Privacy-preserving image distribution

1. A method of distributing customized privacy-preserving images to a plurality of users, the method comprising employing at least one hardware processor of a privacy management server to:

in response to receiving an encrypted source image decryptable with an administration key, perform an encrypted-domain image segmentation of the source image to produce a plurality of user-specific encrypted private images, wherein:

a selected private image comprises a region of the source image selected to show a private item of a selected user of the plurality of users,

another private image comprises another region of the source image selected to show a private item of another user of the plurality of users, and

wherein determining the selected private image comprises:

employing a pre-trained item detector to calculate a mask identifying the region of the source image showing the private item of the selected user, the mask calculated in the encrypted domain and decryptable with the administration key, and

determining the selected private image according to a pixel-wise multiplication of the encrypted source image and the mask;

in response to the image segmentation, perform an encrypted-domain key change procedure to produce a plurality of user-specific re-encrypted images, wherein:

a selected re-encrypted image comprises a result of transforming the selected private image from being decryptable with the administration key to being decryptable with a private key of the selected user, and

another re-encrypted image comprises a result of transforming the other private image from being decryptable with the administration key to being decryptable with a private key of the other user; and

transmit the plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to reconstruct user-specific plaintext versions of the source image.

2. The method of claim 1 , wherein:

performing the encrypted-domain image segmentation of the source image further comprises determining an encrypted public image comprising regions of the source image selected to show neither the private item of the selected user nor the private item of the other user;

wherein the method further comprises employing at least one hardware processor of the privacy management server to transmit the encrypted public image to the image distribution server for decryption and further distribution to client devices; and

wherein the client devices are configured to reconstruct user-specific plaintext versions of the source image further according to a decrypted public image received from the image distribution server.

3. The method of claim 1 , further comprising employing at least one hardware processor of the image distribution server to:

in response to receiving the selected re-encrypted image, select a device from a plurality of client devices according to whether the selected device is operated by the selected user; and

in response to selecting the client device, transmit the selected re-encrypted image to the selected device.

4. The method of claim 3 , further comprising employing at least one hardware processor of the image distribution server to:

in response to receiving the other re-encrypted image, select another device from the plurality of client devices according to whether the other device is operated by the other user; and

in response to selecting the other device, transmit the other re-encrypted image to the other device.

5. The method of claim 1 , wherein the encrypted source image is encrypted according to a homomorphic encryption scheme.

6. The method of claim 1 , wherein a plaintext version of the source image reconstructed by a client device operated by the selected user shows the private item of the selected user and obscures the private item of the other user.

7. The method of claim 1 , wherein the private item comprises an item selected from a group consisting of a person and a human face.

8. The method of claim 1 , wherein the private item comprises a bank card.

9. The method of claim 1 , wherein the private item comprises a trademark.

10. A computer system comprising a privacy management server configured to:

in response to receiving an encrypted source image decryptable with an administration key, perform an encrypted-domain image segmentation of the source image to produce a plurality of user-specific private images, wherein:

a selected private image comprises a region of the source image selected to show a private item of a selected user of the plurality of users,

another private image comprises another region of the source image selected to show a private item of another user of the plurality of users, and

wherein determining the selected private image comprises:

employing a pre-trained item detector to calculate a mask identifying the region of the source image showing the private item of the selected user, the mask calculated in the encrypted domain and decryptable with the administration key, and

determining the selected private image according to a pixel-wise multiplication of the encrypted source image and the mask;

in response to the image segmentation, perform an encrypted-domain key change procedure to produce a plurality of user-specific re-encrypted images, wherein:

a selected re-encrypted image comprises a result of transforming the selected private image from being decryptable with the administration key to being decryptable with a private key of the selected user, and

another re-encrypted image comprises a result of transforming the other private image from being decryptable with the administration key to being decryptable with a private key of the other user; and

transmit the plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to reconstruct user-specific plaintext versions of the source image.

11. The computer system of claim 10 , wherein:

performing the encrypted-domain image segmentation of the source image further comprises determining an encrypted public image comprising regions of the source image selected to show neither the private item of the selected user nor the private item of the other user;

wherein the privacy management server is further configured to transmit the encrypted public image to the image distribution server for decryption and further distribution to client devices; and

wherein the client devices are configured to reconstruct user-specific plaintext versions of the source image further according to a decrypted public image received from the image distribution server.

12. The computer system of claim 10 , further comprising the image distribution server and wherein the image distribution server is further configured to:

in response to receiving the selected re-encrypted private image, select a device from a plurality of client devices according to whether the selected device is operated by the selected user; and

in response to selecting the client device, transmit the selected re-encrypted private image to the selected device.

13. The computer system of claim 12 , wherein the image distribution server is further configured to:

in response to receiving the other re-encrypted private image, select another device from the plurality of client devices according to whether the other device is operated by the other user; and

in response to selecting the other device, transmit the other re-encrypted private image to the other device.

14. The computer system of claim 10 , wherein the encrypted source image is encrypted according to a homomorphic encryption scheme.

15. The computer system of claim 10 , wherein a plaintext version of the source image reconstructed by a client device operated by the selected user shows the private item of the selected user and obscures the private item of the other user.

16. The computer system of claim 10 , wherein the private item comprises an item selected from a group consisting of a person and a human face.

17. The computer system of claim 10 , wherein the private item comprises a bank card.

18. The computer system of claim 10 , wherein the private item comprises a trademark.

19. A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a privacy management server, cause the privacy management server to:

in response to receiving an encrypted source image decryptable with an administration key, perform an encrypted-domain image segmentation of the source image to produce a plurality of user-specific private images, wherein:

a selected private image comprises a region of the source image selected to show a private item of a selected user of the plurality of users,

another private image comprises another region of the source image selected to show a private item of another user of the plurality of users, and

wherein determining the selected private image comprises:

employing a pre-trained item detector to calculate a mask identifying the region of the source image showing the private item of the selected user, the mask calculated in the encrypted domain and decryptable with the administration key, and

determining the selected private image according to a pixel-wise multiplication of the encrypted source image and the mask;

in response to the image segmentation, perform an encrypted-domain key change procedure to produce a set of user-specific re-encrypted images, wherein:

a selected re-encrypted image comprises a result of transforming the selected private image from being decryptable with the administration key to being decryptable with a private key of the selected user, and

another re-encrypted image comprises a result of transforming the other private image from being decryptable with the administration key to being decryptable with a private key of the other user; and

transmit the plurality of user-specific re-encrypted images to an image distribution server for further distribution to client devices configured to reconstruct user-specific plaintext versions of the source image.