METHOD FOR SENDING AND RECEIVING AN IMAGE REPRESENTING AT LEAST ONE OBJECT, ELECTRONIC SENDING AND RECEIVING DEVICES AND COMPUTER PROGRAM PRODUCTS FOR THIS PURPOSE

Description

[0001] The present invention relates to a method for emitting an image representing at least one object. The present invention also relates to a computer program product for implementing such an emission method and an electronic device for emitting an image representing at least one object.

[0002] The present invention also relates to a method for receiving an image. The present invention also relates to a computer program product adapted to implement such a reception method and an electronic device for receiving an image representing at least one object.

[0003] The present invention relates more specifically to the field of encryption and decryption of information contained in an image.

[0004] Public interest in the confidentiality of transmitted information has recently increased significantly, particularly concerning the protection of personal data relating to natural persons.

[0005] As an example, within the European Union, the General Data Protection Regulation (GDPR) illustrates this growing interest.

[0006] This regulation notably imposes confidentiality as a design standard for personal data communication devices.

[0007] Therefore, when transmitting information, it is now recommended that only users authorized to view the transmitted information should have access to said information.

[0008] In the context of video surveillance, it is common practice to transfer images via secure communication channels. However, such communication is complex to implement. Furthermore, it incurs high costs because secure communication channels require specific infrastructure.

[0009] Alternatively, it is known to apply total blurring to the images, transmit them in this state, and communicate only to a chosen recipient a key allowing the image to be completely unblurred.

[0010] However, this all-or-nothing technique only ensures the confidentiality of personal data when the recipient is authorized to view the entire content of the images. Therefore, the confidentiality of personal data is not optimal.

[0011] WO 2019 / 245 680 A1 describes a method of secure video surveillance with privacy features including processing a video stream on a camera device to identify exploitable privacy objects (APOs), extracting coordinates associated with the identified APOs in a metadata stream and masking the identified APOs in the video stream.

[0012] US 2019 / 218407 A1 describes a process in which an image is created by masking certain objects (faces) and storing the masked parts in a metadata file that is encrypted in such a way that it can be decrypted using several different keys, said keys being distributed to authorized users. These decryption keys do not, however, allow selective decryption of the metadata file.

[0013] The present invention aims to provide a simple way to ensure the confidentiality of personal data present on an image during its communication.

[0014] For this purpose, the present invention relates to an emission method according to claim 1.

[0015] With the emission method according to the invention, it is possible to emit an image that protects personal data, while being partially decipherable for a user authorized to view part of its content.

[0016] This effect is achieved in particular through the obfuscation of the identified area(s), as well as through the individual secret key which allows only the decryption of certain pixel values, i.e. of certain area(s).

[0017] According to particular embodiments of the invention, the emission process is, according to any one of claims 2 to 4.

[0018] The present invention also relates to a computer program product according to claim 5.

[0019] The present invention also relates to an electronic transmission device according to claim 6.

[0020] The present invention also relates to a receiving method according to claim 7.

[0021] With the reception method according to the invention, it is possible to decipher only a part of an image for which only certain objects are allowed to be consulted.

[0022] This effect is achieved in particular by the individual secret key, which only allows decryption of a portion of the encrypted message. Thus, the partially reconstructed image preserves the confidentiality of objects that the receiving device is not authorized to view.

[0023] The present invention also relates to a computer program product according to claim 8.

[0024] The present invention also relates to an electronic receiving device according to claim 9.

[0025] The present invention also relates to an electronic communication system according to claim 10.

[0026] The communication system makes it possible to improve the confidentiality of personal data in a simple way.

[0027] These features and advantages of the invention will become apparent upon reading the following description, given solely by way of non-limiting example, and made with reference to the accompanying drawings, in which: there figure 1 is a schematic representation of a communication system according to the invention comprising an electronic transmitting device and at least one electronic receiving device according to the invention; the figure 2 is an example of an image acquired by the electronic emission device of the figure 1 ; there figure 3 is an example of an image with obfuscated area(s) emitted by the electronic emission device of the figure 1 , intended for the electronic receiving device(s) figure 1 ; there figure 4 is an example of a partially reconstructed image obtained by the or one of the electronic receiving devices of the figure 1 ; there figure 5 is a flowchart of an emission process according to the invention, implemented by the electronic emission device of the figure 1 ; and the figure 6 is a flowchart of a reception process according to the invention, implemented by each electronic reception device of the figure 1 .

[0028] With reference to the figure 1 , we describe an electronic communication system 10. The electronic communication system 10 is suitable for being connected to a camera 15.

[0029] The communication system 10 comprises an electronic transmitting device 20 and at least one electronic receiving device 25. In the example of the figure 1 , the communication system 10 includes several receiving devices 25.

[0030] Camera 15, for example, is a CCTV camera in a city street. Camera 15 is designed to capture images of an environment. The images captured by camera 15 may show several objects of interest, also called objects. Objects of interest include, for example, silhouettes of passersby, their faces, and vehicles.

[0031] Thus, each image captured 37 by the camera 15 represents at least one of said objects.

[0032] For example, camera 15 is connected to the transmission device 20 and is capable of sending it the captured images 37.

[0033] The transmission device 20 includes a configuration unit 30 and an encryption unit 35.

[0034] The configuration unit 30 includes a sending module 40 of individual secret key(s) I s, to each receiving device 25. Preferably, the configuration unit 30 further includes a module 42 for acquiring a lookup table, a module 44 for determining a master public key M p and a master secret key M s, and a module 46 for calculating the individual secret key(s) I s.

[0035] The encryption unit 35 includes a module 50 for obtaining at least one respective image 37 from the camera 15, a module 52 for applying obfuscation to parts of the image which will be detailed below, a module 54 for generating an encrypted message and a module 56 for transmitting, to each receiving device 25, elements from the application 52 and generation 54 modules.

[0036] Each receiving device 25 includes a receiving module 60, a module 62 for decrypting the encrypted message and a module 64 for reconstructing an image.

[0037] Each receiving device 25 is associated with a user. In the example shown on the figure 1 The communication system 10 comprises a first 25A, a second 25B, and a third 25C receiving device. The first receiving device 25A is, for example, associated with a security guard monitoring a parking lot entrance. The second receiving device 25B is, for example, associated with a police service. The third receiving device 25 is, for example, associated with an investigating judge. In this example, the security guard is only authorized to view the "vehicle" objects in images 37. The police service is only authorized to view the "silhouette" objects in images 37. Finally, the investigating judge is authorized to view all objects—that is, vehicles, silhouettes, and faces—in image 37.

[0038] Preferably, each receiving device 25 further includes a respective display screen 67.

[0039] The sending module 40 is configured to send, to each receiving device 25, its unique individual secret key Is. To this end, the sending module 40 is configured to send this key Is through a secure channel, for example, a TLS-type channel such as an encrypted and authenticated HTTPS channel.

[0040] Each individual secret key Is is for example stored in the configuration unit 30. Each individual secret key Is is respective to a receiving device 25. In the case where the communication system 10 includes several receiving devices 25, the individual secret keys Is are distinct from each other.

[0041] Each individual secret key I s is unique in enabling decryption of the encrypted message to reveal the objects that the user of the receiving device 25 to which said key I s is sent is authorized to consult.

[0042] In the example described above, the sending module 40 is configured to send a first I s1, a second I s2, and a third I s3 individual secret keys.

[0043] In particular, the sending module 40 is configured to send: to the first receiving device 25A, the first individual secret key I s1, which is suitable for deciphering objects representing vehicles, to the second receiving device 25B, the second individual secret key I s2, which is suitable for deciphering objects representing silhouettes, and to the third receiving device 25C, a third individual secret key I s3, which is suitable for deciphering all objects, i.e. vehicles, silhouettes and faces.

[0044] Optionally, the acquisition module 42 is configured to acquire the lookup table. The lookup table associates, with each receiving device 25, a respective list of object(s) that said receiving device 25 is authorized to consult by decrypting the encrypted message using the respective individual secret key Is. In the example above, the lookup table associates: to the first receiving device 25A, the object "vehicle"; to the second receiving device 25B, the object "silhouette"; and to the third receiving device 25C, the objects "vehicle", "silhouette", and "face".

[0045] The determination module 44 is configured to determine the master public key M p and the master secret key M s. In a manner known per se, the master public key M p is configured to encrypt data which is decryptable using the master secret key M s.

[0046] The master public key Mp and the master secret key Ms are preferably distinct from each other. Thus, the master public key Mp is intended to be accessible to anyone wishing to encrypt data. The master secret key Ms, on the other hand, is kept secret, i.e., confidential, by the configuration unit 30. The master secret key Ms is preferably not communicated to any other electronic device.

[0047] For example, the public master key M p and the secret master key M s are determined randomly.

[0048] The calculation module 46 is configured to calculate, for each electronic receiving device 25, the respective individual secret key I s, for example from the master secret key M s and the list of object(s) associated with the electronic receiving device 25 in the lookup table.

[0049] Calculation module 46, for example, is configured to apply a key generation function of an attribute-based encryption algorithm, also known as the ABE algorithm (from the English Attribute-Based Encryption ) known in itself, in which each attribute is an object. Thus, the calculation module 46 is configured to calculate an individual secret key Is for each receiving device 25 from the objects that said receiving device 25 is authorized to consult in the lookup table.

[0050] The calculation of each individual secret key Is depends on the type of ABE algorithm used. Preferably, the ABE algorithm is chosen from the following: BSW07 described in the article Ciphertext-Policy Attribute-Based Encryption de Bethencourt et AI, CPW08 described in the article Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization de Waters et AI, and AC17 described in the article FAME: Fast Attribute-based Message Encryption de Agrawal et AI.

[0051] Thus, the calculation module 46 is configured to calculate the individual secret key(s) I s, such that each individual secret key I s only allows decryption of the object(s) associated with the corresponding receiving device 25 in the correspondence table.

[0052] "Deciphering an object" means deciphering encrypted pixel values ​​associated with the object, as will be described below.

[0053] The acquisition module 50 is configured to obtain the image 37 representing at least one object, in which one or more areas 70 are identified as representing the object or one of the objects. Each area 70 contains certain pixels from the image 37.

[0054] The expression "some pixels of the image" is understood to mean that only a part of the pixels of the image are contained within each zone 70.

[0055] As is well known, every image is composed of a plurality of elements, for example, pixels. Each pixel is defined by its spatial position in the image and by an n-tuple of values. Each value is called a channel or spectral band.

[0056] For example, the image is an RGB image, in which the n-tuple of values ​​is a triplet of values ​​corresponding to the colors red, green, and blue. Each value in the triplet is, for example, between 0 and 255. The higher the value associated with a color, the darker the pixel's shade of that color. Alternatively, when the image is grayscale, each pixel is associated with a unique value corresponding to a grayscale level. In this case, a maximum value (for example, 255) corresponds to a white pixel, while a minimum value (for example, 0) corresponds to a black pixel, or vice versa.

[0057] According to one embodiment, the acquisition module 50 is configured to acquire, from the camera 15, the image 37 captured by said camera 15.

[0058] There figure 2 represents such an image 37. It is notably visible on the figure 2 that five vehicles, five silhouettes and two faces have been identified.

[0059] The acquisition module 50 is further configured to identify, in the acquired image 37, the area(s) 70 representing the object(s), based on an identification model. The identification model includes, for example, a neural network, preferably a neural network trained to detect the area(s) 70 corresponding to each type of object in the image 37 and to classify each detected area into a plurality of classes, each corresponding to an object. Each of these areas is subsequently referred to as the identified area 70. In a manner known per se, the neural network comprises a plurality of artificial neurons organized in layers. The neural network thus comprises an input layer, one or more hidden or intermediate layers, and an output layer. The neurons of two successive layers are connected to each other by a link comprising an adjustable weight, also called a synaptic weight.

[0060] Preferably, the acquisition module 50 is configured to detect a portion of the acquired image 37, occupied by each object, and to assign it membership in a specific class among the objects in the lookup table.

[0061] Preferably, this detection involves the trained neural network defining a rectangular bounding box around the object. Each bounding box then forms a respective identified area.

[0062] According to an unrepresented variant, the acquisition module 50 is configured to segment the object in the acquired image 37 more precisely by creating masks on these objects, i.e., by assigning a designation to each pixel of the image. Thus, each area identified 70 is formed by all the pixels of the image containing the same designation. It is then understood that the shape of the areas identified 70 according to this variant is not necessarily rectangular.

[0063] The application module 52 is configured to apply obfuscation to the area or each area identified 70, to form an image with obfuscated area(s) 75.

[0064] "Obfuscation" refers to a modification of the value(s) of a set of pixels to camouflage an object represented in the pixels.

[0065] According to an example shown on the figure 3 Obfuscation is a blurring technique. Application module 52, for example, is configured to divide each area identified as 70 into group(s) of several pixels and to calculate, for each group, an average value of the pixel values ​​in that group. Application module 52 is then configured to replace each pixel in each group with a pixel having the calculated average value. If each pixel comprises a triplet of values, the average value is the average of each value in the triplet. Alternatively, blurring involves applying a blurring filter to the areas identified as 70, such as a Gaussian filter.

[0066] Alternatively, obfuscation is a masking that involves replacing each identified area 70 with a shape whose pixels have a predefined color, preferably a monochrome shape, made up for example of black pixels.

[0067] The application module 52 is configured to obtain an image with obfuscated area(s) 75 in which the area or each area identified 70 is modified by the application of the obfuscation and in which the parts of the image not corresponding to an area identified 70 are not impacted by the obfuscation.

[0068] The generation module 54 is configured to generate an encrypted message, also called a secure message, containing the pixel values ​​of each identified area 70 in the image 37 obtained by the acquisition module 50. The pixel values ​​in the encrypted message are encrypted. For this purpose, the generation module 54 is configured, for example, to store the pixel values ​​corresponding to the identified area(s) 70 in the obtained image 37 in a message. The message is, for example, a database.

[0069] In particular, the generation module 54 is configured so that the message includes, for each identified area 70, several data fields. For each identified area 70, a first data field contains the position of said area 70 in the image 37. For each identified area 70, a second data field contains the pixel values ​​of said area 70. The first and second data fields are, for example, ordered so that the message includes, for each identified area 70, the first data field relating to the identified area 70, then the second data field relating to said identified area 70.

[0070] Preferably, the message also includes, for each identified zone 70, a third data field with a first string of characters indicating the object represented in said zone 70. For example, for each identified zone 70, the third data field is located, in the message, between the first and second data fields.

[0071] In the example described above, the message includes the first data field containing the position of a zone 70 in the image 37, then the third data field containing a first respective string of characters "face", then the second data field containing the pixel values ​​ordered in a predefined way, corresponding to the zone 70 representing a face in the image 37.

[0072] The generation module 54 is further configured to apply an encryption algorithm to the message pixel values, using the master public key Mp, to form the encrypted message. The encrypted pixel values ​​in the encrypted message, associated with each identified area 70, form a "ciphertext." Thus, it is understood that the encrypted, or secure, message includes a ciphertext for each identified area 70.

[0073] In particular, generation module 54 is configured, for example, to apply the encryption algorithm only to the content of the second data field in the message. In other words, the content of the first data field, and optionally the content of the third data field, are not encrypted by the encryption algorithm. More specifically, generation module 54 is configured, for example, to encrypt pixel values ​​as follows.

[0074] The determination module 54 is configured to apply an encryption algorithm to each set of pixel values ​​based on the master public key M p and optionally an encryption policy. The encryption algorithm depends on the applied ABE algorithm, such as BSW07, CPW08, or AC17, as described previously.

[0075] The encryption policy associates with each identified zone 70 a logical relationship depending on the object(s) represented in the identified zone 70, and for example context element(s), from the correspondence table.

[0076] Each logical relation can typically be formulated, according to Boolean algebra, by a logical equation containing at least one operand and possibly one or more operators. Each operand is an object in the lookup table and / or a context element. Each operator is preferably chosen from the following operators: "AND" and "OR".

[0077] Thus, for example, in the case of two overlapping objects in image 37, an area identified as 70 partially encompasses another identified area, the policy includes a logical relationship associated with the partially encompassed area of ​​the type "first object AND second object" or of the type "first object OR second object";

[0078] When the logical relationship is of the type "first object AND second object", the pixels of said partially enclosed area 70 are encrypted so that only a receiving device 25 having an individual secret key corresponding to the first object and the second object can decrypt these pixels.

[0079] When the logical relationship is of the type "first object OR second object", the pixels of said partially enclosed area are encrypted so that only a receiving device 25 having an individual secret key corresponding to the first object or the second object can decrypt these pixels.

[0080] We understand that the third data field includes the logical relationship associated with the corresponding identified zone 70, in the encryption policy.

[0081] The transmitting module 56 is configured to transmit, to each receiving device 25, the image with obfuscated area(s) 75 and the encrypted message. Preferably, the encrypted message is included in the metadata of the transmitted image with obfuscated area(s) 75.

[0082] It is then understood that a third party intercepting the image with obfuscated area(s) 75 and the encrypted message emitted by the transmission module 56, is not able to consult the objects of the identified areas 70 in the acquired image 37, i.e. the objects whose pixel values ​​have been encrypted in the encrypted message.

[0083] In addition, the image with obfuscated area(s) 75 and the encrypted message are transmitted, for example, over an unsecured channel, without any risk to the confidentiality of personal data being incurred.

[0084] For each receiving device 25, its receiving module 60 is configured to receive, from the transmitting device 20, and in particular from the transmitting module 56 of the encryption unit 35, the image with obfuscated area(s) 75 and the encrypted message. The receiving module 60 is further configured to receive, from the transmitting device 25, and more specifically from the configuration unit 30, its unique individual secret key Is.

[0085] The decryption module 62 is configured to apply a decryption algorithm to the encrypted pixel values ​​of the encrypted message from the received individual secret key Is, to obtain a partially decrypted message.

[0086] In particular, the decryption module 62 is configured to use a decryption algorithm that uses the individual secret key Is. For example, the decryption module 62 is configured to also use the public master key Mp. The decryption algorithm used depends on the ABE algorithm that was used to generate the individual secret key Is. This algorithm is known, for example, to each receiving module 25, through the reception of the individual secret key Is.

[0087] As an example, the decryption module 62 is configured to apply the decryption algorithm to all pixel values ​​in the encrypted message, i.e., to the content of the second data field(s) in the message. In this case, the decryption module 62 is configured to obtain, for the area(s) 70 representing one or more objects that the associated receiving device 25 is authorized to view, the pixel values ​​of the identified area 70 corresponding to those of the image acquired 37 by the transmitting device 20.

[0088] For zones 70 corresponding to objects that the receiving module 25 is not allowed to consult, the decryption algorithm fails to decipher the pixel values ​​and returns an error message.

[0089] Alternatively, for these zones 70, the pixel values ​​obtained following the application of the decryption algorithm are distinct from those of these zones 70 in the acquired image 37. In other words, the pixel values ​​corresponding to zones 70 for which the receiving device 37 is not allowed to consult the represented object, form a noisy signal, for example unintelligible content in the partially decrypted message.

[0090] It is then understood that the expression "partially decrypted message" refers to the fact that the application of the decryption algorithm does not necessarily allow the entire encrypted message to be decrypted, but only the parts corresponding to the zone(s) representing the object(s) that the receiving device 25 is authorized to consult.

[0091] The reconstruction module 64 is configured to reconstruct a partially reconstructed image 77 by replacing in the image with obfuscated area(s) 75, the pixel values ​​of the areas with the pixel values ​​of the corresponding areas in the partially deciphered message.

[0092] The partially reconstructed image 77 is such that the areas corresponding to objects that the receiving device 25 is allowed to view are the same as those 70 of the image 37 acquired by the transmitting device 20 from the camera 15. The other areas 70 are not deciphered and therefore include pixels with a value(s) distinct from those in the image acquired 37 by the transmitting device 20. For example, these values ​​form an unintelligible noisy signal.

[0093] An example of a partially reconstructed image 77 obtained by the first receiving device 25A is illustrated on the figure 3 As depicted on the figure 3 , among the objects "vehicle", "silhouette" and "face" only the "vehicle" objects are visible.

[0094] Preferably, the reconstruction module 64 is further configured to transmit the partially reconstructed image 77 to the display screen 67 of said receiving device 25, for display to the user of said receiving device 25.

[0095] According to one variant, the decryption module 62 is configured so that, if the ciphertext received by the receiving module 60 includes, for each zone 70, the third data field, it applies the decryption algorithm only to the pixel values ​​associated with the third data field containing a first string of characters indicating an object that the receiving device 25 is authorized to access, within the ciphertext. According to this variant, the reconstruction module 64 is configured to replace, in the image with obfuscated zone(s) 75, only the pixel values ​​of the zone(s) 70 containing pixel values ​​to which the decryption algorithm has been applied.

[0096] In the example of the figure 1 The configuration unit 30 comprises a first information processing unit, for example, consisting of a first memory 80 and a first processor 82 associated with the first memory 80. The sending module 40, and optionally the acquisition module 42, the determination module 44, and the calculation module 46, are each implemented as a software program, or a software component, executable by the first processor 82. The first memory 80 is thus capable of storing sending software and optionally acquisition software, determination software, and calculation software. The first processor 82 is then capable of executing each of these programs.

[0097] Continuing with the example of the figure 1 The encryption unit 35 includes a second information processing unit, for example, consisting of a second memory 85 and a second processor 87 associated with the second memory 85. The acquisition module 50, the application module 52, the generation module 54, and the transmission module 56 are each implemented as software, or a software component, executable by the second processor 87. The second memory 85 is thus capable of storing acquisition software, application software, generation software, and transmission software. The second processor 87 is then capable of executing each of these programs.

[0098] Continuing with the example of the figure 1 Each receiving device 25 includes a third information processing unit, for example, consisting of a third memory 90 and a third processor 92 associated with the third memory 90. The receiving module 60, the decryption module 62, and the reconstruction module 64 are each implemented as software, or a software component, executable by the third processor 92. The third memory 90 is thus capable of storing receiving software, decryption software, and reconstruction software. The third processor 92 is then capable of executing each of these programs.

[0099] In an alternative not shown, at least one of the following is implemented: the sending module 40, the obtaining module 50, the application module 52, the generation module 54, the transmitting module 56, the receiving module 60, the decryption module 62, the reconstruction module 64, and optionally the acquisition module 42, the determination module 44, the calculation module 46, is implemented as a programmable logic component, such as an FPGA (from the English Field Programmable Gate Array ), or in the form of a dedicated integrated circuit, such as an ASIC (from the English Application Specific Integrated Circuit ).

[0100] When the configuration unit 30, the encryption unit 35, and each receiving device 25 are implemented as one or more software programs, i.e., as a computer program, they are also capable of being stored on a computer-readable medium (not shown). A computer-readable medium is, for example, a medium capable of storing electronic instructions and being connected to a bus of a computer system. Examples of such a readable medium include an optical disc, a magneto-optical disc, ROM, RAM, any type of non-volatile memory (e.g., EPROM, EEPROM, FLASH, NVRAM), a magnetic card, or an optical card. A computer program containing software instructions is then stored on the readable medium.

[0101] The operation of communication system 10 will now be described.

[0102] First, the operation of the emission device 20 will be described with reference to the figure 5 representing a flowchart of an emission process 100 according to the invention.

[0103] The 100 emission process includes a configuration phase 110 and an encryption phase 120.

[0104] Preferably, the configuration phase 110 is implemented prior to the encryption phase 120.

[0105] Initially, an operator of the transmitting device 20 creates the lookup table and sends it to the configuration unit 30.

[0106] Optionally, the configuration phase 110 includes an acquisition step 112 during which the acquisition module 42 acquires the lookup table from the operator.

[0107] Optionally, the configuration phase 110 includes a determination step 114 during which the determination module 44 determines the master public key M p and the master secret key M s, for example randomly.

[0108] Optionally, the configuration phase 110 then includes a step 116 of calculating the individual secret keys Is specific to each receiving device 25, from the lookup table indicating, for each receiving device 25, the object(s) it is authorized to consult. Preferably, each individual secret key is calculated from the master secret key Ms, the objects in the lookup table, and an ABE algorithm as described above.

[0109] The configuration phase 110 further includes a step 118 of sending, to each receiving device 25, its unique individual secret key Is. For this, the sending module 70 preferentially uses a secure channel of the TLS type, such as an encrypted and authenticated HTTPS channel.

[0110] Alternatively, each individual secret key Is is already stored in the configuration unit 30. According to this alternative, the configuration phase 110 includes only the sending step 118.

[0111] The encryption phase 120 includes a step 121 of obtaining the image 37 comprising at least one area 70 identified as representing respectively an object.

[0112] The acquisition step 121 preferably includes a sub-step 122 of acquisition, from the camera 15, of the image 37.

[0113] Then, acquisition step 121 preferentially includes a substep 123 of identification, in the acquired image 37, of the areas 70 representing each object.

[0114] For example, during the identification substep 123, the acquisition module 50 applies, to the acquired image 37, the identification model including the neural network described previously, to identify each area 70.

[0115] The encryption phase 120 further includes an application step 124, during which the application module 52 applies obfuscation to each identified area 70 to form the image with obfuscated area(s) 75. The image with obfuscated area(s) 75 includes, in each identified area 70, pixels whose value is distinct from the value of the same pixels in the acquired image 37.

[0116] The encryption phase 120 further includes a step 125 of generating the encrypted message.

[0117] The generation step 125 preferably includes a storage substep 126 and an encryption application substep 127.

[0118] During the storage substep 126, the generation module 54 stores, for each identified area 70, the pixel values ​​of the acquired image 37, in the message. The message is preferably a database.

[0119] Advantageously, the message then includes, for each identified area 70 in the acquired image 37: the first data field containing the position of said area 70 in the acquired image 37 and the second data field containing the pixel values ​​in the acquired image 37. For each identified area 70, the first data field is preferentially placed, in the message, before the second data field.

[0120] During the encryption application substep 127, the generation module 54 applies to the message pixel values, the encryption from the master public key M p and the encryption policy as previously stated.

[0121] At the end of the 127 encryption application substep, all pixel values ​​of the message are encrypted, thus forming the encrypted message.

[0122] The encryption phase 120 further includes a transmission step 128 during which the transmission module 56 transmits, to each receiving device 25, the image with obfuscated area(s) 75 and the encrypted message.

[0123] For example, the encrypted message is included in the image metadata with obfuscated area(s) 75.

[0124] For example, transmission step 128 is carried out via a standard and unsecured communication channel.

[0125] For example, all steps 121, 124, 125, 128 of the encryption phase 120 are repeated for a plurality of images 37 forming a video stream. Thus, for each image 37 of the video stream, the encryption unit 35 successively implements each of the steps of obtaining 121, applying 124, generating 125 and transmitting 128.

[0126] According to another example, for each image 37 forming the video stream, the encryption unit successively implements only the acquisition 121, application 124 and generation 125 steps. The encryption phase 120 then includes a single transmission 128 step for the entirety, i.e. the whole, of the images with obfuscated area(s) 75 and associated encrypted messages.

[0127] For example, the configuration phase 110 and the encryption phase 120 are implemented successively as described previously.

[0128] Alternatively, the configuration phase 110 and the encryption phase 120 are implemented in parallel. In this case, it is still preferable for the determination phase 114 to be implemented prior to the generation phase 125 so that, during the application sub-phase 127, the master public key Mp has already been determined.

[0129] Secondly, the operation of each receiving device 25 will be described with reference to the figure 6 describing a reception method 200, according to the invention, implemented by each reception device 25.

[0130] The reception process 200 includes a reception step 210. During the reception step 210, the receiving module 60 receives, from the transmitting device 20, its own individual secret key I s, the image with obfuscated area(s) 75 and the encrypted message.

[0131] The reception 210 of the individual secret key I s and the reception of the image with obfuscated area(s) 75 are preferentially not carried out at the same times.

[0132] Advantageously, the receiving module 60 receives its own individual secret key Is from the sending module 40, via the secure channel.

[0133] For example, the receiving module 60 receives the image with obfuscated area(s) 75 and the encrypted message from the transmitting module 56, via the unsecured channel.

[0134] The individual secret key I is received before or after the image with obfuscated area(s) 75 and the encrypted message.

[0135] Preferably, the encrypted message is a database.

[0136] Then, the reception process 200 includes a decryption step 220 during which the decryption module 62 applies the decryption algorithm to the encrypted message, from the individual secret key I s, received to obtain the partially decrypted message.

[0137] For example, decryption module 62 applies the decryption algorithm to all values ​​of the encrypted pixels of the encrypted message.

[0138] During the decryption step 220, the application of the decryption algorithm makes it possible to obtain, for the identified area(s) 70 representing an object that the receiving device 25 is authorized to consult, the pixel values ​​of said areas 70 in the acquired image 37. For the other area(s) where applicable, the application of the decryption algorithm provides pixel values ​​distinct from those in the acquired image 37.

[0139] In other words, applying the decryption algorithm only allows the decryption of pixel values ​​in the zone(s) 70 representing the object(s) that the receiving device 25 is authorized to access. For pixel values ​​in the other zone(s) 70, applying the decryption algorithm provides pixel values ​​that do not represent any intelligible content.

[0140] The decryption process 200 then includes a reconstruction step 230 during which the reconstruction module 64 reconstructs the partially reconstructed image 77. For this, the reconstruction module 64 replaces, in the image with obfuscated area(s) 75, the pixel values ​​of the obfuscated area(s) with the corresponding pixel values ​​of the partially decrypted message, to form the partially reconstructed image 77.

[0141] Preferably, during the replacement step 230, the reconstruction module 64 sends the partially reconstructed image 77 to the display screen 67 of the receiving device 25.

[0142] Thus, the user of the receiving device 25 viewing the partially reconstructed image 77 only has access to the objects of the acquired image 37 that he is authorized to view, the other object(s) not being represented in the partially reconstructed image 77.

[0143] The reception process 200 is, for example, iterated for a plurality of images with obfuscated area(s) 77 and associated encrypted messages. The individual secret key Is is preferentially received only once.

[0144] According to a first variant, the encrypted message also includes, for each identified zone 70, the third data field containing the first string of characters indicating the object represented in said zone 70. For example, if a zone 70 represents a face, the encrypted message includes the first data field indicating the position of said zone in the acquired image, the third data field containing the first string of characters "face" and the second data field containing the values ​​of the pixels of said zone 70 which have been encrypted.

[0145] According to this first variant, during the decryption step 220, the decryption module 62 applies the decryption algorithm only to the pixel values ​​associated with the third data field containing a string of characters corresponding to an object that the receiving device 25 is allowed to consult.

[0146] According to this first variant, during the replacement step 230, the reconstruction module 64 replaces, in the image with obfuscated area(s) 75, only the pixels of the area(s) 70 for which the decryption algorithm was applied by the decryption module 62. According to this variant, the area(s) of the partially reconstructed image 77 distinct from the area(s) representing an object that the receiving device 25 is allowed to consult, are identical to those of the image with obfuscated area(s) 75.

[0147] According to a second variant, the receiving module 60 receives several images with obfuscated area(s) 75 and the corresponding encrypted messages before implementing the decryption steps 220 and reconstruction steps 230. According to this second variant, the individual secret key I s is for example received before and / or after the reception of all the images with obfuscated area(s) 77 and corresponding encrypted messages.

[0148] According to a third variant not shown, the communication system 10 comprises several cameras 15. According to this third variant, each individual secret key IS is suitable for deciphering only pixel values ​​corresponding to an area 70 representing one or more objects and coming from one or more selected cameras 15.

[0149] For example, the communication system 10 includes a first camera 15 capturing images in front of a first parking lot entrance, and a second camera 15' capturing images in front of a second parking lot entrance. The communication system 10 includes a first receiving device 25A associated with a first security guard monitoring the first entrance and a first receiving device 25A' associated with a second security guard monitoring the second entrance.

[0150] In this example, the first receiving device 25A associated with the first guard is authorized to consult only the "vehicle" objects captured by the first camera 15, while the first receiving device 25A' associated with the second guard is authorized to consult only the "vehicle" objects captured by the second camera 15'.

[0151] Depending on the optional configuration in which the configuration unit 30 includes the acquisition module 42, the determination module 44, and the processing module 46, the lookup table then associates, with each receiving device 25, the respective list of object(s) and, for each object, the camera(s) 15 from which the images 37 representing that object originate. Thus, in this example, the lookup table associates: to the first receiving device 25A associated with the first guard, the object "vehicle" from the first camera 15, 15', to the first receiving device 25A' associated with the second guard, the object "vehicle" from the second camera 15, 15', to the second receiving device 25B associated with the police service, the object "silhouette" from each camera 15, 15', and to the third receiving device 25C associated with the investigating judge, the objects "vehicle", "silhouette" and "face" from each camera 15, 15'.

[0152] The calculation module 46 is then configured to calculate each individual secret key I s based on the list of object(s) and also on the camera 15, 15' from which image 37 originates.

[0153] The acquisition module 50 is configured to obtain at least one respective image 37 from each camera 15, 15', each image 37 having one or more identified areas 70.

[0154] Application module 52 is then configured to apply masking to each identified area 70 of each image 37.

[0155] The generation module 54 is configured to generate a respective encrypted message for each image 37.

[0156] Alternatively, the generation module 54 is configured to generate a single encrypted message for a set comprising an image 37 from each camera 15, 15'. Each logical relation of the encryption policy then combines the object(s) represented in the identified area 70 and a context element which is the camera 15, 15' from which the image 37 associated with the identified area 70 originates.

[0157] The transmitting module 56 is configured to transmit, to each receiving device 25, each image with obfuscated area(s) 75 and the encrypted message(s).

[0158] According to this third variant, the decryption module 62 is configured so that, if the receiving module 60 has received an encrypted message for each image with obfuscated area(s) 75, then it applies the decryption algorithm to each encrypted message corresponding to a camera 15, 15' for which the receiving device 25 is authorized to view at least one object. The decryption module 62 is configured so that, if the receiving module 60 has received only one encrypted message for all the images with obfuscated area(s) received 75, then it applies the decryption algorithm only to the pixel values ​​for which the individual secret key Is is associated with at least one object and / or context element(s) satisfying the logical relationship of the third data field.

[0159] According to this variant, the reconstruction module 64 is configured so that, if an image-ciphered message with obfuscated area(s) 75 is received, it then replaces the pixel values ​​of each obfuscated area of ​​each received image 75 with the pixel values ​​of the associated partially decrypted message.

[0160] The reconstruction module 64 is configured so that, if an encrypted message is received for all images with obfuscated area(s) 75, it then replaces in each image with obfuscated area(s) 75, the pixel values ​​of each obfuscated area with the decrypted pixel values ​​of the partially decrypted message.

[0161] According to this third variant, the emission process is identical to emission process 100 described previously, with the following differences.

[0162] During the optional calculation step 116, the calculation module 46 calculates the individual secret key Is associated with each receiving device 25, also taking into account the camera or cameras 15 for which the receiving device 25 is authorized to view the objects.

[0163] During acquisition step 121, the acquisition module 50 obtains a respective image 37 with one or more identified areas 70, for each camera 15, 15'. Preferably, acquisition step 121 includes the acquisition substeps 122 and identification substeps 123 which are implemented for each image 37.

[0164] The application step 124 is applied to each image 37 to form, for said image 37, an image with respective obfuscated area(s) 75.

[0165] During generation step 125, generation module 54 generates a respective encrypted message per image 37 as described previously, or an encrypted message for all images 37. In the latter case, the third data field of the encrypted message then includes the logical relationship associated with the object(s) represented in the identified area 70 and the context element(s) of the encryption policy.

[0166] During the transmission step 128, the transmission module 56 transmits, to each receiving device 25, the images with obfuscated area(s) 75 and the encrypted message(s).

[0167] The acceptance process 200 according to this variant embodiment is identical to the acceptance process 200 described previously with the following differences.

[0168] During the reception step 210, the receiving module 60 receives each image with obfuscated area(s) 75 and the encrypted message(s).

[0169] The 220 decryption step is implemented for the encrypted message or messages to obtain one or more partially decrypted messages.

[0170] If an encrypted message for each image with obfuscated area(s) 75 has been received, the reconstruction step 230 is iterated for each partially decrypted message, i.e. for each image with obfuscated area(s) 75.

[0171] If an encrypted message has been received for all images with obfuscated area(s) 75, during reconstruction step 230, the reconstruction module 64 replaces, for each image with obfuscated area(s) 75, the pixel values ​​of each obfuscated area with the decrypted pixel values ​​of the partially decrypted message.

[0172] The first and second variants described above can be combined with the third variant described above.

[0173] With the emission method 100 according to the invention, it is possible to emit an image that protects personal data, while being partially decipherable for a user authorized to view part of its content.

[0174] With the reception method 200 according to the invention, it is possible to decipher only a part of an image for which only certain objects are allowed to be consulted.

[0175] Thus, the transmission 100 and reception 200 processes according to the invention make it possible to improve the confidentiality of personal data.

Claims

1. A method of transmission (100), from an electronic transmitter device (20) to several electronic receiver devices (25), an image (37) representing several objects, the transmission method (100) being implemented by the electronic transmitter device (20) and comprising a configuration phase (110) including the following step: - acquisition (112) of a lookup table, the lookup table associating with each electronic receiver device (25) a respective list of object(s) that said electronic receiver device (25) is authorized to consult by decrypting the encrypted message, on the basis of said individual secret key (Is), - determination (114) of a master public key (Mp) and of a master secret key (Ms), - calculation (116), for each electronic receiver device (25), of the respective individual secret key (Is) from the master secret key (Ms) and the list of object(s) associated with said electronic receiver device (25) in the lookup table, - sending (118) to each electronic receiver device (25) a respective individual secret key (Is), the method (100) further comprising an encryption phase (120) including the following steps: - acquiring (121) the image (37) representing the objects, wherein one or a plurality of zones (70) including certain pixels of the image are identified, each identified zone (70) representing one of the objects, - applying (124) an obfuscation to the or each zone (70) of the image (37), so as to form an image with obfuscated zone(s) (75), - generating (125) an encrypted message comprising pixel values of the zones in the resulting image, wherein said values are encrypted, the pixel values being encrypted on the basis of the master public key (Mp), the generatiing step (125) comprising the following sub-steps: ∘ storage (126), in a message, of pixel values corresponding to the zone(s) identified in the image, ∘ application (127) of an encryption algorithm to the values of the pixels of the message from the master public key (Mp) and an encryption policy, so as to form the encrypted message, the encryption policy associating with each identified zone (70) a logical relation depending on the object or the objects represented in said zone, - transmitting (128) to the or each electronic receiver device (25), the image with obfuscated zone(s) (75) and the encrypted message for at least partial decryption, by each electronic receiver device (25) in order to reconstruct a partially reconstructed image (77) associated with the electronic receiver device (25), wherein each individual secret key (Is) is calculated from the lookup table by applying a key generation function of an attribute encryption algorithm.

2. The method (100) according to claim 1, wherein the acquiring step (121) comprises the following sub-steps: - acquisition (122) of the image (37), and - identification (123) in the acquired image of zone(s) (70) representing each object from an identification model, the identification step (123) being preferentially implemented by an identification model comprising more preferentially a neural network.

3. The method (100) according to claim 1 or 2, wherein the encryption algorithm is chosen from the group consisting of: - the BSW07 algorithm, - the CPW08 algorithm, and - the AC17 algorithm.

4. The method (100) according to any of the preceding claims, wherein the obtained image (37) comes from a camera (15, 15') chosen from a predefined list of cameras (15, 15'), the lookup table associating, for each electronic receiver device (25), for each object, one or a plurality of cameras (15, 15') suitable for taking images for which the electronic receiver device (25) is authorized to consult said object, the or each individual secret key (Is) further depending on the camera or cameras (15, 15') associated with the corresponding electronic receiver device (25) in the lookup table.

5. A transmission computer program product comprising software instructions which, when executed, implement a transmission method (100) according to any of the preceding claims.

6. An electronic transmitter device (20) for transmitting to several electronic receiver devices (25), an image (37) representing several objects among a predefined list of objects, the electronic transmitter device (20) comprising a configuration unit (30) comprising: - an acquisition module (42) configured to acquire a lookup table, the lookup table associating with each electronic receiver device (25), a respective list of object(s) that said electronic receiver device (25) is authorized to consult by decrypting the encrypted message, on the basis of said individual secret key (Is), - a determination module (44) configured to determine a master public key (Mp) and a master secret key (Ms), and - a calculation module (46) configured to calculate the respective individual secret key (Is) from the master secret key (Ms) and from the list of object(s) associated with said electronic receiver device (25) in the lookup table, - a sending module (40) configured to send to the or each electronic receiver device (25), a respective individual secret key (Is), the electronic transmitter device (20) further comprising at least one decryption unit (35) including: - an acquisition module (50) configured to acquire the image (37) representing the objects, wherein one or more zones (70) including certain pixels of the image are identified, each identified zone (70) representing one of the objects, - an application module (52) configured to apply a masking to the or each zone (70) of the image (37), to form an image with obfuscated zone(s), - a generator module (54) configured to generate an encrypted message comprising values of pixels of the zones (70) in the obtained image (37), wherein said values are encrypted, the values of the pixels being encrypted from a master public key (Mp), the generator module (54) being configured for: ∘ storing, in a message, of pixel values corresponding to the zone(s) identified in the image, ∘ applying an encryption algorithm to the values of the pixels of the message from the master public key (Mp) and an encryption policy, so as to form the encrypted message, the encryption policy associating with each identified zone (70) a logical relation depending on the object or the objects represented in said zone, - a transmission module (56) configured to transmit, to each electronic receiver device (25), the image with obfuscated zone(s) (75) and the encrypted message for at least the partial decryption thereof, by each electronic receiver device (25), so as to reconstruct a partially reconstructed image (77) associated with the respective electronic receiver device (25), wherein each individual secret key (Is) is calculated from the lookup table by applying a key generation function of an attribute encryption algorithm.

7. A method of reception (200), by an electronic receiver device (25) and from an electronic transmitter device (20) according to claim 6, of an image (75) with at least one obfuscated zone suitable for representing an object from a predefined list of object(s), the method (200) being implemented by an electronic receiver device (25) and comprising the following steps: - reception (210) of the image with obfuscated zone(s) (75), of an encrypted message comprising encrypted pixel values, and of an individual secret key (Is) associated with the electronic receiver device (25), the individual secret key (Is) being suitable for decrypting only the encrypted pixel values corresponding to one or a plurality of zones of the image with obfuscated zone(s) (75) representing objects which the electronic receiver device (25) is authorized to consult, - decryption (220), on the basis of a decryption algorithm and the received individual secret key (Is), of the encrypted pixel values of the encrypted message, so as to acquire a partially decrypted message, and - reconstruction (230) of a partially reconstructed image (77), by replacing the obfuscated zone(s) of the image with obfuscated zone(s) (75) by pixels the values of which are comprised in the partially decrypted message, at least one zone of the partially reconstructed image (77) representing an object that the electronic receiver device (25) is authorized to consult.

8. A reception computer program comprising software instructions which, when executed by a computer, implement a reception method (200) according to the preceding claim.

9. An electronic receiver device (25) for receiving, from an electronic transmitter device (20) according to claim 6, an image (75) with at least one obfuscated zone suitable for representing an object, the electronic receiver device (25) comprising: - a reception module (60) configured to receive the image with obfuscated zone(s) (75), an encrypted message comprising encrypted pixel values, and an individual secret key (Is) associated with said electronic receiver device (25), the individual secret key (Is) being apt to decrypt only the encrypted pixel values corresponding to one or a plurality of zones of the image with obfuscated zone(s) (75) representing objects that the electronic receiver device (25) is authorized to consult, - a decryption module (62) configured to decrypt, from a decryption algorithm and the received individual secret key (Is), the encrypted pixel values of the encrypted message in order to acquire a partially decrypted message, and - a reconstruction module (64) configured to reconstruct a partially reconstructed image (77) by replacing the obfuscated zone(s) of the image with obfuscated zone(s) (75) by pixels the values of which are comprised in the partially decrypted message, at least one zone of the partially reconstructed image (77) representing an object that the electronic receiver device (25) is authorized to consult.

10. An electronic communication system (10) comprising an electronic transmitter device (20) and several electronic receiver devices (25), wherein the electronic transmitter device (20) is according to claim 6 and each electronic receiver device (25) is according to claim 9.