1 Introduction

With the fast development of digital products, a series of urgent security issues such as the illegal copying and distortion of private information have been deeply concerned [17, 20, 41, 43]. Digital watermarking is considered as an effective solution to these security issues [16, 25]. Generally, digital watermarking is achieved by embedding the private information into the host image [12, 14]. Invisibility, robustness, security and payload are necessary for an excellent watermarking scheme [2, 13, 26, 35]. The invisibility in a watermarking algorithm refers to the cover image and the watermarked one should be similar enough to avoid being noticed. And the robustness of watermarks indicates that the watermark algorithm is able to resist against common attacks, such as JPEG compression, noise attacks and geometric attacks, etc. The security means that watermark extraction in a watermarking scheme relies on the secret key. The payload implies that the total amount of information can be hidden into the cover image. Generally, digital watermarking can be implemented in frequency domain and spatial domain [27, 39]. The watermarking schemes in the spatial domain generally embed the watermark by altering a set of pixel values of the cover image directly [3]. This kind of spatial domain watermarking algorithm with low complexity is easy to implement but fragile to most common attacks, for example JPEG compression and filtering. While the kind of frequency domain watermarking technique is achieved by modulating the frequency coefficients of the cover image, which can increase the invisibility and robustness [42]. The most popular watermarking techniques in the frequency domain are mainly based on mathematical transforms, such as discrete cosine transform (DCT) [5, 8], discrete Fourier transform (DFT) [4, 19, 34], discrete wavelet transform (DWT) [1, 22, 38] and contourlet transform (CT) [9, 10]. Because of marvelous spatial localization and multi-resolution characteristics of the discrete wavelet transform, the DWT is widely applied in the field of digital watermarking algorithms. Singh D et al. investigated a robust watermarking algorithm based on DWT-SVD and DCT, where watermark encoding is realized by the Arnold cat map [33]. Kang X B et al. proposed a robust and invisible blind watermarking technique by fusing DCT and SVD in the DWT domain, where the embedding strength is selected by the least-square curve fitting [15]. Contourlet transform makes up the directional limitation over wavelet transform and provides a multi-scale and multi-directional representation for high dimension signal with smooth contours [37]. Sadreazami H et al. designed a novel multiplicative watermarking scheme with the univariate and bivariate alpha-stable distributions in the contourlet transform domain [31]. Chen L et al. proposed a new blind image watermarking scheme based on CT and principal component analysis, which is robust to geometric attacks and compressions [6]. As an expansion of the traditional contourlet transform, the non-subsampled contourlet transform (NSCT) can effectively represent high dimension signal with more directional information. Niu P P et al. presented a non-blind watermarking algorithm by combining support vector regression with non-subsampled contourlet transform for color image to resist geometric distortions [28]. However, most of the above-mentioned schemes in the frequency domain embed a binary logo of size 32 × 32 into a 512 × 512 gray-scale image, thereby leading to low payload of the watermarking, unsatisfactory or imperfect robustness and invisibility. Especially, the security of the watermark is ignored in some watermarking schemes. To further simultaneously increase the performance of payload, robustness, invisibility and security, a new blind watermarking algorithm is presented by combining non-subsampled contourlet transform with Schur decomposition. To enhance the security, the original watermark is pre-scrambled by logistic chaotic map and Arnold transform. To reconstruct the watermarked image more efficiently and enhance the hiding capacity, the cover image is decomposed by the two level non-subsampled contourlet transform. And the largest energy element of upper triangular Schur matrix is modified to embed the encrypted watermark sequence with a quantification technique. Then the invisibility of watermarked image is guaranteed by modifying only one element. Moreover, the performance of resisting geometrical attacks is improved by SIFT.

The style of this paper is organized as follows. The related fundamental theories are given in Section 2. The processes of watermark encryption, watermark embedding and watermark decryption are introduced in Section 3. And the simulation results are discussed in Section 4. Finally, a short conclusion is drawn in Section 5.

2 Fundamental theories

2.1 Non-subsampled contourlet transform

Non-subsampled contourlet transform is an improvement over contourlet transform, which efficiently represents typical image with more directional information, including edges and smooth contours [7]. Besides, the non-subsampled contourlet transform is a redundant transform that can increase the capacity of the watermarking system. Usually, the non-subsampled contourlet transform is constructed in two stages: non-subsampled pyramid (NSP) and non-subsampled direction filter banks (NSDFB) [40]. Firstly, the NSP is used to ensure multi-scale property. Then NSDFB provide the directionality of the non-subsampled contourlet transform.

2.2 Schur decomposition

The Schur decomposition is an intermediate step of the singular value decomposition (SVD), which plays a very important role in mathematical linear algebra [18, 30]. The Schur decomposition of a real matrix Y is defined as

$$ \mathrm{Y}=\mathrm{U}\times \mathrm{S}\times {\mathrm{U}}^T, $$
(1)

where the superscript T indicates the matrix transposition operation, and U and S are unitary matrix and upper triangular matrix, respectively.

Comparing with the SVD, the Schur decomposition has low computational complexity, which guarantees its successful applications in the field of digital watermarking. According to Table 1, the Schur decomposition only cost less than 1/3 of computing resources in comparison with SVD. Besides, the upper triangular matrix S has good stability. In this regard, the robustness can be improved when embedding the watermark into the matrix S. To guarantee the invisibility, the watermark information is embedded into the upper triangular matrix S with an optimal quantification in this paper.

Table 1 Time complexity for different matrix factorization techniques
Full size table

2.3 Arnold transform and logistic map

The security of the proposed watermarking scheme is ensured by logistic chaotic map and Arnold transform [29, 32]. The Arnold transform is defined as

$$ \left[\begin{array}{c}{m}^{\prime}\\ {}{n}^{\prime}\end{array}\right]=\left[\begin{array}{cc}1& a\\ {}b& ab+1\end{array}\right]\left[\begin{array}{c}m\\ {}n\end{array}\right]\left(\operatorname{mod}N\right), $$
(2)

where a and b represent two positive numbers, N is the order of watermark and (m, n) denotes the pixel point.

Logistic chaotic map is defined as

$$ {g}_{n+1}=\mu {g}_n\left(1-{g}_n\right),{g}_n\in \left(0,1\right). $$
(3)

The bifurcation diagram of logistic chaotic map is shown in Fig. 1. It can be seen in it, the logistic map becomes chaotic when μ ∈ [3.57, 4].

Fig. 1
figure 1

The bifurcation diagram of logistic chaotic map

Full size image

In this paper, a chaotic sequence generated from Eq. (3) is converted to a binary sequence for watermark encryption. And three binary logos with different sizes are selected as test watermarks. Each of them is pre-scrambled by Arnold transform and logistic map. The encrypted watermarks are shown in Fig. 2 (a1)-(c1).

Fig. 2
figure 2

Binary watermarks and their corresponding encrypted watermarks of difference sizes: (a) Watermark A of size 32 × 32; (b) Watermark B of size 48 × 48; (c) Watermark C of size 64 × 64; (a1) Scrambled image for watermark A; (b1) Scrambled image for watermark B; (c1) Scrambled image for watermark C

Full size image

2.4 Scale invariant feature transform

To make up the weakness in resisting geometrical attack of traditional watermarking schemes, a synchronization mechanism based on the scale invariant feature transform (SIFT) is presented. SIFT is used to extract the distinctive features from typical images, which can be invariant to image scale and rotation [24]. The major stages of SIFT are listed as follows.

Step1 Scale-space extrema detection: The difference of Gaussian function (DOG) is used to identify the potential interest points that are invariant to scale and orientation.

Step2 Keypoint localization: In this stage, the detailed models at each candidate location are built to determine location and scale. And the keypoints are selected by measuring their stability.

Step3 Orientation assignment: One or more orientations are assigned to each keypoint location according to local image gradient directions. Besides, all future operations are executed after transforming relative to the assigned orientation, scale and location for each feature, which can provide the invariance to these transformations.

Step4 Keypoint descriptor: The local image gradients are measured at the selected scale in the region around each keypoint.

Figure 3 shows the results of SIFT.

Fig. 3
figure 3

Keypoints matching with SIFT algorithm

Full size image

In this paper, the SIFT is applied to design a synchronization mechanism. Firstly, the keypoints in watermarked image and the attacked one are extracted and matched. Any two keypoints in watermarked image are connected for constructing directional vector D1. The corresponding two keypoints in the attacked image are connected for constructing vector D2. Let \( {\mathrm{D}}_1=\overrightarrow{\left({x}_1,{y}_1\right)} \) and \( {\mathrm{D}}_2=\overrightarrow{\left({x}_2,{y}_2\right)} \). Then the geometrical distortion parameters are obtained as follows.

  1. (1)

    The measured scale parameter Ms is generated by computing the scale radio of two directional vectors.

$$ Ms=\frac{\sqrt{{x_1}^2+{y_1}^2}}{\sqrt{{x_2}^2+{y_2}^2}} $$
(4)
  1. 2

    The measured rotation parameter Mr is obtained by calculating the angle of two vectors.

$$ Mr=\mathit{\operatorname{arccos}}\frac{x_1{x}_2+{y}_1{y}_2}{\sqrt{{x_1}^2+{y_1}^2}\sqrt{{x_2}^2+{y_2}^2}} $$
(5)

3 Blind watermarking algorithm

The presented watermarking algorithm consists of watermark encryption, watermark embedding, watermark extraction and watermark decryption. The detailed procedures of the proposed watermarking method are described as follows and shown in Figs. 4 and 5.

Fig. 4
figure 4

Watermark embedding process

Full size image
Fig. 5
figure 5

Watermark extraction stage

Full size image

3.1 Watermark encryption

Before embedding the watermark into the cover image, the original watermark is scrambled with Arnold transform and logistic map, respectively.

Step 1 By applying the Arnold transform on the original watermark W of size N × N, the scrambled watermark image W∗ is generated.

Step 2 The scrambled watermark image W∗ is then converted into a binary sequence \( {\mathrm{W}}_o^{\ast } \) of size 1 × N2. Then the encrypted watermark sequence We is generated as

$$ {\mathrm{W}}_e={\mathrm{W}}_o^{\ast}\oplus \mathrm{LB} $$
(6)

where ⊕ is the XOR operation and LB is a binary sequence generated from Eq. (3).

3.2 Watermark embedding

Step 1 The cover image I is decomposed with a two-level non-subsampled contourlet transform to obtain a low pass sub-band and five directional sub-bands. To guarantee the robustness of the watermark, the low pass sub-band of non-subsampled contourlet transform is selected for watermark insertion.

Step 2 The low pass sub-band L of the non-subsampled contourlet transform is divided into some 8 × 8 non-overlapping blocks Bi(i = 1, 2, …, N).

Step 3 For each block

  1. 1

    By applying the Schur decomposition on the non-overlapping block and the maximal value x in the upper triangular matrix is extracted.

$$ \left[\mathrm{U},\mathrm{S}\right]=\mathrm{Schur}\left(\mathrm{B}\right) $$
(7)
$$ x=\mathrm{S}\left(1,1\right) $$
(8)

where U and S are the results of Schur decomposition.

  1. 2

    The encrypted watermark sequence is embedded by modifying the value of x as follows.

$$ {x}^{\prime }=\left\{\begin{array}{c}x-\lambda +\frac{1}{4}\sigma, {\mathrm{W}}_e=0\&\lambda \in \left[0,\frac{3}{4}\sigma \right);\\ {}x-\lambda +\frac{5}{4}\sigma, \kern0.5em {\mathrm{W}}_e=0\&\lambda \in \left[\frac{3}{4}\sigma, \sigma \right);\\ {}x-\lambda -\frac{1}{4}\sigma, \kern0.5em {\mathrm{W}}_e=1\&\lambda \in \left[0,\frac{1}{4}\sigma \right);\\ {}x-\lambda +\frac{3}{4}\sigma, \kern0.5em {\mathrm{W}}_e=1\&\lambda \in \left[\frac{1}{4}\sigma, \frac{3}{4}\sigma \right).\end{array}\right)\operatorname{} $$
(9)

In Eq. (9), x′ is the modified value in the upper triangular matrix S, σ indicates quantification step and λ = mod (x, σ).

  1. 3

    The modified matrix S∗ is generated by replacing the largest energy element with x′.

$$ {\mathrm{S}}^{\ast}\left(1,1\right)={x}^{\prime }. $$
(10)
  1. 4

    The altered coefficients block B∗ is obtained by the inverse Schur decomposition.

$$ {\mathrm{B}}^{\ast }={\mathrm{U}\mathrm{S}}^{\ast }{\mathrm{U}}^{\prime }. $$
(11)

By repeating Step 3, the encrypted watermark sequence can be embedded into the low pass sub-band of the non-subsampled contourlet transform.

Step 4 The watermarked image I∗ is obtained by the inverse non-subsampled contourlet transform.

3.3 Watermark extraction

Step 1 Two-level non-subsampled contourlet transform is applied on the received image I∗.

Step 2 The low pass sub-band of non-subsampled contourlet transform is segmented into some non-overlapping blocks.

Step 3 For each block:

  1. 1

    The upper triangular matrix SΔ is obtained by the Schur decomposition and its maximal value is extracted.

$$ {x}^{\ast }={\mathrm{S}}^{\Delta}\left(1,1\right). $$
(12)
  1. 2

    The encrypted watermark bit \( {\mathrm{W}}_e^{\prime } \) is extracted as follows. Suppose λ∗ = mod (x∗, σ). If \( {\lambda}^{\ast }<\frac{1}{2}\sigma \), then \( {\mathrm{W}}_e^{\prime }=0 \). If \( {\lambda}^{\ast}\ge \frac{1}{2}\sigma \), then \( {\mathrm{W}}_e^{\prime }=1 \).

The encrypted watermark sequence W/ can be extracted by repeating Step 3.

3.4 Watermark decryption

The watermark decryption is the inverse process of watermark encryption. Firstly, the XOR operation is applied on the extracted watermark sequence W/ with a binary sequence LB.

$$ {\mathrm{W}}_d={\mathrm{W}}^{/}\oplus \mathrm{LB}. $$
(13)

Then the decrypted watermark Wd is reshaped and converted by Arnold transform to generate the recovered watermark image Wr of size N × N.

4 Experiment results and analyses

To evaluate the performance of the presented watermarking algorithm, four gray images of size 512 × 512 are selected as test cover images, as shown in Fig. 6, i.e., ‘Man’, ‘Baboon’, ‘Peppers’ and ‘Couple’. And three binary logos of different sizes shown in Fig. 2 (a)-(c) are chosen as the test watermarks. The parameters a, b, μ and g0 in the watermark encryption stage are set as 1, 1, 3.611 and 0.5152, respectively. The quantification step is 70.

Fig. 6
figure 6

Cover images of size 512 × 512

Full size image

4.1 Invisibility analysis

Peak signal to noise ratio (PSNR) [23] and structural similarity index (SSIM) [11] are adopted to evaluate the invisibility of the proposed blind watermarking scheme. SSIM can measure the similarity of two images with same size.

$$ \mathrm{SSIM}\left(\mathrm{I},{\mathrm{I}}^{\ast}\right)=\frac{2{\mu}_{\mathrm{I}}{\mu}_{{\mathrm{I}}^{\ast }}+{p}_1}{\mu_{{\mathrm{I}}^{\ast}}^2+{\mu}_{\mathrm{I}}^2+{p}_1}\times \frac{2{\sigma}_{{\mathrm{I}}^{\ast}\mathrm{I}}+{p}_2}{\sigma_{{\mathrm{I}}^{\ast}}^2{\sigma}_{\mathrm{I}}^2+{p}_2} $$
(14)

where I and I∗ are original cover image and watermarked one, respectively; μI and \( {\mu}_{{\mathrm{I}}^{\ast }} \) are the mean values of I and I∗, respectively. The definition of PSNR is

$$ \mathrm{PSNR}=20\log \frac{255}{\sqrt{\mathrm{MSE}}} $$
(15)
$$ \mathrm{MSE}=\frac{1}{M\times N}\sum \limits_{i=1}^M\sum \limits_{j=1}^N{\left[f\left(i,j\right)-\hat{f}\Big(i,j\Big)\right]}^2. $$
(16)

where f and \( \hat{f} \) denote original cover image and watermarked one of size M × N. (i, j) represents the pixel position.

The result of the proposed watermarking method for embedding watermark A is shown in Fig. 7. And the PSNR and the SSIM values are compiled in Table 2. From Fig. 7, it can be seen that there are no obvious differences between original cover images and watermarked ones. Besides, the corresponding watermarks can be recovered completely without attack.

Fig. 7
figure 7

Results of four test images for embedding watermark A

Full size image
Table 2 The invisibility of the presented watermarking scheme without attack
Full size table

As can be seen in Table 1, the average value of PSNR is larger than 40 dB and the SSIM is close to 1 even if a watermark of size 64 × 64 is embedded. And the PSNR value is larger than 46 dB for embedding a 32 × 32 watermark, which signifies the high invisibility of the watermarking algorithm since only one element of the upper triangular Schur matrix is modified during the watermark embedding.

4.2 Robustness analysis

The bit error rate (BER) is employed to show the performance of robustness. Figure 8 gives the results under various attacks and the bit error rate values are given in Table 3. As can be seen in Fig. 8, the recovered original watermark logo appears slight distortion under various attacks, which indicates the robustness of the proposed watermarking algorithm is acceptable.

Fig. 8
figure 8

The watermarked images under different attacks and their corresponding extracted watermarks: (a) JPEG compression (30%); (b) Gaussian noise 0.001; (c) Salt and Pepper noise 0.005; (d) Multiplicative noise 0.005; (e) Median filtering 3 × 3; (f) Cropping 1/16; (g) Rotation 3°; (h) Low pass filtering

Full size image
Table 3 Experimental results under different attacks
Full size table

To resist the geometrical attacks, a synchronization mechanism with SIFT is offered. The distortion parameters are measured and the attacked image is corrected according the measured parameters. Table 4 lists the measured geometric distortion parameters. The performance of resisting geometrical attacks is given in Fig. 9 and Table 5. It is shown that the measured parameters are closer to the actual values and the extracted watermark is clearly visible.

Table 4 The measured parameters by SIFT
Full size table
Fig. 9
figure 9

Results of geometrical attacks: (a)-(d) Performances of resisting scaling (0.8); (e)-(h) Performance of resisting rotation (10o)

Full size image
Table 5 Results for geometrical attacks
Full size table

According to Table 6, the BER values under most of attacks are below than 0.1. In another word, the proposed blind watermarking scheme is robust for most common attacks as the low pass sub-band of the non-subsampled contourlet transform is selected for embedding watermark. Particularly, the original watermark can be extracted completely when suffering from JPEG compression (50%). And the performance for resisting Median filtering and Rotation is great.

Table 6 Experimental results under different attacks for embedding watermark A
Full size table

4.3 Comparison

To verify the performance of the proposed blind watermarking scheme, comparative experiments with the typical algorithms [15, 21, 36] are executed. A binary logo of size 32 × 32 is selected as a test original watermark and a gray image of size 512 × 512 is chosen as a test cover image. The results are compared in Table 7. From Table 3, the BER values under most attacks are smaller than those with other algorithms, which means the robustness of the proposed watermarking scheme is better. And the presented watermarking method also performs better in terms of invisibility, since the PSNR is up to 47.38 dB. In [15], the low frequency sub-band of cover image in the DWT domain was selected for watermark insertion to guarantee the robustness, however a significant distortion of the watermarked image is inevitable since a multiplicative method is employed in the watermark insertion stage. The blind watermarking scheme based on quaternion singular value decomposition was presented to balance the transparency and the robustness with two threshold values [21], and it performs well in terms of invisibility but poor for filtering. Su Q T et al. designed a new color image watermarking algorithm based on the LU decomposition [36], which is good at resisting Salt and Pepper noise but is not robust for rotation and filtering attacks. Obviously, the proposed blind watermarking scheme is superior in terms of invisibility and robustness under most common attacks. In addition, the watermarking schemes in [15, 21] both embed a binary logo of size 32 × 32 into a 512 × 512 gray-scale image, thus the payload of these methods is 1024 bits, while the proposed blind watermarking method can embed a binary watermark of size 64 × 64 when the host gray images are same.

Table 7 Comparison results among four watermarking schemes
Full size table

Bold data represents the better performance in terms of robustness; ‘-’ indicates the watermark unable to be extracted.

5 Conclusions

Based on non-subsampled contourlet transform and Schur decomposition, a secure and blind watermarking algorithm is presented in this work. The cover image is decomposed with the two-level non-subsampled contourlet transform and its low pass sub-band is selected as watermark insertion to enhance the robustness. Before embedding into the cover image, the original watermark is scrambled with logistic chaotic and Arnold transform to provide an extra level of security. And the invisibility is ensured with a quantification technique. In the watermark extraction stage, the encrypted watermark sequence can be recovered without the host image. Experimental results demonstrate the proposed blind watermarking scheme is superior in terms of invisibility, robustness and payload in comparison with some typical watermarking algorithms. However, the performance against scaling and low pass filtering can be improved further.