From http://api.rubyonrails.org/classes/ActionController/Parameters.html
PERMITTED_SCALAR_TYPES = [ String, Symbol, NilClass, Numeric, TrueClass, FalseClass, Date, Time, StringIO, IO, ActionDispatch::Http::UploadedFile, Rack::Test::UploadedFile]
So you just need to permit it as a scalar type:
params.require(:photo).permit(:image)
Just tested on Rails 4.1.1