JP4019961B2 - Digital watermark embedding method, digital watermark embedding program, digital watermark embedding device, image encoding method, and image encoding device - Google Patents

Description

【００３４】
である。
【００３５】
＜２．５ 歪みの増加＞
署名の埋め込みのために用いる各ブロック最後の署名ビット±１のために、ＪＰＥＧ画像の歪みが増加する。この増加量は量子化の粗さに依存し、それが粗いほど増加量は大きい。例えば、図４の量子化テーブルを用いて、透かしの埋め込みが、ブロックの（３、３）の位置に対して行われたとすると、画素当りの歪みの増加量は、電力にして、およそ
【００３６】
【数２】

【００３７】
である。この場合、ＰＳＮＲ＝４２ｄＢのＪＰＥＧ画像に透かしを入れたとき、そのＰＳＮＲは３ｄＢ減少することになる。
【００３８】
したがって、ダミーのランの長さは、符号量と歪みの増加の観点から、適切に設定すべきである。
【００３９】
＜２．６ JPEG復号の問題について＞
次に、以上のような電子透かし埋め込み方法により生成した符号化ストリームを復号する際の問題について説明する。
【００４０】
図５は、本発明に係る電子透かし埋め込み方法により生成した符号化ストリームを復号する画像復号装置における透かしデータ検出回路の一例を示す図である。図５において、この画像復号装置は、ストリーム復号部２１、可変長復号部２２、透かし分離部２３、暗号復号部２４、逆ハッシュ関数部２５、排他的論理和部２６を有しており、図１に示す画像符号化装置により符号化された符号化ストリームを入力して、ストリーム復号、可変長復号、透かし分離、公開鍵を用いた暗号復号、逆ハッシュ関数、排他的論理和をとることにより、透かしデータを検出するように構成されている。なお、画像復号装置自体は、図１に示す画像符号化装置とは逆に処理するように構成されるので、ここでは説明しない。
【００４１】
ＪＰＥＧ符号化画像を復号した後、再度同じ量子化パラメータで符号化すると、ランレングスの構造が変化する場合がある。この場合、復号された画像は、既にその段階で真正性が崩れていることになる。これを防ぐため、ＪＰＥＧの復号は、再符号化したときに、量子化構造が同じとなるように行わなければならない。これによって、真正性はＪＰＥＧの復号後も保たれる。なお、復号後も透かしが残るという条件は重要である。なぜなら、単にＪＰＥＧのストリームの段階でその真正性を証明したいだけなら、透かしデータを用いなくても、例えばＭＡＣ（Message Authentication Code）を付加するなどして、それを実現することができるからである。
【００４２】
＜３．評価＞
ある人物画像をＪＰＥＧ符号化し、その画像に署名を埋め込んで画質の劣化を評価した。ただし、署名の詳細はインプリメントしていない。署名データとしてランダムなビット系列を用いた。図４の量子化テーブルを用いてＪＰＥＧで符号化した人物画像に署名が埋め込まれていない場合に、この画像のＰＳＮＲが３５．８ｄＢであるとし、この画像にダミーのランを０とした署名を埋め込むとする。ただし、上述したように、署名ビットは、ジグザグスキャンの最後の非零係数の直後に埋め込む。すると、この署名ビット埋め込み後の画像のＰＳＮＲは、原画に対して、３３．７ｄＢである。透かしを埋め込んだ個所は、背景などの平坦な部分で、歪みがやや目立つが、この歪みは量子化を細かくすることで軽減される。
【００４３】
以上説明したように、本実施の形態１では、マクロブロックをＮ個に分割したブロック毎にDCT係数を量子化した後のランレングスの構造をブロックの数だけ並べたものをハッシュ関数によって、Ｎビットのハッシュ値に変換する際、各ブロックのランレングスの最後にダミーのランを一つ追加して、Ｎビットのハッシュ値に透かしデータを埋め込み、これを秘密鍵で暗号化してＮビットの署名データを得て、このＮビットの署名データを透かしデータとして各ブロックに１ビットずつビットが０のときは、そのブロックのダミーのランの後の値を‐１とする一方、ビットが１のときは、そのブロックのダミーのランの後の値を＋１として埋め込むようにしたので、画像のDCT係数や署名ビットの量子化値が少しでも変更されても、それをほぼ確実にその変更を検知することができる。
【００４４】
実施の形態2
上記実施の形態１では、JPEG画像の真正性を保証する電子透かしの方法を説明した。この方法を用いれば、JPEG画像が、発行者の署名後に改ざんされていないことを画像データだけから知ることができる。この方法は、DCT係数の量子化の構造が変化しない限り透かしデータが残るが、DCT係数の量子化の構造がわずかでも変化すると電子透かしは破壊されるということである。そのため、JPEG復号後の画像で透かしデータが残るためには、JPEG復号後の画像を再符号化したときに、もとの量子化の構造が完全に保持される必要がある。ところが、一般のJPEG復号では、逆DCTされた画像データを通常８ビットの整数値に四捨五入してしまうので、復号画像を再度JPEG符号化するとその量子化の構造が変化する場合がある。そこで、本実施の形態２では、量子化のステップ幅を√ N以上とすることによって、再符号化後の量子化の構造が保存されることを証明する。ここで、Ｎは、DCTのブロックサイズであり、８×８DCTの場合は６４である。したがって、DCT係数の量子化を８より大きなステップ幅で行えば、JPEG復号した画像から電子透かしは消えることはない。実際にいくつかの標準画像について再符号化を試した結果では、ステップ幅を４以上とすれば、再符号化によって量子化の構造が変化することはなかった。
【００４５】
つまり、真正性を証明する電子透かしは、画像データが（１）由緒正しいものであり、（２）改ざんが行われていないという２つのことを証明するためのものである。Wong らの方法によれば、（１）は画像の発行者が自分の秘密鍵で透かしデータを暗号化することで実現され、（２）は画像データのハッシュ値を（１）の暗号データとXORして画像に埋め込むことで実現されるとしているが、 Wongは透かしデータを画像データのLSB に入れたので、JPEG などの圧縮画像に用いることができなかった。上記実施の形態１では、 Wong のアルゴリズムをJPEGで符号化された画像に対して拡張した。これによれば、JPEG の量子化の構造がハッシュ関数に与えられ、それと暗号データのXORがDCTブロックの最後に埋め込まれる。しかし、JPEGで復号した画像を同じ量子化器を用いて再符号化しても、その量子化の構造が再現される保証がない。そのため、一旦JPEGで復号すると、透かしデータが消えてしまう場合があるという問題があった。本実施の形態２では、量子化のステップサイズを８以上とすることで、JPEG復号による透かしの消滅がなくなるようにしたものである。また、実際の画像を用いてそのことを確認する。
【００４６】
＜１． JPEG 復号がロスレスでない理由＞
JPEG符号化では、量子化されたDCT係数を逆量子化した後で、画素値を整数に打ち切っているので、一般に、復号後の画像をもう一度符号化すると同じビットストリームが得られる保証がない。このことを図６を用いて説明する。
【００４７】
図６は、２元アダマール変換の時間領域（x-y 座標）と、変換領域（u-v 座標）のサンプル点の構造を示している。アダマール変換は次式の数３で与えられる。
【００４８】
【数３】

【００４９】
ここで、x、y は時間領域の座標であり、画像データは整数であるからそのサンプル点は図の●で表される。上記数３の式から、２元アダマール変換は４５°の回転移動に等しいから、●は、変換領域では図のu-v 座標で読み取った座標に変換される。今、u、vをそれぞれ一様なステップ幅でスカラー量子化することを考える。ただし、u はv より細かく量子化されているとすると、例えば、図の点線で示すような量子化の境界が得られる。この境界で囲まれたクラス毎に、量子化の代表値が○の位置で与えられる。さて、ハッチをかけたクラスi に注目すると、このクラスには２つのベクトルxi1、xi2 が存在し、変換後どちらもxi に量子化される。このxi が逆変換されて、整数値に戻されるとき、それに最も近い整数はクラスi のベクトルでなく、クラスj のベクトルxj2 である。そのため、xj2 が再符号化されると、量子化後のベクトルはxj となって、xi と一致しない。
【００５０】
このように、量子化代表値に最も近い整数ベクトルが必ずしも自分のクラスに属していないことが、変換符号化がロスレスでないことの理由である。これは、アダマール変換に限らず、DCT でも起こり得るし、次数に関係無いことも明らかである。
【００５１】
図６の考察から、量子化幅を大きくすれば、代表値の周辺にはそのクラスの属する多くの整数ベクトルが存在し、再符号化でロスが生じにくくなるだろうと予想される。そこで、本実施の形態２では、次に説明するように、量子化幅を√ N（Ｎ は変換の次数）より大きくすることにより、符号化は完全にロスレスとしたものである。
【００５２】
＜２．復号をロスレスとするための量子化の制限＞
符号化において、変換係数の量子化は、一様なスカラー量子化とする。復号において、逆変換されたベクトルは、ユークリッド距離が最も近い整数ベクトルに打ち切られるとする。また、変換、逆変換の演算誤差を無視すると、変換前後で距離が保たれなければならないが、直交変換の全ての変換係数に対して、Qi ＞ √N が満たされれば、逆変換されたベクトルに最も近い整数ベクトルは、元の変換係数と同じクラスに属することになる。ただし、Qi はi番目の変換係数の量子化ステップ幅、Ｎは変換の次数である。
【００５３】
これを証明しておく。逆変換されたベクトルを、
【００５４】
【数４】

【００５５】
とする。ここで、一般性を失うことなく、
【００５６】
【数５】

【００５７】
としてよい。ベクトルc の周りの整数ベクトルを
【００５８】
【数６】

【００５９】
とおけば、
【００６０】
【数７】

【００６１】
を満たすx は、２^Ｎ個存在する。その中で、c に最も近いベクトルを
【００６２】
【数８】

【００６３】
とすると、
【００６４】
【数９】

【００６５】
であるから、次式の数１０が成り立つ。
【００６６】
【数１０】

【００６７】
上記数１０の式と、条件Q ＞ √N より、
【００６８】
【数１１】

【００６９】
が成り立つ。ただし、Q は、量子化ステップ幅Qi の最小値とする。一方、
【００７０】
【数１２】

【００７１】
を満たすベクトルx は必ずc に量子化される。なぜなら、上記数１２の式が成り立てば、全てのi について、
【００７２】
【数１３】

【００７３】
が成り立つからである。以上より、ベクトルＸcは、再符号化されると必ずクラスc に属することが示された。
【００７４】
＜４．評価＞
５つのテスト画像を用いて、全てのDCT係数を同じステップ幅Q で量子化し、それを復号した後、再度符号化して、異なるクラスにマッピングされるブロックの数を調べた。
【００７５】
図７にその結果を示す。
画像のサイズは全て５１２×５１２であり、ブロックの数は４０９６である。表から、Q=8 とすれば全ての場合において、再符号化後同じクラスにマッピングされていることがわかる。なお、この例では、Q=4 とすればロスレスが成り立っていることがわかる。
【００７６】
以上説明したように、本実施の形態２によれば、上記実施の形態１に対しさらに量子化のステップ幅に制限を加えることにより、JPEG 圧縮がロスレスとなるようにした。これを用いれば、認証用の透かしデータがJPEG復号後も消えないことを保証することができる。
【００７７】
なお、Q=8 の制約は、画質を重視する場合には強過ぎるかも知れない。その場合には、JPEG 圧縮と、電子透かしで異なる量子化テーブルを用いることが可能である。そして、電子透かしの量子化テーブルについてだけQ=8 の制約を課すようにしてもよい。このようにすると、上記数１２の式が満たされなくなるので、JPEG復号は透かしデータが消えないように整数化を行う必要がある。
【００７８】
実施の形態3.
上記実施の形態１では、JPEGの量子化の構造を署名データとして埋め込むことによって、その画像が改ざんされていないことを証明する電子透かしの方法を説明した。また、実施の形態２では、DCT係数の量子化ステップ幅を８以上とすることによって、JPEG復号後も透かしが残存するようにした。
【００７９】
この実施の形態３では、この量子化の制約を取り払い、高画質なJPEG圧縮に適した認証用電子透かしの方法を説明する。概略を説明すると、この実施の形態３の方法は、圧縮のための量子化テーブルと、電子透かしのための量子化テーブルとを持ち、圧縮は細かく量子化する一方、電子透かしは粗く量子化することによって、符号化の画質と、電子透かしの残存とを両立させるようにしたものである。ここで、電子透かしの量子化ステップ幅は、８以上となるように設定される。しかし、この変更によって、逆DCTの結果を最も近い整数値に置き換える一般的なJPEG復号では、電子透かしの残存が保証されなくなる。そのため、本実施の形態３では、電子透かしの残存を保証したJPEGの復号方法を合わせて説明する。なお、本実施の形態３によれば、JPEG標準の量子化テーブルを用いた計算機実験により、スケールファクタを０．１まで小さくしても復号後の透かしデータが消えないことを確認した。このとき、透かしデータを埋めたJPEG画像のPSNRは４０ｄB以上である。また、本実施の形態３で説明する電子透かしの方法は、局所的に量子化幅を変調する適応符号化や、さらにはMPEGなどの動画像符号化に対しても適用が可能である。
【００８０】
上記実施の形態１，２の方法を用いれば、ＪＰＥＧで圧縮された画像が（１）正規の発行者によるものであり、（２）改ざんされていないことを画像データだけから証明することができる。また、そのための電子透かしはＪＰＥＧで復号した後にも残ることが保証される。しかし、上記実施の形態２による制約は、ＪＰＥＧの量子化をステップ幅８以上で行うとするものであり、高画質のＪＰＥＧ圧縮に不適であった。本実施の形態３では、この制約が必要ない電子透かしのアルゴリズムと復号後に透かしが残るためのＪＰＥＧの復号方法を示す。
【００８１】
＜１．実施の形態３の電子透かしのアルゴリズム＞
アルゴリズムの詳細は、上記実施の形態１の場合と同様である。つまり、基本的なアルゴリズムは、画像のDCT係数の量子化構造を暗号化して、ＤＣＴブロックの最後に付加するものである。なお、上記実施の形態１，２までは、画像データ圧縮のための量子化器と、電子透かしのための量子化器とは同一の量子化部２１を用いていた。しかし、JPEG復号後の透かしの残存を保証するためには、上記実施の形態２にて説明したように電子透かしの量子化に対して一定の制約があり、あまり細かい量子化器を用いることができない。よって、本実施の形態３では、画像データ圧縮と、透かしとに、それぞれ別の量子化器を用いる方法を説明する。
【００８２】
図８は、本発明に係る電子透かし埋め込み方法が実行される実施の形態３の画像符号化装置の構成を示す図である。図８において、この画像符号化装置は、ＤＣＴ部１、２つの量子化部２Ａ，２Ｂ、２つのジグザグスキャン部３Ａ，３Ｂ、２つのランレングス化部４Ａ，４Ｂ、ダミーラン付加部５、ハッシュ関数部６、排他的論理和（ＥＸＯＲ）部７、暗号化部８、透かし埋め込み部９、可変長符号化部１０、ストリーム符号化部１１を有しており、入力するホスト画像をJPEG圧縮符号化する際、署名画像等の透かしデータを公開鍵暗号方式により暗号化して電子透かしとして埋め込み符号化ストリームとしてＮ（Nは自然数）個のブロック毎に変換され出力するように構成されている。実施の形態１との違いは、入力したホスト画像を２つの量子化部２Ａ，２Ｂにより、それぞれ異なる量子化テーブル、すなわち圧縮のための量子化テーブルＱｃと、電子透かしのための異なる量子化テーブルＱｗとにより別々に量子化する点である。なお、上記実施の形態１の場合と同様に、ＤＣＴ部１や、量子化部２、ジグザグスキャン部３、ランレングス化部４、可変長符号化部１０、ストリーム符号化部１１等は、通常のJPEG圧縮符号化を行うので、実施の形態３の電子透かし埋め込み方法を中心に以下に説明する。
【００８３】
まず、圧縮のための量子化部２Ａの量子化ステップをQ^c _ij、電子透かしのための量子化部２Ｂの量子化ステップをQ^ｗ _ijとする（i,j=0,1,…,7）。ここで、全てのi,jについて、次の条件が満たされなければならない。
【００８４】
【数１４】

【００８５】
【数１５】

【００８６】
上記数１４の式の条件は、透かしデータが埋め込み可能なために必要である。また、上記数１５の式の条件は、JPEG復号後に透かしデータが残存するために必要である。この条件を満たすには、任意のQ^c _ijに対して、Q^w _ijを以下のように設定すればよい。
【００８７】
【数１６】

【００８８】
DCTブロックに透かしデータを埋め込むには以下のようにする。
（１）DCT係数f_ijをQ^c _ijで量子化して、f^c _ijを得る。
（２）f^c _ijをQ^c _ijで逆量子化したものをQ^w _ijで量子化し、そのランレングスの構造を上記実施の形態１の方法と同様に暗号化し、埋め込みビットbと、埋め込み位置(p,q)を得る。
（３）f^c _pqを以下のように変更する。
【００８９】
【数１７】

【００９０】
次に、JPEGの量子化テーブルを０．４倍した次式の数１８の量子化器で符号化を行う場合の具体例について説明する。
【００９１】
【数１８】

【００９２】
そして、上記数１６の式から、
【００９３】
【数１９】

【００９４】
である。今、あるブロックのDCT係数が、次式で与えられるとする。
【００９５】
【数２０】

【００９６】
これをQ^c _ijで量子化すると、次式のインデックスが得られる。
【００９７】
【数２１】

【００９８】
これをQ^c _ijで逆量子化し、Q^w _ijで再量子化すると、次式のインデックスを得る。
【００９９】
【数２２】

【０１００】
この量子化構造を暗号化して、埋め込みビットが０ならば、上記数１７の式より、次式を得る。
【０１０１】
【数２３】

【０１０２】
ただし、埋め込み位置は、ジグザグスキャンの直後の（０、３）の位置とした。したがって、透かしを埋め込んだ量子化インデックスは、
【０１０３】
【数２４】

【０１０４】
となる。
【０１０５】
＜２．JPEGの復号アルゴリズム＞
符号化の量子化マトリックスQ^cと、電子透かしの量子化マトリックスQ^wとが一致し、そのステップ幅が全て８以上であれば、逆DCTした実数値のベクトルをユークリッド距離が最も近い整数値のベクトルに置き換える復号を行えば、復号後の画像から透かしデータが消えないことが証明できる。しかし、上述したように符号化と、電子透かしとで異なる量子化マトリックスを用いれば、そのことが保証されない。したがって、単純に近接の整数値ベクトルに復号すると透かしデータが消えてしまう場合がある。
【０１０６】
このことを、図９を用いて説明する。
図９は、復号ベクトルの空間を図示したものである。図９において、Ct はQw で量子化したDCT 係数の復号ベクトル、ｙはQc で量子化したDCT 係数の復号ベクトル、○は整数ベクトル、実線で囲んだ領域はQw で量子化して符号化するとCt に復号されるベクトルの集合C である。Ct とｙとは実数値のベクトルであり、Ct は復号する時点で既知である。Qw＝Qc であるときは、ｙ＝Ct である。今、Qw とQc が異なり、ｙが図の位置に復号されたとする。このとき、ｙに最も近い整数ベクトルはｘ０であり、このベクトルは集合C に属さない。これを再符号化するとその復号ベクトルはCt とならない。これが、復号ベクトルから透かしが消える原因である。ところが、今、我々はCt を知っている。したがって、ｘ０から近隣の整数ベクトルを辿ってCt に少しずつ近付いていけば、いつかは集合C に属するベクトルに到着する。この観察から、次の復号アルゴリズムを得る。
【０１０７】
【数２５】

【０１０８】
このアルゴリズムでは、繰返しの各回において、
【０１０９】
【数２６】

【０１１０】
が成り立つ。また、Qw＞８であれば、Ct の周辺に集合C に属する整数ベクトルが存在する。
ゆえに、以上の復号アルゴリズムは常に収束する。
【０１１１】
＜３．評価＞
図１０は、テスト画像（５１２×５１２画素）に対して、符号化の量子化テーブルの細かさを変えて行った実験結果である。表でscaleは量子化の細かさを表す。量子化テーブルはJPEGのデフォルトのものをscaleの値で乗算して用いた。これが小さくなる程、量子化は細かくなる。また、scaleが０．８の場合は、全ての量子化パラメータは８以上となり、符号化と透かしで同一の量子化が行われる。Nblkは復号後に整数ベクトルの修正が必要となったブロックの数である。また、Nrep/Nblkはベクトルが修正された場合に必要とされた繰返し演算の数である。
【０１１２】
図１０から以下のことがわかる。
（１）scale=0.8の場合は、修正されたブロックは０であり、実施の形態２の結果と合致する。すなわち、全ての量子化パラメータが８以上であれば、JPEG復号後に必ず透かしが残存する。
（２）スケールを小さくすると修正されるブロック数は増加する。
（３）スケールを小さくすると修正に必要な繰り返し演算の数は増加する。しかし、この数は実験の範囲で高々４．５である。
【０１１３】
実験の結果、修正されなかったブロックは存在しない。すなわち、この復号アルゴリズムが確実に収束することが裏付けられた。
【０１１４】
以上説明したように、本実施の形態３によれば、符号化の際の量子化テーブルとは別に、電子透かし用の独立な量子化テーブルを持つことによって、高画質なJPEG符号化に対応した認証用電子透かしのアルゴリズムを実現できる。また、復号画像に透かしデータが残存するための復号方法を示した。ここで示した方式はMPEGなどのブロック単位の符号化方式に展開が可能であると考える。
【０１１５】
なお、上記実施の形態１〜３では、説明の便宜のため、静止画をJPEG圧縮符号化により符号化する場合に透かしデータを埋め込む方法について説明したが、本発明では、画像をブロック毎に分割し周波数変換および量子化した量子化インデックスに透かしデータを埋め込めれば良いので、DCT変換を使用したJPEGに限定されず、例えば、ウエーブレット変換を使用するJPEG2000などにも適用可能であるし、さらにはMPEG等の動画を圧縮する圧縮符号化手法にも適用可能である。
【０１１６】
【発明の効果】
以上説明したように、本発明によれば、画像データを量子化した量子化インデックスのランレングス構造を署名データとして画像データに埋め込むようにしたので、画像データが改ざんされていないことを証明することができる。
【図面の簡単な説明】
【図１】 本発明に係る電子透かし埋め込み方法が実行される実施の形態１の画像符号化装置の構成を示す図。
【図２】 量子化インデックスの一例を示す図。
【図３】 ｎが７まであるJPEGで（ｎ、±１）を符号化するためのハフマン符号の符号長の一例を示す図。
【図４】 量子化テーブルの一例を示す図。
【図５】 本発明に係る電子透かし埋め込み方法により符号化ストリームを復号する画像復号装置における透かしデータ検出回路の一例を示す図。
【図６】 ２元アダマール変換の時間領域（x-y 座標）と、変換領域（u-v 座標）のサンプル点の構造の一例を示す図。
【図７】 実施の形態１において５つのテスト画像を用いて全てのDCT係数を同じステップ幅Qで量子化し、それを復号した後、再符号化して異なるクラスにマッピングされるブロック数の一例を示す図。
【図８】 本発明に係る電子透かし埋め込み方法が実行される実施の形態３の画像符号化装置の構成を示す図。
【図９】 復号ベクトルの空間の一例を示す図。
【図１０】 実施の形態３においてテスト画像に対し符号化の量子化テーブルの細かさを変えて行った実験結果の一例を示す図。
【符号の説明】
１ ＤＣＴ部、２ 量子化部、３ ジグザグスキャン部、４ ランレングス化部、５ ダミーラン付加部、６ ハッシュ関数部、７ 排他的論理和（ＥＸＯＲ）部、８ 暗号化部、９ 透かし埋め込み部、１０ 可変長符号化部、１１ ストリーム符号化部。[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a digital watermark embedding method, a digital watermark embedding program, a digital watermark embedding device, and an image encoding device that can prove the authenticity of an image.
[0002]
  Traditionally,DigitizedThere is a method by Wong et al. To prove the authenticity of images. In this method, the upper 7-bit hash value of an image is encrypted with watermark information and a key and embedded in the LSB (see, for example, Non-Patent Document 1).
[0003]
[Non-Patent Document 1]
"Secret and Pubic Key Image Watermarking Schemes for Image Authentication and Ownership Verification" by Ping Wah Wong and Naiser Memon (IEEE TRANSACTIONS ON IMAGE PROCESSSING, VOL.10, NO.10, OCTOBER 2001)
[0004]
  However, with the method of Wong et al., Even if the image is changed even by 1 bit, it can be detected almost certainly, but since the watermark data is embedded in the LSB, it is embedded in the LSB when compressed by JPEG etc. The watermark data will be truncatedUThere was a problem.
[0005]
Therefore, the present invention provides an electronic watermark embedding method, an electronic watermark embedding program, and an electronic watermark embedding method in which watermark data is reliably left even when a compressed and encoded image in which watermark data is embedded is decoded and the authenticity of the image can be verified. An object is to provide a device and an image encoding device.
[0006]
[Means for Solving the Problems]
  In order to achieve the above object, in the present invention,Frequency conversion means for converting a digital image into a conversion coefficient obtained by frequency conversion for each block, and the frequency convertedQuantization index quantized transform coefficientQuantization means for generatingFor each blockScanned aboveRun-length quantization indexRun-length converting means for generating the run-length data, and the above for each of N (N is a natural number) blocksData with run-length data arrangedN bitsConvert to hash valueHash value conversion means that performs this N-bitEmbed watermark data in hash valueN bitsGenerate signature dataWatermark data embedding means, and this N-bitSignature data1 bit for each of the N blocks of run length dataMake it correspond,CorrespondedOf signature dataeachbitThe value of 0 or 1According toTheThe signature bits of different valuesRun length data for the blockInto the specified positionSignature data embedding meansIs.
[0007]
Embodiment 1.
  FIG. 1 is a diagram showing a configuration of an image coding apparatus according to Embodiment 1 in which a digital watermark embedding method according to the present invention is executed. In the figure, this image encoding device performs JPEG compression encoding on an input image.Department andEmbedding watermark data in JPEG compression encoded signal by embedding watermark data by digital watermark embedding method according to the present inventionDepartment andIt is composed of JPEG encodingPart isDigital watermark embedding, because normal JPEG compression encodingPartThe digital watermark embedding method according to the present invention will be described below.
[0008]
First, an outline of the first embodiment of the digital watermark embedding method according to the present invention will be described. The outline of the present invention is as follows. First, N DCT blocks are grouped together to encode a run-length structure of quantized DCT coefficients. The hash value (N bits) of this encoded code is encrypted with the watermark information and the key, and the result is added to the end of scanning of each DCT block. At this time, the value of the last DCT coefficient is -1 if the bit is 0, and 1 if the bit is 1. The run length of the coefficient to be added must be included in the hash value calculation in advance. In this method, the run length structure of the DCT coefficient is embedded at the end of the DCT block. Therefore, if this structure is changed even by 1 bit, it can be detected. In addition, since the last DCT coefficient takes only a value of +1 or −1, the change can be reliably detected by changing it to another value. Even after the image is decoded, the authenticity can be checked by using the same quantizer and examining the run-length structure. When image deterioration was evaluated by computer simulation, when a watermark was embedded in a 35.8 dB JPEG image with a PSNR, the PSNR was 33.7 dB.
[0009]
That is, in Embodiment 1, first, N DCT blocks are grouped together to encode a run-length structure of quantized DCT coefficients. The hash value (N bits) of this encoded code is encrypted with the watermark information and the key, and the result is added to the end of scanning of each DCT block. At this time, the value of the last DCT coefficient is -1 if the bit is 0, and 1 if the bit is 1. The run length of the coefficient to be added must be included in the hash value calculation in advance. In this method, the run length structure of the DCT coefficient is embedded at the end of the DCT block. Therefore, if this structure is changed even by 1 bit, it can be detected. In addition, since the last DCT coefficient takes only a value of +1 or −1, the change can be reliably detected by changing it to another value. Even after the image is decoded, the authenticity can be checked by checking the run-length structure using the same quantizer as that on the encoding side. When image deterioration was evaluated by computer simulation, when a watermark was embedded in a 35.8 dB JPEG image with a PSNR, the PSNR was 33.7 dB.
[0010]
  In the digital watermark for authentication, one purpose is to prove that the image has not been changed, that is, the images are the same. For this reason, in the present invention, it is defined what the two images before encoding and after decoding are considered to be the same. In the present invention, the two images before encoding and after decoding are in a raw data stage. It is not a problem that they are exactly the same. That is, in the present invention, when the DCT coefficients of two images are encoded with the same quantization parameter, these images are the same when the quantization index is exactly the same.,amountIt is assumed that two images are different if even one child index is different. Hereinafter, based on this definition, a digital watermark algorithm that reliably detects when an image changes, that is, when even one quantization index is different, is detected.ExplanationTo do.
[0011]
FIG. 1 is a diagram showing an example of the configuration of an image encoding apparatus in which a digital watermark embedding method according to the present invention is executed. In FIG. 1, the image encoding apparatus includes a DCT unit 1, a quantization unit 2, a zigzag scan unit 3, a run length conversion unit 4, a dummy run addition unit 5, a hash function unit 6, and an exclusive OR (EXOR) unit 7. An encryption unit 8, a watermark embedding unit 9, a variable length encoding unit 10, and a stream encoding unit 11. When JPEG compression encoding is performed on an input host image, watermark data such as a signature image is made public key It is configured so that it is encrypted by an encryption method, and is converted into an embedded coded stream as a digital watermark for each N (N is a natural number) blocks and output. The DCT unit 1, the quantization unit 2, the zigzag scan unit 3, the run length conversion unit 4, the variable length encoding unit 10, the stream encoding unit 11, and the like mainly perform normal JPEG compression encoding. The digital watermark embedding method according to the present invention will be mainly described below.
[0012]
<2. Digital watermark embedding method algorithm>
In the first embodiment, N 8 × 8 DCT blocks are grouped together to form a macroblock, and N-bit signature data in which watermark data such as a signature image in a bitmap format is embedded is embedded in this macroblock. .
[0013]
<2.1 Generation of signature data>
The signature data in which the watermark data is embedded is created as follows.
[0014]
First, the DCT unit 1 divides one image into a plurality of macroblocks, divides each macroblock into N blocks each of which is an 8 × 8 DCT coding unit, and the quantization unit 2 includes N pieces of blocks. The DCT coefficient of each block is quantized for each block, and the zigzag scanning unit 3 scans the quantization index in a zigzag manner. The run length unit 4 expresses the quantization index obtained by the zigzag scan by the run length. Up to here, it is not different from the conventional one.
[0015]
In the first embodiment, the hash function unit 6 arranges the run-length data of the number of blocks, that is, N blocks, and converts the run-length data arranged by the number of blocks into an N-bit hash value by the hash function. However, before or at that time, the dummy run adding unit 5 adds one dummy run to the end of the run length of each block. This dummy run is used later to embed signature data in a JPEG bitstream. Note that this dummy run is not necessarily required because it may be zero or non-zero as will be described later. In addition, as will be described later, here, run-length data in which only N blocks, which are the number of blocks, are converted into an N-bit hash value by a hash function. This is because it is most efficient to correspond each bit of the value to the run-length data of N blocks, one bit at a time. In the present invention, the structure of the block run-length, that is, the quantization structure of the DCT coefficient Is reflected in the hash value that is the signature data, and it is only necessary to correspond the signature data to each of the run length data of each of the N blocks. For example, it is converted into a hash value having an integer multiple of N or a bit number smaller than N, and a multi-bit hash value is assigned to each of N blocks. Or in association, it can also have the same hash value into a plurality of blocks so as to correspond.
[0016]
Next, the exclusive OR unit 7 performs an exclusive OR between the N-bit hash value and the watermark data such as the bitmap format signature image, and embeds the watermark data in the N-bit hash value. The encryption unit 8 encrypts this with a secret key to obtain N-bit signature data. Note that, here, an N-bit hash value in which watermark data is embedded by taking an exclusive OR with the watermark data is encrypted with a secret key. However, the present invention is not limited to this, and common key encryption is not limited thereto. Of course, the encryption process itself may be omitted if it is not necessary to perform encryption with the same common key as in the system, or further encryption.
[0017]
Next, processing until obtaining the above N-bit signature data will be described in detail.
When the DCT coefficient is quantized for a certain block, for example, the quantization index shown in FIG. 2 is obtained. From this, the following (run, size) pairs are obtained.
[0018]
(15), (1, -2), (0, -1), (0, -1), (0, -1), (2, -1)
[0019]
However, the first 15 is the index of the DC coefficient, the following is the number of 0 runs in the previous value in parentheses, and the index of the AC coefficient in the subsequent value. Here, for example, 3 is added as a dummy run,
[0020]
(15), (1, -2), (0, -1), (0, -1), (0, -1), (2, -1), (3)
[0021]
Get. An N-bit hash value is obtained by using the hash function as an input of the hash function, in which N pieces of data arranged in order for each block are input.
[0022]
<2.2 Embedding signature data>
The N-bit signature data in which the watermark data is embedded as described above is embedded in each block by one bit, for example, as follows.
[0023]
That is, when the bit of the signature data is 0, the value after the dummy run of the block is set to -1. When the bit is 1, the value after the dummy run of the block is set to +1.
[0024]
For example, in the example shown in FIG. 2, if the bit to be embedded is 0, the run length structure of the quantization index is
[0025]
(15), (1, -2), (0, -1), (0, -1), (0, -1), (2, -1), (3, -1)
[0026]
It becomes. After that, as in the case of normal encoding, stream encoding to add a header or the like is performed.
[0027]
<2.3 Proof of authentication capability>
  Digital watermark with the above algorithmButFor an embedded image, it can be proved as follows that even if one of the indexes after quantization changes, it can be reliably detected.
[0028]
That is, if the signature bit, that is, the portion other than the +1 or -1 value at the end of the run length in the quantization index run length structure changes, the hash value changes, so the embedded watermark data Cannot be detected.
[0029]
On the other hand, if the signature bit changes, the hash value detected from the image does not match the signature bit, so that the embedded watermark data cannot be detected. From the above, the embedded data can be detected only when neither the signature bit nor any other index is changed.
[0030]
Here, in the case of the first embodiment, it is important that there are only two types of signature bits, +1 or -1. For example, when using a method of embedding information by quantizing even or odd numbers, which is often used in robust digital watermarking, even or odd values cannot be determined in one way, so images with different run length structures are the same. This is because there are cases where it is considered. In the case of the present invention, the signature bit need not be ± 1, and may be other than ± 1 or three or more types as long as it is predetermined and determined in one way.
[0031]
<2.4 Increase in code amount>
In this algorithm, since a set of (run, size) is added to each block for embedding a signature, the code amount after JPEG increases. Here, since the value of the signature bit size is only ± 1, the amount of increase in the code amount is determined only by the run.
[0032]
FIG. 3 shows the code length of a Huffman code for encoding (n, ± 1) in JPEG with n up to 7. From FIG. 3, for example, if the dummy run is 3 in all blocks, the increase in the code amount per pixel is
[0033]
[Expression 1]

[0034]
It is.
[0035]
<2.5 Increase in distortion>
The JPEG image distortion increases due to the last signature bit ± 1 of each block used for signature embedding. The amount of increase depends on the roughness of quantization, and the amount of increase increases as the amount increases. For example, if watermark embedding is performed at the position (3, 3) of the block using the quantization table of FIG. 4, the amount of increase in distortion per pixel is approximately
[0036]
[Expression 2]

[0037]
It is. In this case, PSNR = 42dB JPEG image with watermarkEnterPSNR will decrease by 3 dB.
[0038]
  ButTherefore, the length of the dummy run should be set appropriately from the viewpoint of increasing the code amount and distortion.
[0039]
<2.6 JPEG decoding problems>
  Then, as aboveNaBy digital watermark embedding methodGeneratedA problem in decoding the encoded stream will be described.
[0040]
  FIG. 5 shows a digital watermark embedding method according to the present invention.GeneratedIt is a figure which shows an example of the watermark data detection circuit in the image decoding apparatus which decodes an encoding stream. In FIG. 5, the image decoding apparatus includes a stream decoding unit 21, a variable length decoding unit 22, a watermark separation unit 23, an encryption / decryption unit 24, an inverse hash function unit 25, and an exclusive OR unit 26. By inputting the encoded stream encoded by the image encoding device shown in 1, stream decoding, variable length decoding, watermark separation, encryption using public key, inverse hash function, exclusive OR The watermark data is detected. Note that the image decoding apparatus itself is configured to perform processing opposite to that of the image encoding apparatus illustrated in FIG. 1 and thus will not be described here.
[0041]
  If a JPEG encoded image is decoded and then encoded again with the same quantization parameter, the run-length structure may change. In this case, the decoded image has already lost its authenticity at that stage. To prevent this, JPEG decoding must be performed so that the quantization structure is the same when re-encoding. This preserves authenticity even after JPEG decoding.. NaThe condition that the watermark remains after decoding is important. This is because if it is only necessary to prove its authenticity at the JPEG stream stage, it can be realized by adding a MAC (Message Authentication Code), for example, without using watermark data. .
[0042]
<3. Evaluation>
  A person image was JPEG-encoded and a signature was embedded in the image to evaluate image quality degradation. However, signature details are not implemented. A random bit sequence was used as signature data. When a signature is not embedded in a person image encoded with JPEG using the quantization table in FIG. 4, it is assumed that the PSNR of this image is 35.8 dB, and a signature with a dummy run set to 0 is added to this image. Let's embed. However, as mentioned above,The signature bit is filled immediately after the last non-zero coefficient of the zigzag scanIncludedMu Then, the PSNR of the image after the signature bit is embedded is 33.7 dB with respect to the original image. The place where the watermark is embedded is a flat part such as the background, and the distortion is somewhat conspicuous, but this distortion can be reduced by making the quantization finer.
[0043]
As described above, in the first embodiment, for each block obtained by dividing the macroblock into N blocks, the run length structures after the DCT coefficients are quantized are arranged by the number of blocks using the hash function. When converting to a bit hash value, one dummy run is added to the end of the run length of each block, watermark data is embedded in the N-bit hash value, and this is encrypted with a secret key and an N-bit signature When data is obtained and this N-bit signature data is used as watermark data and the bit is 0 for each block, the value after the dummy run of the block is set to -1 while the bit is 1 Since the value after the dummy run of the block is embedded as +1, even if the DCT coefficient of the image or the quantization value of the signature bit is changed, it is almost sure. It is possible to detect the changes to.
[0044]
Embodiment 2
  In the first embodiment, a digital watermark method for guaranteeing the authenticity of a JPEG image is used.Explanationdid. By using this method, it is possible to know from the image data only that the JPEG image has not been altered after the issuer's signature. This method means that the watermark data remains unless the quantization structure of the DCT coefficient changes, but the digital watermark is destroyed if the quantization structure of the DCT coefficient changes even slightly. Therefore, in order for watermark data to remain in an image after JPEG decoding, when the image after JPEG decoding is re-encoded, the original quantization structure needs to be maintained completely. However, in general JPEG decoding, the inverse DCT image data is usually rounded to an integer value of 8 bits, so that the quantization structure may change when the decoded image is JPEG encoded again. Therefore, in the second embodiment, the quantization step width is set to√ NThis proves that the quantization structure after re-encoding is preserved. Here, N is the block size of DCT, and is 64 in the case of 8 × 8 DCT. Therefore, if the quantization of the DCT coefficient is performed with a step width larger than 8, the digital watermark will not disappear from the JPEG-decoded image. As a result of actually re-encoding for some standard images, the quantization structure does not change by re-encoding if the step width is 4 or more.
[0045]
  That is, the digital watermark for proving authenticity is for proving two things that the image data is (1) historical and (2) not falsified. According to the method of Wong et al., (1) is realized by the image issuer encrypting the watermark data with his / her private key, and (2) is the hash value of the image data and the encrypted data of (1). XOR and fill in imageIncludedAlthough Wong puts the watermark data in the LSB of the image data, it could not be used for compressed images such as JPEG. In Embodiment 1 above, Wong's algorithm is extended for images encoded in JPEG.It was.According to this, the structure of JPEG quantization is given to the hash function, and the XOR of the encrypted data is padded at the end of the DCT block.IncludedBe turned. However, even if an image decoded by JPEG is re-encoded using the same quantizer, there is no guarantee that the quantization structure will be reproduced. For this reason, there is a problem that watermark data may be lost once it is decoded by JPEG. In Embodiment 2, the quantization step size is set to 8 or more so that the watermark disappears due to JPEG decoding. In addition, this is confirmed using an actual image.
[0046]
<1. JPEG Reasons why decryption is not lossless>
In JPEG encoding, since the quantized DCT coefficient is inversely quantized and then the pixel value is truncated to an integer, there is generally no guarantee that the same bit stream will be obtained if the decoded image is encoded again. This will be described with reference to FIG.
[0047]
FIG. 6 shows the structure of sample points in the time domain (x-y coordinates) and the transformation domain (u-v coordinates) of the binary Hadamard transform. The Hadamard transform is given by the following equation (3).
[0048]
[Equation 3]

[0049]
Here, x and y are the coordinates of the time domain, and the image data is an integer, so the sample point is represented by ● in the figure. Since the binary Hadamard transform is equivalent to 45 ° rotational movement from the above equation (3), ● is converted into the coordinates read by the u-v coordinates in the figure in the conversion region. Consider scalar quantization of u and v with uniform step widths. However, if u is quantized more finely than v, for example, a quantization boundary as shown by the dotted line in the figure is obtained. For each class surrounded by this boundary, a representative value of quantization is given at the position of ○. Now, focusing on the hatched class i, there are two vectors xi1 and xi2 in this class, and both are quantized to xi after transformation. When xi is transformed back to an integer value, the closest integer is not a class i vector, but a class j vector xj2. Therefore, when xj2 is re-encoded, the quantized vector becomes xj and does not match xi.
[0050]
  Thus, the integer vector closest to the quantized representative value does not necessarily belong to your class.,This is the reason why transform coding is not lossless. This is not limited to the Hadamard transform but can also occur in DCT, and it is clear that it is independent of the order.
[0051]
  From the consideration of FIG. 6, it is expected that if the quantization width is increased, there will be many integer vectors to which the class belongs in the vicinity of the representative value, and loss will not easily occur in re-encoding. Therefore, in the second embodiment, the quantization width is set as described below.√ NEncoding is completely lossless by making it larger than (N is the order of conversion).
[0052]
<2. Limitation of quantization for lossless decoding>
  In encoding, the transform coefficients are quantized with uniform scalar quantization. In decoding, it is assumed that the inversely transformed vector is truncated to an integer vector having the closest Euclidean distance. In addition, if the calculation error of the transformation and inverse transformation is ignored, the distance must be maintained before and after the transformation. However, if Qi> √N is satisfied for all transformation coefficients of the orthogonal transformation, the inversely transformed vector The closest integer vector to isOriginalBelongs to the same class as the conversion coefficient. Where Qi is the quantization step width of the i-th transform coefficient, and N is the order of the transform.
[0053]
I will prove this. The inverse transformed vector is
[0054]
[Expression 4]

[0055]
And Here, without losing generality
[0056]
[Equation 5]

[0057]
As good as An integer vector around the vector c
[0058]
[Formula 6]

[0059]
If you
[0060]
[Expression 7]

[0061]
X satisfying 2^NThere are. Among them, the vector closest to c is
[0062]
[Equation 8]

[0063]
Then,
[0064]
[Equation 9]

[0065]
Therefore, the following equation (10) holds.
[0066]
[Expression 10]

[0067]
From the above equation (10) and the condition Q> √N,
[0068]
## EQU11 ##

[0069]
Holds. However, Q is the minimum value of the quantization step width Qi. on the other hand,
[0070]
[Expression 12]

[0071]
A vector x satisfying is always quantized to c. Because if the above equation (12) holds, for all i
[0072]
[Formula 13]

[0073]
This is because. From the above, it was shown that the vector Xc always belongs to the class c when re-encoded.
[0074]
<4. Evaluation>
Using five test images, all DCT coefficients were quantized with the same step width Q, decoded and then re-encoded to determine the number of blocks mapped to different classes.
[0075]
FIG. 7 shows the result.
The image sizes are all 512 × 512, and the number of blocks is 4096. From the table, it can be seen that when Q = 8, in all cases, the same class is mapped after re-encoding. In this example, it can be seen that losslessness is established when Q = 4.
[0076]
  As described above, according to the second embodiment, the first embodiment described above.InOn the other hand, JPEG compression is made lossless by limiting the quantization step size. If this is used, it can be ensured that the watermark data for authentication will not disappear after JPEG decoding.
[0077]
  The restriction of Q = 8 is strong when image quality is important.ExcessiveIt may be too much. In that case, it is possible to use different quantization tables for JPEG compression and digital watermarking. And even if the restriction of Q = 8 is imposed only on the quantization table of digital watermark,Good. If this is done, the above equation (12) is not satisfied, so JPEG decoding needs to be converted to an integer so that the watermark data does not disappear..
[0078]
Embodiment 3.
  In the first embodiment, the JPEG quantization structure is embedded as signature data.IncludedDigital watermark method to prove that the image has not been tampered withExplanationdid. Further, in the second embodiment, by setting the DCT coefficient quantization step width to 8 or more, the watermark remains after JPEG decoding.
[0079]
  In this third embodiment, an authentication digital watermark method suitable for high-quality JPEG compression is removed.ExplanationTo do. OutlineExplanationThen, the method according to the third embodiment has a quantization table for compression and a quantization table for digital watermark, and the compression is finely quantized while the digital watermark is coarsely quantized. The encoding image quality and the remaining digital watermark are both compatible. Here, the quantization step width of the digital watermark is set to be 8 or more. However, this change puts the inverse DCT result at the nearest integer value.ChangeIn general JPEG decoding, it is not guaranteed that the digital watermark remains. Therefore, in the third embodiment, a JPEG decoding method that guarantees the remaining digital watermark is also used.ExplanationTo do. According to the third embodiment, it has been confirmed by a computer experiment using a JPEG standard quantization table that the decoded watermark data does not disappear even if the scale factor is reduced to 0.1. At this time, the PSNR of the JPEG image in which the watermark data is embedded is 40 dB or more. Further, the third embodimentExplained inThe digital watermarking method can be applied to adaptive coding for locally modulating the quantization width, and also to moving picture coding such as MPEG.
[0080]
If the methods of the first and second embodiments are used, it can be proved from the image data only that the image compressed with JPEG is (1) by an authorized issuer and (2) has not been tampered with. . In addition, it is guaranteed that a digital watermark for this purpose remains after decoding with JPEG. However, the restriction of the second embodiment is that the JPEG quantization is performed with a step width of 8 or more, which is not suitable for high-quality JPEG compression. The third embodiment shows a digital watermark algorithm that does not require this restriction and a JPEG decoding method for leaving a watermark after decoding.
[0081]
<1. Digital Watermark Algorithm of Embodiment 3>
  Details of the algorithm are the same as in the first embodiment. That is, the basic algorithm is to encrypt the quantization structure of the DCT coefficient of the image and add it to the end of the DCT block. In the first and second embodiments, the quantizer 21 for compressing image data and the quantizer for digital watermark use the same quantizer 21. However, in order to guarantee the remaining watermark after JPEG decoding, there are certain restrictions on the quantization of the digital watermark as described in the second embodiment, and it is necessary to use a very fine quantizer. Can not. Therefore, in the third embodiment, a method of using different quantizers for image data compression and watermarking is used.ExplanationTo do.
[0082]
FIG. 8 is a diagram showing the configuration of the image coding apparatus according to the third embodiment in which the digital watermark embedding method according to the present invention is executed. In FIG. 8, this image encoding apparatus includes a DCT unit 1, two quantizing units 2A and 2B, two zigzag scanning units 3A and 3B, two run length converting units 4A and 4B, a dummy run adding unit 5, a hash function. Unit 6, exclusive OR (EXOR) unit 7, encryption unit 8, watermark embedding unit 9, variable length encoding unit 10, and stream encoding unit 11, and JPEG compression encoding of the input host image In this case, watermark data such as a signature image is encrypted by a public key encryption method, and is converted into an embedded coded stream as a digital watermark for each N (N is a natural number) blocks and output. The difference from the first embodiment is that the input host image is divided into two quantization tables 2A and 2B by different quantization tables, that is, a compression table Qc for compression and a different quantization table for digital watermark. It is a point which is quantized separately by Qw. As in the first embodiment, the DCT unit 1, the quantizing unit 2, the zigzag scanning unit 3, the run length converting unit 4, the variable length encoding unit 10, the stream encoding unit 11, etc. Since the JPEG compression encoding is performed, the digital watermark embedding method according to the third embodiment will be mainly described below.
[0083]
First, the quantization step of the quantization unit 2A for compression is Q^c _ijQ is the quantization step of the quantization unit 2B for digital watermarking^w _ij(I, j = 0,1, ..., 7). Here, the following conditions must be satisfied for all i and j.
[0084]
[Expression 14]

[0085]
[Expression 15]

[0086]
The condition of the equation (14) is necessary because watermark data can be embedded. Further, the condition of the above formula 15 is necessary for the watermark data to remain after JPEG decoding. To meet this condition, any Q^c _ijQ^w _ijShould be set as follows.
[0087]
[Expression 16]

[0088]
  Embed watermark data in DCT blockIncludedTo do so, do the following:
(1) DCT coefficient f_ijQ^c _ijQuantize with f^c _ijGet.
(2) f^c _ijQ^c _ijQ dequantized with Q^w _ijAnd the run-length structure is encrypted in the same manner as in the first embodiment to obtain the embedded bit b and the embedded position (p, q).
(3) f^c _pqIs changed as follows.
[0089]
[Expression 17]

[0090]
  Next, a specific example in which encoding is performed by a quantizer of the following formula (18) obtained by multiplying the JPEG quantization table by 0.4 will be described..
[0091]
[Expression 18]

[0092]
And from the above equation (16),
[0093]
[Equation 19]

[0094]
It is. Assume that the DCT coefficient of a certain block is given by the following equation.
[0095]
[Expression 20]

[0096]
Q this^c _ijWhen quantized with, the following index is obtained.
[0097]
[Expression 21]

[0098]
Q this^c _ijDequantize with Q^w _ijIf we requantize with, we get the following index:
[0099]
[Expression 22]

[0100]
  If this quantization structure is encrypted and the embedded bit is 0, according to the equation 17 above,The following formula is obtained.
[0101]
[Expression 23]

[0102]
However, the embedding position was set to the position (0, 3) immediately after the zigzag scan. Therefore, the quantization index with embedded watermark is
[0103]
[Expression 24]

[0104]
It becomes.
[0105]
<2. JPEG decoding algorithm>
  Encoding quantization matrix Q^cAnd digital watermark quantization matrix Q^wIf the step widths are all 8 or more, the inverse DCT real value vector is placed in the nearest integer vector with the Euclidean distance.ChangeIt is possible to prove that the watermark data is not erased from the decoded image. However, as described above, if different quantization matrices are used for encoding and digital watermarking, this is not guaranteed. Therefore, the watermark data may be lost if it is simply decoded into a close integer vector.
[0106]
  This will be described with reference to FIG.
  FIG. 9 illustrates the space of the decoding vector. Figure9, Ct is the decoded vector of the DCT coefficient quantized with Qw, y is the decoded vector of the DCT coefficient quantized with Qc, ○ is the integer vector, and the area surrounded by the solid line is decoded with Cw when quantized and encoded with Qw Is the set of vectors C Ct and y are real-valued vectors, and Ct is known at the time of decoding. When Qw = Qc, y = Ct. Now assume that Qw and Qc are different and y is decoded at the position shown in the figure. At this time, the integer vector closest to y is x0, and this vector is the set CInDoes not belong. If this is re-encoded, the decoded vector will not be Ct. This is the reason why the watermark disappears from the decoded vector. But now we know Ct. Therefore, from x0, the neighboring integer vector is traced and gradually closer to Ct.WithIf so, one day we will arrive at a vector belonging to the set C. From this observation, the following decoding algorithm is obtained.
[0107]
[Expression 25]

[0108]
In this algorithm, at each iteration,
[0109]
[Equation 26]

[0110]
Holds. If Qw> 8, an integer vector belonging to the set C exists around Ct.
Therefore, the above decoding algorithm always converges.
[0111]
<3. Evaluation>
FIG. 10 shows a result of an experiment performed on the test image (512 × 512 pixels) while changing the fineness of the encoding quantization table. In the table, scale represents the fineness of quantization. The quantization table used was the JPEG default multiplied by the scale value. The smaller this, the finer the quantization. When scale is 0.8, all quantization parameters are 8 or more, and the same quantization is performed for encoding and watermarking. Nblk is the number of blocks whose integer vector needs to be corrected after decoding. Nrep / Nblk is the number of iterations required when the vector is modified.
[0112]
The following can be understood from FIG.
(1) When scale = 0.8, the corrected block is 0, which matches the result of the second embodiment. That is, if all the quantization parameters are 8 or more, a watermark always remains after JPEG decoding.
(2) If the scale is reduced, the number of blocks to be corrected increases.
(3) If the scale is reduced, the number of repeated operations required for correction increases. However, this number is at most 4.5 in the experimental range.
[0113]
  As a result of the experiment, there are no uncorrected blocks. That is,This decryptionIt was confirmed that the algorithm converged reliably.
[0114]
  As described above, according to the third embodiment, an independent quantization table for digital watermarking is provided separately from the quantization table for encoding.TheBy having it, it is possible to realize an authentication digital watermark algorithm that supports high-quality JPEG encoding. Also, a decoding method for leaving watermark data in the decoded image has been shown. It is considered that the system shown here can be expanded to a block unit encoding system such as MPEG.
[0115]
In the first to third embodiments, for convenience of explanation, a method of embedding watermark data when a still image is encoded by JPEG compression encoding has been described. In the present invention, an image is divided into blocks. However, since it is only necessary to embed watermark data in the frequency conversion and quantized quantization index, it is not limited to JPEG using DCT conversion, for example, it can be applied to JPEG2000 using wavelet conversion, and Can also be applied to compression encoding methods for compressing moving images such as MPEG.
[0116]
【The invention's effect】
  As described above, according to the present invention, the run length structure of the quantization index obtained by quantizing the image data is embedded in the image data as signature data.IncludedTherefore, it can be proved that the image data has not been tampered with.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of an image coding apparatus according to Embodiment 1 in which a digital watermark embedding method according to the present invention is executed.
FIG. 2 is a diagram illustrating an example of a quantization index.
FIG. 3 is a diagram illustrating an example of a code length of a Huffman code for encoding (n, ± 1) in JPEG where n is up to 7. FIG.
FIG. 4 is a diagram illustrating an example of a quantization table.
FIG. 5 is a diagram showing an example of a watermark data detection circuit in an image decoding apparatus that decodes an encoded stream by the digital watermark embedding method according to the present invention.
FIG. 6 is a diagram illustrating an example of a structure of sample points in a time domain (x-y coordinates) of a binary Hadamard transform and a transformation domain (u-v coordinates).
FIG. 7 shows an example of the number of blocks that are quantized with the same step width Q using five test images in the first embodiment, decoded, and then re-encoded and mapped to different classes. FIG.
FIG. 8 is a diagram showing a configuration of an image coding apparatus according to a third embodiment in which the digital watermark embedding method according to the present invention is executed.
FIG. 9 is a diagram showing an example of a decoding vector space;
10 is a diagram showing an example of an experimental result obtained by changing the fineness of an encoding quantization table for a test image in Embodiment 3. FIG.
[Explanation of symbols]
1 DCT section, 2 quantization section, 3 zigzag scanning section, 4 run length conversion section, 5 dummy run addition section, 6 hash function section, 7 exclusive OR (EXOR) section, 8 encryption section, 9 watermark embedding section, 10 variable length coding unit, 11 stream coding unit.

Claims (9)

A frequency conversion means for converting a digital image into a conversion coefficient obtained by frequency conversion for each block;
Quantization means for generating a quantization index obtained by quantizing the frequency-transformed transform coefficient ;
Run-length converting means for generating run-length data obtained by run-lengthing the quantization index scanned for each block ;
A hash value conversion means for converting data in which the run length data for each of N (N is a natural number) blocks are arranged into an N-bit hash value ;
A watermark data embedding means for generating an N-bit signature data by embedding the watermark data into the hash value of the N bits,
Signature bit of each bit of the N bits of the signature data to correspond one for each run-length data of said N blocks, the value of each bit of the signature data is made to correspond is different depending on whether 0 or 1 value Signature data embedding means for putting the data in a predetermined position of the run length data of the block ;
An electronic watermark embedding device comprising: The digital watermark embedding apparatus according to claim 1.
Has a dummy run additional means the run-length means adds the end dummy run of run-length data obtained by run-length the quantization index for each of the blocks,
The hash value conversion means generates the N-bit signature data based on the run-length data for each of the N blocks to which the dummy run is added,
The signature data embedding means, the after-run of the added the dummy in the run-length data as the predetermined position of the quantization indices, electronic watermark embedding device characterized by placing the signature bits. The digital watermark embedding device according to claim 1 or 2 ,
The signature data embedding means, the N-bit signature of each bit of the data value 0 or 1 crab Based on the value of the signature bits put in a predetermined position of the run-length data - to correspond to 1 and + 1 and An electronic watermark embedding apparatus characterized by the above . Oite the electronic watermark embedding apparatus according to any one of claims 1 to claim 3,
An electronic watermark embedding apparatus characterized in that a quantization step width for quantizing a transform coefficient for each block is equal to or larger than a square root of M as a block size . A frequency conversion means for converting a digital image into a conversion coefficient obtained by frequency conversion for each block;
First quantization means for generating a first quantization index obtained by quantizing the frequency-transformed transform coefficient;
First run-lengthing means for generating first run-length data obtained by run-lengthing the first quantization index scanned for each block;
A second quantizing means for generating a second quantization index obtained by quantizing the transform coefficient frequency-transformed by the frequency transforming means coarsely than the quantization accuracy of the first quantizing means;
Second run length generating means for generating second run length data obtained by run lengthing the second quantization index scanned for each block ;
N (N is a natural number) and the hash value conversion means for converting the second run-length data of the number of each block of parallel solid data to the hash value of N bits,
A watermark data embedding means for generating an N-bit signature data by embedding the watermark data into the hash value of the N bits,
Each bit of the signature data of N bits to correspond one for each first run-length data of said N blocks, the value of each bit of the signature data is made to correspond it is different depending on whether 0 or 1 value Signature data embedding means for putting the signature bit of the block in a predetermined position of the first run length data of the block
An electronic watermark embedding device comprising: Computer
A frequency conversion means for converting a digital image into a conversion coefficient obtained by frequency conversion for each block;
Quantization means for generating a quantization index obtained by quantizing the frequency-transformed transform coefficient;
Run-length converting means for generating run-length data obtained by run-lengthing the quantization index scanned for each block;
A hash value conversion means for converting data in which the run length data for each of N (N is a natural number) blocks are arranged into an N-bit hash value;
Watermark data embedding means for generating N-bit signature data by embedding watermark data in the N-bit hash value;
Each bit of the N-bit signature data is associated with each of the N blocks of run-length data one by one, and the signature bits having different values depending on whether the value of each bit of the corresponding signature data is 0 or 1 Signature data embedding means for putting the data in a predetermined position of the run length data of the block;
Digital watermark embedding program to make it function . Computer
Frequency conversion means for converting a digital image into a conversion coefficient obtained by frequency conversion for each block;
First quantization means for generating a first quantization index obtained by quantizing the frequency-transformed transform coefficient;
First run-lengthing means for generating first run-length data obtained by run-lengthing the first quantization index scanned for each block;
A second quantizing means for generating a second quantization index obtained by quantizing the transform coefficient frequency-transformed by the frequency transforming means coarsely than the quantization accuracy of the first quantizing means;
Second run length generating means for generating second run length data obtained by run lengthing the second quantization index scanned for each block;
Hash value conversion means for converting data in which the second run-length data for each of N (N is a natural number) blocks are arranged into an N-bit hash value;
Watermark data embedding means for generating N-bit signature data by embedding watermark data in the N-bit hash value;
Each bit of the N-bit signature data is associated with each of the first run-length data of the N blocks, and a different value depending on whether the value of each bit of the corresponding signature data is 0 or 1 Signature data embedding means for putting the signature bit of the block at a predetermined position of the first run-length data of the block;
Digital watermark embedding program to make it function. A digital watermark embedding device according to any one of claims 1 to 5 ,
An image encoding apparatus comprising encoding means for encoding run-length data in which the signature data embedding means embeds signature bits . An image encoding program for causing a computer to function as each unit of the image encoding apparatus according to claim 8.

Images