Data protection compliant camera system for mobile devices with cryptographic chain of custody, real-time PII detection, zero-knowledge image editing and hybrid post-quantum secure server anchoring

Abstract

Data protection compliant camera system for mobile devices, comprehensive: a) a dual-loop camera module (1) with a first processing loop for image display at a frame rate of at least 30 frames per second and a second, asynchronously and independently operating processing loop for PII detection at a frequency of at least 1 hertz, b) an OCR recognition module (2) for optical character recognition on the captured images with bounding box determination at block level and word level, c) a PII recognition pipeline (3) with at least three parallel recognition layers, comprising a natural language name recognition layer, a pattern-based recognition layer using regular expressions, and a remotely configurable recognition layer, wherein the results of all layers are combined in a consolidation stage with confidence boosting on cross-source confirmation and a threshold, d) an image editing module (4) for editing the identified personal data in the image by overwriting the affected areas with an opaque fill in a bitmap context, characterized in that e) a cryptographic signature module (6) is provided which generates a digital signature for each captured image using an elliptic curve method (Ed25519) with a device-specific key pair stored in a hardware-secured key memory of the mobile device (12), f) a hash chain module (7) is provided which concatenates the hashes of all images in a sequential, gapless chain, with each chain hash being calculated as a cryptographic hash over the concatenation of the previous chain hash and the current image hash, and (g) a forensic chain of evidence module (9) is provided which runs a defined processing pipeline for each image and generates a piece of evidence with at least twenty-one fields, comprising image hash, digital signature, public key, timestamp, previous chain hash, chain index and editorial information.

Description

Technical field

[0001] The invention relates to a camera system for mobile devices that automatically recognizes personal data when images are captured, redacts this data in real time, and generates a cryptographically secured, forensically usable chain of evidence for each image. The system is particularly intended for use in data protection-sensitive environments where both the integrity of the recording and the protection of personal data must be guaranteed. State of the art

[0002] Conventional camera applications on mobile devices do not offer integrated recognition and redaction of personal data. If a picture is taken that contains, for example, names, addresses, email addresses, telephone numbers, or dates of birth, this information remains unprotected in the image. Redaction must be done manually in a separate image editing program.

[0003] Existing solutions for automatic text recognition (OCR) in camera applications, such as those offered by large technology companies, are geared towards text extraction, not data protection-compliant editing. The integration of PIL detection, cryptographic signing, and forensic evidence preservation in a single camera system is not known from the current state of the art.

[0004] Furthermore, known systems lack a way to cryptographically verify the integrity and authenticity of a recording after editing. In particular, no system exists that maintains an unbroken hash chain across all recordings, timestamps them in accordance with RFC 3161, and anchors them on a public blockchain.

[0005] Another problem is that in conventional systems, the image data remains in memory after processing and could be extracted using memory analysis tools. Object of the invention

[0006] The invention is based on the objective of providing a camera system for mobile devices that recognizes and redacts personal data in real time, generates a tamper-proof cryptographic chain of evidence for each recording, and securely removes the processed image data from memory. Solution

[0007] The task is solved by a data protection-compliant camera system with the features of protection claim 1. Advantageous implementations are specified in protection claims 2 to 10.

[0008] The system includes the following modules: A dual-loop camera module (1) controls image acquisition on the mobile device (12). It implements two decoupled processing loops: a first loop for image display at a frame rate of 30 frames per second (cycle time 33 milliseconds) and a second loop for OCR-based PII recognition at a frequency of 1.25 hertz (cycle time 800 milliseconds). The two loops operate asynchronously and independently of each other, so that PII recognition does not block image display.

[0009] An OCR recognition module (2) performs optical character recognition on the images captured by the dual-loop camera module (1). It operates in accuracy mode and supports at least two languages. The recognition provides a block-level bounding box and fine-grained word-level bounding boxes for each recognized text block. The recognized words are then passed to the PIl recognition pipeline (3).

[0010] A PII detection pipeline (3) analyzes the texts supplied by the OCR recognition module (2) for personal data. It comprises at least three parallel detection layers: a first layer for natural language name recognition using named entity recognition, a second layer for pattern recognition using at least fifteen regular expressions for addresses, dates, email addresses, telephone numbers, and personal names, and a third layer for server-side pattern recognition using remotely configurable expressions. The results of all layers are combined in a consolidation stage, where confidence boosting is performed and a threshold of 0.80 is applied if a match is confirmed across multiple sources.

[0011] An image editing module (4) edits the areas in the image identified by the PIl recognition pipeline (3). The editing is performed by overwriting the affected image areas with an opaque fill in an RGBA bitmap context, with padding of at least four pixels around each detected area. The edited image is exported as a lossless compressed raster image without EXIF ​​metadata. Additionally, the image editing module (4) includes a tap-to-redact functionality, where user tap inputs are mapped to word-level bounding boxes, with a minimum tap area of ​​30 by 20 pixels and coordinate transformation for scaled image displays.

[0012] A secure memory management module (5) ensures that processed image data and cryptographic keys are securely removed from memory after processing. Deletion is performed by zeroing the memory area byte by byte, with a compiler barrier preventing the compiler from optimizing the deletion operation.

[0013] A cryptographic signature module (6) generates a digital signature for each captured image. It uses an elliptic curve method (Ed25519) with a device-specific key pair. The private key is stored in a hardware-secured key memory of the mobile device (12) and is accessible only when the device is unlocked. The signature is calculated using the SHA-256 hash of the redacted image.

[0014] A hash chain module (7) concatenates the hashes of all images in a sequential, gapless chain. For each image, a chain hash is calculated as a cryptographic hash of the concatenation of the previous chain hash and the current image hash. For the first image (genesis entry), the previous hash is calculated as a cryptographic hash of an empty string concatenated with the image hash. Each entry receives a sequential index that is incremented without gaps.

[0015] A timestamp module (8) assigns a trusted timestamp to each image in accordance with RFC 3161. The module generates a timestamp request in ASN.1-DER format using the SHA-256 hash of the image and sends it to an external timestamp server. If the external server is unreachable, a local fallback timestamp is generated, calculated as a cryptographic hash of the image hash and an ISO-8601-formatted timestamp, explicitly indicating the local origin of the timestamp.

[0016] A forensic chain of evidence module (9) coordinates the entire evidence preservation process in a defined processing pipeline. The pipeline comprises the following steps in a fixed order: Generation of the raster image, calculation of the SHA-256 hash, generation of the Ed25519 signature by the cryptographic signature module (6), Obtaining the RFC-3161 timestamp by the timestamp module (8), updating the hash chain by the hash chain module (7), anchoring on the external server (13) by the server anchoring module (10), compiling the evidence object with at least twenty-one fields, and generating a PDF certificate in DIN A4 format with a QR code encoding the image hash, signature, public key, chain index, previous hash, transaction hash, and PII tag.

[0017] A server anchoring module (10) transmits the proof data to an external server (13), which anchors it to a public blockchain. The server additionally performs a post-quantum secure signature (ML-DSA-65) on the proof data and returns the transaction hash and transaction status to the mobile device (12).

[0018] A remote configuration module (11) enables the updating of PII detection patterns and operating parameters via a secure connection to the external server (13). The integrity of the received configuration is verified using an HMAC-SHA256 algorithm with a constant-time comparison function. The module implements ReDoS protection, which checks received regular expressions for dangerous patterns and limits the total number and length of the expressions. Furthermore, received URLs are checked against a whitelist. Example of implementation

[0019] The invention will be explained in more detail below using an embodiment example.

[0020] A user starts the camera application on a mobile device (12). The dual-loop camera module (1) activates the camera and begins displaying the image at 30 frames per second. Simultaneously, the second loop starts at 1.25 Hz, which transmits the current camera image to the OCR recognition module (2).

[0021] The OCR recognition module (2) recognizes the text "Max Mustermann, born on 15.03.1985, residing at Musterstrasse 42, 12345 Berlin" on the current image. It delivers the corresponding bounding box to the PIL recognition pipeline (3) for each recognized text block and each word.

[0022] The PII recognition pipeline (3) analyzes the recognized text using all three layers. The NLP layer recognizes "Max Mustermann" as a personal name with a confidence level of 0.85. The regex layer recognizes "15.03.1985" as a date of birth (confidence level 0.95), "Musterstrasse 42" as a street address (confidence level 0.85), and "12345 Berlin" as a postal code / city combination (confidence level 0.90). The confidence levels are increased by cross-source confirmation of the name (confidence boosting). All values ​​are above the threshold of 0.80, and the ranges are marked as PII.

[0023] The image editing module (4) creates an RGBA bitmap context and overwrites the selected areas with black, opaque fill, adding a padding of four pixels. The user sees the edited areas as black bars in the real-time preview.

[0024] If the user taps on a word that is not automatically recognized, the Tap-to-Redact functionality of the image editing module (4) maps the tap coordinate to the nearest word-level bounding box and additionally redacts this word.

[0025] When the user triggers the recording, the forensic chain of evidence module (9) starts its eight-step pipeline. The redacted image is exported as a PNG without EXIF ​​metadata. The SHA-256 hash of the image is calculated. The cryptographic signature module (6) signs the hash with the device-specific Ed25519 key, which is loaded from the hardware-secured key memory.

[0026] The timestamp module (8) generates a timestamp request in ASN.1-DER format and sends it to an external timestamp server. The returned timestamp token is added to the evidence object. The hash chain module (7) calculates the chain hash as a SHA-256 hash by concatenating the previous chain hash with the current image hash and increments the chain index.

[0027] The server anchoring module (10) transmits the hash, signature, and chain index to the external server (13), which anchors the data to a public blockchain and generates an additional post-quantum secure ML-DSA-65 signature. The transaction hash and ML-DSA-65 signature are returned to the mobile device (12).

[0028] The forensic chain of evidence module (9) generates a evidence object with twenty-one fields, including image hash, Ed25519 signature, public key, timestamp token, previous chain hash, chain index, device information, number of redacted areas, ML-DSA-65 signature, and transaction hash. It generates a DIN A4-format PDF certificate containing a QR code with essential verification data.

[0029] The secure memory management module (5) erases all image data remaining in main memory by zeroing it out byte by byte. A compiler barrier ensures that the compiler does not optimize away the zeroing as dead code.

[0030] The remote configuration module (11) previously obtained the current PII detection patterns from the external server (13) and checked their integrity using HMAC-SHA256 with a constant-time comparison function. The ReDoS protection checked the received regular expressions for four classes of dangerous patterns and limited the total number to twenty and the length to three hundred characters. Advantages of the invention

[0031] By combining real-time PII detection, a cryptographic chain of custody, and secure memory erasure, a camera system is provided that meets the requirements of the General Data Protection Regulation (GDPR) while simultaneously producing forensically usable images. The dual-loop architecture ensures smooth image display despite computationally intensive PII detection. The hash chain with RFC 3161 timestamps and blockchain anchoring guarantees complete, tamper-proof documentation of all recordings. Byte-wise memory erasure with compiler barrier prevents the subsequent extraction of sensitive image data from memory. Commercial applicability

[0032] The system is suitable for commercial use in documenting insurance claims, building surveys, medical reports, police investigations, journalistic research, and operational audits, where both evidence preservation and data protection must be guaranteed. Implementation is achieved as an application on standard mobile devices without additional hardware. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited non-patent literature

[0000] Max Mustermann, born on 15.03.1985, residing at Musterstrasse 42, 12345 Berlin

[0021] Confidence

[0022] Sample Street 42" as street address (Confidence 0.85

[0022]

Claims

[1] Data protection compliant camera system for mobile devices, including: a) a dual-loop camera module (1) with a first processing loop for image display at a frame rate of at least 30 frames per second and a second, asynchronously and independently operating processing loop for PII detection at a frequency of at least 1 hertz, b) an OCR recognition module (2) for optical character recognition on the captured images with bounding box determination at block level and word level, c) a PII recognition pipeline (3) with at least three parallel recognition layers, comprising a natural language name recognition layer, a pattern-based recognition layer using regular expressions, and a remotely configurable recognition layer, wherein the results of all layers are combined in a consolidation stage with confidence boosting on cross-source confirmation and a threshold, d) an image editing module (4) for editing the identified personal data in the image by overwriting the affected areas with an opaque fill in a bitmap context, characterized by , that e) a cryptographic signature module (6) is provided which generates a digital signature for each captured image using an elliptic curve method (Ed25519) with a device-specific key pair stored in a hardware-secured key memory of the mobile device (12), f) a hash chain module (7) is provided which concatenates the hashes of all images in a sequential, gapless chain, with each chain hash being calculated as a cryptographic hash over the concatenation of the previous chain hash and the current image hash, and (g) a forensic chain of evidence module (9) is provided which runs a defined processing pipeline for each image and generates a piece of evidence with at least twenty-one fields, comprising image hash, digital signature, public key, timestamp, previous chain hash, chain index and editorial information. [2] System according to claim 1, characterized by , that the image editing module (4) has a tap-to-redact functionality in which user tap inputs are mapped to word-level bounding boxes, with a minimum tap area of ​​30 by 20 pixels provided and a coordinate transformation for scaled image representations is performed. [3] System according to claim 1 or 2, characterized by, that a timestamp module (8) is provided which generates a timestamp request in ASN.1-DER format for each recording and sends it to an external RFC-3161 compliant timestamp server, whereby if the external server is unreachable, a local fallback timestamp is calculated as a cryptographic hash of the image hash and an ISO-8601 formatted timestamp and is marked as local. [4] System according to one of the protection claims 1 to 3, characterized by , that a secure memory management module (5) is provided which securely removes processed image data and cryptographic keys from main memory after processing by byte-wise zeroing of the memory area, wherein a compiler barrier prevents path optimization of the deletion operation by the compiler. [5] System according to one of the protection claims 1 to 4, characterized by, that a server anchoring module (10) is provided which transmits the proof data to an external server (13) which anchors it on a public blockchain and generates an additional post-quantum secure signature (ML-DSA-65) over the proof data and returns the transaction hash and post-quantum secure signature to the mobile device (12). [6] System according to one of the protection claims 1 to 5, characterized by , that the forensic chain of evidence module (9) generates a PDF certificate in DIN A4 format which includes a QR code encoding image hash, signature, public key, chain index, previous chain hash, transaction hash and PII tag in a structured format. [7] System according to one of the protection claims 1 to 6, characterized by, that the PII detection pipeline (3) in the pattern-based detection layer includes at least fifteen regular expressions that are subdivided into categories for addresses, dates, email addresses, telephone numbers and personal names, each expression having a category-specific confidence value. [8] System according to one of the protection claims 1 to 7, characterized by , that a remote configuration module (11) is provided which updates PII detection patterns and operating parameters via a secure connection to the external server (13), wherein the integrity of the received configuration is checked by an HMAC-SHA256 procedure with constant-time comparison function and received regular expressions are checked for dangerous patterns (ReDoS protection) with a limit on the total number and length of the expressions. [9] System according to one of the protection claims 1 to 8, characterized by, that the hash chain module (7) for the first recording (genesis entry) calculates the previous hash as a cryptographic hash concatenated over an empty string with the image hash and provides each entry with a sequentially continued index without gaps. [10] System according to one of the protection claims 1 to 9, characterized by , that the image editing module (4) exports the edited image as a lossless compressed raster image without EXIF ​​metadata and performs the editing with a padding of at least four pixels around each detected area. [11] System according to one of the protection claims 1 to 10, characterized by, that the image editing module (4) has a configurable operating mode in which PII detection and editing can be deactivated, whereby in the deactivated mode the cryptographic evidence preservation is continued unchanged by the forensic evidence chain module (9), so that the system can be operated as a forensic evidence camera without image editing.