Image Encryption

Abstract

Encrypting the image data by receiving first image data corresponding to a first image having a first image size, compressing the first image data to produce second image data corresponding to a second image having a second image size, expanding the second image data to produce third image data corresponding to a third image having the first image size, determining coordinates of a position of the second image within the third image, encrypting the third image data according to the coordinates, providing the encrypted third image data to a decoder over a first communications channel, and providing the coordinates of the second image within the third image to the decoder over a second communications channel.

Description

[Technical field]

[0001] FIELD OF THE DISCLOSURE This disclosure relates generally to systems and methods for encrypting image data, and more particularly to using compressed latent spaces and bounding box locations as seeds for encryption / decryption keys. [Background technology]

[0002] Preventing unauthorized access to data stored in a web-enabled computer system is extremely difficult. A user can simply click on a malicious link in an email or inadvertently respond to a seemingly legitimate request for information, giving the intruder complete access to all stored data. In a regulated and public relations environment, such a breach could be devastating.

[0003] Historically, encryption has provided a way for companies to keep data secure. Encryption focuses on encoding data so that only authorized parties can access it, and on controlling access to data rather than controlling the data itself. To achieve higher levels of data security, more restrictions must be placed on actions. However, in today's mobile world, employees need to be able to transfer files outside of the corporate network to travel and work from home efficiently. As a result, companies struggle with the contradiction of maintaining a flexible and efficient work environment while still achieving data security. This challenge has given birth to the next generation of data security.

[0004] The basic idea of ​​encryption is to convert data into a form in which its original meaning is hidden so that only properly authorized people can decrypt it. This is done by scrambling the information using a mathematical function based on a number, called a key. The information is unscrambled (or decrypted) using the reverse process, using either the same or a different key. If the same key is used for both encryption and decryption, the process is said to be symmetric. If different keys are used, the process is defined as asymmetric.

[0005] The definition is very simple from the terminology: encryption means that data or bits from a particular source are altered into a defined pattern known only to the sender and receiver. This is commonly done with the regular bits of any password or with the secure SSL encryption system. However, the concept of applying a similar encryption algorithm to images revolutionizes the field of secret message transfer through images.

[0006] Image encryption is based on the innovative idea of ​​taking sequential or random pixel bits of an image and modifying them collectively using logic, thereby making a complete set of new pixels from the original bits, thus creating a new mode of information transfer.

[0007] Rivest-Shamir-Adleman (RSA) is a widely used encryption algorithm. The RSA algorithm is an asymmetric encryption algorithm. Asymmetric actually means that the algorithm operates on two different keys: a public key and a private key. As the name suggests, the public key is given to everyone and the private key is kept secret.

[0008] An example of asymmetric cryptography: A client (e.g. a browser) sends its public key to a server and requests some data. The server encrypts the data using the client's public key and sends the encrypted data. The client receives this data and decrypts it using its private key. Because it is asymmetric, no one other than the browser can decrypt the data, even if a third party has the browser's public key.

[0009] In RSA encryption, a message is encrypted using a code that can be shared openly, called a public key. Due to the unique mathematical properties of the RSA algorithm, once a message has been encrypted with the public key, it can only be decrypted with another key, known as the private key. Each RSA user has a key pair, consisting of its public key and a private key. As the name suggests, the private key must be kept secret.

[0010] Public key cryptography differs from symmetric key cryptography in that the same secret key is used for both the encryption and decryption processes. These differences make public key cryptography, such as RSA, useful for communication where there is no opportunity for secure advance distribution of the key.

[0011] Object detection algorithms use bounding boxes and the types or classes of objects located in an image to identify the presence of objects. The algorithm creates a list of object categories present in the image, as well as axis-aligned bounding boxes that indicate the location and scale of all instances of each object category.

[0012] There are several top-performing deep learning models that perform object localization and object detection, including the R-CNN models (R-CNN, Fast R-CNN, Faster R-CNN), and the YOLO model. The most popular family of object recognition models is collectively called YOLO or You-Only-Look-Once. While the R-CNN models can generally be more accurate, the YOLO family of models is faster, much faster than R-CNN, and achieves object detection in real time. This technique requires a single neural network trained end-to-end that receives images as input and directly predicts object bounding boxes and class labels for each bounding box. Summary of the Invention

[0013] The following presents a summary to provide a basic understanding of one or more embodiments of the present disclosure. This summary is not intended to identify key or critical elements or to delineate the scope of particular embodiments or the scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description that is presented later. In one or more embodiments described herein, a device, a system, a computer-implemented method, an apparatus, or a computer program product, or a combination thereof, enables encryption of image data.

[0014] Aspects of the invention disclose methods, systems, and computer-readable media related to encrypting image data by receiving first image data corresponding to a first image having a first image size, compressing the first image data to produce second image data corresponding to a second image having a second image size, expanding the second image data to produce third image data corresponding to a third image having the first image size, determining coordinates of a position of the second image within the third image, encrypting the third image data according to the coordinates, providing the encrypted third image data to a decoder over a first communications channel, and providing the coordinates of the second image within the third image to the decoder over a second communications channel.

[0015] The above and other objects, features, and advantages of the present disclosure will become more apparent through a more detailed description of several embodiments of the present disclosure in the accompanying drawings. In the embodiments of the present disclosure, the same reference numerals generally refer to the same components. [Brief description of the drawings]

[0016] [Figure 1] 1 is a schematic diagram of a computing environment according to one embodiment of the present invention. [Diagram 2] 4 is a flow chart illustrating an operational sequence according to one embodiment of the present invention. [Diagram 3] FIG. 1 illustrates a cloud computing environment according to one embodiment of the present invention. [Figure 4] FIG. 2 illustrates abstraction model layers according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Certain embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings, in which embodiments of the present disclosure are illustrated. However, the present disclosure may be implemented in various forms and therefore should not be construed as limited to the embodiments disclosed herein.

[0018] Typical image encryption methods rely on RSA encryption algorithms and chaos encryption algorithms. RSA encryption has a public key that consists of two numbers, one of which is the multiplication of two large prime numbers. The private key is also derived from the same two prime numbers. Therefore, the encryption strength depends entirely on the size of the key, and if the key size is doubled or tripled, the strength of the encryption increases exponentially. RSA keys can typically be 1024 or 2048 bits long, although 1024-bit keys may be easier to break in the near future.

[0019] A major drawback of most of the chaotic encryption algorithms is that they use floating-point calculations, which makes the actual software or hardware implementation of such systems inefficient and complex compared to traditional ciphers such as AES and RSA, which operate only with integer arithmetic. The disclosed embodiments provide a system and method that does not require additional elements for encryption / decryption of image data.

[0020] Aspects of the invention generally relate to secure transfer of data using encryption transfer and decryption of image data. In an embodiment, a data transfer system receives unencrypted image data of an image of a first size. Compression of the image data produces a reduced size image. The method then pads the dimensions of the reduced size image to the original size to expand the reduced size image to produce a composite image of the original size including the compressed image and the expanded data. Scanning of the composite image produces coordinates of the location of the compressed image within the composite image. In one embodiment, the system generates an encryption / decryption key pair using the coordinates obtained from the scan. Encryption of the composite image is performed using one key of the pair. The encrypted data is passed to the intended recipient over a first communication channel. Transfer of the complementary key of the pair to the recipient is performed over a second communication channel such that interception of either the key or the data does not provide all the information required for decryption. In this manner, the recipient receives the data and key, decrypts the data to unpack the decrypted image, and is able to possess the full size decrypted original image.

[0021] In one embodiment, the system and method generate a single key from the bounding box coordinates and share the single key with the recipient as described above. In this embodiment, the encryption and decryption of the image data each use the same encryption key generated from the bounding box coordinate data.

[0022] According to an aspect of the invention, there is a method for automatically receiving image data for encryption and transmission, the method compressing the received image data and expanding the compressed image with random data to produce a composite image of the same size as the originally received image. The method scans the composite image and extracts position coordinates of the compressed image within the overall composite image. The method encrypts the composite image using the position coordinates as at least a portion of the basis for generating an encryption key. The method passes the corresponding decryption key and encrypted data file to a recipient, using separate communication channels for each of the data file and decryption key. The recipient utilizes the decryption key to decrypt the data file and then decompresses the decrypted file to obtain the original image.

[0023] Aspects of the present invention provide improvements in the art of data encryption and data transfer systems. Conventional encryption systems utilize RSA or chaos-based encryption methods. Such methods can be susceptible to being broken, depending on the size of the key. The disclosed method utilizes latent properties of the original image in deriving an encryption / decryption key pair, such that each encrypted image utilizes a unique key pair derived by processing the original data itself. Compression of the original image produces a smaller image, and the method then pads the smaller image to its original size. Evaluation of the resulting image produces coordinates of the compressed image's location within the bounds of the composite image. An encryption key derived from these coordinates provides a means for encrypting the composite image data. The corresponding decryption key and encrypted data file are passed to a recipient using an independent communication channel. The recipient utilizes the decryption key to decrypt the data file and decompress the compressed image in the result to produce the original image.

[0024] Aspects of the invention also provide for improvements in computer functionality. In particular, implementations of the invention are directed to specific improvements in the method of operation of an encryption system, embodied in the use of latent data obtained from processing an original image data file through data compression, padding the compression results to the size of the uncompressed image, and isolating the coordinates of the compressed image within the original image for use in deriving an encryption / decryption key unique to the share of the original image. In an embodiment, the system derives a new encryption / decryption key or key pair for each transferred image according to the location coordinates unique to each compressed and expanded image. In one embodiment, the method further processes the compressed image by generating the location of the compressed image within the boundaries of the original image before padding the compressed image to the boundaries of the original image. In this embodiment, knowing the location of the compressed image within a previously encrypted and transferred file is of no value since the location of each image is different. When utilizing a unique key pair for the encryption-transfer-decryption sequence of each image, a malicious actor would need to obtain both the data file of a particular image transfer and the corresponding decryption key in order to decrypt the image.

[0025] In overview, a data encryption system is an application running on data processing hardware that utilizes an encryption methodology shared between a sender and a receiver. The data encryption system receives image data for encryption from various sources, including input over a network. Compression of the image data produces a smaller compressed image that may then be padded up to the original image size using other data. Evaluation of the composite image produces the location coordinates of the compressed image within the original size image. These coordinates form the basis for generating a key or key pair. In the case of a key pair, one key allows encryption of the composite image, and the other key of the pair is passed to the receiver for use in decrypting an encrypted file that is also passed to the receiver, albeit by a different communication channel. In the case of a single key, the system passes the key to the intended receiver and also uses that key to encrypt the data. The decrypted data may then be decompressed to produce the original image.

[0026] In one embodiment, one or more components of the system may employ hardware and / or software to solve problems that are highly technical in nature (e.g., receiving image data, generating a compressed image from the image data, padding the compressed image with the extended data, scanning the extended image to determine the coordinates of the compressed image within the extended image, encrypting the extended image according to a key generated using the coordinates, providing the coordinate-based key and the encrypted image to a recipient, etc.). These solutions are not abstract and cannot be performed as a series of intellectual acts by a human being, e.g., the processing power required to facilitate the encryption of image data. Furthermore, some of the processes performed may be performed by specialized computers to perform predefined tasks related to encryption and transfer of encrypted data. For example, specialized computers may be employed to perform tasks related to securely sharing sensitive image data, etc.

[0027] In one embodiment, the method receives sensitive image data intended for sharing between a sender and a receiver. The sensitive image data may be provided by the sender in any known digital image file format. In this embodiment, the method proceeds by compressing the sensitive image data using a known data compression method, such as DEFLATE, RUNLENGTH, TRANSFORM, or other known image data compression models. (Note: the terms "DEFLATE, RUN-LENGTH, TRANSFORM" and "PuTTYGen" may be subject to trademark rights in various jurisdictions throughout the world and are used herein only with respect to products or services appropriately named by the trademarks to the extent such trademark rights may exist.)

[0028] After compressing the confidential image data, the method generates random pixel data using one or more random number generators that generate random values ​​for pixel characteristics, such as red, blue, green, hue, saturation, L*A*B* values, and augments the compressed data with the generated random noise. In one embodiment, the method pads the compressed data such that the overall size of a composite image including the compressed data and the random data is the same size as the original uncompressed confidential image. In one embodiment, the method randomly selects a location for the compressed image within the boundaries of the original image and pads the space between the compressed image and the boundaries of the original image with random pixel data. In this embodiment, the coordinates of each compressed image within the boundaries of the corresponding original image are different, so that a recipient of a previous encryption process cannot use information regarding the location of a previous compressed image to decrypt other encrypted image data.

[0029] In one embodiment, a method scans a composite image including the compressed image and the augmented random data using a method such as a trained neural network image analysis model such as a You-Only-Look-Once (YOLO) model, a Recurrent Convolutional Neural Network (R-CNN, Fast R-CNN, Faster R-CNN), or the like, to identify bounding boxes defined by coordinates that define the location of the compressed data within the random pixel data of the composite image. The scan outputs the coordinates of the bounding box that encloses the compressed data.

[0030] In one embodiment, the method utilizes bounding box coordinates to generate a public and private key pair specific to the encryption and transfer of the current image data. In this embodiment, the method utilizes a key generation method such as PuTTYGen and the bounding box coordinates to generate the public and private key pair. In this embodiment, the method provides the private key of the pair to a recipient for use in decrypting the encrypted image data. The method transfers the private key using a first communication channel that is different from the communication channel intended to be used to transfer the encrypted data. Using separate communication channels for each of the key and data reduces the likelihood that a malicious actor will be able to intercept and use both the key and the data to access sensitive data.

[0031] In one embodiment, the method generates a single encryption / decryption key for use in a symmetric encryption / decryption algorithm, which then provides the generated single key to an intended recipient for use in decrypting the encrypted image data.

[0032] In one embodiment, the method encrypts the composite image using a known encryption method and an encryption / decryption key generated from the bounding box coordinates. Exemplary encryption methods include asymmetric key encryption algorithms, symmetric key encryption algorithms, RSA encryption, and ECC (Elliptic Curve Cryptography) methods. Following encryption, the method transmits or transfers the encrypted data file to a recipient using a second communication channel as described above.

[0033] In one embodiment, upon receiving both the decryption key and the encrypted data file, the recipient uses a decryption algorithm and the provided decryption key to decrypt the file, producing a composite image including the compressed data and random pixel padding. In this embodiment, the recipient either extracts the original compressed image using the bounding box coordinates, or performs a new scan of the decrypted image to again identify the bounding box of the compressed image data. In this embodiment, the recipient reverses the data compression algorithm using the compressed data as input to produce the original uncompressed confidential image data.

[0034] FIG. 1 provides a schematic diagram of exemplary network resources relevant to the implementation of the disclosed invention. The present invention may be implemented in any processor of the disclosed elements that processes instruction streams. As shown in the figure, networked client device 110 wirelessly connects to server subsystem 102. Client device 104 wirelessly connects to server subsystem 102 via network 114. Client devices 104 and 110 include an image encryption program (not shown) along with sufficient computing resources (processor, memory, network communication hardware) to execute the program. As shown in FIG. 1, server subsystem 102 includes server computer 150. FIG. 1 illustrates a block diagram of components of server computer 150 in networked computer system 1000 according to an embodiment of the present invention. It should be understood that FIG. 1 is merely provided as an example of one implementation and is not intended to suggest any limitation with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

[0035] The server computer 150 may include a processor 154, memory 158, persistent storage 170, a communication unit 152, an input / output (I / O) interface 156, and a communication fabric 140. The communication fabric 140 provides communication between a cache 162, the memory 158, the persistent storage 170, the communication unit 152, and the input / output (I / O) interface 156. The communication fabric 140 may be implemented using any architecture designed to pass data and / or control information between a processor (such as a microprocessor, communication and network processor, etc.), system memory, peripheral devices, and any other hardware components in the system. For example, the communication fabric 140 may be implemented using one or more buses.

[0036] Memory 158 and persistent storage 170 are computer-readable storage media. In this embodiment, memory 158 includes random access memory (RAM) 160. In general, memory 158 may include any suitable volatile or non-volatile computer-readable storage medium. Cache 162 is a high-speed memory that improves performance of processor 154 by holding recently accessed data, and data near to recently accessed data, from memory 158.

[0037] Program instructions and data used to implement embodiments of the present invention, such as image data encryption program 175, are stored in persistent storage 170 for execution and / or access via cache 162 by one or more of the respective processors 154 of server computer 150. In this embodiment, persistent storage 170 includes a magnetic hard disk drive. As an alternative or in addition to a magnetic hard disk drive, persistent storage 170 may include a solid state hard drive, a semiconductor storage device, a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory, or any other computer readable storage medium capable of storing program instructions or digital information.

[0038] The media used by persistent storage 170 may also be removable. For example, a removable hard drive may be used for persistent storage 170. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive to transfer data to another computer-readable storage medium that is also part of persistent storage 170.

[0039] In these examples, the communication unit 152 provides communication with other data processing systems or devices, including resources of the client computing devices 104 and 110. In these examples, the communication unit 152 includes one or more network interface cards. The communication unit 152 may provide communication using either or both physical and wireless communication links. Software distribution programs, as well as other programs and data used to implement the invention, may be downloaded to the persistent storage 170 of the server computer 150 via the communication unit 152.

[0040] The I / O interface 156 allows for input and output of data with other devices that may be connected to the server computer 150. For example, the I / O interface 156 may provide a connection to an external device 190, such as a keyboard, keypad, touch screen, microphone, digital camera, or any other suitable input device or combination thereof. The external device 190 may also include portable computer-readable storage media, such as thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to implement embodiments of the present invention, such as the image data encryption program 175 on the server computer 150, may be stored on such portable computer-readable storage media and loaded into the persistent storage 170 via the I / O interface 156. The I / O interface 156 also connects to a display 180.

[0041] Display 180 provides a mechanism for displaying data to a user and may be, for example, a computer monitor. Display 180 may also function as a touch screen, such as the display of a tablet computer.

[0042] 2 provides a flow chart 200 illustrating exemplary activities associated with practicing the present disclosure. After the program begins, at block 210, the method receives an original image data file from a sender that is intended to be encrypted and transferred to a recipient. At block 220, the method compresses the original data file to produce a compressed image file that is reduced in size compared to the original data file.

[0043] At block 230, the method expands the compressed data image by padding the size of the image with random pixel data or other data up to the size of the original image. This expansion or padding creates a composite image of the same size as the original image with the compressed data embedded within the composite image. The location of the compressed image within the composite image may be set by the sender or may be randomly determined by the method.

[0044] In block 240, the method scans the data of the synthetic image using a bounding box object detection algorithm such as R-CNN trained to detect bounding boxes of objects or a computationally efficient YOLO model to determine bounding box location coordinates of compressed data locations in the synthetic image.

[0045] At block 250, the method generates an encryption / decryption key or key pair from the bounding box coordinates determined from the scan. The method generates the keys using a known key generation algorithm.

[0046] At block 260, the method encrypts the composite image using an encryption algorithm and either a generated single encryption / decryption key or one key from a generated encryption / decryption key pair.

[0047] At block 270, the method transfers the encrypted composite image to a recipient using a communications channel, and at block 280, the method transfers the associated decryption key to the recipient using another communications channel. The method provides a mechanism whereby each encrypted and transferred image utilizes a unique key generated directly from the underlying properties of the composite image itself.

[0048] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0049] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0050] Its features are as follows:

[0051] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without the need for human interaction with the service provider.

[0052] Pervasive Network Access: Functionality is available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin- or thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0053] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated on demand. There is location independence in that consumers generally have no control or knowledge of the exact location of the provided resources, although it may be possible to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0054] Rapid Elasticity: Capabilities can be rapidly and elastically provisioned, sometimes automatically, to rapidly scale out and rapidly release to rapidly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.

[0055] Service Metering: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a certain level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services utilized.

[0056] The service model is as follows:

[0057] Software as a Service (SaaS): The capability offered to a consumer to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). With the possible exception of limited user-specific application configuration settings, the consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or individual application features.

[0058] Platform as a Service (PaaS): is the capability offered to a consumer to deploy applications that the consumer creates or acquires, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, such as networks, servers, operating systems, or storage, but does control the deployed applications and, in some cases, the application hosting environment configuration.

[0059] Infrastructure as a Service (IaaS): The capability offered to consumers to provision processing, storage, network, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does control the operating systems, storage, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).

[0060] The deployment model is as follows:

[0061] Private Cloud: The cloud infrastructure is operated exclusively for an organization. This cloud infrastructure may be managed by the organization or a third party and may reside on-premise or off-premise.

[0062] Community Cloud: Cloud infrastructure is shared by multiple organizations to support a specific community of shared concerns (e.g., mission, security requirements, policies, and compliance considerations). This cloud infrastructure may be managed by the organizations or a third party and may reside on-premise or off-premise.

[0063] Public Cloud: The cloud infrastructure is available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0064] Hybrid Cloud: A cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are tied together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting for load balancing between clouds).

[0065] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0066] Referring now to FIG. 3, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, can communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described herein above (not shown). This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service without the cloud consumer having to maintain resources on a local computing device. It should be understood that the types of computing devices 54A-54N shown in FIG. 3 are intended to be illustrative only, and that the computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network addressable connections (e.g., using a web browser).

[0067] Referring now to Figure 4, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 3) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 4 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0068] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, RISC (reduced instruction set computer) architecture based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0069] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0070] In one example, the management layer 80 may provide the functions described below: Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and charging or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection for data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources such that requested service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-positioning and procurement of cloud computing resources anticipated to be required in the future according to SLAs.

[0071] The workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and image data encryption programs 175.

[0072] The invention may be a system, method, and / or computer program product at any possible level of integration of technical detail. The invention may be advantageously implemented in any system, single or parallel, that processes instruction streams. The computer program product may include a computer readable storage medium (or multiple computer readable storage media) having computer readable program instructions for causing a processor to implement aspects of the invention.

[0073] A computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage media includes the following: portable computer diskettes, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), portable compact disk read-only memories (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or raised structures in grooves with instructions recorded thereon, and any suitable combination of the above. As used herein, computer-readable storage medium or computer-readable storage device should not be construed as being a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0074] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to the respective computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0075] The computer readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer as a stand-alone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer readable program instructions to perform aspects of the invention by utilizing state information of the computer readable program instructions to personalize the electronic circuitry.

[0076] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0077] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable medium, such that the computer readable storage medium on which the instructions are collectively stored comprises an article of manufacture including instructions implementing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0078] The computer readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to create a computer-implemented process that causes a series of operational steps to be performed on the computer, other programmable apparatus, or other device, such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0079] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or a combination of dedicated hardware and computer instructions.

[0080] References herein to "one embodiment," "embodiment," "exemplary embodiment," and the like indicate that the embodiment being described may include a particular feature, structure, or characteristic, but each embodiment does not necessarily include the particular feature, structure, or characteristic. Also, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in connection with one embodiment, it is believed to be within the knowledge of one of ordinary skill in the art to affect such feature, structure, or characteristic in connection with other embodiments, whether or not explicitly described.

[0081] The terms used herein are for the purpose of describing particular embodiments only and are not intended to be limiting of the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly dictates otherwise. It will be further understood that the terms "comprises" and / or "comprising", as used herein, indicate the presence of stated features, integers, steps, operations, elements, or components or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0082] The description of various embodiments of the present invention is presented for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the present invention. The terms used in this specification are selected in order to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed in this specification.

Claims

1. 1. A computer-implemented method for image data encryption, comprising: receiving, by one or more computer processors, first image data corresponding to a first image having a first image size; compressing, by the one or more computer processors, the first image data to produce second image data corresponding to a second image having a second image size; expanding, by the one or more computer processors, the second image data to produce third image data corresponding to a third image having the first image size; determining, by the one or more computer processors, coordinates of a location of the second image within the third image; encrypting, by the one or more computer processors, the third image data according to the coordinates; providing, by the one or more computer processors, the encrypted third image data to a decoder over a first communications channel; and providing, by the one or more computer processors, the coordinates of the second image within the third image to the decoder over a second communications channel.

4. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, further comprising: determining, by the one or more computer processors, a placement location of the second image within the third image; and placing, by the one or more computer processors, the second image at the location.

3. The computer-implemented method of claim 1 , wherein augmenting the second image comprises adding random image data.

4. The computer-implemented method of claim 1 , further comprising: decoding, by the one or more computer processors, the third image according to the coordinates to produce a decoded image.

5. The computer-implemented method of claim 4 , further comprising decompressing, by the one or more computer processors, the decoded image.

6. The computer-implemented method of claim 1 , further comprising generating, by the one or more computer processors, an encryption key using the coordinates.

7. The computer-implemented method of claim 1 , wherein determining the coordinates of the second image within the third image further comprises determining the coordinates according to a you-only-look-once model.

8. 1. A computer program product for encrypting image data, the computer program product comprising one or more computer readable storage devices and program instructions collectively stored on the one or more computer readable storage devices, the stored program instructions, when executed, causing one or more processors to: receiving first image data corresponding to a first image having a first image size; compressing the first image data to produce second image data corresponding to a second image having a second image size; expanding the second image data to produce third image data corresponding to a third image having the first image size; determining coordinates of a position of the second image within the third image; encrypting the third image data according to the coordinates; providing the encrypted third image data to a decoder over a first communication channel; and providing the coordinates of the second image within the third image to the decoder over a second communication channel. A computer program product comprising instructions for causing a computer to execute a program.

9. 9. The computer program product of claim 8, wherein the stored program instructions further cause the one or more processors to determine a placement location of the second image within the third image and place the second image at the location.

10. 10. The computer program product of claim 8, wherein augmenting the second image comprises adding random image data.

11. 9. The computer program product of claim 8, wherein the stored program instructions further cause the one or more processors to decode the third image according to the coordinates to produce a decoded image.

12. 12. The computer program product of claim 11, wherein the stored program instructions further cause the one or more processors to decompress at least a portion of the decoded image.

13. 9. The computer program product of claim 8, wherein the stored program instructions further cause the one or more processors to generate an encryption key using the coordinates.

14. 10. The computer program product of claim 8, wherein determining the coordinates of the second image within the third image further comprises determining the coordinates according to a you-only-look-once model.

15. 1. A computer system for encrypting image data, the computer system including one or more computer processors, one or more computer readable storage devices, and program instructions stored on the one or more computer readable storage devices that are executed by the one or more computer processors, the stored program instructions, when executed, causing the one or more processors to: receiving first image data corresponding to a first image having a first image size; compressing the first image data to produce second image data corresponding to a second image having a second image size; expanding the second image data to produce third image data corresponding to a third image having the first image size; determining coordinates of a position of the second image within the third image; encrypting the third image data according to the coordinates; providing the encrypted third image data to a decoder over a first communication channel; and providing the coordinates of the second image within the third image to the decoder over a second communication channel. The computer system includes instructions for executing the steps of:

16. 16. The computer system of claim 15, wherein the stored program instructions further cause the one or more processors to determine a location of the second image within the third image and to place the second image in the location.

17. 16. The computer system of claim 15, wherein augmenting the second image comprises adding random image data.

18. 16. The computer system of claim 15, wherein the stored program instructions further cause the one or more processors to decode the third image according to the coordinates to produce a decoded image.

19. 20. The computer system of claim 18, wherein the stored program instructions further cause the one or more processors to decompress at least a portion of the decoded image.

20. 16. The computer system of claim 15, wherein the stored program instructions further cause the one or more processors to generate an encryption key using the coordinates.

Images