WO2021175714A1

WO2021175714A1 - Scrambling of regions of interest in an image to preserve privacy

Info

Publication number: WO2021175714A1
Application number: PCT/EP2021/054835
Authority: WO
Inventors: Silver KESKKÜLA; Märt TOOTS
Original assignee: Supervaisor Oü
Priority date: 2020-03-05
Filing date: 2021-02-26
Publication date: 2021-09-10

Abstract

The present invention relates to a method comprising the steps of providing image data comprising at least one image and a labeled portion, scrambling the labeled portion of the image data to generate scrambled image data, wherein the labeled portion of the image data is configured to be descrambled by providing a descrambling key. The present invention also relates to corresponding devices, systems and computer program products.

Description

SCRAMBLING OF REGIONS OF INTEREST IN AN IMAGE TO PRESERVE PRIVACY

Field of invention

The present invention generally relates to the processing of visual data.

Introduction

Cameras are used for capturing images and recording videos. They can obtain visual data from a scene comprising a rich information regarding the captured scene. Moreover, the development of the camera technology allows for a scene to be captured in a great detail. As such, cameras are typically a preferred sensor choice, not only for capturing personal events but also for many applications, such as, monitoring, surveillance, computer vision, autonomous navigation, dashboard cameras (i.e. dash cam), driving recorder, etc. Among the rich information that a camera can obtain from a scene, private information or privacy sensitive data can be present. Private information can, for example, include the identity of the persons (particularly minors) and other identifiable objects, such as, vehicles. Obtaining, storing, processing and sharing private information can violate the rights of the person to whom the private information corresponds. To cope with this, multiple data protection policies, such as, the General Data Protection Regulation (GDPR) of the European Union, have been implemented and enforced.

Thus, in one hand, the cameras are an advantageous sensor to be used in different applications as they can provide a detailed representation of a scene. However, on the other hand, data obtained by a camera may comprise private information and as such obtaining, storing, processing and sharing the data obtained by the camera need to comply with data protection policies.

Typically, in the prior art, this problem is addressed by notifying individuals that a camera is present in an environment. In some cases, data obtained by a camera are encrypted entirely in order to hide the private information. However, encrypting the entire image does not allow sharing or processing the images. Some systems and methods pertaining to preserving privacy data on images and videos are disclosed in the following patent publications: WO 2006/006081, US 2017/0220816 A1 and WO 2018/039646 Al.

Summary

In a first aspect the present invention relates to a method for scrambling one or more selected part(s) of image data. More particularly, the method comprises providing image data comprising at least one image and a labeled portion. The labeled portion of the image data can correspond to one or more selected part(s) of the image data, such as, parts of the image data containing or indicating or representing private information. The method comprises scrambling the labeled portion of the image data to generate scrambled image data. That is, by scrambling the labeled portion of the image data, the image data can be transformed into scrambled image data. In other words, scrambled image data can be generated by scrambling the labeled portion of the image data. Moreover, the labeled portion of the image data is configured to be descrambled by providing a descrambling key. In other words, the labeled portion of the image can be scrambled such that the labeled portion of the image data in the scrambled state can be descrambled using a descrambling key.

Thus, the method can allow to selectively hide one or more part(s) of the image data. This can allow for the image data to be processed or usable even after the scrambling. That is, in contrast to typical prior art methods wherein images or videos are protected by entirely encrypting them, the present method scrambles only selected (i.e. labeled) parts of the image data. In other words, the method may allow for hiding a portion of the information comprised by the image data, while still leaving sufficient information in the image data unscrambled, hence allowing the image data to be usable for further processing, e.g., event detection.

The method can be particularly advantageous for hiding privacy sensitive areas of images and videos that can be comprised by the image data. That is, the method can allow providing image data wherein the portion of the image data relating to private information, e.g., information that can allow an individual or object to be identified (i.e. an object of interest), can be labeled. As such, the portion of the image data relating to private information can be scrambled to generate the scrambled image data. However, the rest of the image data is not scrambled. As such, the scrambled image data can be processed to extract information, e.g., for event detection. Hence, the present method can allow for obtaining, storing, sharing and/or processing image data, while conforming to data privacy policies.

Put simply, while prior art methods typically allow for either sharing or hiding the entire information contained by image data, the present method allows for sharing a part of the information contained by image data without revealing selected information.

Moreover, the present method can be advantageous as it can allow for the scrambled part of the image data to be descrambled. This is in contrast to typical prior art methods, which hide private information on images or videos by scrambling parts of the images or videos (e.g. human faces) such that they cannot be reversed, usually through blurring or pixel value deletion. However, in many instances it can be advantageous to provide the possibility for the scrambled part of an image to be restored. This is particularly advantageous, when the image data indicate an event or action (e.g. an illegal activity) that can be used as legal basis for requesting the scrambled data to be descrambled. As such, for example, if the labeled portion comprises information that can reveal the identity of an individual or object involved in the event or action, by descrambling the labeled portion, the identity of the individual or object can be revealed. Again, encrypting the entire image data cannot allow for the detection of the event. On the other hand, non- reversibly scrambling selected parts of images or videos cannot allow for information related to the event (such as the identity of individuals or objects involved in the event) to be extracted. In contrast, the present method can allow for scrambling sufficient parts of images or videos for hiding selected information (typically private information), while still allowing for the extraction of context information or the detection of events on the image data. For example, the portion of an image depicting a face of a person can be scrambled. However, the body of the person can still appear on the images of the scrambled image data and can allow for the detection of activities that the person can be involved in. Similarly, a number plate of a vehicle can be scrambled however the rest of the vehicle can appear on the images of the scrambled image data. In general, a parent object may comprise an object, wherein the object can be used to identify the parent object. While the portion of the image representing the object can be scrambled, the portion of the image representing the rest of the parent object may not be scrambled.

Furthermore, conditioning the descrambling of the labeled portion of the image data on the provision of the descrambling key, provides not only a security mechanism, but also allows to selectively provide descrambling privileges by choosing where to provide the descrambling key.

In some embodiments, the method can comprise obtaining the image data with an image sensor capturing the at least one image.

The image sensor can comprise at least one camera, such as, a mobile camera, a mobile phone camera, a body camera, a wearable camera, a traffic camera, a dash camera, a drive recorder, a car digital video recorder (DVR), an event data recorder (EDR), car camera, front car camera, rear car camera, side car camera, surveillance camera and/or building surveillance camera. It will be understood, that the above are only some examples of the image sensor.

In some embodiments, the image sensor can be part of an autonomous driving system partly autonomous driving system and/or a driver-assistance system, such as, an advanced driver- assistance system (ADAS). Said systems typically obtain image data of the surroundings of an autonomous or partly autonomous vehicle allowing such vehicles to build a computer vision picture of their surroundings. This can further be used for autonomous driving and/or for driver assistance. However, generally the identity of the objects within the surrounding of a vehicle may not be necessary for generating a computer vision picture of the surrounding. On the other hand, obtaining and processing image data with private or identity information may violate privacy policies and may make such systems unusable. As such, the present invention can allow for scrambling a labeled portion of the image data. This may facilitate hiding private data that can be comprised within the image data. Thus, the computer vision picture of the surrounding of a vehicle can be generated while hiding or protecting selected information comprised by the image data.

The image data can comprise a plurality of images captured sequentially, such as, a video. In such embodiments, obtaining image data can comprise capturing 1 to 240 images per second (i.e. frames per second), preferably 10 to 60 images per second, more preferably 10 to 30 images per second.

The image sensor can be configured to capture images according to different frame rates. In such embodiments, the method can comprise configuring the image sensor to capture images with one of the frame rates prior to capturing the images.

The image data can comprise at least one image comprising a width of at least 100 pixels, preferably at least 640 pixels, more preferably at least 1024 pixels, and a height of at least 100 pixels, preferably at least 480 pixels, more preferably at least 600 pixels.

The image sensor can be configured to capture images with different resolutions. In such embodiments, the method can comprise configuring the image sensor to capture images with one of the resolutions prior to capturing the at least one image.

The labeled portion of the image data can be a subset of the image data. That is, the labeled portion of the image data can relate to one or more regions of interest (e.g. privacy sensitive areas) of an image. In other words, the labeled portion of the image data can be a selected portion of the image data. As such, instead of scrambling the entire image data, only selected portion of the image data can be encrypted. This can be particularly advantageous for selectively hiding or protecting information comprised by the image data.

For example, the image data can comprise a plurality of pixels corresponding to the at least one image and the labeled portion of the image data can be a subset of the pixels corresponding to the at least one image.

The method can comprise providing labeling data corresponding to the image data wherein the labeling data can indicate a labeled portion of the image data. This can facilitate identifying or determining the portion of the image data which is labeled, i.e., the portion of the image data to be scrambled.

The labeling data can comprise different formats. In the following some exemplary formats of the labeling data will be discussed. The labeling data can comprise or can be configured to indicate a location on the image data of the labeled portion of the image data, at least one coordinate or index indicating a location on the image data of the labeled portion of the image data, a size of the labeled portion of the image data, shape of the image data of the labeled portion of the image data, a start location and an end location of the labeled portion of the image data, a center location and a boundary of the labeled portion of the image data, a reference location on the image data and a function outputting the labeled portion of the image data based on the reference location, or any combination thereof.

In some embodiments, the labeling data can comprise for each of the pixels of an image a binary flag indicating whether the pixel is labeled.

In some embodiments, the labeling data can comprise for each of the pixels a labeling parameter wherein the labeling parameter can be a non-binary value.

In some embodiments the labeling parameter can indicate the likelihood that the pixel can belong to an object. That is, the labeling parameter of a pixel can indicate a probability that the pixel is within an area of the image representing an object. In such embodiments, the method can comprise determining whether the pixel is part of the labeled portion of the image data if the likelihood that the pixel corresponds to an object is higher than a threshold value. That is, only the pixels with a likelihood higher than a threshold value can be determined to be part of the labeled portion and thus can be scrambled.

In some embodiments, the labeling parameter can indicate a category or classification of an object it can belong to. That is, the labeling data can be configured to not only indicate whether or the likelihood that a pixel can correspond to an object, but to also indicate the object class or object type it can belong to. For example, the labeling parameter can indicate whether the pixel is part of a body of a person, a body part of a person, a face of a person, a building, a part of a building, a house, an apartment, windows of buildings, traffic signs, bicycles, vehicles, windows of vehicles, a license plate of a vehicle, an operator of a vehicle, a logo, a text, an image, an advertisement, billboard, a screen, a private territory, a road, the ground or the sky. In such embodiments, the method can comprise determining whether the pixel is part of the labeled portion of the image data based on the object class that the pixel corresponds to.

In some embodiments, the method can further comprise labeling a portion of the image data. More particularly, the step of providing image data comprising at least one image and a labeled portion can comprise the step of providing image data comprising at least one image and the step of labeling a portion of the image data. In other words, the method can comprise selecting the information of the image data to be hidden or protected.

Labeling a portion of the image data can comprise adding labeling data to the image data, adding labeling data to the at least one image comprised by the image data or any combination thereof. For example, the labeling data can be provided as part of metadata that can be associated with the image data.

By labeling a portion of the image data, labeled image data can be generated. The labeled image data can comprise the image data and the labeling data. Put simply, the labeled image data refer to image data wherein a portion of the image data is labeled.

In some embodiments, labeling a portion of the image data can comprise processing the image data for detecting at least one object captured on the at least one image and upon detection of an object, labeling the portion of the image data representing the object. This can facilitate automating the present method and particularly the detection of objects captured on the image data. It will be understood, that not all the images of the image data may comprise objects captured therein. However, if one or more images of the image data may comprise at least one object captured therein, the present method can comprise detecting the at least one object and labeling the respective part(s) of the image representing the at least one object.

Throughout the text, the term object can refer to a body of a person, a body part of a person, a face of a person, a building, a part of a building, a house, an apartment, windows of buildings, traffic signs, bicycles, vehicles, windows of vehicles, a license plate of a vehicle, an operator of a vehicle, a logo, a text, an image, an advertisement, billboard, a screen, a private territory or any combination thereof. However, it will be understood that these are only some examples of the objects that can be detected on the image data. In general, the object may refer to any geometrical shape that can be present on the image data. That is, in general any geometrical shape or visual pattern can be detected on the image data. Furthermore, the object can be part of a parent object and can be used to identify the parent object.

In some embodiments, the method can comprise reducing the size or amount of the image data before processing the image data for detecting at least one object. This can be advantageous for decreasing the amount of computations and time required to process the image data for detecting at least one object.

In some embodiments reducing the size of the image data may comprise applying a lossy compression on the image data, a lossless compression on the image data, reducing the resolution of the images comprised by the image data (e.g. removing each second lines of pixels), uniformly removing pixels from one or more images, uniformly removing some images or frames in a video, or any combination thereof. In general, reducing the size or amount of image data may reduce the information contained in the image data. However, reducing the size or amount of image data can be configured not to render the image data unintelligible. That is, even after the reduction of the size of the image data, all the objects captured by the original image data can still be present on the image data. This can be advantageous as the time and computational efficiency of processing the image data for detecting at least one object therein can be increased without significantly increasing the likelihood of not detecting an object captured on the image data.

In some embodiments, wherein the image data comprises a plurality of images captured sequentially, reducing the size of the image data can comprise removing at least one image from the image data, preferably, uniformly removing a plurality of images from the image data. For example, in embodiments wherein the image data can comprise a video, the size of the image data can be reduced by decreasing the frame rate of the video.

The size of the image data can be reduced by at least 1% and at most 50%.

In some embodiments, wherein the image data comprises a plurality of images captured sequentially, the method can comprise detecting an object on at least one first image captured before at least one second image. The method can further comprise using the location of the object detected on the at least one first image as a priori information for detecting the object on the at least one second image. For example, a first and a second image can be captured one after the other within a short period of time - e.g. within 8 to 1000 milliseconds. Due to the relatively short time delay that can be present between the two images, an object captured in the first image can be expected to be present in the second image in a similar location. This is particularly true for stationary or slowly moving objects. Thus, the location of the object on the first image can be used as a priori information for detecting the object on the second image. This can decrease the number of computations required to detect the same object on the second image. At the same time, after the object is detected on the second image, the portion of the image covered by the object can be excluded from processing for detecting further objects on the second image.

In some embodiments, the image data can comprise metadata indicating a portion of the image data representing at least one parent object, wherein a parent object comprises the object to be detected. That is, the object to be detected can be a part of the parent object. For example, the parent object can refer to a body of a person and the object to be detected can refer to the face of the person. In another example, the parent object can refer to a vehicle and the object can refer to the number plate of the vehicle. In general, the parent object can refer to an individual or identifiable component of an environment and the object can be a part of the parent object that can be used to identify the parent object.

In such embodiments, wherein metadata indicating a portion of the image data representing at least one parent object are provided with the image data, the method can comprise processing only the portion of the image data representing the parent object. This can be advantageous, as instead of processing the entire image data for detection an object only the portion of the image data corresponding to the parent object(s) (as indicated by the metadata) can be processed. Furthermore, in such embodiments, detecting at least one object captured on the at least one image can comprise determining the location of the object on the image data based on a position of the object on the parent object. More particularly, based on a known model of the parent object, the expected location of the object within the parent object can be determined. Based on this, the object can be detected more efficiently.

Processing the image data to detect at least one object can comprise executing an object detection algorithm.

The object detection algorithm can be based on a pattern recognition algorithm.

For example, the object detection algorithm can be configured to detect a portion on an image of the image data that resembles to a known pattern. The object detection algorithm can be trained to recognize a pattern with a plurality of training patterns (e.g. annotated images), wherein the training patterns can correspond to different deviations of the pattern to be learned. The object detection algorithm can comprise a plurality of parameters which it can adjust based on the training patterns to detect a pattern (e.g. a face of a person) more efficiently.

The object detection algorithm can be based on a machine learning algorithm.

The object detection algorithm can be based on a deep learning algorithm.

The object detection algorithm can be based on an artificial neural network.

For example, the object detection algorithm may be based on the scale-invariant feature transform (SIFT), single shot multi-box detector (SSD), you only look once (YOLO) or similar object detection algorithms.

The method can comprise scrambling only the labeled portion of the image data. As discussed, this can be advantageous as it can allow the for the rest of the image data to be processed, e.g., for event detection. Furthermore, this can allow processing image data without providing the information contained by the labeled portion of the image data. In some embodiments scrambling the labeled portion of the image data can comprise changing respective positions of a plurality of pixels within the labeled portion of the image data. For example, the respective position of at least 90%, preferably at least 95%, more preferably at least 99% of the pixels within the labeled portion of the image data can be changed.

Alternatively or additionally, scrambling the labeled portion of the image data can comprise changing respective values of a plurality of pixels within the labeled portion of the image data. For example, the respective values of at least 90%, preferably at least 95%, more preferably at least 99% of the pixels within the labeled portion of the image data can be changed.

Scrambling the labeled portion of the image data can comprise using a scrambling key.

The descrambling key can correspond to the scrambling key. More particularly, the labeled portion of the image data can only be descrambled by using a descrambling key corresponding to the scrambled key used to scramble the labeled portion of the image data.

The scrambling key and the descrambling key may each comprise a respective seed for generating at least one random number.

In some embodiments, the scrambling key and the descrambling key can comprise an identical seed. As such, the scrambling key and the descrambling key can be used to generate identical pseudo-random sequences of numbers.

In some embodiments, the scrambling key and the descrambling key may each comprise a respective cryptographic key. Thus, the scrambling and descrambling key can be used for encrypting and decrypting data, respectively.

The scrambling key and the descrambling key can comprise an identical cryptographic key. As such, the scrambling key and the descrambling key can be used for encrypting and decrypting data, respectively, according to a symmetric encryption algorithm.

Alternatively, the scrambling key and the descrambling key may comprise different cryptographic keys. Thus, the scrambling key and the descrambling key can be used for encrypting and decrypting data, respectively, according to an asymmetric encryption algorithm.

Scrambling the labeled portion of the image data can comprise executing a scrambling function with the labeled portion of the image data as input to the scrambling function. That is, the scrambling of the labeled portion of the image data can be performed in an algorithmic and/or systematic manner. The scrambling function is a parameterized function comprising a configurable scrambling parameter.

The method can comprise configuring the scrambling parameter based on the scrambling key. For example, the scrambling key can be assigned as the value of the scrambling parameter.

The scrambling function can be an invertible function and wherein a descrambling function is the inverse function of the scrambling function. Scrambling the labeled portion of the image data with an invertible scrambling function can be advantageous as it can provide the possibility to descramble the labeled portion of the image data.

The descrambling function can be a parameterized function comprising a configurable descrambling parameter.

The method can comprise configuring the descrambling parameter based on the descrambling key. For example, the descrambling key can be assigned as the value of the descrambling parameter. That is, the labeled portion of the image data can be descrambled not only by providing and executing the descrambling function, but by also configuring the descrambling function, more particularly the descrambling parameter, with the corresponding descrambling key. This can be advantageous, as the descrambling function can typically be a publicly disclosed function, such as, an open source algorithm. As such, by requiring to configure the descrambling parameter with the corresponding descrambling key, it can be ensured that only parties comprising the descrambling key may descramble the labeled portion of the image data.

Typically, the image data can be systematically arranged, e.g., in rows and columns. As such, the labeled portion of the image data can be arranged according to an original order. In such embodiments the scrambling function can comprise a shuffling function and executing the shuffling function can cause the labeled portion of the image data to be ordered according to a shuffled order different from the original order. In other words, the shuffling function can rearrange the data within the labeled portion of the image data, such that, intelligibility of the data within the labeled portion of the image data can be removed or at least significantly reduced.

Shuffling the labeled portion of the image data using the shuffling function can change only the positions of the pixels within the labeled portion of the image data. Although shuffling can remove the intelligibility of the labeled portion of the image data, it can preserve the original content of the labeled portion. That is, the values of the pixels can remain unchanged, i.e., the original colors can be preserved. As such, shuffling the labeled portion of the image data can be less destructive to the image data, particularly compared to other scrambling techniques which can change the values of the pixels, e.g., encryption. As the original information of the labeled portion is preserved through shuffling, less artifacts can be produced by compressing and decompressing the image data. That is, through shuffling the image data can comprise a minimal number of artifacts after compression and decompression. This can be particularly advantageous, as the original information of the labeled portion of the image data can be restored even after the labeled portion of the image data is shuffled and compressed. On the other hand, other scrambling techniques which can change the values of the pixels, such as, encryption, may not allow compression after the scrambling. That is, the labeled portion of the image data may not be restored if the labeled portion of the image data are compressed after scrambling or may be restored but with a lot of artifacts.

Furthermore, shuffling the image data can be computationally more efficient, compared to other scrambling techniques which can change the values of the pixels, e.g., encryption.

The original order and the shuffled order can be uncorrelated. As such, the original order cannot be determined in a computationally feasible manner from the shuffler order. For example, a correlation coefficient, such as a Pearson correlation coefficient, between the original order and the shuffled order is in the range of -0.1 to 0.1, preferably in the range of -0.01 to 0.01, such as, 0. As it will be understood, a shuffled order with perfect uncorrelation with the original order can be most advantageous, as it contains the least amount of information in common with the original order.

The shuffled order can be pseudo-random. That is, the scrambled data can appear as random data. As such, no or very little information can be extracted from the labeled portion of the image data arranged according to the shuffled order. For example, an autocorrelation coefficient of the shuffled order can be in the range of -0.1 to 0.1, preferably in the range of -0.01 to 0.01, such as, 0. As it will be understood, a shuffled order with no autocorrelation is most advantageous, because it can appear as a random sequence with least amount of information that can be extracted.

The shuffling function can comprise a pseudo-random number generator. A pseudo-random sequence can be generated by executing the pseudo-random number generator. In such embodiments, the shuffling of the labeled portion of the image data can be based on the pseudo-random sequence. More particularly, the shuffled order can be determined based on the pseudo-random sequence.

The pseudo-random number generator can comprise a configurable seed parameter such that the pseudo-random sequence can be determined based on the value of the seed parameter. That is, for the same configurable seed parameter, the pseudo-random number generator can generate the same pseudo-random sequence. In other words, the pseudo-random sequence can be reproduced. This can facilitate descrambling the labeled portion. In such embodiments, the method can comprise configuring the seed parameter based on the seed of the scrambling key.

Alternatively or additionally to the shuffling function, the scrambling function can comprise an encryption function. Executing the encryption function can cause the labeled portion of the image data to be encrypted. That is, the values of the pixels within the labeled portion can be encoded.

The encryption function can be configured and executed such that, the labeled portion of the image data in an unencrypted state and the labeled portion of the image data in the encrypted state are uncorrelated. As such, the labeled portion of the image data cannot be restored in a computationally feasible manner merely based on the labeled portion of the image data in the encrypted state. For example, a correlation coefficient, such as a Pearson correlation coefficient, between the labeled portion of the image data in an unencrypted state and the labeled portion of the image data in the encrypted state can be in the range of -0.1 to 0.1, preferably in the range of -0.01 to 0.01, such as, 0. As it will be understood, a perfect uncorrelation of the labeled portion of the image data before and after encryption can be the most advantageous.

The encryption function can use an encryption key. That is, the labeled portion of the image data can be encrypted with an encryption key.

The encryption key used to encrypt the labeled portion of the image data can correspond or can be configured based on the cryptographic key of the scrambling key. In other words, the scrambling key can be used for encrypting the labeled portion of the image data.

In some embodiments, the encryption function can be based on a symmetric encryption scheme, such as, Blowfish, Advanced Encryption Standard (AES), Rivest Cipher 4/5/6 (RC 4/5/6), or Data Encryption Standard (DES). That is, the encryption and decryption of the labeled portion of the image data can be performed using the same encryption key. In other words, the scrambling key and the descrambling key can comprise the same encryption key.

In some embodiments, the encryption function can be based on an asymmetric encryption scheme, such as, RSA, ECC P256kl, ECC P256rl, X25519. In such embodiments, encryption and decryption can be performed using different cryptographic keys, typically corresponding to each other such that data encrypted using an encryption key can be decrypted only with a corresponding decryption key. The scrambled image data can comprise image data wherein the labeled portion of the image data is scrambled. The labeled portion comprised by the scrambled image data i.e., the labeled portion of the image data in a scrambled state, can also be referred to as a scrambled portion.

Furthermore, the scrambled image data can comprise labeling data. That is, the scrambled image data can be configured to indicate which portion therein is labeled and as a result scrambled. For example, the scrambled image data can comprise metadata and wherein the metadata can comprise the labeling data. This can facilitate locating the portion of the scrambled image data that is scrambled, particularly if descrambling is required.

In addition, the scrambled image data can comprise metadata related to the scrambling of the labeled portion of the image data. For example, the metadata can be configured to indicate the scrambling technique used to scramble the labeled portion contained therein, such as, the scrambling function, shuffling function, encryption function and type of encryption. The metadata can further indicate which descrambling key can be used for descrambling the labeled portion comprised by the scrambled image data. It will be noted that the metadata may not comprise the descrambling key - as this may allow any party, user, operator or device provided with the scrambled image data to descramble them - but rather an indication of which descrambling key is required. For example, the metadata can comprise a unique id corresponding to a device comprising the required descrambling key. In general, the metadata associated to the scrambled image data can comprise descriptive information of the scrambling algorithm(s) and/or scrambling key(s) used to scramble the labeled portion. Alternatively or additionally, the metadata associated to the scrambled image data can comprise descriptive information of the descrambling algorithm(s) and/or descrambling key(s) used to scramble the labeled portion. This can facilitate descrambling the labeled portion of the image data.

In the above embodiments, the scrambling key and the descrambling key were used to directly scramble/descramble the labeled portion of the image data. Alternatively, the scrambling key and the descrambling key can be used to securely share a secret key, e.g. a random secret key, which can be used to scramble and descramble the labeled portion of the image data. That is, the labeled portion of the image data can be scrambled using a secret key, which can be a randomly generated sequence of characters, i.e. a random secret key. The secret key can for example comprise a size of 32 to 1024 bits, typically a size of 64 - 256 bits. The secret key can be used to shuffle and/or encode the labeled portion of the image data, as discussed above. That is, the secret key can be used as a seed to shuffle the labeled portion of the image data and/or as a cryptographic key to encrypt the labeled portion of the image data. In addition, the same secret key can be used to descramble the labeled portion of the image data. That is, the secret key can be used as a seed to restore the order of the labeled portion of the image data and/or as a cryptographic key to decrypt the labeled portion of the image data. In other words, the same secret key can be used to configure both the scrambling parameter and the descrambling parameter, discussed above.

Furthermore, the secret key itself can be protected to maintain the secrecy of the labeled portion of the image data after scrambling. An advantageous technique, can be the use of public key cryptography (also referred to as asymmetric encryption algorithms), preferably identity-based cryptography. In such embodiments, the secret key can be encrypted with a public key. The public key can be a publicly accessible cryptographic key (or string) uniquely corresponding to a device. After encryption, the secret key in the encrypted state can be added to the metadata of the scrambled image data. Furthermore, the secret key can be descrambled with a corresponding private key. The private key can correspond to the same device that the public key used for scrambling the secret key corresponds to. In such embodiments, the scrambling key can comprise the public key and the descrambling key can comprise the private key. Thus, the scrambling key and the descrambling key can be used as a secure transport mechanism for the secret key.

The method can further comprise detecting at least one event on the scrambled image data and based thereon generating activity-related image data, wherein the activity- related image data comprise a portion of the scrambled image data indicating the event. As discussed above, the detection of at least one event on the scrambled image data can be facilitated by scrambling only the labeled portion of the image data such that the unscrambled portion of the image data is sufficient for detecting at least one event therein. The at least one event can refer to a position of an object in the captured scene, movements of an object in the captured scene, interaction between objects in the captured scene or any combination thereof.

Typically, the detected events can be classified and only a subset of the classification(s) of the events can trigger the generation of the activity-related image data. Generally, events indicating an illegal activity can trigger the generation of the activity related image data. This can provide legal basis for requesting to descramble the labeled portion of the image data. That is, based on the detection of such events, the labeled (and scrambled) portion of the activity-related image data can be descrambled while still complying with data privacy policies.

The activity related image data may comprise one or more images captured during the event. The activity related image data may depict the entire event or only an excerpt of the event. In general, the activity related image data can be generated such that they can provide sufficient information and context to indicate the event. Generating the activity-related image data can comprise generating an image id or frame number. This can be particularly advantageous when the image data can comprise a video. In such embodiments, the image id or frame number may indicate a starting frame of the detected event. Additionally, the image id or frame number may indicate an ending frame of the detected event. For example, generating the activity-related image data can comprise generating a hyperlink or hypertext which can be used to access the image data with a starting and/or ending frame of the detected event.

Alternatively or additionally, generating the activity-related image data can comprise generating activity-indicating data. That is, the activity-related image data can comprise activity-indicating data. The activity-indicating data can be configured to indicate whether an event is detected on the image data or a subset of the image data, such as, an image, a cropped image, part of an image, plurality of images, a video, part of a video, a video excerpt or any combination thereof. The activity-indicating data can comprise one or activity-indicating flags. The activity-indicating flags can be binary data indicated whether an event is detected or not. A respective activity-indicating flag can be generated for an image, a cropped image, part of an image, plurality of images, a video, part of a video, a video excerpt. For example, in some embodiments, images or videos can be processed or detecting at least one event therein and an output (i.e. activity-indicating flags) can be generated to indicate whether an event was detected or not.

Detecting at least one event on the scrambled image data can comprise executing an activity recognition algorithm.

The activity recognition algorithm can be based on a gesture recognition algorithm, motion detection algorithm, body position detection algorithm, gait analysis algorithm, motion analysis algorithm, vehicle motion analysis algorithm, traffic violation detection algorithm, moving violation detection algorithm or any combination thereof.

The activity recognition algorithm can be based on a machine learning algorithm.

The activity recognition algorithm can be based on a deep learning algorithm.

The activity recognition algorithm can be based on an artificial neural network.

That is, in some embodiments, the detection of at least one event on the scrambled image data can be performed automatically.

It will be understood that the above are exemplary and non-limiting action recognition algorithms. The method can further comprise descrambling the labeled portion of the activity-related image data using the descrambling key. As discussed, the labeled portion of the image data can be scrambled such that it can be descrambled using the descrambling key. This allows for the labeled portion of the activity-related image data to be descrambled using the descrambling key. Furthermore, this step of the method may also comply with data privacy policies as the event depicted on the activity-related image data may be used as legal proof for descrambling the labeled portion therein. In addition, descrambling the labeled portion of the activity-related image data using the descrambling key may allow the identification of the objects being part or responsible of the event.

Furthermore, as discussed, the activity-related image data can comprise only a portion of the scrambled image data, i.e., only a portion of the image data. That is, instead of descrambling the labeled portion of the entire image data, the present method comprises descrambling the labeled portion only within a part of the image data indicating an event or an excerpt of an event. As such, while the labeled portion within the activity- related image data can be descrambled, the labeled portion of the rest of the image data can be left in the scrambled state. This can be advantageous, because even in the cases wherein an event is captured by the image data, the descrambling of the labeled portion of the entire image data may not be required. This further facilitates maintaining private information hidden, and extracting it only when necessary (e.g. when an event is detected) and only a part of the private information (i.e. only the private information within the activity-related image data).

In some embodiments, descrambling the labeled portion of the activity-related image data using the descrambling key can comprise descrambling only a part of the labeled portion of the activity-related image data. This can be advantageous, as some objects may not be part of the event. As such, their privacy can be maintained by descrambling only a part of the labeled portion of the activity-related image data that relate to the event.

Descrambling the labeled portion of the activity-related image data using the descrambling key can comprise restoring the respective positions of the plurality of pixels within the labeled portion of the activity-related image data.

Descrambling the labeled portion of the activity-related image data using the descrambling key can comprise restoring the respective values of the plurality of pixels within the labeled portion of the activity-related image data.

Descrambling the labeled portion of the activity-related image data using the descrambling key can comprise executing the descrambling function with the labeled portion of the activity- related image data as input to the descrambling function. The descrambling function can comprise an ordering function and executing the ordering function can restore the order of the labeled portion of the activity-related image data to the original order.

The ordering function can comprise a pseudo-random number generator, wherein a pseudo random sequence is generated by executing the pseudo-random number generator. In such embodiments, restoring of the original order of the labeled portion of the image data can be determined based on the pseudo-random sequence.

The pseudo-random generator can comprise a configurable seed parameter such that the pseudo-random sequence can be determined based on the value of the seed parameter and the method can comprise configuring the seed parameter according to the seed of the descrambling key.

That is, the method can comprise generating the same pseudo-random sequence when executing the shuffling function and when executing the ordering function. This can allow for the original order of the labeled portion to be determined after shuffling.

The descrambling function can comprise a decryption function and executing the decryption function can cause the labeled portion of the activity-related image data to be decrypted.

The decryption function can use a decryption key.

The decryption key can be configured based on the cryptographic key of the descrambling key.

The method can comprise generating identification data related to the labeled portion of the activity-related image data based on the labeled portion of the activity-related image data in the descrambled state. That is, descrambling the labeled portion of the activity-related image data can allow the identification of at least one object captured on the image data.

In some embodiments, the at least one image can be a cropped image.

The method can comprise securely storing the descrambling key. This can be advantageous as it can facilitate maintaining the secrecy of the labeled portion of the image data after scrambling. Securely storing the descrambling key may comprise storing the descrambling key in dedicated memory, wherein access to the dedicated memory is controlled more strictly. Alternatively or additionally, the dedicated memory can be encrypted which can provide security for the descrambling key stored therein. In some embodiments, the descrambling key can be stored in hardware security module (HSM). HSMs typically comprise hardware and software measured for securely storing data and can thus provide a secure environment for storing the descrambling key.

In some embodiments, wherein the method comprises labeling a portion of the image data, the method can comprise a labeling unit performing the step of labeling a portion of the image data. That is, a labeling unit can be provided for automatically labeling a portion of the image data. For example, the labeling unit may execute an object detection algorithm. This can facilitate automating the method.

In some embodiments, the method can comprise a scrambling unit performing the step of scrambling the labeled portion of the image data to generate scrambled image data. That is, the scrambling of the labeled portion of the image data can be performed automatically by a scrambling unit.

In some embodiments, the method can comprise an activity recognition unit performing the step of detecting at least one event on the scrambled image data. That is, the detection of at least one event on the scrambled image data can be performed automatically by the scrambling unit.

In some embodiments, the method can comprise a descrambling unit performing the step of descrambling the labeled portion of the activity-related image data using the descrambling key. That is, the descrambling of the labeled portion of the activity-related image data can be performed automatically by a descrambling unit. In such embodiments, the method can comprise providing the descrambling key to the descrambling unit. As such, the descrambling key can use the descrambling key to descramble the labeled portion of the image data comprised within the activity-related image data.

In some embodiments, the method can comprise an identification unit performing the step of generating identification data related to the labeled portion of the activity-related image data based on the labeled portion of the activity-related image data in the descrambled state. That is, in some embodiments, the method can comprise automatically identifying objects after descrambling the labeled portion of the activity-related image data.

The method can preferably be a computer implanted method. That is, the method can be carried out by one or more devices executing computer instructions.

For example, the method can be implemented as one or more computer program product(s).

In some embodiments, the method can comprise providing descrambling privileges to at least one node in a communication network. The communication network can comprise a plurality of nodes. Each node can be configured to communicate (i.e. transfer electronic data) with at least one other node in the communication network. The node(s) provided with descrambling privileges, different from the rest of the nodes in the communication network, can descramble the labeled portion of the image data.

Different nodes in the communication network can perform different steps of the method. For example, one or more nodes may obtain image data, on or more nodes may label a portion of the image data to generate labeled image data, one or more nodes may scramble the labeled portion of the image data to generate scrambled image data and one or more nodes may process the scrambled image data to detect event therein. Furthermore, only the nodes obtaining, labeling and scrambling the image data may have access to the labeled portion of the image data, as the labeled portion of the image data may not be scrambled yet. Due to scrambling of the labeled portion of the image data the rest of the nodes in the network may not extract information from the labeled portion of the image data; they may still access the scrambled image data and extract information form the rest of the scrambled image data. As discussed, the scrambled image data can comprise unscrambled parts (i.e. only the labeled portion are scrambled). This can allow other nodes in the network to process the scrambled image data, e.g., for detecting at least one event therein.

Furthermore, as discussed, the present method allows the possibility of descrambling the labeled portion of the image data by using a descrambling key. However, typically due to privacy concerns or policies, not all the nodes should be able to perform descrambling. As such, the present method can comprise allowing only a subset of the nodes to descramble the labeled portion of the image data, preferably trusted nodes or nodes corresponding to a legal authority that can access or determine to access private data. Hence, the present method can allow descrambling the labeled portion of the image data, without violating privacy policies.

The method can comprise at least two nodes transferring electronic data to each other using a short-range communication protocol, an on-chip communication protocol, a long-range communication protocol or any combination thereof.

The method can comprise at least two nodes transferring electronic data to each other using a wired communication protocol, a wireless communication protocol, or any combination thereof.

The method can comprise at least two nodes transferring electronic data to each other using a standardized communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, any of communication protocols of the internet protocol suite, mobile communication protocol or any combination thereof. The electronic data comprise image data, labeled image data, scrambled image data, activity- related image data, descrambled activity-related image data, identity of an object, metadata, labeling data or any combination thereof.

The nodes in the communication network can be an image sensor, a labeling unit, a scrambling unit, an activity recognition unit, a descrambling unit, an identification unit, or any combination thereof.

At least one node in the communication network can be an end device. The end device can comprise an image sensor and optionally a labeling unit and further optionally a scrambling unit.

The at least one node in the communication network can be a server. The server can typically be provided as a central node, i.e., a node being closest, in terms of the number of hops, to all other nodes in the communication network.

The server can comprise a database and the method can comprise storing the scrambled image data on the database. This can facilitate providing the scrambled image data to the other nodes in the communication network.

At least one node in the communication network can be an authority terminal.

The method can comprise providing at least one labeling unit embedded in the end device.

The method can comprise providing at least one labeling unit embedded in a second server.

The method can comprise providing at least one scrambling unit embedded in the end device.

The method comprises providing at least one scrambling unit embedded in the server. As such, the scrambling of labeled portion of image data can be provided by the server.

At least one node in the communication network can be a user terminal configured to allow at least one end user to access the communication network.

The at least one end user can own a respective end device.

Providing descrambling privileges to at least one node in the communication network can comprise at least one of providing and storing the descrambling key to/on the at least one node.

Providing descrambling privileges to at least one node in a communication network can be performed during the scrambling of the labeled portion of the image data. More particularly, scrambling the labeled portion of the image data such that the labeled portion can be descrambled by at least one node. As such, the at least one node can be provided with descrambling privileges.

Each node in the communication network can comprise a respective descrambling key. Providing descrambling privileges to at least one node in a communication network can comprise scrambling the labeled portion of the image data such that the labeled portion of the image data can be descrambled with the respective descrambling key of the at least one node in the communication network.

The method can comprise providing descrambling privileges to the authority terminal. In some embodiments, the method can comprise providing descrambling privileges to a trusted authority by providing descrambling privileges to the authority terminal operated by the trusted authority. The trusted authority can be a law enforcement authority and/or judicial authority. Alternatively or additionally, the trusted authority can be any party, person, user, entity who/which is provided with permission to access the information contained in the labeled portion. For example, a user to which the image data can correspond to can provide consent to a party, person, another user or entity for accessing the information contained in the labeled portion. In other words, the trusted authority can be any party, person, or entity that can receive permission either by law and/or by user consent to access the labeled portion of the image data of the user. In such embodiments, the method can comprise at least one of providing and storing the descrambling key to/on the authority terminal.

Alternatively or additionally, the method can comprise providing descrambling privileges to the server. In such embodiments, the method can comprise at least one of providing and storing the descrambling key to/on the server.

Alternatively or additionally, the method can comprise providing descrambling privileges to the end device. In some embodiments, the method can comprise providing descrambling privileges to the user by providing descrambling privileges to the end device of the user. In such embodiments, the method can comprise at least one of providing and storing the descrambling key to/on the end device.

Alternatively or additionally, the method can comprise providing descrambling privileges to the user terminal. In some embodiments, the method can comprise providing descrambling privileges to the user by providing descrambling privileges to the user terminal of the user. In such embodiments, the method can comprise at least one of providing and storing the descrambling key to/on the user terminal. In some embodiments, the method can comprise performing selective scrambling. More particularly, the labeled portion of the image data can comprise a first sub-portion representing a first object and a second sub-portion representing a second object. The first sub-portion can be configured to be descrambled by providing a first descrambling key and the second sub-portion can be configured to be descrambled by providing a second descrambling key. In other words, the first sub-portion can be scrambled such that it can be descrambled by providing a first descrambling key and the second sub-portion can be descrambled by providing a second descrambling key. It will be understood, that the first and the second descrambling keys are different from each other. Thus, during descrambling it can be possible to descramble some of the pixels of the labeled portion while it may not be possible to descramble some other pixels of the labeled portion. For example, only pixels corresponding to objects that interacts in a detected event can be descrambled.

Furthermore, in such embodiments, the method can comprise providing to at least one first node descrambling privileges for the first sub-portion of the labeled portion such that the at least one first node can descramble the first sub-portion and providing to at least one second node descrambling privileges for the second sub-portion of the labeled portion such that the at least one first node can descramble the second sub-portion. Thus, different parties can descramble respective parts of the labeled portion. For example, different parties may descramble respective parts of the labeled portion (but not all) based on their legal standing.

In a second aspect the present invention relates to a device comprising a scrambling unit configured to receive image data comprising at least one image and a labeled portion and scramble the labeled portion of the image data to generate scrambled image data.

The device can comprise an image sensor configured to obtain image data by capturing at least one image.

The device can comprise a labeling unit configured to label a portion of the image data.

The device can comprise a memory component. The memory component comprises a volatile or non-volatile memory, such as a random-access memory (RAM), Dynamic RAM (DRAM), Synchronous Dynamic RAM (SDRAM), static RAM (SRAM), Flash Memory, Magneto-resistive RAM (MRAM), Ferroelectric RAM (F-RAM), or Parameter RAM (P-RAM).

The memory component or a portion of the memory component can be shared by the image sensor and the labeling unit.

The memory component or a portion of the memory component can be shared by the labeling unit and the scrambling unit. The device can comprise at least one data communication component configured to facilitate the image sensor and the labeling unit and the scrambling unit or any combination thereof to transfer data between each other.

The image sensor comprises at least one camera, such as, a mobile camera, a mobile phone camera, a body camera, a traffic camera, a dash camera, a drive recorder, a car digital video recorder (DVR), an event data recorder (EDR), car camera, front car camera, rear car camera, side car camera, surveillance camera and/or building surveillance camera.

The image sensor can be configured to capture images according to different frame rates.

The image sensor can be configured to capture images with different resolutions.

The labeling unit can comprise an object detection unit.

The scrambling unit can comprise a shuffling unit.

The scrambling unit can comprise an encryption unit.

The labeling unit can comprise at least one processor, such as, a CPU (central processing unit), GPU graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array) or any combination thereof.

The scrambling unit (130) comprises at least one processor, such as, a CPU (central processing unit), GPU graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array) or any combination thereof.

The labeling unit and the scrambling unit can be integrated into a single processing unit.

The single processing unit comprises at least one processor, such as, a CPU (central processing unit), GPU graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array) or any combination thereof.

The device is configured to carry out the steps of the method according to the first aspect of the present invention. It will be understood, that features and advantages discussed with reference to the method embodiments, can also be comprised by the device according to the second aspect of the present invention. For the sake of brevity, a detailed discussion of some features and advantages is provided only for the method embodiments and omitted for the device embodiments. The device can be an end device.

In a third aspect the present invention related to a system comprising a scrambling unit configured to receive image data comprising at least one image and a labeled portion and scramble the labeled portion of the image data to generate scrambled image data. The labeled portion of the image data is configured to be descrambled by providing a descrambling key.

The system can comprise an image sensor configured to obtain image data by capturing at least one image.

The system can comprise a labeling unit configured to label a portion of the image data.

The image sensor, labeling unit and/or the scrambling unit can be comprised by the device according to any of the preceding device embodiments.

The system can comprise an action recognition unit.

The system can comprise a descrambling unit.

The system can comprise at least one end device.

Each of the at least one end devices can comprise a respective image sensor.

Each of the at least one end devices can comprise a respective labeling unit.

The system can further comprise a server.

The server can comprise a database configured to store scrambled image data.

The server can comprise the scrambling unit.

The system can be configured to carry out the method according to any of the preceding method embodiments. It will be understood, that features and advantages discussed with reference to the method embodiments, can also be comprised by the system according to the third aspect of the present invention. For the sake of brevity, a detailed discussion of some features and advantages is provided only for the method embodiments and omitted for the system embodiments.

The present technology is also defined by the following numbered embodiments.

Below, method embodiments will be discussed. These embodiments are abbreviated by a number. When reference is herein made to method embodiments, these embodiments are meant.

1. A method comprising the steps of providing image data (210) comprising at least one image (215) and a labeled portion; scrambling the labeled portion of the image data (210) to generate scrambled image data (230); wherein the labeled portion of the image data (210) is configured to be descrambled by providing a descrambling key.

Imaging

2. The method according to the preceding embodiment, wherein the method comprises obtaining the image data (210) with an image sensor (110) capturing the at least one image (215).

3. The method according to the preceding embodiment, wherein the image sensor (110) comprises at least one camera, such as, a mobile camera, a mobile phone camera, a body camera, a wearable camera, a traffic camera, a dash camera, a drive recorder, a car digital video recorder (DVR), an event data recorder (EDR), car camera, front car camera, rear car camera, side car camera, surveillance camera and/or building surveillance camera.

4. The method according to any of the preceding embodiments, wherein the image data (210) comprise a plurality of images (215) captured sequentially, such as, a video.

5. The method according to any of the 3 preceding embodiments, wherein obtaining image data (210) comprises capturing 1 to 240 images (215) per second, preferably 10 to 60 images (215) per second, more preferably 10 to 30 images (215) per second.

6. The method according to any of the 4 preceding embodiments, wherein the image sensor (110) is configured to capture images (210) according to different frame rates and the method comprises configuring the image sensor (110) to capture images with one of the frame rates prior to capturing the images (215).

7. The method according to any of the preceding embodiments, wherein the image data (210) comprise at least one image (215) comprising: a width of at least 100 pixels (212), preferably at least 640 pixels (212), more preferably at least 1024 pixels (212), and a height of at least 100 pixels (212), preferably at least 480 pixels (212), more preferably at least 600 pixels (212). 8. The method according to any of the 6 preceding embodiments, wherein the image sensor (110) is configured to capture images (215) with different resolutions and the method comprises configuring the image sensor (110) to capture images (215) with one of the resolutions prior to capturing the at least one image (215).

Labeling

9. The method according to any of the preceding embodiments, wherein the labeled portion of the image data (210) is a subset of the image data (210).

10. The method according to any of the preceding embodiments, wherein the image data (210) comprises a plurality of pixels (212) corresponding to the at least one image (215) and wherein the labeled portion of the image data (210) is a subset of the pixels (212) corresponding to the at least one image (215).

11. The method according to any of the preceding embodiments, wherein the method comprises providing labeling data (222) corresponding to the image data (210) and

(222) wherein the labeling data (222) indicates a labeled portion of the image data

(210).

12. The method according to the preceding embodiment, wherein the labeling data (222) comprises a location on the image data (210) of the labeled portion of the image data (210), at least one coordinate or index indicating a location on the image data (210) of the labeled portion of the image data (210), a size of the labeled portion of the image data (210), a shape of the image data of the labeled portion of the image data (210), a start location and an end location of the labeled portion of the image data (210), a center location and a boundary of the labeled portion of the image data (210), a reference location on the image data (210) and a function outputting the labeled portion of the image data (210) based on the reference location, or any combination thereof.

13. The method according to any of the 2 preceding embodiments, wherein the image data (210) comprise a plurality of pixels (212) corresponding to the at least one image (215) and wherein the labeling data comprise for each of the pixels (212) a binary flag indicating whether the pixel (212) is labeled.

Labeling a portion of the image data

14. The method according to any of the preceding embodiments, wherein the method comprises labeling a portion of the image data (210).

15. The method according to the preceding embodiment and with the features of embodiment 11, wherein labeling a portion of the image data (210) comprises adding labeling data (222) to the image data (210).

16. The method according to any of the 2 preceding embodiments and with the features of embodiment 11, wherein labeling a portion of the image data (210) comprises adding labeling data (222) to the at least one image (215) comprised by the image data (210).

17. The method according to any of the 3 preceding embodiments and with the features of embodiment 11, wherein labeling a portion of the image data (210) comprises generating labeled image data (220) and wherein the labeled image data comprise the image data (210) and the labeling data (222).

Object detection

18. The method according to any of the preceding embodiments and with the features of embodiment 14, wherein labeling a portion of the image data (210) comprises processing the image data (210) for detecting at least one object captured on the at least one image (215) and upon detection of an object, labeling the portion of the image data (210) representing the object.

19. The method according to the preceding embodiment, wherein processing the image data (210) for detecting at least one object captured on the at least one image (215) comprises processing the image data (210) for detecting a body of a person, a body part of a person, a face of a person, a building, a part of a building, a house, an apartment, windows of buildings, traffic signs, bicycles, vehicles, windows of vehicles, a license plate of a vehicle, an operator of a vehicle, a logo, a text, an image, an advertisement, billboard, a screen, a private territory or any combination thereof.

- Reducing size of image data -

20. The method according to any of the preceding embodiments and with the features of embodiment 18, wherein the method comprises reducing the size of image data (210) before processing the image data (210) for detecting at least one object.

21. The method according to the preceding embodiment, wherein reducing the size of the image data (210) comprises applying a lossy compression on the image data, applying a lossless compression on the image data, reducing the resolution of the image data (e.g. removing each second lines of pixels), uniformly removing pixels from one or more images, or any combination thereof.

22. The method according to any of the 2 preceding embodiments, wherein the image data (210) comprises a plurality of images (215) captured sequentially and wherein reducing the size of the image data (210) comprises removing at least one image (215) from the image data (210), preferably, uniformly removing a plurality of images (215) from the image data.

23. The method according to any of the preceding embodiments, wherein the method comprises reducing the size of the image data by at least 1% and at most 50%.

Optimizations -

24. The method according to any of the preceding embodiments and with the features of embodiment 18, wherein the image data (210) comprises a plurality of images (215) captured sequentially and wherein the method comprises detecting an object on at least one first image (215) captured before at least one second image (215), using the location of the object detected on the at least one first image (215) as a priori information for detecting the object on the at least one second image (215). 25. The method according to any of the preceding embodiments and with the features of embodiment 18, wherein the image data (210) comprise metadata indicating a portion of the image data representing at least one parent object, wherein a parent object comprises the object to be detected.

26. The method according to the preceding embodiment, wherein processing the image data (210) for detecting at least one object captured on the at least one image (215) comprises processing only the portion of the image data (210) representing the parent object.

27. The method according to any of the 2 preceding embodiments, wherein processing the image data (210) for detecting at least one object captured on the at least one image (215) comprises determining the location of the object on the image data based on a position of the object on the parent object.

- Object detection algorithm -

28. The method according to any of the preceding embodiments and with the features of embodiment 18, wherein processing the image data (210) to detect at least one object comprises executing an object detection algorithm.

29. The method according to the preceding embodiment, wherein the object detection algorithm is based on a pattern recognition algorithm.

For example, the object detection algorithm can be configured to detect a portion on an image (215) of the image data (210) that resembles to a known pattern. The object detection algorithm can be trained to recognize a pattern with a plurality of training patterns (e.g. annotated images), wherein the training patterns can correspond to different deviations of the pattern to be learned. The object detection algorithm can comprise a plurality of parameters which it can adjust based on the training patterns to detect a pattern (e.g. a face of a person) more efficiently.

30. The method according to any of the 2 preceding embodiments, wherein the object detection algorithm is based on a machine learning algorithm.

31. The method according to any of the 3 preceding embodiments, wherein the object detection algorithm is based on a deep learning algorithm.

32. The method according to any of the 4 preceding embodiments, wherein the object detection algorithm is based on an artificial neural network. Scrambling

33. The method according to any of the preceding embodiments, wherein the method comprises scrambling only the labeled portion of the image data (210).

34. The method according to any of the preceding embodiments, wherein the image data (210) comprises a plurality of pixels (212) corresponding to the at least one image (215) and scrambling the labeled portion of the image data (210) comprises changing respective positions of a plurality of pixels within the labeled portion of the image data (210).

35. The method according to the preceding embodiment, wherein changing respective positions of a plurality of pixels within the labeled portion of the image data (210) comprises changing the respective position of at least 90%, preferably at least 95%, more preferably at least 99% of the pixels within the labeled portion of the image data (210).

36. The method according to any of the preceding embodiments, wherein the image data (210) comprises a plurality of pixels (212) corresponding to the at least one image (215) and scrambling the labeled portion of the image data (210) comprises changing respective values of a plurality of pixels within the labeled portion of the image data (210).

37. The method according to the preceding embodiment, wherein changing respective values of a plurality of pixels within the labeled portion of the image data (210) comprises changing the respective values of at least 90%, preferably at least 95%, more preferably at least 99% of the pixels within the labeled portion of the image data (210).

- Scrambling key -

38. The method according to any of the preceding embodiments, wherein scrambling the labeled portion of the image data (210) comprises using a scrambling key.

39. The method according to any of the preceding embodiments, wherein the descrambling key corresponds to the scrambling key.

40. The method according to any of the 2 preceding embodiments, wherein the scrambling key and the descrambling key each comprise a respective seed for generating at least one random number. 41. The method according to the preceding embodiment, wherein the scrambling key and the descrambling key comprise an identical seed.

42. The method according to any of the 4 preceding embodiments, wherein the scrambling key and the descrambling key each comprise a respective cryptographic key.

43. The method according to the preceding embodiment, wherein the scrambling key and the descrambling key comprise an identical cryptographic key.

44. The method according to the penultimate embodiment, wherein the scrambling key and the descrambling key comprise different cryptographic keys.

- Scrambling function -

45. The method according to any of the preceding embodiments, wherein scrambling the labeled portion of the image data (210) comprises executing a scrambling function with the labeled portion of the image data (210) as input to the scrambling function.

46. The method according to the preceding embodiment, wherein the scrambling function is a parameterized function comprising a configurable scrambling parameter.

47. The method according to the preceding embodiment and with the features of embodiment 38, wherein the method comprises configuring the scrambling parameter based on the scrambling key.

For example, the scrambling key can be assigned as the value of the scrambling parameter.

48. The method according to any of the 3 preceding embodiments, wherein the scrambling function is an invertible function and wherein a descrambling function is the inverse function of the scrambling function.

49. The method according to the preceding embodiment, wherein the descrambling function is a parameterized function comprising a configurable descrambling parameter.

50. The method according to the preceding embodiment, wherein the method comprises configuring the descrambling parameter based on the descrambling key.

For example, the descrambling key can be assigned as the value of the descrambling parameter.

- Shuffling function -

51. The method according to any of the preceding embodiments and with the features of embodiment 45, wherein the labeled portion of the image data (210) is arranged according to an original order and wherein the scrambling function comprises a shuffling function and executing the shuffling function causes the labeled portion of the image data (210) to be ordered according to a shuffled order different from the original order.

52. The method according to the preceding embodiment, wherein the original order and the shuffled order are uncorrelated.

53. The method according to any of the 2 preceding embodiments, wherein a correlation coefficient, such as a Pearson correlation coefficient, between the original order and the shuffled order is in the range of -0.1 to 0.1, preferably in the range of -0.01 to 0.01, such as, 0.

54. The method according to any of the 3 preceding embodiments, wherein the shuffled order is pseudo-random.

55. The method according to any of the 4 preceding embodiments, wherein an autocorrelation coefficient of the shuffled order is in the range of -0.1 to 0.1, preferably in the range of -0.01 to 0.01, such as, 0.

56. The method according to any of the 5 preceding embodiments, wherein the shuffling function comprises a pseudo-random number generator, and wherein a pseudo-random sequence is generated by executing the pseudo-random number generator, and wherein the shuffling of the labeled portion of the image data (210) is based on the pseudo-random sequence.

57. The method according to the preceding embodiment and with the features of embodiment 40, wherein the pseudo-random number generator comprises a configurable seed parameter such that the pseudo-random sequence can be determined based on the value of the seed parameter and the method comprises configuring the seed parameter based on the seed of the scrambling key.

Encryption 58. The method according to any of the preceding embodiments and with the features of embodiment 45, wherein the scrambling function comprises an encryption function and executing the encryption function causes the labeled portion of the image data (210) to be encrypted.

59. The method according to the preceding embodiment, wherein the labeled portion of the image data (210) in an unencrypted state and the labeled portion of the image data in the encrypted state are uncorrelated.

60. The method according to any of the 2 preceding embodiments, wherein a correlation coefficient, such as a Pearson correlation coefficient, between the labeled portion of the image data (210) in an unencrypted state and the labeled portion of the image data (210) in the encrypted state is in the range of -0.1 to 0.1, preferably in the range of -0.01 to 0.01, such as, 0.

61. The method according to any of the 3 preceding embodiments, wherein the encryption function uses an encryption key.

62. The method according to the preceding embodiment and with the features of embodiment 42, wherein the encryption key is configured based on the cryptographic key of the scrambling key.

63. The method according to any of the 5 preceding embodiments, wherein the encryption function is based on a symmetric encryption scheme, such as, Blowfish, Advanced Encryption Standard (AES), Rivest Cipher 4/5/6 (RC 4/5/6), or Data Encryption Standard (DES).

64. The method according to any of the 6 preceding embodiments, wherein the encryption function is based on an asymmetric encryption scheme, such as, RSA, ECC P256kl, ECC R256P, X25519.

- Scrambled image data -

65. The method according to any of the preceding embodiments, wherein the scrambled image data (230) comprise image data (210) wherein the labeled portion of the image data (210) is scrambled.

The labeled portion comprised by the scrambled image data (230), i.e., the labeled portion of the image data (210) in a scrambled state, can also be referred to as a scrambled portion.

66. The method according to any of the preceding embodiments and with the features of embodiment 11, wherein the scrambled image data (230) comprise labeling data (222). 67. The method according to any of the preceding embodiments, wherein the scrambled image data (230) comprise metadata related to the scrambling of the labeled portion of the image data (210).

Action detection

68. The method according to any of the preceding embodiments, the method comprising detecting at least one event (232) on the scrambled image data (230) and based thereon generating activity-related image data (240), wherein the activity-related image data (240) comprise a portion of the scrambled image data (230) indicating the event (232).

69. The method according to the preceding embodiment, wherein detecting at least one event (232) on the scrambled image data (230) comprises executing an activity recognition algorithm.

70. The method according to the preceding embodiment, wherein the activity recognition algorithm is based on a gesture recognition algorithm, motion detection algorithm, body position detection algorithm, gait analysis algorithm, motion analysis algorithm, vehicle motion analysis algorithm, traffic violation detection algorithm, moving violation detection algorithm or any combination thereof.

71. The method according to any of the 2 preceding embodiments, wherein the activity recognition algorithm is based on a machine learning algorithm.

72. The method according to any of the 3 preceding embodiments, wherein the activity recognition algorithm is based on a deep learning algorithm.

73. The method according to any of the 4 preceding embodiments, wherein the activity recognition algorithm is based on an artificial neural network.

Descrambling

74. The method according to any of the preceding embodiment and with the features of embodiment 68, wherein the method comprises descrambling the labeled portion of the activity-related image data (240) using the descrambling key.

75. The method according to the preceding embodiment and with the features of embodiment 34, wherein descrambling the labeled portion of the activity-related image data (240) using the descrambling key comprises restoring the respective positions of the plurality of pixels within the labeled portion of the activity-related image data (240).

76. The method according to the preceding embodiment and with the features of embodiment 36, wherein descrambling the labeled portion of the activity-related image data (240) using the descrambling key comprises restoring the respective values of the plurality of pixels within the labeled portion of the activity-related image data (240).

- Descrambling function -

77. The method according to any of the 3 preceding embodiments and with the features of embodiment 48, descrambling the labeled portion of the activity-related image data (240) using the descrambling key comprises executing the descrambling function with the labeled portion of the activity- related image data (240) as input to the descrambling function.

- Ordering function -

78. The method according to the preceding embodiment and with the features of embodiment 52, wherein the descrambling function comprises an ordering function and executing the ordering function restores the order of the labeled portion of the activity-related image data (240) to the original order.

79. The method according to the preceding embodiment, wherein the ordering function comprises a pseudo-random number generator, and wherein a pseudo-random sequence is generated by executing the pseudo-random number generator, and wherein the original order of the labeled portion of the image data (210) is determined based on the pseudo-random sequence.

80. The method according to the preceding embodiment and with the features of embodiment 40, wherein the pseudo-random generator comprises a configurable seed parameter such that the pseudo-random sequence can be determined based on the value of the seed parameter and the method comprises configuring the seed parameter according to the seed of the descrambling key.

81. The method according to any of the 2 preceding embodiments and with the features of embodiment 52, the method comprising generating the same pseudo-random sequence when executing the shuffling function and when executing the ordering function.

- Decryption algorithm -

82. The method according to any of the preceding embodiments and with the features of embodiment 77, wherein the descrambling function comprises a decryption function and executing the decryption function causes the labeled portion of the activity-related image data (240) to be decrypted.

83. The method according to the preceding embodiment, wherein the decryption function uses a decryption key.

84. The method according to the preceding embodiment and with the features of embodiment 42, wherein the decryption key is configured based on the cryptographic key of the descrambling key.

Identification

85. The method according to any of the preceding embodiments and with the features of embodiment 74, the method comprises generating identification data related to the labeled portion of the activity-related image data (240) based on the labeled portion of the activity- related image data (240) in the descrambled state.

Further features

86. The method according to any of the preceding embodiments, wherein the at least one image (215) is a cropped image (215).

87. The method according to any of the preceding embodiments, wherein the method comprises securely storing the descrambling key.

88. The method according to any of the preceding embodiments and with the features of embodiment 14, wherein the method comprises a labeling unit (120) performing the step of labeling a portion of the image data (210). 89. The method according to any of the preceding embodiments, wherein the method comprises a scrambling unit (130) performing the step of scrambling the labeled portion of the image data (210) to generate scrambled image data (230).

90. The method according to any of the preceding embodiments and with the features of embodiment 68, wherein the method comprises an activity recognition unit (140) performing the step of detecting at least one event (232) on the scrambled image data (230).

91. The method according to any of the preceding embodiments and with the features of embodiment 74, wherein the method comprises a descrambling unit (150) performing the step of descrambling the labeled portion of the activity-related image data (240) using the descrambling key.

92. The method according to any of the preceding embodiments, wherein the method comprises providing the descrambling key to the descrambling unit (150).

93. The method according to any of the preceding embodiments and with the features of embodiment 85, wherein the method comprises an identification unit (160) performing the step of generating identification data related to the labeled portion of the activity- related image data (240) based on the labeled portion of the activity-related image data (240) in the descrambled state.

94. The method according to any of the preceding embodiments, wherein the method is a computer implanted method.

95. The method according to any of the preceding embodiments, wherein the method is implemented as one or more computer program product(s).

Distributing descrambling privileges in a communication network

96. The method according to any of the preceding embodiments, wherein the method comprises providing descrambling privileges to at least one node in a communication network wherein the communication network comprises a plurality of nodes, each configured to communicate with at least one other node in the communication network and wherein the at least one node provided with descrambling privileges can descramble the labeled portion of the image data.

- Communication protocols -

97. The method according to the preceding embodiment, wherein the method comprises at least two nodes transferring electronic data to each other using a short-range communication protocol, an on-chip communication protocol, a long-range communication protocol or any combination thereof.

98. The method according to any of the 2 preceding embodiments, wherein the method comprises at least two nodes transferring electronic data to each other using a wired communication protocol, a wireless communication protocol, or any combination thereof.

99. The method according to any of the 3 preceding embodiments, wherein the method comprises at least two nodes transferring electronic data to each other using a standardized communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, any of communication protocols of the internet protocol suite, mobile communication protocol or any combination thereof.

100. The method according to any of the 3 preceding embodiments, wherein the electronic data comprise image data (210), labeled image data (220), scrambled image data (230), activity-related image data (240), descrambled activity-related image data (250), identity of an object (260), metadata, labeling data (222) or any combination thereof.

- Nodes -

101. The method according to any of the 5 preceding embodiments and with the features of embodiment 2, wherein at least one node in the communication network is an image sensor (HO).

102. The method according to any of the 6 preceding embodiments and with the features of embodiment 88, wherein at least one node in the communication network is a labeling unit (120).

103. The method according to any of the 7 preceding embodiments and with the features of embodiment 89, wherein at least one node in the communication network is a scrambling unit (130).

104. The method according to any of the 8 preceding embodiments and with the features of embodiment 90, wherein at least one node in the communication network is an activity recognition unit (140).

105. The method according to any of the 9 preceding embodiments and with the features of embodiment 91, wherein at least one node in the communication network is a descrambling unit (120). 106. The method according to any of the 10 preceding embodiments and with the features of embodiment 93, wherein at least one node in the communication network is an identification unit (160).

107. The method according to any of the 11 preceding embodiments, wherein at least one node in the communication network is an end device (310).

108. The method according to the preceding embodiment and with the features of embodiment 2, wherein the end device (310) comprises an imaging device (110).

109. The method according to any of the 13 preceding embodiments, wherein at least one node in the communication network is a server (300).

110. The method according to the preceding embodiment, wherein the server (300) comprises a database (302) and the method comprises storing the scrambled image data (230) on the database (302).

111. The method according to any of the 15 preceding embodiments, wherein at least one node in the communication network is an authority terminal (350).

112. The method according to any of the 16 preceding embodiments and with the features of embodiments 88 and 107, wherein the method comprises providing at least one labeling unit (120) embedded in the end device (310).

113. The method according to any of the 17 preceding embodiments and with the features of embodiment 88, wherein the method comprises providing at least one labeling unit (120) embedded in a second server (320).

114. The method according to any of the 18 preceding embodiments and with the features of embodiments 89 and 107, wherein the method comprises providing at least one scrambling unit (130) embedded in the end device (310).

115. The method according to any of the 19 preceding embodiments and with the features of embodiments 89 and 109, wherein the method comprises providing at least one scrambling unit (130) embedded in the server (300),

116. The method according to any of the 20 preceding embodiments, wherein at least one node in the communication network is a user terminal configured to allow at least one end user to access the communication network.

117. The method according to the preceding embodiment and with the features of embodiment 107, wherein the at least one end user owns a respective end device (310). - Descrambling privileges -

118. The method according to any of the 22 preceding embodiments, wherein providing descrambling privileges to at least one node in a communication network comprises at least one of providing and storing the descrambling key to/on the at least one node.

119. The method according to any of the 23 preceding embodiments, wherein providing descrambling privileges to at least one node in a communication network is performed during the scrambling of the labeled portion of the image data.

120. The method according to any of the 24 preceding embodiments, wherein providing descrambling privileges to at least one node in a communication network comprises scrambling the labeled portion of the image data such that the labeled portion can be descrambled by at least one node.

121. The method according to any of the 25 preceding embodiments, wherein each node in the communication network comprises a respective descrambling key, and wherein providing descrambling privileges to at least one node in a communication network comprises scrambling the labeled portion of the image data such that the labeled portion of the image data can be descrambled with the respective descrambling key of the at least one node in the communication network.

122. The method according to any of the 26 preceding embodiments and with the features of embodiment 111, wherein the method comprises providing descrambling privileges to the authority terminal (350).

123. The method according to any of the 27 preceding embodiments and with the features of embodiment 111, wherein the method comprises providing descrambling privileges to a trusted authority by providing descrambling privileges to the authority terminal (350) operated by the trusted authority.

124. The method according to the preceding embodiment, wherein the trusted authority is a law enforcement authority and/or judicial authority.

125. The method according to any of the 3 preceding embodiments, wherein the method comprises at least one of providing and storing the descrambling key to/on the authority terminal (350). 126. The method according to any of the 30 preceding embodiments and with the features of embodiment 109, wherein the method comprises providing descrambling privileges to the server (300).

127. The method according to the preceding embodiment, wherein the method comprises at least one of providing and storing the descrambling key to/on the server (300).

128. The method according to any of the 32 preceding embodiments and with the features of embodiment 107, wherein the method comprises providing descrambling privileges to the end device (310).

129. The method according to any of the 33 preceding embodiments and with the features of embodiment 107, wherein the method comprises providing descrambling privileges to the user by providing descrambling privileges to the end device (310) of the user.

130. The method according to any of the 2 preceding embodiments, wherein the method comprises at least one of providing and storing the descrambling key to/on the end device (310).

131. The method according to any of the 35 preceding embodiments and with the features of embodiment 116, wherein the method comprises providing descrambling privileges to the user terminal.

132. The method according to any of the 36 preceding embodiments and with the features of embodiment 116, wherein the method comprises providing descrambling privileges to the user by providing descrambling privileges to the user terminal of the user.

133. The method according to any of the 2 preceding embodiments, wherein the method comprises at least one of providing and storing the descrambling key to/on the user terminal.

Further features

134. The method according to any of the preceding method embodiments and with the features of embodiment 11, wherein the image data (210) comprise a plurality of pixels (212) corresponding to the at least one image (215) and wherein the labeling data comprise for each of the pixels (212) a labeling parameter and wherein the labeling parameter is a non-binary value. 135. The method according to the preceding embodiment, wherein the labeling parameter of a pixel indicates a likelihood that the pixel corresponds to an object.

136. The method according to the preceding embodiment, wherein the method comprises determining whether the pixel is part of the labeled portion of the image data if the likelihood that the pixel corresponds to an object is higher than a threshold value.

137. The method according to any of the 3 preceding embodiments, wherein the labeling parameter of a pixel indicates an object class that the pixel corresponds to.

138. The method according to the preceding embodiment, wherein the method comprises determining whether the pixel is part of the labeled portion of the image data based on the object class that the pixel corresponds to.

139. The method according to any of the 2 preceding embodiments, wherein the method comprises determining whether two pixels correspond to the same object based on the labeling parameter.

140. The method according to any of the preceding embodiments, wherein the labeled portion of the image data (210) comprises a first sub-portion representing a first object and a second sub-portion representing a second object and wherein the first sub-portion is configured to be descrambled by providing a first descrambling key and the second sub-portion is configured to be descrambled by providing a second descrambling key.

141. The method according to the preceding embodiment and with the features of embodiment 96, wherein providing descrambling privileges to at least one node in a communication network comprises providing to at least one first node descrambling privileges for the first sub-portion of the labeled portion such that the at least one first node can descramble the first sub-portion, and providing to at least one second node descrambling privileges for the second sub-portion of the labeled portion such that the at least one first node can descramble the second sub portion.

142. The method according to the preceding embodiment, wherein the at least one first node is different from the at least one second node. Below, device embodiments will be discussed. These embodiments are abbreviated by the letter "D" followed by a number. When reference is herein made to device embodiments, these embodiments are meant.

Dl. A device comprising a scrambling unit (130) configured to receive image data (210) comprising at least one image (215) and a labeled portion and scramble the labeled portion of the image data (210) to generate scrambled image data (230); wherein the labeled portion of the image data (210) is configured to be descrambled by providing a descrambling key.

D2. The device according to the preceding embodiment, the device comprises an image sensor (110) configured to obtain image data (210) by capturing at least one image (215).

D3. The device according to any of the preceding device embodiments, wherein the device comprises a labeling unit (120) configured to label a portion of the image data (210).

D4. The device according to any of the preceding device embodiments, wherein the device comprises a memory component.

D5. The device according to the preceding embodiment, wherein the memory component comprises a volatile or non-volatile memory, such as a random access memory (RAM), Dynamic RAM (DRAM), Synchronous Dynamic RAM (SDRAM), static RAM (SRAM), Flash Memory, Magneto-resistive RAM (MRAM), Ferroelectric RAM (F-RAM), or Parameter RAM (P- RAM).

D6. The device according to any of the 2 preceding embodiments and with the features of embodiments D2 and D3, wherein the memory component or a portion of the memory component is shared by the image sensor (110) and the labeling unit (120).

D7. The device according to any of the 3 preceding embodiments and with the features of embodiment D3, wherein the memory component or a portion of the memory component is shared by the labeling unit (120) and the scrambling unit (130).

D8. The device according to any of the preceding device embodiments and with the features of embodiments D2 and D3, wherein the device comprises at least one data communication component configured to facilitate the image sensor (110) and the labeling unit (120) and the scrambling unit (130) or any combination thereof to transfer data between each other.

D9. The device according to any of the preceding device embodiments, wherein the image sensor (110) comprises at least one camera, such as, a mobile camera, a mobile phone camera, a body camera, a wearable camera, a traffic camera, a dash camera, a drive recorder, a car digital video recorder (DVR), an event data recorder (EDR), car camera, front car camera, rear car camera, side car camera, surveillance camera and/or building surveillance camera.

D10. The device according to any of the preceding device embodiments and with the features of embodiment D2, wherein the image sensor (110) is configured to capture images (210) according to different frame rates.

Dll. The device according to any of the preceding device embodiments and with the features of embodiment D2, wherein the image sensor (110) is configured to capture images (215) with different resolutions.

D12. The device according to any of the preceding device embodiments and with the features of embodiment D3, wherein the labeling unit (120) comprises an object detection unit.

D13. The device according to any of the preceding device embodiments, wherein the scrambling unit (130) comprises a shuffling unit.

D14. The device according to any of the preceding device embodiments, wherein the scrambling unit (130) comprises an encryption unit.

D15. The device according to the preceding embodiment and with the features of embodiment D3, wherein the labeling unit (120) comprises at least one processor, such as, a CPU (central processing unit), GPU graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array) or any combination thereof.

D16. The device according to the preceding embodiment, wherein the scrambling unit (130) comprises at least one processor, such as, a CPU (central processing unit), GPU graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array) or any combination thereof. D17. The device according to any of the preceding device embodiments and with the features of embodiment D3, wherein the labeling unit (120) and the scrambling unit (130) are integrated into a single processing unit.

D18. The device according to the preceding embodiment, wherein the single processing unit comprises at least one processor, such as, a CPU (central processing unit), GPU graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array) or any combination thereof.

D19. The device according to any of the preceding device embodiments, wherein the device is configured to carry out the steps of the method according to any of the preceding method embodiments.

D20. The method according to any of the preceding embodiments and with the features of embodiment D2, wherein the device is an end device (310).

Below, system embodiments will be discussed. These embodiments are abbreviated by the letter "S" followed by a number. When reference is herein made to system embodiments, these embodiments are meant.

51. A system comprising a scrambling unit (130) configured to receive image data (210) comprising at least one image (215) and a labeled portion and scramble the labeled portion of the image data (210) to generate scrambled image data (230); wherein the labeled portion of the image data (210) is configured to be descrambled by providing a descrambling key.

52. The system according to the preceding embodiment, wherein the system comprises an image sensor (110) configured to obtain image data (210) by capturing at least one image (215).

53. The system according to any of the preceding system embodiments, wherein the system comprises a labeling unit (120) configured to label a portion of the image data (210). 54. The system according to any of the preceding system embodiments, wherein the image sensor (110), labeling unit (120) and/orthe scrambling unit (130) are comprised by the device according to any of the preceding device embodiments.

55. The system according to any of the preceding system embodiments wherein the system comprises an action recognition unit (140).

56. The system according to any of the preceding system embodiments wherein the system comprises a descrambling unit (150).

57. The system according to any of the preceding system embodiments, wherein the system comprises at least one end device (310).

58. The method according to the preceding embodiment and with the features of embodiment S2, wherein each of the at least one end devices (310) comprises a respective image sensor (110).

59. The method according to any of the 2 preceding embodiments and with the features of embodiment S3, wherein each of the at least one end devices (310) comprises a respective labeling unit (120).

510. The system according to any of the preceding system embodiments, wherein the system comprises a server (300).

511. The system according to the preceding embodiment, wherein the server (300) comprises a database (302) configured to store scrambled image data (230).

512. The system according to any of the preceding system embodiments and with the features of embodiment S3, wherein the server comprises the scrambling unit (130).

513. The system according to any of the preceding system embodiments, wherein the system is configured to carry out the method according to any of the preceding method embodiments.

Below, use embodiments will be discussed. These embodiments are abbreviated by the letter "U" followed by a number. When reference is herein made to use embodiments, these embodiments are meant.

Ul. Use of the method according to any of the preceding method embodiments, the device according to any of the preceding device embodiments and the system according to any of the preceding system embodiments for monitoring an environment, such as, traffic, building, retail environment, entrance of a building or any combination thereof. U2. Use of the method according to any of the preceding method embodiments, the device according to any of the preceding device embodiments and the system according to any of the preceding system embodiments for detecting a law, policy or regulation violation in an environment, such as, traffic, building, retail environment, entrance of a building or any combination thereof.

Brief description of the drawings

Figure 1 schematically illustrates a system according to an aspect of the present invention;

Figure 2 schematically illustrates a data flow diagram related to the system;

Figures 3a to 3c illustrate a more detailed view of different arrangements of the system illustrated in Fig. 1;

Figures 4a to 4d illustrate a scrambling of the image data performed by the system;

Figure 5a depicts an illustrative image;

Figure 5b depicts the illustrative image of Fig. 5a with labeled portions;

Figure 5c depicts the illustrative image of Fig. 5a wherein the labeled portions are scrambled;

Figure 5d illustrates the detection of an event on the illustrative image of Fig. 5a wherein the labeled portions are scrambled;

Figure 5e illustrates the descrambling of one of the labeled portions of the illustrative image of Fig. 5a;

Figure 5f illustrates the identification of one of the descrambled labeled portions of the illustrative image of Fig. 5a;

Figure 6 depicts the steps of a method according to an aspect of the present invention.

Detailed description of the drawings

In the following description, a series of features and/or steps are described. The skilled person will appreciate that unless explicitly required and/or unless requires by the context, the order of features and steps is not critical for the resulting configuration and its effect. Further, it will be apparent to the skilled person that irrespective of the order of features and steps, the presence or absence of time delay between steps can be present between some or all of the described steps.

It is noted that not all the drawings may carry all the reference signs. Instead, in some of the drawings, some of the reference signs may have been omitted for sake of brevity and simplicity of illustration. Embodiments of the present invention will now be described with reference to the accompanying drawings.

Fig. 1 illustrates a system according to an aspect of the present invention. The system may comprise an image sensor 110. The image sensor 110 can be configured to detect electromagnetic waves such as light and/or infrared and convert them into signals such as electrical signal. The electrical signals convey the information for generating an image. The image sensor 110 may comprise at least one camera, such as, a mobile camera, a mobile phone camera, a body camera, a wearable camera, a traffic camera, a dash camera, a drive recorder, a car digital video recorder (DVR), an event data recorder (EDR), car camera, front car camera, rear car camera, side car camera, surveillance camera and/or building surveillance camera. It will be understood that the above list of cameras that can be comprised by the image sensor 110 is only exemplary and is not an exhaustive list.

The image sensor 110 can be utilized to capture images to obtain image data. The image data can comprise at least a portion of an image. That is, the image data may comprise an entire image or a cropped version of an image. Each image comprised in the image data may comprise a plurality of pixels. For example, each image may comprise a width of at least 100 pixels, preferably at least 640 pixels, more preferably at least 1024 pixels and a height of at least 100 pixels, preferably at least 480 pixels, more preferably at least 600 pixels. Thus, each image may comprise at least 64000 pixels, preferably at least 614400 pixels.

In some embodiments, the image sensor 110 can be configured to capture images with different resolutions, such as, 100x100 pixels, 640x480 pixels, 1024x600 pixels, 1280x720 pixels, 1920x1080 pixels or 3840x2160 pixels. It will be understood that the above resolutions are only exemplary and the provided list of exemplary resolutions is not an exhaustive list. In such embodiments, prior to capturing the image data, the image sensor 110 may be configured to allow selecting a resolution of capturing the images. Further still, the image sensor 110 may be configured to captured a plurality of images sequentially. That is, the image sensor 110 may be configured to record a video. For example, the image sensor 110 may capture 1 to 240 images per second, preferably 10 to 60 images per second, more preferably 10 to 30 images per second. The images captured sequentially (while recording a video) can also be referred to as frames.

The image sensor 110 may be configured to output images and/or videos in a raw format. The raw format can be configured to comprise with minimum loss of information data obtained from the image sensor 110. Alternatively or additionally, the image sensor 110 may be configured to output images and/or videos in a compressed and/or encoded format. Any compression and/or encoding technique may be used with the present technology.

In addition, the image sensor 110 may associate to the captured images respective metadata. The metadata can be associated to an image or to a group of images, e.g. to a video, and may describe the conditions surrounding the capturing of the image(s). For example, the metadata may indicate the time, date, location, size, resolution, aperture, focal length, ISO and/or exposure time of capturing the image(s). It will be understood, that this is only exemplary information that can be comprised by the metadata.

That is, utilizing the image sensor 110 image data can be obtained. More particularly, the image data can be obtained by capturing images and/or videos with the image sensor 110. Thus, the image data can comprise at least one image or at least one portion of each of the at least one image that can be captured by the image sensor 110. In addition, the image data may comprise metadata related to the at least one image captured by the image sensor 110.

The system may further comprise a labeling unit 120. The labeling unit 120 can be configured to receive the image data obtained by the image sensor 110. Additionally or alternatively, the image sensor 110 may be configured to provide the image data to the labeling unit 120.

In some embodiments the image sensor 110 and the labeling unit 120 may be configured to access the same memory device (not shown), or the same portion of a memory device. More particularly, the image sensor 110 may be configured to provide the image data to the memory device wherein they can be stored. The labeling unit 120 may access the memory device to receive the image data obtained therein. The memory device may be configured as a buffer. The buffer shared by the image sensor 110 and the labeling unit 120 may be advantageous as the rate at which the image sensor 110 may output the image data can be different than the rate at which the labeling unit 120 can receive and/or process the image data.

In some embodiments, a data transmission channel may be provided to allow data transmission between the image sensor 110 and the labeling unit 120. The data transmission channel may be configured according to a wired and/or wireless communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, mobile communication protocol, or any combination thereof. It will be understood that the above are only exemplary communication protocols that can be used by the present invention to allow data communication between the image sensor 110 and the labeling unit 120.

Typically, the image sensor 110 and the labeling unit 120 can be provided in close proximity with each other. As such, a local or on-chip data transmission channel (e.g. bus interconnection) can be provided between the image sensor 110 and the labeling unit 120. However, it will be understood that this is not limiting. The image sensor 110 and the labeling unit 120 can also be provided distant from each other. In such embodiments, the image sensor 110 can be configured to communicate remotely with the labeling unit 120, e.g. through TCP/IP protocol.

In general, the labeling unit 120 can be configured for labeling a portion of the image data, hence generating a labeled portion of the image data. The labeled portion of the image data can be a subset of the image data. For example, the image data may comprise a plurality of pixels (corresponding to the at least one image) and the labeled portion of the image data can be a subset of the pixels. Furthermore, the labeled portion of the image data may be a continuous portion of the image data or a discontinuous portion of the image data (i.e. comprising a plurality of smaller portions of the image data which are labeled).

The labeling unit 120 may be configured to generate labeling data configured to indicate a labeled portion of the image data. More particularly, the labeling data may comprise a location on the image data of the labeled portion of the image data, at least one coordinate or index indicating a location on the image data of the labeled portion of the image data, a size of the labeled portion of the image data, a shape of the image data of the labeled portion of the image data, a start location and an end location of the labeled portion of the image data, a center location and a boundary of the labeled portion of the image data, a reference location on the image data and a function outputting the labeled portion of the image data based on the reference location, or any combination thereof.

For example, the image data may comprise data structures comprising a systematic arrangement of similar items. For example, the image data may comprise lists or matrices wherein pixels of an image can be arranged systematically. Each element (e.g. pixel) on such data structures comprises a unique location, which can be determined based on the index (or indices) corresponding to that location. Thus, the labeling data can indicate the labeled portion (i.e. labeled elements, e.g., pixels) based on the location, index or indices of the elements of the labeled portion. Similarly, the labeling data may comprise a function and a reference point which can indicate the labeled portion. For example, the labeled portion in an image may resemble the shape of a disk and to indicate it the labeling data may comprise the equation of a circle and the indices of the center of the circle. It will be noted, that the labeled portion may resemble other shapes as well, e.g. a rectangle.

Alternatively, the labeling unit 120 may assign a flag to each data element of the image data. The flag can be a binary digit indicating whether the assigned data element is part of a labeled portion or not.

In some embodiments, the labeling unit 120 may be configured as an object detection unit 120. That is, the labeling unit 120 can be configured to process image data for detecting at least one object captured on an image of the image data. The object can also be referred to as an object of interest. Upon detection of an object, the labeling unit 120 may label the portion of the image data representing the object. In some embodiments, the border of the labeled portion may resemble or coincide with the border of the portion of the image representing the object. Alternatively, the labeled portion may cover a larger area on an image then the area of the portion of the image representing the object. This can increase the likelihood that the entire portion of the image representing the object can be covered by the labeled portion. Typically, the border of the labeled portion may comprise a fixed shape (e.g. circle, rectangle, ellipse) and may comprise or overlap with the portion of the image representing the object.

The object can be a body of a person, a body part of a person, a face of a person, a building, a part of a building, a house, an apartment, windows of buildings, traffic signs, bicycles, vehicles, windows of vehicles, a license plate of a vehicle, an operator of a vehicle, a logo, a text, an image, an advertisement, billboard, a screen, a private territory or any combination thereof. It will be understood that the above list of objects is only exemplary and is not an exhaustive list of objects. That is, the labeling unit 120 may be configured to detect on an image one or more objects which can be of one or more types or categories.

In some embodiments, the labeling unit 120 may process the entire image data for detecting at least one object. This may decrease the likelihood of not detecting (i.e. missing) an object captured on image. Thus, the labeling unit 120 can be more accurate.

In some embodiments, the labeling unit 120 may reduce the size or amount of image data before detecting at least one object. This can be advantageous for decreasing the amount of computations and time required to process the image data for detecting at least one object. In some embodiments reducing the size of the image data may comprise applying a lossy compression on the image data, a lossless compression on the image data, reducing the resolution of the image data (e.g. removing each second lines of pixels), uniformly removing pixels from one or more images, uniformly removing some images or frames in a video, or any combination thereof. In general, reducing the size or amount of image data may reduce the information contained in the image data. However, reducing the size or amount of image data can be configured not to render the image data unintelligible. That is, even after the reduction of the size of the image data, all the objects captured by the original image data are still visible from the image data. This can be advantageous because the time and computational efficiency of processing the image data for detecting at least one object therein can be increased without significantly increasing the likelihood of not detecting (i.e. missing) an object captured on the image data.

In some embodiments if images are captured sequentially (e.g. while recording a video), time and computational efficiency can be increased by utilizing object detections from previous images. For example, a first and a second image are captured one after the other within a short period of time - e.g. within 8 to 1000 milliseconds. Due to the relatively short time delay that can be present between the two images, an object captured in the first image can be expected to be present in the second image in a similar location. This is particularly true for stationary or slowly moving objects. Thus, the location of the object on the first image can be used as a priori information for detecting the object on the second image. This can decrease the number of computations required to detect the same object on the second image. At the same time, after the object is detected on the second image, the portion of the image covered by the object can be excluded from processing for detecting further objects on the second image. To put simply, objects can be tracked from image to image. This can make it easier to detect objects that were detected on one of the previous images and decrease the area of the image that may require a thorough processing for detecting further objects. As such, computational and time efficiency for detecting objects over several sequential images can be increased.

As discussed, the labeling unit 120 may be configured to detect at least one object captured on an image of the image data by processing the image data. Processing the image data to detect at least one object can comprise executing an object detection algorithm. The object detection algorithm can be based on a pattern recognition algorithm. For example, the object detection algorithm can be configured to detect a portion on an image of the image data that resembles to a known pattern. The object detection algorithm can be trained to recognize a pattern with a plurality of training patterns (e.g. annotated images), wherein the training patterns can correspond to different deviations of the pattern to be learned. The object detection algorithm can comprise a plurality of parameters which it can adjust based on the training patterns to detect a pattern (e.g. a face of a person) more efficiently.

The object detection algorithm can be based on a machine learning algorithm, deep learning algorithm, artificial neural network or any combination thereof. For example, the object detection algorithm may be based on the scale-invariant feature transform (SIFT), single shot multi-box detector (SSD), you only look once (YOLO) or similar algorithms.

It will be understood, that the labeling unit 120 may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. For example, the labeling unit 120 may take the form of a computer program product stored on a computer-readable storage medium comprising computer- readable instructions (e.g., software) embodied in the storage medium. In such embodiments, the labeling unit 120 embodied as a computer program product may be executed by a data processing unit which can be configured to receive image data similarly as discussed above for the labeling unit 120 and to process them by executing the labeling unit 120 embodied as a computer program product.

The system may further comprise a scrambling unit 130. The scrambling unit 130 can be configured to receive labeled image data obtained from the labeling unit 120. Additionally or alternatively, the labeling unit 120 may be configured to provide the labeled image data to the scrambling unit 130.

The labeled image data may refer to the entire image data comprising labeled portions. That is, the labeled image data may comprise the image data and the labeling data. In such embodiments, the entire image data comprising labeled portions can be provided to the scrambling unit 130. Alternatively, the labeled image data may refer only to the labeled portions of the image data. That is, in some embodiment, only the labeled portions of the image data may be provided to the scrambling unit 130. Irrespective of whether the entire image data comprising labeled portions or only the labeled portions of the image data are provided to the scrambling unit 130, the operation of the scrambling unit 130 can be the same, as it will be discussed in the following.

In some embodiments the labeling unit 120 and the scrambling unit 130 may be configured to access the same memory device (not shown), or the same portion of a memory device. More particularly, the labeling unit 120 may be configured to provide the labeled image data to the memory device wherein they can be stored. The scrambling unit 130 may access the memory device to receive the labeled image data obtained therein. The memory device may be configured as a buffer. The buffer shared by the labeling unit 120 and the scrambling unit 130 may be advantageous as the rate at which the labeling unit 120 may output the labeled image data can be different than the rate at which the scrambling unit 130 can receive and/or process the labeled image data.

In some embodiments, a data transmission channel may be provided to allow data transmission between the labeling unit 120 and the scrambling unit 130. The data transmission channel may be configured according to a wired and/or wireless communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, mobile communication protocol, or any combination thereof. It will be understood that the above are only exemplary communication protocols that can be used by the present invention to allow data communication between the labeling unit 120 and the scrambling unit 130.

Typically, the labeling unit 120 and the scrambling unit 130 can be provided in close proximity with each other. As such, a local or on chip data transmission channel (e.g. bus interconnection) can be provided between the labeling unit 120 and the scrambling unit 130.

However, it will be understood that this is not limiting. The labeling unit 120 and the scrambling unit 130 can also be provided distant from each other. In such embodiments, the labeling unit 120 can be configured to communicate remotely with the scrambling unit 130, e.g. through TCP/IP protocol. Alternatively, the labeling unit 120 and the scrambling unit 130 can be implemented on the same device. For example, a processing unit can be configured both as a labeling unit 120 and as a scrambling unit 130.

The scrambling unit 130 can be configured to scramble the labeled portion of the image data to remove intelligibility of the labeled portion of the image data. Furthermore, the scrambling unit 130 can be configured to scramble the labeled portion of the image data such that the labeled portion of the image data can be descrambled by using a descrambling key. That is, the scrambling unit 130 may scramble the labeled portion of the image data such that the intelligibility of the labeled portion of the image data can be restored if a descrambling key is provided for descrambling the labeled portion of the image data. Put simply, the scrambling unit 130 may transform the labeled portion of the image data into a scrambling state such that a descrambling key be used to transform the labeled portion of the image data from a scrambling state to a descrambling state.

Scrambling the labeled portion of the image data can be advantageous as it allows generating scrambled image data wherein the labeled portions of the image data are in a scrambled state. Thus, the content of the labeled portion of the image data can be hidden. More particularly, any party (operator and/or device) not comprising or being provided with the descrambling key cannot extract intelligible information from the labeled portion of the image data in the scrambled state. On the other hand, any party (operator and/or device) being provided or comprising the descrambling key can descramble the labeled portion of the image data and can extract information comprised by the labeled portion of the image data. As such, by determining where to provide or store the descrambling key, the provision of the information comprised by the labeled portion of the image data can be controlled.

This is particularly advantageous for preserving the privacy of objects captured on the image data and/or complying with data privacy policies. For example, the identity of persons and/or vehicles captured on image by the image sensor 110 may be hidden from unauthorized parties. Thus, unauthorized parties may be able to process the images without being able to determine or reveal the identity of objects captured therein. In other words, scrambling the labeled portion of the image data may allow a safe sharing of the image data. Furthermore, scrambling only the labeled portion of the image data (instead of the entire image data) allows for processing the image data without revealing the information comprised by the labeled portion of the image data. That is, the scrambled image data can still be used to extract other information captured therein except for the information captured by the labeled portion. Further still, scrambling the labeled portion of the image data such that it can be descrambled by a providing a descrambling key allows for the labeled portion of the image data to be descrambled. Moreover, a selective sharing of the information contained in the labeled portion of the image data can be performed. By securely storing the descrambling key a selective sharing of the information contained in the labeled portion of the image data and a full (e.g. public) sharing of the image data comprising labeled portion in the scrambled state can be simultaneously performed.

In some embodiments, the scrambling unit 130 can be configured to use a scrambling key for scrambling the labeled portion of the image data. More particularly, the scrambling unit 130 can be configured to scramble data (e.g. the labeled portion of the image data) based on a scrambling key, such that, different scrambling keys can cause different scrambling of the data. As such, for each scrambling key a respective scrambling of the labeled portion of the image data can be performed. Furthermore, the scrambling key and the descrambling key may correspond to each other, such that, data scrambled using a scrambling key may only be descrambled using the corresponding descrambling key.

The scrambling unit 130 can scramble the labeled portion of the image data based on a scrambling function. That is, by providing the labeled portion of the image data to the scrambling function as input and by executing the scrambling function, the labeled portion of the image data may be transformed into a scrambled state. The scrambling function may comprise a configurable scrambling parameter. The output of the scrambling function can depend on the input to the scrambling function and on the scrambling parameter. That is, for the same input, the scrambling function can yield different outputs for different scrambling parameters. The scrambling parameter can be configured based on the scrambling key. For example, the value of the scrambling parameter can be set equal to the scrambling key. Thus, different scrambling keys may cause the scrambling function to yield different outputs for the same input.

As discussed, the scrambling unit 130 can be configured to scramble the labeled portion of the image data such that the labeled portion of the image data can be descrambled by providing a descrambling key. Thus, the scrambling function can be an invertible (i.e. reversible) function. In other words, the scrambling function may comprise an inverse function which can reverse the operation of the scrambling function. The inverse function of the scrambling function can be referred to as a descrambling function. For an example, if the scrambling function applied to an input denoted by X gives a result denoted by Y, then applying the descrambling function to Y gives the result X and vice versa.

Similarly, the descrambling function can be a parameterized function comprising a configurable descrambling parameter. The output of the descrambling function can depend on the input to the descrambling function and on the descrambling parameter. That is, for the same input, the descrambling function can yield different outputs for different descrambling parameters. The descrambling parameter can be configured based on the descrambling key. As such, different descrambling keys may cause the descrambling function to yield different output for the same input. Thus, the descrambling function can reverse the operation of the scrambling function only if the descrambling parameter of the descrambling function is configured according to the descrambling key that correspond to the scrambling key used by the scrambling function.

In some embodiments, scrambling the labeled portion of the image data may comprise shuffling (i.e. rearranging, reordering) the labeled portion of the image data. As discussed, typically, the image data can be systematically arranged. That is, the image data can comprise a particular arrangement or order and can communicate the maximum amount of intelligible information only on that particular arraignment. Changing the arrangement can reduce the amount of information that can be extracted from the image. Based on this, by shuffling or rearranging or reordering the labeled portion of the image data can reduce the amount of information that can be extracted from the labeled portion of the image data and preferably can make the labeled portion of the image data unintelligible.

Thus, originally the labeled portion of the image data can be arranged according to an original order. The scrambling unit 130 may execute the scrambling function comprising a shuffling function. This can rearrange the labeled portion of the image data according to a shuffled order different from the original order. The shuffled order and the original order can be uncorrelated. Furthermore, the shuffled order can be pseudo-random.

The shuffled order can be based on a pseudo-random sequence. Thus, the shuffling function can comprise a pseudo-random number generator which can generate at least one pseudo random sequence of numbers. The pseudo-random sequence resembles or approximates the properties of a truly random number sequence. For example, the pseudo-random sequence may comprise an autocorrelation coefficient close to 0. However, the pseudo-random sequence can be determined by providing the initial state (i.e. the seed) of the pseudo-random generator when generating the pseudo-random sequence.

Thus, on one hand the shuffled ordered can appear random or approximately random. This can be advantageous to minimize the amount of information conveyed by the labeled portion of the image data arranged in the shuffled order. At the same time, this can be advantageous to increase the computational complexity required to determine the original order from the shuffled order. On the other hand, the shuffled order can be determined by providing the seed used by the pseudo-random generator to generate the pseudo-random sequence. This can be advantageous, as it can allow for the labeled portion of the image data to be determined given the seed of the pseudo-random generator.

Thus, the shuffling function may comprise a configurable seed parameter. The seed parameter of the shuffling function can be used to set the seed of the pseudo-random generator. Different seeds may cause the pseudo-random generator to generate different pseudo-random sequences. As such, for different seeds the shuffling function may shuffle the labeled portion of the image data differently. The scrambling key may comprise a seed, which can be used to set the seed of the pseudo-random generator.

An ordering function can be configured to restore the shuffled labeled image data to their original order. The ordering function, can similarly comprise a pseudo-random number generator. By providing to the ordering function the same seed that was provided to the shuffling function, the pseudo-random generator of the ordering function may generate the same pseudo-random sequence that the pseudo-random generator of the shuffling function generated when shuffling the labeled portion of the image data. Based on this, the original order of the labeled portion of the image data can be determined.

Alternatively or additionally, the scrambling unit 130 can be configured to encrypt the labeled portion of the image data. Through encryption, the labeled portion of the image data can be encoded in such a way that the intelligibility of the labeled portion of the image data is removed. Thus, even if the encrypted labeled portion of the image data is accessed by an unauthorized party, the original information cannot be recovered unless the labeled portion of the image data is decrypted.

Data can be typically encrypted using an encryption algorithm, also referred to as a cipher. The cipher can use an encryption key for encrypting the data. The encryption key can typically be pseudo-random. The cipher and the encryption key can be implemented such that, in principle, it is not possible (i.e. it is not computationally feasible) to decrypt the message without possessing the decryption key. However, an authorized party that comprises the decryption key can easily in a computationally feasible manner decrypt the data to recover the original information.

The scrambling unit 130 can be configured to execute an encryption algorithm, and thus encrypt the labeled portion of the image data. The encryption algorithm can be a computer program comprising instructions which, when the program is executed by a computer can cause the computer to encrypt data. Thus, when the encryption algorithm is executed by the scrambling unit 130, one or more labeled portions of the image data can be encrypted.

The encryption algorithm can be based on one of more encryption schemes. In some embodiments, the encryption algorithm can be based on a symmetric encryption scheme, such as, and not limited to, Blowfish, Advanced Encryption Standard (AES), Rivest Cipher 4/5/6 (RC4/5/6), or Data Encryption Standard (DES). It should be understood that these are merely exemplary and that also other schemes may be used. In such embodiments, one cryptographic key is used both for encryption and decryption. That is, the encryption key and the decryption key are identical cryptographic keys.

In such embodiments, the scrambling key and the corresponding descrambling key can comprise the same cryptographic key which can be used for encrypting and decrypting the labeled portion of the image data through a symmetric encryption-decryption scheme.

Alternatively, the encryption routine can be based on an asymmetric encryption scheme, such as, and not limited to, RSA, ECC P256kl, ECC P256rl, X25519. In such embodiments, different cryptographic keys are used for encryption and decryption. In an asymmetric encryption scheme, key pairs are used. The cryptographic keys in the key pair are typically referred to as a private key and a public key. The private key need to be securely stored and the public key can be made public. The public key can typically be easily calculated from the private key; however, it is computationally unfeasible to derive the private key from the public key. Furthermore, each key can be used for encryption and decryption. In the context of securing data, typically data is encrypted with the public key. Thus, only the owner of the private key may access the data, as only the corresponding private key can be used to decrypt the data. In such embodiments, the scrambling key may comprise the public key which can be used for encrypting data and the corresponding descrambling key can comprise the private key corresponding to the public key. That is, if a scrambling key corresponds to a descrambling key then the public key comprised by the scrambling key corresponds to the private key comprised by the descrambling key.

In the above, the public key and the private key were used to directly encrypt or decrypt the labeled portion of the image data during scrambling. Alternatively, the public key and the private key can be used as an infrastructure for sharing a secret cryptographic key. That is, the secret cryptographic key can be used to encrypt the labeled portion of the image data. The secret cryptographic key can then be encrypted with a public key. Then, the private key corresponding to the public key can be used to decrypt the secret cryptographic key. Note that only the parties comprising the private key can decrypt and obtain the secret cryptographic key. After decrypting the secret cryptographic key, the labeled portion of the image data can then be decrypted using the secret cryptographic key.

On the other hand, the descrambling function may comprise a decryption algorithm corresponding to the encryption algorithm of the scrambling function. The decryption algorithm can be a computer program comprising instructions which, when the program is executed by a computer can cause the computer to decrypt encrypted data. Thus, when the decryption algorithm is executed, the labeled portion of the image data in an encrypted state can be decrypted.

It will be understood, that the scrambling unit 130 may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. For example, the scrambling unit 130 may take the form of a computer program product stored on a computer-readable storage medium comprising computer- readable instructions (e.g., software) embodied in the storage medium. In such embodiments, the scrambling unit 130 embodied as a computer program product may be executed by a data processing unit which can be configured to receive labeled image data similarly as discussed above for the scrambling unit 130 and to process them by executing the scrambling unit 130 embodied as a computer program product.

The system may further comprise an activity recognition unit 140. The activity recognition unit 140 can be configured to receive scrambled image data generated by the scrambling unit 130. Additionally or alternatively, the scrambling unit 130 may be configured to provide the scrambled image data to the activity recognition unit 140. The scrambled image data refer to image data wherein the labeled portion of the image data is scrambled. In some embodiments the scrambling unit 130 and the activity recognition unit 140 may be configured to access the same memory device (not shown), or the same portion of a memory device. More particularly, the scrambling unit 130 may be configured to provide the scrambled image data to the memory device wherein they can be stored. The activity recognition unit 140 may access the memory device to receive the scrambled image data obtained therein. The memory device may be configured as a buffer. The buffer shared by the scrambling unit 130 and the activity recognition unit 140 may be advantageous as the rate at which the scrambling unit 130 may output the scrambled image data can be different than the rate at which the activity recognition unit 140 can receive and/or process the scrambled image data.

In some embodiments, a data transmission channel may be provided to allow data transmission between the scrambling unit 130 and the activity recognition unit 140. The data transmission channel may be configured according to a wired and/or wireless communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, mobile communication protocol, or any combination thereof. It will be understood that the above are only exemplary communication protocols that can be used by the present invention to allow data communication between the scrambling unit 130 and the activity recognition unit 140.

Typically, the scrambling unit 130 and the activity recognition unit 140 can be provided remote (i.e. distant) from each other. As such, a remote data transmission channel can be provided between the scrambling unit 130 and the activity recognition unit 140. For example, the scrambling unit 130 and the activity recognition unit 140 can be configured to be connected with at least one network (e.g. Internet, cellular network). However, it will be understood that this is not limiting. The scrambling unit 130 and the activity recognition unit 140 can also be provided in close proximity to each other. Alternatively, the scrambling unit 130 and the activity recognition unit 140 can be implemented on the same device. For example, a processing unit can be configured both as a labeling unit 120 and as a scrambling unit 130.

The activity recognition unit 140 can process the scrambled image data to detect at least one event therein. As discussed, the scrambled image data comprise image data wherein the labeled portions are in a scrambled state. As such, the scrambled image data do not convey information comprised by the labeled portions. However, only a part of the image data can be scrambled - i.e. only the labeled portion of the image data which can represent an object. Thus, the activity recognition unit 140 can be able to extract information from the image data other than the information comprised by the labeled portion of the image data. This can allow the activity recognition unit 140 to process the scrambled image data to detect at least one event therein. As long as the activity recognition unit 140 is not provided with the descrambling key, the privacy of the objects captured on the image data is preserved. That is, the activity recognition unit 140 may process the scrambled image data without knowledge of what is in the labeled portions of the image data which are scrambled.

In other words, the portion of the scrambled image data that is not scrambled can be sufficient to detect the action - i.e. the contents of the scrambled portions do not significantly influence the ability to detect actions. For example, to hide the identity of a person, only the portion of the image(s) wherein the face of the person is visible can be scrambled. Thus, the body of the person is visible on the captured image(s) which can allow for the detection of activities or actions performed by the person. Similarly, to hide the identity of a vehicle only the portion of the image(s) wherein the number plate of the vehicle is visible can be scrambled. Thus, the vehicle (without the number plate) is visible on the captured image(s) which can allow for the detection of activities or actions performed by the vehicle.

That is, the labeling unit 120 and/or the scrambling unit 130 can be configured such that scrambling the labeled portions hides privacy sensitive portions of the image data while still allowing for actions to be detected using the scrambled image data.

The activity recognition unit 140 may be configured to detect events, such as, a person walking, a person pointing, a vehicle driving, interactions between objects, a violation of a law, a violation of a rule, a violation of a policy, a violation of a traffic law, a criminal activity and the like.

The activity recognition unit 140 may be configured to execute an activity recognition algorithm. The activity recognition algorithm can be based on a gesture recognition algorithm, motion detection algorithm, body position detection algorithm, gait analysis algorithm, motion analysis algorithm, vehicle motion analysis algorithm, traffic violation detection algorithm, moving violation detection algorithm or any combination thereof. Moreover, the activity recognition algorithm can be based on a machine learning algorithm, deep learning algorithm, artificial neural network.

Upon detection of an activity (also referred to as event), the activity recognition unit 140 may generate activity-related image data. The activity-related image data may comprise only a portion of the image data that relates or indicates the detected event. The activity-related image data may comprise a portion of an image, an image or multiple images. For example, activity-related image data may comprise an excerpt of a video (i.e. a subset of sequentially captured images) that indicate the event in action. The activity-related image data comprise labeled portions in a scrambled state. That is, the activity-related image data do not reveal the information contained in the labeled portion of the image data. The system may further comprise a descrambling unit 150. The descrambling unit 150 can be configured to receive activity-related image data generated by the activity recognition unit 140. Additionally or alternatively, the activity recognition unit 140 may be configured to provide the activity-related image data to the descrambling unit 150.

In some embodiments the activity recognition unit 140 and the descrambling unit 150 may be configured to access the same memory device (not shown), or the same portion of a memory device. More particularly, the activity recognition unit 140 may be configured to provide the activity-related image data to the memory device wherein they can be stored. The descrambling unit 150 may access the memory device to receive the activity-related image data obtained therein. The memory device may be configured as a buffer. The buffer shared by the activity recognition unit 140 and the descrambling unit 150 may be advantageous as the rate at which the activity recognition unit 140 may output the activity-related image data can be different than the rate at which the descrambling unit 150 can receive and/or process the activity-related image data.

In some embodiments, a data transmission channel may be provided to allow data transmission between the activity recognition unit 140 and the descrambling unit 150. The data transmission channel may be configured according to a wired and/or wireless communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, mobile communication protocol, or any combination thereof. It will be understood that the above are only exemplary communication protocols that can be used by the present invention to allow data communication between the activity recognition unit 140 and the descrambling unit 150.

Typically, the activity recognition unit 140 and the descrambling unit 150 can be provided remote from each other. As such, a remote data transmission channel can be provided between the activity recognition unit 140 and the descrambling unit 150. For example, the activity recognition unit 140 and the descrambling unit 150 can be configured to be connected with at least one network (e.g. Internet, cellular network). However, it will be understood that this is not limiting. The activity recognition unit 140 and the descrambling unit 150 can also be provided in close proximity to each other. Alternatively, activity recognition unit 140 and the descrambling unit 150 can be implemented on the same device. For example, a processing unit can be configured both as a labeling unit 120 and as a scrambling unit 130.

The descrambling unit 150 can be configured to descramble the labeled portions comprised in a scrambled state in the activity-related image data. That is, the descrambling unit 150 can be provided with the descrambling key and can be configured to execute the descrambling function, as discussed above. Thus, the descrambling unit 150 can be configured to restore and/or extract the information comprised by the labeled portion of the image data.

The system may further comprise an identification unit 160. The identification unit 160 can be configured to receive the activity- related image data wherein the labeled portions are descrambled by the descrambling unit 150. Additionally or alternatively, the descrambling unit 150 may be configured to provide to the identification unit 160 the activity-related image data wherein the labeled portions are descrambled. The activity-related image data wherein the labeled portions are descrambled can be referred to for the sake of brevity as descrambled activity-related image data.

In some embodiments the descrambling unit 150 and the identification unit 160 may be configured to access the same memory device (not shown), or the same portion of a memory device. More particularly, the descrambling unit 150 may be configured to provide the descrambled activity-related image data to the memory device wherein they can be stored. The identification unit 160 may access the memory device to receive the image data obtained therein. The memory device may be configured as a buffer. The buffer shared by the descrambling unit 150 and the identification unit 160 may be advantageous as the rate at which the descrambling unit 150 may output the image data can be different than the rate at which the identification unit 160 can receive and/or process the image data.

In some embodiments, a data transmission channel may be provided to allow data transmission between the descrambling unit 150 and the identification unit 160. The data transmission channel may be configured according to a wired and/or wireless communication protocol, such as, USB, UART, I2C, SPI, CAN, Bluetooth, Zigbee, WiFi, TCP/IP, mobile communication protocol, or any combination thereof. It will be understood that the above are only exemplary communication protocols that can be used by the present invention to allow data communication between the descrambling unit 150 and the identification unit 160.

The descrambling unit 150 and the identification unit 160 can preferably be provided in close proximity with each other. For example, the descrambling unit 150 and the identification unit 160 may be embedded in the same device. As such, a local or onboard data transmission channel (e.g. bus interconnection) can be provided between the descrambling unit 150 and the identification unit 160. However, the descrambling unit 150 and the identification unit 160 can also be provided remote from each other. As such, a remote data transmission channel can be provided between the descrambling unit 150 and the identification unit 160. For example, the descrambling unit 150 and the identification unit 160 can be configured to be connected with at least one network (e.g. Internet, cellular network). The communication channel between the descrambling unit 150 and the identification unit 160 can preferably be a secure communication channel. This may ensure the secrecy of the labeled portion of the image data which is in a descrambled state in the descrambled activity- related image data.

The identification unit 160 can be connected with an identity database 170. Furthermore, the identification unit 160 can be configured to identify the objects represented by the labeled portions of the descrambled activity-related image data. More particularly, the identification unit 160 may compare the labeled portion of the image data with data comprised in the identity database 170.

For example, the labeled portion of the image data may represent the face of a person. The identity database 170 may comprise a plurality of photos of persons associated with the identity of those persons (e.g. name, surname, birthday, social security number). The labeled portion of the image data may represent a number plate of a vehicle. The identity database 170 may comprise a list of number plates of registered vehicles associated with the identity of the owner of the vehicle.

In some embodiments, the identification unit 160 may detect or be provided with the type of object that is represented on the labeled portion of the descrambled activity-related image data and may determine with what database to link to for (potentially) identifying the object. That is, the identification unit 160 may be connected for data communication with a plurality of identity databases 170 and based on the type of object represented on the labeled portion of the descrambled activity- related image the identification unit 160 may connect with at least one of them. For example, if the object relates to a face of a person the identification unit 160 may connect to an identity database 170 comprising photos of persons associated with the identity of those persons, such as, a database of an authority dealing with the registration of citizens. If the object relates to a number plate of a vehicle, the identification unit 160 may connect with a database comprising a list of number plates of registered vehicles associated with the identity of the owner of the vehicle, such as, a database of an authority dealing with the registration of vehicles.

Fig. 2 depicts a data flow diagram indicating the transformation of the image data. The source of the information can be a scene 200. A scene 200 can be an environment within the field of view of the image sensor 110. The scene 200 may include roads, persons, traffic participants, vehicles, bicycles, pedestrians, buildings, yards, a retail environment, an entrance of a building, a hall, or any combination thereof.

Information related to the scene can be comprised by the image data 210. The image data 210 may be generated with a minimum loss of information comprised by the scene 200. The image data may comprise an image, a portion of an image (i.e. a cropped image), a plurality of images, a plurality of cropped images or a video. In addition, the image data may comprise metadata associated to the images and/or videos. As discussed, the image data 210 can be obtained by the image sensor 110.

The image data 210 can be transformed into labeled image data 220. The labeled image data 220 may comprise the image data 210 wherein at least a portion of the image data is labeled. That is, the labeled image data 220 may comprise image data and labeling data. As discussed, the labeled image data 220 may be generated by the labeling unit 120.

The labeled image data 220 can be transformed into scrambled image data 230. The scrambled image data 230 may comprise the labeled image data 220 wherein the labeled portions are scrambled. That is, the scrambled image data 230 may comprise the image data and labeling data and wherein the labeled portions of the image data are scrambled. In other words, the scrambled image data 230 may comprise all the captured information from the scene 200 wherein some portions of the scene 200 (referred to as objects) are scrambled. Thus, scrambled image data 230 can be shared without revealing any content regarding the objects. As discussed, the scrambled image data 230 may be generated by the scrambling unit 130.

The scrambled image data 230 can be transformed into activity-related image data 240. The activity-related image data 240 may comprise a portion of the scrambled image data 230. More particularly, the activity-related image data 240 may comprise only the portion of the scrambled image data 230 that indicate an event. In other words, the activity-related image data 240 may be a subset of the image data 210, wherein data representing the objects captured therein are scrambled and wherein the said subset of the image data 210 indicate an event. In yet other words, the activity- related image data 240 comprise a subset of the labeled image data 220 wherein the labeled portions are scrambled and wherein the said subset of the labeled image data 220 indicate an event. As discussed, the activity-related image data 240 may be generated by the activity-recognition unit 140.

The activity- related image data 240 can be transformed into descrambled activity-related image data 250. The descrambled activity-related image data 250 may comprise the activity- related image data wherein the scrambled labeled portions are descrambled. As discussed, the descrambled activity-related image data 250 may be generated by the descrambling unit 150.

The descrambled activity-related image data 250 may be processed to generate the identity 260 of an object. As discussed, the identification unit 160 may process the descrambled activity-related image data 250 to identify at least one object captured therein and to generate the identity 260 of an object comprised therein.

Figs. 3a to 3c illustrate a more detailed view of different arrangements of the system illustrated in Fig. 1. The system illustrated in Figs. 3a to 3c can also be referred to as a communication network or as a network of nodes.

The system (i.e. the communication network) can comprise one or more end devices 310, a server 300 and an authority terminal 350. Each of the end devices 310 and the authority terminal 350 can be connected for data transmission to the server 300. For example, the server 300 can be a cloud-based server 300 which can be accessed via the Internet.

In the embodiment of Fig. 3a, each of the end devices 310 comprises a respective image sensor 110, a respective labeling unit 120 and a respective scrambling unit 130. As such, each of the end devices 310 is configured to obtain image data using the image sensor 110, label the image data using the labeling unit 120, and scramble the labeled portions of the image data using the scrambling unit 130. The labeling unit 120 and the scrambling unit 130 can be separate units within the end device 310, as illustrated in Fig. 3a. For example, the end device 310 may comprise respective hardware and software for the labeling unit 120 and the scrambling unit 130. Alternatively, the end device 310 may comprise the same hardware component for the labeling unit 120 and the scrambling unit 130, while comprising separate software components for the labeling unit 120 and the scrambling unit 130. For example, the end device 310 can comprise a processor which can execute computer instructions for labeling the image data and computer instructions for scrambling the labeled portion of the image data.

The end device 310 may further comprise a memory component (not shown). The memory component of the end device 310 may comprise a volatile or non-volatile memory, such as a random access memory (RAM), Dynamic RAM (DRAM), Synchronous Dynamic RAM (SDRAM), static RAM (SRAM), Flash Memory, Magneto-resistive RAM (MRAM), Ferroelectric RAM (F- RAM), or Parameter RAM (P-RAM). The memory component may store image data 210, labeled image data 220, scrambled image data 230, a scrambling key (e.g. a public key corresponding to the end device 310 and/or to a user of the user terminal), a descrambling key (e.g. a private key corresponding to the end device 310 and/or to a user of the user terminal), computer instructions for labeling a portion of the image data, computer instructions for scrambling the labeled portion of the image, computer instructions related to a data communication protocol and/or other computer instructions for facilitating the operation of the end device 310. Further, each of the end devices 310 can be configured to communicate with the server 300. That is, the end device 310 can comprise a communication component (not shown), such as, a network interface card. As such, each of the end devices 310 can provide scrambled image data 230 to the server 300, e.g., via the Internet. In some embodiments, the end device 310 can continuously transmit the scrambled image data 230 to the server 300 in real time. As such, a continuous connection can be established and maintained between the end devices 310 and the server 300. Alternatively, the end device 310 can transmit to the server 300 scrambled data 230 comprising fully recorded video clips wherein portions of the images contained therein are labeled and scrambled as discussed. In such embodiments, the connection between the end device 310 and the server 300 can be established on-demand, e.g., the end device 310 may request a connection with the server 300 for providing scrambled image data 230 to the server.

The server 300 can comprise a database 302. The database 302 can be configured to store the scrambled image data 230. The scrambled image data 230 can be stored in the database associated with metadata indicating the source of the scrambled image data, i.e. which end device 310 provided the scrambled image data 230. That is, the server 300 can receive the scrambled image data and can store them on the database 302. In some embodiments, the database 302 can be a public database 302, i.e., allowing access to any device connected to the server 300.

In addition and connected to the server 300 the activity recognition unit 140 can be provided. The activity recognition unit 140 can access the database 302 or a portion of the database 302 to receive a portion or the entire scrambled image data 230 stored in the database 302. Alternatively, the server 300 may provide scrambled image data 230 to the activity recognition unit 140. In some embodiments, the server 300 can receive scrambled image data 230 from one of the end devices 310 and can provide them to the activity recognition unit 140. That is, the scrambled image data 230 can be provided directly through the server 300 from one or more end device(s) 310 to the activity recognition unit 140. Alternatively, the server 300 can provide previously stored scrambled image data 230 from the database 302 to the activity recognition unit 140. That is, the scrambled image data 230 can firstly be stored on the database 302 and from therein can be provided to the activity recognition unit 140. It will be understood, that the activity recognition unit 140 can be provided in the singular (as illustrated in Fig. 3a) or in the plural.

As discussed, the activity recognition unit 140 can process scrambled image data 230 to detect at least one event. Based thereon, the activity recognition unit 140 can generate the activity- related image data 240. The authority terminal 350 can typically be operated by a trusted authority, such as, a law enforcement authority and/or judicial authority. The authority terminal 350 can be provided with activity-related image data 240. The authority terminal 350 can be configured to facilitate determining whether the labeled portions within the activity-related image data 240 should be descrambled. For example, the authority terminal 350 can comprise a screen or monitor configured to display the images and/or videos contained in the activity-related image data 240 to the trusted authority. Typically, the authority terminal 350 can be a computer, workstation, laptop, smartphone, tablet or a similar device.

The authority terminal 350 may be configured to facilitate providing instructions on whether to descramble the labeled portions within the activity-related image data 240. For example, the authority terminal 350 can comprise an input user interface, such as, a keyboard, trackpad, mouse, touchscreen, joystick or a similar device, to facilitate a trusted authority to provide instructions on whether to descramble the labeled portions within the activity- related image data 240. That is, the authority terminal 350 may display the received activity-related image data to the trusted authority operating the authority terminal 350. The trusted authority may observe the event and may determine whether the event can be used as proof for descrambling the labeled portions within the activity-related image data 240 (for example to identify objects therein). The authority terminal 350 may be configured to receive instructions form the trusted authority on whether to descramble the labeled portions within the activity- related image data 240.

As illustrated in Fig. 3a, the authority terminal 350 can further comprise the descrambling unit 150. As such, the authority terminal 350 can descramble the labeled portions within the activity-related image data 240 using the descrambling unit 150 which it can comprise.

Alternatively, the descrambling unit 150 can be provided external to the authority terminal 350. For example, the descrambling unit 150 can be comprised by the server 300 or the descrambling unit 150 can be provided as a separately and connected to the server 300. In such embodiments, the authority terminal 350 may generate and transmit a request for descrambling the labeled portions within the activity- related image data 240. The request can be provided to the descrambling unit 150, the server 300, to a corresponding end device 310 and/or to a user of the corresponding end device 310. Herein, a corresponding end device 310 refers to the end device 310 which obtained the image data 310 of which the activity-related image data 240 are a part of.

In addition, the system can comprise one or more server accessing device(s) 180. The server accessing device 180 may access the scrambled image data 302. The server accessing device 180 may be configured to process and/or display the scrambled image data 302. That is, the system facilitates providing image data captured by the image sensor 110 to a third party, such as, the server accessing device 180 without revealing the content comprised in privacy sensitive areas (i.e. labeled portions) of the image data 210.

Alternatively and as illustrated in Fig. 3b, the scrambling unit 130 can be provided in the singular or in the plural on the server 300. In such embodiments, the end devices 310 can provide labeled image data 220 to the server 300. The server 300 can scramble the labeled portions by utilizing the scrambling unit 130. In such embodiments, it can be advantageous to establish a secure communication channel between the end device 310 and the server 300.

Alternatively, the scrambling unit 130 and the labeling unit 120 can be provided on the server 300. In such embodiments, the end devices 310 can provide image data 210 to the server 300. The server 300 can label the image data by utilizing the labeling unit 120 and can scramble the labeled portions by utilizing the scrambling unit 130. In such embodiments, it can be advantageous to establish a secure communication channel between the end device 310 and the server 300. For the sake of brevity this embodiment is not illustrated.

Alternatively and as illustrated in Fig. 3c, the system may comprise a second server 320 and the labeling unit 120 may be provided in the singular or in the plural on the second server 320. Each end device 310 can be configured to communicate with the second server 320. That is, each end device 310 may provide image data 210 to the second server 320. The second server 320 can generate labeled image data 220 by utilizing the labeling unit 120 and can transmit the labeled image data 220 to the server 300. The server 300 can scramble the labeled portions by utilizing the scrambling unit 130. In such embodiments, it can be advantageous to establish a secure communication channel between the end device 310 and the second server 320 as well as between the second server 320 and the server 300.

As discussed above, the labeled portions of the image data in the scrambled state can be descrambled only if the descrambling key is provided. As such, descrambling privileges can be assigned to any component and/or user of the system depending on where or to whom the descrambling key is provided. Below and with reference to Figs. 3a to 3c, different ways of assigning the descrambling privileges are discussed.

In some embodiments, the descrambling key can correspond to the authority terminal 350. In such embodiments, the descrambling key can be stored, preferably securely, in a memory component of the authority terminal 350 or in a memory component that the authority terminal can access. For example, the descrambling key can comprise a private key that corresponds to the authority terminal 350 and the scrambling key can comprise a public key that corresponds to the authority terminal 350. The public key of the authority terminal 350 can be used to either directly scramble the labeled portions or to encrypt a random secret key which can be used to scramble the labeled portions. Similarly, the private key of the authority terminal 350 can be used to either directly scramble the labeled portions or to decrypt a random secret key which can be used to descramble the labeled portions. As such, only the authority terminal 350 can descramble the labeled portions because only the authority terminal 350 can provide the descrambling key to the descrambling unit 150. Below an illustrative and non-limiting example illustrating this embodiment is provided. For example, the scrambling unit 130 can generate a random secret key and can scramble the labeled portions using the random secret key. Then, the scrambling unit 130 can scramble (e.g. encrypt) the random secret key with a public key corresponding to the authority terminal 350 and can add the encrypted random secret key to the metadata of the scrambled image data 230. The authority terminal 350 can obtain the encrypted random secret form the metadata of the scrambled image data 230 and can decrypt it using its private key. Then, the authority terminal 350 can provide the random secret key to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240.

In some embodiments, the descrambling key can correspond to the server 300. In such embodiments, the descrambling key can be stored, preferably securely, in a memory component of the server 300 or in a memory component that the server 300 can access. For example, the descrambling key can comprise a private key that corresponds to the server 300 and the scrambling key can comprise a public key that corresponds to the server 300. The public key of the server 300 can be used to either directly scramble the labeled portions or to encrypt a random secret key which can be used to scramble the labeled portions. Similarly, the private key of the server 300 can be used to either directly scramble the labeled portions or to decrypt a random secret key which can be used to descramble the labeled portions. As such, only the server 300 can descramble the labeled portions because only the server 300 can provide the descrambling key to the descrambling unit 150. Below an illustrative and non limiting example illustrating the above embodiment is provided. For example, the scrambling unit 130 can generate a random secret key and can scramble the labeled portions using the random secret key. Then, the scrambling unit 130 can scramble (e.g. encrypt) the random secret key with a public key corresponding to the server 300 and can add the encrypted random secret key to the metadata of the scrambled image data 230. The server 300 can obtain the encrypted random secret form the metadata of the scrambled image data 230 and can decrypt it using its private key. Then, the server 300 can provide the random secret key to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240. For example, the authority terminal 350 can send a request to the server 300 and/or to the operators of the server 300 for descrambling particular activity-related image data. Upon reception of the request form the authority terminal, the server 300 can provide the random secret key to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240.

In some embodiments, the descrambling key can correspond to an end user. An end user can be a user who can own one of the end devices 310. For example, the end user can be a user that can subscribe to the services provided by the server 300. In such embodiments, the descrambling key can be stored in a memory component of the end device 310 and/or in a user terminal (not shown) of the user, such as, a smartphone, a mobile phone, a tablet, a transponder, a computer, a laptop or similar user terminals and/or in a cloud-based storage that the user can access. It will be understood that the above are only exemplary. In general, the descrambling key can be stored in any manner such that only the end user can access its corresponding descrambling key. For example, the descrambling key can comprise a private key that corresponds to the end user and the scrambling key can comprise a public key that corresponds to the end user. The public key corresponding to the end user can be used to either directly scramble the labeled portions or to encrypt a random secret key which can be used to scramble the labeled portions. Similarly, the private key corresponding to the end user can be used to either directly scramble the labeled portions or to decrypt a random secret key which can be used to descramble the labeled portions. As such, only the end user can descramble the labeled portions because only the end user can provide the descrambling key to the descrambling unit 150.

Below an illustrative and non-limiting example illustrating the above embodiment is provided. For example, the scrambling unit 130 can generate a random secret key and can scramble the labeled portions using the random secret key. Then, the scrambling unit 130 can scramble (e.g. encrypt) the random secret key with a public key corresponding to the end user and can add the encrypted random secret key to the metadata of the scrambled image data 230. The end user, using a user terminal, can obtain the encrypted random secret form the metadata of the scrambled image data 230 and can decrypt it using the private key. Then, the end user, using the user terminal, can provide the random secret key to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240. For example, the authority terminal 350 can send a request to the end user for descrambling particular activity-related image data. Upon reception of the request form the authority terminal, the end user can provide the random secret key to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240.

In some embodiments, the descrambling key can correspond partly to the end user and partly to the server 300. That is, a first part of the descrambling key can be stored in a memory component of the end device 310 and/or in a user terminal (not shown) of the user, such as, a smartphone, a mobile phone, a tablet, a transponder, a computer, a laptop or similar user terminals and/or in a cloud-based storage that the user can access. A second part of the descrambling key can be stored, preferably securely, in a memory component of the server 300 or in a memory component that the server 300 can access. For example, the descrambling key can comprise a first private key that corresponds to the end user and a second private key that corresponds to the server 300. On the other hand, the scrambling key can comprise a first public key that can correspond to the end user and a second public key that can correspond to the server 300. The public keys can be used to either directly scramble the labeled portions or to encrypt a random secret key which can be used to scramble the labeled portions. Similarly, the private keys can be used to either directly descramble the image data or to decrypt a random secret key which can be used to descramble the labeled portions.

Below an illustrative and non-limiting example illustrating the above embodiment is provided. For example, the scrambling unit 130 can generate a random secret key and can scramble the labeled portions using the random secret key. Then, the scrambling unit 130 can scramble (e.g. encrypt) the random secret key once with the public key corresponding to the end user and then again with the public key of the server 300 or vice-versa. Then, the scrambling unit 130 can add the encrypted random secret key to the metadata of the scrambled image data 230. The end user, using a user terminal, and the server 300 can obtain the encrypted random secret form the metadata of the scrambled image data 230 and can decrypt it using their respective private keys. Then, the random secret key can be provided to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240. For example, the authority terminal 350 can send a request to the end user and to the server for descrambling particular activity-related image data. Upon reception of the request form the authority terminal, the end user and the server 300 can decrypt the random secret key and provide it to the descrambling unit 150 to descramble the labeled portions of activity-related image data 240.

That is, as discussed above the system can be configured such that the descrambling privileges can be assigned to an end user, the server 300, the authority terminal 350 or any combination thereof. Alternatively or additionally, the descrambling privileges can be assigned to the end devices 310. More particularly, each end device 310 can be able to descramble (i.e. by comprising the descrambling key) only the scrambled portions of image data that the end device 310 obtains with its respective image sensor 110.

Figs. 4a depicts a simplified example of the image data 210 comprising an image 215. The image 215 comprises a plurality of pixels 212. In the example of Fig. 4a, the image 215 comprises 16x24 pixels. It will be understood, that typically the image 215 can comprise more columns and rows of pixels. As discussed, the image 215 may comprise a width of at least 100 pixels, preferably at least 640 pixels, more preferably at least 1024 pixels and a height of at least 100 pixels, preferably at least 480 pixels, more preferably at least 600 pixels. Thus, each image may comprise at least 64000 pixels, preferably at least 614400 pixels. Furthermore, the pixels 212 in the example of Fig. 4a are depicted as receiving only a binary value (illustrated as either black or white). It will be understood, that typically in a grayscale image the value of each pixel can be an 8-bit integer giving a range of possible values from 0 to 255. Typically, zero is taken to be black, and 255 is taken to be white. Values in between make up the different shades of gray. For a colored image each pixel may be represented by a vector of three 8-bit numbers, each representing a red, green and blue component of the color of the pixel. Other formats of representing the value of the pixel can be used as well.

The image 215 illustrated in Fig. 4a depicts in the foreground a face and a part of the body of a person.

Fig. 4b depicts a simplified example of labeled image data 220. The labeled image data 220 comprise the image data 210 depicted in Fig. 4a and, in addition, the labeling data 222. As illustrated, the labeling data 222 indicate a face of a person (i.e. object) that is captured on the image 215.

The labeling data 222 is illustrated in Fig. 4b as a boundary around the detected object (i.e. the face of the person). Alternatively or additionally, the labeling data 222 may comprise a list of coordinates of each pixel 212 that is labeled. Alternatively or additionally, the labeling data 222 may comprise a shape attribute indicating the shape of the labeled portion (e.g. square), a size of the shape of the labeled portion (e.g., height equal to 9 pixels and width equal to 10 pixels) and a reference pixels of the labeled portion (e.g. top-left pixel of the labeled portion is the pixels at the 2^nd row from the top and 9^th column from the left). It will be understood that the above is only exemplary and that the labeling data 222 may comprise other configuration indicating a labeled portion of the image data.

As illustrated in Fig. 4b, the labeled portion of the image data refers to all the pixels within the border 222. The labeled portion comprises the pixels representing the face of the person (i.e. the object). In addition, the labeled portion may comprise other pixels as well. This can be particularly advantageous to ensure that the labeled portion covers the entire detected object. In Fig. 4b, the labeled portion as indicated by the labeling data 22 comprise a rectangular shape. However, it will be understood that the labeled portion may comprise any shape, such as, a circle or an ellipse.

Fig. 4c depicts a simplified example of scrambled image data 230. As illustrated, the scrambled image data 230 comprise the image data 210 (i.e. the image 215) depicted in Fig. 4a wherein the labeled portion as indicated by the labeling data 222 is scrambled. In the depicted example of Fig. 4c, scrambling of the labeled portion of the image data is performed by shuffling (i.e. rearranging, reordering) the pixels within the labeled portion of the image data. That is, the scrambling of the labeled portion of the image data is performed by changing the position of the pixels in the labeled portion.

As illustrated, the new positions of the pixels appear random. Nevertheless, as previously discussed, the new positions of the pixels can be determined based on a pseudo-random sequence. Given the pseudo-random sequence the pixels in the labeled portion may be restored back to their original position.

As depicted, the scrambled image data 230 may comprise image data 210 wherein the labeled portions are scrambled. In addition, the scrambled image data 230 may comprise the labeling data 222 to indicate which portion(s) of the image is/are scrambled. This may be advantageous when/if descrambling the scrambled portions (i.e. labeled portions).

Fig. 4d depicts another simplified example of scrambled image data 230 wherein the scrambling of the labeled portion of the image data is encrypted. The encrypted portion is illustrated blank. However it will be understood, that encrypting the labeled portion can comprise encoding the values of the pixels in the labeled portions. Thus, the values of the pixels with be changed. As a result, the labeled portion may appear scrambled (i.e. similar to Fig. 4c).

It will be noted that in Fig. 4c, the values of the pixels are not changed. Instead only their position within the labeled portion is changed. Alternatively, in Fig. 4d the positions of the pixels are not changed but instead their value is changed (i.e. encoded).

That is, as illustrated in Fig. 4c, scrambling the labeled portion of the image data may comprise changing a position of the pixels within the labeled portion of the image data. As illustrated in Fig. 4cd scrambling the labeled portion of the image data may comprise changing a value of the pixels in the labeled portion of the image data. In some embodiments, scrambling the labeled portion of the image data may comprise changing the position and values of the pixels within the labeled portion of the image data. With respect to Figs. 5a to 5f the above discussed operations of the system on image data are illustrated with a simplified example.

Fig. 5a depicts an image 215 or a portion of an image 215 (i.e. cropped image 215) that can be comprised by image data 210. The image 215 depicts a background 2151, a road 2155, a person 2152, a face 2154 of the person 2152, a vehicle 2156 driving on the road 2155 and a number plate 2158 of the vehicle 2156.

In Fig. 5a, only one image 215 of the image data 210 is depicted. It will be understood that the image data 210 may comprise a plurality of images 215. For example, the image data 210 may comprise a sequence of images depicted the person 2152 walking in a sidewalk, approaching the road 2155, crossing the road 2155 and arriving at the other end of the road 2155 as well as the vehicle 2156 moving on the road 2155. The below illustrated operations on the exemplary image 215 can also be performed on all the other images of the image data 210.

Fig. 5b depicts the image 215 wherein at least one object is detected and the respective pixels are labeled. More particularly, the face 2154 and the number plate 2158 are labeled. The detected and labeled objects 2154, 2158 can be privacy sensitive portions of an image. In the depicted example, the face 2154 can identify the person 2152 and the number plate 2158 can identify the vehicle 2156. As such, the face 2154 and the number plate 2158 can be considered as privacy sensitive portions of the image 215. The face 2154 and the number plate 2156 can be labeled and the labeled image data 220 can be generated. As illustrated, the labeled image data 220 can comprise the labeling data 222 which can be added to the image data 210.

Fig. 5c depicts the image 215 wherein the labeled portions as indicated by the labeling data 222 are scrambled. More particularly, the portions of the image 215 representing the face 2154 and the number plate 2158 are scrambled. As such, the identity of the person 2152 and the vehicle 2156 may not be extracted from the scrambled image data 230.

As illustrated, the labeled portion of the image data 210 can comprise one or more sub portions. More particularly, the labeled portion of the image data 210 is illustrated as comprising a first sub-portion belonging to a first object (i.e. the face of the person) and a second sub-portion belonging to a second object (i.e. the number plate of the car). In some embodiments, the labeling data 222 can indicate for each pixel 212 whether the pixel is part of the first object, second object or neither. Furthermore, the first sub-portion and the second- sub-portion can be scrambled differently. More particularly, the first sub-portion can be scrambled such that it can be descrambled by providing a first descrambling key and the second sub-portion can be descrambled using a second descrambling key. Fig. 5d depicts the image 215 wherein an event 232 is detected. The event 232 indicates the person 2152 crossing the road illegally (i.e. jaywalking). That is, in the provided example the scrambled image data 230 can be processed for detecting at least one event 232 relating to a law violation.

Upon detection of the event 232, activity-related image data 240 can be generated. The activity-related image data 240 can comprise scrambled image data 230 and event data 232. The activity-related image data 240 may not necessarily comprise all the scrambled image data 230. The activity-related image data 240 may comprise only a portion of the scrambled image data 230 that indicate the event 232. For example, the image data 210 (and as such the scrambled data 230) may comprise a plurality of images 215 depicted the person 2152 walking on the sidewalk and then jaywalking. To generate the activity-related image data 240, a portion of the scrambled image data 230 may be selected. For example, only the images 215 depicting the person 2152 jaywalking can be comprised by the activity-related image data 240.

Fig. 5e illustrates descrambled activity-related image data 250. As illustrated, the portion of the image depicting the face 2154 is descrambled. It will be noted that not all the scrambled portions on the image 215 may be descrambled. In the example, the portion of the image depicting the number plate 2158 is not descrambled. That is, only the scrambled portions that relate to the event 232 may be descrambled. In this example, the person 2152 is jaywalking (i.e. performing the event 232). Thus, only the identification of the person 2152 may be required. Hence, only the portion of the image depicting the face 2154 may be descrambled.

As illustrated, the descrambled activity-related image data 250 may further comprise the event data 232.

Fig. 5f illustrates the identification of the person 2152 based on the face 2152 of the person.

Fig. 6 illustrates a method for processing image data, particularly privacy sensitive image data. The method can be executed by the system illustrated in Fig. 1. For the sake of brevity, the method is briefly discussed. It will be understood, that corresponding features discussed above with reference to the system and previous figures can also be comprised by the method.

In a step SI, the method can comprise capturing image data comprising at least a portion of an image. The image data may comprise one image, a plurality of images, one cropped image and/or a plurality of cropped images. In step SI, the method can comprise obtaining image data by capturing at least one image with an image sensor (e.g. the image sensor 110 illustrated in Fig. 1). In a step S2, the method can comprise labeling at least one portion of the image data. The labeled portion of the image data may represent or depict an object. An object may refer to a privacy sensitive portion of an image. For example, the object can be a body of a person, a body part of a person, a face of a person, a building, a part of a building, a house, an apartment, windows of buildings, traffic signs, bicycles, vehicles, windows of vehicles, a license plate of a vehicle, an operator of a vehicle, a logo, a text, an image, an advertisement, billboard, a screen, a private territory or any combination thereof. That is, the labeling unit 120 may be configured to detect on an image one or more objects which can be of one or more types or categories.

In a preferred embodiment, step S2 can comprise processing the image data to detect at least one object. That is, an object detection algorithm can be applied on the image data. The object detection algorithm can be based on a pattern recognition algorithm. For example, the object detection algorithm can be configured to detect a portion on an image of the image data that resembles to a known pattern. The object detection algorithm can be trained to recognize a pattern with a plurality of training patterns (e.g. annotated images), wherein the training patterns can correspond to different deviations of the pattern to be learned. The object detection algorithm can comprise a plurality of parameters which it can adjust based on the training patterns to detect a pattern (e.g. a face of a person) more efficiently. The object detection algorithm can be based on a machine learning algorithm, deep learning algorithm, artificial neural network or any combination thereof. For example, the object detection algorithm may be based on the scale-invariant feature transform (SIFT), single shot multi-box detector (SSD), you only look once (YOLO) or similar algorithms. Upon detecting of a portion of the image data depicting an object, the said portion can be labeled.

Additionally or alternatively, step S2 can comprise defining a portion on the image data to be labeled. In such embodiments, the labeled portion of the image data may comprise the same position on all the different image data captured by the same image sensor. For example, step S2 may comprise labeling the upper third of all the images comprised by the image data.

Step S2 can be performed by the labeling unit 120 discussed with reference to Fig. 1. Furthermore, step S2 can comprise providing image data 210 to the labeling unit 120 and generating labeled image data 220, as illustrated in Fig. 2.

In step S3, the method can comprise scrambling the labeled portion of the image data. That is, each portion of the image data that is labeled in step S2 can be scrambled when executing step S3. Step S3 may comprise executing a shuffling function and/or an encryption function. Step S3 may comprise changing the position and/or the value of the pixels comprised in the labeled portion. Step S3 can be performed by the scrambling unit 130 discussed with reference to Fig. 1. Furthermore, step S3 can comprise providing labeled image data 220 to the scrambling unit 130 and generating scrambled image data 230, as illustrated in Fig. 2.

In a step S4, the method can comprise processing image data, wherein the at least one labeled portion is descrambled, to detect at least one event on the image data. The at least one event, may relate to, a person walking, a person pointing, a vehicle driving, interactions between objects, a violation of a law, a violation of a rule, a violation of a policy, a violation of a traffic law, a criminal activity and the like. Step S4 may comprise executing an activity recognition algorithm. The activity recognition algorithm can be based on a gesture recognition algorithm, motion detection algorithm, motion analysis algorithm, vehicle motion analysis algorithm, traffic violation detection algorithm, moving violation detection algorithm or any combination thereof. Moreover, the activity recognition algorithm can be based on a machine learning algorithm, deep learning algorithm, artificial neural network.

Upon detection of an activity (also referred to as event), step S4 may comprise generating activity-related image data. The activity-related image data may comprise only a portion of the scrambled image data that relates or indicates the detected event. The activity- related image data may comprise a portion of an image, an image or multiple images. For example, activity-related image data may comprise an excerpt of a video (i.e. a subset of sequentially captured images) that indicate the event in action. The activity- related image data can comprise labeled portions in a scrambled state. That is, the activity-related image data do not reveal the information contained in the labeled portion of the image data.

Step S4 can be performed by the activity recognition unit 140 discussed with reference to Fig. 1. Furthermore, step S4 can comprise providing scrambled image data 230 to the activity recognition unit 140 and generating activity-related image data 240, as illustrated in Fig. 2.

Step S5 can comprise descrambling only the labeled portion(s) of the image data related to the event. Furthermore, step S5 can comprise providing a descrambling key for descrambling the labeled portion(s) of the image data (which are in a scrambled state) related to the event. Preferably, step S5 can be performed only if the descrambling key is provided. Step S5 can comprise executing a descrambling function, which may comprise an ordering function and/or a decryption function.

Step S5 can be performed by the descrambling unit 150 discussed with reference to Fig. 1. Furthermore, step S5 can comprise providing activity- related image data 240 to the descrambling unit 150 and generating descrambled activity-related image data 250, as illustrated in Fig. 2. Furthermore, the method may comprise identifying at least one object on the descrambled activity-related image data 250. This step may be performed by the identification unit 160 accessing the identity database 170, illustrated in Fig. 1. Alternatively, identifying at least one object on the descrambled activity-related image data 250 can be performed manually.

Whenever a relative term, such as "about", "substantially" or "approximately" is used in this specification, such a term should also be construed to also include the exact term. That is, e.g., "substantially straight" should be construed to also include "(exactly) straight".

It should also be understood that whenever reference is made to an element this does not exclude a plurality of said elements. For example, if something is said to comprise an element it may comprise a single element but also a plurality of elements.

Whenever steps were recited in the above or also in the appended claims, it should be noted that the order in which the steps are recited in this text may be accidental. That is, unless otherwise specified or unless clear to the skilled person, the order in which steps are recited may be accidental. That is, when the present document states, e.g., that a method comprises steps (A) and (B), this does not necessarily mean that step (A) precedes step (B), but it is also possible that step (A) is performed (at least partly) simultaneously with step (B) or that step (B) precedes step (A). Furthermore, when a step (X) is said to precede another step (Z), this does not imply that there is no step between steps (X) and (Z). That is, step (X) preceding step (Z) encompasses the situation that step (X) is performed directly before step (Z), but also the situation that (X) is performed before one or more steps (Yl), ..., followed by step (Z). Corresponding considerations apply when terms like "after" or "before" are used.

While in the above, a preferred embodiment has been described with reference to the accompanying drawings, the skilled person will understand that this embodiment was provided for illustrative purpose only and should by no means be construed to limit the scope of the present invention, which is defined by the claims.

Furthermore, reference numbers and letters appearing between parentheses in the claims, identifying features described in the embodiments and illustrated in the accompanying drawings, are provided as an aid to the reader as an exemplification of the matter claimed. The inclusion of such reference numbers and letters is not to be interpreted as placing any limitations on the scope of the claims.

Claims

2. The method according to the preceding claim, wherein the method comprises obtaining the image data (210) with an image sensor (110) capturing the at least one image (215) and wherein the image sensor (110) comprises at least one camera, such as, a mobile camera, a mobile phone camera, a body camera, a wearable camera, a traffic camera, a dash camera, a drive recorder, a car digital video recorder (DVR), an event data recorder (EDR), car camera, front car camera, rear car camera, side car camera, surveillance camera, a building surveillance camera, or any combination thereof.

3. The method according to any of the preceding claims, wherein providing image data (210) comprising at least one image (215) and a labeled portion comprises providing image data (210) comprising at least one image (215) and labeling a portion of the image data (210) and wherein labeling a portion of the image data (210) comprises processing the image data (210) for detecting at least one object captured on the at least one image (215) and upon detection of an object, labeling the portion of the image data (210) representing the object.

4. The method according to any of the preceding claims, wherein the image data (210) comprises a plurality of pixels (212) corresponding to the at least one image (215) and scrambling the labeled portion of the image data (210) comprises changing at least one of respective positions and respective values of a plurality of pixels within the labeled portion of the image data (210).

5. The method according to the preceding claim, wherein scrambling the labeled portion of the image data (210) comprises executing a scrambling function with the labeled portion of the image data (210) as input to the scrambling function and wherein the labeled portion of the image data (210) is arranged according to an original order and wherein the scrambling function comprises a shuffling function and executing the shuffling function causes the labeled portion of the image data (210) to be ordered according to a shuffled order different from the original order.

6. The method according to any of the preceding claims, the method comprising detecting at least one event (232) on the scrambled image data (230) and based thereon generating activity-related image data (240), wherein the activity-related image data (240) comprise a portion of the scrambled image data (230) indicating the event (232).

7. The method according to the preceding claim, wherein detecting at least one event (232) on the scrambled image data (230) comprises executing an activity recognition algorithm and wherein the activity recognition algorithm is based on a gesture recognition algorithm, motion detection algorithm, body position detection algorithm, gait analysis algorithm, motion analysis algorithm, vehicle motion analysis algorithm, traffic violation detection algorithm, moving violation detection algorithm or any combination thereof.

8. The method according to any of the 2 preceding claims, wherein the method comprises descrambling the labeled portion of the activity-related image data (240) using the descrambling key.

9. The method according to any of the preceding claims, wherein the method comprises a scrambling unit (130) performing the step of scrambling the labeled portion of the image data (210) to generate scrambled image data (230) and wherein the scrambling unit (130) comprises at least one processor.

10. The method according to any of the preceding claims, wherein the method comprises providing descrambling privileges to at least one node in a communication network wherein the communication network comprises a plurality of nodes, each configured to communicate with at least one other node in the communication network and wherein the at least one node provided with descrambling privileges is configured to descramble the labeled portion of the image data.

11. The method according to the preceding claim, wherein providing descrambling privileges to at least one node in a communication network comprises at least one of providing and storing the descrambling key to/on the at least one node.

12. The method according to any of the 2 preceding claims, wherein providing descrambling privileges to at least one node in a communication network comprises scrambling the labeled portion of the image data (210) such that the labeled portion can be descrambled by at least one node.

13. The method according to any of the 3 preceding claims, wherein at least one node in the communication network is an authority terminal (350) and wherein the method comprises providing descrambling privileges to a trusted authority by providing descrambling privileges to the authority terminal (350) operated by the trusted authority.

14. The method according to any of the 4 preceding claims, wherein at least one node in the communication network is a user terminal configured to allow at least one end user to access the communication network and wherein the method comprises providing descrambling privileges to the user by providing descrambling privileges to the user terminal of the user

15. A system comprising a scrambling unit (130) configured to receive image data (210) comprising at least one image (215) and a labeled portion and scramble the labeled portion of the image data (210) to generate scrambled image data (230); wherein the labeled portion of the image data (210) is configured to be descrambled by providing a descrambling key; and wherein the system is configured to carry out the method according to any of the preceding claims.