Philippe Guillemant
email: philippe@guillemant.net

Alice Guyon

Thomas Lorivel

Julie Milanini

Caroline Bouissou

The cybernetical time

Keywords: space-time, multiverse, determinism, time lines, future, paths, free will, neural network, consciousness, extra dimensions

We consider the two mainstream cosmological models that can be derived from the two physical theories that are the best verified by experiments: general relativity and quantum mechanics, though they are incompatible and a major challenge in physics is to find how to reconcile them. The first model is the block universe, which is considered today as the best way to represent our space-time, if we accept all consequences of general relativity, which seem to imply in particular that our future is already realized and cannot change. The second is the Everett multiverse model, whose most popular interpretation is that it contains all alternative possibilities to conduct our life at our human level (with as many copies of our individual consciousness). Our purpose in this article is to show that the incompatibility between the two mainstream theories could be solved in its global principle via a cybernetical conception of time, through which the block universe would be made flexible. For this purpose, we show that the 6 extra dimensions of space-time we introduced in a previous paper (Guillemant 2018) could be used to coordinate space-time from its outside, so as to make it evolve in the cybernetical time from a 4D structure to any other one belonging to a 10D multiverse. We propose this coordination to be modeled thanks to a 3 layers neural network toy model, using two additional layers corresponding to the necessity to parametrize the choices of paths and destinations so as to restore determinism. The main interest of this approach is to maintain the possibility of a relative free will in our universe.

I INTRODUCTION

On the question of time, the famous philosophers Nietzsche and Bergson had at first sight incompatible intuitions, similar to the current conflict between the two big theories of modern physics that are general relativity and quantum mechanics. The first one wrote in "Human, all too human": "Our destiny exercises its influence over us even when, as yet, we have not learned its nature: it is our future that lays down the law of our today." A strange sentence, which harmonizes well with the theory of the block universe (stemming from the relativity) according to which our future would be already realized: it is then no more surprising that he can influence us. The second wrote, in The possible and the real: "What can be time? … Wouldn't it be the vehicle of creation and choice? Would time's existence not prove that things are undetermined?" Yet it was demonstrated actually, from 60 years later, that a major aspect of quantum mechanics implying indeterminism and non-locality was correct (Aspect et al. 1982[START_REF] Stefanov | Quantum correlations with spacelike separated beam splitters in motion: Experimental test of multisimultaneity[END_REF] and thus that it actually exists a fundamental indeterminism in the quantum scale, giving birth to the quantum model of the Everett multiverse [START_REF] Everett | Relative state' formulation of quantum mechanics[END_REF]. But according to the mainstream current consensus, which considers that this is the best interpretation of the quantum mechanics [START_REF] Wallace | The emergent multiverse. Quantum theory according to the Everett interpretation[END_REF][START_REF] Damour | Quantum cosmology: from Einstein to Everett[END_REF], this multiverse is interpreted as implying that all the alternative versions of our lives, resulting from different choices, could really exist with other self-aware copies of ourselves. We suggest in this article another perspective to reconcile both points of view that will lead us to envisage that the block universe is flexible (Figure 1), should it be only to protect the uncertainty and choices desired by Bergson. But does physics allow it? Here is the central question of this paper.

Figure 1: The metaphor of the invisible tunnel which directs our steps all the rest of our life is the consequence of the block universe in the human scale. The preservation of a free will in this context requires this tunnel to be flexible, so that is can change its position in time.

II THE EVOLUTION OF OUR IDEA OF TIME

The block universe is generally represented as a cylinder starting as a cone from the big-bang and whose main axis is time. We can represent it as well in our human scale as an invisible cylinder which directs our steps during all our life (Figure 1): any choice becomes impossible, unless this tunnel could change its position in time, which is not allowed by the standard block universe model that is perfectly static. Note that in this conception there is no more a present after which the future is not yet created: all the future is already created.

During the evolution of our conception of time, it has been often said that time does not exist. It simply means that the physicists do not understand yet today the sense of the present and that the variable "t" is even absent in the equations of physics (De Witt 1967) that are susceptible to reconcile the two big theories. In support with this, innovations such as GPS and atomic clocks show that we can travel in time a little bit and equations show that we can actually also travel in the far future (some models with wormholes even authorize travelling in the past).

On the question of time, general relativity and quantum mechanics are rather compatible. It is experimentally proven today in quantum mechanics, that the famous spatial non-locality experimented by Alain Aspect (1982) is not only a spatial one, but also a temporal one [START_REF] Megidish | Entanglement Swapping between Photons that have Never Coexisted[END_REF]. Particles may remain entangled1 not only through astronomical distances (without a signal that allows them to be correlated) but also over time. Indeed, many experiments have shown that there is a temporal entanglement and that quantum events can be correlated not only if separated by space, but also if they are separated by time, without any signal traveling in time.

Figure 2 is illustrating the evolution of our space-time models until a new view (to the right) where the past, the present and the future could be "now" and could even have other possible correlated versions of their states in different time lines, due to entanglement over time. Quantum gravity theories, though they have not been proved yet, are dealing with such potentials, which mean that time lines and in particular the future can fluctuate out of time. It implies that time does not exist in the sense of something that creates reality. It would rather be something that emerges, a thermodynamic emerging phenomenon [START_REF] Buonomano | Von Neumann Algebra Automorphisms and Time-Thermodynamics Relation in General Covariant Quantum Theories[END_REF]. It is until now considered that present time could be a thermodynamic illusion created by the brain itself [START_REF] Buonomano | Von Neumann Algebra Automorphisms and Time-Thermodynamics Relation in General Covariant Quantum Theories[END_REF].

III WHAT IF THE PRESENT HAD A REAL THICKNESS?

To get out of illusion, we should try to consider time as we consider space. At any point in spacetime, the locality of what we perceive around corresponds to a certain space thickness. But it also corresponds to a certain time thickness because there is no perception which doesn't correspond to an event (or a non-event) and then to a minimum duration. Wouldn't it imply that only events exist? This is anyway what Carlo Rovelli wrote in [START_REF] Rovelli | L'ordre du temps[END_REF].

To try to understand better this possibility, let's integrate the idea that time might not exist in the sense that the present could be prolonged by the future and preceded by a past, which would be just as real as now is. We could say that the present could have a real thickness, in the sense that our brain is capable of making us anticipate the future and memorize the past. But we can wonder if it is not the idea itself of a sequential time between past and future that could be an illusion, leading us to speak of anticipation and memory while their information is equally here. Because if we consider space itself, what we see on our right just as what we see on our left is equally in the present and has a space thickness. And if we consider now a present event, it also has a duration and then a time thickness. The idea that time would have no thickness (or just equal to zero) would then be only a thermodynamic illusion that would generate the impression of a front of the present creating reality.

We represented in Figure 3 two representation in green and blue to illustrate that. In green we can imagine the displacement of a brain-consciousness having a clear sensation of the thickness of the present. In blue, a brain without consciousness or with a little bit of consciousness: this brain will put illusory time at every point because its internal determinism will prevent it from detecting any possibility of bifurcation and finally make it navigate blindly, without having a choice to make in his trajectory. On the other hand, if we consider that time has a certain thickness which is the thickness of the consciousness (at this level one can even wonder about the difference between time and consciousness), we are facing a problem of choice. That is, if we find ourselves in front of a junction, the brain negates the existence of a choice whereas our consciousness will think there is a choice to make. So, the thickness of time, which could be something more real than the front of time (that is illusory sequential time), imposes us choices. But this consideration then raises the following question: does physics allow free will?

Figure 3: Illustration of the deterministic course of a sequential brain (small blue circles) with opposition to that of a consciousness to whom a thickness of time imposes choices (big green circles).

IV DOES PHYSICS ALLOW FREE WILL?

What does physics say about the possibility of choice? The indeterminism in quantum mechanics makes physicists speak about this possibility and there is even a theorem of free will [START_REF] Conway | The free will theorem[END_REF]. But in classical mechanics, we are not used to consider this possibility. It has even long been customary to consider that classical physics was deterministic, though it has been widely disputed by some renowned physicists. For example, Trinh Xuan Thuan wrote in a book (Xuan Thuan 2011), that chaos could liberate matter and that future could be no more exclusively determined by its present and past. Or physicists like Antoine Suarez and Nicolas Gisin, the first who have repeated in the relativistic field the famous experiments of Alain Aspect [START_REF] Stefanov | Quantum correlations with spacelike separated beam splitters in motion: Experimental test of multisimultaneity[END_REF], are both supporters of free will [START_REF] Gisin | Physics killed free will and time's flow. We need them back[END_REF][START_REF] Suarez | Is science compatible with free will?[END_REF]). In his last paper (Suarez 2017), Suarez says that the quantum multiverse belongs to our choices and that we would have a free will thanks to that. In addition, Nicolas Gisin said in [START_REF] Gisin | Physics killed free will and time's flow. We need them back[END_REF]) that free will can exist because the real numbers that allow classical physics to be deterministic do not exist in reality. That is to say, we cannot inform a number describing reality with an infinity of decimals.

If we think about all the reasons for questioning the determinism of classical mechanics, we always come to a problem with information. This led us to do research from calculations of billiards and then to publish recently an article in Annals of Physics [START_REF] Guillemant | A discrete classical space-time could require 6 extra-dimensions[END_REF]. In this paper we conclude that mechanics absolutely does not determine the course of events, except briefly or incompletely. We propose that to determine the course of events, we have to add 6 dimensions to the space-time: 3 to define the choices that must be made in the present in the presence of bifurcations, and 3 others to define the choices that must be made to determine the destination. According to this theory, the physical laws would not determine neither in the present nor in the future, what we are going to make, because mechanics would be incomplete. Indeterminism always remains, and our above paper concludes finally, by making the link with the quantum gravity, which ends actually in the same report, that additional extra-temporal information is required to make the choice of trajectories.

At the origin of this strange statement stands the problem of physical information.

V INFORMATION: A PHYSICAL QUANTITY

For at least a century and a half, physicists fought to try to find a solution to the famous paradox of the demon of Maxwell (Figure 4). This paradox consists in just giving information to a demon having the capacity to open or close a small door between two gas chambers without consuming energy, allowing him to sort the gas molecules, resulting thereby in heating or putting pressure on one side or the other, thus creating a way to extract energy, simply from information [START_REF] Szilard | On the Reduction of Entropy in a Thermodynamic System by the Intervention of Intelligent Beings[END_REF].

This problem was the object of a lot of confusion and a vast debate (Norton 2005, Leff and[START_REF] Leff | Maxwell's Demon 2: Entropy, Classical and Quantum Information[END_REF] as it contradicts the famous second law of thermodynamics stating that the entropy can only increase. In addition, if it were realistic, it would allow extracting energy very easily, and if it were true, we would know. Today this problem is considered to be solved by considering that information has a cost in energy. This idea was initially proposed by [START_REF] Landauer | Information Is Physical[END_REF] and it was finally demonstrated in 2012 [START_REF] Bérut | Experimental verification of Landauer's principle linking information and thermodynamics[END_REF]) that manipulating bits actually costs an energy equal to k T ln(2), where T is the temperature et k the Boltzmann constant. This shows that information must be placed alongside the usual physical quantities of mass, energy, etc...

At the quantum scale, we also have the Heisenberg fundamental principle of uncertainty: one cannot know both the position and the momentum of a particle. This principle comes down to limiting the amount of information from the phase of a particle to a certain bounded value. It means that like other physical quantities, the information in the universe is always a finite quantity.

Now let us move on to quantum gravity theories. In order to unify quantum mechanics with general relativity, these theories are also obliged to use models that consider that no length less than the length of Planck (about 10 -35 meters) has physical sense. Looped quantum gravity goes even further by postulating straight that all the information associated with any physical object is finite, including mass, energy, time [START_REF] Rovelli | Et si le temps n'existait pas : un peu de science subversive[END_REF]. Therefore, we would finally live in a universe of information. And it is not so surprising insofar as information is primary before physical quantities, because a mass or a temperature are information, in the sense that they are characterized by information. We can easily admit this, as soon as we understand that physics leads us to accept a reversal of perspective in which information is physical. Many different theories are already in accordance with this view, for example the holographic model of [START_REF] Maldacena | The Large N limit of Superconformal Field Theories and Supergravity[END_REF]. This is finally like a coming back of the Plato's cave metaphor.

So today, physics discovers that information comes first. Now, what is information but consciousness, and what is consciousness if not information? If information is really linked to consciousness, how could we conceive infinite information? Let us remind that the great physicist John Wheeler has been given the phrase "It from bit": everything is information.

The key point is then to understand that everywhere in the universe information is finite.

Figure 4: The paradox of Maxwell's demon bases on the thought experiment concluding that a demon who would be capable of opening or closing a small door between two surrounding gas chambers would have the capacity to create energy without consuming any (or a negligible quantity).

VI THE PARADOX OF DETERMINISM

We can now explain the extra dimensions proposed in our recent paper (Guilllemant 2018). When information becomes fundamental and finite, the problem of propagation of uncertainty (Figure 5) in dynamical complex systems, such as a billiard but also into all living systems, becomes a fundamental problem. It implies that mechanics cannot calculate beyond a certain amount of information that we found to be of the same order as information contained into initial conditions.

If we do not add more information, we calculate a multiverse and not a single reality. If we do not add extra information, information density decreases over time, due to increased uncertainty during interactions, and the system becomes a quantum system. But things around us are not quantic, so this means that there is something which adds information to our environment. This information doesn't come from decoherence 2 , because this process doesn't bring information when choices are made at bifurcations. It means that there is extra-dimensional information that intervenes to help mechanics to create a single reality. This additional information would come either from additional dimensions, from outside space-time, from the quantum vacuum or from the future. We don't know yet, but in a universe of information all of them could mean the same as we are talking about extra space-time data.

This implies that the basic laws of mechanics must be conceived as laws transforming an information into another, like if they were unfolding reality during a certain time, rather than as laws that create reality. It means that the laws of physics would not be creative. Mechanics laws are working only in special cases when there are very few interactions or when we consider planets, or objects that interact very little with their environment, or when this environment has a low mass compared to the mass of the body. Although it is only in special cases that the mechanics is deterministic, we have developed our vision of the world from these particular cases, while in reality mechanics cannot generally create the course of events. This result we published is in accordance with other results that mathematicians published two years ago [START_REF] Bodineau | The Brownian motion as the limit of a deterministic system of hard-spheres[END_REF], for which they were awarded in 2016 by the French popular scientific review "La recherche". These mathematicians have shown that with deterministic equations, after a certain time in a billiard table the balls have lost the information corresponding to their initial conditions and a Brownian movement is established.

2 Decoherence is the loss of quantum coherence, meaning that the wave function of a particle with multiple simultaneous states has been destroyed so that the particle has become a classical one with a unique state. The gradual mechanism of decoherence has been experimentally highlighted for the first time in 1996 by the french physicist Serge Haroche and his team, awarded by the Nobel Prize. This natural loss of information would then be at the origin of a macroscopic multiverse: the laws of physics would not calculate a single reality but a multiverse of potentialities. However, we still do not know if alternative potentialities are really physical universes or just virtual ones that don't exist really.

Figure 5: The increase of the uncertainty δ in the interactions leads inevitably at the end of a critical time to the occurrence of a multiverse of distinct trajectories, whose number of branches is increasing geometrically with the number of shocks.

VII SWITCHING TIME LINES OF A MULTIVERSE

We calculated the growing law of the number of multiverse branches in a billiard table, and found that it is independent of the accuracy of the calculations. We can work at a precision down to the Planck scale and even below, we never prevent the multiverse and always have exactly the same increase in the number of bifurcations after a certain delay.

This means, by making a shortcut, that classical physics is much more like quantic than we usually think. There would be enough similarities between classical and quantum mechanics to question their ontological difference, which would be at least that classical mechanics reveals multiple realities (or potentialities) only after a certain delay in the future, that we never reach. This delay from the present moment is depending on the considered system. If we consider a planet, it is going to be very large, but if we consider a living system it will last only a few seconds.

What about the process of decoherence in the absence of observers (in the future) susceptible to inform their environment? We know that for a non-isolated system, the decoherence mechanism prevents our reality to become quantic. However, even in the presence of observers, the decoherence process does not prevent the multiverse from settling down because it does not determine the necessary choices. Furthermore, it does not inform us about the future we have to live. The choices that are made remain mysterious, because even if we consider that all possible choices exist in separate universes, the problem remains namely that we always need extradimensional information to inform us about the universe we are living in. Now we will examine more speculative but important consequences of our paper [START_REF] Guillemant | A discrete classical space-time could require 6 extra-dimensions[END_REF] for our daily life. Finally, in a billiard table but also in any complex system, all the possible final conditions compatible with the initial energy are systematically reached after a certain time. If in addition we wait long enough, we can even allow the luxury of finding a multitude of paths that connect initial and final conditions. As it is valid for all types of interactions, we could extend it to our human scale. Let us have an example: Tonight we are planning to go back to our home. The path that we will follow is now perfectly defined according to the theory of the block universe. However, in an hour, this trip may have changed because maybe this afternoon we have met someone who will make us follow another path. Does physics make it possible? Yes, because it is possible to keep exactly the same future tomorrow while changing the path, without changing the structure of the universe. We just have the freedom to choose the path that will allow us to go back to our home tonight. Even in the case we meet a person who will have a great influence on our life, it does not create a problem to the dynamics of space-time, because if really in our future we do something with this person, space-time will be able to send us another opportunity to meet him or her. According to this view, there is enough fluidity thanks to this multiverse that can be adjusted from the final conditions, to bring us a true free will in our daily life.

VIII DISCUSSION

How to model an unstable future?

The possibility for our space-time to be flexible, as Figure 1 is illustrating, stands on two key points:

First, we have supposed that we could switch time lines, i.e. change the program: this is a speculative proposition but it is a fundamental question, which needs serious consideration.

Second, extra-dimensional information necessarily plays a role and determines the paths, the commutations and the changes of paths that we are going to take: that is still physics.

Nevertheless, where does this information come from? Now we cross the borders of physics if we consider that free will is involved. In other words, could our brain-consciousness system be a navigation system?

From our "time thickness" concept of consciousness, we have to make a difference between brain and consciousness. Brain, like decoherence, does not seem to be able to make the choices at bifurcations. Only consciousness seems to be able to bring extra dimensional information that make us live only one reality. This is a classical point of view, but it is similar to the well-known role of observer in quantum mechanics.

Still we have to solve a problem before considering that commutations at bifurcations are possible: how can we make the different commutations compatible together? If we switch the course of the events, we will change the life of someone who will be on our new course, etc. Can physics allow it? Would there be a risk to cause a sort of space-time collapse? We can answer negatively if we consider, thanks to the principle of macroscopic entanglement, that all switches can become compatible with each other.

Today this generalization of entanglement to the macroscopic level is more and more accepted by great physicists. Thibault [START_REF] Damour | Quantum cosmology: from Einstein to Everett[END_REF] for example, talks about it in quantum cosmology, a possible generalization of quantum mechanics on a macroscopic scale.

Neural networks and quantum entanglement

Recently, the entanglement has been simulated with the help of neural networks (Dong-Ling et al. 2017), which means that neural networks can allow coding various quantum states. As the reduction of entangled states needs information outside space-time (quantum fate), this allows us to better understand why the space-time could be coordinated by brains, in its future timeless evolution.

But if the possibility to change the future in a macroscopic manner takes place thanks to entangled temporal lines, it remains to understand how this process could be stabilized, because the impact of a change of a temporal line on other changes could echo in the infinity. A solution to this problem is simply to forbid this process when it is incompatible with the future, which signifies the acceptance of retrocausality.

Today highly famous physicists like Yakir Aharonov move in this direction. The latter demonstrated that it is possible to accommodate quantum mechanics with our free will on the condition of accepting retrocausality [START_REF] Aharonov | Accomodating retrocausality with free will[END_REF]. In other words, it is possible to accommodate the indeterminism of our reality with the possibility of making choice, thus to replace our temporal lines, on the condition of accepting retrocausality.

This retrocausality should not be shocking. It is only shocking if we believe it is a signal. Initially, when Costa de Beauregard proposed this concept in the 50s (Costa de Beauregard 1953), it was frowned upon because people understood that a signal was sent from the future. This is not a good interpretation because it is rather the same sense as a spatial entanglement, meaning a temporal entanglement without signal. It is not a problem in a universe where the future is already there and the past still there. Simply one must reason with events and time lines instead of reasoning with points of matter that move in time.

Today, physics teaches us to stop reasoning with matter that moves in time. Moreover, it makes us realize that matter does not exist, that there are only space-time densities of probability of presence, etc.

After understanding the pertinence to replace moving points by time lines, we think that retrocausality is the next key point to really understand time… and consciousness.

The great mystery of time

One could finally solve the great mystery of time if taking seriously, all what physics suggests to us. The biggest problem for physicists right now is to resist to dogmas: strict causality, determinism, irreversibility, brain created consciousness, etc. When we relativize dogmas and take seriously all the results of physics experiments and theoretical models, we conclude that reality is not created in time but in another way as suggested by Carlo [START_REF] Rovelli | Et si le temps n'existait pas : un peu de science subversive[END_REF]. Time does not exist in the sense of a front already created: the past still exists and the future is already there, but we add in this paper the fact that it is simply flexible: it can change. Then the key point is that the future could influence the present.

Our cybernetic point of view, due to a long experience in computing engineering, tells us that it is possible to create a mini space-time, like a toy model. For example, if we ask to an engineer: "you shall calculate the future according to the information we give you about the present moment", he will not be able to do it, because as he would have to bring in outside information, there will be a high risk to introduce a bug to the system. On the other hand, if we ask him: "you shall consider such future and calculate the present reality while changing step by step that of the future", then he will have no problem. If you ask him to explain to you how he is doing that, he will answer you:

"I just use a switching system to introduce your information in my system. switching of time lines of a lot of people to take them safely to work and avoiding traffic jams, how can we still believe that the universe is unable to do so?

Now let us try to make a link between physics and consciousness. It is quite conceivable that the information introduced to achieve these commutations expresses itself through quantum gravity.

Although we do not intend to develop the quantum gravity concept here, let us quote simply the physicist Roger Penrose who proposed to connect consciousness to quantum information in the brain, via the Orch' OR model (Penrose and Hameroff 2011) which is involving orchestrated reduction of quantum states in the microtubules of the brain.

A multistage cybernetic model

According to what precedes, it is possible to model in a very simplified way the process of spacetime coordination by quantum information -stemming from quantum gravity or brain consciousness -by using the 3 layers perceptron toy model of a neural network. Considering also the billiard toy model of the space-time, the first layer is constituted by neurons that identify commutable time lines, for example the trajectory A of a given ball that can be replaced by another one. The neurons of the second layer identify all other ball trajectories that also have to commutate if A is changing, so as to manage their entanglement. The third layer is then constituted of neurons that identify given final conditions. If we consider now extra dimensions and a more realistic neural network that would manage space-time flexibility, it would be constituted of 3 layers of 3 spatial dimensions which would be scheduled with information to determine path and destination. It could then gradually change the space-time within all its possibilities of realization into the multiverse. This would involve the introduction of models susceptible to mimic the properties of consciousness such as intention and attention, but we shall not approach these questions, which rather concern psychology.

Let us recall that this modeling requires the acceptance of a double causality, i.e. an influence of the future on our present. To the question "is the double causality a falsifiable theory?" we answer positively by specifying that we have tried, within the framework of a research contract between the CNRS and a webmarketing company (Guillemant 2016[START_REF] Guillemant | A discrete classical space-time could require 6 extra-dimensions[END_REF], to falsify this theory during the last four years. The way we explored this question was the introduction of random choices in the advertising or web robots, so as to highlight via a statistical analysis a possible effect of serendipity, that is the trend (of Internet users) to find accidentally a product which returns a wished service. The principle of this research was to constitute two equiprobable groups of web users receiving advertisements at randomly chosen times, by using a generator of quantum random numbers. For the first group each random draw was renewed for each individual, while for the second it was identical for all the group, but all the draws still differed by using individual offsets. The results obtained at the beginning of 2018 were positive in favor of the existence of such a serendipity effect, with a probability that it was due to chance equal to 1/56.

IX CONCLUSION

We can conclude from the above analysis that it is possible to reconcile the views of Bergson and Nietzsche about time, thanks to a cybernetic conception of a flexible space-time, although forced simultaneously by initial and final conditions. This double constraint has the merit to solve spacetime paradoxes via a double causality, which takes into account its flexibility by means of a neuronal control involving outside information contained into additional dimensions… or consciousness.

This implies to relativize the ontological scope of the equations, because equations are tools and their premises (determinism and continuity) are not compatible with observed reality.

It also involves finding the appropriate cybernetic models, which could be fractal, multiscale or neuronal, to connect entanglement, indispensable for commutations, and different stages or dimensions, and then to accept the idea of an a-causal configuration in physics. Note that the need to inform about the final conditions already exists, as for example in fluid mechanics into appropriate dynamic models.

In human sciences, it means avoiding confusion between brain and consciousness, which play the role of providing additional information, and accepting the research for experimental protocols to falsify or highlight the influence of the future on the present.

Concerning the validation of this view of space-time, we think that the technologies of the internet and big data offer promising paths on this direction. Among others, the biggest brake to our understanding remains the paradigm of our mechanistic current system of thought, which prevents the researchers to break the dogmas and to venture beyond borders of their discipline.

Figure 2 :

 2 Figure 2: The evolution of our conception of space-time, from the presentism to a static block universe where the present time has disappeared or another view where entangled time lines could make space-time flexible.

  ISSN: 2430-3038, ©JIMIS, Creative Commons Revue en libre accès : j i mi s . e p i s c i e n c e s . o r g Volume : 7 -Année : 2019, DOI : 10.18713/JIMIS-210219-7-4

  ISSN: 2430-3038, ©JIMIS, Creative Commons Revue en libre accès : j i mi s . e p i s c i e n c e s . o r g Volume : 7 -Année : 2019, DOI : 10.18713/JIMIS-210219-7-4

  ISSN: 2430-3038, ©JIMIS, Creative Commons Revue en libre accès : j i mi s . e p i s c i e n c e s . o r g Volume : 7 -Année : 2019, DOI : 10.18713/JIMIS-210219-7-4

  But I switch only when I can switch. It is like a GPS: you are moving in a car, you have a perfectly precise journey and at any time the GPS tells you to go there, to turn left or right, etc. Well you have the option of not following what the GPS says. You keep your free will. And what will the GPS do? It will recalculate your course. For a while, it will tell you to turn around, until it understands that in fact you wanted to do something else. As its destination is still scheduled, it has found a new route to take you to your destination.

"

Note that in this process, at no time the GPS has lost the thread of history. If we are able to conceive that now, thanks to technology, a system a little complicated and clever can manage the ISSN: 2430-3038, ©JIMIS, Creative Commons Revue en libre accès : j i mi s . e p i s c i e n c e s . o r g Volume : 7 -Année : 2019, DOI : 10.18713/JIMIS-210219-7-4

Particles are entangled when the quantum state of each particle cannot be described independently of the state of the other(s), even when they are separated by a large distance.


Chapter 10

Hybrid Coding: Encryption-watermarking-compression for Medical Information Security

Introduction

Nowadays, more and more digital images are being sent over computer networks. The works presented in this chapter show how encryption and watermarking algorithms provide security to medical imagery. In order to do this, the images can be encrypted in their source codes in order to apply this functionality at application level. In this way, the encryption and watermarking of images occurs at software level. We can therefore guarantee the protection of a medical image during transmission, and also once this digital data is archived. The subsequent challenge is to ensure that such coding withstands severe treatment such as compression. The quantity of information (entropy) to be sent greatly increases from the original image to the encrypted image. In the case of certain types of medical imagery, large homogenous zones appear. These zones affect the effectiveness of the coding algorithms. Nevertheless, these homogenous zones, useless for any diagnosis, can be safely used for the watermarking of medical images.

When a physician receives a visit from a patient, he often requires a specialist opinion before giving a diagnosis. One possible solution is to send images of the patient, along with a specialist report, over a computer network. Nevertheless, computer networks are complex and espionage is a potential risk. We are therefore Chapter written by William PUECH and Gouenou COATRIEUX. faced with a real security problem when sending data. For ethical reasons, medical imagery cannot be sent when such a risk is present, and has to be better protected. Encryption is the best form of protection in cases such as this. Many different techniques for the encryption of text already exist. Since ancient times, humanity has attempted to encode secret messages in order to elude wandering, indiscreet eyes and ears. The most basic forays into this field relied upon algorithms which allowed coding and decoding. Over time, the notion of a key arose. Today, encryption systems rely upon algorithms which are available to the world at large, and it is the key, a code which remains confidential, which allows for the encryption and decryption of the message [KER 83].

In section 10.2 we will show how essential it is to ensure the security of medical imagery and data. Then in section 10.3 we will present the standard encryption algorithms and will show, in section 10.4, how these can be suited to medical imagery. Finally, in section 10.5, we will show how it is possible to hide data in these images, while retaining a high level of image quality.

Protection of medical imagery and data

Developments in techniques for the treatment, sharing and communication of medical imagery, and medical information in general, go hand in hand with an increased risk for information in a digital format. Medical information in general is chiefly made up of the results of analyses, clinical and para-clinical examinations, and personal information [DUS 97]. Possibilities for distant access and the sending of information have increased the chances of leaks, losses and alterations of the information which are also greater due to, or even assisted by, the availability of network surveillance tools and advanced editing tools such as imagery software.

However, it is the consequences brought about by the occurrence of these risks which create the need for the protection of medical information. These consequences, which are not negligible, concern an individual and his health, and the privacy of these. This is why many countries attribute legal and ethical weight to this question; acknowledging patient rights and thereby obliging medical professionals and health centers to ensure the protection of the data in their possession.

Legislation and patient rights

Legislation and the medical ethics code accompany the technical evolution and, through a number of important legal texts, recognize patient rights. The first, and best-known, refers specifically to the patient-doctor relationship and concerns medical confidentiality. The guaranteed confidentiality of any information which a patient may exchange with anyone in the healthcare system allows a relationship based on trust to be established. This relationship also enables the healthcare professional to judge the patient's situation as effectively as possible.

The computerization of the health system and the possibilities this offers both in terms of the mechanization of treatments and the sharing of information, has resulted in the widening of the legal coverage of the field, and new laws must be taken into account by healthcare professionals; in particular in France law no. 78-17 of 6 th January 1978 -known as the "information technology and freedom law", complemented by the law of 1 st January 1994, the "law pertaining to the treatment of data, with regard to health sector research". In France, the CNIL (National Commission on IT and Liberty) has the task of ensuring that these laws are respected (articles 6 to 13). These laws, aside from the collection of information, give every citizen -and therefore every patient -the right to control the use of information which concerns them personally [DUC 96]. In particular, the patient has a right to security, and article 29 states that it is the responsibility of the healthcare professional to take "every possible measure to ensure the security of the information, and particularly to ensure that it is not altered, damaged or allowed to reach unauthorized third parties". If this law is not respected, legal measures can be taken (article 226-17 of the penal code). From a practical and technical point of view, working groups such as that put in place by the European Standards Committee TC/251 Medical Information (Working Group III), show that in order for this criteria to be met, the following must be achieved [ALL 94]:

-the confidentiality of the data, by restricting access to the rightful owners (the patient and the healthcare professionals dealing with his case, considering the collaborative nature of medical practice and derogations allowed by the law);

-the integrity of the information, ensuring that the information has not been modified by anyone but a qualified person in agreed conditions; -the availability, which guarantees access to the data within standard procedure.

A wide range of protection measures

Whatever the nature of the information, we can distinguish three types of protection measure for data stored, treated and sent using an information system: the legislation, security policies and protection mechanisms. These measures should be considered together in order to meet the AIC (Availability, Integrity and Confidentiality) requirements for the data. Nevertheless, these measures vary amongst themselves according to the target information system and its context. We can draw a difference between the systems installed at a single practitioner's practice from those of a health center -whether fitted or not with communication applications such as telemedicine applications.

The first type of legal measure aims to discourage those who would infringe either deliberately or accidentally the confidentiality, integrity and availability of data and information systems (e.g. in France, the Godfrain Law no. 88-19 of 05/01/1998). However, such measures are only effective if it is possible to detect the intrusion of a third party into an information system. A healthcare establishment's security policy aims to set the strategy for the implementation and upkeep of the highest security level. This policy decides upon, among other things, various protocols for the usage of information and systems, taking into consideration the risks to the AIC of the data and the specific roles of the various parties present in the hospital framework. Most notably, it is up to the security policy to decide and regulate the use of protection tools and mechanisms. These physical or logical mechanisms are numerous and entail more or less complex procedures to be carried out. The first group deals with the physical protection of the material (restricted access to the rooms concerned, steps to avoid damage from the elements, to prevent theft, etc.), and the second group is integrated into the information systems. The tools which we will study in this chapter fall into this second category; cryptographic tools (encoding and digital signatures) and the watermarking of images. Among the other logic protection mechanisms we can include [COA 03]:

-access control which includes a policy determining those with a right to the information or access to the workings of a system, and technical solutions for the identification of users, such as chip-card systems, or biometric screening; -firewalls whose primary task is to control access to the system both at the entry and exit stages, as soon as the system is connected to a network; -antivirus systems; -auditing which allows us to keep a record of the access made to the information by users or computer programs.

It is important to highlight the fact that these mechanisms are complementary, and are therefore to be used alongside one another. Additionally, some of these mechanisms, such as access restriction, rely upon cryptographic systems. The watermarking of images has come into use more recently, and has found its place among the range of tools on offer. Before discussing these techniques, let us return to medical imagery. These images are often produced, stored and communicated with the DICOM standard described in Chapter 4. This standard is more than a simple storage format, and includes very specific "profiles" or procedures, with the aim of guaranteeing the AIC requirements for storage and exchange between DICOM-compatible systems. These profiles are based on cryptographic mechanisms.

Basics of encryption algorithms

Encryption algorithm classification

There are four key objectives for the encryption of digital data:

-confidentiality or masking of the data -the most widely-used characteristicwhich aims to render the cryptogram unintelligible to anyone without the key;

-authentication allows the sender to sign his message, thereby leaving the recipient in no doubt as to who sent the message; -integrity serves to assure the recipient that the message content has not been altered or manipulated since its creation; -non-repudiation is the guarantee that neither of the parties involved will be able to deny having sent or received the message;

The most important objective for medical imagery is, naturally, the first: confidentiality. However, the notion of integrity described in section 10.2., as well as the two others, is also important in the protection of medical imagery.

Encryption algorithms can be separated out according to various characteristics: the systems with a secret key (symmetric systems), illustrated in Figure 10.1, and those with public and private keys (asymmetric systems), shown in Figure 10.2 [DIF 76], [STI 96]. The secret key systems are those which allow encryption and decryption with the same key. It goes without saying that the sender and the recipient must beforehand have exchanged the secret of this key, via a secure method of communication. The systems using a public or asymmetric key can overcome this step by using one key to encrypt the data, and another to decrypt it. Each person should possess a pair of keys, one of which is confidential (the private key) and the other known by the world at large (the public key). In order to write to B, all that needs to happen is for the message to be encoded with the public key of B, which is known. Upon reception, only B will be able to decrypt the message with his private key. In this section, we present several data encryption systems; symmetric block systems, with a secret key (DES and AES), an asymmetric block system, with a public key (RSA); and a stream cipher system.

The DES encryption algorithm

The DES (Data Encryption Standard) algorithm is one of the standard systems for block encryption (Figure 10.1). Its security relies entirely upon the secrecy of the key, as the algorithm is public. In 1974, the DES algorithm became the first standard of modern cryptography [SCH 95]. The DES algorithm is based on 16 rounds, (a collection of stages repeated 16 times) during which a data block of 64 bits is mixed with the key K, which is also encoded on 64 bits. At each of these rounds, a sub-key k i is calculated from the initial key K (this sub-key will serve to mix up the block's bits). Once the 16 sub-keys have been generated from the secret key, it is possible to cipher (or decipher) a 64-bit block of data. The process begins with an initial permutation (IP) which changes the order of the bits in the initial block, before splitting the result into two blocks of 32 bits, L 0 and R 0 . Once the 16 rounds have been passed, and before giving the result, a final permutation must be applied to the block. This permutation is no more than the inversion of the IP. For the decryption, the process is the same, apart from the fact that the sub-keys are used in the opposite order.

Today, even if the algorithm is still respected, it suffers somewhat from the fact that the length of its key is limited to 64 bits. The current performance-levels of machines, in terms of computational time, make the DES breakable. The so-called brutal attack involves trying all of the 2 64 potential keys, and is nowadays feasible for big calculators. A solution has been produced to increase the security level: it is called the triple-DES. The triple DES involves the encryption of the entry block three times with three different keys: K 1 , K 2 and K 3 . There are several variations, but in general the first and third operations are encryption operations, whereas the second is a decryption operation. Often, we choose that K 1 = K 3, which does not allow the whole key to go beyond 128 bits.

The AES encryption algorithm

The AES (Advanced Encryption Standard) algorithm is the standard system for block encryption and aims to replace the DES which has become vulnerable. The number of rounds in the AES algorithm depends upon the size of the key and the size of the data blocks. For example, the number of rounds is 9 if the blocks and the key have a length of 128 bits. To encrypt a block of data with AES (Figure 10.3), we must first of all complete a stage called "AddRoundKey", which involves applying an "exclusive OR" (XOR) between a sub-key and the block. After this, we enter into the operation of a round. Each regular round operation involves four steps. The first step is called "SubByte", where each byte of the block is replaced by another value created by an S-box. The second step is called "ShiftRow", where the rows are cyclically moved with different offsets. In the third step, called "MixColumn", each column is treated as a polynomial which is multiplied with a matrix in the GF(2 8 ) (Galois Field). The final step of a round is again called "AddRoundKey", which is a simple XOR between the given data and the sub-key of the given round. The AES algorithm carries out a final additional stage made up of the "SubByte", "ShiftRow", and "AddRoundKey" stages before producing the final encryption. The process applied to the "plaintext" (original data) is independent of that applied to the secret key, with the latter being called "KeySchedule". This is made-up of two components: the "KeyExpansion" and the "RoundKeySelection" [DAE 02], [AES 01]. The AES algorithm can support the following encryption modes: ECB, CBC, OFB, CFB, CTR, etc. The ECB (Electronic CodeBook) mode is that of the standard AES algorithm as described in document 197 of the FIPS (Federal Information Processing Standards). From a binary sequence X 1 , X 2 ,..., X n of plaintext blocks, each X i is encrypted with the same secret key k in order to produce the coded blocks Y 1 , Y 2 ,.., Y n . The CBC (Cipher Block Chaining) mode adds a step before the encryption. Each encrypted block Y i is added by an XOR to the new current block X i+1 before being encrypted with the key k. An initialization vector (IV) is used for the first iteration. In fact, all the modes apart from ECB need an IV. In the CFB (Cipher FeedBack) mode, IV = Y 0 . The dynamic key (or key stream) Z i is generated by

Z i = E k (Y i-1 ), i > 1,
and the encrypted block is produced by Y i = X i ⊕Z i . In the OFB (Output FeedBack) mode, as in the CFB,

Y i = X i ⊕Z i but VI = Z 0 and Z i = E k (Z i-1 ), i > 1.
The input data is encrypted after an XOR with the output Z i . The CTR (counter) mode has characteristics very similar to those of OFB, but it also allows for a random access for the decryption. It generates the following dynamic key by encryption of the successive value provided by a counter. This counter can be a simple function which produces a pseudo-random sequence. In this mode, the output of the counter is the entry of the AES algorithm.

Even if AES is a block encryption algorithm, the OFB, CFB, and CTR modes operate like stream ciphers. These modes require no particular measure concerning the length of messages. Each mode has its own advantages and disadvantages. In the ECB and OFB modes, for example, any change in the plaintext X i results in a modification in the corresponding encrypted block Y i , but the other encrypted blocks are not affected. On the other hand, if a plaintext X i is changed in the CBC and CFB modes, then Y i and the new encrypted blocks will be affected. These properties mean that the CBC and CFB modes are useful for authentication, and the ECB and OFB modes treat each block separately. As a result, we can note that the OFB mode does not propagate noise, whereas the CFB mode does.

Asymmetric block system: RSA

The RSA algorithm is the most widely-used asymmetric system. Its security relies upon the slowness of current computers for factorizing very large numbers into products of prime numbers [SCH 95], [SHA 78]. Let p and q be two very large distinct prime numbers, and n a very large number which is the product of p and q.

We write as φ(n) the Euler function in n in order to have numbers smaller than n and first with n, with φ(n) = (p-1)(q-1).

The public key/private key pair will reside in two numbers, d and e associated with n. e is first calculated randomly between 2 and φ(n) and must be prime with φ(n). The (n,e) pair is the public key. Then d is calculated such as d = e -1 mod(n).

The extended Euclidian algorithm allows the calculation of this inversion, even in the case of very large numbers. The (n,d) pair is the private key. The use of keys for the encryption and the decryption is as follows. If m is the original message (lower than n, otherwise it is cut), we encrypt it with the public key (n,e) raising it to the power e, modulo n. We obtain the encrypted message m' = m e mod(n). For the decryption, we need the private key second key (n,d). By raising the encrypted message to the power d modulo n and as d and e are inverted modulo n, we obtain:

m n m n n m n m ed d e d = = = ) mod( ) mod( )) mod( ( ) mod( ) ' ( [10.1]
For example, if Bob wishes to send a message to Alice, he converts his message into numbers, and cuts the message into blocks of a size smaller than n. For each block m i , using Alice's public key, Bob calculates and codes the block as follows:

), mod(n m c

e i i = [10.2]
with i, the position of the block in the text, i ∈ [1,N], if N is the number of blocks.

Alice, with her private key, can then decrypt the message by doing:

) mod(n c m d i i = [10.3]
Thus, the RSA method differs from the symmetric encryption systems in that it uses two different keys for encryption and decryption (Figure 10.2). One of these two keys, the public key is meant to be known to everyone, and the other, the private key, is known to only one individual. The RSA algorithm can allow either encryption with a public key, in which case only the recipient will be able to decrypt the message with his private key, or encryption with one's own private key (signature). In this case, everyone can read the message thanks to the public key, but the sender was able to sign the message, since he is potentially the only person who could have encrypted it with his private key. A double encryption, using public key/private key therefore allows combining a signature with confidentiality (Figure 10.2b).

Unfortunately, RSA is a very slow algorithm; much slower than any symmetric system, and even more so because the numbers used are very large. Moreover, it is easily breakable today, even for 512 bits 3 numbers. It is currently advisable to use keys 1,024 bits long. It is therefore preferable to use it to send a secret key in a secure way, which will allow the message to be decrypted, with AES faster than RSA.

Algorithms for stream ciphering

Algorithms for stream ciphering can be defined as algorithms for encryption by block, where each block has a unitary dimension (1 bit or 1 byte) or is relatively small. Their main advantages are their very high speed and their ability to change each symbol of the plaintext. With a stream cipher algorithm, it is possible to encrypt each character of the plaintext separately, using an encryption function which varies each time (these algorithms therefore need memories). In general, algorithms for stream cipher are made up of two stages: the generation of a dynamic key (key stream) and the encryption output function using the dynamic key.

When the dynamic key is created independently of the plaintext and the ciphertext, the stream cipher algorithm is synchronous. With a stream cipher algorithm, the sender and receiver have to synchronize using the same key at the same position. Synchronous stream ciphers are used in environments where error is common, because they have the advantage of not propagating errors [GUI 02]. Concerning active attacks, such as the insertion, deletion or copying of digits of the ciphertext by an active adversary, these attacks immediately result in a loss of synchronization. The encryption process of a synchronous stream cipher is described in Figure 10.4, where f() is the function which determines the following state, g() is the function generating the dynamic key, and h() is the encryption output function:

⎪ ⎩ ⎪ ⎨ ⎧ = = = + ) , ( ) , ( ) , ( 1 i i i i i i i m z h c s K g z s K f s , [10.4]
where K is the key, s i , m i , c i and z i are respectively the i th state, plaintext, ciphertext and dynamic key. The decryption process is shown in Figure 10. When the dynamic key is generated from the key and a certain number of previous ciphertext, the stream cipher algorithm is called asynchronous, also known as a self-synchronous stream cipher. The propagation of errors is limited to the size of the memory. If digits of the ciphertext are erased or added to, the receiver is able to resynchronize himself with the sender, by using the memory. As for active attacks, if an active adversary modifies any part of the digits of the ciphertext, the receiver will be able to detect this attack. The encryption process of an asynchronous stream cipher is described in Figure 10.5, where g() is the function which generates the dynamic key, and h() the encryption output function:

⎩ ⎨ ⎧ = = - - + - - ) , ( ) , ,..., , , ( 1 2 1 i i i i i t i t i i m z h c c c c c K g z , [10.5]
where K is the key, m i , c i and z i are respectively the i th plaintext, the ciphertext, and the dynamic key. We can observe in equations [10.5] that the dynamic key depends upon the previous t digits of the ciphertext. In order to resist statistical attacks, function g(), which generates the dynamic key, must produce a wide period sequence, with good statistical properties which can be called pseudo-random binary sequences. The decryption process is illustrated In this section, we will demonstrate how it is possible to apply the above algorithms to medical images in the grey level. In the case of 1D medical signal, the standard coding algorithms can be applied directly. However, because of the bidimensional characteristic of images, and their size, these standard algorithms must be modified in order to be used effectively on medical images. The aim of image encryption is to obtain an image in the same format and without increasing the size above that of the original image. The encryption of images is considered as a source coding to process this functionality at the application level. Due to this, if a user does not possess the key, he does at least have access to an image in a known format. By carrying the encryption step up to the application level, it is possible to proceed, for example, towards a region of interest of the image. In the case of large images, it therefore becomes unnecessary to decrypt the whole image if we only want to view one particular area. The compression stage should also be taken into account during the image encryption stage.

Image block encryption

In the case of block encryption, the length of the blocks is fixed, and varies from 64 bits (8 pixels) to 192 bits (24 pixels). From the bidimensional information of an image, several pixel grouping solutions are possible. With the aim of withstanding a downstream compression as well as possible, or compressing at the same time as coding, it is useful to group the pixels with their nearest neighbours (in rows, columns, or blocks). Each block of pixels is encrypted separately. The encrypted block obtained will then come to replace the original block in the image. In this chapter, the route taken for scanning the blocks is carried out only in a linear manner (scan line). Manniccam and Bourbakis show that it is often more useful to use other types of scanning (spirals, zigzags etc.) in order to combine encryption with lossless compression [MAN 01], [MAN 04].

Coding images by asynchronous stream cipher

In this section, we present an asynchronous stream cipher algorithm which is applied to images. Let K be a key of length k bits b i , K = b 1 b 2 ...b k . The unit of encryption is the pixel (1 byte). The method lies in the fact that for each pixel of the image, the encryption depends upon the original pixel, the value of the key K, and the k/2pixels previously encrypted. To use equations [10.5], we have t = k/2. For each pixel p i of the original image, we calculate the value of the pixel p' i of the encrypted image using the following equation:

{ } ⎩ ⎨ ⎧ = ± = ∈ - = 3 si 2 2 , 1 , 0 si 1 j j j j j β α β β α [10.7]
with β j = 2b 2j-1 +b 2j , where b 2j-1 and b 2j are two consecutive bits of the secret key K. In addition, the probability density of the α j must be uniform in order to reduce the transmission errors during the decryption stage. The sign in front of the coefficients equal to 2 depends on coefficients α j in order to obtain:

0 2 1 2 1 ≈ ∑ = k j j k α [10.8]
Considering that the encryption of a pixel is based on the k/2 pixels previously encrypted, we cannot encrypt the k/2 first pixels of the image. It is necessary to associate the α i coefficients with a sequence of k/2 virtual encrypted pixels p' -i , for i

∈ [1,…,k/2]
. This pixel sequence corresponds to an initialization vector (IV). In consequence, an IV is coded in the key: k/2 values of virtual pixels which allow us to encrypt the k/2 first pixels of the image as though they had predecessors. The length k of the key K must be big enough to guarantee maximum security. Equation [10.9] presents the decryption procedure. In the decryption procedure, we must apply the process in reverse. We can note that the function which generates the dynamic key is the same as equation [10.6]:

⎪ ⎩ ⎪ ⎨ ⎧ - = ⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ = ∑ = - ) 256 mod( ) ' ( ) 256 mod( ' 2 1 i i i k j j i j i z p p p z α [10.9]

Applying encryption to medical images

Starting out with the image in Figure 10.6a, we have applied the DES algorithm by blocks of 8 pixels in a row, with a 64-bit key to obtain the image in Figure 10.6c. We can observe the appearance of textures (Figures 10.6c-e). The reason for this phenomenon lies in the appearance of large homogenous zones (black in this case) on the medical images. At the level of the histograms (Figures 10.6d-f), we observe the strong presence of grey levels corresponding to the encryption of the grey levels of the homogenous zones. The encryption is therefore very poor for two reasons: firstly because it is easy to guess the nature of the medical image (an ultrasound), but mainly because the availability of the value of the plaintext block (the pixels were all black), and after encryption (the grey levels dominating in the encrypted image) is a precious clue for cryptanalysts. Block encryption algorithms therefore present us with serious problems when images contain homogenous zones.

(442KB), with large homogenous zones, encrypted image; c) encrypted by DES algorithm (block of 8 pixels with a 64-bit key); e) by AES algorithm (block of 8 pixels with a 128-bit key); b), d) and f) histograms

From the original image, Figure 10.7a (396x400 pixels), we have applied a stream cipher algorithm with a 128-bit key.

b) histogram of original image, c) image of the dynamic key z i , d) histogram of the values of the dynamic key z i , e) final encrypted image with the coding algorithm by asynchronous stream cipher, with a 128-bit key, f) histogram of the encrypted image

The stream cipher method has one major advantage over other encryption systems used in medical imagery. As the result of the encryption of the previous pixels is taken into account for each pixel to be encrypted, the problem of homogenous zones is solved. We are no longer dealing with block encryption systems, where two identical original blocks give the same encrypted block. We can observe that whatever the type of image with or without homogenous zones, no texture appears in the encrypted images. In conclusion, in the case of stream cipher algorithms, the homogenous zones are no longer visible either in the image or the histogram. The stream cipher method also carries another advantage: as the calculations which make it up are small in number, it proves to be very quick; even more so than AES. For example, a 7 MB image is encrypted (or decrypted) in 5 s with a standard PC, rather than the 15 s required for algorithms using a block encryption.

Selective encryption of medical images

Another way to ensure confidentiality is to adapt the protection level according to the application and the time available. It is in this second approach that we find selective encryption where users can apply a security level which can vary according to requirements [NOR 03]. Many applications can be protected with only selective encryption; the images are therefore partially visible, without revealing all the information. Selective encryption can be useful in the case of medical images taken with a medical device and needing to be sent over a network in order to be diagnosed remotely. Furthermore, the device used for capturing medical images may be located in an ambulance or some other mobile vehicle, and in this case the transmission is carried out via the intermediary of a wireless network. Due to the vital nature of these images, they must be sent quickly and safely, and in this case a selective encryption seems to be the best solution (in terms of the time/security ratio).

In this section we present a selective encryption method for medical images compressed with JPEG [PUE 06]. This method is based on the AES algorithm, using the OFB (Output Feedback Block) mode in the Huffman coding stage of the JPEG algorithm. The combination of selective encryption and compression allows us to save time in the calculation and to retain the JPEG format and initial compression rate. In terms of security, selective encryption guarantees a certain level of confidentiality. Many different selective encryption methods have been developed for images coded by DCT. Tang [TAN 96] proposes a technique called zigzag permutation, which can be applied to videos or images. Although his method offers a good level of confidentiality, it does decrease the compression rate. [DRO 02] describes a technique which encrypts a selected number of AC coefficients; the DC coefficients are not encrypted as they carry important visible information and are highly predictable. For this method, the compression rate is constant (compared to compression only) and retains the binary flow format. However, the compression and the encryption are carried out separately, so the method is slower than a simple compression. [FIS 04] presents a method where the data is organized in a binary flow form which can be regulated. Recently, Said has shown the strength of partial encryption methods by testing attacks which use the non-encrypted information of an image alongside a small image [SAI 05].

Let E K (X i ) be the encryption of a block X i of n bits using the secret key K with the AES algorithm in OFB mode. In the description of the method, we will suppose that n = 128 and X i is a non-empty plaintext. Let us suppose that D K (Y i ) is the decryption of a ciphertext Y i using the secret key K. The encryption is applied at the same time as the entropic coding procedure during the creation of the Huffman vector. The method works in three steps illustrated in Figure 10.8: the construction of the plaintext X i , the encryption of X i to create Y i and the substitution of the original Huffman vector with the encrypted information [ROD 06]. It should be mentioned that these operations are carried out separately for each DCT block quantified. To construct the plaintext X i, we take the non-null AC coefficients of the current block i accessing the Huffman vector from its end towards its beginning in order to create {HEAD, AMPLITUDE} pairs. From each HEAD we obtain the size of AMPLITUDE in bits. Only the AMPLITUDES (A n , A n-1 ,..., A 1 ) are taken into account to build vector X i . The final length of the plaintext L Xi depends both on the homogenity ρ of the block and a given constraint C, with C ∈ {128, 64, 32, 16, 8} bits. This means that a block with a large ρ will produce a small L Xi . The Huffman vector is processed as long as L Xi ≤ C and the DC coefficient is not reached. Next, the padding function is applied, p(j) = 0, where j ∈ { L Xi ,…, 128}, in order to fill in the X i vector with zeros, if necessary. At the stage where X i is encoded with AES in OFB mode, the dynamic key Z i-1 is used as a parameter by the AES encryption in order to obtain a new dynamic key Z i . For the first iteration, the IV is created from the secret key K with the following strategy: the secret key K is used as a seed for a Pseudo Random Number Generator (PRNG). This K is divided into 16 sections of 8 bits each. The PRNG produces 16 random numbers which define the formation order of the IV. Next, each Z i is added by an XOR with the plaintext X i to generate the encrypted block Y i . The final step is the substitution of the initial information with the encrypted information in the Huffman vector. As in the first step (the construction of the plaintext X i ), the Huffman vector is read backwards, but the coded vector Y i is read starting from the beginning and moving to the end. Knowing the length, in bits, of each AMPLITUDE (A n , A n-1 ,..., A 1 ), these sections are cut in Y i to replace the AMPLITUDE in the Huffman vector. The total quantity of bits must be L Xi . This procedure is carried out for each block. Any homogenous blocks are only slightly coded, or not at all. The use of the OFB method for coding allows for the generation of the independent Z i . During the OFB-mode decryption stage, the dynamic key Z i is added by an XOR to the ciphertext Y i in order to regenerate the plaintext X i . The vector resulting from the plaintext X i is cut into sections from the end to the beginning in order to replace the AMPLITUDES in the Huffman code to generate the Huffman vector. This method is applied to dozens of medical images in the grey level (see example in Figure 10.9). The JPEG algorithm has been used with the online sequential coding system for a quality factor (QF) of 100%. Five values were applied for constraint C (128, 64, 32, 16, and 8). For the encryption, the AES algorithm was used with the stream cipher mode OFB with a key of 128 bits in length. The original medical image of 320x496 pixels (Figure 10.9), compressed so that all the encrypted images are of the same size: 43.4 KB. The encrypted coefficients are distributed in the 2480 8x8 blocks in the image. This means that there are no totally homogenous blocks. For C = 128, maximum of 128 bits encrypted per block, 26,289 AC coefficients have been encrypted, which is an average of 33 encrypted bits per block. The percentage of encrypted bits in the image as a whole is 22.99%. That means, in the spatial domain, 136,038 modified pixels, which means 85.71% of the coded pixels. The PSNR is of 23.39 dB for C = 128. For C = 8, the quantities of AC coefficients and bits encrypted are respectively 6,111 and 16,765. The percentage of encrypted bits in terms of the whole image is 4.7%. This constraint gives a number of modified pixels rising to 76.1% of all the pixels in the image. The PSNR is then 30.90 dB. As the images show, selective encryption of the JPEG image produces block artefacts. These artefacts are at the borders between blocks, which often interfere with the HVS. Since the frequential transformation and the quantification of the pixel-blocks are processed separately, any continuity between the values of pixels in neighbouring blocks is broken during the coding. One of the advantages of this method is that it is possible to decrypt the 8x8 pixel blocks of the image individually (using the OFB mode for AES encryption). In order to form a remote diagnosis, the doctor needs to view regions of interest at a high resolution, where the background can be partially encrypted. We should note that confidentiality is linked with the ability to guess the values of the encrypted data (cryptanalysis). In terms of security, it is therefore preferable to encrypt the bits which seem the most random [PUE 05].

Medical image watermarking and encryption 10.5.1. Image watermarking and health uses

The watermarking of images comes under the more general heading of information hiding: a message is embedded into a document, a host which may be text, sound, video or images. For images, the difference signal between the original image and its watermarked version corresponds to the watermark signal associated with the embedded message. Care must be taken to ensure that the watermarked host document has the same value as the original host document. With the link established between the message and its host, we see steganography, watermarking and fingerprinting. Steganography is a form of secret communication where the host, who serves as the hidden communication channel, is of little interest to the message's recipient. Watermarking and fingerprinting have come to the fore since 1995, to meet the needs of managing DRM (Digital Rights Management). Watermarking involves the insertion of a code identifying the owner, and fingerprinting involves the insertion of a trace linked to the buyer. Since then, other applications have been proposed for information security, such as copy control, restriction of access and integrity control. For more details on watermarking applications and methods, please refer to digital watermarking [COX 02]. Henceforth, the terms "watermarking" and "data hiding" will be used interchangeably.

For medical imagery, several cases making use of watermarking can be identified [COA 00]:

-the authenticity of images with the insertion of data confirming the origin and the fact that a certain image refers to a particular patient; -controlling the integrity of images, by putting control information, such as a digital signature, within the image (section 10.3); -the addition of meta-data (data hiding), allowing the content of images to be enriched by attaching a semantic description of the content [COA 05].

Another, more detailed, scenario combines authenticity with the integrity control of the images, and aims to establish a solid link between these images and the corresponding test results [COA 06]. In information protection [COA 03], watermarking is complementary to the mechanisms discussed above, as it merges the protection information and the image to be protected into one entity: a watermarked image.

Watermarking techniques and medical imagery

Characteristics

The data-hiding techniques proposed for use with images are numerous and vary in their approach. They do nevertheless have some common characteristics which, depending on the application, should be kept in mind when choosing the appropriate technique:

-robustness: a method is classed as robust if after modification of the watermarked image (a "washing" attack or simple image processing) the hidden information can still be accessed and understood. This property is essential for identifying images which undergo treatment or lossy compression; -capacity: this measurement expresses the embedding rate as the number of bits buried per pixel of the image (bpp, for "bit per pixel") and therefore gives an indication of the message size which can be embedded in an image. Data-hiding techniques aim to optimize this parameter and then add useful information to the images; -security: in some cases access to the watermark and its contents must be restricted; as for cryptography, there are symmetric and asymmetric watermarking methods; -complexity: this is an indication of the calculation time needed for embedding and extraction; the complexity plays an important role when treating large image volumes;

-invisibility: this is important for medical images, since a watermark must not interfere with the interpretation of an image, in order to avoid affecting the diagnosis. With this in mind, certain watermarking methods have been proposed specifically for medical imagery; -the need for the original image for decoding is also one of these characteristics; we say that a method is "blind" if the original image is not required in order to extract the watermark; integrity control applications are not possible with non-blind watermarking methods, the question of knowing whether the original image has been modified has no meaning in such cases.

One method can meet certain applications independently, but not simultaneously. A compromise must be reached between capacity, robustness and invisibility. A stronger watermark will better resist alterations to the signal introduced by the compression, or hacking attempts; but its presence will be more obvious to the user and its capacity will be reduced.

The methods

In their principles, watermarking methods proposed for medical imagery are only very slightly different from other methods which we can refer to as "classic" methods. They make use of particular adaptation strategies specifically for medical imagery.

In the habitual schemes, two types of algorithm can generally be identified. The first involves additive methods. Starting from a message (a sequence of bits), they generate a signal which is added to the image or a transformation of the image (DCT, DWT, etc). A technique involving spread spectrum links each bit b j of the message with the value d j = 1-2b j thus multiplies this quantity by a pseudo-random sequence W j low in energy which is then added to the image I to produce the watermarked image: I w = I + αd j W j . α is a parameter of insertion or incrustation strength (robustness parameter). The embedding of a message of N bits adds to the image the watermark

∑ = = N j j j W d W 1 α
. The presence of this watermark is checked by correlation techniques, which implies the orthogonal nature of the pseudo-random sequences W j . The sign of each correlation product gives the value of the embedded bit. The embedding of a large message can lead to a partially visible watermark W. In order to ensure the invisibility of the watermark, psychovisual criteria are used to adapt the insertion strength to the image locally.

The second group covers substitution methods which, in order to embed a bit of the message, replace a piece of information from the image (its grey levels or a transformation thereof) with a symbol from a dictionary. Detection therefore takes place with a simple re-reading. The method of Least Significant Bit (LSB) substitution is the simplest. This method simply replaces the LSB of an image's grey levels with those of the message to be watermarked. For a grey level pixel p(n,m), this means associating the binary value 1 with the odd values of p(n,m), and the value 0 with the even values. This method is far from robust (it is therefore fragile) but does offer a capacity of 1 bpp. More elaborate versions of this approach have since appeared, following the Costa schema [COS 03]. These methods known as informed [COX 02] are based upon structured dictionaries which contain the values that the blocks of pixels will take to carry information.

For medical imagery, three strategies have been established with the key aim of preserving the image interpretation. These are the methods above, methods involving region of non interest watermarking and reversible watermarking methods.

The first methods produce watermarks which replace part of the information in an image. Using them requires careful attention to ensure that the watermark does not interfere with the diagnostic information. The first solutions proposed were techniques secretly modifying the LSB of certain pixels or coefficients of the transform of an image. These are methods with a large capacity, introducing only a slight damage to the original signal but very fragile nevertheless. More recently, robust techniques have been tested with, during the experiments, the involvement of a practitioner giving a threshold of insertion force which should not be crossed [PIV 05]. More generally speaking, the problem with the automatic evaluation of the maximum authorized distortion level is a pertinent question. This problem is far from helped by the wide diversity of signals in the healthcare sector (see Chapter 3) and the availability for practitioners of tools which allow, for example, the isolation of a certain part of the dynamic of an image. These ranges of grey levels vary according to the user, and some may find that the watermark is visible.

One strategy, suggested to optimize the performance of the above methods in terms of robustness and capacity without further damage to the image, is based on the existence in the image of regions with little or no interest for in the image interpretation. These techniques, known as region of non interest watermarking, more often than not place the watermark in the black background of the image [COA 01]. Robustness can be achieved, with the watermark not masking any important information, although a strong watermark can be a hindrance for the physician during his image analysis. The embedding strength must be regulated.

The final approach concerns reversible watermarking methods. The idea is to be able to remove the watermark from the image, thereby restoring the exact same grey levels as in the original image. These techniques make it possible to update the contents of a watermark. This is not the case for the previous methods, where one watermark would have to be added to another. The drawback is that the watermarked image is no longer protected once the watermark has been removed. Such techniques have benefited from progress in recent years; [COA 05], [COA 06], [CAV 04], [COL 07]. The techniques developed have variable performances depending on the host type to be watermarked and with performances lower than any non-reversible methods. Otherwise, these techniques are very rarely robust, and the desire to maximize the capacity often leads to highly visible watermarks: the watermark must be removed before the image can be used.

Watermarking medical imagery is in its early stages at the moment, with the key difficulty encountered being the level of distortion which it introduces. We can however remain hopeful that the work carried out on improving the quality of image compression (Chapter 5) will lead to solutions allowing the full benefits of watermarking to be appreciated.

Confidentiality and integrity of medical images by data encryption and data hiding

The applications of watermarking medical imaging are numerous. In this section, we aim to illustrate the combination of cryptography and watermarking in secure image exchange. We saw in section 10.3 that the encryption process could be either symmetric or asymmetric, by block or by stream. Whereas asymmetric algorithms are not appropriate for image encryption due to their calculation time, block algorithms present security problems (due to homogenous zones) and problems with the data integrity. In order to solve the integrity problem, it is possible to combine a stream cipher algorithm with a secret key for the image and an asymmetric algorithm to encrypt the secret key. A substitutive watermarking method (section 10.5) then allows for the embedding of the encrypted key into the encrypted image [PUE 04], [PUE 07]. If person A sends an image over a network to person B, sender A will use a stream cipher algorithm with the secret key K to encrypt the image. To send key K, A can encrypt it using an algorithm with a public key such as RSA. Let pub(e,n) be the public key and priv(d,n) the private key for RSA with e = d -1 mod(n), so A has his public and private keys pub a (e a ,n a ) and priv a (d a ,n a ), and B has his public and private keys pub b (e b ,n b ) and priv b (d b ,n b ). As a result, A generates a secret key K for this session and encrypts the image with the stream cipher algorithm. Next, A ciphers the key with the RSA algorithm using his private key priv a in order to achieve a key K': The size of the message to be embedded into the image depends upon the size of the recipient's public key and is known to sender A and recipient B. We can therefore calculate the embedding factor and calculate the number of blocks required for the embedding. This key K'' is embedded into the ciphered image. Finally, A sends the image to B as shown in Figure 10.12. This procedure of K encryption with priv a and pub b ensures the authenticity, and only B can decrypt the image. The embedding of the key into the image makes the method autonomous and guarantees its integrity. If, during transfer, the image is attacked, then it is no longer possible to extract the right key on reception, and so the image cannot be decrypted. With the acquired key K, B can decipher the image and thus view it. Starting from the original ultrasound image (512x512 pixels), Figure 10.13a, we have applied a stream cipher algorithm with a key K of 128 bits, in order to obtain the encrypted image Figure 10.13b. If this image is decrypted, we can note that there is no difference between it and the original image. The 128-bit key K was encrypted twice with the RSA algorithm in order to obtain K''. Due to the length of B's public key, the length of K'' is in the region of 1,024 bits. Next, using a watermarking technique in the spatial domain based on the LSB substitution, key K'' is embedded into the encrypted image (Figure 10.13c). The embedding capacity is of 1 bit for every 256 pixels. The difference between the watermarked, encrypted image and the original is shown in Figure 10.13d. The pixels used for the embedding are visible, the PSNR=75.14 dB. After the decryption of the watermarked, encrypted image, in Figure 10.13c, we reach the final image shown in Figure 10.13e. The difference between the original image and the final one is shown in Figure 10.13f. This figure shows that the differences between the two images (PSNR = 55.28 dB) are spread throughout the image. Nevertheless, because the average value of the α(i) coefficients is equal to zero, the error due to the watermarking is not increased during the decryption stage. In order to compare the results of this hybrid method, the watermarking method was applied to the encrypted medical image using the AES algorithm with the ECB and OFB modes (stream cipher mode). After decryption, the image watermarked and encrypted by AES in ECB mode shows a great deal of variation compared to the original image (PSNR=14.81 dB). After decryption, the image watermarked and encrypted by AES in OFB mode presents variations which were not diffused by this mode. The final image quality is good (PSNR=52.81 dB) but an overflow problem remains with the OFB AES mode. The black pixels become white, and vice versa. In conclusion, the combination of encryption and watermarking allows for an autonomous transmission system, and guarantees the integrity of the data transmission.

Conclusion

In this chapter, we have shown that there are many solutions for ensuring security when sending and storing medical images. In current practice, those solutions offered to secure medical data are based on very traditional protection techniques. These old approaches require either the introduction of certain specific mechanisms, or a longer execution time. These traditional approaches are not suitable for real-time applications or for access from a doctor's surgery. Some of the solutions proposed in this chapter can be integrated into systems for sending medical images, if they can be proven robust. The main advantage of all these hybrid approaches is the ability to link several types of coding in one algorithm. In years to come, the appearance of standards in the encryption and watermarking of images will be of great benefit to the safe transmission of medical data.

Figure 10 . 1 .

 101 Figure 10.1. The basis of symmetric encryption

Figure 10 . 3 .

 103 Figure 10.3. General AES scheme

Figure 10 . 4 .

 104 Figure 10.4. Synchronous stream cipher: a) encryption, b) decryption on the right

FigureFigure 10 . 5 .

 105 Figure 10.5. Asynchronous stream cipher: a) encryption, b) decryption on the right

  i ∈ [0,…,N-1] where N is the number of pixels in the image, k is the length of the key with k ∈ [1,N], and α j is a sequence of k/2 coefficients generated from the secret key K [PUE 01a]. The encryption principle is the same as that shown in Figure 10.5. Equations [10.6] have a recurrence of the order k/2, corresponding to half of the length of the key [PUE 01b]. Coefficients α j are integer values included between -2 and +2 such as:

Figure 10

 10 Figure 10.6. a) Medical ultrasound image (442KB), with large homogenous zones, encrypted image; c) encrypted by DES algorithm (block of 8 pixels with a 64-bit key); e) by AES algorithm (block of 8 pixels with a 128-bit key); b), d) and f) histograms

Figure 10

 10 Figure 10.7. a) Original image, b) histogram of original image, c) image of the dynamic key z i , d) histogram of the values of the dynamic key z i , e) final encrypted image with the coding algorithm by asynchronous stream cipher, with a 128-bit key, f) histogram of the encrypted image

Figure 10 . 8 .

 108 Figure 10.8. Global overview of the proposed method

Figure 10 . 9 .

 109 Figure 10.9. From left to right: original medical image of a colon cancer, 320x496 pixels; encrypted image for C = 128; encrypted image for C=8

  Figure 10.10 gives an example of a watermarking chain.

Figure 10 .

 10 Figure 10.10. A watermarking chain

Figure 10 .

 10 Figure 10.11. a) Original Lena image, b) image encrypted by AES by 128-bit block, c) copy of a region of the encrypted image, pasted onto another zone, d) decryption of (c)

  key K' is encrypted a second time with RSA using the public key pub b of the recipient B to generate K'':

Figure 10 .

 10 Figure 10.12. Combination of secret key encryption, public key encryption and a watermarking method

Figure 10

 10 Figure 10.13. a) Original image, b) encrypted image with a stream cipher algorithm with 128-bit key, c) image (b) watermarked with the secret encrypted key, d) the difference between images (b) and (c), e) decryption of image (c), f) the difference between original image (a) and (e)