Overview
ISO/IEC 19566-4:2020 - Information technologies - JPEG systems - Part 4: Privacy and security specifies privacy and security features for the JPEG system layer. The standard defines a generic, backwards‑compatible signalling syntax and box structures that can be applied across all JPEG box‑based file formats to enable content protection, selective replacement and the signalling of access policies. It builds on the JPEG universal metadata box format (JUMBF) and is intended to integrate with existing JPEG families (JPEG‑1, JPEG XT, JPEG 2000) and ISO base media file formats.
Key topics and technical requirements
- Content protection and replacement (Annex A - normative):
- Mechanisms for encrypting parts of an image file and for replacing protected content with alternative data.
- Support for partial image protection (e.g., regions of interest) by combining protection and replacement boxes.
- Implementations must be compliant with ISO/IEC 19566‑5 (JUMBF).
- JUMBF Protection box:
- A dedicated JUMBF box with Content Type “Protection” (UUID: 74B11BBF‑F21D‑4EEA‑98C1‑0BEBF23AEFD3).
- Contains a Protection Description box and a Binary Data box holding encrypted payloads.
- Protection Description box (type 'pspd' - 0x70737064):
- Signals the encryption method and parameters required to decrypt protected content.
- Decoders shall ignore protected content they cannot decrypt; when decrypted, replacement must yield a valid master image.
- Box‑based file format conventions:
- Standardized box header fields (LBox, TBox, XLBox) and payload conventions are defined for interoperability.
- Conformance language, naming conventions for numeric values and graphical box descriptions are specified.
- Backward compatibility and interoperability:
- The framework is designed to be compatible with existing JPEG standards and referenced normative documents (e.g., ISO/IEC 10918‑1, 18477‑3, 19566‑5).
Practical applications and who should use it
- Protecting sensitive image data and metadata (personally identifiable information, GPS/location, private regions) in social media, mobile capture and cloud storage.
- Selective encryption for regions of interest (ROI) or partial redaction in journalism, healthcare imaging, legal evidence and intelligence workflows.
- Implementers: JPEG encoder/decoder developers, file format architects, multimedia and mobile device manufacturers, cloud storage and social platforms, digital rights management (DRM) integrators, and security engineers building image processing pipelines.
Related standards (selection)
Keywords: ISO/IEC 19566‑4:2020, JPEG privacy and security, JUMBF Protection box, content protection, JPEG box‑based file formats, Protection Description box, partial image protection, JPEG systems.
