A Joint Digital Watermarking and Encryption Method
M. Cancellaroa , F. Battistia , M. Carlia , G. Boatob , F.G.B. De Nataleb , and A. Neria
b Dept.
a Applied
Electronics Dept.,Università degli Studi Roma TRE, Roma, Italy;
of Information Engineering and Computer Science, University of Trento, Trento, Italy
ABSTRACT
In this paper a joint watermarking and ciphering scheme for digital images is presented. Both operations are
performed on a key-dependent transform domain. The commutative property of the proposed method allows to
cipher a watermarked image without interfering with the embedded signal or to watermark an encrypted image
still allowing a perfect deciphering. Furthermore, the key dependence of the transform domain increases the
security of the overall system. Experimental results show the effectiveness of the proposed scheme.
Keywords: Encryption, watermarking, key-dependent domain, Tree Structured Haar Transform.
1. INTRODUCTION
Multimedia communications and information security are two active areas in both academia and industry. These
two separate worlds are expected to continue playing important roles in the information era. The trend shows
a fusion between them to allow a secure delivery of multimedia data. According to ITU-T, Rec. X.8001 and
IETF RFC 28282 , the security of data is pursued by assuring, among others: authentication, to verify the
identity claimed by or for any system entity; data confidentiality, to protect data against unauthorized disclosure;
data integrity, to verify that data have not been changed, destroyed, or lost in an authorized or accidental
manner. To satisfy these constraints several methods have been proposed in literature, such as watermarking
and cryptography.
Watermarking techniques are suitable for copyright protection: in this case the cover is the object of communication and the protection of its ownership is the goal of the hiding technique. On the other hand, cryptography
scrambles the messages so that they cannot be understood: it focuses on rendering information not intelligible
to any unauthorized entity who might intercept them. In this case, the data content is kept secret.
Actually, encrypted data need an additional level of protection in order to keep control on them after the
decryption phase. In fact, when the ciphered data is deciphered by the authorized user, it is unprotected and
it can be easily modified, tampered, or stolen. The scientific community started focusing on the possibility of
providing both security services simultaneously and therefore to have the chance of watermarking encrypted
data and detecting the watermark before and after decryption. This allows to work in the encrypted domain,
operating on ciphered data without giving access to the plain one and increasing the operation efficiency. Lian et
al.3 draw a detailed scenario concerning video encryption and video watermarking and proposes a new combined
approach, Bas et al.4 give an overview on the possible scenarios where the combination of both level of protection
can be exploited, while Merhav5 presents a theoretic analysis of this problem. In literature a commutative scheme
is presented by Lian et al.6 : the image is wavelet transformed and some subbands are ciphered while some others
are both ciphered (with sign encryption) and watermarked.
In this paper we propose a joint watermarking and encryption method that is based on a secret decomposition
of the image. The two procedures provide different levels of security as highlighted by Cox et al 7 . We propose
a method that allows to watermark encrypted data, or to encrypt watermarked data. Correspondingly, it will
be possible to detect the watermark into encrypted or decrypted data. The proposed method can be applied to
different scenarios thanks to the layered approach that allows to separately perform the operations of decryption
and detection. This can be useful in a scenario like the one presented in Figure 5 where only the receiver owns
the key to decrypt the data while the third party (i.e. authority) can verify the authenticity of the transmitted
data extracting the digital signature from it. Another scenario is depicted in Figure 8: the receiver can perform
Further author information: Send correspondence (michela.cancellaro, federica.battisti)@uniroma3.it
both the operations acting as the entity that utilizes the content (through the decryption procedure) and as the
verifying authority (through the watermark extraction).
We increase the security of the proposed method by using the Tree-Structured Haar transform (TSH)8 -9 , which
depends on a secret Discontinuity Point Vector (DPV) for the tree generation. In this domain we perform simultaneously the encryption with the Advanced Encryption Standard (AES)10 and the embedding via Quantization
Index Modulation (QIM) scheme11 .
The rest of this paper is organized as follows: in Section 2 the proposed strategy is presented, while in Section
3 some experimental results are reported. Finally, in Section 4 conclusions and future work are drawn.
2. THE PROPOSED APPROACH
In this section we address the problem of designing a complete watermarking scheme where cryptography and
watermarking are organized in a layered architecture as presented by Cox et al 7 . In particular, given an image
X, we use a function fW to hide the watermark W into X
XW = fW (X, W ) ,
(1)
XE = fC (X, ξ) ,
(2)
and a function fC to cipher the data
where ξ is the encryption key. fW and fC are jointly designed such that the watermarked and encrypted image
XW,E fulfill the following rule:
XW,E
=
=
fW (fC (X, ξ) , W )
fC (fW (X, W ) , ξ) .
(3)
The proposed scheme allows to obtain a commutative use of watermarking and encryption, therefore satisfying
eq. (3), by using a suitable bit-plane decomposition in a particular wavelet transform domain.
We exploit a generalization of the Haar transform, the Tree-Structured Haar transform (TSH), recently
developed in8 , which is based on nonuniform sampling of the support. In particular, the set of TSH functions
depends on a key called Discontinuity Point Vector (DPV)9 , that defines a binary tree in which each node
is associated to a space interval. Different DPVs define different subband decompositions of a signal. The
cardinality of the DPV is variable but it must be less than the size of the signal that has to be decomposed. In
the two-dimensional case, the size of the image represents the root of the tree and the image transformation by
rows is performed before the transformation by columns as in classical wavelet decomposition. In Figures 1, 2,
and 3 examples of three-level decompositions depending on different DPVs are shown. The selection of different
DPVs changes the subbands size. Therefore, the knowledge of the DPV becomes crucial for the security of the
method: without disclosing it, the decomposition of the image is kept secret. This transform has been used in
the past by the authors as a possible watermarking domain9 -12 .
2.1. Watermark embedding and encryption
In the following, the general scheme for the joint watermark insertion and encryption is presented. The overall
procedure can be summarized as follows (see Figure 4):
1. Given the original image X, let X be the third order TSH decomposition, computed according to a secret
DPV. It can be noticed that X is characterized by 10 subbands LL3 , LHj , HLj , HHj , where j = 1, 2, 3,
is the corresponding resolution level (see Figures 1(c), 2(c), 3(c)). Let the watermark W be a binary
pseudorandom matrix of the same size of the image. It is important to notice that robustness, perceptual
quality, and capacity constraints depend on the chosen watermarking method.
2. The coefficients of the transformed image X undergo to an analog to digital conversion in B bits. Let
the resulting matrices be the bit-planes BPl with l = 1, 2, ..., B. The least significant bit-plane BPB is
substituted by the binary matrix that contains the sign of the TSH coefficients.
(a) Original image
(b) Decomposed image
(c) Subbands decomposition
Figure 1. A three levels TSH transform of the image Lena. Fibonacci case.
(a) Original image
(b) Decomposed image
(c) Subbands decomposition
Figure 2. A three levels TSH transform of the image Lena with DPV=[230,504].
3. The N most significant bit-planes from BP1 to BPN are individually encrypted by using the AES. We
propose to use this block cipher since it is widely accepted and employed and no weaknesses have been
found to date. However, any other strong block cipher can be used for encryption. In the performed tests
we used 128-bit AES keys.
4. The (B −N −1) bit-planes from BPN +1 to BPB−1 are used for watermark insertion. The coefficients ci,j of
the gray-scale matrix resulting from the conversion binary-decimal of the considered planes are quantized
by using a QIM scheme13 :
c0i,j = ci,j + α · q
¶¾ µ
µ
¶¶
½
µ
Wi,j
Wi,j
+ ki,j
− ci,j − ∆ ·
+ ki,j
,
q = Q∆ ci,j − ∆ ·
D
D
(4)
where W is the TSH transform of the watermark W performed with the same DPV used to decompose the
cover image, ci,j is the coefficient to be modified, α is the strength of the watermark, Q∆ denotes scalar
uniform quantization with step size ∆, D is the cardinality of the alphabet that composes the watermark
(2 in our case), and ki,j ∈ [0, 1) is the watermark key.
5. The digital to analog conversion is performed and the inverse TSH is computed in order to obtain XW,E .
The proposed system is based on the encryption of those bit-planes that are not used for the embedding. So,
the order of embedding or ciphering is not relevant. We stress that the proposed method is compliant with the
(a) Original image
(b) Decomposed image
(c) Subbands decomposition
Figure 3. A three levels TSH transform of the image Lena with DPV=[27].
Figure 4. Commutative watermarking and encryption procedure.
commutative property, described in eq. (3) and that it is possible to detect the watermark without deciphering
the data, as well as to watermark encrypted ones. We also remark that in order to decrypt the bit-planes and
to detect the watermark it is necessary to know the DPV used in the TSH transform.
It is important to underline that the low intercorrelation among the non encrypted bit-planes does not allow a
non authorized user to recover significant information about the cover image.
2.2. Watermark extraction and decryption
The detection of the watermark and the decryption procedures are obtained by inverting the embedding and
encryption schemes as follows (Figure 5):
1. The third order TSH decomposition is performed on the received image XW,E according to the DPV
previously shared with the sender on a secure channel.
2. Each coefficient of the transformed image XW,E undergoes to an analog to digital conversion in B bits. Let
the resulting matrices be the bit-planes BPl with l = 1, 2, ..., B.
3. The N most significant bit-planes from BP1 to BPN are decrypted with AES by using the key specified in
the transmission stage.
4. The (B − N − 1) bit-planes from BPN +1 to BPB−1 used for watermark insertion are recomposed to obtain
a matrix with values in the range [0, 255]. The inverse QIM is performed on this matrix to recover the
inserted watermark W 0 according to the following formula:
00
00
ui,j = Q∆ {ci,j − ki,j ∆} − (ci,j − ki,j ∆)
(
0 if |ui,j | ≤ ∆/2
0
Wi,j =
,
1 if |ui,j | > ∆/2
(5)
where c00i,j is the coefficient supposed to contain the watermark. The knowledge of the watermark key ki,j
and of the quantization step ∆ are required. The inverse TSH transform of the extracted watermark W 0
is performed. Let us denote with W 0 the extracted watermark in the spatial domain.
5. The normalized correlation coefficient between the original watermark and the extracted one is computed
as follows:
¢¡
¢
PP¡
W − W W0 − W0
i j
ρ = rP P ¡
(6)
¢2 ¡
¢2 .
W −W
W0 − W0
i
j
where W and W 0 are the average values of W and W 0 .
Figure 5. Commutative extraction and decryption procedure.
We observe that ρ is bounded by −1 and +1. The greater its magnitude the more confident the detector
is about the existence of the watermark. The detection of the watermark is performed by thresholding the
normalized correlation coefficient; the threshold is set according to a predefined level of the probability of
false alarm following the Neyman Pearson criterion.
3. EXPERIMENTAL RESULTS
In the following some results are shown. The experimental tests have been performed on gray-scale images of
size 512x512 pixels in the range [0, 255]. The chosen DPV has been [120, 43] and it has been performed an analog
to digital conversion with B=12 bits. The QIM parameters used in our tests have been α = 1, ∆ = 30, k = 0.5;
these have been selected as the best trade-off between invisibility, capacity, and robustness. In this section the
results for the image Lena are presented.
In Figure 6, the images after the embedding and encryption process are depicted.
(a) Original image
(b) Watermarked-encrypted image
Figure 6. Original and watermarked-encrypted image.
Several tests have been carried out in order to evaluate the effectiveness of the proposed approach. First,
we considered the effect of the encryption procedure fC on the perceived quality of the image. The number
of bit-planes involved in the watermarking and ciphering procedures have been systematically varied. The goal
was to find the optimum combination denying the access to the content of the image to non authorized users,
while reducing the computational complexity of the whole operation. As shown in Figure 7, by increasing the
number of bit-planes involved in the encryption procedure, the image becomes less intelligible. We have executed
the tests on a set of images and the correlation between the original and encrypted image has been computed.
Results show that the encryption of the three most significant bit-planes (N = 3 as shown in Figure 6(b)) allows
to obtain the best trade-off between the lowest correlation values and the number of bit-planes to be encrypted.
In order to evaluate the invisibility and the robustness of the watermarking technique fW , different attacks
have been executed on the watermarked image XW obtained according to the procedure depicted in Figure 8.
The Peak Signal to Noise Ratio (PSNR) and the Weighted Peak Signal to Noise Ratio (WPSNR) have been
computed to prove the invisibility of the watermark as:
µ
P SN R(db) = 10 log10
L2
M SE
¶
,
(7)
where L is the peak value of the input signal and MSE is the Mean Squared Error between the original and the
modified data;
µ
¶
max(F )2
W P SN R(db) = 10 log10
,
(8)
||N V F (F 0 − F )||2
where F and F’ represent the two images that are compared and NVF is the Noise Visibility Function whose
value is 1 in flat regions and zero in textured regions and edges14 .
The obtained values for the watermarked image when no attacks are performed are PSNR=40 dB and
WPSNR=45 dB.
The effectiveness of the method has been evaluated by performing the extraction of the watermark and the
decryption of the image with different DPVs. Figure 9(a) shows the detector response when 500 random DPVs
are used to decompose the image in order to extract the watermark; the peak corresponds to the DPV used by
the sender in the first stage of the transmission. In Figure 9 (b) an example of deciphered image with a random
DPV is shown.
(a) Encryption of BP1
(d) Encryption of BP1 and BP2
(b) Encryption of BP2
(e) Encryption of BP1 and BP3
(c) Encryption of BP3
(f) Encryption of BP2 and BP3
Figure 7. Obtained images by encryption of different bit-planes.
Figure 8. Reconstruction of the watermarked image.
Figure 10 shows the detector response when 500 random watermarks are presented to the detector and no
attacks are performed is shown. The peak corresponds to the original embedded watermark.
The following attacks have also been considered:
• Gaussian: addition to XW,E white Gaussian noise of mean 0 and variance 0.005.
• Sharpening: application of a 3-by-3 contrast enhancement filter.
1
0.9
0.8
Correlation value
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
0
50
100
150
200
250
300
Random DPVs
350
400
450
500
(a) Detector response computed with 500
different DPVs
(b) Deciphered image computed by performing a different decomposition of the
received image
Figure 9. Experimental results obtained by using different DPVs.
1
0.9
0.8
Correlation value
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
0
50
100
150
200
250
300
Random watermarks
350
400
450
500
Figure 10. Detector response when 500 random watermarks are presented.
• Motion: approximation of the linear motion of a camera by 5 pixels, with an angle of 10 degrees in a
counterclockwise direction through a 2D filter.
• Blurring: using a circular averaging filter within the square matrix of size=5.
The results are summarized in Table 1.
Attack
Gaussian
Sharpening
Motion
Blurring
Embedded watermark
Second highest peak
0.2
0.2186
0.3584
0.25
0.0059
0.0054
0.0064
0.0064
Table 1. Simulation results.
The watermarked images were compressed using the JPEG standard with increasing quality factors from 0 to
100 with step 10. The detector has been tested with 500 random watermarks and Figure 11 shows the first and
the second highest correlation peaks. The experimental results prove that the original watermark (star marked
line) can always be extracted.
The robustness of the proposed techniques against geometric manipulations, e.g. cropping or rotation has also
1
Embedded
Second highest
0.9
0.8
Correlation value
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
10
20
30
40
50
60
Quality factor
70
80
90
100
Figure 11. JPEG robustness test: first and second highest correlation peaks when 500 random watermarks are presented
at the detector.
1
Embedded
Second highest
0.9
0.8
Correlation value
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
50x50
100x100
200x200
300x300
Cropped area
400x400
500x500
Figure 12. Cropping robustness test: first and second highest correlation peaks when 500 random watermarks are
presented at the detector.
been analyzed. In the cropping attack, the watermarked image, of size 512x512 pixels, has been cropped to
different sizes. Six different cropping dimensions have been considered, from 50x50 pixels to 500x500 pixels.
Figure 12 shows the first and the second highest detector responses when 500 random watermarks are tested for
presence; it is always possible to recognize the original watermark.
The rotation attack has been performed using a bilinear interpolation. In this manipulation, the watermarked
image has been rotated in counterclockwise direction around its center point of a number of degrees increasing
from 0 to 90 degrees with step 10. As for the cropping attack, the detector response has been tested with 500
1
0.9
Embedded
Second highest
0.8
Correlation value
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
0
10
20
30
40
50
60
Rotation angle (degree)
70
80
90
Figure 13. Rotation robustness test: plot of the response of the correlation based detector to the embedded watermark
and of the second highest peak of the detector response corresponding to different rotation angles. 500 random watermarks
tested.
random watermarks. The experimental results are shown in Figure 13: it is possible to verify that the detector
is always able to recognize the original watermark.
4. CONCLUSIONS
In this work we have presented a joint watermarking and encryption system, based on a layered scheme and on a
key dependent transform domain. The proposed method grants the authenticity of the transmitted data, thanks
to the watermarking technique, and the privacy, obtained through the encryption procedure. The security system
is extremely flexible since the decryption and the watermark extraction can be performed simultaneously or in
different stages. Experimental tests have shown the effectiveness of the proposed method with respect to some
of the most common image processing procedures. Moreover the presented method shows an increased level of
security due to the use of the TSH. In fact, as shown in Section 3, if an attacker tries to use different DPVs from
the one utilized in the transmission step,it is impossible to recover the hidden information.
REFERENCES
1. ITU-T, “Rec. x.800 security architecture for open systems interconnection,” 1991.
2. R. Shirey, “Internet security glossary,” RFC 2828, GTE/BBN Technologies , May 2000.
3. S. Lian, Z. Liu, Z. Ren, and H. Wang, “Commutative encryption and watermarking in video compression,”
IEEE Transactions on Circuits and Systems for Video Technology 17, June 2007.
4. P. Bas and S. K. et al., “First summary report on hybrid systems,” European Project IST-2002-507932,
ECRYPT - Network of Excellence in Cryptology, Deliverable D.WVL.5 , 2005.
5. N. Merhav, “On joint coding for watermarking and encryption,” IEEE Transactions on Information Theory
52, January 2006.
6. S. Lian, Z. Liu, and H. Wang, “Commutative watermarking and encryption for media data,” Optical Engineering Letters 45, August 2006.
7. I.J.Cox, G. Döerr, and T.Furon, “Watermarking is not cryptography,” 5th Int. Workshop on Digital Watermarking (IWDW) , Nov 2006.
8. K. Egiazarian and J. Astola, “Tree-structured haar transform,” Journal of Mathematical Imaging and Vision, Kluwer Academic Publishers 16, May 2002.
9. M. Cancellaro, M. Carli, K. Egiazarian, and J. Astola, “Perceptual data hiding in tree structured haar
transform domain,” Proc. SPIE Security, Steganography, and Watermarking of Multimedia Contents IX,
San Jose, California, USA , February 2007.
10. J. Deamon and V. Rijmen, “The Design of Rijndael. AES - The Advanced Encryption Standard,” Springer
- Verlag , 2002.
11. B. Chen and G. Wornell, “Quantization index modulation: A class of provably good methods for digital
watermarking and information embedding,” IEEE Transactions on Information Theory 47, May 2001.
12. M. Cancellaro, M. Carli, A. Neri, and K. Egiazarian, “A robust data hiding scheme in tree-structured haar
transform,” Proc. International Workshop on Spectral Methods and Multirate Signal Processing (SMMSP
2006), Firenze, Italy , September 2006.
13. J. Eggers, R. Buml, R. Tzschoppe, and B. Girod, “Scalar costa scheme for information embedding,” IEEE
Transaction on signal processing 51, April 2003.
14. A. Watson, G. Yang, J. Solomon, and J. Villasenor, “Visibility of wavelet quantization noise,” IEEE Trans.
on Image Processing 6, August 1997.