New tool promises private photo sharing

In the next five minutes, roughly a half-million photos will be shared online.

Embarrassing or not, many are only intended for a certain audience - family, or friends maybe - not the whole world. And yet, relatively few will be encrypted, leaving them vulnerable to simple data harvesting.

A photo of P3 collaborator Moo-Ryong Ra before (left) and after (right) encryption using P3. Even at the lowest level of encryption available, the photo is an unrecognisable gray block with only trace elements of the original visble upon close inspection. Image courtesy of Moo-Ryong Ra. Higher resolution image available upon request.

Thanks to a new tool developed by a research team at University of Southern Californa, that could all be about to change. The team has developed a way to encrypt a crucial portion of the photo to keep it secure, while leaving enough unencrypted that it can still be utilized by cloud filesharing services

The tool, dubbed "P3" for "Privacy-Preserving Photo Sharing" removes small amounts of crucial data from a photo and encrypts them, allowing cloud file-sharing services like Facebook and Flickr to have only the unencrypted - but now unrecognizable - portion. The photo's owner can then choose to share the encrypted portion with other parties-allowing them to see the whole picture - without ever uploading it to the cloud.

If the whole photo is encrypted, Facebook and Flickr cannot resize it, making the photo unusable. However, with P3 such cloud file-sharing services can use the unencrypted portions of the photo (which are degraded beyond recognition) to resize it for viewing on multiple devices like laptops, tablets and phones by those who also receive the encrypted portion.

The tool is the brainchild of Antonio Ortega and Ramesh Govindan, both professors at the USC Viterbi School of Engineering. They collaborated with USC PhD student Moo-Ryong Ra on the project, and will present their new tool at the USENIX Symposium on Networked Systems and Design Implementation in Chicago on April 5.

"Nobody doubts the convenience of cloud-based sharing, the question is whether we can trust third parties to protect our photos from unauthorised distribution or use," Ortega said. "With P3 you decide how your photos can be used, without losing the convenience of sharing them on through the cloud."

In addition to ensuring privacy, the tool also allows the photo's owner to retain the rights to the photo. When you upload a photo to Facebook, for example, its Statement of Rights and Responsibilities indicates that it has a non-exclusive license to use that photo until you delete your account (provided that the photo hasn't already been shared with another person whose account is still active).

With P3, Facebook still retains the rights to the portion of the photo that you've uploaded – but that portion is a degraded, unrecognisable mess. Only you retain the rights to the complete photo.

P3 is already protected under a provisional patent, and Ortega and Govindan plan to launch a company this summer to market it to the public.

This research was funded by U.S. National Science Foundation, grant CNS-1048824.