1 Introduction

With the rapid development of information technology, the concept of cloud has gradually become familiar to everyone. Coupled with the arrival and application of 5G technology, it has promoted the rapid development of all walks of life in society. Traditional medical care has gradually become cloud-based, and cloud diagnosis with cloud treatment technologies have become more mature. The new era of smart medical care has arrived, and the intuitive expression ability of images makes medical images (containing private information about the patient’s condition) frequently active in the cloud. The convenience of big data in the cloud makes it store more and more private information [5, 20]. However, it is followed by a series of information security problems, such as willfully copying and tampering of medical pictures transmitted in the cloud, disclosure of patient privacy information and so on [3, 24]. Therefore, how to protect the safe transmission of medical image information and protect the patient’s privacy, and information is a hot topic for scholars from various countries [4, 24]. And due to the particularity of medical images, any watermark embedding method that causes image changes is unacceptable [9, 19]. Medical image digital watermarking technology is an effective solution. It hides the information that users want to hide in the carrier image so that the image only presents the carrier image information, which has good imperceptibility and robustness. Imperceptibility and robustness are particularly important for the medical image watermarking algorithm [4, 14, 28, 29]. According to the division of the embedding area, digital watermarking can be divided into spatial digital watermarking technology and frequency domain digital watermarking technology. In the process of embedding the watermark, both types of algorithms need to modify the spatial or frequency domain information of the carrier image. At this time, the imperceptibility of the watermark will decrease as the modification intensity increases. If the modification intensity is too small, the robustness of the watermark will decrease [18, 25]. The zero-watermarking technology proposed by Wenquan et al. solved the contradiction between imperceptibility and robustness. Nowadays, commonly used zero-watermarking algorithms are based on discrete cosine transform (DCT) [10, 11, 23], discrete wavelet transform (DWT), scale-invariant feature transform (SIFT), etc. [1, 2, 16, 22] Kabir et al. [7] presents a reliable digital watermarking technique that provides high imperceptibility and robustness for copyright protection using an optimal discrete cosine transform (DCT) psychovisual threshold. The watermark image is constructed by modifying some coefficients according to some rules. Lina Aditi Zear et al. [27] creatively combined three transformations of DCT, DWT and SVD, which greatly improved the robustness of a single algorithm for embedding watermarking. Embedding watermarking with multiple transformation domain methods greatly improved the performance of embedding watermarking algorithms. However, this method changes the pixel matrix of the original image and is not suitable for embedding the medical image watermark. Swaraja K et al. [19] proposed a method to hide the watermark information into the non-interested region of the medical image, which is of great help in detecting whether the medical image has been tampered with, but it is weak in resisting geometric attack in the spatial domain.

The algorithm adopted in this paper is the second-generation bandelet transform. Bandelet algorithm belongs to multi-scale geometric analysis, which is a kind of super-wavelet transform, and can adaptively track image edge features, has a wide range of applications in image feature extraction. Shao Dong et al. [6] proposed a robust watermarking algorithm based on bandelet transform and stable feature point detection. The watermark is embedded in the image stable and robust feature area, which has good imperceptibility and robustness. The disadvantage is that the ability to resist conventional attacks is weak and poor security. Yang Yue Xiang et al. [26] combined the bandelet algorithm and adaptive matrix norm to propose a full-frequency lossless watermarking method, adopting the idea of zero-watermarking. The disadvantage is that there is no corresponding hidden encryption technology, and the ability to resist geometric attack is weak. Liu Xuchong et al. [12] proposed an authentication algorithm based on the bandelet transform, which uses the direction flow between the hidden watermark and the vector generated by the bandelet transform for correlation detection to realize image authentication. The disadvantage is that the algorithm cannot resist geometric attacks effectively. The above algorithms can’t be applied to medical image watermark because they change the visual characteristics of the image to a certain extent.

Therefore, to take into account the invisibility and robustness of the medical image watermarking system, and to improve the ability to resist geometric attacks and conventional attacks, our research is focused on solving these issues. This paper creatively proposed a robust medical image watermarking technology based on Bandelet-DCT and chaotic encryption. It used zero-watermarking technology to extract the features of medical images, and performed watermark embedding and extraction operation on the features. The integrity of the original medical image is perfectly guaranteed, and the preprocessing steps of tent map chaotic encryption and scale-invariant feature rotation transformation on the original image are added, which greatly improved the security of the medical image, the invisibility of watermark and the robustness against conventional attacks and geometric attacks.

2 The fundamental theory

2.1 SIFT (scale-invariant feature transform) preprocessing

Scale-invariant feature transform(SIFT) was proposed by Lowe [15] and proved that it has ideal robustness to the rotation, translation, scaling, and projection transformation. The algorithm is a local feature description operator that uses local image features to extract key points. These key points are the maximum value of the image gray value, which contains information such as the location, size, and direction. Therefore, SIFT is often used for the detection and matching of image feature points. Details as follows:

  1. (a)

    Extreme values detection in scale-space

The first stage of calculation is to search for image positions on all scales. The Gaussian differential function is used to identify potential points of interest that are invariant to scale and rotation. Suppose I(x, y) represents the input image, and its scale space function L(x, y, δ) is obtained by convolution of the original image I(x, y) and the variable-scale Gaussian kernel function G(x, y, δ). The specific formula is:

$$ L\left(x,y,\delta \right)=G\left(x,y,\delta \right)\ast I\left(x,y\right) $$
(1)

In order to find the extreme points of the image, by subtracting the adjacent image matrices in the same scale space, the Gaussian difference scale space can be obtained as follows:

$$ D\left(x,y,\delta \right)=\left(G\left(x,y, k\delta \right)-G\left(x,y,\delta \right)\right)\ast I\left(x,y\right)=L\left(x,y, k\delta \right)-L\left(x,y,\delta \right) $$
(2)

Two adjacent scales are separated by a constant k.

  1. (b)

    Extract stable feature points

In order to find the extreme point of the DOG function, each pixel has to be compared with all its neighbors to see if it is larger or smaller than all its neighbors [1]. The Gaussian scale space to the Gaussian difference scale space is shown in Fig. 1. The adjacent point is composed of 8 adjacent points of the same scale and 9 × 2 points of adjacent scales up and down, a total of 26 points [13].

  1. (c)

    Direction determination

Fig. 1
figure 1

Gaussian scale space to Gaussian difference scale space

Full size image

Based on the local gradient direction of the image, one or more directions are assigned to each key point position. All subsequent operations on the image data are transformed relative to the direction, scale and position of the key points, thereby providing invariance to these transformations.

  1. (d)

    Key point description

In the neighborhood around each key point, the local gradient of the image is measured on the selected scale. These gradients are transformed into a representation that allows relatively large local shape deformation and illumination changes (see Fig. 2).

Fig. 2
figure 2

SIFT feature vector generation

Full size image

2.2 Bandelet transformation

The second-generation Bandelet transform was proposed by Peyer and Mallat [17] in 2005. It effectively simplifies the first-generation algorithm and is a multi-scale geometric analysis method. The algorithm is to perform bandelet transform again based on wavelet transform, which can better extract geometric features such as complex textures and edges of the image. There is no edge effect when reconstructing the image, and the algorithm process is simple. It first divides the wavelet coefficients into blocks, and then approximates the geometric flow with a straight line in each sub-block, and realizes the control of the geometric flow with a parameter. This parameter is called the geometric vector line direction flow. The principal flow of the algorithm is as follows:

  1. (a)

    Perform two-dimensional discrete orthogonal wavelet multi-scale transform on the image.

  2. (b)

    Obtain the Bandelet blocks via divide each sub-band after wavelet transform quadtree divisions (the quadtree segmentation diagram is shown in Fig. 3) to establish the best quad-tree decomposition.

Fig. 3
figure 3

The quadtree segmentation diagram: a Binary division; b Quadtree segmentation and Leaf node corresponds to the small square label in (a)

Full size image
  1. (c)

    Bandelet the obtained Bandelet block to obtain the bandelet coefficient. Bandeletization is a reversible transformation of high-frequency sub-band coefficients generated by two-dimensional wavelet transform.

  2. (d)

    Arrange the Bandelet coefficients according to the best geometric flow direction to obtain a matrix.

The output result of the algorithm has three items, namely: quadtree, optimal geometric flow direction, and Bandelet coefficient. Among them, the bottom-up global optimization algorithm is adopted, that is, a quadtree optimization segmentation algorithm. The algorithm optimization process is as follows:

Firstly, the optimal geometric flow direction was searched for each L × L square block S, and the optimal geometric flow direction and the minimum Lagrange function value L0(S) were obtained; Secondly, Let L = 2L, and perform the first step for each square to obtain the corresponding optimal geometric flow direction and the value of Lagrange function L(S); Finally, mark the child nodes of each sub-block as (S1 、 S2 、 S3 、 S4). Then:

$$ \mathrm{L}\left(\mathrm{S}\right)={L}_0\left({S}_1\right)+{L}_0\left({S}_2\right)+{L}_0\left({S}_3\right)+{L}_0\left({S}_4\right)+{L}_0(S)+\lambda \ast {T}^2 $$
(3)

The sum of the Lagrange values of the four child nodes is taken as the Lagrange value of the leaf node, and let L0(S) = min {L0(S), L(S)}, L0(S)is the result of the quadtree split. On this basis, the best geometric flow direction of the Bandelet block can also be obtained. The geometric flow is optimized by the function of Lagrange. The specific method is as follows: for L × L small square, the rounded corners [0, π] are discretized into L2 − 1. That is, the possible values of θ are\( \theta =\frac{k\pi}{L^2-1}\left(k=0,1,\dots, {L}^2-2\right) \), The geometric flow direction that makes the Lagrange function value minimum is the optimal geometric flow direction. The schematic diagram of the geometric flow direction in the sub-block is shown in Fig. 4.

Fig. 4
figure 4

Schematic diagram of geometric flow direction in sub-block

Full size image

Bandelet transform has two advantages compared with wavelet transform: (1) Taking full advantage of geometric regularity, high-frequency sub-band energy is more concentrated, and non-zero coefficients are relatively reduced under the same quantization step; (2) Due to the quadtree structure and geometric flow information, the Bandelet coefficients can be rearranged, and the coefficient scanning mode is more flexible when encoding.

2.3 Discrete cosine transform

Discrete Cosine Transform (DCT) is a special form of Discrete Fourier Transform (DFT). The two-dimensional DCT transform (2D-DCT) formula is shown as follows:

$$ {\displaystyle \begin{array}{c}\underset{x=0}{\sum \limits^{M-1}}\underset{y=0}{\sum \limits^{\mathrm{M}-1}}f\left(x,y\right)\mathit{\cos}\frac{\pi \left(2x+1\right)u}{2M}\mathit{\cos}\frac{\pi \left(2y+1\right)v}{2N}\\ {}u=0,1,\dots, M-1;v=0,1,\dots, N-1;\\ {}c(u)=\left\{\begin{array}{c}\sqrt{1/M}\kern0.5em u=0\\ {}\sqrt{2/M}\kern0.75em u=1,2,\dots, M-1\end{array}\ \right.\ c(u)=\left\{\begin{array}{c}\sqrt{1/M}\kern0.5em u=0\\ {}\sqrt{2/M}\kern0.75em u=1,2,\dots, M-1\end{array}\right.\end{array}} $$
(4)

Through the DCT transformation, the picture pixel matrix is divided into DC (low frequency components) components and AC (medium and high frequency) components. The DC component concentrates more energy, mostly texture and background parts, while the AC component concentrates less energy, mostly sudden changes or details.

3 The proposed algorithm

In this paper, Bandelet and DCT transform are combined to propose a medical zero-watermark robustness algorithm based on Bandelet-DCT transform. This algorithm is more robust than simple use of DCT transform in resisting various conventional and geometric image attacks. The whole algorithm includes five parts: image preprocessing, extract visual feature vector of medical image, embed watermark, extract watermark, and restore watermark.

3.1 Image preprocessing

3.1.1 Watermark image preprocessing

To ensure the security of the watermark image and generate an encrypted watermark signal with higher security, we need to construct a higher security information encryption system before embedding the watermark. The chaotic system can be used to preprocess the original watermark image. Commonly used chaotic systems include Logistic mapping, Arnold transform, Tent mapping [8], etc. Among them, Tent mapping has faster iteration speed and better uniformity than Arnold transform and Logistic mapping. The chaotic sequence generated by this chaos has good statistical characteristics. Therefore, the Tent chaotic map is used in this paper. It is defined as follows:

$$ {\boldsymbol{x}}_{\boldsymbol{n}+\mathbf{1}}=\left\{\begin{array}{c}\frac{{\boldsymbol{x}}_{\boldsymbol{n}}}{\boldsymbol{\alpha}},\mathbf{0}\le {\boldsymbol{x}}_{\boldsymbol{n}}<\boldsymbol{\alpha} \\ {}\frac{\mathbf{1}-{\boldsymbol{x}}_{\boldsymbol{n}}}{\mathbf{1}-\boldsymbol{\alpha}},\boldsymbol{\alpha} \le {\boldsymbol{x}}_{\boldsymbol{n}}<\mathbf{1}\end{array}\right. $$
(5)

The initial parameters are set to generate the Tent chaotic map sequence X(j). The binary encryption matrix C(i, j) is obtained through the sign function. Then, the hash function is used to process C(i, j) and the binary watermark W(i, j) to obtain the encrypted watermark CW(i, j). Figure 5 described the encryption process of the watermark.

$$ CW\left(i,j\right)=W\left(i,j\right)\oplus C\left(i,j\right) $$
(6)
Fig. 5
figure 5

The encryption scheme for the watermark

Full size image

3.1.2 Medical image preprocessing

To improve the robustness of the algorithm against attacks, the SIFT preprocessing transformation is performed on the medical image before the feature extraction of the medical image, and the local feature invariant region IR(i,  j) of the original medical image is established.

3.2 Extract visual feature vector of medical image

As its particularity, the medical image cannot change any information. Therefore, zero-watermarking technology is used to embed the watermark, and Bandelet-DCT is performed on the original medical image. In the low-frequency coefficient matrix, 32-bit data is selected to form a symbol sequence, which is quantized (more than the symbol sequence average value is “1”, otherwise, it is “0”) as the medical image feature vector HV(j). As shown in Table 1, to verify the effectiveness of the proposed visual characteristic sequence of the original image recognition, various attacks are performed on these vectors, and the normalization coefficient NC values are all equal to 1.0. We can see that the vector of the images proposed in this paper will not change with the attacks. To further verify the proposed visual feature sequences can well distinguish the different medical images, we perform a cross-validation test on different medical images (see Fig. 6). As shown in Table 2, the NC values are all less than 0.5 which mean that the proposed vector can distinguish different images. Hence, the symbol sequence proposed by this algorithm can be the visual feature of medical images (For better presentation in the table, only 9 digits of the coefficient matrix are shown).

Table 1 Bandelet-DCT coefficient changes of original medical images under various attacks
Full size table
Fig. 6
figure 6

Medical images for watermarking: a Abdomen; b Brain; c Lung; d Cervical Spine; e head MRI; f Neck; g Lumber spine; h Sacroiliac

Full size image
Table 2 Medical image cross-validation NC value
Full size table

3.3 Embed watermark

Do XOR operation on the obtained medical image feature vector HV(j) and the encrypted watermark CW(j) sequence to complete the watermark embedding process. The key Wkey(i, j) generated after embedding can be stored in IPR (Intellectual Property Rights) database for the authentication and protection of medical images. Figure 7 described the process of feature extraction and watermark embedding.

Fig. 7
figure 7

Feature extraction and watermark embedding

Full size image

3.4 Extract watermark AND restore watermark

After attacked, the tested medical image I ′ (i, j) is obtained. The watermark extraction process is opposite to the embedding process. Figure 8 shows the watermark extraction process. To restore the watermark, the same initial parameters must be obtained and set to generate the same Tent map chaotic mapping sequence X(j), the binary encryption matrix C(i, j) is obtained through the sign function, and then the hash function is used to process C(i, j) and the extracted binary watermark CW ′ (i, j) to obtain the restored watermark W ′ (i, j). Figure 9 shows the restoration of the watermark.

$$ W^{\prime}\left(i,j\right)=C\left(i,j\right)\oplus CW^{\prime}\left(i,j\right) $$
(7)
Fig. 8
figure 8

The extraction process of the watermark

Full size image
Fig. 9
figure 9

Watermark restoration algorithm

Full size image

4 Experiments and results

To verify the effectiveness of the algorithm, a 512 × 512pixel medical image (see Fig. 10a) and a 32 pixel × 32 pixel binary watermark image (see Fig. 10b) is selected for experiments, and use peak signal-to-noise ratio (PSNR) [21] and normalized correlation coefficient (NC) [21] to evaluate the robustness of the algorithm against attacks, the simulation platform is MATLAB R2016a. In the experiment, we carried out various common attacks and geometric attacks on images embedded with watermarks. Figure 10c shows the chaotic encrypted watermark image, the initial value of the chaotic encryption a = 0.8, x(1)=0.34, and Fig. 10d shows the embedded watermarked medical image in the state of no attacks.

$$ PSNR=10{\mathit{\log}}_{10}\frac{MN\underset{i,j}{\mathit{\max}}{\left({I}_{\left(i,\kern0.5em j\right)}\right)}^2}{\sum \limits_i\sum \limits_j{\left({I}_{\left(i,\kern0.5em j\right)}-I{\prime}_{\left(i,\kern0.5em j\right)}\right)}^2} $$
(8)
$$ NC=\frac{\sum_i{\sum}_j{W}_{\left(i,\kern0.5em j\right)}W{\prime}_{\left(i,\kern0.5em j\right)}}{\sum_i{\sum}_j{W}_{\left(\mathrm{i},j\right)}^2} $$
(9)
Fig. 10
figure 10

Medical pictures and watermarks: a original medical image; b original binary watermark; c encrypted watermark; d watermarked medical image

Full size image

In the above formula, I(i,  j) and I′(i,  j) represent the gray values of the original medical images and the coordinates of the embedded watermark images (i, j), respectively, M and N represent the pixel values of image rows and columns. The PSNR value indicates the degree of distortion, and the larger the PSNR value, the smaller was the distortion of the image.

4.1 Common attacks

To test the robustness of the algorithm, we perform common attacks on the test watermarked medical images, the specific performance of the algorithm is shown in Table 3. When the Gaussian noise intensity reaches 30%, the NC value is still greater than 0.5 to 0.78, and the extracted watermark can still be distinguished; Even if the JPEG compression quality reaches only 1% of the original image, the NC value is still 1.00; When the median filter of [7 × 7] is repeated 10 times on the test image, the NC value can also reach 0.88, which shows that the algorithm has strong robustness against common attacks. In Fig. 11, some test watermarked medical images and corresponding extracted watermarked images under common attacks are given.

Table 3 The data under common attacks
Full size table
Fig. 11
figure 11

Medical Images under common attacks: a Gaussian noise level of 30%; b the extracted watermark under Gaussian noise level of 30%; c Gaussian noise level of 15%; d the extracted watermark under Gaussian noise level of 15%; e JPEG compression quality 30%; f the extracted watermark under compression quality 30%; g median filter [7 × 7], 10 times; h the extracted watermark under median filter [7 × 7], 10 times

Full size image

4.2 Geometrical attacks

Geometric attacks on medical images are easier to do than common attacks, so the robustness of the algorithm against geometric attacks is crucial. In Table 4, we show the performance of test images under common geometric attacks. From the data in the table, we can see the significant advantages of this algorithm. When the image is subjected to a high-intensity geometric attack, such as the rotation degree reaches 24 degrees, the downward translation reaches 24%, and the square cropping reaches 1/4, the value of NC can still be maintained above 0.5, and the extracted watermark image features are distinguishable (see Fig. 12). Therefore, the algorithm is also very robust to geometric attacks.

Table 4 The data under geometrical attacks
Full size table
Fig. 12
figure 12

Images under geometrical attacks: a Rotation (clockwise) 24°; b the extracted watermark under rotation (clockwise) 24°; c Scaling factor 2.0; d the extracted watermark under scaling factor 2.0; e down distance 24%; f the extracted watermark under down distance 24%; g left distance 23%; h the extracted watermark under left distance 23%; i Center square cropping 25%; j the extracted watermark under center square cropping 25%

Full size image

4.3 Comparison with other algorithms

In this paper, we compared this algorithm with the other two algorithms, respectively comparing the single DCT zero-watermarking algorithm and Bandelet zero-watermarking algorithm. Detailed comparison results are given in Tables 5 and 6. In the two tables, we can clearly see that the Bandelet-DCT algorithm in this paper is more robust against JPEG compression and geometric attacks than the Bandelet algorithm alone. In terms of translation attack, square cropping, and rotation attack, the robustness of the algorithm in this paper is far stronger than that of the independent DCT zero-watermarking algorithm. On the whole, the robustness of the algorithm in this paper is better than the independent Bandelet zero-watermarking algorithm and DCT zero-watermarking algorithm.

Table 5 The comparison values of PSNR and NC under common attacks
Full size table
Table 6 The comparison values of PSNR and NC under geometrical attacks
Full size table

To further verified the superiority of the algorithm, it was compared with the algorithm in Ref. [24] and Ref. [13]. For ease of comparison, we used the images consistent with the references as the original images. We used the algorithms proposed in the literature to extract the features of the images that have experienced the same attacks. From Fig. 13, we can saw that the NC values of the proposed algorithm were higher than those of the comparative literature. We take the average value of all kinds of attacks and get an average NC value, which can better reflect the superiority of the proposed algorithm.

Fig. 13
figure 13

The NC value of comparative analysis results under the different attacks: A to E respectively represent the attacks: Gaussian noise, JPEG compression, Median filter (10 times), Rotation (clockwise), Translation (left)

Full size image

5 Conclusion

This paper proposed a robust watermarking algorithm for medical images based on Bandelet-DCT, which combined cryptographic algorithms, tent map chaotic sequences, and third-party database authentication protection. It greatly improved the security performance of the algorithm. Moreover, the scale-invariant feature transformation preprocessing process was creatively added in terms of feature extraction, and the optimized bandelet transform and discrete cosine transform were used to extract the visual features of the original image. The experimental results show that the algorithm is robust to both common attacks and geometric attacks, and achieves the requirement of zero-watermarking in extracting watermarks, that is, no original medical images are required. Therefore, the algorithm can be used on special occasions such as medical images that have strict requirements on image quality. In the next step of research, the algorithm will improve its robustness to other cropping attacks except square cropping.