Selective media authentication of video streams using subpictures

Abstract

Methods and signaling are described for selective media authentication for video content. A content provider may use video subpictures to identify regions of interest in a source video that can be either included or excluded when computing digital signatures in authenticating the source video. Example signaling based on a supplemental enhancement information messaging for digital signed content is provided.

Description

SELECTIVE MEDIA AUTHENTICATION OF VIDEO STREAMS USING SUBPICTURESCROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application may be related to U.S. Provisional Patent Application Ser. No.63 / 776,474, filed on March 24, 2025, and U.S. Provisional Patent Application Ser. No. 63 / 888,131, filed on September 25, 2025, each of which is incorporated by reference herein in its entirety.TECHNOLOGY

[0002] The present document relates generally to images and video sequences. More particularly, embodiments of the present invention relate to using subpictures to include or exclude areas of pictures during media authentication.BACKGROUND[00031 In 2020, the MPEG group in the International Standardization Organization (ISO), jointly with the International Telecommunications Union (ITU), released the first version of the Versatile Video Coding Standard (VVC), also known as H.266 (Ref. [1]). More recently, the same group has been working on the development of the next generation coding standard that provides improved coding performance over existing video coding technologies. As part of this investigation, new coding techniques and tools for secure video streaming are also examined.

[0004] When transmitting digital content (such as documents, e-mails, and the like), digital signatures act as an electronic “stamp” or seal of authenticity. Currently, media bitstreams, such as video bitstreams, do not provide mechanisms for authentication or verification of the media content or parts thereof. In particular, the video bitstreams produced via standardized video coding algorithms, such as VVC, do not offer mechanisms for authentication or verification.

[0005] As appreciated by the inventors here, improved techniques for media authentication of video streams are desired, and they are described herein.

[0006] The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section. Similarly, D25043W001 - 1 -issues identified with respect to one or more approaches should not be assumed to have been recognized in any prior art on the basis of this section, unless otherwise indicated.BRIEF DESCRIPTION OF THE DRAWINGS

[0007] An embodiment of the present invention is illustrated by way of example, and not in way by limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which:

[0008] FIG. 1 depicts an example pixel structure for using subpictures for media authentication according to an embodiment of this invention; and

[0009] FIG. 2 depicts an example process of selective media authentication according to an embodiment of this invention.DESCRIPTION OF EXAMPLE EMBODIMENTS

[0010] Example embodiments that relate to media authentication in video coding arc described herein. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the various embodiments of the present invention. It will be apparent, however, that the various embodiments of the present invention may be practiced without these specific details. In other instances, well-known structures and devices are not described in exhaustive detail, in order to avoid unnecessarily occluding, obscuring, or obfuscating embodiments of the present invention.SUMMARY

[0011] Example embodiments described herein relate to media authentication in video coding. In an embodiment, a processor receives a coded picture comprising two or more subpictures. It detects whether selective media authentication is enabled or not for the coded picture. If selective media authentication is enabled, then it identifies a set of selected subpictures from the two or more subpictures for selective media authentication, wherein, for excluded media authentication, the set of selected subpictures is excluded from computing a digital signature for the coded picture, and for inclusive media authentication, only the set of selected subpictures is used for computing a digital signature for the coded picture.

[0012] In another embodiment, in an encoder, a processor generates a coded bitstream by encoding a video picture using two or more coded subpictures. If selective media D25043W001 - 2 -authentication is enabled for the bitstream, then the processor identifies a set of selected subpictures from the two or more subpictures for selective media authentication, wherein, for excluded media authentication, the set of selected subpictures is excluded from computing a digital signature for the coded picture, and for inclusive media authentication, only the set of selected subpicturcs is used for computing a digital signature for the coded picture. The processor also generates a signaling section for the coded picture in the bitstream, wherein the signaling section comprises:a first flag indicating that selective media authentication is enabled; a first parameter indicating how many subpictures are used in selective media authentication; andan ID parameter for each subpicture in the set of selected subpictures.

[0013] Other embodiments that allow a digitally signed content supplemental enhancement information (DSC SEI) message to support selective media authentication are also presented.VIDEO AUTHENTICATION

[0014] In a typical media authentication scenario, the decoder authenticates the content by performing some form of signature detection, using for example a hash function to map data from the content into a fixed-size output, denoted as hash. In video transmission, it is possible that an operator may want to exclude a certain area of each picture, say the location of a logo, advertisement, or other overlay, from such signature detection computations. For example, in a video sequence, a desired region (x, y, w, h) may be designated as an exclusion area, where (x, y) denotes the location of the area (e.g., the upper length corner) with respect to the picture’s origin (say, the top left corner of its active area) and (w, Zz) represent, say, in pixels, the width and height of the region respectively. Since the video is encoded in the compressed bitstream, the portion of the bitstream that represents the excluded region (x, y, w, It) needs to be signaled using high-level syntax or metadata, so it can be excluded in the calculations of the digital signature.

[0015] In an alternative scenario, an operator may prefer to explicitly specify which areas of the picture need to be used for signature detection. Then, such information, e.g., rt= (xt, yt, Wi, hi) values, for regions r where i= 1, 2, ..., N, where N denotes the total number of such regions, needs to also be included in the bitstream as high-level syntax or metadata.D25043W001 - 3 -

[0016] In an example embodiment, to support included or excluded picture areas for media authentication, the video sequence is encoded as a collection of two or more subpictures. A video coding scheme that supports subpictures coding enables breaking a frame of video into multiple regions, each of which is called a subpicture. In such an encoding scheme, the portions of the bitstream that represent a subpicturc arc uniquely identified. Furthermore, the encoding scheme may optionally limit the encoding of a subpicture to be independent from the other subpictures (i.e. no intra / inter-prediction is allowed across subpictures), hence enabling the possibility of removing the portions of the bitstream that belong to the subpicture or replacing them with the corresponding coded bitstreams, of another content, effectively replacing the original content of the subpicture with the new content in the compressed domain.

[0017] In VVC (Ref. [1]), a subpicture is defined as a rectangular region of one or more slices within a picture. A slice is defined as an integer number of complete tiles or an integer number of consecutive complete coding tree units (CTU) rows within a tile of a picture that are exclusively contained in a single NAL unit. Thus, each subpicture is defined by its top left comer coordinates (x, y) and its width and height (w, h). all in units of coding tree units (CTUs) (i.e., the coordinate x, y are located at the comer of a CTU, and w and h denote the width and height as the number of CTUs in each direction. As an example, without limitation, FIG. 1 depicts a picture subdivided into five subpictures: R0 to R4. As an example, R4 may be signaled as the excluded area, while areas R0 to R3 together define the area to be used for authentication.Selective authentication using SEI messaging

[0018] Recently, a proposed “digitally signed content supplemental enhancement information (DSC SEI)” message (Ref. [2]) defines three SEI messages for content verification: initialization (DSCI), selection (DSCS) and verification (DSCV). As discussed in Ref.[2], the DSCI SEI message with a particular dsci_id value provides information about the secure hash algorithm used for calculating message digests, which are used together with the digital signatures present in the associated DSCV SEI messages to verify that the coded video has been produced by the content provider that identifies itself via a digital certificate for all verification substreams in the current verification period (i.e., the verification period containing the current DSCI SEI message). It further provides information about the digital signature algorithm used and the public key of the content provider.D25043W001 - 4 -

[0019] In a first embodiment, it is proposed to extend the DSC SEI message to also list the subpictures that are to be excluded from the content verification associated with this initialization SEI. An example of the proposed new syntax is indicated in Table 1 with an Italic font.Table 1. Example of DSCI SEI message modified to support excluded subpictures digitally_signed_content_initialization( payloadSize ) { Descriptor dsci_id u(8) dsci_hash_method_type u(8) dsci_key_source_uri st(v) dsci_num_verification_substreams_minusl ue(v) for( i = 1; i <= dsci_num_verification_substreams_minusl; i++ )for( j = 0; j < i ; j++ )dsci_ref_substream_flag[ i ][ j ] u(l) dsci_key_retrieval_mode_idc ue(v) if ( dsci_key_retrieval_mode_idc = = 1) {dsci_use_key_register_idx_flag u(D if( dsci_use_key_register_idx_flag )dsci_key_register_idx ue(v) }dsci_content_uuid_present_flag u(D if( dsci_content_uuid_present_flag)dsci_content_uuid u(128) dsci_exclusion .flag u(l) if ( dsci_exclusion_flag ){dsci_exclud_subpic_num_minusl u(8) dsci_exclud_subpic_id_len_minusl u(4) for( i = 0; i < = dsci_exclud_subpic_num_minusl ; i++ )dsci_exchid_subpic_id[ i ] u(v) }}

[0020] The proposed new semantic are:dsci_exclusion_flag equal to 1 indicates that one or more subpictures are excluded from the content verification. dsci_exclusion_flag equal 0 indicates no subpicture is excluded in the verification calculation.dsci_exclud_subpic_num_minusl plus 1 indicates the number of subpictures that are excluded in the content verification. This value shall not be larger than the existing subpictures in the coded stream. For instance, in the case of VVC (ISO / IEC 23009-3), this value shall be smaller than or equal to sps_num_subpics_minusl.D25043W001 - 5 -dsci_exclud_subpic_id_len_minusl plus 1 specifies the number of bits used to represent the syntax element dsci_exclud_subpic_id[ i]. This value shall be equal to sps_subpic_id_len_minusl .dsci_exclud_subpic_id[ i ] specifies the subpicture ID of the i-th subpicture that is excluded in this content verification. The length of the dsci_exclud_subpic_id[i] syntax element is dsci_exclud_subpic_id_len_minusl+ 1 bits. This value shall be identical to one of the subpicture id values that are signalled in the bitstream. For instance, in the case of VVC (ISO / IEC 23009-3), it shall be identical to one of sps_subpic_id[ i ] or pps_subpic_id[i], whichever is present in the bitstream.

[0021] To exclude one or more regions of interest (ROIs) from signature authentication, during encoding, an encoder divides the picture areas to various subpiclures, such that a subset of them define the excluded ROI. During the encoding, a DS CI list is generated that lists the subpicture IDs that represent the excluded ROI. Any update to the DSCI includes the update to the subpicture IDs that are excluded, if any. The update can remove the excluded ROI all together. In calculation of the signature, the following pseudocode may used:while (! (End of CVS)) {if ( current NAL = coded sliced NAL)for( i = 0: i <= dsci_exclud_subpic_num_minusl; i++ ){ if (cument NAL’s sh_subpuc_id != dsci_exclud_subpic_id[i]) continue to calculate the digital signature (e.g., as defined in sections 8.39 and 8.40 of Ref.[2]);_ } _Note: CVS stands for coded video sequence and NAL stands for Network Abstraction Layer.

[0022] In a receiver, after the receiver detects the DSCI SEI message with dsci_exclusion_flag set to 1, it monitors the coded sliced NALs and filters the NALs that belong to the list of excluded subpictures by matching the sh_subpic_id of the slice header to the list of excluded subpicture IDs in DSCI. The same pseudocode as above can be used for calculating the digital signatures at the receiver.

[0023] In a second embodiment, instead of extending the existing DSCI SEI message, one may define a new SEI message, say the digital signed content exclusion SEI message. An example of such a message is provided in Table 2.D25043W001 - 6 -Table 2. Example of DSC exclusion SEI messagedigitally_signed_content_exclusion areas(payloadSize ) { Descriptor dscejd u(8) dsci_exclusion_flag u(D if (dsci_exclusion_flag){dsci_exclud_subpic_num_minus 1 u(8) dsci_exclud_subpic JdJen_minus 1 u(4) for( i - 0J <= dsci_exclud_subpic_num_minusl; i++ )dsci_exclud_subpicjd[i] u(v) 1}

[0024] The semantics and the digital signature encoding and decoding processes remain the same as those discussed earlier. Furthermore,dsce_id contains an identifying number that may be used to identify the subpictures to be excluded for verifying that the coded video has been produced by a content provider.The digitally signed content exclusion SEI message identifies the subpictures to be excluded for verifying the digital signature of a substream indicated in a digitally signed content initialization SEI message indicated by dsci_id equal to dsce_id.When a CVS does not contain a digitally signed content initialization SEI message identified by dsci_id equal to dscv_id, CLVSs (coded layer video sequences) of the CVS shall not contain digitally signed content exclusion SEI message identified by dsci_id equal to dsce_id. When an access unit (AU) contains both a digitally signed content initialization SEI message identified by dsci_id equal to dsce_id and a digitally signed content exclusion SEI message identified by dscijd equal to dscejd, the digitally signed content initialization SEI message shall precede the digitally signed content exclusion SEI message.

[0025] The two proposed signaling methods allow the verification of various subpicture sets by assigning a different exclusion list of subpictures to DSCIs with different dsci_id (or dscejd). In this approach, each dsci with unique dsci d, includes the list of excluded subpictures. Therefore, various regions of interest (such as overlays) can be signaled by excluding all subpicture IDs that are not included in the region of interest. Then for each dscijd, only the coded sliced NALs that are included in the ROI are used for calculating the signature.

[0026] In some applications, instead of signaling excluded ROIs it may be beneficial to signal the list of ROIs to be included when calculating the digital signature. Using again the D25043W001 - 7 -DSCI SEI message as a basis, Table 3 provides an example, where the new syntax is depicted in Italics.Table 3. Example of a DSCI SEI message modified to support included subpictures digitally_signed_content_initialization( payloadSize ) { Descriptor dsci_id u(8) dsci_hash_method_type u(8) dsci_key_source_uri st(v) dsci_num_verification_substreams_minusl ue(v) for( i = 1; i <= dsci_num_verification_substreams_minusl; i++ )for( j = 0; j < i ; j++ )dsci_ref_substream_flag[ i ][ j ] u(D dsci_key_retrieval_mode_idc uc(v) if( dsci_key_retrieval_mode_idc = = 1) {dsci_use_key_register_idx_flag u(l) if( dsci_use_key_register_idx_flag )dsci_key_register_idx ue(v) 1dsci_content_uuid_present_flag U(l) if( dsci_content_uuid_presenl_flag)dsci_content_uuid u(128) dsci_inclusion .flag u(l) if( dscijnclusion Jlag){dsci_includ_subpic_num_minusl u(8) dsci_includ_subpic_id_len_minusl u(4) for( i = 0; i <= dsci_includ_subpic_num_minusl; i++ )dsci_includ_subpic_id[i ] u{v) }}

[0027] With semantics:dsci_inclusion_flag equal to 1 indicates that one or more subpictures are included in the content verification. dsci_inclusion_flag equal 0 indicates all subpictures are included in this content verification.dsci_includ_subpic_num_minusl plus 1 indicates the number of subpictures that are included in this content verification. This value shall not be larger than the existing subpictures in the coded stream. For instance, in the case of VVC (ISO / IEC 23009-3), this value shall be smaller than or equal to sps_num_subpics_minusl.D25043W001 - 8-dsci_includ_subpic_id_len_minusl plus 1 specifies the number of bits used to represent the syntax element dsci_includ_subpic_id[i]. This value shall be equal to sps_subpic_id_len_minusl .dsci_includ_subpic_id[ i ] specifies the subpicture ID of the i-th subpicture that is included in this content verification. The length of the dsci_includ_subpic_id[ i ] syntax element is dsci_includ_subpic_id_len_minusl + 1 bits. This value shall be identical to one of the subpicture ID values that are signalled in the bitstream. For instance, in the case of VVC (ISO / IEC 23009-3), it shall be identical to one of sps_subpic_id[ i ] or pps_subpic_id[i], whichever is present in the bitstream.

[0028] During encoding, to include one or more regions of interest (ROIs) for signature authentication using ROI-dependent content verification, an encoder divides the picture areas to various subpictures, such that a subset of them defines the desired ROI. During the encoding, a DSCI list is generated that lists the subpicture IDs that represent the included ROI. Any update to the DSCI includes the update to the subpicture IDs that are included, if any. In calculation of the signature, the following pseudocode may be used:while (! (End of CVS)) {if ( current NAL = coded sliced NAL)for( i = 0; i <= dsci_includ_subpic_num_minus 1 ; i+- i- ){ if (current NAE’s sh_subpuc_id == dsci_includ_subpic_id[i]) continue to calculate the digital signature (e.g., as defined in sections 8.39 and 8.40 of Ref.[2]);}

[0029] In a receiver, after the receiver detects the DSCI SEI message with dsci_inclusion_flag set to 1, it monitors the coded sliced NALs and filters the NALs that belong to the list of included subpictures by matching the sh_subpic_id of the slice header to the list of included subpicture IDs in DSCI. The same pseudocode as above can be used for calculating the signatures at the receiver.

[0030] In another embodiment, instead of extending the existing DSCI SEI message one may define a new SEI message, say the digital signed content inclusion SEI message. Table 4 depicts an example of such a message.D25043W001 - 9 -Table 4. Example of DSC inclusion SEI messagedigitally_signed_contentjnclusion areas( payloadSize ) { Descriptor dsciijd u(8) dscijnclusion_flag u(l) if ( dsci_inclusion_flag){dsci Jnclud_subpic_num_minus 1 u(8) dsci Jnclud_subpic Jd Jen_minus 1 u(4) for( i - 0J <= dsci_includ_subpic_num_minusl; i++ )dsci Jnclud_subpic Jd [i] u(v) 1}dscii_id contains an identifying number that may be used to identify the subpictures to be included for verifying that the coded video has been produced by a content provider.The digitally signed content inclusion SEI message identifies the subpictures to be included for verifying the digital signature of a substream indicated in a digitally signed content initialization SEI message indicated by dsci_id equal to dscii Jd.When a CVS does not contain a digitally signed content initialization SEI message identified by dscijd equal to dscvjd, CLVSs (coded layer video sequences) of the CVS shall not contain digitally signed content inclusion SEI message identified by dscijd equal to dscii Jd. When an access unit (AU) contains both a digitally signed content initialization SEI message identified by dscijd equal to dscii_id and a digitally signed content inclusion SEI message identified by dscijd equal to dscii Jd, the digitally signed content initialization SEI message shall precede the digitally signed content inclusion SEI message.Combining excluding and including digital signature ROIs

[0031] In certain applications it may be suitable to use both excluded and included ROIs for digital signature detection. For example, an encoder may separate the pictures into two or more areas: a) areas that are the main picture and b) areas that are suitable for overlays. Then a receiver can detect the authenticity of both the main picture areas and the overlay areas independently of each other. In an example implementation:• The encoder uses exclusion signaling to signal the overlay area, so a first digital signature is computed for the main areaD25043W001 - 10 -• The encoder creates a second, separate, digital signature for the overlay area by signaling inclusion of the overlay area• The list of subpictures being signaled is identical in both cases, but with a different dsci_id value. This allows a receiver to validate each digital signature independently of each other, thus verifying independently the authenticity of both the main area and the overlay area.

[0032] In an embodiment, the syntax of inclusion or exclusion in Tables 1 and 3 (or Tables 2 and 4) may be combined as in Tables 5 and 6 using a 2-bit selective authentication mode parameter (e.g., dsci_selective_auth_mode).Table 5. Example of a DSCI SEI message modified to support selective authentication digitally_signed_content_initialization( payloadSize ) { Descriptor dscijd u(8) dsci_hash_method_type u(8) dsci_key_source_uri st(v) dsci_num_verification_substreams_minusl ue(v) for( i = 1; i <= dsci_num_verification_substreains_minusl; i++ )for( j = 0; j < i ; j++ )dsci_ref_substream_flag[ i ][ j ] u(l) dsci_key_retrieval_mode_idc ue(v) if( dsci_key_retrieval_mode_idc = = 1) {dsci_use_key_register_idx_flag u(D if( dsci_use_key_register_idx_flag )dsci_key_register_idx ue(v) }dsci_content_uuid_present_flag u(D if( dsci_content_uuid_present_flag)dsci_content_uuid u(128) dsci_selective_auth_mode / / 01: exclusion, 11: inclusion u(2) if ( dsci_selectivejlag !- 0){dsci_selective_subpic_num_minusl u(8) dsci_selective_subpic_id_len_minusl u(4) for( i = 0; i <= dsci_selective_subpic_num_minusl: i++ )dsci_selective_subpic_id[ i ] u(v) }}D25043W001 - 11 -Table 6. Example of DSC selective authentication SEI message digitally_signed_content_selective areas( payloadSize ) { Descriptor dscijd u(8) dsci_selective_auth_mode Z / 01 : exclusion, 11: inclusion u(2) if ( dsci_selective_flag != 0) {dsci_selective_subpic_num_minus 1 u(8) dsci_selective_subpic_id_len_minusl u(4) for( i - 0; i <= dsci_selective_subpic_num_minusl; i++ )dsci_selective_subpic_id[i] u(v) 1}dsci_selective_auth_mode equal to 1 indicates that one or more subpictures are excluded in the content verification. dsci_selective_auth_mode equal to 3 indicates that one or more subpictures are included in the content verification. dsci_selective_auth_mode equal to 0 indicates that all subpictures are included in this content verification.dsci_selective_subpic_num_minusl plus 1 indicates the number of subpictures that are excluded or included in this content verification. This value shall not be larger than the existing subpictures in the coded stream. For instance, in the case of VVC (ISO / IEC 23009- 3), this value shall be smaller than or equal to sps_num_subpics_minus 1.dsci_selective_subpic_id_len_minusl plus 1 specifies the number of bits used to represent the syntax element dsci_selective_subpic_id[i]. This value shall be equal to sps_subpic_id_len_minus 1.dsci_selective_subpic_id[ i ] specifies the subpicture ID of the i-th subpicture that is excluded or included in this content verification. The length of the dsci_selective_subpic_id[ i ] syntax element is dsci_selective_subpic_id_len_minusl + 1 bits. This value shall be identical to one of the subpicture ID values that are signalled in the bitstream. For instance, in the case of VVC (ISO / IEC 23009-3), it shall be identical to one of sps_subpic_id[ i ] or pps_subpic_id[i], whichever is present in the bitstream.

[0033] With respect to the DSC selective authentication SEI message,dscis_id contains an identifying number that may be used to identify the subpictures to be included or excluded for verifying that the coded video has been produced by a content provider.D25043W001 - 12 -The digitally signed content selective authentication SEI message identifies the subpictures to be included or excluded for verifying the digital signature of a substream indicated in a digitally signed content initialization SEI message indicated by dsci_id equal to dscis_id. When a CVS does not contain a digitally signed content initialization SEI message identified by dscijd equal to dscv_id, CEVSs (coded layer video sequences) of the CVS shall not contain digitally signed content inclusion SEI message identified by dscijd equal to dscis_id. When an access unit (AU) contains both a digitally signed content initialization SEI message identified by dsci d equal to dscis Jd and a digitally signed content selective authentication SEI message identified by dscijd equal to dscis Jd, the digitally signed content initialization SEI message shall precede the digitally signed content selective authentication SEI message.

[0034] An example of a process for selective authentication is also depicted in FIG. 2. As depicted in FIG. 2, in step 205, a processor first decides or detects whether selective authentication is enabled or not. If there is no selective authentication, then the processor applies authentication using the whole picture (208). If there is selective authentication, then, in step 210, the processor reads the number of selected subpictures to be processed (K) during selective authentication and their IDs (e.g., dsci_selective_subpicjd[i] values). Next (215), it monitors the coded sliced NALs and filters the NALs that belong to the list of the selected subpictures. If there is a match, then selective authentication (i.e., inclusion or exclusion) is applied in computing a digital signature (220), otherwise no selective authentication is applied (225).Skipping DSCS SEI messages

[0035] In an embodiment, as depicted in Table 7, one may extend the VSEI Digitally Signed Content SEI messages in Ref. [3] to allow skipping NAL units in a picture unit (PU) during the selection of NALs.Table 7. Example to skip NAL units following the DSCS SEI message digitally_signed_content_selection( payloadSize ) { Descriptor dscsjd u(8) dscs_verilication_substreamjd u(8)dscs_skip _Jlag u(l) The new semantic is given by:D25043W001 - 13 -dscs_skip_flag equal to 1 indicates that one or more NAL units in the same PU that follows the SEI message in decoding order until the next DSCS SEI message in the PU or the end of the PU, where each of the NAL units is either a non-VCL NAL unit with a NAL unit type identifier among the values in nonVclDigitallySignedNalUnitsList or a VCL NAL unit, are not associated with any message digest for the verification substrcam indicated by the DSCS SEI message. If dscs_skip_Hag is equal to 1, then the value of dscs_verification_substream_id is ignored.This allows some NALs to be skipped and not to be associated with any message digest. From Ref. [3]:dscs_id contains an identifying number of a verification system that may be applied for verifying that the coded video represented by the current verification period (i.e., the verification period for dsci_id equal to dscs_id containing the current DSCS SEI message) has been produced by the content provider indicated by the associated DSCI SEI message.dscs_verification_substream_id specifies the verification substream ID of the verification substream to which the verification substream member NAL units in the current PU are assigned.Note: embodiments presented herein may use separate verification substreams to separate the authentication of one or more subpictures from the rest of a picture unit. Hence, such applications as subpicture extraction and selective authentication are possible by allowing the inclusion and / or exclusion of regions of interest.Enabling consistency across PUs during a verification period

[0036] As appreciated by the inventors, it is important to maintain a consistent subpicture selection across PUs during a verification period. Three alternative embodiments are proposed: a) enforcing a new semantic constraint to existing semantics, b) using new semantics, and c) supporting using multiple DSCS messages with the same dscs_verification_substream_id.a) Enforcing a new a semantic constraint

[0037] In a first embodiment, as shown in Table 8, one may add a constraint to the DSCS extension discussed in Ref. [4] that the value of dscs_picture_segment_id shall beD25043W001 - 14 -constant across all PUs of a verification period. The text in Italics indicates the additional constraint.Table 8. Example of DSCS SEI messaging with a new semantic constraint allowing consistency across PUs _ _ digitally_signed_content_selection( payloadSize ) { Descriptor dscs id u(8) dscs_verification_substream_id u(8) dscs_independently_signed_picture_segments_enabled_flag u(l) if ( dscs_independently_signed_picture_segments_enabled_flag ) dscs_picture_segment_id ue(v)}dscs_picture_segment_id indicates a picture segment ID of a coded picture segment in the PU to which the SEI message applies, for which the coded picture segment is associated to the verification substream with verification substream ID equal to dscs_verification_substream_id. The value of dscs_picture_segment_id shall be in the range of 0 to 1023. This value shall be identical in all PUs of a verification period with identical values ofdscsjd and dscs_verification_substream_id.From Ref. [4] :dsci_independently_signed_picture_segments_enabled_flag equal to 1 specifies that independent signing of coded picture segments is enabled. dsci_independently_signed_picture_segments_enabled_flag equal to 0 specifies that independent signing of coded picture segments is disabled. When not present, dsci_independently_signed_picture_segments_enabled_flag is inferred to be equal to 0. The value of dscs_independently_signed_picture_segments_enabled_flag shall be equal to the value of dsci_independently_signed_picture_segments_enabled_flag of the DS CI SEI message with dsci_id equal to dscs_id.b) Using new semantics100038 J In another embodiment, as depicted in Table 9, one may move the signaling of the segment IDs to the DS CI.D25043W001 - 15 -Table 9. Example of DSCI SEI messaging with signaling of verification segment and corresponding picture segment IDs _ _ digitally _signed_content_initialization( payloadSize ) { Descriptor for( i = 1; i <= dsci_num_verification_substreams_minusl; i++ )for( j = 0; j < i ; j-i-- F )dsci_ref_substream_flag[ i ] [ j ] u(l) dsci_independently_signed_picture_segments_enabled_flag u(l) if( dsci_independently_signed jicture_segments_enabledjlag ){dsci_num_separate _picture_segment_minusl u(8) for (i - 0; i <- dsci_num_separate _j)icture_segment_minusl ; i ++ ) dsci_verification_substream_id u(8) dsci _picture_segment_id ue(v) }}The new syntax elements are:dsci_num_separate_picture_segment_minusl plus 1 indicates the number of separate verification substreams that each describes the message digest corresponding to a coded picture segment in every PU in the verification period.dsci verification substream id specifies the verification substream ID of the verification substream to which the verification substream member NAL units is assigned.dsci_picture_segment_id indicates a picture segment ID of a coded picture segment in the PU to which the SEI message applies, for which the coded picture segment is associated to the verification substream with verification substream ID equal to dscs_verification_substream_id. The value of dsci_picture_segment_id shall be in the range of O to 1023.The syntax depicted in Italics and the new syntax elements allow defining the subpictures and their corresponding verification substream IDs at DSCI, thus allowing for a consistent subpicture selection across PUs in a verification period.c) Supporting multiple DSCS with the same dscs_verification_substream_id

[0039] In another embodiment, as shown in Italics, one may enable the use of multiple DSCS messages with various subpicture IDs:D25043W001 - 16 -The value of dscs_independently_signed_picture_segments_enabled_flag shall be equal to the value of dsci_independently_signed_picture_segments_enabled_flag of the DSCI SEI message with dsci_id equal to dscs_id.dscs_picture_segment_id indicates a picture segment ID of a coded picture segment in the PU to which the SEI message applies, for which the coded picture segment is associated to the verification substream with verification substream ID equal to dscs_verification_substream_id. The value of dscs_picture_segment_id shall be in the range of 0 to 1023. Inclusion of two or more DSCS, with identical dscsjd and dscs_verification_substream_id, but with different dscs _picture_segment_id indicates that the pictures segments with those IDs in the PU are all associated to the same verification substream.Multiple subpictures in a single DSCS

[0040] Alternatively, in another embodiment, as depicted in Table 10, one may enable the use of multiple subpicture IDs in a single DSCS.Table 10. Example of enabling multiple subpicture IDs in a single DSCS digital]y_signed_content_selection( payloadSize ) { Descriptor dscsjd u(8) dscs_verification_substreamjd u(8) dscsjndependently_signed_picture_segments_enabled_flag u(l) if ( dscsjndependently_signed_picture_segments_enabled_flag ){ dscs_num_subpic_minusl u(8) for(i - 0; i <= dsci_num_subpic_minusl ; i + + )dscs _picture segment _id ue(v) }}Where:dscs_num_subpic_minusl plus 1 indicates the number of picture segments that are associated with the verification substream identified by dscs_verification_substream_id.Signaling cross-PU consistency in DSCI.D25043W001 - 17 -

[0041] In an embodiment, as depicted in Table 11, if both options of cross-PU consistency and inconsistency are desired, one may signal the list of verification substream IDs that are consistent in DSCI. Proposed amendments to the current proposal are shown in Italics.Table 11. Example of signaling consistent verification substreams’ IDs in DSCI _ digitally_signed_content_initialization( payloadSize ) { Descriptor for( i = 1; i <= dsci_num_verification_substreams_minusl; i++ )for( j = 0; j < i ; j++ )dsci_ref_substream_flag[ i ] [ j ] u(l) dsci_independently_signed_picture_segments_enabled_flag u(l) if (dsci_indcpcndcntly_signcd_picturc_scgmcnts_cnablcd_flag) {dsci_consistent _j)icture_segments_enabled Jlag U(l) if(dsci_consistent _picture_segments_enabledjlag) {dseijnax _picture_segments_minusl u(8) for( i = 0; i <= dsci_max_layers_minusl ; i++ ) dsci_consistent_verification_substream_id[i] u(8) / }The new syntax elements are:dsci_consistent_picture_segments_enabled_flag equal to 1 specifies that one or more subpicturcs arc assigned to one verification substrcam during the verification period.dsci_max_picture_segments_minusl plus 1 indicates the number of the verification substreams that are consistent by having NALs from specific subpictures.dsci_consistent_verification_substream_id specifies the verification substream ID of the verification substream where the same picture segment(s) are assigned to in each PU during the verification period.Selective authentication by signaling additional properties of the DSC

[0042] In another embodiment, as depicted in Table 12, one may enable selective authentication by defining two new parameters to be added to the DSCI message, to describe additional properties of the DSC. These parameters allow the content author to provide information about the application and authentication characteristics of the digitally signed content SEIs.D25043W001 - 18 -Table 12. Example of signaling additional properties in a DSCI message digital]y_signed_content_initialization( payloadSize ) { Descripto r dsci_id u(8) dsci_hash_method_type u(8) dsci_kcy_retricval_mode_idc ue(v) iff dsci_key_retrieval_mode_idc = = 1 ) {dsci_use_key_register_idx_flag u(l) if( dsci_use_key_register_idx_flag )dsci_key_register_idx ue(v) }dsci_content_uuid_present_flag u(l) if( dsci_content_uuid_present_flag )dsci_content_uuid u(128) dsci_num_verification_substreams_minusl ue(v) for( i = 1; i <= dsci_num_verification_substreams_minusl; i++ )for( j = 0; j < i ; j++ )dsci_ref_substream_flag[ i ][ j ] u(D dsci vss implicit association mode flag u( 1 ) dsci_signed_content_start_flag U(l) dsci_sei_signing_flag u(l) dsci_information _Jlagwhile( !byte_aligned( ) )dsci_alignment_zero_bit f(l) dsci_key_source_uri st(v) if( dsci_informationJTag ){dsci_information_uridsci_infonnation_data Sl(v) }1Where the new syntax elements are:dsci_information_flag equal to 1 indicates this SEI contains additional information on the DSC application.dsci_information_uri contains a uniform resource identifier (URI) with syntax and semantics as specified in IETF Internet Standard 66 which identifies the format of dsci_information_data.dsci_information_data contains the additional information regarding this DSC characteristics. The sematic of this field is defined by dsci_information_uri.D25043W001 - 19 -

[0043] The dsci_information_uri and dsci_information_data can be used to signal the characteristic of the DSC. For instance, the following Table shows a few examples of such use cases.Examples of provided application information in DSCIUse case dsei_information_uri dsci_information_uri value example value Separate DSC verification for certain urn : j vet : vsei :dsc : info : sep “1 2” number of subpictures from the rest of aratePU (white space separated list of separated subpicture ids) Selection NAL for propose of reducing urn:jvet:vsei:dsc:info:red N / A computational complexity ucedcomplexitySkipped subpictures in DSC (for um:jvet:vsei:dsc:info:skip “3 5” applications such as replaceable ROI) ped (white space separated listof subpicture ids)Signaling of ROIs using scalable nesting SEIs

[0044] In another embodiment, one may also define an alternative approach for signaling an authentication ROI using the scalable nesting SEI, which is defined in Annex D of the H.266 specification (Ref. [1]) and copied herein as Table 13. In an example, the scalable nesting SEI supports the following syntax:Table 13. The employed VVC’s Scalable nesting SEI message for signaling selection / separation of subpictures for DSC streams or different verification bitstreams scalable_nesting( payloadSize ) { Descriptor sn_ols_flag u(l) sn_subpic_flag u(l) if( sn_ols_flag ) {sn_num_olss_minusl ue(v) for( i = 0; i <- sn_num_olss_minusl; i++ )sn_ols_idx_delta_minusl[ i ] ue(v) } else {sn_all_layers_flag u(l) if( !sn_all_layers_flag ) {sn_num_layers_minusl ue(v)for( i = 1 ; i <= sn_num_layers_minus 1 ; i++ )D25043W001 - 20 -sn_layer_id[ i ] u(6) })if( sn_subpic_flag ) {sn_num_subpics_minusl ue(v) sn_subpic_id_len_minusl ue(v) for( i = 0; i <= sn_num_subpics_minus 1 ; i++ )sn_subpic_id[ i ] u(v) }sn_num_seis_minusl uc(v) while( !byte_aligned( ) )sn_zero_bit / * equal to 0 * / u(l) for( i = 0; i <= sn_num_seis_minusl; i++ )sei_message( )}

[0045] In an embodiment, the scalable nesting SEI is employed by using sn_num_subpics_minus 1 parameter to define the number of subpictures that are in the ROI. For each subpicture exists a dedicated sei_message that may include one of the following solutions:• solution 1 (DSCS): replacing the DSCS with a scalable nesting SEI containing the DSCS (with no picture_segment_id) in its sei_message() with the following constraints; or• solution 2 (DSCI): replacing the DSCI with a scalable nesting SEI containing the DSCI in its sei_message().

[0046] Both solutions allow use of single or multiple subpictures in one verification stream, since either DSCS or DSCI is defined for each subpicture. In both solutions, the following parameters shall be set as the following: sn_ols_flag = 0, sn_subpic_flag = 1, sn_all_layers_flag =1. Solution 2 provides consistency in a verification period, since the subpictures are defined at the beginning of the verification period. Further, the DSCIs of various subpictures may have the same dsci_id, meaning that the NALs of the corresponding DSCIs are part of the same verification stream. Such DSCIs shall have identical values for the following parameters: dsci_hash_method_type, dsci_key_retrieval_mode_idc, dsci_use_key_register_idx_flag, dsci_key_register_idx, dsci_content_uuid_present_flag, dsci_content_uuid, dsci_num_verification_substreams_minus 1 ,D25043W001 - 21 -dsci_ref_substream_flag[ i ][ j ] for every i and j, dsci_vss_implicit_association_mode_flag , dsci_signed_content_start_flag, dsci_sei_signing_flag, and dsci_key_source_uri.

[0047] For solution 1 (DSCS), if the values of dscs_verification_substream_id are identical between two scalable nesting SEIs, then the corresponding subpictures are associated with the same verification substrcam. For signaling cross-PU consistency one of the methods described earlier can be used (see Tables 8, 9, and 11).Note: For reference, the semantic of sn_ols_flag, sn_subpic_flag, and sn_all_layers_flag are (Ref.[l]):sn_ols_flag equal to 1 specifies that the scalable-nested SEI messages apply to specific OLSs. sn_ols_flag equal to 0 specifies that the scalable-nested SEI messages apply to specific layers.sn_subpic_flag equal to 1 specifies that the scalable-nested SEI messages that apply to specified OLSs or layers apply only to specific subpictures of the specified OLSs or layers. sn_subpic_flag equal to 0 specifies that the scalable-nested SEI messages that apply to specific OLSs or layers apply to all subpictures of the specified OLSs or layers.sn_all_layers_flag equal to 1 specifies that the scalable-nested SEI messages apply to all layers that have nuh_layer_id greater than or equal to the nuh_layer_id of the current SEI NAL unit. sn_all_layers_flag equal to 0 specifies that the scalable-nested SEI messages might or might not apply to all layers that have nuh_layer_id greater than or equal to the nuh_layer_id of the current SEI NAL unit.ReferencesEach one of the references listed herein is incorporated by reference in its entirety. The term JVET refers to the Joint Video Experts Team of ITU-T SG21 WP3 / 21 and ISO / IEC JTC 1 / SC 29.[1] ITU-T Rec. H.266, “Versatile Video Coding,” ITU-T, (v3) Sep. 2023[2] J. Boyce, et al., “Additional SEI messages for VSEI version 4 (Draft 5),” JVET-AK2006, JVET 37thMeeting, Geneva, CH, Jan. 2025.D25043W001 - 22 -[3] J. Boyce, et al., “Additional SEI messages for VSEI version 4 (Draft 7),” JVET-AM2006, JVET 39thMeeting, Daejeon, KR, July 2025.[4] S. McCarthy, et al. “Technologies under consideration for future extensions of VSEI (version 9),” JVET-AM2032, JVET 39thMeeting, Daejeon, KR, July 2025.EXAMPLE COMPUTER SYSTEM IMPLEMENTATION

[0048] Embodiments of the present invention may be implemented with a computer system, systems configured in electronic circuitry and components, an integrated circuit (IC) device such as a microcontroller, a field programmable gate array (FPGA), or another configurable or programmable logic device (PLD), a discrete time or digital signal processor (DSP), an application specific IC (ASIC), and / or apparatus that includes one or more of such systems, devices or components. The computer and / or IC may perform, control, or execute instructions relating to media authentication in video coding, such as those described herein. The computer and / or IC may compute any of a variety of parameters or values that relate to media authentication in video coding as described herein. T he image and video embodiments may be implemented in hardware, software, firmware and various combinations thereof.

[0049] Certain implementations of the invention comprise computer processors which execute software instructions which cause the processors to perform a method of the invention. For example, one or more processors in a display, an encoder, a set top box, a transcoder, or the like may implement methods related to media authentication in video coding as described above by executing software instructions in a program memory accessible to the processors. Embodiments of the invention may also be provided in the form of a program product. The program product may comprise any non-transitory and tangible medium which carries a set of computer-readable signals comprising instructions which, when executed by a data processor, cause the data processor to execute a method of the invention. Program products according to the invention may be in any of a wide variety of non-transitory and tangible forms. The program product may comprise, for example, physical media such as magnetic data storage media including floppy diskettes, hard disk drives, optical data storage media including CD ROMs, DVDs, electronic data storage media including ROMs, flash RAM, or the like. The computer-readable signals on the program product may optionally be compressed or encrypted.

[0050] Where a component (e.g. a software module, processor, assembly, device, circuit, etc.) is referred to above, unless otherwise indicated, reference to that component (including a D25043W001 - 23 -reference to a "means") should be interpreted as including as equivalents of that component any component which performs the function of the described component (e.g., that is functionally equivalent), including components which are not structurally equivalent to the disclosed structure which performs the function in the illustrated example embodiments of the invention.EQUIVALENTS, EXTENSIONS, ALTERNATIVES AND MISCELLANEOUS

[0051] Example embodiments that relate to media authentication in video coding are thus described. In the foregoing specification, embodiments of the present invention have been described with reference to numerous specific details that may vary from implementation to implementation. Thus, the sole and exclusive indicator of what is the invention, and what is intended by the applicants to be the invention, is the set of claims that issue from this application, in the specific form in which such claims issue, including any subsequent correction. Any definitions expressly set forth herein for terms contained in such claims shall govern the meaning of such terms as used in the claims. Hence, no limitation, element, property, feature, advantage or attribute that is not expressly recited in a claim should limit the scope of such claim in any way. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

[0052] Various aspects of the present disclosure may be appreciated from the following Enumerated Example Embodiments (EEEs):EEE 1. A method to perform selective media authentication, the method comprising:receiving a coded picture comprising two or more subpictures; detecting whether selective media authentication is enabled or not for the coded picture;if selective media authentication is enabled, then:identifying a set of selected subpictures from the two or more subpictures for selective media authentication, wherein: for excluded media authentication, the set of selected subpictures is excluded from computing a digital signature for the coded picture and for inclusive media authentication, only the set of selected subpictures is used for computing a digital signature for the coded picture.EEE 2. A method to generate a bitstream with selective media authentication, the method comprising:D25043W001 - 24 -encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures;if selective media authentication is enabled for the bitstream, then: identifying a set of selected subpictures from the two or more coded subpicturcs for selective media authentication, wherein: for excluded media authentication, the set of selected subpictures is excluded from computing a digital signature for the coded picture and for inclusive media authentication, only the set of selected subpictures is used for computing a digital signature for the coded picture; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises:a first flag indicating that selective media authentication is enabled; a first parameter indicating how many subpictures are used in selective media authentication; andan ID parameter for each subpicturc in the set of selected subpicturcs.EEE 3. The method of EEE 2, wherein the signaling section further includes a media authentication ID to distinguish between media authentication methods within the video picture.EEE 4. The method of EEE 2, wherein the first flag indicates that the set of selected subpictures is excluded from media authentication.EEE 5. The method of EEE 2, wherein the first flag indicates that only the set of selected subpictures is to be used for media authentication.EEE 6. The method of EEE 2, wherein the signaling section comprises high-level syntax in the bitstream.EEE 7. The method of EEE 2, wherein the signaling section comprises syntax parameters in a supplemental enhancement information (SEI) message.EEE 8. A method to perform selective media authentication, the method comprising:in decoder, receiving metadata in a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message;D25043W001 - 25 -accessing a DSC skip flag; andif the DSC skip flag is enabled, then skipping authenticating NAL units in the video content associated with the DSC message.EEE 9. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream; and generating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, whereinif the DSC message includes a DSC picture segment ID parameter (dscs_picture_segment_id) which indicates a picture segment ID of a coded picture segment in a picture unit (PU) to which the DSC message applies,then the DSC picture segment ID parameter is identical in all PUs of a verification period with identical values of a DSC verification system ID (dscs_id).EEE 10. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises one or more of:a first parameter ( dsci_num_separate_picture_segment_minusl) which indicates a number of separate verification substreams that each describes a message digest corresponding to a coded picture segment in every PU in a verification period;a second parameter (dsci_verification_substream_id) which specifies the verification substream ID of the verification substream to which verification substream member NAL units are assigned; anda third parameter (dsci_picture_segment_id) which indicates a picture segment ID of a coded picture segment in the PU to which the DSC message applies, for which the codedD25043W001 - 26 -picture segment is associated to the verification substream with verification substream ID equal to the second parameter (dscs_verification_substream_id).EEE 11. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises a parameter (dscs_num_subpic_minusl) indicating the number of separate verification substreamsthat each describes a message digest corresponding to a coded picture segment in every PU in a verification period.EEE 12. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises one or more of:a first parameter (dsci_consistent_picture_segments_enabled_flag) which when equal to 1 specifies that one or more subpictures are assigned to one verification substream during a verification period;a second parameter (dsci_max_picture_segments_minusl) indicating the number of the verification substreams that are consistent by having NALs from specific subpictures; and a third parameter (dsci_consistent_verification_substream_id) which specifies the verification substream ID of the verification substream where the same picture segment(s) are assigned to in each PU during the verification period.D25043W001 - 27 -EEE 13. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises one or more of:a first flag (dsci_information_flag), which when equal to 1 indicates the DSC message contains additional information related to content authentication;a DSC uniform resource identifier (URT) for a third syntax parameter( dsci_information_data), wherein the third syntax parameter contains the additional information related to content authentication.EEE 14. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a scalable nesting SEI message to enable authenticating video content associated with the scalable nesting message, wherein the scalable nesting SEI message comprises:a first parameter (sn_num_subpics_minusl) indicating a number of subpictures defining a region of interest (RO I) that are excluded from authentication; anda dedicated SEI message for each of the subpictures defining the ROI, wherein the dedicated SEI message contains either a digitally signed content selection (DSCS) SEI message or a digitally signed content selection initialization (DSCI) SEI message.EEE 15. A tangible computer- readable storage medium having stored thereon computerexecutable instructions for executing with one or more processors a method in accordance with any one of the methods recited in EEEs 1-14.D25043W001 - 28 -EEE 16. An apparatus comprising a processor and configured to perform any one of the methods recited in EEEs 1-14.D25043W001 - 29 -

Claims

CLAIMSWhat is claimed is:

1. A method to perform selective media authentication, the method comprising:receiving a coded picture comprising two or more subpictures; detecting whether selective media authentication is enabled or not for the coded picture;if selective media authentication is enabled, then:identifying a set of selected subpictures from the two or more subpictures for selective media authentication, wherein: for excluded media authentication, the set of selected subpictures is excluded from computing a digital signature for the coded picture and for inclusive media authentication, only the set of selected subpictures is used for computing a digital signature for the coded picture.

2. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures;if selective media authentication is enabled for the bitstream, then: identifying a set of selected subpictures from the two or more coded subpictures for selective media authentication, wherein: for excluded media authentication, the set of selected subpictures is excluded from computing a digital signature for the coded picture and for inclusive media authentication, only the set of selected subpictures is used for computing a digital signature for the coded picture; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises:a first flag indicating that selective media authentication is enabled; a first parameter indicating how many subpictures are used in selective media authentication; andan ID parameter for each subpicture in the set of selected subpictures.

3. The method of claim 2, wherein the signaling section further includes a media authentication ID to distinguish between media authentication methods within the video picture.D25043W001 - 30 -4. The method of claim 2, wherein the first flag indicates that the set of selected subpictures is excluded from media authentication.

5. The method of claim 2, wherein the first flag indicates that only the set of selected subpicturcs is to be used for media authentication.

6. The method of claim 2, wherein the signaling section comprises high-level syntax in the bitstream.

7. The method of claim 2, wherein the signaling section comprises syntax parameters in a supplemental enhancement information (SEI) message.

8. A method to perform selective media authentication, the method comprising:in decoder, receiving metadata in a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message:accessing a DSC skip flag: andif the DSC skip flag is enabled, then skipping authenticating NAL units in the video content associated with the DSC message.

9. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream; and generating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, whereinif the DSC message includes a DSC picture segment ID parameter (dscs_picture_segment_id) which indicates a picture segment ID of a coded picture segment in a picture unit (PU) to which the DSC message applies,then the DSC picture segment ID parameter is identical in all PUs of a verification period with identical values of a DSC verification system ID (dscsjd).

10. A method to generate a bitstream with selective media authentication, the method comprising:D25043W001 - 31 -encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises one or more of:a first parameter ( dsci_num_separate_picture_segment_minusl) which indicates a number of separate verification substreams that each describes a message digest corresponding to a coded picture segment in every PU in a verification period;a second parameter (dsci_verification_substream_id) which specifies the verification substream ID of the verification substream to which verification substream member NAL units are assigned; anda third parameter (dsci_picture_segment_id) which indicates a picture segment ID of a coded picture segment in the PU to which the DSC message applies, for which the coded picture segment is associated to the verification substream with verification substream ID equal to the second parameter (dscs_verification_substream_id).

11. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises a parameter (dscs_num_subpic_minusl) indicating the number of separate verification substreamsthat each describes a message digest corresponding to a coded picture segment in every PU in a verification period.

12. A method to generate a bitstream with selective media authentication, the method comprising:D25043W001 - 32 -encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises one or more of:a first parameter (dsci_consistent_picture_segments_enabled_flag) which when equal to 1 specifies that one or more subpictures are assigned to one verification substream during a verification period;a second parameter (dsci_max_picture_segments_minusl) indicating the number of the verification substreams that are consistent by having NALs from specific subpictures; and a third parameter (dsci_consistent_verification_substream_id) which specifies the verification substream ID of the verification substream where the same picture segment(s) are assigned to in each PU during the verification period.

13. A method to generate a bitstream with selective media authentication, the method comprising:encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a digitally signed content (DSC) message to enable authenticating video content associated with the DSC message, wherein the DSC message comprises one or more of:a first flag (dsci_information_flag), which when equal to 1 indicates the DSC message contains additional information related to content authentication;a DSC uniform resource identifier (URI) for a third syntax parameter( dsci_information_data), wherein the third syntax parameter contains the additional information related to content authentication.

14. A method to generate a bitstream with selective media authentication, the method comprising:D25043W001 - 33 -encoding a video picture as a coded picture in the bitstream, wherein the coded picture comprises two or more coded subpictures; andgenerating a signaling section for the coded picture in the bitstream, wherein the signaling section comprises a scalable nesting SEI message to enable authenticating video content associated with the scalable nesting message, wherein the scalable nesting SEI message comprises:a first parameter (sn_num_subpics_minus 1 ) indicating a number of subpictures defining a region of interest (ROI) that are excluded from authentication; anda dedicated SEI message for each of the subpictures defining the ROI, wherein the dedicated SEI message contains either a digitally signed content selection (DSCS) SEI message or a digitally signed content selection initialization (DSCI) SEI message.

15. A tangible computer- readable storage medium having stored thereon computerexecutable instructions for executing with one or more processors a method in accordance with any one of the methods recited in claims 1-14.

16. An apparatus comprising a processor and configured to perform any one of the methods recited in claims 1-14.D25043W001 - 34 -

Images