FR2837039A1 - Digital signal watermark insertion having step calculating first control bit representing key and step supplementary insertion information bits with insertion supplementary information bits/different calculation operation - Google Patents

Abstract

The watermarking method has a step (E1) calculating the first coefficient of a first control bit representing a key (Ks). There is a step (E2) of insertion of supplementary information bits with calculation (E4,E5) of a second key. A second operation calculates the result of the first control bit, and a calculation follows a predetermined operation different to the resultant calculation of the first bit.

Description

<Desc / Clms Page number 1>

 The present invention relates to a method of inserting additional information such as a secret mark in a digital signal.

 It also relates to a method of extracting the secret mark with a view to authenticating the digital signal from the secret mark which had been inserted into the signal.

 Correlatively, the present invention relates to a device for inserting additional information and an extraction device adapted respectively to implement the insertion and extraction methods according to the invention.

 The present invention relates generally to the authentication of digital data, and more particularly of digital images. Its purpose is to allow the detection of changes in original digital data.

 More specifically, the invention is in the technical field of marking (watermarking in English) of digital data which can be interpreted as the insertion of a seal in the digital data, allowing to authenticate the content of a original digital data file. The marking is then said to be fragile, since the additional information inserted must be degradable in a detectable manner when the marked image has been subjected to distortions.

<Desc / Clms Page number 2>

 Thus, it is possible to decide if a document is authentic, that is to say if it contains an unmodified identification mark or if it has been modified compared to an initial authenticated version.

 The state of the art in fragile labeling is described by E. T. Lin and E. J. Delp in A review of fragile image watermarks, in Proc. Multimedia and Security Workshop (ACM Multimedia'99), pages 25-29, Orlando, 1999.

 For example, French patent applications No. 2,786,583 and No. 2,787,604 describe fragile marking techniques.

 These techniques use a public decoding key.

 Most tag authentication methods have a security issue. Indeed, a hacker who has the public decoding key and the corresponding decoder can fraudulently modify an image, so that this image seems to be authentic during a subsequent decoding with the public key.

 Furthermore, the document Using escrow public key to enhance confidence in an image authentication scheme by J. Malcolm and B. Robinson, in Proc. IEE, 2000, proposes to apply a double cryptographic coding / decoding.

 Two signatures, in the cryptographic sense, are calculated for the same image, each of these signatures using a pair of public and private keys.

 The public signature is used to decode the image. The private signature is used to check whether an image decoded with the public signature has been pirated or not.

 This document therefore introduces the concept of double decoding. But it should be noted that it does not concern fragile data marking.

 The present invention aims to remedy the drawbacks of the prior art, by providing a method and a fragile marking device which limits the risk of falsification of the marked data.

<Desc / Clms Page number 3>

 To this end, the invention proposes a method of inserting additional information such as a secret mark for the authentication of a digital signal comprising a set of coefficients, characterized in that it comprises the steps of: - calculation, for at least a first coefficient, of a respective first control bit as a function of a first key, according to a first predetermined operation, - insertion of at least one additional information bit on said at least one first coefficient, as a function of the value of its control bit, - calculation of a second key, such as: - the result of the calculation, for all the first coefficients for which a respective first control bit has been calculated, of a second control bit as a function of the second key, according to a second predetermined operation is respectively equal to the result of the calculation of the first control bit, and - the result of the calculation, for at least one second co efficient for which a respective first control bit has not been calculated, a second control bit as a function of the second key, according to a second predetermined operation is different from the result of the calculation of the first control bit calculated for said at minus a second coefficient.

 Correlatively, the invention relates to a device for inserting additional information such as a secret mark for authenticating a digital signal comprising a set of coefficients, characterized in that it comprises: - calculation means , for at least a first coefficient, of a respective first control bit as a function of a first key, according to a first predetermined operation, - means for inserting at least one additional information bit on said at least a first coefficient, as a function of the value of its control bit, - means for calculating a second key, such as:

<Desc / Clms Page number 4>

 the result of the calculation, for all the first coefficients for which a respective first control bit has been calculated, of a second control bit as a function of the second key, according to a second predetermined operation is respectively equal to the result of the calculation of the first control bit, and - the result of the calculation, for at least one second coefficient for which a respective first control bit has not been calculated, of a second control bit as a function of the second key, following a second predetermined operation is different from the result of the calculation of the first control bit calculated for said at least one second coefficient.

 The invention thus provides a method of marking data which uses a key during insertion of the marking signal and two keys for the subsequent extraction of this marking signal. One of the extraction keys is public while the other remains secret.

 The invention makes it possible to limit the risk of falsification of the marked data. Indeed, the additional information can be extracted with each of the two keys. We can then verify that the public key and the private key make it possible to extract the same additional information.

 According to a preferred characteristic, the second key is associated with the digital signal into which the additional information has been inserted.

 So the second key is public.

 According to a preferred characteristic, the calculation of the second key comprises, for each of the keys of a predetermined set of keys: - the calculation of the second control bit, for said at least one first coefficient, according to the second predetermined operation, - the comparison, for said at least one first coefficient, of the second control bit and of the first control bit, - elimination of the keys for which the first and the second control bits are different, for said at least one first coefficient.

<Desc / Clms Page number 5>

 Thus, the second key makes it possible to obtain the same control bit as the first key, for the first coefficients.

 According to a preferred characteristic, the calculation of the second key comprises: - determination of at least one second coefficient for which a first control bit has not been calculated, - calculation, for said at least one second coefficient, of a respective first control bit as a function of the first key, according to the first predetermined operation, - calculation, for said at least one second coefficient, of a respective second control bit as a function of each of the keys not eliminated, according to the second operation predetermined, - determination of the second key as a function of the difference between the first and second control bits.

 Thus, the second key makes it possible to obtain, for the second coefficient (s), a second control bit which is different from that obtained with the first key.

 According to a preferred characteristic, the first operation and the second operation are identical. The implementation is thus simplified.

 The insertion device includes means for implementing the above characteristics.

 The invention also relates to a method of extracting additional information inserted into a digital signal by the method previously presented, characterized in that it comprises the steps of: - extracting a first additional information using the first key and the first predetermined operation, - extraction of a second additional information using the second key and the second predetermined operation, - comparison of the first and second additional information,

<Desc / Clms Page number 6>

 - authentication of the digital signal according to the result of the comparison.

 The invention also relates to an extraction device comprising means for implementing the above characteristics.

 The insertion device, the method and the extraction device have advantages similar to those previously presented.

 The invention also relates to a digital device including the device according to the invention, or means for implementing the method according to the invention. This digital camera is in particular a digital camera. It can also be, for example, a digital camcorder, a scanner, a printer, a photocopier, a fax machine. The advantages of the device and of the digital apparatus are identical to those previously exposed.

 An information storage means, readable by a computer or by a microprocessor, integrated or not in the device, possibly removable, stores a program implementing the method according to the invention.

 A computer program readable by a microprocessor and comprising one or more sequence of instructions is capable of implementing the methods according to the invention.

- la figure 2 représente un dispositif de codage, - la figure 3 représente un dispositif de décodage correspondant au dispositif de la figure 2, - la figure 4 représente un dispositif de codage selon l'invention, - la figure 5 représente un dispositif de décodage selon l'invention correspondant au dispositif de la figure 4, The characteristics and advantages of the present invention will appear more clearly on reading a preferred embodiment illustrated by the attached drawings, in which: - Figure 1 is an embodiment of a device implementing the invention,

- Figure 2 shows a coding device, - Figure 3 shows a decoding device corresponding to the device in Figure 2, - Figure 4 shows a coding device according to the invention, - Figure 5 shows a decoding device according to the invention corresponding to the device of FIG. 4,

<Desc / Clms Page number 7>

 - Figure 6 shows an embodiment of the coding method according to the invention, - Figure 7 shows an embodiment of the decoding method according to the invention, - Figure 8 shows the detail of a public decoding step , included in the method of FIG. 7, - FIG. 9 represents the detail of a private decoding step, included in the method of FIG. 7, - FIG. 10 represents the detail of a step of searching for a set of public keys, included in the method of FIG. 6, FIG. 11 represents the detail of a step of searching for a public key, included in the method of FIG. 6.

 According to the embodiment chosen and represented in FIG. 1, a device implementing the invention is for example a microcomputer 10 connected to different peripherals, for example a digital camera 107 (or a scanner, or any means of image acquisition or storage) connected to a graphics card and providing information to be processed according to the invention.

 The device 10 includes a communication interface 112 connected to a network 113 capable of transmitting digital data to be processed or, conversely, of transmitting data processed by the device. The device 10 also includes a storage means 108 such as for example a hard disk. It also includes a disc drive 109. This disc 110 can be a floppy disk, a CD-ROM, or a DVD-ROM, for example. The disk 110 like the disk 108 can contain data processed according to the invention as well as the program or programs implementing the invention which, once read by the device 10, will be stored in the hard disk 108. According to a variant, the program allowing the device to implement the invention can be stored in read-only memory 102 (called ROM in the drawing). In a second variant, the program can be received to be stored in an identical manner to that described previously via the communication network 113.

<Desc / Clms Page number 8>

 The device 10 is connected to a microphone 111. The data to be processed according to the invention will in this case be an audio signal.

 This same device has a screen 104 making it possible to view the data to be processed or to serve as an interface with the user who can thus configure certain processing modes, using the keyboard 114 or any other means (mouse for example) .

 The central unit 100 (called CPU in the drawing) executes the instructions relating to the implementation of the invention, instructions stored in the read-only memory 102 or in the other storage elements. During power-up, the processing programs stored in a non-volatile memory, for example the ROM 102, are transferred to the RAM RAM 103 which will then contain the executable code of the invention as well as registers for storing the variables necessary for the implementation of the invention.

 More generally, an information storage means, readable by a computer or by a microprocessor, integrated or not in the device, possibly removable, stores a program implementing the method according to the invention.

 The communication bus 101 allows communication between the different elements included in the microcomputer 10 or connected to it. The representation of the bus 101 is not limiting and in particular the central unit 100 is capable of communicating instructions to any element of the microcomputer 10 directly or through another element of the microcomputer 10.

 An embodiment of a fragile marking device 20 is described with reference to FIG. 2. This device is described in French patent application No. 2 786 583. The device is integrated into an apparatus, which is for example a digital photographic camera , a digital camcorder, a scanner, a printer, a photocopier, a fax machine, a database management system, or even a computer.

<Desc / Clms Page number 9>

 In this example, and by way of nonlimiting example, the digital signal is a digital image 1 consisting of a series of digital samples. An original image 1 can be represented by a series of pixels coded for example on 8 bits or bytes. The black and white image 1 can thus be decomposed in the spatial domain into a set of coefficients on 256 gray levels, each coefficient value representing a pixel of image 1.

 Conventionally in the digital data processing domain, image 1 can also be represented in a spectral domain, after spectral decomposition of the digital image, by a set of spectral coefficients, possibly quantified when image 1 must be stored or transmitted in a compressed data file. These spectral coefficients are also represented on a number L of bits, for example L = 8 if the coefficient is represented on a byte.

 In the following description relating to the insertion and authentication devices, the spatial or spectral coefficients are indifferently denoted X ,, with i an integer index.

 The additional information to be inserted to authenticate image 1 is a secret mark W. This secret mark may contain information on the origin of the digital data (identification of the author or owner of the image) or on their date of creation. It is also represented by a set of binary values Wj, equal for example to 0 or 1, of size equal to or less than that of the set of coefficients Xj.

 In general, an insertion device can be assimilated to an encoder 20 which encodes in a picture t, in compressed or uncompressed format, a mark W. A marked image is provided at the output of the encoder 20.

 The coefficients of image 1 are separated into two subsets.

One of the subsets is used by a calculation module 21 which determines image dependent data which will later be used for authentication.

<Desc / Clms Page number 10>

 The other subset is supplied to a coding module 22 which inserts the mark W into the coefficients of this subset. The encoder 20 provides an image marked la.

 As explained in patent application No. 2 786 583, the insertion device comprises: - means for calculating a control bit C, according to a predetermined operation as a function of L-M first bit plans of a coefficient Xi; means for calculating M last bit plans according to a predetermined reversible rule as a function of the control bit C, and of a binary value w, of the additional information W; and - means for replacing the M last bit plans of the coefficient X, by the M last calculated bit plans.

l'information à insérer w,. The M least significant bit plans of the coefficient X, are thus modified as a function of the other LM bit plans of the coefficient X, and of

the information to insert w ,.

 The image la can undergo various distortions (compression and decompression, filtering) so that an image a is transmitted at the input of an authentication device which can be assimilated in part to a decoder 30 as shown in FIG. 3 The purpose of the authentication device is to indicate whether the image has is the image which has been transmitted.

As explained in patent application No. 2 786 583, the authentication device comprises for this: - a module 31 for calculating a control bit C, according to the same predetermined operation as that used for coding, as a function of LM first bit planes of a coefficient X,; - an extraction module 32 of the value w'i of the additional information inserted according to the predetermined reversible rule as a function of the control bit C, and of M last bit plans of the coefficient X,;
The decoder 30 thus makes it possible to find the additional information w ′, inserted in the image received a.

<Desc / Clms Page number 11>

 The authentication device also includes: - comparison means 33 of the value extracted w'j from the additional information inserted and the binary value Wj of the additional information W; and - decision means 34 to authenticate or not the digital signal a as a function of the identity or not of the extracted value w ', and of the binary value w, of the additional information inserted W.

 The means of calculation 21 and 31 of a control bit C, for each coefficient X, are identical in the insertion device and in the authentication device.

 For example, the predetermined operation implemented by these calculation means 21, 31 is a function of the L-M first bit plans of the coefficient X, and of a confidential key K also represented on L bits.

 The confidential key is used to secure the information entered. For example, you can have a key per image 1 to authenticate, or a key for a set of images), or even a unique key for each type of device that creates or stores images , for example a digital camera.

 In addition, the key K is identical to coding and decoding.

 FIG. 4 represents an embodiment of a device for inserting additional information into an image, according to the invention.

This device can be compared to an encoder 200.

 The encoder 200 receives as input an initial image 1 comprising coefficients X, and a marking signal W, which is a binary image comprising coefficients Wj. The signal W is of size less than or equal to that of image 1.

 The coder uses a coding key Ks which is a numerical value represented on a predetermined number of bits. The key Ks is preferably secret.

<Desc / Clms Page number 12>

 The coding results in an image la into which the marking signal W has been inserted and which is visually identical to the initial image 1.

The coding is identical to that described with reference to FIG. 2.

 The coding also results in a decoding key Kp, called the public key. The public key Kp is intended to be used subsequently to decode the image la. The public key Kp can be attached to the coded image la, for example by being written in the header data of the JPEG file containing the image la. The determination of the key Kp is detailed below.

 The operation of the coding device will be detailed below using algorithms.

 An image is transmitted to the input of an authentication device according to the invention 300, an embodiment of which is shown in FIG. 5.

 The image a may be equal to the image la. The image la can undergo various distortions (compression and decompression, filtering) so that the image a is an altered version of the image la. These distortions can be compared either to noise or to image piracy. The purpose of the authentication device 300 is to indicate whether the image a is indeed the image la which has been transmitted or vice versa if the image a is a modified version of the image la.

 The decoder 300 comprises two decoding modules. The two decoders carry out operations for extracting the marking signal which are analogous. The first decoder 301 uses the secret key Ks equal to the key used for coding and a decoding mode 01. Information Ws is thus extracted.

 The second decoder 302 uses a public key Kp and a decoding mode Ds. Wp information is thus extracted.

 The first decoder is said to be private, that is to say that its characteristics (key Ks and decoding mode 01) are not public. The second decoder is public.

Functions 01 and O2 respect the following properties:
Dl (la, Ks) = D2 (la, Kp)

<Desc / Clms Page number 13>

D1 (lb, Ks) D2 (tb, Kp)
In which lb represents an image which is a modification of the image la. In other words, the two decoding modes provide the same result with the same image previously authenticated with the keys Ks and Kp, but different results with an unauthenticated image or with an authenticated image then modified.

 The extracted information Ws and Wp are applied to a comparison module 303. This module checks whether the extracted information Ws and Wp are identical. An authentication module authenticates or not the image has it according to the result of the comparison. If the information extracted Ws and Wp are identical, then this means that the image a has not been modified with respect to the image la. Otherwise, the image has been modified.

 FIG. 6 represents an embodiment of an image coding method according to the invention. This method is implemented in the coding device and includes steps E1 to E6.

 The method is carried out in the form of an algorithm which can be stored in whole or in part in any information storage means capable of cooperating with the microprocessor. This storage means can be read by a computer or by a microprocessor. This storage means is integrated or not to the device, and can be removable. For example, it may include a magnetic tape, a floppy disk or a CD-ROM (compact disk with frozen memory).

 Steps E 1 and E2 are described in French patent application No. 2 786 583. An image to be coded is represented by a set of coefficients, for example coefficients transformed in the DCT domain (from Discret Cosine Transform ). The image is considered by blocks of coefficients.

 A subset of coefficients {XI} is determined, for example by selecting the coefficients whose magnitude is greater than a predetermined threshold. The insertion of the marking signal is carried out on the coefficients of this subset.

<Desc / Clms Page number 14>

 For this, in step E1, the coefficients of the subset are considered one by one. We consider a coefficient X, and we associate it with a value B, which represents the position of the coefficient in the block to which it belongs.

 A control bit C, is then calculated for the coefficient Xi. The control bit C is calculated as a function of the value of the coefficient X ,, of its position in the block to which it belongs and of the secret key Ks.

The first step in the calculation is the application of a deterministic function h to calculate a real value K, = h (Xi, B ,, Ks). For example, we have:
K, = MSB [X,]. B, + Ks.

Where MSB [X,] represents the most significant bit of XI, according to the English Most Significant Bit>>
The second step of the calculation is a pseudo-random draw made from the value K, previously determined: C, = f1 (K,).

 For the pseudo-random drawing, we use for example the procedure, noted ran1 (...), of generation of real values uniformly distributed over the interval [0, 1], described in the book Numerical Recipes in C, second edition, Cambridge University Press, 1992, by WH Press, SA Teukolsky, WT Vetterling and BP Flannery.

 The value of the control bit C, thus determined is then used in step E2 to insert a coefficient w, of the marking signal W on the coefficient X ,.

LSB [X',] = C, 0 W,
Où 0 représente l'opération binaire OU exclusif n et LSB [X'i] représente le bit de poids faible de X'I. Si les deux bits ont la même valeur, le résultat est égal à un, et à zéro sinon. For example, still as in French patent application No. 2 786 583, the coefficient marked X ′ is determined by the formula:

LSB [X ',] = C, 0 W,
Where 0 represents the exclusive OR binary operation n and LSB [X'i] represents the least significant bit of X'I. If the two bits have the same value, the result is equal to one, and zero otherwise.

The set of marked coefficients determines the image marked la.
After the calculation of each control bit Ci, the pair (XI! Ci) is stored in step E3. The set of couples thus formed is noted E.

<Desc / CRUD Page number 15>

 From the set E, the public key Kp corresponding to the secret key Ks is calculated in step E4.

 For this, a range of potential keys [Km! n, Kmax] is considered.

In this interval, a subset of keys K are sought which give the same result on the set E of the image being processed, with the same calculation function fi.

fi (h (XI, B,, K)) = C,, V (Xi, C,) E E
En variante, on recherche les clés K qui donnent le même résultat sur l'ensemble E de l'image en cours de traitement, mais avec une fonction de calcul f2 différente de la fonction fi. This condition results in the formula:

fi (h (XI, B ,, K)) = C ,, V (Xi, C,) EE
As a variant, one searches for the keys K which give the same result on the set E of the image being processed, but with a calculation function f2 different from the function fi.

f2 (h (XI, B,, K)) = CI, V (Xi, Ci) E E. This condition results in the formula:

f2 (h (XI, B ,, K)) = CI, V (Xi, Ci) E E.

In this case, we have for example: fi (K) = (PRNG1 [K] + PRNG1 [K] / 2)% 2, and f2 (K) = (PRNG2 [K])% 2 where% 2 denotes the remainder of the division by two and PRNG1 [K] and PRNG2 [K] are pseudo-random number generators such as: PRNG1 [K] = ran1 (k) * V1, and PRNG2 [K] = ran 1 (k) * V2
Where V1 and V2 are two large integer values, for example equal to 1000 and 500, and ran1 (K) is the procedure for generating real values uniformly distributed over the interval [0, 1].

 Step E4 will be detailed below.

l'ensemble E. Cette recherche est effectuée avec la fonction fi ou la fonction f2, suivant la variante choisie. In the next step E5, a key Kp is sought, among the keys previously determined, which maximizes the number of result differences with respect to the key Ks, for the values of couples (Xj, B,) which are not in

the set E. This search is carried out with the function fi or the function f2, depending on the variant chosen.

<Desc / Clms Page number 16>

 This step is detailed below.

 In the next step E6, the key Kp is attached to the image marked la.

For this, it is for example written in the header data of the file containing the image marked la. The key Kp can be used later for the extraction of the marking signal.

 FIG. 7 represents an embodiment of a method for decoding an image, according to the invention. This method is implemented in the decoding device and includes steps E 10 to E 13.

 The method is carried out in the form of an algorithm which can be stored in whole or in part in any information storage means capable of cooperating with the microprocessor. This storage means can be read by a computer or by a microprocessor. This storage means is integrated or not to the device, and can be removable. For example, it may include a magnetic tape, a floppy disk or a CD-ROM (compact disk with frozen memory).

 Step E10 is a first decoding, called public decoding, of the image marked a. This decoding uses the public key Kp and the function fi or the function f2, depending on the variant chosen during coding. This decoding results in information extracted Wp.

 This step will be detailed below.

 The next step E11 is a second decoding, called private decoding, of the image marked a. This decoding uses the secret key Ks and the function fi.

This decoding results in information extracted Ws.

 This step will be detailed below.

 It should be noted that steps E10 and E11 can be executed in reverse order or in parallel.

 The next step E12 is a comparison of the information extracted Ws and Wp. We are looking here if the information extracted is strictly equal. Indeed, the two decoding keys must give equal results on the authentic image and different results in the other cases.

<Desc / Clms Page number 17>

 The next step E13 is an authentication of the image a, as a function of the result of the comparison. Thus, the result of the comparison makes it possible to validate or not the decoding carried out with the public key.

 FIG. 8 represents step E10 in detail, in the form of an algorithm comprising steps E100 to E170.

 In step E100, the image a is considered and a subset of coefficients X ′, of the image a is formed. The coefficients of the subset are such that their magnitude is greater than the same predetermined threshold as during insertion. The subset has NC coefficients.

 The next step E110 is an initialization at which the parameter i is set to zero to consider a first coefficient of the subset. An integer parameter N is also set to zero. Parameter N is an error number counter.

 The next step E120 is the calculation of the control bit C, for the current coefficient X ',. This calculation is performed with the public key Kp and the function fi. As a variant, the function f2 replaces the function fi. This calculation is similar to that performed during insertion.

 The next step E130 is the extraction of a binary value W ',, from the least significant bits of the coefficient X'j.

 The next step E140 is an update of the error number N. If the extracted binary value W ', is different from the binary value W, which is known here, then the counter N is incremented by one. Otherwise, the counter N keeps its value.

 In the next step E150, the parameter i is incremented by one to consider a next coefficient.

 The next step E160 is a test to determine the parameter i is less than the number of coefficients to be processed NC.

 If the answer is positive, then step E160 is followed by step E120 previously described.

<Desc / Clms Page number 18>

 If the answer is negative in step E160, then this step is followed by the decision step E170 in which the parameter N is analyzed to determine whether the processed image is identical or not to the initial image.

 The step E11 of private decoding is analogous to the step E10. It includes steps similar to those of FIG. 8, with the exception of step E120 which is replaced by step E220. As shown in FIG. 9, the control bit is calculated with the secret key Ks and the function fi.

 This decoding provides a set of binary values Ws which is compared with that obtained with the public key (step E13).

 FIG. 10 represents the detail of step E4 previously described with reference to FIG. 6. This step is the search for a set of keys which provide the same control bits as the secret key Ks on the image being treatment.

 Step E4 includes sub-steps E40 to E44.

 Step E40 is an initialization to which we consider a set of keys which are between two values Kmin and Kmax.

 In the next step E41, a first key K of the preceding set is considered.

 The next step E42 is the calculation of a control bit C ', = fi (h (XI, B ,, K)) for the current key K, for each of the coefficients X ,.

E1. In step E43, the result C ', of each of the preceding calculations is respectively compared with the result C, = fi (h (XI, B, Ka)) calculated in step

E1.

 As soon as one of the results C ', is different from the respective result C, the current key K is eliminated.

 The steps E42 and E43 are repeated for all the keys of the set defined in step E40.

 When all the keys have been tested, step E44 provides the set of keys which provide the same control bits as the secret key Ks on the image being processed.

<Desc / Clms Page number 19>

 FIG. 11 represents the detail of step E5 previously described with reference to FIG. 6. This step is the search for a key which provides as many control bits as possible, calculated on coefficients not belonging to the current image, different from those provided by the secret key Ks on the image being processed.

 Step E5 includes sub-steps E50 to E57.

 Step E50 is the determination of a set Z of couples (Zj, Bj) not belonging to the set E (step E3). For this, we consider here all the values that the coefficients of the image can take, with the exception of those which are actually taken by the coefficients of the image.

 As a variant, a subset of the set Z is considered, for example of the same cardinality as the set E. The elements of this subset can be chosen in a pseudo-random manner. This variant is suboptimal, but it is also less complex and faster to implement.

 The next step E51 is the calculation and storage of the control bits calculated for each of the pairs (Zj, Bj), with the secret key Ks.

 The following step E52 is an initialization at which an integer parameter m is set to zero. The parameter m represents the current key of the set of keys determined in step E44.

 The next step E53 is the calculation and storage of the control bits calculated for each of the pairs (Z ,, Bj), with the current key Km.

 The next step E54 is the counting of the differences Dm between the control bits calculated in step E51 and those calculated in step E53.

 In the next step E55, the parameter m is incremented by one to consider a next key. The next step E56 is a test to check whether all the Km keys have been processed.

 If the answer is negative, step E56 is followed by step E53 previously described, for the following key.

<Desc / Clms Page number 20>

 When the response is positive in step E56, then this step is followed by step E57 in which the key Km corresponding to the largest value Dm is selected. This key is the public key Kp.

 According to a first variant, the key corresponding to the largest value Dm is not chosen in step E57, but a key from those which have high numbers of differences Dm. Indeed, there is only one function which achieves the maximum number of differences compared to an initial function. Knowledge of the public key Kp could therefore allow a hacker to find the secret key Ks. This variant therefore makes it possible to further reduce the risk of hacking.

 According to a second variant, the step E53 of calculating the control bits with the key Km can be replaced by a reading in memory of these control bits, provided that they have been previously calculated and stored in memory. This variant allows faster execution, but requires more memory space.

 Of course, the present invention is not limited to the embodiments described and shown, but encompasses, quite the contrary, any variant within the reach of ordinary skill in the art.

 In particular, the invention has been described more specifically with reference to the insertion of additional information into data described in French patent application No. 2,786,583. However, it applies to other modes of insertion , for example the insertion described in French patent application No. 2,787,604.

Claims (16)

1. Method for inserting additional information (W) such as a secret mark for authenticating a digital signal comprising a set of coefficients, characterized in that it comprises the steps of: - calculation (E1 ), for at least a first coefficient, of a respective first control bit as a function of a first key (Ks), according to a first predetermined operation, - insertion (E2) of at least one additional information bit on said at least one first coefficient, as a function of the value of its control bit, - calculation (E4, E5) of a second key (Kp), such as: - the result of the calculation, for all the first coefficients for which a respective first control bit has been calculated, a second control bit as a function of the second key (Kp), according to a second predetermined operation is respectively equal to the result of the calculation of the first control bit, and - the result of the calculation, for at least one second d coefficient for which a respective first control bit has not been calculated, a second control bit as a function of the second key (Kp), according to a second predetermined operation is different from the result of the calculation of the first control bit calculated for said at least one second coefficient.  2. Method according to claim 1, characterized in that the second key is associated (E6) with the digital signal in which the additional information has been inserted. <Desc / Clms Page number 22>  3. Method according to claim 1 or 2, characterized in that the calculation of the second key comprises, for each of the keys of a predetermined set of keys: - the calculation (E42) of the second control bit, for said at least a first coefficient, according to the second predetermined operation, - the comparison (E43), for said at least one first coefficient, of the second control bit and of the first control bit, - the elimination (E43) of the keys for which the first and the second control bits are different, for said at least one first coefficient.  4. Method according to claim 3, characterized in that the calculation of the second key comprises: - determination (E50) of at least a second coefficient for which a first control bit has not been calculated, - calculation (E51 ), for said at least one second coefficient, of a respective first control bit as a function of the first key (Ks), according to the first predetermined operation, - calculation (E53), for said at least one second coefficient, of a respective second control bit as a function of each of the keys not eliminated, according to the second predetermined operation, - determination (E5?) of the second key as a function of the difference between the first and second control bits.  5. Method according to any one of claims 1 to 4, characterized in that the first operation and the second operation are identical.  6. Method for extracting additional information inserted into a digital signal by the method according to any one of claims 1 to 5, characterized in that it comprises the steps of: <Desc / Clms Page number 23>  - extraction (E10) of a first additional information using the first key and the first predetermined operation, - extraction (EU) of a second additional information using the second key and the second predetermined operation, - comparison (E12) of the first and second additional information, - authentication (E13) of the digital signal as a function of the result of the comparison.  7. Device for inserting additional information (W) such as a secret mark for authenticating a digital signal comprising a set of coefficients, characterized in that it comprises (200): - means for calculation, for at least a first coefficient, of a respective first control bit as a function of a first key (Ks), according to a first predetermined operation, - means for inserting at least one additional information bit on said at least one first coefficient, as a function of the value of its control bit, - means for calculating a second key (Kp), such as: - the result of the calculation, for all the first coefficients for which a respective first control bit has been calculated, a second control bit as a function of the second key (Kp), according to a second predetermined operation is respectively equal to the result of the calculation of the first control bit, and - the result of the calculation , for at minus a second coefficient for which a respective first control bit has not been calculated, by a second control bit as a function of the second key (Kp), according to a second predetermined operation is different from the result of the calculation of the first bit control calculated for said at least one second coefficient. <Desc / Clms Page number 24>  8. Device according to claim 7, characterized in that it comprises means for associating the second key (Kp) with the digital signal in which the additional information has been inserted.  9. Device according to claim 7 or 8, characterized in that the means for calculating the second key comprise: - means for calculating the second control bit, for each of the keys of a predetermined set of keys and for said au at least a first coefficient, according to the second predetermined operation, - comparison means, for each of the keys of the predetermined set of keys and for said at least a first coefficient, of the second control bit and of the first control bit, - means for eliminating the keys for which the first and second control bits are different, for said at least one first coefficient.  10. Device according to claim 9, characterized in that the means for calculating the second key comprise: - means for determining at least one second coefficient for which a first control bit has not been calculated, - means of calculation, for said at least one second coefficient, of a respective first control bit as a function of the first key (Ks), according to the first predetermined operation, - means of calculation, for said at least one second coefficient, a respective second control bit as a function of each of the keys not eliminated, according to the second predetermined operation, - means for determining the second key (Kp) as a function of the difference between the first and second control bits.  11. Device according to any one of claims 7 to 10, characterized in that it is adapted to implement a first operation and a second operation which are identical. <Desc / Clms Page number 25>  12. Device for extracting additional information inserted into a digital signal by the device according to any one of claims 7 to 11, characterized in that it comprises: - means (301) for extracting a first additional information using the first key and the first predetermined operation, - means (302) for extracting a second additional information using the second key and the second predetermined operation, - means (303) for comparing the first and second additional information, - means (304) for authenticating the digital signal as a function of the result of the comparison.  13. Insertion device according to any one of claims 7 to 11, characterized in that the calculation and insertion means are incorporated in: - a microprocessor (100), - a read only memory (102) comprising a program for processing the data, and - a random access memory (103) comprising registers adapted to record variables modified during the execution of said program.  14. Extraction device according to claim 12, characterized in that the extraction, comparison and authentication means are incorporated in: - a microprocessor (100), - a read only memory (102) comprising a program for processing the data, and <Desc / Clms Page number 26>  - A random access memory (103) comprising registers adapted to record variables modified during the execution of said program.  15. Apparatus for processing (10) a digital image, characterized in that it comprises means suitable for implementing the method according to any one of claims 1 to 6.  16. Apparatus for processing (10) a digital image, characterized in that it comprises the device according to any one of claims 7 to 14.