Data anonymisation

Abstract

A device and method for anonymising data prior to storage. Captured data is received and an identification unit processes the captured data to identify personal data within the captured data. The capt

Description

Technical Field of the Invention The present invention relates to data anonymisation. Particularly, but not exclusively, the present invention relates to a device and method for anonymising captured data prior to storage. Background to the Invention With the increased usage of surveillance cameras and similar devices, the amount of data captured is ever increasing. This has created a large concern over the privacy of people’s data, and an increased demand for data privacy rights. One example of this is the General Data Protection Regulation 2016 / 679 (GDPR), which was introduced by the European Union (EU) in 2016, and relates to ensuring that personal and / or identifying data of the citizens of the EU is protected using appropriate technical measures. In relation to data collected by surveillance cameras and the like, there is thus a need to anonymise personal information, such as images which can be used to identify people, or other relevant information such as vehicle number plates. Conventionally, this can be achieved by the use of anonymisation software. This can be applied directly on locally stored data, or by transmitting the relevant data to a cloud-based server for anonymisation. These software-based systems contain several vulnerabilities, notably that the data is transmitted from the camera to the storage device, and subsequently stored (at least temporarily) in non-anonymised form. Further, for cloud based anonymisation, the raw data is also transmitted to the cloud. This means data breaches or hacking incidents could allow unauthorised access to non-anonymised data. Further, these devices are complex and processing-heavy, requiring storing and transmission of at least two sets of data and access to a suitable anonymization software or server. It is an object of the present invention to provide a device and method for data anonymisation to at least partially overcome or alleviate the above issues in existing data anonymisation devices. Summary of the Invention 24 04 25 According to a first aspect of the present invention, there is provided a data anonymisation device according to claim 1. According to a second aspect of the present invention, there is provided a method of anonymising data according to claim 9. The present invention therefore provides a device (and method) by which data can be anonymised without the need to store or transmit any personal data captured. This increases the security of said personal data by removing vulnerabilities in the path of the data. The input may be connected to a camera. The data may be in the form of still or moving images. The identification unit may be operable to identify faces, number plates, street names and house numbers, taxi license numbers, ID badges, or the like. The identification unit may be operable using hardware such as Field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Complex Programmable Logic Devices (CPLDs) or a System on Chip (SoC).The identification unit may be operable using software such as based on Verilog, VHLD, Assembler, C / C++, Java, Python, NET, TypeScript, TensorFlow, PyTorch, Torch, Apache Sparc or CNTK. The identification unit may be operable to perform algorithms such as Deep Neural Networks (DNN), Convolution Neural Networks (CNN), Recurrent Neural Networks (RNN), Region based CNNs (R-CNNs), variations of YOLO algorithm, Fully Connected Neural Networks, Histogram of Oriented Gradients (HOG) and Data Clustering Techniques. The skilled man will appreciate that there are many suitable hardware, software and algorithmic techniques possible to identify any personal data in the captured data. The identification unit may be operable to recognise personal data that is identified multiple times in the captured data. The identification unit may be operable to link any personal data which is identified multiple times in the captured data. The identification may be operable to link matching personal data across multiple sets of captured data. For example, if a particular number plate is detected multiple times within the captured data, such as entering and leaving a car park, the identification 24 04 25 unit may be operable to link the separate detections of the same number plate with an appropriate tag. The anonymisation unit may be operable to obscure personal data via blurring, deleting or replacing the personal data. The anonymisation unit may replace the personal data with a pattern or an alternate image. The blurring could take the form of pixelating the personal data until it is not identifiable. The pattern may be a blank or plain, evenly coloured region. The pattern may be a simple geometric pattern, or a static / pseudo static pattern. The alternate image may be a placeholder, such as a simulated version of the personal data, or a randomly selected alternate other piece of personal data. For example, all faces identified by the identification unit may be replaced with the same placeholder face. Alternatively, each face may be replaced with a generic face randomly selected from a set of multiple generic faces. The generic faces may be randomly generated using a generative algorithm. One suitable example of such an algorithm is a generative adversarial network (GAN). The device may comprise an encryption unit operable to encrypt the captured data and output this alongside the anonymised data. The encryption unit may also be operable to encrypt the anonymised data output by the anonymisation unit. The encryption unit may be operable to encrypt the entirety of the captured data. Alternately, the encryption unit may be operable to encrypt only the identified personal data after it had been identified by the identification unit. The encryption unit may be operable to encrypt each piece of personal data separately. The encryption unit may be operable to produce a decryption key. The decryption key may be operable to decrypt the encrypted data when the key is used. The decryption key may be applied to the encrypted data on any suitable device. After decryption, the entirety of the captured data, or alternately individual pieces of personal data, may be viewed, depending on the decryption key used. The decryption key may be operable to only decrypt certain subsets of the encrypted data. For example, these subsets could include the personal data captured by a particular data capture device, or the personal data captured in a specified time period. 24 04 25 The decryption key may be operable to leave any data which is not be decrypted in an encrypted form, or may be operable to decrypt the entirety of the personal data, whilst leaving the data which is not for decryption obscured following the anonymisation process. It will be understood that the decryption key should only be made available to people with a suitable authorisation to decrypt the data, thus ensuring the personal data is protected. The encryption unit may be operable to systematically encrypt each linked piece of personal data using an identical technique, such that only a single decryption key is required to decrypt all linked personal data. Alternatively, the encryption unit may be operable to encrypt certain subsets of the linked personal data. For example, these subsets could include the personal data captured by a particular data capture device, or the personal data captured in a specified time period. To use the example above, the encryption unit would be operable, using only a single decryption key, to access the captured data of the number plate entering and leaving the car park, as opposed to requiring two separate keys. The encryption unit of the above example may only be operable to decrypt the personal data captured on a specific day with the single decryption key. The encryption unit may be operable to encrypt any linked personal data across multiple sets of captured data. The device may comprise a storage unit connected to the output of the device. The storage unit may be operable to the anonymised data. The storage unit may be operable to store the encrypted data produced by the encryption unit. The skilled person will understand that there are many suitable types of storage unit and storage formatting that could be used. The device may comprise a communication unit connected to the output of the device. The communication unit may be operable to transmit the anonymised data to a suitable receiver. In embodiments where the device comprises a communication unit in addition to a storage unit, the communication unit may be placed before the storage unit in the path of the data, or vice versa. The storage unit may be operable to store only the encrypted data, or alternatively only the anonymised data. Similarly, the 24 04 25 communication unit may be operable to transmit the data which is not stored by the storage unit. Optionally, the device may be operable to enable both the encrypted and anonymised data to be both stored in the storage unit and transmitted by the communication unit. The transmission unit may be operable, for example, to transmit the anonymised data to a display unit where the anonymised data can be displayed for monitoring. The device may be integrated into a data capture device. An example of a suitable data capture device is a camera. The skilled person will understand that there are many suitable data capture devices to which the data anonymisation device could be integrated into. The anonymisation and identification units may be integrated into a single master unit. The master unit may take the form of an integrated circuit. Any of the data capture device, encryption, storage and communication units may also comprise part of the master unit. Further, when implemented as a hardware-based solution, this reduces the need to use software that requires intense processing and / or transmission of the data to a cloud-based server for anonymisation. The skilled person will understand that the method of anonymising data of the second aspect of the present invention may comprise the step of performing any of the actions performed by any of the above mentioned features of the device of the first aspect of the present invention. According to a third aspect of the present invention, there is provided a data capture device according to claim 16. According to a fourth aspect of the present invention, there is provided a data acquisition system according to claim 18. According to a fifth aspect of the present invention, there is provided a data acquisition system according to claim 19. Detailed Description of the Invention In order that the invention may be more clearly understood one or more embodiments thereof will now be described, by way of example only, with reference to the accompanying drawings, of which: 24 04 25 Figure 1 is a schematic illustration of a data anonymisation device according to the present invention. Figure 2 is a schematic illustration of an alternate embodiment of the data anonymisation device of the present invention. Figure 3 is a flow chart illustrating a method of anonymising data according to the second aspect of the present invention. Figure 4 is a flow chart illustrating a method of decrypting personal data according to the present invention. Figure 5 is a schematic illustration of an embodiment of a data capture device according to the third aspect of the present invention. Figure 6A is a schematic illustration of an embodiment of a data acquisition system according to the fourth aspect of the present invention. Figure 6B is a schematic illustration of an alternate embodiment of a data acquisition system according to the fourth aspect of the present invention. Figures 7A-C show example options for the format of the output data from the data anonymisation device, method, data capture device or data acquisition system of the first, second third and fourth aspects of the present invention respectively. Figures 8A&B show state of the art data acquisition systems. In existing prior art systems, as exemplified in Figures 8A&B, data is captured using cameras 42, and transmitted to a storage unit 51 for temporary storage. The captured data CD, which may contain personal data PD is stored prior to anonymisation and / or encryption. The captured data CD is then transmitted, through a router 52, to a server 41 for permanent storage. From the server 41, the captured data can then either be anonymised directly by anonymisation software, as shown in Figure 8A, or 24 04 25 transmitted to yet another server 41 via the cloud 54. The captured data CD is anonymised on said server 41, and transmitted back to the original server 41 for permanent storage, as shown in Figure 8B. Turning now to Figure 1, there is provided a schematic illustration of a data anonymisation device 1 of the present invention. The device 1 comprises a data input 2. The data input 2 is connected to an identification unit 3. The identification unit 3 is operable to process any captured data CD received from the input 1 in order to assess whether the captured data CD contains any personal data PD. The identification unit 3 is operable to tag any identified personal data PD within the captured data CD. The identification unit 3 is operable to recognise particular pieces of personal data PD that occurs multiple times within the captured data CD and link the personal data PD accordingly. The identification unit 3 is connected to an anonymisation unit 4, to which it transmits the captured data CD after the identification of the personal data PD is complete. The anonymisation unit 4 is operable to obscure any personal data PD identified in the captured data CD by the identification unit 3. Thus, the anonymisation unit 4 is operable to produce anonymised data AD from the captured data CD. The anonymisation unit 4 is operable to obscure the personal dataPD using various techniques, as illustrated in Figures 7A, B and C. The anonymisation unit 4 is connected to an output means 5 operable to output the anonymised data AD. Figure 2 shows a schematic illustration of an alternate embodiment of a data anonymisation device 1 according to the present invention. In addition to the features shown in Figure 1 and described above, there is provided an encryption unit 4a operable to encrypt the captured data CD. In this embodiment, the encryption unit 4a is connected between the anonymisation unit 4 and the output 5. The encryption unit 4a is operable to encrypt the personal data PD identified by the identification unit 3, or to encrypt the entirety of the captured data CD. The encryption unit 4a is operable to act in conjunction with or in place of the anonymisation unit 4. As such, it will be understood that the encryption unit 4a could be placed between 24 04 25 the identification unit 3 and the anonymisation unit 4. In this alternate embodiment, the output means 5 is connected to both a storage unit 6 and a communication unit 7. The encryption unit 4a is operable to encrypt the personal data PD such that an appropriate key can be provided to decrypt and thus display the personal data PD. In cases where there exists personal data PD that has been linked to other instances of that same personal data PD being identified, the encryption unit 4a is operable to encrypt each linked piece of personal data PD using a common key. This technique produces encrypted data ED that requires just a single key to unlock all instances of that particular piece of linked personal dataPD. The storage unit 6 is operable to store any encrypted data ED or anonymised data AD. The communication unit 7 is operable to transmit any anonymised data AD or encrypted data ED to a suitable external device. The storage unit 6 and communication unit are connected such that any data stored by the storage unit 7 can then be transmitted by the communication unit 7, and vice versa. Turning to Figure 3, there is provided a flow chart showing an example method of anonymising data according to a second aspect of the present invention. Firstly, at step 11, data is captured or received from an external device. This captured data CD may take the form of still or moving images, among other alternatives. The captured data CD is then processed, at step 12, to identify any personal data PD which is contained in the captured data CD. Any personal data PD identified in this step is tagged as being personal data PD. Further, any particular piece of personal data PD which is identified multiple times as that same piece of personal data PD are assigned a tag to denote that the instances are linked. At step 13, the captured data CD is anonymised by obscuring any personal data PD contained within the captured data CD. Alternately, the anonymisation step 13 may comprise of anonymising the entirety of the captured data CD. The anonymisation is followed by the step 14 of encrypting the identified personal data PD to form encrypted data ED. This step 14 optionally comprises encrypting the entirety of the captured data CD. This step 14 comprises the encryption of any linked personal data PD such that any linked personal data PD is operable to be 24 04 25 decrypted by a single key. The step 15 comprises the outputting of the encrypted data ED or anonymised data AD. The data ED, AD may be stored (step 16), or communicated (step 17), or both stored and communicated. Figure 4 shows an example decryption method when applied to encrypted data ED produced via the method of the second aspect of the present invention. At step 21, a decryption key is input into a suitable device on which the encrypted data ED is stored. At step 22, the decryption key identifies the personal data PD within the encrypted data ED for decryption, and at step 23, identifies any personal data PD linked to the personal data to be decrypted (i.e. other instances of the same personal data PD within the encrypted data ED, or within the relevant subset of the encrypted data ED). After all the relevant personal data PD is identified by the decryption key, the relevant personal data PD is decrypted at step 24. This decryption process ends with the outputting of the decrypted data DD at step 25, which it will be understood may not be identical to the captured data CD, depending upon the contents of the captured data CD and the decryption key used. Figure 5 illustrates a data capture device according to the third aspect of the present invention. This particular embodiment is a camera fitted with the data anonymisation device of the first aspect of the present invention. The skilled person would understand basic camera architecture, but this is briefly explained below for clarity. A camera 30 comprises a lens 31 operable to focus incoming light onto a charge-coupled device (CCD) 32. The CCD 32 is operable to convert the incoming light from the lens 31 and convert this into an analogue signal. This signal is output to an analogue to digital converter 33, which outputs a digital signal to an image processor 34. The incoming digital signal is processed to form an image, which is the captured data CD referred to above. The captured data CD is then output from the image processor 34 and input into the data input 2 of a data anonymisation device 1, as described above. The data anonymisation device 1 operates to anonymise (and optionally encrypt) any personal data PD identified within the captured data CD, and output this anonymised data AD and / or encrypted data ED. The output means 5 of the device 1 is 24 04 25 connected to a compressor 35, which is operable to compress the anonymised data AD and / or encrypted data ED, and transmit and or store the compressed data as required. Figure 6A shows an embodiment of a system according to the fourth aspect of the present invention. An array of data capture devices, in this embodiment three video cameras 30, are arranged to capture, anonymise and optionally encrypt data as detailed above. These cameras are connected to a server 41, such that any data output by the cameras is operable to be stored, or otherwise operated on by the server 41. Figure 6B shows an alternate embodiment of the system according to the first aspect of the present invention. In this embodiment, an array of three cameras 42 (not containing data anonymisation devices) are each connected individually to separate data anonymisation devices 1. The captured data CD output from the cameras is input to the devices 1, which operate on the data as described above. Each of the devices 1 connect to a server 41. The server is operable to receive, store and perform operations on the data output by the devices 1. Figures 7A, B and C show the various types of anonymisation that can be performed by the above described devices, method and system. In each figure, identical captured data CD is input into a device 1 as described above. The device is operable to identify any personal data PD present and produce totally anonymised data ADI, data anonymised through insertion of a selective blurring effect AD2 and anonymisation via replacement of the personal data PD with a placeholder face AD3, as shown in Figures 7A, B and C respectively. The devices, method and system are also operable to provide alternative pattern rather than blurring or the insertion of placeholder faces, as will be understood. The one or more embodiments are described above by way of example only. Many variations are possible without departing from the scope of protection afforded by the appended claims. 24 04 25

Claims

1. A data anonymisation device comprising:an input for receiving captured data wherein the captured data is image data and the captured data is received directly from an image sensor;an identification unit operable to process said captured data and thereby identify personal data within the captured data and link any personal data which is identified multiple times in the captured data;an anonymisation unit operable to obscure the identified personal data within the captured data so as to thereby provide anonymised data for output;an encryption unit operable to systematically encrypt each linked piece of personal data using an identical technique, such that only a single decryption key is required to decrypt all linked personal data; andan output means for outputting the anonymised data and encrypted data; wherein the encrypted data is stored as a digital watermark in the anonymised data.

2. A device as claimed in claim 1 wherein the identification unit is operable to identify any one or more of faces, number plates , street names and house numbers, taxi license numbers, ID badges and other features that can uniquely identify a person.

3. A device as claimed in any preceding claim wherein the identification unit is operable to link matching personal data across multiple sets of captured data.

4. A device as claimed in any preceding claim wherein the anonymisation unit is operable to obscure personal data via blurring, deleting or replacing the personal data with a pattern or an alternate image.

5. A device as claimed in claim 4 wherein the encrypted data is stored as an extension to the file containing the anonymised data.

6. A device as claimed in any preceding claim wherein the encryption unit is operable to encrypt certain subsets of the linked personal data.24 04 257. A device as claimed in any preceding claim wherein the device comprises astorage unit connected to the output of the device; the storage unit operable to store the anonymised data.

8. A device as claimed in any preceding claim wherein the device comprises a communication unit connected to the output of the device; the communication unit operable to transmit the anonymised and / or encrypted data to a suitable receiver.

9. A method of anonymising data, comprising the steps of:receiving captured data wherein the captured data is image data and the captured data is being received directly from an image sensor;processing the data in order to identify personal data within said captured data;linking any personal data which is identified multiple times in the captured data;anonymising the identified personal data so as to provide an anonymised data output;systematically encrypting each linked piece of personal data using an identical technique, such that only a single decryption key is required to decrypt all linked personal data; andoutputting the anonymised data and encrypted data; wherein the method comprises the step of storing the encrypted data as a digital watermark in the anonymised data.

10. A method as claimed in claim 9 comprising the step of linking matching personal data across multiple sets of captured data.

11. A method as claimed in either of claims 9 or 10 comprising the step of obscuring personal data via blurring, deleting or replacing the personal data with a pattern or an alternate image.

12. A method as claimed in any of claims 9 to 11 comprising the step of storing the encrypted data as an extension to the file containing the anonymised data.

13. A method as claimed in any of claims 9 to 12 comprising the step of encrypting certain subsets of the linked personal data.24 04 2514. A method as claimed in any of claims 9 to 13 comprising the step of storing the anonymised data.

15. A method as claimed in any of claims 9 to 14 comprising the step of transmitting the anonymised and / or encrypted data to a suitable receiver.

16. A data capture device comprising an image sensor and a data anonymisation device according to any of claims 1 to 8 or operable to the method of any of claims 9 to 15 integrated into the data capture device.

17. A data capture device as claimed in claim 16 wherein the data capture device is a camera.

18. A data acquisition system comprising:one or more data capture devices, said data capture devices each in communication with one or more servers characterised in that:at least one data capture device is a data capture device according to any one of claims 16 or 17.

19. A data acquisition system comprising:one or more data capture devices characterised in that:the system comprises at least one data anonymisation device according to any of claims 1 to 8 or at least one data anonymisation device operable according to the method of any of claims 9 to 15 wherein the input of the at least one data anonymisation device receives captured data directly from the image sensor of the data capture data and the at least one data anonymisation device is in communication with one or moreservers.

Images