Efficient PRNU Matching in the Encrypted Domain ^†

Abstract

Photoresponse Non-Uniformity (PRNU) is becoming particularly relevant within digital media forensics, as a means to effectively determine the source camera of a given image. Most of the practical applications in digital media forensics involve dealing with highly sensitive data whose content must be protected. In this context, several secure frameworks have been proposed to perform PRNU-based camera attribution while preserving the privacy of both the testing images and the PRNU fingerprint. The two most recent and relevant ones, independently proposed in 2018, are (a) Mohanty et al.’s, who combine the use of a trusted environment (ARM TrustZone) to compute the PRNU fingerprint, with the Boneh-Goh-Nissim (BGN) cryptosystem to perform the matching, and (b) Pedrouzo-Ulloa et al.’s, who propose a more flexible solution which can be fully implemented on a general purpose architecture and does not require access to a trusted environment. In this work, we revisit the existing frameworks and propose a general formulation for PRNU matching based on lattice cryptosystems which improves on the BGN-based solution in terms of efficiency, flexibility and privacy.

1. Introduction

Photoresponse Non-Uniformity (PRNU) is a specific noise pattern inherent to digital imaging sensors [1]. It is becoming especially relevant in digital media forensics as, due to its random nature, can be used as a fingerprint of the underlying device.

In particular, PRNU has a great protential within image forensics, as it can help to determine whether a given image was taken by a certain camera [2]. Actually, several commercial applications are already able to identify acquisition devices, but they present two apparently contradictory needs:

• High Computational Demands: Outsourcing is an appealing solution for digital media forencis because the involved operations are computationally intensive and they must also deal with very large databases.
• Privacy issues: Forensic data is especially privacy-sensitive and it must be protected when outsourced. Actually, not only while outsourced, but it should be protected even when it is inside our own infrastructure to prevent non-authorized parties from accessing to the content.

In view of the above restrictions, several works have proposed solutions for the secure evaluation of PRNU-based camera attribution [3,4,5]: (1) In [3,4], Mohanty et al. combine the use of a trusted environment (ARM TrustZone) to compute the PRNU fingerprint, and the Boneh-Goh-Nissim (BGN) cryptosystem to perform the matching. (2) In [5], we proposed a more general formulation based on lattice cryptosystems. On the contrary to the previous method, our solution can be fully implemented on a general purpose arquitecture, and does not need to have access to a trusted environment because the involved images are encrypted along the whole computing chain.

Structure and Objectives: Our main objective in this work is to provide a brief overview of the existing secure schemes for PRNU-based camera attribution. With this in mind, we revisit the existing schemes and showcase how lattice-based cryptosystems are more convenient to perform the PRNU matching, improving the BGN-based solution in terms of efficiency, flexibility and privacy.

The structure is as follows: Section 2 describes the high-level structure of the two main existing secure approaches. Finally, Section 3 includes a discussion regarding the convenience of lattice-based cryptosystems for the case of PRNU matching, highlighting the flexibility of our solution.

2. Main Approaches

This section includes a high-level description of the two main methods for secure PRNU-based camera attribution: (a) Mohanty et al.’s scheme [3,4], and (b) our fully unattended solution from [5].

2.1. Previous Methods

In [3,4], Mohanty et al. describe their solution to securely compute the PRNU extraction/detection. It is composed of two main blocks:

• The Wavelet-based denoising is computed in a trusted environment (ARM TrustZone).
• The correlation test is homomorphically evaluated by means of the BGN cryptosystem.

The availability of a trusted environement enables to work very efficiently with the data in the clear. However, their use of the BGN cryptosystem introduces a high overhead (they report runtimes of $1.2$ ms for the encryption of one number). To mitigate this effect, they resort to a fingerprint digest by removing some values of the fingerprint. This icreases the efficiency but also worsens the performance.

2.2. Our Fully Unattended Solution

In [5], we proposed a fully unattended solution, based on RLWE (Ring Learning with Errors) cryptosystems [6], which is able to homomorphically evaluate the PRNU extraction/detection without the need of the intervention of the secret key owner in the middle of the process. To this aim, we resort to the pre-/post processing introduced in [7] and the homomorphic Wavelet-denoising proposed in [8].

A complete diagram of our proposed scheme in [5] is included in Figure 1. The main challenge is the homomorphic evaluation of the threshold operation inside the denoising block. This threshold operation is implemented by the use of the “lowest digita removal” polynomials introduced in [9,10].

We include some runtimes for the encrypted PRNU detection in

Table 1. Performance of Encrypted PRNU detection ( bit security $>128$ ).

Parallelization	8	16
Encryption + Pre-coding (s)	3.6
Decryption + Post-coding ($ms$)	27
Encrypted Detection ($min$)	$16.05$	$8.03$

. To obtain the given runtimes, images of size $2048\times 2048$ and a PRNU of 16 Mpixels were considered.

The obtained results (see [5] for a much more detailed analysis) are promising as for all the conducted experiments, a True Acceptace Rate (TAR) of at least $95\%$ was obtained for values of False Alarm Rate (FAR) above $0.5\%$.

3. A Discussion: Efficient Encrypted Matching

This work reviews the existing methods in the literature for secure camera attribution based on PRNU. Even though the Mohanty et al.’s scheme is evaluating most of the computation in the clear, their runtimes do not outperform the runtimes obtained with our fully unattended proposed solution in [5]. This fact highlights the versatibility of our scheme, which can be implemented in a more general arquitecture and does not need a trusted environment. Even so, if a trusted environement is available, we could make use of it to have important efficiency improvements on the scheme.

It is worth noting that the BGN scheme seems to add a high overhead in the Mohanty et al.’s solution. By making use of an RLWE-based cryptosystem combined with a pre-/post-coding [11], the correlation runtimes are improved, while also avoiding to have to discard values of the fingerprint.