Literature Review

When dealing with patients' sensitive medical records, it's always important how one also deals with medical images that should also be kept private. Health Insurance Portability and Accountability initiated on April 14, 2013 by the federal government, establishes all relevant standards to address the issue of privacy protection. The HIPAA requires for integrity and confidentiality in all of current, previous and future from hospitals, doctors, and other relevant professionals.

In an era where digital technology has become of major importance, there is a series of medical images that can now be kept in digital format and become quite easy to retrieve, store and preserve.

Watermarking – An Essential Aspect for the Protection of Medical Images

A. Ethical reasons and relevant legislation define Medical Information Assurance & Watermarking Medical directions. USA's HIPAA and Europe's EC 95/46 Directive are the major legislations defining relevant directions. When dealing with medical information records, thus, which involve a series of clinical examinations, diagnoses, and EPR images, three major security attributes should be considered:

• Confidentiality: only authorised users can view and evaluate medical information;

• Availability: Scheduled accessing periods should be set when entering the information system containing the medical data;

• Reliability: The information should be examined by authorised people and not changed by unauthorised ones. Additionally, it’s important for a proof to exist that there is a direct link between the patient and his/her corresponding medical information and nothing else that could change this connection should interfere.

Medical Information Systems (MIS) secure that the above named attributes exist by adopting five relevant security principles: availability, integrity, confidentiality, authentication, and non-repudiation. Confidentiality and Integrity availability refer, more or less, to the same attribute when considering security. Authentication refers to the validity of information providing in aspects relevant to the message, its transmission and the source it comes from. Authentication also refers to the receiver of the message and his/her authorization level to access this kind of data. Non-repudiation refers to delivery confirmation and identifying sender's identity.

As illustrated in figure 1, reliability can expand to traceability when information can be spotted in the distribution process. Traceability is the qualitative element defining and validating information’s content, leading to better control and dependability of given information. Watermarking is a means, interfering between the information and the MIS security services, helping to gain a significant information protection. Its significance lies to the fact that it constitutes an extra security layer for information and its final product is a watermarked document.

Watermarking has been suggested so as to secure confidentiality and reliability in major medical applications such as e-diagnosis or in medical image sharing by the use of PACS (Picture Archiving and Communication System).

In medical images integrity can, usually be achieved through enclosing a digital signature (DS) or a Message Authentication Code (MAC) applied in the whole image or in some secondary image characteristics. The purpose of a cryptographic DS is the detailed and specific protection of the information. It is a useful tool aiming at securing integrity through pointing out any difference between DS/MAC images and the enclosed ones. It is also a means used to distinguish image blocks.

The most significant advantage of DS as a cryptographic tool is that it has a legal substance in most countries when, at the same time, a watermark doesn’t. Recent researches have tried to identify other content-based integrity methods; these let "innocent" modifications to take place, declaring that the image content is not modified (ex. lossy image compression). Other researches try to identify how modifications can be spotted after image integrity has been violated. The focus in these researches, called ‘image forensic’ researches, is on whether violation is a malicious or not.

In order to authenticate EPR image source when distributing, there exist some effective solutions. All of them are actually considering that images are in DICOM format (a header followed by the raw image data). One of the solutions suggests inputting the UIDs (Unique IDentifiers) provided by the DICOM header. The watermark can verify the header-raw data relation and image origin can be identified even if image format has been changed. Another solution suggests enclosing the complete DICOM header; due to the fact, though, that some of the header parts are constantly changing every time the image is transmitted, it’s important for complex header information to exist, considering only patient information linked to the image. Another solution suggests inputting a DS on the header of the raw image data. While this alternative leads to a smaller message length to be enclosed, the header should be going together with the image when it is distributed. Therefore, image format can be changed difficultly weakening watermark’s advantages.

Some opinions suggest entering EPR elements (annotation, signal, etc.) in e-health applications so as to ensure image data confidentiality. However, this can only apply to a limited number of cases, where image embedding capacity can be quite sizeable. This solution cannot be applied to a complete patient EPR, especially when no images at all are contained.

In addition to authenticity, integrity and confidentiality, only a few researches have been done on image traceability. A relevant experiment {22] tries to establish medical image tracing in a communication between a group of users. A user key is set; then a part of the watermark is extracted from the protected image and a watermark signal is left in the image pointing out the user. As for the copyright purpose, this can be used to spot a final user (a "buyer") but it cannot be a means of identifying every user in the distribution process. Actually, watermarking does not involve medical image traceability.

Burgsteiner et al. [2, 5] established a scheme that implements secure communication for mobile e-health applications. In this scheme a relay is actually used between mobiles and data storage, letting people to securely connect and legally process medical data. Strong standard cryptographic algorithms safeguard a secure communication from the beginning to the end.

Xianping Wu et.al [4] focused on dynamic key based group management so as to establish a relevant secure authentication and authorization management mechanism for protecting privacy in sensitive information systems. Their approach concerns focusing on different administrative areas based on geographical location. Each area possesses a Local Secure Group Controller (LSGC) to deal with sensitive information sharing; in order to enter LSGC a Strong Authentication Server (SAS), a Key Server (KS), an Access Control Server (ACS) and a Record Tracing Server (RTS) are required to manage users logging in and out. KS’s philosophy concerns onetime keys instead of unique key encryption key for better security.

Song Han et al. [3] suggested a different security approach; its purpose is to integrate the role-based method and attribute certificate based method in the e-health system. Identity management term is entered at this part. This approach aims at providing a secure, valuable and adaptable way of administration in the e-health system. The relevant design and implementation of the role and privilege authentication is not examined in the paper. The paper examines authorization and authentication architecture for e-health services system, which integrates the role-based method [6] and attributes certificate based method [7]. Additionally, finger print –based model for using in medical images as a means of privacy protection is examined.

Shih and Ta Wu (2005) introduced a state-of-the art technique based on genetic algorithms to enclose a watermark or textual data in the Region of Interest (ROI) of a medical image. They are actually focused on the non ROI part where they fit the signature image and the fragile watermark.

Woo et al. (2005) provided another tool concerning multiple watermarking involving both an annotation part and a fragile part. Annotation watermark can enclose encrypted EPR whereas a fragile watermark can identify tampering. Their approach was further enriched by hash-block-chaining watermarking approach in the fragile watermarking so as to gain better security.

Zhou et al. (2001) focused on affixing digital signature and EPR on the medical image. They used LSB replacing technique to enclose the signature.

Chao et al. (2002) focused on including various EPR data in the same mark image; they used the bipolar multiple-base conversion approach to ensure a secure data hiding. The mark image could be the mark of a hospital in order to find out EPR’s origin. Their approach can isolate and then restore hidden data by authorized users. Luo et al. (2003) provided another approach for medical image processing. They suggest a relatively high data embedding rate and then a full restoration of the original image. Giakoumaki et al. (2003) followed another approach suggesting multiple watermarking. Their method involves using three different ‘waves’ of watermarks in order to secure protection and confidentiality: a robust watermark including the doctor’s digital signature for authentication, a caption watermark including patient’s personal data, and a fragile watermark so as to ensure integrity control.

Cheng et al. (2005) proposed a combination of record indexing and integrity protection in medical images. Message Digest 5 (MD5) is providing vague interpretations of ROI; this is accompanied with EPR into non-ROI parts of the medical image. Additionally, their approach is durable to processing attacks such as cropping, sharpening, and compression solely or in combination.

Acharya et al. (2004) introduced watermarking in interleaving EPR with medical images when JPEG compression takes place so as to reduce storage. A logarithmic technique is used to encrypt Text files and, this is enclosed in JPEG’s info.

Nayak et al. introduced the use of Error Correcting Codes (ECC) so as to ensure a decent, strong and reliable transmission and storage of patient information including medical images. ECC is encrypting EPR to make it rugged to noise introduced when transmitting. With their approach, ECC will correct the errors introduced in EPR until the limit of error correction is reached.

Srinivasan et al. (2004) introduced Bit-Plane Complexity Segmentation (BPCS) Steganography as a means of hiding medical records using colour cervical images. Anand and Niranjan (1998) used LSB technique partially; a log function is used to encrypt a text. Due to its simplicity, this method is a perfect means of securely transmitting data since it is quick and appropriate when an urgent diagnosis is required.

Coatrieux et al. (2006) emphasized on the secondary role watermarking has when considering medical info protection. They confirm that watermarking is an appropriate tool, providing authentication and traceability through a security layer, in the communication of medical information systems.

Coatrieux et al. (2008) highlighted that it is important to have a direct link between the patient and the medical information connected to him/her; emphasis is given on the right source and the right data provided. They introduced a pivot number identifier so as to secure privacy and interoperability. Osman et al. (2008) suggested reversible data hiding based on integer wavelet transform in 2008. Encryption of EPR is an additional tool used in their way to achieving the above named. Acharya et al. (2003) suggested the usage of watermarking in patient information and relevant medical images as a means to reduce storage. The graphical signals are interleaved with the image. Their technique established error-correcting codes to achieve safety of transmission and small storage holding of medical images and patient information.

Kallel et al. (2009) focused on usage of telecommunication as a route to achieving early diagnosis. In order to achieve data integrity, they suggested a reversible watermarking method. After applying the method (i.e. embedding the watermark), they proceed on doing visual qualitative evaluation on the image.

Memon et al. (2009) focused on how to include watermark in non ROI areas. Additional security using of Bose–Chaudhuri–Hocquengham (BCH) is also done through data encryption.

Hu et al. (2010) introduced a novel e-health security approach focusing on contracts rather than sessions as most of the literature suggests. The researchers introduced Hybrid Public Key Infrastructure (HPKI) involving a series of current cryptographic technologies involving a series of respective security standards, tools and products. Recently, researchers hided EPR into medical image through Steganography and Cryptography to address the medical image’s confidentiality issue (Srinivasan et al., 2004; Ho et al., 2004; Nayak et al., 2009; Li et al., 2005; Lou et al., 2009; Hu and Han, 2009).

Lou et al. (2009) went on establishing a multiple-layer data hiding technique in spatial domain. They focus on embedding the bit-stream by using the least significant bits (LSBs) of the expanded differences. The initial image can be rebuilt after extracting the hidden data from the stego image. Another approach by Hu and Han (2009) suggests scrambling image pixels so as to transmit medical images safely. Chaotic attractors are used to scramble the picture in the best possible cryptography. The medical image is turning into noise like image and protection and security is ensured.

Secure storage and transmission are the main issues when it comes to medical image security. For this reason, it’s always important to secure that unauthorised people won’t have access to patient’s medical records. This access to sensitive data gives power; if, for example, information about a political leader’s health becomes wide-known, a series of side effects can be caused to governmental policy. Li et al. (2005) gave great importance on this issue. They focused on Image Adaptive Watermarking. A broadcast image not suitable for diagnosis is created; then, and before identifying image’s use as a means to identify an illness, a clinician must de-code this image using his/her own watermark key. A credible third person is the one responsible for key generation and distribution. Images are broadcasted with a low PSNR value but the relevant key is needed so as to view medical images. EPR hiding is not used in their suggestion.

All the tools and techniques identified above are addressing different aspects.

Lou et al. (2009) established Steganography as a means of hiding EPR in the medical image; however, integrity and confidentiality are not examined at all. Hu and Han (2009) established Cryptography as a means to transform medical images into noise for protection purposes; however, noisy images may attract wicked people whereas EPR hiding is not examined.

Li et al. (2005) suggested how to protect medical images from unauthorised access. However, broadcast images show elements of medical images. EPR hiding is not considered in their scheme. In 2005, Ho et al. (2004) suggested fragile watermarking as a means of biomedical image authentication; nevertheless, low PSNR values exist in watermarked images and EPR hiding is not taken into consideration. Nayak et al. (2009), similar to Lou et al, focused on Steganography reversed in order to hide EPR in medical images; however, it is questionable whether confidentiality and authenticity of the medical image are accomplished. Also, the number of pixels defines medical image histogram, which is of questionable quality.

All of the methods suggested address a set of different security requirements (confidentiality, authenticity, EPR hiding) for medical image sharing but not all requirements are addressed by a single method. A method will be suggested as a means of achieving secure and private medical image sharing, addressing the requirements set below:

(i) Electronic patient records should not be evident in medical images in order to achieve small storage requirements and a limited network bandwidth.

(ii) Confidentiality needs to be achieved so as for malicious users not to be attracted by a medical image shared. This shall be done if the image looks like a natural image.

(iii) Diagnosis of political leaders or military officials should be done by a range of persons having access to specific data needed for diagnosis and not the whole person’s medical information.

(iv) Authenticity should be granted through securing that medical images are not changed during distribution.