Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

From See to Shield: ML-Assisted Fine-Grained Access Control for Visual Data

Mete Harun Akcay, Buse Gul Atli, Siddharth Prakash Rao, Alexandros Bakas

TL;DR

This work tackles the problem of secure, fine-grained access control for visual data by integrating ML-based detection of privacy-sensitive regions (PSOs) with a cryptographic framework that enforces policies directly on the data. The proposed architecture combines four modules—AccessPolicy, Detection and Classification, Post-Correction, and CryptoCore—across a System Plane, User Plane, and Encrypted Data Repository to achieve selective encryption and policy-driven decryption. Key contributions include context-aware post-correction for textual and multimodal PSOs, a monotone policy design $P_\ell = a_1 \lor a_2 \lor \dots \lor a_r$, and a hybrid SKE-ABE scheme that enables a single ABE decryption per user to access all allowed symmetric keys. Experimental results on VISPR-Redactions show improvements in PSO detection metrics and sub-second decryption times, with linear storage overhead, demonstrating the approach’s practicality, scalability, and potential applicability to other data modalities.

Abstract

As the volume of stored data continues to grow, identifying and protecting sensitive information within large repositories becomes increasingly challenging, especially when shared with multiple users with different roles and permissions. This work presents a system architecture for trusted data sharing with policy-driven access control, enabling selective protection of sensitive regions while maintaining scalability. The proposed architecture integrates four core modules that combine automated detection of sensitive regions, post-correction, key management, and access control. Sensitive regions are secured using a hybrid scheme that employs symmetric encryption for efficiency and Attribute-Based Encryption for policy enforcement. The system supports efficient key distribution and isolates key storage to strengthen overall security. To demonstrate its applicability, we evaluate the system on visual datasets, where Privacy-Sensitive Objects in images are automatically detected, reassessed, and selectively encrypted prior to sharing in a data repository. Experimental results show that our system provides effective PSO detection, increases macro-averaged F1 score (5%) and mean Average Precision (10%), and maintains an average policy-enforced decryption time of less than 1 second per image. These results demonstrate the effectiveness, efficiency and scalability of our proposed solution for fine-grained access control.

From See to Shield: ML-Assisted Fine-Grained Access Control for Visual Data

TL;DR

This work tackles the problem of secure, fine-grained access control for visual data by integrating ML-based detection of privacy-sensitive regions (PSOs) with a cryptographic framework that enforces policies directly on the data. The proposed architecture combines four modules—AccessPolicy, Detection and Classification, Post-Correction, and CryptoCore—across a System Plane, User Plane, and Encrypted Data Repository to achieve selective encryption and policy-driven decryption. Key contributions include context-aware post-correction for textual and multimodal PSOs, a monotone policy design , and a hybrid SKE-ABE scheme that enables a single ABE decryption per user to access all allowed symmetric keys. Experimental results on VISPR-Redactions show improvements in PSO detection metrics and sub-second decryption times, with linear storage overhead, demonstrating the approach’s practicality, scalability, and potential applicability to other data modalities.

Abstract

As the volume of stored data continues to grow, identifying and protecting sensitive information within large repositories becomes increasingly challenging, especially when shared with multiple users with different roles and permissions. This work presents a system architecture for trusted data sharing with policy-driven access control, enabling selective protection of sensitive regions while maintaining scalability. The proposed architecture integrates four core modules that combine automated detection of sensitive regions, post-correction, key management, and access control. Sensitive regions are secured using a hybrid scheme that employs symmetric encryption for efficiency and Attribute-Based Encryption for policy enforcement. The system supports efficient key distribution and isolates key storage to strengthen overall security. To demonstrate its applicability, we evaluate the system on visual datasets, where Privacy-Sensitive Objects in images are automatically detected, reassessed, and selectively encrypted prior to sharing in a data repository. Experimental results show that our system provides effective PSO detection, increases macro-averaged F1 score (5%) and mean Average Precision (10%), and maintains an average policy-enforced decryption time of less than 1 second per image. These results demonstrate the effectiveness, efficiency and scalability of our proposed solution for fine-grained access control.
Paper Structure (25 sections, 6 equations, 4 figures, 6 tables)

This paper contains 25 sections, 6 equations, 4 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Object Detection, Segmentation & Character Recognition:
  4. Private Content & Privacy Risk Scoring in Visual Data:
  5. Secure Data Sharing and Access Control:
  6. Preliminaries
  7. Sensitivity Scores & Groups:
  8. Notation:
  9. Proposed Architecture
  10. AccessPolicy Module
  11. Key Generation:
  12. Policy Definition & Encryption Delegation:
  13. Detection and Classification Module
  14. Post-Correction Module
  15. CryptoCore Module
  16. ...and 10 more sections

Figures (4)

  • Figure 1: High-level system architecture illustrating three operational phases: (a) registration, (b) data encryption, and (c) data decryption. The system includes key actors (system administrator, data owners, and users) and four core modules (AccessPolicy, Detection, Post-Correction, and CryptoCore). Sensitive data provided by the owner is processed, labeled, and encrypted before storage. Users receive personalized decryption keys and can only access protected content if authorized by the embedded policy.
  • Figure 2: Sensitivity scores of available objects in the dataset and corresponding symmetric keys that can decrypt four different sensitivity groups.
  • Figure 3: Progressive decryption example under fine-grained access control. Privacy-sensitive objects are grouped into four sensitivity groups with predefined threshold values (see Table \ref{['tab:class_key_scores']}) Users holding higher-level ABE decryption keys can gain access to progressively more sensitive content, while unauthorized regions remain scrambled.
  • Figure 4: Per-image encryption time vs. total number of encrypted pixels (reported for 350 images randomly selected from the test set).

Theorems & Definitions (2)

  • Definition : Symmetric Key Encryption
  • Definition : Attribute-Based Encryption