Image and Video Encryption

Chapter 4 APPLICATION SCENARIOS FOR THE ENCRYPTION OF VISUAL DATA (p.31-32)

1. Security provided by Infrastructure or Application Images and videos (often denoted as visual data) are data types which require enormous storage capacity or transmission bandwidth due to the large amount of data involved. In order to provide reasonable execution performance for encrypting such large amounts of data, only symmetric encryption (as opposed to public key cryptography) can be used. As done in most current applications with demand for confidentiality, public key techniques are used for key exchange or signature generation only (such schemes are usually denoted as "hybrid").

There are two ways to provide confidentiality to a storage or transmission application. First, confidentiality is based on mechanisms provided by the underlying computational infrastructure. The advantage is complete transparency, i.e. the user or a specific application does not have to take care about confidentiality. The obvious disadvantage is that confidentiality is provided for all applications, no matter if required or not, and that it is not possible to exploit specific properties of certain applications. To give a concrete example, consider the distributed medical database infrastructure mentioned in the introduction. If the connections among the components are based on TCP/IP internet-connections (which are not confidential by itself of course), confidentiality can be provided by creating a Virtual Private Network (VPN) using IPSec (which extends the IP protocol by adding confidentiality and integrity features).

In this case, the entire visual data is encrypted for each transmission which puts a severe load on the encryption system. The second possibility is to provide confidentiality is on the application layer. Here, only applications and services are secured which have a demand for confidentiality. The disadvantage is that each application needs to take care for confidentiality by its own, the advantage is that specific properties of certain applications may be exploited to create more efficient encryption schemes or that encryption is omitted if not required. Selective encryption of visual data takes advantage of the redundancy in visual data which takes place at the application level and is therefore classified into the second category.


2. Full Encryption vs. Selective Encryption

Over the last years a number of different encryption schemes for visual data types have been proposed, since methods to provide confidentiality need to be specifically designed to protect multimedia content and fulfil the security requirements for a particular multimedia application.

The so called naive method - the most secure one - is to take the multimedia bitstream and encrypt this stream with the aid of a cryptographically strong cipher like AES. Here, the encryption is performed after the compression stage and due to the complexity of the involved encryption algorithm, such a scheme inherently adds significant latency which often conflicts with real-time constraints. Since runtime performance is often very critical in video encoding and decoding, more efficient methods have been proposed. Such systems - often denoted as "selective" or "soft" encryption systems - usually trade off runtime performance for security, and are therefore - in terms of security - somewhat weaker than the naive method.

Whereas selective encryption (SE) approaches exploit application specific data structures to create more efficient encryption systems (e.g. encryption of I-encoded blocks in MPEG, packet data of selected layers in JPEG 2000) using secure but slow "classical" ciphers, soft encryption systems employ weaker encryption systems (like permutations) to accelerate the processing speed.