Secure image capture system

Abstract

The invention relates to a secure image capture system (10) of a scene (Sc) comprising: -at least one first camera (CA1), -at least one first light source (S1), -a measuring device (DMI), -a processing unit (TU) configured: -to drive said at least one first source and determine a time sequence of illumination (TSI), -to drive said first camera so that the first camera acquires at least one image of said scene, -the processing unit being further configured to: -randomly determine said transition times of the time sequence of illumination, -drive the light parameter measuring device during said time sequence of illumination, and -check the temporal consistency between said time sequence of illumination and measurements of the light parameter, from a time offset, an abnormal offset indicating an attempt to deceive said image capture system.Figure to be published: Figure 1.

Description

Title of the invention: Secure image capture system FIELD OF THE INVENTION

[0001] The present invention relates to a secure image capture system. By secure is meant the fact that the system is capable of detecting an attempt to deceive it, typically by presenting it with false images. This secure system finds applications, for example, in the fields of video surveillance or element recognition, such as facial recognition or any other object presented to the image capture system. STATE OF THE ART

[0002] In a known manner, an image sensor system for the aforementioned applications comprises one or more cameras positioned in a suitable manner to image a scene of interest. It is also known that it is possible to deceive this system. Several means can be used, such as, for example, putting a photo of the scene being monitored or of the object to be recognized in front of the camera. A list of threats relating to video surveillance systems is detailed in particular in the publication entitled "Security of CCTV and Video Surveillance Systems: threats, vulnerabilities, attacks and Mitigations" by Andrei Costin, TrustED' 16, October 2016 (Vienna).

[0003] Even if certain threats are known, it turns out that the solutions to remedy them are not always effective and not always easy to implement.

[0004] Generally speaking, there is no simple solution for analyzing a scene and ensuring the veracity of the scene captured by the system's camera.

[0005] An aim of the present invention is to remedy the aforementioned drawbacks by proposing a secure image capture system, capable of effectively detecting an attempted deception, relatively easy to implement and inexpensive. DESCRIPTION OF THE INVENTION

[0006] The present invention relates to a secure system for capturing images of a scene comprising:

[0007] -at least one first camera configured to image said scene so as to acquire images called acquired images,

[0008] -at least one first light source configured to illuminate the scene according to a first plurality of states,

[0009] - a measuring device configured to measure a light parameter from the scene,

[0010] - a processing unit configured:

[0011] -to control said at least one first source and determine an illumination time sequence during which said at least one first source illuminates the scene according to successive ordered states chosen from the first plurality of states, the time sequence comprising a plurality of instants, called transition instants, a transition instant corresponding to a change between one state and another state,

[0012] -to control said first camera so that the first camera acquires at least one image of said scene during said illumination time sequence,

[0013] -the processing unit being further configured to:

[0014] - randomly determining said transition instants of the illumination time sequence,

[0015] -control the device for measuring the light parameter during said illumination time sequence, and

[0016] -checking the temporal coherence between said illumination time sequence and measurements of the light parameter, from a time shift between a change in state of the source controlled by the processing unit and a change in value of said light parameter, an abnormal shift reflecting an attempt to deceive said image capture system.

[0017] According to one embodiment, the time shift is considered abnormal when it is outside a detection interval having a lower threshold and an upper threshold, said thresholds being determined from a so-called normal shift determined by the processing unit as a function of system parameters.

[0018] According to one embodiment, the time shift is determined between said transition instant associated with a change in state of the source and an instant representative of a change in value of the measured light parameter following said change in state.

[0019] Preferably, the light parameter is the light intensity.

[0020] According to one variant, the measuring device is a photodetector.

[0021] According to another variant, the measuring device comprises a pixel or a group of pixels of a matrix detector of the first camera.

[0022] According to one embodiment, a state corresponds to a value of the measured parameter, the values ​​associated with said states all being different, and the measuring device has a sensitivity adapted to discriminate the two closest values ​​of the light parameter.

[0023] According to one embodiment, the processing unit is further configured to control the spatial coherence of acquired images by comparison between a content of the acquired images and said chosen states.

[0024] According to one embodiment, said first plurality of states comprises:

[0025] - a so-called ON state in which the source illuminates the scene and a so-called OFF state in which the source is off, and / or

[0026] -a plurality of light intensities (II, 12, 13), and / or

[0027] -a plurality of illuminations at a plurality of wavelengths or spectral bands, said pluralities of wavelengths or spectral bands being produced where appropriate with a plurality of sources, and / or

[0028] -a plurality of illuminations through a plurality of associated patterns (M1, M2) projected onto the scene.

[0029] According to one embodiment, the processing unit is configured to randomly determine the chosen states and their order in the illumination time sequence.

[0030] According to one embodiment, the processing unit is secure.

[0031] According to one embodiment, the first source emits at least one length wavelength included in the infrared range and called IR wavelength, the first camera being sensitive in the infrared range and comprising a filter at said IR wavelength, the system further comprising a second camera sensitive in the visible range, and in which the processing unit is configured to control the spatial coherence of acquired images, by comparison between images acquired in the infrared and images acquired in the visible range.

[0032] According to one application, the system according to the invention is used for the recognition of an element included in the scene, the processing unit comprising data relating to a reference element to be recognized, called identification data. The processing unit is further configured to, once the temporal coherence has been checked, compare at least one image of the scene comprising said element acquired by the first camera with said identification data.

[0033] According to another application, the system according to the invention is used for monitoring the scene, the illumination time sequence being repeated over time.

[0034] According to another aspect, the invention relates to a secure method for capturing images of a scene by at least one first camera, the scene being illuminated according to a temporal illumination sequence during which at least one first source illuminates the scene according to successive ordered states chosen from a first plurality of states, the temporal sequence comprising a plurality of instants, called transition instants, a transition instant corresponding to a change between one state and another state, the method comprising the steps consisting of:

[0035] -To randomly determine said transition times,

[0036] -B illuminate the scene with said at least one first light source and according to the illumination time sequence,

[0037] -C acquire images with said at least one first camera during the illumination time sequence,

[0038] -D measure a light parameter from the scene during at least part of the illumination time sequence, and

[0039] -E control the temporal coherence between said illumination time sequence and measurements of the light parameter, from a time shift between a change in state of the source controlled by the processing unit and a change in value of said light parameter, an abnormal shift reflecting an attempt to deceive said image capture system.

[0040] According to one embodiment, the method further comprises a calibration step consisting of acquiring at least one image of the scene and carrying out at least one measurement of the light parameter with said at least one source switched off.

[0041] According to one embodiment, the method according to the invention is implemented for monitoring the scene, steps A to E being repeated over time.

[0042] According to another aspect, the invention relates to a method for recognizing an element included in the scene comprising,

[0043] -capturing images of the scene with the method according to the invention, and

[0044] -when the temporal consistency check validates the image capture, compare at least one image of the scene comprising said element acquired by the first camera with identification data of a reference element to be recognized.

[0045] The following description presents several exemplary embodiments of the device of the invention: these examples are not limiting of the scope of the invention. These exemplary embodiments present both the essential characteristics of the invention as well as additional characteristics linked to the embodiments considered.

[0046] The invention will be better understood and other characteristics, aims and advantages thereof will appear during the detailed description which follows and with reference to the appended drawings given as non-limiting examples and in which:

[0047] [Fig.l] illustrates a first variant of the image capture system according to the invention.

[0048] [Fig.2] illustrates a second variant of the image capture system according to the invention.

[0049] [Fig.3] illustrates an example of a time sequence of illumination when the source takes two chosen states different from the default state and the associated measurement of the light parameter.

[0050] [Fig.4] illustrates an embodiment in which the illumination comprises two sources.

[0051] [Fig.5] illustrates an example of a time sequence of illumination associated with two-source illumination, as well as the intensity captured by the photodetector and the image taken by the camera.

[0052] [Fig.6] illustrates an embodiment of the system according to the invention with two cameras respectively sensitive in the infrared and the visible, and the embodiment according to which the measuring device is integrated into the detector of the first camera. DETAILED DESCRIPTION OF THE INVENTION

[0053] The invention aims more particularly to detect sophisticated "replay" type attacks which are currently problematic. In this type of attack, the attacker first analyzes the strategy developed by the system to protect itself.

[0054] For example, some systems project one or more particular patterns (called "watermarks" in English) onto the scene according to a determined sequence, or several different colors. A processing unit checks the spatial coherence between the captured images and visual information that the images should contain, linked to the projected patterns or to the colors, this information being memorized or calculated by the system. See for example documents US20200311448 and W2021 / 015293 based on several colors / wavelengths, and document EP3218846 based on the projection of a pattern.

[0055] Once the attacker has determined the different patterns / colors and the sequence, in a second step he “replays” the sequence to the image capture system by presenting it with calculated images or images in the right colors, at the right time, corresponding to what the system expects to see. This presentation is carried out, for example, by projecting, using a video projector, the calculated images onto a screen placed in front of the camera, and by masking the projection of the patterns / colors.

[0056] The secure system 10 for capturing images of a scene Sc according to a first variant of the invention is illustrated [Fig.l]. It comprises at least one first camera CAI configured to image the scene Sc so as to acquire images called acquired images Im and at least one first light source SI configured to illuminate the scene according to a first plurality of states.

[0057] According to the most basic embodiment, the source has two states, an ON state in which the source illuminates the scene and an OFF state in which the source is off (e.g.: “normal” flash).

[0058] According to another embodiment, the source illuminates the scene according to a plurality of associated light intensities Isl, Is2, Is3 (ex unitary “LEDs”).

[0059] According to one embodiment, the source illuminates the scene according to a plurality of illuminations at a plurality of wavelengths or spectral bands BS1, BS2, BS3, such as colors: visible colors (R, G, B), IR 850nm, 940nm, UV.

[0060] The different wavelengths or spectral bands can be produced with one source or several sources (lasers, LEDs).

[0061] According to another embodiment, the source illuminates the scene according to a plurality of illuminations through a plurality of associated patterns / masks (or "watermarks") W1, W2, W3 projected onto the scene. For example: projection of points, vertical straight lines, horizontal straight lines, speckle.

[0062] According to one embodiment, the source is a video projector (LCD, micro-mirrors, laser, LEDs), which makes it possible to have only one physical object. According to one embodiment, the source is a laser with an optical device to produce a particular “pattern”, or speckle is used.

[0063] According to another embodiment, the source illuminates the scene according to different polarization modes (linear, circular).

[0064] The various aforementioned modes can of course be combined with each other, for example green vertical lines / red horizontal lines.

[0065] The system 10 according to the invention also comprises a DMI measuring device configured to measure a light parameter P from the scene. Preferably, the light parameter is the brightness or light intensity I. According to one embodiment, this is the intensity filtered in a determined spectral band.

[0066] According to a first variant, the DMI measuring device is a PD photodetector, such as a photodiode, as illustrated [Fig. 1]. According to a second illustrated variant [Fig. 2] the measuring device is integrated into the matrix detector of the CAI camera and comprises a pixel or a group of pixels of the matrix detector dedicated to the detection of the light parameter, preferably the light intensity.

[0067] According to one embodiment, the system comprises several sensors, each dedicated to a spectral band, for example a photodetector which detects green and another UV. For a device integrated into a camera, a visible camera having 3 sensors per pixel, typically 3 RGB, it is easy to obtain three intensity values ​​in these bands.

[0068] The system 10 also comprises a processing unit UT configured to control the at least one first source SI and determine an illumination time sequence TSI during which the at least one first source illuminates the scene according to successive ordered states chosen from the first plurality of states. The processing unit UT is advantageously a secure unit which executes processing operations in secret. The processing unit determines time instants called transition instants tci (i index of the instants varying from 1 to n) for which or a change occurs between one state and another state, and the sequence has a total duration D. The time sequence TSI therefore comprises a plurality of transition instants tci, a transition instant corresponding to a change between one state and another state.

[0069] Preferably, the source has a default state, i.e. outside the illumination sequence, which is the OFF state.

[0070] [Fig.3] illustrates an example of a time sequence of illumination when the source takes two chosen states El(l) and El(2) different from the default state.

[0071] The illumination time sequence of [Fig.3] is defined by:

[0072] At such a time the source goes from the default state OFF to the state El(2),

[0073] At tc2 the source passes from state El(2) to state El(l),

[0074] At tc3 the source passes from state El(2) to state El(2),

[0075] At tc4 the source passes from state El(2) to state El(l), and

[0076] At tc5 the source goes from El(l) to the default state OFF.

[0077] The TSI illumination sequence starts at tel and ends at tc5 (n=5).

[0078] According to one embodiment, the default off state is one of the chosen states.

[0079] The processing unit also controls the first camera CAI so that it acquires at least one image, preferably several images Im of the scene Sc at times called acquisition times taj (j index) during the illumination time sequence TSI.

[0080] The processing unit is also configured to randomly determine the transition times of the illumination time sequence. The time sequence can also be defined as a relative value, in the form of a duration relative to a time 0 (=tcl) at the start of the sequence. It is then the durations of each chosen state which are randomly determined.

[0081] These different instants or durations are either included in a predetermined total duration D, or the duration D of the illumination time sequence is determined by the sum of the random durations.

[0082] The random determination of transition moments prevents the attacker from "simply" recording the entire scene to replay it later: "simply" replaying it, by launching the video of the previous recorded sequence, will not correspond to the sequence expected by the system. To deceive the system, it will have to "listen" to the illuminations to send the images at the right time, which greatly complicates the attack.

[0083] This random determination is for example carried out by a local random number generator such as an RNG for Random Number Generator integrated into the electronic system of the processing unit, which can also be used for encryption and key generation.

[0084] The processing unit also controls the device for measuring DMI of the light parameter P at least during the illumination time sequence TSI. By controlling is meant the fact of triggering the measurement during the illumination sequence and of recovering (detecting) this measurement.

[0085] According to one embodiment, the device performs the measurement over the entire duration of the TSI sequence. Preferably, it turns on a little before the sequence and turns off a little after.

[0086] A value of the parameter P is associated with a state of the source SI, the values ​​having to be different for each state. In the example of [Fig.3] when the source illuminates according to the state El(l) respectively El(2) the value of the measured parameter is PI 1 respectively P12.

[0087] The processing unit controls the source SI which illuminates the scene according to the chosen states, in the chosen order and according to the transition times determined randomly, and this for each new illumination sequence.

[0088] The invention proposes to measure, for each TSI sequence, the light parameter P, let us take the intensity I, recorded by the DMI device, at least in the vicinity of the changes of state, preferably throughout the duration of the sequence as illustrated [Fig.3].

[0089] According to one embodiment, a simple and inexpensive device consists of using at least one photodiode which will provide an analog signal proportional to the light intensity with a negligible delay (less than a nanosecond), which signal can be digitized with an analog-digital converter where conversion times of the order of a microsecond (1 MHz) are easily achievable with a resolution of 8 to 12 bits, i.e. a thousand times faster than a millisecond. It will be noted, for example, that it is common to already have a photodiode in a smartphone where the ambient light intensity is measured to adapt the brightness of the screen in order to limit power consumption and extend the battery life. According to one embodiment of the DMI device, the brightness sensor of the CAL camera is

[0090] For an even more secure system, according to one embodiment, more efficient converters are used, achieving 1 giga-sample per second (1 GHz), or 1 ns: we are then in the orders of magnitude of the propagation times of a light signal between a source and a scene at the speed of light.

[0091] According to another embodiment, a specially adapted camera is used where a pixel has been added and plays the role of analyzing the light intensity.

[0092] According to yet another embodiment, a pixel or a group of pixels of the matrix detector of the camera is used, which are configured to be read faster than a reading frequency of a complete image. The resolution is reduced by using only a portion of the pixels, which makes it possible to increase the acquisition speed.

[0093] According to one embodiment, several photodiodes are used in parallel to have a better spectral response and better distinguish the various states.

[0094] The idea here is that the DMI device has a detection and acquisition speed much faster than the system camera. Indeed, a camera typically has a frame rate of 25 images per second, or 40 ms per image, this image acquisition time can hardly go down to 1 ms. Any change of state, which must take place at tci, is “immediately” detected by the DMI device, to the transmission time of the order tttans and the response time of the detection chain tdet. The transmission time is the time elapsed between the order to change state emitted by the UT, the actual implementation by the source which changes state and the travel time of the light signal between the source, the scene and the DMI device. The detection time tdet is the time elapsed between the physical detection carried out by the DMI device and its arrival at the processing unit, including its digitization.

[0095] The fast DMI device controls the scene roughly but effectively.

[0096] The processing unit UT of the system 10 according to the invention is configured to control the temporal coherence between the illumination time sequence TSI and measurements of the luminous parameter carried out by the DMI device.

[0097] From the state change order sent, the processing unit UT can determine the arrival date of the information relating to the change in the value of the parameter P detected, corresponding to the actual state change. This arrival date takes into account the transmission time ttrans and the detection chain time tdet , including the response time of the DMI device and the analog / digital conversion of the measurement.

[0098] The consistency check is carried out from the detection of the time shift between a change in state of the source, ordered and controlled by the processing unit UT, and a change in the value of said light parameter measured by the DMI device and transmitted to the processing unit, an abnormal shift reflecting an attempt to deceive the image capture system.

[0099] A time representative of a change in the value of the luminous parameter measured and detected (recovered) by the processing unit is called a sort. The UT detects this change of state from the digitized measured signal, typically by signal processing.

[0100] According to a preferred embodiment illustrated [Fig.3] the time shift di is determined between the transition instant tci associated with a change of state of the source, which is known to the processing unit, and an instant tri representative of a change in value of the luminous parameter measured following the change of state and detected by the processing unit.

[0101] A “normal” time shift, in other words the shift between the expected arrival date of the detection of the change in value of the measured parameter and tci, can be determined by the processing unit. For a given change of state i, the expected arrival date tri(n), corresponding to the instant representative of the change in value of the measured light parameter for a real change of state of the source controlled by the processing unit, is written:

[0102] tri(n) = tci

[0103] For detection without decoy, a “normal” shift di(n) is expressed by:

[0104] di(n) = tri(n) -tci =

[0105] Thus, a change of state, measured by DMI and transmitted to UT at a tri instant located beyond a first value or below a second value, is suspicious. This reflects the fact that the attacker cannot be fast enough or has poorly anticipated relative to the DMI device to deceive the image capture system.

[0106] Due to the random nature of the triggering of the change of state, only the system is capable of predicting this arrival date with certainty. To detect a decoy, we therefore look for an advance or a delay in relation to this expected arrival date.

[0107] The time shift di is considered abnormal when it is outside a detection interval Int having a lower threshold Thr-inf and an upper threshold Thr-sup.

[0108] di e Int: [Thr-inf; Thr-sup]: shift considered “normal”

[0109] di outside Int: abnormal shift

[0110] Said thresholds Thr-inf and Thr-sup are determined from the normal offset di(n) determined by the processing unit as a function of system parameters.

[0111] We easily understand the value of the upper threshold, corresponding to an attacker who does not have time to detect and identify the state taken by the source and to send a decoy in a time sufficiently close to di(n) = ttrans+tdet for example k.di(n).

[0112] The lower threshold, i.e. the display of a decoy in advance of the state considered, corresponds for example to the case in which the sequence of states taken by the source is identical from one sequence to another, only their respective duration is chosen randomly. An attacker having been able to predict the spatial sequence of illuminations (because he will have noticed that the spatial sequence is often the same), could light a decoy with the expected illumination before the system starts its sequence, in order to be ready before the triggering of the first illumination by the system. If the lower threshold is for example chosen equal to 1^, the system in the previous situation will not detect the expected change of state in the interval, since the illumination is already present before it has sent the state change order, and will trigger an alarm.

[0113] Thus, an offset di in the range tttans < di < ^(1^+^) will not lead to an alert.

[0114] According to one embodiment, the processing unit determines several or even all of the offsets associated with all of the state changes in the illumination time sequence. The offsets may be different because the transmission times ttrans may be different, for example depending on the source: a flash or an LED lights up in a few nanoseconds, whereas a video projector will typically take around ten milliseconds (100 images per second on a 100 Hz TV) to display a pattern. When the system includes several sources, these different transmission times must be taken into account.

[0115] The offset di detected by the processing unit is considered abnormal when it is greater than the upper threshold Thr-sup, this threshold being determined from the so-called normal offset di(n) determined by the processing unit, according to system parameters (for example the type of source see the previous example lighting of a flash or projection of a pattern by a projector). According to one example if the detected offset di is greater than a threshold of 2.di(n) the system emits a decoy attempt alarm (k=2). According to another example the threshold is set at 20% above the normal offset or 1.2.di(n). Preferably the threshold is chosen according to the temporal precision of the measuring device.

[0116] The offset di detected by the processing unit is also considered abnormal when it is lower than the lower threshold Thr-inf, this case being much less likely than the previous case, in particular when the spatial sequence is actually unpredictable, because the attacker will in this case have to wait for the appearance of the signal before being able to determine the correct signal to be emitted.

[0117] The attacker time Tatt is the time taken by an attacker between the detection of the signal emitted by the source, and the emission of the attacker using an "adversary source" (which includes the recognition of the signal, then the calculation of the new image). If the detection time tdet of the DMI device is fast compared to the attacker time Tatt, the system will detect the attack.

[0118] According to a first example, a flash is lit having a transmission time relative to the ignition order by FUT of ttrans=50 ns. It is detected with a photodetector with a response time of tdet= 10 ns using a 100 MHz CAN. The UT calculates a “normal” shift di(n) (corresponding to detection without decoy) of 60 ns, i.e. an arrival date relative to the top 0 of the start of the change order equal to 60 ns, neglecting the light travel time of the order of a few ns over a distance of one meter. A shift greater than a threshold of 200 ns is considered abnormal. Any detection of a light signal arriving at the unit of processing after 200 ns means that there is an attempt to deceive the system. Any detection of a light signal arriving at the processing unit before 50 ns also means that there is an attempt to deceive the system.

[0119] According to a second example, a video projector is switched on, sending an image to the scene, having a transmission time tttans relative to the switching order by the UT of 20 ms. It is detected with a photodetector with a response time of 10 ps using a 100 kHz ADC. The UT calculates a “normal” offset di(n) (corresponding to detection without decoy) of 20.01 ms, i.e. an arrival date relative to the top 0 of the start of the change order equal to 20.01 ms. For example, a minimum threshold is set at 20 ms and a maximum threshold at 21 ms. The image becomes visible to the attacker after 20 ms. The attacker must then i) detect the displayed image ii) understand this image iii) send a decoy image to his own projector. Carrying out the three steps i) to iii) in 1 ms is impossible.Assuming that he has a projector that displays the image in 10 ms, he will have taken at least 10 ms to carry out i) to iii) or an attack time of 20+10 ms, and the decoy will be rejected by the system because FUT will have noted a lag of 30 ms, beyond the maximum acceptable threshold of 21 ms.

[0120] Thanks to the random, unpredictable time sequence, the invention makes it possible to thwart “replay” type attacks where the attacker simply records the scene to replay it with a projector: the transition dates will not correspond.

[0121] It is appropriate that a state El(k) corresponds to a value of the measured parameter Plk different from the values ​​Pli corresponding to the other states El(1), 1 k. The measuring device has a sensitivity adapted to discriminate the two closest values ​​of the light parameter (a value is associated with a state). For the case of intensity this translates among other things into the resolution of the CAN of 8 bits, 10 bits, 12 bits.

[0122] When the light parameter is the intensity I and the DMI device is a photodetector, it is therefore appropriate that the intensities associated with the states are all different from each other so that a change of state is always detectable by the photodetector PD. The photodetector is at least configured to detect a change in intensity between two values ​​corresponding to the two states of the source having the closest intensity levels and a simple analog-digital conversion of the comparator type on one bit may suffice.

[0123] According to one embodiment, the photodetector is configured to distinguish the intensity levels of each state of the source. From the measurements of P over the duration of each lit / projected state, an average value of P is determined for each successive state, then the corresponding state (deduced state), and this deduced state is compared to the state actually projected during the illumination time sequence, these two states having to coincide.

[0124] An image is acquired for at least one state of the source. According to one embodiment, certain states of the sequence, typically of short duration, are reserved for the verification of temporal coherence. No image is acquired for this state. According to one embodiment, an image is acquired for several states taken by the source during the sequence, or even each successive state of the source.

[0125] According to one embodiment, the processing unit further controls the spatial coherence of acquired images by comparison between the content of the acquired images and said chosen states.

[0126] According to one embodiment, at least one image Im per successive state in the sequence is acquired.

[0127] For example, when the two states chosen are Is 1 / horizontal lines and Is2 / vertical lines, the processing unit checks, in addition to temporal coherence, whether the acquired images are indeed three-dimensional (when it is a photo / a decoy display, the projected lines remain straight).

[0128] From the “content” of an image, it is possible to determine an average intensity of the image and verify that this average light intensity is within a range consistent with the projected state during image acquisition.

[0129] According to one embodiment, the processing unit also randomly determines the states chosen, from among the plurality of possible states of the source SI, and their order in the illumination time sequence. This complicates the work of the attacker who will not be able to predict the states. In this case, there is no possibility for the attacker to be early, he can only be late.

[0130] With a random choice of the projected images, the attacker will then have to observe the light source with a camera which will have an acquisition time at best of the order of a few milliseconds, analyze the projected image which will also take a time at least of the order of a few microseconds using a very fast processor, and calculate / project a suitable image with a projector which will also take at least a few milliseconds: the duration of the attack will be far too long compared to a system with a detection time of less than one millisecond. The system will advantageously be able to acquire an image between two consecutive transitions in order to verify the consistency of the acquired image.

[0131] The processing unit controls the first CAI camera so that it acquires the images Im of the scene Sc at acquisition times taj (j index) during the illumination time sequence TSI. An image acquisition by the CAI camera is carried out for a duration called exposure time texj from the acquisition time taj.

[0132] According to one embodiment, the exposure time corresponds to the ignition time of the source in the corresponding state, between two consecutive transitions, for capture an adequate amount of light for the camera. This mode is suitable when illumination times per state are short.

[0133] According to another embodiment, the time tex is predetermined and independent of the state of the source. This is for example the case when the light source has a fixed intensity (example of the flash) and the camera has a planned operation with a fixed time, adapted to the illumination which is not adjustable (typically when the camera does not include a diaphragm). The acquisition time taj of an image for the associated state of the source is determined by the processing unit UT so that tex is included in the duration of the state considered.

[0134] An application of the image capture system according to the invention is the recognition of an element included in the scene. The processing unit comprises data relating to a reference element to be recognized called identification data. For example, this involves biometrics: facial recognition, fingerprint, gait or identity data.

[0135] In this application, once the temporal coherence has been checked and validated, at least one image of the scene comprising the element, acquired by the first CAI camera during the illumination temporal sequence, is compared with the identification data. Each time an element is sought to be recognized, the illumination sequence is activated.

[0136] Another application is the permanent surveillance of a scene (video surveillance). In this case, the illumination time sequence is repeated over time, regularly or preferably randomly (in this case the processing unit determines the time between two successive sequences randomly).

[0137] For video surveillance, according to one embodiment, a single camera is used for coherence control and monitoring, with part of the camera's detector acting as a DMI device. For example, a flash in the near IR and a camera with sensitivity in the visible and near IR are used as a source. During the day, the camera observes the scene without the flash (monitoring function). At night, it uses the flash both for the temporal control described as claimed, and for the spatial coherence control of the scene where an image of the near IR type and not of the visible type in RGB colors must be observed. The coherence control only works here at night. For the coherence control to also work during the day, the camera must be equipped with an IR filter synchronized with the IR flash to detect only the IR during the control.

[0138] According to another embodiment, the system comprises two cameras, one in the visible and one sensitive only in the near IR, adapted to the IR flash. In this case, the control as claimed applies mainly to the camera assembly (which acts as DMI) + near IR flash. However, it is possible and advantageously to use the visible image to check consistency with the near IR image, for example that it is indeed the same scene observed.

[0139] According to one embodiment, the system further comprises an additional camera so as to carry out a stereoscopic acquisition of the scene.

[0140] According to one embodiment, the system 10 according to the invention comprises a second source S2 configured to illuminate the scene according to a second plurality of states and controlled by the processing unit in the same manner as the first source SI. The illumination time sequence TSI then comprises states of the first source and states of the second source, which follow one another, and where appropriate overlap during a part of the sequence TSI.

[0141] An example of a two-source illumination is illustrated [Fig.4], and [Fig.5] illustrates an example of an associated illumination time sequence, as well as the intensity I captured by the photodetector PD and the image capture by the CAI camera. In this example the processing unit comprises a “secure element” SE, which is a secure microprocessor placed in a smartphone. The CAI camera is a 2 Mpixel IR camera sensitive to 940 nm, capable of acquiring an image in 2 ms of exposure time using the following light sources SI and S2:

[0142] -SI is a 940 nm IR flash (“flood” in English), more powerful than the sun at this specific wavelength, which allows operation in full sunlight.

[0143] -S2 is a second IR flash of the same nature but capable of projecting two “patterns » or selectable patterns, a first DOT1 stitch pattern and a second DOT2 stitch pattern.

[0144] The photodetector is a photodiode sensitive to 940 nm. For example, the photodetector is the brightness sensor of a smartphone. The photodiode is connected to a circuit of the SE processor where the signal is digitized with a detection time of 10 ps, ​​and allows the detection of the light levels of the three possibilities, with the assumption that only one source is on at a time. We have Ioff the intensity measured when both sources are off, and:

[0145] Ioff

[0146] Default state outside the sequence: SI and S2 off.

[0147] According to one embodiment for calibration purposes before launching the sequence, we records a reference image with both sources SI and S2 switched off and the light intensity is read by the photodiode. ​

[0148] The SE processor generates with its local random generator (RNG) the sequence to be sent, identified in the form of switching-on and switching-off durations from a triggering instant t0. It is chosen to perform an image capture for each of the switched-on states of the two sources (10, II, 12). The switching-on durations corresponding to these three states are chosen to be greater than or equal to 2 ms (acquisition duration of a image by the camera). The random generator provides random time intervals, restricted in the range [2ms; 20ms] for the states for which image acquisition is planned.

[0149] Thus, for each image capture Im the camera shutter (preferably electronic) opens for 2 ms (tex=2ms) to obtain a known quantity of light. The processing unit chooses the acquisition instants taj in the middle of an ignition.

[0150] Time sequence:

[0151] - S2 ignition with DOT1 for 13 ms, image capture Iml for tex=2 ms,

[0152] - extinction for 7 ms,

[0153] - S2 ignition with DOT1 for 5ms, Im2 image capture during the same tex,

[0154] - extinction for 17 ms,

[0155] -SI ignition for 19 ms, taking of image Im3 for tex,

[0156] -extinction for 11 ms, and

[0157] -ignition S2 with DOT2 for 13 ms, taking image Im4 for tex.

[0158] Alternatively, two or more images may be acquired during one ignition if time permits.

[0159] Alternatively, an image can be acquired during one or more extinctions in order to verify the consistency of the images, i.e. to verify that there is no image when there is no illumination.

[0160] We send light slots of duration of the order of a few milliseconds, and we wish to verify that the scene is actually lit at the right times with a typical precision of 10 ps, ​​authorized by a detection time tdet of 10 ps.

[0161] The choice of a DMI with tdet = lOps is dictated by the threat considered, because it is estimated that the attacker will have a Tatt duration of at least 100 ps (we neglect the order transmission and light propagation times which are of the order of a few tens of ns, a thousand times less than the desired precision). We choose a photodiode with an analog / digital converter (ADC) of sufficient precision to distinguish the four intensity levels (loff, II, 12,10) and having an acquisition frequency of the order of 100k samples per second (response time of 10 ps), which is compatible with existing technologies. It is also possible to use several photodiodes and several ADCs in parallel and offset, or to increase the sampling if we estimate that the attacker could be better.

[0162] The light intensity capture device (including the photodiode and the CAN) allows the processor to determine the measured times of each event / scene change, and the processor checks the compatibility of these measured times with the times tcl=tO, tc2 determined by the RNG.

[0163] As these are two flashes, we recall that we consider the transmission time tttans negligible compared to the time tdet for the detection chain of 10 ps: the “normal” shift is therefore 10 ps here. Any shift di measured by the system outside the interval [0, 50 ps] will mean an attempt to deceive the system with an acceptable margin.

[0164] The attacker could directly illuminate the photodiode with specific means different from the decoy image sent to the camera. To limit the effects of such an attack, according to one embodiment the photodiode is placed near the camera so that the photodiode and the camera necessarily see the same scene, possibly with suitable optics such as a semi-reflecting mirror. It is also possible to use several photodiodes located near the camera. According to another embodiment already mentioned, it is a pixel or a group of pixels of the camera detector which constitutes the detector of the DMI detection device.

[0165] With the recorded images Iml, Im2 and Im4 the processor checks the presence of points, possibly the 3D character of the recorded images, to detect any attempt at deception with an image reproducing the scene.

[0166] According to an illustrated embodiment [Fig.6] the first source SI emits at least one wavelength X1R included in the infrared range and called IR wavelength, the first camera CAI being sensitive in the infrared range and comprising a filter at the IR wavelength. The system further comprises a second camera CA2 sensitive in the visible range. The processing unit UT performs a spatial coherence check by comparison between Im(IR) images acquired in the infrared and Im(Vis) images acquired in the visible range. This visible / IR comparison is particularly effective for thwarting fraud attempts for facial recognition by facilitating the detection of living beings thanks to spectral analysis. [Fig.6] also illustrates the embodiment according to which the DMI measuring device is integrated into the CAI camera (brightness sensor or pixel(s) of the CAL matrix detector

[0167] According to another aspect, the invention relates to a secure method for capturing images of a scene Sc by a first camera CAI, the scene being illuminated according to a temporal illumination sequence TSI during which at least one first source SI illuminates the scene according to successive ordered states chosen from a first plurality of states, a change between one state and another state taking place at temporal instants called transition instants te. The method comprises the steps consisting of:

[0168] -To randomly determine said transition times,

[0169] -B illuminate the scene with at least one first light source and according to the time sequence of illumination,

[0170] -C acquire images with the camera during the illumination time sequence,

[0171] -D measure a light parameter from the scene during at least part of the illumination time sequence, and

[0172] -E control the temporal coherence between said illumination time sequence and measurements of the light parameter, from a shift between a change in state of the source controlled by the processing unit and a change in value of said light parameter, an abnormal shift reflecting an attempt to deceive said image capture system.

[0173] Preferably, the method comprises a calibration step consisting of acquiring at least one image of the scene and carrying out at least one measurement of the light parameter with said at least one source switched off.

[0174] For monitoring, steps A to E of the method according to the invention are repeated over time.

[0175] For the recognition of an element included in the scene, images are first captured with the method according to the invention (steps A to E). When the temporal consistency check validates the image capture, at least one image of the scene acquired by the first camera and comprising the element to be identified is compared with identification data of a reference element to be recognized.

Claims

1. Claims Secure system (10) for capturing images of a scene (Sc) comprising: -at least one first camera (CAI) configured to image said scene so as to acquire images called acquired images, said camera having an image acquisition time, -at least one first light source (SI) configured to illuminate the scene according to a first plurality of states (El(l), El(2)), - a measuring device (DMI) configured to measure a light parameter (P) from the scene, the measuring device being a photodetector (PD), - a processing unit (TU) configured: -to control said at least one first source and determine an illumination time sequence (TSI) during which said at least one first source illuminates the scene according to successive ordered states chosen from the first plurality of states, the time sequence comprising a plurality of instants, called transition instants (tci), a transition instant corresponding to a change between one state and another state, -to control said first camera so that the first camera acquires at least one image of said scene during said illumination time sequence, -the processing unit being further configured to: - randomly determine said transition times of the illumination time sequence, -control the device for measuring the light parameter during said illumination time sequence, the measuring device having a detection time (tdet) corresponding to the time elapsed between a physical detection carried out by said measuring device and its arrival at the processing unit, including its digitization, said detection time being strictly less than the image acquisition time, and -control the temporal coherence between said illumination time sequence and measurements of the light parameter, from a time shift between a change in state of the source controlled by the processing unit and a change in value of said parameter bright, an abnormal shift reflecting an attempt to deceive the said image capture system.

2. System according to the preceding claim in which the time shift is considered abnormal when it is outside a detection interval (Int) having a lower threshold (Thr-inf) and an upper threshold (Thr-sup), said thresholds being determined from a so-called normal shift determined by the processing unit as a function of system parameters.

3. System according to one of the preceding claims in which the time shift is determined between said transition instant (tci) associated with a change in state of the source and an instant (tri) representative of a change in value of the measured light parameter following said change of state.

4. System according to one of the preceding claims in which the light parameter is the light intensity.

5. System according to one of the preceding claims in which a value of the measured parameter corresponds to a state, said values ​​associated with said states all being different, and in which the measuring device has a sensitivity adapted to discriminate the two closest values ​​of the light parameter.

6. System according to one of the preceding claims in which the processing unit is further configured to control the spatial coherence of acquired images by comparison between a content of the acquired images and said chosen states.

7. System according to one of the preceding claims in which said first plurality of states comprises: - a so-called on state (ON) in which the source illuminates the scene and a so-called off state (OFF) in which the source is off, and / or - a plurality of light intensities (II, 12, 13), and / or - a plurality of illuminations at a plurality of wavelengths or spectral bands, said pluralities of wavelengths or spectral bands being produced where appropriate with a plurality of sources, and / or - a plurality of illuminations through a plurality of associated patterns (Ml, M2) projected onto the scene.

8. System according to one of the preceding claims in which the processing unit is configured to determine in a manner randomizes the chosen states and their order in the illumination time sequence.

9. System according to one of the preceding claims in which the processing unit is secure.

10. System according to one of the preceding claims in which the first source (SI) emits at least one wavelength (¼) included in the infrared range and called IR wavelength, the first camera (CAI) being sensitive in the infrared range and comprising a filter at said IR wavelength, the system further comprising a second camera (CA2) sensitive in the visible range, and in which the processing unit is configured to control the spatial coherence of acquired images, by comparison between images acquired in the infrared (Im(IR)) and images acquired in the visible (Im(Vis)).

11. System according to one of the preceding claims for the recognition of an element included in the scene, the processing unit (UT) comprising data relating to a reference element to be recognized, said identification data, and the processing unit being further configured to, once the temporal coherence has been checked, compare at least one image of the scene comprising said element acquired by the first camera with said identification data.

12. System according to one of claims 1 to 10 for monitoring said scene, in which the temporal sequence of illumination is repeated over time.

13. Secure method for capturing images of a scene (Sc) by at least one first camera (CAI), the scene being illuminated according to a temporal illumination sequence (TSI) during which at least one first source illuminates the scene according to successive ordered states chosen from a first plurality of states, the temporal sequence comprising a plurality of instants, called transition instants (tci), a transition instant corresponding to a change between one state and another state, the method comprising the steps of: -A randomly determining said transition instants, -B illuminating the scene with said at least one first light source (SI) and according to the temporal illumination sequence,

14.

15.

16. -C acquire images with said at least one first camera during the illumination time sequence, said camera having an image acquisition time, -D measure a light parameter from the scene during at least part of the illumination time sequence with a measuring device (DMI) configured to measure said light parameter, the measuring device being a photodetector, the measurement of the light parameter being carried out with a detection time (tdet) corresponding to the time elapsed between a physical detection carried out by said measuring device and its arrival at the processing unit, including its digitization, said detection time being strictly less than the image acquisition time, and -E control the temporal coherence between said illumination time sequence and measurements of the light parameter, from a time shift between a change in state of the source controlled by the processing unit and a change in value of said light parameter, an abnormal shift reflecting an attempt to deceive said image capture system. Method according to the preceding claim further comprising a calibration step consisting of acquiring at least one image of the scene and carrying out at least one measurement of the light parameter with said at least one source switched off. Method according to one of the preceding claims for monitoring the scene in which steps A to E are repeated over time. Method for recognizing an element included in the scene comprising, -capturing images of the scene with the secure image capture method according to one of claims 13 or 14, and -when the temporal consistency check validates the image capture, a comparison of at least one image of the scene comprising said element acquired by the first camera with identification data of a reference element to be recognized.

Images