Image sensor and methods for generating signature for verification of an image

Abstract

An image sensor (110) for being communicatively connected to an application processor, AP, (120) implementing an image signal processing, ISP, unit (120a), the sensor device comprising processing circuitry (110a) The processing circuitry is configured to obtain raw image data (210), generate a thumbnail (212) of the raw image data (210), generate at least one first timestamp, generate a sensor signature (214), when the image sensor (110) is communicatively connected to the AP (120) send, to the AP (120), the raw image data (210), the thumbnail (212), the first timestamp, the sensor identifier, and the sensor signature (214). Further, there is an AP (120), a verifier device (130), an image sensor (110) related method, an AP (130) related method, and a verifier device (130) related method.

Description

[0001] IMAGE SENSOR AND METHODS FOR GENERATING SIGNATURE TECHNICAL FIELD

[0002] The disclosure relates to an image sensor, an application processor, a verifier device and methods performed by the image sensor, the application processor, and the verifier device. Related computer programs and computer readable storage media are also disclosed.

[0003] BACKGROUND

[0004] Creation of Artificial Intelligent (Al)-generated media such as hyper-realistic images and videos e.g. using Generative Artificial Intelligence (GenAI), have revolutionized digital media. While the creation of Al-generated media offers remarkable opportunities for creativity and efficiency, it also poses significant challenges related to trust and authenticity as it is increasingly difficult to distinguish between genuine media and manipulated or a synthetic creation. As Al-generated media becomes more sophisticated, potential for misuse grows. Deepfakes can be employed to spread false information, impersonate individuals, or manipulate public opinion, undermining trust in digital content and media sources. Thus, there is a growing demand for mechanisms to verify an authenticity of media content and assure consumers of its integrity.

[0005] The most common solution for manufacturing, cost and market / procurement reasons, especially for high-end smartphones and professional cameras, involves the image sensor and image signal processor (ISP) for image processing being housed on separate chips from different manufacturers. A separation allows device manufacturers to select components for each function, optimizing performance and image quality. Some companies specialize in producing high-quality image sensors. Other manufacturers develop application processors that include integrated ISPs. Image sensor manufacturers and application processor manufacturers use agreed formats for an electrical as well as logical interface between the image sensor and the application processor.With separate chips, even if they are soldered to a circuit board in such a way that signals remain hidden between two chips, an attacker can desolder the components so that the attacker can feed the ISP in an application processor with an image generated by GenAI. To prevent an exchange of an unprocessed image with an image generated by GenAI, the unprocessed image sent from the image sensor to the application processor may be cryptographically protected and verified by the application processor. The application processor may then only process the image upon successful verification.

[0006] WO 2022 / 184587 A1 relates to an image sensor device. The image sensor device has a data communication interface configured to receive a hash value from an application processor, a cryptographically secure storage storing a cryptographic key of the image sensor device, and a processor configured to sign captured image data or a processed version thereof and the received hash value using the cryptographic key to generate a signature of the image data. The data communication interface is configured to transmit the generated signature, the captured image data, and an identifier of the image sensor.

[0007] Sending a cryptographically protected image to the application processor for verification or receiving the hash value from the application processor as in WO 2022 / 184587 A1 requires a dependency of cryptographic formats and algorithms between the sensor and ISP, besides the format of the data transfer between the two components.

[0008] Therefore, additional security measures need to be implemented to improve and simplify the verification of an image such as for reducing a risk against a misuse of an image generated by GenAI.

[0009] SUMMARY

[0010] An object of the invention is to enable an improved verification of that an image captured by an image sensor and processed by an application processor is unmodified.

[0011] A first aspect of the invention relates to an image sensor for being communicatively connected to an application processor, AP, implementing an image signalprocessing, ISP, unit, the sensor device comprising processing circuitry. The processing circuitry is configured to obtain raw image data, generate a thumbnail of the raw image data based on at least a part of the raw image data, generate at least one first timestamp indicative of when the image sensor obtains the raw image data, generates the thumbnail, and / or sends the thumbnail, generate a sensor signature based on the thumbnail, the first timestamp, and a sensor identifier of the image sensor, using a first private key of a first public-private key pair for the image sensor, and when the image sensor is communicatively connected to the AP: send, to the AP, the raw image data, the thumbnail, the first timestamp, the sensor identifier, and the sensor signature.

[0012] A second aspect of the invention relates to an application processor, AP, for being communicatively connected to an image sensor, and comprising an image signal processing, ISP, unit of the AP and a processing circuitry. The processing circuitry is configured to when the image sensor is communicatively connected to the AP: receive, from the image sensor, raw image data, a thumbnail of the raw image data, at least one first timestamp, a sensor identifier of the image sensor, and a sensor signature; generate, using the ISP unit of the AP, at least one processed image based on the raw image data; generate at least one second timestamp indicative of when the AP receives the raw image data, the thumbnail of the raw image data, the first timestamp, the sensor identifier, and the sensor signature, and / or when the AP has generated the processed image; generate an AP signature based on the processed image, an AP identifier of the AP, and the second timestamp using a second private key of a second private-public key pair for the AP; output the processed image, the sensor signature, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and the AP identifier. A third aspect of the invention relates to a verifier device, the verifier device comprising processing circuitry. The processing circuitry is configured to: obtain at least one processed image, a thumbnail of raw image data, at least one first timestamp, a sensor identifier of an image sensor, a sensor signature, an application processor, AP, signature, at least one second timestamp, and an AP identifier of an AP implementing an image signal processor, ISP, unit of the AP, wherein the first timestamp is indicative of when the image sensor obtains the raw image data,generates the thumbnail, sends the thumbnail and / or sends the raw image data, and wherein the second timestamp is indicative of when the AP receives the raw image data, the thumbnail of the raw image data, the first timestamp, the sensor identifier, and the sensor signature, and / or when the AP has generated the processed image; determine that the processed image is modified or unmodified based on a verification of the sensor signature using a first public key of a first public-private key pair, the thumbnail, the first timestamp, and the sensor identifier, a verification of the AP signature using a second public key of a second public-private key pair, the processed image, the AP identifier, and the second timestamp, an image difference verification between the processed image and the thumbnail, and a time difference verification between the first timestamp and the second timestamp.

[0013] A fourth aspect of the invention relates to a method performed by an image sensor for being communicatively connected to an application processor, AP, implementing an image signal processing, ISP, unit. The method comprises: obtaining raw image data; generating a thumbnail of the raw image data based on at least a part of the raw image data; generating at least one first timestamp indicative of when the image sensor obtains the raw image data, generates the thumbnail, and / or sends the thumbnail; generating a sensor signature based on the thumbnail, the first timestamp, and a sensor identifier of the image sensor, using a first private key of a first public-private key pair for the image sensor; and when the image sensor is communicatively connected to the AP: sending, to the AP, the raw image data, the thumbnail, the first timestamp, the sensor identifier, and the sensor signature.

[0014] A fifth aspect of the invention relates to a method performed by an application processor, AP, for being communicatively connected to an image sensor, and comprising an image signal processing, ISP, unit of the AP. The method when the image sensor is communicatively connected to the AP comprises: receiving, from the image sensor, raw image data, a thumbnail of the raw image data, at least one first timestamp, a sensor identifier of the image sensor, and a sensor signature; generating, using the ISP unit of the AP, at least one processed image based on the raw image data; generating at least one second timestamp indicative of when the AP receives the raw image data, the thumbnail of the raw image data, the first timestamp, the sensor identifier, and the sensor signature, and / or when the AP hasgenerated the processed image; generating an AP signature based on the processed image, an AP identifier of the AP, and the second timestamp using a second private key of a second private-public key pair for the AP; outputting the processed image, the sensor signature, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and the AP identifier. A sixth aspect of the invention relates to a method performed by a verifier device. The method comprises: obtaining at least one processed image, a thumbnail of raw image data, at least one first timestamp, a sensor identifier of an image sensor, a sensor signature, an application processor, AP, signature, at least one second timestamp, and an AP identifier of an AP implementing an image signal processor, ISP, unit of the AP, wherein the first timestamp is indicative of when the image sensor obtains the raw image data, generates the thumbnail, sends the thumbnail and / or sends the raw image data, and wherein the second timestamp is indicative of when the AP receives the raw image data, the thumbnail of the raw image data, the first timestamp, the sensor identifier, and the sensor signature, and / or when the AP has generated the processed image; determining that the processed image is modified or unmodified based on a verification of the sensor signature using a first public key of a first public-private key pair, the thumbnail, the first timestamp, and the sensor identifier, a verification of the AP signature using a second public key of a second public-private key pair, the processed image, the AP identifier, and the second timestamp, an image difference verification between the processed image and the thumbnail, and a time difference verification between the first timestamp and the second timestamp.

[0015] A seventh aspect of the invention relates to an image sensor for being communicatively connected to an application processor, AP, implementing an image signal processing, ISP, unit, the sensor device comprising processing circuitry and a computer readable storage medium. The processing circuitry is configured to: obtain raw image data; generate a thumbnail of the raw image data based on at least a part of the raw image data; generate at least one first timestamp indicative of when the image sensor obtains the raw image data, generates the thumbnail, and / or sends the thumbnail; generate a sensor signature based on the thumbnail, the first timestamp, and a sensor identifier of the image sensor, using a first private key of a first public-private key pair for the image sensor; and when the image sensor is communicatively connected to the AP: send, to the AP, the raw image data, the thumbnail, the first timestamp, the sensor identifier, and the sensor signature.

[0016] An eighth aspect of the invention relates to an application processor, AP, for being communicatively connected to an image sensor, and comprising an image signal processing, ISP, unit of the AP and a processing circuitry and a computer readable storage medium. The processing circuitry is configured to when the image sensor is communicatively connected to the AP: receive, from the image sensor, raw image data, a thumbnail of the raw image data, at least one first timestamp, a sensor identifier of the image sensor, and a sensor signature; generate, using the ISP unit of the AP, at least one processed image based on the raw image data; generate at least one second timestamp indicative of when the AP receives the raw image data, the thumbnail of the raw image data, the first timestamp, the sensor identifier, and the sensor signature, and / or when the AP has generated the processed image; generate an AP signature based on the processed image, an AP identifier of the AP, and the second timestamp using a second private key of a second private-public key pair for the AP; output the processed image, the sensor signature, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and the AP identifier.

[0017] A ninth aspect of the invention relates to a verifier device, the verifier device comprising processing circuitry and a computer readable storage medium. The processing circuitry is configured to: obtain at least one processed image, a thumbnail of raw image data, at least one first timestamp, a sensor identifier of an image sensor, a sensor signature, an application processor, AP, signature, at least one second timestamp, and an AP identifier of an AP implementing an image signal processor, ISP, unit of the AP, wherein the first timestamp is indicative of when the image sensor obtains the raw image data, generates the thumbnail, sends the thumbnail and / or sends the raw image data, and wherein the second timestamp is indicative of when the AP receives the raw image data, the thumbnail of the raw image data, the first timestamp, the sensor identifier, and the sensor signature, and / or when the AP has generated the processed image; determine that the processed image is modified or unmodified based on a verification of the sensorsignature using a first public key of a first public-private key pair, the thumbnail, the first timestamp, and the sensor identifier, a verification of the AP signature using a second public key of a second public-private key pair, the processed image, the AP identifier, and the second timestamp, an image difference verification between the processed image and the thumbnail, and a time difference verification between the first timestamp and the second timestamp.

[0018] A tenth aspect of the invention relates to a computer program comprising instructions which, when executed on processing circuitry of an image sensor, cause the processing circuitry of the image sensor to carry out the method according to the fourth aspect.

[0019] An eleventh aspect of the invention relates to a computer program comprising instructions which, when executed on processing circuitry of an application processor, AP, cause the processing circuitry of the AP to carry out the method according to the fifth aspect.

[0020] A twelfth aspect of the invention relates to a computer program comprising instructions which, when executed on processing circuitry of verifier device, cause the processing circuitry of the verifier device to carry out the method according to the sixth aspect.

[0021] A thirteenth aspect of the invention relates to a tangible, non-volatile computer readable medium comprising instructions that, when executed on processing circuitry of an image sensor, cause the processing circuitry of the image sensor to carry out the method according to the first aspect.

[0022] A fourteenth aspect of the invention relates to a tangible, non-volatile computer readable medium comprising instructions that, when executed on processing circuitry of an application processor, AP, cause the processing circuitry of the AP to carry out the method according to the fifth aspect.

[0023] A fifteenth aspect of the invention relates to a tangible, non-volatile computer readable medium comprising instructions that, when executed on processing circuitry of verifier device, cause the processing circuitry of the verifier device to carryout the method according to the sixth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a schematic diagram illustrating an example of image sensor, an application processor and a verifier device;

[0025] Figure 2 is a schematic diagram illustrating an example of an environment;

[0026] Figure 3 is a flowchart illustrating a method performed by the image sensor;

[0027] Figure 4 is a flowchart illustrating a method performed by the application processor;

[0028] Figure 5 is a flowchart illustrating a method performed by the verifier device;

[0029] Figures 6A to 6B are signalling diagrams of an exemplary interaction between the image sensor, the application processor and the verifier device according to an embodiment;

[0030] Figure 7 illustrates a block diagram illustrating embodiments of the image sensor;

[0031] Figure 8 illustrates a block diagram illustrating embodiments of the application processor; and

[0032] Figure 9 illustrates a block diagram illustrating embodiments of the verifier device.

[0033] DETAILED DESCRIPTION

[0034] Figure 1 shows a schematic diagram illustrating an example setup of an environment in which embodiments presented herein can be applied. Figure 1 illustrates an image sensor 110 comprising processing circuitry 110a which in some embodiments below is referred to as a first processing circuitry, an application processor (AP) 120 comprising processing circuitry 120a which in some embodiments below is referred to as a second processing circuitry, a verifier device 130 comprising processing circuitry 130a which in some embodiments below is referred to as a third processing circuitry, an optional modifier device 140, an optional communication device 150comprising a memory 150a, and an optional third party device 160. The AP 120 implements an Image Signal Processing (ISP) unit 120b.

[0035] Figure 2 shows a schematic diagram illustrating an example setup of an environment in which embodiments presented herein can be applied. In Figure 2 the image sensor 110, and the application processor 120 are depicted for illustration.

[0036] The image sensor 110 obtains raw image data 210, generates a thumbnail 212 of the raw image data 210 based on at least a part of the raw image data 210, and generates at least one first timestamp. The image sensor 110 is further configured to generate a sensor signature 214 based on the thumbnail 212 as illustrated in Figure 2. The sensor signature 214 is further based on the first timestamp, and a sensor identifier of the image sensor 110, using a first private key of a first public-private key pair for the image sensor 110. The image sensor 110 is configured to send, to the AP 120, the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, and the sensor signature 214. The AP 120 is configured to receive, from the image sensor 110, the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, and the sensor signature 214. The AP 120 generates at least one processed image 220 based on the raw image data 210, at least one second timestamp, and an AP signature 222 based on the processed image 220, an AP identifier, and the second timestamp. The AP outputs the processed image 220, the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, and the AP identifier. Optionally, the AP 120 and the image sensor 110 may comprised in the communication device 150.

[0037] Referring to Figure 1 , the verifier device 130 is configured to obtain the processed image 220, the thumbnail 212, the sensor signature 214, the first timestamp, the sensor identifier, AP signature 222, the second timestamp, and the AP identifier. The verifier device 130 determines that the processed image 220 is modified, e.g., by the modifier device 140, or unmodified. The determining is based on a verification of the sensor signature 214, a verification of the AP signature 222, an image difference verification between the processed image 220 and the thumbnail 212, and a time difference verification between the first timestamp and the second timestamp.The solution presented herein addresses above-mentioned challenges of enabling an improved verification of an image. The solution presented herein allows a verification of a processed image 220 without a need for a dependency of cryptographic formats and algorithms, and / or key management between the image sensor 110 and the AP 120. Additionally, the solution presented herein enables validation of which AP 120 and which image sensor 110 that provided the data for the processed image 220, and that the raw image data 210 sent from the image sensor 110 is not modified before it is processed by the AP 120.

[0038] In an example, the second processing circuitry is comprised in the ISP unit 120b of the AP. Alternatively, the second processing circuitry is outside the ISP unit 120b of the AP. In an example, the third processing circuitry is comprised in the ISP unit 130b of the verifier device 130. Optionally, the verifier device 130 implements an ISP function 130b. In an example, the third processing circuitry is comprised in the ISP unit 130b of the verifier device 130. Alternatively, the third processing circuitry is outside the ISP unit 130b of the verifier device 130. The image sensor 110 is adapted to be communicatively connected to the AP 120, e.g., via a Mobile Industry Processor Interface (MIPI) interface such as MIPI Camera Serial Interface (CSI)-2 or 3, a digital-video-port (DVP) interface, and a Low-Voltage Differential Signaling (LVDS) interface. Alternatively, or additionally the image sensor 110 is adapted to be communicatively connected to the AP 120, such as via external and / or internal entities using wired communications, e.g., based on Ethernet, and / or wireless communications, e.g., Wi-Fi, and / or a cellular network corresponding to one of or a combination of a 5G cellular network, Long Term Evolution (LTE) and Evolved Packet System (EPS), LTE-advanced, Universal Mobile Telecommunications System (UMTS), or any other current or future wireless network, such as a future 3rd Generation Partnership Project (3GPP) 6G network. Optionally, the AP 120 is adapted to be communicatively connected to the communication device 150 and or / the modifier device 140 via any of the communications listed with regards to the image sensor 110 being adapted to be communicatively connected to the AP 120. Optionally, the AP 120 and / or the image sensor 110 is comprised in the communication device 150. In the case, where the AP 120 and the image sensor 110 are comprised in the communication device 150, the image sensor 110 is adapted to be communicatively connected to the AP 120 via e.g. a differentialinterface (IF) for transferring data such as the raw image data, and a serial IF for transmitting sensor information. Further in a case, where the AP 120, and the ISP unit 120b of the AP are comprised in the communication device 150, the ISP unit may be configured to write the processed image to a system memory of the communication device 150, wherein the AP 120 obtains the processed image from the system memory over a system bus such as a Advanced extensible Interface (AMBA AXI). Optionally, the communication device 150, and / or the modifier is adapted to be communicatively connected, e.g. via at least one third party entity, to the verifier device 130, via any of the communications listed with regards to that the image sensor 110 is adapted to be communicatively connected to the AP 120.

[0039] Optionally, the verifier device 130 is adapted to be communicatively connected to at least one third party device 160, via any of the communications listed with regards to the image sensor 110 is adapted to be communicatively connected to the AP 120. Figure 3 is a flowchart illustrating a method 300 performed by the image sensor 110, as shown in Figure 1 and described in the text thereto.

[0040] The method 300 comprises a first step 310, where the image sensor 110 obtains raw image data 210. The image sensor 110 generates in a step 320 a thumbnail 212 of the raw image data 210 based on at least a part of the raw image data 210. The image sensor 110 generates in a step 330 at least one first timestamp. The timestamp is indicative of when the image sensor 110 obtains the raw image data 210, generates the thumbnail 212, and / or sends the thumbnail 212. In a step 340 the image sensor 110 generates a sensor signature 214 based on the thumbnail 212, the first timestamp, and a sensor identifier of the image sensor 110, using a first private key of a first public-private key pair for the image sensor 110. In a step 350, the image sensor 110 sends the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, and the sensor signature 214 to the AP 120.

[0041] Optionally the step 350 comprises a step 352, where the image sensor 110 also sends an offset value for the first timestamp to the AP 120.

[0042] Naturally, the steps 310 to 350 are performed by the first processing circuitry comprised in the image sensor 110.By generating the thumbnail 212 in step 320, the image sensor 110 may enable a fast preview of the raw image data 210. By generating the first timestamp in step 330, the image sensor 110 may enable the verifier device 130 to verify whether a time difference between the sensor obtaining the raw image data 210 and / or generating the thumbnail 212, and further processing of the raw image data 210 by the AP 120 is within a time range. Based on the time difference meeting the time range, the verifier may be enabled to determine that the raw image data 210 and / or the thumbnail 212 has been unmodified before further processing of the raw image data 210 by the AP 120. If the time difference is not within the time range, the verifier may be enabled to determine that the raw image data 210 or the thumbnail 212 have been modified by, e.g., the modifier device 140 before further processing of the raw image data 210 by the AP 120. The verifier device 130 may thus be enabled to verify that an attacker did not exchange or modify the raw image data 210 using GenAI. By generating the sensor signature 214 in step 340, the image sensor 110 enables the verifier device 130 to verify that the image sensor 110 is a trusted device, and that the thumbnail 212 and first timestamp have not been modified. The step 350 may enable the AP 120 to generate the processed image 220 using the raw image data 210.

[0043] Figure 4 is a flowchart illustrating a method 400 performed by the AP 120, as shown in Figure 1 and described in the text thereto.

[0044] The method 400 comprises a first step 410, wherein the AP 120 may receive, from the image sensor 110, the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, and the sensor signature 214. Optionally, the first step 410 comprises a step 412 of receiving the offset value from the image sensor 110. The method 400 further comprises a step 420, where the AP 120 generates, using the ISP unit 120b of the AP, at least one processed image 220 based on the raw image data 210. In a step 430, the AP generates at least one second timestamp. The at least one second timestamp is indicative of when the AP 120 receives the raw image data 210, the thumbnail 212 of the raw image data 210, the first timestamp, the sensor identifier, and the sensor signature 214, and / or when the AP 120 has generated the processed image 220. In a step 440, the AP 120 generates an AP signature 222 based on the processed image 220, an AP identifier of the AP 120,and the second timestamp using a second private key of a second private-public key pair for the AP 120. In a step 450, the AP 120 outputs the processed image 220, the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, and the AP identifier. Optionally, the step 450 comprises a step 452, wherein the AP 120 outputs the offset value.

[0045] Naturally, the steps 410 to 450 are performed by the second processing circuitry comprised in the AP 120.

[0046] By generating the processed image 220 in step 420, the AP 120 may be enabled to convert the raw image data 210 into a viewable image by, e.g., demosaicing the raw image data 210, and / or reducing the image sensor 110 noise. By generating the second timestamp in step 430, the AP 120 may enable the verifier device 130 to verify whether the time difference between the sensor obtaining the raw image data 210 and / or generating the thumbnail 212 and the AP generating the processed image 220, and / or receiving the raw image data 210 is sufficiently low as described with regards to step 330 of method 300. By generating an AP signature 222 in step 440, the AP 120 may enable the verifier device 130 to verify that the AP 120 is a trusted device and that the processed image 220 has not been modified after the AP 120 generated the processed image 220.

[0047] Figure 5 is a flowchart illustrating a method 500 performed by the verifier device 130, as shown in Figure 1 and described in the text thereto.

[0048] The method 500, comprises a step 510, where the verifier device 130, obtains the processed image 220, the thumbnail 212, the sensor signature 214, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, and the AP identifier. Optionally, the step 510 comprises a step 512, where the verifier device 130 obtains the offset value. Optionally, the method 500 comprises a step 514, wherein the verifier device 130 generates at least one processed thumbnail based on the thumbnail 212, using the ISP unit 130b of the verifier device 130.

[0049] Optionally, the method 500 comprises a step 516, where the verifier device 130 obtains a sensor certificate based on the sensor identifier. The sensor certificate comprises a first public key of a first public-private key pair. Optionally, the method 500 comprises a step 518, where the verifier device 130 obtains an AP certificatebased on the AP identifier, wherein the AP certificate comprises a second public key of a second public-private key pair. In a step 520, the verifier device 130 determines that the processed image 220 is unmodified or may have been modified based on a verification of the sensor signature 214 using the first public key, the thumbnail 212, the first timestamp, and the sensor identifier. Further, determining, by the verifier device 130, that the processed image 220 is unmodified or may have been modified is based on a verification of the AP signature 222 using the second public key, the processed image 220, the AP identifier, and the second timestamp. Further, determining, by the verifier device 130, that the processed image 220 is unmodified or may have been modified is based on an image difference verification between the processed image 220 and the thumbnail 212. ; Further, determining, by the verifier device 130, that the processed image 220 is unmodified or may have been modified is based on a time difference verification between the first timestamp and the second timestamp. Optionally the step 520 comprises a step 522a or a step 522b, a step 524a or a step 524b, a step 526a or a step 526b, a step 528a or a step 528b. In the step 524a, the verifier device 130 determines that the verification of the sensor signature 214 is successful. In the step 522a, the verifier device 130 determines that the verification of the AP signature 222 is successful. In the step 526a, the verifier device 130 determines that a time difference between the first timestamp and the second timestamp is within a time range. In the step 528a, the verifier device 130 determines that an image difference between the processed image 220 and the thumbnail 212 is within a determined similarity range. In case 522a, 524a, 526a, and 528a are performed, the verifier device 130 may determine that the processed image 220 has been unmodified. In the step 524b, the verifier device 130 determines that the sensor verification of the sensor signature 214 is unsuccessful. In the step 522b, the verifier device 130 determines that the AP verification of the AP signature 222 is unsuccessful. Steps 522a, 524a, 526a, and 528a comprised in step 520 may be performed in one step. In the step 526b the verifier device 130 determines that the time difference is outside the time range. In the step 528b, the verifier device 130 determines that the image difference is within the determined similarity range. In case 522b, 524b, 526b, and 528b are performed, the verifier device 130 may determine that the processed image 220 may have been modified. Steps 522b, 524b, 526b, and 528b comprised in step 520 may be performed in one step. Forexample, the processed image 220 may be processed using the modifier device 140 additionally or alternatively to the AP 120 and / or the sensor device.

[0050] By step 516 and / or 518, the verifier device may be enabled to trust the sensor signature and / or the AP signature, as the sensor certificate and / or AP certificate may certify that the first public key for the sensor and / or the second public key for the AP belongs to the corresponding first private key and / or the second private key. By step 522a, the verifier device 130 may be enabled to verify that the processed image 220 has not been modified after the AP 120 has generated it. By performing the step 524a, and that the thumbnail 212 has not been modified. By performing the step 526a, wherein the verifier device 130 may be enabled to verify that the AP 120 processed the raw image data 210 and not a modified version of the raw image data 210. By performing the step 528a the verifier device 130 may be enabled to validate that the processed image 220 has been generated using the image sensor 110 and the AP 120.

[0051] Naturally, the steps 510 to 520 are performed by the third processing circuitry comprised in the verifier device 130.

[0052] Figures 6A to 6B are signaling diagrams of an exemplary interaction between the image sensor 110, the AP 120, and the verifier device 130 as shown in Figure 1. In Figure 6A and 6B, the image sensor 110, the application processor 120, the verifier device 130 (as shown in Figure 1 and described in the text thereto) are depicted for illustration, even if not all entities are comprised in the interaction of each sub figure 6A to 6B. Figure 6A and 6B are illustrated on two pages for convenience, but they are understood as one single signaling diagram. The steps of Figure 6B continue where the steps of Figure 6A end.

[0053] In a step 601 of Figure 6A, the image sensor 110 obtains the raw image data 210. The step 601 corresponds to step 310 of method 300. Obtaining the raw image data 210 may comprise capturing light in an environment where the image sensor 110 is located in using a lens and converting the captured light into an electrical signal. The electrical signal may be converted into a digital signal using an Analog-to-Digital conversion (ADC).In an example, the image sensor 110 may use a Bayer pattern filter such as a color filter array for arranging Red Green Blue (RGB) color filters on a square grid of the image sensor 110. Alternatively, the image sensor 110 may use a (cyan, yellow, green, magenta) CYGM filter, (red, green, blue, emerald) RGBE filter, or any other type of a color filter pattern and color filter arrangement.

[0054] In a step 602 of Figure 6, the image sensor 110 generates the thumbnail 212 of the raw image data 210 based on at least part of the raw image data 210. The step 602 corresponds to step 320 of method 300.

[0055] In case the raw image data 210 pertains to an unprocessed image, the thumbnail 212 is generated for the unprocessed image. The raw image data 210 pertaining to the unprocessed image may be the representation of the light of the environment. In an example, the raw image data 210 is obtained by acquiring the raw image data 210 from a sensor comprised in the image sensor 110. For example, the unprocessed image may be an unprocessed photograph.

[0056] In case the raw image data 210 pertains to unprocessed image frames, the thumbnail 212 may be generated as a representation of the unprocessed image frames. Alternatively, in case the raw image data 210 pertains to unprocessed image frames, a thumbnail 212 may be generated as a representation for each of the unprocessed image frames. The thumbnail 212 may correspond to a plurality of thumbnail 212s representing a plurality of unprocessed images frames respectively. The raw image data 210 pertaining to the unprocessed image frames may be the representation of the light of the environment, which has been captured at several points in time. For example. The raw image data 210 is obtained by continuously capturing frames using a rolling shutter, wherein each row of pixels of the sensor is acquired one row at a time. In an example, the unprocessed image frames correspond to an unprocessed video. The unprocessed image frame may correspond to the full X by Y image frame which is formed when all rows are read.

[0057] In a step 603 of Figure 6, the image sensor 110 generates at least one first timestamp indicative of, e.g. a time during, at the start, and / or at the end of, when the image sensor 110 obtains the raw image data 210, generates the thumbnail 212, sends the thumbnail 212, and / or sends the raw image data. The step 603corresponds to step 330 of method 300. By signing the first timestamp tampering of the timestamp may be prevented.

[0058] In a step 604 of Figure 6, the image sensor 110 generates the sensor signature 214 based on the thumbnail 212, the first timestamp, the sensor identifier, and optionally the offset value of the first timestamp, using the first private key of the first publicprivate key pair for the image sensor 110. The sensor signature 214 is generated commonly for the thumbnail 212, the first timestamp, the sensor identifier, and optionally the offset value of the first timestamp, using the first private key. The step 604 corresponds to step 340 of method 300.

[0059] The thumbnail 212, the first timestamp, the sensor identifier, and optionally the offset value may be provided as an input to a signature algorithm. The output of the signature algorithm may be the sensor signature 214. Providing the input to the signature algorithm and obtaining the output may correspond to generating the sensor signature 214. The signature algorithm may be a Rivest-Shamir-Adleman (RSA), a Digital Signature Algorithm (DSA), an Elliptic Curve Digital Signature Algorithm (ECDSA), an Edwards-curve Digital Signature Algorithm (EdDSA), or a Post-quantum cryptography (PQC) algorithm such as a Module-Lattice-based Digital Signature Algorithm (ML-DSA), a Fast Fourier Transform over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA), and a Stateless Hash-Based Digital Signature Standard (SLH-DSA).

[0060] In an example, a first cryptographic hash may be determined in step 604 based on the thumbnail 212, the first timestamp, the sensor identifier, and optionally the offset value. Determining the first cryptographic hash value may comprise computing the first cryptographic hash value for the thumbnail 212, the first timestamp, the sensor identifier, and optionally the offset value commonly, and signing the cryptographic hash value using the first private key. In an alternative example, the step 604 comprises signing the thumbnail 212, the first timestamp, the sensor identifier, and optionally the offset value using the first private key without determined the first cryptographic hash value.

[0061] In a step 605, the image sensor 110 sends, to the AP 120, the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, the sensor signature214, and optionally the offset value. The step 605 corresponds to step 350 of method 300, and step 410 of method 400. The AP 120 receives the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, the sensor signature 214, and optionally the offset value. The thumbnail 212, the first timestamp, the sensor identifier, the sensor signature 214, and optionally the offset value may be sent as a Binary Large Object (blob) along with the raw image data 210.

[0062] In a step 606, the AP 120 generates using the ISP unit 120b of the AP, the processed image 220 based on the raw image data 210. The step 606 corresponds to step 420 of method 400.

[0063] In an example, generating the processed image 220 using the ISP unit 120b of the AP may comprise, at least one of, processing adjusting brightness and noise reduction; demoasicing Red Green Blue (RGB); applying a White-Balance and Color Space Transformation such as Commission Internationale de I'Eclairage = International Commission on Illumination (CIE) XYZ; applying a color manipulation such as photo-finishing; applying a mapping a standard such as standard RGB (sRGB) output, a Adobe RGB, Recommendation (REC 2020), Digital Cinema Initiatives (DCI)-P3; and applying a compression such as a Joint Photographic Experts Group (JPEG) compression. The steps for generating the processed image 220 may be performed in various orders.

[0064] In a step 607, the AP 120 generates the at least one second timestamp. The step 607 corresponds to step 430 of method 400. The at least one second timestamp is timestamp indicative, e.g., a time during, at a start and / or at an end of, when the AP 120 receives the raw image data 210, the thumbnail 212 of the raw image data 210, the first timestamp, the sensor identifier, and the sensor signature 214, and / or when the AP 120 has generated the processed image 220. By signing the second timestamp tampering of the second timestamp may be prevented.

[0065] In a step 608, the AP 120 generates the AP signature 222 based on the processed image 220, the AP identifier, the second timestamp, optionally the sensor signature 214, optionally on the thumbnail, and optionally the offset value using the second private key of a second private-public key pair for the AP 120. The AP signature 222 is generated commonly for the processed image 220, the AP identifier, the secondtimestamp, optionally the sensor signature 214, and optionally the offset value, using the second private key. The step 608 corresponds to step 440 of method 400.

[0066] The processed image 220, the AP identifier, the second timestamp, optionally the sensor signature 214, and optionally the offset value may be provided as an input to the signature algorithm. The output of the signature algorithm may be the AP signature 222. Providing the input to the signature algorithm and obtaining the output may correspond to generating the AP signature 222.

[0067] In an example the step 608 comprises determining a computing a second cryptographic hash value commonly for the processed image 220, the AP identifier, the second timestamp, optionally the sensor signature 214, and optionally the offset value. The AP may sign the second cryptographic hash value using the second private key using the signature algorithm. In an alternative example, the AP may sign the processed image 220, the AP identifier, the second timestamp, optionally the sensor signature 214, and optionally the offset value using the signature algorithm without computing a second cryptographic hash value.

[0068] Referring to Figure 6B, in a step 609, the AP 120 outputs the processed image 220, the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value. The step 609 corresponds to 450 of method 400.

[0069] In an example the processed image 220 is saved in a file such as JPEG, Portable Network Graphics (PNG), or High Efficiency Image File Format (HEIF) file in a memory of the AP. The sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value may be saved in an image container of the file.

[0070] Alternatively, or additionally, the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value may be saved in a watermark of the processed image 220.

[0071] Optionally, the AP may send, to the communication device 150, the processed image 220, the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, andoptionally the offset value, e.g., in case the AP is comprised in the communication device 150. Optionally, the processed image 220, the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value may be saved in the memory 150a of the communication device 150 and / or the memory of the AP 120. In an example, the memory of the AP and / or the memory 150a of the communication device 150 is an internal storage such as a flash memory or RAM, or an external storage such as secure digital (SD) card or a solid-state drive (SSD). Alternatively or additionally, the communication device 150 and / or the AP 120 may send or stream the processed image 220, the sensor signature 214, the thumbnail, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value to the third party entity such as a cloud hosted by a server device, to a remote server device to a output device such as a screen, a video encoder, or an external Graphics Processing Unit (GPU).

[0072] In a step 610, the verifier device 130 obtains the processed image, the sensor signature 214, the thumbnail, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value. The step 610 corresponds to step 510 of method 500.

[0073] In an example, the verifier device 130 receives, from the communication device 150 or the modifier device 140 the processed image, the thumbnail, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, and the AP identifier. Receiving from the communication device 150 and / or the modifier device 140 may correspond to receiving via at least one third party entity.

[0074] In an optional step 611 , the verifier device 130 generates based on the thumbnail, at least one processed thumbnail using the ISP unit 130b of the verifier device 130. The step 611 corresponds to step 514 of method 500. Optionally, any of the steps described for generating the processed image in step 606 may be used to generate the processed thumbnail using the ISP unit 130b of the verifier device 130.

[0075] In an optional step 612a, the verifier device 130 obtains the sensor certificate based on the sensor identifier, wherein the sensor certificate comprises the first public key.The step 612 corresponds to step 516 of method 500. The verifier device 130 may request the sensor certificate from the third party device 160 using the sensor identity. The verifier device 130 may receive the sensor certificate comprising the first public key from the third party device 160.

[0076] In an optional step 612b, the verifier device 130 obtains the AP certificate based on the AP identifier, wherein the sensor certificate comprises the second public key. The step 612b corresponds to step 518 of method 5OO.The verifier device 130 may request the AP certificate from the third party device 160 using the AP identity. The verifier device 130 may receive the AP certificate comprising the second public key from the third party device 160.

[0077] In a step 613, the verifier device 130 determines that the processed image is unmodified, e.g., processed using the image sensor 110 and the AP 120.

[0078] Alternatively, the verifier device 130 determines that the processed image may have been modified, e.g., processed using at least the modifier device 140. The determining is based on the verification of the sensor signature 214 using the first public key, the thumbnail, the first timestamp, and the sensor identifier; the verification of the AP signature 222 using the second public key, the processed image, the AP identifier, and the second timestamp; the image difference verification between the processed image and the thumbnail; optionally the offset value; and the time difference verification between the first timestamp and the second timestamp. The step 613 corresponds to step 520 of method 500.

[0079] In an example, the verifier device 130 may determine that the processed image is unmodified. In the example, the verifier device 130 determines that the verification of the sensor signature 214 is successful, the verification of the AP signature 222 is successful, the time difference between the first timestamp and the second timestamp is within a time range, and the image difference between the processed image and the thumbnail is within the determined similarity range.

[0080] In an example, the verifier device 130 determines that the processed image may have been modified, e.g., using the modifier device 140. In the example, the verifier device 130 determines that the verification of the sensor signature 214 is unsuccessful, the verification of the AP signature 222 is unsuccessful, the timedifference between the first timestamp and the second timestamp is outside the time range, and / or the image difference between the processed image and the thumbnail is outside the determined similarity range.

[0081] The step 613 comprises an optional step 614a, wherein the verifier device 130 determines that the verification of the sensor signature 214 is successful. The step 614a corresponds to step 522a of method 500. By determining that the verification of the sensor signature 214 is successful, the verifier device 130 verifies that the thumbnail has not been modified.

[0082] The verification of the sensor signature 214 may be performed by the verifier device 130. The verifier device 130 may decrypt the sensor signature 214 using the first public key. By successfully decrypting the sensor signature 214, the verifier device 130 may verify that the processed image has been processed by the image sensor 110. In an example, the verifier device 130 may compute a third cryptographic hash value based on the thumbnail, the first timestamp, the sensor identifier, and optionally the offset value of the first timestamp. In this example, the verifier device 130 may determine that the third cryptographic hash value and the first cryptographic hash value are equal. Determining that the third cryptographic hash value and the first cryptographic hash value are equal comprises determining the verification of the sensor signature 214 being successful.

[0083] Alternatively, the verification of the sensor signature 214 may be performed by the third party device 160. The verifier device 130 may send to the third party device 160 the thumbnail, the first timestamp, the sensor identifier, and optionally the offset value of the first timestamp, and optionally the offset value. The third party device 160 may verify the sensor signature 214 and send, to the verifier device 130, a notification that the verification of the sensor signature 214 is successful. The verifier device 130 may receive the notification from the third party device 160. Receiving the notification comprises determining that the verification of the sensor signature 214 is successful.

[0084] The step 613 comprises an optional step 614b, wherein the verifier device 130 determines that the verification of the sensor signature 214 is unsuccessful. The step 614b corresponds to step 522b of method 500. By determining that the that theverification of the sensor signature 214 is unsuccessful, the verifier device 130 may fail to verify that the thumbnail is unmodified.

[0085] The verifier device 130 may fail to decrypt the sensor signature 214 using the first public key. In an alternative example, the verifier device 130 may compute the third cryptographic hash value based on the thumbnail, the first timestamp, the sensor identifier, and optionally the offset value of the first timestamp. Upon computing the third cryptographic hash value, the verifier device 130 may determine that the third cryptographic hash value and the first cryptographic hash value are different.

[0086] In the alternative example, the third party device 160 may fail to verify the sensor signature 214 and send, to the verifier device 130, a notification that the verification of the sensor signature 214 is unsuccessful. Receiving the notification may comprise determining that the verification of the sensor signature 214 is unsuccessful. The verification of the sensor signature 214 is unsuccessful if the third entity or the verifier device 130 fails to decrypt the sensor signature 214.

[0087] The step 613 comprises an optional step 615a, wherein the verifier device 130 determines that the verification of the AP signature 222 is successful. The step 615a corresponds to step 524a of method 500. By determining that the that the verification of the AP signature 222 is successful, the verifier device 130 may verify that the processed image has not been modified after it has been signed by the AP 120 and that the processed image has been processed by the AP 120. In the example of the AP signature 222 covering the sensor signature 214, the verifier device 130 may verify that the thumbnail 212, the first timestamp, and the sensor identifier is signed by the sensor. In an example, that the AP signature covers the sensor signature may provide an improved security as signing the sensor signature as the verifier device is enabled to verify that an attacker has not exchanged the sensor signature with a signature from another sensor.

[0088] The verification of the AP signature 222 may be performed by the verifier device 130. The verifier device 130 may decrypt the AP signature 222 using the second public key. By successfully decrypting the AP signature 222 the verifier device 130 verifies that the processed image has been processed by the AP 120. In an example, , the verifier device 130 may compute a fourth cryptographic hash value based on theprocessed image, the AP identifier, the second timestamp, optionally the sensor signature 214 and optionally the offset value. Upon computing the fourth cryptographic hash value, the verifier device 130 may determine that the fourth cryptographic hash value and the second cryptographic hash value are equal.

[0089] In an alternative example, the verification of the AP signature 222 may be performed by the third party device 160 (e.g. equal or different to the third party device 160 which may be used in step 614a or 614b). The verifier device 130 may send to the third party device 160 the processed image, the thumbnail, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, optionally the sensor signature 214, and optionally the offset value. The third party device 160 may verify the AP signature 222 and send, to the verifier device 130, a notification that the verification of the AP signature 222 is successful. The verifier device 130 may receive the notification from the third party device 160. Receiving the notification may comprise determining that the verification of the AP signature 222 is successful. In an example, the verification of the AP signature 222 is successful if the third party device 160 or the verifier device 130 successfully decrypts the second cryptographic hash value and determines that the fourth cryptographic hash value and the second cryptographic hash value are equal.

[0090] The step 613 comprises an optional step 615b, wherein the verifier device 130 determines that the verification of the AP signature 222 is unsuccessful. The step 615b corresponds to step 524b of method 500. By determining that the that the verification of the AP signature 222 is unsuccessful, the verifier device 130 may fail to verify that the processed image has been unmodified after it has been signed by the AP 120 and that the processed image has been processed by the AP 120.

[0091] The verifier device 130 may fail decrypt the AP signature 222 using the second public key. In an example, the verifier device 130 may compute a fourth cryptographic hash value based on the processed image, the AP identifier, the second timestamp, optionally the sensor signature 214 and optionally the offset value and determine that the fourth cryptographic hash value and the second cryptographic hash value are different.In the alternative example, the verification of the AP signature 222 may be performed by the third party device 160. The third party device 160 may fail to verify the AP signature 222 and send, to the verifier device 130, a notification that the verification of the AP signature 222 is unsuccessful. Receiving the notification may comprise determining that the verification of the AP signature 222 is unsuccessful. In an example, the verification of the AP signature 222 being unsuccessful comprises determining by the verifier device 130 or the third party device 160 that the fourth cryptographic hash value and the second cryptographic hash value are different or that the verifier device 130 or the third party device 160 fails to decrypt the second cryptographic hash value.

[0092] The step 613 comprises an optional step 616a, wherein the verifier device 130 determines that the time difference between the first timestamp and the second timestamp is within the time range. The step 616a corresponds to step 526a of method 500. By determining that the time difference is within the time range, the verifier device 130 may verify that the raw image data 210 was immediately processed by the AP 120 after it was sent from the image sensor 110. The verifier may thus verify using the time difference verification that the raw image data is unmodified between sending the raw image data by the image sensor and receiving the raw image data by the AP. Optionally the verifier device 130 determines that the time difference is between the first timestamp and the offset value, and the second timestamp is within the time range. The time difference may correspond to an absolute value, a positive value, or a negative value.

[0093] Determining, that the time difference is within the time range may comprise computing the time difference, and compare the time difference to the time range. Alternatively, the verifier device 130 may send the first timestamp, the second timestamp and optionally the offset value to the third party device 160 (e.g. being equal or different to the third party device 160 used in steps 614a and b, and 615a and b). The third party device 160 may determine that the time difference is within the time range and notify the verifier device 130 by sending a notification. By receiving the notification, the verifier device 130 may determine that the time difference is within the time range.The step 613 comprises an optional step 616b, wherein the verifier device 130 determines that the time difference between the first timestamp and the second timestamp is outside the time range. The step 616b corresponds to step 526b of method 500. By determining that the time difference is outside the time range, the verifier device 130 may fail to verify that the raw image data 210 was immediately processed by the AP 120 after it was sent from the image sensor 110.

[0094] Optionally the verifier device 130 determines that the time difference between the first timestamp and the offset value, and the second timestamp is outside the time range. Determining that the time difference is outside the time range may optionally comprise computing the time difference and compare the time difference to the time range. Alternatively, the verifier device 130 may send the first timestamp, the second timestamp and optionally the offset value to the third party device 160. The third party device 160 may determine that the time difference is outside the time range and notify the verifier device 130 by sending a notification. By receiving the notification, the verifier device 130 may determine that the time difference is outside the time range.

[0095] The step 613 comprises an optional step 617a, wherein the verifier device 130 determines that the image difference between the processed image and the thumbnail is within the determined similarity range. The step 617a corresponds to step 528a of method 500. By determining that the image difference is within the determined similarity range, the verifier device 130 may verify that the processed image is not being generated by the modifier device 140.

[0096] Optionally, the image difference is between the processed image and the processed thumbnail. The verifier device 130 may send the processed image and the (processed) thumbnail to the third party device 160 (e.g. equal or different to the third party device 160 of steps e.g. being equal or different to the third party device 160 used in steps 614a and b, 615a and b, and / or 616a and b). The third party device 160 may obtain a degree of similarity, compare it with the predetermined similarity range and notify the verifier device 130 that the image difference is within the determined similarity range by sending a notification to the verifier device 130. By receiving the notification, the verifier device 130 may determine that the image difference is within the determined similarity range. Alternatively, the verifier device130 may compute the degree of similarity and compare it with the predetermined similarity range.

[0097] A technique like a Scale-Invariant Feature Transform (SIFT) functionality may be used, by the verifier device 130 or by the third party device 160, for comparing the (processed) thumbnail with the processed image. The SIFT functionality detects and describes local features in the thumbnail and the processed image that are invariant to scaling, rotation, and partially invariant to illumination changes. By extracting the local features from both the thumbnail and the processed image, algorithms such as K-Nearest Neighbors may be used to find correspondences / the degree of similarity between the features. Optionally, a convolutional neural network (CNNs) or transformer-based architecture network may be used to extract high-level features that capture semantic content of the (processed) thumbnail and the processed image. By passing both the thumbnail and the processed image through a pretrained model, feature vectors can be obtained from the CNN network or the transformer-based architecture network. The similarity between these feature vectors may be compared to a metric such as cosine similarity or Euclidean distance. A high degree of similarity represents that the thumbnail corresponds to the processed image. In the example of using the SIFT functionality the determined similarity range may correspond to a feature / descriptors matching such as between a feature / descriptors matching of 30-50%. In the example of using a similarity metric like cosine or a Euclidean distance, the determined similarity range may correspond to a similarity score indicating a good match such as above 0.7-0.8. Alternatively, to using the SIFT functionality, the verifier device may use a Speeded-Up Robust Features (SURF) functionality, a Oriented FAST and Rotated BRIEF (ORB) functionality, a deep learning-based method e.g. using a convolutional neural network CNN, or a transformer for extracting high-level image features for comparing the (processed) thumbnail with the processed image.

[0098] The step 613 comprises an optional step 617b, wherein the verifier device 130 determines that the image difference between the processed image and the thumbnail is outside the determined similarity range. The step 617b corresponds to step 528b of method 500. By determining that the image difference is outside thedetermined similarity range, the verifier device 130 may fail verify that the processed image is not entirely being generated by the modifier device 140.

[0099] In the example of, the third party device 160 obtaining the degree of similarity and compare the degree of similarity to the predetermined similarity range, e.g. using the SIFT functionality, the third party device 160 notifies the verifier device 130 that the image difference is outside the determined similarity range by sending a notification to the verifier device 130. By receiving the notification, the verifier device 130 may determine that the image difference is outside the determined similarity range.

[0100] Alternatively, the verifier device 130 may compute the degree of similarity and compare it with the predetermined similarity range, e.g., using the SIFT functionality. Optionally, the verifier device 130 sends, to the communication device 150, an acknowledgement that the processed image has been modified or unmodified.

[0101] In a first embodiment, the step 601 is performed by the image sensor 110, wherein the raw image data 210 corresponds to the unprocessed image. The unprocessed image corresponds to an unprocessed photograph.

[0102] In the first embodiment, the step 602 is performed, wherein the thumbnail 212 is generated for the unprocessed image. The thumbnail 212 corresponds to a single thumbnail 212 of the raw image data 210, e.g., with a lower resolution, than the unprocessed image data. Alternatively, the thumbnail 212 may correspond to the raw image data 210.

[0103] In the first embodiment, the step 603 is performed, wherein the first timestamp is generated during the generation of the thumbnail 212.

[0104] In the first embodiment, the step 604 is performed, wherein the image sensor 110 generates the sensor signature 214 based on the thumbnail 212, the first timestamp, the sensor identifier using the first private key and the signature algorithm.

[0105] In the first embodiment, the step 605 is performed, wherein the image sensor 110 sends, and the AP 120 receives, the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, and the sensor signature 214, to the AP 120, via the MIPI interface, e.g. using packets.In the first embodiment, steps 606 and 607 are performed, wherein the second timestamp is generated at the start of the AP 120 generating the processed image 220.

[0106] In the first embodiment, the step 608 is performed, wherein the AP 120 generates the AP signature 222 based on the AP identifier, the second timestamp, using the second private key and the signature algorithm.

[0107] In the first embodiment, the step 609 is performed, wherein the AP 120 outputs the processed image 220 comprising the image container with the sensor signature 214, the thumbnail 212, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier. In an example, the AP 120 may send the processed image 220 comprising the image container to the communication device 150. The communication device 150 sends, or streams, the processed image 220 comprising the image container to the third party entity.

[0108] In the first embodiment, the step 610 is performed wherein the verifier device 130 obtains the processed image 220 comprising the image container. In the example, obtaining may comprise receiving the image comprising the image container from the third party entity. In the example, the verifier device 130 is for verifying that the processed image 220 is not modified. In the example, a user interacting with the communication device 150 may have the intention to assess the authenticity of a received processed image 220. The processed image 220 may be received from a third party entity (equal or different to the third party entity of step 609).

[0109] In the first embodiment, steps 612a, 612b are performed, wherein the verifier device 130 obtains the first and the second public key.

[0110] In the first embodiment, steps 614a and 615a are performed, wherein the verifier device 130 decrypts the sensor signature 214 and the AP signature 222 successfully.

[0111] In the first embodiment, the step 616a is performed, wherein the verifier device 130 computes the time difference and compares the time difference to the time range. In an example, the verifier may determine that the time difference between the first and the second timestamp is less than 20ms, e.g., 5ms, 10ms, or 15ms. In the example,the time range may correspond to 20ms as the ISP unit 120b of the AP in the AP 120 may require less than 18ms for generating the processed image 220. In this example, the first timestamp is determined after creation of the thumbnail, and just before generating the second signature. The second timestamp is in this example created directly after generating the processed image. The time range in which a time difference is tolerable can depend on factors such as the resolution of the processed image 220 (a validation instance). The verifier may thus verify that the raw image data 210 was immediately processed by the AP 120 after it was sent from the sensor chip.

[0112] In the first embodiment, the step 617a is performed, wherein the verifier device 130 sends the thumbnail 212 and the processed image 220 to the third party device 160, implementing the ISP unit 130b of the verifier device 130 and the SIFT functionality. By receiving the notification, the verifier device 130 determines that the image difference is within the predetermined image similarity.

[0113] By performing the steps 614a, 615a, 616a, and 617a, the verifier device 130 determined that the processed image 220 is unmodified.

[0114] In the first embodiment, the verifier device 130 sends, to the communication device 150, an acknowledgement that the processed image has been unmodified. In an example, the verifier device 130 sends a response to the third party entity of step 610 of the first embodiment.

[0115] In a second embodiment, step 601 is performed, wherein the image sensor 110 obtains the raw image data 210. The raw image data 210 corresponds to the unprocessed frames, wherein the unprocessed frames correspond to an unprocessed video.

[0116] In the second embodiment, step 602 is performed, wherein the image sensor 110 generates thumbnails for each unprocessed frame respectively. Each thumbnail of an unprocessed frame is a representation of the unprocessed image frame with e.g. lower resolution. Alternatively, one thumbnail is processed for the unprocessed image frame.In the second embodiment, step 603 is performed, wherein the first timestamp is comprised of a plurality of first timestamps. A timestamp of the plurality of first timestamps is generated after each part of the raw image data 210 is obtained, wherein the part of the raw image data 210 corresponds to an unprocessed image frame of the unprocessed image frames. The plurality of first timestamps are generated as the representation of the unprocessed image frames respectively. The image sensor 110 adds an offset value. The offset value is added to each of the plurality of first timestamps respectively. In an example, the offset value may be preconfigured and may be chosen such that it corresponds to a period, the AP takes to generate the processed image 220 e.g. 5, 10 or 15ms. Additionally, or alternatively, the offset value may be chosen such that the time difference between the first timestamp plus the offset value and the second timestamp is small, such as close to zero.

[0117] In the second embodiment, step 604, step 604a and step 604b are performed, wherein the sensor signature 214 is commonly generated based on the thumbnails, the plurality of first timestamps, the sensor identifier, and the offset value using the signature algorithm and the first private key.

[0118] In the second embodiment, step 605 is performed wherein each part of the raw image data 210, each corresponding thumbnail of the thumbnails, the corresponding first timestamp of the plurality of first timestamps are send one after the other.

[0119] Alternatively, the raw image data 210, the thumbnails, the plurality of first timestamps, sensor identifier, sensor signature 214, and the offset value is sent in serially transmitted packets via the MIPI interface using a bit depth of e.g. 8-bit, 10-bit, 12-bit, or 14-bit per pixel for the raw image data 210 using RAW Bayer, YUV or JPEG.

[0120] In the second embodiment, steps 606 and step 607 are performed, wherein the AP 120 has generated the processed image 220 corresponding to processed image frames. The second timestamp corresponds to a plurality of second timestamps. A timestamp of the plurality of timestamps is generated at a moment when a processed image frame of the processed image frames is generated.In the second embodiment, the steps 608, 608a and 608b are performed, wherein the AP signature 222 is generated commonly based on the processed image 220, the AP identifier, the second timestamp, and the offset value using the second private key and the signature algorithm.

[0121] In the second embodiment, the step 609 is performed, wherein the AP 120 outputs the processed image frames as a compressed or encoded video comprising a watermark including the sensor signature 214, the thumbnail, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, the AP identifier, and optionally the offset value. Outputting may comprise saving the compressed or encoded video in a file such as an MP4, MOV, AVI, MKV file in the memory 150 of the communication device 150 as described in the first embodiment.

[0122] In the second embodiment, the communication device 150 may send the encoded or compressed video comprising the watermark to the third party entity. The third party entity may be a modifier device 140, modifying the processed image frames of the encoded video to modified image frames of a modified video. A communication device 150 may receive the modified video. A user of the communication device 150 would like to assess the authenticity of the modified video. The communication device 150 sends the modified image frames comprising the watermark to the verifier device 130.

[0123] In the second embodiment, the step 610 is performed, wherein the verifier device 130 received the modified image frames comprising the watermark.

[0124] In the second embodiment, the step 614a is performed, wherein the verifier device 130 determines that the verification of the sensor signature 214 is successful. The verifier device 130 verifies that the thumbnails have been unmodified. The verifier device 130 sends the modified image frames to the third party device 160, which verifies the sensor signature 214 comprised in the watermark using the first public key. The third party device 160 sends the notification to the verifier device 130. The verifier device 130 verifies that the thumbnails have been unmodified and that the modified image has been originally generated by the image sensor 110.

[0125] In the second embodiment, the step 615b is performed wherein the verifier device 130 determines that the verification of the AP signature 222 is unsuccessful. Theverifier device 130 sends the modified image frames to the third party device 160, which fails to verify the AP signature 222 comprised in the watermark using the second public key. The third party device 160 sends the notification to the verifier device 130. The verifier device 130 fails to verify that the processed image frames have been unmodified after signed by the AP 120.

[0126] Alternatively, and / or additionally to step 615b, the verifier device 130 determines in step 617b that the image difference between the thumbnails and the processed image frames are outside the determined similarity difference using the SIFT functionality. The verifier device 130 thus fails to verify that the processed image is unmodified.

[0127] In an example, the verifier device 130 may additionally determine in step 616a, that the time difference between the plurality of first timestamps and the offset value, and the plurality of second timestamps is within the time range by computing the time difference. The verifier device 130 thus verifies that the original raw image date was used to generate the processed image frames.

[0128] In the second embodiment, the verifier device 130 thus determines that the processed image frames have been modified such as processed by the image sensor 110, the AP 120 and the modifier device 140.

[0129] In the second embodiment, the verifier device 130 sends an acknowledgment to the communication device 150 of step 610 in the second embodiment, that the modified image frames, i.e. the processed image frames have been modified, e.g. specifying that the modified image frames have been modified after the AP 120 signed the processed image frames.

[0130] In a third embodiment, the step 601 and step 602 are performed, wherein the thumbnail 212 are generated for raw image data 210 pertaining to unprocessed image frames.

[0131] In the third embodiment, the step 603 is performed, wherein the first timestamp corresponds to two first timestamps. The first of the two first timestamps is generated at the start of when the raw image data 210 is obtained. The second of the two timestamp is generated during the generation of the thumbnail 212.In the third embodiment, the steps 604, 604a and 604b are performed, wherein the sensor signature 214 is generated based on the thumbnail 212, the two first timestamp, and the sensor identifier using the first private key.

[0132] In the third embodiment, the step 605 is performed similarly to the first embodiment via the modifier device 140.

[0133] In the third embodiment, the modifier device 140 receives the raw image data 210, the sensor signature 214, the two first timestamps, the thumbnail 212, and the sensor identifier. The modifier device 140 modifies the raw image data 210 to modified raw image data 210 and the thumbnail 212 to a modified thumbnail using GenAI. The modifier device 140 sends, to the AP 120, the modified raw image data 210, the sensor signature 214, the two first timestamps, the modified thumbnail, and the sensor identifier.

[0134] In the third embodiment, the steps 606 and 607 is performed, wherein the AP 120 has generated the processed image 220 based on the modified raw image data 210. The AP 120 generates the second timestamp when receiving the modified raw image data 210, the sensor signature 214, the two first timestamps, the modified thumbnail, and the sensor identifier.

[0135] In the third embodiment, the steps 608, 608a and 608b are performed, wherein the AP signature 222 is commonly based on the processed image 220, the AP identifier, the second timestamp, the sensor signature 214 using the second private key.

[0136] In the third embodiment, the step 609 is performed, wherein the AP 120 sends, to a first communication device of a plurality communication device, the processed image 220 comprising a container including the sensor signature 214, the thumbnail, the first timestamp, the sensor identifier, the AP signature 222, the second timestamp, and the AP identifier. The first communication device may correspond to the communication device 150. The first communication device 150 may send the processed image 220 to any of the plurality of communication devices via the third party entity.A second communication device may receive the processed image 220 from the first communication device via the third party entity. The second communication device may comprise the verifier device 130.

[0137] In the third embodiment, the second communication device provides the processed image 220 comprising the container as input to the verifier device 130 in step 610. In the third embodiment, step 611 is performed, wherein the verifier device 130 comprises the ISP unit 130b of the verifier device 130 and generates the processed thumbnail based on the modified thumbnail.

[0138] In the third embodiment, steps 612a and 612b are performed wherein the verifier device 130 obtains the first and second public key.

[0139] In the third embodiment, the step 617a is performed, wherein the verifier device 130 determines that the image difference is within the predetermined similarity range using the SIFT functionality. The verifier device 130 verifies that the processed image 220 has not entirely being generated by the modifier device 140. The SIFT functionality is implemented in the verifier device 130.

[0140] In the third embodiment, the step 616b is performed, wherein the verifier device 130 determines that the time differences between the first timestamps and the second timestamp is outside the time range. By determining that the time difference is outside the time range, the verifier device 130 fails to verify that the raw image data 210 was immediately processed by the AP 120 after it was sent from the image sensor 110.

[0141] The verifier device 130 computes a first time difference between the first of the two first timestamps and the second timestamp; and a second time difference between the second of the two timestamps and the second time timestamp. The verifier device 130 compares the first time difference with a first time range and the second time difference and a second time range. The verifier device 130 determines that the first or the second time difference is outside the first time range or second time range respectively.In the third embodiment, the verifier device 130 determines based on step 616b that the communication between the image sensor 110 and the AP 120 may have been interrupted by the modifier device 140.

[0142] Optionally, the verifier device 130 additionally determines in the step 615a that the verification of the AP signature 222 is successful. By determining that the AP signature 222 is successful the verifier device 130 may verify that the processed image 220 and the sensor signature 214 has not been modified after the AP 120 has generated the processed image 220. Verifying that the sensor signature has not been modified may correspond to verifying that an attacker has not exchanged data signed by the sensor using a signature from another set of signed data and / or a signature from another sensor not corresponding to the image sensor 110.

[0143] The verifier device 130 decrypts the AP signature 222 and optionally compares the fourth cryptographic hash value with the second cryptographic hash value using the second public key.

[0144] Optionally, the verifier device 130 additionally determines in the step 614b that the verification of sensor signature 214 is unsuccessful.

[0145] The verifier device 130 decrypts the sensor signature 214 using the first public key. The verifier device 130 may verify that the image sensor 110 is a trusted device. In an example, the verifier device 130 determines that the first cryptographic hash value and the second cryptographic hash value is not equal. By determining that the first cryptographic hash value being unequal to the second cryptographic hash value, the verifier device 130 determines that the thumbnail has been modified. Based on step 617a and step 614b the verifier device 130 may verify that the raw image data 210 has been modified.

[0146] In the third embodiment, the verifier device 130 outputs that the processed image has been modified such as processed by the image sensor 110, the AP 120 and the modifier device 140. Further, the verifier device 130 may output that the raw image data 210 and the thumbnail has been modified before the AP 120 has generated the processed image.In a fourth embodiment, the steps 601 , 602 are performed as described in the first, second or third embodiment.

[0147] In the fourth embodiment, the step 605 is performed, wherein the raw image data 210 is sent.

[0148] In the fourth embodiment, step 603 and step 604 are performed upon step 605, wherein the first timestamp is generated based on sending the raw image data 210. Further, the sensor signature is generated as described in the first second or third embodiment. After the thumbnail 212, the first timestamp, the sensor identity and the sensor signature are sent to the AP 120. By generating the thumbnail 212 at a later point in time than sending the raw image data 210, a time-window to generate a fake version of the thumbnail 212 may be decreased i.e. by giving the modifier device 140 a decreased amount of time to use it. Optionally, the thumbnail 212, the first timestamp, the sensor identity, and the sensor signature are generated and / or send at the same time as, after, or before the AP 120 has generated the processed image 220 based on the raw image data 210. Sending at the same time as, after or before the AP 120 has generated the processed image 220 may cause a smaller time difference between the first timestamp and the second timestamp than when the thumbnail 212, the first timestamp, the sensor identity, and the sensor signature are sent at the same time or directly after the raw image data.

[0149] In the fourth embodiment, steps 606 to 613 comprising any of 617a-b, 616a-b, 615a-b and 614a-b are performed as described in the first, second or third embodiment. In a fifth embodiment, the steps 601 to 613 comprising any of 617a-b, 616a-b, 615a-b and 614a-b are performed as described in the second or third embodiment, wherein the unprocessed image corresponds to an unprocessed photograph and wherein the processed image 220 to a processed photograph.

[0150] In a sixth embodiment, the steps 601 to 613 comprising any of 617a-b, 616a-b, 615a-b and 614a-b are performed as described in the first embodiment, wherein the unprocessed image corresponds to a plurality of unprocessed image frames and the processed image corresponds to an encoded or compressed video.In a seventh embodiment, the steps 601 to 604 of the second embodiment are performed. The image sensor 110 sends, to the AP 120 via a modifier device 140, the raw image data 210, the thumbnail 212s, the first timestamps, the sensor identifier, the sensor signature 214, and the offset. The modifier device 140 modifies the raw image data 210 and forwards the thumbnails, the first timestamps, the sensor identifier, the sensor signature 214, and the offset to the AP 120.

[0151] In the seventh embodiment, the steps 606 to 613 of the second embodiment are performed. No modifier device 140 modifies the processed image frames after the AP 120 generates the processed image frames.

[0152] In the seventh embodiment, the step and 610 is 611 is performed, wherein the verifier device 130 generates the processed thumbnails.

[0153] In the seventh embodiment, the step 615a is performed, wherein the verifier device 130 determines that the verification of the AP 120 is successful. The verifier device 130 may send the processed image frames comprising the watermark to the third party device 160. The third party device 160 verifies the AP signature 222 and sends the notification to the verifier device 130.

[0154] In the seventh embodiment, the step 616b is performed, wherein the verifier device 130 determines that the time difference between the first timestamps and the offset value, and the second timestamps are outside the time range. The verifier device 130 fails to verify that the AP 120 did receive the raw image data 210 immediately after the image sensor 110 sent the raw image data 210.

[0155] Optionally, the verifier device 130 further performs additionally step 617b that the image difference between the thumbnails and processed image frames are outside the determined similarity difference using the SIFT functionality.

[0156] In the alternative example, the verifier device 130 outputs that that the raw image data 210 has been modified in step 616.

[0157] In an eighth embodiment, 601 to 613 comprising any of 617a-b, 616a-b, 615a-b and 614a-b are performed. In the eight embodiment, the order of steps 617a-b, 616a-b, 615a-b and 614a-b is interchangeable.In a ninth embodiment, the steps 601 to 613 comprising any of 617a-b, 616a-b, 615a-b and 614a-b are performed as in the first to the eighth embodiment. The image sensor 110 encrypts the first timestamp using the first private key or a chip specific key shared by a manufacturer server. By encrypting the first timestamp, a modifier device 140 is not able to modify the first timestamp to simulate that the raw image data 210 has been processed by the AP 120 immediately after the image sensor 110 has sent the raw image data 210. The verifier device 130 may obtain the public key or the chip specific key and decrypt the first timestamp to perform step 616a or 616b.

[0158] For example, the image sensor 110 is a Complementary Metal-Oxide-Sem iconductor (CMOS) sensor, a Charge-Coupled Device (CDD) sensor, Single-Photon Avalanche Diodes (SPAD) sensor, a Foveon X3 Sensor, an Infra-Red (IR) sensor, a bolometric sensor, or a thermopile sensor.

[0159] For example, the AP 120 may be a system-on-chip (SoC) that includes an integrated ISP to process image and video data captured by a camera sensor.

[0160] The ISP unit 120b of the AP is a dedicated hardware block or integrated circuit for processing raw image data 210 obtained by the image sensor 110. The ISP unit 120b of the AP may convert raw pixel values comprised in the raw image data 210 into the processed image 220 such as a final, high-quality image or video by performing noise reduction, colour correction, sharpening, and / or encoding in realtime.

[0161] In an example, the verifier device 130 may be a Coalition for Content Provenance and Authenticity (C2PA)-compliant device, and / or a device implementing a truepic system, or a camera authentication system such as a Nikon image authentication and a Canon data verification kit. The C2PA-compliant device may be capable of checking provenance data for confirming an original creator of content. The truepic system may be capable of verifying an authenticity via a cloud service checking the AP signature and / or sensor signature.

[0162] The modifier device 140 may be a device for modifying the processed image 220 and / or the raw image data 210. The modifier device 140 may implement a GenAI to process the raw image data 210 and / or the processed image 220.The communication device 150 may correspond to a plurality of communication devices, or devices, representing at least one device directly interacting with the verifier device 130 and / or the image sensor 110.

[0163] The third-party entity, may represent at least one device spreading, saving, streaming, receiving, sending the processed image 220.

[0164] The third-party entity and / or the communication device 150 may correspond to a User Equipment (UE) such as a smartphone, a tablet, a laptop, a wearable device, Augmented Reality (AR) glasses, a robot or industrial machine with a sensor such as a camera, a smart TV, s set-top box, a car dashboard with access to internet and suitable for streaming, a Internet of Thing (loT) device, an edge device for image capturing and processing, a smart security camera, a home security hub, a public kiosk (such as in an airport, museum, mall) with a display.

[0165] Additionally, or alternatively, the third-party entity and / or the communication device 150 may also be a server device hosting cloud services, such as a data center server, edge computing node, or content delivery network (CDN) server. Additionally, or alternatively, the third-party entity and / or the communication device 150 may correspond to an input / output (I / O) device such as a screen, a smart display, a gaming console, an Augmented Reality (AR) headset and / or a Virtual Reality (VR) headset. Additionally, or alternatively, the third-party entity and / or the communication device 150 could be a drone, a video streaming device, a video encoder, a Graphics Processing Unit (GPU) such as nVidia, Advanced Micro Devices (AMD), Advanced Reduced Instruction Set Computing (RISC) Machine (ARM) (Mali GPU) , which enhances graphical rendering, Al processing, or video acceleration for connected devices.

[0166] The third-party device may be corresponded to a plurality of third-party devices the verifier device 130 is adapted to communicate with. The third-party device may correspond to a trusted device offering a service to verify a signature, computing time, or image differences.

[0167] The raw image data 210 is a collection of unprocessed pixel values representing light intensity with different wavelength, wherein the raw image data 210 is obtained directly from an image sensor 110 before any image enhancement, compression, orencoding is applied. In an example, the raw image data 210 may comprise pixel intensity values, and a color filter array according to e.g. a Bayer pattern. In an example, each pixel of the image sensor 110 can only sense, red (R) wavelength, blue (B) wavelengths or green (G) wavelengths and stores monochrome data for respective color at this time in the raw image data 210. The raw image data 210 may be stored in a data format such as RAW, or adobe digital negative (DNG). The raw image data 210 is pertaining to an unprocessed image or a plurality of unprocessed image frames, wherein the unprocessed image may be captured by the image sensor 110.

[0168] The unprocessed image or the unprocessed image frame is an image or image frame before any image enhancement, compression, or encoding is applied.

[0169] The thumbnail 212 of at least part of the raw image data 210 is a pre-processed image representation such as a compressed, lower-resolution preview of the unprocessed image or of each of the plurality of unprocessed image frame the raw image data 210 is pertaining to.

[0170] The processed image 220 or the processed image frame is the image or the image frame after any image enhancement, compression, or encoding is applied generated using the ISP unit 120b of the AP.

[0171] The first timestamp is a time record marking during, at a start and / or at an end of the image sensor 110 obtaining the raw image data 210 and / or generates thumbnail 212.

[0172] The second timestamp is a time record marking during, at a start and / or at an end of the AP 120 receiving, from the image sensor 110, the raw image data 210, the thumbnail 212, the first timestamp, the sensor identifier, and the sensor signature 214. Alternatively, or additional the second timestamp is a time record marking during, at a start and / or at an end of the AP 120 generating the processed image 220 based on the raw image data 210.

[0173] The first or second public-private key pair are two cryptographic keys used in asymmetric encryption i.e. the first private key and the first public key, or the second private key and the second public key. The first or second public key and thecorresponding first and / or second private key corresponds to a number, e.g. in a binary or hexadecimal format. The first public-private key pair is for the image sensor 110 and the second public-private key pair is for the AP 120.

[0174] The sensor signature 214 is a digital signature. In an example, the sensor signature 214 is associated to an encrypted first cryptographic hash value or to the thumbnail 212, the first timestamp, and the sensor identifier of the image sensor. Anything signed with the first private key of the image sensor 110 can be verified using the first public key.

[0175] The AP signature 222 is a digital signature. In an example, the AP signature 222 is is associated to an encrypted second cryptographic hash value, or to on the processed image 220, the AP identifier of the AP 120, and the second timestamp. Anything signed with the second private key of the AP 120 can be verified using the second public key.

[0176] The sensor certificate and / or the AP certificate may be e.g. a certificate such as a X509 certificate. The certificate may e.g. chain back to a root certificate of the manufacturer of the sensor / AP that is trusted by the verifier.

[0177] The sensor identifier of the image sensor 110 is an identifier uniquely identifying the image sensor 110 such as a serail number of the image sensor 110.

[0178] The AP identifier of the AP 120 is an identifier uniquely identifying the AP 120 such as a serail number of the AP 120.

[0179] The watermark in the processed image 220 is a visible or invisible marker embedded into the image to indicate information.

[0180] The image container may include optionally additional metadata in a file format of the processed image 220, and data corresponding to the processed image in e.g. a compressed or non-compressed format. In an example, the image container is JPEG, PNG, Tag Image File Format (TIFF).

[0181] The blob is a large, unstructured block of binary data that contains information from the image sensor 110. In an example, the format of the blob is XML.Figure 7 illustrates a block diagram illustrating embodiments of the image sensor 110 in further detail. In practice, the steps 310 to 350 of the method 300 performed by the image sensor 110 are performed by processing circuitry 110a, embodied in one or more processors and / or microprocessors arranged to execute a computer program 701 that is downloaded to a computer program product 705, here in the form of a computer readable storage medium 702. The computer readable storage medium 702 may be a memory, such as a flash memory, or a tangible non-volatile computer readable storage medium, such a Read-Only Memory (ROM) or a hard disk drive, or any combination thereof. The computer program 701 comprises computerexecutable instructions stored or downloaded to the computer readable storage medium 702 and are executable by the processing circuitry 110a. Alternatively, the computer program 701 may be transferred to the computer readable storage medium 702 using a suitable computer program product, such as a memory stick or in a memory of a device. Thus, the computer program 701 may be stored in any suitable manner in the computer program product. The processing circuity 110a is arranged to cause the image sensor 110 to carry out the steps 310 to 350 of method 300 in accordance with any of the of the described embodiments for steps 310 to 350. The processing circuitry 110a is in one embodiment one or more general-purpose processors wherein each one of the general purpose processors includes one or more cores, but may alternatively be a DSP, an ASIC, an FPGA, a CPLD, etc. An I / O interface 703 is provided for communicating with external and / or internal entities using wired communications, e.g., based on Ethernet, and / or wireless communications, e.g., Wi-Fi, and / or a cellular network corresponding to one or a combination of 5G cellular networks, LTE, LTE-advanced, UMTS, or any other current or future wireless network, such as a future 3GPP 6G network, as long as the principles described below are applicable.

[0182] Figure 8 illustrates a block diagram illustrating embodiments of the AP 120 in further detail. In practice, the steps 410 to 450 of the method 400 performed by the AP 120 are performed by processing circuitry 120a, embodied in one or more processors and / or microprocessors arranged to execute a computer program 801 that is downloaded to a computer program product 805, here in the form of a computer readable storage medium 802. The computer readable storage medium 802 may be a memory, such as a flash memory, or a tangible non-volatile computer readablestorage medium, such a ROM or a hard disk drive, or any combination thereof. The computer program 801 comprises computer-executable instructions stored or downloaded to the computer readable storage medium 802 and are executable by the processing circuitry 120a. Alternatively, the computer program 801 may be transferred to the computer readable storage medium 802 using a suitable computer program product, such as a memory stick or in a memory of a device. Thus, the computer program 801 may be stored in any suitable manner in the computer program product. The processing circuity 120a is arranged to cause the AP 120 to carry out the steps 410 to 450 of method 400 in accordance with any of the of the described embodiments for steps 410 to 450. The processing circuitry 120a is in one embodiment one or more general-purpose processors wherein each one of the general purpose processors includes one or more cores, but may alternatively be a DSP, an ASIC, an FPGA, a CPLD, etc. An I / O interface 803 is provided for communicating with external and / or internal entities using wired communications, e.g., based on Ethernet, and / or wireless communications, e.g., Wi-Fi, and / or a cellular network corresponding to one or a combination of 5G cellular networks, LTE, LTE-advanced, UMTS, or any other current or future wireless network, such as a future 3GPP 6G network, as long as the principles described below are applicable. Figure 9 illustrates a block diagram illustrating embodiments of the verifier device 130 in further detail. In practice, the steps 510 to 520 of the method 500 performed by the verifier device 130 are performed by processing circuitry 130a, embodied in one or more processors and / or microprocessors arranged to execute a computer program 901 that is downloaded to a computer program product 905, here in the form of a computer readable storage medium 902. The computer readable storage medium 902 may be a memory, such as a flash memory, or a tangible non-volatile computer readable storage medium, such a ROM or a hard disk drive, or any combination thereof. The computer program 901 comprises computer-executable instructions stored or downloaded to the computer readable storage medium 902 and are executable by the processing circuitry 130a. Alternatively, the computer program 901 may be transferred to the computer readable storage medium 902 using a suitable computer program product, such as a memory stick or in a memory of a device. Thus, the computer program 901 may be stored in any suitable manner in the computer program product. The processing circuity 130a is arranged to causethe verifier device 130 to carry out the steps 510 to 520 of method 500 in accordance with any of the of the described embodiments for steps 510 to 520. The processing circuitry 130a is in one embodiment one or more general-purpose processors wherein each one of the general purpose processors includes one or more cores, but may alternatively be a DSP, an ASIC, an FPGA, a CPLD, etc. An I / O interface 903 is provided for communicating with external and / or internal entities using wired communications, e.g., based on Ethernet, and / or wireless communications, e.g., WiFi, and / or a cellular network corresponding to one or a combination of 5G cellular networks, LTE, LTE-advanced, UMTS, or any other current or future wireless network, such as a future 3GPP 6G network, as long as the principles described below are applicable.

[0183] While the image sensor 110, the AP 120 and the verifier device 130 have been disclosed with the help of Figs. 7-9 as configured with computer programs 701, 801 and 901 respectively, they are in alternative embodiments implemented in pure hardware, e.g. through one or more ASICs.

Claims

CLAIMS:

1. An image sensor (110) for being communicatively connected to an application processor, AP, (120) implementing an image signal processing, ISP, unit (120a), the sensor device comprising processing circuitry (110a), wherein the processing circuitry is configured to:obtain raw image data (210);generate a thumbnail (212) of the raw image data (210) based on at least a part of the raw image data (210);generate at least one first timestamp indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail (212), and / or sends the thumbnail (212);generate a sensor signature (214) based on the thumbnail (212), the first timestamp, and a sensor identifier of the image sensor (110), using a first private key of a first public-private key pair for the image sensor (110); andwhen the image sensor (110) is communicatively connected to the AP (120):send, to the AP (120), the raw image data (210), the thumbnail (212), the first timestamp, the sensor identifier, and the sensor signature (214).

2. The image sensor (110) according to claim 1, wherein the raw image data (210) pertains to an unprocessed image, and wherein the thumbnail (212) is generated for the unprocessed image.

3. The image sensor (110) according to claim 1 , wherein the raw image data (210) pertains to unprocessed image frames, and wherein the thumbnail (212) is generated as a representation of the unprocessed image frames.

4. The image sensor (110) according to any one of claims 1 to 3, wherein the at least one first timestamp is generated based on a time during, at a start and / or at an end of the processing circuitry (110a) being configured to:obtain the raw image data (210),generate the thumbnail (212),send the thumbnail (212), and / orsend the raw image data (210).

5. The image sensor (110) according to any one of claims 1 to 4, wherein the processing circuitry (110a) being configured to send the raw image data (210), the thumbnail (212), the first timestamp, the sensor identifier, and the sensor signature (214) comprises: the processing circuitry (110a) being configured to also send an offset value for the first timestamp to the AP (120), and wherein the processing circuitry (110a) being configured to generate the sensor signature (214) comprises the processing circuitry (110a) being configured to generate the sensor signature also based on the offset value.

6. The image sensor (110) according to any one of claims 1 to 5, wherein the thumbnail is sent after a predetermined time after the image sensor sends the raw image data.

7. An application processor, AP, (120) for being communicatively connected to an image sensor (110), and comprising an image signal processing, ISP, unit (120b) of theAP and a processing circuitry (120a), wherein the processing circuitry (120a) is configured to when the image sensor (110) is communicatively connected to theAP (120):receive, from the image sensor (110), raw image data (210), a thumbnail of the raw image data (210), at least one first timestamp, a sensor identifier of the image sensor (110), and a sensor signature (214);generate, using the ISP unit (120b) of the AP, at least one processed image (220) based on the raw image data (210);generate at least one second timestamp indicative of when the AP (120) receives the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214), and / or when the AP (120) has generated the processed image (220);generate an AP signature (222) based on the processed image (220), an AP identifier of the AP (120), and the second timestamp using a second private key of a second private-public key pair for the AP (120);output the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier.

8. The AP (120) according to claim 7, wherein the raw image data (210) pertains to an unprocessed image (220), and wherein the thumbnail is generated for the unprocessed image (220).

9. The AP (120) according to claim 7, wherein the raw image data (210) pertains to unprocessed image (220) frames, wherein the processed image (220) corresponds to processed image frames, and wherein the thumbnail is generated as a representation of the unprocessed image frames.

10. The AP (120) according to any one of claims 7 to 9, wherein the sensor signature (214) is based on the thumbnail, the first timestamp, and the sensor identifier.

11. The AP (120) according to any one of claims 7 to 10, wherein the at least one second timestamp is generated based on a time during, at a start and / or at an end of the processing circuitry (120a) being configured to:receive, from the image sensor (110), the raw image data (210), the thumbnail, the first timestamp, the sensor identifier, and the sensor signature (214); and / orgenerate the processed image (220) based on the raw image data (210).

12. The AP (120) according to any one of claims 7 to 11 , wherein the first timestamp is indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail and / or sends the thumbnail.

13. The AP (120) according to claim any one of claims 7 to 12, wherein the processing circuitry (120a) being configured to generate the AP signature (222) comprises: the processing circuitry (120a) being configured to generate the AP signature (222) based on the sensor signature (214).14.TheAP (120) according to any one of claims 7 to 13, wherein the processing circuitry (120a) being configured to receive the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214) comprises: the processing circuitry (120a) being configured to also receive an offset value and output the offset value.

15. The AP (120) according to any one of claims 7 to 14, wherein the processing circuitry (120a) being configured to output the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier comprises: the processing circuitry (120a) being configured to send, to a communication device (150), the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier.

16. A verifier device (130), the verifier device (130) comprising processing circuitry (130a), wherein the processing circuitry (130a) is configured to:obtain at least one processed image, a thumbnail of raw image data (210), at least one first timestamp, a sensor identifier of an image sensor (110), a sensor signature (214), an application processor, AP, signature, at least one second timestamp, and an AP identifier of an AP (120) implementing an image signal processor, ISP, unit (120b) of the AP, wherein the first timestamp is indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail, sends the thumbnail and / or sends the raw image data (210), andwherein the second timestamp is indicative of when the AP (120) receives the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214), and / or when the AP (120) has generated the processed image (220);determine that the processed image is modified or unmodified based ona verification of the sensor signature (214) using a first public key of a first public-private key pair, the thumbnail, the first timestamp, and the sensor identifier,a verification of the AP signature using a second public key of a second public-private key pair, the processed image, the AP identifier, and the second timestamp,an image difference verification between the processed image and the thumbnail, anda time difference verification between the first timestamp and the second timestamp.

17. The verifier device (130) according to claim 16, wherein the processing circuitry (130a) being configured to determine that the processed image is unmodified comprises: configuring the processing circuitry (130a) to determine thatthe verification of the sensor signature (214) is successful; the verification of the AP signature is successful;a time difference between the first timestamp and the second timestamp is within a time range; andan image difference between the processed image and the thumbnail is within a determined similarity range.

18. The verifier device (130) according to any one of claims 16 to 17, wherein the processing circuitry (130a) being configured to determine that the processed image is modified, comprises: configuring the processing circuitry (130a) to determine that:the sensor verification of the sensor signature (214) is unsuccessful; the AP verification of the AP signature is unsuccessful;a time difference between the first timestamp and the second timestamp is outside a time range; and / oran image difference between the processed image and the thumbnail is outside a determined similarity range.

19. The verifier device (130) according to any one of claims 16 to 18, wherein the processing circuitry (130a) is configured to:generate, based on the thumbnail, at least one processed thumbnail using an ISP unit (130b) of the verifier device (130), wherein the verifier device (130) is implementing the ISP unit (130b) of the verifier device (130), andwherein the image difference is determined based on the processed thumbnail.

20. The verifier device (130) according to any one of claims 16 to 19, wherein the image difference verification between the processed image and the thumbnail is based on a difference between a first local feature vector in the processed image and a second local feature vector in the thumbnail to a metric.

21. The verifier device (130) according to any one of claims 16 to 20, wherein the processing circuitry (130a) is configured to:obtain a sensor certificate based on the sensor identifier, wherein the sensor certificate comprises the first public key of the first public-private key pair; andobtain an AP certificate based on the AP identifier, wherein the AP certificate comprises the second public key of the second public-private key pair.

22. The verifier device (130) according to any one of claims 16 to 21 , wherein the AP signature comprises the sensor signature (214).

23. The verifier device (130) according to any one of claims 16 to 22, wherein the processing circuitry (130a) being configured to obtain the processed image, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and the AP identifier comprises: the processing circuitry (130a) being configured to also obtain an offset value of the first timestamp.

24. The verifier device (130) according to any one of claims 16 to 23, wherein the raw image data (210) pertains to an unprocessed image, and wherein the thumbnail is generated for the unprocessed image.

25. The verifier device (130) according to any one of claims 16 to 24, wherein the raw image data (210) pertains to unprocessed image frames, wherein the processed image corresponds to processed image frames, and wherein the thumbnail is generated as a representation of the unprocessed image frames.

26. The image verifier (130) device to any one of claims 16 to 25, wherein the processing circuitry (130a) being configured to obtain the processed image, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and the AP identifier, comprises: the processing circuitry (130a) being configured to receive, from a communication device (150) and / or a modifier device (140), the processed image, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and the AP identifier.

27. A method (300) performed by an image sensor (110) for being communicatively connected to an application processor, AP, (120)implementing an image signal processing, ISP, unit (120a), wherein the method comprises:obtaining (310) raw image data (210);generating (320) a thumbnail (212) of the raw image data (210) based on at least a part of the raw image data (210);generating (330) at least one first timestamp indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail (212), and / or sends the thumbnail (212);generating (340) a sensor signature (214) based on the thumbnail (212), the first timestamp, and a sensor identifier of the image sensor (110), using a first private key of a first public-private key pair for the image sensor (110); andwhen the image sensor (110) is communicatively connected to the AP (120):sending (350), to the AP (120), the raw image data (210), the thumbnail (212), the first timestamp, the sensor identifier, and the sensor signature (214).

28. The method (300) according to claim 27, wherein the wherein the raw image data (210) pertains to an unprocessed image, and wherein the thumbnail (212) is generated for the unprocessed image.

29. The method (300) according to claim 27, wherein the raw image data (210) pertains to unprocessed image frames, and wherein the thumbnail (212) is generated as a representation of the unprocessed image frames.

30. The method (300) according to any one of claim 27 to 29, wherein the at least one first timestamp is generated based on a time during, at a start and / or at an end of :obtaining (310) the raw image data (210),generating (320) the thumbnail (212),sending (350) the thumbnail (212), and / orsending (350) the raw image data (210).31.The method (300) according to any one of claim 27 to 30,wherein sending (350) the raw image data (210), the thumbnail (212), the first timestamp, the sensor identifier, and the sensor signature (214) comprises sending (352) an offset value for the first timestamp to the AP (120); andwherein generating (340) the sensor signature (214) generating the sensor signature also based on the offset value.

32. The method (300) according to any one of claim 27 to 31 , wherein the thumbnail is sent after a predetermined time after the image sensor sends the raw image data.

33. A method (400) performed by an application processor, AP, (120) for being communicatively connected to an image sensor (110), and comprising an image signal processing, ISP, unit (120b) of the AP, wherein the method when the image sensor (110) is communicatively connected to the AP (120) comprises:receiving (410), from the image sensor (110), raw image data (210), a thumbnail of the raw image data (210), at least one first timestamp, a sensor identifier of the image sensor (110), and a sensor signature (214);generating (420), using the ISP unit (120b) of the AP, at least one processed image (220) based on the raw image data (210); generating (430) at least one second timestamp indicative of when the AP (120) receives the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214), and / or when the AP (120) has generated the processed image (220);generating (440) an AP signature (222) based on the processed image (220), an AP identifier of the AP (120), and the second timestamp using a second private key of a second private-public key pair for the AP (120);outputting (450) the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier.

34. The method (400) according to claim 33, wherein the raw image data (210) pertains to an unprocessed image (220), and wherein the thumbnail is generated for the unprocessed image (220).

35. The method (400) according to claim 33, wherein the raw image data (210) pertains to unprocessed image (220) frames, wherein the processed image (220) corresponds to processed image frames, and wherein the thumbnail is generated as a representation of the unprocessed image frames.

36. The method (400) according to any one of claim 33 to 35, wherein the sensor signature (214) is based on the thumbnail, the first timestamp, and the sensor identifier.

37. The method (400) according to any one of claim 33 to 36, wherein the at least one second timestamp is generated based on a time during, at a start and / or at an end of:receiving (410), from the image sensor (110), the raw image data (210), the thumbnail, the first timestamp, the sensor identifier, and the sensor signature (214); and / orgenerating (420) the processed image (220) based on the raw image data (210).

38. The method (400) according to any one of claim 33 to 37, wherein the first timestamp is indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail and / or sends the thumbnail.

39. The method (400) according to any one of claim 33 to 38, wherein the generating (440) the AP signature (222) comprises generating the AP signature (222) based on the sensor signature (214).

40. The method (400) according to any one of claim 33 to 39, wherein receiving (410) the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214) comprises receiving (412) an offset value and output the offset value.41.The method (400) according to any one of claim 33 to 40, wherein outputting (450) the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier comprises: sending, to a communicationdevice (150), the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier.

42. A method (500) performed by a verifier device (130), wherein the method (500) comprises:obtaining (510) at least one processed image, a thumbnail of raw image data (210), at least one first timestamp, a sensor identifier of an image sensor (110), a sensor signature (214), an application processor, AP, signature, at least one second timestamp, and an AP identifier of an AP (120) implementing an image signal processor, ISP, unit (120b) of the AP,wherein the first timestamp is indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail, sends the thumbnail and / or sends the raw image data (210), andwherein the second timestamp is indicative of when the AP (120) receives the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214), and / or when the AP (120) has generated the processed image (220);determining (520) that the processed image is modified or unmodified based ona verification of the sensor signature (214) using a first public key of a first public-private key pair, the thumbnail, the first timestamp, and the sensor identifier,a verification of the AP signature using a second public key of a second public-private key pair, the processed image, the AP identifier, and the second timestamp,an image difference verification between the processed image and the thumbnail, anda time difference verification between the first timestamp and the second timestamp.

43. The method (500) according to claim 42, wherein determining (520) that the processed image is unmodified comprises: determining (522a, 524a, 526a, 528a) thatthe verification of the sensor signature (214) is successful;the verification of the AP signature is successful;a time difference between the first timestamp and the second timestamp is within a time range; andan image difference between the processed image and the thumbnail is within a determined similarity range.

44. The method (500) according to any one of claims 42 to 43, wherein determining that the processed image is modified, comprises: determining (522b, 524b, 526b, 528b) that:the sensor verification of the sensor signature (214) is unsuccessful;the AP verification of the AP signature is unsuccessful;a time difference between the first timestamp and the second timestamp is outside a time range; and / oran image difference between the processed image and the thumbnail is outside a determined similarity range.

45. The method (500) according to any one of claims 42 to 44, wherein the method (500) comprises:generating (514), based on the thumbnail, at least one processed thumbnail using an ISP unit (130b) of the verifier device (130), wherein the verifier device (130) is implementing the ISP unit (130b) of the verifier device (130), andwherein the image difference is determined based on the processed thumbnail.

46. The method (500) according to any one of claims 42 to 45, wherein the image difference verification between the processed image and the thumbnail is based on a difference between a first local feature vector in the processed image and a second local feature vector in the thumbnail to a metric.

47. The method (500) according to any one of claims 42 to 46, wherein the method (500) comprises:obtaining (516) a sensor certificate based on the sensor identifier, wherein the sensor certificate comprises the first public key of the first publicprivate key pair; andobtaining (518) an AP certificate based on theAP identifier, wherein the AP certificate comprises the second public key of the second public-private key pair.

48. The method (500) according to any one of claims 42 to 47, wherein the AP signature comprises the sensor signature (214).

49. The method (500) according to any one of claims 42 to 48, wherein obtaining (510) the processed image, the thumbnail, the first timestamp, the sensoridentifier, the AP signature, the second timestamp, and the AP identifier comprises: obtaining (512) an offset value of the first timestamp.

50. The method (500) according to any one of claims 42 to 49, wherein the raw image data (210) pertains to an unprocessed image, and wherein the thumbnail is generated for the unprocessed image.51.The method (500) according to any one of claims 42 to 50, wherein the raw image data (210) pertains to unprocessed image frames, wherein the processed image corresponds to processed image frames, and wherein the thumbnail is generated as a representation of the unprocessed image frames.

52. The method (500) according to any one of claims 42 to 51 , obtaining the processed image, the thumbnail, the first timestamp, the sensor identifier, the AP signature, the second timestamp, and theAP identifier, comprises: receiving, from a communication device (150) and / or a modifier device (140), the processed image, the thumbnail, the first timestamp, the sensor identifier, theAP signature, the second timestamp, and theAP identifier.

53. An image sensor (110) for being communicatively connected to an application processor, AP, (120) implementing an image signal processing, ISP, unit (120a), the sensor device comprising processing circuitry (110a) and a computer readable storage medium (702), wherein the processing circuitry is configured to:obtain raw image data (210);generate a thumbnail (212) of the raw image data (210) based on at least a part of the raw image data (210);generate at least one first timestamp indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail (212), and / or sends the thumbnail (212);generate a sensor signature (214) based on the thumbnail (212), the first timestamp, and a sensor identifier of the image sensor (110), using a first private key of a first public-private key pair for the image sensor (110); and when the image sensor (110) is communicatively connected to the AP (120):send, to the AP (120), the raw image data (210), the thumbnail (212), the first timestamp, the sensor identifier, and the sensor signature (214).

54. The image sensor (110) according to claim 53, configured to perform the method according to any of claims 28 to 32.

55. An application processor, AP, (120) for being communicatively connected to an image sensor (110), and comprising an image signal processing, ISP, unit (120b) of the AP and a processing circuitry (120a) and a computer readable storage medium (802), wherein the processing circuitry (120a) is configured to when the image sensor (110) is communicatively connected to the AP (120):receive, from the image sensor (110), raw image data (210), a thumbnail of the raw image data (210), at least one first timestamp, a sensor identifier of the image sensor (110), and a sensor signature (214);generate, using the ISP unit (120b) of the AP, at least one processed image (220) based on the raw image data (210);generate at least one second timestamp indicative of when the AP (120) receives the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214), and / or when the AP (120) has generated the processed image (220);generate an AP signature (222) based on the processed image (220), an AP identifier of the AP (120), and the second timestamp using a second private key of a second private-public key pair for the AP (120);output the processed image (220), the sensor signature (214), the thumbnail, the first timestamp, the sensor identifier, the AP signature (222), the second timestamp, and the AP identifier.

56. The AP (120) according to claim 55, configured to perform the method according to any of claims 34 to 41.

57. A verifier device (130), the verifier device (130) comprising processing circuitry (130a) and a computer readable storage medium (902), wherein the processing circuitry (130a) is configured to:obtain at least one processed image, a thumbnail of raw image data (210), at least one first timestamp, a sensor identifier of an image sensor (110), a sensor signature (214), an application processor, AP, signature, at least one second timestamp, and an AP identifier of an AP (120) implementing an image signal processor, ISP, unit (120b) of the AP,wherein the first timestamp is indicative of when the image sensor (110) obtains the raw image data (210), generates the thumbnail, sends the thumbnail and / or sends the raw image data (210), andwherein the second timestamp is indicative of when the AP (120) receives the raw image data (210), the thumbnail of the raw image data (210), the first timestamp, the sensor identifier, and the sensor signature (214), and / or when the AP (120) has generated the processed image (220);determine that the processed image is modified or unmodified based ona verification of the sensor signature (214) using a first public key of a first public-private key pair, the thumbnail, the first timestamp, and the sensor identifier,a verification of the AP signature using a second public key of a second public-private key pair, the processed image, the AP identifier, and the second timestamp,an image difference verification between the processed image and the thumbnail, anda time difference verification between the first timestamp and the second timestamp.

58. The verifier device (130) according to claim 57, configured to perform the method according to any of claims 43 to 52.

59. A computer program (701) comprising instructions which, when executed on processing circuitry (704) of an image sensor (110), cause the processing circuitry (704) of the image sensor (110) to carry out the method according to any one of claims 27 to 32.

60. A computer program (801) comprising instructions which, when executed on processing circuitry (804) of an application processor, AP, (120), cause the processing circuitry (804) of the AP (120) to carry out the method according to any one of claims 33 to 41.

61. A computer program (901) comprising instructions which, when executed on processing circuitry (904) of verifier device (130), cause the processing circuitry (904) of the verifier device (130) to carry out the method according to any one of claims 42 to 52.

62. A tangible, non-volatile computer readable medium (702) comprising instructions that, when executed onprocessing circuitry (704) of an image sensor (110), cause the processing circuitry (704) of the image sensor (110) to carry out the method according to any one of claims 27 to 32.

63. A tangible, non-volatile computer readable medium (802) comprising instructions that, when executed onprocessing circuitry (804) of an application processor, AP, (120), cause the processing circuitry (804) of the AP (120) to carry out the method according to any one of claims 33 to 41.

64. A tangible, non-volatile computer readable medium (902) comprising instructions that, when executed onprocessing circuitry (904) of verifier device (130), cause the processing circuitry (904) of the verifier device (130) to carry out the method according to any one of claims 42 to 52.

Images