0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
Joint Wavelet Compression and Authentication Watermarking Liehua Xie and Gonzalo R. Arce Department of Electrical and Computer Engineering University of Delaware Newark, DE 19711, U.S. e-mail:
[email protected],
[email protected]
ABSTRACT
A blind watermarking technique embedding a digital image signature for authentication is developed. The signature algorithm is rst implemented in the discrete wavelet transform (DWT) domain and is later coupled within the SPIHT compression algorithm. The capacity of the watermarking method is determined by the upper bound on the attainable information bit rate that can be hidden in the image using two methods: binary engraving and multi-bit engraving.
1 Introduction
With the advent of multimedia communications over the internet, it is critical to provide security mechanisms in the transmission of imagery data. It has been proposed in [1] that digital signatures based on public key cryptography can be used to authenticate digital images. In [2], it is pointed out that a content digital signature can be implemented by watermarking an image. Most watermark schemes proposed to date serve the purpose of copyright protection. They have desirable characteristics like transparency and robustness, however, they require a-priori knowledge at the decoder in order to extract and verify the embedded signal. Watermarking for image authentication di ers from copyright protection watermarking in two aspects:
We extend our prior work on digital image signatures [3, 4]. In particular, we include a method to increase the capacity, and we develop bounds for the attainable bit rate capacity. The coupling between watermarking and compression is considered in detail.
2 Etching Signatures In The Wavelet Domain
We rst present the algorithm in the wavelet domain without compression. In Section 3, the watermarking algorithm is integrated within the SPIHT codec [5].
2.1 Etching Algorithm
First, a \soft" message digest of the image that captures the \strong" image features is generated. Edge maps or \robust" bit maps of the image can be used as message digests. In most cases, the message digest is encrypted for assured security. To assure robustness, the message digest's bit sequence is etched into the low-frequency band of the wavelet image representation. The etching algorithm is illustrated in Fig. 1 and is described next. b (2) is modified
The binary watermark b 1b 2b
3
(i,j-1)(i,j)(i,j+1)
A nonlinear operation: change Median
b 1 b 2 b ’3 (i,j-1)(i,j)(i,j+1)
First, the embedded signals must carry information to verify the integrity of an image.
Secondly, the decoder of image authentication is
blind in that the decoder doesn't know the original data.
This
work was supported in part by the National Science Foundation under the grant CDA-9703088, by Dupont, and through collaborative participation in the Advanced Telecommunications and Information Distribution Research Program (ATIRP) Consortium sponsored by the U.S. Army Research Laboratory under the Federated Laboratory Program, Cooperative Agreement DAAL01-96-2-0002.
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
Figure 1: The watermark engraving structure. We slide a non-overlapping 31 running window through the entire low frequency band of the wavelet decomposed image. At each location, a watermark bit is etched. Elements within the window are denoted as b1 , b2, b3 , which are the coecients' value at locations with coordinates (i , 1; j ), (i; j ), (i + 1; j ). The corresponding rank-ordered coecients are denoted as
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
b(1) b(2) b(3) . We then perform a nonlinear transformation algorithm (see Section 2.2), changing the median of these coecients while keeping the remaining coecients the same. Denote the modi ed median by b0(2) , which is obtained by the transformation,
b0(2) = f ( ; b(1) ; b(3); x);
(1)
where x is the watermark bit to be etched. At the receiver, watermark extraction is an inverted etching process. A 31 window is shifted through the received image. And a sequence with elements: B(1) , B(2) and B(3) is obtained. The watermarked bit associated with the window at each location is extracted as:
x = arg x2min j B(2) , f ( ; b(1) ; b(3) ; x) j : (2) (0;1) where x is the possible value of the watermark sample and B(1) = b(1) , B(3) = b(3) . The need of the original image to retrieve the signature is removed since the invariance of rank-ordering is utilized to memorize the hidden information bit. Shifting the decoding window throughout the entire watermarked image, the entire embedded watermark sequence is retrieved. The received image is then hashed using the same hash as that used to sign the original image. Authentication is performed by comparing it with the message digest carried by the watermark.
2.2 Rank-Order Based Transformation
Here, we brie y introduce the nonlinear transformation in (1). A detailed description is available in our previous work [3, 4]. The proposed scheme is able to engrave the signature data into a large number of images while preserving their image quality. Basically, the transformation changes the median of a local area to a value set by its neighbors. Given the coecients b1, b2 , b3 and the corresponding order statistics b(1) , b(2) , b(3) , we de ne:
S =
jb j + jb j ; 2 (1)
(3)
where is a tuning parameter with its default value of 0.05. It should be noted that in [3, 4] S was de ned as b +2 b . The modi cation greatly increases the bit rate as we will show in Section 3.2. Next, the range of the coecients (b(1) , b(3) ) is partitioned into M intervals, each interval of length S . The boundary of the partitions are denoted as `0 , `1 , , `M , with `0 = b(1) , `1 = b(1) + S , , `M = b(3) , with M being the smallest integer for which (1)
(3)
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
b (1)
b (1) + S α
l0
l1
x=1
x=0 x=0 b (2) l k
l k-1
x=1
b (2)
b (3) lM
l k+1
(a) Binary Bit Engraving 11 11
00
10
00
01
l k-1
q
01
b (2)
lk
10
b (2)
l k+1
(b) Mutliple Bit Engravaing
Figure 2: A comparison of binary and multi-bit engraving methods (a) Binary engraving method (b) Muti-bit engraving method.
MS > b(3) , b(1) . De ne the region in the interval [`k,1 ; `k ) as Rk , then b(2) is transformed into b0(2) as: A b0(2) = ``k case k,1 case B; where 4 case A = fk is odd and x = 1, or k is even and x = 0g 4 fk is even and x = 1, or k is odd and x = 0g case B = where x is the bit of the watermark being inserted in the location of the window. In part (a) of Fig. 2, for instance, k is assumed odd.
3 Digital Signatures In A Wavelet Compression Scheme
We argue that higher eciency can be attained if the watermarking and compression algorithms are jointly considered with the underlying assumption that compression is inevitably used during transmission. The signature engraving must be embedded within the particular compression scheme adopted by the protocol. Here, we adopt the SPIHT compression algorithm [5].
3.1 The SPIHT Algorithm
In essence the SPIHT algorithm aims to keep large coecients (quantized) and throw away small coecients in the DWT transform domain. The coecients are ordered by magnitude and the most signi cant bits are transmitted rst. A signi cance test is used to decide whether the coecient is to be coded or discarded at the current bit level. A coecient ci;j is considered signi cant if jci;j j 2n ; where n is the bit level. n = n0 , n0 , 1, , m, where n0 is the highest bit level, n0 = blog2max(i;j)2I (jci;j j)c and m is the last bit level at the end of the coding when the requested compression ratio is met. The coding algorithm uses a tree-structured indexing in order to exploit the pyramid decomposition. In
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
particular, the concept of parent-child dependencies is used. We de ne the brothers of a coecient as those coecients having the same parent as that coecient does. Denote the coecient at coordinate (i; j ) as ci;j 4 the brothers of c . We notice that, in the and Bi;j = i;j coding algorithm, the brother set Bi;j is treated as an indivisible group, which is made up by 2 2 adjacent pixels. Hence, in our algorithm within the compression framework, rather than sliding a non-overlapping 31 window, we slide a non overlapping 22 window through the Bi;j sets.
3.2 Signature Engraving
At the encoder, the SPIHT algorithm algorithm is executed rst. To insert the watermark, the 22 nonoverlapping window is scanned through all the brother sets where at least three coecients survive quantization. We sort the three coecients with the largest absolute value and get the order-statistics b(1) , b(2), b(3) in ascending order. A test is performed on each set Bi;j to decide whether or not a watermark bit can be inserted. We de ne: b(3) , b(1) 2m W (Bi;j ) = 10;; ifotherwise (3) ; where W (Bi;j ) indicates if watermark engraving in the local window Bi;j is admissible. m is the last bit level used by the codec to determine the signi cance of the coecients. For those Bi;j that satisfy W (Bi;j ) = 1, we apply the watermarking method. Hence, a local area is considered signi cant for watermarking if the image data in the area contains a margin larger than the compression quantization threshold. Note that the watermarking locations are now distributed in all bands and are determined by the local characteristic of the underlying image.
3.3 Multi-bit Engraving
In general, the engraved signature is represented by binary data such that one bit at a time is engraved where admissible. The watermark capacity, however, can be greatly increased if we engrave as many bits as we can in each window location. This is possible if the range b(3) , b(2) in (3) is signi cantly larger than the threshold 2m . Recall that information is hidden in a local area where the coecient range overcomes the quantization constant q = 2m . When b(3) , b(1) q, we perform watermarking by partitioning the range (b(3) , b(1)) into intervals of length S and by modifying b(2) according to the watermark sample. However, when S is several times larger than q, the engraving process is re ned by splitting S into smaller segments. Formerly, we inserted two watermark values only: 0 and 1. Now if the
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
distance is twice as large as that of the quantization constant, a 3-ary symbol (0, 1, or 2) can be inserted. This approach is called \multiple bit engraving". Part (b) of Fig. 2 depicts the concept behind multibit engraving where the size of the partition used in binary engraving is 3q. Two bits of information can be hidden in this case. As we can see, multiple bit engraving is similar in principle to the binary approach.
4 Information Bit Rate
The bit rate of the watermark (measured in bits per pixel) indicates the amount of information that can be embedded within an image, which is particularly important for content based signatures since the length of the binary data representing the signature is often large.
4.1 Information Capacity for Multi-bit Engraving
In [4], we proved that the information capacity for multi-bit engraving scheme is bounded by the rate given by Shannon's channel capacity theorem, where a di erent interpretation of noise is used. According to Shannon's results [6]:
C W log2 (1 + NS );
(4)
where C is the channel bit rate, S is the signal power, N is the power of the Gaussian noise and W is bandwidth. The principle Shannon used to derive the upper limit is that two symbols modulated at the sender in a communication channel must have a noise margin in order to get the correct decision at the receiver. In our signal and distortion model, the compressed image is approximated as a continuous, band-limited channel. We regard the compressed image I as the signal and the quantization truncation as the source of noise. Let's assume the image I , has a power S and the quantization constant is q where q = 2m . We note that a watermark bit can be inserted if and only if the range of (b(3) , b(1) ), i.e. the distance of the two signals, is large enough to overcome the quantization. By exploiting the similarity between watermarking and signal detection in a communication channel, we derive that the maximum information bit rate using our engraving scheme is equal to the maximum bit rate of a communication channel with the same signal power S , the same bandwidth W , and Gaussian noise power N = q2 . The following evolves directly from Shannon's theorem: Theorem 4.1 [4]: The information bit rate we can engrave in an image is bounded by (5) B W log S + N ; 2
N
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
where B is the information bit rate, S is the image power, N = q2 , and W is the bandwidth.
4.2 Information Capacity for Binary Engraving
The derived upper bound of the bit rate corresponds to the multi-bit engraving method, by which the distance between two signals is fully exploited. Next, we will consider the binary engraving case. In the coding scheme, the coecients sent may be truncated at two di erent quantization thresholds, q and 2q, because of the incomplete scan of the last bit level. Only at some \ideal" compression ratio, the quantization threshold is \complete" in the sense that all coecients are truncated by the same threshold and all coecients which are no less than 2m are sent. A sequence q(i) (i = 0 to k) is de ned to describe the quantization constants we are interested in. q(i) = 2k ,i where k0 is an integer usually less than n0 . An example of q(i) is: 64, 32, 16, 8, 4, 2, 1. We use a sequence c(i) (i = 0 to k) to denote the \ideal" compression ratios corresponding to each q(i). The bit rate for the compression ratios other than c(i) is bounded by the bit rates of the two c(i)s closest to it. We also de ne the sequences B (i) and b(i) to be the bit rate with compression ratios c(i) using multi-bit engraving and binary engraving respectively. We derive an approximate relation between the bit rate sequence of multi-bit and binary engraving. The approximate equivalence is indicated by the symbol O(:). Theorem 4.2: The bit rate of binary engraving is related to the bit rate of multiple bit engraving by: 0
O(b(i + 1)) = O(B (i + 1)) , O(B (i)); O(B (i + 1)) = O(b(i + 1)) + O(b(i)):
(6)
(7) Proof: At c(i), we index all the signi cant areas by m, m = 1, , b(i) and name them Am . We also de ne the sequence dm = jb j+2 jb j ( m = 1 to b(i)) for each Am . Let Gi = fA1 ; A2 ; ; Ab(i) g. Note that dm must be larger or equal than q(i). The number of bits we can engrave by the multibit engraving method is: (3)
B (i) =
b(i) X m=1
(1)
log2 (1 + b qd(mi) c);
(8)
where the function bc is the lowest integer truncating \ oor" function. Similarly at i + 1,
B (i + 1) =
b(X i+1) m=1
log2 (1 + b q(id+m 1) c):
0-8186-8821-1/98 $10.00 Copyright 1998 IEEE
(9)
And Gi+1 = fA1 ; ; Ab(i) ; Ab(i)+1 ; Ab(i+1) g where Ab(i)+1 ; ; Ab(i+1) are the new admitted areas. It can be seen that Gi Gi+1 . De ne Gi+1ji such that Gi+1 = Gi [ Gi+1ji and Gi \ Gi+1ji = ; so Gi+1ji = fAb(i)+1 ; ; Ab(i+1) g. It follows that B (i +1) is equal to: b(i) X
b(X i+1) d m log2 (1+b q(i + 1) c)+ log2 (1+b q(id+m 1) c): m=1 m=b(i)+1
(10) Since q(i) = 2q(i + 1), B (i + 1) , B (i) is equal to, b(X i+1) m c 1 + b q(di+1) + log2 (1 + b q(id+m 1) c) : log2 d m 1 + b 2q(i+1) c m=b(i)+1 m=1 b(i) X
|
{z
} |
I1
{z I2
}
(11) Let I1 be the rst term on the right side of (11). Denoting = 2q(dim+1) and () = 1+ , we have
I1 , b(i)
b(i) X m=1
(log2 (1 + ()) , 1)
(12)
where the approximation x bxc was made to remove the \lowest integer" operation. Using the Taylor expansion on ln(1 + x) = x , x2 + x3 + , we obtain: 2
I1 , b(i)
b(i) X m=1
3
(1:44 () , 1 + o( ())) ;
(13)
where o( ) are the higher order terms compared with (). Since dm 2q(i + 1) for those Am 2 Gi , 1 and 0:5 () < 1, then discarding the higher order terms, we have:
,0:28 b(i) I , b(i) < 0:44 b(i); 1
(14)
The second term in (11), I2 , is:
I2 = b(i + 1) , b(i): (15) since q(i+1) dm 2q(i+1) for those Am 2 Gi ji + 1, m c = 1. Furthermore, we assume that b(i)
