Anonymized video recording and restoring method and system based on container reversible restoration

Abstract

The invention belongs to the technical field of video monitoring and data security, and particularly relates to an anonymized video recording and restoring method and system based on container reversible restoration. The recording method comprises the following steps: performing anonymization processing on a sensitive area; encoded reference pixel data (such as a local reconstructed frame) is obtained, spatial domain differential pixel values are calculated based on the data and development levels are divided, content binding hash is constructed, and it is encrypted and packaged in an independent metadata track of a container. The restoration method comprises the following steps: executing file integrity and content binding dual hash verification on the record file, executing spatial domain differential recovery only when verification is consistent, and forcibly keeping an anonymization state if verification is consistent. According to the method, lossy compression noise is eliminated by using a reconstruction frame calibration mechanism, and lossless restoration independent of a coding format is realized; through dual verification and a rolling key mechanism, splicing attacks and frame extraction attacks are effectively prevented, and the integrity and security of an evidence chain are ensured.

Description

[0001] This invention relates to the fields of video surveillance, data security, and digital forensics, specifically to anonymized video recording and restoration methods and systems based on container-based reversible restoration. Background Technology

[0002] With the widespread deployment of video surveillance, dashcams, wearable cameras, and other similar devices, the risk of leakage of sensitive information such as faces, license plates, and screen content contained in videos has increased significantly. To prevent privacy breaches, existing technologies typically anonymize sensitive areas during video capture or post-processing stages by using techniques such as mosaicking, blurring, or pixelation. However, existing anonymization technologies suffer from the following main problems: Traditional mosaic or blurring processes irreversibly damage the original pixels. Even if there is a need for legitimate evidence collection or auditing later, it is impossible to recover the true content of the obscured area from the anonymized video. The only option is to rely on the original video that is saved separately, which increases storage costs and the risk of leakage.

[0003] Some reversible anonymization schemes only record differential data or original pixel blocks before and after encoding and save them in the form of independent files. They lack tight binding with the video container structure and it is difficult to achieve synchronous management and indexing of differential data within a standard video container. At the same time, they lack fine-grained permission control and cannot open only partial recovery capabilities for different users, different time periods, and different sensitive categories.

[0004] Quantization noise and prediction errors are introduced during video encoding. If the differential data is calculated directly based on the original video frames and the decoded pixels, uncertain errors will be introduced in the encoding and decoding links, affecting the accuracy of reversible restoration. Existing solutions usually do not use the local reconstructed frames in the video encoder feedback loop as a unified reference, resulting in deviations between the restoration results and the original content.

[0005] Existing solutions often only perform integrity checks on the recovered data itself, lacking a binding check on the "current anonymized video frame content" and the "corresponding differential data". This makes it impossible to effectively detect the inconsistency risks that arise after the anonymized video track is replaced, cropped, or re-transcoded, posing a risk of malicious tampering or misuse. Summary of the Invention

[0006] The purpose of this invention is to provide a technical solution to address one of the aforementioned problems in the prior art. Specifically, this invention is achieved through the following technical solution: The anonymized video recording method based on container reversible restoration includes the following steps: Step 1: Acquire raw video frames, perform sensitive region detection and multi-target tracking on each raw video frame to obtain the location of the sensitive region, the sensitive region identifier, and the sensitive category identifier; Step 2: Perform anonymization processing on the pixels in the sensitive area according to the preset deterministic anonymization transformation function to obtain anonymized video frames, and encode the anonymized video frames into an anonymized video bitstream that does not contain the original pixels in the sensitive area; Step 3: Obtain the coded reference pixel data corresponding to the anonymized video frame; calculate the spatial domain differential pixel value in the sensitive area based on the original video frame and the coded reference pixel data; divide the differential pixel value into multiple subsets according to the recovery bit depth precision or pixel color component to form development level differential data. Step 4: Calculate the content binding hash value based on the sensitive area pixels in the encoded reference pixel data; construct a development level record file containing the development level differential data and the content binding hash value; Step 5: Determine the development level encryption key through the key derivation function, use the development level encryption key to encrypt the development level differential data and content binding hash value in the development level record file to obtain the encrypted development level record file, and calculate the file integrity hash value of the encrypted development level record file; Step six: Encapsulate the anonymized video stream as a video track into a video container file, create an anonymous recovery metadata track independent of the video track in the video container file, write the encrypted development level record file and the file integrity hash value in chronological order, and write a record index table in the global metadata storage area of ​​the video container file; the record index table includes at least the frame index associated with the encrypted development level record file, the development level identifier, and position indication information.

[0007] Furthermore, the preset deterministic anonymization transformation function employs fuzzing with fixed convolution kernel parameters, mosaic processing with fixed block size, or pixelation processing with fixed sampling step size.

[0008] Furthermore, the development grade difference data is a collection of multiple development grade difference data subsets. The division methods of the development grade difference data subsets include: dividing the difference values ​​into high-level contour data and low-level detail data based on bit plane segmentation; or dividing the difference values ​​into luminance channel data and chrominance channel data based on color space separation.

[0009] Furthermore, the spatial domain difference pixel values ​​are processed using modulo addition or offset operations to map the difference results into unsigned integers for storage.

[0010] Furthermore, obtaining the encoded reference pixel data corresponding to the anonymized video frame includes: When the anonymized video frame is fed into the video encoder for lossy encoding, a local reconstructed frame is obtained from the feedback loop of the video encoder, and the pixel data of the local reconstructed frame is used as the encoding reference pixel data to counteract the quantization noise generated by video encoding.

[0011] Furthermore, the content binding hash value is calculated using a collision-resistant safe hash function, and its input data includes at least the frame index associated with the current development level record file, the sensitive area identifier, and the encoded reference pixel data.

[0012] Furthermore, the key derivation function adopts a rolling mechanism based on time-series trajectories: the development level encryption key of the current frame is derived based on the key of the previous frame and the motion vector of the current target; the motion vector is stored as plaintext index data in the record index table, or as unencrypted data in the header of the development level record file, so that the restoration end can read it before decryption.

[0013] The anonymized video restoration method based on container reversible restoration performs the following steps on the video container file generated by the anonymized video recording method based on container reversible restoration: Step A: Decode the video track in the video container file to obtain the current anonymized video frame; Step B: Read permission configuration data and record index table, and read the target encrypted imaging level record file from the anonymous recovery metadata track; Step C: Calculate the real-time file integrity hash value based on the read record file and compare it with the stored file integrity hash value; Step D: If the comparison is the same, decrypt the record file to extract the content binding hash value; calculate the real-time content binding hash value based on the target sensitive area pixels in the currently decoded anonymized video frame, and compare it with the extracted content binding hash value; if they are different, proceed to step F. Step E: If the comparison is the same, extract the decrypted differential data according to the development grade identifier and perform spatial domain differential recovery; if they are different, proceed to step F. Step F: Terminate the recovery of the target sensitive region and maintain the anonymized pixel state of the target sensitive region in the current anonymized video frame.

[0014] Furthermore, the permission configuration data includes a set of target sensitive category identifiers, a set of target development level identifiers, and a target time range. In step B, reading and subsequent operations are performed only on encrypted development level record files whose sensitive category identifiers belong to the set of target sensitive category identifiers, whose development level identifiers belong to the set of target development level identifiers, and whose frame indexes are located within the target time range.

[0015] An anonymized video recording system based on container reversible restoration includes an image acquisition module and a processor equipped with a video encoder unit. The processor is configured to: acquire encoded reference pixel data corresponding to the anonymized video frame, and execute an anonymized video recording method based on any one of claims 1 to 8 based on the encoded reference pixel data.

[0016] Compared with the prior art, the present invention has the following advantages and beneficial effects: By concealing the original sensitive area pixels within the development level differential data and encapsulating them in an independent metadata track, permanent anonymization of the user's viewing path is achieved, while providing reversible recovery capabilities under the condition of meeting permission requirements.

[0017] By dividing differential data into bit depth or color space, multiple development levels are constructed. Combined with the set of development level identifiers in the permission configuration data, different precision development control of sensitive information can be achieved for different users and in different scenarios.

[0018] By using the local reconstructed frame after loop filtering in the video encoder feedback loop as the coding reference pixel data, coding quantization noise, prediction error and filtering effect are offset, ensuring that the restoration result is highly consistent with the original video.

[0019] The development level record file and index information are encapsulated in an anonymous recovery metadata track and a global metadata storage area within a standard video container structure, maintaining the standardized encoding and compatibility of the main video track, while not disrupting the normal decoding of anonymized videos by existing players.

[0020] The integrity of the development level record file itself is guaranteed by the file integrity hash value, and the consistency of the record file with the sensitive area pixels in the current anonymized video frame is guaranteed by the content binding hash value, so as to prevent individual tampering with the anonymized video or recovery metadata.

[0021] By deriving a function from the previous frame key and the current target's motion vector input key, a dynamic imaging level encryption key that changes with time and target trajectory is achieved. At the same time, combined with a keyframe key reset mechanism, random access (Seek) of video and decryption recovery after target re-entry are supported while ensuring security. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating an anonymized video recording method based on container-based reversible restoration. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments and accompanying drawings. The illustrative embodiments and descriptions of this invention are for illustrative purposes only and are not intended to limit the invention. It should be noted that this invention is already in the actual research and development stage.

[0024] Example 1 like Figure 1 As shown, the anonymized video recording method based on container reversible restoration includes the following steps: Step 1: Acquire raw video frames, perform sensitive region detection and multi-target tracking on each raw video frame to obtain the location of the sensitive region, the sensitive region identifier, and the sensitive category identifier; Step 2: Perform anonymization processing on the pixels in the sensitive area according to the preset deterministic anonymization transformation function to obtain anonymized video frames, and encode the anonymized video frames into an anonymized video bitstream that does not contain the original pixels in the sensitive area; Step 3: Obtain the coded reference pixel data corresponding to the anonymized video frame; calculate the spatial domain differential pixel value in the sensitive area based on the original video frame and the coded reference pixel data; divide the differential pixel value into multiple subsets according to the recovery bit depth precision or pixel color component to form development level differential data. Step 4: Calculate the content binding hash value based on the sensitive area pixels in the encoded reference pixel data; construct a development level record file containing the development level differential data and the content binding hash value; Step 5: Determine the development level encryption key through the key derivation function, use the development level encryption key to encrypt the development level differential data and content binding hash value in the development level record file to obtain the encrypted development level record file, and calculate the file integrity hash value of the encrypted development level record file; Step six: Encapsulate the anonymized video stream as a video track into a video container file, create an anonymous recovery metadata track independent of the video track in the video container file, write the encrypted development level record file and the file integrity hash value in chronological order, and write a record index table in the global metadata storage area of ​​the video container file; the record index table includes at least the frame index associated with the encrypted development level record file, the development level identifier, and position indication information.

[0025] Specifically, in this embodiment, the video acquisition end includes an image acquisition module, a processor, and a video encoder unit connected to the processor. The processor may internally include a sensitive area detection and multi-target tracking module, an anonymization transformation module, a differential calculation and imaging level classification module, a content-bound hash calculation module, a key derivation and encryption module, and a container encapsulation module.

[0026] The image acquisition module acquires scene video in real time and generates serialized raw video frames. For each raw video frame, the sensitive region detection and multi-target tracking module performs the following operations: Perform face detection, license plate detection, and screen region detection based on deep learning or traditional image processing algorithms on the original video frames to obtain the spatial locations of several candidate sensitive regions. A unique sensitive region identifier is assigned to each persistent sensitive region based on a multi-target tracking algorithm, which is used to associate the same target across frames; a sensitive category identifier is assigned to each sensitive region, which is used to distinguish different categories of recovery strategies in subsequent access control.

[0027] After the above processing, for each original video frame, the original video frame pixel data, as well as the position, sensitive area identifier, and sensitive category identifier of each sensitive area in the frame are obtained.

[0028] The anonymization transformation module performs the following processing on each original video frame: For each sensitive region, a corresponding pixel block is extracted from the original video frame. A preset deterministic anonymization transformation function is applied to the extracted pixel block to map the sensitive region pixels to anonymized pixels, resulting in anonymized region pixels. This transformation function is completely deterministic under given parameters, does not rely on random noise, and ensures the repeatability of subsequent difference operations. The preset deterministic anonymization transformation function may include at least any one or more of the following combinations: Blur processing with fixed convolution kernel parameters is used to perform convolution operations with fixed kernel size and weights on pixels in sensitive regions; A mosaic process with fixed block size is used to divide the sensitive area into rectangular blocks of fixed size, and replace all pixels in the block with the average or center value of the pixels in each block. A fixed sampling step size pixelation process is adopted. In the sensitive area, a portion of pixels are sampled with a fixed step size, and the sampling results are copied or interpolated to the surrounding pixel positions.

[0029] The anonymized region pixels are written back to their corresponding positions to obtain an anonymized video frame containing the anonymization-sensitive region. Subsequently, the video encoder unit inputs the anonymized video frame into the encoder and generates an anonymized video bitstream using lossy compression.

[0030] To offset the quantization noise introduced during the video encoding process and improve the accuracy of reversible reconstruction, the differential calculation and development level classification module obtains the encoded reference pixel data in the following way: In the internal feedback loop of the video encoder, after completing transformation, quantization, entropy coding and loop filtering (such as Deblocking Filter or SAO), the encoder generates a fully reconstructed local reconstructed frame (Rec Frame) for motion compensation prediction of subsequent frames. During the encoding of each anonymized video frame, the corresponding locally reconstructed frame, after loop filtering, is read from the feedback loop. The pixel data of the locally reconstructed frame is used as the encoding reference pixel data for that frame. This scheme explicitly requires the reconstruction end to use a bit-exact decoding environment consistent with the recording end to ensure the mathematical consistency of the reference pixels.

[0031] After obtaining the coded reference pixel data, the differential calculation and development level division module performs the following spatial domain differential calculation for each sensitive region: Let the original pixel value of a certain sensitive area in the original video frame be... The pixel value at the corresponding position in the encoded reference pixel data is ,in This represents the pixel coordinates within the sensitive area. This represents the color component channel.

[0032] This embodiment explicitly specifies that the original video frame Specifically, this refers to pixel data that has been preprocessed and converted to a color space consistent with the video encoder's input format (such as YCbCr 4:2:0 or YCbCr 4:4:4). If the acquisition source is RGB, then... This refers to the data after RGB to YCbCr conversion. The reversible restoration of this invention refers to restoring to the YCbCr input state, thereby avoiding the loss of accuracy caused by repeated color space conversion.

[0033] Assuming pixel depth is Bits, then the differential pixel value is defined as: When using modular addition: ; When using the operation form with offset: Among them, offset It is a fixed constant, usually taken as This allows the difference results to be mapped to an unsigned integer range.

[0034] The aforementioned spatial domain differential pixel values ​​will be used for the construction of subsequent development grade differential data and reversible restoration operations.

[0035] To support step-by-step recovery at different development levels, this embodiment divides the differential pixel values ​​into multiple subsets of differential data for different development levels, forming a set of differential data for different development levels. The methods for dividing these subsets include, but are not limited to: Bit-plane segmentation method: For bit depth of pixel difference This can be split into high-level and low-level data planes. For example, high-level data can be split into high-level and low-level data planes. The remaining bits constitute a high-level basic recovery subset. The bits constitute a low-precision compensation subset.

[0036] Color space separation-based partitioning method: When using the YCbCr color space, the luminance channel differential data can be... As a subset of the luminance channel data, the chrominance channel difference data and As a subset of chroma channel data.

[0037] The differential calculation and development level classification module divides the differential pixel values ​​into multiple development level differential data subsets according to one or more of the above methods, and assigns a development level identifier to each subset. The set of all development level differential data subsets constitutes the development level differential data.

[0038] The content binding hash calculation module then calculates the content binding hash value based on the sensitive region pixels in the encoded reference pixel data. Specifically, a collision-resistant safe hash function can be used to perform hash operations on the following combination of data: decoded sequence frame index; sensitive region identifier; and the pixel sequence of the corresponding sensitive region in the encoded reference pixel data.

[0039] To ensure consistency in hash calculations, the pixel sequence must be arranged in a predefined standardized order. For example, in the YCbCr 4:2:0 color space, the Y component is extracted first and arranged in raster scan order, followed by the Cb and Cr components extracted sequentially and arranged in the same order. Finally, these components are concatenated into a one-dimensional byte stream input to the hash function. Regardless of the decoder's output format (Planar or Packed), it must be converted to this standardized intermediate format before hash calculation.

[0040] Given that this embodiment adopts strict bit consistency decoding requirements, the content binding hash value adopts a standard cryptographic hash algorithm (such as SHA-256) to perform strict integrity calculation on pixel data, without introducing fault tolerance or approximate matching mechanisms.

[0041] Subsequently, a development level record file is constructed. To address the parameter dependency issue during decryption, the development level record file is structurally divided into a plaintext header area and a ciphertext payload area: Plaintext header area: Stores metadata that does not require confidentiality but is used for decryption guidance or indexing, including the decoding sequence frame index, sensitive area identifier, sensitive category identifier, sensitive area location, motion vector (or its index), random salt value used for key derivation, number of development levels and corresponding development level identifiers, etc.

[0042] Ciphertext payload area: Stores privacy-sensitive data that needs to be kept confidential, including development grade differential data and content-bound hash values.

[0043] To prevent unauthorized access to developer grade differential data, this embodiment employs a key derivation and encryption mechanism to protect the developer grade record file.

[0044] The key derivation and encryption module first determines the development level encryption key corresponding to the current development level record file through the key derivation function. The key derivation function adopts a rolling mechanism based on time trajectory, combined with a keyframe reset mechanism (see Example 4 for details).

[0045] The motion vector or random salt value required for key calculation has been stored as plaintext in the plaintext header area of ​​the aforementioned record file, ensuring that the restoration end can read it before decryption.

[0046] After obtaining the development grade encryption key, the key derivation and encryption module uses a symmetric encryption algorithm to encrypt only the ciphertext payload area (differential data and content-bound hash value) in the development grade record file, leaving the plaintext header area unencrypted. Subsequently, a collision-resistant secure hash function is used to calculate the file integrity hash value for the entire development grade record file (including the plaintext header area and the encrypted ciphertext payload area). This hash value will be used by the restoration end to verify whether the record file has been tampered with (including preventing malicious modification of the plaintext header).

[0047] The container encapsulation module encapsulates the anonymized video stream as a video track into a video container file. Within this video container file, the container encapsulation module performs the following operations: Create an anonymous recovery metadata track independent of the video track to store the encrypted development level record files and their file integrity hashes for each frame in chronological order; Each encrypted imaging level record file and its corresponding file integrity hash value are organized into a record unit, sorted according to the frame index and sensitive area identifier, and then written into the anonymous recovery metadata track. Write a record index table to the global metadata storage area of ​​the video container file. The record index table includes at least the following fields: decoding sequence frame index; timestamp or display time; sensitive area identifier; sensitive category identifier; development level identifier; offset position and length in the anonymous recovery metadata track; decoder environment fingerprint (Decoder ProfileSignature): used to record key configuration information of the encoder at the recording end (such as video standard version, IDCT algorithm identifier, color gamut conversion matrix coefficients, etc.), so that the restoration end can verify whether the decoding environment matches during initialization to prevent hash errors caused by bit inconsistency.

[0048] Using the above organizational method, the recovery end can quickly filter the encrypted development level record files to be read in the record index table according to the sensitive category, development level and time range set in the permission configuration data, and retrieve the corresponding record units from the anonymous recovery metadata track as needed.

[0049] Example 2: This embodiment is an anonymized video recording system based on container reversible restoration, used to implement the methods described in Embodiment 1 and other embodiments.

[0050] This system includes: Image acquisition module: Used to acquire scene video and output raw video frames, which can be industrial cameras, surveillance cameras, mobile terminal cameras or wearable camera devices.

[0051] Processor: Connected to the image acquisition module, it is used to receive raw video frames and work with the video encoder unit to complete operations such as anonymization, differential calculation, hash calculation, encryption, and container encapsulation.

[0052] The processor may include: a sensitive area detection and multi-target tracking module; an anonymization transformation module; a differential calculation and imaging level classification module; a content binding hash calculation module; a key derivation and encryption module; a container encapsulation module; and a container parsing and restoration module.

[0053] Video encoder unit: Connected to the processor, it receives anonymized video frames, performs lossy compression encoding, outputs anonymized video bitstream, and provides locally reconstructed frames in the feedback loop. The processor reads pixel data from the locally reconstructed frames in the feedback loop of the video encoder unit, uses them as encoding reference pixel data, and performs spatial domain difference operations in sensitive areas.

[0054] The processor is configured as follows: During the recording phase, the anonymized video recording method based on container reversible restoration described in Example 1 is executed, and a video container file containing video tracks and anonymized recovery metadata tracks is output. During the restoration phase, the video container file is parsed, and the anonymized video restoration method of the present invention is executed to reversibly restore sensitive areas and display levels with legal permissions.

[0055] Example 3: This embodiment, based on Embodiment 1 and Embodiment 2, illustrates the organization of development grade differential data based on bit plane segmentation and the corresponding restoration process.

[0056] 1. Bit plane development level classification during the recording stage In the differential calculation and development level classification module, assuming a pixel bit depth of 8 bits, for the differential pixel value... In this embodiment, the development grades are divided in the following manner: The high 4 bits of the differential pixel values ​​are used to form the high-bit basic recovery subset, which corresponds to the development level L1; The lower 4 bits of the differential pixel values ​​are used to form a low-precision compensation subset, corresponding to the development level L2.

[0057] When constructing the development level record file, the high-level basic recovery subset of L1 level and the low-level precision compensation subset of L2 level are respectively marked with development level identifiers; the permission configuration data can allow some users to only access L1 level data, so that only the main features of the sensitive area are recovered, while the fine texture restoration of L2 level is not enabled.

[0058] 2. Selection and reconstruction of developing grades during the reduction stage On the restoration side, the container parsing and restoration module reads permission configuration data, including: target sensitive category identifier set; target imaging level identifier set; target time range.

[0059] After filtering out the encrypted imaging level record files that meet the permission configuration data constraints according to the record index table, the container parsing and restoration module performs the following in sequence: file integrity hash value verification; reading decryption parameters from the plaintext header area, decrypting the ciphertext payload area, and extracting the content binding hash value; obtaining the decoded and reconstructed pixel data of the current anonymized video frame, calculating the real-time content binding hash value based on the target sensitive area in the data, and comparing it. If all checks pass, extract the high-level baseline recovery subset at level L1 according to the development grade identifier, and further extract the low-level precision compensation subset at level L2 if necessary; reconstruct the complete difference value based on the selected development grade difference data subset. And perform spatial domain difference recovery operation.

[0060] When only L1-level data is used for restoration, the restored image is a visually shallow approximation with significant quantization loss of detail. This L1-level image is usually sufficient to support the analysis of human behavior and posture (behavior recognition level), but due to the lack of low 4-bit detail texture, it to some extent hides high-frequency facial features, preventing high-precision biometric identification (identity verification level). When both L1 and L2-level data are used for restoration, a high-precision image that is completely consistent with the original sensitive area input by the encoder can be obtained.

[0061] Example 4: This embodiment, based on the aforementioned embodiments, focuses on explaining the organization of development level differential data based on color space separation and the rolling key derivation mechanism based on time-series trajectories.

[0062] 1. Color channel development level classification during the recording stage In the differential calculation and development level classification module, based on the color space preprocessing rules determined in Example 1, the differential pixel values ​​are... It is already located in the YCbCr color space. Therefore, no space conversion is needed; the following partitioning is applied directly to each component channel: Difference data of the brightness channel This constitutes a subset of the brightness development level difference data, corresponding to the development level LY; the chroma channel difference data... and The data are merged to form a subset of chromaticity development grade differential data, corresponding to the development grade LC.

[0063] When constructing the development level record file, development level identifiers are marked for LY and LC respectively. The permission configuration data can be set to allow only the recovery of the LY development level, thereby restoring only the brightness outline of the sensitive area while keeping the color information anonymous; or, under higher permissions, both LY and LC can be restored simultaneously, so that the sensitive area is completely restored to the true color state of the encoder input.

[0064] 2. Rolling Key Derivation Based on Time-Sequence Trajectory In the key derivation and encryption module, this embodiment employs a rolling mechanism based on time-series trajectories to derive the imaging level encryption key. Considering the presence of B-frames in video encoding leading to inconsistencies between the display order (PTS) and decoding order (DTS), this invention explicitly stipulates that the key derivation chain is constructed based on the decoding order (DTS) of the video stream. Furthermore, to address the difficulties in random access (Seek) caused by the rolling key and the decryption chain breakage problem after target occlusion re-entry, this embodiment introduces a forced key reset mechanism. Specifically: Assume the system has a root key. Stored only in a secure environment; key reset will be performed when any of the following conditions are met: 1. Initial frame for the sensitive area; 2. The current frame is an Instant Decode Refresh (IDR) frame or a keyframe (I-frame); 3. If the sensitive area was absent, obscured, or lost during tracking in the previous frame (in decoding order), then the valid key from the previous frame cannot be obtained. hour.

[0065] When performing a key reset, a random salt value is generated. (Stored in the plaintext header area of ​​the record file), calculation This mechanism ensures that when the player drags the progress bar or the target re-enters, it only needs to locate the nearest reset point to begin decryption, without having to start calculating from the beginning.

[0066] For subsequent frames that do not meet the reset conditions Based on the previous frame key in the decoding order and the motion vector of the current frame calculate: in, Key derivation functions to satisfy cryptographic security, This is the index of the current frame.

[0067] This embodiment uses the following rules to determine the unique key used for key calculation. Select the motion vector of the coding unit (CU) or macroblock containing the geometric center point of the sensitive region. If multiple motion vectors exist (e.g., vectors in a forward list List0 and a backward list List1 in a bidirectional prediction B-frame), the motion vector in List0 is selected first; if List0 does not exist, the motion vector in List1 is selected; if the coding unit uses a complex motion model such as affine transformation or sub-block prediction (Sub-PU), the motion vector of the upper left control point of the unit is forced to be used, or the motion vector of the upper left control point of the unit is directly forced to be used. Defined as zero vector If it is Intra Mode, then the same applies. Defined as zero vector The above rules ensure that the selection of motion vectors is uniquely determined in any encoding mode.

[0068] To facilitate key reconstruction at the restoration end, this embodiment stores the selected key in plaintext in the plaintext header area of ​​the recording index table or the development grade record file. Or its compressed representation.

[0069] 3. Access control and recovery process during the restoration phase On the restoration side, the permission configuration data includes a set of target sensitivity category identifiers, a set of target visibility level identifiers, and a target time range. The container parsing and restoration module performs the following steps: Initialization verification: First, the "decoder environment fingerprint" in the global metadata is read to check if the decoder version and configuration of the current playback device match the fingerprint. If they do not match, the user is prompted to switch the decoding kernel or an error message is displayed to avoid subsequent hash verification failures due to environment inconsistencies.

[0070] Decode the video track in the video container file to obtain the current anonymized video frame, and select the record entry that is within the target time range and matches both the sensitive category identifier and the development level identifier according to the record index table; read the corresponding encrypted development level record file; calculate the real-time file integrity hash value (overlaying the plaintext header and ciphertext payload) based on the read record file, and compare it with the stored file integrity hash value; If the file integrity check passes, the salt value or motion vector is read from the plaintext header area. At the reconstruction end, the key is calculated using the same key derivation function as at the recording end: check if the current frame meets the key reset condition; if so, calculate based on the salt value and root key; otherwise, calculate based on the key and motion vector of the previous frame in the decoding order. The calculated key is used to decrypt the ciphertext payload area, extracting the content binding hash value and the development level differential data; the decoded reconstruction pixel data of the current anonymized video frame is obtained, which is pure YCbCr data within the decoder without post-processing. A real-time content binding hash value is calculated based on the target sensitive area in this decoded reconstruction pixel data and compared with the extracted content binding hash value; this embodiment requires a strict equality comparison. If the hash values ​​are completely identical, it indicates that the reference pixel environment is consistent with the bit at the recording end.

[0071] If the content binding hash value matches, then the luminance development level differential data subset and the optional chrominance development level differential data subset are extracted according to the allowed development level identifiers in the permission configuration data. Spatial domain differential recovery is performed to generate the recovered sensitive area pixels and write them back to the current anonymized video frame. If the comparison at any stage is inconsistent, the recovery of the sensitive area is terminated, and the anonymized pixel state is maintained. The permission configuration data can be issued by the backend permission management service or loaded from a local policy file, and is bound to user accounts and terminal devices; the specific implementation is not limited to these methods.

[0072] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A container-based method for anonymized video recording, characterized in that, Includes the following steps: Step 1: Acquire raw video frames, perform sensitive region detection and multi-target tracking on each raw video frame to obtain the location of the sensitive region, the sensitive region identifier, and the sensitive category identifier; Step 2: Perform anonymization processing on the pixels in the sensitive area according to the preset deterministic anonymization transformation function to obtain anonymized video frames, and encode the anonymized video frames into an anonymized video bitstream that does not contain the original pixels in the sensitive area; Step 3: Obtain the coded reference pixel data corresponding to the anonymized video frame; calculate the spatial domain differential pixel value in the sensitive area based on the original video frame and the coded reference pixel data; divide the differential pixel value into multiple subsets according to the recovery bit depth precision or pixel color component to form development level differential data. Step 4: Calculate the content binding hash value based on the sensitive area pixels in the encoded reference pixel data; construct a development level record file containing the development level differential data and the content binding hash value; Step 5: Determine the development level encryption key through the key derivation function, use the development level encryption key to encrypt the development level differential data and content binding hash value in the development level record file to obtain the encrypted development level record file, and calculate the file integrity hash value of the encrypted development level record file; Step six: Encapsulate the anonymized video stream as a video track into a video container file, create an anonymous recovery metadata track independent of the video track in the video container file, write the encrypted development level record file and the file integrity hash value in chronological order, and write a record index table in the global metadata storage area of ​​the video container file; the record index table includes at least the frame index associated with the encrypted development level record file, the development level identifier, and position indication information.

2. The anonymized video recording method based on container reversible restoration according to claim 1, characterized in that, The preset deterministic anonymization transformation function employs fuzzing with fixed convolution kernel parameters, mosaic processing with fixed block size, or pixelation processing with fixed sampling step size.

3. The anonymized video recording method based on container reversible restoration according to claim 1, characterized in that, The development grade differential data is a collection of multiple development grade differential data subsets. The division methods for the development grade differential data subsets include: dividing the differential values ​​into high-level contour data and low-level detail data based on bit plane segmentation; or dividing the differential values ​​into luminance channel data and chrominance channel data based on color space separation.

4. The anonymized video recording method based on container reversible restoration according to claim 1, characterized in that, The spatial domain difference pixel values ​​are processed using modulo addition or offset operations to map the difference results to unsigned integers for storage.

5. The anonymized video recording method based on container reversible restoration according to claim 1, characterized in that, The step of obtaining the encoded reference pixel data corresponding to the anonymized video frame includes: When the anonymized video frame is fed into the video encoder for lossy encoding, a local reconstructed frame is obtained from the feedback loop of the video encoder, and the pixel data of the local reconstructed frame is used as the encoding reference pixel data to counteract the quantization noise generated by video encoding.

6. The anonymized video recording method based on container reversible restoration according to claim 1, characterized in that, The content binding hash value is calculated using a collision-resistant safe hash function, and its input data includes at least the frame index associated with the current development level record file, the sensitive area identifier, and the encoded reference pixel data.

7. The anonymized video recording method based on container reversible restoration according to claim 1, characterized in that, The key derivation function adopts a rolling mechanism based on time trajectory: the development level encryption key of the current frame is derived based on the key of the previous frame and the motion vector of the current target; the motion vector is stored as plaintext index data in the record index table, or as unencrypted data in the header of the development level record file, so that the restoration end can read it before decryption.

8. A method for restoring anonymized videos based on container-based reversible restoration, characterized in that, For the video container file generated by the anonymized video recording method based on reversible container restoration as described in any of claims 1-7, perform the following steps: Step A: Decode the video track in the video container file to obtain the current anonymized video frame, and obtain the decoded and reconstructed pixel data corresponding to the current anonymized video frame; Step B: Read permission configuration data and record index table, and read the target encrypted imaging level record file from the anonymous recovery metadata track; Step C: Calculate the real-time file integrity hash value based on the read record file and compare it with the stored file integrity hash value; Step D: If the comparison is the same, decrypt the record file to extract the content binding hash value; calculate the real-time content binding hash value based on the target sensitive area pixels in the decoded and reconstructed pixel data, and compare it with the extracted content binding hash value; if they are different, proceed to step F. Step E: If the comparison is the same, extract the decrypted differential data according to the development level identifier, and perform spatial domain differential recovery using the decoded and reconstructed pixel data as reference pixel data; if they are different, proceed to step F. Step F: Terminate the recovery of the target sensitive region and maintain the anonymized pixel state of the target sensitive region in the current anonymized video frame.

9. The anonymized video restoration method based on container reversible restoration according to claim 8, characterized in that, The permission configuration data includes a set of target sensitive category identifiers, a set of target development level identifiers, and a target time range. In step B, reading and subsequent operations are performed only on encrypted development level record files whose sensitive category identifiers belong to the set of target sensitive category identifiers, whose development level identifiers belong to the set of target development level identifiers, and whose frame indexes are located within the target time range.

10. An anonymized video recording system based on container reversible restoration, characterized in that, It includes an image acquisition module and a processor; the image acquisition module is connected to the processor; The processor is configured with a video encoder unit for acquiring encoded reference pixel data corresponding to anonymized video frames, and executing the container-based reversible anonymized video recording method as described in any one of claims 1 to 7 based on the encoded reference pixel data.

Images