A method, apparatus and device for processing an image

Abstract

This specification discloses an image processing method, apparatus, and device. The method is applied to a terminal device equipped with a trusted execution environment. The method includes: acquiring user image data by calling a camera component through a trusted application and setting the user image data in the trusted execution environment; generating watermark information for the user image data based on the user image data and a preset seed key in the trusted execution environment to protect the privacy of the user image data; sending the user image data, watermark information, and seed key to a server; triggering the server to verify the watermark information using the user image data and seed key to obtain a corresponding verification result; receiving the verification result sent by the server; and if the verification result is successful, performing corresponding business processing based on the user image data.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to an image processing method, apparatus, and device. Background Technology

[0002] The widespread use of biometrics in financial services and identity authentication has brought many conveniences to people's lives. Biometric mechanisms have advantages such as being contactless, user-friendly, intuitive, convenient, fast, and easy to expand, and are widely used in intelligent systems, especially facial recognition mechanisms.

[0003] Facial recognition mechanisms can generally be divided into face detection and face recognition. Face detection detects the presence of a user's facial information in an image and removes background information unrelated to the user's face. Face detection can be implemented based on image feature values, such as facial edge and shape features, as well as facial texture and color features. It can also be based on deep learning mechanisms to extract relevant features for detection. However, facial recognition mechanisms can be attacked. Therefore, biometric detection is usually performed before facial recognition to ensure that the image in front of the camera is of the user, not an image or 3D model. However, biometric detection algorithms can also be bypassed by attackers through injection attacks, enabling dangerous behaviors such as logging into other people's accounts. Therefore, there is a need for a method that can accurately determine whether an image has been replaced or tampered with, to improve the security of image transmission and biometric recognition, and effectively defend against such attacks. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide a method that can accurately determine whether an image has been replaced or tampered with, thereby improving the security of image transmission and biometric identification and effectively defending against the aforementioned attacks.

[0005] To achieve the above technical solution, the embodiments in this specification are implemented as follows:

[0006] This specification provides an image processing method applied to a terminal device. The terminal device is equipped with a trusted execution environment (TEA). The method includes: acquiring user image data by invoking a camera component through a trusted application, and setting the user image data in the TEA. In the TEA, based on the user image data and a preset seed key, watermark information is generated for the user image data to protect its privacy. The user image data, the watermark information, and the seed key are then sent to a server. The user image data, the watermark information, and the seed key trigger the server to verify the watermark information using the user image data and the seed key, obtaining a corresponding verification result. The verification result sent by the server is received. If the verification result is successful, corresponding business processing is performed based on the user image data.

[0007] This specification provides an image processing method applied to a server. The method includes: receiving user image data, watermark information, and a seed key sent by a terminal device through a trusted execution environment (TEA). The user image data is acquired by the terminal device through a trusted application calling a camera component, and the user image data is set in the TEA. The watermark information is generated by the terminal device in the TEA based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server. The watermark information is verified using the user image data and the seed key to obtain a corresponding verification result. If the verification result is successful, corresponding business processing is performed based on the user image data.

[0008] This specification provides an image processing apparatus with a trusted execution environment. The apparatus includes: an image acquisition module that acquires user image data by calling a camera component through a trusted application and sets the user image data in the trusted execution environment; an image processing module that, in the trusted execution environment, generates watermark information for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data, and sends the user image data, the watermark information, and the seed key to a server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, obtaining a corresponding verification result; and a service processing module that receives the verification result sent by the server. If the verification result is successful, it performs corresponding service processing based on the user image data.

[0009] This specification provides an image processing apparatus, comprising: a data receiving module, which receives user image data, watermark information, and a seed key sent by a terminal device through a trusted execution environment (TEA). The user image data is acquired by the terminal device through a trusted application calling a camera component and is set in the TEA. The watermark information is generated by the terminal device in the TEA based on the user image data and a preset seed key to protect the privacy of the user image data. The data receiving module then sends the user image data, the watermark information, and the seed key to the apparatus. A verification module verifies the watermark information using the user image data and the seed key to obtain a verification result. A service processing module performs corresponding service processing based on the user image data if the verification result is successful.

[0010] This specification provides an image processing device with a trusted execution environment (TEA). The device includes a processor and a memory configured to store computer-executable instructions. When executed, the processor instructs the processor to: acquire user image data via a trusted application using a camera component, and set the user image data within the TEA. Within the TEA, a watermark is generated for the user image data based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, the watermark information, and the seed key are then sent to a server. These elements trigger the server to verify the watermark information using the user image data and the seed key, obtaining a verification result. The verification result sent by the server is received. If the verification result is successful, corresponding business processing is performed based on the user image data.

[0011] This specification provides an image processing device comprising: a processor; and a memory arranged to store computer-executable instructions. When executed, the executable instructions cause the processor to: receive user image data, watermark information, and a seed key sent by a terminal device through a trusted execution environment (TEA). The user image data is acquired by the terminal device through a trusted application calling a camera component, and the user image data is set in the TEA. The watermark information is generated by the terminal device in the TEA based on the user image data and a preset seed key to protect the privacy of the user image data. The processor then sends the user image data, the watermark information, and the seed key to the image processing device. The watermark information is verified using the user image data and the seed key to obtain a verification result. If the verification result is successful, corresponding business processing is performed based on the user image data.

[0012] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: A trusted application invokes a camera component to acquire user image data, and the user image data is placed in a trusted execution environment. In the trusted execution environment, based on the user image data and a preset seed key, watermark information is generated for the user image data to protect its privacy. The user image data, the watermark information, and the seed key are then sent to a server. The user image data, watermark information, and seed key trigger the server to verify the watermark information using the user image data and the seed key, obtaining a corresponding verification result. The verification result sent by the server is received. If the verification result is successful, corresponding business processing is performed based on the user image data.

[0013] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: receiving user image data, watermark information, and a seed key sent by a terminal device through a trusted execution environment (TEA). The user image data is acquired by the terminal device through a trusted application calling a camera component, and is set within the TEA. The watermark information is generated by the terminal device within the TEA based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, watermark information, and seed key are then sent to a server. The watermark information is verified using the user image data and the seed key to obtain a verification result. If the verification result is successful, corresponding business processing is performed based on the user image data. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1A This is an embodiment of an image processing method described in this specification;

[0016] Figure 1B This is a schematic diagram illustrating an image processing procedure as described in this specification;

[0017] Figure 2A This is a schematic diagram of the system structure of a terminal device described in this specification;

[0018] Figure 2B This is a schematic diagram of the structure of an image processing system described in this specification;

[0019] Figure 3 This is a schematic diagram illustrating another image processing procedure described in this specification;

[0020] Figure 4A This is another embodiment of an image processing method described in this specification;

[0021] Figure 4B This is a schematic diagram illustrating yet another image processing procedure described in this specification;

[0022] Figure 5 This is a schematic diagram illustrating yet another image processing procedure described in this specification.

[0023] Figure 6 This specification provides an embodiment of an image processing apparatus.

[0024] Figure 7 This is another embodiment of an image processing apparatus described in this specification;

[0025] Figure 8 This is an embodiment of an image processing device described in this specification. Detailed Implementation

[0026] This specification provides an image processing method, apparatus, and device through its embodiments.

[0027] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0028] Example 1

[0029] like Figure 1A and Figure 1B As shown in the embodiments of this specification, an image processing method is provided. The execution subject of this method can be a terminal device, such as a mobile phone, tablet computer, or other terminal device; it can also be a computer device such as a laptop or desktop computer; or it can be an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The terminal device is equipped with a trusted execution environment (TEE), which can be implemented through a program written in a predetermined programming language (i.e., in software form), or through a combination of hardware and a pre-written program (i.e., in a hardware + software form). This trusted execution environment can serve as a secure operating environment for data processing. The method specifically includes the following steps:

[0030] In step S102, the user image data is obtained by calling the camera component through a trusted application, and the user image data is set in a trusted execution environment.

[0031] Trusted applications can be pre-defined applications used to perform specific business processes, such as trusted applications for financial payments, trusted applications for instant messaging, or pre-developed applications. Trusted applications can be applications installed on the terminal device, code pre-embedded in the terminal device's hardware, or programs running in the background of the terminal device's operating system as plugins. The specific configuration can be determined based on actual needs. Trusted execution environments can be implemented using programs written in a predetermined programming language (i.e., in software form), or through a combination of hardware and pre-written programs (i.e., in a hardware + software form). A trusted execution environment can be a secure data processing environment isolated from other environments; that is, processing performed within the trusted execution environment, and the data generated during data processing, cannot be accessed by other execution environments or applications outside the executable environment. Figure 2AAs shown, a Trusted Execution Environment (REE) can be implemented by creating a small operating system that can run independently in a trusted zone (such as TrustZone). The REE can provide services directly through system calls (such as those handled directly by the TrustZone kernel). Terminal devices can include REEs (Rich Execution Environments) and TEEs (Trusted Execution Environments). REEs can run operating systems installed on the terminal device, such as Android, iOS, Windows, and Linux. REEs are characterized by their powerful functionality, openness, and scalability, providing all the functions of the terminal device to upper-layer applications, such as camera and touch functionality. However, REEs have many security vulnerabilities. For example, the operating system can obtain all the data of an application, but it is difficult to verify whether the operating system or the application has been tampered with. If tampered with, user information will be at significant security risk. Therefore, TEEs within the terminal device are needed to address this issue. TEE has its own execution space, meaning there is also an operating system within TEE. TEE has a higher security level than REE. The software and hardware resources of the terminal device that TEE can access are separate from REE, but TEE can directly obtain information from REE, while REE cannot obtain information from TEE. TEE can perform verification and other processing through provided interfaces, thereby ensuring that user information (such as payment information, user privacy information, etc.) will not be tampered with, passwords will not be hijacked, and fingerprints or facial information will not be stolen. The camera component can be a component used to capture images or videos, such as a camera, and can be specifically set according to actual conditions. User image data can be image data related to the user, such as image data including user facial information, or image data including user fingerprint information, etc., and can be specifically set according to actual conditions. This specification does not limit this in the embodiments.

[0032] In practice, the widespread adoption of biometrics in financial services and identity authentication has brought numerous conveniences to people's lives. Biometric mechanisms offer advantages such as contactless operation, user-friendliness, intuitiveness, speed, and scalability, leading to their widespread application in intelligent systems, especially facial recognition mechanisms. Facial recognition mechanisms can generally be divided into face detection and face recognition. Face detection detects the presence of a user's facial information in an image and removes background information unrelated to the user's face. Face detection can be implemented based on image feature values, such as facial edge and shape features, as well as facial texture and color features. Alternatively, it can be based on deep learning mechanisms to extract relevant features for detection. However, facial recognition mechanisms can be compromised by attackers. For example, an attacker could use an image or a 3D facial model to perform facial recognition on behalf of the user. Therefore, biometric detection is typically performed before facial recognition to ensure that the image in front of the camera is of the user, not an image or 3D model. However, biometric detection algorithms can also be bypassed by attackers through injection attacks, enabling dangerous actions such as logging into other people's accounts. Specifically, attackers replace the data acquired by the camera component with pre-set videos or images. By using application-internal key functions such as hooks, they perform data replacement before the data is sent, tamper with the camera component's driver, and customize the attack ROM, thereby changing the code-level execution logic to return data specified by the attacker. The images or videos in this process are all real-shot images or videos, and actions such as nodding and shaking the head can be simulated in the video, thus achieving the goal of bypassing the liveness detection algorithm. Therefore, there is a need to provide a method that can accurately determine whether an image has been replaced or tampered with, in order to improve the security of image transmission and biometric identification and effectively defend against the above-mentioned attacks. The embodiments of this specification provide a feasible technical solution, which may include the following:

[0033] like Figure 2B As shown, a user's terminal device can have an application installed to perform biometric identification or related services (such as payment). This application can have trigger mechanisms (such as button presses or hyperlinks) set up for these services. When the user needs to perform a biometric identification or related service, they can launch the application through the terminal device and trigger the aforementioned trigger mechanism. The terminal device can then perform the relevant service. During this process, biometric processing is required. The terminal device can call the corresponding application (CA) in the REE (Reliable Execution Environment) via JNI. The CA can initiate a facial image acquisition command, and then the CA interacts with the trusted application (TA) in the trusted execution environment. The trusted application (TA) can call the terminal device's camera component to acquire the user's image data. The user's image data can be stored in the trusted execution environment, thus ensuring the security of the user's image data during processing.

[0034] In step S104, in the trusted execution environment, watermark information is generated for the user image data based on the user image data and the preset seed key to protect the privacy of the user image data. The user image data, watermark information and seed key are sent to the server. The user image data, watermark information and seed key are used to trigger the server to verify the watermark information using the user image data and seed key to obtain the corresponding verification result.

[0035] The seed key can be used as the initial key to initiate the key update process or the key generation process. In this embodiment, the seed key can be used as the initial key for the key generation process. The watermark information can be digital watermark information. Watermark information can be specific digital signals used as protective information for a designated item to protect its copyright, integrity, prevent copying, or track its whereabouts. Watermark information can also be specific information representing the copyright holder's identity (such as text, logo, serial number, etc.) associated with the protected item in a certain way. In the event of a copyright dispute, the watermark information is extracted through a corresponding algorithm to verify the ownership of the copyright, ensure the legitimate interests of the copyright holder, and avoid the threat of illegal piracy. Alternatively, the watermark information can change accordingly when the content of the protected item changes, thereby identifying whether the protected item is complete, etc. The specific settings can be determined according to the actual situation, and this embodiment does not limit this.

[0036] In implementation, after user image data is collected into a trusted execution environment using the above method, it can be processed within that environment. Specifically, a seed key of a certain length can be set according to the actual situation. Based on this seed key and the user image data, a watermark can be generated for the user image data using a pre-defined algorithm. The specific processing can be varied. For example, the user image data can be analyzed to obtain corresponding feature data. Then, based on the seed key and combined with the aforementioned feature data, a data string of a certain length can be generated using a pre-defined algorithm. This data string can be used as the watermark information generated for the user image data. A preset watermark embedding algorithm can be used to embed the watermark information into the user image data. In this way, the user image data can be protected, thereby protecting the privacy information of user image data.

[0037] like Figure 2BAs shown, user image data with embedded watermark information and a seed key can be sent to the server. The server can receive the above information. It should be noted that the seed key can also be processed before being sent to the server. For example, to prevent the seed key from being tampered with during transmission, a specified algorithm (such as a hash algorithm or encryption algorithm) can be used to calculate the seed key to obtain the corresponding calculation result. Then, the calculation result and the seed key can be sent to the server. The specific settings can be set according to the actual situation, and this embodiment does not limit this. The server can verify the above watermark information using user image data and seed key to obtain the corresponding verification result. Specifically, the server can use the same calculation method as the terminal device to calculate the corresponding watermark information using user image data and seed key. The calculated watermark information can be compared with the received watermark information. If they are the same, the verification of the above watermark information is confirmed to be successful; if they are different, the verification of the above watermark information is confirmed to be unsuccessful.

[0038] In step S106, the verification result sent by the server is received. If the verification result is successful, the corresponding business processing is performed based on the user image data.

[0039] In implementation, such as Figure 2B As shown, the terminal device can receive the verification result sent by the server and analyze the verification result. If the verification result is successful, it indicates that the user image data has not been tampered with. At this time, the received user image data can be obtained, and subsequent biometric detection and biometric recognition can be performed based on the user image data, thereby executing the corresponding business processing.

[0040] This specification provides an image processing method applied to a terminal device. The terminal device is equipped with a trusted execution environment (TEA). A trusted application invokes a camera component to acquire user image data, which is then stored within the TEA. Within the TEA, watermark information is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These three elements trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result. If the verification is successful, corresponding business processing is executed based on the user image data. By utilizing a camera component connected to the TEA to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm runs within the TEA, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, the watermark information. The storage of the seed key and other information within the TEA ensures data security and provides some defense against deepfake attacks and biometric attacks.

[0041] Example 2

[0042] like Figure 3 As shown in the embodiments of this specification, an image processing method is provided. The execution subject of this method can be a terminal device, such as a mobile phone, tablet computer, or computer device such as a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The terminal device is equipped with a trusted execution environment (TEE), which can be implemented using a program written in a predetermined programming language (i.e., in software form), or by combining hardware devices and a pre-written program (i.e., in a hardware + software form). This trusted execution environment can serve as a secure operating environment for data processing. The method specifically includes the following steps:

[0043] In step S302, the user image data is obtained by calling the camera component through a trusted application, and the user image data is set in a trusted execution environment.

[0044] In step S304, in a trusted execution environment, the user image data is converted into image data in YUV mode.

[0045] In practice, within a trusted execution environment, the following formula can be used to convert RGB mode user image data into YUV mode image data:

[0046] Y = 0.2990R + 0.5870G + 0.1140B; U = -0.1684R - 0.3316G + 0.5B + ​​128; V = 0.5R - 0.4187G - 0.0813B + 128. Specifically, the R, G, and B elements contained in the user image data can be obtained. These values ​​can then be substituted into the above formulas to obtain the values ​​of Y, U, and V, thereby achieving the purpose of converting the user image data into YUV mode image data.

[0047] In step S306, the YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key.

[0048] Among them, multiple different image blocks can be multiple different image blocks of the same size or multiple different image blocks of different sizes, which can be set according to the actual situation.

[0049] In implementation, an image segmentation algorithm can be pre-defined to divide YUV mode image data into multiple different image blocks. For any given image block, it can be analyzed to obtain its corresponding feature data. Then, based on the seed key and combined with the aforementioned feature data, a data string of a certain length can be generated using a pre-defined algorithm. This data string can be used as the watermark information generated for that image block.

[0050] In practical applications, the process of generating a corresponding key for each image block based on a preset seed key in step S306 can be varied. The following provides an optional processing method, which may include the processing of steps A2 and A4.

[0051] In step A2, for each image block, a key stream is generated based on a preset cryptographic function and a preset seed key.

[0052] The preset cryptographic functions can include a variety of functions, such as AES-128, AES-192, and AES-256.

[0053] In practice, taking the AES-128 cryptographic function as the preset cryptographic function as an example, for each image block converted into frequency domain information, a key stream can be generated based on the AES-128 cryptographic function and a preset seed key.

[0054] In step A4, data with a preset number of bits is obtained from the key stream above, and the obtained data with a preset number of bits is used as the corresponding key generated for each image block. The data with a preset number of bits includes the watermark position, the original watermark information, and the reference bit information.

[0055] The preset bit depth can be set according to the actual situation, such as 24 bits or 32 bits.

[0056] In practical applications, the processing of step A4 above can be varied. The following is an optional processing method, which may include the following: obtaining 21 bits of data from the key stream and using the obtained 21 bits of data as the corresponding key generated for each image block. Among them, 16 bits of data in the 21 bits of data represent 4 watermark positions, 4 bits of data in the 21 bits of data represent the original watermark information, and 1 bit of data in the 21 bits of data represents the reference bit information.

[0057] In step S308, the time-domain information of each image block is converted into frequency-domain information.

[0058] In implementation, considering that image compression algorithms can significantly reduce image storage space and data transmission time by retaining low-frequency information and discarding high-frequency signals, it is necessary to recover the same watermark information as the original image as much as possible after image compression. Therefore, the upper left corner of the image is selected as the low-frequency region, whose values ​​are less affected by quantization. Thus, the corresponding watermark information can be generated based on the upper left corner of the image. To this end, the time domain information of each image block can be converted into frequency domain information. The process of converting the time domain information of each image block into frequency domain information can include various methods, such as converting the time domain information of each image block into frequency domain information through Fourier transform or discrete cosine transform.

[0059] In practical applications, the process of dividing the YUV mode image data into multiple different image blocks in step S308 can be varied. The following is an optional processing method, which may include the following: dividing the YUV mode image data into multiple different image blocks, each image block being 8*8 in size.

[0060] In practice, YUV mode image data can be divided into 8*8 image blocks to obtain multiple different image blocks.

[0061] In practical applications, the process of converting the time-domain information of each image block into frequency-domain information in step S306 can be varied. The following provides an optional processing method, which may include the following: converting the time-domain information of each image block into frequency-domain information through discrete cosine transform.

[0062] In practice, a discrete cosine transform can be performed on each image block after subtracting 128, i.e.

[0063]

[0064] Where f(i,j) represents the time-domain information of the image patch, i and j represent the coordinate positions of a certain element in the time-domain information (specifically, the time-domain matrix), F(u,v) represents the frequency-domain information of the image patch after discrete cosine transform, N represents the length and width of the image patch, u and v represent the coordinate positions of a certain element in the frequency-domain information (specifically, the frequency-domain matrix) after discrete cosine transform, and c represents the function that maps the coordinate positions to coefficients.

[0065] Using the above formula for discrete cosine transform, the time-domain information of each image block can be converted into frequency-domain information.

[0066] In step S310, based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, and the quantization information corresponding to the watermark position in each image block, the watermark information is determined.

[0067] In implementation, based on the above, data with a preset number of bits can be obtained from the keystream. This preset number of bits is used as the corresponding key generated for each image block. The preset number of bits includes watermark positions, original watermark information, and reference bit information. Specifically, 21 bits of data can be obtained from the keystream and used as the corresponding key generated for each image block. Of these 21 bits, 16 bits represent the four watermark positions, 4 bits represent the original watermark information, and 1 bit represents the reference bit information. Then, quantization can be performed using a standard quantization table with a certain quality factor. For example, a standard quantization table with a quality factor of 50 can be used. The specific settings can be determined according to the actual situation. Specifically, for any watermark position, quantization can be performed on that watermark position.

[0068]

[0069] Where R represents the rounding operation, d(i) represents the coefficient of the corresponding unknown discrete cosine transform, q0 represents the quantization step size, i represents the watermark position, and D(i) represents the quantization information corresponding to the watermark position i.

[0070] The original watermark information and reference bit information in each image block, as well as the quantization information corresponding to the watermark position in each image block, can be input into the following formula to obtain the watermark information.

[0071]

[0072] Where F represents the floor operation, E represents the watermark information, s represents the reference bit information, w represents the original watermark information, and r(i) represents the auxiliary bit calculation parameter for watermark position i.

[0073] In step S312, the seed key is encrypted based on the first key corresponding to the server, and the encrypted seed key is signed using the user's second key to obtain the processed seed key.

[0074] The server's first key can be its public or private key, or a key used for encryption on the server. The user's second key can be their public or private key, or a key used for signature processing.

[0075] In implementation, to prevent attackers from obtaining key information and algorithm results, it is necessary to generate a user key (i.e., the user's second key, such as the user's public-private key pair) from the root key, pre-set the server's corresponding first key (such as the server's private key corresponding to the public key or the server's private key), and transmit the user's second key to the server. It should be noted that if the user's second key includes both a public key and a private key, and the terminal device retains the private key, then the public key is transmitted to the server; if the terminal device retains the public key, then the private key is transmitted to the server.

[0076] In practical applications, the processing of step S312 above can be varied. The following is one feasible processing method, which includes: using the RSA algorithm, the seed key is encrypted according to the first key corresponding to the server. The encrypted seed key can be used to generate a digest through a hash algorithm. The digest can be encrypted using the user's second key to obtain a signature, thus obtaining the processed seed key.

[0077] In step S314, the user image data is used to generate an image in a preset image format, and the generated image, watermark information, encrypted seed key, and processed seed key are sent to the server. The generated image, watermark information, encrypted seed key, and processed seed key are used to trigger the server to verify the watermark information using the generated image, encrypted seed key, and processed seed key, and obtain the corresponding verification result.

[0078] The preset image format can include various types, such as images obtained through lossy compression (e.g., JPEG images) or images obtained through lossless compression. The specific format can be set according to actual conditions, and this embodiment does not limit this. In this embodiment, based on the above, the preset image format can be an image obtained through lossy compression (e.g., JPEG images).

[0079] In implementation, considering that embedding watermark information into user image data would cause some damage to the user image data, and that it would require inverse discrete cosine transform before being provided to the application layer, which would require more computation time, in this embodiment, the watermark information does not need to be embedded in the user image data, but is provided to the application layer as additional information. The application layer then sends the generated image, watermark information, encrypted seed key, and processed seed key to the server.

[0080] Furthermore, for facial recognition scenarios, considering that facial recognition applications only focus on the user's face and the background is not important, it can be further extended to detect the face in the user's image data in a trusted execution environment and directly generate watermark information on the face according to the above processing method. This can reduce the amount of information contained in the watermark information, facilitate transmission, and save computing resources.

[0081] In step S316, the verification result sent by the server is received. If the verification result is successful, the corresponding business processing is performed based on the user image data.

[0082] This specification provides an image processing method applied to a terminal device. The terminal device is equipped with a trusted execution environment (TEA). A trusted application invokes a camera component to acquire user image data, which is then stored within the TEA. Within the TEA, watermark information is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These three elements trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result. If the verification is successful, corresponding business processing is executed based on the user image data. By utilizing a camera component connected to the TEA to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm runs within the TEA, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, the watermark information. The storage of the seed key and other information within the TEA ensures data security and provides some defense against deepfake attacks and biometric attacks.

[0083] Furthermore, the combination of TEE and key for watermark acquisition ensures that attackers cannot forge watermarks, guaranteeing image security throughout the entire link from the camera component to the server. This prevents attackers from using injection attacks to bypass biometric detection algorithms. In addition, based on the JPEG compression principle, it has a certain robustness to JPEG compression and takes into account the effectiveness under different attack scenarios, making it more widely applicable.

[0084] Example 3

[0085] like Figure 4A and Figure 4B As shown in the embodiments of this specification, an image processing method is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for financial services or online shopping services, or a backend server for an application. The method specifically includes the following steps:

[0086] In step S402, the terminal device receives user image data, watermark information, and a seed key sent through a trusted execution environment. The user image data is obtained by the terminal device through a trusted application calling the camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server.

[0087] In step S404, the watermark information is verified using the user image data and the seed key to obtain the corresponding verification result.

[0088] In implementation, such as Figure 2B As shown, corresponding watermark information can be generated based on user image data and a seed key. The specific processing procedure can be implemented in the same way as the terminal device's method of generating corresponding watermark information based on user image data and a seed key (i.e., the relevant content in Embodiment 1 or Embodiment 2 above). For details, please refer to the relevant content in Embodiment 1 or Embodiment 2 above, which will not be repeated here. Then, the generated watermark information can be compared with the received watermark information to verify the watermark information and obtain the corresponding verification result.

[0089] In step S406, if the above verification result is successful, the corresponding business processing is performed based on the user image data.

[0090] This specification provides an image processing method. A trusted application on a terminal device invokes a camera component to acquire user image data. This user image data is then placed in a trusted execution environment (TEA). Within the TEA, watermark information is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These three elements trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result. If the verification is successful, corresponding business processing is executed based on the user image data. By utilizing a camera component connected to the TEA to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm runs within the TEA, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, the watermark information. The storage of the seed key and other information within the TEA ensures data security and provides some defense against deepfake attacks and biometric attacks.

[0091] Example 4

[0092] like Figure 5 As shown in the embodiments of this specification, an image processing method is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for financial services or online shopping services, or a backend server for an application. The method specifically includes the following steps:

[0093] In step S502, the terminal device receives user image data, watermark information, and a seed key sent through a trusted execution environment. The user image data is obtained by the terminal device through a trusted application calling the camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server.

[0094] The seed key includes an encrypted seed key and a processed seed key obtained after encryption and signing. The method for determining the encrypted seed key and the processed seed key can be found in the aforementioned content; that is, the seed key is encrypted using the server's first key, and the encrypted seed key is signed using the user's second key to obtain the processed seed key. Based on this, steps S504 to S518 can be executed.

[0095] In step S504, the encrypted seed key is signed using the user's second key stored locally to obtain the processed target seed key.

[0096] In practical applications, the processing of step S504 above can be varied. The following is one feasible processing method, which specifically includes: generating a digest of the encrypted seed key through a hash algorithm, and encrypting the digest with the user's second key to obtain a signature, thereby obtaining the processed target seed key.

[0097] In step S506, it is determined whether the processed target seed key matches the above-mentioned processed seed key.

[0098] In step S508, if a match is found, the encrypted seed key is decrypted using the server's corresponding key to obtain the seed key.

[0099] The key corresponding to the server can be either the server's public key or private key. If the first key corresponding to the server is a public key, then the key corresponding to the server is a private key. If the first key corresponding to the server is a private key, then the key corresponding to the server is a public key. The server's public key can also be a key used for decryption processing within the server, etc.

[0100] In step S510, the user image data is converted into image data in YUV mode.

[0101] Furthermore, considering that user image data can be obtained through lossy compression of images, it can also be processed in the following way: the user image data obtained through lossy compression of images is decoded to obtain decrypted user image data.

[0102] Among them, lossy compression processing of images can be such as JPEG-based compression processing.

[0103] Accordingly, the above-mentioned process of converting user image data into YUV mode image data can be performed as follows: convert the decrypted user image data into YUV mode image data.

[0104] In step S512, the YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key.

[0105] In step S514, the time-domain information of each image block is converted into frequency-domain information.

[0106] In step S516, based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, and the quantization information corresponding to the watermark position in each image block, the watermark information of each image block is determined.

[0107] The processing of steps S510 to S516 can be found in the relevant content of steps S304 to S310 in the aforementioned embodiment two, and will not be repeated here.

[0108] In step S518, if the watermark information of each determined image block matches the watermark information of each received image block, a verification result that has passed the verification is generated.

[0109] In practice, if the watermark information of each determined image block is the same as the watermark information of each received image block, a verification result that passes the verification is generated; otherwise, a verification result that fails the verification is generated.

[0110] In practical applications, the processing of step S518 above can be varied. The following provides an achievable processing method, which may specifically include the processing of steps B2 and B4.

[0111] In step B2, the number of bits corresponding to the different information contained in the watermark information of each determined image block and the watermark information of each received image block are obtained.

[0112] In step B4, if the number of bits obtained is less than a preset threshold, a verification result indicating that the verification has passed is generated.

[0113] In practical applications, in addition to obtaining the verification result through the processing method in step B4 above, the verification result can also be obtained in the following way: the ratio of the number of bits corresponding to the different information contained in the watermark information of each determined image block to the total number of bits can be calculated to obtain the bit error rate. If the bit error rate is higher than the preset threshold, an error is returned; otherwise, it indicates that the user image data has not been tampered with. At this time, the server can accept the user image data and pass it into the biometric detection module and the facial recognition module, and finally return the corresponding result.

[0114] In step S520, if the above verification result is successful, the corresponding business processing is performed based on the user image data.

[0115] Based on the above processing, when the terminal device transmits the original user image data to the server, its watermark information can be completely recovered. After the user image data is compressed using JPEG with a quality factor of 80, the bit error rate between the watermark information extracted by the server and the received watermark information is only 3%. However, after the user image data is replaced, the bit error rate is over 30%. The above processing can also support scaling and cropping operations to a certain extent. Furthermore, considering the bit error rate under adversarial attack scenarios, the experiment used 1994 facial images. The adversarial attack sample achieved a detection evasion rate of 22.9%, and in a deepfake attack scenario, the detection evasion rate was 13.4%. It can be seen that the above processing method still has a certain defensive capability against adversarial attacks and deepfake attacks.

[0116] This specification provides an image processing method. A trusted application on a terminal device invokes a camera component to acquire user image data. This user image data is then placed in a trusted execution environment (TEA). Within the TEA, watermark information is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These three elements trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result. If the verification is successful, corresponding business processing is executed based on the user image data. By utilizing a camera component connected to the TEA to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm runs within the TEA, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, the watermark information. The storage of the seed key and other information within the TEA ensures data security and provides some defense against deepfake attacks and biometric attacks.

[0117] Furthermore, the combination of TEE and key for watermark acquisition ensures that attackers cannot forge watermarks, guaranteeing image security throughout the entire link from the camera component to the server. This prevents attackers from using injection attacks to bypass biometric detection algorithms. In addition, based on the JPEG compression principle, it has a certain robustness to JPEG compression and takes into account the effectiveness under different attack scenarios, making it more widely applicable.

[0118] Example 5

[0119] The above describes the image processing method provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide an image processing apparatus, wherein the apparatus is provided with a trusted execution environment, such as... Figure 6 As shown.

[0120] The image processing device includes: an image acquisition module 601, an image processing module 602, and a service processing module 603, wherein:

[0121] The image acquisition module 601 acquires user image data by calling the camera component through a trusted application, and sets the user image data in the trusted execution environment;

[0122] In the trusted execution environment, the image processing module 602 generates watermark information for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The module then sends the user image data, the watermark information, and the seed key to the server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, and obtain the corresponding verification result.

[0123] The business processing module 603 receives the verification result sent by the server. If the verification result is successful, it performs corresponding business processing based on the user image data.

[0124] In this embodiment of the specification, the image processing module 602 includes:

[0125] The conversion unit converts the user image data into YUV mode image data in the trusted execution environment.

[0126] The key generation unit divides the YUV mode image data into multiple different image blocks and generates a corresponding key for each image block based on a preset seed key;

[0127] The time-frequency conversion unit converts the time-domain information of each image block into frequency-domain information;

[0128] The watermark determination unit determines the watermark position, original watermark information, and reference bit information in each image block based on the corresponding key generated for each image block. Based on the frequency domain information of each image block, it quantizes the watermark position in each image block to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, and the quantization information corresponding to the watermark position in each image block, it determines the watermark information.

[0129] In the embodiments described in this specification, the time-frequency conversion unit converts the time-domain information of each image block into frequency-domain information through discrete cosine transform.

[0130] In the embodiments described in this specification, the key generation unit divides the YUV mode image data into multiple different image blocks, each image block being 8*8 in size.

[0131] In the embodiments of this specification, the key generation unit generates a key stream for each image block based on a preset cryptographic function and a preset seed key; it obtains data of a preset number of bits from the key stream and uses the obtained data of the preset number of bits as the corresponding key generated for each image block. The data of the preset number of bits includes watermark position, original watermark information, and reference bit information.

[0132] In this embodiment of the specification, the key generation unit obtains 21 bits of data from the key stream and uses the obtained 21 bits of data as the corresponding key generated for each image block. 16 bits of the 21 bits of data represent 4 watermark positions, 4 bits of the 21 bits of data represent the original watermark information, and 1 bit of the 21 bits of data represents the reference bit information.

[0133] In this embodiment of the specification, the image processing module 602 includes:

[0134] The processing unit encrypts the seed key based on the first key corresponding to the server, and signs the encrypted seed key using the user's second key to obtain the processed seed key.

[0135] The information sending unit generates an image in a preset image format from the user image data, and sends the generated image, the watermark information, the encrypted seed key, and the processed seed key to the server.

[0136] This specification provides an image processing apparatus with a trusted execution environment. A trusted application invokes a camera component to acquire user image data, which is then stored within the trusted execution environment. Within this environment, a watermark is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These components trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result; if the verification is successful, corresponding business processing is executed based on the user image data. By utilizing a camera component connected to the trusted execution environment to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm operates within the trusted execution environment, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, the watermark information. The storage of the seed key and other information within the trusted execution environment ensures data security and provides some defense against deepfake attacks and biometric attacks.

[0137] Furthermore, the combination of TEE and key for watermark acquisition ensures that attackers cannot forge watermarks, guaranteeing image security throughout the entire link from the camera component to the server. This prevents attackers from using injection attacks to bypass biometric detection algorithms. In addition, based on the JPEG compression principle, it has a certain robustness to JPEG compression and takes into account the effectiveness under different attack scenarios, making it more widely applicable.

[0138] Example 6

[0139] The above describes the image processing method provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide an image processing apparatus, wherein the apparatus is provided with a trusted execution environment, such as... Figure 7 As shown.

[0140] The image processing device includes: a data receiving module 701, a verification module 702, and a service processing module 703, wherein:

[0141] The data receiving module 701 receives user image data, watermark information, and a seed key sent by a terminal device through a trusted execution environment. The user image data is obtained by the terminal device through a trusted application calling a camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The module then sends the user image data, the watermark information, and the seed key to the device.

[0142] The verification module 702 verifies the watermark information using the user image data and the seed key, and obtains the corresponding verification result.

[0143] If the verification result is successful, the business processing module 703 performs corresponding business processing based on the user image data.

[0144] In this embodiment of the specification, the seed key includes an encrypted seed key and a processed seed key obtained after encryption and signature processing. The verification module 702 includes:

[0145] The signing unit uses the user's second key stored locally to sign the encrypted seed key, thus obtaining the processed target seed key;

[0146] The judgment unit determines whether the processed target seed key matches the processed seed key;

[0147] If a match is found, the decryption unit uses the key corresponding to the server to decrypt the encrypted seed key to obtain the seed key.

[0148] The conversion unit converts the user image data into image data in YUV mode;

[0149] The key generation unit divides the YUV mode image data into multiple different image blocks and generates a corresponding key for each image block based on a preset seed key;

[0150] The time-frequency conversion unit converts the time-domain information of each image block into frequency-domain information;

[0151] The watermark generation unit determines the watermark position, original watermark information, and reference bit information in each image block based on the corresponding key generated for each image block. Based on the frequency domain information of each image block, it quantizes the watermark position in each image block to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, as well as the quantization information corresponding to the watermark position in each image block, it determines the watermark information of each image block.

[0152] The verification unit generates a verification result if the watermark information of each determined image block matches the watermark information of each received image block.

[0153] In this embodiment of the specification, the verification unit obtains the number of bits corresponding to the different information contained in the watermark information of each determined image block and the received watermark information of each image block; if the number of bits obtained is less than a preset number threshold, a verification result that has passed the verification is generated.

[0154] In this embodiment of the specification, the user image data is image data obtained through lossy compression of the image, and the device further includes:

[0155] The decoding module decodes the user image data obtained after lossy compression of the image to obtain decrypted user image data.

[0156] The conversion unit converts the decrypted user image data into YUV mode image data.

[0157] This specification provides an image processing apparatus that uses a trusted application on a terminal device to call a camera component to acquire user image data. The user image data is then placed in a trusted execution environment. Within this environment, watermark information is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These three elements trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result. If the verification is successful, corresponding business processing is executed based on the user image data. By using a camera component connected to the trusted execution environment to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm runs within the trusted execution environment, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, from forging the watermark information. In addition, the seed key and other information are stored within the trusted execution environment, ensuring data security and providing some defense against deepfake attacks and biometric attacks.

[0158] Furthermore, the combination of TEE and key for watermark acquisition ensures that attackers cannot forge watermarks, guaranteeing image security throughout the entire link from the camera component to the server. This prevents attackers from using injection attacks to bypass biometric detection algorithms. In addition, based on the JPEG compression principle, it has a certain robustness to JPEG compression and takes into account the effectiveness under different attack scenarios, making it more widely applicable.

[0159] Example 7

[0160] The above describes the image processing apparatus provided in the embodiments of this specification. Based on the same concept, the embodiments of this specification also provide an image processing device, such as... Figure 8 As shown.

[0161] The image processing device can be a terminal device or server, as described in the above embodiments, wherein the terminal device is equipped with a trusted execution environment.

[0162] Image processing devices can vary considerably depending on their configuration and performance. They may include one or more processors 801 and memory 802, with memory 802 storing one or more application programs or data. Memory 802 can be temporary or persistent storage. The application programs stored in memory 802 may include one or more modules (not shown), each module including a series of computer-executable instructions for the image processing device. Furthermore, processor 801 may be configured to communicate with memory 802 and execute the series of computer-executable instructions in memory 802 on the image processing device. The image processing device may also include one or more power supplies 803, one or more wired or wireless network interfaces 804, one or more input / output interfaces 805, and one or more keyboards 806.

[0163] Specifically, in this embodiment, the image processing device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the image processing device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0164] User image data is acquired by calling the camera component through a trusted application, and the user image data is set in the trusted execution environment;

[0165] In the trusted execution environment, watermark information is generated for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, and obtain the corresponding verification result.

[0166] The system receives the verification result sent by the server. If the verification result is successful, the system performs corresponding business processing based on the user image data.

[0167] In the embodiments of this specification, the step of generating watermark information for the user image data based on the user image data and a preset seed key in the trusted execution environment includes:

[0168] In the trusted execution environment, the user image data is converted into image data in YUV mode;

[0169] The YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key;

[0170] Convert the time-domain information of each image block into frequency-domain information;

[0171] Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantized information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, and the quantized information corresponding to the watermark position in each image block, the watermark information is determined.

[0172] In the embodiments of this specification, the conversion of the time-domain information of each image block into frequency-domain information includes:

[0173] The time-domain information of each image block is converted into frequency-domain information through discrete cosine transform.

[0174] In the embodiments of this specification, dividing the YUV mode image data into multiple different image blocks includes:

[0175] The YUV mode image data is divided into multiple different image blocks, each with a size of 8*8.

[0176] In the embodiments of this specification, the generation of a corresponding key for each image block based on a preset seed key includes:

[0177] For each image block, a key stream is generated based on a preset cryptographic function and the preset seed key;

[0178] Data with a preset number of bits is obtained from the key stream, and the obtained data with a preset number of bits is used as the corresponding key generated for each image block. The data with a preset number of bits includes watermark position, original watermark information and reference bit information.

[0179] In this embodiment of the specification, obtaining data of a preset number of bits from the keystream and using the obtained data of the preset number of bits as the corresponding key generated for each image block includes:

[0180] 21 bits of data are obtained from the key stream and used as the corresponding key for each image block. 16 bits of the 21 bits of data represent 4 watermark positions, 4 bits of the 21 bits of data represent the original watermark information, and 1 bit of the 21 bits of data represents the reference bit information.

[0181] In this embodiment of the specification, sending the user image data, the watermark information, and the seed key to the server includes:

[0182] The seed key is encrypted using the first key corresponding to the server, and the encrypted seed key is signed using the user's second key to obtain the processed seed key.

[0183] The user image data is used to generate an image in a preset image format, and the generated image, the watermark information, the encrypted seed key, and the processed seed key are sent to the server.

[0184] Furthermore, specifically in this embodiment, the image processing device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the image processing device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0185] The terminal device receives user image data, watermark information, and a seed key sent through a trusted execution environment. The user image data is obtained by the terminal device through a trusted application calling a camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The terminal device then sends the user image data, the watermark information, and the seed key to the server.

[0186] The watermark information is verified using the user image data and the seed key to obtain the corresponding verification result;

[0187] If the verification result is successful, then the corresponding business processing is performed based on the user image data.

[0188] In this embodiment of the specification, the seed key includes an encrypted seed key and a processed seed key obtained after encryption and signature processing. The step of verifying the watermark information using the user image data and the seed key to obtain the corresponding verification result includes:

[0189] The encrypted seed key is signed using the user's second key stored locally to obtain the processed target seed key.

[0190] Determine whether the processed target seed key matches the processed seed key;

[0191] If a match is found, the encrypted seed key is decrypted using the key corresponding to the server to obtain the seed key.

[0192] Convert the user image data into YUV mode image data;

[0193] The YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key;

[0194] Convert the time-domain information of each image block into frequency-domain information;

[0195] Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, as well as the quantization information corresponding to the watermark position in each image block, the watermark information of each image block is determined.

[0196] If the watermark information of each determined image block matches the watermark information of each received image block, a verification result that has passed the verification is generated.

[0197] In the embodiments of this specification, the step of generating a verification result indicating successful verification if the watermark information of each determined image block matches the watermark information of each received image block includes:

[0198] Obtain the number of bits corresponding to the different information contained in the watermark information of each determined image block and the watermark information of each received image block;

[0199] If the number of bits obtained is less than the preset threshold, a verification result indicating that the verification has passed will be generated.

[0200] In this embodiment of the specification, the user image data is image data obtained through lossy compression of the image. Before converting the user image data into YUV mode image data, the method further includes:

[0201] The user image data obtained after lossy compression of the image is decoded to obtain decrypted user image data;

[0202] The step of converting the user image data into YUV mode image data includes:

[0203] The decrypted user image data is converted into YUV mode image data.

[0204] This specification provides an image processing device with a trusted execution environment (TEA). A trusted application invokes a camera component to acquire user image data, which is then stored within the TEA. Within the TEA, watermark information is generated based on the user image data and a preset seed key to protect the user image data's privacy. The user image data, watermark information, and seed key are then sent to a server. These three elements trigger the server to verify the watermark information using the user image data and seed key, obtaining a verification result. The server receives the verification result; if the verification is successful, corresponding business processing is executed based on the user image data. By utilizing a camera component connected to the TEA to acquire user image data, the reliability of the input image data is ensured. Furthermore, the algorithm runs within the TEA, and the watermark generation process is key-dependent, preventing attackers from obtaining and forging the seed key, and consequently, the watermark information. The storage of the seed key and other information within the TEA ensures data security and provides some defense against deepfake attacks and biometric attacks.

[0205] Furthermore, the combination of TEE and key for watermark acquisition ensures that attackers cannot forge watermarks, guaranteeing image security throughout the entire link from the camera component to the server. This prevents attackers from using injection attacks to bypass biometric detection algorithms. In addition, based on the JPEG compression principle, it has a certain robustness to JPEG compression and takes into account the effectiveness under different attack scenarios, making it more widely applicable.

[0206] Example 8

[0207] Furthermore, based on the above Figures 1A to 5 The method shown in this specification, along with one or more embodiments, also provides a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can achieve the following process:

[0208] User image data is acquired by calling the camera component through a trusted application, and the user image data is set in the trusted execution environment;

[0209] In the trusted execution environment, watermark information is generated for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, and obtain the corresponding verification result.

[0210] The system receives the verification result sent by the server. If the verification result is successful, the system performs corresponding business processing based on the user image data.

[0211] In the embodiments of this specification, the step of generating watermark information for the user image data based on the user image data and a preset seed key in the trusted execution environment includes:

[0212] In the trusted execution environment, the user image data is converted into image data in YUV mode;

[0213] The YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key;

[0214] Convert the time-domain information of each image block into frequency-domain information;

[0215] Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantized information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, and the quantized information corresponding to the watermark position in each image block, the watermark information is determined.

[0216] In the embodiments of this specification, the conversion of the time-domain information of each image block into frequency-domain information includes:

[0217] The time-domain information of each image block is converted into frequency-domain information through discrete cosine transform.

[0218] In the embodiments of this specification, dividing the YUV mode image data into multiple different image blocks includes:

[0219] The YUV mode image data is divided into multiple different image blocks, each with a size of 8*8.

[0220] In the embodiments of this specification, the generation of a corresponding key for each image block based on a preset seed key includes:

[0221] For each image block, a key stream is generated based on a preset cryptographic function and the preset seed key;

[0222] Data with a preset number of bits is obtained from the key stream, and the obtained data with a preset number of bits is used as the corresponding key generated for each image block. The data with a preset number of bits includes watermark position, original watermark information and reference bit information.

[0223] In this embodiment of the specification, obtaining data of a preset number of bits from the keystream and using the obtained data of the preset number of bits as the corresponding key generated for each image block includes:

[0224] 21 bits of data are obtained from the key stream and used as the corresponding key for each image block. 16 bits of the 21 bits of data represent 4 watermark positions, 4 bits of the 21 bits of data represent the original watermark information, and 1 bit of the 21 bits of data represents the reference bit information.

[0225] In this embodiment of the specification, sending the user image data, the watermark information, and the seed key to the server includes:

[0226] The seed key is encrypted using the first key corresponding to the server, and the encrypted seed key is signed using the user's second key to obtain the processed seed key.

[0227] The user image data is used to generate an image in a preset image format, and the generated image, the watermark information, the encrypted seed key, and the processed seed key are sent to the server.

[0228] In another specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc., and the computer-executable instruction information stored in the storage medium can achieve the following process when executed by the processor:

[0229] The terminal device receives user image data, watermark information, and a seed key sent through a trusted execution environment. The user image data is obtained by the terminal device through a trusted application calling a camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The terminal device then sends the user image data, the watermark information, and the seed key to the server.

[0230] The watermark information is verified using the user image data and the seed key to obtain the corresponding verification result;

[0231] If the verification result is successful, then the corresponding business processing is performed based on the user image data.

[0232] In this embodiment of the specification, the seed key includes an encrypted seed key and a processed seed key obtained after encryption and signature processing. The step of verifying the watermark information using the user image data and the seed key to obtain the corresponding verification result includes:

[0233] The encrypted seed key is signed using the user's second key stored locally to obtain the processed target seed key.

[0234] Determine whether the processed target seed key matches the processed seed key;

[0235] If a match is found, the encrypted seed key is decrypted using the key corresponding to the server to obtain the seed key.

[0236] Convert the user image data into YUV mode image data;

[0237] The YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key;

[0238] Convert the time-domain information of each image block into frequency-domain information;

[0239] Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, as well as the quantization information corresponding to the watermark position in each image block, the watermark information of each image block is determined.

[0240] If the watermark information of each determined image block matches the watermark information of each received image block, a verification result that has passed the verification is generated.

[0241] In the embodiments of this specification, the step of generating a verification result indicating successful verification if the watermark information of each determined image block matches the watermark information of each received image block includes:

[0242] Obtain the number of bits corresponding to the different information contained in the watermark information of each determined image block and the watermark information of each received image block;

[0243] If the number of bits obtained is less than the preset threshold, a verification result indicating that the verification has passed will be generated.

[0244] In this embodiment of the specification, the user image data is image data obtained through lossy compression of the image. Before converting the user image data into YUV mode image data, the method further includes:

[0245] The user image data obtained after lossy compression of the image is decoded to obtain decrypted user image data;

[0246] The step of converting the user image data into YUV mode image data includes:

[0247] The decrypted user image data is converted into YUV mode image data.

[0248] This specification provides a storage medium that uses a trusted application to call a camera component to acquire user image data and places the user image data in a trusted execution environment. In the trusted execution environment, watermark information is generated for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, watermark information, and seed key are then sent to a server. The user image data, watermark information, and seed key trigger the server to verify the watermark information using the user image data and seed key, obtaining the corresponding verification result. The server receives the verification result; if the verification is successful, corresponding business processing is executed based on the user image data. Thus, by using a camera component connected to the trusted execution environment to acquire user image data, the reliability of the input image data is ensured. Simultaneously, the algorithm runs in the trusted execution environment, and the watermark generation process is key-dependent, ensuring that attackers cannot obtain or forge the seed key, and therefore cannot forge the watermark information. Furthermore, the seed key and other information are stored in the trusted execution environment, ensuring data security and providing a certain degree of defense against deepfake attacks and biometric adversarial attacks.

[0249] Furthermore, the combination of TEE and key for watermark acquisition ensures that attackers cannot forge watermarks, guaranteeing image security throughout the entire link from the camera component to the server. This prevents attackers from using injection attacks to bypass biometric detection algorithms. In addition, based on the JPEG compression principle, it has a certain robustness to JPEG compression and takes into account the effectiveness under different attack scenarios, making it more widely applicable.

[0250] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0251] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using a hardware physical module. For example, a Programmable Logic Device (PLD) (e.g., a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program a digital system themselves to "integrate" it onto a PLD, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0252] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0253] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0254] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0255] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0256] The embodiments described herein are illustrated with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0257] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0258] These computer program instructions may also be loaded onto a computer or other programmable device in parallel or in series, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable device, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0259] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0260] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0261] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0262] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0263] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0264] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0265] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0266] The above description is merely an embodiment of this specification and is not intended to limit this application. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. An image processing method applied to a terminal device, wherein the terminal device is provided with a trusted execution environment, the method comprising: User image data is acquired by calling the camera component through a trusted application, and the user image data is set in the trusted execution environment; In the trusted execution environment, watermark information is generated for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, and obtain the corresponding verification result. The watermark information is generated by converting the user image data into YUV mode image data, and generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key. The time domain information of each image block is converted into frequency domain information. Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in the corresponding image block is quantized. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information of the quantized watermark position in each image block. The system receives the verification result sent by the server. If the verification result is successful, the system performs corresponding business processing based on the user image data.

2. The method according to claim 1, wherein converting the time-domain information of each image block into frequency-domain information comprises: The time-domain information of each image block is converted into frequency-domain information through discrete cosine transform.

3. The method according to claim 1, wherein dividing the YUV mode image data into multiple different image blocks includes: The YUV mode image data is divided into multiple different image blocks, each with a size of 8*8.

4. The method according to claim 1, wherein generating a corresponding key for each image block based on a preset seed key includes: For each image block, a key stream is generated based on a preset cryptographic function and the preset seed key; Data with a preset number of bits is obtained from the key stream, and the obtained data with a preset number of bits is used as the corresponding key generated for each image block. The data with a preset number of bits includes watermark position, original watermark information and reference bit information.

5. The method according to claim 4, wherein obtaining data of a preset number of bits from the keystream and using the obtained data of the preset number of bits as the corresponding key generated for each image block includes: 21 bits of data are obtained from the key stream and used as the corresponding key for each image block. 16 bits of the 21 bits of data represent 4 watermark positions, 4 bits of the 21 bits of data represent the original watermark information, and 1 bit of the 21 bits of data represents the reference bit information.

6. The method according to claim 4, wherein sending the user image data, the watermark information, and the seed key to the server comprises: The seed key is encrypted using the first key corresponding to the server, and the encrypted seed key is signed using the user's second key to obtain the processed seed key. The user image data is used to generate an image in a preset image format, and the generated image, the watermark information, the encrypted seed key, and the processed seed key are sent to the server.

7. An image processing method applied to a server, the method comprising: The receiving terminal device sends user image data, watermark information, and a seed key through a trusted execution environment. The user image data is acquired by the terminal device through a trusted application calling a camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The receiving terminal device then sends the user image data, the watermark information, and the seed key to the server. The watermark information is generated by converting the user image data into YUV mode image data, generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key, converting the time domain information of each image block into frequency domain information, determining the watermark position, original watermark information, and reference bit information in each image block based on the corresponding key generated for each image block, and quantizing the watermark position in the corresponding image block based on the frequency domain information of each image block. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information of the quantization processing of the watermark position in each image block. The watermark information is verified using the user image data and the seed key to obtain the corresponding verification result; If the verification result is successful, then the corresponding business processing is performed based on the user image data.

8. The method according to claim 7, wherein the seed key includes an encrypted seed key and a processed seed key obtained after encryption and signature processing, and the step of verifying the watermark information using the user image data and the seed key to obtain a corresponding verification result includes: The encrypted seed key is signed using the user's second key stored locally to obtain the processed target seed key. Determine whether the processed target seed key matches the processed seed key; If a match is found, the encrypted seed key is decrypted using the key corresponding to the server to obtain the seed key. Convert the user image data into YUV mode image data; The YUV mode image data is divided into multiple different image blocks, and a corresponding key is generated for each image block based on a preset seed key; Convert the time-domain information of each image block into frequency-domain information; Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in each image block is quantized to obtain the quantization information corresponding to the watermark position in each image block. Based on the original watermark information and reference bit information in each image block, as well as the quantization information corresponding to the watermark position in each image block, the watermark information of each image block is determined. If the watermark information of each determined image block matches the watermark information of each received image block, a verification result that has passed the verification is generated.

9. The method according to claim 8, wherein generating a verification result that passes verification if the determined watermark information of each image block matches the received watermark information of each image block includes: Obtain the number of bits corresponding to the different information contained in the watermark information of each determined image block and the watermark information of each received image block; If the number of bits obtained is less than the preset threshold, a verification result indicating that the verification has passed will be generated.

10. The method according to claim 7, wherein the user image data is image data obtained through lossy compression of an image, and before converting the user image data into YUV mode image data, the method further comprises: The user image data obtained after lossy compression of the image is decoded to obtain decrypted user image data; The step of converting the user image data into YUV mode image data includes: The decrypted user image data is converted into YUV mode image data.

11. An image processing apparatus, wherein a trusted execution environment is provided in the apparatus, the apparatus comprising: The image acquisition module acquires user image data by calling the camera component through a trusted application, and sets the user image data in the trusted execution environment; In the trusted execution environment, the image processing module generates watermark information for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The module then sends the user image data, the watermark information, and the seed key to the server. The user image data, the watermark information, and the seed key trigger the server to verify the watermark information using the user image data and the seed key, obtaining a corresponding verification result. The watermark information is generated by converting the user image data into YUV mode image data, generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key, converting the time-domain information of each image block into frequency-domain information, determining the watermark position, original watermark information, and reference bit information in each image block based on the corresponding key generated for each image block, and quantizing the watermark position in the corresponding image block based on the frequency-domain information of each image block. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information from the quantization processing of the watermark position in each image block. The business processing module receives the verification result sent by the server. If the verification result is successful, it performs corresponding business processing based on the user image data.

12. An image processing apparatus, the apparatus comprising: The data receiving module receives user image data, watermark information, and a seed key sent by the terminal device through a trusted execution environment. The user image data is acquired by the terminal device through a trusted application calling a camera component and is set within the trusted execution environment. The watermark information is generated by the terminal device within the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The module then sends the user image data, the watermark information, and the seed key to the device. The watermark information is used to... User image data is converted into YUV mode image data, and a corresponding key is generated for each image block in multiple different image blocks divided into YUV mode image data based on a preset seed key. The time domain information of each image block is converted into frequency domain information. Based on the corresponding key generated for each image block, the watermark position, original watermark information and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in the corresponding image block is quantized. The watermark position is determined according to the original watermark information and reference bit information in each image block, as well as the quantization information of the quantization process of the watermark position in each image block. The verification module verifies the watermark information using the user image data and the seed key, and obtains the corresponding verification result. If the verification result is successful, the business processing module performs corresponding business processing based on the user image data.

13. An image processing apparatus, the image processing apparatus being provided with a trusted execution environment, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: User image data is acquired by calling the camera component through a trusted application, and the user image data is set in the trusted execution environment; In the trusted execution environment, watermark information is generated for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, and obtain the corresponding verification result. The watermark information is generated by converting the user image data into YUV mode image data, and generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key. The time domain information of each image block is converted into frequency domain information. Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in the corresponding image block is quantized. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information of the quantized watermark position in each image block. The system receives the verification result sent by the server. If the verification result is successful, the system performs corresponding business processing based on the user image data.

14. An image processing apparatus, the image processing apparatus comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: The receiving terminal device sends user image data, watermark information, and a seed key through a trusted execution environment. The user image data is acquired by the terminal device through a trusted application calling a camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The receiving terminal device then sends the user image data, the watermark information, and the seed key to an image processing device. The watermark information is generated by converting the user image data into YUV mode image data, generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key, converting the time domain information of each image block into frequency domain information, determining the watermark position, original watermark information, and reference bit information in each image block based on the corresponding key generated for each image block, and quantizing the watermark position in the corresponding image block based on the frequency domain information of each image block. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information of the quantization processing of the watermark position in each image block. The watermark information is verified using the user image data and the seed key to obtain the corresponding verification result; If the verification result is successful, then the corresponding business processing is performed based on the user image data.

15. A storage medium for storing computer-executable instructions, which, when executed by a processor, perform the following process: User image data is acquired by calling the camera component through a trusted application, and the user image data is set in a trusted execution environment; In the trusted execution environment, watermark information is generated for the user image data based on the user image data and a preset seed key to protect the privacy of the user image data. The user image data, the watermark information, and the seed key are then sent to the server. The user image data, the watermark information, and the seed key are used to trigger the server to verify the watermark information using the user image data and the seed key, and obtain the corresponding verification result. The watermark information is generated by converting the user image data into YUV mode image data, and generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key. The time domain information of each image block is converted into frequency domain information. Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in the corresponding image block is quantized. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information of the quantized watermark position in each image block. The system receives the verification result sent by the server. If the verification result is successful, the system performs corresponding business processing based on the user image data.

16. A storage medium for storing computer-executable instructions, which, when executed by a processor, perform the following process: The receiving terminal device sends user image data, watermark information, and a seed key through a trusted execution environment. The user image data is acquired by the terminal device through a trusted application calling a camera component and is set in the trusted execution environment. The watermark information is generated by the terminal device in the trusted execution environment based on the user image data and a preset seed key to protect the privacy of the user image data. The receiving terminal device then sends the user image data, the watermark information, and the seed key to a server. The watermark information is generated by converting the user image data into YUV mode image data and generating a corresponding key for each image block in multiple different image blocks divided from the YUV mode image data based on the preset seed key. The time domain information of each image block is converted into frequency domain information. Based on the corresponding key generated for each image block, the watermark position, original watermark information, and reference bit information in each image block are determined. Based on the frequency domain information of each image block, the watermark position in the corresponding image block is quantized. The watermark information is determined based on the original watermark information and reference bit information in each image block, as well as the quantization information of the quantized watermark position in each image block. The watermark information is verified using the user image data and the seed key to obtain the corresponding verification result; If the verification result is successful, then the corresponding business processing is performed based on the user image data.

Images