A METHOD FOR SELECTIVE DISCLOSURE AND REDACTION OF SENSITIVE REGIONS IN AERIAL IMAGERY WHILE PRESERVING SIGNATURE VERIFIABILITY
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1435Keywords:
data integrity, provenance, Merkle tree, redactable signatures, selective disclosure, anonymisation, UAV, aerial imagery, geographic information systems, C2PAAbstract
UAV imagery documenting damage to civilian infrastructure must remain verifiable by any party, yet regions whose disclosure creates risks must be removed before publication; a monolithic file signature does not allow this, because any pixel change breaks it. The proposed method transfers the known Merkle-tree redactable-signature construction to a tiled georeferenced raster: the georeference is part of the signed header, the hidden region is represented by a minimal subtree cover, expansion policies deliberately enlarge the hidden set to make the position of the requested region harder to determine, and the original signature remains valid for the redacted version without the signer's involvement. Measurements used synthetic rasters and exhaustive enumeration of placements on grids from 8×8 to 64×64 tiles. For 3×3, 3×4 and 4×5 rectangles the Morton order yields fewer cover nodes than row-major order in 100 % of placements with a median ratio of 1.20–1.33; for width 2 and for rotated shapes the advantage is incomplete. For a single tile on an 8×8 grid the normalised structural leakage indicator over the set of compatible positions decreases from 1.0 to 0.17 with subtree hiding at 48 % excess area and to 0.47 with decoy regions at 12.5 % (for the randomised policies these values are conditional on the implemented inversion procedure; probabilistic leakage was not assessed). For a 2×3 rectangle, quantising the number of tiles with step q ≤ 8 mostly does not hide the position (it is unique in 83–100 % of placement–secret pairs over all 42 placements, with q = 16 in 17 %), and the median of 0.52 for 4×4 block alignment and subtree hiding at levels 3 and 4 conceals a worst case of 0.81. For 256 tiles the tree package is smaller than a signed list of all hashes by 7894–8194 bytes, and smaller than a list of the hidden tiles' hashes only when a cover node holds on average more than about 1.2 hidden tiles, e.g. for all studied rectangles at least three tiles wide; for isolated tiles it is larger by 4–7 bytes per tile. All 1589 instances of 26 validation test classes gave the predicted result; throughput was not measured, and validation on real imagery is left for further research.
Downloads
References
Yang, Z., Xu, Y., Song, H., & Yu, K. (2025). Data-driven structural damage monitoring and assessment based on unmanned aerial vehicle images: A survey. International Journal of Digital Earth, 18(1), 2528617. https://doi.org/10.1080/17538947.2025.2528617
Office of the High Commissioner for Human Rights, & Human Rights Center, UC Berkeley School of Law. (2022). Berkeley Protocol on digital open source investigations: A practical guide on the effective use of digital open source information in investigating violations of international criminal, human rights and humanitarian law (HR/PUB/20/2). United Nations. ISBN 978-92-1-154233-2
Coalition for Content Provenance and Authenticity. (2026). Content Credentials: C2PA technical specification (Version 2.4). https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html
ISO/IEC. (2021). Information security — Redaction of authentic data — Part 1: General (ISO/IEC 23264-1:2021). https://www.iso.org/standard/78341.html
ISO/IEC. (2024). Information security — Redaction of authentic data — Part 2: Redactable signature schemes based on asymmetric mechanisms (ISO/IEC 23264-2:2024). https://www.iso.org/standard/78342.html
Johnson, R., Molnar, D., Song, D., & Wagner, D. (2002). Homomorphic signature schemes. In Topics in Cryptology — CT-RSA 2002 (LNCS, Vol. 2271, pp. 244–262). Springer. https://doi.org/10.1007/3-540-45760-7_17
Merkle, R. C. (1988). A digital signature based on a conventional encryption function. In Advances in Cryptology — CRYPTO '87 (LNCS, Vol. 293, pp. 369–378). Springer. https://doi.org/10.1007/3-540-48184-2_32
Goldreich, O., Goldwasser, S., & Micali, S. (1986). How to construct random functions. Journal of the ACM, 33(4), 792–807. https://doi.org/10.1145/6490.6503
Haber, S., Hatano, Y., Honda, Y., Horne, W., Miyazaki, K., Sander, T., Tezoku, S., & Yao, D. (2008). Efficient signature schemes supporting redaction, pseudonymization, and data deidentification. In Proceedings of the 2008 ACM Symposium on Information, Computer and Communications Security (ASIACCS '08) (pp. 353–362). ACM. https://doi.org/10.1145/1368310.1368362
Steinfeld, R., Bull, L., & Zheng, Y. (2002). Content extraction signatures. In Information Security and Cryptology — ICISC 2001 (LNCS, Vol. 2288, pp. 285–304). Springer. https://doi.org/10.1007/3-540-45861-1_22
Brzuska, C., Busch, H., Dagdelen, Ö., Fischlin, M., Franz, M., Katzenbeisser, S., Manulis, M., Onete, C., Peter, A., Poettering, B., & Schröder, D. (2010). Redactable signatures for tree-structured data: Definitions and constructions. In Applied Cryptography and Network Security (ACNS 2010) (LNCS, Vol. 6123, pp. 87–104). Springer. https://doi.org/10.1007/978-3-642-13708-2_6
Kundu, A., Atallah, M. J., & Bertino, E. (2012). Leakage-free redactable signatures. In Proceedings of the Second ACM Conference on Data and Application Security and Privacy (CODASPY '12) (pp. 307–316). ACM. https://doi.org/10.1145/2133601.2133639
Derler, D., Pöhls, H. C., Samelin, K., & Slamanig, D. (2016). A general framework for redactable signatures and new constructions. In Information Security and Cryptology — ICISC 2015 (LNCS, Vol. 9558, pp. 3–19). Springer. https://doi.org/10.1007/978-3-319-30840-1_1
Hirose, S., & Kuwakado, H. (2013). Redactable signature scheme for tree-structured data based on Merkle tree. In Proceedings of the 10th International Conference on Security and Cryptography (SECRYPT 2013) (pp. 313–320). SciTePress. https://doi.org/10.5220/0004507003130320
Johnson, R., Walsh, L., & Lamb, M. (2012). Homomorphic signatures for digital photographs. In Financial Cryptography and Data Security (FC 2011) (LNCS, Vol. 7035, pp. 141–157). Springer. https://doi.org/10.1007/978-3-642-27576-0_12
Naveh, A., & Tromer, E. (2016). PhotoProof: Cryptographic image authentication for any set of permissible transformations. In 2016 IEEE Symposium on Security and Privacy (SP) (pp. 255–271). IEEE. https://doi.org/10.1109/SP.2016.23
Ko, H., Lee, I., Lee, S., Kim, J., & Oh, H. (2021). Efficient verifiable image redacting based on zk-SNARKs. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security (ASIA CCS '21) (pp. 213–226). ACM. https://doi.org/10.1145/3433210.3453110
Marinho, J., Schiller, E., Debauge, A., & Foukia, N. (2025). ZK-Disclosure: Privacy-preserving information disclosure for digital evidence with C2PA and zk-SNARKs. In 2025 Annual Computer Security Applications Conference Workshops (ACSAC Workshops) (pp. 309–315). IEEE. https://doi.org/10.1109/ACSACW69556.2025.00040
Awan, M., & Collomosse, J. (2026). Soft redaction of image provenance via zero-knowledge proofs (arXiv:2608.07063). arXiv. https://arxiv.org/abs/2608.07063
Datta, T., Chen, B., & Boneh, D. (2025). VerITAS: Verifying image transformations at scale. In 2025 IEEE Symposium on Security and Privacy (SP) (pp. 4606–4623). IEEE. https://doi.org/10.1109/SP61157.2025.00097
Della Monica, P., Visconti, I., Vitaletti, A., & Zecchini, M. (2025). Trust Nobody: Privacy-preserving proofs for edited photos with your laptop. In 2025 IEEE Symposium on Security and Privacy (SP) (pp. 4624–4642). IEEE. https://doi.org/10.1109/SP61157.2025.00014
Gruteser, M., & Grunwald, D. (2003). Anonymous usage of location-based services through spatial and temporal cloaking. In Proceedings of the 1st International Conference on Mobile Systems, Applications and Services (MobiSys 2003) (pp. 31–42). ACM. https://doi.org/10.1145/1066116.1189037
Kalnis, P., Ghinita, G., Mouratidis, K., & Papadias, D. (2007). Preventing location-based identity inference in anonymous spatial queries. IEEE Transactions on Knowledge and Data Engineering, 19(12), 1719–1733. https://doi.org/10.1109/TKDE.2007.190662
Kido, H., Yanagisawa, Y., & Satoh, T. (2005). An anonymous communication technique using dummies for location-based services. In Proceedings of the International Conference on Pervasive Services (ICPS '05) (pp. 88–97). IEEE. https://doi.org/10.1109/PERSER.2005.1506394
Chow, C.-Y., & Mokbel, M. F. (2007). Enabling private continuous queries for revealed user locations. In Advances in Spatial and Temporal Databases (SSTD 2007) (LNCS, Vol. 4605, pp. 258–275). Springer. https://doi.org/10.1007/978-3-540-73540-3_15
Smith, G. (2009). On the foundations of quantitative information flow. In Foundations of Software Science and Computational Structures (FoSSaCS 2009) (LNCS, Vol. 5504, pp. 288–302). Springer. https://doi.org/10.1007/978-3-642-00596-1_21
Krawczyk, H., & Eronen, P. (2010). HMAC-based extract-and-expand key derivation function (HKDF) (RFC 5869). IETF. https://doi.org/10.17487/RFC5869
Bormann, C., & Hoffman, P. (2020). Concise binary object representation (CBOR) (RFC 8949). IETF. https://doi.org/10.17487/RFC8949
Moon, B., Jagadish, H. V., Faloutsos, C., & Saltz, J. H. (2001). Analysis of the clustering properties of the Hilbert space-filling curve. IEEE Transactions on Knowledge and Data Engineering, 13(1), 124–141. https://doi.org/10.1109/69.908985
Fett, D., Yasuda, K., & Campbell, B. (2025). Selective disclosure for JSON Web Tokens (RFC 9901). IETF. https://doi.org/10.17487/RFC9901
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Андрій Нижник, Денис Ханін
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
