Cryptographic key distribution over a public network via variance-based watermarking in compressive measurements

TL;DR

This paper proposes a secure cryptographic key distribution protocol using watermarking in photon-counting compressive imaging, enabling identity authentication and tampering detection over public networks.

Contribution

It introduces a novel watermarking-based key distribution method utilizing variance characteristics in compressive measurements for optical security.

Findings

Secure key extraction via watermarking and variance analysis

Tampering detection through reconstructed image verification

Practical implementation advances optical security applications

Abstract

The optical communication has an increasing need for security in public transmission scenarios. Here we present a protocol for cryptographic key distribution over a public network via photon-counting compressive imaging system with watermarking, which utilizes watermarking technique to distribute secure keys, and uses reconstructed images for simultaneous identity authentication and tampering identification. The watermark is embedded in the rearranged compressed measurements of the object, and then the signal is transmitted through a public network. At the receiving terminal, the legitimate users can easily extract the watermark as the cryptographic key by using initial keys and the variance characteristic of random measurements. Artificial tampering and attacks can be detected by the accurately retrieved images. The realization of this protocol is a step forward toward the practical applications, and will be beneficial for the broader fields of optical security in many ways.

Equations

$$seq_{i}=\left\{\begin{array}[]{l}\textrm{XOR}(seq_{i}),\ \textrm{if}\ w_{i}=1;\\ seq_{i},\ \textrm{otherwise}.\end{array}\right.$$

$$w^{\prime}_{i}=\left\{\begin{array}[]{l}1,\ \textrm{if}\ \textrm{var}(b^{\prime\prime}_{i})<\textrm{var}(b^{\prime}_{i});\\ 0,\ \textrm{otherwise},\end{array}\right.$$

$$\underset{x}{\min }\sum _i{\Vert D_{i}x\Vert }_p+\frac{\mu }{2}{\Vert b-Ax\Vert }_2^2,\text{s.t.}Ax+e=b,D_{i}x=x_i^{\prime }\text{and}x\ge 0\text{for all}i,$$

$$\text{PSNR}=10\log (255^2/\text{MSE}),$$

$$BER=\frac{1}{len}\sum _{i=1}^{len}\left|W_i-Q_i\right|.$$

Full text

Cryptographic key distribution over a public network via variance-based watermarking in compressive measurements

Wen-Kai Yu∗

Center for Quantum Technology Research, School of Physics, Beijing Institute of Technology, Beijing 100081, China

11footnotetext: Corresponding author.   E-mail address: yuwenkai@bit.edu.cn (W.-K. Yu).

A B S T R A C T

The optical communication has an increasing need for security in public transmission scenarios. Here we present a protocol for cryptographic key distribution over a public network via photon-counting compressive imaging system with watermarking, which utilizes watermarking technique to distribute secure keys, and uses reconstructed images for simultaneous identity authentication and tampering identification. The watermark is embedded in the rearranged compressed measurements of the object, and then the signal is transmitted through a public network. At the receiving terminal, the legitimate users can easily extract the watermark as the cryptographic key by using initial keys and the variance characteristic of random measurements. Artificial tampering and attacks can be detected by the accurately retrieved images. The realization of this protocol is a step forward toward the practical applications, and will be beneficial for the broader fields of optical security in many ways.

Keywords: Optical communications; Secure key distribution; Image reconstruction; Compressive sensing; Single-pixel imaging

1 Introduction

In recent years, digital information has been widely transmitted through insecure public network [1] where the data is particularly easy to be wiretapped by others, thus the techniques for information security are of great importance. Many optical encryption methods have been developed. As far as we know, the double random phase encoding (DRPE) technique [2] proposed in 1995 may be the first successful example in optical encryption. Based on optical parallel characteristics, it generally uses double spatial light modulators for phase encoding and array charge-coupled devices (CCDs) for recording the intensities [3, 4, 5, 6]. Lately, the DRPE has been integrated with photon-counting to obtain better security and verification performance [7, 8, 9], but its sampling is still redundant. Fortunately, the newly developed theory of compressed sensing (CS) [10, 11, 12] provides a new technical solution for DRPE compression during the optical sampling [13], and allows one to accurately reconstruct the signal known a priori to be sparse or compressive from its linear projections, with a sampling rate far below the Nyquist rate [10, 11]. Given all these advantages of CS, many methods in optical security field, like Ptychography [14], quick response codes [15], have been recently combined with compressed DRPE to enhance their performance. On the other hand, CS has developed a single-pixel camera [16, 17] to acquire wider applications, like in remote sensing [18, 19], adaptive ghost imaging [20], biological imaging [21], phase retrieval [22], and so forth. Recent works have successfully combined single-pixel compressive imaging with optical encryption, where the signal and its compressed measurements are treated as the plaintext and the ciphertext. This technology is proven to be able to increase the security [23, 24] and thus becomes popular.

With the developments of information age, one important issue is how to improve the security of the information delivered by the public network, especially in financial transactions, secure video communication, Internet conferences, telemedicine, and the like. Our earlier works have proposed a protocol for high-speed secure key distribution over a public network [25, 26], in which the legitimate parties acquire the cryptographic keys from the images recovered by computational ghost imaging algorithms. Note that the watermarking [27, 28, 29] and data hiding [30, 31] are two representative choices for privacy protection [32] by embedding a label to a visible image, we find that they may be useful for improving the performance of the secure key distribution. However, to our knowledge, most of traditional watermarking techniques needed to embed the watermark into the non-overlapping blocks of original image [29, 30, 31], and failed to consider authentication and tampering identification aspects. Besides, the watermarked image transmission may incur the content leakage.

In this work, we propose a watermarking-based protocol for cryptographic key distribution over a public network, in which the watermark is regarded as the cryptographic key to be distributed. In the carrier generation process, based on a single-pixel compressive imaging system, the server uses a digital micromirror device (DMD) for random modulation and a photomultiplier tube (PMT) for photon counting. Then the server will embed the watermark in the rearranged compressed measurements which have no spatial correlation, rather than in the image or its non-overlapping divided blocks, thus increasing the confidentiality and imperceptibility of the cryptographic key, and without the content leakage. After that, the disordered sequence will be sent to the legitimate users through the public network. With the aid of the initial keys and the variance characteristic of measurements, the valid parties can exactly extracted the distributed cryptographic key. By utilizing CS algorithm, the users can reconstruct the images for simultaneous efficient authentication and tampering identification. Additionally, unlike traditional optical communication schemes that are mainly based on the two-dimensional encrypted images, our protocol also offers an alternative approach for embedding the watermark directly in the randomly-ordered one-dimensional sampled signal as well as taking full advantage of the variance characteristic of measurements, which will have a great impact on research in the broader fields of optical security, especially in cryptographic key distribution applications.

2 Protocol

Our protocol applies CS for carrier generation and authentication. In CS, an image signal $x$ of pixel size $s\times t$ can be reshaped into a one-dimensional column vector of length $N=s\times t$. Every pattern encoded on the DMD has the same size as the object image, and is flattened accordingly into a row vector $a_{j}$ of length $N$. There are $M$ random binary patterns that will be sequentially fed into the DMD, the row vectors reshaped from these $M$ patterns are rearranged into a measurement matrix $A\in\mathds{R}^{M\times N}$. Rather than directly sampling the image pixel values, CS captures the linear projections of the signal at a rate that is significantly below the Nyquist rate, namely, it samples the inner product between $M$ modulating row vector $a_{j}$ and the signal $x$. Thus the problem can be given by a set of linear equations: $y=Ax+e$, where $y$ is the observed measurement vector, $e\in\mathds{R}^{M\times 1}$ denotes the stochastic noise. Hence simultaneous compression and sampling of an image can be achieved. Generally, the natural signal $x$ can be sparsely represented in a certain basis (e.g., discrete cosine transform basis, Fourier transform basis, wavelet basis) $\Psi=[\psi_{1},\psi_{2},...,\psi_{N}]$, thus $x=\Psi x^{\prime}$, or $x=\sum\limits_{i=1}^{N}{{x^{\prime}}_{i}}{\psi_{i}}$, where $x^{\prime}\in\mathds{R}^{N\times 1}$ is the coefficient sequence of $x$. Since the total variation (TV) regularization can ensure excellent reconstructed image quality by preserving the edges accurately [17], here we use TV solver as the sparse basis. In order to satisfy the restricted isometry property (RIP) [12], the column vectors taken from arbitrary subsets of the measurement matrix $A$ should be approximately orthogonal and incoherent with the sparse basis. It is found that a completely random matrix $A$ works well in general and is largely incoherent with any fixed basis. Therefore, the random measurement matrix is adopted here, and its randomness can render the measurement data unintelligible. The object image can be reconstructed precisely from the dimension reduction measurements via optimization algorithm.

This protocol is an extension of our previous work [25, 26]. Here, the measurement matrix is used as a key known by the legitimate parties in advance, and a watermark label is embedded to the measured signal for cryptographic key distribution. As depicted in figure 1, our protocol can be divided into four parts: carrier generation, watermark embedding, watermark extraction, and authentication. Figure 2 shows the detailed procedure for watermark embedding and extraction.

2.1 Carrier generation

In the carrier generation step, the server performs compressive sampling [11] via a single-pixel imaging system, which is simpler than DRPE setup. The object and the measurement matrix can be denoted as $x$ and $A$, then the carrier $y\in\mathds{R}^{M\times 1}$ can be acquired by the linear equations $y=Ax+e$. For different legitimate parties, the object $x$ and the measurement matrix $A$ can be different. Therefore, our protocol can realize multiparty communication.

2.2 Watermark embedding

Here the watermark is treated as the cryptographic key to be distributed. In the watermark embedding process as shown in the left half of figure 2, $y$ will be disordered by the server via the random allocation key 1 to obtain $y^{\prime}$, which is then divided into $M/r$ (the same as the length of the watermark) groups with each of size $r$. For the $i$th group, if the element value $w_{i}$ in the watermark equals to 1, then all the bits in the corresponding group (denoted as $seq_{i}$, $i=1,2,\cdots,M/r$) of $y^{\prime}$ are exclusive-ORed (XOR), otherwise, leaving it as it is, i.e.,

[TABLE]

Here using XOR for watermark embedding is a common operation [30]. By this means, we will get the sequence $y^{\prime\prime}$, which will be disordered again according to the random allocation key 2 to obtain $y^{\prime\prime\prime}$. After that, the signal $y^{\prime\prime\prime}$ will be transmitted through the public network to the legitimate users.

2.3 Watermark extraction

In the watermark extraction as shown in the right half of figure 2, the legitimate receiver restores $b^{\prime}$ via the random allocation key 2, and then carries out XOR operation on every bit of $b^{\prime}$ to obtain $b^{\prime\prime}$ (this operation we call global XOR). The values $w^{\prime}_{i}$ of the watermark bits are extracted via

[TABLE]

where var denotes the variance. According to the extracted watermark and the group assignment, the XOR operation of the whole bits in the divided groups of $b^{\prime}$ that correspond to the extracted watermark bit value 1 is performed, also via Eq. 1, to get $b^{\prime\prime\prime}$. In theory, $b^{\prime}$ and $b^{\prime\prime\prime}$ equals to $y^{\prime\prime}$ and $y^{\prime}$, respectively. The correct sequence $b$ is then recovered following the random allocation key 1. Theoretically, $b$ equals to $y$ with a great probability. Through the above operations, legitimate users will finally get the corresponding cryptographic keys distributed from the server. The cryptographic keys can be used to encrypt the plaintext and decrypt the ciphertext during the multiparty communication.

2.4 Authentication

Finally, the receiving parties use the TVAL3 algorithm [17] to recover the image from $A$ and $b$ for identity authentication, as demonstrated in figure 1. The core TV norm minimization of TVAL3 can be described as:

[TABLE]

where ${\left({\left\|u\right\|}_{p}\right)^{p}}={\sum\nolimits_{i=1}^{N}{\left|{u_{i}}\right|}^{p}}$ stands for $l_{p}$ norm. ${D_{i}}x$ is the discrete gradient vector of $x$ at position $i$, $D$ is the gradient operator, and $\mu>0$ is a penalty constant scalar used to balance these two terms. $\sum\nolimits_{i}{{{\left\|{{D_{i}}x}\right\|}_{p}}}$ is the TV regularization term, which is isotropic for $p=2$, and anisotropic for $p=1$. Here we use the isotropic (the higher, 2nd-order) derivative to get better image quality for authentication.

3 Simulation

To obtain a quantitative measure of the image quality, the peak signal-to-noise ratio (PSNR) is defined here as a figure of merit:

[TABLE]

where $\textrm{MSE}=\frac{1}{st}\sum\nolimits_{i,j=1}^{s,t}[U_{o}(i,j)-\tilde{U}(i,j)]^{2}$. The MSE describes the squared distance between the recovered image $\tilde{U}$ and the original image $U_{o}$ for all $s\times t$ pixels. Naturally, the larger the PSNR value, the better the quality of the image recovered.

Additionally, we introduce another unitless performance measure, the bit error rate (BER), which is defined as

[TABLE]

Here, $W$ is the original watermark, $Q$ is the extracted watermark, and $len$ is the length of $W$. Therefore, the BER is the number of bit errors divided by the total length of the watermark bits during a time interval studied. The generation of error bits is mostly due to noise, randomness, or tampering.

To illustrate our strategy, the simulation procedure is presented in figure 3. After the sampling, the watermark embedding and extraction will be performed. According to the CS theory, the original image can be any complex gray-scale or colour-scale image, as long as it is sparse or compressive. Generally speaking, many natural images except pure noisy ones have sparse representations when they are expressed in a certain basis. It is worth noting that the watermark can be not only a binary vector but also a gray-scale image, because the image pixel values can be easily converted into a binary sequence and linked end-to-end to form a long one in watermark embedding, and vice versa during watermark extraction. After that, the CS image [figure 3(b) and (c)] can be recovered accurately if and only if the extracted watermark is exactly consistent with the original one. Although the poor quality of the recovered image is possibly caused by the measurement noise, we find that repeatedly using the same watermark can greatly improve the image quality. Here the watermark is reused five times in one set of measurements to reduce the negative effect of the measurement noise on the quality of the extracted watermark. The number five used here is an empirical parameter. Actually, for a 40-bit watermark with five repetitions, when the group (block) size $r$ is set to 11, the BER is already low enough; when $r$ is larger than 20, the watermark is extracted exactly with high immunity to noise, as illustrated in figure 4. Therefore, by applying this strategy, the quality of the CS image can be used for authentication to validate whether there exists an attacker or not. The demonstrating experiment is performed by increasing the measurement number. There is a tradeoff between the group size for the BER performance and the length of the watermark.

4 Experimental validation and results

The carrier generation process of our proposal is based on a photon-counting single-pixel camera, as presented in figure 5. The binary modulation patterns are provided by a DMD. In the experiment, the thermal light from a stabilized halogen tungsten light source with a wavelength range from 360 nm to 2600 nm passes through a beam expander and a neutral density filter (NDF) onto a black-and-white film (the object) with a printed transparent letter “S”. Here the NDF is used to attenuate the light to the ultra-weak light level. The object is then imaged directly onto the DMD which consists of $1024\times 768$ micromirrors. Each micromirror is switched between two positions oriented at $\pm 12^{\circ}$, which correspond to a bright pixel 1 and a dark pixel 0, determined by the pattern. The reflected light in one of the orientations is converged onto one spot by a focusing lens and is collected by a counter-type Hamamatsu H10682-210 PMT. Since the PMT counts the number of the photons that is proportional to the total light intensity for each pattern, it can be treated as a single-photon detector. Actually, the recorded photon sequence $y$ is a measured signal of the object. Following the procedures given in figure 2, it is simple for the receiver to obtain the signal $y^{\prime\prime\prime}$ from the public network, to extract the watermark, and to recover the signal $b$ according to the random allocation keys 1 and 2. It is worth noting that all the values of $y^{\prime}$ should be converted into a binary sequence for XOR operation, and $b^{\prime\prime}$ should be turned back to a decimal sequence at last. Using the measurement matrix, the image is recovered by total variation minimization for identity authentication. Here the experimental setup is simple and the whole techniques reduce the complexity.

Each pattern corresponds to one row of the measurement matrix $A$, and has $64\times 64$ pixels, of the same size as the CS image. There are $M$ binary patterns, thus the size of $A$ is $M\times N$ with $N=64\times 64$. The experimental results [figure 6] are in accord with figure 3. In the case of five-repetition usage of the same watermark, we get five sets of extracted results, compute their average, and then set the value to 0 if the mean is less than 0.5, and 1 otherwise. From figure 6(c), it can be seen that the calculated watermark is accurate with large probability. Here $A$ is generated by a random physical process. Since the photon fluctuations contain the stochastic intensity fluctuations of the light source, scattering noise along the light path, and shot noise, the signal $y$ has true randomness as well as good information imperceptibility. Here the matrix $A$, the random allocation keys 1 and 2, and some other essential parameters (like the imaging area, the pixel size, the number of measurements, the allocation selection strategy) are all used as the initial keys, which are distributed to the legitimate parties through absolutely secure approaches (e.g., secure hash algorithm 3, quantum key distribution protocol) in advance. In the future, we can also make a difference between each adjacent frames to perform the “positive-negative” modulation and acquire a very satisfactory image quality [19]. For full-colour imaging, one can use three spectral filters to restore the red, green, and blue sub-images, extending the dimension of the signal carrier.

5 Security analysis and discussion

Now let us discuss the security of our one-time-pad protocol against different attacks. Here, for simplicity and without loss of generality, we directly perform our security analysis on the experimentally recorded signal. Assume that the eavesdropper Eve possesses any advanced technique. In order to ensure information transmission security, further channel coding and decoding can be used. Even if Eve knows complete $y^{\prime\prime\prime}$ from the public network, to recover the watermark she must guess the random allocation key 2 exactly, which costs a full permutation of $M$. In the case of figure 7, we have $M=2560$, thus Eve must sweep through $M!\gg 2^{M}\gg M^{2}$ (when $M>=5$) possible permutations. For example, from $170!=7.2574\times 10^{306}$, we see that $2560!$ is thought to be extremely large. Assuming that each run costs a few milliseconds for a supercomputer, it will take many years to finish the exhaustion. Furthermore, if Eve wants to get the CS image, she must firstly spend another $M!$ possible permutations to guess the random allocation key 1 and recover the signal $b$, and secondly guess all the frames and secure parameters. For a $2560\times 4096$ binary measurement matrix, where $4096=64\times 64$, the probability of it being deciphered through exhaustive attack is $2^{10485760}$. Actually, the size of the image and the measurement matrix can be much larger, and the measurement matrix owned by each user can also be different. So it is impossible for her to decipher the communication.

Additionally, Eve can also intercept the signal $y^{\prime\prime\prime}$, falsify some bits in it and then send it to the legitimate users, as illustrated in figure 7. However, the legitimate party can easily discover Eve’s presence by checking the quality of recovered images, whether she completely disorders the signal $y^{\prime\prime\prime}$, or only changes one fixed bit in each value, or takes some values away. If one user finds that the quality of CS image is poor, then he/she can conclude that there must exist an attack. Therefore, it is demonstrated that our method has a highly sensitivity to the intentional tampering and an outstanding performance for data tamper detection. It is worth mentioning that our protocol is robust against the attack because of its particular scheme, rather than the experiment. Thus we can regard this protocol as being greatly safe for practical applications in defense, communication, and financial market.

6 Conclusions

In conclusion, we propose a secure protocol for cryptographic key distribution over a public network, where a watermark is treated as the cryptographic key to be distributed from the server to the valid parties. The compressive sampling is experimentally performed via a single-pixel photon-counting imaging system, in which the photon-limited measurements contribute additional security of the protocol. The watermark is embedded directly in the randomly-rearranged compressive measurements, rather than in the image or its non-overlapping divided blocks, ensuring the confidentiality and imperceptibility of the cryptographic key and avoiding the content leakage. Thus the watermark embedding is actually performed between compressive sampling and authentication procedures. At the receiving terminal, based on the initial keys and the variance of disordered measurement sequence that is send through the public network, the legitimate users have full access to both the accurate watermark and the encrypted image, the latter can be used for efficient authentication and tampering identification. Both numerical simulation and experimental results show that our approach owns a good robustness against different eavesdropping attacks. This protocol may pave the way for applying the variance characteristic of the measurements in optical secure communication, and will have a great impact on many practical applications of optical security.

Acknowledgements

The author greatly appreciates Ning Wu for offering help in improving the manuscript. This work is supported by the National Natural Science Foundation of China [grant number 61801022], the Beijing Natural Science Foundation [grant number 4184098], the National Key Research and Development Program of China [grant number 2016YFE0131500], the International Science and Technology Cooperation Special Project of Beijing Institute of Technology [grant number GZ2018185101], and the Beijing Excellent Talents Cultivation Project - Youth Backbone Individual Project.