# Facial Privacy Protection with Dynamic Multi-User Access Control for Online Photo Platforms
## 4 Proposed System
### System Workflow
#### 4.2.4 Key Splitting for Shared Access  
After encrypting the facial regions in an image \(I\), [PERSON] can selectively share the image with others, such as [PERSON], by granting access to the encrypted facial data. To initiate this shared access mechanism, [PERSON] submits a request to [PERSON] for permission to view the protected regions. [PERSON] can then approve or reject the request. Upon approval, [PERSON] is granted access to the encrypted facial regions in the image. This process is illustrated in Figure 5.  
The access-granting process begins when [PERSON] sends an access request to [PERSON] via the server. This request includes the image identifier \(a\), which uniquely identifies the image. Upon receiving and validating the request, the server identifies that the user with identifier \(ID_{\text{bob}}\) is requesting access to the image and notifies [PERSON] of the pending request.  
If [PERSON] rejects the request, she submits a request to the server to deny access, and no further action is taken by the server except for deleting the request. If [PERSON] approves the request, she submits a follow-up request to the server to initiate the key-splitting process. This request contains the image identifier \(a\), [PERSON]'s password \(pwd_{\text{alice}}\), and [PERSON]'s user identifier \(ID_{\text{bob}}\). The server validates [PERSON]'s request and forwards it to the CSP for processing.  
Upon receiving the server's request, the CSP retrieves the encrypted symmetric key \(K_{a}^{\text{enc}}\), the salt generated for [PERSON] \(salt_{\text{alice}}\), [PERSON]'s encrypted private key \(ssl_{\text{alice}}^{\text{enc}}\), and [PERSON]'s public key \(pk_{\text{bob}}\) from its storage. Since \(ssl_{\text{alice}}^{\text{enc}}\) is encrypted, the CSP decrypts it using a key derived from [PERSON]'s password \(pwd_{\text{alice}}\) and \(salt_{\text{alice}}\), yielding \(sk_{\text{alice}}\). This private key is then used to decrypt \(K_{a}^{\text{enc}}\), resulting in the original symmetric key \(K_{a}\), which is required to reveal the facial data in the image.  
Once the symmetric key \(K_{a}\) is obtained, the CSP splits it into two shares: one for [PERSON] \(q_{(\text{alice},a)}\) and one for [PERSON] \(q_{(\text{bob},a)}\)--using [PERSON]'s secret sharing scheme, denoted as \(\mathbf{SPLIT}(K_{a})\). These shares are then encrypted using [PERSON]'s public key \(pk_{\text{bob}}\), ensuring that only [PERSON] can decrypt and recombine them. As [PERSON]'s public key is available in plaintext, this process does not require his direct involvement to provide credentials during key splitting. Finally, the encrypted shares are stored and can be accessed by [PERSON] when he submits a subsequent request to the server to perform decryption of the facial regions, as described in the next section.  
If [PERSON] later decides to revoke [PERSON]'s access to the facial data, she can submit a revocation request to the server. Upon verifying [PERSON]'s identity and her ownership rights to the image, the server forwards the request to the CSP. The CSP then deletes [PERSON]'s share \(q_{(\text{alice},a)}\) of the key for image \(a\) from its key storage. Since both shares, \(q_{(\text{alice},a)}\) and \(q_{(\text{bob},a)}\), are required for the consumer to decrypt the facial data in image \(a\), removing [PERSON]'s share \(q_{(\text{alice},a)}\) automatically renders [PERSON]'s share \(q_{(\text{bob},a)}\) invalid. This revocation  
Figure 5: Key splitting process for shared access. This figure illustrates the process by which [PERSON] splits the symmetric key of a shared image into two shares: one for herself and one for [PERSON], the image consumer.  
mechanism ensures that [PERSON] retains full control over access to the facial data in her shared images, even after initially granting permission.