Image Watermarking for Secure Transmission over Public Networks M. Barni, F. Bartolini, V. Cappellini, A. Piva Department of Electronic Engineering University of Florence Via S. Marta 3, 50139, Firenze, Italy e-mail:
[email protected] .it
Abstract Digital watermarking represents a viable solution to the ever increasing demand for copyright protection mechanisms. A code number is indissolubly embedded in the document to be protected, thus allowing the identi cation of its creator, owner, authorized author, and so on. A new image watermarking algorithm is presented here which represents a signi cant improvement with respect to existing methods. The codemark, namely a sequence of randomly generated real numbers, is embedded in a selected set of DCT coecients. At the decoder side, the correlation between the mark sequence whose presence is to be checked for and the set of possibly corrupted DCT coecients is calculated. If the correlation is large enough, the presence of the mark is revealed. Experimental results are reported proving the robustness of the proposed method against some of the most common image processing techniques.
1 Introduction In the last decade, networked multimedia systems have known rapid development and expansion, so that everyday more and more information is transmitted through digital public networks. This expansion will increase even more when advanced multimedia services will be widely available, such as electronic com-
merce, pay-per-view, video-on-demand, electronic newspapers, teleworking, teleconsulting, etc. In spite of the bene ts achievable by the use of these new facilities, authors, publishers and providers of multimedia data are reluctant to grant the distribution of their documents in public networked environments, because the ease of intercepting, copying and redistributing electronic data in their exact original form encourages copyright violation. It is crucial, then, for the future development of networked multimedia systems that robust methods are developed to protect the intellectual property rights of data owners against unauthorized copying and redistribution of the material put on the network. Classical encryption systems do not completely solve the problem of unauthorized copying, since once encryption is removed from a document, there is no more control on its dissemination. A possible solution consists in marking multimedia works to allow their spreading to be tracked, in such a way not to limit the number of copies allowed, but to let a mean to control the original distributor. Digital watermarking represents a viable solution to the above problem, since it makes possible to identify the source, author, creator, owner, distributor or authorized consumer of a document. A digital watermark is an identi cation code carrying information about the copyright owner, the creator of the work, authorized consumers and so on. The watermark is perma-
nently embedded into digital data for copyright protection and for checking if the data has been corrupted. By means of watermarking the work is still accessible, but permanently marked [1]. In order to be e ective, a watermark should meet the following requirements [2, 4, 5]: unobtrusive : it should be statistically and perceptually invisible not to degrade data quality and to prevent attackers from nding and deleting it; readily extractable : the data owner or an independent control authority should easily extract it; lossless : it should imply no loss of relevant information; robust : it should be dicult (virtually impossible) to remove by attackers trying to counterfeit copyright of data; if only partial knowledge of the watermark is available, then attempts by an outsider to remove or destroy it should produce a remarkable degradation in data quality before the watermark is lost. In particular, the watermark should be resistant to common signal processing techniques, to distortions and to collusion and forgery attacks by multiple persons each possessing a watermarked copy of the document; universal : the same watermarking method should apply to all multimedia data (audio, image and video); unambiguous : its retrieval should unambiguously prove the identity of the data owner. This note focuses on image watermarking algorithms; in this special case, the requirement of robustness implies the watermark should be resistant to common signal processing techniques such as digital-to-analog and analog-todigital conversions, resampling, dithering, compression, contrast/colour enhancements, and to common geometric distortions such as rotation, translation, cropping, scaling, cutting of a line. The watermarking process can be viewed as a communication task, consisting of two main
steps. The rst step is watermark casting, in which the signal, i.e. the watermark, is transmitted over the channel, which the original image acts the part of; intentional attacks and distortions to the image represent channel noises the signal must be immune to. The second step of the watermarking process is watermark detection, in which the signal is received and extracted from the corrupted image. In watermark casting an encoder function E takes an image I and a watermark X , and generates a new image IX , called watermarked image [1]: E (I; X ) = IX . The function E embeds the watermark X into some sets of features F (I ) by means of an insertion operation denoted by the symbol that is: F 0 (I ) = F (I ) X . In watermark detection a decoder function D takes a possibly corrupted image whose ownership is to be determined, and extracts a watermark from it: D(J; I ) = X 0 . Watermark recovery is achieved by means of the extraction operation, in which a watermark X 0 is extracted from the features F 0 (I ). In general, to the aim of watermark recovery, the decoder D can also use the original image I . As a matter of fact, some techniques use the original image in the watermark detection process, to provide extra robustness against JPEG compression and other attacks, like cropping, rotation, translation, scaling etc. The use of the original image permits, in fact, some preprocessing to be performed before the watermark is checked; moreover rotation angles, translation and scale vectors can be estimated and missing parts of the image can be replaced by the corresponding parts of the original image. However, for these techniques to be applied the possibility to access the original image must be granted. This on one side complicates the setup of the watermarking system and on the other side compels the owner of the original image to share it unsecurely with anyone who would check for the watermark. Image watermarking techniques proposed so far can be divided in two groups, according to the type of features the watermark is embedded in: the intensity values of the luminance in the spatial domain, or the image coecients in a transformed domain (e.g. DCT, wavelet).
In this paper, a new technique to embed a watermark into digital images is presented. To achieve a high degree of robustness, the algorithm operates in the frequency domain, moreover watermark extraction is performed without resorting to the original, uncorrupted image. Though at the expense of a slight loss of robustness, the technique we propose represents a major improvement with respect to methods relying on the comparison between the watermarked and original images [2, 3, 6, 7, 8, 9]. On the other hand, the algorithm is robust enough to represent a good starting point, if not a de nite solution, to the protection of image-like data to be disseminated through an open network environment.
2 A new watermarking system Like in [2], the watermark consists of a sequence of M randomly generated real numbers X = fx1 ; x2 ; : : : ; xM g; each value xi is a random number with a normal distribution having zero mean and unity variance. The watermarking process can be viewed as a communication task, consisting of two main steps: watermark casting, in which the signal, represented by the watermark, is transmitted over the channel, which the original image acts the part of; intentional attacks and distortions to the image represent channel noises the signal must be immune to; watermark detection, in which the signal is received and extracted from the corrupted image. In watermark casting the N N DCT for a N N gray scale image I is computed; the DCT coecients of I are reordered into a zig-zag scan, such as in the JPEG compression algorithm, and the rst L + M coecients are selected to generate a vector T = ft1 ; t2 ; : : : ; tL ; tL+1 ; : : : ; tL+M g. Then, in order to obtain a tradeo between perceptual invisibility and robustness to image processing techniques, the lowest L coef cients are skipped and in the last M numbers a watermark X = fx1 ; x2 ; : : : ; xM g (chosen among 1000 pseudo-random orthogonal sequences) is embedded, to obtain a new vector T 0 = ft1; t2 ; : : : ; tL; t0L+1 ; : : : ; t0L+M g according
to the following rule:
t0L+i = tL+i + j tL+i j xi
(1)
where i = 1; : : : ; M . The vector T 0 is then reinserted in the zig-zag scan and an inverse DCT algorithm is performed, obtaining the watermarked image I 0 . In watermark detection, given a possibly corrupted image I , the N N DCT algorithm of I is applied; the DCT coecients are reordered into a zig-zag scan, and the rst L+M coecients are selected to generate a vector T = ft1 ; t2 ; : : : ; tL; tL+1 ; : : : ; tL+M g. Then, L coecients are skipped and the sequence of the last M numbers is used to calculate the correlation with each of the 1000 randomly generated watermarks X .
z=
Xt + x M
i=1
L i i
(2)
The sequence producing the highest value of z is chosen as the embedded watermark.
Figure 1: Original image "Lenna".
3 Experimental results In order to test the described watermarking algorithm, 1000 watermarks were randomly generated. The standard image "Lenna" in Figure 1 was signed with parameter = 0.2, a watermarking random sequence of length M = 16000, and skipping L = 16000 coecients in
220 200
Maximum Detector Response
180 160 140 120 100 80 60 40 20 0
10
20
30
40 50 60 JPEG quality (%)
70
80
90
100
Figure 4: Maximum detector response to Figure 2: Watermarked image "Lenna" with JPEG compressed and watermarked image parameter =0.2, L=16000 and M=16000. "Lenna", with decreasing qualities. 250
200
Detector Response
150
100
50
0
−50 0
100
200
300
400
500 600 Watermarks
700
800
900
1000
Figure 3: Detector response of the watermaked image in Figure 2 to 1000 randomly generated watermarks. Only watermark number 100 Figure 5: JPEG compressed copy of the watermarked "Lenna", (10% quality, 0% smoothing). matches that embedded. 250
the zig-zag scan, to obtain a watermarked copy shown in Figure 2. The detector was applied to this copy: the response to the correct watermark is much higher than the responses to the other watermarks (Figure 3). The watermarked image was then attacked in many ways to test the algorithm robustness. JPEG coding with 0% smoothing and decreasing quality was applied to the signed image: the watermark is detected until quality is higher than 10% (Figure 4), although the image is visibly distorted (see Figure 5). The watermarked image was ltered with a Figure 6: Detector response of the multiple walow pass lter and a median lter having in- termaked image to 1000 randomly generated creasing window size; the watermark is robust watermarks. 200
Detector Response
150
100
50
0
−50 0
100
200
300
400
500 600 Watermarks
700
800
900
1000
to lters of window size 3 3 and 5 5; also, in [3] Hsu, C.T. and Wu, J.L. (1996), Hidthe watermarked image, some lines were randen Signatures in Images. IEEE Interdomly inverted: the proposed algorithm is innational Conference on Image Processsensitive to this attack. Finally, the original ing (ICIP'96), Lausanne, Switzerland, image was watermarked, then the watermarked September 16-19, 1996, vol. III, pp. 223{ copy was again signed, and so on until an image 226. with ve di erent watermarks is obtained; the detector is able to retrieve all ve watermarks [4] Koch, E., Rindfrey, J., and Zhao, J. (1994). Copyright Protection for Multime(see Figure 6). dia Data. Proc. of the International Conference on Digital Media and Electronic Publishing , December 6-8, 1994, Leeds, 4 Conclusions UK. In this paper a new watermarking algorithm for digital images which operates on the fre- [5] Nikolaidis, N., and Pitas, I. (May 1996). Copyright protection of images using roquency domain is presented: a sequence of ranbust digital signatures. IEEE Internadomly generated real numbers having normal tional Conference on Acoustics, Speech distribution with zero mean and unity variance and Signal Processing (ICASSP-96), vol. is embedded in a selected set of DCT coe4, pp. 2168{2171. cients. Moreover watermark extraction is performed without resorting to the original, un- [6] O Ruanaidh, J.J.K., Boland, F.M., and corrupted image. Experimental results demonDowling, W.J. (1996). Phase Waterstrate that the watermark is robust to several marking of Digital Images. IEEE Intersignal processing and geometric distortions, innational Conference on Image Processcluding JPEG compression, low pass and meing (ICIP'96), Lausanne, Switzerland, dian ltering, inversion of two lines and mulSeptember 16-19, 1996, vol. III, pp. 239{ tiple watermarking. Future work will be fo242. cused on checking spatial masking of the watermarked image to increase the robustness of the [7] van Schyndel, R.G., Tirkel, A.Z., and Oswatermark without degrade the image quality. borne, C.F. (1996). A Digital Watermark. IEEE International Conference on Image Processing (ICIP'94), Austin, Texas, 5 Acknowledgements November 13-16, 1994, vol. II, pp. 86{90. The present work was developed with sup- [8] Swanson, M.D., Zhu, B., and Tew k, A.H. port of "Progetto Finalizzato Beni Culturali (1996). Transparent Robust Image WaterC.N.R." (Italian Finalized Project on Cultural marking. IEEE International Conference Heritage - National Research Council). on Image Processing (ICIP'96), Lausanne, Switzerland, September 16-19, 1996, vol. III, pp. 211{214. References [9] Wolfgang, R., and Delp, E.J. (1996) A [1] Craver, S., Memon, N., Yeo, B.L., and YeWatermark for Digital Images. IEEE Inung, M. (1996). Can Invisible Watermarks ternational Conference on Image ProResolve Rightful Ownerships?. IBM Recessing (ICIP'96), Lausanne, Switzerland, search Report, RC 20509, July 25, 1996. September 16-19, 1996, vol. III, pp. 219{ 222. [2] Cox, I.J., Kilian, J., Leighton, T., and Shamoon, T. (1995). Secure Spread Spectrum Watermarking for Multimedia. NEC Research Institute Technical Report 95-10.
