JP2004242162A - Method, program and device for embedding electronic watermark, and method and device for encoding image - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To surely leave watermark data even in the case of decoding an encoded image inserted with the watermark data. <P>SOLUTION: Run length structures obtained after quantizing DCT coefficients of blocks are arranged as many as the number of the blocks for grouping are converted into an N-bit hash value with a hash function. However, one dummy run is attached to the last of the run length of each block. Next, watermark data are embedded by taking an exclusive OR of the N-bit hash value and the watermark data, and the watermark is encrypted with a private key to obtain N-bit signature data. The N-bit signature data embedded with the watermark data in this way is obtained by one bit for each block, wherein a value behind a dummy run of the block is defined as -1 when the bit is 0, and a value behind the dummy run of the block is defined as +1 when the bit is 1. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

【００３４】
である。
【００３５】
＜２．５ 歪みの増加＞
署名の埋め込みのために用いる各ブロック最後の署名ビット±１のために、ＪＰＥＧ画像の歪みが増加する。この増加量は量子化の粗さに依存し、それが粗いほど増加量は大きい。例えば、図４の量子化テーブルを用いて、透かしの埋め込みが、ブロックの（３、３）の位置に対して行われたとすると、画素当りの歪みの増加量は、電力にして、およそ
【００３６】
【数２】

【００３７】
である。この場合、ＰＳＮＲ＝４２ｄＢのＪＰＥＧ画像に透かしをいれたとき、そのＰＳＮＲは３ｄＢ減少することになる。
【００３８】
従って、ダミーのランの長さは、符号量と歪みの増加の観点から、適切に設定すべきである。
【００３９】
＜２．６ ＪＰＥＧ 復号の問題について＞
次に、以上のようにして電子透かし埋め込み方法により符号化ストリームを復号する際の問題について説明する。
【００４０】
図５は、本発明に係る電子透かし埋め込み方法により符号化ストリームを復号する画像復号装置における透かしデータ検出回路の一例を示す図である。図５において、この画像復号装置は、ストリーム復号部２１、可変長復号部２２、透かし分離部２３、暗号復号部２４、逆ハッシュ関数部２５、排他的論理和部２６を有しており、図１に示す画像符号化装置により符号化された符号化ストリームを入力して、ストリーム復号、可変長復号、透かし分離、公開鍵を用いた暗号復号、逆ハッシュ関数、排他的論理和をとることにより、透かしデータを検出するように構成されている。なお、画像復号装置自体は、図１に示す画像符号化装置とは逆に処理するように構成されるので、ここでは説明しない。
【００４１】
ＪＰＥＧ符号化画像を復号した後、再度同じ量子化パラメータで符号化すると、ランレングスの構造が変化する場合がある。この場合、復号された画像は、既にその段階で真正性が崩れていることになる。これを防ぐため、ＪＰＥＧの復号は、再符号化したときに、量子化構造が同じとなるように行わなければならない。これによって、真正性はＪＰＥＧの復号後も保たれる。このような復号方法は可能であると思うが、本報告では、詳細な検討はしない。なお、復号後も透かしが残るという条件は重要である。なぜなら、単にＪＰＥＧのストリームの段階でその真正性を証明したいだけなら、透かしデータを用いなくても、例えばＭＡＣ（Ｍｅｓｓａｇｅ Ａｕｔｈｅｎｔｉｃａｔｉｏｎ Ｃｏｄｅ）を付加するなどして、それを実現することができるからである。
【００４２】
＜３．評価＞
ある人物画像をＪＰＥＧ符号化し、その画像に署名を埋め込んで画質の劣化を評価した。ただし、署名の詳細はインプリメントしていない。署名データとしてランダムなビット系列を用いた。図４の量子化テーブルを用いてＪＰＥＧで符号化した人物画像に署名が埋め込まれていない場合に、この画像のＰＳＮＲが３５．８ｄＢであるとし、この画像にダミーのランを０とした署名を埋め込むとする。ただし、上述したように。署名ビットは、ジグザグスキャンの最後の非零係数の直後に埋めむ。すると、この署名ビット埋め込み後の画像のＰＳＮＲは、原画に対して、３３．７ｄＢである。透かしを埋め込んだ個所は、背景などの平坦な部分で、歪みがやや目立つが、この歪みは量子化を細かくすることで軽減される。
【００４３】
以上説明したように、本実施の形態１では、マクロブロックをＮ個に分割したブロック毎にＤＣＴ係数を量子化した後のランレングスの構造をブロックの数だけ並べたものをハッシュ関数によって、Ｎビットのハッシュ値に変換する際、各ブロックのランレングスの最後にダミーのランを一つ追加して、Ｎビットのハッシュ値に透かしデータを埋め込み、これを秘密鍵で暗号化してＮビットの署名データを得て、このＮビットの署名データを透かしデータとして各ブロックに１ビットずつビットが０のときは、そのブロックのダミーのランの後の値を‐１とする一方、ビットが１のときは、そのブロックのダミーのランの後の値を＋１として埋め込むようにしたので、画像のＤＣＴ係数や署名ビットの量子化値が少しでも変更されても、それをほぼ確実にその変更を検知することができる。
【００４４】
実施の形態 ２
上記実施の形態１では、ＪＰＥＧ画像の真正性を保証する電子透かしの方法を提案した。この方法を用いれば、ＪＰＥＧ画像が、発行者の署名後に改ざんされていないことを画像データだけから知ることができる。この方法は、ＤＣＴ係数の量子化の構造が変化しない限り透かしデータが残るが、ＤＣＴ係数の量子化の構造がわずかでも変化すると電子透かしは破壊されるということである。そのため、ＪＰＥＧ復号後の画像で透かしデータが残るためには、ＪＰＥＧ復号後の画像を再符号化したときに、もとの量子化の構造が完全に保持される必要がある。ところが、一般のＪＰＥＧ復号では、逆ＤＣＴされた画像データを通常８ビットの整数値に四捨五入してしまうので、復号画像を再度ＪＰＥＧ符号化するとその量子化の構造が変化する場合がある。そこで、本実施の形態２では、量子化のステップ幅をｓｑｒｔ（Ｎ）以上とすることによって、再符号化後の量子化の構造が保存されることを証明する。ここで、Ｎは、ＤＣＴのブロックサイズであり、８×８ＤＣＴの場合は６４である。したがって、ＤＣＴ係数の量子化を８より大きなステップ幅で行えば、ＪＰＥＧ復号した画像から電子透かしは消えることはない。実際にいくつかの標準画像について再符号化を試した結果では、ステップ幅を４以上とすれば、再符号化によって量子化の構造が変化することはなかった。
【００４５】
つまり、真正性を証明する電子透かしは、画像データが（１）由緒正しいものであり、（２）改ざんが行われていないという２つのことを証明するためのものである。Ｗｏｎｇ らの方法によれば、（１）は画像の発行者が自分の秘密鍵で透かしデータを暗号化することで実現され、（２）は画像データのハッシュ値を（１）の暗号データとＸＯＲして画像に埋めこむことで実現されるとしているが、 Ｗｏｎｇは透かしデータを画像データのＬＳＢ に入れたので、ＪＰＥＧ などの圧縮画像に用いることができなかった。上記実施の形態１では、 Ｗｏｎｇ のアルゴリズムをＪＰＥＧで符号化された画像に対して拡張した［。これによれば、ＪＰＥＧ の量子化の構造がハッシュ関数に与えられ、それと暗号データのＸＯＲがＤＣＴブロックの最後に埋めこまれる。しかし、ＪＰＥＧで復号した画像を同じ量子化器を用いて再符号化しても、その量子化の構造が再現される保証がない。そのため、一旦ＪＰＥＧで復号すると、透かしデータが消えてしまう場合があるという問題があった。本実施の形態２では、量子化のステップサイズを８以上とすることで、ＪＰＥＧ復号による透かしの消滅がなくなるようにしたものである。また、実際の画像を用いてそのことを確認する。
【００４６】
＜１． ＪＰＥＧ 復号がロスレスでない理由＞
ＪＰＥＧ符号化では、量子化されたＤＣＴ係数を逆量子化した後で、画素値を整数に打ち切っているので、一般に、復号後の画像をもう一度符号化すると同じビットストリームが得られる保証がない。このことを図６を用いて説明する。
【００４７】
図６は、２元アダマール変換の時間領域（ｘ−ｙ 座標）と、変換領域（ｕ−ｖ 座標）のサンプル点の構造を示している。アダマール変換は次式の数３で与えられる。
【００４８】
【数３】

【００４９】
ここで、ｘ、ｙ は時間領域の座標であり、画像データは整数であるからそのサンプル点は図の●で表される。上記数３の式から、２元アダマール変換は４５°の回転移動に等しいから、●は、変換領域では図のｕ−ｖ 座標で読み取った座標に変換される。今、ｕ、ｖをそれぞれ一様なステップ幅でスカラー量子化することを考える。ただし、ｕ はｖ より細かく量子化されているとすると、例えば、図の点線で示すような量子化の境界が得られる。この境界で囲まれたクラス毎に、量子化の代表値が○の位置で与えられる。さて、ハッチをかけたクラスｉ に注目すると、このクラスには２つのベクトルｘｉ１、ｘｉ２ が存在し、変換後どちらもｘｉ に量子化される。このｘｉ が逆変換されて、整数値に戻されるとき、それに最も近い整数はクラスｉ のベクトルでなく、クラスｊ のベクトルｘｊ２ である。そのため、ｘｊ２ が再符号化されると、量子化後のベクトルはｘｊ となって、ｘｉ と一致しない。
【００５０】
このように、量子化代表値に最も近い整数ベクトルが必ずしも自分のクラスに属していないことが変換符号化がロスレスでないことの理由である。これは、アダマール変換に限らず、ＤＣＴ でも起こり得るし、次数に関係無いことも明らかである。
【００５１】
図６の考察から、量子化幅を大きくすれば、代表値の周辺にはそのクラスの属する多くの整数ベクトルが存在し、再符号化でロスが生じにくくなるだろうと予想される。そこで、本実施の形態２では、次に説明するように、量子化幅をＮ（Ｎ は変換の次数）より大きくすることにより、符号化は完全にロスレスとしたものである。
【００５２】
＜２．復号をロスレスとするための量子化の制限＞
符号化において、変換係数の量子化は、一様なスカラー量子化とする。復号において、逆変換されたベクトルは、ユークリッド距離が最も近い整数ベクトルに打ち切られるとする。また、変換、逆変換の演算誤差を無視すると、変換前後で距離が保たれなければならないが、直交変換の全ての変換係数に対して、Ｑｉ ＞ √Ｎ が満たされれば、逆変換されたベクトルに最も近い整数ベクトルは、もとの変換係数と同じクラスに属することになる。ただし、Ｑｉ はｉ番目の変換係数の量子化ステップ幅、Ｎは変換の次数である。
【００５３】
これを証明しておく。逆変換されたベクトルを、
【００５４】
【数４】

【００５５】
とする。ここで、一般性を失うことなく、
【００５６】
【数５】

【００５７】
としてよい。ベクトルｃ の周りの整数ベクトルを
【００５８】
【数６】

【００５９】
とおけば、
【００６０】
【数７】

【００６１】
を満たすｘ は、２^Ｎ個存在する。その中で、ｃ に最も近いベクトルを
【００６２】
【数８】

【００６３】
とすると、
【００６４】
【数９】

【００６５】
であるから、次式の数１０が成り立つ。
【００６６】
【数１０】

【００６７】
上記数１０の式と、条件Ｑ ＞ √Ｎ より、
【００６８】
【数１１】

【００６９】
が成り立つ。ただし、Ｑ は、量子化ステップ幅Ｑｉ の最小値とする。一方、
【００７０】
【数１２】

【００７１】
を満たすベクトルｘ は必ずｃ に量子化される。なぜなら、上記数１２の式が成り立てば、全てのｉ について、
【００７２】
【数１３】

【００７３】
が成り立つからである。以上より、ベクトルＸｃは、再符号化されると必ずクラスｃ に属することが示された。
【００７４】
＜４．評価＞
５つのテスト画像を用いて、全てのＤＣＴ係数を同じステップ幅Ｑ で量子化し、それを復号した後、再度符号化して、異なるクラスにマッピングされるブロックの数を調べた。
【００７５】
図７にその結果を示す。
画像のサイズは全て５１２×５１２であり、ブロックの数は４０９６である。表から、Ｑ＝８ とすれば全ての場合において、再符号化後同じクラスにマッピングされていることがわかる。なお、この例では、Ｑ＝４ とすればロスレスが成り立っていることがわかる。
【００７６】
以上説明したように、本実施の形態２によれば、上記実施の形態１の対しさらに量子化のステップ幅に制限を加えることにより、ＪＰＥＧ 圧縮がロスレスとなるようにした。これを用いれば、認証用の透かしデータがＪＰＥＧ復号後も消えないことを保証することができる。
【００７７】
なお、Ｑ＝８ の制約は、画質を重視する場合には強すぎるかも知れない。その場合には、ＪＰＥＧ 圧縮と、電子透かしで異なる量子化テーブルを用いることが可能である。そして、電子透かしの量子化テーブルについてだけＱ＝８ の制約を課すようにしても。このようにすると、上記数１２の式が満たされなくなるので、ＪＰＥＧ復号は透かしデータが消えないように整数化を行う必要がある。
そのような復号方法は可能であり、詳細は別途報告する。
【００７８】
実施の形態 ３．
上記実施の形態１では、ＪＰＥＧの量子化の構造を署名データとして埋めこむことによって、その画像が改ざんされていないことを証明する電子透かしの方法を提案した。また、実施の形態２では、ＤＣＴ係数の量子化ステップ幅を８以上とすることによって、ＪＰＥＧ復号後も透かしが残存するようにした。
【００７９】
この実施の形態３では、この量子化の制約を取り払い、高画質なＪＰＥＧ圧縮に適した認証用電子透かしの方法を提案する。概略をせつめいすると、この実施の形態３の方法は、圧縮のための量子化テーブルと、電子透かしのための量子化テーブルとを持ち、圧縮は細かく量子化する一方、電子透かしは粗く量子化することによって、符号化の画質と、電子透かしの残存とを両立させるようにしたものである。ここで、電子透かしの量子化ステップ幅は、８以上となるように設定される。しかし、この変更によって、逆ＤＣＴの結果を最も近い整数値に置きかえる一般的なＪＰＥＧ復号では、電子透かしの残存が保証されなくなる。そのため、本実施の形態３では、電子透かしの残存を保証したＪＰＥＧの復号方法を合わせて提案する。なお、本実施の形態３によれば、ＪＰＥＧ標準の量子化テーブルを用いた計算機実験により、スケールファクタを０．１まで小さくしても復号後の透かしデータが消えないことを確認した。このとき、透かしデータを埋めたＪＰＥＧ画像のＰＳＮＲは４０ｄＢ以上である。また、本実施の形態３が提案する電子透かしの方法は、局所的に量子化幅を変調する適応符号化や、さらにはＭＰＥＧなどの動画像符号化に対しても適用が可能である。
【００８０】
上記実施の形態１，２の方法を用いれば、ＪＰＥＧで圧縮された画像が（１）正規の発行者によるものであり、（２）改ざんされていないことを画像データだけから証明することができる。また、そのための電子透かしはＪＰＥＧで復号した後にも残ることが保証される。しかし、上記実施の形態２による制約は、ＪＰＥＧの量子化をステップ幅８以上で行うとするものであり、高画質のＪＰＥＧ圧縮に不適であった。本実施の形態３では、この制約が必要ない電子透かしのアルゴリズムと復号後に透かしが残るためのＪＰＥＧの復号方法を示す。
【００８１】
＜１．実施の形態３の電子透かしのアルゴリズム＞
アルゴリズムの詳細は、上記実施の形態１の場合と同様である。つまり、基本的なアルゴリズムは、画像のＤＣＴ係数の量子化構造を暗号化して、ＤＣＴブロックの最後に付加するものである。なお、上記実施の形態１，２までは、画像データ圧縮のための量子化器と、電子透かしのための量子化器とは同一の量子化部２１を用いていた。しかし、ＪＰＥＧ復号後の透かしの残存を保証するためには、上記実施の形態２にて説明したように電子透かしの量子化に対して一定の制約があり、あまり細かい量子化器を用いることができない。よって、本実施の形態３では、画像データ圧縮と、透かしとに、それぞれ別の量子化器を用いる方法を提案する。
【００８２】
図８は、本発明に係る電子透かし埋め込み方法が実行される実施の形態３の画像符号化装置の構成を示す図である。図８において、この画像符号化装置は、ＤＣＴ部１、２つの量子化部２Ａ，２Ｂ、２つのジグザグスキャン部３Ａ，３Ｂ、２つのランレングス化部４Ａ，４Ｂ、ダミーラン付加部５、ハッシュ関数部６、排他的論理和（ＥＸＯＲ）部７、暗号化部８、透かし埋め込み部９、可変長符号化部１０、ストリーム符号化部１１を有しており、入力するホスト画像をＪＰＥＧ圧縮符号化する際、署名画像等の透かしデータを公開鍵暗号方式により暗号化して電子透かしとして埋め込み符号化ストリームとしてＮ（Ｎは自然数）個のブロック毎に変換され出力するように構成されている。実施の形態１との違いは、入力したホスト画像を２つの量子化部２Ａ，２Ｂにより、それぞれ異なる量子化テーブル、すなわち圧縮のための量子化テーブルＱｃと、電子透かしのための異なる量子化テーブルＱｗとにより別々に量子化する点である。なお、上記実施の形態１の場合と同様に、ＤＣＴ部１や、量子化部２、ジグザグスキャン部３、ランレングス化部４、可変長符号化部１０、ストリーム符号化部１１等は、通常のＪＰＥＧ圧縮符号化を行うので、実施の形態３の電子透かし埋め込み方法を中心に以下に説明する。
【００８３】
まず、圧縮のための量子化部２Ａの量子化ステップをＱ^ｃ _ｉｊ、電子透かしのための量子化部２Ｂの量子化ステップをＱ^ｗ _ｉｊとする（ｉ，ｊ＝０，１，…，７）。ここで、全てのｉ，ｊについて、次の条件が満たされなければならない。
【００８４】
【数１４】

【００８５】
【数１５】

【００８６】
上記数１４の式の条件は、透かしデータが埋め込み可能なために必要である。また、上記数１５の式の条件は、ＪＰＥＧ復号後に透かしデータが残存するために必要である。この条件を満たすには、任意のＱ^ｃ _ｉｊに対して、Ｑ^ｗ _ｉｊを以下のように設定すればよい。
【００８７】
【数１６】

【００８８】
ＤＣＴブロックに透かしデータを埋めこむには以下のようにする。
（１）ＤＣＴ係数ｆ_ｉｊをＱ^ｃ _ｉｊで量子化して、ｆ^ｃ _ｉｊを得る。
（２）ｆ^ｃ _ｉｊをＱ^ｃ _ｉｊで逆量子化したものをＱ^ｗ _ｉｊで量子化し、そのランレングスの構造を上記実施の形態１の方法と同様に暗号化し、埋め込みビットｂと、埋め込み位置（ｐ，ｑ）を得る。
（３）ｆ^ｃ _ｐｑを以下のように変更する。
【００８９】
【数１７】

【００９０】
次に、ＪＰＥＧの量子化テーブルを０．４倍した次式の数１８の量子化器で符号化を行う場合の具体例について説明する。。
【００９１】
【数１８】

【００９２】
そして、上記数１６の式から、
【００９３】
【数１９】

【００９４】
である。今、あるブロックのＤＣＴ係数が、次式で与えられるとする。
【００９５】
【数２０】

【００９６】
これをＱ^ｃ _ｉｊで量子化すると、次式のインデックスが得られる。
【００９７】
【数２１】

【００９８】
これをＱ^ｃ _ｉｊで逆量子化し、Ｑ^ｗ _ｉｊで再量子化すると、次式のインデックスを得る。
【００９９】
【数２２】

【０１００】
この量子化構造を暗号化して、埋め込みビットが０ならば、上記数１７の式より、
【０１０１】
【数２３】

【０１０２】
ただし、埋め込み位置は、ジグザグスキャンの直後の（０、３）の位置とした。したがって、透かしを埋め込んだ量子化インデックスは、
【０１０３】
【数２４】

【０１０４】
となる。
【０１０５】
＜２． ＪＰＥＧ の復号アルゴリズム＞
符号化の量子化マトリックスＱ^ｃと、電子透かしの量子化マトリックスＱ^ｗとが一致し、そのステップ幅が全て８以上であれば、逆ＤＣＴした実数値のベクトルをユークリッド距離が最も近い整数値のベクトルに置きかえる復号を行えば、復号後の画像から透かしデータが消えないことが証明できる。しかし、上述したように符号化と、電子透かしとで異なる量子化マトリックスを用いれば、そのことが保証されない。したがって、単純に近接の整数値ベクトルに復号すると透かしデータが消えてしまう場合がある。
【０１０６】
このことを、図９を用いて説明する。
図９は、復号ベクトルの空間を図示したものである。図８において、Ｃｔ はＱｗ で量子化したＤＣＴ 係数の復号ベクトル、ｙはＱｃ で量子化したＤＣＴ 係数の復号ベクトル、○は整数ベクトル、実線で囲んだ領域はＱｗ で量子化して符号化するとＣｔ に復号されるベクトルの集合Ｃ である。Ｃｔ とｙとは実数値のベクトルであり、Ｃｔ は復号する時点で既知である。Ｑｗ＝Ｑｃ であるときは、ｙ＝Ｃｔ である。今、Ｑｗ とＱｃ が異なり、ｙが図の位置に復号されたとする。このとき、ｙに最も近い整数ベクトルはｘ０であり、このベクトルは集合Ｃ の属さない。これを再符号化するとその復号ベクトルはＣｔ とならない。これが、復号ベクトルから透かしが消える原因である。ところが、今、我々はＣｔ を知っている。したがって、ｘ０から近隣の整数ベクトルを辿ってＣｔ に少しずつ近づいていけば、いつかは集合Ｃ に属するベクトルに到着する。この観察から、次の復号アルゴリズムを得る。
【０１０７】
【数２５】

【０１０８】
このアルゴリズムでは、繰返しの各回において、
【０１０９】
【数２６】

【０１１０】
が成り立つ。また、Ｑｗ＞８であれば、Ｃｔ の周辺に集合Ｃ に属する整数ベクトルが存在する。
ゆえに、以上の復号アルゴリズムは常に収束する。
【０１１１】
＜３．評価＞
図１０は、テスト画像（５１２×５１２画素）に対して、符号化の量子化テーブルの細かさを変えて行った実験結果である。表でｓｃａｌｅは量子化の細かさを表す。量子化テーブルはＪＰＥＧのデフォルトのものをｓｃａｌｅの値で乗算して用いた。これが小さくなる程、量子化は細かくなる。また、ｓｃａｌｅが０．８の場合は、全ての量子化パラメータは８以上となり、符号化と透かしで同一の量子化が行われる。Ｎｂｌｋは復号後に整数ベクトルの修正が必要となったブロックの数である。また、Ｎｒｅｐ／Ｎｂｌｋはベクトルが修正された場合に必要とされた繰返し演算の数である。
【０１１２】
図１０から以下のことがわかる。
（１）ｓｃａｌｅ＝０．８の場合は、修正されたブロックは０であり、実施の形態２の結果と合致する。すなわち、全ての量子化パラメータが８以上であれば、ＪＰＥＧ復号後に必ず透かしが残存する。
（２）スケールを小さくすると修正されるブロック数は増加する。
（３）スケールを小さくすると修正に必要な繰り返し演算の数は増加する。しかし、この数は実験の範囲で高々４．５である。
【０１１３】
実験の結果、修正されなかったブロックは存在しない。すなわち、提案のアルゴリズムが確実に収束することが裏付けられた。
【０１１４】
以上説明したように、本実施の形態３によれば、符号化の際の量子化テーブルとは別に、電子透かし用の独立な量子化テーブルと持つことによって、高画質なＪＰＥＧ符号化に対応した認証用電子透かしのアルゴリズムを実現できる。また、復号画像に透かしデータが残存するための復号方法を示した。ここで示した方式はＭＰＥＧなどのブロック単位の符号化方式に展開が可能であると考える。
【０１１５】
なお、上記実施の形態１〜３では、説明の便宜のため、静止画をＪＰＥＧ圧縮符号化により符号化する場合に透かしデータを埋め込む方法について説明したが、本発明では、画像をブロック毎に分割し周波数変換および量子化した量子化インデックスに透かしデータを埋め込めれば良いので、ＤＣＴ変換を使用したＪＰＥＧに限定されず、例えば、ウエーブレット変換を使用するＪＰＥＧ２０００などにも適用可能であるし、さらにはＭＰＥＧ等の動画を圧縮する圧縮符号化手法にも適用可能である。
【０１１６】
【発明の効果】
以上説明したように、本発明によれば、画像データを量子化した量子化インデックスのランレングス構造を署名データとして画像データに埋めこむようにしたので、画像データが改ざんされていないことを証明することができる。
【図面の簡単な説明】
【図１】本発明に係る電子透かし埋め込み方法が実行される実施の形態１の画像符号化装置の構成を示す図。
【図２】量子化インデックスの一例を示す図。
【図３】ｎが７まであるＪＰＥＧで（ｎ、±１）を符号化するためのハフマン符号の符号長の一例を示す図。
【図４】量子化テーブルの一例を示す図。
【図５】本発明に係る電子透かし埋め込み方法により符号化ストリームを復号する画像復号装置における透かしデータ検出回路の一例を示す図。
【図６】２元アダマール変換の時間領域（ｘ−ｙ 座標）と、変換領域（ｕ−ｖ 座標）のサンプル点の構造の一例を示す図。
【図７】実施の形態１において５つのテスト画像を用いて全てのＤＣＴ係数を同じステップ幅Ｑで量子化し、それを復号した後、再符号化して異なるクラスにマッピングされるブロック数の一例を示す図。
【図８】本発明に係る電子透かし埋め込み方法が実行される実施の形態３の画像符号化装置の構成を示す図。
【図９】復号ベクトルの空間の一例を示す図。
【図１０】実施の形態３においてテスト画像に対し符号化の量子化テーブルの細かさを変えて行った実験結果の一例を示す図。
【符号の説明】
１ ＤＣＴ部、２ 量子化部、３ ジグザグスキャン部、４ ランレングス化部、５ ダミーラン付加部、６ ハッシュ関数部、７ 排他的論理和（ＥＸＯＲ）部、８ 暗号化部、９ 透かし埋め込み部、１０ 可変長符号化部、１１ ストリーム符号化部。[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a digital watermark embedding method, a digital watermark embedding program, a digital watermark embedding device, and an image encoding device that can prove the authenticity of an image.
[0002]
[Prior art]
Conventionally, there is a method of Wong et al. As a method of proving the authenticity of an image compressed and encoded by JPEG or the like. In this method, the hash value of the upper 7 bits of an image is encrypted with watermark information and a key and embedded in an LSB (for example, see Non-Patent Document 1).
[0003]
[Non-patent document 1]
"Secret and Pubic Key Image Watermarking Schemes for Image Authentication and Ownership Verification" by Ping WON EM O EM ION EM O NG EM O NG EM O N E G E O M E N O G E O N E MON EM
[0004]
[Problems to be solved by the invention]
However, according to the method of Wong et al., Even if the image is changed even by one bit, the change can be almost certainly detected. However, since the watermark data is embedded in the LSB, it is embedded in the LSB when compressed by JPEG or the like. However, there was a problem that the watermark data was truncated.
[0005]
Therefore, the present invention provides a digital watermark embedding method, a digital watermark embedding program, a digital watermark embedding program, and a digital watermark embedding method that can reliably verify the authenticity of an image even when a compressed encoded image in which the watermark data is embedded is decoded. It is an object to provide a device and an image encoding device.
[0006]
[Means for Solving the Problems]
In order to achieve the above object, in the present invention, a run length structure of a quantization index obtained by quantizing image data is embedded in image data as signature data. Specifically, a transform coefficient for each block is quantized. When embedding watermark data into the quantized quantization index, the quantization index is run-lengthized for each of the blocks, data obtained by arranging the run-length data for each block is converted into a hash value, and the hash value is converted to the hash value. Embedding watermark data to generate signature data composed of a plurality of bits, associating each of the plurality of bits constituting the signature data with each of the blocks, and for each of the blocks, providing a different value according to the corresponding bit of the signature data The signature bit is placed at a predetermined position of the quantization index.
[0007]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiment 1.
FIG. 1 is a diagram illustrating a configuration of an image encoding device according to a first embodiment in which a digital watermark embedding method according to the present invention is executed. In the figure, the image encoding apparatus includes a JPEG encoding unit 1 for performing JPEG compression encoding on an input image, and digital watermark embedding for embedding watermark data in a JPEG compression encoded signal by a digital watermark embedding method according to the present invention. 2. Since the JPEG encoding unit 1 performs normal JPEG compression encoding, the digital watermark embedding method according to the present invention performed by the digital watermark embedding unit 2 will be described below.
[0008]
First, an outline of Embodiment 1 of a digital watermark embedding method according to the present invention will be described. The outline of the present invention is as follows. First, a run-length structure of quantized DCT coefficients is encoded using N DCT blocks as one unit. The hash value (N bits) of the encoded code is encrypted with the watermark information and the key, and the result is added to the end of each DCT block scan. At this time, the value of the last DCT coefficient is −1 if the bit is 0, and 1 if the bit is 1. The run length of the added coefficient must be included in the calculation of the hash value in advance. In this method, the run-length structure of the DCT coefficients is embedded at the end of the DCT block. Therefore, if this structure is changed even by one bit, it can be detected. Further, since the last DCT coefficient takes only a value of +1 or -1, if the value is changed to another value, the change can be detected without fail. Even after the image is decoded, the authenticity can be checked by checking the run-length structure using the same quantizer. When image degradation was evaluated by computer simulation, when a watermark was embedded in a JPEG image having a PSNR of 35.8 dB, the PSNR was 33.7 dB.
[0009]
That is, in the first embodiment, first, the run-length structure of the quantized DCT coefficients is encoded using N DCT blocks as one unit. The hash value (N bits) of the encoded code is encrypted with the watermark information and the key, and the result is added to the end of each DCT block scan. At this time, the value of the last DCT coefficient is −1 if the bit is 0, and 1 if the bit is 1. The run length of the added coefficient must be included in the calculation of the hash value in advance. In this method, the run-length structure of the DCT coefficients is embedded at the end of the DCT block. Therefore, if this structure is changed even by one bit, it can be detected. Further, since the last DCT coefficient takes only a value of +1 or -1, if the value is changed to another value, the change can be detected without fail. Further, even after the image is decoded, the authenticity can be checked by examining the run-length structure using the same quantizer as that on the encoding side. When image degradation was evaluated by computer simulation, when a watermark was embedded in a JPEG image having a PSNR of 35.8 dB, the PSNR was 33.7 dB.
[0010]
One purpose of the digital watermark for authentication is to prove that the image has not been changed, that is, that the images are the same. For this reason, in the present invention, what defines two images before encoding and after decoding to be the same is defined as follows. In the present invention, the two images before encoding and after decoding are processed at the stage of raw data. It does not matter that they are exactly the same, but it is sufficient that they be the same at the quantized stage. That is, in the present invention, when the DCT coefficients of two images are encoded with the same quantization parameter and the quantization indexes are exactly the same, these images are assumed to be the same, and the quantized index Are different, it is assumed that the two images are different. Hereinafter, based on this definition, a digital watermarking algorithm for reliably detecting an image change, that is, when one or more quantization indices are considered different, will be proposed.
[0011]
FIG. 1 is a diagram showing an example of a configuration of an image encoding device in which a digital watermark embedding method according to the present invention is executed. In FIG. 1, the image encoding apparatus includes a DCT unit 1, a quantization unit 2, a zigzag scan unit 3, a run length generation unit 4, a dummy run addition unit 5, a hash function unit 6, and an exclusive OR (EXOR) unit 7. , An encryption unit 8, a watermark embedding unit 9, a variable-length encoding unit 10, and a stream encoding unit 11. When JPEG compression encoding of an input host image is performed, watermark data such as a signature image is converted to a public key. It is configured to be converted into an embedded watermarked stream as an electronic watermark by encrypting it by a cryptosystem and for each N (N is a natural number) block to be output. Note that the DCT unit 1, the quantization unit 2, the zigzag scan unit 3, the run length conversion unit 4, the variable length coding unit 10, the stream coding unit 11, and the like perform normal JPEG compression coding. The following mainly describes the digital watermark embedding method according to the present invention.
[0012]
<2. Digital watermark embedding algorithm>
In the first embodiment, a macroblock is formed by combining N 8 × 8 DCT blocks, and N-bit signature data in which watermark data such as a bitmap signature image is embedded is embedded in the macroblock. .
[0013]
<2.1 Signature data generation>
The signature data in which the watermark data is embedded is created as follows.
[0014]
First, the DCT unit 1 divides one image into a plurality of macroblocks, divides each macroblock into N blocks which are 8 × 8 DCT coding units, and the quantization unit 2 The DCT coefficient of each block is quantized for each block, and the zigzag scanning unit 3 scans the quantization index in a zigzag manner. The run length unit 4 expresses the quantization index obtained by the zigzag scan by the run length. Up to this point, there is no change from the past.
[0015]
In the first embodiment, the hash function unit 6 arranges the run-length data in the number of blocks, that is, N blocks, and converts the run-length data in which the number of blocks is arranged into an N-bit hash value by a hash function. However, before or at that time, the dummy run adding unit 5 adds one dummy run to the end of the run length of each block. This dummy run is used for later embedding the signature data in a JPEG bit stream. Note that this dummy run may be 0 or a value other than 0 as described later, and is not necessarily required. Further, as described later, here, run-length data in which N blocks, which are the number of blocks, are arranged is converted into an N-bit hash value by a hash function. It is most efficient to make each bit of the value correspond to the run-length data of each of N blocks one bit at a time. In the present invention, the run-length structure of the block, that is, the quantization structure of the DCT coefficient is used. Is reflected in the hash value, which is the signature data, and the signature data only needs to correspond to the run-length data of each of the N blocks. For example, it is converted into a hash value of an integer multiple of N or a bit number smaller than N, and a hash value of a plurality of bits is provided for each of the N blocks. Or in association, it can also have the same hash value into a plurality of blocks so as to correspond.
[0016]
Next, the exclusive OR unit 7 takes the exclusive OR between the N-bit hash value and the watermark data such as a bitmap-format signature image and embeds the watermark data in the N-bit hash value. , The encryption unit 8 encrypts this with a secret key to obtain N-bit signature data. In this case, the N-bit hash value in which the watermark data is embedded by taking an exclusive OR with the watermark data is encrypted with the secret key. However, the present invention is not limited to this. If it is not necessary to perform encryption using the same common key for transmission and reception as in the system, or if encryption is not necessary, the encryption processing itself may be omitted.
[0017]
Next, the processing until the above-mentioned N-bit signature data is obtained will be specifically described.
It is assumed that when the DCT coefficient is quantized for a certain block, for example, the quantization index shown in FIG. 2 is obtained. From this, the following (run, size) set is obtained.
[0018]
(15), (1, -2), (0, -1), (0, -1), (0, -1), (2, -1)
[0019]
Here, the first 15 is the index of the DC coefficient, the following values in parentheses are the numbers of 0 runs, and the subsequent values are the indexes of the AC coefficients. Here, for example, 3 is added as a dummy run,
[0020]
(15), (1, -2), (0, -1), (0, -1), (0, -1), (2, -1), (3)
[0021]
Get. An N-bit hash value is obtained by the hash function using the data obtained by arranging N pieces of data in order of each block as an input of the hash function.
[0022]
<2.2 Embedding Signature Data>
The N-bit signature data in which the watermark data is embedded as described above is embedded in each block, one bit at a time, for example, as follows.
[0023]
That is, when the bit of the signature data is 0, the value after the dummy run of the block is set to -1. When the bit is 1, the value after the dummy run of the block is set to +1.
[0024]
For example, in the example shown in FIG. 2, if the bit to be embedded is 0, the structure of the run length of the quantization index is:
[0025]
(15), (1, -2), (0, -1), (0, -1), (0, -1), (2, -1), (3, -1)
[0026]
Becomes Then, as in the case of normal encoding, stream encoding for adding a header or the like to this is performed.
[0027]
<2.3 Certification of certification ability>
With respect to an image in which a digital watermark is embedded by the above algorithm, it can be proved as follows that if even one index after quantization changes, it can be reliably detected.
[0028]
That is, if the signature bit, that is, the portion other than the value of +1 or −1 at the end of the run length, changes in the structure of the run length of the quantization index, the hash value changes. Cannot be detected.
[0029]
On the other hand, if the signature bit changes, the embedded watermark data cannot be detected because the hash value detected from the image does not match the signature bit. From the above, the embedded data can be detected only when the signature bit and other indexes have not changed.
[0030]
Here, in the case of the first embodiment, it is important that there are only two types of signature bits, +1 and -1. For example, when a method of embedding information by quantizing to an even number or an odd number, which is often used in a robust digital watermark, is used, since even or odd values are not determined in one way, it is assumed that images having different run-length structures are the same. This is because it may be considered. In the case of the present invention, the signature bit does not need to be ± 1, and if it is determined in advance as one, there may be three or more types other than ± 1.
[0031]
<2.4 Increase in code amount>
In this algorithm, a set of (run, size) is added to each block for embedding a signature, so that the code amount after JPEG increases. Here, since the value of the size of the signature bit is only ± 1, the amount of increase in the code amount is determined only by the run.
[0032]
FIG. 3 shows the code length of the Huffman code for encoding (n, ± 1) in JPEG in which n is up to 7. From FIG. 3, for example, if the dummy runs are set to 3 in all the blocks, the increase in the code amount per pixel is as follows.
[0033]
(Equation 1)

[0034]
It is.
[0035]
<2.5 Increase in distortion>
The distortion bit in the JPEG image increases because of the signature bit ± 1 at the end of each block used for embedding the signature. The amount of increase depends on the roughness of quantization, and the coarser the amount, the greater the amount of increase. For example, assuming that the watermark is embedded at the position (3, 3) of the block using the quantization table of FIG. 4, the amount of increase in distortion per pixel is approximately equivalent to power.
[0036]
(Equation 2)

[0037]
It is. In this case, when a watermark is applied to a JPEG image of PSNR = 42 dB, the PSNR is reduced by 3 dB.
[0038]
Therefore, the length of the dummy run should be set appropriately from the viewpoint of increasing the code amount and distortion.
[0039]
<2.6 JPEG About decryption issues>
Next, a problem in decoding an encoded stream by the digital watermark embedding method as described above will be described.
[0040]
FIG. 5 is a diagram showing an example of a watermark data detection circuit in an image decoding device that decodes an encoded stream by the digital watermark embedding method according to the present invention. 5, the image decoding apparatus includes a stream decoding unit 21, a variable length decoding unit 22, a watermark separation unit 23, an encryption decoding unit 24, an inverse hash function unit 25, and an exclusive OR unit 26. 1 by inputting an encoded stream encoded by the image encoding apparatus shown in FIG. 1 and performing stream decoding, variable length decoding, watermark separation, encryption / decryption using a public key, an inverse hash function, and exclusive OR. , And is configured to detect watermark data. Note that the image decoding device itself is configured to perform processing in a manner opposite to that of the image encoding device illustrated in FIG. 1 and thus will not be described here.
[0041]
If a JPEG encoded image is decoded and then encoded with the same quantization parameter again, the run-length structure may change. In this case, the decoded image has already lost its authenticity at that stage. In order to prevent this, JPEG decoding must be performed so that the quantization structure becomes the same when re-encoding. As a result, the authenticity is maintained after JPEG decoding. I think such a decoding method is possible, but this report does not discuss it in detail. The condition that the watermark remains after decoding is important. The reason is that if it is only necessary to prove the authenticity at the stage of a JPEG stream, this can be realized without using watermark data, for example, by adding a MAC (Message Authentication Code). .
[0042]
<3. Evaluation>
A certain person image was JPEG-encoded, and a signature was embedded in the image to evaluate deterioration in image quality. However, the details of the signature are not implemented. A random bit sequence was used as the signature data. When a signature is not embedded in a person image encoded by JPEG using the quantization table of FIG. 4, it is assumed that the PSNR of this image is 35.8 dB, and a signature with a dummy run of 0 is assigned to this image. Let's embed. However, as described above. The signature bit is padded immediately after the last non-zero coefficient of the zigzag scan. Then, the PSNR of the image after the signature bits are embedded is 33.7 dB with respect to the original image. Where the watermark is embedded, the distortion is slightly noticeable in a flat part such as the background, but this distortion can be reduced by making the quantization finer.
[0043]
As described above, in the first embodiment, the run length structures obtained by quantizing the DCT coefficients for each of the blocks obtained by dividing the macroblock into N pieces are arranged by the number of blocks by using a hash function. When converting to a hash value of bits, one dummy run is added to the end of the run length of each block, watermark data is embedded in the hash value of N bits, and this is encrypted with a secret key to sign an N bit. When data is obtained and the N bits of the signature data are used as watermark data, and the bit is 0 for each bit in each block, the value after the dummy run of the block is set to -1 while the bit is 1 Embeds the value after the dummy run of the block as +1. Therefore, even if the DCT coefficient of the image or the quantization value of the signature bit is slightly changed, It can be detected almost certainly change.
[0044]
Embodiment 2
The first embodiment has proposed a digital watermarking method that guarantees the authenticity of a JPEG image. Using this method, it is possible to know only from the image data that the JPEG image has not been tampered with after the signature of the issuer. In this method, the watermark data remains unless the quantization structure of the DCT coefficient changes, but the digital watermark is destroyed if the quantization structure of the DCT coefficient changes even slightly. Therefore, in order for the watermark data to remain in the image after JPEG decoding, it is necessary to completely retain the original quantization structure when re-encoding the image after JPEG decoding. However, in general JPEG decoding, image data that has been subjected to inverse DCT is usually rounded to an 8-bit integer value, so that when the decoded image is JPEG-coded again, the quantization structure may change. Therefore, in the second embodiment, it is proved that the quantization structure after re-encoding is preserved by setting the quantization step width to sqrt (N) or more. Here, N is the DCT block size, which is 64 in the case of 8 × 8 DCT. Therefore, if the quantization of the DCT coefficient is performed with a step width larger than 8, the digital watermark does not disappear from the JPEG decoded image. As a result of actually performing re-encoding on some standard images, the quantization structure did not change by the re-encoding if the step width was set to 4 or more.
[0045]
That is, the digital watermark for certifying the authenticity is for certifying two things that the image data is (1) venerable and (2) has not been tampered with. According to the method of Wong et al., (1) is realized when an image issuer encrypts watermark data with his / her own secret key, and (2) uses a hash value of image data with encrypted data of (1). It is said that this is realized by XORing and embedding in the image, but Wong could not use it for a compressed image such as JPEG because Wong puts the watermark data in the LSB of the image data. In the first embodiment, the Wong algorithm is extended for an image encoded by JPEG. According to this, the JPEG quantization structure is given to the hash function, and the XOR of the hash function and the encrypted data is embedded at the end of the DCT block. However, even if an image decoded by JPEG is re-encoded using the same quantizer, there is no guarantee that the quantization structure will be reproduced. Therefore, there is a problem in that once the data is decoded by JPEG, the watermark data may disappear. In the second embodiment, the disappearance of the watermark due to JPEG decoding is prevented by setting the quantization step size to 8 or more. In addition, this is confirmed using an actual image.
[0046]
<1. JPEG Why decryption is not lossless>
In JPEG encoding, the pixel value is truncated to an integer after the quantized DCT coefficient is inversely quantized, so that generally there is no guarantee that the same bit stream will be obtained if the decoded image is encoded again. This will be described with reference to FIG.
[0047]
FIG. 6 shows the structure of sample points in the time domain (xy coordinates) of the binary Hadamard transform and the transform domain (uv coordinates). The Hadamard transform is given by the following equation (3).
[0048]
(Equation 3)

[0049]
Here, x and y are coordinates in the time domain, and the image data is an integer, so the sample point is represented by ● in the figure. From the above equation (3), since the binary Hadamard transform is equivalent to a 45 ° rotational movement, ● is transformed into coordinates read by the uv coordinates in the figure in the transform domain. Now, consider scalar quantization of u and v with a uniform step width. However, if u is quantized more finely than v, for example, a boundary of quantization as shown by a dotted line in the figure is obtained. For each class surrounded by the boundary, a representative value of quantization is given at the position of ○. Looking at the hatched class i, there are two vectors xi1 and xi2 in this class, both of which are quantized to xi after the transformation. When this xi is inversely transformed back to an integer value, the closest integer is not the vector of class i but the vector xj2 of class j. Therefore, when xj2 is re-encoded, the vector after quantization becomes xj and does not match xi.
[0050]
Thus, the reason that the transform vector is not lossless is that the integer vector closest to the quantized representative value does not necessarily belong to its own class. This can occur not only in the Hadamard transform but also in DCT, and it is clear that the order is not related.
[0051]
From the consideration of FIG. 6, it is expected that if the quantization width is increased, many integer vectors belonging to the class exist around the representative value, and loss will not easily occur in re-encoding. Therefore, in the second embodiment, the encoding is completely lossless by setting the quantization width larger than N (N is the order of the transformation), as described below.
[0052]
<2. Restriction on Quantization for Lossless Decoding>
In the encoding, the quantization of the transform coefficients is uniform scalar quantization. In decoding, it is assumed that the inversely transformed vector is truncated to an integer vector having the closest Euclidean distance. Also, ignoring the calculation error of the transformation and the inverse transformation, the distance must be maintained before and after the transformation. However, if Qi> √N is satisfied for all the transformation coefficients of the orthogonal transformation, the inversely transformed vector is obtained. Will belong to the same class as the original transform coefficients. Here, Qi is the quantization step width of the i-th transform coefficient, and N is the order of the transform.
[0053]
Prove this. The inversely transformed vector is
[0054]
(Equation 4)

[0055]
And Here, without loss of generality,
[0056]
(Equation 5)

[0057]
It may be. Integer vector around vector c
[0058]
(Equation 6)

[0059]
If so,
[0060]
(Equation 7)

[0061]
X that satisfies^NExists. Among them, the vector closest to c is
[0062]
(Equation 8)

[0063]
Then
[0064]
(Equation 9)

[0065]
Therefore, the following equation 10 holds.
[0066]
(Equation 10)

[0067]
From the above equation (10) and the condition Q> √N,
[0068]
(Equation 11)

[0069]
Holds. Here, Q is the minimum value of the quantization step width Qi. on the other hand,
[0070]
(Equation 12)

[0071]
The vector x that satisfies is always quantized to c. Because, if the above equation (12) holds, for all i,
[0072]
(Equation 13)

[0073]
Is satisfied. From the above, it has been shown that the vector Xc always belongs to the class c when re-encoded.
[0074]
<4. Evaluation>
Using the five test images, all DCT coefficients were quantized with the same step width Q 1, decoded, and then re-encoded to determine the number of blocks mapped to different classes.
[0075]
FIG. 7 shows the result.
The size of each image is 512 × 512, and the number of blocks is 4096. From the table, it can be seen that if Q = 8, in all cases, mapping is performed to the same class after re-encoding. In this example, it can be seen that losslessness is satisfied if Q = 4.
[0076]
As described above, according to the second embodiment, JPEG compression is made lossless by further restricting the quantization step width in the first embodiment. By using this, it is possible to guarantee that the watermark data for authentication does not disappear even after JPEG decoding.
[0077]
Note that the constraint of Q = 8 may be too strong when emphasizing image quality. In that case, it is possible to use different quantization tables for JPEG compression and digital watermarking. Then, a restriction of Q = 8 may be imposed only on the quantization table of the digital watermark. In this case, the equation (12) is no longer satisfied, so it is necessary to perform integer conversion in JPEG decoding so that the watermark data does not disappear.
Such a decoding method is possible and details will be reported separately.
[0078]
Embodiment 3.
The first embodiment proposes a digital watermarking method for proving that an image is not falsified by embedding a JPEG quantization structure as signature data. In the second embodiment, the watermark remains even after JPEG decoding by setting the quantization step width of the DCT coefficient to 8 or more.
[0079]
In the third embodiment, an authentication digital watermarking method suitable for high-quality JPEG compression is proposed by removing the restriction of quantization. In brief, the method of the third embodiment has a quantization table for compression and a quantization table for digital watermarking, and the compression is finely quantized, while the digital watermark is coarsely quantized. By doing so, it is possible to achieve both the image quality of encoding and the remaining digital watermark. Here, the quantization step width of the digital watermark is set to be 8 or more. However, this change does not guarantee the remaining digital watermark in general JPEG decoding in which the result of the inverse DCT is replaced with the nearest integer value. Therefore, the third embodiment proposes a JPEG decoding method that guarantees the remaining of the digital watermark. According to the third embodiment, it has been confirmed by computer experiments using a quantization table of the JPEG standard that the watermark data after decoding does not disappear even if the scale factor is reduced to 0.1. At this time, the PSNR of the JPEG image in which the watermark data is embedded is 40 dB or more. Further, the digital watermarking method proposed in the third embodiment can be applied to adaptive coding for locally modulating the quantization width, and further to moving picture coding such as MPEG.
[0080]
By using the methods of the first and second embodiments, it is possible to prove that an image compressed by JPEG is (1) an authorized publisher and (2) that the image has not been tampered with only the image data. . Also, it is guaranteed that the digital watermark for that purpose will remain even after decoding by JPEG. However, the restriction according to the second embodiment is that JPEG quantization is performed with a step width of 8 or more, which is not suitable for high quality JPEG compression. In the third embodiment, a digital watermark algorithm that does not require this restriction and a JPEG decoding method for leaving a watermark after decoding will be described.
[0081]
<1. Digital Watermark Algorithm of Third Embodiment>
The details of the algorithm are the same as in the first embodiment. That is, the basic algorithm encrypts the quantization structure of the DCT coefficient of the image and adds it to the end of the DCT block. In the first and second embodiments, the same quantizer 21 is used for the quantizer for compressing image data and the quantizer for digital watermarking. However, in order to guarantee that the watermark remains after JPEG decoding, there are certain restrictions on the quantization of the digital watermark as described in the second embodiment, and it is necessary to use a very fine quantizer. Can not. Therefore, the third embodiment proposes a method of using different quantizers for image data compression and a watermark, respectively.
[0082]
FIG. 8 is a diagram illustrating a configuration of an image encoding device according to a third embodiment in which the digital watermark embedding method according to the present invention is executed. 8, the image encoding apparatus includes a DCT unit 1, two quantization units 2A and 2B, two zigzag scan units 3A and 3B, two run-length units 4A and 4B, a dummy run addition unit 5, a hash function It has a unit 6, an exclusive OR (EXOR) unit 7, an encryption unit 8, a watermark embedding unit 9, a variable-length encoding unit 10, and a stream encoding unit 11, and JPEG compression-encodes an input host image. At the time, watermark data such as a signature image is encrypted by a public key cryptosystem, converted as an electronic watermark, and converted and output for each N (N is a natural number) block as an encoded stream. The difference from the first embodiment is that the input host image is subjected to different quantization tables, that is, a quantization table Qc for compression, and a different quantization table for digital watermarking by the two quantization units 2A and 2B. The point is that quantization is performed separately by Qw. Note that, as in the first embodiment, the DCT unit 1, the quantization unit 2, the zigzag scan unit 3, the run length conversion unit 4, the variable length coding unit 10, the stream coding unit 11, etc. Since the JPEG compression encoding is performed, a digital watermark embedding method according to the third embodiment will be mainly described below.
[0083]
First, the quantization step of the quantization unit 2A for compression is Q^c _ij, The quantization step of the quantization unit 2B for digital watermark^w _ij(I, j = 0, 1,..., 7). Here, the following condition must be satisfied for all i and j.
[0084]
[Equation 14]

[0085]
[Equation 15]

[0086]
The condition of the above equation (14) is necessary for embedding the watermark data. Further, the condition of the above equation (15) is necessary for watermark data to remain after JPEG decoding. To satisfy this condition, any Q^c _ijFor Q^w _ijMay be set as follows.
[0087]
(Equation 16)

[0088]
In order to embed watermark data in a DCT block, the following is performed.
(1) DCT coefficient f_ijTo Q^c _ijAnd quantized by f^c _ijGet.
(2) f^c _ijTo Q^c _ijQ that is inversely quantized by^w _ij, And the run length structure is encrypted in the same manner as in the first embodiment to obtain an embedded bit b and an embedded position (p, q).
(3) f^c _pqIs changed as follows.
[0089]
[Equation 17]

[0090]
Next, a description will be given of a specific example in which encoding is performed by a quantizer represented by the following expression 18 obtained by multiplying a JPEG quantization table by 0.4. .
[0091]
(Equation 18)

[0092]
Then, from the above equation (16),
[0093]
[Equation 19]

[0094]
It is. Now, it is assumed that the DCT coefficient of a certain block is given by the following equation.
[0095]
(Equation 20)

[0096]
This is Q^c _ijThe following index is obtained by quantization.
[0097]
(Equation 21)

[0098]
This is Q^c _ijInverse quantization with Q^w _ijWhen requantization is performed, the following index is obtained.
[0099]
(Equation 22)

[0100]
If this quantization structure is encrypted and the embedded bit is 0, from the above equation (17),
[0101]
(Equation 23)

[0102]
However, the embedding position was the position (0, 3) immediately after the zigzag scan. Therefore, the quantization index with the embedded watermark is
[0103]
[Equation 24]

[0104]
Becomes
[0105]
<2. JPEG Decryption algorithm>
Coding quantization matrix Q^cAnd the digital watermark quantization matrix Q^wIf the step widths are all 8 or more, the watermark data is not erased from the decoded image by performing decoding by replacing the inverse DCT real-valued vector with an integer-valued vector having the closest Euclidean distance. It can be proved. However, if different quantization matrices are used for encoding and digital watermarking as described above, this is not guaranteed. Therefore, watermark data may disappear when simply decoding to a nearby integer value vector.
[0106]
This will be described with reference to FIG.
FIG. 9 illustrates the space of the decoded vector. In FIG. 8, Ct is a decoded vector of the DCT coefficient quantized by Qw, y is a decoded vector of the DCT coefficient quantized by Qc, は is an integer vector, and a region surrounded by a solid line is quantized by Qw to be encoded. Is a set of vectors C 1 decoded to. Ct and y are real-valued vectors, and Ct is known at the time of decoding. When Qw = Qc, y = Ct. Now, it is assumed that Qw and Qc are different and y is decoded at the position shown in the figure. At this time, the integer vector closest to y is x0, and this vector does not belong to the set C 1. When this is re-encoded, the decoded vector does not become Ct. This is why the watermark disappears from the decoded vector. However, now we know Ct. Therefore, if the robot approaches the integer vector little by little by tracing a neighboring integer vector from x0, it will eventually arrive at a vector belonging to the set C 1. From this observation, the following decoding algorithm is obtained.
[0107]
(Equation 25)

[0108]
In this algorithm, at each iteration,
[0109]
(Equation 26)

[0110]
Holds. If Qw> 8, an integer vector belonging to the set C 1 exists around Ct.
Therefore, the above decoding algorithm always converges.
[0111]
<3. Evaluation>
FIG. 10 shows the results of an experiment performed on a test image (512 × 512 pixels) by changing the fineness of the encoding quantization table. In the table, “scale” indicates the level of quantization. The quantization table used was obtained by multiplying the default value of JPEG by the value of scale. The smaller this is, the finer the quantization. When the scale is 0.8, all the quantization parameters are 8 or more, and the same quantization is performed for encoding and watermarking. Nblk is the number of blocks that require modification of the integer vector after decoding. Nrep / Nblk is the number of iterative operations required when the vector is modified.
[0112]
The following can be seen from FIG.
(1) When scale = 0.8, the corrected block is 0, which matches the result of the second embodiment. That is, if all the quantization parameters are 8 or more, the watermark always remains after JPEG decoding.
(2) When the scale is reduced, the number of blocks to be corrected increases.
(3) When the scale is reduced, the number of repetitive operations required for correction increases. However, this number is at most 4.5 within the scope of the experiment.
[0113]
As a result of the experiment, there is no block that has not been modified. That is, it was confirmed that the proposed algorithm converged reliably.
[0114]
As described above, according to the third embodiment, high-quality JPEG encoding is supported by having an independent quantization table for digital watermarking separately from the quantization table for encoding. An authentication digital watermark algorithm can be realized. Also, a decoding method for remaining watermark data in a decoded image has been described. It is considered that the method shown here can be expanded to an encoding method in block units such as MPEG.
[0115]
In the first to third embodiments, for convenience of description, a method of embedding watermark data when a still image is encoded by JPEG compression encoding has been described. However, in the present invention, an image is divided into blocks. Since it is only necessary to embed the watermark data in the quantized index that has been frequency-transformed and quantized, the present invention is not limited to JPEG using DCT transform, but is also applicable to, for example, JPEG2000 using wavelet transform. Is also applicable to a compression encoding method for compressing moving images such as MPEG.
[0116]
【The invention's effect】
As described above, according to the present invention, since the run-length structure of the quantization index obtained by quantizing the image data is embedded in the image data as signature data, it is proved that the image data is not falsified. Can be.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of an image encoding device according to a first embodiment in which a digital watermark embedding method according to the present invention is executed.
FIG. 2 is a diagram illustrating an example of a quantization index.
FIG. 3 is a diagram showing an example of a code length of a Huffman code for encoding (n, ± 1) in JPEG in which n is up to 7.
FIG. 4 is a diagram showing an example of a quantization table.
FIG. 5 is a diagram showing an example of a watermark data detection circuit in an image decoding device that decodes an encoded stream by the digital watermark embedding method according to the present invention.
FIG. 6 is a diagram showing an example of the structure of sample points in a time domain (xy coordinates) of a binary Hadamard transform and a transform domain (uv coordinates).
FIG. 7 shows an example of the number of blocks mapped to different classes after quantizing all DCT coefficients with the same step width Q using five test images in Embodiment 1 and decoding and decoding them. FIG.
FIG. 8 is a diagram showing a configuration of an image encoding device according to a third embodiment in which a digital watermark embedding method according to the present invention is executed.
FIG. 9 is a diagram illustrating an example of a space of a decoded vector.
FIG. 10 is a diagram illustrating an example of an experimental result obtained by changing the fineness of an encoding quantization table for a test image in the third embodiment.
[Explanation of symbols]
1 DCT section, 2 quantization section, 3 zigzag scan section, 4 run length conversion section, 5 dummy run addition section, 6 hash function section, 7 exclusive OR (EXOR) section, 8 encryption section, 9 watermark embedding section, 10 Variable length coding unit, 11 Stream coding unit.

Claims (9)

In a digital watermark embedding method for embedding watermark data with respect to a quantization index obtained by quantizing transform coefficients for each of N (N is a natural number) blocks,
The quantization index is run-lengthized for each block, data obtained by arranging the run-length data for the block is converted into an N-bit hash value, and watermark data is embedded in the N-bit hash value to generate an N-bit signature. Generate data,
Each bit of the N-bit signature data is made to correspond to each of the N blocks, and a signature bit of a different value is determined according to whether the value of each bit of the signature data is 0 or 1. A digital watermark embedding method that is inserted at a predetermined position. 2. The digital watermark embedding method according to claim 1, further comprising:
When the quantization index is run-lengthized for each block, a dummy run is added at the end of the run-length data,
A digital watermark embedding method for inserting a signature bit having a different value into a predetermined position of a quantization index according to whether the value of each bit of the N-bit signature data is 0 or 1 after the dummy run. In the digital watermark embedding method according to any one of claims 1 and 2,
Each bit of the N-bit signature data is made to correspond to one of the N blocks, and the signature bits having different values depending on whether the value of each bit of the signature data is 0 or 1 are +1 and A digital watermark embedding method. When performing encoding processing including quantization on image data in which the watermark data is embedded by the digital watermark embedding method according to any one of claims 1 to 3, the quantization step width is set to An image coding method in which the number of blocks is equal to or larger than the square root of N. In a digital watermark embedding method for embedding watermark data with respect to a quantization index obtained by quantizing transform coefficients for each of N (N is a natural number) blocks,
When generating the above-mentioned quantization index, a plurality of quantization indexes having different quantization precisions are generated by performing quantization using a plurality of quantization tables,
For a quantization index with a coarse quantization accuracy, the quantization index with a coarse quantization accuracy is run-lengthized for each block, and the data obtained by arranging the run-length data for the block is converted into an N-bit hash value. Converting, embedding the watermark data in the N-bit hash value to generate N-bit signature data,
For a quantization index with a fine quantization precision, the quantization index with the fine quantization precision is run-lengthized for each of the blocks, and each bit of the N-bit signature data is converted into a corresponding one of the N blocks. One of the run length data of the quantization index having the fine quantization precision is associated with one, and a signature bit having a different value according to whether the value of each bit of the signature data is 0 or 1 is quantized with the fine quantization precision. A method for embedding a digital watermark at a predetermined position in an index. A digital watermark embedding program for causing a computer to execute the digital watermark embedding method according to any one of claims 1 to 5. In a digital watermark embedding device that embeds watermark data with respect to a quantization index obtained by quantizing a transform coefficient for each block,
The quantization index is run-lengthized for each block, data obtained by arranging run-length data for each block is converted into a hash value, and watermark data is embedded in the hash value to generate signature data composed of a plurality of bits. ,
Digital watermark embedding, in which a plurality of bits constituting the signature data are made to correspond to the respective blocks, and for each of the blocks, a signature bit having a different value according to a bit of the corresponding signature data is inserted into a predetermined position of a quantization index. apparatus. An image encoding method for encoding image data in which the watermark data is embedded by the digital watermark embedding method according to claim 1. An image encoding apparatus having a digital watermark embedding unit configured to embed watermark data in a JPEG encoded image by the image encoding method according to claim 8.

Images