WO2007093923A1

WO2007093923A1 - Image processing apparatus using partial encryption

Info

Publication number: WO2007093923A1
Application number: PCT/IB2007/050291
Authority: WO
Inventors: Narendranath Udupa; Nagaraju Bussa; Anil Yekkala
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2006-02-13
Filing date: 2007-01-29
Publication date: 2007-08-23

Abstract

The image processing apparatus comprises obtains data units that represent pixel values for respective blocks of pixel values in an incoming image. A change detector (12) is configured to determine for each respective block whether a measure of change in the pixel values within the respective block and/or between the respective block and a neighboring block exceeds a threshold. Preferably the change detector is an edge detector that selectively detects transitions between pixel regions that are internally nearly homogeneous. An encryption circuit (14) encrypt only the data units for selected ones of the respective blocks. The change detector (12) controls selection of the blocks that are encrypted by the encryption circuit (14) so that blocks are selected for which the measure of change exceeds a threshold.

Description

Image processing apparatus using partial encryption

The invention relates to a method and apparatus for processing image signals, said processing including encryption of the image signal.

From EP 1 575 297 it is known to represent an original image by means of an edge representation and a residue image. A similar teaching is known from an article titled "Image Decomposition for Selective Encryption and Flexible Network Services" by R.M. Scopigno and S. Belfiore, published in the proceedings of the GLOBECOM '04 IEEE Global Telecommunications Conference (2004) volume 4 pages 2302-2307. These publications propose to detect the location of edges in the original image (i.e. the location of strong changes in image values as a function of position in the image). Information about the edges, such as their coordinate sets, defines an edge image that differs from the original image. The difference defines a residue image. The publications propose to form an encrypted image signal that contains the residue image and an encryption of the information about the edges. Thus, on one hand, an effective representation of the image obtained, avoiding artefacts due to strong edges that may occur for example in a synthetic image and on the other hand the amount of computation for encryption and decryption is kept small, because only the edge information needs to be encrypted and decrypted, which usually contains fewer bits than a block with an edge. Because the edges in an image determine most of its intelligibility for humans this technique minimizes intelligibility at a minimum cost in terms of computations for encryption.

Unfortunately, this technique deviates strongly from image compression techniques for which compression and decompression circuits are widely available. These techniques, such as MPEG and JPEG techniques, typically involve subdividing an image into blocks and compressing and decompressing on a block-by-block basis. Decompression using the technique described in EP 1 575 297 would require a special circuit to reconstruct the edge image from the edge information. Moreover, the compression gain is strongly dependent on the quality of edge detection. MPEG signals can be encrypted by encrypting the image content of all blocks. However, this involves much more computation than encryption of edge information. Attempts have been made to reduce the amount of computation for encrypting and decrypting MPEG signals. European patent application serial number 05105365.0 (attorney docket PH000518) proposes to encrypt only the DC coefficient for each block, leaving DCT transform coefficients for higher frequencies in the clear (not encrypted). This application also proposes to encrypt the sign bit of the DC coefficients or a plurality of the most significant bits.

Among others it is an object to provide for an image processing technique that involves encryption, using a block based image representation, which allows a reduction of the computational effort needed to encrypt a complete image, while maximizing a reduction of intelligibility of the image due to encryption. A method and apparatus according to the independent claims are provided.

Herein a measure of change in the pixel values within a block and/or between the block and a neighboring block is used to select whether the block will be subjected to an encryption operation or not. A change detector selects only blocks with a measure of change that exceeds a threshold for the application of the encryption operation. In an embodiment the measure of change is computed from non-zero frequency transform coefficients for the block, such as DCT coefficients. Thus for example in an MPEG signal the available DCT coefficients are used to select blocks for the encryption operation. In an alternative embodiment the measure of change is a position in a transmission sequence for the frequency transform coefficients starting from which all remaining frequency transform coefficients in the sequence for the respective block are zero.

In an embodiment the measure of change is a computed edge strength. In a further embodiment the edge strength is derived from the difference between average pixel values in different regions of pixel locations in the block or average gradients between such regions. Thus, blocks that have a highest impact on intelligibility are selected.

These and other objects and advantageous aspects will become apparent from the accompanying figures and their description which show examples of embodiments. Figure 1 shows an encoding system Figure 2 shows a flow chart of an encryption process

Figure 1 shows a video encoding system comprising an encoder 10, a change detector 12, an encryption unit 14 and a post-processing unit 16. Encoder 10 has an input for receiving video input signals. Encryption unit 14 is coupled between an output of encoder 10 and post-processing unit 16. Post-processing unit 16 has an output for supplying partially encrypted, encoded versions of the video input signals. Change detector 12 has an input coupled to the output of encoder 10 and an output coupled to a control input of encryption unit 14. Encoder 10 may for example by a part of an MPEG or JPEG encoder, which performs encoding up to a DCT (Digital Cosine Transform). In this case post-processing unit 16 may contain a remaining part of the MPEG or JPEG encoder to perform remaining encoding functions such as variable length encoding and entropy coding.

By way of demonstration of the functions performed by encryption unit 14, encryption unit 14 is shown to contain an encryption circuit 140, a buffer 142 and a multiplexer 144. Buffer 142 has an input coupled to the output of encoder 10 and an output coupled to encryption circuit 140 and a first multiplex input of multiplexer 144. Encryption circuit 140 has an output to a second multiplex input of multiplexer 144. The control input of encryption unit 14 is coupled to control inputs of encryption circuit 140 and multiplexer 144. It should be realized that the video encoding system of figure 1 is shown by way of example only. It may be implemented using respective different circuits for each of the elements shown in the figure, but alternatively one or more, or even all of the elements may be implemented using a programmable processor operating under control of a computer program to make the processor perform the functions of the elements. Also, although a video encoding system is shown by way of example, it should be realized that this video encoding system is only one example of an image encoding system. The video encoding system encodes a stream of images (conventionally called frames) comprised in the video signal. In other image processing systems an individual image may be encoded. In operation the encoder 10 receives a video signal that comprises a stream of images. Encoder 10 subdivides at least a number of the images in to a plurality of blocks of pixels and computes data for each block. By way of example encoder 10 may be a part of an MPEG encoder, which computes DCT transform coefficients of pixel values for each block. In addition encoder 10 may compute other data such as motion vectors, audio signals etc. Encoder 10 supplies data representing the data for the blocks and the other data to encryption unit 14.

In another embodiment encoder 10 operates on the stream of bits that makes up the video signal. In this embodiment the encoder 10 selects each block by selecting the bits that make up this block. Preferably this is done by checking for an EOB code that indicates End-Of-Block in the bit stream.

Encryption unit 14 applies an encryption operation to the data for selected ones of the blocks, but not to the remaining blocks (although not shown, some other, simple encryption operation may be applied to part or all of the remaining blocks or to all blocks). The data other than the blocks may be passed with or without encryption, in different embodiments. Encryption unit 14 produces a stream that contains the the results of encryption of the selected ones of the blocks and the remaining blocks. In the example, this is realized by making multiplexer 144 pass either the original blocks directly from buffer 142 or encrypted blocks from encryption circuit 140. Encryption circuit 140 receives a control signal from change detector 12 indicating which of the blocks it should encrypt. Buffer 142 serves to delay subsequent blocks while encryption circuit 140 is busy encrypting a selected block.

Post processing unit 16 assembles compressed video signal using the results of the encryption operation on the selected blocks and the remaining blocks obtained without the encryption operation. In the MPEG embodiment encryption may be applied to quantized DCT coefficients for example and post-processing unit 16 may perform run-length coding and variable length coding of encrypted quantized DCT coefficients. But in alternative embodiments encoder 10 may already perform run- length coding and/or variable length coding of quantized DCT coefficients, so that these run- length coded and/or variable length coded coefficients are encrypted in the selected blocks. But in another alternative embodiment un-quantized coefficients may be encrypted, but this may have the disadvantage that encryption affects image quality.

Change detector 12 controls which ones of the blocks will be selected for encryption. In an embodiment change detector 12 computes, for each block, a value that is a measure of change of the data in the block, compares this value with a threshold and sends a signal to apply encryption to the block if the value for the block exceeds the threshold. In an embodiment a predetermined threshold is used. In another embodiment the threshold is adapted dynamically, so that the number of encrypted blocks in each image is maintained within a predetermined range. In the above-mentioned embodiment where the encoder 10 operates on the stream of bits, the threshold is the number of bits used to represent the block. As blocks with edges will have more high frequency components compared to other blocks, they require more bits to be encoded. By setting the threshold appropriately, only blocks with a sufficient number of high frequency components will be selected and hence encrypted.

In a preferred embodiment this threshold is computed based on the average number of bits used to represent each block for an image. A number of bits that substantially exceeds the average indicates a block with a sufficient number of high frequency components. The average can be obtained from the total number of bits used to represent the image pixel data (excluding the headers and the metadata present) and the resolution of the image.

Then the threshold can be set to be an integer greater than the average number of bits used for representing each block based on the level of requirement.

Figure 2 illustrate a flow-chart of the encryption process that may be executed by the system of figure 1 or any other suitable system. In a first step 21 data for a block of pixels is obtained. In a second step 22 the value that is a measure of change for the data in the block is computed. In a third step 23 the value is compared with a threshold. If the measure of change for the block exceeds the threshold, a fourth step 24 is executed wherein the block is encrypted. In a fifth step 25 the resulting block is incorporated in an output signal. If the measure of change for the block does not exceed the threshold, fourth step 24 is skipped and the block is incorporated in the output signal without the encryption of fourth step 24. After fourth step 24 the process continues for a next block and so on until all blocks in the image have been processed.

In an embodiment change detector 12 computes the value that is a measure of change of the data in the block from the DCT coefficients for the block, for example by summing numbers that increase with increasing absolute values of the DCT coefficients for non-zero frequencies, e.g. by summing absolute values or squares of the coefficients. Any significant contribution of the zero frequency coefficient is excluded from this sum. In an embodiment the coefficients for different frequency may be weighted in the sum, in a further embodiment by using only coefficients for selected frequencies, e.g. a number of the lower frequencies. More generally non-zero frequency coefficients of frequency transforms other than of a DCT may be used, such as Hadamard or wavelet transforms coefficients. In another embodiment, change detector can also use zero frequency coefficients along with the nonzero frequency coefficients to determine the measure of change of data in the block. In another embodiment change detector 12 makes use of properties of a sequence of coefficient that is used to represent the block. In MPEG for example, the coefficients are scanned in a zigzag order from low to high frequency and a point in the zigzag order is indicated from which all coefficients may be taken as zero. In an embodiment computes the distance from the coefficient for zero frequency to this point is used as the value that is a measure of change of the data in the block.

In another embodiment change detector 12 is an edge detector, the computed value representing an edge strength. Techniques for computing edge strength are known per se. For example, a technique may be used that computes differences between average pixel values for pairs of adjoining regions in the block (e.g. regions of at least three pixels and preferably regions that have a significant extent transverse to a central line between the regions, for example an extent of at least two pixels, but preferably more), the maximum absolute value of these differences being used as edge strength for the block. In these differences effects of pixels outside the regions are not included. Edges between homogeneous regions are typically important for intelligibility of the image. In another example, a technique may be used that computes an average gradient in the pixel values for between adjoining regions in the block (e.g. regions as defined in the preceding), the maximum absolute value of these gradients being used as edge strength for the block. In these gradients effects of pixels outside the regions and/or outside a transition region between the regions are not included. As another example, a technique may be used that detects whether the block contains at least two regions of pixels of at least a predetermined size (e.g. regions as defined in the preceding) in each of which the pixels have homogeneous properties, the edge strength representing the absolute value of the difference between averages of these properties for the different regions. As a further alternative embodiment change detector 12 uses the blocks that are direct neighbors of a block, or at least part of these neighbors to determine the value that is a measure of changes or the edge strength. Thus for example, the edge strength may be computed as a maximum of edge strength in the block and edge strength of edges between the block and its neighbors. Thus, edges that run along edges of blocks can also be detected and used to control encryption.

As will be appreciated change detector 12 ensures that preferably those blocks will be selected that contribute to changes in the image that exceed a threshold, e.g. due to pixel value variation in the block. These selected blocks are encrypted. The intelligibility of an image for humans is determined mainly by image regions where edges occur. Because the edges are associated with pixel regions that have variation high variation, selection of blocks with such high pixel variation promotes a maximum impact on intelligibility with a minimum of computational load for encrypting blocks. An even higher impact is realized by specifically computing edge strength, i.e. using differences between averages of regions, or average gradients between regions, the regions that each containing a plurality of pixels (e.g. at least three pixels). Thus waste of computational effort on textured regions, which contain many pixel value variations that are not transitions between larger regions of pixels, is avoided.

Encryption circuit 140 may use any form of encryption. Encryption techniques are known per se. In an embodiment for each selected block all data is encrypted. This realizes high protection. In another embodiment only part of the data, such as (quantized) DCT coefficients for one or more frequencies below a threshold frequency are encrypted. Similarly, only a most significant part of numbers represented by the data may be encrypted. Also, in an embodiment for example only luminance blocks may be selected for encryption. Figure 3 shows a video decoding system comprising a decoder 30, a change detector 32, a decryption unit 34 and a post-processing unit 36. Decoder 30 has an input for receiving encrypted video signals. Decryption unit 34 is coupled between an output of decoder 30 and post-processing unit 36. Post-processing unit 36 has an output for supplying decrypted versions of the encrypted input signals. Change detector 32 has an input coupled to the output of decoder 30 and an output coupled to a control input of decryption unit 34. Decoder 130 may for example by a part of an MPEG or JPEG decoder, which performs encoding up to a DCT (Digital Cosine Transform). In this case post-processing unit 36 may contain a remaining part of the MPEG or JPEG decoder to perform remaining decoding functions such as variable length decoding and entropy coding. By way of demonstration of the functions performed by decryption unit 34, decryption unit 34 is shown to contain a decryption circuit 340, a buffer 342 and a demultiplexer 344. Demultiplexer 344 has an input coupled to the output of decoder 30. Buffer 342 has an input coupled to an output of demultiplexer 344 and an output coupled to decryption circuit 340. Decryption circuit 340 has an output to the post-processing unit 16. A second output of demultiplexer 344 is coupled to the post-processing unit 16 as well .

It should be realized that the video decoding system of figure 3 is shown by way of example only. It may be implemented using respective different circuits for each of the elements shown in the figure, but alternatively one or more, or even all of the elements may be implemented using a programmable processor operating under control of a computer program to make the processor perform the functions of the elements.

Also, although a video decoding system is shown by way of example, it should be realized that this video decoding system is only one example of an image decoding system. The video decoding system decodes a stream of images (conventionally called frames) comprised in the video signal. In other image processing systems an individual image may be decoded.

In operation the decoder 30 receives a compressed video signal and supplies decompressed blocks to the decryption unit 34. Decryption unit 34 produces a stream that contains the results of decryption of the selected ones of the blocks and the remaining blocks. In the example, this is realized by making demultiplexer 344 pass the received blocks either to buffer 342 or directly to post-processing unit 36. Change detector 32 signals to the demultiplexer 344 whether to pass a block to the buffer 342 or to the post-processing unit 36. Decryption circuit 140 performs decryption on the blocks in the buffer 342. Buffer 342 serves to delay subsequent blocks while decryption circuit 140 is busy decrypting a selected block.

The change detector 32 can detect whether a block is encrypted in multiple ways. One preferred option is indicate this using a bit in the block header. In an embodiment where the encoder 10 operates on the stream of bits itself, the change detector 32 monitors the number of bits used to represent each block. A block with a relatively high number of bits should be subjected to decryption.

In a preferred embodiment the average number of bits used to represent each block is used as a threshold. As noted above, for an input block a number of bits that substantially exceeds the average indicates this block has a sufficient number of high frequency components. The change detector 34 can then detects that the number of bits in this block exceeds the average and from that infer that this block is encrypted.

Although embodiments have been described wherein the change detector finally decides for each block whether it will be encrypted or not, it should be understood that alternatively, some modification of the selection may be applied, for example by selecting additional blocks according to some other criterion, or by deselecting some blocks selected blocks for some other reason (e.g. because of an excess of selected blocks). Thus control of selection by change detector 12 may be partial. Although embodiments have been described wherein encryption is combined with encoding (and compression, like MPEG compression, in particular, it should be realized that encryption can also be performed as a separate post-processing step. In this case, instead of an encoder 10 a partial decoder is used, encryption is applied to selected blocks that result from decoding and the resulting blocks with and without encryption are recombined into a coded signal.

Preferably information is added to the data to indicate the selected blocks that have been encrypted. When the signal is decoded, the selected blocks are decrypted and the signal is decoded to regenerate an approximation of the original video signal. Typically, the signal is transmitted over a shared medium, for example via a cable TV system, wireless broadcast or over the Internet. In this case a plurality of receivers may be coupled to the shared medium, the receivers of subscribers being selectively provided with decryption keys needed to perform decryption of the decrypted block.

Claims

CLAIMS:

1. An image processing apparatus comprising

- an input for receiving a signal that includes a representation of an image;

- a block obtaining circuit (10), configured to obtain, from the signal, data units that represent pixel values for respective blocks of pixel values in the image; - an encryption circuit (14) configured to encrypt only the data units for selected ones of the respective blocks;

- a change detector (12), configured to determine for each respective block whether a measure of change in the pixel values within the respective block and/or between the respective block and a neighboring block exceeds a threshold, the change detector (12) being configured to control selection of the selected ones of the respective blocks that are encrypted by the encryption circuit (14), for those of the respective blocks for which the measure of change exceeds a threshold.

2. An apparatus according to claim 1, wherein said measure of change is an edge strength.

3. An apparatus according to claim 2, wherein the change detector (12) is an edge detector configured to compute the edge strengths form differences between averages of pixel values from pairs of adjacent regions of pixel locations respectively and/or sizes of average gradients between pairs of adjacent regions of pixel locations.

4. An apparatus according to claim 3, wherein the regions extend over at least two pixels transverse to a central line, the regions lying on respective sides of the central line.

5. An apparatus according to claim 1, wherein the data unit represents frequency transform coefficients for the pixel values in the block that are used to encode the signal, wherein the change detector is configured to compute the measure of change for each respective block from a sum of terms that increase with increasing values of the frequency transform coefficients for the respective block, excluding a zero frequency coefficient for the respective block.

6. An apparatus according to claim 1, wherein the data unit represents frequency transform coefficients for the pixel values in the block that are used to encode the signal, and wherein the change detector is configured to compute the measure of change for each respective block from a position in a transmission sequence for the frequency transform coefficients starting from which all remaining frequency transform coefficients in the sequence for the respective block are zero.

7. An apparatus according to claim 1, wherein the block obtaining circuit is part of an encoder (10) that is configured to compress the signal on a block by block basis.

8. An apparatus according to claim 7, wherein the encoder is part of an MPEG or JPEG encoder that performs DCT computations on the respective blocks.

9. An apparatus according to claim 1, wherein said measure of change is a number of data units used to represent the block.

10. An apparatus according to claim 1, wherein the block obtaining circuit is a decoder configured to obtain the data units from a block by block compressed signal.

11. An image processing apparatus configured to decrypt a signal produced by the apparatus of claim 1.

12. A method of processing an image signal, the method comprising

- obtaining, from the image signal, data units that represent pixel values for respective blocks of pixel values in the image, which is spatially subdivided into said respective blocks;

- computing for each respective block a value representing a measure of change in the pixel values within the respective block and/or between the respective block and a neighboring block;

- selectively encrypting at least part of information representing selected ones of the respective blocks for which said values indicate that the measure of change exceeds a threshold value.

13. A method according to claim 12, wherein said edge strengths are computed to determine said values.

14. A computer program product, comprising a program of instructions that, when executed by a programmable processing circuit cause the programmable processing circuit to perform the steps of the method of claim 12.