Preserving image privacy when manipulated by cloud services

Patent metadata

Field	Value
Publication number	US-9276745-B2
Application number	US-201113976298-A
Country	US
Kind code	B2
Filing date	Dec 15, 2011
Priority date	Dec 15, 2011
Publication date	Mar 1, 2016
Grant date	Mar 1, 2016

Abstract

An apparatus and method for preserving image privacy when manipulated by cloud services includes middleware for receiving an original image, splitting the original image into two sub-images, where the RGB pixel values of the sub-images have a bit value that is less than RGB pixel values of the original image. The sub-images are encrypted by adding a keystream to the RGB pixel values of the sub-images. The sub-image data is transmitted to a cloud service such as a social network or photo-sharing site, which manipulate the images by resizing, cropping, filtering, or the like. The sub-image data is received by the middleware and is successfully decrypted irrespective of the manipulations performed by the cloud services. In an alternative embodiment, the blocks of the original image are permutated when encrypted, and then reverse-permutated when decrypted.

First claim

What is claimed is:

1. A method operating on a processor for preserving image privacy by encrypting an original image for later storage on a publically accessible storage facility, comprising:
receiving the original image;
splitting the original image into first and second sub-images, each of the first and second sub-images having a same number of pixels as the original image;
for each of a plurality of pixel values of the first sub-image, adding a first corresponding keystream value selected from a plurality of keystream values;
producing a first encrypted sub-image;
for each of a plurality of pixel values of the second sub-image, adding a second corresponding keystream value selected from the plurality of keystream values, the second corresponding keystream value different than the first corresponding keystream value;
producing a second encrypted sub-image; and
storing the first encrypted sub-image and the second encrypted sub-image as data for transmission to the publically accessible storage facility.

2. The method of claim 1 , wherein the pixel values are Red/Green/Blue (RGB) pixel values, and wherein splitting further comprises:
determining an RGB pixel value for each of a plurality of pixels of the original image;
dividing each RGB pixel value of the original image into a first split RGB pixel value and a second split RGB pixel value;
associating each of the first split RGB pixel values with a corresponding RGB pixel value of the first sub-image; and
associating each of the second split RGB pixel values with a corresponding RGB pixel value of the second sub-image.

3. The method of claim 1 , in which transmission to the publically accessible storage facility comprises
transmitting the first and second encrypted sub-images to a cloud service.

4. The method of claim 1 , wherein the pixel values are RGB pixel values, the method further comprising:
receiving the first and second encrypted sub-images from the cloud service;
for each RGB pixel value of the first sub-image, subtracting a corresponding modified keystream value selected from a plurality of modified keystream values;
producing a first decrypted sub-image;
for each RGB pixel value of the second sub-image, subtracting a corresponding modified keystream value selected from the plurality of modified keystream values; and
producing a second decrypted sub-image.

5. The method of claim 4 , further comprising:
combining the first and second decrypted sub-images into the original image or a reconstructed version of the original image.

6. The method of claim 4 , further comprising:
producing a master key;
storing the master key in a database;
generating the plurality of keystream values using at least the master key;
modifying the plurality of keystream values according to a predefined post-processing function, thereby producing the plurality of modified keystream values.

7. The method of claim 6 , further comprising:
producing a random number using a random number generator;
storing the random number in metadata of at least one of the first and second sub-images; and
generating an image key using at least the random number.

8. The method of claim 6 , further comprising:
associating the predefined post-processing function to an identifier of a cloud service;
storing the identifier in metadata of at least one of the first and second sub-images; and
identifying the predefined post-processing function using the identifier.

9. The method of claim 1 , wherein the original image is formed of a number of pixels with an n-bit depth, and wherein at least the first sub-image has a bit depth less than the n-bit depth.

10. The method of claim 9 , wherein the first sub-image has a bit depth of n−1.

11. The method of claim 9 , wherein the first keystream value is a number having a length of n−1 bits.

12. A middleware processor for encrypting an original image for later storage on a publically accessible storage facility, comprising:
a computer hardware assisted splitter configured to split an original image into first and second sub-images, the first and second sub-images having a same number of pixels as the original image;
a computer hardware assisted encrypter configured to:
add each of a plurality of pixel values of the first sub-image to a first corresponding keystream value selected from a plurality of keystream values;
produce a first encrypted sub-image;
add each of a plurality of pixel values of the second sub-image to a second corresponding keystream value selected from the plurality of keystream values, the second corresponding keystream value different than the first corresponding keystream value; and
produce a second encrypted sub-image: and

a physical memory for receiving and storing the first encrypted sub-image and the second encrypted sub-image as data.

13. The middleware processor of claim 12 , wherein the pixel values are Red/Green/Blue (RGB) pixel values, and wherein the splitter is further configured to:
determine an RGB pixel value for each of a plurality of pixels of the original image;
divide each RGB pixel value of the original image into a first split RGB pixel value and a second split RGB pixel value;
associate each of the first split RGB pixel values with a corresponding RGB pixel value of the first sub-image; and
associate each of the second split RGB pixel values with a corresponding RGB pixel value of the second sub-image.

14. The middleware processor of claim 12 , wherein the middleware is configured to transmit the first and second encrypted sub-images to a cloud service.

15. The middleware processor of claim 12 , wherein the pixel values are RGB pixel values, the apparatus further comprising:
a decrypt section configured to:
subtract a modified keystream value, selected from a plurality of modified keystream values, from each RGB pixel value of the first sub-image;
produce a first decrypted sub-image;
subtract a modified keystream value, selected from the plurality of modified keystream values, from each RGB pixel value of the second sub-image; and
produce a second decrypted sub-image; and

a combiner configured to combing the first and second decrypted sub-images into substantially the original image.

16. The middleware processor of claim 12 , further comprising:
a random number generator configured to produce a master key; and
a database configured to store the master key,
wherein the encrypt section is configured to generate the plurality of keystream values based on at least the master key.

17. The middleware processor of claim 12 , further comprising:
a random number generator configured to produce a random number storable in metadata of at least one of the first and second sub-images; and
an image key based on at least the random number.

18. One or more tangible computer-readable media storing non-transitory computer-executable instructions that, when executed by a processor, operate to perform a method for preserving image privacy by encrypting an original image for later storage on a publically accessible storage facility, the method comprising:
receiving the original image;
splitting the original image into first and second sub-images, each of the first and second sub-images having a same number of pixels as the original image;
for each of a plurality of pixel values of the first sub-image, adding a first corresponding keystream value selected from a plurality of keystream values;
producing a first encrypted sub-image;
for each of a plurality of pixel values of the second sub-image, a

Assignees

• Durham David M
• Long Men
• Grewal Karanvir S
• Dewan Prashant
• Kang Xiaozhu
• Intel Corp

Inventors

• Durham David M
• Long Men
• Grewal Karanvir S
• Dewan Prashant
• Kang Xiaozhu

Classifications

• H04N21/2743 Primary

  Video hosting of uploaded data from client · CPC title

• G06F2221/2107

  File encryption · CPC title

• H04N21/4788

  communicating with other users, e.g. chatting {(arrangements for providing for computer conferences, e.g. chat rooms, to substation in data switching networks H04L12/1813; distributed application using peer-to-peer [P2P] networks H04L67/104)} · CPC title

• G06F21/6263

  during internet communication, e.g. revealing personal data from cookies · CPC title

• H04N21/4408

  involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network · CPC title