Skip to main content
EURASIP Journal on Information Security
Download PDF

Recoverable Privacy Protection for Video Content Distribution

EURASIP Journal on Information Security volume 2009, Article number: 293031 (2010) Cite this article

Abstract

This paper presents a method which attains recoverable privacy protection for video content distribution. The method is based on discrete wavelet transform (DWT), which generates scaling coefficients and wavelet coefficients. In our method, scaling coefficients, which can be regarded as a low-resolution image of an original image, are used for producing privacy-protected image. On the other hand, wavelet coefficients, which can be regarded as privacy information, are embedded into the privacy-protected image via information hiding technique. Therefore, privacy protected image can be recovered by authorized viewers if necessary. The proposed method is fully analyzed through experiments from the viewpoints of the amount of the embedded privacy information, the deterioration due to the embedding, and the computational time.

1. Introduction

Recently, video surveillance has received a lot of attention as a useful technology for crime deterrence and investigations and has been widely deployed in many circumstances such as airports, convenience stores, and banks. Video surveillance allows us to remotely monitor a live or recorded video feed which often includes objects such as people. Although video surveillance contributes to realizing a secure and safe community, it also exposes the privacy of the object in the video.

Over the past few years, a lot of techniques on privacy protection in video surveillance system have been proposed [1–7]. Newton et al. [1] proposed an algorithm to protect the privacy of the individuals in video surveillance data by deidentifying faces. Kitahara et al. [2] proposed a video capturing system called Stealth Vision, which protects the privacy of the objects by blurring or pixelizing their images. In [3], Wickramasuriya et al. protect object's privacy based on the authority of either object or viewers. In [4], Boyle et al. considered face obscuring for privacy protection and discussed the effects of blurring and pixelizing. Crowley et al. [5] proposed a method for privacy protection by replacing an socially inappropriate original image with a socially acceptable image using eigen-space coding technique. Chinomi et al. [6] proposed privacy-protected video surveillance system called PriSurv, which adaptively protects objects' privacy based on their privacy policies which are determined according to closeness between objects and viewers.

Although these techniques fulfill some requirements of privacy protection, it also has a potential security flaw when privacy-protected videos produced by the above techniques are distributed on the Internet, because these techniques do not provide methods for recovering the original videos from privacy-protected videos. For example, suppose that a surveillance video camera is installed around school route, and the camera distributes a privacy-protected video on the Internet in usual case. When a crime has occurred around school route, police wants to observe the original image of a suspect in privacy-protected video. In addition, when parents want to observe the situation of their children, they require the video as they are. Thus, in order to improve the security of privacy-protected surveillance system, the privacy protection which can recover the original image from privacy-protected image is strongly required. We refer to such privacy protection as recoverable privacy protection.

Concerning recoverable privacy protection, several techniques have been proposed [8–11]. Dufaux and Ebrahimi [8] and Dufaux et al. [9] proposed a method based on transform domain scrambling of regions of interest in a video sequence. A pioneering work was done by Zhang et al. [10]. They proposed a method for storing original privacy information in video using information hiding technique, and it can recover the original privacy information if necessary. However, the method has the drawback that the large amount of the privacy information must be embedded to recover the original image since the privacy information is obtained from the whole information of the object regions. Even if all the privacy information could be embedded using data compression technique, it requires huge computational loads. In [11], Yu and Babaguchi proposed another method to realize recoverable privacy protection. Their method masks a real face (privacy information) with a virtual face (newly generated face for anonymity). To deal with the huge payload problem of privacy information hiding, the method uses statistical active appearance model (AAM) [12] for privacy information extraction and recovering. It is shown that the method can embed the privacy information into video without affecting its visual quality and keep its practical usefulness. However, the method requires a set of face images for training statistical AAM.

In this paper, we propose a method for recoverable privacy protection based on discrete wavelet transform (DWT). It is well known that DWT is one of the useful tools for multiresolution analysis. DWT generates scaling coefficients and wavelet coefficients. Since an image consisting of scaling coefficients can be regarded as a reduced-size image of its original, we refer to it as a low-resolution image. A low-resolution image is used for producing privacy-protected image by expanding it to the size of the original image. Using wavelet coefficients, together with a low-resolution image, one can recover its original image. Therefore, wavelet coefficients are regarded as privacy information. In order to prevent unauthorized viewers from recovering privacy-protected image, our method embeds wavelet coefficients into the privacy-protected image via information hiding technique. By this, the privacy-protected image can only be recovered by authorized viewers if necessary. Furthermore, it is shown that the amount of the privacy information of the object can significantly be reduced compared to Zhang's method [10]. In addition, in contrast with Yu's method [11], our method requires no training beforehand.

Some results of this paper have already been reported in [13], where a method for bitmap image is developed. In this paper, we extend the method so as to deal with compression technique such as JPEG [14] and JPEG2000 [15] for content distribution on the Internet and provide detailed algorithms for privacy information extracting, hiding, and recovering. Furthermore, we analyze the effectiveness of the proposed method through numerical experiments from the viewpoints of the amount of the embedded privacy information, the deterioration due to the embedding, and the computational time.

This paper is organized as follows. In Section 2, we show the architecture of the proposed system. In Section 3, the discrete wavelet transform is introduced and the new image processing method for privacy information extraction is proposed. The privacy information hiding and recovering are described in Section 4. Experimental results on the proposed method are presented in Section 5. Conclusions are made in Section 6.

2. System Architecture

Figure 1 shows the architecture of the proposed system. In the encoding procedure, the object region is extracted using adaptive Gaussian mixture model [16, 17], where the object region is defined as the least rectangular area containing human body. Then, the privacy-protected image of the object region is produced by expanding the low-resolution image obtained by DWT. Next, the privacy information of the object is extracted. In this case the privacy information of the object region is defined as the information from which the person corresponding to the region is identified, that is, a set of wavelet coefficients obtained by DWT for the region. Finally, the extracted privacy information and region information are embedded into the surveillance video using the amplitude modulo modulation-based information hiding scheme [18]. The locations and the order of the embedded pixels are described by their corresponding secret key.

Figure 1
figure 1

Schematic diagram of the system.

Full size image

When there are multiple object regions in a single image, the obscuration for privacy protection would differ according to each object region. However, in this paper, we do not deal with this issue for simplicity. We have considered such an issue in [7].

For the decoding procedure, the privacy information and region information are extracted with the procedure of the information hiding method using the secret key. Then the original image of the objects could be recovered by using the encoding process in the reversed order.

3. Privacy Information Extraction

In our system, the original image of the object region is transformed into two sets of data: a low-resolution image and a set of wavelet coefficients. This process is carried out by using discrete wavelet transform. In what follows, first, the discrete wavelet transform is introduced and then, the proposed method is described.

3.1. Discrete Wavelet Transform

The discrete wavelet transform (DWT) is computed by successive lowpass and highpass filtering of discrete signal. We use a Haar discrete wavelet transform to extract privacy information. The Haar DWT of image is given by the following equations:

(1)

where , , . The sequences and , which correspond to the impulse responses of lowpass and highpass filters, respectively, are defined as follows:

(2)

is the scaling coefficients of level , which is extracted by the lowpass filter . The image composed of the scaling coefficients is referred to as the low-resolution image of level . , , and are, respectively, the wavelet coefficients of level in vertical, horizontal, and diagonal direction, which are extracted by the highpass filter . We refer to these wavelet coefficients as a set of wavelet coefficients of level . Figure 2 shows the result of level DWT, which is composed of a low-resolution image of level and a set of wavelet coefficients from level to level . As defined above, low-resolution image given by DWT can be regarded as a down sampling of the original image. Therefore, if we expand the low-resolution image to the size of the original image, a mosaic image could be obtained, in which the original information can be protected. If the level of DWT is large enough, the low-resolution image of the object region can protect the object's privacy, although the amount of the set of wavelet coefficients to be embedded becomes large. Figure 3 shows the results of low-resolution images, which are expanded to the original image size.

Figure 2
figure 2

Result of level 2 DWT.

Full size image
Figure 3
figure 3

Results of low-resolution images, which are expanded to the original image size. (a) original image; (b) result of level 3 DWT; (c) result of level 5 DWT.

Full size image

3.2. DWT-Based Privacy Information Extraction

We can extract the bounding box of the object in the surveillance video, using the background subtraction method of adaptive Gaussian mixture model [16, 17]. The bounding box is referred to as an object region. We transform the object region from color space to color space where is the luminance component, and and are the blue and red chrominance components, respectively. According to the fact that human eyes are only sensitive to the luminance but not sensitive to the chrominance, the sensitive privacy information is only included in image. Therefore, we apply the DWT-based method presented in Section 3.1 for images and produce the low-resolution image and the set of wavelet coefficients . When image is given by and level DWT is employed, and are defined as follows:

(3)

whereand Since is a one-dimensional array consisting of wavelet coefficients, we also express as . Let be the image obtained by expanding image to the size of image . The privacy-protected image is produced by replacing by and transform to color space. Finally, the set of wavelet coefficients and the coordinates of the most top-left and bottom right pixels of the object region are embedded by applying amplitude modulo modulation. In usual case, images are compressed before Internet transmission by JPEG and so on. For protecting the embedded data from the image compression, we embed the privacy information and region information into the frequency domain of the privacy-protected image after quantization. As compression format, JPEG and JPEG2000 are used in our method. Figure 4 shows the structure of the privacy-protected image compression and information hiding. The details of the embedding method are described in the next section.

Figure 4
figure 4

The structure of the privacy-protected image compression and information hiding.

Full size image

4. Privacy Information Hiding and Recovering

Let the size of image be and let the level of DWT be . Then, the encoded data sequence which is embedded in privacy-protected image is generated by the set of wavelet coefficients . The process is shown in Algorithm 1.

Algorithm 1:

  • Input:

  Set of wavelet coefficients:

  Quantization step size of the privacy information:

  • Processing:

  Step: Generate the quantized data sequence by

    quantizing , Whereis the largest integer

    that does not exceed .

  Step: Find the intervals consist of successive zeros (but the number

   of zeros is more than ) from the data sequence , where , , are the number of

   such intervals,the th smallest element of the set of starting points of successive zeros

   , and the th smallest element of the set

   of end points of successive zeros .

    For this calculation, we suppose .

  Step:

 For ():

  For ():

   If ():

    If (): Encode the data sequence of the interval with the run length

    coding, and add it to the data sequence . Then Goto Next

    Else (): Goto Next

  If (): Encode to binary bits, and add the binary bits to the data sequence with

    delimiter digit .

  Else (): Encode to binary bits, and add the binary bits sandwiched by

    the sign bit and delimiter digit to the data sequence .

  • Output:

  Data sequence to be embedded:

We apply run length coding for the intervals consisting of successive zeros, since, as shown in Figure 5, a histogram of wavelet coefficients of an image is distributed around with small variance in general.

Figure 5
figure 5

Histogram of wavelet coefficients.

Full size image

Next, embed the encoded data sequence to the frequency domain of the privacy-protected image after quantization via amplitude modulo modulation (AMM) [18] according to the following equation:

(4)

where is the set of integers given by . And and are the frequency components at frequency before and after embedding, respectively, and the frequencies for embedding are described by a secret key. Therefore, only the viewer who has the secret key can extract the embedded information from the image. The embedded color component is in the order of , , . Finally, we can obtain a compressed privacy-protected image after the entropy coding of JPEG/JPEG2000.

For the recovering procedure, the privacy information and region information are extracted by taking the congruence modulo of the corresponding pixel values. Then the original image of the object is obtained by the recovering process of the Figure 1.

5. Experiments

In this section, we evaluate the performance of proposed method through several experiments. The video sequences used for the experiments are ice (), ice (), and deadline (). In experiments, we apply JPEG for compression. In Figure 6, an original image, a privacy-protected image with privacy information embedded, and a recovered image of ice are shown in Figures 6(a) and 6(b), and 6(c), respectively. In a similar manner, corresponding images of deadline are shown in Figure 7.

Figure 6
figure 6

Video sequence: ice (), DWT level:, quantization step size: , compression: JPEG.

Full size image
Figure 7
figure 7

Video sequence: deadline (), DWT level: , quantization step size: , compression: JPEG.

Full size image

For each video sequence, the average number of pixels of object regions per frame and the average number of bits for embedded data sequences per frame at different DWT levels are shown, respectively, in Tables 1 and 2.

Table 1 Average number of pixels of object regions per frame (pixel/frame).
Full size table
Table 2 Average number of bits for embedded data sequences per frame (bit/frame).
Full size table

From Tables 1 and 2, we can observe that the number of pixels of object regions and the amount of embedded data sequence of ice are about four times larger than those of ice . This is quite natural because the resolution of ice is four times larger than that of ice . We can also observe that the amount of embedded data sequences of deadline is larger than that of ice , whereas the numbers of pixels of object regions of deadline and ice are similar.

In the following, we consider the influence of the above values on the performance of the proposed method. We employ the following three measures for performance evaluation: API, PSNR, and processing time.

API is an abbreviation of Average of Privacy Information and is defined as follows:

(5)

Namely, API is the average of the required bits of data sequences for recovering one pixel in the object regions and is regarded as a measure of the amount of privacy information which should be embedded. API is also calculated by using the following equation, which is equivalent to (5):

(6)

Therefore, API can be calculated by Tables 1 and 2.

PSNR (Peak Signal-to-Noise Ratio) is used as a measure of deterioration of recovered image and is also used for evaluating the influence of embedded data sequence on privacy-protected image. PSNR between and is defined as follows:

(7)

where MSE (Mean Square Error) is defined by

(8)

5.1. Evaluation of the Amount of Privacy Information and the Deterioration Due to Embedding

APIs of each video sequence for different levels of DWT under the condition are shown in Figure 8. From Figure 8, we can observe that API tends to be large as DWT level increases. However, API hardly increases when the level is larger than and does not exceed bit/pixel. Therefore, we could embed all the privacy information into three color channels , , and of the privacy-protected image, even if the level of DWT is large and the object region size is equal to the size of the whole image. On the other hand, using the method of [10], API becomes bit/pixel ( bit/pixel/channel channel) when the data to be embedded consist of whole information of the object regions.

Figure 8
figure 8

API for the different level of DWT.

Full size image

Next, we consider the deterioration of the privacy-protected image due to the privacy information embedding. The deterioration due to embedding can be estimated by (7) and (8). Since amplitude modulo modulation in Section 4 uses congruence modulo 3, in (8) becomes less than or equal to 2. Therefore, an upper bound of MSE can be calculated as follows:

(9)

By this inequality, we obtain

(10)

This result implies that the deterioration of the privacy-protected image due to the embedding of privacy information is small enough so that we can ignore the influence of the embedding.

5.2. Evaluation of the Deterioration of the Recovered Image

Here, we evaluate the deterioration of the recovered image by PSNR between the original image and the recovered image. Figures 9 and 10 show the PSNR of the recovered image for ice and deadline at the different quantization step size and the different DWT levels. From Figures 9 and 10, we observe that PSNR becomes small as becomes large. Almost PSNRs are larger than 30 (dB). Therefore, the proposed method can recover the image with low deterioration by appropriate choice of DWT level and quantization step size. We can also observe that PSNR of deadline is worse than that of ice . This is due to the fact that the embedded data sequence of deadline is larger than that of ice as shown in Table 2.

Figure 9
figure 9

PSNR of recovered image. (ice ).

Full size image
Figure 10
figure 10

PSNR of recovered image. (deadline ).

Full size image

5.3. Evaluation of Computational Time

Computational time for generating recoverable privacy-protected image and that for recovering image are shown in Tables 3 and 4, respectively, for each video sequence at different DWT levels under the condition . From Tables 3 and 4, together with Tables 1 and 2, we observe that the influence of the resolution on computational time is dominant, whereas DWT level, the amount of embedded data sequence, and the number of pixels of object regions have an insignificant effect on the computational time.

Table 3 Average CPU time for generating recoverable privacy-protected image per frame (sec/frame).
Full size table
Table 4 Average CPU time for recovering image per frame (sec/frame).
Full size table

The generation of recoverable privacy-protected image consists of the following four processes: object extraction, expanding low-resolution image after DWT, JPEG compression, and privacy data embedding. As for the image recovering, we have the following three processes, that is, privacy data extraction, JPEG decompression, and IDWT after shrinking low-resolution image. The rate of each process in generating recoverable privacy-protected image and that for image recovering are shown in Figures 11 and 12, respectively. From Figures 11 and 12, we can observe that computational costs for object extraction, privacy data embedding, privacy data extraction, and image recovering are very small compared to the costs for image compression. Therefore, our proposed method can be applied for real time processing, provided that the computational time for compression can be small.

Figure 11
figure 11

Rates of CPU time of each processing for generating recoverable protected image.

Full size image
Figure 12
figure 12

Rates of CPU time of each processing for image recovering.

Full size image

6. Conclusion

In this paper, we have presented a method which attains recoverable privacy protection for video content distribution. By the proposed method, all the privacy information can be embedded into the privacy-protected image even if the level of DWT is large and the object region size is equal to the size of the whole image. We also show that proposed method recovers the privacy-protected image with low deterioration, and the computational time for privacy protection and image recovering is small.

The proposed method is based on the idea that the privacy information needed for recovering video sequence is embedded in the video sequence itself (which is referred to as self-recoverable), and only authorized viewers can extract the privacy information. An alternate approach is that the privacy information for recovering video sequence is stored outside (e.g., in a server), and only authorized viewers can access the privacy information. Such a system would be more secure than self-recoverable system, although the system is inferior with respect to the convenience. It is desirable to develop the system that can deal with both methods for protecting privacy information.

Currently, we use the same DWT level for each object region in a single image. However, it is better to change the DWT level adaptively according to the size of object region since the permissible visible detail of each object is not identical. The realization of this function is one of our future work. In our current method, when JPEG2000 is applied for image compression, we have to calculate DWT twice; one is for image compression using 5–3 filter, and another one is for privacy protection using Haar bases. If these two DWTs can be unified, the process of recoverable privacy protection becomes much simpler, and the computational time will be further reduced. The development of such methods is also our future work.

References

  1. Newton EM, Sweeney L, Malin B: Preserving privacy by de-identifying face images. IEEE Transactions on Knowledge and Data Engineering 2005, 17(2):232-243. 10.1109/TKDE.2005.32

    Article  Google Scholar 

  2. Kitahara I, Kogure K, Hagita N: Stealth vision for protecting privacy. Proceedings of the 17th International Conference on Pattern Recognition (ICPR '04), August 2004, Cambridge, UK 4: 404-407.

    Article  Google Scholar 

  3. Wickramasuriya J, Datt M, Mehrotra S, Venkatasubramanian N: Privacy protecting data collection in media spaces. Proceedings of the 12th ACM International Conference on Multimedia (ACM Multimedia '04), October 2004, New York, NY, USA 48-55.

    Chapter  Google Scholar 

  4. Boyle M, Edwards C, Greenberg S: The effects of filtered video on awareness and privacy. Proceedings of the ACM Conference on Computer Supported Cooperative Work, December 2000, Philadelphia, Pa, USA 1-10.

    Google Scholar 

  5. Crowley JL, Coutaz J, Babaguchi F: Things that see. Communications of the ACM 2000, 43(3):54-64. 10.1145/330534.330540

    Article  Google Scholar 

  6. Chinomi K, Nitta N, Ito Y, Babaguchi N: PriSurv: privacy protected video surveillance system using adaptive visual abstraction. Proceedings of the 14th International Multimedia Modeling Conference (MMM '08), January 2008, Kyoto, Japan, Lecture Notes in Computer Science 4903: 144-154.

    Google Scholar 

  7. Yu X, Chinomi K, Koshimizu T, Nitta N, Ito Y, Babaguchi N: Privacy protecting visual processing for secure video surveillance. Proceedings of the International Conference on Image Processing (ICIP '08), October 2008, San Diego, Calif, USA 1672-1675.

    Google Scholar 

  8. Dufaux F, Ebrahimi T: Scrambling for video surveillance with privacy. Proceedings of IEEE Conference on Computer Vision and Pattern Recognition Workshops, June 2006, New York, NY, USA

    Google Scholar 

  9. Dufaux F, Ouaret M, Abdeljaoued Y, Navarro A, Vergnenègre F, Ebrahimi T: Privacy enabling technology for video surveillance. Mobile Multimedia/Image Processing for Military and Security Applications, April 2006, Kissimmee, Fla, USA, Proceedings of SPIE 6250:

    Chapter  Google Scholar 

  10. Zhang W, Cheung S-CS, Chen M: Hiding privacy information in video surveillance system. Proceedings of the International Conference on Image Processing (ICIP '05), September 2005, Genova, Italy 3: 868-871.

    Google Scholar 

  11. Yu X, Babaguchi N: Privacy preserving: hiding a face in a face. Proceedings of the 8th Asian Conference on Computer Vision (ACCV '07), November 2007, Tokyo, Japan, Lecture Notes in Computer Science 4844: 651-661.

    Google Scholar 

  12. Cootes TF, Edwards GJ, Taylor CJ: Active appearance models. Proceedings of the European Conference on Computer Vision, 1998 2: 484-498.

    Google Scholar 

  13. Li G, Ito Y, Yu X, Nitta N, Babaguchi N: A discrete wavelet transform based recoverable image processing for privacy protection. Proceedings of the International Conference on Image Processing (ICIP '08), October 2008, San Diego, Calif, USA 1372-1375.

    Google Scholar 

  14. Wallace GK: The JPEG still picture compression standard. IEEE Transactions on Consumer Electronics 1992, 38(1):18-34. 10.1109/30.125072

    Article  Google Scholar 

  15. Skodras A, Christopoulos C, Ebrahimi T: The JPEG 2000 still image compression standard. IEEE Signal Processing Magazine 2001, 18(5):36-58. 10.1109/79.952804

    Article  MATH  Google Scholar 

  16. Grimson WEL, Stauffer C, Romano R, Lee L: Using adaptive tracking to classify and monitor activities in a site. Proceedings of IEEE Computer Society Conference on Computer Vision and Pattern Recognition, June 1998, Santa Barbara, Calif, USA 22-29.

    Google Scholar 

  17. Stauffer C, Grimson WEL: Learning patterns of activity using real-time tracking. IEEE Transactions on Pattern Analysis and Machine Intelligence 2000, 22(8):747-757. 10.1109/34.868677

    Article  Google Scholar 

  18. Princeton University,Wu M: Multimedia data hiding, Ph.D. dissertation. Princeton University; 2001.

    Google Scholar 

Download references

Acknowledgments

This work was supported in part by a Grant-in-Aid for scientific research from the Japan Society for the Promotion of Science and by SCOPE from the Ministry of Internal Affairs and Communications, Japan.

Author information

Authors and Affiliations

  1. Division of Electrical, Electronic and Information Engineering, Graduate School of Engineering, Osaka University, 2-1, Yamada-oka Suita, Osaka, 565-0871, Japan

    Guangzhen Li, Yoshimichi Ito, Naoko Nitta & Noboru Babaguchi

  2. School of Software and Microelectronics, Peking University, No. 24, Jinyuan Industry Development Zone, Daxing District, Beijing, 102600, China

    Xiaoyi Yu

Authors
  1. Guangzhen Li
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yoshimichi Ito
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Xiaoyi Yu
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Naoko Nitta
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Noboru Babaguchi
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yoshimichi Ito.

Rights and permissions

Open Access This article is distributed under the terms of the Creative Commons Attribution 2.0 International License ( https://creativecommons.org/licenses/by/2.0 ), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Reprints and Permissions

About this article

Cite this article

Li, G., Ito, Y., Yu, X. et al. Recoverable Privacy Protection for Video Content Distribution. EURASIP J. on Info. Security 2009, 293031 (2010). https://doi.org/10.1155/2009/293031

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1155/2009/293031

Keywords

  • Original Image
  • Video Sequence
  • Discrete Wavelet Transform
  • Privacy Information
  • Wavelet Coefficient