1 Introduction

In recent years, with more and more color images appearing on the Internet, the problem of copyright protection has been receiving more and more attention. Among the published copyright protection techniques, digital watermarking is considered as a powerful method. There are still several important issues existing in the watermarking system. Firstly, the embedded watermark should not degrade the quality of the image and should be perceptually invisible to maintain its protective secrecy. Secondly, the watermark must be robust enough to resist common image processing attacks and not be easily removed; only the owner of the image is able to extract the watermark. Thirdly, the blind watermarking technique is necessary since sometimes it is not easy to obtain the original image or original watermark during extraction process. Compared with the method of embedding binary or gray images into color image [2, 4, 6, 9, 14, 18, 19], the double color watermarking, i.e., embedding color watermark images into color host image [5, 7, 25], not only has the features of more information and higher fidelity, but also can solve the copyright problems for some corporations which using the unique identifiable color log as corporation mark.

Recently, some works on the SVD-based watermarking have been published, which sufficiently utilized the stable property of the singular value matrix [7, 11, 13, 22, 24]. For example, Yin et al. [24] proposed a SVD-based color image watermarking, in which the singular values of original watermark were required to extract the embedded singular values, and then the U and V orthogonal matrices of original watermark were utilized to recover the watermark. In [11], two orthogonal matrices U, V and the diagonal matrix S of the original watermark were viewed as the user’s secret keys to extract watermark, in which the original host image was needed to extract watermark. The method in [22] also required the singular values of the original watermark to extract the embedded color watermark information. In [13], a hybrid robust digital watermarking algorithm based on finite Radon transform and SVD is proposed. It is noted that in the aforementioned SVD-based methods [13, 24], only the singular values of watermark were embedded in the host image, which might result in the false-positive detection problem such that the attackers can easily prove the ownership of the arbitrary watermarked image without knowing the original watermark embedded in the host image. Although a blind color image watermarking was proposed in [7], one or more singular values must be modified to keep the order of singular values, which might degrade the quality of the watermarked image.

In addition, the SVD has sophisticated computation. Especially, when the problem is of recursive nature, the SVD requires O(n 3) flops for a matrix of order n. As a major intermediate step in SVD, the QR decomposition only needs O(n 2) flops, which is lower than that of SVD [8, 10]. The feature highlights the use of QR decomposition in digital watermarking and a few of methods have been proposed in [16, 23]. Yashar et al. [23] proposed to embed a watermark bit in the first row of R matrix after each 8 × 8 block was decomposed by QR decomposition, in which the watermark was 88 × 88 binary image. In [16], by modifying the elements in the Q matrix, a 32 × 32 binary image was embedded into the 512 × 512 host image. The common feature in [16, 23] was to use binary image as the watermark. As is well known, the binary information included in the 24-bit color image is twenty-four times more than that of the binary image with same size. When embedding the color image watermark into color host image, the watermark capacity increases by eight times. That is, the method [23] could not be better used to embed large amounts of color watermark information into host image. Meanwhile, in [16], the threshold T and the embedding rules were not suitable for the color watermark image, which can be proved in Fig. 5. Therefore, these mentioned methods [16, 23] cannot be better used to embed the color image watermark into color host image.

Motivated by the above discussion, we propose a new double color image blind algorithm based on QR decomposition. By analysis, it is found that there is a stronger correlation between q 2,1 and q 3,1 of Q matrix after performing QR decomposition on 4 × 4 pixels matrix. Thus, this relation may be utilized to represent one kind of embedded watermark information, ‘1’ or ‘0’. Hence, the number of modified pixels may be reduced and the invisibility and robustness of watermark can be improved. In this proposed method, the watermark extraction can be performed in a blind manner via the above correlation. Moreover, the presented compensatory method is used in the R matrix to enhance the imperceptibility of watermark. Especially, because all information of color image watermark can be embedded into the host image, the false-positive detection problem like in SVD-based algorithm will not happen. Finally, the experimental results show that the proposed scheme can attain better invisibility and stronger robustness against many common image processing attacks such as image compression, low-pass filtering, cropping, and so on. Meanwhile, the comparisons with related SVD-based algorithm and spatial-domain algorithm also reveal the higher efficiency of the proposed algorithm.

The rest of this paper is organized as follows. The related operations in QR decomposition are described in Section 2. The detailed watermark embedding and extraction procedures are presented in Section 3. Subsequently, Section 4 gives the experimental results and comparisons with other related methods. Finally, conclusions are made in Section 5.

2 Preliminary

2.1 QR Decomposition

In QR decomposition [1], the orthogonal-triangular decomposition of a matrix is performed, which is defined as

$$ \left[Q,R\right]= qr(A) $$
(1)

where an m × m matrix A produces an m × m upper triangular matrix R and an m × m unitary matrix Q so that A = Q × R.

2.2 Selecting the embedding position in unitary matrix Q

Suppose one m × n image block in RGB color space is A = [a1, a2, …, an], any column vector ai(i = 1, 2,…, n) includes m elements. Since the pixel values of the color image in RGB color space are between 0 and 255, the matrix elements that represent the color image pixels should be non-negative. Thus, any element a j,1(j = 1, 2,…, m) in the first column a1 meets the following condition expression.

$$ {a}_{j,1}\ge 0 $$
(2)

Meanwhile, let Q = [q1, q2, …, qn] be the unitary matrix of image block A, and the first column vector q1 can be described in Eq. (3) according to Gram-Schmidt orthogonalization process.

$$ q1=\frac{a1}{\Vert a1\Vert } $$
(3)

wherer ‖ ⋅ ‖ is the norm operation. According to the Eqs. (2) and (3), any element q j,1(j = 1, 2,…, m) of the first column q1 meets the following condition.

$$ {q}_{j,1}\ge 0 $$
(4)

That is, the first column vector in the unitary matrix of image block has stable non-negative feature that can be used to embed watermark in RGB color space.

In order to further determine the accurate embedding position in the first column of Q matrix after performing QR decomposition on m × n image block, let m = n = 4 and suppose one matrix includes the x-th row first column element q x,1 of each Q matrix and another one includes the y-th row first column element q y,1 of each Q matrix, respectively, where x ≠ y. Now, the similarity degree between the above two matrices is computed by the Normalized cross-Correlation (NC). Table 1 shows the experimental results of many standard test images. As seen from the table, the average value of NC (q 2,1, q 3,1) is 0.9874, which shows q 2,1 and q 3,1 are the closest elements in the first column of 4 × 4 Q matrix. This strong similarity relation can represent one kind of embedded watermark information ‘1’ or ‘0’. Thus, watermark can be embedded by slightly modifying the magnitude relationship between q 2,1 and q 3,1.

Table 1 The NC values of different elements in first column of Q matrix after QR decomposition
Full size table

2.3 Compensating the visual distortion in upper triangular matrix R

When q 2,1 and q 3,1 are modified for embedding watermark, the image visual quality will be inevitably affected. Hence, the compensatory method is proposed to possibly decrease the negative affection. For explaining the proposed compensatory method, we assume the original pixel block A is a 4 × 4 matrix and the QR decomposition of A is performed as follows.

$$ \begin{array}{c}\hfill A=\left[a1,a2,a3,a4\right]=\left[\begin{array}{cccc}\hfill {a}_{1,1}\hfill & \hfill {a}_{1,2}\hfill & \hfill {a}_{1,3}\hfill & \hfill {a}_{1,4}\hfill \\ {}\hfill {a}_{2,1}\hfill & \hfill {a}_{2,2}\hfill & \hfill {a}_{2,3}\hfill & \hfill {a}_{2,4}\hfill \\ {}\hfill {a}_{3,1}\hfill & \hfill {a}_{3,2}\hfill & \hfill {a}_{3,3}\hfill & \hfill {a}_{3,4}\hfill \\ {}\hfill {a}_{4,1}\hfill & \hfill {a}_{4,2}\hfill & \hfill {a}_{4,3}\hfill & \hfill {a}_{4,4}\hfill \end{array}\right]= QR\hfill \\ {}\hfill =\left[q1,q2,q3,q4\right]\left[r1,r2,r3,r4\right]\hfill \\ {}\hfill =\left[\begin{array}{cccc}\hfill {q}_{1,1}\hfill & \hfill {q}_{1,2}\hfill & \hfill {q}_{1,3}\hfill & \hfill {q}_{1,4}\hfill \\ {}\hfill {q}_{2,1}\hfill & \hfill {q}_{2,2}\hfill & \hfill {q}_{2,3}\hfill & \hfill {q}_{2,4}\hfill \\ {}\hfill {q}_{3,1}\hfill & \hfill {q}_{3,2}\hfill & \hfill {q}_{3,3}\hfill & \hfill {q}_{3,4}\hfill \\ {}\hfill {q}_{4,1}\hfill & \hfill {q}_{4,2}\hfill & \hfill {q}_{4,3}\hfill & \hfill {q}_{4,4}\hfill \end{array}\right]\left[\begin{array}{cccc}\hfill {r}_{1,1}\hfill & \hfill {r}_{1,2}\hfill & \hfill {r}_{1,3}\hfill & \hfill {r}_{1,4}\hfill \\ {}\hfill 0\hfill & \hfill {r}_{2,2}\hfill & \hfill {r}_{2,3}\hfill & \hfill {r}_{2,4}\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill {r}_{3,3}\hfill & \hfill {r}_{3,4}\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill {r}_{4,4}\hfill \end{array}\right]\hfill \end{array} $$
(5)

Performing the matrix multiplication for QR, the result is given by Eq. (6).

$$ A=\left[\begin{array}{llll}{q}_{1,1}{r}_{1,1}\hfill & {q}_{1,1}{r}_{1,2}+{q}_{1,2}{r}_{2,2}\hfill & {q}_{1,1}{r}_{1,3}+{q}_{1,2}{r}_{2,3}+{q}_{1,3}{r}_{3,3}\hfill & {q}_{1,1}{r}_{1,4}+{q}_{1,2}{r}_{2,4}+{q}_{1,3}{r}_{3,4}+{q}_{1,4}{r}_{4,4}\hfill \\ {}{q}_{2,1}{r}_{1,1}\hfill & {q}_{2,1}{r}_{1,2}+{q}_{2,2}{r}_{2,2}\hfill & {q}_{2,1}{r}_{1,3}+{q}_{2,2}{r}_{2,3}+{q}_{2,3}{r}_{3,3}\hfill & {q}_{2,1}{r}_{1,4}+{q}_{2,2}{r}_{2,4}+{q}_{2,3}{r}_{3,4}+{q}_{2,4}{r}_{4,4}\hfill \\ {}{q}_{3,1}{r}_{1,1}\hfill & {q}_{3,1}{r}_{1,2}+{q}_{3,2}{r}_{2,2}\hfill & {q}_{3,1}{r}_{1,3}+{q}_{3,2}{r}_{2,3}+{q}_{3,3}{r}_{3,3}\hfill & {q}_{3,1}{r}_{1,4}+{q}_{3,2}{r}_{2,4}+{q}_{3,3}{r}_{3,4}+{q}_{3,4}{r}_{4,4}\hfill \\ {}{q}_{4,1}{r}_{1,1}\hfill & {q}_{4,1}{r}_{1,2}+{q}_{4,2}{r}_{2,2}\hfill & {q}_{4,1}{r}_{1,3}+{q}_{4,2}{r}_{2,3}+{q}_{4,3}{r}_{3,3}\hfill & {q}_{4,1}{r}_{1,4}+{q}_{4,2}{r}_{2,4}+{q}_{4,3}{r}_{3,4}+{q}_{4,4}{r}_{4,4}\hfill \end{array}\right] $$
(6)

Assume q 2,1, q 3,1 are modified by adding Δ1 and Δ2, respectively, which will result in the changes of the original pixels a 2,n, a 3,n, n = (1,2,3,4). Thus, we can modify r 1,1, r 1,2, r 1,3, r 1,4 for compensating the visible distortion, and assume the modified quantity is Δ3, Δ4, Δ5, Δ6, respectively.

For example, the following Eq. (7) must be met to compensate the a 2,1.

$$ \left({q}_{2,1}+\varDelta 1\right)\left({r}_{1,1}-\varDelta 3\right)={q}_{2,1}{r}_{1,1}={a}_{2,1} $$
(7)

That is,

$$ \varDelta 3=\frac{\varDelta 1{r}_{1,1}}{q_{2,1}+\varDelta 1} $$
(8)

As the same reason, Δ3 also need to meet the following Eq. (9) for compensating a 3,1 .

$$ \varDelta 3=\frac{\varDelta 2{r}_{1,1}}{q_{3,1}+\varDelta 2} $$
(9)

In order to keep the robustness of watermark, we adopt the following Eq. (10) to determine Δ3.

$$ \varDelta 3=\frac{1}{2}\left(\frac{\varDelta 1{r}_{1,1}}{q_{2,1}+\varDelta 1}+\frac{\varDelta 2{r}_{1,1}}{q_{3,1}+\varDelta 2}\right) $$
(10)

Similarly, Δ4, Δ5, Δ6are determined via the following equations, respectively.

$$ \varDelta 4=\frac{1}{2}\left(\frac{\varDelta 1{r}_{1,2}}{q_{2,1}+\varDelta 1}+\frac{\varDelta 2{r}_{1,2}}{q_{3,1}+\varDelta 2}\right) $$
(11)
$$ \varDelta 5=\frac{1}{2}\left(\frac{\varDelta 1{r}_{1,3}}{q_{2,1}+\varDelta 1}+\frac{\varDelta 2{r}_{1,3}}{q_{3,1}+\varDelta 2}\right) $$
(12)
$$ \varDelta 6=\frac{1}{2}\left(\frac{\varDelta 1{r}_{1,4}}{q_{2,1}+\varDelta 1}+\frac{\varDelta 2{r}_{1,4}}{q_{3,1}+\varDelta 2}\right) $$
(13)

Define the modified a 2,n , a 3,n as a ′2,n , a ′3,n when embedding operation is performed but compensatory operation is not adopted, and the modified a m,n as a ′ ′ m,n when compensatory operation is further used, here m = (1,2,3,4), n = (1,2,3,4). Note the compensatory operation may cause larger change than without the compensatory operation. Only the following condition Eq. (14) is true, the compensatory operation is further used; otherwise no modification is performed on r 1,1, r 1,2, r 1,3, r 1,4.

$$ {{\displaystyle \sum_{m=1}^4{\displaystyle \sum_{n=1}^4\left({a}_{m,n}^{\prime \prime }-{a}_{m,n}\right)}}}^2<{{\displaystyle \sum_{m=2}^3{\displaystyle \sum_{n=1}^4\left({a}_{m,n}^{\prime }-{a}_{m,n}\right)}}}^2 $$
(14)

3 The proposed watermarking scheme

In this section, a new double color image blind watermarking scheme based on QR decomposition is proposed. As shown in Fig. 1, the color watermark image is embedded into color host image and the final watermark can be extracted from the watermarked image without the original host image or watermark image. Without loss of generality, let the original host image H be 24-bit color image with size of M × M and the watermark image be 24-bit color image W with size of N × N. The detailed embedding procedures are as follows.

Fig. 1
figure 1

Block diagram of the proposed watermarking scheme

Full size image

3.1 Watermark embedding process

The summary process of the watermark embedding is shown in Fig. 2 and the detailed steps are listed as follows.

Fig. 2
figure 2

Watermark embedding process

Full size image
  1. Step 1.

    Pre-processing on the color watermark image

    Since the color image has much more information than the binary or grayscale image, its binarization process is important in that it will directly affect the embedded quality of watermarking. Firstly, 3-D original color watermark image W is divided into three components R, G, B by dimension-reduction treatment. Then, the 2-D component watermarks are obtained corresponding to the R, G and B component, respectively. In order to enhance the security and robustness of the embedded watermark, each component watermark is permuted by Arnold transform with private key KA i (i = 1, 2, 3) and each pixel value is converted to 8-bit binary sequence [3]. Finally, combining all 8-bit binary sequence to form the binary component watermark W i (i = 1, 2, 3).

  2. Step 2.

    Block processing of the host image

    The host image H is also divided into three components H i (i = 1, 2, 3), which represents the R, G and B component respectively, and each component image is divided into 4 × 4 non-overlapping blocks.

  3. Step 3.

    Selecting the embedding blocks

    The MD5-based Hash pseudo-random replacement algorithm with private key K i (i = 1, 2, 3) is used to select the embedding block in H i for embedding the corresponding component watermark W i [15]. The MD5 algorithm will be used to randomly select the non-collision embedding blocks to ensure the security of watermark.

  4. Step 4.

    QR decomposition

    Each selected block is decomposed by QR decomposition according to Eq. (1) to obtain the unitary matrix Q.

  5. Step 5.

    Embedding watermark

    The watermark is embedded by changing the magnitude relation between the second (q 2,1) and the third (q 3,1) elements in the first column of Q matrix. If the embedded watermark information bit is ‘1’, the difference between q 2,1 and q 3,1 should be greater than a threshold T. If the embedded binary watermark bit is ‘0’, the difference between q 3,1 and q 2,1 should be greater than a threshold T. When these two conditions are violated, q 2,1 and q 3,1 should be modified as q ′2,1 and q ′3,1 based on the following rules in Eqs. (15) and (16), respectively.

    $$ \begin{array}{llllll} if\hfill & w=1\hfill & and\hfill & {q}_{2,1}-{q}_{3,1}<T,\hfill & then\hfill & \left\{\begin{array}{l}{q}_{2,1}^{\prime }={q}_{avg}+T/2\\ {}{q}_{3,1}^{\prime }={q}_{avg}-T/2\end{array}\right.\hfill \end{array} $$
    (15)
    $$ \begin{array}{llllll} if\hfill & w=0\hfill & and\hfill & {q}_{3,1}-{q}_{2,1}\le T\hfill & then\hfill & \left\{\begin{array}{l}{q}_{2,1}^{\prime }={q}_{avg}-T/2\\ {}{q}_{3,1}^{\prime }={q}_{avg}+T/2\end{array}\right.\hfill \end{array} $$
    (16)

    where w indicates the embedded binary watermark information bit and q avg  = (q 2,1 + q 3,1)/2.

  6. Step 6.

    If the condition of Eq. (14) is true, then according to the mentioned compensatory method in Section 2.3 to compensate the related elements in R matrix.

  7. Step 7.

    Inverse QR operation

    The inverse QR operation is performed to obtain the watermarked image block according to Eq. (17).

    $$ A\prime =Q\prime \times R $$
    (17)
  8. Step 8.

    Repetition

    Repeating steps 4–7 until all watermark bits are embedded in the host image. Finally, the watermarked R, G, B components are reconstructed to obtain the watermarked image H′.

Since all information of color image watermark has been embedded into the host image, which means the final extracted watermark will be decided by the all watermark information bits but is not the partial watermark information, the false-positive detection problem like in SVD-based algorithm will not happen.

3.2 Watermark extraction process

According to whether the original host image and watermark image are needed in the extraction procedure, the watermarking scheme could be categorized into blind scheme or non-blind scheme. As shown in Fig. 3, the watermark extraction procedure belongs to blind extraction method, that is, the original host image and watermark image are not needed in the procedure. The detailed steps of the watermark extraction are described as follows.

Fig. 3
figure 3

Watermark extraction process

Full size image
  1. Step 1.

    Pre-processing on the watermarked image

    The watermarked image H′ is divided into R, G, B component images, which are further divided into watermarked blocks with size of 4 × 4 pixels, respectively.

  2. Step 2.

    Select the watermarked block

    Using the Hash pseudo-random replacement based on private key K i (i = 1, 2, 3) to select the watermarked blocks.

  3. Step 3.

    QR decomposition

    Each watermarked block is decomposed by QR decomposition and its unitary matrix Q′ is obtained.

  4. Step 4.

    Extract watermark

    The relation between q ′2,1 and q ′3,1 in the first column of Q′ is used to extract the watermark information w′, as shown in Eq. (18).

    $$ w\prime =\left\{\begin{array}{lll}1,\hfill & if\hfill & {q}_{2,1}^{\prime}\ge {q}_{3,1}^{\prime}\hfill \\ {}0,\hfill & if\hfill & {q}_{2,1}^{\prime }<{q}_{3,1}^{\prime}\hfill \end{array}\right. $$
    (18)
  5. Step 5.

    Repetition

    The above steps 2–4 are repeated until all embedded image blocks are performed. These extracted bit values are partitioned into 8-bit groups and converted to decimal pixel values.

  6. Step 6.

    Reconstruction

    Each component watermark is transformed by the inverse Arnold transformation based on the private key KA i (i = 1, 2, 3). Then, the final extracted watermark W′ is reconstructed from the extracted watermarks of the three components.

4 Experimental results and discussion

In this experiment, all 24-bit 512 × 512 color images in the CVG-UGR image database are used as the host images [20]. Additionally, two 24-bit color images with size of 32 × 32, as shown in Fig. 4(a), (b), are used as original watermarks. Generally, the bigger the size of image block is, the smaller the watermark capacity is, the worse the watermark invisibility is and the better the watermark robustness is, vice verse. Meanwhile, the bigger the threshold T is, the worse the watermark invisibility is and the better the watermark robustness is, vice verse. Considering the tradeoff between the invisibility and the robustness of watermarking and based on many experiments, let the size of image block be 4 × 4 and the threshold T be 0.042.

Fig. 4
figure 4

Original watermark images: a PEUGEOT logo, b 8-color image; Original host images: c Lena, d Avion, e Peppers, f TTU

Full size image

The performance of the watermarking methods under consideration is investigated by measuring their imperceptible and robust capabilities. For the imperceptible capability, the structural similarity (SSIM) index as a new method is used to measure the similarity between the original color image H and the watermarked image H′. SSIM is designed to improve on traditional methods like peak signal-to-noise ratio (PSNR) and mean squared error (MSE), which have proved to be inconsistent with human eye perception [21]. For the robust capability, the Normal cross-Correlation (NC) measures the similarity between the original color watermark W and the corresponding extracted watermark W′ [17]. Besides NC, the above-mentioned SSIM is also used to evaluate and compare the visual quality of extracted watermarks in section 4.1.

To investigate the robustness of the proposed method, different host images and different watermarks are adopted to compare with the methods of [7] and [5], and several attacks are simulated to degrade the watermarked images.

4.1 The watermark invisibility comparison between different methods

When the different watermark images in Fig. 4(a) and (b) were respectively embedded into all 512 × 512 color images of the CVG-UGR image database, the average SSIM values of all watermarked images, the average SSIM values and NC values of extracted watermark images were obtained and shown in Table 2. Based upon this experiment, we draw the conclusion that the proposed method can effectively to embed and extract color watermark image.

Table 2 The average results when the different watermark images are respectively embedded into all 24-bit 512 × 512 color images of the CVG-UGR image database
Full size table

As an example, in order to evaluate the invisibility of the embedded watermark, we embed the watermark of Fig. 4(a) in the host images of Fig. 4(c) and (d), and embed the watermark of Fig. 4(b) in the host images of Fig. 4(e) and (f), respectively. Here, Fig. 4(c), (d) and (e) are three standard images of the CVG-UGR image database, and Fig. 4(f) is a common image that will be used to compare with the method [5] in the following section 4.2.

Figure 5 not only gives the watermarked color images and their SSIM values, but also shows the extracted watermark and their NC and SSIM values. By comparison, it can be seen that Song et al. [16] based on QR decomposition could not extract good watermark and the host image is obviously modified via embedding the watermark, which can not meet the need of watermark invisibility. Thus, this method of Song et al. [16] is not suitable for embedding color watermark image into color host image. Golea et al. [7] and the proposed method have better watermark imperceptibility, but the former has lower NC and SSIM values than the latter. Thus, the proposed method not only has better watermark invisibility, but also can effectively extract the embedded watermark. To further prove the other performances of the proposed method, the different comparisons with the relating methods are made in the following sub-section.

Fig. 5
figure 5

The watermarked color images and the extracted watermarks without any attacks

Full size image

4.2 The watermark robustness comparison between different methods

4.2.1 Comparison with the SVD-based algorithm

In this sub-section, various attacks such as JPEG compression, JPEG2000 compression, cropping, adding noise, scaling, filtering, rotation, blurring et al. are performed on the watermarked image to estimate the robustness of the proposed method, and compare the proposed method with the related work [7]. For saving some space, we give the extracted results from the attacked images Lena and F16 after the watermark of Fig. 4(a) was embedded into.

JPEG is one of the most used formats in the Internet and digital camera. The JPEG quality factor is a number between 0 and 100. When the quality factor is decreased from 100, the image compression is improved, but the quality of the resulting image is significantly reduced. In this experiment, the watermarked images are compressed with different compression factors from 10–100 increasing in steps of 10. Figure 6 gives the part of the results. Compared with the method [7], the proposed scheme achieves better robust against the JPEG compression.

Fig. 6
figure 6

The extracted watermarks via using different methods after the JPEG compression operation

Full size image

JPEG 2000 is developed by the JPEG in the aim of improving the properties of the JPEG standard. The watermarked images are also performed by JPEG 2000 compression with the compression ratio from 1–10 increasing in steps of 1. Figure 7 gives the NC values, SSIM values and visual-perception results with compression ratios of 5 and 10, respectively.

Fig. 7
figure 7

The extracted watermarks via using different methods after the JPEG 2000 compression operation

Full size image

In addition, a salt & peppers noising scheme is performed by generating noise to corrupt the watermarked images. The noising scheme generates 2 % and 10 % noise, respectively, to degrade the watermarked images. Figure 8 shows the quantitative results in terms of the NC, SSIM and visual-perception, respectively. It is evident from these results that the proposed method is more robust against salt & peppers noise attacks than the method [7].

Fig. 8
figure 8

The extracted watermarks via using different methods after the salt & peppers noising operation

Full size image

Moreover, the Gaussian noising is also added to corrupt the watermarked images. The mean of Gaussian parameters are set to 0.1, 0.3, respectively. The extracted watermarks, NC values and SSIM values are shown in Fig. 9. The robustness of the proposed method is superior to that of the method [7] when the mean parameter is smaller. However, the bigger the Gaussian parameter is, the weaker the robustness is. Hence, it must be further improved in the future work.

Fig. 9
figure 9

The extracted watermarks via using different methods after the Gaussian noising operation

Full size image

Figure 10 shows the NC values, SSIM values and visual-perception results after low-pass filters attack. In this experiment, the Butterworth low-pass filters are used to corrupt the watermarked images with cut-off frequency 100, and order 1, 3, respectively.

Fig. 10
figure 10

The extracted watermarks via using different methods after the low-pass filter operation

Full size image

Figure 11 gives the result of sharpening attack. In the procedure of sharpening, the radii are 0.2 and 1.0, respectively. It is proved that the proposed method outperforms the method [7]. We can notice that the extracted watermarks closely resemble the original watermarks.

Fig. 11
figure 11

The extracted watermarks via using different methods after the sharpening operation

Full size image

Figure 12 shows the quantitative results and visual-perception results for the case of scaling, respectively. In this experiment, two scaling operations of 400 % and 25 % are utilized to deteriorate the watermarked image.

Fig. 12
figure 12

The extracted watermarks via using different methods after the scaling operation

Full size image

In the blurring attacks, two cases are simulated here to degrade the two watermarked images. The radius in the first case is 0.2, while the second case is 1.0. Figure 13 exhibits the results of visual comparison and quantitative values. It is evident that the proposed method is more robust than the method [7] in this case.

Fig. 13
figure 13

The extracted watermarks via using different methods after the blurring operation

Full size image

In order to test the robustness against rotation attacks, two experiments are investigated. One involves rotating the watermarked image to the right by 5°. The other experiment involves rotating the watermarked image to the right by 30°. The images are first rotated a certain number of degrees clockwise, and then are rotated the same number of degrees counterclockwise. Such rotation attacks are simulated to mimic the occurrence of truncation errors which degrade the image. Consequently, the method [7] is not robust to geometric transform (rotation and scaling) as shown in Fig. 14.

Fig. 14
figure 14

The extracted watermarks via using different methods after the rotation operation

Full size image

In the cropping attack, two cases are simulated here to crop the two watermarked images. The first case is cropped by 25 %, while the second case is cropped by 50 %. Because the watermark used in [7] is not permuted, the position and size of cropping can fully affect the watermark in the cropped region. In Fig. 15, there is a black region in the extracted watermark, which means the watermark information in this region is fully deleted by cropping attack. Hence, the quality of the proposed method outperforms the method [7].

Fig. 15
figure 15

The extracted watermarks via using different methods after the cropping operation

Full size image

4.2.2 Comparison with the spatial-domain algorithm

In order to further prove the robustness, the proposed methods are also compared with the spatial domain method [5]. In the spatial domain method, each color pixel’s color quantization index, which is modified to carry the watermark in the embedding process, is encoded; however, the color gamut and quantization table are required in the extraction.

Two color images, as shown in Fig. 4(e) and (f), were used as the host image and 8-color image of Fig. 4(b) was taken as the watermark image in [5]. For fair comparison, we also use these host images and watermark image to carry out the experiment under same attack styles in [5]. Figures 16 and 17 respectively shows the comparison results using Peppers, TTU as the host image. These results reveal that the proposed algorithm is more robust. In most cases, the performance of the proposed method is superior to the method in [5] except the adding Gausssian noise with larger parameter. In [5], the changed color values for various attacks have directly affected the mapping relation between the original color value and the color table, which results in the degraded quality of extracted watermark.

Fig. 16
figure 16

The watermarks extracted from the attacked Peppers images via using different methods

Full size image
Fig. 17
figure 17

The watermarks extracted from the attacked TTU images via using different methods

Full size image

4.3 The execution time comparison of different algorithms

We carried out the simulations on the platform of 2.27GHZ CPU, 2.00GB RAM, Win 7, MATLAB 7.10.0 (R2010a). After many times running, as can be seen from Table 3, the average execution time of the proposed method is less than that of [7]. This means that SVD is more complex than QR decomposition, which is because the QR decomposition is an intermediate step in SVD and the time complexity for SVD is typically worse than for QR decomposition [10]. Meanwhile, the average execution time of the proposed algorithm is also less than that of [5], which is because the host image needs to be transformed to the CIE-Lab color space for the color quantization and its inverse-transformation is also required in [5]. Therefore, one should notice that the proposed algorithm requires much less number of computations.

Table 3 The comparison of execution time between different methods (Second)
Full size table

4.4 The security of the proposed method

4.4.1 Security analysis

In this paper, in order to enhance the security and robustness of the watermarking, each component watermark is permuted by Arnold transform with private key KA i (i = 1, 2, 3). When the component watermark is extracted from the watermarked image, nobody can rearrange the watermark without the private key KA i (i = 1, 2, 3).

Moreover, the MD5-based Hash pseudo-random replacement algorithm with private key K i (i = 1, 2, 3) is used to select the random and non-collision embedding blocks. The feature of Hash algorithm is to map the packets of any length into a fixed length of Hash code, which is a function of information in each packet. Any change in the message will result in the change of Hash code. It should be pointed out that, in the proposed method, MD5 is applied to the specific Hash function [15], which makes it difficult for the third party to extract the watermark integrally without the keys. Hence, this proposed algorithm is of higher security.

4.4.2 Security measurement

In order to prove the security of the proposed method, we use different private keys to extract watermark. Figure 18 gives the watermark image extracted from the watermarked image Lena. As can be seen from the figure, the right watermark can be extracted only if the private keys K and KA are right. Moreover, the attacker without the right keys can only try all possible forms of the keys until he believes that the original image has been obtained through exhaustive manner, which is an NP-hard problem. If the attacker does not know the range of keys generation, then he needs to try the infinitely many possibility; when attacker tries wrong keys, he will obtain an image that no actual visual significance [12].

Fig. 18
figure 18

The extracted watermark with different keys

Full size image

4.5 The watermark capacity analysis of the proposed method

In this paper, the 24-bit 32 × 32 color image is embedded into the 24-bit 512 × 512 color host image. The proposed method and Golea et al. [7] have the same watermark capacity. The watermark capacity of Chou et al. [5] can achieve 0.48bpp (bit per pixel) that is more than that of [7] or our method. Since the watermarking capacity, invisibility and robustness are contradict, the watermarking capacity of the proposed method is acceptable in the premise of ensuring the watermarking invisibility and robustness.

5 Conclusions

In this paper, a double color image watermarking scheme has been proposed. The strong correlation, between the second row first column coefficient q2,1 and the third row first column coefficient q3,1 in the unitary matrix Q of QR decomposition, has been utilized to embed and extract watermark. Watermark invisibility has been achieved by the presented compensatory method in R matrix. Watermark robustness has been ensured by coefficients q2,1 and q3,1 in the unitary matrix Q. Watermark security has been enhanced by the Arnold transform and the MD5-based Hash pseudo-random replacement algorithm with different private keys. Experimental results have shown that this proposed algorithm not only attains higher invisibility of watermarking, but also has stronger robustness in the various distortion operations. On-going works is to improve this watermarking scheme more robust to add Gaussian noise and extend that to color video watermarking.