Keywords: Medical imaging, Security, Watermarking, Encryption, JPEG-LS Compression, JPEG Compression Imagerie médicale, Sécurité, Tatouage, Chiffrement, Compression JPEG-LS, Compression JPEG

À mes parents À ma soeur À la mémoire de ma grand-mère À tous ceux qui me sont chers, ... Le travail présenté dans cette thèse a été réalisé au sein du département ITI de l'IMT Atlantique Bretagne-Pays de la Loire.

Par ces quelques lignes, je tiens à remercier toutes les personnes qui ont participé de près ou de loin au bon déroulement de cette thèse, en espérant n'avoir oublié personne.

Je tiens à adresser en premier lieu mes plus chaleureux remerciements à mon directeur de thèse Professeur Gouenou Coatrieux. Les conseils qu'il m'a prodigué, la patience, la confiance qu'il m'a témoignée ont été déterminants dans la réalisation de mon travail de recherche.

Je remercie également le professeur Alexandre Moreau-Gaudry, mon co-directeur de thèse pour son encadrement tout au long de cette thèse, ses conseils, et ses encouragements.

Ma très vive reconnaissance va à Monsieur Michel Cozic, directeur R&D, MEDECOM. Je vous remercie d'avoir cru en moi et en mes capacités, pour vos précieux conseils, et pour le temps que vous m'avez accordé ces années.

J'exprime tous mes remerciements à Professeur Henri Maitre d'avoir accepté de présider le jury d'examen. Je lui adresse mes sentiments les plus respectueux.

Je tiens à remercier Messieurs Philippe Carré et Nacim Betrouni pour avoir bien voulu rapporter sur mon travail de thèse et pour toutes leurs précieuses remarques qui m'ont beaucoup aidé à améliorer la qualité de ce travail.

Je remercie également Madame Dalel Bouslimi et Monsieur Jean-Claude Nunes d'avoir accepter de participer à mon jury de thèse.

Je tiens à remercier vivement tous les membres de ma famille, qui m'ont énormément aidée et tenue tout au long de ces années par leur soutien moral continu.

Pour conclure,

List of Figures

The resulting bitstream corresponds to the Huffman code of the resulting data after the DPCM and RLE processes on the DCT block. . . . . . . . . . . . . . . . . . . 2.9 General scheme of the proposed joint watermarking-compression for image protection. 2.10 Computation and embedding of S Bci into the compressed block B ci , where B wc{1..i-1}

are the previous compressed-watermarked blocks of N bits, K wc is the secret watermarking key and B wci is the compressed-watermarked block. . . . . . . . . . . . . 2.11 Samples of our image test sets: (a) Ultrasound and (b) Mammography images. . . 2.12 Trade-off between the message length and JPEG quality factor (Q f ). . . . . . . . . 2.13 PSNR vs. total embedding capacity in the compressed domain in case of JWJLS scheme for: a) ultrasound images, and b) mammography images. . . . . . . . . . . 2.14 PSNR vs. total embedding capacity in the compressed domain in case of JWJPG scheme for: a) ultrasound images, and b) mammography images. . . . . . . . . . . correspond to the original, the watermarked-encryptedcompressed, the watermarked-compressed and the decompressed images, the watermarking keys in compressed and encrypted domains, the encryption key, the embedded and extracted messages from compressed and encrypted domains, respectively. depending on the error-correcting code parameters where "1", "2" and "3" corresponds to the repetition code (3, 1), Hamming [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Coatrieux | A review of image watermarking applications in healthcare[END_REF] and Hamming [START_REF] Lokesh | Cloud based telemedicine in neurology clinics: A new horizon[END_REF][START_REF] Jr | Picture archiving and communication system[END_REF], respectively. . 4. [START_REF] Saripalle | Using hl7 fhir to achieve interoperability in patient health record[END_REF] Tests on "Airplane" image: PSNR according to the shifting magnitude (∆). . . . . 4.17 Simulation results of the proposed scheme on "Lena":

List of Tables

General Introduction

Medical imaging refers to techniques and processes used to create images of various parts of the human body for diagnostic and treatment purposes. Being well-known through various radiological imaging modalities such as: X-ray radiography, Magnetic resonance imaging (MRI), Computed Tomography (CT); medical imaging also includes ultrasound modalities, as well as in the visible spectrum like in ophthalmology and dermatology. Nowadays, medical imaging is an essential component of the care pathway, adding value in each stage it is involved in. Medical imaging contributes to better and more accurate diagnoses from the start and, through continuous monitoring allowing better care decisions and more effective treatments and results, in general. In addition, along with the introduction and the exponential development of telecommunication technologies in the healthcare domain, medical images are cross-exchanged in right time allowing new medical practices participating in the connection between physicians and other caregivers as well as the patient through, for example telediagnosis, teleconsultation and tele-expertise services. To sum up, medical images within the modern health information infrastructure present significant benefits.

However, while the recent advances in information and communication technologies provide new means to access, handle and exchange medical images, they also compromise their security. Medical images can be intentionally or unintentionally manipulated both within the secure medical system environment and outside. Hardly a day goes by without an article in the press featuring hacking of medical data or security breaches [1]. Due to the fact that medical imaging plays more and more an important role in the health system, questions of medical images' security are of utmost importance. Indeed, as any medical records, a medical image is a sensitive piece of data in terms of confidentiality, integrity (the alteration of an image can bring misdiagnosis) and so on.

Security requirements of medical information are mostly derived from strict and strong legislative and ethic regulations, that professionals are obliged to respect (e.g the French medical ethic code, the General Data Protection regulation (GDPR) [START_REF]How does the general data protection regulation (gdpr) affect gps?[END_REF]). This requires four mandatory features to satisfy: confidentiality, reliability, availability, and traceability. Confidentiality indicates that only authorized users can access medical data. Reliability corresponds to the confidence one can have into a piece of data. Basically, data reliability relies on the outcomes of: i) integrity -a proof that a piece of information has not been modified by a non-authorized user; and, ii) authenticity -a proof that certifies a piece of data belongs to the correct patient and is issued from the right source. Being sure that a piece of information is reliable, health professionals will use it in complete trust for diagnosis purposes. Availability defines the ability of authorised persons to use the health information system in the normally scheduled situations of access and practice. Data traceability stands on the proofs of the reliability of data, i.e. proofs of data authenticity and integrity, all along their life cycle. Hence, it is easy to understand the reasons of these needs: any violation of these security principles endangers the patient care and health, while also having consequences for the healthcare professional or institution. Furthermore, security is the base of a trustful relationship between patients and the health care system (practitioners, administration, etc.). As example, being sure that his or her say are confidentially stored, a patient will talk about his or her health problem without any shadows.

In order to counter-fight these threats, several protection mechanisms have been proposed. In an information system, such as the one at the hospital, the mechanism stands on the definition and deployment of a security policy. To do so, one can for instance follows ISO 27005 [START_REF] Fraser | Iso 27799: Security management in health using iso/iec 17799[END_REF]. Such a standard asks for a security risk analysis of the information system, against various threats (accidents -e.g., material failures, natural phenomena, negligence; errors -e.g., mistyping, transmission errors; attacks and misappropriations -e.g., frauds, piracy, blackmailing), and helps to identify the appropriate security mechanisms to counteract possible threats. A non-exhaustive list includes access control, user rights management and encryption which are helpful for confidentiality while digital signatures will ensure data integrity. However, these security solutions offer an a priori protection or in other words, once they are bypassed or more simply when the access to data content is granted, data are no longer protected. Here comes the interest of an "a posteriori " protection, a kind of protection watermarking ensures [START_REF] Coatrieux | A review of image watermarking applications in healthcare[END_REF]. Basically, when it is applied to images, watermarking is defined as the invisible embedding of a message into a host image by imperceptibly modifying its gray values; such a message can be used so as to verify whether the image has been modified as well as whether it has been illegally redistributed. Watermarking leaves access to the data while maintaining them protected by the message.

On the other side, the ever-growing quantities of information needing to be managed have to be taken into account while protecting medical images. In fact, on a daily basis, large amount of medical images are acquired. Note that these images, in turn, constitute large volumes of data: for instance, a typical CT heart exam can yield a data size up to 1 Gigabyte. Compression of medical images is thus largely exploited to optimize costs of storage and of transmission. Images can be lossy or lossless compressed. If in the latter case no information loss occurs, that is to say that the original data are exactly recovered from the compressed data bitstream (e.g., using JPEG-LS, Lempel-Ziv compression standards), lossy compression tends to be more and more accepted (e.g., using JPEG or lossy JPEG2K). From this standpoint, it becomes desirable to develop solutions that can give access to watermarking-based security services (e.g. integrity and authenticity control) in the compressed domain.

In the medical domain, the communication, data format, storage, retrieval, visualization and printing of medical imaging information are specified by the international medical imaging standard DICOM (Digital Imaging and Communications in Medicine) [START_REF] Miguel | Web validation service for ensuring adherence to the dicom standard[END_REF]. DICOM takes into account different security aspects in its part 15. To ensure image confidentiality, while being DICOM compliant, the triple DES or AES encryption can be used. Image integrity can be provided with the help of the DSA digital signature. Such a signature will be located in the DICOM file header of the image. As a consequence, developing new watermarking-based security services for compressed or protected medical images should also be compliant to DICOM. This is the context of our research works conducted during the three years of PhD. This thesis is structured as follows. Chapter 1 provides some general definitions about the main domains we addressed in order to position the problems we focused on. We will thus come back on: medical imaging modalities -the way medical images are produced; medical image information systemsthe way medical images are shared and stored; the security needs associated to medical images in such open environment. We will also focus on the actual security tools, both general and specific to medical images, underlying their weakness and highlighting the interest of watermarking as a complementary security mechanism to these solutions. Then, we will introduce the main principles of image watermarking, its properties as well as its techniques. A state of the art of existing medical image watermarking methods concludes this chapter.

Chapter 2 is devoted to joint watermarking-compression of medical images. Existing methods, beyond the medical domain, are reviewed before focusing on the method proposed for medical image protection. The weaknesses of such methods led us to focus on a solution that allows accessing to watermarking-based security services from compressed data, an original topic. More clearly, as medical images constitute large volumes of data stored and distributed in a compressed form, we were interested in the access to the security services directly from the compressed image without having to decompress it, even partially. From this system, we have derived two schemes: the first embeds a watermark during the JPEG-LS compression of the image [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF] while the second watermarks an image during its JPEG compression. Note that both schemes are DICOM-compliant as JPEG-LS and JPEG are part of the DICOm standard. Furthermore, with our schemes watermark extraction is independent to the decompression process; that is to say, image decompression can be performed with the common standard decompression algorithm. Performance of these schemes are experimentally validated on large image data set, showing their suitability for different security objectives like integrity control and data authenticity.

In Chapter 3, we propose an amelioration of the method proposed in the previous chapter adding the possibility to access to various watermarking-based security services from the encryptedcompressed image and from the decrypted-compressed image bitstream [START_REF] Haddad | A new joint watermarking-encryptionjpeg-ls compression method for a priori & a posteriori image protection[END_REF]. This scheme comes from the interest of offering an a priori an a posteriori image protection. The originality of this proposal is twofold. First, as already said, it allows accessing to watermarking-based security services from both encrypted and compressed image bitstream without having to decrypt or to decompress them, even partially. Second, it combines the bit-substitution watermarking modula-tion with JPEG-LS and the AES block cipher algorithm in its cipher block chaining (CBC) mode, in a single operation. It is important to notice that with our scheme, it is possible to decipher and decompress the image with the common AES and JPEG-LS algorithms. More clearly, decryption, decompression as well as message extraction processes are conducted independently without having to be modified or adapted. With such a capability, our scheme is DICOM compliant. The performance of this scheme in terms of embedding capacity and image quality distortion is theoretically analyzed and experimentally verified, demonstrating the possibility of access to various watermarking-based security services ranging from authenticity control to data traceability as well as the good quality of the watermarked-decompressed-decrypted images. Note also that the proposed scheme saves the computational complexity as it does not require decryption and decompression to verify the image reliability in the encrypted domain and the compressed one, respectively.

Chapter 4 is devoted to lossless or reversible image watermarking of encrypted images. We propose a novel data hiding approach which allows embedding, in a reversible manner, a message into an encrypted image; a message that can be accessed whether the image is encrypted or decrypted. To do so, the proposed solution relies on the insertion of a pre-watermark into the image before its encryption. This "pre-watermarking" step is conducted with the help of a robust reversible histogram shifting watermarking modulation we propose; modulation that has errorcorrection capabilities. Message insertion (resp. extraction) is then commonly conducted into (resp. from) the encrypted image. It is the impact of this message insertion process onto the "prewatermark" that gives us access to the message into the clear domain, i.e. after the decryption process. Due to the robustness of the embedded pre-watermark, the errors introduced into it can be corrected in the clear domain, thereby allowing then to restore the original image. With our approach, the watermark process is independent of the knowledge of the encryption key. One just has to know the watermarking key for message embedding and extraction. Reciprocally, message embedding/extraction processes are completely independent from encryption/decryption. The feasibility of our approach is demonstrated considering the Trivium stream cipher and a robust histogram shifting modulation that we developed. Experiments conducted on some natural images and medical images confirm the efficiency of our approach to make available a message in both clear and encrypted domains and to correctly recover the original image in the clear domain.

Finally, in Chapter 5 we present a psychovisual study on the watermarking impact on CT (Computer Tomography) images. The first objective of this study is to confirm that for CT images, a loss of information related to watermarking is acceptable. The second objective is to determine, for a watermarking algorithm, the range of its parameters' values that can be used without any significant reduction of the image visual/diagnostic quality. To do so, we select in our study the least significant bit substitution modulation as a watermarking algorithm. Then, on a lung thoracic CT image database, we detail the implementation of two protocols for the subjective evaluation of image quality. The first protocol is designed to perform an in-house test with MEDECOM and IMT-Atlantique staffs, with as purpose to identify an embedding strength threshold above which the watermarked image appears visibly different from its original version. The second protocol was set up for a psychovisual study with radiologists to assess the diagnostic quality of watermarked images. All the results obtained from the first protocol are analyzed and compared with results obtained from objective quality metrics.

Chapter 1

Security of Medical Images

In recent years, advance in information and communication technologies have radically changed our daily lifestyle and have boosted all economic sectors including healthcare. They offer new possibilities to store, access and transfer data over networks in between practitioners, for a second opinion for example, between the physician and the patient. Medical data are rapidly growing, in both volume and complexity as the sources of data keep on proliferating. According to a report by EMC Digital Universe [START_REF]The digital universe: Driving data growth in healthcare[END_REF], healthcare data will be about 2,314 Exabytes (one Exabyte equates to about 1 billion gigabytes) per year by 2020. Medical imaging, very essential in many steps of patient cares (e.g. diagnosis, patient follow-up), largely contributes to this evolution with more and more accurate image modalities. Such an evolution also leads to a situation in which patients' health data are confronted to new security threats all along their life cycle in terms of confidentiality, integrity and privacy, but not only. For instance, in 2016, Los Angelos-based Hollywood Presbyterian Medical Center (LAHPC) was attacked by the Locky ransomware. In order to retrieve the access to its system, LAHPC has to pay nearly 160 Ke. To respond such threats and due to the sensitive nature of medical data for patients' life, many regulations have been progressively established in order to impose on healthcare professionals to ensure the security of the data of their patients. At the same time, new security research topics have emerged due to the lack of solutions to reach these security objectives in such open environments (i.e. connected to internet). Let us take as example, cryptographic mechanisms and access control policies. Once these mechanisms bypassed or in other words, once the access to data is granted, data are no longer protected. Here comes the interest for a complementary security technique but still rather new in healthcare: "data watermarking". This chapter hinges on three main parts. The first one presents the basic notions of what medical data are, and especially medical images, how they are distributed and the security risks they are submitted to. In the second part, we go through the security needs and actual security mechanisms used to protect medical images. We introduce watermarking in the third part and how it can advantageously complete the previous techniques to better protect data against leaks and malevolent manipulations.

Medical Imaging

Image modalities

In terms of diagnosis, common imaging types include radiology, ultrasound imaging (US), computerized tomography (CT), magnetic resonance imaging (MRI), and positron emission tomography (PET). Radiology is the oldest but one of the most frequently used imaging modalities. It uses X-ray attenuation properties and maps out the cumulated absorption process of an X-ray during its path along the tissues. To create a radiograph, a patient is positioned so that the part of the body being explored is located between an X-ray source and an X-ray detector. To improve X-ray image quality, a contrast agent can be used. CT imaging uses X-rays to produce a 3D image of the anatomy of the internal organs, bones, soft tissue and blood vessels within the body by acquiring several projections at different angles and reconstructing the 3D volume using tomography. X-ray properties make it very useful for medical diagnosis and treatment. It is widely used in clinical routines for the study of bones, to examine breasts (mammography) or lungs as well as in cardiol- ogy for coronary angiography. Regarding MRI, it is used to observe the anatomy of body organs; their lesions as well as their performance that cannot be well seen using X-rays or CT scans. MRI is used to diagnose strokes, tumors, spinal cord injuries, aneurysms and brain function. US uses sound waves rather than ionizing radiation. High frequency sound waves are transmitted from the probe to the body via the conductive gel. These waves then bounce when they reach the different structures of the body and create a diagnostic image. Because of the minimal risk associated with it, US imaging is the first choice in pregnancy, but its applications are so vast: cardiac, spine, internal organs, and emergency diagnosis. PET is a type of nuclear medicine technique in which tracers are used for diagnosis disease to efficiently distinguish between benign and malignant tumors in single imaging.

Let us now emphasize some of their characteristics: for instance, all the medical imaging modalities offer image sequences either spatial (e.g. slices in CT, MRI, PET) or temporal (e.g. US, X-ray). Furthermore, the contrast between the organs or the characteristics of the organs is very variable: if the bones are clearly visible in CT images, this modality is not very discriminating for the soft tissues hence the need to inject a product of contrast (the best example concerns the angiography, the possibility of seeing the vascular network). MRI provides a better understanding of soft tissue differences. US images are considered difficult images because of the so-called speckle noise. Noise is intrinsically present in all images: physical noise of course due to the sensors but also to the diffusion and the diffusion effects (US, PET, etc.). Artifacts are common: they can come from the reconstruction itself, as in a scanner, when several heartbeat cycles are used to obtain a sequence of images in a time. The movement of the organs (heartbeat, breathing or displacement of the patient during the image acquisition) can also provide a filtering and therefore a smoothing of the borders of the organs.

In fact, unlike natural images, which are generally encoded on 8 bits, medical images have a larger range of gray values. The magnitude of each pixel or voxel is encoded on 16 bits while in radiology, images are often encoded on 12 bits. The difference between images issued from different modalities can also be noticed in images' size, as given in Table 1.1. The image depth influences the visualization and thus interpretation of radiologists, even if the eye is unable to differentiate as many tones. Indeed, a study done in [START_REF] Krupinski | Influence of 8-bit vs. 11-bit digital displays on observer performance and visual search: A multi-center evaluation[END_REF] has compared the performance in terms of interpretation time and radiologists' diagnosis reliability when images are projected on 11-bit screens and 8-bit screens using various types of images. Authors concluded that 11-bit screens could improve observer performance.

To resume, these various imaging modalities are complementing each other by highlighting different properties of normal and abnormal structures and tissues of the human body. This is the basis of multimodal imaging. There exist several ways to deal with it. A joint system can be designed by coupling in the same device two or more modalities: PET-CT is one example where CT brings the anatomical frame totally absent in PET. Another way consists of performing distinct image acquisitions, separated over time, and then registering the data through geometric transformations, rigid or elastic. After being acquired, medical images are consequently reviewed for clinical analysis, diagnosis, and treatment as part of the patient's care plan. The collected information can be used to identify any anatomical and physiological abnormalities, to map the progress of treatment as well as for research purposes. Having digital access to the latest version of a patient's medical images, clinical reports and medical history can speed up and improve care and avoiding redundant testing. Digital access can also improve patient safety and save both the facility, its time and money. Herein, some technologies were developed to provide an efficient mechanism in dealing with the outsourced images, either for remote consultations inside the hospital, or outside, or combining both environments.

Medical image information system

Hospital Information System & Radiology Information System

In healthcare organization, different categories of information systems exist: systems for the general practitioners and the specialists (cardiologists, ophthalmologists, dentists, etc.); systems for hospital units such as radiology, functional exploration, laboratory; hospital information systems. Hospital Information System (HIS) is an integral component of any hospital. It provides the context within which collecting, processing, analysis and reporting of medical information take place. More clearly, it is designed to access patient information, reports from various services, and billing information. This electronic patient records give physicians an overview of the care provided to the patient. HIS can be composed of various software components with specific extensions as well as of a large variety of medical speciality sub-systems. However, HIS rarely give to medical images, nor do they have a user interface that can display images and navigate a large, complex, multi-image study. This is the role of the Radiology Information System (RIS) that is designed to place radiology orders, to receive interpretations, and to prepare bills for patients. This system is especially useful for tracking radiology imaging orders and billing information, and is often used in conjunction with PACS (Picture Archiving and Communication System) [START_REF] Jr | Picture archiving and communication system[END_REF] that constitutes the core of radiography technical units.

Picture Archiving and Communication System (PACS)

PACS is a combination hardware and software systems that are used to acquire, store, distribute, and retrieve medical images. It facilitates the handling of digital radiology images so that they can be accessed and viewed by a variety of health professionals in different locations and settings, enhancing patient care and improving operational efficiencies for healthcare professionals.

As summarized in Figure 1.1, a PACS is constituted of four major components: image acquisition devices such as MRI and CT, communication networks, PACS archive and server for the storage and retrieval of patients' images and reports, and integrated display workstations for interpreting and reviewing images. In fact, this technology replaces the need for hard-copy films and management of physical archives, enabling radiologists in different physical locations to review the same data at the same time and allows health professionals to manage and follow the workflow of a patient exam. Furthermore, PACS offers an electronic platform for images interfacing with other medical information systems such HIS and RIS.

In addition to the mentioned medical imaging systems, there exist complementary technologies that attempt to improve the efficiency, accuracy, speed and access of medical imaging systems. One of the most remarkable technologies is Telemedicine.

Telemedicine

This technology [START_REF] Scott Kruse | Evaluating barriers to adopting telemedicine worldwide: A systematic review[END_REF][START_REF] Kahn | Virtual visits-confronting the challenges of telemedicine[END_REF] corresponds to the remote delivery of health services, such as health assessments or consultations, over networks. It allows physicians to assess, diagnose and treat patients using common technologies, such as videoconferencing and smartphones, without the need for an in-person visit in order to provide care at less cost to the patient, especially in emergency Figure 1.1: Picture Archiving and Communication System cases. Telemedicine can be categorized into three classes; which are: i) remote patient monitoring, ii) interactive telemedicine and iii) store-and-forward. The first class allows for instance patients with chronic diseases to be tracked and monitored at home with mobile medical devices that collect data related to health (e.g. blood glucose level, blood pressure), patient behaviour (verification he/she follows treatment procedure).

Practitioners can remotely review acquired data instantly. This can also empower patients to better manage their health and participate in their health-cares. Interactive telemedicine, called also as "synchronous telemedicine", is a real-time video visit where patients and health providers are able to exchange information and communicate between each other. The patient may be at home or in a healthcare center. Regarding the last class also known as "asynchronous" telemedicine, it regroups techniques by which healthcare providers share patient medical data like reports, images with another physician, radiologist, or specialist at another location even across long distance to collaborate for remote diagnosis.

Healthcare innovation and virtualization continue to drive the expansion and strengthening of hospital service lines. However, telemedicine technologies are designed for specific healthcare provider or organization, with static requirements and specifications; which make them difficult to scale to changing needs or extended applications. Moreover, another obstacle to the use of telemedicine is the prohibitive up-front costs for healthcare providers and patients, including investment in expensive equipment and costly network infrastructure and specialized training. As revealed by [START_REF] Kim | 10 ehr implementations with the biggest price tags in[END_REF], the cost of implementing a data-center system to store and manage medical data costed, in 2017, from $25 millions up to $10 billions for 26 hospitals. Therefore, alternative and innovative ways to provide more flexible and affordable telemedicine services are of high interest.

Cloud-based platforms for telemedicine [START_REF] Lokesh | Cloud based telemedicine in neurology clinics: A new horizon[END_REF] have addressed such a problem. It is essentially the use of remote servers hosted on Internet. More clearly, it allows health professionals to flexibly store and process massive data remotely, without a need to purchase and maintain their own infrastructure, unlike physical servers. Basically, Cloud-computing allowing multiple users geographically separated from one another to manage, store and share massive amount of data with high availability.

Diagnosis is also concerned with the development in the healthcare domain. As known, misdiag-nosis costs unnecessary additional testing, results in delayed treatment plans and reduced survival or remission rates compared to what it might have happened if the disease had been correctly captured and identified earlier. That is why and due to the availability of large-scale labelled (i.e. annotated) image datasets, some technology innovators are trying to address these issues by experimenting with artificial intelligence (AI) and machine learning. Computer-aided diagnosis system can work on colossal amounts of data -much faster and more precisely than health professionalsto discover patterns and predictions to improve the diagnosis of diseases, inform treatment plans and improve public health.

Transmission standards

Transmission of medical data between different users and systems is complicated for two reasons: i) medical information systems use different machine platforms and ii) medical images are created from various imaging modalities from distinct manufacturers. Here comes the need for universal normal data formats and correspondence protocols that enable interfacing between two or more medical systems. Health Level seven (HL7) is the standard of reference for managing non-imaging data such as test results, patient demographics, and billing information. Basically, HL7 [START_REF] Saripalle | Using hl7 fhir to achieve interoperability in patient health record[END_REF] is a set of international standards for exchange, management and integration of clinical and administrative electronic data in healthcare centers. It allows thus the interoperability between various medical information systems (e.g. HIS-RIS interfaces).

The Digital Imaging and Communications in Medicine (DICOM) is the standard [START_REF] Miguel | Web validation service for ensuring adherence to the dicom standard[END_REF] for handling medical images. It was originally developed by the American College of Radiology and the National Electrical Manufacturers Association in 1985 to improve the interoperability between medical imaging systems. DICOM provides detailed specifications on how to format and exchange medical images and their associated information, both inside and outside the healthcare organization (e.g. telemedicine). DICOM interfaces are available for facilitating the connection between any combinations of the following categories of digital imaging devices:

• Image acquisition equipment (e.g. Ultrasound imaging, CT imaging, MRI, X-ray imaging);

• Image processing devices and workstations for displaying images;

• Image archive;

• Print devices.

As previously mentioned, PACS can resolve the problems of images storage and transmission but the ever-growing quantities of information needing to be managed also have to be taken into consideration. In fact, on a daily basis, large amount of medical images are acquired using various imaging modality devices. For instance, a typical CT heart exam can yield a data size up to one Gigabyte (see Table 1.1 in Section 1.1.1). One hospital can thus produce at least 27,000 Terabytes of medical imaging data per year [START_REF]What's next for the health-care data center?[END_REF]. Furthermore, according to a report by EMC Digital Universe [START_REF]The digital universe: Driving data growth in healthcare[END_REF], healthcare data will be about 2,314 Exabytes (one Exabyte equates to about 1 billion Gigabytes) per year by 2020. Medical image compression can therefore be extremely useful to optimize costs of storage, transmission and management of these data. Many of compression standards have been thus included in DICOM as compressed data formats for the exchange of medical images.

Image compression

Image compression reduces storage space, transmission time and bandwidth requirements. Basically, it takes advantage of the image information redundancy to minimize the number of bits needed to represent the image. We give in Figure 1.2 an overview of the main steps of an image compression chain. The first step consists in transforming the original image from its representation in the spatial domain (i.e. pixels) into a separate type of representation (e.g. prediction-errors, transformed coefficients) to reduce image signal redundancies. In essence, three types of redundancy in images can be identified [START_REF] Sachin | Wavelets: applications to image compression-i[END_REF]. Beyond the fact that the statistical distribution of pixels' values varies; there are pixels of more occurrences than others. There also exists interpixel redundancy due to the high correlation between nearby pixels within the image; i.e. they have very similar intensities as those of their neighboring pixels. This type of redundancy can be reduced when the 2-D representation of the image is transformed into a representation of differences between pixels. This is the case of compression standards based on prediction such as JPEG-LS [START_REF] Haddad | A new joint watermarking-encryptionjpeg-ls compression method for a priori & a posteriori image protection[END_REF]. But in general, the main idea of transforming the image is to find another representation where the signal energy is compacted onto some transformed and statistically independent coefficients. That is the case of JPEG and JPEG2000 that are based on the Discrete Cosine Transform or the Discrete Wavelet Transform, respectively. Notice that these compression standards also combine prediction to image transform so as to improve the compression rate (i.e. the ratio between the sizes of the compressed image and its uncompressed form). Furthermore, this image transformation process can introduce some information loss by taking into account the properties of the human visual system (HVS) properties [START_REF] Kai | Hvs-based medical image compression[END_REF]. More clearly, the human eye is more sensitive to lower frequencies (e.g. flat areas in the image) that to the higher one (e.g. textural regions). It can be hence considered as a lowpass filter. Therefore, such high frequency information or image details can be discarded without affecting or changing the visual quality of the image. JPEG and JPEG2000 achieve this goal by more or less quantizing DCT or wavelet coefficients, respectively. The harder the quantization is , the more information loss occurs and the more efficient the compression is.

The image transformation step is then followed by an entropy encoding step, the purpose of which is to find a more compact encoding representation of the transformed data with no information loss. One basic idea is to assign to a coefficient value a "codeword", the size of which depends on the probability of the coefficient value in the image. By attributing shorter codes to the more probable coefficients' values, it is possible to reduce the global size of the image representation. Among entropy encoding compression techniques, one can find arithmetic coding [START_REF] Xiang | Reversible natural language watermarking using synonym substitution and arithmetic coding[END_REF], Huffman encoding [START_REF] Jas | An efficient test vector compression scheme using selective huffman coding[END_REF], and Golomb-Rice encoding [START_REF] Walter D Leon-Salas | Encoding compressive sensing measurements with golomb-rice codes[END_REF]. We will come back on these aspects in the case of JPEG-LS and JPEG with more details in Chapter 2.

Based on these various redundancy reduction types, compression techniques can be discriminated into two classes:

• Lossless image compressionit is also called reversible or noiseless compression [START_REF] Rusyn | Lossless image compression in the remote sensing applications[END_REF]. It allows the representation of the image with the smallest possible number of bits without information loss. More clearly, the original image is exactly recovered after its decompression. This type of compression is based on reducing the coding and/or interpixel redundancies in the image. However, due to its modest compression rate, lossless compression techniques are of limited use (e.g. it can be used in few applications with stringent requirements such as healthcare domain).

• Lossy image compressionit allows some loss of information as long as the recovered image is perceived to be identical to the original one [START_REF] Zemliachenko | Still image/video frame lossy compression providing a desired visual quality[END_REF]. This loss of information comes from the removal of psychovisual redundancies by quantization process known as an irreversible process. This type of compression can achieve much higher compression rate compared to lossless methods but at the cost of a decrease in quality.

For medical images, the use of lossy compression techniques is of major concern. They offer a significant space gain but could change the diagnostic interpretation of the image and result in injury to a patient. It is complicated to define the amount of distortion accepted that could preserve the reliability of the diagnosis of the decompressed image. Therefore, the adoption of lossy compression was not permitted [START_REF] Liu | The current role of image compression standards in medical imaging[END_REF]. Nevertheless, several professional organizations have issued guidelines and standards supporting the safe use of lossy compression in clinical practice. For example, the American College of Radiology released a standard [START_REF]Acr-aapm-siim technical standard for electronic practice of medical imaging[END_REF] that allows the compression of medical images using only the algorithms defined in the DICOM standard such as JPEG, JPEG2K. Still, it does not highlight any statements on "the type or amount of compression that is appropriate to any particular modality, disease, or clinical application to achieve the diagnostically acceptable goal". Canadian Association of Radiologists has recently published the recommended compression ratios [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF] for lossy techniques. Note that these recommendations were based on objective and subjective quality assessments and have involved many experts. If we refer to this study, the allowable compression ratio does not only vary depending on the used compression technique, but it also largely depends on the characteristics of the image; characteristics that are related to the image modality as well as the nature of the organ being explored. Table 1.2 provides the maximum compression ratios recommended for JPEG and JPEG2000 for the specific modalities and anatomical areas.

To sum up, medical images play an important role in diagnosis, patient follow-up and screening. This is why they are more and more shared in-between health professionals (e.g. telemedicine applications, cloud-based medical imaging applications) and also re-used and combined with machine learning techniques so as to develop tools for diagnosis aid support. But, the ever-growing quantities of medical imaging needing to be managed have to be taken into consideration. Therefore, medical images should be stored and distributed in compressed form in order to optimize their costs of storage, transmission and management. However, with the widespread applications of medical images, possibilities for distant access, processing and distribution of medical images over open environments have increased the chances of leaks, losses and alterations of the medical information. As a consequence and due to their sensitive nature, medical images security is of a major concern .

Protection of Medical Images

Medical image risks and threats

As stated previously, medical images are more and more manipulated in open environments, where they are accessed by different users from different places. This has plagued medical information with several breaches. According to Moody's Investors Service report, hospitals are a prime target for hackers and pirates. As reported by Protenus [1], in USA about 15 M records were breached in 2018, where hacking was the cause of 44% of the total number of breaches throughout the year. This is to say that 56% of the total breaches are caused by other types of breaches. Risks can be thus classified into two categories [START_REF] Allaert | La sécurité des systèmes d'information médicohospitaliers[END_REF]; which are innocent and malicious disruptions.

Innocent disruptions

Based on the report done by CLUSIF (Club de la Sécurité de l'Information Français) in 2018 [START_REF]Menaces informatiques et pratiques de sécurité en france[END_REF], this category can be discriminated into two classes • Accidents, as for instance:

-Total or partial destruction of hardware, software (earthquake, fire, explosion, ...); -Dysfunction of hardware, software or technology environment; -Negligence or failure/lack of technical staff responsible for handling or maintenance of the system.

These risks are always present and hospitals or medical centers can only attempt to limit their consequences. The definition of safety standard and guidelines can contribute to minimize such issues. CLUSIF reported that in 2018, among 151 hospitals, 17% of hospitals lost essential services (e.g. water and power cuts) and that 19% of them experienced errors in conception of software.

• Errors, the most of them being:

-Input errors;

-Errors in the transmission of data by the information system;

-Error handling functions of the information system;

-Error resulting from the incorrect use of the information system Manipulation errors can take multiple forms. The most classical example is the assignment of patient records to another patient, leading thus to errors in diagnosis, therapy and/or surgery. Loss or alteration of information during the transmission can be identified in this type of disruption. For example, a simple degradation of images during their transmission can hide pathology, which leads to error in diagnosis. Again, these risks are always present, and can be mitigated with the help of good practice guidelines as well as user training.

Malicious disruptions

Nowadays, digital security risks are of high level in the healthcare industry, which comes from or is exacerbated by human factors. Malicious manipulations can arise from hacking, malware, physical sabotage and materiel theft to insider threats. In fact, hacking can be defined as the unauthorized access to an information system to gain information or cause disruption. For example, in Singapore in 2018 hackers who were targeting the prime Minister have stolen medical files of 1.5 million patients (about 25% of the population). In its side, malware (i.e., malicious software) refers to programs designed to infiltrate information systems without users' consent. These programs include threats such as viruses and ransomwares. For example, on May 2019, Indiana-based Talley Medical Surgical Eyecare Associates notified the US department of Health and Human Services of a potential malicious attack of 106K patient records, caused by a ransomware attack on its system. In France, CLUSIF reported that, among 151 French public hospitals (constituted of over 100 beds), the information system of 44% has been infected by viruses. Material sabotage and theft of are also present in hospitals. As reported by the Irving, TX-based healthcare supply chain network VHA Inc. [START_REF]Patients stealing $52m worth of items from hospitals, says survey[END_REF], found that about $52 million worth of items are stolen each year from hospitals. Based on the study done by CLUSIF, 7% among 151 french hospitals experienced physical sabotage. Insiders' threats are also important issues created by inadvertent (naïve and careless insiders) or malicious employee actions. A study done by MediaPro [START_REF]Healthcare cybersecurity and the human factor: Using risk-based authentication that considers behavioral factors[END_REF] found that 37 percent of healthcare employees pose an outright risk to their organizations, meaning their actions could cause a breach of privacy or a security incident. More clearly, the inadvertent employees do not intend to do harm, but they still unintentionally respond to phishing emails, lose their laptops or send unencrypted emails, for example. In addition, we find employees that engage in malicious use of confidential data. The study [START_REF]58% of all healthcare breaches are initiated[END_REF] reported that 18% of healthcare employees are willing to sell confidential data to unauthorized parties. To sup up, the consequences of these risks are not negligible, as they concern an individual and his health. According to Dr. Sung Choi, a researcher at Vanderbilt university, over 2,100 patient deaths per year are caused by data breaches [START_REF]Hospital data breaches connected to patient deaths[END_REF]. As a conclusion, these risks create an urgent need for the protection of medical information. That is why, many countries attribute legal and ethical weight to this question; acknowledging patient rights and thus obliging healthcare professionals and medical centers to ensure the security of medical data, including medical images.

Security requirements in healthcare: ethics and legislation

Medical data are subject to deontological and legislative rules that require their security in order to build and maintain trust in the patient-health professional relation-ship. Indeed, trust is a critical factor that influences the quality of care, patient health, and the medical system as a whole. In other words, without trust the patient will not give to the practitioner a clear view of his/her situation. That is why ethics are considered a crucial and important branch in medicine guiding good medical practice. Among the different deontological ethic codes, one can find the "Hippocratic Oath" [START_REF] Steven | The Hippocratic Oath and the ethics of medicine[END_REF], and the French medical ethic code (article R. 4127-73) [START_REF]French code of medical ethics[END_REF], which insist on the fact that the duty of keeping a medical secret is for the whole life; it does not stop with the end of the professional activity. However, in France, the concept of medical secret does not exist. It derives from the professional secret and it refers to the principle of not disclosing confidential information about the patient. Divulging a medical secret or breaking the professional secret lead to criminal convictions as determined by the different international and national legal norms and laws. In Europe, the General Data Protection Regulation(GDPR) [START_REF]How does the general data protection regulation (gdpr) affect gps?[END_REF] has been designed to harmonize data privacy laws across European countries to maintain reasonable and appropriate administrative, technical and physical safeguards to ensure data protection, including medical data. Healthcare organizations that fail to ensure security of patients' data, risk fines of up to 20M e. Recently, Barreiro Montijo hospital has been fined e 400K for violating the GDPR [START_REF]Panocrim 2018 -des attaques au coeur des métiers -santé[END_REF]. It allowed indiscriminate access to an excessive number of users while being incapable to ensure continued confidentiality, integrity, and availability of medical treatment systems and services. Notice also, as part of GDPR, the Information Commissioner's Office (ICO) must be notified of any security breaches that are "likely to result in a risk to people's rights and freedoms" within 72 hours of breach occurring. In US, health professionals must take care of the Health Insurance Portability and Accountability Act (HIPPA) [START_REF] George | Hipaa regulations-a new era of medical-record privacy?[END_REF]. HIPPA is a federal law invoked to protect patients' data and well-being by imposing regulatory standards on any organization with a hand in healthcare industry. Beyond these legislative and deontological rules, one must also consider regulations of general scope like for database and software protection, illegal intrusion in information systems [START_REF] Tréguer | Le droit pénal de la fraude informatique, nouvel ami des censeurs?. liberté d'expression[END_REF]. Furthermore, there exist national and international recommendations which provide implementation guidance. That is the case of IHE (Integrating the Healthcare Enterprise) that is an international standardized medical information integration organization established to address integration problems among medical information systems. Furthermore, IHE adopts existing standards such as HL7 and DICOM format to fulfill specific clinical needs regarding medical information sharing as well it provides security recommendations. Note that HL7 and DICOM standards on their side include security constraints (see part 15 of DICOM standard for instance).

In Figure 1.3, we sum up the security needs for patient data any health professional has to consider when considering deontological and legislative frameworks. These ones correspond to data:

We define now these security engagements before explaining how they can be ensured in Section 1.2.2:

• Confidentialityit refers to the prevention of information disclosure to non authorized individuals or systems. Only authorized users, in the normally scheduled situations, have access to data.

• Reliability -Reliable data can be used by a healthcare professional in a total trust. It is based on the outcomes of data:

-Authenticity -It is the proof that a piece of information belongs to the right patient and is delivered from the correct source.

-Integrity -The purpose of integrity control is to find out whether any modification has been done upon the medical image. In other words, it assures that the image is accurate and has not been altered.

• Traceability -The concept of reliability can be extended to traceability when it becomes possible to trace data along their life cycle. Tracing a piece of information along its distribution is an important issue. It is defined as the capability of identifying all the users or systems that have accessed, transferred, modified or deleted a piece of information during its transmission from its source to its final user or in a given period of time.

• Availabilityit corresponds to the ability of a medical information system (including equipments, software and communication channels) to be used under the normal conditions of access. Its absence may lead to a partial or total destruction of the information or a denial of access. This may be caused by different attacks such as accidents, errors or malicious disruptions.

Once security needs identified, the next question is how to achieve these goals. This is a part of security policy that is more and more deployed by hospitals due to legislative constraints, of course, but also for a better functioning of their information system and for the image of the healthcare organization as a whole.

Security mechanims

Beyond these legislative and deontological rules, there also exist , such as rules stated by ISO/27799 standard [START_REF] Fraser | Iso 27799: Security management in health using iso/iec 17799[END_REF] which specifies a set of detailed control for managing health information security and provides best practice guidelines on how to protect images in terms of confidentiality, integrity, availability, authenticity and traceability.

As previously mentioned, as medical images are stored and accessed in different systems, they are exposed to different security breaches; i.e. hacking and other unlawful forms of processing (see Section 1.2.1). Healthcare organizations have to implement appropriate technical measures to ensure a level of security. Nowadays, there exist security standards that specify a set of detailed rules and requirements to be satisfied by a healthcare information system. These rules precise how security services must be deployed and how medical data can and cannot be accessed, and by whom, etc. Among these standards, one can find the ISO 2700X, the latest being the ISO 27005, which are based on the principle of continual improvement of data protection, known as the model PDCA (Plan, Do, Check, Act). In France, recommendations of ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information) and ASIP Santé (Agence des Systèmes d'Information Partagés de Santé) for the healthcare domain have to be considered too.

As risks in healthcare are multiplying, both in number and costs, risk analysis has to be at the forefront. It allows the identification of the requirements and objectives of security that an information system must achieve. This analysis can be done by means for example of the standard EBIOS (Expression of Needs and Identification of Security Objectives in english) [START_REF] Mcdonald | Application of ebios for the risk assessment of ict use in electrical distribution sub-stations[END_REF], which provide a list of risks discriminated into different classes based on the required security applications (i.e. confidentiality, authenticity, integrity and traceability); FMEA (Failure Mode and Effect Analysis) [START_REF] Diomidis | Failure mode and effect analysis: FMEA from theory to execution[END_REF] or MEHARI (MEthode Harmonisée d'Analyse de RIsques) [START_REF]Méthode Harmonisée d'Analyse de Risques[END_REF] that is a complete model of risk analysis. A risk analysis process is based on the following steps illustrated in Figure 1.4: • Context establishmentthat identifies activities and actors, data workflow and the components of the system within the scope of the risk analysis.

• Hazard identification/Prioritizationconsists in the identification of something with the potential to cause harm. Hazards can be identified from different sources such as EBIOS, by discussing with users (department Chiefs, and employees), analyzing patient complaints and satisfaction survey results, incident reporting system, and so on.

• Risk evaluationit is about understanding and evaluating the gravity of a risk by underlying its causes, analyzing its probability and impact associated-with and identifying its level or in other worlds computing the "risk score" [START_REF]How risk assessment scores are calculated[END_REF]. The risk risk may be of different impacts on data and system resources in terms of confidentiality, reliability, traceability and availability. The purpose of computing the risk score is to prioritize the risks from "most to least" critical so as to determine the appropriate level of training and control measures necessary for effective mitigation.

• Risk management (or risk mitigation) -In order to minimize/counter the identified risks, existing protection tools and devices are deployed.

The used security tools deal with four aspects; which are protecting patients' confidentiality, controlling data reliability, traceability as well as ensuring data availability. Ignoring any of these aspects may cause a number of problems. However, a "unique" security mechanism cannot ensure all these security objectives at the same time.

Protection means can be classified into physical and logical mechanisms. The former mechanisms concern the materials and essentially aim at counteracting unauthorized physical access; theft/robbery and natural risks such as fire, flooding. In such cases, an early warning fire and smoke detection systems can be used in different areas of the hospitals. To improve the physical/environmental safeguards, the use of video surveillance, security staff, intrusion detection systems, innovative architectural (e.g. use of access badge) are also suggested to avoid external agents and unauthorized access to data centers.

In practice, the efficiency of physical protection is arguable, as health organizations are open structures in which patients and their accompanists are mixed with health professionals with an easy access to equipments. This is why, logical protection mechanisms are important to be deployed. Hence, to have more comprehensive view of the existing logical security tools for images, we propose to present them depending on three main security issues.

Confidentiality

Four different categories of risks related to disclosure and misappropriation should be considered: 1) illicit access to medical images, 2) mistakesintentional or notin data manipulation (file copy, diffusion of information to a non-authorized third, etc.), 3) interception in transmission, and 4) viruses. To mitigate such threats, one can find five main mechanisms: a) User authentication -It is the fundamental method of security for protecting medical data being stored in a medical information system. Usually, two steps are required: i) identification; where a user provides a proof of his/her identity (e.g. login name, smart card) to respond to the question "who is he?", ii) authentication, where the user proves his identity using a password. This solution can be associated with a token, which ensures a unique connection per user. Once the user connected, the token is assigned to the computer in which he/she is logged on.

b) Access control -Once the user has provided a correct login name and password and accessed the system, it is mandatory to control the actions he/she can perform by defining user access rights. However, the design of access control systems is very complex. There exist many implementations of an access control model; according to the appropriate access control policies that define the rules that only authorize certain people to access certain information to organize access privileges. Among the different access control models, one can find:

• The Role-Based Access Control (RBAC) [START_REF] Ferraiolo | Role-based access control[END_REF] or the Organization-Based Access Control (OrBAC) [START_REF] Abou | Organization based access control[END_REF] that associates rights to groups of users according to their roles within the organization (i.e. it is based on a hierarchy system where the person with the greater responsibility has access to more resources throughout the healthcare system);

• The Mandatory Access Control (MAC) model [START_REF] Langaliya | Enhancing cloud security through access control models: A survey[END_REF] that gives the delegation to a thirdparty (or a central) authority to determine what information can be accessed and by whom;

• The Discretionary Access Control (DAC) [START_REF] Stephen | Enabling granular discretionary access control for data stored in a cloud computing environment[END_REF] in which the owner of a file is responsible for access control on this file and is granted the ability to restrict access to it based on the users' identity or a membership in certain group.

Nevertheless, a model can also be hybrid and include more than one model in order to tackle the more heterogeneous needs of an organization.

Furthermore, to avoid indiscreet or malicious access, the implementation of automatic logout procedure for users in case of prolonged use is thus desirable. However, the use of such a model cannot block all the possible attacks by itself, as a user can by-pass its imposed restrictions. Hence, it is necessary to implement other security tools to ensure confidentiality, for instance, firewalls, anti-viruses and data encryption. c) Firewalls -they are designed to strengthen the security of an organization's networks and the information that resides on the network. Basically, it is defined as a system that allows filtering the incoming and outgoing network traffic based on a set of access control rules. There exist different forms of firewalls that can be implemented both internally (e.g. an equipment, local computer, intranet) and externally (e.g. the internet) to protect the organization from any type of threats to the information the network could face [START_REF] Liu | The enhancement of security in healthcare information systems[END_REF]. Furthermore, it can accomplish other various functions such as address translation (i.e. it allows to keep an internal address space unknown and inaccessible from the outside) or act as an application proxy which interprets each request to internet of an application (commands, requests and responses) so as to verify whether these information exchanges follow the security policy rules.

d) Anti-viruses -Viruses represent a major threat to the security of a system and of its data [START_REF] Thomas B Slayton | Ransomware: The virus attacking the healthcare industry[END_REF].

They can be introduced into the information system in many ways: through a connection to an open network as well as by simply uploading data from a CD-ROM or an USB key.

Herein, an anti-virus policy should be defined in terms of prevention, detection and isolation of viruses and system restoration (backup management). Prevention of viruses is based not only on testing all storage units but also on Internet connections, databases and programs that can be imported. Detection consists in simply controlling the virus throughout the information system. According to the isolation principle, suspicious memory units should be disconnected. System restoration goes from virus removal performed by an anti-virus to the reformatting of the storage units and reinstallation of the information system. e) Image encryption -it aims at maintaining data confidentiality. As depicted in Figure 1.5, it consists in transforming a clear plaintext image into a non-interpretable cipher-text image by means of an encryption algorithm parameterized by an encryption key. Encryption algorithms can be grouped according to various characteristics: i) symmetric algorithms (with a secret key) and ii) asymmetric algorithms (with private and public keys). Secret key systems allow encryption and decryption with the same key as shown in Figure 1.6. As a consequence, the sender and the receiver should hold the secret key to be able to encrypt and decrypt image data. Symmetric encryption algorithms can be also divided into two encryption types: blockcipher systems and stream-cipher systems. The former one encrypts a fixed size of n-bits of data -known as a block -at one time. The sizes of each block could be 64 bits, 128 bits, and 256 bits. 3-DES (triple Data Encryption Standard) [START_REF] Singh | A study of encryption algorithms (rsa, des, 3des and aes) for information security[END_REF], AES (Advanced Encryption Standard) [START_REF] Dag | Fast software aes encryption[END_REF], and Blowfish are some of the commonly used encryption algorithms that fall under this group. For their parts, stream-cipher algorithms encrypt 1 bit or byte of plain-text image, at one time. Here, one can find Trivium [START_REF] De | Trivium. In New Stream Cipher Designs[END_REF], RC4 [START_REF] Mousa | Evaluation of the rc4 algorithm for data encryption[END_REF], RC6, etc.

Regarding the asymmetric encryption systems, as shown in Figure 1.7, they are based on a pair of keys. One of them is known by the world at large (the public key) and is used to encrypt data while the other is confidential (the private key) and exploited to decrypt the image. By doing so, only the owner of the private key can decrypt the image, ensuring thus confidentiality. The most widespread asymmetric algorithm is RSA [START_REF] Singh | A study of encryption algorithms (rsa, des, 3des and aes) for information security[END_REF] and is recommended by the DICOM standard.

Reliability Control

Reliability control corresponds to the second most important property after confidentiality because, to attack it, information must be accessed beforehand. It is based on the outcomes of the data integrity and authenticity.

In DICOM (Digital Imaging and COmmunications in Medicine), there exists a digital signature (DS) profile. Thiss one combines RSA with the RIPEMD-160, MD5, or SHA-1 hashing functions. One of these functions is first used to generate a Message Authentication Code (MAC), which is computed over the whole image or over some specific local regions of the image. This MAC is a digest of the data, encoded on a few number of bits. For instance, SHA-256 requires that the maximum size of the input data be of 2 64 -1 bits and produces a hash of 256 bits. the SHA-256 "strength" is of 128 bits against collision attacks. This digest is then encrypted using RSA parameterized with the private key of the emitter. By doing so, the resulting signature can only be decrypted using the public key of the emitter, ensuring thus the non-repudiation. At the verification stage, any slight difference between the recomputed DS/MAC and the decrypted one will be proof of the image integrity violation. Note that, in DICOM, such a digital signature is stored in the DICOM image file. Once the signature deleted, the image is no more protected in terms of integrity.

Regarding authenticity control, the DICOM standard makes use of Unique IDentifiers (UIDs) to uniquely identify DICOM images. These UIDs are present in the DICOM image file header and they refer to the acquisition machine, health institution, patient, date and time of examination, etc. Notice that patient identifier is sometimes defined in a legislative way. For instance, in France, a national health identifier is provided to each patient since 2007 (Article L1111-8 of the public health code [START_REF]L'agrément d'hébergeur de données de santé d'orange healthcare[END_REF]). Such identifiers must be used with care as they may induce privacy issues.

Availability

A violation of data availability is simply equivalent to making its access impossible. Hardware or material problems can be minimized by means of maintenance contracts, prevention of natural damage, staff training, etc. Logical risks can result from a violation of data integrity or from a logical dysfunction at the access control level, etc. Herein, to ensure availability, medical information systems often have redundant components, known as fault-tolerance systems. So if one component fails or is experiencing problems the system (e.g. in case of malware detection), will switch to a backup component. The main objective is thus to limit the impact of the risks on patients' health.

Traceability

Classic traceability techniques are based on log-files that record the history of all interactions in the medical information system. Later solutions are based on audit trails the purpose of which is to track all system activities, by generating their date and time stamps; detailed listings of what was viewed, for how long, and by whom; and logs of all modifications to medical records. System administrators can also specify which reports were printed, the number of screenshots taken, the exact location, and even the computer used to submit a request. Alerts are often configured to report suspicious or unusual activity, such as reviewing information about a patient who is not treating or attempting to access information that one is not authorized to view. However, audit trails do not prevent unintentional access or disclosure, but it can be used to deter the would-be violators.

In last year, Blockchain technology [START_REF] Yaga | Blockchain technology overview[END_REF] has gained considerable attention in the healthcare domain. It focuses on ensuring patient health management at a superior level at all times. Basically, Blockchain provides a safe and secure platform enabling not only tracking each step of a user's interaction with this platform, but also improving traceability of falsified data. However, Blockchain runs complex algorithms which in turn require large amount of computing power. Hence, due to its complexity, its transactions can take a while to process.

As exposed, the above security mechanisms are designed to deal with one or more security objectives or specific risks. However, they do not offer a "never-failing" protection as accessed and consulted medical data can sometimes escape these measures of control. In fact, once the access to data is granted or once data are cut off from their ancillary data (i.e. file header) that contain proofs of integrity and authenticity (e.g. digital signature, proof of image origin), they are no more protected and can be altered or illegally redistributed straightaway. Several questions arise then about the security of the image once decrypted. Here comes the interest for an "a posteriori " protection that allows the user to access the image content while keeping it protected -a kind of protection the watermarking techniques are best suited.

Watermarking as a complementary security mechanism

By definition, watermarking technology offers "a posteriori " protection: it allows accessing the image information while keeping it protected by a watermark inserted or dissimulated into it. In the following, we come back on watermarking fundamentals, and on how it is applied on medical images.

Fundamentals of image watermarking

Definition

Digital watermarking appeared during the 90's. It consists in the embedding of a message or a watermark into the "host" image by imperceptibly modifying its gray values, without disturbing its normal use or interpretation. It is a concept closely related to steganography, in that they both hide a message inside a host document but differ in their purpose. With steganography, the host image has no importance. It is merely used as a cover to hide the message for secret communications while watermarking aims at protecting the "host" image by means of the embedded message. Indeed, watermarking was originally designed for copyright protection of multimedia contents [START_REF] Cox | Digital watermarking[END_REF] through the embedding of the owner identifier. Since then, watermarking has been extended for different security objectives in various application domains. As this report is concerned with the healthcare domain, several cases making use of watermarking can be identified [START_REF] Coatrieux | Relevance of watermarking in medical imaging[END_REF]:

• Authenticity of images, by the embedding of data confirming the source of image and to which patient it belongs. For instance, in [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF], it is proposed to embed a unique authenticity code that refers to the image origin (e.g. patient, date of image acquisition, user).

• Integrity control of images. The basic idea is to insert a digital signature of the image [START_REF] Pan | Medical image integrity control combining digital signature and lossless watermarking[END_REF] or a summary of it [START_REF] Huang | Blind integrity verification of medical images[END_REF] that can be used to detect whether an image has been altered or falsified, identify which parts of the image can still be used for diagnosis purposes and, at least, identify the nature of the alteration (is it a transmission error or a malicious attack?).

• Addition of meta-data such as elements related to an authorization policy and to the patient consent [START_REF] Pan | Watermarking to enforce medical image access and usage control policy[END_REF].

As defined, watermarking can be defined as a complementary security mechanism to those described above (in Section 1.2.2), as the watermarked image can be accessed and interpreted while maintaining its protection by means of a message.

It should be known that, beyond security services, watermarking has also been proposed in order to enrich the image content or to provide new image functionalities, by inserting some elements about semantic description of the image [START_REF] Acharya | Simultaneous storage of patient information with medical images in the frequency domain[END_REF]. ). This modification is performed based on a secret watermarking key K s . This key is usually used to secretly select regions in the image where the message could be embedded and/or to construct the message itself.

During the verification stage (see 1.8 (b)), with the help of the secret watermarking key K s , the message can be extracted or simply detected depending on the used watermarking method. Here, two models of detection/extraction can be distinguished according to the need to have access or not to the original image; which are known as non-blind and blind watermarking schemes, respectively.

Watermarking properties

Each watermarking technique is described based on various properties:

• Robustness -a watermarking method is said "robust" [START_REF] Chen | A robust watermarking algorithm based on qr factorization and dct using quantization index modulation technique[END_REF] when the watermark can resist some image modifications, being innocent or malicious. Malicious disruptions want to suppress or modify the embedded watermark for "illegal" use of the image (e.g. distribution to unauthorized users, illegal copy). "Innocent" image modifications are those considered as authorized in the application framework. They usually correspond to image processing like lossy compression (e.g. JPEG, JPEG2000), filtering, geometric transformation, etc. Conversely, one can find "fragile" watermarking methods where once the image is altered or falsified, the watermark will be subsequently modified. Note that fragile watermarking techniques allow integrity control of images; i.e. based on the watermark, it will be possible to verify whether the image has been altered. There also exist semi-fragile schemes in which the watermark has been designed to survive certain image processing but not others that are considered as illegal in the application framework.

• Capacity -it expresses the embedding rate that is to say the number of bits of message embedded per pixel (bpp) of an image. It gives an indication of the message length that can be embedded in an image. The larger is the message length, the more watermarking-based security services can be provided.

• Imperceptibility -watermarking is a process that alters the image to add a message into it, therefore it can degrade the perceptual quality of the image. Various objective assessment measures of image quality can be used to assess it such as: PNSR [START_REF] Hore | Image quality metrics: Psnr vs. ssim[END_REF] (Peak-Signal-to-Noise Ratio) and MSE (Mean Squared Error) which are appropriate in the case of a uniform image distortion; SSIM (Structural SIMilarity) [START_REF] Hore | Image quality metrics: Psnr vs. ssim[END_REF] and UQI (Universal Quality Index) [START_REF] Wang | A universal image quality index[END_REF] that take into account some visual human properties. Note that watermark imperceptibility is very important for medical images. No obvious difference between the watermarked and the original image must be noticed so watermarking methods must keep the degradation of the image quality to a minimum. Different psychovisual masking strategies have been proposed so as to better preserve image quality. Most of them have been designed for natural public images. They take into account the Human Visual System (HVS) in the conception of a watermarking algorithm. Basically, they first select the suitable sites for the imperceptible embedding of the watermark, then they attribute a specific watermarking strength to apply to the selected sites before finally inserting the watermark. Because natural images differ from medical images, specific watermarking methods have been proposed for medical images (see Section 1.3.2).

• Reversibility -some watermarking methods allow the exact reconstruction of the original image from the watermarked one after having extracted and removed the message. These methods are called reversible or "lossless" watermarking techniques [START_REF] Liu | A novel robust reversible watermarking scheme for protecting authenticity and integrity of medical images[END_REF]. These methods are most of the time fragile and devoted to integrity control. In general, watermarking schemes are lossy or irreversible [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Haddad | A new joint watermarking-encryptionjpeg-ls compression method for a priori & a posteriori image protection[END_REF].

• Complexity -it is an indication of the calculation time needed for embedding and extraction.

The algorithm complexity plays an important role in case of images of large volume.

• The need of the original image for message detection/extraction -if during the verification stage, the original image is not required to extract the watermark, the watermarking method is called "blind". Otherwise, it is called as "non-blind". Note that integrity control applications are not possible with non-blind watermarking methods; the question of knowing whether the original image has been modified has no sense in such a case.

• Security -the basic idea behind this property is that the access to the embedded watermark is impossible without the knowledge of the secret key as for cryptography.

A watermarking method cannot provide all the above properties at the same time. Each one establishes a balance between these properties. Let us consider the trade-off between the basic watermarking characteristics, which are capacity, robustness and imperceptibility. As shown in Figure 1.9, an increase in capacity comes with imperceptibility and robustness costs. A stronger watermark can better resist against alterations (innocent or malevolent modifications), but its presence will be more obvious in the image and the capacity will be reduced. Robustness is essential in authenticity and traceability control, where the considered watermarking modulation should ensure that embedded identifiers remain detectable after innocent or malicious manipulations of image data. In this case, as the embedded watermark is visible in the image due to its robustness, some HVS-based models are applied on the image so as to select positions to be watermarked and to identify the watermark amplitude in each position in order to increase the imperceptibility of the message. On the contrary, if we consider for instance integrity control, the watermark is fragile and the embedding capacity (i.e. the length of the watermark that can be hidden into the image) should be high in order to be able to detect and locate the tamper location in the image. Thus, from a general point of view, to an application framework, corresponds a set of watermarking properties.

Watermarking techniques

Watermarking techniques can be classified in many ways. Nevertheless, two types of algorithm are generally identified. The first group involves additive methods and the second one covers substitutive methods.

Additive methods

Their first step consists in generating , from a given binary message M = {m i } i=1,...,N , a watermark that is a pseudo-random uniformly distributed signal W = {w i } i=1,...,N . The generated watermark W is then added to the image or to a transformation of it I = {I i } i=1,...,N (e.g. DCT, DWT), leading to the watermarked image I w = {I wi } i=1,...,N as follows:

I wi = I i + β (I i ) W (1.1)
where β is a strength watermark parameter that allows controlling the robustness/imperceptibility compromise. This parameter depends on image characteristics. More clearly, its value is usually computed based on psychovisual mask that selects the adequate parts of the image where to embed the watermark and the amplitude of this later to optimize the trade-off between imperceptibility and robustness.

With this kind of methods, the presence of the watermark is checked by correlation techniques, which implies the orthogonal nature of the pseudo-random sequences W . More clearly, let us consider the original host image I, its watermarked version I w with its watermark W . Let us also denote I w the possibly attacked watermarked image, and W the extracted watermark. Assuming that the watermark is orthogonal to the image, the detection of W in I w stands on the correlation coefficient γ given by:

γ =< I w , W >=< I + W , W >=< I, W > + < W , W >≈< W , W > (1.2)
Hence, the computation of γ comes in the computation of the correlation between the embedded and the extracted watermark. the decision of whether W is present or not in I w depends on a threshold value [START_REF] Osama | Hierarchical watermark detector[END_REF][START_REF] Rabizadeh | A new detector for contourlet domain multiplicative image watermarking using bessel k form distribution[END_REF] such that:

if γ ≥ T, then the watermark is present if γ < T, then the watermark is absent (1.3)
By working on a block or a set of pixels or of coefficients, it is possible to embed a binary sequence. In this case, each set is watermarked with a message that encodes a specific symbol (e.g. '0' or '1').

Substitutive methods Such a modulation replaces or substitutes some features of the image (e.g. pixels, coefficients) by some others issued from dictionaries that encode the desired symbols to embed. Message extraction takes place with a simple re-reading or interpretation of the image features that have been substituted. Among various substitutive watermarking modulations, one can find the Least-Significant-Bit (LSB) substitution and the Quantization Index Modulation (QIM).

• LSB substitution modulation [START_REF] Wang | Hiding data in images by optimal moderately-significant-bit replacement[END_REF] -it is the simplest substitutive method. Basically, it replaces the least significant bit of each pixel or transformed coefficient x i of the image to be watermarked by the message bit b i ∈ {0, 1}. Given for instance a pixel x i encoded on 8 bits as 10001010 and a message bit b i , then the resulting watermarked pixel

x iw = 1000101b i .
The extraction of the message relies on the interpretation of the parity of the watermarked image features. Note that this method provides high embedding capacity with low image quality distortion, but it is "fragile" to any image modification.

• QIM [START_REF] Chen | Quantization index modulation: A class of provably good methods for digital watermarking and information embedding[END_REF] -it is an extension of the previous modulation and relies on quantifying some image components independently (e.g., pixels, coefficients) or at once (e.g., group of pixels or transformed coefficients -vector quantization) according to a set of quantizers based on codebooks in order to embed the watermark. More clearly, QIM associates, to each message m i issued from a finite set of q possible messages M = {m i } i=0,q , a codebook C mi such that:

C mi ∩ C mj = ∅, i = j (1.4)
To embed the message m i , an image component x has to be substituted by its nearest element x w in the codebook C mi . The insertion function is given by:

x w = Q mi (x, C mi ) (1.5)
where Q mi (.) determines the nearest elements x w of x within C mi . The distance between x w and x corresponds to the watermarking distortion. Let us consider the image components such as a vector of pixels x ∈ N N , while dividing the N N -dimensional space into non-overlapping cells of equal size. To satisfy (1.4), each cell is associated to a codebook C mi , i = 0, .., q. The insertion process is conducted as follows. If x belongs to the cell which encodes the message to be inserted, x w (the watermarked version of x) corresponds then to the center of this cell; otherwise, x is moved to the center of the nearest cell that encodes the desired message.

For instance, given a binary message; i.e. m i ∈ {0, 1}, two codebooks C 0 and C 1 are defined. These codebooks can be built up by uniformly quantizing a pixel x with a quantization step ∆, as illustrated in Figure 1.10. In this example, cells centered on crosses represent C 1 (i.e. m i = 1) whereas cells centered on circles represent C 0 (i.e., m i = 0). Thus x will be quantized to the nearest cross or circle in order to encode the message m i .

To extract the message, the watermark reader has to determine the cell to which the received version x w of x w belongs.

Notice that, unlike the LSB modulation, QIM is a robust substitutive watermarking method [START_REF] Chen | A robust watermarking algorithm based on qr factorization and dct using quantization index modulation technique[END_REF].

Watermarking of medical images

In their principles, watermarking methods proposed for medical images differ from "classic" or "conventional" ones (i.e. watermarking methods proposed for natural images) mainly in the management of imperceptibility. The visual fidelity of the watermarked image to its original counterpart constitutes the big issue in the healthcare domain. Watermarking a medical image without controlling the introduced distortion could lead to misdiagnosis with possible life threatening consequences. Hence, specific watermarking strategies have been proposed for medical images. One can distinguish three types of watermarking methods: common lossy watermarking, region of non-interest watermarking, and reversible or lossless watermarking.

Lossy watermarking techniques

These solutions directly apply conventional watermarking techniques, while paying careful attention in order to ensure that the watermark does not interfere with the diagnostic information. These solutions consider that if the use of lossy compression in medical imaging is accepted, as previously detailed in Section 1.3.1, lossy watermarking methods can also be applied on medical images, but under control. The first solutions of watermarking proposed for medical images are based on this reasoning. They are based on the LSB substitution modulation [START_REF] Coatrieux | Relevance of watermarking in medical imaging[END_REF][START_REF] Anand | Watermarking medical images with patient information[END_REF] due to its slight damage of the original image and its large embedding capacity. Let us recall that these solutions are obviously fragile. That is why, robust watermarking [START_REF] Kumar | Joint robust and reversible watermarking for medical images[END_REF][START_REF] Sharma | Robust and secure multiple watermarking for medical images[END_REF][START_REF] Sivaprakash | A novel robust medical image watermarking employing firefly optimization for secured telemedicine[END_REF][START_REF] Seo | Medical image watermarking using bit threshold map based on just noticeable distortion in discrete cosine transform[END_REF] schemes were developed. In order to preserve the image quality, these methods make use of a Human Visual System (HVS) model to adapt the watermark amplitude according the image local characteristics. However, these masking models [START_REF] Seo | Medical image watermarking using bit threshold map based on just noticeable distortion in discrete cosine transform[END_REF][START_REF] Kalaivani | An efficient watermarking scheme for medical data security with the aid of neural network[END_REF][START_REF] Bhinder | Image-adaptive watermarking using maximum likelihood decoder for medical images[END_REF] have been proposed for natural images and ahve not been validated for medical images, especially for X-ray, CT, ultrasound and MR images/ Developping such masking models in medical imaging remains a challenging task as it requires mobilizing a lot of expertise resources so as to conduct large subjective studies. To the best of our knowledge, one solution to overcome this issue has been proposed in [START_REF] Karasad | Watermarking of radiographic images based on quantum noise modulation[END_REF]; that proposed, in case of X-Ray imaging, to embed the watermark into the quantum noise. Such a noise is inherent to any medical image modality but with different intensities (the noise in ultrasound images is greater than in CT images). In [START_REF] Karasad | Watermarking of radiographic images based on quantum noise modulation[END_REF], the noise is extracted by means of denoising method in transformed domain proposed by [START_REF] Wang | Noise reduction using wavelet with application to medical x-ray image[END_REF]. Once extracted, the noise is modulated so as to embed a message for various security services. Due to the fact that such a noise is of small amplitude, the embedded watermark is fragile.

Region Of Interest and Region Of Non-Interest watermarking

These watermarking techniques have been proposed to optimize the performance of the lossy methods in terms of robustness and embedding capacity without introducing a visual distortion in the image. It stands on the idea that medical image can be divided into two separate regions: Region Of Interest (ROI) [START_REF] Frank | High-capacity multiple regions of interest watermarking for medical images[END_REF] that includes the informative image features for diagnostic purposes and that should not be modified, and the Region Of Non-Interest (RONI) of less interest or more generally the areas that are not important for the diagnosis and where the watermark amplitude /robustness can be optimized. Such RONI usually corresponds to the black background of the image. These methods can achieve high robustness by embedding strong watermark in the RONI [START_REF] Thanki | A roni based visible watermarking approach for medical image authentication[END_REF][START_REF] Narendra | Medical image protection using genetic algorithm operations[END_REF]. However, these methods have some drawbacks:

• Robust watermark can hinder and annoy the radiologists in their interpretation of the image.

• The embedded message length depends on the RONI area size, which can be absent in certain medical images where ROI covers the whole image.

• If the ROI that constitutes the important informative area of the image is not watermarked/protected against malicious attacks, it facilitates ROI copy/past attacks (e.g. copying/pasting ROI or RONI from distinct images).

Most of RONI-watermarking methods [START_REF] Frank | High-capacity multiple regions of interest watermarking for medical images[END_REF][START_REF] Liang Khor | Region of interest-based tamper detection and lossless recovery watermarking scheme (roi-dr) on ultrasound medical images[END_REF][START_REF] Al-Haj | Crypto-watermarking of transmitted medical images[END_REF][START_REF] Roček | Reversible watermarking in medical imaging with zero distortion in roi[END_REF] work as follows: the regions of interest are preselected by experts [START_REF] Frank | High-capacity multiple regions of interest watermarking for medical images[END_REF] or using an automatic segmentation procedure. Then, the ROI LSBs' information [START_REF] Frank | High-capacity multiple regions of interest watermarking for medical images[END_REF] or a cryptographic watermark representing the hash of ROI of the image [START_REF] Al-Haj | Crypto-watermarking of transmitted medical images[END_REF][START_REF] Roček | Reversible watermarking in medical imaging with zero distortion in roi[END_REF] is embedded into the RONI in order to provide integrity. Along with this watermark, patient personal data and the hospital logo can be also embedded into RONI to implement authenticity.

Reversible watermarking

As stated above, the embedding of a watermark, no matter how minor or trivial the modifications are, there is still a risk to bias the radiologists' interpretation and diagnostic. From here comes the idea of reversible watermarking. As stated in Section 1.3.1, the reversibility property ensures the possibility to remove the embedded watermark, and thereby the exact recovering of the original image. Unlike other methods, reversible watermarking techniques also allow the update of the content of the watermark in order to be able to trace the images without introducing additional distortion; As we will see in more details in Chapter 4, these methods are based on either Difference Expansion (DE) [START_REF] Osamah | High capacity data hiding schemes for medical images based on difference expansion[END_REF], histogram shifting [START_REF] Coatrieux | Reversible watermarking based on invariant image classification and dynamic histogram shifting[END_REF][START_REF] Rajkumar | Reversible and robust image watermarking based on histogram shifting[END_REF], or combination of them [START_REF] Yu | Reversible watermarking based on multi-dimensional prediction-error expansion[END_REF]. In their vast majority, reversible methods are fragile. Once the watermarked image damaged, the watermark is lost and cannot be removed from altered image parts. This is why these methods are appropriate for integrity control. Moreover, the desire to maximize the capacity often leads to highly visible watermarks, hence the watermark has to be removed before the image can be used. We can here notice that once the watermark is removed, the image is unfortunately no longer protected as for cryptography. Nevertheless and as we will see in Chapter 4, these methods are still of interest in the medical field.

Conclusion

As we saw in this chapter, medical images are issued from various sources and manipulated in highly open environments. They are transferred and shared between different users inside and outside the medical centers, in case of telemedicine or when the PACS is externalized into the cloud. In such a framework, medical images can be modified accidentally, as for example during communication, or malevolently with the introduction or removal of signs of pathology. These risks together with the sensitive nature of medical images have led to the definition of strict deontological and legislative rules that oblige health professionals to ensure the security of patients' data. Focusing on medical data in daily medical practice, a special interest should be given to their reliability. As seen, this one is at the basis of trust a physician can have in the data he/she handles and on which he/she is going to take a medical decision. By definition, data reliability is based on the outcomes of data: i) integrity -proof that the image has not been modified by non-authorized users, and ii) authenticity -proof that the image belongs to the correct patient and issued from the right source. Being able to provide the proof of data reliability all along their life cycle leads to traceability; a major concern when data are reused by machine learning algorithms so as to develop new diagnosis aid systems.

We have also pointed out that the deployment of security solutions for medical images requires the implementation of various security mechanisms. Indeed, there does not exist a "unique" mechanism that can control the access to data while ensuring its reliability during its life cycle. These techniques should be complementary and coherent to provide a high level of security while not perturbing the daily clinical practice. But, in essence, most of security mechanisms are oriented to data confidentiality and to the protection of the medical information system. In addition, very few are devoted to integrity; these ones being based on the digital signature principles. All these mechanisms provide an a priori protection. Once data decrypted or dissociated from their digital signature, they are no longer protected. In this context, watermarking, an a posteriori protection, is of main interest. It allows to the data while maintaining it protected. Even though watermarking provides a non-trivial contribution, there is an interest to go further and to see how it can be combined with cryptography. The idea is to take advantage of both technologies and to ensure an a priori and a posteriori protection at once.

Nevertheless, the deployment of security mechanisms in the healthcare domain should take into account its specificities. In particular and as we have seen, medical images constitute large volumes of data: for instance, one CT image file size can be up to 1GB. For question of efficiency, medical images should be compressed in order to reduce costs of storage and transmission. Verifying the security of medical while keeping them compressed, that is to say without decompressing them even partially constitutes one of the main objective of this Ph. D thesis. In order to gain in processing time, we propose to verify the reliability of medical images directly from their compressed bitstreams. This will be detailed in the next chapter. In Chapter 3, we will study how jointly conduct encryption, compression and watermarking in order to ensure the confidentiality of images while being able to control their reliability, encryption in the compressed and encrypted domains.

As also discussed, the reversibility property of watermarking is of special interest in the healthcare domain as the original image can be restored once the watermark is extracted, leading thus to various applications such as integrity and authenticity control. In chapter 4, we will illustrate how to merge reversible watermarking with encryption so as to verify the security of an image in its both encrypted and clear (i.e. decrypted) forms. In particular, we introduce a novel robust histogram shifting modulation.

The evaluation of the distortion introduced by watermarking is another important issue in medical imaging. This will be the subject of Chapter 5, where we introduce a preliminary study which aims at measuring the impact of the watermarking process on the visual and diagnostic quality of medical images. The first objective of this study is to demonstrate the fact that the information loss sue to the embedding of a watermark is not necessarily linked to a loss of quality. Beyond, the main objective is to identify the optimal watermark distortion so that diagnostic value is not compromised.

Chapter 2

Reliability Control of Compressed Medical Images

As mentioned in Chapter 1, in recent years, medical information system are more and more integrated and connected across local, regional and institutional boundaries in order to offer infinite ways of making progress toward better health. For example, it becomes possible to share medical data between physicians for remote diagnosis or a second opinion, as well as for patients to access to their medical records stored in the Cloud or to discuss with the health professionals. However, such advances in information and communication technologies also led to a situation where data are confronting many security and privacy threats. Medical images are obviously concerned. Recent image processing based on deep learning demonstrates that they can be easily manipulated. In [START_REF] Wu | Conditional infilling gans for data augmentation in mammogram classification[END_REF], authors makes data increase for mammogram classification by introducing finding in images of healthy women. Any misuse of such data could lead to irreversible consequences for the patient. More generally, in 2018, [START_REF]Hospital data breaches connected to patient deaths[END_REF] estimates that more than 2,100 patients annually die because of data breaches at hospitals. Different security mechanisms have been proposed in order to maintain data confidentiality and/or control their reliability all along their life cycle. Among them, one can find digital watermarking. By definition and when it is applied on images (see Section 1.3.1), watermarking corresponds to the embedding of a binary message/watermark (e.g. image origin, user identifier) by imperceptibly modifying the image pixel or coefficient values. Such a message can be used so as to verify whether the image has been modified or whether it has been illegally redistributed. Furthermore, one of its major interests is that watermarking provides a protection independent of the file format storage of the information. It leaves access to the information while maintaining it protected by the embedded watermark. It is an a posteriori protection mechanism that completes other existing data protection tools (e.g. encryption, access control). Its development in the medical domain is of strong interest, but several constraints have to be considered. On of them is that medical images are usually stored under a compressed form.

Indeed, the growth and the advent of medical imaging have resulted in growing demand to transmit and store images digitally. In fact, medical images constitute very large volume of data. One hospital can produce at least 27,000 terabyte of medical imaging data per year [START_REF]What's next for the health-care data center?[END_REF]. Herein, compression obviously plays an important role. It is not only used to decrease the requirements of storage, but also to decrease the entire time of transmission, image processing and so on. As seen in Chapter 1, many lossy and lossless image compression techniques have been included in the DICOM standard as compressed data formats for medical image storage and exchange. If with lossless compression the original image can be exactly recovered after its decompression, lossy image compression induces information loss, which under some constraints remains negligible while allowing increasing compression rate. Notice that such a technique is widely used in medical applications where a less amount of compromise on image quality is tolerable [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF].

From this standpoint, it becomes thus desirable to develop solutions that can give access to watermarking-based security services (e.g. integrity and authenticity control) in the compressed domain i.e. available from the image compressed bitstream. To achieve this goal, three main issues should be considered when working with medical images. The first one stands on the capacity to embed a message without causing quality degradation of the image. The second is to identify where and how the compressed bitstream can be modified without changing its semantic; that is to say guaranteeing that the bitstream can be decompressed. The third one relies on the capability to extract the message from the compressed image bitstream without having to decompress it nor to parse it, even partially.

Combination of compression and watermarking

Existing solutions that combine watermarking and compression can be discriminated depending on the compression-watermarking processual sequence: watermarking before compression (WBC) [START_REF] Ernawan | A robust image watermarking technique with an optimal dct-psychovisual threshold[END_REF][START_REF] Boujemaa | Fragile watermarking of medical image for content authentication and security[END_REF][START_REF] Belkacem | A masking model of hvs for image watermaking in the dct domain[END_REF][START_REF] Lou | A novel multi-bit watermarking algorithm based on hvs[END_REF], watermarking of the compressed bitstream (CBW) [START_REF] Bijan | A foundation for watermarking in compressed domain[END_REF][START_REF] Fridrich | Lossless data embedding with file size preservation[END_REF][START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF] or joint watermarkingcompression when watermarking is conducted during the compression process (JWC) [START_REF] Goudia | Tatouage et compression conjoint dans jpeg2000 avec un algorithme de quantification codée par treillis (tcq)[END_REF][START_REF] Srivastava | Computationally efficient joint imperceptible image watermarking and jpeg compression: a green computing approach[END_REF][START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF]:

• WBC schemesthe message is embedded before image compression and is only available in the decompressed domain. In essence, these methods watermark the quantized coefficients of the image Discrete Cosine Transform (DCT) or of the image Discrete Wavelet Transform (DWT), depending on the subsequent image compression algorithm, that is to say JPEG or JPEG2000, respectively. In [START_REF] Ernawan | A robust image watermarking technique with an optimal dct-psychovisual threshold[END_REF], two human visual system models (visual and edge entropy models) are used to select DCT blocks suitable for the embedding, i.e. blocks that cause the least image distortion. The message is then embedded into certain DCT coefficients of the middle frequency based on a psychovisual threshold to enhance robustness and imperceptibility. In [START_REF] Boujemaa | Fragile watermarking of medical image for content authentication and security[END_REF], the message is inserted into the wavelet coefficients of the image by applying spread spectrum modulation onto the most significant part of the host image without introducing noticeable degradation. The authors of [START_REF] Belkacem | A masking model of hvs for image watermaking in the dct domain[END_REF] proposed to embed the watermark into the DCT coefficients of the image based on texture and luminance masks so as to adapt the watermark amplitude and maintain it imperceptible. In these methods, the message is designed to be robust to a lossy compression algorithm by embedding it into the appropriate transformed domain (i.e. Discrete Cosine Transform (DCT) -JPEG; Discrete Wavelet Transform (DWT) -JPEG2K). However, the watermark is only available in the uncompressed domain.

To make these operations possible the compressed image bitstream has to be pre-processed before being encrypted. This pre-process reorganizes and modifies the compressed wavelet coefficients in order to: i) facilitate the identification of watermarkable coefficients in the encrypted image bitstream, and ii) ensure the watermarking process does not modify elements of the compressed bitstream that will make impossible image decompression.

• CWB methods -This strategy consists in embedding the message directly into the image compressed bitstream or after its partial decompression. Watermark extraction is usually conducted in the same domain as the embedding process. In [START_REF] Bijan | A foundation for watermarking in compressed domain[END_REF], it is the Variable Length Coding (VLC) table of the JPEG file header that is watermarked. In order to extract the message, the reader has to compare the original VLC table to the watermarked one. This scheme is thus non-blind and once the image is decompressed, it is no longer protected. In [START_REF] Fridrich | Lossless data embedding with file size preservation[END_REF], after Huffman decoding of the JPEG image file; that is to say after a partial decompression of the image, the watermark is inserted into the quantized AC coefficients. In order to preserve the file size, the authors proposed to maintain the same coefficient category (i.e. coefficient magnitude) for the watermarked coefficients. The message is extracted from the watermarked quantized AC coefficients by following the same steps of the embedding. The authors of [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF] went further. After JPEG2000 compressing the image, the bitstream is encrypted and a watermark is inserted into the least significant bit planes of the encrypted coefficients of the middle wavelet frequency in order to guarantee a good quality of the watermarked image. The watermark detection is conducted from the decrypted JPEG2000 compressed image bitstream using a correlation detector along with the a priori known pseudo-random sequence. To sum up, in this class, the watermark detection is always conducted in the same domain as the embedding process.

• JWC schemes -where the message is embedded during the compression of the image. The main benefit of such a strategy is that compression is no longer considered as an attack from the watermark robustness point of view. In [START_REF] Goudia | Tatouage et compression conjoint dans jpeg2000 avec un algorithme de quantification codée par treillis (tcq)[END_REF], the insertion of the message is performed during the image the wavelet coefficients quantization step of JPEG2000 image compression. Message extraction can be achieved either during the inverse quantization step of JPEG2000 decompression of from the decompressed watermarked image. The main benefit of such a strategy is that compression is no longer considered as an attack from the watermark robustness point of view. The scheme proposed in [START_REF] Srivastava | Computationally efficient joint imperceptible image watermarking and jpeg compression: a green computing approach[END_REF] involves watermarking during JPEG compression. It allows watermark embedding into the middle or high frequency (quantized or not) DCT coefficients based on an additive watermarking. However, this scheme is not blind; that is to say, the original image is required to be able to extract the watermark. [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF] addresses joint watermarking-JPEG-LS. It is based on the near-lossless mode of JPEG-LS, which induces some information loss in addition to the distortion introduced by watermarking. At the same time, with this scheme, the message can only be read from the decompressed watermarked image or during the decompression process. More clearly, accessing the message without decompressing the bitstream is not possible. It should be noticed that, in this class, it is not possible to extract the watermark from the compressed image bitstream. More clearly, to verify the image security, the watermark reader has to decompress totally or partially the watermarked image.

With methods of the first class, message extraction is always conducted in the decompressed domain. That is not the case of the two last classes, where the watermark reader has to decompress the image bitstream, totally or partially or to compare the watermarked image to the original one for message extraction. As we will see, that is not the case of the solution we propose.

During this PhD, we propose a new joint watermarking-compression scheme we first propose for JPEG-LS and by next we extend its principles to JPEG. Its originality stands on the fact that it allows accessing to watermarking-based security services from compressed image bitstream without having to decompress it, even partially. The system we propose combines, in a single operation, bit-substitution watermarking modulation with JPEG-LS, in a first scheme, and with JPEG in a second one. It is important to notice that with our schemes, it is possible to normally decompress the image with the common JPEG-LS or JPEG algorithms. More clearly, decompression as well as message extraction processes are conducted independently. We did not modify nor adapt them for a proprietary protection mechanism. With such a capability, our scheme is fully DICOMcompliant. Furthermore, this solution makes possible to trace images and control their reliability (i.e. authenticity and integrity) directly from compressed domain. Note also that the proposed scheme saves the computational complexity as it does not require decompression to verify the image reliability in the compressed domain.

In this chapter, the two compression standards, JPEG-LS and JPEG, are first presented. In the second part, we will give an overview of the method proposed to access to watermarking-based security services from the image com-pressed bitstream without decompressing it, even partially. Then, we will detail how watermarking is jointly conducted with JPEG-LS and with JPEG compression for verifying the image reliability. Finally, we will discuss both schemes' performance in terms of image quality and embedding capacity.

These works were published in [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF] and in [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF].

JPEG-LS and JPEG standards

JPEG-LS

JPEG-LS is a lossless image compression standard proposed by the International Standards Organization ISO/IEC JTC [START_REF]JPEG)/ FCD 14495. Lossless and near-lossless coding of continuous-tone still image jpeg-ls[END_REF]. DICOM allows its use in order to compress medical images. JPEG-LS is based on the Low Complexity Lossless Compression for Images (LOCO-I) algorithm [START_REF] Weinberger | The loco-i lossless image compression algorithm: Principles and standardization into jpeg-ls[END_REF]. This one relies on a pixel prediction based on a local contextual statistical model. The main steps of JPEG-LS are described in Figure 2.1. As it can be seen, an image is sequentially processed pixel by pixel. JPEG-LS encodes one pixel x accordingly to two modes: the regular-mode or the run-mode.

JPEG-LS compression

Local activity analysis

To decide encoding a pixel x in the regular-mode or in the run-mode, JPEG-LS first analyses the local activity around it. To do so, three local gradients {g i } i=1..3 are computed from its immediate causal neighborhood constituted of previously encoded pixels (i.e. pixels a, b, c and d in Figure 2.1), such that: If all local gradients are null then the run-mode is activated, otherwise the regular-mode is chosen.

{g 1 = d -b, g 2 = b -c, g 3 = c -a} (2.1)

Run-mode encoding

JPEG-LS run-mode is based on run-length encoding (RLE). It encodes the number of times the previous pixel has been repeated. This mode stops when a pixel of a different value is encountered or when the end of an image line is met. An example of a pixels' sequence that will be encoded in run-mode is given in Figure 2.2. This run length encoding mode is based on an inverse unary encoder in order to code the repetition number. For example, if the repeated sequence length is of 2 pixels, the inverse unary code of 2 corresponds to '110'.

Regular-mode encoding

As depicted in Figure 2.1, the regular-mode encoding of one pixel x relies on three steps:

-Prediction -Adaptive correction -Golomb-Rice encoding

Prediction

The causal neighborhood of x is used to estimate its gray value. To do so, JPEG-LS exploits the edge-detecting predictor:

x =    min(a, b) if c ≥ max(a, b) max(ab) if c ≤ min(a, b) a + b -c otherwise (2.2)
where x is the estimated value of x. The prediction-error, that will be processed, is then calculated as e = x -x.

Adaptive correction Because the edge-detecting predictor only provides integer values, it introduces a prediction bias. This bis corresponds to a translation of the prediction-error e. In order to compensate such a systematic offset, a context-dependant term is computed so as to shift back the prediction-error for each image pixel. To do so, JPEG-LS assigns to x a context value Q evaluated from its associated local gradients according to the following procedure: a) Local gradients {g i } i=1...3 are quantized into {q i } i=1...3 accordingly to a non-uniform scalar quantization defined in the JPEG-LS standard; b) JPEG-LS computes the context Q of x, defining it as an index value, such that:

Q = 81q 1 + 9q 2 + q 3 (2.3)
This context value is subsequently used to correct the prediction-error bias as well as to parameterize the Golomb-Rice encoder. For a given pixel x and its context Q, this term corresponds to the prediction-error mean ē of pixels belonging to the same context Q as x.

Golomb-Rice encoding The next step in the regular-mode consists in encoding the corrected prediction-error with the help of the Golomb-Rice encoder (GRE). Due to the fact, GRE only encodes non-negative values, the corrected prediction-error is modified into a "mapped prediction-error" ẽ such that the positive and negative values are mapped to even and odd positive integers of ẽ, respectively. Hence, the parity of ẽ, or equivalently its least significant bit indicates the corrected prediction-error sign. Then, the resulting mapped prediction-error is GRE encoded. Basically, GRE encodes a positive integer value p into two parts that are concatenated. These two parts of p will be referred in the sequel as: the Most Significant Bit part (p M SB ) and the Least Significant Bit part (p LSB ). Notice that these two parts are of great importance in our proposal. The MSB-part corresponds to the quotient of the Euclidean division of p by 2 k , where k is the non-negative Golomb-Rice factor. This quotient is unary encoded, i.e. by a sequence of '0' ended by '1', the number of '0' being the quotient value. This part is then concatenated to the LSB-part that corresponds to the binary encoding of the division reminder, i.e. an integer value encoded on k bits. To sum up, in the case of p = 53, k = 4, then the Golomb-Rice encoding p is such as 00010101 , where p M SB code is '0001' and p LSB code is '0101'. Note that the value of Golomb-Rice factor, i.e. k, is also pixel's context dependent. Notice also that the Golomb-Rice MSB-part codes follow a geometric distribution making it highly suitable for situations in which the occurrence of small prediction-errors' values is significantly more likely than large values.

JPEG-LS decompression

JPEG-LS decompression is accomplished by performing the same steps as for compression. To decode one pixel, its local context is re-computed from its causal neighborhood already decompressed. Based on this context, the decoding mode is chosen. If the regular-mode is selected, the predicted value x of x is computed and its bias corrected as in the encoding stage. Then, the pixel's Golomb-Rice factor k is calculated. The mapped prediction-error is decoded from the compressed image bitstream and the pixel value x is worked out. Otherwise, the run-mode is activated and JPEG-LS decodes the number of repetitions of the previous decoded pixel.

The example given in Figure 2.3 illustrates the JPEG-LS encoding of a sequence of pixels. It can be seen that without any additional information it is rather impossible to clearly identify a pixel in the compressed bitstream. Nevertheless, there is a high probability that a sequence '0X1'; where X is a sequence of '0', indicates the position of a regular-mode encoded pixel. As we will see in Section 2.3, we will take advantage of such property so as to make a watermarked message available in the compressed domain.

JPEG

JPEG (Joint Photographic Experts Group) [START_REF] Gregory | The jpeg still picture compression standard[END_REF] is a widely used image compression standard. It supports two different coding processes: lossy and lossless.

In this work, we are interested in the "baseline JPEG" (i.e. lossy JPEG compression in its sequential mode). Its main steps are given in Figure 2.4. Considering gray-scale images, first of all, JPEG divides the image into non-overlapping 8 × 8 blocks. Each block is then sequentially processed: transformed using the Discrete Cosine Transform (DCT), quantized, and prepared for the entropy encoding. We detail these steps in the following differentiating the compression and decompression stages of JPEG.

JPEG Compression

DCT transformation

Due to the fact that, in the spatial domain, the information of an individual pixel is relatively small but highly correlated to its neighbors (i.e. one pixel value can be predicted from its neighboring ones), image data are transformed into the frequency domain so as to eliminate this correlation. To do so, each pixel B(x, y) of a 8 × 8 pixel block B is transformed from the spatial to frequency domain based on the Discrete Cosine Transform (DCT):

B(u, v) = 2 N c(u)c(v) N -1 x=0 N -1 y=0 B(x, y) • cos π N u x + 1 2 • cos π N v y + 1 z (2.4) where c(w) = 1 √ 2 , if w = 0 c(w) = 1, otherwise B(0, 0)
is the DC coefficient (DC as in "Direct Current"), which refers to the average brightness in the block while B(u, v), where u, v > 0, are the AC coefficients (AC from "Alternating Current").

The interest of DCT is not only to decorrelate the image signal, but also to concentrate its energy in a small number off coefficients. More clearly, coefficients of low spatial frequencies carry most of the signal energy (i.e. top left region as given in Figure 2.5). Even if high frequency coefficients are set to zero, the resulting reconstructed block (i.e. after applying the inverse DCT) will be quite close to the original block [START_REF] Kk | A modified framework for secure and robust blind data hiding in videos using chaotic encryption and forbidden zone concept[END_REF].

JPEG quantization

The objective of this step is to take advantage of the human visual system and to optimize the compression rate by suppressing the information where human eyes are less sensitive to. Indeed, human vision can be considered as a low pass filter, being less sensitive to high frequency variations. To conduct this task, DCT coefficients are quantized according to psychovisual-dependent quantization tables. These default tables can be also scaled to vary the compression ratios. More clearly, JPEG allow the user to specify a range of values for the scaling factor, by specifying a compression metric called quality factor Q f (0 (lowest quality) < Q f ≤ 100 (best quality)):

B q (u, v) = B(u, v) q(u, v) Q f (2.5)
where B(u, v) is the original DCT coefficient, q(u, v) is the quantization step associated to the spatial frequency (u, v) and issued from table Q, and B q (u, v) is the quantized DCT coefficient. Note that the quantization table has to be stored in the header of the JPEG image file.

As it can be seen in Equation 2.5, this process introduces an irreversible information loss, due to integer rounding. It is not possible to recover B(u, v) from B q (u, v). of a quantization table. As shown, the quantization steps for high frequencies are higher than for low frequencies.

JPEG entropy encoding

After the quantization step, DC and AC coefficients are managed differently. The redundancy between DC coefficients of adjacent blocks is exploited using prediction so as to reduce the information entropy to encode. To do so, the Differential Pulse Code Modulation (DPCM), which computes the difference diff between DC coefficients of the current and the previous blocks.

Regarding AC coefficients, they are first ordered in a 1 × 63 vector according to a zig-zag scan. The objective of this process is not only to pass from a 2D structure to a 1D vector easier to handle, but also to ensure that consecutive coefficients are close in terms of spatial frequencies, and consequently in values. Another consequence of such a zig-zag scan along with quantization, is that this 1D vector will end with a more or less long sequence of null coefficients (see example in Figure 2.7). In order to take advantage of this ordering and to optimize the compression rate, JPEG next applied RLE (Run Length Encoding). RLE encodes the 1D vector coefficient vector in (run, value) pairs; where run corresponds to the number of zeros preceding a non-zero AC coefficient, and value corresponds to the value of the non-zero AC coefficient.

Finally, Huffman entropy encoding is applied onto RLE encoded AC and on DC predictionerrors. In essence, Huffman encoding is based on variable-length table it derives a table from the estimated probability for each possible value of the source symbol. This table associates to one symbol a codeword, a sequence of bits, the length of which depends on the symbol probability. Shorter codewords are associated to symbol of highest probability and longer ones to more rare symbols. Notice that no codeword is the prefix of another one, otherwise decoding will not be possible.

As defined, Huffman encoding requires computing this table, but to reduce the algorithm complexity and skip this latter step, JPEG standard fixed four tables (two tables used for DC coefficient: one of Luminance (Y) and the other of Chrominance, and two tables for AC coefficients: one of Luminance (Y) and the other of Chrominance) that are reasonable approximations of the statistics of most images and that define the mapping between the variable-length codes and the code values. Note that these tables are stored in the header of any JPEG image file.

In order to encode one DC prediction-error, the difference value diff is represented as (size dif f , val dif f ); where size DC is the number of bits needed to encode the value of diff val dif f in binary. Then, size dif f is encoded the corresponding JPEG DC-Huffman table. Table 2.1 provides the JPEG DC-Huffman luminance table of gray-scale images. It can be seen that diff magnitudes size dif f are grouped into 12 categories and a unique Huffman codeword is associated to each category. A codeword c i in the Huffman table is not the prefix of any other codeword; that is • Finally, the Huffman encoded version of (run, size AC ) is concatenated to the binary code of val AC .

It is important to notice that in the case the block ends with zeros (i.e. null AC coefficients), this sequence of zeros is encoded with the codeword EOB = 1010 , where EOB refers to End Of Block.

Note that the Huffman encoding is a variable length algorithm, which assigns the shortest codes to the most frequently values. The JPEG standard provides up to four Huffman tables that define the mapping between the variable-length codes and the code values.

To more clarify the entropy encoding, we give an example, in Figure 2.8, of Huffman entropy encoding of a zig-zag scanned quantized block.

JPEG Decompression

JPEG decompression is accomplished by applying the preceding steps in reverse order. First of all, based on the Huffman tables from the JPEG image-file header, entropy and RLE decoding are performed. The resulting data are then rearranged accordingly to the zig-zag scan procedure to reconstruct 8 × 8 quantized DCT blocks. After that, de-quantization is applied on blocks. More clearly, each quantized coefficient B q (u, v) is multiplied by the corresponding quantization step value. Let us recall that this value is also stored in the JPEG file header. Finally, IDCT (Inverse Discrete Cosine Transform) is applied so as to get access to decompressed pixels B(x, y) of the 8 × 8 block. IDCT is given by:

B(x, y) = 1 4 7 u=0 7 i=0 c(u) • c(v) • B(u, v) • cos π 8 u x + 1 2 cos π 8 v y + 1 2 (2.6) where c(w) = 1 √ 2 , if w = 0 c(w) = 1, otherwise
It is important to notice that the decoding process needs to parse the JPEG file header to extract the Huffman and quantization tables so as to be able to identify, in the compressed bitstream, bits that correspond to the DCT coefficients. Without these pieces of data, it is rather impossible to identify a DCT coefficient directly in the compressed bitstream. Nevertheless, as already said in Section 2.2.2.1, the standard Huffman tables have specific codewords, where no codeword corresponds to a prefix of another one in the same table and shorter codewords correspond to more frequent DCT coefficients. Hence, we will take advantage of the standard JPEG Huffman codewords in order to make a watermark accessible from the JPEG compressed image bitstream without decompressing it, even partially.

Proposed Joint Watermarking-Compression Scheme

The purpose of our scheme is to give access to watermarking-based security services directly from the compressed image bitstream without decompressing it, even partially. To do so, we propose to merge image compression and watermarking in a single operation, under the constraint that decompression can be normally conducted; that is to say without the need of a proprietary decompression algorithm in order to be compliant to the DICOM standard.

System Architecture and Basic Principles

The basic architecture of our scheme is given in Figure 2.9. At the protection stage (see Figure 2.9(a)), the watermarking process or equivalently message embedding is performed during the encoding of the image I. Such a joint watermarking-compression allows the insertion of a message m c that will be available from the compressed image bitstream I wc without having to decompress it, even partially. The embedded message m c contain security attributes that assess the image reliability (see Sub-Section 2.3.5). The embedding and the extraction of m c depend on a secret watermarking key K wc in order to provide an additional security to our scheme.

At the verification stage (see Figure 2.9(b))), the image reliability can be verified by accessing to the extracted m ext c with the help of the extraction function f e . Note that the watermarkedcompressed image I wc can be decompressed in a regular way. That is to say JPEG image decompression is performed with no modification of its algorithm; watermarking is completely transparent to JPEG. This is the main interest of DICOM system that are not watermarking compliant.

In the following, we expose how to deploy our DICOM-compliant scheme in the case of JPEG-LS and JPEG, while considering the bit-substitution watermarking modulation. Let us recall that such a watermarking modulation replaces one bit of an integer p by one bit of the message to embed.

Joint Watermarking-Compression (JWC) Scheme

Message embedding

As mentioned in Chapter 1 (Section 1.1.2), compression methods stand on an image transformation followed by an entropy encoding. Both Huffman and Golomb-Rice entropy encoders are variablelength encoders, which replace a fixed-length input symbol by the corresponding variable-length prefix codeword. Hence, we take advantage of this property to embed the message m c and to make it accessible from the compressed image bitstream without decompressing it. Our basic idea is to fix a reference sequence R (i.e. label) among the variable-length prefix codewords related to the entropy encoder and embed the message into image pixels or coefficients their prefix codewords correspond to the reference sequence R. This later has to be known from the watermark reader in order to extract the message m c . More clearly, the reference sequence R will labialize the position of the message bits in the image watermarked-compressed bitstream.

Nevertheless, different constraints has to be considered so as to decide which bit that will be watermarked and to guarantee an error-free extraction of m c : (i) The embedded message should be extracted from the compressed image bitstream without computing any additional parameters. The watermark reader has just to identify the reference sequence R so as to extract the watermark.

(ii) It is possible to embed a message bit after each reference sequence R.

(iii) A sequence of bits equals to R should correspond to a watermarked pixel/coefficient in the watermarked-compressed bitstream. We will come back to these constraints with more details for each compression standard (i.e. JPEG-LS and JPEG) in Section 2.3.3 and 2.3.4.

Message extraction

Based on the secret watermarking key K wc , the extraction function identifies the reference bitsequence R in the compressed-watermarked image bitstream I wc and extract the message m ext c , without neither decompressing the compressed image bitstream nor computing additional parameters.

Joint Watermarking-JPEG-LS Compression (JWJLS) Scheme

As exposed in section 2.2.1, JPEG-LS sequentially encodes pixels depending on their local context and accordingly to two encoding-modes: the regular and the run modes. To roughly sum up, the run-mode is selected to compress sequences of pixels in flat areas while the regular-mode is used to encode the others. We recall that this latter relies on a prediction and context-based coding of pixel prediction-errors using the Golomb-Rice encoder. As shown in Section 2.1, it is rather impossible to clearly identify the bits of one pixel in the bitstream, but there is a high probability that a sequence of bits 0X1 , where X is sequence of '0', corresponds to a regular-mode encoded pixel. We take advantage of this property so as to embed the message m c and to make it readable from the image compressed bitstream without decompressing it. Our basic idea is to embed m c in pixels the mapped prediction-error of which has a Golomb-Rice MSB-part encoded such that ẽMSB = 0X1 (see Section 2.1) by modifying its Golomb-Rice LSB-part using watermarking bit-substitution modulation. In the sequel, R = 0X1 corresponds to the "reference sequence".

In order to decide which bit of the pixel's Golomb-Rice LSB-part can be substituted by one bit of m c , let us recall that the LSB-part is encoded onto k bits; k being the pixel Golomb-Rice factor (see Section 2.2.1.1). k depends on the pixel's context and is thus unknown from the watermark reader unless it decompresses the bitstream. As a consequence, under the constraint not parsing the bitstream, it is not possible to identify the bits of the pixel's Golomb-Rice LSB-part. Nevertheless, it is possible to embed one bit of m c by substituting the higher order bit of the Golomb-Rice LSB-part by one bit of the message m c . More clearly, let us consider a watermarkable (i.e. to be watermarked) pixel p, i.e. a pixel the ẽMSB of which equals the reference sequence arbitrary fixed to 0001 , with a Golomb-Rice factor k = 4 and a mapped prediction-error as ẽ = 00011010 ; where ẽMSB = 0001 and ẽLSB = 1010 . ẽ will be watermarked into ẽw = 0001b010 = ẽw-MSB ẽw-LSB where b is one bit of the message m c , i.e. b ∈ {0, 1}.

However, as mentioned is Section 2.3.2, two main issues have to be considered so as to guarantee the error-free extraction of m c : i) the possibility to embed one bit after each reference bit-sequence R = 0X1 ; ii) a sequence of bits equals to R should correspond to a watermarked pixel in the watermarked compressed image bitstream. Regarding the former issue, a watermarkable pixel should hold an LSB-part ẽLSB , i.e. its Golomb-Rice factor should be non-null, otherwise message insertion is not possible. In addition, due to the fact that the last bit of ẽLSB informs the JPEG-LS decoder of the prediction-error sign, k should be strictly greater than 1. To overcome this issue, our JWEC algorithm modifies the pixel ẽMSB by suppressing one '0' (i.e. 0X1 is changed into 0X1 ). The pixel is thus turned into a non-watermarked pixel.

The second issue imposes the constraint that all sequences 0X1 in the protected compressed bitstream correspond to a watermarked pixel. Otherwise, the watermark will be desynchronized extracting bit values that are not part of m c . More clearly, the extracted message will be longer than the original one. This kind of problem occurs when a non-watermarkable pixel (i.e. ẽMSB = 0X1 ) is preceded by a sequence of bits 0S , where S is a sequence of '0', such that 0S ẽMSB = 0X1 ; ' ' being the concatenation operator. To solve it, our scheme considers this pixel as watermarkable and one bit of m c is embedded into its ẽLSB . Such a problem may also occur in the mapped prediction-error LSB-part, i.e. ẽLSB , of pixels the Golomb-Rice factor k of which is greater than the reference sequence length (i.e. k > | 0X1 | bits). Here, our JWEC algorithm commutes one bit of the pixel ẽLSB so as to avoid the problem.

Regarding the watermarking extraction function f c (see Figure 2.9), the watermark reader has just to identify the reference sequence ẽMSB = 0X1 in the compressed bitstream I cw and to read the immediate following bit value to extract m c . In order to ensure the security of our scheme, that is to say securing the access to m c , we suggest secretly selecting watermarkable pixels with the help of the watermarking key K wc .

Joint Watermarking-JPEG Compression (JWJPG) Scheme

As exposed in Section 2.2.2, JPEG sequentially encodes 8 × 8 DCT blocks based on the predefined standard JPEG tables (i.e. quantization and Huffman tables). Hence, it will be rather impossible to identify a DCT coefficient in the compressed domain without decompressing the JPEG image bitstream. In other word, without extracting the Huffman tables from the JPEG file header and parsing the JPEG bitstream depending on these tables, none can identify a DCT coefficient, and a pixel, by next. Nevertheless, there is a high probability that the Huffman codewords can be identified from the JPEG compressed bitstream. As previously said in Section 2.2.2, these codewords are present in Huffman tables in the JPEG image header. Hence, by taking the advantage of these properties, we proposed to embed during the JPEG image encoding, a message m c that will be accessible from the image compressed bitstream without neither extracting the Huffman tables from the JPEG image-file header nor decompressing it, even partially.

To do so, the fundamental of the proposed method is to watermark DCT coefficient values during their encoding preceded by a pre-fixed Huffman codeword, as defined above as reference sequence R that will be used to identify the watermarked bits during the verification stage.

In order to decide which coefficients their Huffman codewords will be used to labialize or to identify m c , let us recall that the DC coefficients correspond to the average of all coefficients in a 8 × 8 DCT block and its modification will thus introduce high distortion in the image. That is why we propose to watermark non-null AC coefficients encoded as [(run R , size AC R ), val AC R ]. As described in Section 2.2, the first part (run R , size AC R ) correspond to a Huffman codeword that should not be modified. The second part val AC R that defines the non-null AC coefficient value will be thus watermarked based on the bit-substitution watermarking modulation.

Therefore, the reference sequence R can be one of the codewords given in Table 2.2 or a concatenation of Huffman encoded DCT coefficients that certainly finish with an AC coefficient Huffman codeword so as to be able to watermark its val AC R .

After identifying the reference sequence R that will labialize the watermark m c , let us now define which bit of val AC R will be watermarked. Unlike Golomb-Rice encoder used by JPEG-LS, the Huffman codewords give an idea about the size of the encoded DCT coefficients. Hence, we suggest substituting the lower order bit of the non-null AC coefficient value preceded by the reference sequence R, by one bit of the message. More clearly, let us consider the following example of a reference sequence R = EOB (size dif f = 1, val dif f = 1) (run = 0, size AC = 1) = 1010010100 ; where: ' ' is a concatenation operator, (size dif f , val dif f ) corresponds to the Huffman encoded DC coefficient; and (run, size AC ) is the Huffman codeword of the AC coefficient. Herein, one bit b ∈ {0, 1} of m c will be embedded into the low order bit of val AC . The watermarked non-null AC w coefficient value is thus as 1010010100b .

However, one main constraint has to be checked so as to guarantee an error-free extraction of the message m c . It imposes that all binary sequences equal to the reference sequence R in the watermarked compressed JPEG image bitstream correspond to watermarked coefficients, otherwise the watermark reader will be desynchronized due to the extraction of bits that are not part of m c . As in the case of our joint watermarking-JPEG-LS compression (JWJLS) scheme, this kind of problem occurs when a non-watermarkable AC' coefficient (i.e. (run, size AC ) = R) is preceded by a binary sequence S, such that S (run, size AC ) = R. Herein, another problem has to be considered; which is the possibility, or not, of embedding a bit of the message after the formed reference sequence. It is possible to embed one message bit when size AC is greater or equal to size AC R (i.e. size AC R corresponds to the size of AC coefficient adopted by the reference sequence R ). Hence, a bit of message m c is embedded into the AC' coefficient value val AC at bit position b i of which corresponds to b i = (size AC -size AC R ) so as to not desynchronize the watermark reader during the verification stage. Let us take an example of a reference sequence R = EOB (size dif f R = 1, val dif f R = 1) (run R = 0, size AC R = 1) = 1010 0101 00 and the Huffman codeword of the non-watermarkable AC' such as (run = 0, size AC = 3) = 100 concatenated to S = 1010010 . Herein, the bit-index of val AC that will be watermarked is b i = size AC -size AC R = 3 -1 = 2, and as val AC = 110 , the watermarked val AC w is b10 , where b is a bit of the message m c .

Regarding the situation where it is impossible to embed a message bit, this problem occurs when the S (run, size AC ) = R but size AC is lower than size AC R . Herein, the position of the message bit to be embedded falls into a Huffman codeword that should not be modified. Therefore, to circumvent this problem, we proposed to break this sequence, by commuting one bit of S, a bit that should belong to a val AC or a val dif f . Let us consider an example where the reference sequence R = (run R = 0, size AC R = 5) = 11010 and the Huffman codeword of the non-watermarkable AC' such as (run = 0, size AC = 2) = 01 concatenated to S = val AC = 1101 . As given, size AC is lower than size AC R = 5. Hence, the Least Significant Bit of S should be permuted; S will be of S = 1100

Regarding the message extraction stage, like in the JWJLS scheme, the extraction function f c first identifies the reference sequence R in the watermarked-JPEG compressed image bitstream I cw and reads the message m c bit value. In order to secure the access to m c , we suggest encrypting the Reference sequence R and the message m c with the help of the watermarking key K wc .

JWC Image Reliability Control From The Compressed Domain

As seen in Chapter1, in the healthcare domain, the confidence of practitioners into pieces of data they receive relies on their reliability, that is to say proofs that [START_REF] Coatrieux | Relevance of watermarking in medical imaging[END_REF]: i) data have not been modified by an unauthorized user (integrity), and, ii) they belong to the correct patient and are issued from the correct source (authenticity). Non-reliable data should be automatically rejected by medical information system. We further propose an extension of the previous scheme so as to ensure image reliability in the compressed domain. Indeed, it inserts a fragile watermark in both encrypted and compressed domains. Any modification of the image, as well as of its compressed bitstream will alter the embedded messages.

Ensuring the authenticity of the image in both domains is rather simple. One just has to integrate in m c an authenticity code AC; that is the combination of unique identifiers of the image, the patient and of the image transmitter, that we estimate of about 600 bits by combining the French National Identifier with the DICOM Unique Identifier [START_REF] Acharya | Simultaneous storage of patient information with medical images in the frequency domain[END_REF].

Providing the proof of the image integrity is more complex. In the compressed domain, image integrity can be controlled by means of a cryptographic hash computed from the image compressed bitstream elements that are not modified during the JWC watermarking process. At the verification stage, any differences between the extracted hash and the recomputed one will indicate a loss of data integrity [START_REF] Bouslimi | A crypto-watermarking system for ensuring reliability control and traceability of medical images[END_REF]. In this work, we opted for the well-known 256 cryptographic Secure Hash Algorithm (SHA-256). Because such a hash function is very sensitive to data modification and due to the fact the watermarked-compressed bitstream evolves along with the insertion of m c (see Section 2.3.2 and 2.3.4), we propose an iterative procedure, where the compressed image bitstream is divided into non-overlapping blocks of size N . As depicted in Figure 2.10, the hash S Bci of all previous compressed-watermarked blocks B wc{1..i-1} is embedded into the i th compressed block B ci . S Bci is given by:

S Bci = hash B wc{1..i-1} , K wc (2.7)
where K wc is the watermarking key based on which we secretly select bits of the hash that will be inserted into B ci . Regarding the last compressed block B cf , its integrity is controlled by the hash of the non-watermarked pixels in the same block along with the hash of the previous blocks. More clearly, the final hash S B cf to be inserted into the block B cf corresponds to:

S B Cf = hash B wc{1..f -1} , K wc hash nw B c f , K wc (2.8)
where: the function nw (B cf ) provides the image bits that are not modified by the watermarking process and, is the concatenation operator.

Note that because the SHA-256 "strength" is of 128 bits, if 1 bit of B wci changes then, there is one-in-two chance that S Bci commutes and to detect the bitstream tampering.

At the detection stage, the watermark reader will just have to compute the SHA-256 of the compressed blocks and use the secret watermarking key to determine which bits from the compressed block hash correspond to the embedded message bits. If image data are tampered, compressed blocks will not allow the corrected recovery of m c , indicating thus the data cannot be used.

Experimental Results

Experiments were conducted on two sets of medical images of 8-bit depth: 200 Ultra-sound images of 576 × 690 pixels and over 300 mammography images from a public image database [START_REF] Suckling | The mammographic image analysis society digital mammogram database[END_REF] of 1024 × 1024 pixels. Some samples of our image test set are given in Figure 2.11.

Capacity Rates

The capacity rate corresponds to the size of message that can be embedded into an image, being expressed in bit of message per pixel or per coefficient of image (bpp or bpc, respectively).

The following series of experiments have been performed considering one reference sequence for message embedding in both schemes (i.e. joint watermarking-JPEG-LS compression (JWJLS) and joint watermarking-JPEG compression (JWJPG)). In JWJLS, we opted for R 1 = 0X 1 1 = 001 , and in JWJPG, R 1 = (run R1 , size AC R 1 ) = (0, 5) = 11010 . These reference sequences are chosen based on their high occurrence probability in order to achieve high embedding capacity. Note also that in all tests, the embedded binary message m c is uniformly distributed and all watermarkable pixels were used in order to have an idea of the maximum capacity that can be achieved.

Capacity of joint watermarking-JPEG-LS compression (JWJLS) scheme

Let us first start with the JWJLS scheme. It is important to notice that the capacity of our scheme depends on the percentage of pixels that have been encoded during JPEG-LS regularmode. The greater this percentage, the greater is the water-marking capacity. This can be seen in Table 2. [START_REF] Fraser | Iso 27799: Security management in health using iso/iec 17799[END_REF], where capacity values are given based on the use of two different reference sequences R 1 = 0X 1 1 = 001 and R 2 = 0X 2 1 = 0001 . It can be noticed that the capacity is impacted by the choice of the reference sequence. In fact, as mentioned in Section 2, the Golomb-Rice MSB-part (the reference sequence in other words) follows a geometric distribution (i.e. the sequence 001 is of greater occurrence than the sequence 0001 ), hence it is normal that our JWEC reaches better embedding capacity in the compressed domain with R 1 than with R 2 . The watermark capacity is also impacted by the percentage of regular-mode encoded pixels: the more percentage is, the more the embedding capacity can be achieved.

Capacity of joint watermarking-JPEG compression (JWJPG) scheme

According to the JWJPG scheme, we give in Figure 2.12 the trade-off between the embedding capacity average using two reference sequences of different sizes that correspond to , 1(-1)) (0, 1) = 1010 010 1(0) 00 , and the JPEG quality factor (i.e. Q f ), on our ultrasound image dataset. It can be seen that the capacity using R 2 decreases and the one using R 1 increases, along with the increase of the Q-factor. This can be explained by the increase of the number of non-null AC coefficients and by next the decrease of the number of zeros in the end of blocks, in other words decrease of the occurrence probability of "EOB" in the image when Q f is as close to 100.

R 1 = (run R1 , size AC R 1 ) = (0, 5) = 11010 and R = EOB size dif f R 2 , val dif f R 2 run R2 , size AC R 2 = EOB (1
Moreover, it is important to notice that the capacity of our scheme depends on the used reference bit-sequence itself. As shown in Figure 2.12 and in Table 2.4, the embedding capacity when the reference sequence = R 1 is larger than when the reference sequence = R 2 . This is due to the fact that shorter reference sequences are more probable than longer ones.

In both our JWC schemes, the offered embedding capacity is large enough compared to the requirements for verifying the reliability of the image that we estimate about 800 bits (a digital signature provided by the SHA-2: 256 bits and one authenticity code: 600 bits by combining the French National Identifier). As a consequence, image quality can be better preserved than in previous experiments by reducing the number of watermarked pixels. This can also contribute to the security of our scheme by secretly selecting subsets of watermarkable pixels and coefficients (i.e. identified by the reference sequence) for the embedding of m c . On another hand, one can take advantage of this free space to embed some other pieces of information like some elements related to a security policy and to the patient consent [START_REF] Pan | Watermarking to enforce medical image access and usage control policy[END_REF] or any other metadata in relation with the patient health [START_REF] Acharya | Simultaneous storage of patient information with medical images in the frequency domain[END_REF]. Embedding capacity for R 1 (bpp) 2.46.10 -3 7.8.10 -7 9.61.10 -4 8.5.10 -8

Image Distortion

Due to the fact that our JWEC algorithm introduces on average the same distortion in each block, one can refer to the Peak-Signal-to-Noise-Ratio (PSNR) so as to evaluate the image distortion. Moreover, the structural similarity (SSIM) between the original image I and its decompressedwatermarked version I wd is considered as better takes into account some human visual system properties. PSNR is given by:

P SN R (I, I wd ) = 10 log 10 2 d -1 2 M SE (2.9)
with

MSE (I, I wd ) = 1 nm m i=1 n j=1 [I(i, j) -I wd (i, j)] 2 (2.10)
where d corresponds to the image depth, and n × m is the image size. On its side, SSSIM [START_REF] Dosselmann | A comprehensive assessment of the structural similarity index[END_REF] is defined as: The compromise between embedding capacity and PSNR of JWJLS and of JWJPG schemes are given for both ultrasound and mammography image datasets in Figure 2.13, respectively. Obviously, quality distortion varies with the embedding capacity in both schemes. This compromise evolves depending on the image type (or modality) and on its content (e.g. texture of the image, flat areas). As given in Figures 2. [START_REF] Kahn | Virtual visits-confronting the challenges of telemedicine[END_REF] and , in average, the obtained PSNR values for ultrasound and mammography images are of 52.44 dB and 55.53 db with JWJLS, and of 41 dB and of 44.23 dB with JWJPG, respectively. As it can be also noticed, the distortion introduced by the JWJPG is larger than the one introduced by JWJLS. This is due to the fact that JPEG is a lossy compression standard and by applying it, already some information loss occurs. As the JPEG image quality is managed via the quality factors, we give in table 2.5 the trade-off between the Q f , the compression ratio, P SN R c (i.e. the PSNR between the original and the decompressed JPEG images) and P SN R wc (i.e. the PSNR between the original and the watermarked-decompressed JPEG images). These results show that PSNR is not directly related to the watermarking process or in other words to the length of the message embedded into the image but strongly affected by the quality factor Q f . In fact, as said before, the quality factor manages the trade-off between image quality and compression rate. Hence, the lower the quality factor is, the more loss of information occurs and by next the higher image quality distortion is.

SSIM = l (I, I wd ) • c (I, I wd ) • s (I, I wd ) (2.
To sum up, in both JWJLS and JWJPG schemes, the degree of the introduced distortion is small enough and does not endanger the diagnostic value of medical images. One can refer to the study on the impact of lossy image compression on medical images in [START_REF] Chen | Near-lossless compression of medical images through entropy-coded dpcm[END_REF], where it is reported that image distortion should be maintained in the range of 40 and 50 dB without endangering the diagnostic quality.

Resulting SSIM values, being greater that 0.98 also confirm the good quality of watermarked images [START_REF] Dosselmann | A comprehensive assessment of the structural similarity index[END_REF]. As also illustrated in Figure 2.15, where we give two examples of JWC protected images along with their original versions, it can be noticed that we are so far from introducing a visible distortion in the image using both JWJLS and JWJPG schemes..

Algorithm Complexity, Compression Rate & Performance Comparison

As stated in Section 2.3.2, our scheme has sometimes to modify compressed image bitstream so as to ensure the error-free extraction of the message. This can be seen in Figure 2.16, where we provide JWJLS and JWJPG files' size evolution depending on the total embedding capacity in the case of ultrasound images. File size increased linearly with the capacity. As also shown, this increase is very small.

In terms of complexity, we verified that our scheme is about one and half time slower than only JPEG-LS compressing the image. The reason of this difference is obviously caused by the embedding of m c in the compressed domain. However, our JWC gives access to watermarkingbased security services in compressed domain without decompressing the image bitstream, even partially.

To the best of our knowledge, our joint watermarking-compression scheme is the first of its kind. Let us recall that it gives access to different security services (e.g. authenticity, integrity) in the compressed domain without having to decompress the compressed image bitstream, even partially nor counting any additional parameters for partial decompression. Moreover, watermarking is fully transparent to compression in both JWJLS and JWJPG schemes and can be hence decompressed by means of the common JPEG-LS or JPEG decoder, respectively. Nevertheless, as the proposed scheme induces an irreversible image information loss, we propose to compare it to the scheme presented in [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF]. The authors of [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF] embed thee message during the JPEG-LS encoding of the image and authentication is only carried out in the non-compressed domain unlike our proposal. Furthermore, our JWJLS scheme is the first that combines watermarking with JPEG-LS in its fully lossless mode contrarily to [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF] that works with JPEG-LS in its near-lossless (i.e. lossy) mode.

Conclusion

In this chapter, we have focused on the protection of compressed medical images by means of watermarking. As exposed, improving medical data security is a top healthcare priority. On the other hand, medical images constitute huge volumes of data. That is why, they are most of the time stored in a compressed form so as to reduce costs of storage and transmission.

Considering these requirements, we proposed two DICOM-compliant joint watermarkingcompression systems. The first is based on the lossless JPEG-LS compression standard and the second on the lossy JPEG compression. As discussed above, the proposed scheme originality stands of the fact that it allows verifying image reliability directly from the compressed image bitstream without decompressing it, even partially. Indeed, JPEG-LS or JPEG is combined to the bit-substitution watermarking modulation in a single operation so that message extraction can be performed in the image compressed domain without decompressing the compressed bitstream nor computing any additional parameter that can be used for partial image decompression. To do this, we take advantage of the variable-length encoders; i.e. Huffman and Golomb-Rice, used in JPEG and JPEG-LS, respectively. These encoders replace a fixed-length input symbol by the corresponding variable-length prefix codeword. Our basic idea thus is to fix a reference sequence among these variable-length codewords and to embed a message bit into the image pixels or coefficients their prefix codewords correspond to the reference sequence. This later has to be known from the watermark reader so as to extract the message, as it labialize the positions of the message bits in the image watermarked-compressed bitstream.

In order to guarantee normal image decompression and an error-free extraction of the watermark, some issues should be addressed during its embedding. The first issue is to identify where and how the compressed bitstream can be modified without changing its semantic so as to be able to reconstruct the image from its compressed bitstream. The second stands on the capability to embed a message without causing high quality degradation as we work on medical images.

By addressing these constraints, as discussed in Section 2.4, the offered watermarking capacity in both schemes is large enough to give access to different security services ranging from authenticity control to traceability. Regarding the watermarked image quality, it is small and does not endanger the diagnostic value of medical images.

As seen, being able to access to watermarking-based security services from the compressed image without decompressing it nor computing additional parameters is of major concern. Nevertheless, such a solution can be improved, essentially when we consider most of medical images are encrypted before being stored or distributed. Thus, it becomes desirable to access to watermarking-based security services from both encrypted and compressed domains. This issue will be dealt with in the following chapter. Furthermore, we will theoretically evaluate the performance of our scheme in terms of embedding capacity in both compressed and encrypted domains and image quality distortion, and we will analyze the security of the proposed scheme.

Chapter 3

Joint Watermarking-Encryption-JPEG-LS for Medical Image Reliability Control in Encrypted and Compressed Domains

As previously concluded, there is a need to combine watermarking with confidentiality control tools in order to ensure a better protection of medical images. Regarding medical image confidentiality, one has to consider the Digital Imaging and Communications in Medicine (DICOM) standard that has been developed in order to facilitate the transmission handling of medical images [START_REF] Miguel | Web validation service for ensuring adherence to the dicom standard[END_REF]. DICOM also takes into account different security aspects in its part 15. To ensure image confidentiality, while being DICOM compliant, the triple DES or AES encryption can be used. Image integrity can be provided with the help of the DSA digital signature. Such a signature will be located in the DICOM file header of the image. It is important to notice that the kind of protection these security mechanisms offer is "a priori" [START_REF] Singh | A study of encryption algorithms (rsa, des, 3des and aes) for information security[END_REF], in the sense that once an image is decrypted or its digital signature is lost or deleted, the image is no longer protected. Here comes the interest of the "a posteriori" protection watermarking ensures [START_REF] Coatrieux | A review of image watermarking applications in healthcare[END_REF]. Let us recall that watermarking leaves access to the data while maintaining them protected by the message. It has been recently shown that there is a great interest to combine watermarking with encryption so as to simultaneously achieve an "a priori"/ "a posteriori" protection [START_REF] Bouslimi | A joint encryption/watermarking system for verifying the reliability of medical images[END_REF]. By doing so, we refer to crypto-watermarking techniques the main purpose of which is to provide watermarking-based security services from encrypted data [START_REF] Bouslimi | A crypto-watermarking system for ensuring reliability control and traceability of medical images[END_REF].

As seen in Chapter 1 and 2, the deployment of such crypto-watermarking protection in the healthcare domain needs to take into account its specificities, and in particular the fact that medical images are most of time stored in a compressed form so as to decrease storage costs and improve transmission efficiency. A hospital generates more than 27,000 Terabytes per year [START_REF]What's next for the health-care data center?[END_REF]. As a consequence, there is a need for crypto-watermarking-compression solutions. In this chapter, we extend our joint compression watermarking scheme into a joint encryption-compressionwatermarking tool. This solution is the first of its kind. Its originality is twofold. First, it allows accessing to watermarking-based security services from both encrypted and compressed image bitstreams without having to decrypt or decompress them, even partially. In second, it is DICOM-compliant. If the protection we offer is proprietary, image decryption, decompression and watermark extraction processes can be conducted separately.

This chapter is organized as follows. First, we come back on the state of the art of cryptowatermarking and watermarking of compressed and non-compressed images in order to refine the originality of our proposal. Then, we recall the main principles of the AES cryptosystem and the JPEG-LS compression standard, before detailing how they can be combined with substitutive watermarking so as to provide a general joint watermarking-encryption-compression technique.Finally, experimental results and comparison with all the above methods are given and discussed.

Notice that the work we present in this chapter has been published in [START_REF] Haddad | A new joint watermarking-encryptionjpeg-ls compression method for a priori & a posteriori image protection[END_REF] and has been accepted for submission in IEEE Transactions on Information Forensics and Security (IEEE-TIFS).

Combining Watermarking, Encryption and Compression

Watermarking, encryption and compression have been considered in different ways but, as we will see, rarely all three together. We propose to consider four main categories of techniques: encryption & watermarking, watermarking & compression, encryption & compression, and watermarking & compression & encryption. We then sub-classify the corresponding methods from a technical point of view after having recalled the main applications or security services these methods have been proposed for: a) Encryption-watermarking methods -They combine encryption and watermarking mechanisms and have been proposed with as main concern copyright protection in Video on Demand frameworks. As suggested in [START_REF] He | A real-time dual watermarking algorithm of h. 264/avc video stream for video-on-demand service[END_REF], they can however provide integrity and traceability security services. They can be differentiated depending on the domain from where the watermark or the message can be accessed:

• In the clear domain [START_REF] Bouslimi | A crypto-watermarking system for ensuring reliability control and traceability of medical images[END_REF][START_REF] Zhang | Reversible data hiding in encrypted image[END_REF][START_REF] Shilpa | Digital image security improvement by integrating watermarking and encryption technique[END_REF] such methods require to decrypt the image before accessing to the watermark.

• In the encrypted domain [START_REF] Qian | Block cipher based separable reversible data hiding in encrypted images[END_REF][START_REF] Zhang | Separable reversible data hiding in encrypted image[END_REF][START_REF] Cao | High capacity reversible data hiding in encrypted images by patch-level sparse representation[END_REF]] -these schemes jointly conduct encryption and watermarking processes or not. In the latter case, the watermark has to be removed so as to make possible image decryption.

• In both encrypted and clear domains [START_REF] Bouslimi | A joint encryption/watermarking system for verifying the reliability of medical images[END_REF][START_REF] Schmitz | A new approach to commutative watermarking-encryption[END_REF][START_REF] Bouslimi | Data hiding in encrypted images based on predefined watermark embedding before encryption process[END_REF]] -these schemes usually take advantage of partial , invariant or homomorphic encryption.

It is important to notice that methods of the two last categories are not DICOM compliant. They need to reorganize the image bitstream or to parse the encrypted bitstream in a specific fashion so as to give access to the watermark. Beyond, none of them have been combined with image compression. As we will see, the solution we propose makes possible to extract a message from both encrypted and compressed bitstreams without having to reorganize or parse (i.e. decrypt or decompress) them, even partially.

b) Watermarking-compression schemes -Again, those ones mainly focus on the copyright protection of data. They can be discriminated depending on the compression-watermarking processual sequence:

• Watermarking before compression [START_REF] Boujemaa | Fragile watermarking of medical image for content authentication and security[END_REF][START_REF] Lou | A novel multi-bit watermarking algorithm based on hvs[END_REF] the message is embedded before image compression and is only available in the decompressed domain. The watermark is usually designed to be more robust to a lossy compression algorithm than another by inserting the message into the appropriate transform domain (i.e. Discrete Cosine Transform (DCT) -JPEG; Discrete Wavelet Transform (DWT) -JPEG2K).

• Compression followed by watermarking [START_REF] Bijan | A foundation for watermarking in compressed domain[END_REF][START_REF] Xu | Watermarking in h. 264/avc compressed domain using exp-golomb code words mapping[END_REF][START_REF] Naveen | Tamper detection and authentication in jpeg 2000 images using chaotic watermarking scheme[END_REF][START_REF] Long | Rotation based reversible data hiding for jpeg images[END_REF]]-This strategy consists in embedding the message directly into the compressed bitstream or after a partial decompression of it. Watermark extraction is usually conducted in the same domain as the embedding process.

• Joint watermarking and compression [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF] where the message is embedded during the compression process. The main benefit of such a strategy is that compression is no longer considered as an attack from the watermark robustness point of view.

With the first sub-class methods, message extraction is always conducted in the decompressed domain. That is not the case of the two last sub-classes, where the watermark reader has to parse the image bitstream or to compare the watermarked image to the original one for message extraction. As we will see, that is not the case of the solution we propose. c) Encryption-compression solutionsone can distinguish three different classes:

• Compression before encryption [START_REF] Wang | Jpeg image encryption by shuffling dct coefficients in defined block[END_REF][START_REF] Sun | Image compression and encryption scheme using fractal dictionary and julia set[END_REF] these schemes aim at improving the security of compressed images during their transmission over bandwidth-constrained channels.

• Encryption before compression [START_REF] Bm Shreedhar | Image encryption-then-compression system via prediction error clustering and lossless encoding[END_REF][START_REF] Kaur | Designing an efficient image encryption-then compression system with haar and daubechies wavelet[END_REF][START_REF] Hazay | Compressing block-cipher encrypted data[END_REF] such methods are worked-with when the storage service provider wants to gain memory space without knowing the encryption key.

• Joint encryption and compression [START_REF] Tong | A joint image lossless compression and encryption method based on chaotic map[END_REF][START_REF] Alfalou | Simultaneous compression and encryption of color video images[END_REF] where both mechanisms are conducted simultaneously to gain in complexity, security and storage space.

As it can be seen, the only purpose of these schemes is to ensure data confidentiality.

d) Encryption-compression-watermarking techniquesto the best of our knowledge, two methods focusing on watermarking, encryption and compression, have been proposed. The technique in [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF] embeds a watermark into an homomorphically encrypted JPEG2000 compressed image. Homomorphic encryption allows conducting some operations onto encrypted data with the guaranty that the decrypted result equals the one of the equivalent calculation conducted onto unencrypted data. In [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF], authors use a stream-cipher with homomorphic properties so as to not expand the size of compressed data. They embed a pseudo-random sequence into the less significant bit planes of the encrypted middle wavelet coefficients of the image in order to ensure the watermark invisibility. The watermark detection is conducted from the decrypted JPEG2000 compressed image bitstream using a correlation detector along with the a priori known pseudo-random sequence. To make these operations possible the compressed image bitstream has to be pre-processed before being encrypted. This pre-process reorganizes and modifies the compressed wavelet coefficients in order to: i) facilitate the identification of watermarkable coefficients in the encrypted image bitstream, and ii) ensure the watermarking process does not modify elements of the compressed bitstream that will make impossible image decompression. Authors of [START_REF] Qian | New framework of reversible data hiding in encrypted jpeg bitstreams[END_REF] proposed a reversible watermarking scheme in the encrypted domain for labeling ciphered images for their storage in the Cloud. In this scheme, the JPEG-compressed image is rearranged, resized and re-encoded before being encrypted. The JPEG image header is encrypted based on a stream cipher algorithm (e.g. RC4) while Huffman encoded coefficients are encrypted using a permutation technique. After the image encryption, secret data are embedded into the Huffman table present in JPEG image header and into the quantized AC coefficients after their partial decompression using histogram shifting, a reversible watermarking modulation [START_REF] Coatrieux | Reversible watermarking based on invariant image classification and dynamic histogram shifting[END_REF]. To extract the message, the encrypted-JPEG compressed bitstream should be partially decompressed.

In order to allow image decryption and decompression, the modified Huffman table has to be replaced by the table predefined in the JPEG standard and permuted-watermarked AC coefficients have to be un-watermarked and de-permuted. As it can be seen, beyond these two works, there is no joint watermarking-compression-encryption algorithm, contrarily to the other above classes. If [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF] and [START_REF] Qian | New framework of reversible data hiding in encrypted jpeg bitstreams[END_REF]algorithms are separable, they also require compressed data reorganization before and after data watermarking in the encrypted domain. Without such data reorganization, decryption and decompression processes are impossible. As a consequence, these schemes need proprietary decoding (decryption and decompression cannot be conducted regularly) and are not compliant with the DICOM standard. It can also be noticed that watermarking based services are only available in the encrypted domain for [START_REF] Qian | New framework of reversible data hiding in encrypted jpeg bitstreams[END_REF] and in the decrypted domain for [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF].

In this chapter, we propose the first joint watermarking-encryption-compression (JWEC) scheme. Its originality is twofold. First, it allows accessing to watermarking-based security services from both encrypted and compressed image bitstreams without having to decrypt or decompress them, even partially. Second, it combines bit-substitution watermarking with JPEG-LS and the AES block cipher algorithm in its cipher block chaining (CBC) mode [START_REF] Shadangi | Novel arnold scrambling based cbc-aes image encryption[END_REF], in a single operation performed on the entire image (i.e. the image is entirely compressed and encrypted). It is important to notice that with our scheme, it is possible to decipher and decompress the image with the common AES and JPEG-LS algorithms. More clearly, decryption, decompression as well as message extraction processes are conducted independently without having to be modified or adapted, unlike [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF] and [START_REF] Qian | New framework of reversible data hiding in encrypted jpeg bitstreams[END_REF]. With such a capability, our scheme is DICOM compliant. Furthermore and as we will demonstrate, our solution makes possible to trace images and control their reliability (i.e. authenticity and integrity) directly from both encrypted and compressed domains. Note also that the proposed scheme saves the computational complexity as it does not require decryption and decompression to verify the image reliability in the encrypted domain and the compressed one, respectively.

AES and JPEG-LS in brief

As our scheme is combines watermarking with JPEG-LS and the AES cryptosystem, let us recall some of their basic principles our solution relies on.

Advanced Encryption Standard

AES is a symmetric key cryptosystem that encrypts blocks of data, typically 128-bit blocks (see Chapter 1, Section 1.2.3.1 about block cipher algorithms). Furthermore, AES works different modes of operation so as to adapt the algorithm for a specific application or to enhance its efficiency. To meet these requirements, the NIST (National Institute of Standards and Technology), in 2001, standardized five AES-modes of operations: ECB (Electronic Code Book), CBC (Cipher Block Chaining), CFB (Cipher FeedBack), OFB (Output FeedBack) and CTR (Counter).

In this work, we opted for the Advanced Encryption Standard (AES) in its cipher block chaining (CBC) mode in order to make our system compliant with the DICOM standard. The CBC mode refers to the manner in which plain-text blocks are processed at the encryption and decryption stages. Technically, each block of plain-text is XORed with the previous cipher-text block before being encrypted. More clearly, let us denote the encrypted version of the i th block B i as B e i . With the CBC mode, B e i is given by:

B e i = AES B i ⊕ B e i-1 , K e (3.1)
where B e i-1 is the previous encrypted block and K e is the encryption key.

JPEG-LS compression

Our system hides a message that will be available in the image JPEG-LS bitstream without having to parse it, even partially. In this section, we just recall the core elements of JPEG-LS compression technique we already presented in Chapter 2 (Section 2.2). JPEG-LS is a lossless image compression standard [START_REF]JPEG)/ FCD 14495. Lossless and near-lossless coding of continuous-tone still image jpeg-ls[END_REF]. DICOM allows its use in order to compress medical images. JPEG-LS is based on the Low Complexity Lossless Compression for Images (LOCO-I) algorithm [START_REF] Weinberger | The loco-i lossless image compression algorithm: Principles and standardization into jpeg-ls[END_REF]. This one relies on a pixel prediction based on a local contextual statistical model.

The main steps of JPEG-LS are described in Figure 3.1. As it can be seen, an image is sequentially processed pixel by pixel. JPEG-LS encodes one pixel x accordingly to two modes: the regular-mode or the run-mode. To decide in-between these modes, JPEG-LS first analyses the local activity around x, based on its immediate causal neighborhood constituted of previously encoded pixels (i.e. pixels a, b, c and d in Figure 3.1), by calculating its corresponding local gradients (see equation ()).

If all local gradients are null then, the run-mode is activated, otherwise the regular-mode is chosen. JPEG-LS run-mode is based on run-length encoding (RLE). It encodes the pixel value followed by the number of times this one is repeated.

During the regular-mode, the causal neighborhood of x is used to estimate its gray value based on the edge-detecting predictor (see equation in ()). By next, JPEG-LS assigns to x a context Q evaluated from its associated local gradients. This context value will subsequently be used to correct the prediction-error bias as well as to parameterize the Golomb-Rice encoder. More clearly, because the edge-detecting predictor only provides integer values, a prediction bias exists. This bias induces a translation of the prediction-error e = x -x. In order to compensate such a systematic offset, a context-dependent term is computed so as to shift back the prediction-error for each pixel. For a given pixel x and its context Q, this term corresponds to the prediction-error mean e of the pixels of the same context Q as x, i.e. of same Q value. The next step in the regular-mode consists in encoding the corrected prediction-errors with the help of the Golomb-Rice encoder (GRE). Due to the fact, GRE only encodes non-negative integer values, the corrected prediction-errors are modified into "mapped prediction-errors" ẽ such that the positive and negative values are mapped to even and odd positives integers of ẽ, respectively. So the parity of ẽ, or equivalently its least significant bit indicates the corrected prediction-error sign. Then, the resulting mapped-prediction errors are GRE encoded. Basically, GRE encodes a positive integer p into two parts that are concatenated. These two parts of p will be referred in the sequel as: the Most Significant Bit part (p M SB ) and the Least Significant Bit part (p LSB ). Notice that these two parts are of great importance in the proposed scheme. The MSB-part corresponds to the quotient of the Euclidean division of p by 2 k , where k is the non-negative Golomb-Rice factor. This quotient is unary encoded, i.e. by a sequence of '0' ended by '1', the number of '0' being the quotient value. This part is then concatenated to the binary encoding of the division reminder, i.e. an integer value encoded on k bits. Note that the value of Golomb-Rice factor, i.e. k, is also pixel's context-dependent. JPEG-LS decompression is accomplished by performing the same steps as for compression (see Chapter 2 Section 2.2 for more details).

Proposed Joint Watermarking-Encryption-Compression

(JWEC) Scheme

System architecture and basic principles

The purpose of our system is to ensure the confidentiality of an image I through encryption while giving access to watermarking-based security services in both encrypted and compressed domains. As shown in Figure 3.2, it relies on two main procedures: protection and verification. At the protection stage (see Figure 3.2 (a)), substitutive watermarking, JPEG-LS and AES in its CBC mode are jointly conducted so as to protect an image I. This procedure, we name as JWEC, for joint watermarking-encryption-compression, allows the insertion of two messages m e and m c that will be available or readable from the encrypted image bitstream I cwe and from the compressed image bitstream I cw , respectively, without having to parse them , even partially. Both messages contain security attributes that assess the image reliability (see Sub-Section 4.2.3). The embedding and the extraction of messages m e and m c depend on two distinct watermarking keys: K wc in the compressed domain and K we in the encrypted domain. On its side, AES is parameterized with the encryption key K e .

At the verification stage (Figure 3.2 (b)), the image reliability can be verified by accessing to m e or m c with the help of two watermarking functions f e and f c , respectively. Notice that a JWEC protected image I cwe can be decrypted and decompressed in a regular way. AES decryption and JPEG-LS decompression can be conducted independently with no modification of their algorithms. More clearly, our JWEC scheme does not need some proprietary decryption or decompression procedures. Watermarking is completely transparent to JPEG-LS and to AES. This is of goal interest for DICOM systems that are not watermarking-compliant.

In the sequel and for sake of simplicity, we first recall how to combine JPEG-LS with the least significant bit substitution watermarking modulation (see Chapter 2, Section 2.3.3). We then detail how to take into account AES encryption so as to build our JWEC scheme and the way it can be used to protect the reliability of an image in the encrypted domain. correspond to the original, the watermarked-encrypted-compressed, the watermarked-compressed and the decompressed images, the watermarking keys in compressed and encrypted domains, the encryption key, the embedded and extracted messages from compressed and encrypted domains, respectively.

Combination of watermarking, encryption and JPEG-LS

Embedding of m c message available in the compressed domain -Joint JPEG-LS-Watermarking

As exposed in Section 3.2.2, JPEG-LS sequentially encodes pixels depending on their local context and accordingly to two encoding modes: the regular and the run modes. To roughly sum up, the run-mode is selected to compress sequences of pixels of same gray value while regular-mode is used to encode the others. We recall that this latter relies on a prediction and context-based coding of pixel prediction-errors using the Golomb-Rice encoder. As shown in Section 2.2.1, it is rather impossible to clearly identify the bits of one pixel in the bitstream, but there is a high probability that a sequence of bits 0X1 , where X is a sequence of '0', corresponds to a regular-mode encoded pixel. As already said in Chapter 2, Section 2.3.3, we take advantage of this property so as to make the message m c readable from the image compressed bitstream without decompressing it. Our basic idea is to embed m c in pixels the mapped prediction-errors of which have a Golomb-Rice MSB-part encoded such that ẽMSB = 0X1 , 0X1 is called as "the reference sequence", by modifying its higher order bit of Golomb-Rice LSB-part using watermarking bit-substitution modulation (see Section 2.2.1). The used reference sequence has to be known from the watermark reader in order to extract the message m c . In order to guarantee the error-free extraction of m c , two main constraints have to be considered : i) the possibility to embed one bit after each reference sequence 0X1 ; ii) a sequence of bits equals to 0X1 should correspond to a watermarked pixel in the watermarked-compressed image bitstream. As we have detailed and showed how to address these constraints in Chapter 2 Section 2.3.3, let us briefly remember what are these issues. Regarding the former issue, a watermarkable pixel should hold an LSB-part ẽLSB , i.e. its Golomb-Rice factor should be non-null, otherwise message insertion is not possible. In addition, due to the fact that the last bit of ẽLSB informs JPEG-LS decoder of the prediction-error sign, k should be strictly greater than 1. To overcome this issue; i.e. when ẽMSB = 0X1 but k ≤ 1, we propose to modify the pixel ẽMSB part: it suppresses one '0' from ẽMSB (i.e. 0X1 is changed into X1 ). The pixel is thus turned into a non-watermarkable pixel. The second issue imposes that all reference sequences 0X1 in the protected compressed bitstream correspond to the watermarked pixels. Otherwise, the watermark reader will be desynchronized by extracting bit values that are not part of m c . This kind of problem occurs when a non-watermarkable pixel (i.e. ẽMSB = 0X1 ) is preceded by a sequence of bits 0S, where S is a sequence of '0', such that 0S ẽMSB = 0X1 , '||' being the concatenation operator. To solve it, our scheme considers this pixel as watermarkable and one bit of m c is embedded into its ẽLSB . As we will see in the experimental section, these solutions can attribute to the increase in the watermark capacity and the image distortion.

Regarding the watermarking extraction function f c (see Figure 3.2), it has just to identify the reference sequence ẽMSB = 0X1 in the watermarked-compressed image bitstream I cw and to read the immediate following bit value to extract m c . In order to ensure the security of our scheme, that is to say securing the access to m c , we suggest secretly selecting watermarkable pixels with the help of watermarking key K wc . It can be noticed that, after decompression, as long as the protected image has not been modified, one just has to JPEG-LS re-compressed it to retrieve the message m c in the compressed domain.

Theoretical capacity and image quality distortion

The embedding capacity of our JWEC in the compressed domain, it means the size in bits of m c , depends on the probability of occurrence of the reference sequence 0X1. It has been shown in [128] that unary coding is an optimally efficient encoding for the following discrete probability distribution:

P ( 0X1 ) = 2 -(|X|+2) (3.2)
where |X| is the number of '0' the sequence X contains.

In our case, as all pixels are not necessarily encoded in the regular-mode, the optimal embedding capacity in bits of message per pixel of image (bpp) of our JWEC in the compressed domain is given by:

C mc = 2 -(|X|+2) R (3.3)
where R is the ratio of regular-mode encoded pixels in the image.

One can also estimate the image distortion this joint watermarking-JPEG-LS solution introduces. According to [START_REF] Vasilache | Order adaptive golomb rice coding for high variability sources[END_REF], for a given reference sequence 0X1 , the Golomb-Rice factor k follows a geometric distribution of parameter p. It is thus possible to compute the mean squared error (MSE) between an image I of n × m pixels, and its watermarked-decompressed counterpart I wd :

MSE c (I, I wd ) = 1 nm m i=1 n j=1 [I(i, j) -I wd (i, j)] 2 = 1 nm k max -1 k=0 2 2k N k (3.4)
where k max = 8 for 8-bit depth image; N k is the number of pixels the Golomb-Rice factor of which equals k. When C mc (given by ( 6)) of pixels are watermarkable, N k = C mc P(k).

In that case, the average distortion is such that:

M SE c (I, I wd ) = E 1 nm kmax-1 k=0 2 2k N k = 1 p C mc nm 4 kmax-1) 3 (3.5)
where E[x] is the expected value of x. Note that the expected value of a geometrically distributed value is E[k] = 1/p.

Embedding of m e message available in the encrypted domain -proposed JWEC scheme

The embedding of the message m e works similarly as the previous one. The watermarkedcompressed bitstream is modified or, equivalently, again watermarked so as to make m e available from the watermarked-encrypted-compressed image bitstream. Our idea is to introduce a distortion in the compressed image bitstream in order one can extract m e from the AES encrypted data using watermarking extraction function f e . Let us consider B wci is the i th block of consecutive bits of a watermarked-JPEG-LS compressed bitstream. In the case of AES, such a block is of 128-bit long (see Section 3.2.1). m e will be made available in the encrypted domain by modifying B wci into B we wci such that f e (B we wci , K we ) = f e (AES (B w wci , K e ) , K we ) = m e (3.6)

where K e is the AES encryption key, B we wci is the AES encrypted version of B w wci and K we is the secret watermarking key in the encrypted domain.

One simple solution to give access to m e without having to parse the watermarked-encryptedcompressed bitstream of a JWEC protected image consists in secretly selecting one bit of each watermarked-encrypted-compressed block B we wci that will correspond to one bit of m e . More clearly, B wci will be modified into B w wci such that the secretly selected bit of B we wci equals one bit of m e . The watermark extraction function f e of our JWEC system is thus defined as:

f e (B we wci , K we ) = AES (B w wci , K e ) j (3.7)
where AES(.) j corresponds to the j th bit of the AES block. The choice of the value of j for each AES encrypted block depends on the secret watermarking key K we . Nevertheless, to make this scheme works, two main constraints have to be considered. First, the embedding of m e should not interfere with the one of m c . In our JWEC scheme, the way one watermarked-JPEG-LS compressed block B wci is modified into its version B w wci is an iterative procedure. It modifies some mapped prediction-errors belonging to B wci until the bit of m e is embedded, i.e. by verifying equation 3.7. To do so, the bit-substitution watermarking modulation is applied to the second lower order bit of the LSB-part of some prediction-errors that are not used for the embedding of m c (i.e. pixels the Golomb-Rice MSB-part of which differ to the reference sequence 0X1 ). The choice of the second lower order bit stands on the fact that the least significant bit encodes the prediction-error sign and should not be modified (see Section 3.1). This procedure guarantees that the embedding of m e does not interfere with the one of m c . Beyond, as in JPEG-LS the modification of one bit or equivalently of one pixel impacts the encoding of the following pixels, the embedding of m e cannot be conducted separately from the one of m c . The second constraint to consider is that a compressed-watermarked block B wci should at least possess one pixel encoded in the regular-mode in order to be able to embed one bit of m e . When a block only contains run-mode encoded pixels, these repeated sequences should be broken; by introducing one or more several regular-mode encoded pixels. To sum-up, the procedure we propose to watermark one block B wci is iterative and relies on a buffer memory to manipulate a block as it is necessary to come back to the JWC encoding of pixels so as to ensure the embedding of m e without interfering with the one of m c . To give an example, let us assume B wci is constituted of N pixels or equivalently, N Golomb-Rice encoded prediction-errors: B wci = {(ẽ M SB , ẽLSB ) u } u=1...N . The procedure we propose to insert m e is as given as follows:

Algorithm 1: Embedding of m e u = N ; % Start with the last encoded pixel in the AES block ; B we wci = AES (B w wci , K e ); % encrypting the watermarked -compressed block while AES (B w wci , K e ) j = m ei do %m ei corresponds to i th bit of m e if ẽMSB,u = 0X1 then bit_substitution(ẽ LSB,u ); reencode(B w wci ); B we wci = AES (B w wci , K e ); end u = u -1; end where: the function bit_substitution() substitutes one bit of the prediction-error LSB-part (ẽ LSB,u ); and reencode() corresponds to the JPEG-LS re-encoding of the modified 128-bit block.

Theoretical capacity and image quality distortion

The capacity of our JWEC in the encrypted domain depends on the AES block size (N = 128 bits), the image size (n × m) and depth (d ) as well as the JPEG-LS compression rate (τ ). For a given image, the number of bits one can embed (or the number of blocks in the image, in other words) is such that

C meB = nmd N τ bits (3.8)
or, equivalently, in bit of message per pixel of image

C me = d N τ bpp (3.9)
It should be known that, as mentioned in [130] and [131], the optimal compression ratio of the JPEG-LS for medical images is of 2 : 1 (i.e. τ = 2).

Considering the AES cryptosystem as perfect, the diffusion property states that the change of one bit of the clear-text will lead to an AES cipher-text with at least 50% different bits. There is thus one-in-two chance that the change of one bit in a block leads to the correct value of the bit of m e (see 3.7). The probability of being able to embed one bit after t tests is defined as P (t) = 1 -(1/2) t . This probability converges rapidly to 1 with the increase of t. On average, one bit of m e is inserted in one block within 2 tests. Our JWEC process is thus 2 times slower than simply compressing then encrypting the image.

Similarly to the embedding of m c in the compressed image bitstream, we can estimate the distortion this second watermarking process injects into the image so as to embed m e . Let us consider a JWEC block of N bits. Because of the diffusion property of AES [START_REF] Nazeh | A comparison of cryptographic algorithms: Des, 3des, aes, rsa and blowfish for guessing attacks prevention[END_REF], as already said, there is one chance over two that a pixel change in the block commutes one bit of the AES block, and because this embedding modifies the second lower order bit of the Golomb-Rice LSB part of pixels, the average MSE in the whole image is such that

M SE e (I, I wd ) = 2 2 l mean C meB nm (3.10)
where, l mean is the number of changes to make so as to encode one bit of m e . Because of the AES property, l mean = 2 and C meB is given by 3.8. More generally, because watermarking processes in the encrypted and in the compressed domains do not rely on the same pixels, it is possible to estimate the total average distortion that our JWEC can introduce in an image by summing 3.5 and 3.10, that is to say:

M SE T = 1 p C m C nm 4 kmax-1) 3 + 2 2 l mean C meB nm (3.11)
Due to the fact that our JWEC algorithm introduces on average the same distortion in each block, one can refer to the Peak-Signal-to-Noise-Ratio (PSNR) so as to evaluate the image distortion rather than MSE. Let us consider an image of d bit-depth and let us denote I and I wd the original image and its watermarked-decompressed-decrypted version, respectively, the theoretical average PSNR is given by

P SN R mean (I, I wd ) = 10 log 10 2 d -1 2 M SE T (3.12)

JWEC Image Reliability Control in both encrypted and compressed domains

In the healthcare domain and as seen in Chapter 1, the confidence of practitioners into pieces of data they receive relies on their reliability, that is to say proofs that [START_REF] Coatrieux | Relevance of watermarking in medical imaging[END_REF]: i) data have not been modified by an unauthorized user (integrity), and, ii) they belong to the correct patient and they are issued from the correct source (authenticity). Non-reliable data should be automatically rejected by medical information system. We thus propose an extension of the previous JWEC scheme so as to ensure image reliability in the compressed and in the encrypted domains. Indeed, it inserts fragile watermarks in both encrypted and compressed domains. Any modification of the image, of its compressed bitstream as well as of its encrypted bitstream will alter the embedded messages.

Ensuring the authenticity of the image in both domains is rather simple. One just has to integrate in m c and in m e an authenticity code AC; that is the combination of unique identifiers of the image, the patient and of the image transmitter (see [START_REF] Coatrieux | Watermarking medical images with anonymous patient identification to verify authenticity[END_REF] for more details).

Providing the proof of the image integrity is more complicated. In the compressed domain and by taking into account the scheme proposed for integrity control in Chapter 2, image integrity can be controlled by means of a cryptographic hash computed from the image compressed bitstream elements that are not modified during the JWEC watermarking process. At the verification stage, any differences between the extracted hash and the recomputed one will indicate a loss of integrity. In this work, we opted for the well-known 256 cryptographic Secure Hash Algorithm (SHA-256). Because such a hash function is very sensitive to data modification and due to the fact the watermarked-compressed bitstream evolves along with the insertion of m c and m e (see Section 3.3), we propose an iterative procedure. Let us consider the previous JWEC system based on 128-AES. As depicted in Figure 3.3, the hash S Bci of all previous compressed-watermarked blocks B w wc{1..i-1} is embedded into the i th compressed block B ci , unlike in the joint watermarkingcompression scheme proposed in Chapter 2 where the hash was computed onto compressed blocks watermarked by m c , only. S Bci of the JWEC-based reliability control is thus given by

S Bci = hash B w wc{1,i-1} , K wc (3.13)
where K wc is the secret watermarking key based on which we secretly select bits of the hash, that will be inserted into B ci .

Regarding the last compressed-block, its integrity is controlled by the hash of the nonwatermarked pixels in the block along with the hash of the previous blocks. More clearly, the final hash S B cf to be inserted in the block B cf corresponds to : where: the function nw (B cf ) provides the image bits that are not modified by the watermarking process and, || is the concatenation operator.

To control the image integrity from the image encrypted-compressed bitstream, we propose to modify the extraction function f e that gives access to m e . Rather than extracting the message from bits of the AES bitstream, we propose to extract them from the SHA-256 hash of AES blocks. More clearly, the extraction function f e used to extract m e from an AES encrypted B we wc is defined as:

f e (B we
wci , K we ) = hash (AES (B w wci , K e ) , K we ) j = h j (3.15) where h j corresponds to the j th bit of the SHA-256 hash of B we wci . j is chosen based on the secret watermarking key K we . Because the SHA-256 "strength" is of 128 its, if 1 bit of B wci changes then, there is one-in-two chance that h j commutes and to detect the bitstream tampering. Notice that, this JWEC-based reliability control induces the same image distortion as the previous JWEC scheme (see Section 3.2.2). It is nearly 2 times slower than simply compressing then encrypting an image. It is of same complexity as the our general JWEC scheme.

At the detection stage, the watermark reader will just have to compute the SHA-256 of the encrypted blocks and use the secret watermarking key to determine which bit from the encrypted block corresponds to the embedded message bit. In the case encrypted data are tampered, cipheredblock will not allowed the corrected recovery of m e , indicating thus the data cannot be used.

Experimental Results of The Proposed JWEC-based Reliability Control

Experiments were conducted on two sets of medical images of 8-bit depth : 1200 Retina images of 627 × 643 pixels, and 100ultrasound images of 579 × 690 pixels. Some samples of our image data set are given in Figure 3.4.

Capacity Rates

As already mentioned in Section 4.2.2, message capacity in the compressed domain depends on the distribution probability of the chosen reference sequence 0X1 and on the percentage of regularmode encoded pixels. In the following tests, the reference sequence 001 has been considered for the embedding of m c . Table 3.1 provides the capacity rates we achieved in both encrypted and compressed domains. It can be seen that the theoretical capacity given by 3.3 is close to the practical one for ultrasound images. For Retina images, the difference stands on the fact that the watermark can be embedded into the bitstream of pair of consecutive prediction-errors (see Section 4.2.2). Ultrasound images provide the lowest embedding capacity values. This can be explained by the fact they contain large black background encoded in run-mode. The embedding capacity in the encrypted domain depends on the encrypted block size (N ), the image depth (d ) and the JWEC compression rate (τ ). As we considered the AES cryptosystem in its CBC mode, the block size is limited to N = 128 bits. In practice, as indicated in Table 3.1, resulting capacities in the encrypted domain are very close to the theoretical one given by 3.9. This latter gives an upper insertion capacity limit. For Retina images, one can at least embed a message of 56 Kbits.

We also give in Table 3.2, the embedding capacity values considering two different reference sequences; 0X1 = 001 and 0X1 = 0001 for Retina images. It confirms that the watermark capacity is impacted by the choice of the reference sequence. It is normal that our JWEC reaches better embedding capacity in the compressed domain with 0X1 = 001 than with 0X1 = 0001 .

The offered embedding capacities in both domains are large enough compared to the requirements for verifying the reliability of the image that we estimate about 1 Kbits (a digital signature provided by the SHA-2: 256 bits and one authenticity code: 600 bits by combining the French National Identifier with the DICOM Unique Identifier [START_REF] Coatrieux | Watermarking medical images with anonymous patient identification to verify authenticity[END_REF]). As a consequence, image quality can be better preserved than in previous experiments by reducing the number of watermarked pixels. This can also contribute to the security of our scheme by secretly selecting subsets of watermarkable pixels (i.e. identified by the reference sequence 0X1 ) for the embedding of m c and encrypted blocks from which m e will be extracted. On another hand, one can take advantage of this free space to embed other pieces of information like some elements related to a security policy and to the patient consent [START_REF] Pan | Watermarking to enforce medical image access and usage control policy[END_REF] or any other metadata in relation to the patient health [START_REF] Acharya | Simultaneous storage of patient information with medical images in the frequency domain[END_REF].

Distortion

The Peak-Signal-to-Noise-Ratio (PSNR) and the Structural SIMilarity (SSIM) between the original image I and its decrypted-decompressed-watermarked version I wd , were considered so as to evaluate the image distortion. As already said in Chapter 2, if PSNR is appropriate in the case of a uniform As discussed in Section. 3.2.2, the distortion introduced by our JWEC scheme depends not only on the considered reference sequence 0X1 but also on the Golomb-Rice factor k and the number of modulated pixels l for the insertion of m e . In the case of 0X1 = 001 , it is possible to compute the theoretical value of P SN R mean (see Equation (3.12)). Figure 3.5 confirms that the Golomb-Rice factor k follows a geometric distribution of parameter p the value of which can be estimated for both ultrasound (p = 0.7) and Retina images (p = 0.6). We have also verified that, in order to embed m e , two pixels are in average modulated per JWEC block (i.e. a block of N = 128 bits compressed with a ratio τ = 2 : 1. In consequence, the theoretical mean PSNR value (P SN R mean ) between the original and the watermarked-decompressed-decrypted images is of 54.01 dB, and of 54.11 dB for Retina and ultrasound images, respectively.

The compromise between the embedding capacity and PSNR of our JWEC scheme is given in Figure 3.6 for both used image data set. Obviously, capacity varies with the image distortion. This compromise evolves depending on the image type (or modality) and of its content (e.g. the percentage of regular-mode encoded pixels, the texture of the image). In average, the obtained PSNR values for ultrasound and Retina images are of 49.8 dB and 51.65 dB, respectively. The gap between the previous theoretical values has the same explanation as the difference between theoretical and experimental capacity values. Several bits of the watermark in the compressed domain are embedded in pairs of consecutive pixels' prediction-errors the bitstream of which gives access to the reference sequence 0X1 (see end of the first sub-section of Section 3.2.2). More generally, our system has sometimes to introduce other distortions so as to guarantee the errorfree extraction of both messages m e and m c . Beyond, the degree of such distortion is small and does not endanger the diagnosis value of the medical images. One can refer to the study on the impact of lossy image compression on medical images in [START_REF] Chen | Near-lossless compression of medical images through entropy-coded dpcm[END_REF], where it is reported that image distortion should be maintained in the range of 40 and 50 dB to establish good diagnosis. To sum up, even though our JWEC scheme induces an image information loss, it well preserves the diagnosis value of images. Resulting SSIM values, being greater than 0.98 also confirms the good quality of watermarked images [START_REF] Dosselmann | A comprehensive assessment of the structural similarity index[END_REF]. As also illustrated in Figure 3.7, where we give two examples of JWEC protected images along with their original versions, it can be noticed that we are so far from introducing a visible distortion in the image and the diagnosis value of images is preserved.

Distortion-Capacity Performance and Comparison

We compare in Table 3.3 our JWEC solution to methods of the state of the art dealing with encryption, watermarking and compression, independently of the medical imaging domain. As it can be seen, our scheme is the first joint watermarking-encryption-compression algorithm. All other joint methods only consider encryption & watermarking, or watermarking & compression or encryption & compression. By merging encryption, compression and watermarking in a single process, our scheme is neither commutative nor separable. Nevertheless, as the proposed JWEC does not rely on data reorganization, it makes watermarking completely transparent to decryption and decompression. Hence, decompression and decryption can be conducted separately and regularly (i.e. using the common AES and JPEG-LS) making our scheme compliant to DICOM. Only a few watermarking & encryption schemes can do the same ( [START_REF] Bouslimi | A joint encryption/watermarking system for verifying the reliability of medical images[END_REF], [START_REF] Bouslimi | A crypto-watermarking system for ensuring reliability control and traceability of medical images[END_REF], [START_REF] Bouslimi | Data hiding in encrypted images based on predefined watermark embedding before encryption process[END_REF], [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF] and [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF]). Note that watermarking & compression schemes that work with JPEG, JPEG 2000, or JPEG-LS will obviously be compliant to DICOM. Our scheme also offers watermarking-based services from the encrypted and compressed domains without having to decrypt or to decompress, even partially, the image data. None of its competitors from the literature provides this functionality. Moreover, our method is fully compliant to JPEG-LS, while [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF] works with a near-lossless version of JPEG-LS [START_REF] Caldelli | Joint near-lossless compression and watermarking of still images for authentication and tamper localization[END_REF] and only allows message extraction from the spatial (i.e. pixel values) domain unlike our JWEC that gives access to a message in the compressed domain. As stated in Section Table 3.3: Comparison of methods from the state of the art and the proposed JWEC scheme. Non-Independent decryption or non-independent decompression indicate that the solution depends on some data pre/post-processing so as to decrypt or to decompress the data, respectively. 3.2.2, if a decompressed JWEC protected image has not been modified, the watermark reader just has to JPEG-LS re-compress it to retrieve the message from the compressed image bitstream. Our scheme is however fragile in the sense that, if data are modified, message recovery is not possible. To go further, the recovery of the message in the encrypted domain requires the knowledge of the encryption key so as to re-encrypt the compressed bitstream. This can be a constraint.

Because our JWEC algorithm induces an irreversible image information loss, we propose to compare it to schemes presented in [START_REF] Venkata Subramanyam | Robust watermarking of compressed and encrypted jpeg2000 images[END_REF] and [START_REF] Qian | New framework of reversible data hiding in encrypted jpeg bitstreams[END_REF] from the same class (see Table 3.3). In these schemes, encryption, watermarking and compression are separable in the sense that these operations are conducted in a cascade manner but not in one operation. They however rely on a proprietary decryption or decompression algorithms, due to the fact that data have to be reorganized at one point. Furthermore, they give access to the watermark in only one image domain.

Regarding the capacity/distortion compromise, in case of the well-known test image "Lena",

Algorithm Complexity and Compression Rate

As stated in Section 3.2.2, our scheme has sometimes to modify compressed image bitstream so as to ensure the error-free extraction of messages. This can be seen in Figure 3.8, where we provide JWEC file size evolution depending on the total embedding capacity (i.e. considering the embedded messages in both encrypted and compressed domains) in the case of Retina images. File size increased linearly with the capacity. Notice also that this increase is very small. In terms of complexity, we verified that our scheme is about 2 times slower than compressing then encrypting the image in a cascade manner. The reason of this difference is obviously caused by the embedding of m e in the encrypted domain. However, our JWEC gives access to watermarking-based security services in both encrypted and compressed domains while ensuring the confidentiality of the image, without parsing or decoding data bitstream, even partially.

Security Analysis

The proposed JWEC scheme allows ensuring confidentiality of images while providing watermarking-based security services, through two messages m c and m e . It can however face different cryptographic and watermarking attacks.

Cryptographic Attacks

Our scheme is implemented with the AES block-cipher algorithm in its CBC mode. Because we do not intrinsically modify it, its security performances against common cryptographic attacks are preserved [START_REF] Zhang | A fast image encryption scheme based on aes[END_REF]. Indeed, even if K we or m e are known by the attacker, he/she has no additional means than a regular cryptographic attack to get k e or to have an idea about the watermarkedcompressed image bitstream.

Watermarking Attacks

Three classes of watermarking attacks should be considered [START_REF] Zhou | Security theory and attack analysis for text watermarking[END_REF]:

• Unauthorized embeddingwhere an attacker wants to modify the embedded messages or insert his own ones. In this case, if he/she does not know neither the encryption key nor the watermarking keys (K we and K wc ), such a tamper will be detected easily. Without the watermarking key K we , the attacker cannot insert fake message m e that will be considered as valid. Even if he/she succeeds, the watermarked-compressed bitstream as well as the image will not be properly decoded. Thus, if the attacker knows the watermarking key in the encrypted domain, an alarm will be raised in the compressed domain thanks to the message m c that will be altered too. In the case that the attacker knows K e and K we , he/she can decrypt the image but his/her capability to modify or insert a new message m e is impossible without the knowledge of the watermarking key in the compressed domain (K wc ). Indeed, modifying even one bit of the image watermarked-compressed bitstream will make impossible the JPEG-LS decompression. If the attacker now decompresses the protected image and tries to JWEC it again, he/she still has to ensure the embedding of a valid message m c ; the validity of which depends on the watermarking key in the compressed domain.

• Unauthorized detection/extraction of messageswhere an attacker wants to detect or extract the embedded messages. With our JWEC scheme, the location of the messages' bits in both domains depends on secret watermarking keys. Without these keys, the attacker cannot distinguish the bits that correspond to the watermarks. To reinforce security, we recommend encrypting the messages before being embedded into the image.

• Unauthorized removal attackin such case, the attacker tries to remove the embedded messages from the image. As already said in Section 3.3.3, when the received image is stated unreliable, i.e. it is not possible to verify its integrity and its origins; it has to be directly rejected by the medical information system. As a consequence, valid watermarks should be present in the encrypted and compressed domains.

Conclusion

In this chapter, we have descried the first joint watermarking-encryption-compression system, which guarantees an a priori and a posteriori protection of medical images. Our JWEC gives access to watermarking-based security services in the compressed domain as well as in the encrypted one, without having to decrypt or to decompress the corresponding the corespondent image bitstream, even partially. Additionally, we have shown how such a JWEC algorithm can be used for verifying the reliability of an image. Beyond, offered embedding capacity is large enough so as to allow various watermarking-based security services ranging from authenticity to traceability and patient consent management. Even though our scheme introduces an image information loss, this one is small and the diagnosis value of images is preserved. Our JWEC system is about two times slower than simply JPEG-LS compressing the image and encrypting it, but it provides watermarkingbased security functionalities. Furthermore, image decryption and decompression processes are not modified making our scheme compliant or transparent to the DICOM standard. A JWEC protected image can be deciphered and decompressed by a non-compliant watermarking system, using AES and JPEG-LS normally. Due to the need to combine watermarking with confidentiality control tools in order to ensure a better protection of medical image, our future works focus on extending the joint watermarkingencryption-compression scheme to JPEG compressed domain. As described in Chapter 2, it is possible to combine watermarking and JPEG compression in a single operation so as to extract the message directly from the compressed image bitstream, without decompressing even partially. Hence, it will be possible to combine this scheme with an encryption algorithm so that message extraction will be performed in both JPEG compressed and encrypted domains.

As discussed in Chapter 1, the reversibility property is of special interest in the medical context as the original image can be completely recovered once the watermark extracted, leading thus to applications like integrity and authenticity control and traceability. In the next chapter, we will detail a lossless watermarking scheme, which allows the embedding, into the encrypted image, of a message that can be extracted from both encrypted and clear (i.e. spatial) domain, as well as the error-free recovery of the original image.

Chapter 4

Reversible Image Crypto-Watermarking based on Robust Histogram Shifting

In the previous chapters, we addressed the protection of compressed images, encrypted or not, by means of lossy or irreversible watermarking. As stated in Chapters 1, 2 and 3, such a distortion can impact image interpretation. Herein, it is interesting to use reversible watermarking, which guarantees the exact recovery of the original image from its watermarked version by removing the embedded watermark. Furthermore, it makes possible to update the watermark content at any time without adding new image distortions.

Reversible watermarking methods are generally based on the Difference Expansion (DE) [START_REF] Tian | Reversible data embedding using a difference expansion[END_REF] and/or the Histogram Shifting (HS) [START_REF] Coatrieux | Reversible watermarking based on invariant image classification and dynamic histogram shifting[END_REF] modulations. To roughly summarize DE, this one divides the image into pairs of pixels and embeds bits of the secret by expanding their differences so as to create a virtual LSB bit; one bit of the message. At the reading stage, the reader recomputes the pixels' differences, read the virtual LSB bit values so as to extract the message and expands back pixels differences so as to recover the original image. Regarding, we will come back on its details in the sequel, as we propose an original extension of it. It is also important to notice that these reversible watermarking modulations are in essence fragile, in the sense that the watermark will not survive to any image modifications. We propose a solution in order to make HS robust to some image modifications.

In this chapter, we are interested in being able to reversibly watermark encrypted images. As medical images are sensitive data, they are usually stored in a encrypted fashion in order to ensure their confidentiality. When managing such data, it is desirable to embed additional data (e.g. time stamps, labels) without accessing to their contents so as to trace them or protect them in terms of integrity, without having to decrypt the data. In this context, it is interesting to allow message extraction from the encrypted and decrypted image. For instance, one server can embed in the encrypted image the identity of the user who requested it with the capability to retrieve the user identity from the decrypted image so as trace herhim. This can be helpful in order to verify the reliability of an image this one being encrypted or not.

Herein, we propose a new crypto-watermarking approach based on "pre-watermarking" which allows embedding in a reversible manner a message in encrypted data; a message that can be extracted before and after image decryption. Its main originality stands on the insertion of a reversible pre-watermark that is robust to the insertion of a message in the encrypted domain.

To do so, we propose a robust version of the well-known histogram shifting modulation. Due to its robustness, the original pre-watermark can be correctly recovered, allowing thus restoring the original image. The proposed scheme encrypts the entire image while watermarking and encryption/decryption processes are conducted separately. More clearly, message insertion and extraction (resp. encryption and decryption) do not require neither the knowledge of the encryption key (resp. watermarking key or other extra parameters). Notice also that, unlike actual similar solutions, our scheme does not require the reorganization of image pixels or bitstream. More clearly, the image is commonly decrypted and can be used by the user. The decryption algorithm is not proprietary. This chapter is organized as follows. First, we come back on the state of the art of cryptowatermarking schemes so as refine the originality of the objectives of our proposal. Then, we present some preliminaries about stream cipher encryption, we use in our scheme, as well as on the principles of the Histogram Shifting (HS) modulation before detailing our robust version of HS. The third par is devoted to the general principles of our approach and illustrates one possible implementation of it using the Trivium stream cipher along with the LSB substitution watermarking modulation and our robust HS modulation. Some experimental results considering natural and medical image datasets are then provided so as to support possible applications of our scheme as, for instance, how it can be used for verifying the image integrity and authenticity in both clear and encrypted domains.

Crypto-Watermarking Schemes

As seen in Chapter 3, for the last few years, various crypto-watermarking approaches have been proposed in order to offer both "a priori " and "a posteriori " protection. The basic objective of such crypto-watermarking schemes is to guarantee at the same time confidentiality of data through encryption while providing watermarking-based security services. These security services can be made available in the clear domain and/or in the encrypted domain. Five categories of cryptowatermarking approaches can be distinguished according to the way encryption and watermarking mechanisms are combined (see Figure 4.1).

• Watermarking Followed by Encryption (WFE) [START_REF] Song | A buyer-seller watermarking protocol for digital secondary market[END_REF][START_REF] Priya | A novel visual medical image encryption for secure transmission of authenticated watermarked medical images[END_REF] where the host signal is watermarked and by next encrypted. With such a method, the embedded message is not available from the encrypted signal.

• Commutative Encryption and Watermarking (CEW) [START_REF] Jiang | The identical operands commutative encryption and watermarking based on homomorphism[END_REF][START_REF] Vaibhav | An improved commutative reversible watermarking and encryption for fingerprint image[END_REF][START_REF] Cancellaro | A commutative digital image watermarking and encryption method in the tree structured haar transform domain[END_REF] with these schemes, the ordering of watermark insertion and image encryption processes has no influence: the same encrypted-watermarked image will be obtained. These methods are usually based on partial encryption [START_REF] Vaibhav | An improved commutative reversible watermarking and encryption for fingerprint image[END_REF] or homomorphic encryption [START_REF] Jiang | The identical operands commutative encryption and watermarking based on homomorphism[END_REF]. In the former case, image data are divided into two sets: one set is used for watermark embedding and the other set for encryption. By doing so, there is no risk that watermarking interferes with encryption/decryption processes. [START_REF] Cancellaro | A commutative digital image watermarking and encryption method in the tree structured haar transform domain[END_REF] proposes a commutative scheme where a bit-plane subset of the image representation in a suitable transformed domain is watermarked while the remaining bit-planes are encrypted. Due to the fact that correlation between watermarked and encrypted subsets can introduce some security breaches, authors propose to pseudo-randomly select the representation domain among a wide set of parametric transformation to enhance scheme security. To make this possible, the parametric discrete Tree-Structured Haar transform has been used, which depends on a secret set named Discontinuity Point Vector (DPV) that defines the splitting scheme. Homomorphic schemes are referred as "invariant schemes" as they allow conducting some operations onto encrypted data with the guaranty that the decrypted result equals the one of the equivalent calculation conducted onto unencrypted data. However, these methods can be only realized with specific encryption algorithms that matched with a watermarking algorithm limiting thus their applicability. The authors of [START_REF] Jiang | The identical operands commutative encryption and watermarking based on homomorphism[END_REF] propose an algorithm based on the Paillier homomorphic cryptosystem and the Patchwork watermarking to realize commutative watermarking/encryption. The Patchwork watermarking uses the statistical characteristics of the carrier data to embed the watermark. To sum up, even if these commutative encryption and watermarking schemes allow accessing to the watermark from both encrypted and clear domains, they present many inconveniences. One may consider that CEW schemes based on partial encryption do not fully ensure confidentiality. It could be possible to use non-encrypted data to attack the system. Regarding homomorphic encryption-based CEW schemes, it is important to notice that beyond its high computation complexity, homomorphic encryption induces a huge expansion of data. A clear text message may have an encrypted version of more than 2048 bits (e.g. Paillier cryptosystem [START_REF] Yao | Accelerate the paillier cryptosystem in cryptdb by chinese remainder theorem[END_REF]).

• Joint Encryption/Watermarking (JEW) [START_REF] Bouslimi | A joint encryption/watermarking system for verifying the reliability of medical images[END_REF][START_REF] Bouslimi | A joint encryption/watermarking algorithm for verifying the reliability of medical images: Application to echographic images[END_REF][START_REF] Abdel | Efficient joint encryption and data hiding algorithm for medical images security[END_REF] -In these schemes, watermarking and encryption operations are conducted jointly. For instance, in [START_REF] Bouslimi | A joint encryption/watermarking algorithm for verifying the reliability of medical images: Application to echographic images[END_REF], two messages conveying some security attributes are embedded during the encryption process. Each message is only available in one domain in order to ensure watermarking services in both domains. It is important to notice that in general, even though encryption and message embedding are jointly conducted, decryption and message extraction can be performed independently. One weakness of these approaches is that most of the time, they insert read-only messages. More clearly, it is not possible to modify the messages in the encrypted bitstream. Modifying the message will not allow the correct decryption of the image.

• Joint Decryption/Watermarking (JDW) [START_REF] Bouslimi | Combination of watermarking and joint watermarking-decryption for reliability control and traceability of medical images[END_REF][START_REF] Utku Celik | Lookup-table-based secure client-side embedding for spread-spectrum watermarks[END_REF] -where a fingerprint is embedded during the decryption process. These schemes are inspired by the well-known cipher algorithm Chameleon [START_REF] Anderson | Chameleon-a new kind of stream cipher[END_REF]. The basic idea of JDW scheme is to insert a watermark during the decryption process. Such a strategy allows essentially reducing time computing and complexity on the server side.

• Encryption Followed by Watermarking (EWF) [START_REF] Qian | Block cipher based separable reversible data hiding in encrypted images[END_REF][START_REF] Zhang | Separable reversible data hiding in encrypted image[END_REF][START_REF] Cao | High capacity reversible data hiding in encrypted images by patch-level sparse representation[END_REF][START_REF] Bouslimi | Data hiding in encrypted images based on predefined watermark embedding before encryption process[END_REF][START_REF] Qian | Reversible data hiding in encrypted images with distributed source encoding[END_REF][START_REF] Zheng | Lossless data hiding algorithm for encrypted images with high capacity[END_REF][START_REF] Zhou | Secure reversible image data hiding over encrypted domain via key modulation[END_REF][START_REF] Hao-Tian | Reversible data hiding in paillier cryptosystem[END_REF][START_REF] Bouslimi | An a priori and a posteriori protection by means of data hiding of encrypted images: application to ultrasound images[END_REF][START_REF] Bouslimi | Data hiding in homomorphically encrypted medical images for verifying their reliability in both encrypted and spatial domains[END_REF][START_REF] Yin | Reversible data hiding in encrypted images based on multi-level encryption and block histogram modification[END_REF][START_REF] Wu | High-capacity reversible data hiding in encrypted images by prediction error[END_REF] -The solution we propose belongs to this category of methods. Five main strategies can be distinguished. The first one consists in embedding the message in the encrypted domain using a classical reversible watermarking modulation. In [START_REF] Zhang | Separable reversible data hiding in encrypted image[END_REF][START_REF] Qian | Reversible data hiding in encrypted images with distributed source encoding[END_REF][START_REF] Zheng | Lossless data hiding algorithm for encrypted images with high capacity[END_REF], some bits of the encrypted image are losslessly compressed and replaced by their compressed versions along with the message. As a consequence, the message is only available in the encrypted domain and the image can only be decrypted after extracting the message. The image decryption is thus proprietary too. These schemes remain limited depending on the efficiency of the crypto-system. In theory, a perfect cryptosystem maximizes entropy leading to an un-compressible bitstream. The second strategy takes advantage of the differences of the statistical properties of the encrypted and decrypted images for watermark embedding and removal [START_REF] Qian | Block cipher based separable reversible data hiding in encrypted images[END_REF][START_REF] Cao | High capacity reversible data hiding in encrypted images by patch-level sparse representation[END_REF]. For instance, [START_REF] Qian | Block cipher based separable reversible data hiding in encrypted images[END_REF] embeds one message bit per encrypted image block by flipping the three LSB planes of half of the encrypted pixels. To extract the message, the recipient first decrypts the image and computes some correlation measurement in each pixel block. If the correlation is high, the block has not been modified and a bit '1' is extracted. On the contrary, the block has been modified and a bit '0' is extracted. To recover the original block, the recipient flip-back the LSBs of the encrypted block, and decrypt the block again. Notice that with this second EWF strategy, the embedded message can be only extracted from either the clear or the encrypted domain. Notice also that the original image is sometimes recovered with some errors due to the fact that correlation fails to detect the correct message bit. The third strategy exploits homomorphic and/or probabilistic encryption [START_REF] Zhou | Secure reversible image data hiding over encrypted domain via key modulation[END_REF][START_REF] Hao-Tian | Reversible data hiding in paillier cryptosystem[END_REF]. For instance, [START_REF] Hao-Tian | Reversible data hiding in paillier cryptosystem[END_REF] first independently Paillier encrypts the image pixels. Then, by taking advantage of the additive homomorphism property of the used cryptosystem, the authors apply pixel expansion so as to embed the message. More clearly, considering a pixel value p, this one is changed into the value 2p+b; where b is a bit of the message. These operations are easy to perform in the Paillier encrypted domain. To recover the original pixels' values and to extract the message, the encrypted image needs to be decrypted first. The forth strategy, which can be referred under the concept of "vacating room before encryption", consists in: 1) generating an embedding room by embedding LSBs of certain pixels into other pixels using traditional reversible watermarking,; 2) encrypting the image and; 3) embedding the message by replacing the vacated LSBs in the encrypted bitstream. The main inconvenient of such a scheme is that image data have to be reorganized before being encrypted, in order to make possible the identification of the vacated space in the encrypted domain. As example, this one can be placed at the beginning of the encrypted image bitstream [START_REF] Yao | Content-adaptive reversible visible watermarking in encrypted images[END_REF]. Furthermore, the image is in essence partially encrypted. The last strategy [START_REF] Bouslimi | Data hiding in encrypted images based on predefined watermark embedding before encryption process[END_REF][START_REF] Bouslimi | An a priori and a posteriori protection by means of data hiding of encrypted images: application to ultrasound images[END_REF][START_REF] Bouslimi | Data hiding in homomorphically encrypted medical images for verifying their reliability in both encrypted and spatial domains[END_REF] are based on the embedding of a pre-watermark in the plain-text image before encrypting it. The basic idea is to next embed the message in the encrypted image and to ensure that the decryption errors, related to this insertion process, impact the pre-watermark so as to be able to extract it from the clear/decrypted domain. Message extraction in the clear domain is done by comparing the extracted pre-watermark to the original one. The extraction in the encrypted domain depends on the modulation used to insert the message. However, these methods are not reversible, in the sense that original image cannot be exactly recovered after having extracted the message. To sum up, none of the above reversible watermarking-based EFW schemes allow the extraction of a message, embedded into the encrypted domain, from both encrypted and clear domains. In addition, they do not entirely encrypt the image and/or, image decryption is only possible after the encrypted image bitstream reorganization. The solution we propose does not suffer of these issues. We sum up in Table 4.1 the above state of art and compare it to our EFW solution independently of the medical imaging domain.

Encryption and Watermarking Primitives

Stream Cipher

As described in Chapter 1, two kinds of encryption algorithms can be distinguished: block cipher and stream cipher algorithms. Contrarily to block cipher algorithms which operate on large blocks of plaintext, stream cipher algorithms; like RC4 [START_REF] Sriadhi | Rc4 algorithm visualization for cryptography education[END_REF] and Trivium [START_REF] De | Trivium. In New Stream Cipher Designs[END_REF], manipulate stream of bits/bytes of plaintext. As given in Figure 4.2, stream cipher algorithms combine the bits/bytes of plaintext T = [t 1 , . . . t i , . . . , t n ] with a secret keystream of bits/bytes K = [k 1 , . . . k i , . . . , k n ] issued by a pseudorandom number generator (PRNG), through a typically XOR operation. The keystream generation depends on the secret encryption key K e . Thus, bits/bytes of cipher-text C = [c 1 , . . . c i , . . . , c n ] are usually defined as:

c i = t i ⊕ k i (4.1)
where ⊕ represents the XOR operation. The way the PRNG produces the bit/byte keystream is specific to the stream cipher algorithm. Some of the main advantages of this type of algorithms are they are easy to implement and operate at a higher speed than block cipher algorithms making them appropriate to the encryption of huge volume of data. Furthermore, it has maximum entropy because 0's and 1's are generated with equal probability [START_REF] Tuyls | Xor-based visual cryptography schemes[END_REF], that is to say there is any form of correlation within the encrypted image. Table 4.1: Comparison of methods from the state of the art and the proposed EFW scheme. Non-Independent decryption indicates that the solution depends on some data pre/post-processing so as to decrypt the data, respectively.

In this work, we opted for the Trivium stream cipher. Basically, Trivium is a synchronous stream cipher algorithm designed to generate up to 2 64 bits of random binary sequence from an 80-bit secret key and an 80-bit initial value (IV). This algorithm consists of 2 phases: i) the internal state of the cipher is initialized using the key and the IV, then ii) the state is repeatedly updated and used to generate the random binary sequence. Trivium was designed to be compact in constrained environments and fast in applications that require a high throughput as mentioned in [START_REF] De | Trivium. In New Stream Cipher Designs[END_REF].

The choice of this algorithm stands on the fact that it belongs to the eSTREAM portfolio of recommended stream cipher algorithms suitable for different applications and due to its provable security and high software/hardware implementation efficiency [START_REF] Canteaut | End-to-end data security for iot: from a cloud of encryptions to encryption in the cloud[END_REF].

Histogram Shifting Modulation

General Principle

Proposed by Ni et al. [START_REF] Ni | Reversible data hiding[END_REF] and as illustrated in Figure 4.3, the histogram shifting (HS) modulation, consists in shifting a range of the signal histogram according to a fixed magnitude ∆ to create a 'gap' near the histogram maxima; which corresponds to C 1 in Figure 4.3. Samples of the signal (e.g. pixels) with values associated to the class of histogram maxima, are then shifted to the gap or kept unchanged to encode '1' or '0', respectively. These samples are referred as "carriers" and samples of other classes are called "non-carriers". At the extraction step, the watermark reader just has to interpret the message from classes' samples and to shift back samples' values. Nevertheless, in order to restore exactly the original signal, the watermark reader needs to be informed of the samples values of which have not be shifted at the insertion stage due to the fact their values are at the extremities of the sample dynamic range. These samples are called overflows or underflows (see overflows' example in Figure 4.3). This requires the embedding of some extra data (a message overhead) along with the message to inform the watermark reader. Such a message overhead reduces the watermark capacity. This overhead generally corresponds to a location map the components of which inform the reader whether samples are original or have been shifted. Another strategy is to build a vector, one component of which indicates to the reader if a sample of value in the value in the overflow class has been or not shifted.

Prediction-Error Histogram Shifting (PEHS)

In the traditional form of HS, the embedding capacity is limited by the cardinality of peak point class. As a consequence, the prediction-error-based HS has been introduced, in order to go beyond the low embedding capacity of HS in the spatial domain, by exploiting the similarity of neighboring pixels. The idea is to construct a prediction error histogram. This also facilitate the identification of the carrier classes as they are centered on zero.

PEHS thus relies on two main steps: 1) Computation of the histogram of the image predictionerrors, and 2) Watermarking of prediction-errors based on HS modulation. The former step consists in calculating the prediction-error e ij of each image pixel p ij , such that

e ij = p ij -pij (4.2)
where pij is the predicted value of p ij . Different predictors have been proposed in the literature.

In this work we opted for the very classic one, where pi,j is derived from the four nearest neighbor pixels of p i,j [START_REF] Coatrieux | Reversible watermarking based on invariant image classification and dynamic histogram shifting[END_REF]:

pi,j = (p i-1,j + p i,j+1 + p i+1,j + p i,j-1 ) 4 (4.3)
e w ij = e ij -∆ if e ij < -∆ e ij + ∆ if e ij ≥ ∆ (4.4)
The prediction-errors within the carrier-class C c are used for the embedding of the binary message

M = {b i } i=1,...N , b i ∈ {0, 1}. A bit b i is embedded into e ij , e ij ∈ C c such that e w ij =    e ij if b i = 0 e ij -∆ if b i = 1 and e ij ∈ [-∆, 0] e ij + ∆ if b i = 1 and e ij ∈ [0, ∆[ (4.5)
Notice that embedding a message in the prediction-error domain implies: i) modulating the image pixels; and ii) the possibility of underflows or overflows in the clear domain. To address this problem, the embedding of an image overhead is required.

Robust Histogram Shifting

PEHS offers very interesting performance in terms of embedding capacity and image quality preservation. However, as most of reversible watermarking methods, it is fragile. Indeed, any modification of watermarked image prevents the correct extraction of the message and consequently the restoration of the original image. We detail in what follows the proposed Robust Histogram Shifting (RHS) considering the general case where HS is applied to any image characteristics (e.g. pixels, DCT coefficients) and the case where it is applied to image prediction-errors.

General Principle of Robust HS

The objective of our robust HS scheme is to embed a robust message. Message robustness is defined as the ability to correctly extract the embedded message after an image modification or alteration. In our work, if we look at an image sample watermarked using HS modulation (see Section 4.1.2), this one is said robust to an attack if it remains in the same class (carrier or non-carrier) that encodes the same bit value. In the case of a sample image attack, leading to the introduction of a distortion δ, three possible situations can happen: (i) A message-bit error: where a carrier sample that encodes 0 becomes carrier that encodes 1 , and vice versa.

(ii) A carrier deletion: where a carrier sample encoding 1 is turned into a non-carrier sample.

(iii) A carrier injection: when a non-carrier sample becomes a carrier sample that encodes 1 .

Notice that carrier injections and deletions lead to a desynchronization between the message embedder and reader. In fact, in the case of a carrier deletion, the message reader will extract a message shorter than the embedded one. To circumvent the desynchronization problems, supposing that the maximum distortion that can be introduced into an image sample is known and is of δ; where δ < ∆ and ∆ is the shifting magnitude, the solution we propose consists in creating two gaps, both of size δ (C e 1 and C e 2 in Figure 4. 2 ), it is considered as a carrier encoding 1 (resp. non-carrier). Thus, this solution (i.e. the creation of the gaps) allows avoiding the desynchronization problems.

Regarding message-bit errors that can occur after an image attack, we propose to use an errorcorrecting code before message embedding to overcome this problem. Notice that our solution does not guarantee the error-free message extraction. Indeed, the detection/correction of message-bit errors depends not only on the correction ability of the adopted error-correcting code, but also on the statistical distributions of injected errors and carrier samples (i.e., the number of carrier samples should be greater than the one of injected errors). Notice that even if our strategy makes the message more robust against attack, it increases the size of the message overhead, which avoids the reader confusing underflow and overflow samples with non-carriers samples.

Robust Prediction-Error Histogram Shifting (RPEHS)

Similarly to HS, the main problems to solve in building robust PEHS are to counteract synchronization and message bit error issues. The solution we adopted to circumvent these issues is similar to robust HS in the spatial domain. Indeed, to overcome the synchronization problem, two gaps of size 2δ ([2∆, 2(∆ + δ)[ and [-2(∆ + δ), -2∆[ in Figure 4. 6(a) are created between the carrier and non-carrier classes. In order to avoid the message-bit error problem, we also propose to encode the message using an error-correcting code before its embedding. To make our proposal clearer, let us detail how message embedding is conducted. As illustrated in Figure 4.6, each non-carrier prediction-error e ij is shifted of +/ -2(∆ + δ) as follows:

e w ij = e ij -2(∆ + δ) if e ij < 0 e ij + 2(∆ + δ) if e ij > 0 (4.6)
To embed a bit b i of the message M , a carrier prediction-error e ij is modulated such that:

e w ij =    e ij if b i = 0 e ij -∆ if b i = 1 and e ij ∈ [-∆, [0 e ij + ∆ if b i = 1 and e ij ∈ [0, ∆[ (4.7)
Note that M corresponds to the concatenation of the message overhead M over and a message the detected bit bi is given by bi

= 1 if êw ij ∈ [-2∆ -δ, -∆[∪[∆, 2∆ + δ[ 0 if êw ij ∈ [-∆, ∆[ (4.9)
The extracted message M is then decoded and corrected so as to obtain M sg Note that creating gaps introduces a distortion of 4δ into the non-carrier image predictionerrors. This distortion can be minimized if the attack or the type of the distortion is known. In our case, as the introduced distortion corresponds to the permutation of image pixels' LSBs by RPEHS message embedding, it can be minimized of 2δ. In fact, instead of creating two gaps of 2δ between carrier and non-carrier classes, we will only create two gaps of size δ in [-2∆ -δ, -2∆[ and in [2∆, 2∆ + δ[, as given in Figure 4.6(c). By doing so, after an attack (i.e. a permutation of image pixels' LSBs), a non-carrier prediction-error and a carrier encoding 1 can fall in the same gap ([-2∆ -δ, -2∆[ and [2∆, 2∆ + δ[ in Figure 4.6(c)). Hence, the watermark reader only has to permute the LSB of the corresponding pixel in order to obtain the corrected prediction-error.

Reversible Watermarking of Encrypted Images

Basic Principles and General Architecture

Our approach allows embedding within an encrypted image a message M e that is available in both encrypted and clear domains (i.e. in the encrypted and decrypted images). To do so, as illustrated in Figure 4.7, its principle is based on the insertion into the image I of a predefined watermark, a pre-watermark W before image encryption process. This insertion process is conducted by embedding a binary message M s using our robust and reversible watermarking scheme and a secret watermarking key K ws . The least significant bits of the pixels of the obtained pre-watermarked image I correspond to the pre-watermark W . I is then encrypted into I e . A message M e is then embedded into I e using a common watermarking scheme and a watermarking key K we , leading to the watermarked encrypted image I ew . By definition, M e can be extracted from I ew using an extraction function f e . Furthermore, the message M e is available from the decrypted image I w based on the fact that the insertion of M e modifies the embedded pre-watermark W . In fact, due to the robustness of M s , the extracted pre-watermark W ext can be corrected to recover the original W . The differences between the recovered pre-watermark W r and the extracted one allow encoding M e into the decrypted image and the extraction of M e during the verification process from the decrypted image I d . Moreover, as M s is embedded using a reversible watermarking scheme, it can then be removed to restore the original image. As it can be seen, in our approach, message extraction and image decryption are considered as two independent processes. It is important to notice that all of pre-watermark embedding, encryption and data hiding processes have not to be conducted at the same time, i.e. jointly. As example, images can be pre-watermarked and encrypted and stored before being watermarked at a later time.

In the following, we present one implementation of our approach based on a stream cipher algorithm and our RPEHS (see Section 4.3.2).

Message Embedding using RPEHS

As said above, this step allows embedding into an image I a pre-watermark W by inserting a binary message M s robust against the insertion of a second message M e into the image after encryption using the LSB substitution modulation. With this technique, the image distortion is limited to the permutation of the image LSBs and the value of δ = 1. Under this constraint, our objective is to embed W using the robust PEHS so that, after the insertion of M e , the message M s and the original image can be correctly recovered. As seen in Section 4.3.2, with our RPEHS, the original image cannot be recovered after permuting the image LSBs. So, we propose to modify the RPEHS to ensure the original image recovery and the embedded message M s , and consequently the embedded pre-watermark W . To do so, we shall ensure correcting the LSBs of the pixels that correspond to the non-carriers and carrier prediction-errors. To be able to correct the pixel LSBs that correspond to the non-carriers errors, we propose to encode those LSBs using an error correcting-code and insert the redundancy bits redu into the carrier prediction-errors. On the other hand, pixel LSBs that correspond to the carrier prediction-errors carry the message encoded with an error-correcting code. Nevertheless, the use of this code allows correcting the embedded message, but not the pixel LSBs that carry it. In fact, the carrier prediction-error of positive value encoding '0' can become negative, but remains encoding the same bit '0', and vice versa. This allows introducing an error into the image LSBs, but not into the embedded message. To circumvent this problem, we propose to create a gap of size δ = 1 between the positive and negative carriers that encode '0'. To summarize the way the modified version of RPEHS works, let us consider the process the message embedder follows. After computing image prediction errors, it builds the message M s to be embedded such that:

M = err_code (M osr ) , where M osr = M over redu M s (4.10)
where M over corresponds to the message overhead, redu are the redundancy bits and M s is the secret message encoded with an error-correcting code.

The message M is then embedded as follows. As illustrated in Figure 4.8, a non-carrier prediction-error e ij is firstly shifted of 2(∆ + δ) if e ij < -∆ and of 2∆ + δ if e ij ≥ ∆. A carrier prediction-error e ij of a negative value is also shifted of δ for creating a gap between the positive and negative carrier prediction errors. The shifted version e s ij of a prediction-error e ij is thus given as follows

e s ij =        e ij + 2∆ + δ if e ij ≥ ∆ e ij -2(∆ + δ) if e ij < -∆ e ij -δ if -∆ ≤ e ij < 0 e ij if 0 ≤ e ij < ∆ (4.11)
A shifted carrier prediction-error

e s ij , e s ij ∈ [0, ∆[∪[-∆ -δ, -δ[, is modulated as follows for embedding one bit b i of M e w ij =    e s ij if b i = 0 e s ij -∆ if b i = 1 and e s ij ∈ [-∆ -δ, -δ[] e s ij + ∆ if b i = 1 and e s ij ∈ [0, ∆[ (4.12)
Notice that modulating the prediction error e ij implies adding e w ij -e ij to its corresponding pixel p ij . The watermarked version of p ij , p w ij , is thus computed as:

p w ij = p ij + e w ij -e ij (4.13)
Furthermore, in order to improve the embedding capacity, we propose a preprocess that allows removing the over/underflows, and consequently the overhead to embed. This process is done before the robust PEHS message insertion. Considering in the image N over and N und pixels that if watermarked lead to an overflow or an underflow, two thresholds T min and T max can be identified such that

T min = max n=1,...,N und (p ij ) ; T max = min n=1,...,Nover (p ij ) (4.14)
where pij is the predicted value of p ij (see Section 4.2.2.2). Therefore, the N over pixels (resp. N und ) are preprocessed by subtracting 2∆ + δ (resp. adding 2(∆ + δ)). By doing so, image pixels do not lead to an underflow or overflow if watermarked using our robust PEHS. In such a case, the message M (see Equation 4.10) is defined as

M = err_code (M sr ) , where M sr = redu M s (4.15)
At the extraction stage, the extractor needs to know the histogram shifting ∆, δ, T min , T max , and the parameters of the adopted error correcting code. Those parameters form the watermarking key K ws that should be transmitted to the extractor enabling him to extract the message M s and recover the original image.

Herein, our objective is to theoretically determine the embedding capacities in clear domain, i.e. the maximum size of the message M s one can embed into the image. As stated above, this capacity depends on the number N c of carrier prediction errors, those for which |e ij | < ∆. Indeed, the maximum size of M (see Equation 4.15), which corresponds to the total amount of bits that can be embedded into the image prediction errors is equal to N c , i.e. |M | = N c .N c can be calculated based on the probability density function of e ij . Let us assume that e ij follows a centered normal distribution N 0, σ 2 e (see Figure 4.9). Therefore, the probability P c that e ij is a carrier is defined as:

P c = Φ ∆ σ e -Φ - ∆ σ e (4.16)
where Φ(.) is the cumulative distribution function of a normal distribution, defined as

Φ ∆ σ e = 1 σ e √ 2π ∆ -∞ e -t 2 2σ 2 e dt = 1 2 1 + erf ∆ σ e √ 2 (4.17)
Considering N e the number of carrier and non-carrier prediction errors in an image of L × N pixels. As an image prediction error corresponds to the difference between a pixel and its predicted value derived from its four neighbor pixels, N e is equal to the number of pixels the sum of the horizontal and vertical positions of which is even (see Figure ). Therefore, we have:

|M | = N c = N e × P c (4.18)
As given in Equation 4.15, M is formed by the concatenation of the secret message M s and the redundancy bits of the LSBs of the non-carriers redu, M sr = redu M s ), encoded with an error correcting code C(n, k, d). The maximum size of M sr is given by:

|M sr | = N c k n (4.19)
In order to get the maximum capacity of our system in the clear domain, i.e. the maximum size of M s , the size of the redundancy bits redu resulting from encoding the LSBs of non-carriers prediction errors with C should be subtracted from |M sr |. The size of redu is such that

|redu| = N nc k (n -k) (4.20)
where N nc is the number of non-carrier prediction errors calculated as:

N nc = N e -N c = N e (1 -P c ) (4.21)
Therefore, the maximum size of M s is given as:

|M s | = |M sr | -|redu| (4.22)

Encryption Step

During this step, each watermarked pixel p w ij is encrypted into p e ij using a stream cipher algorithm (noted E) initialized with the encryption key K e :

p e ij = E p w ij , K e = p w ij ⊕ k i (4.23)
where [k 1 , . . . , k i , . . . , k l×n ] is the secret keystream of bytes generated by the adopted stream cipher to encrypt the pre-watermarked image.

Data Hiding in The Encrypted Domain

This step can be made in a differed time. It enables a user to embed a message M e into the encrypted image pixels p e ij i=1,...,l,j=1...h without knowing its original content. In the sequel, M e corresponds to a sequence of bits {b j } j=1,...,q uniformly distributed. Let us consider C(n, k, d) the error-correcting code adopted by our RPEHS.(n, k, d)C acts on a block of k bits of input data to generate a codeword of n bits of output data. d is its minimum distance stating that the code C can detect (d -1) errors and correct d c = d-1 2 errors per codeword. In order to be able to correct the errors that will be introduced by this process in the clear domain, only d c pixels per each set of n image pixels that are modified/protected by our robust PEHS are modulated according to the following process for embedding M e . Firstly, the encrypted version of the N e pixels that are modulated by our robust PEHS for embedding M s are identified. Those pixels are then split into N s non-overlapping sets of N modc = n 2 pixels {I e i } i=1,...Ns . One bit b j of M e is then embedded by set I i as follows. I i is firstly divided into two subsets of N sub = N mod c /2 pixels, I 1i and I 2i , where I ki = I j ki j=1,...,N sub ,k=1,2 , I j ki represents the j th pixel of the subset I ki . b j is then inserted into each subset so as I 1i (resp. I 2i ) carries b j in the encrypted domain (resp. the clear domain).

Bit insertion in the encrypted domain b j is embedded into I 1i by substituting the LSB of the d th pixel I d1 1i by b j . The watermarked version I 1 wi of I 1i is given as follows

I 1wi = I j 1wi j=1,...N sub (4.24)
where

I j 1wi = I j 1wi = I j 1i if j = d1 I d1 1wi = 2 l d1 1i 2 + b j otherwise (4.25)
The choice of the rank d1 depends on the secret watermarking key K we . As a consequence, the extraction function f e we use in the encrypted domain in order to extract one bit from one encrypted watermarked pixel subset I 1wi is such that

b j = f e (I 1wi ) = LSB I d1 1wi (4.26)
Bit insertion in the clear domain b j is embedded into I 2i by modifying or not the LSB of one of its pixels according to the value of b j . More clearly, if b j equals 1, we modify the LSB of one randomly-selected pixel I d2

2i . In such a case, the watermarked version of I 2i , I 2wi , is given by

I 2wi = I j 2wi j=1,...N sub (4.27)
where

I j 2wi =    I j 2wi = I j 2i if j = d2 I d2 2wi = 2 I d 2 2i 2 + LSB I d2 2l otherwise (4.28)
The choice of the rank d2 also depends on the secret watermarking key K we . Rather, if b j = 0 , I 2i is kept unchanged:

I 2wi = I 2i .
The errors introduced by this insertion process into the LSBs of the decrypted version of I j 2wi , I j 2di , will give access to the message in the clear domain. Indeed, in the case where b j = 1 , one LSB of I 2i is modified for obtaining I 2wi . This implicitly commutes the corresponding bit of the pre-watermarked version of I 2i , and consequently introduces an error into I j 2di . Therefore, if an error is detected into I j 2di , the embedded bit is 1 , 0 otherwise. Regarding the embedding capacity in the encrypted domain, as mentioned above, in order to ensure recovering the embedded pre-watermark and the original image, only one bit of M e is embedded by set I i of N modc encrypted image pixels. Therefore, the maximum size of M e equals to the number of image sets:

|M e | = N s = 1 2 ( N e N modc ) (4.29)
Regarding the algorithm complexity, the proposed RPEHS does not require high computational complexity because it is based on simple algebraic calculations: Equations (4.3), (4.11), (4.12), (4.13), (4.14), (4.15), (4.25), and (4.28).

Message Extraction & Image Recovery

As mentioned previously, unlike the pre-watermark M s that can be only extracted from the clear domain, the message M e can be extracted in both encrypted and clear domains.

Message extraction in the encrypted domain

As during the insertion process (see Setion 4.4.4), after identifying the N mod pixels, those pixels are firstly split into sets of N modc pixels, {I wi } i=1,...,Ns according to K we . Each set I wi is then divided into two subsets of N sub pixels, I 1wi and I 2wi according to the secret watermarking key in the encrypted domain K we . Then, the extraction function f e (Equation 4.26) is used to extract from each I 1wi one bit of the message M e .

Message extraction in the clear domain

Extraction of the message M s & image recovery

In addition to the extraction of the message M s and the recovery of the original image, this step allows constructing a binary vector map V that indicates if there is an error in the image pixels or their prediction-errors, and consequently in the embedded pre-watermark W . We will see in the next subsection how this map will be used to extract the message M e .

Let us first detail how the message M s is extracted and the original image is reconstructed. To do so, the watermark reader computes the histogram of prediction errors of the decrypted image. As a first step, he corrects the prediction errors that fall in the 3 gaps, i.e.

[-2(∆ + δ), -2∆ - δ)[∪[-δ, 0[∪[2∆, 2∆ + δ[.
As the image modification is limited to the permutation of the image pixel LSBs, if a prediction error falls in a gap, this means that the LSB of its corresponding pixel is permuted. Therefore, to correct a prediction error êij of a pixel p ij that belongs to a gap, the extractor permutes the LSB of p ij and re-computes its prediction-error. This latter is then attributed to êij . Moreover, a bit '1' is attributed to V ij in order to indicate that the pixel p ij has been modified during the message M e insertion in the encrypted domain. After correcting the image prediction errors, the attacked version M of M is extracted. In fact, one bit mi of M is extracted from each carrier prediction error êij , êij ∈ [-2∆ -δ, 2∆[ as follows:

m i = 0 if êij ∈ [-∆ -δ, ∆[] 1 otherwise (4.30)
The extracted message M is then decoded using the adopted error-correcting code (see Equation 4.15). During this decoding step, if a message bit error is detected, this means that there an error in the pixel p ij . To correct it, the LSB of p ij is permuted. At the same time, 1 is attributed to V ij to indicate that there was an error in the pixel p ij . Meanwhile, knowing the non-carrier prediction-errors and the parameters of the error correcting code, the extractor can retrieve the size of the redundancy bits redu and extracts then it along with M s from the decoded and corrected value of the message M .

The next step consists in correcting the LSBs of the pixels that correspond to the non-carrier prediction errors. This is done based on redu. Again, note that when an error is detected in the LSB of a non-carrier pixel p ij , 1 is attributed to the binary map V ij . After correcting those LSBs, the non-carrier prediction errors are re-computed.

Finally, the original prediction error histogram is built by shifting back the prediction errors as follows:

e o ij =          êij + 2(∆ + δ) if êij < -2(∆ + δ) êij + δ if -∆ -δ ≤ êij < -δ êij -∆ if ∆ ≤ êij < 2∆ êij -2∆ -δ if êij ≥ 2∆ + δ (4.31)
Then, based on the knowledge of T min and T max , the extractor identifies the pixels that are pre-processed and corrects them by applying the reverse process.

Extraction of the message M e

The errors introduced into the embedded pre-watermark M by the insertion process of M e into the encrypted domain give access to M e in the clear domain. In fact, as explained in section 4.4.4, one bit of M e is embedded into each subset of pixels I 2wi by introducing an error within one of their LSBs. As the encryption algorithm used here is of stream cipher type, the modification of the LSB of one encrypted pixel implicitly commutes the corresponding bit of its decrypted version. Therefore, if one bit error is detected into the decrypted version I 2di of I 2wi , then b j = 1 , 0 otherwise. In order to verify if there are bit errors in I id , we exploit the binary map V produced by the previous step and the watermarking key K w e. Based on K w e, the N sub bits of V that correspond to the pixels of I 2di are selected {ζ i } i=1,...,N sub . The bit ζ i indicates that there is error in the LSB of the i th pixel of I id if its value equals 1 .

Therefore, a bit b j of M e is extracted as follows:

b j = 0 if i=1,...N sub ζ i = 0 1 else (4.32)

Experimental Results

These tests have been performed over several natural gray-scale images (an example of image data set in Figure 4.11) and medical image test sets issued from different modalities: 320 mammography images [START_REF] Suckling | The mammographic image analysis society digital mammogram database[END_REF] and over 100 ultrasound images (see Figure 4.12).

Capacity Rates

As already mentioned in Section 4.4.2, capacity rate in clear domain depends on the distribution of carriers in the image (|N c |), the shifting magnitude (∆) and the error-correcting code parameters (n, k). Note that experimental embedding capacities are equal to the theoretical ones as messages are only embedded in predefined locations and based on the used system's parameters (∆, n and k).

The selection of the value of ∆ actually depends on the distribution of the carriers and the noncarriers. In other word, it depends on the image properties. We give in Figure 4.13, the predictionerrors' histograms in "Airplane" and "Peppers" images. It can be seen that the distribution of the prediction-errors in "Airplane" is different from the one in "Baboon". In this later, the distributions of prediction-errors are close to each other whereas in Airplane, the histogram is significantly concentrated around 0. This can be explained by the fact that in image with more smooth areas, the consistency of the adjacent pixels in a local area is strong. Thus, higher accuracy predictionerror around 0 is obtained, and |carriers| >> |non-carriers|. As a consequence, ∆ can be of a small value. However, this is not the case for textured images where the shifting magnitude ∆ has to be of bigger value so as to be able to embed the redundancy bits of non-carriers and consequently extract M s and M e with no error and correctly recover the original image. This is can be experimentally confirmed. As given in Table 4.2, the watermarking capacity in textured images is lower than the one in images with more flat/smooth areas.

Furthermore, as given in Figure 4.14 with a larger value of the shifting magnitude ∆, a higher embedding rate in the clear domain can be ensured. For instance, the achieved capacities of M s are equal to 7857 and 40015 bits when ∆ = 2 and ∆ = 4, respectively. Note that only M s depends on the shifting magnitude ∆ whereas M e depends on the error-correcting code parameters and the image size. Let us now consider the impact of the error-correcting code parameters on the proposed approach. Figure 4.15 gives an idea about the effects of these parameters (i.e. n and k), on the watermarking capacity in both encrypted and decrypted domains. Obviously and as shown in Fig. 10, |M e | cr [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Coatrieux | A review of image watermarking applications in healthcare[END_REF] > |M e | cr [START_REF] Lokesh | Cloud based telemedicine in neurology clinics: A new horizon[END_REF][START_REF] Jr | Picture archiving and communication system[END_REF] but |M s | cr(7,4) < |M s | cr [START_REF] Lokesh | Cloud based telemedicine in neurology clinics: A new horizon[END_REF][START_REF] Jr | Picture archiving and communication system[END_REF] , where cr(.) corresponds to the error-correcting code function and |x| gives the length in bits of x. Hence, when n and k are of small values, our system is able to reach a higher embedding rate in the encrypted domain as one bit of M e is embedded into each block of n 2 pixels (see Section 4.4.4). But, in the clear (i.e. decrypted) domain, message embedding increases when k > d, or in other words, when the length of redundant bits decreases. Nevertheless these parameters should be adjusted in order our system remains robust against the embedding in the encrypted domain. images without decrypting the image. Figure 4.17 shows the encrypted and decrypted images of "Lena" image that were generated by the proposed RPEHS. Figure 4.17(c) is the watermarked-decrypted image, in which the PSNR value is of 41 dB and the SSIM is of 0.998. The reconstructed image is given by Figure 4.17(d), which is completely the same as the original image in Figure 4.17(a). As it can also be seen, there are no visible differences between the watermarked-decrypted image (in Figure 4.17(c)) and the original one (in Figure 4.17 For all test images, obtained values of SSIM and UQI are greater than 0.99 and 0.89, respectively, confirming the good quality of watermarked images [START_REF] Dosselmann | A comprehensive assessment of the structural similarity index[END_REF].

For medical images, the results reported in Table 4.4 are somewhat equivalent to those obtained for standard test gray-scale images. Both embedding capacity and introduced distortion increase with the increase of the shifting magnitude (∆). Beyond, the degree of the distortion in these images is small and does not endanger their diagnosis value. One can refer to the study on the impact of lossy image compression on medical images in [START_REF] Chen | Near-lossless compression of medical images through entropy-coded dpcm[END_REF], where it is reported that image Figure 4.15: Tests on "Airplane" image: Embedding rate in both encrypted and clear domains depending on the error-correcting code parameters where "1", "2" and "3" corresponds to the repetition code (3, 1), Hamming [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Coatrieux | A review of image watermarking applications in healthcare[END_REF] and Hamming [START_REF] Lokesh | Cloud based telemedicine in neurology clinics: A new horizon[END_REF][START_REF] Jr | Picture archiving and communication system[END_REF], respectively.

Capacity-Distortion Performance Comparison

In this Section, we provide some comparisons between the proposed method and different techniques from state-of-the-art that allow extracting the secret data and recovering the original image without any loss of information. We also selected 5 standard natural images which are "Lena", "Barbara", "Airplane", "Peppers" and "Boat" in order to evaluate their embedding rates and image distortion. As given in Table 4.2, compared to [START_REF] Zhang | Reversible data hiding in encrypted image[END_REF][START_REF] Zhou | Secure reversible image data hiding over encrypted domain via key modulation[END_REF][START_REF] Yin | Reversible data hiding in encrypted images based on multi-level encryption and block histogram modification[END_REF][START_REF] Wu | High-capacity reversible data hiding in encrypted images by prediction error[END_REF], our method achieves better embedding rate, especially when the test image contains less textured regions (e.g. boat and airplane). For instance, in Lena, M e -message available in both encrypted and decrypted domains -is of 1328 bits and M s (i.e. message available in the decrypted image) is of 21326 bits. In the case of Lena test image, the introduced distortion quantified with PSNR is of 39.8 dB that can be considered as an acceptable value while in [START_REF] Zhang | Reversible data hiding in encrypted image[END_REF] for example, 256 bits are embedded into the encrypted image and with a larger quality distortion (P SN R = 37.9dB). Note that all these techniques carried the message in only one domain; i.e. the message can be extracted from either the plain-text image or the encrypted one. For example, in [START_REF] Wu | High-capacity reversible data hiding in encrypted images by prediction error[END_REF], data extraction must be carried out before image decryption so as to be able to decrypt the image and recover its original version.

Discussion & Possible Applications

If we consider the scenario given in Figure 4.18 where a content owner outsources certain images, already encrypted and pre-watermarked, to a cloud server, this later -who is not granted to access to the image content -can verify images' reliability and at the same time, embed into the encrypted images some additional data (e.g. image owner and her/his identifiers, time stamps). On the other side, images can be downloaded and decrypted by a legal user holding the decryption key. Hence, original image content can be recovered without any error after image decryption and message extraction processes using the secret watermarking key. Notice that it is very important to extract the additional data (M e ), embedded by the cloud server, from the decrypted images in order to trace the data. This can be helpful in case of illegal redistribution or of image content falsification.

Similarly, the embedded pre-watermark in the clear domain by an authorized user (M s ) are used to control the reliability of data and trace them.

The proposed scheme can be used in different applications. For instance, in healthcare, medical data are required to be reliable so as to be used in complete trust by the practitioner for diagnosis or therapeutic purposes. Non-reliable data should be rejected by the medical information system [START_REF] Coatrieux | Relevance of watermarking in medical imaging[END_REF]. In this case, if the purpose of the healthcare application is just the verification of data authenticity (i.e. embedding of the patient ID and/or image ID) then the capacity requirements are not so important. But, if the purpose is to allow various security services ranging from integrity to traceability, then the capacity needs substantially increase. Fortunately, the offered capacities, in both domains, are large enough compared to the requirements for verifying image reliability (i.e. authenticity and integrity control) that we estimate less than 1 Kbits (i.e. a digital signature provided by the SHA-1: 160 bits and one authenticity code AC: 600 bits by combining the French National Identifier with the DICOM Unique Identifier [START_REF] Coatrieux | Watermarking medical images with anonymous patient identification to verify authenticity[END_REF]).

Consequently, we opted for the embedding, in both domains, of a message composed of the identifier of the image origin along with a digital signature; an integrity proof so as to be able to determine whether the image has been modified during its transmission. So, the message available either in the clear or encrypted domain, T , is such that:

T =< AC RSA Kpr (H(f (I)) > (4.33)
where: '||' is the concatenation operator, H corresponds to the SHA cryptographic hash function, f (.) is a function that identifies pixels that will not be modified by the watermarking process, RSA is the well-known asymmetric encryption algorithm parameterized with the private key K p r of the image provider. In the following, we will discuss the security of this scheme in terms of confidentiality and reliability. We first start by analyzing our method considering cryptographic attacks; which aims at breaking data confidentiality, and then focus on watermarking attacks.

In this work, encryption operations are performed using the Trivium algorithm. Trivium offers a security level of 80 bits. Because we only exploit its semantic security, there is no access to private parameters like private key and user's data. Indeed, even if K we or m e are known by the attacker, he/she has no additional means than a regular cryptographic attack to get K e or to have an idea about the clear image content.

There exist different types of watermarking attacks: unauthorized detection/extraction of messages, unauthorized embedding, and unauthorized removal attack. In both encrypted and clear domain, the message embedding and the reliability verification of the image depend on the corresponding watermarking keys K we or K ws . Without the knowledge of these secret keys, it is extremely difficult for an attacker to know the image partitioning and to distinguish the bits of messages from the others. Even though the attacker has an idea about the message structure, he/she can only try an exhaustive search until he/she finds a valid message; which does not mean that it corresponds to the image. Furthermore, as our scheme is fragile, if the attacker tries to modify arbitrarily or falsify the watermark, an alarm will be raised in both encrypted and clear domains thanks to the message M e and M s that will be altered too. Hence, valid messages should then be present in all images in their clear and encrypted domains to ensure the image reliability.

Conclusion

In this chapter we have presented a new lossless watermarking scheme that gives access to different watermarking-based security services in both encrypted and clear domains and allows the errorfree reconstruction of the original image. In fact, it allows the embedding, in the encrypted image, of a message that will be accessible from both clear and encrypted domains. The originality of our proposal stands on the insertion of a robust pre-watermark in the image before its encryption, that will make the message embedded in the encrypted image accessible from the decrypted image and makes the insertion/extraction processes independent of the encryption/decryption processes, and vice versa. Experimental results show that the achieved capacities in both domains are large enough to support various security services.

As noticed, in reversible watermarking schemes once the watermark is removed, the image is unfortunately no longer protected as for cryptography. That is why non-reversible watermarking is of high interest. However, embedding a watermark into a medical image, in an irreversible manner, can unfortunately sometimes introduce, or hide pathology. The consequences of this risk are not negligible, as they concern an individual and his health. That is why we propose in the next chapter to evaluate the introduced quality degradations caused by watermarking in order to identify a range of watermarking parameters that could preserve the image diagnostic and visual quality.

Chapter 5

Assessment Protocol of Watermarking Impact on CT Images

As mentioned earlier, the choice of watermarking scheme depends on tradeoff in-between different properties so as to respond the intended application, and the pursued security purposes by just focusing on the three main basic properties: watermarking capacity, robustness and imperceptibility. For instance, if data authenticity and traceability are of major interest in an application framework where an attacker could falsify the data so as to break its protection, the watermarking scheme should be robust against such a modification in order to ensure the correct detection/extraction of the embedded message. Considering another example, where watermarking is used to control data integrity with the ability to detect, localize and restore tampered parts of the image, such an application will need huge watermarking capacity. These both situations will obviously have an impact on the watermark imperceptibility. As said in Chapter 1, imperceptibility is very important for medical images as these later hold decisive information about patient's health. Thus, watermarking should not compromise the image interpretation. Defining the acceptable amount of distortion that can preserve the diagnosis accuracy of the watermarked image is a complex problem and one of the main issues in the deployment of watermarking in medical imaging.

Medical image quality can be assessed and analyzed depending on two criteria [START_REF] Jasni M Zain | Clinical evaluation of watermarked medical images[END_REF]: fidelity and intelligibility. The former one corresponds to the perceptual similarity between the watermarked and the original images. The latter relies on the preservation of the same diagnostic interpretation of the image. These two metrics demonstrate the complexity of such assessment that requires the intervention of radiologists. At the same time, the automatization of watermarking distortioncontrol is also an open debate. If solutions based on psychovisual masking exist for watermarking of general public images (i.e. natural images), no equivalent approach has really been proposed for medical imaging data or even for simulated medical images such as phantom database [START_REF] Özdemir | Investigation of ballistic gelatin based phantom models for computed tomography, x-ray and ultrasound imaging devices[END_REF]. Nevertheless, one can refer to the work of Karasad et al. [START_REF] Karasad | Watermarking of radiographic images based on quantum noise modulation[END_REF] that allows hiding a watermark in the sensor noise of X-Ray images. However, this method is fragile due to the fact that sensor noise is of low amplitude. There is thus an interest to develop a solution that better controls image distortion in order to increase watermark robustness and/or capacity.

Assessment of the quality of watermarked images is performed by means of both objective and subjective measures. Objective metrics are based on the use of quantitative quality measures (e.g. PSNR, SSIM, UQI) and have often been used in medical image watermarking literature. However, whether an objective measure on image quality is efficient or not, it depends strongly on its accordance with subjective measures. These later are run by a group of radiologists who rate the diagnostic quality as well as the visual quality of the watermarked image so as to assess the legal risk of medical image watermarking. Unfortunately, this type of studies is difficult to arrange [START_REF] Liu | The current role of image compression standards in medical imaging[END_REF]. It is complicated to give a standard amount of distortion. Indeed, this amount does not only depend on the watermarking technique, but also on the image characteristics being studied that is to say: the acquisition modality and its parameterization, the anatomical object, the different expression of the possible lesions that could be seen, and so on. Furthermore, this type of study is time-consuming and expensive. That is why few subjective quality assessment methods of medical images have been done in literature and most of these studies [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF][START_REF] Chen | Near-lossless compression of medical images through entropy-coded dpcm[END_REF][START_REF] Nouri | Evaluation subjective de la qualité de vidéos encodées MPEG2 dans un contexte de télé-robotique chirurgicale[END_REF][START_REF] Chetouani | Vers un système d'évaluation de la qualité d'image multi-critères[END_REF] evaluate the distortion caused by lossy compression techniques and, to the best of our knowledge, only two studies [START_REF] Jasni M Zain | Clinical evaluation of watermarked medical images[END_REF][START_REF] Coatrieux | Strict integrity control of biomedical images[END_REF] are done to assess the quality of watermarked medical images.

In this chapter, we are interested in measuring the impact of the watermarking process on the diagnostic quality and thus on the interpretation of the medical watermarked images. To do so, we implemented a subjective study protocol that first aims to provide an optimal watermarking parameter that will ensure the preservation of diagnostic information in all watermarked image data-set. More clearly it attempts to quantify the level of loss that may be acceptable. Second, it relies on the determination of a link between subjective and objective measures so as to control the image distortion cause by one watermarking modulation. As stated above, for practical reasons and to reduce the complexity of such a study, this one is limited to lung thoracic CT images encoded on 16 bits as well as to the LSB substitution watermarking modulation. In order to more reduce the number of tests and limit the study to a small number of radiologists, this work was conducted in several stages. In a first, we carried out two pre-studies which aim to reduce the range of watermarking parameters' values. The first pre-study aims at identifying the "maximum" watermarking parameters not to exceed, on the basis of objective measurements in comparison with the results of the Canadian Association of Radiologists (CAR) (study on lossy compression of thoracic CT images [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF]). The second pre-study consists in a subjective experiments where IMT Atlantique and MEDECOM staff -non-experts persons -are invited to assess the visual quality of the watermarked images and identify a subset of "threshold values" of watermarking parameters most likely to introduce visible distortion into the image in order to limit duration of tests with radiologists to this range of values. The last stage thus corresponds to the subjective study with experts so as to evaluate both diagnostic and visual qualities of watermarked lung thoracic CT images. Unfortunately, this stage has not yet been started due to the unavailability of radiologists and time constraints.

This chapter is divided into four parts. In the first part we detail what is a subjective image quality assessment. In the second part, we will identify the chosen image test set, and the selected watermarking method. The third part deals with both objective and subjective pre-studies so as to identify the range of watermarking parameters' values that will be adopted by the subjective study with radiologists. Furthermore, a link between subjective pre-study results and objective quality measures is determined so as to quantify the level of information loss that may be acceptable. The last part is however only devoted to the definition of the operational implementation of the subjective quality assessment study because the results of tests with radiologists are not available.

Subjective Quality Assessment of a watermarking scheme

To analyze the visual and diagnostic quality of a medical image, experts have to assess the diagnosis legibility on a particular set of images. Radiologists have to do this task in adapted conditions, similar to those applied during clinical routine, allowing them to observe all the necessary details. This type of evaluation is desirable but of large complexity of implementation and costs (duration of tests, availability of experts, equipment, etc.). The number of images used and of radiologists participated in the study must be sufficient for a statistical evaluation. For instance, images must be evaluated by at least three experts selected from amongst senior radiologists specialized in the analysis of the organ being studied [START_REF] Cavaro-Ménard | Quality assessment of lossy compressed medical images[END_REF]. That is why, we find few subjective quality assessment studies [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF][START_REF] Nouri | Evaluation subjective de la qualité de vidéos encodées MPEG2 dans un contexte de télé-robotique chirurgicale[END_REF][START_REF] Chetouani | Vers un système d'évaluation de la qualité d'image multi-critères[END_REF]. Most of them evaluated the impact, on medical images' visual and diagnostic quality, of the loss of information caused by lossy compression and, more rarely, by watermarking. regarding lossy image compression, one can refer, for example, to the study realized by the Canadian Association of Radiologists [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF]. It published a standard to validate the use of lossy compression under certain conditions and for specified examination types. For instance, they recommend compression ratios of 15:1 using JPEG and JPEG2000 on chest CT and from 10:1 to 15:1 on body CT images. These recommendations were based on data collected during a large-scale study done by 100 radiologists across Canada, on 23 different sessions, of 60 to 80 images for each session. To the best of our knowledge, only two works [START_REF] Jasni M Zain | Clinical evaluation of watermarked medical images[END_REF][START_REF] Coatrieux | Strict integrity control of biomedical images[END_REF] focused on the evaluation of the impact of the distortion introduced by watermarking in medical images. [START_REF] Coatrieux | Strict integrity control of biomedical images[END_REF] is a subjective study that aims at establishing the link between the visibility of the watermark embedded in the Region of Non-Interest (RONI) -the black background of MRI images in this case -the interference it can induces for image interpretation. Indeed, even if the watermark is located in the black background of the image, the change of the background gray-scale, making it clearer for instance, may be uncomfortable or "non-natural" for physicians. The objective of this study is thus to determine distortion threshold to satisfy while inserting a robust watermark in the DCT domain. The study done in [START_REF] Jasni M Zain | Clinical evaluation of watermarked medical images[END_REF] showed that ROI (Region Of Interest) can also be an area for watermarking without altering the clinical diagnosis. This study was done by three radiologists on 21 X-ray, 27 CT and 27 ultrasound images watermarked based on the LSB modulation. Experts were then asked to comment the images' quality and to give a clinical diagnosis for each image in order to compare it with the original one. The results of this study have shown that LSB watermarking modulation applied to various medical images in both ROI and RONI is possible and preserves image quality for clinical purposes. To sum-up, as shown, these subjective studies are expensive and time-consuming as they require large image dataset and many experts to conduct these researches.

Although, because of the lack of bibliographical references on this subject, a current approach that consists in comparing the level of distortion introduced by a watermarking method to the one caused by lossy compression is of interest. The underlying assumption is to consider that both watermarking and compression induce a similar information loss. By doing so, it becomes possible to take advantage of the subjective studies like the one conducted by the Canadian Associations of Radiologists. Notice also that it has never shown that such hypothesis is valid.

In this chapter, we hence propose to evaluate the imperceptibility of the watermark embedded into the image according to the observations of experts so as to define the amount of distortion accepted that could preserve the diagnosis accuracy of watermarked images. However, some critical points have to be taken into account for the deployment of such an evaluation protocol:

• Selection of image test set -the nature of medical image is very diverse, even when the modality and organ are restricted. Furthermore, conducting large-scale studies with radiologists for researches is thus highly impractical, time-consuming and expensive. It is indeed very complicated to gather different images to define a standard amount of distortion caused by watermarking enabling us to judge the result on all medical images issued from the various modalities, for a given organ and pathology. Hence, the choice of the test image data set will be linked to a limited and specific modality and pathology at the same time.

• Variability of the evaluators (i.e. the experts) -an evaluation protocol depends not only on the skill level of the radiologists, but also on their practice and the conditions under which the evaluation is conducted. It is highly recommended that the evaluators are specialized in the analysis of the organ and the pathology being studied. Moreover, the more motivated the radiologists are on the watermarking subject, the more efficient and productive the evaluation will be.

• Conditions of the evaluation -in order to avoid drifts during the statistical analysis of the subjective evaluation, the conditions of observations during the tests must be standardized and remains close enough to the conditions of real medical clinical practice. Indeed, any change may bias the analysis of test results. For example, changes of contrast and/or luminosity as well as zooming are not allowed. The same observation parameterization as during first image interpretation will be considered. Moreover, environmental conditions (e.g. an ambient room light less than 5 lux [START_REF] Christianson | An improved index of image quality for task-based performance of ct iterative reconstruction across three commercial implementations[END_REF], observer-screen distance of 1m) have to be the same for all evaluators. We will come back on these elements in Section Therefore, all these conditions make the subjective study time-consuming, expensive and "unique" due to the fact that it focuses on analyzing one specific pathology using one image modality.

Materials And Methodology

The Choice of Image Modality and Organ to be Studied

In this study, we were interested in evaluating the visual and diagnostic quality of thoracic Computed Tomography (CT) scans for lung cancer diagnosis purposes (i.e. detection of nodules); a use-case proposed by the CHU Grenoble-Alpes' (CHUGA) radiologists who have strong expertise in the domain.

Lung cancer is the most commonly occurring cancer in men and the third most commonly occurring cancer in women worldwide [START_REF] Soerjomataram | Global cancer statistics 2018: Globocan estimates of incidence and mortality worldwide for 36 cancers in 185 countries. ca cancer j clin[END_REF]. France had the 13 highest rate of lung cancer in 2018. The French public health body and the French national cancer institute have reported that the rate of lung cancer among women has increased by 5 % every year since 1990, and now 45% of all cancers among women in France are lung cancer and in men, lung cancer is the main cause of death. For patients with lung disease, chest CT is especially effective to assess disease progression or treatment response. Basically, the diagnosis of lung cancer in CT scans consists in the detection and interpretation of lesions in the form of pulmonary nodules within the CT data. These nodules will show up as a spot that are roughly spherical with round opacity and a diameter of up to 30 mm. After the identification of lung nodule, the radiologist will look at its size, shape, and general appearance. Lung nodules are usually about 3 millimeters to 30 millimeters in size. A larger lung nodule, of 30 millimeters or larger, is more likely to be cancerous than is a smaller lung nodule [START_REF] Nishio | Computer-aided diagnosis of lung nodules: Systems for estimation of lung cancer probability and false-positive reduction of lung nodule detection[END_REF]. In such a context, it may be possible that the watermarking masks nodules, introduces, or even changes their sizes. Hence, "lung thoracic CT scan" can be a representative example. A lung thoracic CT image is given in Figure 5.1.

Watermarking Technique

As mentioned above, we opted for Least Significant Bit (LSB) substitution watermarking modulation applied to pixels, for different reasons:

-It is the simplest method to implement, to embed and extract a message into an image.

-We have adopted this watermarking modulation for all our proposed protection schemes.

LSB substitution modulation is a watermarking technique that has been presented in Chapter 1 Section (1.3.1). To avoid problems of notation we propose to recall it here in detail. It consists in substituting the β least significant bits of each pixel P i of an image of depth d by a sequence of bits of the message m to be embedded. β corresponds to the watermarking strength (where 1 ≤ β ≤ d). As a consequence, the watermarked version P w i of the i th pixel P i in the image is given by:

P w i = P i 2 β • 2 β + β-1 k=0 m j+k 2 k (5.1)
where m j is the j th of the message m.

In order to extract the message, the watermark reader has to read the β LSB(s) of the watermarked image pixels P w i . To increase the detection difficulty of the message, a secret key can be used to control the location into which the message is going to be embedded. But in this study, all bit-planes will be considered. Figure shows the impact of LSB substitution watermarking modulation in case of lung thoracic CT images for different values of β. As seen, the watermark is not necessarily visible. Also, for an insertion strength = 6, the texture in the image appears more contrasted than in the previous images. It is therefore necessary to determine for which values of β, the watermark remains invisible and does not alter the structures of the image or other information essential for the interpretation of the radiologist.

Objective and Subjective Pre-Studies

As mentioned above, in order to limit tests with radiologists, a pre-study is done before. The prestudy includes two stages: an objective and a subjective selection of the watermarking parameters.

Objective pre-protocol: preselection of the watermarking parameters

The goal of this first pre-study is to make a preselection of the watermarking parameters (i.e. the watermarking strength β) that will be respected by next in the subjective pre-study with MEDECOM and IMT Atlantique staff (security team), i.e. non-expert assessors. We conducted this task objectively on the basis of the Canadian Association of Radiologists (CAR); i.e. a subjective study for lossy JPEG2000 compression for CT images [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF].

Our idea is to pre-select watermarking parameters; i.e. the values of the watermarking strength β of the LSB substitution watermarking modulation, based on an objective comparison between the distortion introduced by watermarking and lossy JPEG2000 compression by means of several image quality measures. More clearly, we will only keep watermarking parameters' values that induce an objective distortion closer to the one induced by lossy JPEG2000 and considered as allowable by CAR. This later has shown that a JPEG2000 compression ratio of 1:15 can be performed without compromising the diagnostic value of the lung thoracic CT image. We decided not to consider JPEG compression as it is less efficient than JPEG2000 in terms of image quality preservation/compression rate compromise.

In this study, we opted for the following quality objective measures:

• PSNR (Peak-Signal-to-Noise Ratio) [START_REF] Hore | Image quality metrics: Psnr vs. ssim[END_REF] -it is one of the most used metrics for assessing the perceptual quality of the watermarked or decompressed image. PSNR is a good criterion when the distortion is uniformly over the whole image. But, if this hypothesis is not verified, it is better to use other quality measurements. PSNR is defined as: • UQI (Universal Quality Index) [START_REF] Wang | A universal image quality index[END_REF] -it has been designed to model any image distortion as a combination of three factors: loss of correlation, luminance distortion and contrast distortion: • SSIM (Structural Similarity) [START_REF] Hore | Image quality metrics: Psnr vs. ssim[END_REF] -it is an objective metric for assessing perceptual image quality, working under the assumption that human visual perception is highly adapted for extracting structural information (e.g. texture, edges) from a scene. Quality assessment is thus based on the degradation of this structural information. To do so, SSIM separates the task of similarity measurement between the original image and its distorted version into three comparisons: luminance l, contrast c and structural information s.

U QI (I, I d ) = 4cov II d µ I µ I d σ 2 I + σ 2 I d µ 2 I + µ 2 I d (

SSIM (I, I

d ) = l (I, I d ) c (I, I d ) s (I, I d ) = (2µ I µ I d + c 1 ) (2σ I σ I d + c 2 ) (2cov I d + c 3 ) µ 2 I + µ 2 I d + c 1 (σ 2 I + σ 2 I + σ 2 I + c 2 ) (σ I σ I d + c 3 )
(5.5) where c 1 , c 2 and c 3 are constants used to avoid instability when the denominator might approach zero. "Do you notice any difference between the two images?" with as expected answer: "yes" or "no". We do not wish to have an ambiguous answer.

Experimental design

We describe here the implementation of this pre-study. It has been established in such a way that the duration of a test remains less than 45 minutes per observer. This "time" factor has not been mentioned before, but it is important for several reasons: it is directly related to the attention or the fatigue of the observers on the one hand and to their availability, on the other hand. Other points were also considered in the development of this pre-protocol. We review them in the following.

Image test set -A test database has been created from the public database [START_REF] Samuel | Data from lidcidri[END_REF]. This test base consists of 20 16-bit depth images of lung scanners, issued from 20 different patients. These images have been acquired according to standard clinical procedures and issued from two different acquisition systems: TOSHIBA and General-Electric (GE) MEDICAL SYSTEM.

These images were chosen by a PhD student, having received no training in medical imaging, according to several criteria:

• Image visual quality (+: poor quality, ++: acceptable quality, and +++: good quality);

• The presence or not of a pathology (i.e. presence of nodule(s)≥ 3mm;

• The number of nodules of size ≥ 3mm.

More details are given in Table 5.3.

Analysis biases

Several biases can affect the statistical analysis of results. Herein, in order to avoid and limit such biases, the most obvious ones are discussed.

• Bias related to the test environment: This bias can be related to several environmental conditions that we distinguish in two classes:

-Viewing conditions -the room lighting as well as the distance between the screen and the observer plays an important role in the perception of a stimuli. For example, high lighting can dazzle the observer and thus alter his perception. Similarly, the light color in the room can influence the perception of certain shades of gray in the test images.

-The screen -its calibration should not be modified during the test; otherwise the displayed colors may differ from the original stimulus. Zooming and windowing parameters' modification are also not allowed.

To minimize the effects of environmental bias, the tests should be performed under the same conditions for all observers.

• Bias related to the observer : in our case, the observers are of distinct age and experience. Different other factors can influence their answers:

-Psychological factors -they can be at the origin of a difference of perception. The interpretation of an image is closely related to the degree of concentration of the observer. Also, access to the image without any prior information on the watermarking strength can influence the interpretation of the image.

-Understanding of the study objective -the watermarking concept can be abstract for people outside the domain. An observer may thus imagine distortions even if the images have not been watermarked or these distortions are not visible.

To limit these biases, the test should start with an introductory session allowing the observer to better understand the objective of purpose of the test and the protocol to be followed.

• Bias related to image test set: For each original image, its watermarked versions are presented in a random manner. More clearly, watermarked images are not presented according to the embedding strength (sorted in ascending or descending order). Also, watermarked images related to the same image are not displayed in a successive way. More clearly, we do not display the same image when moving from one image to another in order to not to avoid the bias of remembering a specific condition.

The number of the original images used in this test may result in low representativeness of the results. However, as the test is based on a comparison between an original image and its 5 watermarked versions, increasing the number of watermarked images for an original image with a finer discrimination of the embedding strengths' space require a high and sustained concentration of observers and could impair the test quality.

Test environment -In order to avoid drifts during the statistical analysis of results, this subjective pre-study took place in SePEMED laboratory, under similar conditions to clinical practices. Images were presented using MedMammo 4.0.0 64-bit software from the Medecom Company on a Dell diagnostic workstation with a NEC 23" LSD -MultiSync P232W screen. Note that The contrast, zooming and windowing parameters are correctly calibrated in advance according to the preset values of the original image interpretation (for example, windowing factors of the used image dataset are of (Window Level, Window Width) = (-600, 1600), zoom = 100%) and have not to be modified during the experiments. Furthermore, watermarked images are always displayed to the right of their original versions.

Watermarked image dataset and display -The adopted watermarking method, i.e. the LSB substitution modulation, depends only on a single parameter, which is the embedding strength β (see Section 5.2). In this pre-study, we use the values retained from the objective pre-study, seen previously, that is to say for β values = {2, 3, 4, 5, 6}. 20 images are considered and watermarked with 5 strengths, leading to a set of 100 pairs of watermarked/original images, a number of the overall data used in the experiments sufficient enough for a statistical evaluation (minimum of 30 according to [START_REF] Ferrer-Roca | Handbook of telemedicine[END_REF] and [START_REF] Cavaro-Ménard | Quality assessment of lossy compressed medical images[END_REF]). Each observer will be asked to compare an original image to one of its watermarked versions, where both images are displayed side by side on the same screen, and to answer the question given above. Watermarked images with distinct embedding strengths β will be randomly presented to the observer. A random ordering of the watermarked images brings more robustness to the results of this pre-study.

The observers -The tests were carried out by 6 IMT Atlantique and MEDECOM staffs as given in Table 5.4. Most of the observers have acquired experience in medical imaging.

Information to the observers -Before running the test, observers have received the same information about the objective of the test they would achieve. The idea is to ensure that all the readers receive the same instruction. Here is an example of the test provided for the test:

"Image watermarking is a protection technique that consists of inserting a message (e.g. security attributes, digital signature) by modifying the pixels' gray values of the image. Due to these modifications, distortions are introduced into the watermarked images. We then want to study the impact of these distortions on the radiologist's diagnosis (i.e. diagnostic quality). The test consists of comparing watermarked images of lung scanners (displayed on the right) to their original versions (displayed on the left). Each original image has 5 watermarked versions whose embedding strength (i.e. the level of distortion) varies. The observer has thus to identify images watermarked with a visible distortion compared to their original image. Note that it is not allowed to modify the display parameters (zoom and windowing)."

Figure 5.2: the percentage of observers who perceive a difference between one or more watermarked images and their original image according to the embedding strength β.

Test results

The following analysis is based on direct interpretation of test results as well as on some statistical data analysis methods.

Let us recall that the objective of this subjective pre-study is the identification of the values of the embedding strength (i.e. watermarking parameters) from which the watermark -or in other words the distortion caused by the watermark -becomes visible or is perceived by the observers. We will use these results to select the embedding strengths that will be subsequently used in the subjective study with the radiologists.

Observers' answers

Six observers participated in this test. Each of them was asked to compare an original image to one of its watermarked versions chosen randomly and to indicate if he/she sees a difference between them: '1' if so, '0' otherwise. Table 1 in the appendix provides the responses of the observers. Remember that for an original image, we have a sequence of five watermarked images. Therefore, for twenty original images, we have one hundred separate pairs. According to the duration of tests with the observers, as given in Table 5.5, the average duration of the test is of about 34 minutes/observer.

Watermark visibility

We are interested in determining the watermark visibility level according to the watermarking As mentioned above, the image display, i.e zoom, windowing, for the original images and their watermarked versions cannot be modified by the observers. We give in Figure 5.2, the percentage of observers who perceive a difference between one or more watermarked images and their original image according to the embedding strength. This percentage increases as expected with the level of watermarking strength. The perception rate of the mark for the level of distortion β = 3 is very low (rate ≤ 0.1) and for β = 2 is null.

In Figure 5.3, the average rate of detection for each embedding strength level on all the images is plotted for each observer. As it can be see, all the observers can notice a difference between the original and its watermarked version at level β=6. As it can be also noticed, the observers O 3 , O 4 , O 5 , O 6 can detect the distortion at level β=5, for 100% of images, O 1 and O 2 differentiate between 85% and 95% of images watermarked with β=5 from their original versions, respectively. According to images watermarked with β=4, as it can be seen, observers hold scattered opinions. Sometimes, they can detect the watermark and sometimes they cannot. O 2 , O 3 and O 4 detect the watermark in 50 % of watermarked images at this level, and O 5 , O 6 in 40% of them. O 1 perceives a difference in only 20% of images watermarked at level β=4. Note that O 1 is the most experienced of our observers (an engineer with over 13 years of experience). One can thus think that the experiment is a discriminating element between observers. Table 5.6 give the correlation coefficients of PEARSON between all the observers. Basically, two observers whose answers are close should have a correlation factor close to 1. As it can be noticed, the answers of all observers are close and correlated between each other, especially between O 2 and O 6 and between O 5 and O 6 . O 1 and O 5 are the less correlated than others. As already mentioned in Table 5.4, O 1 and O 5 correspond to the most and least experienced observers, respectively. This can make of the level of experience a discriminating factor. Also, it is likely that the discriminating factor is a level of visual acuity. This hypothesis remains to be verified.

On the basis of these results, it seems relevant to test with radiologists the insertion strengths β = {4, 5, 6}, which are in the transition zone "the watermark is invisible, the watermark is visible" for non-specialist observers. We selected embedding strengths that make a watermark visible in the image in order to determine whether a low image visual quality has some impact on the image diagnostic quality.

Link between objective and subjective results of the pre-study

Even though the subjective study with the radiologists has been postponed to 2020, due to the unavailability of radiologists, based on the previous results, we think it is possible to establish a link between objective measures and subjective test results. As for β 1 = 4 (i.e. four bit planes watermarked), observers sometimes see a difference between the watermarked and original images and for β 3 = 6, they always detect the watermark. If objective measurements are coherent whatever the test images, one can use these values so as to determine embedding strength threshold not to exceed.

We give in Table 5.8 the objective measures obtained on our image test dataset. As it can be seen, the image distortion evaluated in terms of PSNR; UQI; SSIM; MSSIM and NQM, and introduced by the substitution modulation of LSBs at level β 1 = 4 is very close to or lower than the distortion introduced by lossy JPEG2000 compression as previously demonstrated (See Section 5.3.1). As a consequence, one can conclude that, in case of LSB watermarking modulation, the measurements of the distortion caused by watermarking up to the four least significant bit planes can be considered as threshold values not to be exceeded in order to better preserve the visual image quality. These threshold measures are given in Table 5.7.

To go beyond, we propose to see whether the distortions induced by our JWC and JWEC (presented in Chapter 2 and 3, respectively) schemes remain below these threshold values. As it can be seen in Table 5.8, these distortions respect the threshold values given in Table 5.7 and are so much lower that the ones induced by lossy JPEG2000 with a compression rate = 15:1 and by image watermarking up to level β 1 = 4.

Quality Assessment Protocol of the Subjective Study

The objectif of this study is to identify the embedding strength that can be used without compromising the "diagnostic value" of the image. Due to the modesty of our means, this study will at most allow us to identify the threshold value of the watermarking parameter β from which radiologists detect a difference between an image and its watermarked version in the case of Least Bit substitution watermarking modulation applied on CT medical images. As previously said, one use-case has been identified by CHUGA (CHU Grenoble-Alpes) radiologists as particularly relevant for a study of this type: the detection of pulmonary nodules in lung thoracic CT scans. Lung cancer is the most common type of cancer in the world (1.8 million new cases in 2012), and the most deadly (1.59 million deaths) [START_REF]du cancer, globocan : Lung cancer estimated incidence, mortality and prevalence worldwide in[END_REF] because it is most often discovered at an advanced stage. The lesions in chest scanner slices are of the order of a few millimeters. Their detection and characterization requires a thorough reading of the images that can be impacted by a degradation of the image quality or changes of texture.

A β 0 β 1 β 2 β 3 Radiologist B β 3 β 0 β 1 β 2 Radiologist C β 2 β 3 β 0 β 1 Radiologist D β 1 β 2 β 3 β 0

Operational implementation

The definition of such a subjective protocol depends on several points, such as the number of images to be watermarked according to the previously selected parameters, the test environment, the choice of questions to ask the radiologists and, the observers (in this case the radiologists).

Image test set

A test database has been created from a database already acquired for the npUBD study (i.e. a study done in CHUGA). This test image set base consists of 64 16-bit depth images of lung scanners, issued from 50 different patients. A ratio of approximately 50% of "normal mini-examinations" (absence of nodules) and 50% of "abnormal mini-examinations" (presence of nodule ≥ 4mm will be respected.

Image watermarking

In this study, as in the above, the LSB modulation is considered parameterized by the embedding strength values retained from the subjective pre-study, seen previously, that is to say for β values = {4, 5, 6}. Notice that β = 0 refers to a non-watermarked image. The adopted watermarking strengths are thus β = {β 0 , β 1 , β 2 , β 3 } = {0, 4, 5, 6}.

For each of 4 radiologists who should participate to the test, a «mini-examination» database of 64 images is created, where:

• 64/4 non-watermarked (β 0 ) «mini-examinations»,

• 64/4 « mini-examinations » watermarked with β 1 ,

• 64/4 « mini-examinations » watermarked with β 2 ,

• 64/4 « mini-examinations » watermarked with β 3 .

Each image (watermarked or not) of the mini-examination is only displayed once for each reader (see Table 5.9), ensuring thus the reading of the entire watermarked image test set.

Test environment

The tests will be done by respecting the following experimental conditions:

• The used screen will be one of those used for diagnosis in clinical routine,

• The contrast and luminance parameters will be correctly calibrated beforehand,

• The experimental conditions have to be identical for each expert reader (e.g. brightness of the room, distance between the reader and the screen).

Test

To avoid any reading bias, the "mini-examination" database will be presented to the radiologist randomly and blindly, that is to say that the radiologist does not know neither the embedding strength applied to the image nor its original diagnosis. Experts will hence be asked to answer the following answers: a) In this image, do you identify the presence of nodule(s) ≥ 4mm and not calcified?

The answer has to be: yes, no or I do not know.

If yes: i) You have to determine the number of nodules in the image and to localize them.

ii) You have to identify the characteristics of each identified nodule.

b) How do you subjectively evaluate the quality of the image?

Only one answer can be chosen from the following ones:

• Excellent image quality: distinct anatomical details, absent or minimal noise.

• Good visual image quality without altering the diagnostic quality: clear anatomical details, moderate increase in noise but not affecting the diagnosis.

• Not diagnosable.

Unfortunately, due to time constraints, the tests with the radiologists have not yet been started. Nevertheless, we can identify some statistical data analysis methods that can be used to interpret the answers of radiologists for these questions. For instance, diagnostic accuracy (Question a, a.i and, b) can be assessed by comparing rater Sensitivity [175] (e.g. in terms of number of nodules in the image) and the Specificity (proportion of normal images -images without nodules -correctly identified) across the image test set watermarked with different embedding strengths β. According to the morphological feature of the nodules (Question a.ii), the concordance of the variable "density of the nodule" can be evaluated using the Cohen's Kappa coefficient [START_REF] Mchugh | Interrater reliability: The kappa statistic[END_REF].

Conclusion

Watermarking does not leave original medical image unimpaired. It is therefore necessary to evaluate such degradations. Our objectives were thus twofold. The first was to verify that, for lung thoracic CT images, a loss of information related to watermarking is tolerable. The second objective was to identify the watermarking parameters that can be used without any signification reduction of the visual and diagnostic quality of the image. Notice that assessing image quality through subjective studies for large variety of data present in medical imaging applications is time-consuming, expensive and difficult to set up. That is why, few subjective quality assessment methods of medical images have been done and most of them.

This study was conducted on a database of thoracic Computed Tomography (CT) scans for lung cancer diagnosis purposes that consist in the detection and interpretation of nodules within the CT images. In such a context, it may be possible that the watermarking masks nodules, introduces, or even changes their sizes. Before performing the experiment with radiologists, two pre-studies were conducted. The first one objectively compared watermarking distortions with those introduced by JPEG2000 lossy compression with the compression ratio recommended by the Canadian Association of Radiologists (CAR) [START_REF] Koff | Pan-canadian evaluation of irreversible compression ratios ("lossy" compression) for development of national guidelines[END_REF], using common image quality metrics like PSNR, SSIM, and so on. The second pre-study was conducted with MEDECOM and IMT Atlantique staffs to subjectively assess the visual quality of watermarked images. The analysis of the results of these pre-studies allowed us to choose the ranges of values of watermarking parameters that will be used in the study with the radiologists.

Unfortunately, the subjective study with the experts has not yet been started due to time constraints. Nevertheless, according to our pre-studies, it is possible to establish a link in-between subjective and objectives studies. It appears that, for instance, when the PSNR is greater than 77 dB the watermarked CT image is of good visual quality. However, these results needs to be confirmed.

Conclusion

Medical images play an important role in diagnosis, patient follow-up and screening. This is why they are more and more shared in-between health professionals (e.g. telemedicine applications, cloud-based medical imaging applications) and also re-used and combined with machine learning techniques so as to develop tools for diagnosis aid support. However, as they are manipulated in highly open environments in which different users access information, security issues are increased due to the sensitive nature of medical images. As a consequence, healthcare organizations implement stringent policies and procedures to ensure data security so as to be used trustworthy in daily medical practice. Image security can thus expressed in terms of confidentiality, reliability and traceability.

We have seen that developing new security mechanism for the protection of medical images needs to take into account the specificity of the domain, in particular the Digital Imaging and Communications in Medicine (DICOM) standard and the fact that medical image data are usually stored and exchanged under a compressed form, due to the very large volume they represent (an hospital can generate at least 27,000 Terabytes per year [START_REF]What's next for the health-care data center?[END_REF]) DICOM has been introduced in order to facilitate the transmission handling of medical images. It specifies which lossless and lossy image compression algorithms can be used. JPEG-LS and JPEG are part of them. DICOM also takes into account different security aspects in its part 15. It recommends the use of the triple DES or AES cryptosystems so as to ensure image confidentiality while image integrity can be provided with the help of the DSA digital signature. Let us recall that the kind of protection these security mechanisms offer is "a priori ", in the sense that once an image is decrypted or its digital signature is lost or deleted, it is no longer protected. Here comes the interest of an "a posteriori " protection, a kind of protection watermarking ensures due to the fact that it leaves the user accessing the data while maintaining them protected by the message.

From this standpoint, we have showed that it is desirable to develop solutions that can give access to watermarking-based security services (e.g. integrity and authenticity control) from the compressed domain, i.e. from the image compressed bitstream, and also from the encrypted domain.

In a first moment, we have studied the combination of watermarking and compression in order to be able to control image security without having to decompress it, even partially. In this context, we have proposed new joint watermarking-compression scheme [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF][START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF]. The system we propose combines, in a single operation, bit-substitution watermarking modulation with JPEG-LS,in the first scheme, and with JPEG in the second one. It is important to notice that with our schemes, it is possible to decompress the image with the common JPEG-LS or JPEG algorithms. More clearly, decompression as well as message extraction processes are conducted independently without having to be modified or adapted. With such an ability, our scheme is DICOM compliant. Furthermore, due to the fragile watermark, this solution makes possible to control image reliability (i.e. authenticity and integrity) directly from compressed domain. Note also that the proposed scheme saves the computational complexity as it does not require decompression to verify image reliability in the compressed domain. Future works will focus on improving the robustness of the watermark.

As stated above, there is a great interest to combine watermarking with encryption so as to simultaneously achieve an a priori/ a posteriori protection. We thus work on two cryptowatermarking techniques with as main objective to provide watermarking-based security services from encrypted data. The first one we proposed takes into account the fact that medical images are most of the time stored in a compressed form. It jointly combines watermarking, encryption and compression at once [START_REF] Haddad | A new joint watermarking-encryptionjpeg-ls compression method for a priori & a posteriori image protection[END_REF][START_REF] Haddad | Joint watermarking-encryptionjpeg-ls for medical image reliability control in encrypted and compressed domains[END_REF]. Its originality is twofold. First, it allows accessing to watermarkingbased security services from both encrypted and compressed image bitstreams without having to decrypt or to decompress them, even partially. Second, it combines bit-substitution watermarking with JPEG-LS and the AES block cipher algorithm in its cipher block chaining (CBC) mode , in a single operation. It is important to notice that with our scheme, it is possible to decipher and decompress the image with the common AES and JPEG-LS algorithms. More clearly, decryption, decompression as well as message extraction processes are conducted independently without having to be modified or adapted. With such a capability, our scheme is DICOM compliant. Furthermore, this solution makes possible to control medical image reliability (i.e. authenticity and integrity) directly from both encrypted and compressed domains. Note also that the proposed scheme saves the computational complexity as it does not require decryption and decompression to verify the image reliability in the encrypted domain and the compressed one, respectively. In this work, we have also theoretically demonstrated the performance of the above scheme in terms of watermarking capacity and image quality distortion. These theoretical results have been validated experimentally on a real medical image data set and allow us to precisely predict the performance of our scheme. Moreover, they prove the suitability of the proposed scheme to the applications it is conceived for. Future works will focus on the possibility to embed a message in the encrypted-compressed image while being able to extract it from both encrypted and compressed domains.

The second crypto-watermarking scheme we propose consists in losslessly watermark an encrypted image for the purpose of verifying the reliability of an image in both encrypted and clear domains. The originality of the proposed system stands on the capability of embedding a message in the encrypted domain and being able to extract it from both encrypted and clear domains and to recover the original image. This is possible by means of a "pre-watermark" embedded before image encryption using a new robust reversible histogram shifting watermarking modulation with error-correction abilities. The message is then embedded in the encrypted image using a common watermarking technique. It is the impact of this message insertion process onto the "pre-watermark" that gives us access to the message in the clear domain, i.e. after the decryption process. Due to the robustness of the embedded pre-watermark, the original image can be thus exactly recovered. Message embedding/extraction processes are completely independent from encryption/decryption. The feasibility of our approach is demonstrated considering the Trivium stream cipher and a robust histogram shifting modulation that we developed. Experiments conducted on some natural images and medical images confirm the efficiency of our approach to make available a message in both clear and encrypted domains and to correctly recover the original image. However, the proposed approach is not DICOM-compliant because of the use of a stream cipher algorithm. Hence, future works will focus on making this scheme compliant to DICOM standard by using a block-cipher algorithm (e.g. AES, 3-DES).

Finally, we proposed to study the impact of lossy watermarking on lung thoracic CT images, in order to identify watermarking parameters or strengths to preserve the image quality. To do so, we have developed objective and subjective validation studies in cooperation with the CIC-IT, imaging pole and the University Clinic of Radiology and Imaging (Clinique Universitaire de Radiologie et Imagerie Médicale (CURIM)) of CHU Grenoble-Alpes, and MEDECOM so as to validate our distortion constraint hypothesis. Even though we were not able to make the test with radiologists due to time constraints, objective and subjective pre-studies was conducted with MEDECOM and IMT Atlantique staffs to assess the visual quality of watermarked images and to identify the watermarking parameters most likely to introduce visible distortion in the image. Herein, only the visual quality of the image was evaluated and not the diagnostic quality. This latter will be evaluated by radiologists by taking into account the results of the pre-study in order to limit the test duration with experts. In the continuity of this work, the impact of watermarking of medical images on automatic analysis methods can be studied as the modification of these images can have side effects on the extracted parameters.

Even though this Ph.D. thesis provides some contributions to medical image watermarking, there are still several open issues. In future works, we will focus on the better preservation of the image quality and improving the robustness of the watermark while reducing the algorithm complexity.

Résumé en français

L'imagerie médicale joue un rôle important et vital dans l'aide du diagnostic et la prise de décision. À ce propos, plusieurs techniques d'acquisition sont utilisées: Computer Tomographie (CT), échographie, Imagerie par Résonance Magnétique (IRM). D'autre part, l'incursion des nouvelles technologies de l'information et de la communication a entrainé d'importants développements dans le domaine de la santé. Ces technologies ont des différents impacts sur la pratique professionnelle, la gestion de l'information médicale et la prise en charge des patients. En particulier, l'échange numérique d'images médicales dans différentes applications de télémédicine (ex. téléradiologie, télédiagnostic, téléexpertise) permet de simplifier la prise de décision multidisciplinaire en faisant gagner du temps aux acteurs impliqués dans la chaîne de soin et d'améliorer la qualité des soins.

Cependant, avec l'évolution numérique du secteur, les données médicales sont de plus en plus exposées aux risques de sécurité. Du fait que ces données jouent un rôle important pour la santé d'un patient; son altération peut être la cause directe ou indirecte d'une atteinte grave à la santé d'un patient (ex. Selon le Dr. Sung Choi, chercheur à l'université de Vanderbilt, plus de 2100 décès de patients par an sont causés par des violations de données), le traitement de données médicales s'intègre à un cadre législatif et déontologique. Par exemple, au regard de la sensibilité des ces informations, le Règlement Général sur la Protection des Données (RGPD) interdit tout traitement de ces données, sans le consentement exprès des personnes concernées (i.e. patients) qui doivent obligatoirement être informée des buts et objectifs du traitement. Ce règlement interdit également que ce traitement se fasse en dehors des cas légalement prévus. Ainsi, il faut assurer l'intégrité et l'authenticité des données, garantir leur confidentialité et éviter les vols ou les fuites d'information comme aussi assurer leur disponibilité dans les conditions d'accès normalement prévues.

Pour pouvoir répondre à ces besoins et assurer la sécurité des données médicales, il faut d'abord connaître les menaces et les risques rencontrés afin d'être capable de les éviter. Si l'on se réfère aux standards pour le déploiement de politiques de sécurité, comme l'ISO 27799 dédiée aux données de santé en particulier, les risques pour l'information médicale peuvent être classés en trois catégories:

• Les accidents (ex. les pannes matérielles, les phénomènes naturels).

• Les erreurs (ex. erreur lors de la saisie de l'information, des transferts).

• Les malveillances (ex. fraudes, détournement de l'information, intrusion dans le système).

Plusieurs solutions informatiques ont été proposées pour assurer la sécurité comme : le contrôle d'accès, le chiffrement, la signature numérique. Mais, elles restent insuffisantes. Prenons le cas par exemple du chiffrement d'images (voir Figure 5.4), cette opération a pour but de rendre le contenu d'une image inaccessible (confidentialité), sauf pour les détenteurs de la clé de déchiffrement. Il s'agit ainsi d'un mécanisme de protection de type que l'on peut qualifier de "a priori" car une fois déchiffrée, l'image n'est plus protégée. Le tatouage a été proposé comme un mécanisme complémentaire à ces solutions "a priori". Il peut contribuer à une protection continue et "a posteriori".

Dans son principe (voir Figure 5.5), le tatouage laisse l'accès à l'information tout en la maintenant protégée par une "marque" imperceptible, un message qui porte une information de protection (ex. des attributs de sécurité -signatures numériques, code d'authenticité). Dans le cas des images, l'insertion d'un message se fait par une distorsion contrôlée des niveaux de gris de celles-ci. Ces travaux de thèse portent sur la combinaison de techniques de tatouage avec des mécanismes de chiffrement de manière à développer de nouvelles solutions permettant d'assurer une protection à la fois a priori et a posteriori, et donc continue de données d'imagerie médicales partagées et échangées. Finalement, dans le but de valider nos hypothèses en termes de distorsion, nous nous sommes intéressés à mesurer l'impact du processus de tatouage sur la qualité du diagnostic et donc sur l'interprétation des images tatouées. Pour ce faire, nous avons mis en oeuvre un protocole d'étude Ce choix repose sur le fait que ces nodules sont de l'ordre de quelques millimètres, et leur détection requière une lecture approfondie des images qui peuvent être impactée par une dégradation de la qualité de l'image. Aussi, Les images ont déjà été collectées pour une autre étude. Ceci nous fait gagner un temps précieux vu que les données sont déjà anonymisées, et annotées.

Quant à l'algorithme de tatouage, la modulation par substitution de bits de poids faibles a été utilisée. Cette modulation a été choisie car elle correspond au schéma de tatouage le plus basique et à partir de laquelle, on peut déterminer les paramètres des autres modulations Afin de réduire davantage le nombre de tests et de limiter l'étude à un petit nombre de radiologues, ce travail s'est déroulé en plusieurs étapes. Dans un premier temps, nous avons réalisé deux pré-études qui visent à réduire la plage de valeurs des paramètres de tatouage. La première pré-étude vise à identifier les paramètres "maximaux" de tatouage à ne pas dépasser, sur la base de mesures objectives en comparaison avec les résultats de l'étude de l'association canadienne des radiologistes CAR (Canadian Association of Radiologists) sur la compression avec perte des images de scanner thoraciques. La seconde pré-étude consiste en une expérimentation subjective où les collaborateurs d'IMT Atlantique et de MEDECOM -personnes non expertes -sont invités à évaluer la qualité visuelle des images tatouées et à identifier un sous-ensemble de «valeurs seuils» de paramètres de tatouage les plus susceptibles d'introduire une déformation visible dans l'image dans le but de limiter les tests avec les radiologues. La dernière étape correspond donc à l'étude subjective avec des experts afin d'évaluer à la fois la qualité diagnostique et visuelle des images de scanner thoraciques pulmonaires tatouées. Malheureusement, cette étape n'a toujours pas commencé en raison de l'indisponibilité des radiologues et des contraintes de temps.

1. 1

 1 Picture Archiving and Communication System . . . . . . . . . . . . . . . . . . . . 1.2 General scheme of image compression. . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Information security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4 Overview of risk analysis process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 General scheme of image encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . 1.6 Overview image of symmetric encryption. . . . . . . . . . . . . . . . . . . . . . . . 1.7 General principles of asymmetric encryption. . . . . . . . . . . . . . . . . . . . . . 1.8 Overview of a watermarking technique. . . . . . . . . . . . . . . . . . . . . . . . . . 1.9 Graphical representation of the antagonism between the three canonical watermarking properties. A high performance in terms of two of them typically implies a very low performance in terms of the third one, as represented by the black dot in the figure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.10 Example of two codebooks' cells in the mono-dimensional space (i.e. x is a scalar value) considering an uniform quantization of quantization step ∆. Symbols o and × denote cells' centers that encode 0 and 1 respectively. d = ∆/2 establishes the measure of robustness to signal perturbations. . . . . . . . . . . . . . . . . . . . . . 2.1 JPEG-LS general scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 An example of a pixel sequence that will be encoded in run-mode, where the local gradients computed from {a, b, c, d} are null and the sequence length is of 2 pixels. 2.3 JPEG-LS compressed bitstream example. . . . . . . . . . . . . . . . . . . . . . . . 2.4 JPEG compression general scheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Low, Middle, and High frequencies distribution in a DCT block. . . . . . . . . . . 2.6 An example of a quantization table. . . . . . . . . . . . . . . . . . . . . . . . . . . 2.7 Ordering of a 2D matrix into 1D vector according to a zig-zag scan. . . . . . . . . 2.8 Example of a Huffman encoding of the zig-zag scanned vector; where EOB corresponds to the "End of Block" (i.e. a sequence of zeros until the end of the block).

2 . 15

 215 Original images (left) alongside with their decompressed-watermarked images (right) for both JWJLS (a) and JWJPG (b) schemes. . . . . . . . . . . . . . . . . . . . . . 2.16 % file size evolution vs. embedding capacity on ultrasound image dataset in both JWJLS (a) and JWJPG (b) schemes. . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 JPEG-LS general scheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 General architecture of the proposed system where: I, I cwe , I cw , I dw , K wc , K we , K e , m c , m e , m ext c , m ext e

3 . 3

 33 Computation and embedding of S Bci into the compressed block B ci , where B w wc{1...i-1}are the previous compressed-watermarked blocks of 128 bits, K wc is the secret watermarking key and B wci is the compressed-watermarked by m c block. . . . . . . . 3.4 Samples of our image test sets (ultrasound and Retina images, respectively). . . . . 3.5 Probability distribution of the Golomb-Rice factor corresponding to watermarked pixels (computed on ultrasound and Retina images). . . . . . . . . . . . . . . . . . 3.6 PSNR vs. total capacity considering both encrypted and compressed domains. . . 3.7 Image samples from our data set (a) Original images (b) decompressed-decryptedwatermarked images. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8 % file size evolution vs. embedding capacity on Retina images. . . . . . . . . . . . 4.1 The five categories of crypto-watermarking approache combinations; where WFE corresponds to Watermarking Followed by Encryption, CEW to Commutative Encryption-Watermarking, JEW to Joint Encryption-Watermarking, JDW to Joint Decryption-Watermarking and EFW to Encryption Followed by Watermarking. . . . . . . . . 4.2 Encryption/decryption processes of a stream cipher algorithm with a secret key K. t i , c i and k i correspond to the plain-text bits/bytes, the cipher-text bits/bytes and the secret bits/bytes keystream respectively. k i is issued by a Pseudo-Random Number Generator (PRNG). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Basic principle of the Histogram Shifting modulation.(a) original histogram (b) histogram of the watermarked data. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 Histogram Shifting applied on prediction-errors. . . . . . . . . . . . . . . . . . . . . 4.5 Histogram of the watermarked data in the case of: (a) the classic Histogram Shifting modulation, (b) our robust HS modulation. . . . . . . . . . . . . . . . . . . . . . . 4.6 Basic principle of Robust Prediction-Error Histogram. (a) original prediction-error histogram (b) histogram of the watermarked prediction-errors (c) histogram of the watermarked prediction-errors when the attack is known and corresponds to the permutation of the LSBs of image pixels. . . . . . . . . . . . . . . . . . . . . . . . 4.7 General Architecture of the system associated to our approach. I, I w , I e , I ew , I d , K e , K ws and K we denote the original image, the watermarked image, the encrypted image, the encrypted-watermarked image, the watermarked-decrypted image and the encryption key and watermarking keys in both clear and encrypted domains, respectively. M s and M e are the embedded messages in the clear and encrypted domains, respectively. f e is the watermarking extraction function in the encrypted domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.8 Basic principle of our RPEHS modified for ensuring the exact recovery of the original image. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.9 Image prediction error distribution. . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.10 Positions (in black) of pixels our RPEHS on which is applied. . . . . . . . . . . . . 4.11 Natural test images of 512 × 512 pixels : (a) Lena, (b) Airplane, (c) Barbara, (d) Baboon. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.12 Samples of our image test sets (ultrasound, mammography, respectively). . . . . . 4.13 Distribution of prediction-errors in Airplane (a) and Baboon (b) images. . . . . . . 4.14 Tests on "Airplane" and "Lena" images: Embedding rate in clear domain depending on the shifting magnitude ∆ values. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.15 Tests on "Airplane" image: Embedding rate in both encrypted and clear domains

  (a) original image; (b) watermarkedencrypted image, with ∆ = 3 and message encoded with Hamming (7, 4) the error correction code; (c) decrypted-watermarked image where P SN R = 41 dB and SSIM = 0.998; (d) reconstructed image. . . . . . . . . . . . . . . . . . . . . . . . . 4.18 Example of a scenario using the proposed scheme. . . . . . . . . . . . . . . . . . . 5.1 An example of a lung thoracic CT image. . . . . . . . . . . . . . . . . . . . . . . . 5.2 the percentage of observers who perceive a difference between one or more watermarked images and their original image according to the embedding strength β. . . 5.3 Watermark perception rate for each observer according to the embedding strength β.108 5.4 Schéma général du chiffrement d'images. . . . . . . . . . . . . . . . . . . . . . . . . 5.5 Étapes principales d'une chaine de tatouage classique. L'image tatouée est partagée (e.g. via l'Internet) et elle peut être manipulée entre l'insertion et la lecture. À la lecture, dans le cas du tatouage réversible (lossless), l'image originale peut être complètement récupérée. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6 Classes de méthodes combinant le tatouage et la compression. . . . . . . . . . . . . 5.7 Architecture de la méthode "Tatouage-Compression Conjoint". . . . . . . . . . . . . 5.8 Classes de méthodes combinant le tatouage, le chiffrement et la compression. . . . 5.9 Architecture de "Tatouage-Chiffrement-Compression Conjoint". . . . . . . . . . . . 5.10 Classes de méthodes "Tatouage de données chiffrées". . . . . . . . . . . . . . . . . . 5.11 Architecture générale de "Tatouage réversible et robuste d'images chiffrées". . . . . 5.12 Image scanner thoracique plumonaire. . . . . . . . . . . . . . . . . . . . . . . . . .

3. 1

 1 Comparison between theoretical and experimental embedding capacities expressed in bit of message in pixel (bpp)µ and σ correspond to average and standard deviation of capacity values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Embedding capacities in the compressed domain for two different reference sequences. Tests done on Retina images . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Comparison of methods from the state of the art and the proposed JWEC scheme. Non-Independent decryption or non-independent decompression indicate that the solution depends on some data pre/post-processing so as to decrypt or to decompress the data, respectively. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Comparison of methods from the state of the art and the proposed EFW scheme. Non-Independent decryption indicates that the solution depends on some data pre/postprocessing so as to decrypt the data, respectively. . . . . . . . . . . . . . . . . . . . 4.2 Embedding rate comparisons of the proposed method with some the state of the art methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 PSNR and correlation coefficients between encrypted and plain-text images . . . . 4.4 Embedding rate of medical images when the message is encoded with Hamming (7, 4) 5.1 Quality measure values obtained for LSB substitution watermarking modulation and for lossy JPEG 2000 with a compression ratio of 15. . . . . . . . . . . . . . . . . . 5.2 5-level scale assessment of image quality. . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Lung thoracic CT images selected for the test. . . . . . . . . . . . . . . . . . . . . 5.4 The observers who have done the tests . . . . . . . . . . . . . . . . . . . . . . . . . 5.5 Duration of test for each observer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6 Pearson correlation matrix between the observers. . . . . . . . . . . . . . . . . . . 5.7 Threshold values of different quality measures. . . . . . . . . . . . . . . . . . . . . 5.8 Image quality measurements obtained for LSB substitution watermarking modulation according to the selected embedding strength β values, lossy JPEG 2000 with a compression ratio of 15, our joint watermarking-compression (JWC) and joint watermarking-encryption-compression (JWEC) schemes. . . . . . . . . . . . . . . . 5.9 Distribution of the image test set for each radiologist . . . . . . . . . . . . . . . . .

Figure 1 . 2 :

 12 Figure 1.2: General scheme of image compression.

Figure 1 . 3 :

 13 Figure 1.3: Information security.

Figure 1 . 4 :

 14 Figure 1.4: Overview of risk analysis process.

Figure 1 . 5 :

 15 Figure 1.5: General scheme of image encryption.

Figure 1 . 6 :

 16 Figure 1.6: Overview image of symmetric encryption.

Figure 1 . 7 :

 17 Figure 1.7: General principles of asymmetric encryption.

Figure 1 . 8 :

 18 Figure 1.8: Overview of a watermarking technique.

Figure 1 . 9 :

 19 Figure 1.9: Graphical representation of the antagonism between the three canonical watermarking properties. A high performance in terms of two of them typically implies a very low performance in terms of the third one, as represented by the black dot in the figure.

Figure 1 . 10 :

 110 Figure 1.10: Example of two codebooks' cells in the mono-dimensional space (i.e. x is a scalar value) considering an uniform quantization of quantization step ∆. Symbols o and × denote cells' centers that encode 0 and 1 respectively. d = ∆/2 establishes the measure of robustness to signal perturbations.

Figure 2 .Figure 2 . 2 :

 222 Figure 2.1: JPEG-LS general scheme

Figure 2 . 3 :

 23 Figure 2.3: JPEG-LS compressed bitstream example.

Figure 2 . 4 :

 24 Figure 2.4: JPEG compression general scheme.

Figure 2 . 5 :

 25 Figure 2.5: Low, Middle, and High frequencies distribution in a DCT block.

Figure 2 . 6 :

 26 Figure 2.6: An example of a quantization table.

Figure 2 .

 2 [START_REF] Haddad | Joint watermarking and lossless jpeg-ls compression for medical image security[END_REF] gives an example

Figure 2 . 7 :

 27 Figure 2.7: Ordering of a 2D matrix into 1D vector according to a zig-zag scan.

Figure 2 . 8 :

 28 Figure 2.8: Example of a Huffman encoding of the zig-zag scanned vector; where EOB corresponds to the "End of Block" (i.e. a sequence of zeros until the end of the block). The resulting bitstream corresponds to the Huffman code of the resulting data after the DPCM and RLE processes on the DCT block.

Figure 2 . 9 :

 29 Figure 2.9: General scheme of the proposed joint watermarking-compression for image protection.

Figure 2 . 10 :

 210 Figure 2.10: Computation and embedding of S Bci into the compressed block B ci , where B wc{1..i-1} are the previous compressed-watermarked blocks of N bits, K wc is the secret watermarking key and B wci is the compressed-watermarked block.

Figure 2 . 11 :

 211 Figure 2.11: Samples of our image test sets: (a) Ultrasound and (b) Mammography images.

Figure 2 .

 2 Figure 2.12: Trade-off between the message length and JPEG quality factor (Q f ).

  [START_REF] Jr | Picture archiving and communication system[END_REF] where l(I, I wd ) is the luminance comparison function, c(I, I wd ) is contrast comparison and s(I, I wd ) is structural comparison.

Figure 2 .

 2 Figure 2.13: PSNR vs. total embedding capacity in the compressed domain in case of JWJLS scheme for: a) ultrasound images, and b) mammography images.

Figure 2 .

 2 Figure 2.14: PSNR vs. total embedding capacity in the compressed domain in case of JWJPG scheme for: a) ultrasound images, and b) mammography images.

Figure 2 . 15 :

 215 Figure 2.15: Original images (left) alongside with their decompressed-watermarked images (right) for both JWJLS (a) and JWJPG (b) schemes.

Figure 3 .

 3 Figure 3.1: JPEG-LS general scheme.

Figure 3 . 2 :

 32 Figure 3.2: General architecture of the proposed system where: I, I cwe , I cw , I dw , K wc , K we , K e , m c , m e , m ext c , m ext e

Figure 3 . 3 :

 33 Figure 3.3: Computation and embedding of S Bci into the compressed block B ci , where B w wc{1...i-1}are the previous compressed-watermarked blocks of 128 bits, K wc is the secret watermarking key and B wci is the compressed-watermarked by m c block.

Figure 3 . 4 :

 34 Figure 3.4: Samples of our image test sets (ultrasound and Retina images, respectively).

Figure 3 . 5 :

 35 Figure 3.5: Probability distribution of the Golomb-Rice factor corresponding to watermarked pixels (computed on ultrasound and Retina images).

Figure 3 . 6 :

 36 Figure 3.6: PSNR vs. total capacity considering both encrypted and compressed domains.

Figure 3 . 7 :

 37 Figure 3.7: Image samples from our data set (a) Original images (b) decompressed-decryptedwatermarked images.

Figure 3 . 8 :

 38 Figure 3.8: % file size evolution vs. embedding capacity on Retina images.

Figure 4 . 1 :

 41 Figure 4.1: The five categories of crypto-watermarking approache combinations; where WFE corresponds to Watermarking Followed by Encryption, CEW to Commutative Encryption-Watermarking, JEW to Joint Encryption-Watermarking, JDW to Joint Decryption-Watermarking and EFW to Encryption Followed by Watermarking.

Figure 4 . 2 :

 42 Figure 4.2: Encryption/decryption processes of a stream cipher algorithm with a secret key K. t i , c i and k i correspond to the plain-text bits/bytes, the cipher-text bits/bytes and the secret bits/bytes keystream respectively. k i is issued by a Pseudo-Random Number Generator (PRNG).

Figure 4 . 3 :

 43 Figure 4.3: Basic principle of the Histogram Shifting modulation. (a) original histogram (b) histogram of the watermarked data.

Figure 4 . 4 :

 44 Figure 4.4: Histogram Shifting applied on prediction-errors.

Figure 4 . 5 :

 45 Figure 4.5: Histogram of the watermarked data in the case of: (a) the classic Histogram Shifting modulation, (b) our robust HS modulation.

  5.b), in-between the carrier class that encodes 1 (C 1 in Figure 4.5) and the non-carrier class (C 2 in Figure 4.5). By doing so, after an attack of maximum amplitude δ, a non-carrier sample remains non-carrier or falls in the gap near the non-carrier classes, i.e. C e 2 in Figure 4.5.b and a carrier sample encoding 1 may fall in the gap near the carrier class encoding 1 , i.e. gap in C e 1 in Figure 4.5.b, or remain carrier but encoding 0 , leading thus to a message-bit error. Therefore, at the extraction stage, if a watermarked image sample belongs to the gap C e 1 (resp. C e

Figure 4 . 6 :

 46 Figure 4.6: Basic principle of Robust Prediction-Error Histogram. (a) original prediction-error histogram (b) histogram of the watermarked prediction-errors (c) histogram of the watermarked prediction-errors when the attack is known and corresponds to the permutation of the LSBs of image pixels.

Figure 4 . 7 :

 47 Figure 4.7: General Architecture of the system associated to our approach. I, I w , I e , I ew , I d , K e , K ws and K we denote the original image, the watermarked image, the encrypted image, the encrypted-watermarked image, the watermarked-decrypted image and the encryption key and watermarking keys in both clear and encrypted domains, respectively. M s and M e are the embedded messages in the clear and encrypted domains, respectively. f e is the watermarking extraction function in the encrypted domain.

Figure 4 . 8 :

 48 Figure 4.8: Basic principle of our RPEHS modified for ensuring the exact recovery of the original image.

Figure 4 . 9 :

 49 Figure 4.9: Image prediction error distribution.

Figure 4 .

 4 Figure 4.10: Positions (in black) of pixels our RPEHS on which is applied.

Figure 4 . 11 :

 411 Figure 4.11: Natural test images of 512 × 512 pixels : (a) Lena, (b) Airplane, (c) Barbara, (d) Baboon.

Figure 4 . 12 :

 412 Figure 4.12: Samples of our image test sets (ultrasound, mammography, respectively).

Figure 4 . 14 :

 414 Figure 4.14: Tests on "Airplane" and "Lena" images: Embedding rate in clear domain depending on the shifting magnitude ∆ values.

  (a)) which means the embedded secret data are imperceptible.

Figure 4 . 16 :

 416 Figure 4.16: Tests on "Airplane" image: PSNR according to the shifting magnitude (∆).

Figure 4 . 17 :

 417 Figure 4.17: Simulation results of the proposed scheme on "Lena": (a) original image; (b) watermarked-encrypted image, with ∆ = 3 and message encoded with Hamming (7, 4) the error correction code; (c) decrypted-watermarked image where P SN R = 41 dB and SSIM = 0.998; (d) reconstructed image.

Figure 4 . 18 :

 418 Figure 4.18: Example of a scenario using the proposed scheme.

Figure 5 .

 5 Figure 5.1: An example of a lung thoracic CT image.

P 2 ( 5 . 3 )

 253 SN R (I, I d ) = 10 log 10 2 i, j) -I d (i, j)] where I, I d correspond to the original and the distorted d-depth images, respectively of size [n, m].

5 . 4 )

 54 where µ I , µ I d , σ I , σ I d , cov II d are the mean of the original image I, the mean of the distorted image I d , the variance of I, the variance of I d and the covariance of I and I d .

Figure 5 . 3 :

 53 Figure 5.3: Watermark perception rate for each observer according to the embedding strength β.

Figure 5 . 4 :

 54 Figure 5.4: Schéma général du chiffrement d'images.

Figure 5 . 5 :Figure 5 . 6 :

 5556 Figure 5.5: Étapes principales d'une chaine de tatouage classique. L'image tatouée est partagée (e.g. via l'Internet) et elle peut être manipulée entre l'insertion et la lecture. À la lecture, dans le cas du tatouage réversible (lossless), l'image originale peut être complètement récupérée.

Figure 5 . 7 :

 57 Figure 5.7: Architecture de la méthode "Tatouage-Compression Conjoint".

Figure 5 . 8 :

 58 Figure 5.8: Classes de méthodes combinant le tatouage, le chiffrement et la compression.

Figure 5 . 10 :

 510 Figure 5.10: Classes de méthodes "Tatouage de données chiffrées".

Figure 5 . 11 :

 511 Figure 5.11: Architecture générale de "Tatouage réversible et robuste d'images chiffrées".

Figure 5 . 12 :

 512 Figure 5.12: Image scanner thoracique plumonaire.

  1.1 Typical properties of images acquired in clinical routine through different modalities and on different organs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Maximum lossy compression ratios recommended by the Canadian Associations of Radiologist Standard. NI corresponds to the Nuclear Medicine, JPG to JPEG and J2K to JPEG2000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Embedding capacities in the compressed domain for two different reference sequences in case of JWJLS scheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 Embedding capacities in the compressed domain for two different reference-sequences in case of JWJPG scheme (Q-factor = 90). . . . . . . . . . . . . . . . . . . . . . . 2.5 PSNR and compression ratio versus JPEG Q-factor for Ultrasound images. . . . .

2.1 Huffman -Luminance (Y) -DC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Huffman -Luminance (Y) -AC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3

Table 1

 1

	Modality	Organ	Image size	Depth (bits)	File size
	Radiography	Thorax	2,060× 2,060	16	8 MB
		Abdomen	512× 512	16	250 MB
	CT	Brain	512× 512	16	150 MB
		Heart	512× 512	16	1 GB
		Abdomen	512× 512	16	15 MB
	MRI	Brain	512× 512	16	10 to 60 MB
		Heart	512× 512	16	50 MB
	US	Standard	512× 512	8	12.5 MB/sec
	PET	Heart	128× 5128	16	24 MB

.1: Typical properties of images acquired in clinical routine through different modalities and on different organs.

Table 1 .

 1

	Modalities

2: Maximum lossy compression ratios recommended by the Canadian Associations of Radiologist Standard. NI corresponds to the Nuclear Medicine, JPG to JPEG and J2K to JPEG2000.

Table 2 .

 2

			1: Huffman -Luminance (Y) -DC
	size dif f Codeword	val dif f	Code
	0	00	0	-
	1	010	-1, 1	0,1
	2	011	-3,-2, 2,3	00,01,10,11
	3	100	-7,. . . , -4, 4,. . . , 7	000,. . . ,011,100,. . . ,111
	4	101	-15,. . . , -8, 8,. . . , 15	0000,. . . ,0111,1000,. . . ,1111
	.	.	.	.
	.	.	.	.
	11	111111110	-2047,. . . ,-1024, 1024,. . . , 2047	. . .

to say, no other codeword in Huffman table starts with c i in order to correctly decode diff.The difference value val dif f is then binary encoded and concatenated to the Huffman code of size dif f . For instance, given a difference value diff = -512. Thus, size dif f is equal to 10 bits and val dif f = -512. According to DC-Huffman table, the codeword that correspond to size dif f = 10 is of 1111110 and the binary code of val dif f = -512 is of 0111111111 . The final code of diff, that corresponds to the concatenation of size dif f and val dif f is of 11111100111111111 .

Regarding AC coefficients, the resulting (run, value) pairs of RLE are Huffman encoded according to the following procedures:

• [(run, size AC ) , val AC ]; where size AC represents the number of bits needed to encode the non-zero AC of value val AC .

• (run, size AC ) is next encoded based on the corresponding AC-Huffman table . We give an example of such table in case of gray-scale images in Table

2

.2.

Table 2 .

 2

		2: Huffman -Luminance (Y) -AC
	run/size AC	Codeword	run/size AC	Codeword
	0/1	00	3/1	111010
	0/2	01	4/1	111011
	0/3	100	0/6	1111000
	0/0 (EOB)	1010	1/3	1111001
	0/4	1011	5/1	1111010
	1/1	1100	6/1	1111011
	0/5	11010	0/7	11111000
	1/2	11011	. . .	. . .
	2/1	11100	F/A	1111111111111110

Table 2 .

 2 3: Embedding capacities in the compressed domain for two different reference sequences in case of JWJLS scheme.

	Ultrasound	Mammography
	Average Variance Average Variance

Table 2 . 4 :

 24 Embedding capacities in the compressed domain for two different reference-sequences in case of JWJPG scheme (Q-factor = 90).

		Ultrasound	Mammography
		Average	Variance	Average	Variance
	Embedding capacity for R 1 (bpp)	0.012	6.10 -4	0.0087	4.3.10 -5

Table 2 .

 2 5: PSNR and compression ratio versus JPEG Q-factor for Ultrasound images.

	Q-factor Compression Ratio P SN R c	P SN R wc
	50	12:1	35.3054	34.16
	70	10:1	37.7	36.6
	80	8:1	40.03	37.5
	90	5:1	44.18	41

Table 3 .

 3 1: Comparison between theoretical and experimental embedding capacities expressed in bit of message in pixel (bpp)µ and σ correspond to average and standard deviation of capacity values

	Image type	Retina	Ultrasound
	Image size	627 × 643	576 × 690
	Image depth (bits)	8		8
	%Regular-mode encoded pixels	80%	75%
	Theoretical embedding	0.093	0.1
	capacity of m c (bpp) (see (7))
	Experimental embedding	µ	σ	µ	σ
	capacity of m c (bpp)	0.14 0.012 0.095	0.034
	Theoretical embedding	0.031	0.031
	capacity of me (bpp) (see (13))
	Experimental embedding	µ	σ	µ	σ
	capacity of me (bpp)	0.03 0.002 0.0286 0.0017

S B cf = hash B w wc(1,f -1) , K wc ||hash (nw (B cf ) , K wc ) (3.14)

Table 4 .

 4 2: Embedding rate comparisons of the proposed method with some the state of the art methods

		Proposed
	Embedding capacity (bpp)	[154] [155] [150] [109]
		M e	M s
	Lena	0.07 0.062 0.15 0.004 0.01 0.17

Table 4 .

 4 3: PSNR and correlation coefficients between encrypted and plain-text images

	Image	Peppers	Airplane	Baboon	Lena
	PSNR (dB)	8.876	8.01	9.54	9.46
	Correlation coefficient 8.67.10 -4 -2.21.10 -4	0.0012	4.63.10 -4
	Table 4.4: Embedding rate of medical images when the message is encoded with Hamming (7, 4)
				Embedding capacity (bpp)
	Images	Shifting magnitude			PSNR (dB)
				M e	M s
		∆ = 1		0.01	0.1	43.6
	Ultrasound
		∆ = 2		0.01	0.27	40
		∆ = 1		0.01	0.12	44.2
	Mammography
		∆ = 2		0.01	0.29	41.05

Table 5 .

 5 3: Lung thoracic CT images selected for the test.

	Image Nb.	Scanner manufacturer	Quality Pathology Nb. of nodules ≥ 3mm
	1	GE MEDICAL SYSTEM	++	absent
	2	TOSHIBA	+++	obvious
	3	GE MEDICAL SYSTEM	++	absent
	4	TOSHIBA	+++	obvious
	5	TOSHIBA	++	obvious
	6	TOSHIBA	+++	obvious
	7	TOSHIBA	+++	obvious
	8	TOSHIBA	++	obvious
	9	TOSHIBA	++	obvious
	10	TOSHIBA	+++	obvious
	11	TOSHIBA	+++	absent
	12	TOSHIBA	+++	obvious
	13	TOSHIBA	++	obvious
	14	TOSHIBA	+++	obvious
	15	TOSHIBA	++	obvious
	16	GE MEDICAL SYSTEM	++	absent
	17	TOSHIBA	++	obvious
	18	TOSHIBA	+++	obvious
	19	GE MEDICAL SYSTEM	++	absent
	20	TOSHIBA	+++	obvious

Table 5 .

 5 4: The observers who have done the tests

	Observer	O1	O2	O3	O4	O5	O6
	Function	R&D director Ph.D student Engineer Ph.D student Trainee Ph.D student
	Degree of expertise (years)	>10	1	<1	>3	0	>3

Table 5 .

 5 5: Duration of test for each observer.

	Observer Duration of test (minutes)
	O 1	35
	O 2	35
	O 3	40
	O 4	29
	O 5	29
	O 6

Table 5 . 6 :

 56 Pearson correlation matrix between the observers.

	Variables	O 1	O 2	O 3	O 4	O 5	O 6
	O1	1	0.7930	0.8009	0.8098	0.7523	0.8098
	O 2	0.7930	1	0.8407	0.8202	0.84	0.9002
	O 3	0.8009	0.8407	1	0.7816	0.8407	0.8617
	O 4	0.8098	0.8202	0.7816	1	0.8202	0.8399
	O 5	0.7523	0.84	0.8407	0.8202	1	0.9002
	O 6	0.8098	0.9002	0.8617	0.8399	0.9002	1
	parameter β.

Table 5 .

 5 7: Threshold values of different quality measures.

	Quality measure Threshold value
	PSNR	77 dB
	UQI	0.8
	SSIM	≈ 1
	MSSIM	0.98
	NQM	50

Table 5 . 9 :

 59 Distribution of the image test set for each radiologist

	Batch 1	Batch 2	Batch 3	Batch 4
	(64 « mini-	(64 « mini-	(64 « mini-	(64 « mini-
	examinations »)	examinations »)	examinations »)	examinations »)
	Radiologist

Remerciements

Image Distortion

As we propose in this chapter a reversible scheme the original image can be recovered without any distortion, after extracting the embedded watermark. Nevertheless, the visual quality of the watermarked-decrypted image should be evaluated. The Peak-Signal-to-Noise-Ration (PSNR), the structural similarity (SSIM) and the Universal Quality Measure (UQI) between the original image I and its decrypted-watermarked version I wd were considered so as to evaluate the image distortion. On its side, SSIM and UQI are considered to be correlated with the human visual system. As exposed in Section 4.4, the distortion introduced by our RPEHS is obviously related to the shifting of pixels' values.

The performance of our RPEHS in terms of distortion under different values of shifting magnitude (∆) on "Airplane" image is given in Figure 4. [START_REF] Saripalle | Using hl7 fhir to achieve interoperability in patient health record[END_REF]. Obviously, the bigger ∆ is, the lower the achieved PSNR value is or, in other words, the larger the introduced distortion is. For instance, for "Airplane", when ∆ = 2, the obtained PSNR value is of 41 dB while, the obtained PSNR between the original and the watermarked-decrypted image is equal to 38.5 dB by setting ∆ = 4.

Table 4. [START_REF] Fraser | Iso 27799: Security management in health using iso/iec 17799[END_REF] shows the PSNR values and the correlation coefficient between the encrypted and the decrypted images. PSNR values are very low (near to 0) so it is rather difficult to detect the content of the original image from its encrypted counterpart. The correlation coefficients between encrypted original images are almost zero, so no information can be recognized from the encrypted • MSSIM (Mean Structural Similarity) -it is applied to calculate the average SSIM in small local area. It thus consists of luminance, contrast and structure correlation components.

MSSIM (I,

where M is the number of local window in the image, I j and I dj are the small images at the j th window corresponding to the original image and the distorted one, respectively.

• NQM (Noise Quality Measure) -it is a human visual system-based metric. It was originally used to assess the quality of images degraded by noise injection. Nevertheless, it has shown acceptable results in thee presence of other types of degradation. Moreover, it takes into account contrast measure as well as the luminance, size, etc.

We considered a test data set of 200 lung thoracic CT images [START_REF] Samuel | Data from lidcidri[END_REF] for this objective pre-study, which consists in:

• Compressing images using lossy JPEG2000 with a ratio of 15, the maxi-mum ratio recommended by the CAR standard.

• Watermarking images using the LSB substitution modulation for different embedding strengths β; β ∈ {1, .., 12}.

• Determining the amount of distortion caused by compression and watermarking based on the quality objective metrics given above.

The objective measures' values obtained for LSB substitution modulation and lossy JPEG2000 compression are given in Table 5.1. As we can see in this table, the distortion introduced by the substitution modulation of LSBs is close to the distortion introduced by JPEG2000 compression until β ≥ 6 and very different beyond. Based on this result, the insertion force values we retain for the future tests are: β ∈ {2, 3, 4, 5, 6}. However, the size of this range of preselected values still remains high, hence a second pre-study to reduce this range.

Subjective Pre-Protocol: Selection of watermarking parameters

The purpose of this pre-study is to identify the watermarking parameters or strengths most likely to introduce visible distortion into the image. These identified parameters will be then used in the study with the radiologists. This pre-protocol involves IMT Atlantique and MEDECOM staff.

Before detailing this pre-study, we first present the different ways to conduct such a subjective protocol in order to justify our implementation choice.

Subjective protocol models

Subjective evaluation is considered as the most reliable way to judge the quality of an image because it involves experts in the domain. The subjective assessment methods can be distinguished into three main models:

• Single stimulus categorical rating -that assesses the quality of an image without any information about the original one.

• Double stimulus categorical rating -where the observer is asked to judge the similarity between two images.

• Comparative methods -the purpose of these methods is to compare between two or more images according to their quality.

Table 5.1: Quality measure values obtained for LSB substitution watermarking modulation and for lossy JPEG 2000 with a compression ratio of 15.

Quality measure ) SSIM Mean (variance)

) 0.9997

) 0.998 Single stimulus categorical rating: This type of evaluation assesses the quality of one image at a time. The test images are displayed one by one on a screen for a period with a lag time between the display of two images. This time allows the observer to note the quality of the image on a scale of five levels, such that: excellent, good, fair, poor or bad. Other scales of assessments can of course be used [START_REF] Bt Series | Methodology for the subjective assessment of the quality of television pictures[END_REF]. All test images are displayed randomly.

Double stimulus categorical rating: This method allows measuring the quality of an image according to another version; its original version or another one. For example, the reference image is first presented followed by a gray screen and in second, its degraded version is displayed followed by a gray screen. Notice that the gray screen is displayed so as not to affect the quality of the analysis. IN particular, the user will not be influenced by the "image of difference". It should be noted that the display duration must be the same during each stage. Then, the observer should rate the quality or the level of perception of the degradation. In this case, different rating scales can be used. An example of a 5-level rating scale [START_REF] Chetouani | Vers un système d'évaluation de la qualité d'image multi-critères[END_REF] is given in Table 5.2.

Comparative methods: These methods look for quantifying the visual differences between images without having any information on their quality. Among these methods, one can find:

• Ordering by force-choice pair-wise comparison -this method consists in displaying a pair of images simultaneously [START_REF] Rafał K Mantiuk | Comparison of four subjective methods for image quality assessment[END_REF]. Observers are asked to compare images and to determine the one of better quality, even if both images appear identical. Moreover, there is no time limit to make a decision.

• Pair-wise similarity judgments -like the force-choice pair-wise methods, images are presented in pairs. However, observers are asked to choose the image of a better quality and to quantify the degree of difference between images on an "a priori " fixed scale.

The adopted subjective pre-study

As previously mentioned, the objective of this subjective pre-study is to determine the embedding strengths β that introduce a visible distortion in lung thoracic CT images. It is important to notice that this pre-study has been performed by non-expert assessors/observers. As consequence, only the visual quality of the image will be evaluated. Indeed, the image diagnostic quality can be only assessed by experts. Consequently, the diagnostic quality of lung thoracic CT images will be evaluated by radiologists after getting the results of this pre-study.

Pre-study model and questionnaire

Due to this pre-study the purpose, we opted for an evaluation method based on the "ordering by force-choice pair-wise comparison" protocol in order to assess the quality of the watermarked images according to different embedding strengths. That is why, our basic idea is to present to the observers on one screen a series of pairs of original/watermarked images according to different embedding strengths. More clearly, each watermarked image is displayed alongside its corresponding original version. The observers have then to visually compare the original image to its watermarked versions.

Herein, based on the "ordering by force-choice pair-wise comparison" protocol, for each pair of original/watermarked images, the observer is asked to answer the question: Table 5.8: Image quality measurements obtained for LSB substitution watermarking modulation according to the selected embedding strength β values, lossy JPEG 2000 with a compression ratio of 15, our joint watermarking-compression (JWC) and joint watermarking-encryption-compression (JWEC) schemes.

Quality measure ) SSIM Mean (variance)