TrustEYE.M4: Protecting the sensor - Not the camera

Images captured in camera networks are potentially privacy sensitive and therefore need protection. A critical aspect is where protection is applied – after transmission at the data center or preferably already on the camera. In this work we take on-camera protection a step further and propose to make privacy protection and security inherent features of the image sensing unit. Already within the camera we realize strong separation between components that have access to raw image data and those that do not need raw data access. Our approach is based on the custom-designed TrustEYE.M4 prototype of a secure sensing unit. We demonstrate the feasibility of sensor-level privacy protection with a cartoon-like effect based on mean shift filtering. 1. Motivation and Approach In home monitoring and assisted living applications cameras are deployed in private environments where captured data is highly privacy sensitive. This is addressed by integrating privacy protection techniques [2, 8], combined with IT-security features [3, 16, 19], directly into cameras. With our TrustEYE.M4 prototype [18] we contribute to the state of the art by moving privacy protection and security into the image sensing unit. We demonstrate the feasibility of this approach by applying real-time privacy protection via a cartoon-like effect at the sensor level. Furthermore, we advance the state of the art by addressing the following two major limitations of existing secure camera solutions: Implicitly trusted software components. Large software components of a camera such as the operating system, the network stack and system libraries are part of the implicitly trusted software base. Even with, e.g., secure boot which ensures that only genuine software is executed, it is impossible to guarantee the absence of, yet undisclosed, security flaws which can be exploited by attackers. It is therefore a ’best practice’ to reduce the amount trusted components as much as possible. Lack of separation. On-camera privacy protection and security measures are performed typically at the application level as part of the computer vision tasks. Consequentially, security and privacy protection are tightly interwoven with the application logic and they are left in the responsibility of application developers. Secure Sensing Unit Camera Host System