Jacques M Bahi
email: jacques.bahi@univ-fcomte.fr

Christophe Guyeux
email: christophe.guyeux@univ-fcomte.fr

Abdallah Makhoul
email: abdallah.makhoul@univ-fcomte.fr

Efficient and Robust Secure Aggregation of Encrypted Data in Sensor Networks

Keywords: Wireless Sensor Networks, Secure Data Agregation, Homomorphic Encryption, Elliptic Curves

Wireless sensor networks are now in widespread use to monitor regions, detect events and acquire information. To reduce the amount of sending data, an aggregation approach can be applied along the path from sensors to the sink. However, usually the carried information contains confidential data. Therefore, an end-to-end secure aggregation approach is required to ensure a healthy data reception. End-to-end encryption schemes that support operations over cypher-text have been proved important for private party sensor network implementations. Unfortunately, nowadays these methods are very complex and not suitable for sensor nodes having limited resources. In this paper, we propose a secure end-to-end encrypted-data aggregation scheme. It is based on elliptic curve cryptography that exploits a smaller key size. Additionally, it allows the use of higher number of operations on cypher-texts and prevents the distinction between two identical texts from their cryptograms. These properties permit to our approach to achieve higher security levels than existing cryptosystems in sensor networks. Our experiments show that our proposed secure aggregation method significantly reduces computation and communication overhead and can be practically implemented in on-the-shelf sensor platforms. By using homomorphic encryption on elliptic curves, we thus have realized an efficient and secure data aggregation in sensor networks.

I. INTRODUCTION

Wireless sensor networks have received enormous attention over past few years, due to a wide range of potential applications (environmental, ecological, military, etc.). A typical sensor network is expected to consist of a large number of sensor nodes deployed randomly in a large scale. Usually, these nodes have limited power, storage, communication, and processing capabilities, making energy consumption an issue.

A major functionality of a sensor node is to measure environmental values using embedded sensors, and transmit it to a base station called "sink". The sensed data needs to be analyzed, which eventually serves to initiate some action. Almost this analysis presumes computation of the maximum, minimum, average, etc. It can be either done at the base station or by the nodes themselves, in a hierarchical scenario. In order to reduce the amount of data to be transmitted to the sink, it is beneficial that this analysis can be done over the network itself. To save the overall energy resources of the network, it is agreed that the sensed data needs to be aggregated on the way to its final destination. Sensor nodes send their values to certain special nodes, i.e., aggregators. Each aggregator then condenses the data prior to sending it on. In terms of bandwidth and energy consumption, aggregation is beneficial as long as the aggregation process is not too CPU-intensive. The aggregators can either be special (more powerful) nodes or regular sensors nodes.

At the same time, sensor networks are often deployed in public or otherwise untrusted and even hostile environments, which prompts a number of security issues (e.g., key management, privacy, access control, authentication, etc.). Then, if security is a necessary in other (e.g., wired or MANET) types of networks, it is much more so in sensor networks. Actually, it is one of the more popular research topic and many advances have been reported on in recent years.

From the above observations, we can notice the importance of a cooperative secure data aggregation in sensor networks. In other terms, after the data gathering and during transmissions to the base station, each node along the routing path cooperatively integrates and secures the fragments messages. In this paper, we focus on security data aggregation and we propose a simple secure homomorphic cypher-system that allows efficient aggregation of encrypted data.

Data encryption becomes necessary in sensor networks when this type of sensors can be subject of many types of attacks [START_REF] Chandramouli | Battery power-aware encryption[END_REF]. Without encryption, adversaries can monitor and inject false data into the network. In a general manner the encryption process is done as follows: sensor nodes must encrypt data on a hop-by-hop basis. An intermediate node (i.e., aggregator) possessing the keys of all sending nodes, decrypts the received encrypted value, aggregates all received values, and encrypts the result for transmission to the base station. Though viable, this approach is fairly expensive and complicated, due to the fact of decrypting each received value before aggregation, which generates an overhead imposed by key management. Encryption can solve the security problem, but how can we aggregate over encrypted data [START_REF] Chandramouli | Battery power-aware encryption[END_REF]? Some privacy homomorphism based works have been proposed recently [START_REF] Castelluccia | Efficient aggregation of encrypted data in wireless sensor networks[END_REF], [START_REF] Girao | Cda: Concealed data aggregation in wireless sensor networks[END_REF], [START_REF] Acharya | Secure comparison of encrypted data in wireless sensor networks[END_REF] that, without participating in checking, the aggregators can directly aggregate the encrypted data. However, such schemes, for the moment, need high and complex computations to encrypt data and aggregate it, which leads to large cypher-texts. Sensor nodes cannot provide sufficient CPU, memory and bandwidth to address such complex operations. For instance, Rivest Shamir Adleman (RSA) cryptosystems [START_REF] Haodong | Elliptic curve cryptographybased access control in sensor networks[END_REF], [START_REF] Liu | Tinyecc: A configurable library for elliptic curve cryptography in wireless sensor networks[END_REF] are used, which requires high CPU and memory capabilities to perform exponential operations. Therefore, in our study we adopt an elliptic curve encryption [START_REF] Boneh | Evaluating 2-dnf formulas on ciphertexts[END_REF] that allows nodes to generate a smaller key size while providing the same security level of existing complex schemes. The cyphersystem we exploit permits N additions and one product, thus it is not limited to a single basic function. A major advantage of our method is the fact that it has been proved safe, and until now it has not been cryptanalized. To assess the practicality of our technique, we evaluate it and compare it to existing cypher-system. The obtained results show that we significantly reduce computation and communication overhead and that our secure aggregation method can be practically implemented in on-the-shelf sensor platforms.

The rest of this paper is organized as follows: in the next section we present a review of some previous related work. Section III presents our security model. Sections IV and V discuss the details of the proposed aggregation scheme for sensor networks. In Section VI, we describe simulation and results of simulation experiments. Finally, we end the paper by conclusions.

II. RELATED WORK

The benefit and vulnerability, as well as the need to secure in-network aggregation, have been identified by a number of schemes in the literature. One approach [START_REF] Przydatek | Sia: Secure information aggregation in sensor networks[END_REF] proposed a secure information aggregation protocol to answer queries over the data acquired by the sensors. Even though their method provided data authentication to provide secrecy, the data still sent in plain text format, which removes the privacy during transmission. Another one [START_REF] Cam | Espda: Energy-efficient secure pattern based data aggregation for wireless sensor networks[END_REF] proposed a secure energy efficient data aggregation (ESPDA) to prevent redundant data transmission in data aggregation. Unlike conventional techniques, their scheme prevents the redundant transmission from sensor motes to the aggregator. Before transmitting sensed data, each sensor transmits a secure pattern to the aggregator. Only sensors with different data are allowed to transmit their data to the cluster-head. However, since each sensor at least needs to transmit a packet containing a pattern once, power cannot be significantly saved. In addition, each sensor mote uses a fixed encryption key to encrypt data; data privacy cannot be maintained in their scheme. In [START_REF] Huang | Secure encrypted-data aggregation for wireless sensor networks[END_REF], the authors presented a secure encrypted-data aggregation scheme for wireless sensor networks. The idea is based on eliminating redundant sensor readings without using encryption and maintains data secrecy and privacy during transmission. This scheme saves energy on sensor nodes but still do not guarantee the privacy of sent data.

The problem of aggregating encrypted data in sensor networks was introduced in [START_REF] Girao | Cda: Concealed data aggregation in wireless sensor networks[END_REF] and further refined in [START_REF] Castelluccia | Efficient aggregation of encrypted data in wireless sensor networks[END_REF]. The authors propose to use homomorphic encryption schemes to enable arithmetic operations over cypher-texts that need to be transmitted in a multi-hop manner. However, these approaches provide a higher level of system security, since nodes would not be equipped with private keys, which would limit the advantage gained by an attacker compromising some of the nodes. Unfortunately, existing privacy homomorphisms used for data aggregation in sensor networks have exponential bound in computation. It is too computationally expensive to implement in sensor nodes. Moreover, the expansion in bit size during the transformation of plain text to cypher-text introduces costly communication overhead, which directly translates to a faster depletion of the sensors energy. On the other hand and from security viewpoint, the cryptosystems [START_REF] Domingo-Ferrer | A provably secure additive and multiplicative privacy homomorphism[END_REF] used in these approaches were cryptanalized [START_REF] Cheon | Known-plaintext cryptanalysis of the domingo ferrer algebraic privacy homomorphism scheme[END_REF], which means they can't guarantee anymore high security levels.

In this paper we try to relax the statements above by investigating elliptic curve cryptography that allows feasible and suitable data aggregation in sensor networks beside the security of homomorphisms schemes. First, our proposed scheme for secure data aggregation in sensor networks is based on a cryptosystem, which has been proved safe and has not been cryptanalyzed. Another property that enforces the security level of such approach is coming from the fact that, as it is the case in ElGamal cryptosystem, for two identical messages it generates two different cryptograms. This property suggested fundamental for security in sensor networks [START_REF] Boneh | Evaluating 2-dnf formulas on ciphertexts[END_REF], [START_REF] Huang | Secure encrypted-data aggregation for wireless sensor networks[END_REF], [START_REF] Lin | Cooperative secure data aggregation in sensor networks using elliptic curve based cryptosystems[END_REF], to the best of our knowledge, was not addressed in previous homomorphism-based security data aggregation works. Beside all these properties and due to the use of elliptic curves, our approach saves energy by allowing nodes to encrypt and aggregate data without the need of high computations. Lastly, the scheme we use allows more aggregations types over cypher data than the homomorphic cryptosystem used until now.

III. SECURITY MODEL

In this work, we are primarily concerned with data privacy in sensor networks. Our goal is to prevent attackers from gaining any information about sensor data. Therefore, ensuring an end-to-end privacy between sensor nodes and the sink becomes problematic. This is largely because popular and existing cyphers are not additively homomorphic. In other words, the summation of encrypted data does not allow for the retrieval of the sum of the plain text values. Moreover, privacy existing homomorphisms have usually exponential bound in computation. To overcome this problem, in our model we propose a security scheme for sensor networks using elliptic curve based cryptosystem. We show that our model permits many operations on crypted data and does not demand high sensor capabilities and computation.

A. Operations over elliptic curves

In this section, we give a brief introduction to elliptic curve cryptography. The reader is referred to [START_REF] Hankerson | Guide to elliptic curve cryptography[END_REF] for more details.

1) Addition and multiplication: Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields [START_REF] Hankerson | Guide to elliptic curve cryptography[END_REF]. Elliptic curves used in cryptography are typically defined over two types of finite fields: prime fields F p , where p is a large prime number, and binary extension fields F 2 m [START_REF] Cheung | Secure encrypted-data aggregation for wireless sensor networks[END_REF]. In our paper, we focus on elliptic curves over F p . Let p > 3, then an elliptic curve over F p is defined by a cubic equation y 2 = x 3 + ax + b as the set

E = (x, y) ∈ F p × F p , y 2 ≡ x 3 + ax + b (mod p)
where a, b ∈ F p are constants such that 4a 3 + 27b 2 0 (mod p). An elliptic curve over F p consists of the set of all pairs of affine coordinates (x, y) for x, y ∈ F p that satisfy an equation of the above form and an infinity point O.

The point addition and its special case, point doubling over E is defined as follows (the arithmetic operations are defined in F p ) [START_REF] Hankerson | Guide to elliptic curve cryptography[END_REF] :

Let P = (x 1 , y 1 ) and Q = (x 2 , y 2 ) be two points of E. Then:

P + Q = O if x 2 = x 1 and y 2 = -y 1 , (x 3 , y 3 )
otherwise.

where:

• x 3 = λ 2 -x 1 -x 2 , • y 3 = λ × (x 1 -x 3 ) -y 1 , λ = (y 2 -y 1 ) × (x 2 -x 1 ) -1 if P Q , (3x 2 1 + a) × (2y 1 ) -1 if P = Q.
Finally, we define P + O = O + P = P, ∀P ∈ E, which leads to an abelian group (E, +). On the other hand the multiplication n × P means P + P + .... + P n times and -P is the symmetric of P for the group law + defined above for all P ∈ E.

2) Public/Private keys generation with ECC: In this section we show how we can generate the public and private keys for encryption, following the cryptosystem proposed by Boneh et al. [START_REF] Boneh | Evaluating 2-dnf formulas on ciphertexts[END_REF]. The analysis of the complexity will be treated in a later section.

Let τ > 0 be an integer called "security parameter". To generate public and private keys, first of all, two τ-bits prime numbers must be computed. Therefore, a cryptographic pseudo-random generator can be used to obtain two vectors of τ bits, q 1 and q 2 . Then, a Miller-Rabin test can be applied for testing the primality or not of q 1 and q 2 . We denote by n the product of q 1 and q 2 , n = q 1 q 2 , and by l the smallest positive integer such that p = l × n -1. l is a prime number while p = 2 (mod 3).

In order to find the private and public keys, we define a group H, which presents the points of the super-singular elliptic curve y 2 = x 3 + 1 defined over F p . It consists of p + 1 = n × l points, and thus has a subgroup of order n, we call it G. In another step, we compute g and u as two generators of G and h = q 2 × u. Then, following [START_REF] Boneh | Evaluating 2-dnf formulas on ciphertexts[END_REF], the public key will be presented by (n, G, g, h) and the private key by q 1 .

3) Encryption and Decryption: After the private/public keys generation, we proceed now to the two encryption and decryption phases:

• Encryption : Assuming that our messages space consists of integers in the set {0, 1, ..., T}, where T < q 2 , and m the (integer) message to encrypt. First, a random positive integer is picked from the interval [0, n -1].

Then, the cypher-text is defined by

C = m × g + r × h ∈ G,
in which + and × refer to the additive and multiplication laws defined previously. • Decryption : Once the message C arrived to destination, to decrypt it, we use the private key q 1 and the discrete logarithm of (q 1 × C) base q 1 × g as follows:

m = log q 1 ×g q 1 × C.
This takes expected time √ T using Pollard's lambda method. Moreover, this decryption can be speed-up by precomputing a table of powers of q 1 × g.

B. Homomorphic properties

As we mentioned before, our approach ensures easy encryption/decryption without any need of extra resources. This will be proved in the next section. Moreover, our approach supports homomorphic properties, which gives us the ability to execute operations on values even though they have been encrypted. Indeed, it allows N additions and one multiplication directly on cryptograms, which prevents the decryption phase at the aggregators level and saves nodes energy, which is crucial in sensor networks.

Additions over cypher-texts are done as follows: let m 1 and m 2 be two messages and C 1 , C 2 their cypher-texts respectively. Then the sum of C 1 and C 2 , let call it C, is represented by C = C 1 + C 2 + r × h where r is an integer randomly chosen in [0, n -1] and h = q 2 × u as presented in the previous section. This sum operation guarantees that the decryption value of C is the sum m 1 + m 2 . The addition operation can be done several times, which means we can do sums of encrypted sums.

The multiplication of two encrypted values and its decryption are done as follows: let e be the modified Weil pairing on the curve and g, h the points of G as defined previously. Let us recall that this modified Weil pairing e is obtained from the Weil pairing E [START_REF] Boneh | Evaluating 2-dnf formulas on ciphertexts[END_REF] by the formula: e(P, Q) = E(x × P, Q), where x is a root of X 3 -1 on F p 2 . Then, the result of the multiplication of two encrypted messages C 1 , C 2 is given by

[C m = e(C 1 , C 2 ) + r × h 1 ]
, where h 1 = e(g, h) and r is a random integer pick in [1, n].

The decryption of C m is equal to the discrete logarithm of q 1 × C m to the base q 1 × g 1 :

m 1 m 2 = log q 1 * g 1 (q 1 × C m .)
where g 1 = e(g, g).

IV. OUR SECURE DATA AGGREGATION FOR SENSOR NETWORKS

Data aggregation schemes aim to combine and summarize data packets of several sensor nodes so that amount of data transmission is reduced. An example data aggregation scheme is presented in Figure 1 where sensor nodes collect information from a region of interest. When the user (sink) queries the network, instead of sending each sensor node's data to the base station, aggregators collect the information from its neighboring nodes, aggregates them (e.g., computes the average), and send the aggregated data to the base station over a multihop path. As the majority of wireless sensor network applications require a certain level of security, encryption of the sensed data before its transmission becomes necessary and it is preferable to decrypt the data only at the base station level (c.f. previous sections). In our work, we adopt the following scenario as shown in Figure 1: after collecting information, each sensor node encrypts its data according to elliptic curve encryption (c.f. Section III-A) and sends it to the nearest aggregator. Then, aggregators aggregate the received encrypted data (without decryption) and send it to the base station, which in his turn decrypts the data and aggregates it. We notice that all aggregators can done N additions and the final layer of aggregators can done one multiplication on encrypted data. For instance, to compute the average of nodes measurements, aggregators can calculate the sum of the encrypted measurements and the number of nodes took these measurements and send it to the base station.

V. SECURITY STUDY Due to hostile environments and unique characteristics of sensor networks, it is a challenging task to protect sensitive information transmitted by nodes to the end user. In addition, this type of networks has security problems that traditional networks do not face. In this section, we present a security study dedicated to wireless sensor networks. First we introduce the principal attacks that sensor networks can face and how our approach can support them, then we present some practical issues that improve the network security.

A. Related attacks and results

In a sensor network environment adversaries can commonly use the following attacks:

Known-plain text attack: They can use common key encryption to see when two readings are identical. By using nearby sensors under control, attackers can conduct a known-plain text attack.

Chosen-plain text attack: Attackers can tamper with sensors to force them to predeterminated values.

Man-in-the-middle: They can inject false readings or resend logged readings from legitimate sensor motes to manipulate the data aggregation process. In Table I and similar to [START_REF] Cheung | Secure encrypted-data aggregation for wireless sensor networks[END_REF], we present a comparison between different encryption policies and possible attacks. In our method, as data are encrypted by public keys, and these public keys are sent by the sink to the sole authenticated motes, the wireless sensor network is then not vulnerable to a Man-in-the-middle attacks. On the other hand, our approach guarantees that for two simalar texts gives two different cryptograms, which prevents the Chosen-plain text attacks and the Man-in-the-middle attacks. Finally, as the proposed scheme possesses the homomorphic property, data aggregation is done without decryption, and no private key is used in the network.

B. Practical issues

In this section we present some practical issues to our security model. First we study the sizes of the encryption keys and we compare it to existing approaches. Then, we present how we can optimize the sizes of cryptograms in order to save more sensors energy.

1) Sizes of the keys: Cryptograms are points of the elliptic curve E. They are constituted by couples of integer coordinates lesser than or equal to p = lq 1 q 2 -1.

It is commonly accepted [16] that for being secure until 2020, a cryptosystem:

• must have p ≈ 2 161 , for EC systems over F p , • must satisfy p ≈ 2 1881 for classical asymmetric systems, such as RSA or ElGamal on F p . Thus, for the same level of security, using elliptic curve cryptography does not demand high keys sizes, contrary to the case of RSA or ElGamal on F p . The use of small keys leads to small cryptograms and fast operations for encryption.

C. Reducing the size of cryptograms

In this section we show how we can reduce the size of cryptograms while using ECC. This is benefit for sensor nodes in terms of reducing energy consumption by sending data with smaller size. The messages are encrypted with q 2 bits, which leads to cryptograms with a mean of 160 bits long.

Let us suppose that p ≡ 3 ( mod 4). As the cryptogram is an element (x, y) of E, which is defined by y 2 = x 3 + 1, we can compress this cryptogram (x, y) to (x, y mod 2)) before sending it to the aggregator (as the value of y 2 is known). In this situation, we obtain cryptograms with a mean of 81 bits long for messages between 20 and 40 bits long.

To decompress the cryptogram (x, i), the aggregator must compute z = x 3 + 1 mod p and y = √ z mod p, which can be written as y = z (p+1)/4 mod p, then :

• if y ≡ i(mod 2), then the decompression of (x, i) is (x, y). • else the decompression is (x, py).

VI. EXPERIMENTAL RESULTS

To show the effectiveness of our approach we conducted a series of simulations comparing our method to another existing one based on RSA cryptosystem. We considered a network formed of 500 sensor nodes, each one is equipped by a battery of 100 units capacity. We consider that the energy consumption E of a node is proportional to the computational time t, i.e., E = kt. The same coefficient of proportionality k is taken while comparing the two encryption scenarii. Sensor nodes are then connected to 50 aggregators chosen randomly. Each sensor node choose the nearest aggregator. The running of each simulation is as follows: each sensor node takes a random value, encrypts it using one of the encryption methods then sends it to its aggregator. Aggregators compute the sum of the encrypted received data and send it to the sink. We compared our approach to the known RSA public-key cryptographic algorithms, and we evaluated the energy consumption of the network while varying the sizes of the keys and obviously the security levels. The energy consumption is the units of the battery used to do the encryption.

Tables II andIII show the energy consumption of sensor nodes to do the encryption operations using our encryption method and the RSA one respectively. We varied the keys sizes and obviously the security levels. We notice that for the same level of security in our approach we used small keys while saving more energy. For instance, for high security levels (4 for example) a node using our approach needs to use a key of 167 bits instead of 1891 in the case of RSA and consumes 0.1 % of the battery power instead of 3.63 %.

Tables IV and V give the energy consumption E at the aggregation stage. The same hypothesis that above have been made, the sole difference is that aggregator nodes have a battery of 1000 units of energy. It can be seen that the energy needed by aggregators are between 50 and 500 times more important in the RSA-based scheme, for the same level of security.

Figure 2 gives the comparison between RSA and elliptic curve based encryption, concerning the average energy consumption of an aggregating wireless sensor network. We can notice that our approach saves the energy largely greater than the case of RSA, where its depletion is so fast. Finally let us notice that, in addition of reducing the amount of energy units needed for encryption and aggregation, the sink receives many more values per second in EC-based networks than in RSA-based one.

VII. CONCLUSION

In this paper, we presented an elliptic curve based approach for secure data aggregation in sensor networks. It is based on data encryption with homomorphic properties that provide the possibility to operate on cypher-text. It prevents the decryption phase at the aggregators layers and saves nodes energy. Existing works have exponential bound in computation and are not suitable for sensor networks, which we tried to relax in our approach. The proposed scheme permits the generation of shorter encryption asymmetric keys, which is so important in the case of sensor networks. The experimental results show that our method significantly reduces computation and communication overhead compared to other works, and can be practically implemented in on-the-shelf sensor platforms.

Figure 1 .

 1 Figure 1. Secure data aggregation in sensor networks


Christophe Guyeux
email: christophe.guyeux@univ-fcomte.fr

Jacques M Bahi
email: jacques.bahi@univ-fcomte.fr

A NEW CHAOS-BASED WATERMARKING ALGORITHM

Keywords: Watermarking, Chaotic iterations, Topological chaos, Information hiding

This paper introduces a new watermarking algorithm based on discrete chaotic iterations. After defining some coefficients deduced from the description of the carrier medium, chaotic discrete iterations are used to mix the watermark and to embed it in the carrier medium. It can be proved that this procedure generates topological chaos, which ensures that desired properties of a watermarking algorithm are satisfied.

INTRODUCTION

Information hiding has recently become a major security technology, especially with the increasing importance and widespread distribution of digital media through the Internet. It includes several techniques, among which is digital watermarking. The aim of digital watermarking is to embed a piece of information into digital documents, like pictures or movies for example. This is for a large panel of reasons, such as: copyright protection, control utilization, data description, integrity checking, or content authentication. Digital watermarking must have essential characteristics including imperceptibility and robustness against attacks. Many watermarking schemes have been proposed in recent years, which can be classified into two categories: spatial domain [START_REF] Wu | A chaos based robust spatial domain watermarking algorithm[END_REF] and frequency domain watermarking [START_REF] Cong | A wavelet packets watermarking algorithm based on chaos encryption[END_REF], [START_REF] Dawei | A chaos-based robust wavelet-domain watermarking algorithm[END_REF]. In spatial domain watermarking, a great number of bits can be embedded without inducing too clearly visible artifacts, while frequency domain watermarking has been shown to be quite robust against JPEG compression, filtering, noise pollution, and so on. More recently, chaotic methods have been proposed to encrypt the watermark, or embed it into the carrier image for security reasons.

In this paper, a new watermarking algorithm is given. It is based on the commonly named chaotic iterations and on the choice of relevant coefficients deduced from the description of the carrier medium. This new algorithm consists of two basic stages: a mixture stage and an embedding stage. At each of these two stages, the proposed algorithm offers additional steps that allow the authentication of relevant information carried by the medium or the extraction of the watermark without knowledge about the original image.

This paper is organized as follows: firstly, some basic definitions concerning chaotic iterations is recalled. Then, the new chaos-based watermarking algorithm is introduced in Section 3. Section 4 is constituted by the evaluation of our algorithm: a case study is presented, some classical attacks are executed and the results are presented and commented on. The paper ends by a conclusion section where our contribution is summarized, and planned future work is discussed.

BASIC RECALLS: CHAOTIC ITERATIONS

In the sequel S n denotes the n th term of a sequence S, V i denotes the i th component of a vector V and f k = f • ... • f denotes the k th composition of a function f . Finally, the following notation is used: 1; N = {1, 2, . . . , N}.

Let us consider a system of a finite number N of cells, so that each cell has a boolean state. Then a se-quence of length N of boolean states of the cells corresponds to a particular state of the system. A sequence which elements belong in 1; N is called a strategy. The set of all strategies is denoted by S.

Definition 1 Let S ∈ S. The shift function is defined by σ : (S n ) n∈N ∈ S -→ (S n+1 ) n∈N ∈ S and the initial function i is the map which associates to a sequence, its first term: i :

(S n ) n∈N ∈ S -→ S 0 ∈ 1; N .
Definition 2 The set B denoting {0, 1}, let f : B N -→ B N be a function and S ∈ S be a strategy. Then, the so-called chaotic iterations are defined by x 0 ∈ B N and ∀n ∈ N * , ∀i ∈ 1; N ,

x n i = x n-1 i if S n = i f (x n-1 ) S n if S n = i.
(1)

A NEW CHAOS-BASED WATERMARKING ALGORITHM

Most and Least Significant Coefficients

Let us first introduce the definitions of most and least significant coefficients of an image.

Definition 3 For a given image, the most significant coefficients (in short MSCs), are coefficients that allow the description of the relevant part of the image, i.e. its most rich part (in terms of embedding information), through a sequence of bits.

For example, in a spatial description of a grayscale image, a definition of MSCs can be the sequence constituted by the first three bits of each pixel. Definition 4 By least significant coefficients (LSCs), we mean a translation of some insignificant parts of a medium in a sequence of bits (insignificant can be understand as: "which can be altered without sensitive damages").

The LSCs are used during the embedding stage: some of the least significant coefficients of the carrier image will be chaotically chosen and replaced by the bits of the (possibly mixed) watermark.

The MSCs are only useful in case of authentication, mixture and embedding stages will then depend on them. Hence, a coefficient should not be defined at the same time both as a MSC and a LSC: the LSC can be altered, while the MSC is needed to extract the watermark (in case of authentication).

Stages of the Algorithm

Our watermarking scheme consists of two classical stages: the mixture of the watermark and its embedding into a cover image.

Watermark mixture

For security reasons, the watermark can be mixed before its embedding. A common way to achieve this stage is to use the bitwise exclusive or (XOR), for example, between the watermark and a logistic map. In this paper, we will introduce a mixture scheme based on chaotic iterations. Its chaotic strategy will be highly sensitive to the MSCs, in case of an authenticated watermark [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF]. For the details of this stage see the Paragraph 4.1.2 in Section 4.

Watermark Embedding

This stage can be done either by applying the logical negation of some LSCs, or by replacing them by the bits of the possibly mixed watermark.

To choose the sequence of LSCs to be changed, a number of integers, less than or equals to the number N of LSCs, corresponding to a chaotic sequence U k k , is generated from the chaotic strategy used in the mixture stage and possibly the watermark. Thus, the U kth least significant coefficient of the carrier image is either switched, or substituted by the k th bit of the possibly mixed watermark. In case of authentication, such a procedure leads to a choice of the LSCs which are highly dependent on the MSCs.

On the one hand, when the switch is chosen, the watermarked image is obtained from the original image, whose LSCs L = B N are replaced by the result of some chaotic iterations. Here, the iterate function is the vectorial boolean negation, defined by f 0 : B N -→ B N , (x 1 , . . . , x N ) -→ (x 1 , . . . , x N ), the initial state is L and strategy is equal to U k k . In this case, it is possible to prove that the whole embedding stage satisfies topological chaos properties [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF], but the original medium is needed to extract the watermark.

On the other hand, when the selected LSCs are substituted by the watermark, its extraction can be done without the original cover. In this case, the selection of LSCs still remains chaotic, because of the use of a chaotic map, but the whole process does not satisfy topological chaos [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF]: the use of chaotic iterations is reduced to the mixture of the watermark. See the Paragraph 4.1.3 in Section 4 for more details.

Extraction

The chaotic sequence U k can be regenerated, even in the case of an authenticated watermarking: the MSCs have not been changed during the stage of embedding watermark. Thus, the altered LSCs can be found. So, in case of substitution, the mixed watermark can be rebuilt and "decrypted". In case of negation, the result of the previous chaotic iterations on the watermarked image, is the original image.

If the watermarked image is attacked, then the MSCs will change. Consequently, in case of authentication and due to the high sensitivity of the embedding sequence, the LSCs designed to receive the watermark will be completely different. Hence, the result of the decrypting stage of the extracted bits will have no similarity with the original watermark.

A CASE STUDY

Stages and Details

Images Description

Carrier image is the famous Lena, which is a 256 grayscale image and the watermark is the 64 × 64 pixels binary image depicted in Fig. 1a. The embedding domain will be the spatial domain. The selected MSCs are the four most significant bits of each pixel and the LSCs are the three following bits (a given pixel will at most be modified by four levels of gray by an iteration). The last bit is then not used. Lastly, LSCs of Lena are substituted by the bits of the mixed watermark.

(a) Watermark.

(b) Watermarked Lena. Figure 1: Watermark and watermarked Lena.

Mixture of the Watermark

The initial state x 0 of the system is constituted by the watermark, considered as a boolean vector. The iteration function is the vectorial logical negation f 0 and the chaotic strategy (S k ) k∈N will depend on whether an authenticated watermarking method is desired or not, as follows. A chaotic boolean vector is generated by a number T of iterations of a logistic map ((µ,U 0 ) parameters will constitute the private key). Then, in case of unauthenticated watermarking, the bits of the chaotic boolean vector are grouped six by six, to obtain a sequence of integers lower than 64, which will constitute the chaotic strategy. In case of authentication, the bitwise exclusive or (XOR) is made between the chaotic boolean vector and the MSCs and the result is converted into a chaotic strategy by joining its bits as above. Thus, the mixed watermark is the last boolean vector generated by the chaotic iterations.

Embedding of the Watermark

To embed the watermark, the sequence (U k ) k∈N of altered bits taken from the M LSCs must be defined. To do so, the strategy (S k ) k∈N of the mixture stage is used as follows

U 0 = S 0 U n+1 = S n+1 + 2 × U n + n (mod M).
(2)

To obtain the result depicted in Fig. 1b.

Remark that the map θ → 2θ of the torus, which is a famous example of topological Devaney's chaos (?), has been chosen to make (U k ) k∈N highly sensitive to the chaotic strategy. As a consequence, (U k ) k∈N is highly sensitive to the alteration of the MSCs: in case of authentication, any significant modification of the watermarked image will lead to a completely different extracted watermark.

Simulation Results

To prove the efficiency and the robustness of the proposed algorithm, some attacks are applied to our chaotic watermarked image. For each attack, a similarity percentage with the watermark is computed, this percentage is the number of equal bits between the original and the extracted watermark.

Zeroing Attack

In this kind of attack, some pixels of the image are put to 0. In this case, the results in Table 1 have been obtained. We can conclude that in case of unauthentication, the watermark still remains after a cropping attack: the desired robustness is reached. In case of authentication, even a small change of the carrier image leads to a very different extracted watermark. In this case, any attempt to alter the carrier image will be signaled.

Rotation Attack

Let r θ be the rotation of angle θ around the center (128, 128) of the carrier image. So, the transformation r -θ • r θ is applied to the watermarked image. The good results in Table 2 are obtained.

JPEG Compression

A JPEG compression is applied to the watermarked image, depending on a compression level. Let us notice that this attack leads to a change of the representation domain (from spatial to DCT domain). In this case, the results in Table 3 have been found. A good authentication through JPEG attack is obtained. As for the unauthentication case, the watermark still remains after a compression level equal to 10. This is a good result if we take into account the fact that we use spatial embedding.

Gaussian Noise

Watermarked image can be also attacked by the addition of a Gaussian noise, depending on a standard deviation. In this case, the results in

DISCUSSION AND FUTURE WORK

In this paper, a new way to generate watermarking methods is proposed. The new procedure depends on a general description of the carrier medium to watermark, in terms of the significance of some coefficients we called MSC and LSC. Its mixture and also the selection of coefficients to alter are based on chaotic iterations, which generate topological chaos in the sense of Devaney. Thus, the proposed algorithm possesses expected desirable properties for a watermarking algorithm. For example, strong authentication of the carrier image, security, resistance to attacks, and discretion.

The algorithm has been evaluated through attacks and the results expected by our study have been experimentally obtained. The aim was not to find the best watermarking method generated by our general algorithm, but to give a simple illustrated example to prove its feasibility. In future work, other choices of iteration functions and chaotic strategies will be explored. They will be compared in order to increase authentication and resistance to attacks. Lastly, frequency domain representations will be used to select the MSCs and LSCs.

Table 2 :

 2 Rotation attacks.

	UNAUTHENTICATION	AUTHENTICATION
	Size (pixels) Similarity	Size (pixels) Similarity
	10	99.08%	10	89.81%
	50	97.31%	50	54.54%
	100	92.43%	100	52.24%
		Table 1: Zeroing attacks.
	UNAUTHENTICATION	AUTHENTICATION
	Angle	Similarity	Angle	Similarity
	5	94.67%	5	59.47%
	10	91.30%	10	54.51%
	25	80.85%	25	50.21%

Table 4

 4

				have been
	found.
	UNAUTHENTICATION	AUTHENTICATION
	Ratio	Similarity	Ratio	Similarity
	2	82.95%	2	54.39%
	5	65.23%	5	53.46%
	10	60.22%	10	50.14%
		Table 3: JPEG compression attacks.

Table 4 :

 4 Gaussian noise attacks.


Christophe Guyeux
email: christophe.guyeux@univ-fcomte.fr

Jacques M Bahi
email: jacques.bahi@univ-fcomte.fr

An improved watermarking algorithm for Internet applications

Keywords: Information hiding, Internet security, Wavelets, Error correcting codes, Social search engines, Digital rights management

In this document is proposed a data hiding scheme ready for Internet applications. An existing algorithm based on chaotic iterations is improved, to respond to some major Internet security concerns, such as digital rights management, communication over hidden channels, and social search engines. By using Reed Solomon error correcting codes and wavelets domain, we show that this data hiding scheme can be improved to solve issues and requirements raised by these Internet fields.

I. INTRODUCTION

Information hiding has recently become a major digital technology, especially with the increasing importance and widespread distribution of digital media through the Internet. It encompasses steganography and digital watermarking. The aim of watermarking is to slightly alter some digital documents, like pictures or movies, for a large panel of reasons, such as: copyright protection, control utilization, data description, integrity checking, or content authentication. Various qualities are required for a watermarking method, depending on the aims to reach: discretion, robustness against attacks, etc. Many watermarking schemes have been proposed in recent years, which can be classified into two categories: spatial domain [START_REF] Wu | A chaos based robust spatial domain watermarking algorithm[END_REF] and frequency domain watermarking [START_REF] Cong | A wavelet packets watermarking algorithm based on chaos encryption[END_REF], [START_REF] Dawei | A chaos-based robust wavelet-domain watermarking algorithm[END_REF]. In spatial domain watermarking, a great number of bits can be embedded without inducing too clearly visible artifacts, while frequency domain watermarking has been shown to be quite robust against JPEG compression, filtering, noise pollution and so on. More recently, chaotic methods have been proposed to encrypt the watermark, or embed it into the carrier image, to improve security.

Information hiding is now an integral part of Internet technologies. In the field of social search engines, for example, contents like pictures or movies are tagged with descriptive labels by contributors, and search results are determined by these descriptions. These collaborative taggings, used for example in Flickr [START_REF]The frick collection[END_REF] and Delicious [START_REF]Delicious social bookmarking[END_REF] websites, contribute to the development of a Semantic Web, in which every Web page contains machine-readable metadatas that describe its content. Information hiding technologies can be used for embedding these metadatas. The advantage of its use is the possibility to realize social search without websites and databases: descriptions are directly embedded into media, whatever their formats. Robustness is required in this situation, as descriptions should resist to modifications like resizing, compression, and format conversion.

The Internet security field is also concerned by watermarking technologies. Steganography and cryptography are supposed to be used by terrorists to communicate through the Internet. Furthermore, in the areas of defense or in industrial espionage, many information leaks using steganographic techniques have been discovered. Lastly, watermarking is often cited as a possible solution to digital rights managements issues, to counteract piracy of digital work in an Internet based entertainment world [START_REF] Nakashima | Watermarked movie soundtrack finds the position of the camcorder in a theater[END_REF].

In this paper, the desire is to improve the robustness of the watermarking algorithm proposed in [START_REF] Bahi | A new chaos-based watermarking algorithm[END_REF], to respond to Internet security concerns recalled above. The robustness of the watermarking algorithm through geometric attacks is improved by using Reed Solomon correcting codes, whereas the capacity to withstand JPEG compression and noise pollution attacks is enlarged by embedding the watermark into the wavelets domain. Due to its improved robustness, this scheme is suitable for tagging multimedia contents in a social web search context. Additionally, the proposed algorithm possesses various properties of chaos and is secure (see [START_REF] Bahi | A new chaos-based watermarking algorithm[END_REF]), so it is suitable when desiring to establish a hidden communication channel through the Internet, or for digital rights management. Lastly, watermark encryption and authentication are possible, which enlarge the variety of use in Internet security applications.

The rest of this paper is organized as follows. Firstly, some basic definitions concerning chaotic iterations and topological chaos are given in Section II. The data hiding scheme used in this paper is recalled in the same section. In Section III, the way to use Reed Solomon error correcting codes to improve robustness against geometric attacks is given. Then it is explained in Section IV how to improve robustness against frequency domain attacks by using wavelets coefficients into our scheme. The paper ends with a conclusion section where the contribution is summed up and the planned future work is discussed.

II. BASIC RECALLS

This section is devoted to the recall of the data hiding scheme, which will be improved in Sections III and IV. To do so, basic notations and terminologies in the fields of chaotic iterations and topological chaos are introduced.

A. Chaotic iterations and Devaney's chaos 1) Chaotic iterations:

In the sequel S n denotes the n th term of a sequence S, V i denotes the i th component of a vector V , and f k = f • ... • f is for the k th composition of a function f . Finally, the following notation is used:

1; N = {1, 2, . . . , N }.

Let us consider a system of a finite number M of cells, so that each cell has a boolean state. Then a sequence of length M of boolean states of the cells corresponds to a particular state of the system. A sequence which elements belong in 1; M is called a strategy. The set of all strategies is denoted by S.

x n i = x n-1 i if S n = i, f (x n-1 ) S n if S n = i. (1)
In other words, at the n th iteration, only the S n -th cell is "iterated".

2) Devaney's chaotic dynamical systems: Consider a metric space (X , d) and a continuous function f : X -→ X . f is said to be topologically transitive if, for any pair of open sets U, V ⊂ X , there exists k > 0 such that f k (U ) ∩ V = ∅. (X , f ) is said to be regular if the set of periodic points is dense in X . f has sensitive dependence on initial conditions if there exists δ > 0 such that, for any x ∈ X and any neighborhood V of x, there exists y ∈ V and n 0 such that |f n (x)f n (y)| > δ. δ is called the constant of sensitivity of f . Quoting Devaney in [START_REF] Devaney | An Introduction to Chaotic Dynamical Systems[END_REF], a function f : X -→ X is said to be "chaotic" on X if (X , f ) is regular, topologically transitive, and has sensitive dependence on initial conditions. When f is chaotic, then the system (X , f ) is highly unpredictable because of regularity and sensitive dependence on initial conditions. Moreover, it cannot be simplified (broken down or decomposed into two subsystems which do not interact) because of topological transitivity. These chaotic dynamical systems then present behaviors very similar to physical noise sources.

In [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF], a rigorous theoretical framework has been introduced for the study of chaotic iterations. It has been proven that chaotic iterations (CIs) presented above satisfy topological chaos properties, which leads to improve the security of data hiding schemes based on CIs.

B. Definition of a chaos-based data hiding algorithm 1) Most and least significant coefficients:

Let us define the notions of most and least significant coefficients of an image.

Definition 1 For a given image, most significant coefficients (in short MSCs), are coefficients that allow the description of the relevant part of the image, i.e. its richest part (in terms of embedding information), through a sequence of bits.

For example, in a spatial description of a grayscale image, a definition of MSCs can be the sequence constituted by the first four bits of each pixel (see Figure 1). In a discrete cosine frequency domain description, each 8 × 8 block of the carrier image is mapped onto a list of 64 coefficients. The energy of the image is mostly contained in a determined part of themselves, which can constitute a possible sequence of MSCs. Definition 2 By least significant coefficients (LSCs), we mean a translation of some insignificant parts of a medium in a sequence of bits (insignificant can be understand as: "which can be altered without sensitive damages"). These LSCs can be, for example, the last three bits of the gray level of each pixel (see Figure 1). Discrete cosine, Fourier, and wavelet transforms can be used also to generate LSCs and MSCs. Moreover, these definitions can be extended to other types of media. LSCs are used during the embedding stage. Indeed, some of the least significant coefficients of the carrier image will be chaotically chosen and switched, or replaced by the bits of the watermark. The MSCs are only useful in case of authentication; mixture and embedding stages depend on them. Hence, a coefficient should not be defined at the same time as a MSC and a LSC: the last can be altered while the first is needed to extract the watermark.

2) Stages of the algorithm: Our data hiding scheme consists of two stages: (1) mixture of the watermark and (2) its embedding.

Watermark mixture: Firstly, for safety reasons, the watermark can be mixed before its embedding into the image. A common way to achieve this stage is to use the bitwise exclusive or (XOR), for example between the watermark and a pseudo-random binary sequence provided by the generator defined in [START_REF] Bahi | A novel pseudo-random generator based on discrete chaotic iterations[END_REF]. In this paper, we introduce a new mixture scheme based on chaotic iterations. Its chaotic strategy will be highly sensitive to the MSCs, in the case of an authenticated watermarking.

Watermark embedding: Some LSCs will be switched, or substituted by the bits of the possibly mixed watermark. To choose the sequence of LSCs to be altered, a number of integers, less than or equal to the number M of LSCs corresponding to a chaotic sequence U , is generated from the chaotic strategy used in the mixture stage. Thus, the U k -th least significant coefficient of the carrier image is either switched, or substituted by the k th bit of the possibly mixed watermark. In case of authentication, such a procedure leads to a choice of the LSCs which are highly dependent on the MSCs [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF].

On the one hand, when the switch is chosen, the watermarked image is obtained from the original image whose LSBs L = B M are replaced by the result of some chaotic iterations. Here, the iterate function is the vectorial boolean negation,

f 0 : (x 1 , ..., x M ) ∈ B M -→ (x 1 , ..., x M ) ∈ B M , (2)
the initial state is L, and the strategy is equal to U . In this case, the whole embedding stage satisfies topological chaos properties (see [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF]), but the original medium is needed to extract the watermark. On the other hand, when the selected LSCs are substituted by the watermark, its extraction can be done without the original cover (blind watermarking). In this case, the selection of LSBs still remains chaotic because of the use of a chaotic map, but the whole process does not satisfy topological chaos [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF]. The use of chaotic iterations is reduced to the mixture of the watermark. See the following sections for more detail.

Extraction: The chaotic strategy can be regenerated even in the case of an authenticated watermarking, because the MSCs have not been changed during the embedding stage. Thus, the few altered LSCs can be found, the mixed watermark can be rebuilt, and the original watermark can be obtained. In case of a switch, the result of the previous chaotic iterations on the watermarked image should be the original cover. The probability of being watermarked decreases when the number of differences increase.

If the watermarked image is attacked, then the MSCs will change. Consequently, in case of authentication and due to the high sensitivity of the embedding sequence, the LSCs designed to receive the watermark will be completely different. Hence, the result of the recovery will have no similarity with the original watermark.

The chaos-based data hiding algorithm is summed up in Figure 2.

III. IMPROVING ROBUSTNESS AGAINST GEOMETRIC

ATTACKS

In this section, we are interested in improving our scheme to make its use relevant in a social web search context. The idea is to embed the tag of a given image into its pixel values. As neither the cover image nor the tag should be required during a search, the LSBs will be replaced (not switched), by the tags. Authentication is not required, as man-in-the-middle attacks are not supposed to occur. However tags are vulnerable to involuntary attacks such as rotation or resizing, so we need to improve robustness against geometric attacks. To do so, the embedding domain will be the spatial domain. This choice leads to a large given payload, so a lot of tags can be embedded into the cover image. Additionally, we will use Reed-Solomon error correcting codes, to reinforce the capacity to extract the watermark from a tagged image, even though it has been altered. As an illustrative example, we will show how to embed the description of the well-known Lena into its own image. Let us remark that the same procedure can be applied to create a hidden channel for communicating through a given web page, for example, by inserting messages in the background image of this website. In this situation, it is recommended to add the encryption stage to improve the security of the hidden channel.

In this illustrative example, the following text extracted from Wikipedia's description of Lena will be inserted into its own image: Lena (Soderberg), a standard test image originally cropped from the November 1972 issue of Playboy magazine.

The cover image will be the Figure 1(a), which is a 256×256 grayscale image. The text to embed is converted into 756 binary digits by using the ASCII table: each of the 109 characters are coded with 7 digits, thus obtaining the following bits flow (called a system): 100110011001011101110110000101000000101000101001111011 111100100110010111100101100010110010111100101100111... 20000 binary digits are computed from a logistic map, with parameters µ = 3.999999, x 0 = 0.65, and those binary digits are grouped ten by ten (10 = ⌈log 2 (756)⌉) to obtain an integer sequence S lesser than or equal to 756. So, chaotic iterations are applied to the above system, with chaotic strategy S and the vectorial boolean negation, to obtain the following encrypted message: 001000111110001110001101110111111000011011010011000101 001011110000110110011010010001110101101100010110101... In this example, there is no authentication step, but Reed-Solomon error correction codes are used to increase the robustness. Here, two layers of Reed-Solomon coding, respectively (32,24)-RS and (24,16)-RS codes, are separated by a 3-way convolutional interleaver operation, to obtain a scheme similar to the Cross-Interleaved Reed Solomon Coding (CIRC) of the compact disc. The message to embed is the result of this coding operation: a 2112 binary stream, starting by: 010110100101100000100001000111000010011100111111010001 110111100000010110001101010111011000010011001001110... These 2112 bits will be embedded into Lena, an image constituted by 256 × 256 × 8 = 524288 bits (8 bits per pixel). To do so, we will consider the two least significant bits of each pixel as LSCs: a few of them will be replaced by the bits of the watermark. To select these bits to replace, the strategy S of the encryption stage is used again, to generate a sequence of triplets (x n , y n , z n ) n∈N in such a way that x n , y n ∈ 0; 255 N , and z n ∈ {1; 2} N . This generation is realized as follows:

   x 0 = 11, y 0 = 23, z 0 = 1, and    x n+1 = 2x n + S 3n + n (mod 255), y n+1 = 2y n + S 3n+1 + n (mod 255), z n+1 = 2z n + S 3n+2 + n (mod 2).
So the n th bit of the encrypted and encoded binary message is inserted into the z n least significant bit of the pixel in position (x n , y n ) of Lena, to obtain the watermarked Lena in Figure 3(a). In Figure 3(b) the differences are shown between the original Lena and the watermarked Lena. This image illustrates the fact that LSCs to be replaced are chaotically chosen and uniformly distributed [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF].

In [START_REF] Bahi | A new chaos-based watermarking algorithm[END_REF], our scheme has been defined without RS codes and its robustness has been evaluated. It is established that the watermark can resist rotation, cropping, JPEG compression, and gaussian noise attacks. However, the extracted watermark is slightly different from the original one and this difference increases with the number of attacks. These errors, which are undesirable in a social web search context, can be corrected by the use of RS codes.

To illustrate, the watermarked Lena is zeroed: a square of 40 × 40 pixels is removed from the image, as in Figure 3(c). So the message is extracted from the watermarked and attacked Lena: the strategy S is regenerated from a logistic map with the same parameters as above. Then the sequences x n , y n and z n can be regenerated too, and the embedded bits can thus be extracted. These bits are decoded in the reverse process: (24,16)-RS decoding, 3way deinterlacing, and (32,24)-RS decoding codes. Lastly, the resulting bits sequence is decrypted, bits are grouped 7 by 7, and converted into characters with the ASCII table, to obtain the following message: Lena (Soderberg), a standard test image originally cropped from the November 1972 issue of Playboy magazine.

IV. IMPROVING ROBUSTNESS AGAINST FREQUENCY DOMAIN ATTACKS

In this section, the way to use our algorithm in frequency DWT domain is explained. Due to its robustness against frequency attacks such as JPEG compression, this scheme can be used to insert a copyright into a media (digital rights management context).

A. Stages and detail

The carrier image and watermark are the same as in Section III, but Lena is now constituted by 512 × 512 pixels. The embedding domain is the discrete wavelets domain (DWT). In this paper, the Daubechies family of wavelets is chosen: Lena is converted into its Daubechies-1 DWT coefficients, which are altered by chaotic itera-tions. The watermark is encrypted by chaotic iterations before its embedding, with the same procedure as above.

Each example below depends on a decomposition level and a coefficient matrix (Figure 4): LL means approximation coefficient, when HH, LH, HL denote respectively diagonal, vertical and horizontal detail coefficients. For example, the DWT coefficient HH2 is the matrix equal to the diagonal detail coefficient of the second level of decomposition of Lena. To embed the encrypted watermark, LSCs are obtained from the coefficients defined above. The system to iterate is the boolean vector of size 256 2 , constituted by these M LSCs of Lena. Iterate function is the vectorial boolean negation, and chaotic strategy U is defined as follows:

U 0 = S 0 U n+1 = S n+1 + 2 × U n + n (mod M). (3)
where S denotes the strategy used in the encryption stage (see [START_REF] Bahi | A new chaos-based watermarking algorithm[END_REF]). Thus, bits of the LSCs are switched, not replaced: the whole embedding process satisfies Devaney's chaos property [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF]. However, for this reason, the watermark cannot be extracted: contrary to Section III, we are not in a steganographic framework, but in a pure non-blind watermarking scheme used for digital rights management.

To know if a given image I ′ is the watermarked version of another image I:

• the whole process is applied to I ′ , with the same parameters (LSCs, watermark, etc.), to obtain I ′′ , • I ′′ is compared to the original I. To evaluate the differences, the RMS value defined by x =

1 M M i=1 (I -I ′′ ) 2
i is computed. The probability that the image has been watermarked increases when the RMS decreases. Indeed, each bit of the LSCs of I ′′ has been switched an even number of times (the RMS is nonzero because of computational errors).

B. First example: coefficient HH2

1) Embedding: In this first experiment, the watermark is inserted into the diagonal coefficient HH2 (a real matrix of size 128 × 128). LSCs are the second least significant bit of each integral value of HH2. To do the insertion, chaotic iterations are made. The system to iterate is the boolean vector of size 128 2 , constituted by the LSCs of Lena. Iterate function is the vectorial boolean negation and chaotic strategy is defined as in Equation 3, with U 0 = 1 and M = 256 2 . In this situation, PSNR = 53.45db. Pixel values have been modified by at most of one level of gray. The mean value of differences is equal to 0.294, when RMS = 0.542. The alteration can thus be considered as indistinguishable.

2) Extraction: The system to iterate is constituted by the second least significant bit of each integral value of HH2, the approximation coefficient of the first decomposition level of the watermarked Lena. Iterate function is the vectorial boolean negation and chaotic strategy is computed as above. Thus, the result is compared to the coefficient HH2 of the original Lena. The RMS is equal to 0.129. As a comparison, Table I gives the RMS values resulting on a bad extraction (wrong parameters, etc.) Symbol '-' means that the value of the considered parameter is unchanged. We show that the least RMS is obtained for an extraction with the same parameters as the embedding. Let us notice that if the extraction is attempted to the original Lena, RMS is twice greater than 0.127.

C. Second example: coefficient LL1

1) Embedding: In this paragraph, the watermark is inserted into the approximation coefficient LL1 of Lena (a real matrix of size 256 × 256) and LSCs are the second least significant bit of each integral value of LL1.

To realize the embedding, chaotic iterations are realized as before. The system to iterate is the boolean vector, of size 256 2 , constituted by the LSCs of Lena. Iterate function is the vectorial boolean negation, chaotic strategy is defined as in Equation 3 with U 0 = 1, and M = 256 2 . In this situation, PSNR = 60.06 db. Pixel values have been modified by at most two levels of gray. The mean value of differences is 0.063, when the RMS is equal to 0.245. For all of these reasons, the alteration can be considered again as indistinguishable.

2) Extraction: The system to iterate is constituted by the second least significant bit of each integral value of LL1. Iterate function is the vectorial boolean negation and chaotic strategy is computed as above. Thus, the result is compared to the coefficient LL1 of the original Lena. In our example, we obtain RMS = 0.127. As a comparison, Table II below gives the RMS values resulting in a bad extraction (wrong parameters, etc.) Symbol '-' means that the value of the considered parameter is unchanged. We show that the least RMS is obtained for an extraction with the same parameters as the embedding. Let us remark that if the extraction is tried on the original Lena, then RMS is twice greater than 0.127.

V. DISCUSSION AND FUTURE WORK

In this paper, the robustness of the data hiding scheme proposed in [START_REF] Bahi | A new chaos-based watermarking algorithm[END_REF] is improved to achieve properties required in Internet applications of data hiding techniques. This scheme depends on a general description of the carrier medium to watermark, in terms of the significance of some coefficients we called MSCs and LSCs. The encryption of the watermark and the selection of coefficients to alter are based on chaotic iterations, which generate topological chaos in the sense of Devaney [START_REF] Bahi | Topological chaos and chaotic iterations, application to hash functions[END_REF]. Thus, the proposed algorithm has a sufficient level of security for Internet applications, such as digital rights management or social web search.

We have proposed in this paper to enlarge the relevance of our scheme in these contexts by using Reed-Solomon error correcting codes and wavelets domain. The first improvement is relevant in a social web search domain, in which the tags of an image must be recovered exactly, even though the image has faced geometric operations. The use of wavelets domain is linked more to digital rights management. This domain is known to present good results against frequency attacks, which can occur when someone tries to remove some DRM. It can be noticed that these two improvements can be realized together.

Algorithms have been evaluated through attacks and results have been experimentally obtained. Choices that have been made in this first study are simple: spatial and Daubechies domains for the embedding, negation function as iteration function, etc. The aim was not to find the best watermarking method generated by our general algorithm, but to explain how to improve robustness for Internet applications.

In future work, other choices of iteration functions and chaotic strategies will be explored and compared in order to increase authentication and robustness to attacks. In addition, new frequency domain representations will be used to select the MSCs and LSCs. Properties induced by topological chaos, such as entropy, will be explored and their role in Internet applications will be explained.

Definition 1 Definition 2

 12 Let S ∈ S. The shift function is defined by σ : (S n ) n∈N ∈ S -→ (S n+1 ) n∈N ∈ S and the initial function i is the map which associates to a sequence, its first term: i : (S n ) n∈N ∈ S -→ S 0 ∈ 1; M . The set B denoting {0, 1}, let f : B M -→ B M be a function and S ∈ S be a strategy. Then, the socalled chaotic iterations are defined [10] by x 0 ∈ B M and ∀n ∈ N * , ∀i ∈ 1; M ,

  (a) Lena. (b) MSCs of Lena. (c) LSCs of Lena (×17).

Figure 1 .

 1 Figure 1. Example of most and least significant coefficients of Lena.

Figure 2 .

 2 Figure 2. The chaos-based data hiding algorithm.

  (a) Watermarked Lena. (b) Differences with Lena.(c) Attacked Lena.

Figure 3 .

 3 Figure 3. Watermarked Lenas (scale reduced).

Figure 4 .

 4 Figure 4. Wavelets coefficients.

  (a) Original Lena. (b) Watermarked Lena.

Figure 5 .

 5 Figure 5. Data hiding in DWT domain