On the design of perceptual MPEG-video encryption algorithms

2022-04-03 来源：好走旅游网

214IEEETRANSACTIONSONCIRCUITSANDSYSTEMSFORVIDEOTECHNOLOGY,VOL.17,NO.2,FEBRUARY2007

OntheDesignofPerceptualMPEG-Video

EncryptionAlgorithms

ShujunLi,GuanrongChen,Fellow,IEEE,AlbertCheung,Member,IEEE,BharatBhargava,Fellow,IEEE,and

Kwok-TungLo,Member,IEEE

Abstract—Inthispaper,someexistingperceptualencryptionalgorithmsofMPEGvideosarereviewedandsomeproblems,especiallysecuritydefectsoftworecentlyproposedMPEG-videoperceptualencryptionschemes,arepointedout.Then,asimplerandmoreeffectivedesignissuggested,whichselectivelyencryptsﬁxed-lengthcodewordsinMPEG-videobitstreamsunderthecontrolofthreeperceptibilityfactors.Theproposeddesignisac-tuallyanencryptionconﬁgurationthatcanworkwithanystreamcipherorblockcipher.Comparedwiththepreviously-proposedschemes,thenewdesignprovidesmoreusefulfeatures,suchasstrictsize-preservation,on-the-ﬂyencryptionandmultiplepercep-tibility,whichmakeitpossibletosupportmoreapplicationswithdifferentrequirements.Inaddition,fourdifferentmeasuresaresuggestedtoprovidebettersecurityagainstknown/chosen-plain-textattacks.

IndexTerms—Cryptanalysis,ﬁxed-lengthcodeword(FLC),known/chosen-plaintextattack,MPEG,perceptualencryption.

Fig.1.Diagrammaticviewoftheperceptualencryption.

I.INTRODUCTION

HEWIDEUSEofdigitalimagesandvideosinvariousap-plicationsbringsseriousattentiontothesecurityandpri-vacyissuestoday.Manydifferentencryptionalgorithmshavebeenproposedinrecentyearsaspossiblesolutionstotheprotec-tionofdigitalimagesandvideos,amongwhichMPEGvideosattractmostattentionduetoitsprominentprevalenceincon-sumerelectronicmarkets[1]–[5].

Inmanyapplications,suchaspay-per-viewvideos,pay-TVandvideoondemand(VoD),thefollowingfeaturecalled“perceptualencryption”isuseful.Thisfeaturerequiresthatthequalityofaural/visualdataisonlypartiallydegradedbyencryption,i.e.,theencryptedmultimediadataarestillpar-tiallyperceptibleafterencryption.Suchperceptibilitymakesitpossibleforpotentialuserstolisten/viewlow-qualityversions

ManuscriptreceivedDecember2,2004;revisedFebruary21,2006.Thisre-searchwassupportedinpartbytheCityUniversityofHongKongSRGunderGrant7001702,inpartbyTheHongKongPolytechnicUniversity’sPostdoc-toralFellowshipsSchemeunderGrantG-YX63,inpartbytheResearchGrantCouncilofHongKongunderGrantPolyU5232/06E,andinpartbytheNationalScienceFoundationGrantsANI-0219110andRIS-0292890.

S.LiandK.-T.LoarewiththeDepartmentofElectronicandInformationEngineering,TheHongKongPolytechnicUniversity,Kowloon,HongKong(e-mail:hooklee75@hotmail.com;enktlo@polyu.edu.hk).

G.CheniswiththeDepartmentofElectronicEngineering,CityUniversityofHongKong,HongKong(e-mail:gchen@ee.cityu.edu.hk).

A.CheungiswiththeDepartmentofBuildingandConstructionandShen-zhenAppliedR&DCentres,CityUniversityofHongKong,HongKong(e-mail:clacc@cityu.edu.hk).

B.BhargavaiswiththeDepartmentofComputerSciences,PurdueUniver-sity,WestLafayette,IN47907-2066USA(e-mail:bb@cs.purdue.edu).

Colorversionsofoneormoreoftheﬁguresinthispaperareavailableonlineathttp://ieeexplore.ieee.org.

DigitalObjectIdentiﬁer10.1109/TCSVT.2006.888840

ofthemultimediaproductsbeforebuyingthem.Itisdesirablethattheaural/visualqualitydegradationcanbecontinuouslycontrolledbyafactor,whichgenerallydenotesapercentagecorrespondingtotheencryptionstrength.Fig.1showsadia-grammaticviewofperceptualencryption.Theencryptionkeyiskeptsecret(notneededwhenpublic-keyciphersareused)butthecontrolfactorcanbepublished.

Regardingthevisualqualitydegradationoftheencryptedvideos,thefollowingpointsshouldberemarked.1)Sincetheredoesnotexistawell-acceptedobjectivemeasureofvisualqualityofdigitalimagesandvideos,thecontrolfactorisgen-erallychosentorepresentaroughmeasureofthedegradation.2)Thevisualqualitydegradationsofdifferentframesmaybedifferent,sothecontrolfactorworksonlyinanaveragesenseforallvideos.3)Thecontrolfactorisgenerallyselectedtofacilitatetheimplementationoftheencryptionscheme,whichmaynothavealinearrelationshipwiththevisualqualitydegra-dation(butalargervaluealwaysmeansastrongerdegradation).

,thestrongestvisualquality4)whenthecontrolfactor

degradationofthespeciﬁcalgorithm(i.e.,ofthetargetappli-cation)isreached,butitmaynotbethestrongestdegradationthatallalgorithmscanproduce(i.e.,allvisualinformationofthevideoiscompletelyconcealed).

Inrecentyears,someperceptualencryptionschemeshavebeenproposedforG.729speech[6],[7],MP3music[8],JPEGimages[9],[10],wavelet-compressed(suchasJPEG2000)imagesandvideos[11]–[13]andMPEGvideos[14]–[17],respectively.Theselectiveencryptionalgorithmsproposedin[18]–[20]canbeconsideredasspecialcasesoftheperceptualencryptionforimagescompressedwithwaveletpacketdecom-position.Insomeresearchpapers,adifferentterm,“transparentencryption,”isusedinsteadof“perceptualencryption”[16],[17],emphasizingthefactthattheencryptedmultimediadataaretransparenttoallstandard-compliantdecoders.However,transparencyisactuallyanequivalentofanotherfeaturecalled“format-compliance”(or“syntax-awareness”)[21],[22],

LIetal.:PERCEPTUALMPEG-VIDEOENCRYPTIONALGORITHMSwhichdoesnotmeanthatsomepartialperceptibleinformationinplaintextsstillremainsinciphertexts.Inotherwords,aperceptualciphermustbeatransparentcipher,butatransparentciphermaynotbeaperceptualcipher[5].Generally,perceptualencryptionisrealizedbyselectiveencryptionalgorithmswiththeformat-compliantfeature.Thispaperchoosestousethenameof“perceptualencryption”forsuchausefulfeatureofmultimediaencryptionalgorithms.Moreprecisely,thispaperfocusesontheperceptualencryptionofMPEGvideos.Afteridentifyingsomeproblemsoftheexistingperceptualencryptionschemes,amoreeffectivedesignofperceptualMPEG-videoencryptionwillbeproposed.

Therestofthispaperisorganizedasfollows.Thenextsectionwillprovideabriefsurveyofrelatedworkandpointoutsomeproblems,especiallyproblemsexistingintwore-cently-proposedperceptualencryptionalgorithms[16],[17].InSectionIII,thevideoencryptionalgorithm(VEA)proposedin[23]isgeneralizedtorealizeanewperceptualencryptiondesignforMPEGvideos,calledtheperceptualVEA(PVEA).ExperimentalstudyispresentedinSectionIV,toshowtheen-cryptionperformanceofPVEA.Thelastsectionpresentstheconclusion.

II.RELATEDWORKANDEXISTINGPROBLEMS

A.Scalability-BasedPerceptualEncryption

OwingtothescalabilityprovidedinMPEG-2/4standards[24],[25],itisnaturaltorealizeperceptualencryptionbyencryptingtheenhancementlayer(s)ofanMPEGvideo(butleavingthebaselayerunencrypted)[14].However,sincenotallMPEGvideosareencodedwithmultiplelayers,thisschemeisquitelimitedinpractice.MoregeneraldesignsshouldbedevelopedtosupportvideosthatarecomplianttotheMPEGstandards.

B.PerceptualEncryptionforJPEGImages

DuetothesimilaritybetweentheencodingofJPEGimages[26]andtheframe-encodingofMPEGvideos[24],[25],[27],theideasofperceptualencryptionforJPEGimagescanbeeasilyextendedtoMPEGvideos.

In[9],twotechniquesofperceptualencryptionwerestudied:encryptingselectivebitplanesofuncompressedgray-scaleim-ages,andencryptingselectivehigh-frequencyaccoefﬁcientsofJPEGimages,withablockciphersuchasDES,triple-DES,orIDEA[28].Thecontinuouscontrolofthevisualqualitydegra-dationwasnotdiscussed,however.

In[10],theperceptualencryptionofJPEGimagesisreal-izedbyencryptingvariable-lengthcodewords(VLCs)ofpar-tialaccoefﬁcientsinazoneofencryption(ZoE)tobeotherVLCsintheHuffmantable.Thevisualqualitydegradationis

controlledviaanencryptionprobability,

,where.ThisencryptionideaissimilartotheVEA

proposedin[22].ThemainproblemwithencryptingVLCsisthatthesizeoftheencryptedimage/videowillbeincreasedsincetheHuffmanentropycompressionisactuallydiscardedinthisalgorithm.

215

C.PerceptualEncryptionforWavelet-CompressedImagesandVideos

In[11]–[13],severalperceptualencryptionschemesforwavelet-compressedimagesandvideoswereproposed.Underthecontrolofapercentageratio,signbitscramblingandse-cretpermutationsofwaveletcoefﬁcients/blocks/bitplanesarecombinedtorealizeperceptualencryption.Theproblemwiththeseperceptualencryptionschemesisthatthesecretpermuta-tionsarenotsufﬁcientlysecureagainstknown/chosen-plaintextattacks[29]–[32]:bycomparingtheabsolutevaluesofanumberofplaintextsandciphertexts,onecanreconstructthesecretpermutations.Oncethesecretpermutationsareremoved,theencryptionperformancewillbesigniﬁcantlycompromised.D.PerceptualEncryptionofMotionVectorsinMPEG-VideosIn[15],motionvectorsarescrambledtorealizeperceptualen-cryptionofMPEG-2videos.SinceI-framesdonotdependonmotionvectors,suchaperceptualencryptionalgorithmcanonlyblurthemotionsofMPEGvideos.ItcannotprovideenoughdegradationofthevisualqualityoftheMPEGvideosforen-cryption(seeFig.3).Generallyspeaking,thisalgorithmcanbeusedasanoptionforfurtherenhancingtheperformanceofaperceptualencryptionschemebasedonothertechniques.E.Pazarci–DipçinScheme

In[16],PazarciandDipçinproposedanMPEG-2perceptualencryptionscheme,whichencryptsthevideointheRGBcolorspaceviafoursecretlineartransformsbeforethevideoiscom-pressedbytheMPEG-2encoder.ToencrypttheRGB-formatuncompressedvideo,eachframeisdividedintoscram-blingblocks(SB),whichiscomposedofmultiplemacroblocksofsize1616.Assumingtheinputandtheoutputpixelvalues

are

and,respectively,thefourlineartransformsarede-scribedasfollows:

(1)

where

()isafactorcontrol-lingthevisualqualitydegradation,,

aretwobinarypa-rametersthatdetermineanafﬁnetransformforencryption,and

meansthemaximalpixelvalue(forexample,

for8-bitRGB-videos).ThevalueofineachSBiscalculatedfromtheprecedingI-frame,withafunctioncalled-rule(see[16,Sec.2.2]formoredetails).The-ruleanditsparametersaredesignatedtobethesecretkeyofthisscheme.

ThemainmeritofthePazarci–Dipçinschemeisthattheencryption/decryptionandtheMPEGencoding/decodingpro-cessesareseparated,whichmeansthattheencryptionpartcansimplybeaddedtoanMPEGsystemwithoutanymodiﬁcation.However,thefollowingdefectsmakethisschemeproblematicinrealapplications.

1)Unrecoverablequalitylosscausedbytheencryption

alwaysexists,unless

(whichcorrespondstonoencryption).Evenauthorizeduserswhoknowthesecretkeycannotrecoverthevideowiththeoriginalquality.Althoughitisclaimedin[16]thathumaneyesarenot

216IEEETRANSACTIONSONCIRCUITSANDSYSTEMSFORVIDEOTECHNOLOGY,VOL.17,NO.2,FEBRUARY2007

sensitivetosuchaqualitylossifissetabove0.5,itmaystillbeundesirableforhigh-qualityvideoservices,suchasDVDandHDTV.Inaddition,limitingthevalueoflowersthesecurityandﬂexibilityoftheencryptionscheme.

2)Thecompressionratiomaybesigniﬁcantlyinﬂuencedbyencryptioniftherearefastmotionsintheplainvideos.Thisisbecausethemotioncompensationalgorithmmayfailtoworkforencryptedvideos.Themainreasonisthatthecor-respondingSBsmaybeencryptedwithdifferentparame-ters.Toreducethiskindofinﬂuence,theencryptionpa-rametersofallSBshavetobesufﬁcientlyclosetoeachother.This,however,compromisestheencryptionperfor-manceandthesecurity.

3)TheschemeisnotsuitableforencryptingMPEG-com-pressedvideos.Inmanyapplications,suchasVoDser-vices,theplain-videoshavealreadybeencompressedinMPEGformatandstoredindigitalstoragemedia(DSM).Inthiscase,thePazarci–Dipçinschemebecomestooex-pensiveandslow,sincethevideoshavetobeﬁrstdecoded,thenencrypted,andﬁnallyencodedagain.Notethatthereencodingmayreducethevideoquality,sincetheencoderisgenerallydifferentfromtheoriginalonethatproducedthevideosinthefactory.Apparently,thisdefectisanat-uralsideeffectofthemeritofthePazarci–Dipçinscheme.4)Theschemeisnotsecureenoughagainstbrute-forceat-tacks.Foragivencolorcomponent

ofany22SBstructure,onecanexhaustivelyguessthe-valuesofthefourSBstorecoverthe22SBstructure,byminimizingtheblockartifactsoccurringbetweenadjacentSBs.ForeachcolorcomponentofaSB,thevalueof

,andisdeterminedby,

soonecancalculatethatthesearchingcomplexityisonly

,whichissufﬁcientlysmallforPCs.1

OncethevalueofofanSBisobtained,onecanfurtherbreakthesecretkeyofthecorresponding-rule.Fortheexempliﬁed-rulegivenin[16,Eq.(3)],thesecretkeyconsistsoftheaddressesoftwoselectedsubblocks(ofsize

)ina22SBstructure,andabinaryshiftvalue

.Becausecanbeuniquelydeterminedfrom

,oneonlyneedstosearchotherpartofthekey,whichcorrespondstoacomplexityof

.When,thecomplexityis,and

whenwhenitis.Ap-parently,thekeyspaceisnotsufﬁcientlylargetoresistbrute-forceattacks,either.Inaddition,sincethevaluesofqualityfactorsandthesecretparameterscorrespondingtothethreecolorcomponentscanbeseparatelyguessed,thewholeattackcomplexityisonlythreetimesoftheabovevalues,whichisstilltoosmallfromacryptographicalpointofview[28].Althoughusingmultiplesecretkeysfordif-ferentSBscanincreasetheattackcomplexityexponen-tially,thekeysizewillbetoolongandthekey-managementwillbecomemorecomplicated.Here,notethatthe-ruleitselfshouldnotbeconsideredaspartofthekey,following

1Even

when󰀋2f0;...;100g,thesearchingcomplexityisonly(1012

2)󰀙2,whichisstillpracticallysmall.

thewell-knownKerckhoffs’principleinmoderncryptog-raphy[28].

5)Theschemeisnotsufﬁcientlysensitivetothemismatchofthesecretkey,sincetheencryptiontransformsandthe-rulegivenin[16]arebothlinearfunctions.Thismeansthatthesecurityagainstbrute-forceattackswillbefur-thercompromised,asanapproximatevalueofmaybeenoughtorecovermostvisualinformationintheplain-video.

6)Theschemeisnotsecureenoughagainstknown/chosen-plaintextattacks.Thisisbecausethevalueofcanbede-rivedapproximatelyfromthelinearrelationbetweentheplainpixel-valuesandthecipherpixel-valuesinthesame

SB.Similarly,thevalue

canbederivedfromthesignoftheslopeofthelinearmapbetweenand,andthevalueofcanbederivedfromthevaluerangeofthemap.Furthermore,assumingthattherearesecretparam-etersinthe-rule,ifmorethandifferentvaluesofaredeterminedasabove,itispossibletouniquelysolvetheapproximatevaluesofthesecretparameters.Tore-sistknown/chosen-plaintextattacks,thesecretkeyhastobechangedmorefrequentlythanthatsuggestedin[16](onekeyperprogram),whichwillincreasethecomputa-tionalburdenoftheservers(especiallythekey-manage-mentsystem).F.Wang–Yu–ZhengScheme

Adifferentschemeworkinginthediscretecosinetransform(DCT)domain(betweenDCTtransformandHuffmanentropycoding)wasproposedbyWang,Yu,andZhengin[17],whichcanbeusedasanalternativesolutiontoovercometheﬁrsttwoshortcomingsofthePazarci–Dipçinscheme.Bydividingall64DCTcoefﬁcientsofeach88blockinto16subbandsfol-lowingthedistancebetweeneachDCTcoefﬁcientandthedccoefﬁcient,thisnewschemeencryptsthethaccoefﬁcientinthethsubbandasfollows:

(2)

whereanddenotestheplainpixel-valueandthecipher

pixel-value,respectively,

isthecontrolfactor,istheroundingaveragevalueofallaccoefﬁcientsinthethsubband,

and

meanstheroundingfunctiontowardszero.Thedccoef-ﬁcientsareencryptedinadifferentway,as,

where

andisthesecondcontrolfactor.2Thevalueof

canalsobecalculatedinamorecomplicatedwaytoenhancetheencryptionperformance,following[17,Eqs.(5)

and(6)],wherethreenewparameters,

areintroducedtodeterminethevaluesof

forthethreecolorcomponents,Y,Cr,andCb.The16averagevalues,

,thetwocon-trolfactors,and,andthethreeextraparameters(ifused),

,altogetherserveasthesecretscramblingparame-ters(i.e.,thesecretkey)ofeachSB.Threedifferentwaysaresuggestedforthetransmissionofthesecretparameters:1)en-cryptingthemandtransmittingtheminthepayloadoftransport

2Note

thattheroundingfunctionismissedin[17,Eqs.(3)and(4)].Inaddi-tion,[17,Eq.(4)]shouldreadb=b6bC󰀌ac,notb=a6C󰀌.

LIetal.:PERCEPTUALMPEG-VIDEOENCRYPTIONALGORITHMSstream(TS);2)embeddingtheminthehigh-frequencyDCTco-efﬁcients;and3)calculatingthemfromthepreviousI-frameinawaysimilartothe-rulein[16].

Infact,theWang–Yu–Zhengschemeisjustanenhancedver-sionofthePazarci–Dipçinscheme,withoutamendingallshort-comingsofthelatterscheme.Precisely,thefollowingproblemsstillremain.

1)Thoughthereductionofthecompressionratioaboutmo-tioncompensationsisavoided,theencryptionwillchangethenaturaldistributionoftheDCTcoefﬁcientsandthusreducethecompressionefﬁciencyoftheHuffmanentropyencoder.Forexample,wheneachsubbandhasonlyonenonzerocoefﬁcient,itispossiblethatall64coefﬁcientsbecomenonzeroaftertheencryption.Thissigniﬁcantlyin-creasesthevideosize.Inaddition,ifthesecretparametersareembeddedintothehigh-frequencyDCTcoefﬁcientsfortransmission,thecompressionperformancewillbefurthercompromised.

2)Theschemeisstillnotsufﬁcientlysensitivetothemis-matchofthesecretparameters,sincetheencryptionfunc-tionandthecalculationfunctionof

arekeptlinear.Itisstillnotsufﬁcientlysecureagainstbrute-forceattackstothesecretparameters,becauseofthelimitedvaluesof

.Furthermore,duetothenonuniform

distributionoftheDCTcoefﬁcientsineachsubband,anattackerneedsnottorandomlysearchallpossiblevaluesof.

3)Thisschemeisstillinsecureagainstknown/chosen-plain-textattacksifthethirdwayisusedforcalculatingthesecretparameters.Inthiscase,ofeachSBcanbeeasilycal-culatedfromthepreviousI-frameoftheplain-video.Ad-ditionally,sincethevalueof

canbeobtainedfrom,thesecretparametercanbederivedapproxi-mately.Inasimilarway,thesecretparametercanalsobe

derivedapproximately.Ifiscalculatedwith

,thevaluesofcanbesolvedapproximatelywithanumberofknown/chosenaccoefﬁcientsinfourormoredifferentsubbands,sothatcanbefurtherderivedfromoneknown/chosendccoefﬁcient.

4)Themethodoftransmittingthesecretparametersinthepayloadofthetransportstreamcannotbeusedunderthefollowingconditions:1)thekey-managementsystemisnotavailable;and2)thevideoisnottransmittedwiththeTSformat.AtypicalexampleistheperceptualencryptionofMPEG-videoﬁlesinpersonalcomputers.III.MOREEFFICIENTDESIGNOFPERCEPTUALMPEG-VIDEO

ENCRYPTIONSCHEMESBasedontheanalysisgivenabove,weproposeasimplerde-signofperceptualencryptionforMPEGvideos,andattempttoovercometheproblemsinexistingschemes.Thefollowingusefulfeaturesaresupportedinournewdesign.

•Format-compliance:theencryptedvideocanstillbede-codedbyanystandard-compliantMPEGdecoder.Thisisabasicfeatureofallperceptualencryptionschemes.

•Losslessvisualquality:theencryptedvideohasthesamevisualqualityastheoriginalone,i.e.,theoriginalfull-

217

qualityvideocanbeexactlyrecoveredwhenthesecretkeyispresentedcorrectly.

•Strictsize-preservation:thesizeofeachdataelementinthelowestsyntaxlevel,suchasVLCs,ﬁxed-lengthcodewords(FLCs),andcontinuousstufﬁngbits,remainsunchangedafterencryption.Whenthevideostreamispacketizedinasystemstream(i.e.,PSorTS),thesizeofeachvideopacketremainsunchangedafterencryption.Thisenablesthefollowingusefulfeaturesinapplications:

•independenceofbitratetypes(VBRandFBR);

•avoidingsometime-consumingoperationswhenen-cryptingMPEG-compressedvideos:bitratecontrol,repacketizationofthesystemstreamandtheremulti-plexingofmultipleaudio/videostreams;

•on-the-ﬂyencryption:1)directencryptionofMPEG-compressedvideoﬁleswithoutcreatingtempo-raryﬁles,i.e.,onecanopenanMPEGvideoﬁle,readthebitstreamandsimultaneouslyupdate(encrypt)it;2)instantaneousswitchingencryptionon/offforonlinevideotransmission;

•ROI(regionofinterest)encryption:selectivelyen-cryptingpartialframes,slices,macroblocks,blocks,motionvectorsand/orDCTcoefﬁcientswithinspeciﬁcregionsofthevideo.

•IndependenceofoptionaldataelementsinMPEGvideos:theperceptibilityisnotobtainedbyencryptingop-tionaldataelements,suchasquantiser_matrixandcoded_block_pattern.3ThismeansthattheschemecanencryptanyMPEG-compliantvideoswithauniformperformance.

•Fastencryptionspeed:1)theextracomputationalloadaddedbytheencryptionismuchsmallerthanthecompu-tationalloadofatypicalMPEGencoder;2)MPEG-com-pressedvideoscanbequicklyencryptedwithoutbeingfullydecodedandreencoded(atleastthetime-consuminginverseDCT(IDCT)/DCToperationsareavoided).

•Easyimplementation:theencryption/decryptionpartscanbeeasilyincorporatedintothewholeMPEGsystem,withoutmajormodiﬁcationofthestructureofthecodec.•Multidimensionalperceptibility:thedegradationofvisualqualityiscontrolledbymultidimensionalfactors.

•Securityagainstknown/chosen-plaintextattacksisensuredbyfourdifferentmeasures.

Tothebestofourknowledge,someoftheabovefeatures(suchason-the-ﬂyencryption)haveneverbeendiscussedinthelit-eratureonvideoencryption,inspiteoftheirusefulnessinrealapplications.

Withtheabovefeatures,theperceptualencryptionschemebecomesmoreﬂexibletofulﬁlldifferentrequirementsofvar-iousapplications.Torealizethestrictsize-preservationfeature,theencryptionalgorithmhastobeincorporatedintotheMPEGencoder,i.e.,the(evenpartial)separationofthecipherandtheencoderisimpossible.Thisisaminordisadvantageinsomeap-plications.However,iftheredesignissufﬁcientlysimple,itisworthdoingsotogetabettertradeoffbetweentheoverallper-formanceandtheeasyimplementation.Inthecasethatthere-3Strictly

speaking,motionvectorsarealsooptionalelementsinMPEG

videos,sotheschemeshouldnotencryptonlymotionvectorsasdidin[15].

218IEEETRANSACTIONSONCIRCUITSANDSYSTEMSFORVIDEOTECHNOLOGY,VOL.17,NO.2,FEBRUARY2007

designoftheMPEGcodecisimpossible,forexample,ifthecodecissecuredbythevendor,asimpliﬁedMPEGcodeccanbedevelopedfortheembeddingoftheperceptualvideocipher.Sincethemosttime-consumingoperationsinanormalMPEGcodecincludingDCT/IDCTandpicturereconstruction,areex-cludedfromthesimpliﬁedMPEGcodec,fastencryptionspeedandlowimplementationcomplexityofthewholesystemcanstillbeachieved.

Inthefollowingtextofthissection,wedescribethedesignprinciplealongwithdifferentmethodsofprovidingsecurityagainstknown/chosen-plaintextattacks,anddiscussseveralim-plementationissues.A.NewDesign

ThisdesignisageneralizedversionofVEA[23]forpercep-tualencryption,byselectivelyencryptingFLCdataelementsinthevideostream.Apparently,encryptingFLCdataelementsisthemostnaturalandperhapsthesimplestwaytomaintainallneededfeatures,especiallytheneedforthestrictsize-preserva-tionfeature.TheproposedschemeisnamedPVEA.NotethatPVEAcanalsobeconsideredasanenhancedcombinationoftheencryptiontechniquesforJPEGimagesproposedin[9]and[10]andtheperceptualencryptionofmotionvectors[15].TherearethreemainreasonsforselectingonlyFLCdatael-ementsforencryption.

1)Asanalyzedbelow,allexistingVLCencryptionalgorithmscannotbedirectlyusedtoprovideacontrollabledegrada-tionofthequality.NewideashavetobedevelopedtoadoptVLCencryptioninperceptualencryptionschemes.

•VLCencryptionwithdifferentHuffmantables[23],[33]–[38]:SinceeachVLC-codewordisapairof(run,level),ifaVLC-codewordisdecodedtogetanincor-rect“run”value,thenthepositionofallthefollowingDCTcoefﬁcientswillbewrong.Asaresult,thevisualqualityofthedecodedblockwillbedegradedinanun-controllableway.Thus,itisdifﬁculttoﬁndafactortocontrolsuchvisualqualitydegradation.Moreover,iftheHuffmantablesdonotkeepthesizeofeachVLC-entryasdesignatedin[33]–[37],syntaxerrorsmayoccurwhenanunauthorizeduserdecodesanencryptedvideo.ThismeansthattheencryptioncannotensuretheformatcompliancetoanystandardMPEGcodecs.

•VLC-indexencryption[21],[22]:Thisencryptionschemecanensureformatcompliance,butstillsuffersfromtheuncontrollabilityofthevisualqualitydegrada-tionduetothesamereasonasabove.AnotherweaknessofVLC-indexencryptionisthatitmayinﬂuencethecompressionefﬁciencyandbringoverheadonvideosize.

•ShufﬂingVLC-codewordsorRLEeventsbeforetheentropyencodingstage[22],[39]:Thisalgorithmcanensureboththeformatcomplianceandthestrictsize-preservation.However,evenexchangingonlytwoVLC-codewordsmaycauseadramaticchangeoftheDCTcoefﬁcientsdistributionofeachblock.So,thisencryptionalgorithmcannotrealizeaslightdegrada-tionofthevisualqualityandfailstoserveasanidealcandidateforperceptualencryption.

2)ItisobviousthatFLCencryptionisthesimplestwaytoachieveallthedesiredpropertiesmentionedinthebegin-ningofthissection,especiallytoachieveformatcompli-ance,strictsize-preservationandfastencryptionsimulta-neously.Forexample,naiveencryption4canrealizestrictsize-preservationandfastencryption,butcannotensureformatcompliance.

3)Aswillbeseenbelow,usingFLCencryptionissufﬁcienttofulﬁlltheneedsofmostrealapplicationsforperceptualencryption.

AccordingtoMPEGstandards[24],[25],[27],thefollowingFLCdataelementsexistinanMPEG-videobitstream:•4-bytestartcodes:000001xx(hexadecimal);

•almostallinformationelementsinvariousheaders;•signbitsofnonzeroDCTcoefﬁcients;

•(differential)dccoefﬁcientsinintrablocks;•ESCAPEDCTcoefﬁcients;

•signbitsandresidualsofmotionvectors.

Tomaintaintheformat-compliancetotheMPEGstandardsaftertheencryption,theﬁrsttwokindsofdataelementsshouldnotbeencrypted.So,inPVEA,onlythelastfourFLCdataelementsareconsidered,whicharedividedintothreecategoriesaccordingtotheircontributionstothevisualquality:

•intradccoefﬁcients:correspondingtotheroughview(inthelevelof88block)ofthevideo;

•signbitsofnonintradccoefﬁcientsandaccoefﬁcients,andESCAPEDCTcoefﬁcients:correspondingtodetailsin88blocksofthevideo;

•signbitsandresidualsofmotionvectors:correspondingtothevisualqualityofthevideorelatedtothemotions(residualsfurthercorrespondstothedetailsofthemo-tions).

Basedontheabovedivision,threecontrolfactors,

,,andintherange[0,1],areusedtocontrolthevisualqualityinthreedifferentdimensions:thelow-resolutionrough(spatial)view,thehigh-resolution(spatial)details,andthe(temporal)motions.Withthethreecontrolfactors,theencryptionproce-dureofPVEAcanbedescribedasfollows:

1)encryptingintradccoefﬁcientswithprobability;

2)encryptingsignbitsofnonzeroDCTcoefﬁcients(exceptforintradccoefﬁcients)andESCAPEDCTcoefﬁcientswithprobability;

3)encryptingsignbitsandresidualsofmotionvectorswithprobability.

TheencryptionofselectedFLCdataelementscanbecarriedoutwitheitherastreamcipherorablockcipher.Whenablockcipherisadopted,theconsecutiveFLCdataelementsshouldbeﬁrstconcatenatedtogethertoformalongerbitstream,theneachblockofthebitstreamisencrypted,andﬁnallyeachencryptedFLCdataelementisplacedbackintoitsoriginalpositioninthevideostream.UndertheassumptionthatthestreamcipherorblockcipherembeddedinPVEAissecure,somespecialconsiderationsshouldbetakenintoaccountinordertoensurethesecurityagainstvariousattacks,asdiscussedbelow.

4In

theimage/videoencryptionliterature,theterm“naiveencryption”meanstoconsiderthevideoasa1-Dbitstreamandencryptitviaacommoncipher.

LIetal.:PERCEPTUALMPEG-VIDEOENCRYPTIONALGORITHMSIntheabove-describedPVEA,thethreefactorscontrolthevisualquality,asfollows:

•

:thespatialperceptibilitychangesfrom“al-mostimperceptible”to“perfectlyperceptible”whenorto“roughlyperceptible”when;

•

,:thespatialperceptibilitychangesfrom“roughlyperceptible”to“perfectlyperceptible”;

•

:thetemporal(motion)perceptibility(forP/B-picturesonly)changesfrom“almostimperceptible”to“perfectlyperceptible.”

Theencryptionmaybringtherecoveredmotionvectorsoutofthespatialrangeofthepicture,sothemotioncompensationop-erations(oreventheinvolvedpictureitself)maybesimplydis-cardedbytheMPEGdecoder.Inthiscase,thetemporal(mo-tion)perceptibilitywillbe“perfectlyimperceptible,”notjust“almostimperceptible.”

In[23,Appendix],itwasclaimedthatthedccoefﬁcientsofeachblockcanbeuniquelyderivedfromtheother63accoef-ﬁcients.Thismeansthattheperceptualencryptionofdccoef-ﬁcientsmustnotbeusedalone,i.e.,someaccoefﬁcientsmustalsobeencryptedtomaketheencryptionofthedccoefﬁcientssecure.Itwaslatelyobservedthatthisclaimisnotcorrect[40].Infact,thedccoefﬁcientofablockmeanstheaveragebright-nessoftheblock,andisindependentoftheother63accoefﬁ-cients.Thus,thedcencryptionandacencryptionofPVEAare

independentofeachother,i.e.,thetwocontrolfactors,

and,areindependentofeachother,andtheycanbefreelycom-binedinpractice.

B.SecurityAgainstCiphertext-OnlyAttacksandaConstraintoftheControlFactor

TheformatcomplianceofperceptualencryptionmakesitpossiblefortheattackertoguessthevaluesofallencryptedFLCdataelementsseparatelyinciphertext-onlyattacks.ThesimplestattackistotrytorecovermorevisualinformationbysettingalltheencryptedFLCdataelementstozeros.Thisiscallederror-concealment-basedattack(ECA)[22].Ourexper-imentalresultshaveshownthatPVEAissecureagainstsuchattack.Moredetailsaregiveninthenextsection.

ToguessthevalueofeachFLCdataelement,onecanalsoemploythelocalcorrelationexistingbetweenadjacentblocksineachframe.Thatis,onecansearchforasetofallencryptedFLCdataelementsineachframetoachievetheleastblockingartifact.Doessuchadeblockingattackwork?Nowletustrytogetalowerboundofthisattack’scomplexity,byassumingthatthenumberofallFLCdataelementsineachframeis,whichmeansthatthenumberofencryptedFLCdataelements

.Then,thecomplexityofthedeblockingattackwillnotbelessthan,sinceeachFLCdataelementshasatleasttwocandidatevalues.So,ifiscryptographicallylarge,thedeblockingattackwillnotcompromisethesecurityofPVEA.Asalowerboundofcorrespondingtoatypicalsecu-ritylevel,onecanget

byassuming.Formostconsumervideosthatneedtobeprotectedviapercep-tualencryption,

isgenerallymuchlargerthan100,sothisconstraintongenerallydoesnothavetoomuchinﬂuenceontheoverallperformanceofPVEA.Becausethecomplexity

219

ismuchover-estimated,5theconstraintcanbefurtherrelaxedin

practice.Forexample,when

,theaboveconditionsug-geststhat

.However,calculationsshowedthatisenoughtoensureacomplexitylargerthan

Sinceitisgenerallyimpracticaltocarryoutthedeblockingattackonthewholeframe,anothertwo-layerdeblockingattackmaybeadoptedbytheattacker:1)performingthedeblockingattackonsmallareasoftheframe;and2)forallcandidatesofthesesmallareas,performingthedeblockingattackonthearea-levelagain.Thoughthistwo-layerattackgenerallyhasamuchsmallercomplexitythanthesimpleattack,itsefﬁciencyisstilllimitedduetothefollowingreasons.

•Foreachsmallarea,thenumberofencryptedFLCele-mentsisgenerallynotequalto

,wheredenotesthetotalnumberofallFLCelementsinthearea.Thus,eventhisnumberhastobeexhaustivelyguessedandthenvali-datedbyconsideringthenumbersofotherareas(i.e.,thewholeframe).Theexistenceofthreeindependentqualityfactorsmakestheattackevenmorecomplicated.

•Forsmalleachareas,theprobabilitythattheleastde-blockingresultdoesnotcorrespondtotherealscenemaynotverysmall.Accordingly,theattackerhastomountamoreloosedeblockingattack,thusleadingtoahigherattackingcomplexity.

•Evenforthesmallestareaofsize1616,therearegen-erallymorethanonehundredFLCelements(i.e.,

),especiallywhentherearerichvisualinformationin-cludedinthearea.

•IfthenumberofFLCelementsinanareaisrelativelysmall,thisareagenerallycontainslesssigniﬁcantvisualinformation(suchasasmootharea).

•Thesmallereachareais,themorethenumberoffakeresultswillbe,andthenthemorethecomplexityofthesecondstagewillbe.

Ofcourse,withthetwo-layerdeblockingattack,theattackercanhaveachancetorecoveranumberofsmallareas,thoughhe/shegenerallycannotgetthewholeframe.Suchaminorsecurityproblemisanunavoidableresultoftheinherentformat-com-pliancepropertyoftheperceptualencryptionalgorithmsandrelatedtotheessentialdisadvantageofperceptualencryptionexertedonsomespecialMPEG-videos(seethediscussiononFig.5inthenextsection).

C.SecurityAgainstKnown/Chosen-PlaintextAttacksGenerallyspeaking,therearefourdifferentwaystoprovidesecurityagainstknown/chosen-plaintextattacks.Userscanse-lectonesolutionforaspeciﬁcapplication.

1)UsingaBlockCipher:Withablockcipher,itiseasytoprovidesecurityagainstknown/chosen-plaintextattacks.SincethelengthsofdifferentFLCdataelementsaredifferent,theblockciphermayhavetorunincipherfeedback(CFB)modewithvariable-lengthfeedbackbitstorealizetheencryp-tion.Notethat-biterrorpropagationexistsinblockciphers

5There

aretworeasonsabouttheover-estimation:1)theomissionof,

whichisverylargewhenN󰀝pNandpNisnotverysmall;2)someFLCelements(suchasintradccoefﬁcients)havemorethan2candidatevalues.

220IEEETRANSACTIONSONCIRCUITSANDSYSTEMSFORVIDEOTECHNOLOGY,VOL.17,NO.2,FEBRUARY2007

runningintheCFBmode[28],whereistheblocksizeofthecipher.ItisalsopossibletocascademultipleFLCdataelementstocomposean-bitblockforencryption,asinRVEA[23,Sec.7].ComparedtotheCFBmode,thelatterencryptionmodecanachieveafasterencryptionspeed(withalittlemoreimplementationcomplexityforbitcascading),sinceintheCFBmodeonlyoneelementcanbeencryptedineachrunoftheblockcipher.

2)UsingaStreamCipherWithPlaintext/CiphertextFeed-back:Afterencryptingeachplaindataelement,theplaintextortheciphertextissenttoperturbthestreamcipherfortheencryp-tionofthenextplaindataelement.Insuchaway,thekeystreamgeneratedbythestreamcipherbecomesdependentonthewholeplain-video,whichmakestheknown/chosen-plaintextattacksimpractical.Notethataninitialvectorisneededfortheencryp-tionoftheﬁrstplaindataelement.

3)UsingaKey-ManagementSystemandaStreamCipher:Whenakey-managementsystemisavailableinanapplication,theencryptionprocedureofPVEAcanberealizedwithastreamcipher.Toeffectivelyresistknown/chosen-plaintextattacks,thesecretkeyofthestreamciphershouldbefrequentlychangedbythekey-managementsystem.Inmostcases,itisenoughtochangeonekeyperpicture,orperGOP.Notethatthismea-sureneedsmorecomputationalloadwithhigherimplementa-tioncost,andissuitablemainlyforencryptingonlinevideos.4)UsingaStreamCipherWithUID:Whenkey-manage-mentsystemsarenotavailableinsomeapplications,auniqueID(UID)canbeusedtoprovidethesecurityagainstknown/chosen-plaintextattacksbyensuringthattheUIDsaredifferentfordifferentvideos.TheUIDofanMPEG-videocanbestoredintheuser_dataarea.ThesimplestformoftheUIDisthevendorIDplusthetimestampofthevideo.Itisalsopossibletodeter-minetheUIDofavideowithahashfunctionorasecurepseudo-randomnumbergenerator(PRNG).Inthiscase,theUIDsoftwodifferentvideosmaybeidentical,buttheprobabilityiscryp-tographicallysmalliftheUIDissufﬁcientlylong.TheUIDisusedtoinitializethestreamciphertogetherwiththesecretkey,whichensuresthatdifferentvideosareencryptedwithdif-ferentkeystreams.Thus,whenanattackersuccessfullygetsthekeystreamusedforknown/chosenvideos,hecannotusethebrokenkeystreamstobreakotherdifferentvideos.Ofcourse,theemployedstreamciphershouldbesecureagainstplaintextattacksinthesensethatthesecretkeycannotbederivedfromaknown/chosensegmentofthelongkeystreamthatencryptsthewholevideostream[28].D.ImplementationIssues

SincePVEAisageneralizationofVEA,itisobviousthatfastencryptionspeedcanbeeasilyachieved,asshownin[23].Inaddition,bycarefullyoptimizingtheimplementation,theen-cryptionspeedcanbefurtherincreased.WegivetwoexamplestoshowhowtooptimizetheimplementationofPVEAsoastoincreasetheencryptionspeed.

Atypicalwaytorealizetheprobabilisticqualitycontrolwithadecimalfactorisasfollows:generateapseudo-randomdec-imal,

,foreachdataelementwithauniformly-dis-tributedPRNG,andthenencryptthecurrentelementonlywhen

Fig.2.Encryptionresultsoftheﬁrstframein“Carphone.”(a)(p;p)=(0(d);0)(p:the;pplain)=frame.(0:2;(b)0).(p(e);(pp);p=)(0=;0:2)(0.:2(c);0:(2)p.(f);p(p)=;p(0);1)=.(0(1:;51);0.

:5).(g)(p;p)=(1;0).(h)(p;p)=(1;0:2).(i)(p;p)=

Fig.3.Encryptionresultsofthe313thframein“Carphone.”(a)((0p;0;;p0:5);p.(c))(p=;p(0;;p0;0)):=the(0plain;0;1)frame..

;(b)(p;p;p)=Fig.4.RecoveredresultsafterapplyingECAfortheﬁrstframein“Carphone.”(a)BreakingFig.2(c).(b)BreakingFig.2(i).

.Theaboveimplementationcanbemodiﬁedasfollowstofurtherincreasetheencryptionspeed:

1)pseudo-randomlyselect

integersfromtheset;

2)createabinaryarray

:iftheintegerisselected;otherwise,;3)encryptthethFLCdataelementonlywhen

LIetal.:PERCEPTUALMPEG-VIDEOENCRYPTIONALGORITHMS221

Fig.5.Encryptionresultsofthe169thframeinanMPEG-1video.(a)(p;p;p(c)(p;p;p)=(1;1;0).(d)(p;p;p)=(1;1;1).

)=(0;0;0):theplainframe.(b)(p;p;p)=(1;0;0).

Inthismodiﬁedimplementation,onlyamodulusadditionandalook-up-tableoperationareneededtodeterminewhetherthecurrentdataelementshouldbeencrypted.Asacomparison,inthetypicalimplementation,onerunofthePRNGisneededforeachdataelement,whichisgenerallymuchslower.Althoughbitsofextramemoryisneededtostorethearrayinthemodiﬁedimplementation,itismerelyatrivialproblemsincevideocodecgenerallyrequiresmuchmorememory.Toensurethesecurityagainstdeblockingattacks,inthemodiﬁedimplementationthevalueofshouldnotbetoosmall.6

TofurtherreducethecomputationalloadofPVEA,anotherwayistoselectivelyencryptpartialFLCdataelements.Twopossibleoptionsareasfollows:1)encryptonlyintrablocks;and2)encryptonlysignbits(orafewnumberofmostsignif-icantbits)ofintradccoefﬁcients,ESCAPEDCTcoefﬁcients,andresidualsofmotionvectors.Theabovetwooptionscanalsobecombinedtogether.Thiswillhaveverylittleeffectontheen-cryptionperformance,sinceanattackercanonlyrecovervideoframeswithapoorvisualqualityfromotherunencrypteddataelements[22],[41].

IV.ENCRYPTIONPERFORMANCEOFPVEA

SomeexperimentshavebeenconductedtotesttherealencryptionperformanceofPVEAforawidely-usedMPEG-1testvideo,“Carphone.”Theencryptionresultsofthe1stframe(I-type)areshowninFig.2,withdifferentvaluesofthetwo

6In

mostcases,itisenoughtosetN󰀕300.

controlfactorsand.Itcanbeseenthatthedegradationofthevisualqualityiseffectivelycontrolledbythetwofactors.

areTheencryptionresultsofthethirdcontrolfactor

giveninFig.3,wherethe313thframe(B-type)isselectedfordemonstration.Itcanbeseenthatencryptingonlythemotionvectorswillnotcausemuchdegradationinthevisualquality.OurexperimentshavealsoshownthatPVEAissecureagainsterror-concealmentbasedattacks.FortwoencryptedframesshowninFig.2,therecoveredimagesafterapplyingECAareshowninFig.4.InFig.4(a),thesignbitsofallaccoefﬁcientsaresettobezeros,andinFig.4(b)alldccoef-ﬁcientsarealsosettobezeros.Itcanbeseenthatthevisualqualityoftherecoveredimagesviasuchanattackisevenworsethanthequalityofthecipher-images,whichmeansthatECAcannothelpanattackergetmorevisualinformation.Actually,thesecurityofPVEAagainstECAdependsonthefactthatanattackercannottellencrypteddataelementsfromun-encryptedoneswithoutbreakingthekey.Asaresult,hehastosetallpossibledataelementstobeﬁxedvalues,whichisequivalenttoperceptualencryptionwiththecontrolfactor1,i.e.,thestrongestlevelofperceptualencryption.

Finally,itisworthmentioningthatPVEAhasaminordisad-vantagethatthedegradationinthevisualqualityisdependentontheamplitudesoftheintradccoefﬁcients.Asanextremeexample,consideranintrapicturewhosedccoefﬁcientsareallzeros,whichmeansthattheFLC-encodeddifferentialvalueofeachintradccoefﬁcientdoesnotoccurinthebitstream,i.e.,

occurs.Inthiscase,onlytheVLC-encoded

222IEEETRANSACTIONSONCIRCUITSANDSYSTEMSFORVIDEOTECHNOLOGY,VOL.17,NO.2,FEBRUARY2007

thecontroloftheroughvisualqualitybycompletelydisap-pears.Similarly,when

,theencryptioncanonlychangethedifferentialvaluefrom

to,sothedegradationwillnotbeverysigniﬁcant.Asaresult,thisproblemwillcausetheperceptibilityofsomeencryptedvideosbecome“partially

perceptible”when

(shouldbe“almostimperceptible”formostvideos).ForanMPEG-1video7withadarkbackground(i.e.,withmanyintradccoefﬁcientsofsmallamplitudes),theencryptionresultsareshowninFig.5.Fortunately,thisproblemisnotsoseriousinpractice,forthefollowingreasons:

•mostconsumervideoscontainsufﬁcientlymanyintradccoefﬁcientsoflargeamplitudes;

•evenwhentherearemanyzerointradccoefﬁcients,thecontentofthevideohastoberepresentedbyotherintradccoefﬁcientsofsufﬁcientlylargeamplitudes;

•thedifferentialencodingcanincreasethenumberofnonzerointradccoefﬁcients;

•thepartialdegradationcausedby

andthedegradationcausedby

andareenoughformostapplicationsofperceptualencryption(seeFigs.2and5).

FromthisminordisadvantageofPVEA,anaturalresultcanbeimmediatelyderived:fortheprotectionofMPEGvideosthatarehighlyconﬁdential,VLCdataelementsshouldalsobeen-crypted.Infact,ouradditionalexperimentsonvariousVEAshaveshownthatitmightbeimpossibletoeffectivelydegradethevisualqualityoftheMPEGvideoswithdarkbackgroundviaformat-compliantencryption,unlessthecompressionratioandthestrictsize-preservationfeaturearecompromised.Therelationsamongtheencryptionperformance,thecompressionratio,thesize-preservationfeature,andotherfeaturesofVEAs,areactuallymuchmorecomplicated.Theseproblemswillbeinvestigatedinourfutureresearch.

V.CONCLUSION

Thispaperfocusesontheproblemofhowtorealizepercep-tualencryptionofMPEGvideos.Basedonacomprehensivesurveyonrelatedworkandperformanceanalysisofsomeex-istingperceptualvideoencryptionschemes,wehaveproposedanewdesignwithmoreusefulfeatures,suchason-the-ﬂyen-cryptionandmultidimensionalperceptibility.Wehavealsodis-cusseditssecurityagainstdeblockingattackandpointedoutsomemeasuresagainstknown/chosen-plaintextattack.Thepro-posedperceptualencryptionschemecanalsobeextendedtorealizenonperceptualencryptionbysimplyaddingaVLC-en-cryptionpart.

REFERENCES

[1]W.Zeng,H.Yu,andC.-Y.Lin,MultimediaSecurityTechnologiesfor

DigitalRightsManagement.NewYork:Academic,2006.

[2]A.UhlandA.Pommer,ImageandVideoEncryption:FromDigital

RightsManagementtoSecuredPersonalCommunication.Boston,MA:SpringerScience+BusinessMedia,Inc.,2005,vol.15,AdvancesinInformationSecurity.

[3]B.Furht,E.Muharemagic,andD.E.Socek,Eds.,MultimediaEncryp-tionandWatermarking.NewYork:Springer,2005.7Source

ofthistestvideo:http://www5.in.tum.de/forschung/visualisierung/

duenne_gitter/DG_4.mpg.

[4]B.Furht,D.Socek,andA.M.Eskicioglu,“Fundamentalsofmulti-mediaencryptiontechniques,”inMultimediaSecurityHandbook,B.FurhtandD.Kirovski,Eds.BocaRaton,FL:CRCPress,2004,ch.3,pp.93–131.

[5]S.Li,G.Chen,andX.Zheng,“Chaos-basedencryptionfordigital

imagesandvideos,”inMultimediaSecurityHandbook,B.FurhtandD.Kirovski,Eds.BocaRaton,FL:CRCPress,2004,ch.4,pp.133–167.

[6]A.ServettiandJ.C.D.Martin,“Perception-basedselectiveencryp-tionofG.729speech,”inProc.IEEEICASSP’2002,2002,vol.1,pp.621–624.

[7]——,“Perception-basedpartialencryptionofcompressedspeech,”

IEEETrans.SpeechAudioProcess.,vol.10,no.8,pp.637–643,Aug.2002.

[8]A.TorrubiaandF.Mora,“PerceptualcryptographyonMPEGlayer

IIIbitstreams,”IEEETrans.Consum.Electron.,vol.48,no.4,pp.1046–1050,Apr.2002.

[9]M.V.DroogenbroeckandR.Benedett,“Techniquesforaselec-tiveencryptionofuncompressedandcompressedimages,”inProc.ACIVS’2002,pp.90–97.

[10]A.TorrubiaandF.Mora,“PerceptualcryptographyofJPEGcom-pressedimagesontheJFIFbitstreamdomain,”inProc.Dig.ICCE’2003,pp.58–59.

[11]S.Lian,J.Sun,andZ.Wang,“PerceptualcryptographyonSPIHTcom-pressedimagesorvideos,”inProc.IEEEICME’2004,pp.2195–2198.[12]——,“PerceptualcryptographyonJPEG2000compressedimagesor

videos,”inProc.Int.Conf.CIT’2004,pp.78–83.

[13]S.Lian,X.Wang,J.Sun,andZ.Wang,“Perceptualcryptographyon

wavelet-transformencodedvideos,”inProc.IEEEISIMP’2004,pp.57–60.

[14]J.DittmannandA.Steinmetz,“Enablingtechnologyforthetradingof

MPEG-encodedvideo,”inProc.ACISP’97,vol.1270,pp.314–324.[15]Y.Bodo,N.Laurent,andJ.-L.Dugelay,“Ascramblingmethodbased

ondisturbanceofmotionvector,”inProc.10thACMInt.Conf.Multi-media,2002,pp.89–90.

[16]M.PazarciandV.Dipçin,“AMPEG2-transparentscramblingtech-nique,”IEEETrans.Consum.Electron.,vol.48,no.2,pp.345–355,Feb.2002.

[17]C.Wang,H.-B.Yu,andM.Zheng,“ADCT-basedMPEG-2transparent

scramblingalgorithm,”IEEETrans.Consum.Electron.,vol.49,no.4,pp.1208–1213,Apr.2003.

[18]A.PommerandA.Uhl,“Selectiveencryptionofwaveletpacketsub-bandstructuresforobscuredtransmissionofvisualdata,”inProc.3rdIEEEBeneluxSPS’2002,pp.25–28.

[19]——,“Selectiveencryptionofwavelet-packetencodedimagedata:Ef-ﬁciencyandsecurity,”MultimediaSyst.,vol.9,no.3,pp.279–287,2003.

[20]A.Pommer,“Selectiveencryptionofwavelet-compressedvisualdata,”

Ph.D.dissertation,Dept.Sci.Comput.,Univ.Salzburg,Salzburg,Aus-tria,2003.

[21]J.Wen,M.Severa,W.Zeng,M.H.Luttrell,andW.Jin,“Aformat-compliantconﬁgurableencryptionframeworkforaccesscontrolofmultimedia,”inProc.IEEE4thWorkshopMMSP’2001,pp.435–440.[22]——,“Aformat-compliantconﬁgurableencryptionframeworkforac-cesscontrolofvideo,”IEEETrans.CircuitsSyst.VideoTechnol.,vol.12,no.6,pp.545–557,Jun.2002.

[23]B.Bhargava,C.Shi,andS.-Y.Wang,“MPEGvideoencryptionalgo-rithms,”MultimediaToolsAppl.,vol.24,no.1,pp.57–79,2004.

[24]InformationTechnology–GenericCodingofMovingPicturesandAs-sociatedAudioInformation:Video,ISO/IEC13818-2andITU-TRec.H.262(MPEG-2),2000.

[25]InformationTechnology–CodingofAudio-VisualObjects–Part2:

Visual,ISO/IEC14496-2(MPEG-4),2004.

[26]InformationTechnology–DigitalCompressionandCodingofCon-tinuous-ToneStillImages:RequirementsandGuidelines,ISO/IEC10918-1(JPEG),1994.

[27]InformationTechnology–CodingofMovingPicturesandAssociated

AudioForDigitalStorageMediaatuptoAbout1.5Mbit/s–Part2:Video,ISO/IEC11172-2(MPEG-1),1993.

[28]B.Schneier,AppliedCryptography–Protocols,Algorithms,andSouce

CodeinC,2nded.NewYork:Wiley,1996.

[29]J.-K.JanandY.-M.Tseng,“Onthesecurityofimageencryption

method,”Inf.Process.Lett.,vol.60,no.5,pp.261–265,1996.

[30]C.-C.ChangandT.-X.Yu,“Cryptanalysisofanencryptionschemefor

binaryimages,”PatternRecognit.Lett.,vol.23,no.14,pp.1847–1852,2002.

LIetal.:PERCEPTUALMPEG-VIDEOENCRYPTIONALGORITHMS[31]X.-Y.Zhao,G.Chen,D.Zhang,X.-H.Wang,andG.-C.Dong,“De-cryptionofpurepositionpermutationalgorithms,”J.ZhejiangUniv.SCIENCE,vol.5,no.7,pp.803–809,2004.

[32]S.Li,C.Li,G.Chen,D.Zhang,andN.G.Bourbakis,AGeneral

CryptanalysisofPermutation-OnlyMultimediaEncryptionAlgo-rithmsCryptologyePrintArchive,2004,Tech.Rep.2004/374.

[33]C.-P.WuandC.-C.J.Kuo,“Fastencryptionmethodsforaudiovisual

dataconﬁdentiality,”Proc,SPIEMultimediaSyst.Appl.III,vol.4209,pp.284–295,2001.

[34]C.-P.WuandC.-C.J.Kuo,“Efﬁcientmultimediaencryptionviaen-tropycodecdesign,”Proc.SPIESecurityWatermarkingMultimediaContentsIII,vol.4314,pp.128–138,2001.

[35]D.XieandC.-C.J.Kuo,“AnenhancedMHTencryptionschemefor

chosenplaintextattack,”Proc.SPIEInternetMultimediaManag.Syst.IV,vol.5242,pp.175–183,2003.

[36]C.-P.WuandC.-C.J.Kuo,“Designofintegratedmultimediacom-pressionandencryptionsystems,”IEEETrans.Multimedia,vol.7,pp.828–839,Jul.2005.

[37]M.S.KankanhalliandT.T.Guan,“Compressed-domainscrambler/

descramblerfordigitalvideo,”IEEETrans.Consum.Electron.,vol.48,no.2,pp.356–365,Feb.2002.

[38]C.ShiandB.Bhargava,“Light-weightMPEGvideoencryptionalgo-rithm,”inProc.Int.Conf.Multimedia,1998,pp.55–61.

[39]G.Liu,T.Ikenaga,S.Goto,andT.Baba,“Aselectivevideoencryp-tionschemeforMPEGcompressionstandard,”IEICETrans.Funda-mentals,vol.E89-A,no.1,pp.194–202,2006.

[40]S.LiandB.Bhargava,ANoteonMPEGVideoEncryptionAl-gorithms’2004[Online].Available:http://www.hooklee.com/Pa-pers/MMTA2004_note.pdf

[41]I.AgiandL.Gong,“AnempiricalstudyofsecureMPEGvideotrans-mission,”inProc.ISOCSNDSS’96,pp.137–144.

ShujunLireceivedtheB.S.degreeininformationscienceandengineeringandthePh.D.degreeininformationandcommunicationengineering,bothfromtheXianJiaotongUniversity,Xian,China,in1997and2003,respectively.

CurrentlyheisaPostdoctoralFellowwiththeDepartmentofElectronicandInformationEngi-neering,TheHongKongPolytechnicUniversity,HongKong.Hiscurrentresearchinterestsincludemultimediasecurity(mainlyimageandvideoen-cryption),chaoticcryptography,andsecurehuman-computeridentiﬁcation.

GuanrongChen(M’89–M’92–F’97)receivedtheM.Sc.degreeincomputersciencefromZhongshanUniversity,Zhongshan,China,andthePh.D.degreeinappliedmathematicsfromTexasA&MUniversity,CollegeStation.

CurrentlyheisaChairProfessorandtheFoundingDirectoroftheCentreforChaosandComplexNet-works,CityUniversityofHongKong.Hehas(co)au-thored15researchmonographsandadvancedtext-books,morethan400journalpapers,andabout200refereedconferencepapers,publishedsince1981in

theﬁeldsofnonlinearsystemdynamicsandcontrols.HeisHonoraryProfessoroftheCentralQueenslandUniversity,Australia,andofmorethantenuniversi-tiesinChina.

Dr.ChenisaFellowoftheIEEEforhisfundamentalcontributionstothetheoryandapplicationsofchaoscontrolandbifurcationanalysis.HehasservedorisservingasEditorforeightinternationaljournals,includingIEEETRANSACTIONSONCIRCUITSANDSYSTEMS,IEEETRANSACTIONSONAUTOMATICCONTROL,andInternationalJournalofBifurcationandChaos,andreceivedfourbestjournalpaperawardsinthepast.

223

AlbertCheung(M’95)teacheselectricalserviceen-gineeringattheBuildingandConstructionDepart-ment,CityUniversityofHongKong,HnigKong.Heworksonsustainableenergy,voiceandvideoencryption,andelectromechanicalapplications.

BharatBhargava(F’93)receivedtheB.E.degreefromtheIndianaInstituteofScienceandtheM.S.andPh.D.degreesinelectricalengineeringfromPurdueUniversity,WestLafayette,IN.

HeiscurrentlyaProfessorofcomputerscienceatPurdueUniversity.Hisresearchinvolvesmobilewirelessnetworks,hostauthenticationandkeyman-agement,secureroutinganddealingwithmalicioushosts,adaptabilitytoattacks,andexperimentalstudies.

Dr.BhargavahasbeenawardedtheCharterGold

CoreMemberdistinctionbytheIEEEComputerSocietyforhisdistinguishedserviceandreceivedanIEEEtechnicalachievementawardforthemajorimpactofhisdecadelongcontributionstothefoundationsofadaptabilityincommu-nicationanddistributedsystemsin1999.HeisafellowoftheIEEEComputerSociety.HisnamehasbeenincludedintheBookofGreatTeachersatPurdueandwasselectedbythestudentchapterofACMatPurduefortheBestTeacherAward.

Kwok-TungLo(M’92)wasborninHongKong.HereceivedtheM.Phil.andPh.D.degreesinelectronicengineeringfromtheChineseUniversityofHongKong,Hong,Kong,in1989and1992,respectively.Since1992,hehasbeenwiththeHongKongPolytechnicUniversity,HongKong,whereheisnowanAssociateProfessorattheDepartmentofElectronicandInformationEngineering.Heisveryactiveinresearchandhaspublishedover130papersinvariousinternationaljournalsandconferenceproceedings.Heisoneoftheauthorsofthebook

FundamentalsofImageCodingandWaveletCompression:Principles,Algo-rithmsandStandards(TsinghuaUniv.Press).HeiscurrentlyamemberoftheEditorialBoardofMultimediaToolsandApplicationsandanAssociateEditorofHKIETransactions.Hiscurrentresearchinterestsincludemultimediasignalprocessing,digitalwatermarking,multimediacommunicationsandInternetapplications.

因篇幅问题不能全部显示，请点此查看更多更全内容

查看全文

全部栏目

On the design of perceptual MPEG-video encryption algorithms