advantages of the present invention will become more apparent from reading the following detailed description given with reference to the drawings, in which:

[0010] Fig. 1 shows an example of a privacy-preserving surveillance system in accordance with some embodiments of the present invention.

[0011] Fig. 2 shows examples of components of an input sensor in accordance with some embodiments of the present invention.

[0012] Fig. 3 shows examples of components of a client device in accordance with some embodiments of the present invention.

[0013] Fig. 4 shows examples of components of an image distribution server in accordance with some embodiments of the present invention.

[0014] Fig. 5 shows examples of components of a privacy management server in accordance with some embodiments of the present invention.

[0015] Fig. 6 shows an example of a source image in accordance with some embodiments of the present invention.

[0016] Fig. 7 illustrates an example of a public image contained in the original image of Fig. 6, in accordance with some embodiments of the present invention.

[0017] Fig. 8 shows an example of a private image contained in the original image of Fig. 6, in accordance with some embodiments of the present invention.

[0018] Fig. 9 shows an example of a user mask in accordance with some embodiments of the present invention.

[0019] Fig. 10 shows an example of data exchange performed to configure a privacy-preserving surveillance system in accordance with some embodiments of the present invention.

[0020] Fig. 11 shows an example of data exchange performed during operation of a privacy-preserving surveillance system in accordance with some embodiments of the present invention.

[0021] Fig. 12 shows an example of a sequence of steps performed by a privacy management server in the embodiments of the invention illustrated in Fig. 11.

[0022] Fig. 13 shows an example of data exchange performed in an alternative embodiment of the present invention.

[0023] Fig. 14 shows an alternative example of a sequence of steps performed by a privacy management server in the embodiments of the invention illustrated in Fig. 13.

[0024] Fig. 15 illustrates an example of a sequence of steps performed by an image distribution server in accordance with some embodiments of the present invention.

[0025] Fig. 16 shows an example of a sequence of steps describing an exchange between a client device and a distribution server in accordance with some embodiments of the present invention.

[0026] Fig. 17-A shows an example of a reconstructed image available to a selected client device, in accordance with some embodiments of the present invention.

[0027] Fig. 17-B shows another example of a reconstructed image available to another client device, in accordance with some embodiments of the present invention.

[0028] Fig. 18 shows an example of data exchange in an embodiment of the present invention configured to perform a selected task while maintaining privacy.

[0029] Fig. 19 illustrates an example of a hardware configuration of a computing device configured to perform operations in accordance with some embodiments of the present invention.

IMPLEMENTATION OF THE INVENTION

[0030] It should be understood that in the following description, all listed connections between structures can be direct functional connections or indirect functional connections through intermediate structures. A set of elements includes one or more elements. Any reference to an element is considered to refer to at least one element. A plurality of elements includes at least two elements. Unless otherwise specified, any use of "OR" refers to a non-exclusive or. Unless otherwise required, any described method steps do not necessarily have to be performed in the specific illustrated order. A first element (e.g., data) obtained from a second element includes a first element equal to the second element, as well as a first element generated by processing the second element and, optionally, other data. Making a determination or decision in accordance with a parameter includes making a determination or decision in accordance with the parameter and, optionally, in accordance with other data. Unless otherwise specified, an indicator of a quantity/data may be the quantity/data itself or an indicator different from the quantity/data itself. A computer program is a sequence of processor instructions that perform a task. The computer programs described in some embodiments of the present invention may be stand-alone software objects or sub-objects (e.g., routines, libraries) of other computer programs. The term "database" is used herein to denote any structured collection of data. Executing an encrypted domain procedure/operation herein means executing the corresponding procedure/operation in the encrypted domain, i.e., directly on the encrypted input to obtain an encrypted output in a manner that does not involve decrypting the input. An encrypted domain procedure is distinct from a procedure that decrypts the input and then encrypts the output of the corresponding procedure. Unless otherwise specified, an entity executing an encrypted domain procedure/operation on an encrypted item does not have to be aware of the plaintext version of the corresponding item. Machine-readable media include non-transitory media such as magnetic, optical and semiconductor storage media (e.g., hard disks, optical disks, flash memory, DRAM), as well as communication channels such as conductive cables and fiber optic lines. According to some embodiments, the present invention provides, among other things, computer systems comprising hardware (e.g., one or more processors) programmed to perform the methods described herein, as well as machine-readable multimedia encoding instructions for performing the methods described herein.

[0031] The following description illustrates embodiments of the invention by way of example and not necessarily limitation.

[0032] Fig. 1 shows an example of a privacy-preserving surveillance system 10 in accordance with some embodiments of the present invention. The term "surveillance" is used herein only to clarify the disclosure by focusing on a specific example use case, and is not limited to typical surveillance activities such as crime prevention. Although the following description will focus on the example of video surveillance, the disclosed systems and methods can be adapted to other applications, such as maintaining privacy and/or ensuring confidentiality during collaboration between multiple parties working on the same document, preventing cyberbullying committed via online messages, etc.

[0033] The system 10 includes, among other things, an input sensor 14, a distribution server 30, a privacy management server 40, and a plurality of client devices 12a-c, all of which are communicatively connected via a network 15, which may include the Internet.

[0034] The sensor 14 (e.g., a camera, a microphone, etc.) is configured to receive a signal (e.g., encode an image and/or sound), which is further manipulated and transformed as described below. In the example of video surveillance, the sensor 14 may comprise a video camera positioned to receive images of a public space, such as a school yard, a market square, etc. Thus, the sensor 14 may comprise hardware and/or software for receiving a signal (e.g., a charge-coupled device - a CCD illumination sensor), machine-readable media for storing the received signal, and means for transmitting the corresponding signal (e.g., physical layer communication hardware, encoders, antennas, etc.). Fig. 2 shows other examples of components of the input sensor 14, which may comprise special software modules according to some embodiments of the present invention. The cryptographic engine 16 encrypts the received images/sound recordings. The communication module 18 further transmits the received encrypted signals to the privacy management server 40 and/or the image distribution server 30, as described in detail below.

[0035] In some embodiments of the invention, the cryptographic engine 16 encrypts data according to a homomorphic encryption scheme. Homomorphic encryption is a particular type of encryption that allows certain computations, such as addition and/or multiplication, to be performed on encrypted data, wherein decrypting the result of such computation produces the same output as applying the corresponding computation to the plaintext version of the same data. In other words, if Enc(p) = c denotes a homomorphic encryption operation, where p denotes a plaintext message and c denotes its corresponding ciphertext, Dec(c) = p denotes a homomorphic decryption operation that recovers the corresponding plaintext message from its ciphertext, and Eval(F, {c ₁ , …, c _k }) = C denotes a homomorphic evaluation procedure that produces a ciphertext C by applying a function F to a set of ciphertexts c _i , then:

where p _i =Dec(c _i ), i=1, …, k. In formal mathematical language, we say that the encryption and decryption procedures of a homomorphic encryption scheme are homomorphisms between the plaintext space and the ciphertext space.

[0036] Several homomorphic encryption schemes/cryptosystems are known in the art. Schemes that preserve the homomorphic property over any combination of additions and multiplications are widely known as fully homomorphic. An example is the Gentry-Sahai-Waters (GSW) scheme. Other schemes/algorithms are homomorphic only for a certain type of operation, such as only addition in the case of the Paillier scheme, and only multiplication in the case of the Rivest-Shamir-Adelman (RSA) scheme. Such schemes are known in the art as partially homomorphic. In contrast, ciphers that do not have the homomorphic property described above are considered non-homomorphic herein. Examples of non-homomorphic ciphers include the Advanced Encryption Standard (AES) used in some Transport Layer Security (TLS) communication protocols.

[0037] Client devices 12a-c generally represent any end-user electronic device, such as a personal computer, a smartphone, a television, etc., used to access and/or process (e.g., render, play, etc.) data provided by input sensor 14. In some embodiments of the invention, illustrated in Fig. 3, client device 12 may execute surveillance software application 22 configured to perform user authentication exchange (e.g., registration procedure) with distribution server 30 and then display a reconstructed image to the user. Data reconstruction engine 24 is configured to reconstruct the image from a set of public plaintext images and a set of encrypted private images, as described below. Client cryptographic engine 26 is configured to decrypt the received encrypted private image(s). In some embodiments of the invention, engine 26 implements a homomorphic decryption algorithm.

[0038] Each of the distribution server 30 and the privacy management server 40 generally represents a set of interconnected computer systems that may or may not be in physical proximity to one another. Examples of components of the servers 30 and 40 are shown in Figs. 4 and 5, respectively. In some embodiments of the invention, such components are computer programs (software) running on at least a hardware processor. Not all of the illustrated components need to run on the same hardware processor or physical machine. One skilled in the art will understand that in alternative embodiments, some of the illustrated components may be implemented in special hardware, such as application-specific integrated circuits (ASICs) and/or field-programmable gate arrays (FPGAs), in firmware, in a combination of the above.

[0039] In some embodiments of the invention, the distribution server 30 manages the monitoring service, including, for example, communication with the client devices 12a-c for registration and/or authentication of the user, as well as distribution of selectively encrypted data to each client device. Without loss of generality, the server 30 can be referred to herein as an image distribution server, that is, a server configured to distribute images (e.g., video) to clients. It will be understood by one skilled in the art that, depending on the actual embodiment and use case, the server 30 can distribute other types of data, such as audio, electronic documents, etc. The user manager component 32 can manage a set of user and/or account data (user names, passwords, various service agreement parameters, etc.) and provide user interfaces for user registration and account management.

[0040] The access manager component 38 may selectively store and/or retrieve data in/from the data store 20 and selectively forward such data to each client device 12a-c in accordance with the identifier of the user currently authenticated on the corresponding client device. The access manager 38 may comprise, among other things, a web server.

[0041] The cryptographic key manager 34 may initiate and/or perform a procedure for generating keys and exchanging them with the client devices 12a-c and the privacy management server 40. The key manager 34 may further generate a set of proxy re-encryption tokens and selectively associate each such token with a registered user of the monitoring service and/or with a client device 12a-c. More detailed information about such processes is provided below.

[0042] The cryptographic administration mechanism 36 may be configured to perform encryption and/or decryption operations of data, as described below. The mechanism 36 may implement a version of a homomorphic encryption/decryption algorithm.

[0043] In some embodiments of the invention, the data store 20 may comprise a machine-readable storage medium configured to store a database of private and public data. Public data may comprise any data that is accessible to all users, such as a plaintext (i.e., unencrypted) image. Private data may be accessible and/or decryptable only by selected users. Examples of private data include user-specific and composite images encrypted by a proxy, as shown below. Such data may be indexed according to the user to allow selective insertion and retrieval. Indexing may take any form known in the art.

[0044] In some embodiments, the privacy management server 40 (FIG. 5) provides services such as cryptography and automatic detection of private/sensitive elements in data provided by the input sensor 14. The re-encryption engine 46 of the server 40 is configured to perform key replacement procedures on encrypted data, as shown in more detail below. The key replacement procedure herein refers to a procedure for converting ciphertext from being decryptable with one key to being decryptable with another key. One example of a key replacement procedure is known in the art as proxy re-encryption, which allows an entity Z, given some information about another entity Y, to change the ciphertext encrypted under the public key of an entity X, thereby making it decryptable by entity Y. In other words, entity Y can decrypt the ciphertext encrypted under the public key of X using its own secret key, but only after the corresponding ciphertext has been encrypted by the proxy entity Z using a re-encryption key (also known in the art as a re-encryption token) specific to entity Y. Translating this general scheme to the example entities illustrated in Fig. 1, some embodiments of the privacy management server 40 re-encrypt with the proxy data already encrypted with the public key of the distribution server 30 to make the corresponding data decryptable by a selected user of the client device 12a-c. The re-encryption procedure using a proxy uses a re-encryption token specific to the relevant user and/or device, such as a token generated in accordance with the public encryption key of the relevant use/device.

[0045] In some embodiments, the re-encryption engine 46 operates in an encrypted domain, i.e., the corresponding key replacement procedures are performed without decrypting the input. To achieve key replacements in an encrypted domain, some embodiments of the engine 46 implement proxy re-encryption algorithms that are compatible with the homomorphic encryption/decryption algorithms implemented by the client devices 12a-c, the distribution server 30, and/or the input sensor 14. Such algorithms are beyond the scope of the present description; several such examples are known in the field of cryptography, such as the PALISADE code library available at https://gitlab.com/palisade/palisade-development.

[0046] The set of element detectors 42 may be configured to determine whether the input data received from the sensor 14 (e.g., a frame captured by a surveillance camera) contains a representation of a private/confidential element associated with a selected user. Examples of private elements include, among other things, a person, a face or some other part of the body, a logo/trademark, a license plate number, a bank card, an identity card (e.g., a driver's license, a passport), handwritten text, and a person's signature. In embodiments of the invention configured to work with sound, examples of private elements may comprise any element that allows identifying a person, such as any quality of voice, such as timbre, bass, pitch, tempo, modulation, etc. Other examples of private sound elements include the pronunciation of a name and a selected word (e.g., profanity, racial slur, etc.), a gunshot, the sound of a verbal altercation, etc. In embodiments configured to process text documents and/or electronic messages, examples of private elements include written names, addresses, financial information such as credit card numbers, etc. Other examples include, among other things, text written by a selected author, text written on a selected topic, and text written in a selected style or conveying selected sentiments.

[0047] Private objects may be specific to a user. For example, in a schoolyard surveillance use case, each parent may define their own child as a private item, so that the corresponding child may only be visible to the corresponding parent. In some embodiments, multiple users may share a private item and/or one user may have multiple private items. In one such example, all members of a particular user group (e.g., parents of 3rd grade children) may be able to see the faces of their child's peers, but other users may not.

[0048] Fig. 6 shows an example of an original image 70 obtained from a surveillance camera (input sensor 14), which shows examples of private/confidential elements, including a person (e.g., children 72a-b), a face 72c, and a specific object 72d. Figs. 7-8 show examples of public and private images contained in the example of the original image 70. In some embodiments, the private image contains a representation (e.g., an array of numbers) of a private/confidential element. In the example of Fig. 8, the private image 76a contains an area of the original image that displays the private element 72a in Fig. 6. In turn, the public image 74 (Fig. 7) may contain another area of the original image 70 that does not display any private element. For example, the public image 74 may display all of the contents of the original image 70 that are not private. An example of a public image includes a background of a scene (landscape, buildings, trees, yard, sky, etc.). In some embodiments, the public image 74 and/or private image(s) 76a are represented as arrays of numbers having the same size as the original image 70.

[0049] The element detectors 42 may be constructed using any method known in the art. For example, an example of the element detector 42 may comprise an artificial intelligence (AI) system 43a, such as a set of artificial neural networks pre-trained to identify an instance of a corresponding private element in a source image. Examples of the artificial intelligence system 43a include, among other things, a face recognition module and an image segmentation module. The structure and training of such element detectors are beyond the scope of the present description; several architectures and training strategies are known in the art.

[0050] In an embodiment of image processing, an example of an element detector 42 may receive an original image 70 and output a custom mask indicating a region of the original image that displays a representation of a private item (e.g., a region of the original image that displays a face of a particular person). Fig. 9 shows an example of a custom mask 80a associated with a private item 72a from Fig. 6. The example of a custom mask is characterized by a subset of pixels belonging to an image of a corresponding private item. Another example of a custom mask contains all pixels located within an adjacent region of the original image 70, where the region displays a private item. For example, in the embodiment illustrated in Fig. 9, such a region may be defined as the interior of a polygon (e.g., a convex hull, a bounding box, etc.) surrounding the image of the private item. A convenient machine-readable encoding of a user mask comprises a sparse array of numbers, the array having the same size as the original image 70, with all elements equal to zero except for the elements corresponding to the mask pixels. Multiple user masks may be associated with a single user (i.e., a single re-encryption token, see below). Some user masks may overlap.

[0051] In some embodiments, the detectors 42 operate in an encrypted domain, i.e., without decrypting the original images. To achieve such an encrypted domain operation, the AI system 43a (e.g., a neural network implementing face recognition) may be intentionally structured to be compatible with homomorphic encryption schemes. For example, the detector(s) 42 may receive a homomorphically encrypted original image and output a homomorphically encrypted user mask in response, wherein the user mask is encrypted using the same encryption key as that used to encrypt the original image. Several such AI systems have been described in the art. Examples include CryptoNets, described in N. Dowlin et al., "CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy," Proceedings of the 33rd International Conference on Machine Learning, New York, NY, 2016, JMLR: W&CP vol. 48. In one such example, an AI system 43a includes a neural network in which selected layers are equivalent to polynomials of a given degree, and in which typical nonlinear activation functions such as rectifier linear units (ReLUs) are replaced by polynomial approximations.

[0052] In some embodiments, the AI system 43a is pre-trained by the AI training system 11 (e.g., machine learning algorithms running on a processor) using training data provided or otherwise specified by each user. In one such example, when registering with the service, each user may provide a sample representation of a private element(s) of the corresponding user, such as an image of a face or a sample of a person's voice. Some embodiments may then train the AI system 43a to identify representations of the corresponding private elements in the data stream received from the input sensor 14. A corresponding example is training software for recognizing faces on target faces provided by each user. The training produces a set of optimized values 45a of the detector parameters, which are passed to the element detector(s) 42. In an embodiment of a neural network, examples of the parameters 45A include, among other things, a set of synapse weights and neuron biases.

[0053] Fig. 10 shows an example of an exchange performed to initialize/configure a privacy-preserving surveillance service in accordance with some embodiments of the present invention. In the illustrated example, the distribution server 30 performs a key generation procedure to obtain a pair of homomorphic encryption keys specific to the distribution server 30 (hereinafter referred to as administration keys) and transmits a public key 52 of the pair to the input sensor 14 for use in encrypting the received signals/image(s). The server 30 further interacts with a key generation and/or key exchange protocol with the client device 12 (generally representing any of the client devices 12a-c in Fig. 1), wherein the device 12 generates a separate pair of encryption keys specific to each user accessing the privacy-preserving surveillance service through the client device 12 (herein referred to as user keys). An alternative embodiment may generate encryption keys specific to a device. The user and/or device key generation may occur during registration as part of the initial service setup procedures for each user and may be performed in accordance with a homomorphic encryption key generation algorithm. The client device 12 then sends the user's public key(s) 54 to the distribution server 30. In response to receiving the key(s) 54, the key manager 34 may generate a set of proxy re-encryption tokens 50 uniquely associated with each user and/or client device. Some embodiments generate each set of user-specific tokens 50 in accordance with the public key associated with the corresponding user/device and in accordance with the administration key, using a token generation algorithm that is compatible with the homomorphic encryption algorithm used by the client device 12 to generate the user/device keys. Such key generation protocols/procedures are beyond the scope of the present description; several examples are known in the field of cryptography. The re-encryption markers 50 are then transmitted to the privacy management server 40 for use in re-encrypting the proxy of user-specific private images, as described in detail below.

[0054] Fig. 11 and 13 illustrate data exchange performed in two exemplary embodiments of a privacy-preserving surveillance system. For clarity, the following description will focus on video surveillance, i.e., the corresponding source data comprises image data. It will be understood by one skilled in the art that the methods described herein can be adapted to other applications in which the corresponding data comprises audio encoding (e.g., voice recordings), text, etc.

[0055] Fig. 12 and 14 show alternative sequences of steps performed by the privacy management server 40 in the embodiments of the invention described in Fig. 11 and 13, respectively. In turn, Fig. 15 shows examples of steps performed by the image distribution server 30.

[0056] In some embodiments, the data received by the input sensor 14 is encoded as a plaintext image I, for example, comprising an array of numbers in which each number represents the intensity of the corresponding image at a certain position/pixel. Some images may have multiple channels (e.g., red, green, and blue); in such embodiments, each channel may be represented by a separate array. The image I is then encrypted using the cryptographic engine 16 of the sensor in accordance with the public key(s) 52 of the administration to obtain an encrypted data stream 60, which is transmitted to the privacy management server 40. The stream 60 may comprise, for example, a set of encrypted source images:

where Enc(x, k) generally denotes the encryption of a quantity x using a key k, and k ^p _admin denotes the public key(s) 52 of the administration. The asterisk (*) symbol is used to denote encrypted quantities. In a video surveillance embodiment, each encrypted source image I ^* may correspond to a single frame and may be labeled with a corresponding timestamp indicating the time at which the corresponding frame was taken.

[0057] In response to receiving the data stream 60, for each encrypted source image I ^* , in step 204 (FIG. 12), the server 40 may apply the element detector(s) 42 to determine whether the corresponding image contains private data (i.e., images of elements considered private by some users). If so, some embodiments of the detector(s) 42 return a set of user masks (see the example mask 80a in FIG. 9) identifying areas of the source image that display various private elements. In addition, such masks are indexed according to the users who declared the corresponding elements as private. Some embodiments may further determine a set of public masks containing areas of the current frame that contain only public data. In an example embodiment, the public mask is determined by inverting all of the user masks and superimposing the results. In another embodiment, the element detectors 42 may be trained to return a set of public masks along with user masks.

[0058] However, since the privacy management server 40 does not have the private key(s) of administration and thus cannot decrypt the original image(s) I ^* , some embodiments of the element detector(s) 42 operate in the encrypted domain, i.e., directly on encrypted data, and produce encrypted output (i.e., the user masks are also encrypted). Therefore, in some embodiments, although the element detectors 42 are executed on the server 40, the server 40 does not pay attention to the content of the original image, as well as to which region of the original image contains the private element, if any.

[0059] In some embodiments, the set of steps 206-208 (FIG. 12) performs an encrypted domain image segmentation procedure to extract a set of encrypted public and private images from the current source image I ^* in accordance with the output of the element detector(s) 42. Each private image may contain the (encrypted) content of the current source image located in a separate user mask. In some embodiments, the encrypted private image associated with the user mask i may be determined in accordance with the pixel-wise multiplication of the encrypted source image and the encrypted mask i:

where M ^* _i denotes the encrypted user mask i returned by the 42-element detector(s):

and where M _i denotes the user mask i, unencrypted/plaintext.

[0060] The circled dot operator in this document denotes pixel multiplication:

where the pair {xy} indexes the position/pixels in the original image and the custom mask, respectively. Pixel-wise multiplication is applied to images/arrays of the same size.

[0061] Meanwhile, the encrypted public image of the current frame (element 62 in Fig. 11) can be calculated according to the element-wise multiplication of the encrypted original image and the encrypted public mask:

where M ^*PUBLIC denotes the encrypted public mask obtained by the 42-element detector(s):

where M ^PUBLIC denotes the corresponding public mask, unencrypted/plaintext.

[0062] In some embodiments, at step 210, the privacy management server 40 may use the re-encryption mechanism 46 to re-encrypt the proxy of the private image(s) determined as described above (e.g., formula [2]) in accordance with the re-encryption token associated with the corresponding user/mask i, to create an individual, user-specific re-encrypted private image 66 (FIG. 11), which is then transmitted to the image distribution server 30. Such re-encryption of the proxy ensures that the corresponding private image can be decrypted only by the holder of the decryption key associated with the user/mask i. In some embodiments, the re-encrypted private image 66 is tagged with an indicator of the corresponding user to allow the server 30 to selectively insert and/or extract the image 66 into/from the data store 20. An additional sequence of steps 212-214 transmits the encrypted public image 62 and the re-encrypted private image(s) 66 to the server 60 for further distribution to the client devices 12a-c.

[0063] In an alternative embodiment of the invention, illustrated in Fig. 13-14, at step 230, the server 40 may transmit the encrypted user mask(s) 64 to the image distribution server 30 for decryption, and in response receive the decrypted user mask(s) 65 from the server 30. In some embodiments, the decrypted mask(s) 65 comprises plaintext versions of the encrypted user masks determined by the element detector(s) 42:

where Dec(x,k) generally denotes the decryption of a quantity x using a key k, and where k ^s _admin denotes a secret cryptographic key held by the image distribution server 30. In such embodiments, even though the privacy management server 40 can clearly see whether and which region of the original image displays a private element, privacy is still maintained because the server 40 cannot decrypt any region of the corresponding original image I ^* .

[0064] Next, step 234 may extract private images by copying the pixels of the encrypted frame located within each decrypted user mask 65. In some embodiments, this may be equivalent to determining the encrypted private image associated with mask i as:

[0065] The next step 236 may use the re-encryption mechanism 46 to re-encrypt the proxy of each such private image using the user re-encryption token associated with the corresponding mask i to create individual re-encrypted private images. Next, in step 238, some embodiments may calculate a composite re-encrypted private image 67 in accordance with the plurality of individual re-encrypted private images determined in step 236. In some embodiments, the composite image 67 comprises a single image assembled from the plurality of private images in a mosaic, in which each individual re-encrypted private image occupies an area of the composite image corresponding to the corresponding user mask Mi. The calculation of the composite private image may be facilitated by zero-padding each re-encrypted proxy of the private image to the size of the original image. The composite re-encrypted private image 67 may then be calculated in accordance with:

where ReEnc(x, t) generally denotes re-encryption of proxy ciphertext x using token t, and t _i denotes the re-encryption token associated with user/mask i. The circled plus operator here denotes pixel-wise addition:

where the pair {xy} indexes the positions/pixels within the example images I ₁ and I ₂ , respectively. Pixel-wise addition applies to images of the same size.

[0066] The calculated composite re-encrypted private image 67 may then be transmitted to the image distribution server at step 240. In an alternative embodiment, the privacy management server 40 may calculate individual re-encrypted proxy private images and transmit the corresponding images to the distribution server 30. In turn, the server 30 may determine the composite image 67 from the received individual re-encrypted images, for example, using equation [10].

[0067] At the same time (step 226 in Fig. 14), the privacy management server 40 may calculate the encrypted public image 62 as shown above (e.g., equation [6]). Alternatively, the image 62 may be determined according to the plaintext public mask:

where M ^PUBLIC is received from the distribution server 30. In another embodiment, M ^PUBLIC may be calculated by inverting all plaintext user masks M _i received from the server 30 and overlaying the results. In any of these situations, the image 62 is encrypted with the administration key due to the fact that the server 40 performs the segmentation of the image in the encrypted domain, i.e., without decrypting the original image. In other words, the server 40 is not aware of the plaintext content of the public image 62. In step 228, the encrypted public image 62 is transmitted to the server 30 for decryption and further distribution to clients.

[0068] Fig. 15 illustrates an example of the operation of the image distribution server 30 in accordance with some embodiments of the present invention. In a sequence of steps 252-254, the server 30 may wait for messages from the privacy management server 40. When such messages contain encrypted user masks (step 256 returns "yes"), the image distribution server 30 may use the cryptographic mechanism 36 to decrypt the corresponding masks in accordance with its secret administration key (e.g., formula [6] above) and transmit the decrypted mask(s) to the privacy management server 40.

[0069] When the communication contains an encrypted public image 62, the server 40 may decrypt it to obtain a decrypted public image 63:

and store image 63 in data storage 20. Decrypted public image 63 may be marked with a timestamp, frame number or other indicator linking image 63 to the original image from which it was extracted.

[0070] When the message received from the server 40 contains a re-encrypted private image (either specific to the user/mask i or composite, depending on whether the server 40 follows the flow chart 12 or 14, respectively), the image distribution server 30 can insert the corresponding private image into the data store 20. The re-encrypted private images can also be labeled according to a timestamp and/or a label linking the corresponding image(s) to the corresponding original image. The private images can also be labeled to indicate a link to a specific user and/or mask.

[0071] Fig. 16 shows additional examples of steps performed by the image distribution server 30 with respect to the client device 12, generally representing any of the client devices 12A-C in Fig. 1. In step 280, the client device 12 may perform a user authentication procedure to identify the current user of the device 12 to the distribution server 30. Step 280 may implement any user authentication protocol known in the art (e.g., password, two-factor, biometric, etc.). In step 282, the device 12 may then transmit a request to the server 30, for example, to indicate a request to view images from a particular surveillance camera and captured during a certain period of time. In response, in a sequence of steps 284-290, the image distribution server 30 can selectively retrieve from the data store 20 a set of public and private images in accordance with the request and transmit the corresponding images to the client device 12. Depending on whether the privacy management server 40 operates in accordance with the flow charts illustrated in Fig. 12 or 14, the private image (images) can comprise individual re-encrypted private images 66 or composite re-encrypted private images 67, respectively. Such transactions can be carried out, for example, through a web interface. In an alternative embodiment, the image distribution server 30 can open a dedicated connection (for example, a VPN tunnel) with the client device 20 and transmit the public and private images through the corresponding connection.

[0072] One skilled in the art will appreciate that, although the public images were decrypted to plaintext prior to distribution, step 288 does not necessarily involve transmitting the corresponding public images in plaintext. Instead, step 288 may involve re-encrypting the transmitted public image, such as as part of a TLS/HTTPS transmission. However, such encryption does not affect the recovery of the image on the client device; in a TLS/HTTPS transaction, the receiving client device can always decrypt the payload.

[0073] In response to receiving the public and private images, at step 292, the client device 12 may use the client cryptographic engine 26 (FIG. 3) to decrypt the corresponding private images using a secret cryptographic key associated with the corresponding user of the client device 12. Next, at step 294, the data recovery engine 24 may calculate a recovered image in accordance with the decrypted private image(s) and then in accordance with the decrypted public image 63 received from the image distribution server 30. For example, the recovered image may be calculated by adding the decrypted public image 63 and the decrypted private image pixel by pixel:

or

where R _i denotes the reconstructed image visible to user i, and k ^s _i denotes the secret key of user i. When the original image contains private data of multiple users, formula [14] cannot compute the entire reconstructed image in the sense that areas of the reconstructed image corresponding to user masks M _j belonging to users other than the current user i of the client device 12 may be empty. To obtain the entire reconstructed image, some embodiments may fill in the missing areas with dummy data, such as zeros, random noise, random colors, etc.

[0074] Reconstructing a frame according to formula [14] may be advantageous in situations where masks associated with individual users may overlap, such as when some information may be relevant to several users (e.g., members of a selected group), while other information is private to each user. Another example of such a situation may occur in an automatic image segmentation system capable of obtaining a multi-level classification.

[0075] In an embodiment in which the reconstructed image is calculated from a composite private image, the reconstructed image R _i is complete, but the secret key k ^s _i held by user i can only decrypt the private data of the corresponding user. Therefore, areas of the reconstructed image corresponding to user masks M _j of other users will display scrambled images. This effect is illustrated in Fig. 17-AB, which show how two different users see a reconstruction of the same original image. Fig. 17-A shows the reconstructed image seen by user A, who has declared item 72a (Fig. 6) private. User A will see the images of private item 72a, but will not be able to see the images of private items of other users, such as the images of items 72b-cd (see Fig. 6). Fig. 17-B shows the reconstructed image seen by another user B, for whom item 72b is private. User B may be able to see images of item 72b, but may not be able to see images of private items 72a and 72c-d.

[0076] Reconstructing the frame R _i in accordance with formula [15], i.e. from composite encrypted private images, may be advantageous in embodiments in which the element detectors 42 produce only non-overlapping user masks and/or in which individual users do not exchange private information. Otherwise, the areas of the reconstructed image covered by the mask overlaps may not be decryptable by any individual user and, therefore, may appear scrambled. Working with composite private images may further save computational resources, since it allows sending the same encrypted private data (i.e., one composite private image) to all users, instead of storing, indexing and selectively delivering individual private images to each user. In such embodiments, the server 40 may directly insert private and public images into the data store 20 without additional involvement of the distribution server 30. A disadvantage of embodiments using composite re-encrypted private images is that they provide a relatively lower level of privacy compared to embodiments using individual private images, since the server 40 works with decrypted masks/plaintext masks when computing the private images. In other words, although the server 40 does not pay attention to the content of the private images, it knows, for example, whether the original image contains a private element, and it also knows the approximate location of the corresponding private element via the corresponding plaintext mask.

[0077] Fig. 18 illustrates an improvement of a privacy-preserving surveillance system according to some embodiments of the present invention. In some embodiments, the privacy management server 40 ( Fig. 5 ) is further provided with an image processing task module 44 configured to perform a specific task in accordance with the encrypted data stream 60 received from the input sensor 14. One example of an image processing task includes event detection (determining whether an image or sequence of images is indicative of the occurrence of a specific event). For example, in a school surveillance embodiment, the task module 44 may be configured to analyze images captured by a surveillance camera to determine whether the images are indicative of a fight or a bullying incident. In a traffic monitoring embodiment, the task module may automatically determine whether a source image is indicative of an accident, a traffic jam, etc. Other example tasks include counting people in an image and determining whether the number exceeds a predetermined threshold. Another example of a task, in general, includes any image classification/labeling task, such as determining whether an image displays a particular type of object (e.g., a weapon, a personal identification card, a bank card, a license plate, etc.). It will be understood by a person skilled in the art that, although the above examples include image processing, this aspect is not intended to be limiting, and some embodiments of the invention can be adapted to process other types of data, such as audio files, text documents, etc. For example, in an embodiment of audio processing, the task module 44 can determine whether the sound captured by the input sensor 14 is a sign of a gunshot, people screaming, offensive or discriminatory language, etc.

[0078] In some embodiments, the task module 44 (FIG. 5) comprises an AI system 43b that is pre-trained to perform a corresponding task. Several such examples are known in the field of computer vision; their architecture and training are beyond the scope of the present invention. The AI system 43b may be pre-trained by the AI training system 11 in the sense that the system 11 may determine a set of optimized values for the parameters of the task module 45b (e.g., synapse weights, etc.), for example, using a machine learning process, and use the values 45b to create an execution time instance of the image task module 44.

[0079] The task module 44 may operate in an encrypted domain, i.e., without decrypting the original data. In such embodiments, the module 44 may input an encrypted image and generate an encrypted output containing the result of performing the corresponding task, wherein the corresponding output is encrypted with the public administration key, , associated with the distribution server 30. For example, the output of the task module 44 may contain an encrypted version of the verdict or label (for example, YES/NO according to whether the data stream 60 is an indication of the occurrence of a particular event or not). Since the module 44 is executed in an encrypted domain, the privacy management server 40 does not know the result of the task.

[0080] In some embodiments, the output of the task module 44 is re-encrypted by the proxy using the engine 46 (FIG. 5) using the re-encryption token of the selected user to obtain a re-encrypted task result 86, which is sent to the distribution server 30 for delivery to a predetermined notification device 13 (for example, a smartphone of the selected user). In some embodiments, the notification device 13 may also receive the decrypted public image 63, so that the corresponding user can see the publicly available image data in addition to the notification of the occurrence of the corresponding event or situation. For example, a school principal (or a security officer) may receive a notification that a fight is taking place on school grounds, but he/she cannot see who is actually involved in the fight when such information is considered private. Meanwhile, since the task result 86 can only be decrypted by the selected notification device, all users except the school principal may not pay attention to the occurrence of the fight. In addition, the owners/operators of the server 40 are also unaware of such events.

[0081] Some embodiments are further supplemented by adding a superuser who may be allowed to view all private information contained in the original image. Such a superuser may represent an authority figure, such as a school principal, a company human resources representative, etc. When setting up a surveillance service, the image distribution server 30 may create a pair of cryptographic keys, as well as a set of re-encryption tokens associated with the superuser. In one such example embodiment, in response to determining user masks and retrieving private images, the privacy management server 40 may re-encrypt the retrieved private images associated with all users using the re-encryption token(s) of the superuser, thereby creating a composite private image accessible only to the superuser. The corresponding re-encrypted private data is then sent to the image distribution server 30 and further made available to the superuser together with the decrypted public image 63. The superuser can decrypt the corresponding re-encrypted private image and thus completely restore the original image according to the public image 63 and the decrypted composite private image. At the same time, a user who does not have the private encryption key of the superuser may not see the private data belonging to another user.

[0082] Fig. 19 shows an example of a computer system 90 configured to perform some of the methods described herein. The computer system 90 may be any of the client devices 12a-c, as well as the image distribution server 30 and the privacy management server 40. The illustrated hardware configuration is a configuration of a personal computer; the configuration of other computing devices, such as mobile phones and servers, may differ slightly from the configuration shown in Fig. 19. The processor(s) 92 comprises a physical device (e.g., a microprocessor, a multi-core integrated circuit formed on a semiconductor substrate) configured to perform computational and/or logical operations on a set of signals and/or data. Such signals or data may be encoded and delivered to the processor(s) 92 in the form of processor instructions, such as machine code. The processor(s) 92 may comprise a central processing unit (CPU) and/or an array of graphics processing units (GPUs).

[0083] The memory module 93 may comprise volatile computer-readable media (e.g., dynamic random access memory (DRAM)) storing data and/or instruction encodings accessible or generated by the processor(s) 92 during execution of operations. The input devices 94 may include, among other things, computer keyboards, mice, trackpads, and microphones, including corresponding hardware interfaces and/or adapters that allow a user to enter data and/or instructions into the computer system 90. The output devices 95 may comprise display devices, such as, among other things, monitors and speakers, and hardware interfaces/adapters, such as graphics cards, that allow a corresponding computing device to transmit data to a user. In some embodiments, the input and output devices 94-95 have a common hardware portion (e.g., a touch screen). The memory devices 96 comprise computer-readable media that provide non-transitory storage, reading, and writing of program instructions and/or data. Examples of storage devices include magnetic and optical disks and flash memory devices, as well as removable media such as CD and/or DVD disks and drives. Network adapter(s) 97 comprises mechanical, electrical and signal circuitry for transmitting data over physical communication channels connected to an electronic communication network (e.g., network 15 in Fig. 1) and/or to other devices/computer systems. Adapter(s) 97 may be further configured to transmit and/or receive data using a plurality of communication protocols.

[0084] The controller hub 98 generally represents a plurality of system, peripheral, and/or chipset buses and/or all other circuits that provide communication between the processor(s) 92 and the remaining hardware components of the computer system 90. For example, the controller hub 98 may include a memory controller, an input/output (I/O) controller, and an interrupt controller. Depending on the hardware manufacturer, some such controllers may be included in a single integrated circuit and/or may be integrated with the processor(s) 92. In another example, the controller hub 98 may include a northbridge connecting the processor 92 to the memory 93 and/or a southbridge connecting the processor 92 to devices 94, 95, 96, and 97.

[0085] Examples of systems and methods described in this document allow data (e.g., recorded video, photographs, recorded audio, digital documents, etc.) to be distributed among multiple users in a manner that preserves the privacy of the respective users. In some embodiments, homomorphic encryption and proxy re-encryption techniques are used to manipulate the respective data so that selected portions thereof are identified in accordance with the identity of the user currently accessing the respective data.

[0086] One example of an application of some embodiments comprises video surveillance, wherein the distributed data comprises a stream of images obtained from a surveillance camera. In some embodiments, image recognition techniques are used to determine whether the image contains an element considered confidential by a selected user (e.g., a specific person or face, a specific license plate, etc.), and to manipulate and selectively encrypt the corresponding image so that only the corresponding user can see the confidential element. Meanwhile, other users may be given access to another version of the same image in which the confidential element is hidden (e.g., blurred, cut out, scrambled, etc.).

[0087] One example use case includes monitoring a school yard for signs of bullying, fighting, and verbal aggression. In some embodiments, selected users (e.g., parents) may designate certain children as private elements. Images of the school yard captured by a video camera may be distributed among multiple users. However, images distributed to the school principal and the parent of a child who is considered private will show the face of the corresponding child, while in images distributed to all other users, the face may be hidden or scrambled. Such manipulations may, for example, preserve the privacy of a child who has been bullied and/or delay the disclosure of the identity of the bully until the incident has been investigated.

[0088] The use of some embodiments is not limited to surveillance. In another example, a camera records a presentation of a product or prototype. The images are then transmitted to multiple remote users, such as in a video conference format. However, individual users may receive different versions of the same image. For example, users who have signed a non-disclosure agreement may be shown the corresponding product or prototype, while in images distributed to other users, the corresponding element may be hidden/scrambled.

[0089] The nature of the elements considered private/sensitive may vary greatly depending on the embodiments. Some examples include, but are not limited to, an offensive hand gesture, an item of clothing (headscarf, swimsuit, etc.), an item of jewelry, a specific body part (bare leg, chest, etc.), a weapon, a company logo, a body lying on the ground (potentially a homeless person or a person in need of medical attention), and a person in uniform (e.g., police, medical personnel). The AI system 43 (FIG. 5) can be trained to recognize any such type of private element in the original image. Subsequently, some users will see an image of the corresponding elements, while others will not.

[0090] Many conventional video surveillance systems use encryption to prevent unauthorized access to the acquired images. Some such systems are also supplemented with automatic image recognition and/or image segmentation functions. However, conventional surveillance systems first decrypt the original images in preparation for image recognition. For example, a conventional computer system that performs image analysis typically also has cryptographic keys for decrypting the original images. In contrast, using homomorphic encryption, some embodiments of the present invention perform automatic feature detection/mask construction directly in the encrypted domain, i.e., without first decrypting the original images. In particular, the privacy management server as described herein does not even have the keys for decrypting the original data. Therefore, in embodiments of the present invention, the computer system that performs image recognition and/or segmentation does not pay attention to the content of the images being analyzed, which significantly increases the privacy of users of the system.

[0091] The use of homomorphic encryption in some embodiments of the present invention also allows for the separation of user management/image distribution activities from image analysis activities. In the example of a privacy-preserving video surveillance system as shown in Fig. 1, servers 30 and 40 may be owned and operated by separate entities. In one example of a use case illustrating the advantages of some embodiments of the present invention, company A owns and operates the input sensor(s) 14 and the distribution server 30 and outsources the image processing services, i.e., the services provided by the server 40, to another company B. The sensors 14 may collect images from an office building, and company A may be interested in automatically detecting events such as abnormal office dynamics, the presence of an unknown person, etc., to determine attendance at certain office events, to determine when certain employees arrive at work or leave the office, etc. Company B can provide such services in a privacy-preserving manner, since the server 40 does not have access to unencrypted data and additionally does not have the information to decrypt the incoming raw data. Instead, the segmentation of images and/or the execution of other tasks are performed in an encrypted domain, and the results of such operations can only be decrypted by computer systems (e.g., server 30, selected client devices 12a-c) controlled by representatives of company A. Privacy is further enhanced by the fact that in the embodiments illustrated in Figs. 11 and 13, distribution server 30 may not have access to the original data as such, but only to the “public portion” thereof, i.e., the portion of the original images that does not display private/confidential elements.

[0092] Applications of some embodiments are not limited to image/video surveillance processing and can be adapted to, among other things, processing audio files, documents, and electronic messages. In one such illustrative embodiment, the voice of a target person may be selected as a private element. Source data, such as an audio recording, may be processed as shown herein, i.e., may be divided into a private part and a public part, where the private part may consist of a segment of the source recording containing the utterances of the target person. The private part may then be re-encrypted by a proxy using a marker corresponding to a selected subset of users. When the corresponding audio recording is reconstructed, the selected users may hear the speech of the target person, while other users may not. Another example of an embodiment may distort/scramble utterances of certain words (e.g., curses, selected names, etc.).

[0093] In an example embodiment of document or message processing, private elements may contain specific names, addresses, telephone numbers, credit card or bank account numbers, etc. In some embodiments, private elements may contain entire portions of a document, such as a specific section/chapter, portions having a specific author, portions relating to a specific subject. In another example embodiment, private elements may contain portions of a conversation (e.g., an exchange of emails) that indicate specific feelings, such as anger, threat, suicidal thoughts, overt sexual intent, etc. Element detectors 42 may use a set of rules or a pre-trained artificial intelligence system to automatically identify such private elements in an encrypted source document. Using selective proxy re-encryption techniques as shown herein, the same document may then be distributed to multiple users such that selected users can see the corresponding private elements in plaintext, while other users cannot.

[0094] It will be understood by those skilled in the art that the embodiments described above can be modified in various ways without departing from the scope of legal protection of the present invention. Accordingly, the scope of legal protection of the present invention is defined by the following claims and their legal equivalents.

Claims (60)

1. A method for distributing personalized privacy-preserving images to a plurality of users, comprising using at least one hardware processor of a privacy management server to: in response to receiving an encrypted source image decrypted using the administration key, performing segmentation of the encrypted domain source image to obtain a plurality of user-specific encrypted private images, wherein: the selected private image contains a region of the original image selected to display the private element of the selected user from the plurality of users, and another private image contains another region of the original image selected to display a private element of another user from the plurality of users; in response to segmenting the image, performing a procedure for changing the key of the encrypted domain to obtain a plurality of user-specific re-encrypted images, wherein: the selected re-encrypted image contains the result of converting the selected private image from decryptable with the administration key to decryptable with the private key of the selected user, and the other re-encrypted image contains the result of converting the other private image from being decryptable with the administration key to being decryptable with the private key of another user; and transmitting a plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to recover user-specific plaintext versions of the original image. 2. The method according to item 1, wherein: performing segmentation of the original image of the encrypted domain further comprises determining an encrypted public image containing regions of the original image selected so as not to display either the private element of the selected user or the private element of another user; wherein the method further comprises using at least one hardware processor of the privacy management server to transmit the encrypted public image to the image distribution server for decryption and further distribution to client devices; and wherein the client devices are configured to recover user-specific plaintext versions of the original image in addition to the decrypted public image received from the image distribution server. 3. The method according to claim 1, further comprising using at least one hardware processor of the image distribution server to: in response to receiving the selected re-encrypted image, selecting a device from the plurality of client devices in accordance with whether the selected device is controlled by the selected user; and in response to the client device's selection, transmitting the selected re-encrypted image to the selected device. 4. The method according to claim 3, further comprising using at least one hardware processor of the image distribution server to: in response to receiving another re-encrypted image, selecting another device from the plurality of client devices in accordance with whether the other device is controlled by another user; and in response to selecting another device, transmitting another re-encrypted image to another device. 5. The method according to claim 1, wherein the definition of the selected private image comprises: using a pre-trained element detector to compute a mask identifying a region of the original image displaying a private element of the selected user, wherein the mask is computed in an encrypted domain and is decryptable using the administration key; and determining the selected private image according to the pixel multiplication of the encrypted source image and the mask. 6. The method according to claim 1, wherein the encrypted source image is encrypted in accordance with a homomorphic encryption scheme. 7. The method of claim 1, wherein the plaintext version of the original image, restored by the client device controlled by the selected user, displays the private element of the selected user and hides the private element of another user. 8. The method according to claim 1, wherein the private element comprises an element selected from the group consisting of a person and a person's face. 9. The method according to claim 1, wherein the private element contains a bank card. 10. The method according to claim 1, wherein the private element contains a trademark. 11. A computer system comprising a privacy management server configured to: in response to receiving an encrypted source image decrypted using the administration key, performing segmentation of the encrypted domain source image to obtain a plurality of user-specific private images, wherein: the selected private image contains a region of the original image selected to display the private element of the selected user from the plurality of users, and another private image contains another region of the original image selected to display a private element of another user from the plurality of users; in response to segmenting the image, performing a procedure for changing the key of the encrypted domain to obtain a plurality of user-specific re-encrypted images, wherein: the selected re-encrypted image contains the result of converting the selected private image from decryptable with the administration key to decryptable with the private key of the selected user, and the other re-encrypted image contains the result of converting the other private image from being decryptable with the administration key to being decryptable with the private key of another user; and transmitting a plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to recover user-specific plaintext versions of the original image. 12. The computer system according to item 11, in which: performing segmentation of the original image of the encrypted domain further comprises determining an encrypted public image containing regions of the original image selected so as not to display either the private element of the selected user or the private element of another user; wherein the privacy management server is additionally configured to transmit the encrypted public image to the image distribution server for decryption and further distribution to client devices; wherein the client devices are configured to restore user-specific plaintext versions of the original image in addition to the decrypted public image received from the image distribution server. 13. The computer system of claim 11, further comprising an image distribution server, wherein the image distribution server is further configured to: in response to receiving the selected re-encrypted private image, selecting a device from the plurality of client devices in accordance with whether the selected device is controlled by the selected user; and in response to the client device's selection, transmitting the selected re-encrypted private image to the selected device. 14. The computer system of claim 13, wherein the image distribution server is further configured to: in response to receiving another re-encrypted private image, selecting another device from the plurality of client devices in accordance with whether the other device is controlled by another user; and in response to selecting another device, transmitting another re-encrypted private image to another device. 15. The computer system of claim 11, wherein the definition of the selected private image comprises: using a pre-trained element detector to compute a mask identifying a region of the original image displaying a private element of the selected user, wherein the mask is computed in an encrypted domain and is decryptable using the administration key; and determining the selected private image according to the pixel multiplication of the encrypted source image and the mask. 16. The computer system of claim 11, wherein the encrypted source image is encrypted in accordance with a homomorphic encryption scheme. 17. The computer system of claim 11, wherein the plaintext version of the original image, restored by the client device controlled by the selected user, displays the private item of the selected user and hides the private item of another user. 18. The computer system of claim 11, wherein the private element comprises an element selected from the group consisting of a person and a person's face. 19. The computer system of claim 11, wherein the private element comprises a bank card. 20. The computer system of claim 11, wherein the private element contains a trademark. 21. A non-transitory machine-readable medium storing instructions that, when executed by at least one hardware processor of the privacy management server, cause the privacy management server to: in response to receiving an encrypted source image decrypted using the administration key, segment the source image of the encrypted domain to obtain a plurality of user-specific private images, wherein: the selected private image contains a region of the original image selected to display the private element of the selected user from the plurality of users, and another private image contains another region of the original image selected to display a private element of another user from the plurality of users; in response to image segmentation, perform a key change procedure on the encrypted domain to obtain a set of user-specific re-encrypted images, wherein: the selected re-encrypted image contains the result of converting the selected private image from decryptable with the administration key to decryptable with the private key of the selected user, and the other re-encrypted image contains the result of converting the other private image from being decryptable with the administration key to being decryptable with the private key of another user; and transmit a plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to recover user-specific plaintext versions of the original image.