Method and apparatus for image authentication

[0002] 1. Field of the Invention

[0003] The present invention relates to image authentication, and more particularly relates to methods and apparatus for image authentication which distinguish unauthorized content-altering image alterations from content preserving manipulations, such as image compression.

[0004] 2. Description of Related Art

[0005] With the recent growth in accessability of computers and digital cameras, the importance of digital images is constantly increasing. Digital images offer advantages over traditional photographic processes in ease of manipulation, storage and processing. However, the ease in which digital images can be altered significantly reduces the reliability which was once inherent in a photographic image.

[0006] To enhance the reliability of digital images, image authentication techniques have been pursued to detect malicious manipulation of an image. Previously, two techniques have been investigated: 1) generating a digital signature of the image at the point of origin, i.e., at the digital camera; and 2) embedding a secret code, or “watermark,” related to the content of the image within the image.

[0007] The first method employs an encrypted digital signature which is generated by the image capturing device. Generally, the digital signature is based on a public key encryption method. In this type of method, a private key, known only to the capturing device, is used to encrypt a hashed version of an image to form the “signature” of the image which travels with the image. A public key is used to decrypt the signature. The public key is also used to hash the image and compare the codes of the current image to the original signature. If the codes match, the present image is considered authentic.

[0008] In the second method, a checksum value is generated corresponding to the bit values of the pixels forming the image. The checksum value is considered a fragile “watermark” for the image, as any alteration of the image will alter the checksum value and destroy the watermark. To authenticate an image, the current checksum value of the image is compared against the value of the watermark to verify that the values are equal.

[0009] Both of the above image authentication methods are limited in that any change in the image will result in a verification failure. However, certain image manipulations do not significantly alter the meaning of the image content and are considered desirable. For example, digital images are generally compressed prior to storage and data transmission in order to optimize the use of computer storage and data transmission resources. However, a very common image compression standard, JPEG (Joint Photographic Experts Group), results in a “lossy” compression of image data which irrevocably alters certain pixels in the image. Because JPEG compression alters the content of the image, the above described authentication methods cannot successfully verify an image after such lossy compression is applied.

[0010] FIGS. 1A and 1B illustrate systems known in the art for performing JPEG compression and decompression of a digital image, respectively. Referring to FIG. 1A, the source image 100, X, is grouped into ρ nonoverlapping 8×8 blocks, O FPIXELS i.e., X=∪_p=1^ρX_p. Each block is sent sequentially to a Discrete Cosine Transform (DCT) processor 102 to extract DCT coefficients for each block. Instead of representing each block, X_p, as a 8×8 matrix, each block can be represented as a 64×1 vector following the “zig-zag” order of the original matrix. Therefore, the DCT coefficients F_p, of the vector, X_p, can be considered as a linear transformation of X_pwith a 64×64 transformation matrix D, s.t.,

[0011] F_p=DX_p.  (1)

[0012] Each of the 64 DCT coefficients is applied to a quantizer 104 where the DCT coefficients are quantized with a 64-element quantization table Q 106. In JPEG compression, this table is used on all blocks of an image. (For color images, there could be three quantization tables for CrCb domains, respectively.) Quantization is defined as the division of each DCT coefficient by its corresponding quantizer step size, followed by rounding to the nearest integer: $\begin{array}{cc}{\tilde{f}}_p\left(v\right)\equiv \mathrm{Integer}\mathrm{Round}\left(\frac{F_p\left(v\right)}{Q\left(v\right)}\right)& \left(2\right)\end{array}$

[0013] where ν=1 . . . 64. In eq.(2), {tilde over (f)}_pis the output of the quantizer. For the convenience of later discussion, we can define {tilde over (F)}_p, a quantized approximation of F_p, as

[0014] {tilde over (F)}_p(ν)≡{tilde over (F)}_p(ν)·Q(ν).  (3)

[0015] After quantization, the inter-block differences of DC coefficients are encoded by an entropy encoder 108. The AC terms are ordered following the “zig-zag” order. Both DC and AC coefficients are then entropy encoded. The final JPEG file, {tilde over (B)} includes the Huffman table 110, the quantization table 106, the encoded data and some other information.

[0016] FIG. 1B illustrate a decoder suitable for decompressing an image subjected to JPEG compression. First, the decoder extracts and reconstructs the Huffman table 110 and quantization table 106 from the compressed image. Then the bitstream is sent to an entropy decoder 112 and a dequantizer 114 to substantially reconstruct the DCT coefficients of the original image. The output of dequantizer, {tilde over (F)}_p, is the same as that defined above in equation(3). An Inverse DCT (IDCT) processor 116 is then used to convert {tilde over (F)}_pto the spatial-domain image block {tilde over (X)}_p.

[0017] {tilde over (X)}_p=D⁻¹{tilde over (F)}_p.  (4)

[0018] All blocks are then tiled to form a decoded image frame.

[0019] Theoretically, the results of the IDCT process will be real numbers. However, the brightness of an image is usually represented by an 8-bit integer from 0 to 255. Therefore, a rounding process which maps those real numbers to integers may be necessary. This process is performed after the IDCT processor 116 by processing block 118.

[0020] In addition to image compression, it is also desirable to allow certain other manipulations to an image while still verifying the remaining content as authentic. In some cases image cropping, image translation, image masking, global intensity alteration etc. may be allowable. However, as with lossy compression, present image authentication techniques cannot verify an image once such allowable image manipulations are performed.

[0021] The above-described prior art techniques fail to satisfy the growing need for robust image authentication which can distinguish between allowable image manipulations and malicious, content altering manipulations which are impermissible.

[0022] An object of the present invention is to provide robust image authentication methods and apparatus which distinguish malicious content based attacks of an image from allowable transformations of an image.

[0023] A further object of the present invention is to provide an image authenticator which accepts and authenticates images subjected to format transformation, lossless compression as well as acceptable forms of lossy compression.

[0024] Another object of the present invention is to provide an image authenticator which accepts and authenticates images subjected to user specified content manipulations, such as cropping, shifting and image intensity adjustment.

[0025] Yet another object of the present invention is to provide an image authenticator which accepts and authenticates images subjected to JPEG image compression.

[0026] In accordance with a first embodiment of the present invention a system for authentication of a digital image includes a signature generator and an authentication processor. The signature generator includes an image analyzer which receives an original digital image, parses the image into block pair and generates invariant features of the image based on a relationship between corresponding pixels in the block pairs. Preferably, the signature generator also includes an encryption processor for encoding the invariant features generated by the image analyzer in accordance with encryption key data, thereby providing an encrypted signature for the image. The authentication processor receives a digital image to be authenticated as well as the signature for the original image. When the signature is encrypted, the authentication processor includes a decryption processor for decrypting the signature in accordance with decryption key data to extract the invariant features of the original image. The authentication processor further includes means for extracting coefficients of the image to be authenticated and an authentication comparator. The authentication comparator receives the coefficients of the image to be authenticated, extracts invariant features of the image to be authenticated based on a relationship between corresponding coefficients and compares the invariant features from the original image to those of the image to be authenticated to provide a signal indicative of an authentication failure if the corresponding features are not substantially equal.

[0027] Preferably, the relationship between corresponding pixels used to form the invariant features is the polarity of the difference of discrete cosine transform coefficients of corresponding coefficient locations in pairs of non-overlapping blocks of the image. The relationship preferably further includes the relative magnitude of the difference of discrete cosine transform coefficients of corresponding coefficient locations in the pairs of non-overlapping blocks of the image.

[0028] Preferably, the authentication system of the present invention can accept digital image data in the form of a raw image or a JPEG compressed bit stream. When the digital image to be authenticated is in the form of a raw image, the means for extracting invariant features includes a discrete cosine transform processor which receives the raw image and provides discrete cosine transform coefficients representing the raw image to the authentication comparator. When the digital image to be authenticated is in the form of a JPEG compressed image bit stream, the means for extracting invariant features includes a JPEG decoder which provides discrete cosine transform coefficients representing the raw image to the authentication comparator.

[0029] In accordance with another form of the present invention, a signature generator for providing a robust digital signature for a digital image includes an image analyzer which receives an original digital image, parses the image into at least one image block pair and generates substantially invariant features of the image. The invariant features correspond to a relationship between corresponding coefficient values in block pairs which remains unaltered during allowable image manipulations.

[0030] The relationship between corresponding coefficients includes the polarity of the difference of discrete cosine transform coefficients of corresponding coefficients locations of image block pair. Preferably, the relationship further includes the relative magnitude of the difference of discrete cosine transform coefficients of corresponding locations of the image block pairs.

[0031] In accordance with another form of the present invention, a digital image authenticator is formed for receiving data representing a digital image to be authenticated and a digital signature for the original image. The authenticator includes means for generating coefficients from the data representing the image to be authenticated, means for extracting invariant features for the original image from the digital signature and an authentication comparator. The authentication comparator receives the coefficients from the generating means and generates invariant features for the image to be authenticated from the coefficients. The authentication comparator then compares corresponding invariant features of the present image to those invariant features from the original image and provides a signal indicative of an authentication failure if the corresponding invariant features do not exhibit an expected relationship.

[0032] The expected relationship is at least partially defined by the polarity of the difference of discrete cosine transform coefficients of corresponding locations in non-overlapping block pairs of the image. Preferably, the expected relationship is further defined by the magnitude of the difference of discrete cosine transform coefficients of corresponding locations in non-overlapping block pairs of the image.

[0033] In accordance with a method of the present invention, an invariant feature for a digital image is formed by the following steps: partitioning the image into a plurality of image blocks; assigning image block pairs from the plurality of image blocks; extracting DCT coefficients in the image block pairs and determining an invariant relationship between corresponding coefficients DCT of the image block pairs.

[0034] In this method, the relationship is at least partially defined by the polarity of the difference of corresponding coefficients. Preferably, the relationship is further defined by the magnitude of the difference of the corresponding coefficients.

[0035] Exemplary embodiments of the present invention will be described in detail with reference in the accompanying drawings, in which:

[0036] FIG. 1A is a block diagram of an encoding system, known in the prior art, for performing JPEG image compression;

[0037] FIG. 1B is a block diagram of a decoding system, known in the prior art, for substantially restoring an image subjected to JPEG image compression;

[0038] FIG. 2 is block diagram of a system for generating a signature of an image in accordance with the present invention;

[0039] FIG. 3 is a flow chart illustrating a method of extracting invariant feature codes of an image from the relationship of DCT coefficients in corresponding positions in two separate image blocks;

[0040] FIG. 4 is a block diagram of an image authentication system, formed in accordance with the present invention; and

[0041] FIG. 5 is a flow chart illustrating a method of authenticating an image using invariant feature codes of the encoded image, in accordance with the present invention.

[0042] FIG. 2 is a block diagram of a system for generating a robust digital signature which employs invariant features of an image which survive lossy image compression and other allowable image transformations. A raw image X is first applied to an image analyzer 200 which performs image feature extraction, resulting in an extracted feature set Z. The image analyzer 200 identifies and extracts features of the image which remain unchanged after the performance of an allowable operation on an image, such as JPEG compression. Following the image analyzer 200 is an encryption processor 202 which applies known encryption methods, such as public key encryption, to the extracted feature set Z to form the resulting digital signature S of the image X.

[0043] To illustrate the principles of the present invention, the description herein focuses primarily in the context of JPEG compression. However, it will be understood that image authentication following other allowable image transformations, such as cropping, translation, intensity shifting and the like, is also within the scope of the present invention.

[0044] In broad terms, JPEG compression operates in two steps. First discrete cosine transform (DCT) coefficients are extracted and quantized. Second, the DCT coefficients are subjected to entropy encoding. The first process is a lossy operation wherein pixel values are altered. While the goal is to maintain the integrity of the image, some distortion is introduced by this step and certain features of the image are altered. The second operation, i.e., entropy encoding, is a lossless operation which efficiently represents the information without altering the contents of the information. Accordingly, in order to provide a set of robust invariant features, the image processor 200 extracts features of the image which are not altered by the first process of JPEG encoding.

[0045] Referring to FIG. 1A, the matrices of DCT coefficients F_pfrom the DCT processor 102 are applied to quantizer 104 and are operated on by a common quantization table 106. As a result, the relationship between DCT coefficients of the same coordinate position in two arbitrary blocks of the image will remain unchanged by the quantization process. However, because of rounding operations, the relationship of the two may remain unchanged or may become equal. These fundamental properties are expressed below as theorem 1:

[0046] Theorem 1 Assume F_pand F_qare DCT coefficient vectors of two arbitrarily 8×8 nonoverlapping blocks of an image X, and Q is the quantization table of JPEG lossy compressions. ∀νε[1, . . . , 64] and p, q ε[1, . . . ρ], where ρ is the total number of blocks. Define ΔF_p,q≡F_p−F_qand ΔFp,q≡{tilde over (F)}_p−{tilde over (F)}_pwhere {tilde over (F)}_pis defined as ${\tilde{F}}_p\left(v\right)\equiv \mathrm{Integer}\mathrm{Round}\left(\frac{F_p\left(v\right)}{Q\left(v\right)}\right)·Q\left(v\right).$

[0047] Then, the following properties are true:

[0048] if ΔF_p,q(ν)>0, then Δ{tilde over (F)}_p,q(ν)≧,0

[0049] else if ΔF_p,q(ν)<0, then Δ{tilde over (F)}_p,q(ν)≦0,

[0050] else ΔF_p,q(ν)=0, then Δ{tilde over (F)}_p,q(ν)=0.

[0051] Theorem 1 indicates that the sign relationship of corresponding features of two blocks in an image remains unchanged as a result of JPEG compression. However, theorem 1 does not address the relative magnitude of these features. In some practical cases, the quantization table Q is known or can be estimated in the authenticator. This is true in the case of JPEG compression where the JPEG compression file includes the quantization table used to compress the image. If a recompression process is not allowed, i, e., the image can not be compressed, decompressed and compressed again, this quantization table will be the only one that has been used during the compression process. Therefore, the DCT coefficients after compression will be limited in a specific range according to the following theorem:

[0052] Theorem 2 Using the parameters defined in Thorem 1, assume a fixed threshold k εR. ∀ν, define $\widetilde{k_v}\equiv \mathrm{Integer}\mathrm{Round}\left(\frac{k}{Q\left(v\right)}\right).$

[0053] Then,

[0054] if ΔF_p,q(ν)>k, $\begin{array}{cc}\Delta {\tilde{F}}_{p,q}\left(v\right)\ge \{\begin{array}{c}\widetilde{k_v}·Q\left(v\right),\frac{k}{Q\left(v\right)}\in Z,\\ \left(\widetilde{k_v}-1\right)·Q\left(v\right),\mathrm{elsewhere},\end{array}& \left(5\right)\end{array}$

[0055] else ΔF_p,q(ν)>k, $\begin{array}{cc}\Delta {\tilde{F}}_{p,q}\left(v\right)\le \{\begin{array}{c}\widetilde{k_v}·Q\left(v\right),\frac{k}{Q\left(v\right)}\in Z,\\ \left(\widetilde{k_v}+1\right)·Q\left(v\right),\mathrm{elsewhere},\end{array}& \left(6\right)\end{array}$

[0056] else ΔF_p,q(ν)=k, $\begin{array}{cc}\Delta {\tilde{F}}_{p,q}\left(v\right)\le \{\begin{array}{c}\widetilde{k_v}·Q\left(v\right),\frac{k}{Q\left(v\right)}\in Z\\ \left(\widetilde{k_v}\mathrm{or}\widetilde{k_v}\pm 1\right)·Q\left(v\right),\mathrm{elsewhere}\end{array}& \left(7\right)\end{array}$

[0057] In Theorem 2, k is a designated threshold value used to bound the difference of two DCT coefficients of the same position in two separate 8×8 blocks of an image. In contrast, Theorem 1 only describes the invariance property of the sign of ΔF_p,q. Therefore, Theorem 1 can be considered a special case of Theorem 2 (with k set to be 0). Several different k's (e.g., a series of binary division factors over a fixed dynamic range) can be used for a single authentication system of different levels of strength. Based on Theorem 2, we can read the quantization table Q from a bitstream and use Equations (5), (6) and (7) to predict the difference relationships those coefficients have after compression.

[0058] Employing the principles of Theorem 1 and 2, a signature generator, as illustrated in FIG. 2, operates in accordance with the method steps depicted in FIG. 3 to extract invariant features from an image and create a robust digital signature. Referring to FIG. 3, an image X is first partitioned into P blocks, corresponding to the blocks used for JPEG compression (step 300). Next, for each of the P blocks, the matrix of DCT coefficients is generated (step 302). The extraction of the invariant features is then performed using three iterative, nested loops beginning at steps 304, 308 and 310, respectively.

[0059] Step 304 is the start of the first (outermost) loop and defines the number of sets feature codes (N) which will be generated. Step 308 is the start of the second (intermediate) loop which operates as a block counter index. Step 310 is the start of the third (innermost) loop which is a coefficient counter which operates in accordance with the number of bits (b_n) which are allocated in each block.

[0060] For each iteration of the first loop, the threshold value k and the number of bits allocated (b_n) for feature extraction for each set, introduced in theorem 2, are varied to provide protection of the magnitude of coefficient difference in the DCT domain (step 306). During the first iteration of the first loop, k is assigned a value of 0, thereby protecting the sign relationship, ΔF_p,qin accordance with Theorem 1. In this first set, (b_n) should have a maximum value. From the second to the Nth iteration of the first loop, the magnitude of k is first assigned a value which is capable of binary division and is then divided in half for each increment of N. The first non-zero value of k can be estimated by evaluating this maximum range of ΔF(υ) and assigning the value 2·k to be equal to the highest power of two within the maximum range. For example, if the maximum range of ΔF(υ) was found to be equal to 160, then 2·k=128 and k=64 for n=2. K is then reduced in a binary fashion for subsequent iterations of n. This progressive binary reduction of k serves to protect the magnitude relationship of ΔF_p,qwith greater accuracy in each iteration.

[0061] While processing commences in the third loop, the magnitude of k remains constant, however, the polarity (sign) of k depends on the result of the test ΔF(υ)<k for the previous value of n. For example, if for n=1, the value of Z(υ) was 0, i.e., ΔF(υ)<k, then k would be assigned a negative value of the current magnitude. On the other hand, if Z(υ) was 1, then k is assigned a positive value at the current magnitude. This relationship can be described by the following closed form mathematical expression for k: $\begin{array}{cc}k=k_{n,p}\left(\upsilon \right)=\zeta \sum _{i=1}^{n-1}{\left(\frac{1}{2}\right)}^i{\left(-1\right)}^{Z_{t,p}\left(\upsilon \right)+1},n>1& \left(8\right)\end{array}$

[0062] where ζ is a constant which is a power of two and within the maximum range of ΔF(υ).

[0063] The third loop is where the actual feature extraction for the selected block pairs takes place. For a given threshold value, the difference of coefficients in corresponding locations in the selected block pairs is determined. The difference value is then compared against the current threshold value k (step 312). If the value of ΔF_p,q(ν) is less than the threshold value k, the corresponding bit z of the feature vector Z_n,p(ν) is assigned a value of zero (step 314). If the value of ΔF_p,q(ν) is greater than or equal to the threshold value, the corresponding bit z of the feature vector Z_n,p(ν) is assigned a value of one (step 314). The counter value for the third loop is then incremented and if v≦b_n(step 316), processing in the third loop is repeated from step 310. Once all b_niterations of the third loop have been performed for the current block pair, the block counter is incremented and tested (step 318). If there are still block pairs to process, the third loop is repeated with the new block pair. After all blocks have been processed for given values of k on b_n, the set counter n is incremented (step 320) and the process repeats from step 304. From the operation of FIG. 3, N sets of feature vectors Z_n,p(ν) are generated for each block pair of the image. After the feature vectors are generated in this fashion, they are encrypted (step 322) by the encryption processor 202 (FIG. 2) to generate the robust signature for the image.

[0064] FIG. 4 is a block diagram illustrating an embodiment of an authentication system formed in accordance with the present invention. The authentication system receives an image to be authenticated as either a raw image {circumflex over (X)} or a JPEG compressed bit stream {circumflex over (B)}. A raw image to be authenticated is applied to a DCT processor 402, which is equivalent to that used in the JPEG compression process, to extract the DCT coefficients of the image. A JPEG compressed bit stream to be authenticated is first applied to an entropy encoder 404 and then a dequantizer 406 to provide the DCT coefficients of the compressed image. The entropy encoder 404 and dequantizer 406 receive the Huffman table 408 and quantization table 410, respectively, from the compressed bit stream and function in an equivalent manner to the JPEG decoders which are known in the art.

[0065] The authentication system also receives the robust signature S which was generated for the image. The signature is applied to a decryption processor 410 which removes the encryption from the signature to extract the invariant feature vector Z for the original image. The DCT coefficients of the current image, which are extracted from either the raw image or a JPEG compressed bit stream, and the invariant feature vector Z from the original image are applied to an authentication comparator 412.

[0066] The authentication comparator 412 is a digital processor which preferably operates in accordance with the method depicted in the flow chart of FIG. 5. As with the previously discussed encoding process of FIG. 3, the authentication process of FIG. 5 operates in three nested processing loops. Step 502 is the start of the first (outermost) loop and defines the number of sets of feature codes (N) which will be used for authentication. In some cases, this number can be less than the number of loops used by the image analyzer to generate the sets of feature codes. In these cases, only a subset of the feature codes are evaluated to determine authenticity. Step 506 is the start of the second (intermediate) loop which operates as a block counter index. Step 508 is the start of the third (innermost) loop which is a coefficient counter defined by the number of bits (b_n) used form the current feature vector for the current value of n. The number of iterations in both the second and third loops correspond to the number of iterations performed in the corresponding loops performed by the image analyzer during the encoding process of FIG. 3.

[0067] Inside the third loop, the DCT coefficient relationships obtained from the original image, are compared to those of the image subjected to authentication.

[0068] From Theorem 2, we can define $\begin{array}{cc}\hat{k}=\{\begin{array}{c}\widetilde{k_v}·Q\left(v\right),\frac{k}{Q\left(v\right)}\mathrm{is}\mathrm{an}\mathrm{integer},\\ \left(\widetilde{k_v}+1\right)·Q\left(v\right),\frac{k}{Q\left(v\right)}\mathrm{is}\mathrm{an}\mathrm{integer}\mathrm{and}{Z}_n\left(v\right)=0,\\ \left(\widetilde{k_v}-1\right)·Q\left(v\right),\frac{k}{Q\left(v\right)}\mathrm{is}\mathrm{not}\mathrm{an}\mathrm{integer}\mathrm{and}{Z}_n\left(v\right)=1.\end{array}& \left(9\right)\end{array}$

[0069] (It should be noted that {circumflex over (k)} is a function of ν, p, and n)

[0070] Observe from FIG. 3(b), if Z_n(ν)=0, that is, ΔF_p,q(ν)<k, then ΔF_p,q(ν)−{circumflex over (k)}<0, must be satisfied. Therefore, if Δ{tilde over (F)}_p,q(ν)−{circumflex over (k)}>0, some parameters of block p or q have been modified. Similar results can be obtained in the case of ΔF_p,q(ν)≧k.

[0071] However, because integer rounding noise may be introduced if the image is converted back to integer pixel values during the decode-reencode process, if the compressor and the signature generator use different chromatic resolution decimation algorithms for color images, or if the JPEG compressor calculates non-so-precious DCT, a tolerance bound τ must be used in the detection function. In accordance with this observation, the comparing process is augmented by Proposition 1:

[0072] Proposition 1: Block p or q can be claimed aas being manipulated if

[0073] ΔF_p,q(ν)−{circumflex over (k)}>τ,  (10)

[0074] for the case of ΔF_p,q(ν)−k<0, (or equivalently Z_n(ν)=0); or if

[0075] ΔF_p,q(ν)−{circumflex over (k)}>−τ,

[0076] for the case of Δ_p,q(ν)−k≧0, (or equivalently Z_n(ν)=1.)

[0077] The above stated principles are implemented in FIG. 5 beginning with step 508. For each bit position in the selected image block pairs, the binary value of the corresponding bit of the invariant feature vector Z is tested (step 510). If the value of the corresponding feature bit Z_n,p(ν) is equal to zero, and the difference in bit values of the block pairs of the current image minus the current value of k is greater than a predetermined threshold value τ, then one of the blocks p,q of the current block pair has been manipulated (step 512). Similarly, if the value of the corresponding feature bit Z_n,p(ν) is equal to one (step 510), and the difference in bit values of the block pairs of the current image minus the current value of k is less than −τ, this condition also indicates that one of the blocks p,q of the current block pair has been manipulated (step 514). If the conditions in steps 512 and 514 are not true, i.e., the image block has not been manipulated, the method advances to step 518, which routes control back to step 508 if additional bit locations for the current block pair p,q require testing. Otherwise, the next block pair is selected and the third loop is performed again from the first bit position (step 520). After each block pair has been tested in this manner, the next set of invariant feature vectors are selected by incrementing the first loop (step 522), selecting the next values of k and b₂(step 504) and repeating the second and third processing loops as previously described.

[0078] The threshold variable τ is introduced to prevent false alarms from occurring as a result of noise introduced by the compression process as well as through round off errors that occur throughout the processing steps. The value of τ is determined based on the probability of a false alarm occurring in a given system. In practice, computer software and hardware calculate the DCT coefficients with finite precision. For some cases, not only the input and the output of DCT operations are integers, but also some of the intermediate values are integers as well. This adds rounding noises to the DCT coefficient values. Other noises are introduced from the integer rounding process of the quantized DCT values. In general, the integer value of rounding a real number is its nearest integer. However, some application software may drop small values in the high frequency positions. In other words, the rule of integer rounding may change at different DCT positions when using different software. Combining these considerations, Eq.(2) can be modified as follows: $\begin{array}{cc}\widetilde{f_p}\left(v\right)=\mathrm{Integer}\mathrm{Round}\left(\frac{F_p\left(v\right)+N_d}{Q\left(v\right)}\right)+N_r,& \left(11\right)\end{array}$

[0079] where N_dis the noise associated with the DCT operation and N_ris the noise of integer rounding. Both N_dand N_rare random variables. N_dusually depends on specific system implementations and the number of recompression processes. In most systems, as the rounding rules are consistent across and positions and the value of N_rcan be assumed to be zero.

[0080] The probability of a false alarm of a block pair, P_f, represents the probability that at least one DCT difference value in the block pair triggers the detector in Proposition 1, merely because of the effect of rounding noise. We can write P_fas $\begin{array}{cc}{P}_f=\sum _{n=1}^N\sum _{v=1}^b{\alpha }_{n,v}& \left(12\right)\end{array}$

[0081] where α_n,ν is the probability that a DCT difference value Δ{tilde over (F)}_p,q(ν) does not satisfy the constraint of Z_n(ν). That is, $\begin{array}{cc}{\alpha }_{n,v}=\{\begin{array}{c}P\left[\Delta {\tilde{F}}_{p,q}\left(v\right)-\hat{k}<-\tau \right],\mathrm{given}\Delta {\tilde{F}}_{p,q}\left(v\right)\ge k,\\ P\left[\Delta {\tilde{F}}_{p,q}\left(v\right)-\hat{k}>\tau \right],\mathrm{given}\Delta {\tilde{F}}_{p,q}\left(v\right)<k.\end{array}& \left(13\right)\end{array}$

[0082] Because of symmetry, these two probabilities will be the same. If the probability density function (pdf) of N_dis known, then the probability of a false alarm can be found as follows.

[0083] First, define a random variable $N_{d,p},s.t.,f_p+\frac{1}{2}+N_{d,p}\equiv \mathrm{Integer}\mathrm{Round}\frac{F_p\left(v\right)+N_{d,p}}{Q\left(v\right)}$

[0084] where $f_p=\frac{F_p\left(v\right)}{Q\left(v\right)}.$

[0085] The associated probability density function is $\begin{array}{cc}P\left[N_{d,p}^{\prime }=n_d\right]=P[\left(n_d+\lfloor f_p+\frac{1}{2}\rfloor -f_p+\frac{1}{2}\right)·Q\left(v\right)>N_{d,p}\ge \left(n_d+\lfloor f_p+\frac{1}{2}\rfloor -f_p-\frac{1}{2}\right)·Q\left(v\right)\rfloor & \left(14\right)\end{array}$

[0086] The probability density function of N′_d,qcan be obtained in a similar way. With some transformations, α_n,ν is stated as: $\begin{array}{cc}{\alpha }_{n,v}=P\left[N_{d,p}-N_{d,p}^{\prime }<{\hat{k}}^{\prime }-{\tau }^{\prime }-\lfloor f_p+\frac{1}{2}\rfloor +\lfloor f_p+\frac{1}{2}\rfloor \right].& \left(15\right)\end{array}$

[0087] where ${\hat{k}}^{\prime }=\frac{\hat{k}}{Q\left(v\right)}\mathrm{and}{\tau }^{\prime }=\frac{\tau }{Q\left(v\right)}.$

[0088] The symbol of └.┘ represents the ‘floor’ function.

[0089] From Eq. (12), Eq. (14), and Eq. (15), the user of the image authenticator can set a suitable tolerance value τ depending on the quantization table reconstructed from the bitstream, the estimated variances of noises, and the thresholds. However, in practical applications, the user must assume the pdf of N_ra priori. If the model assumption of N_ris not available, rules of thumbs can be used to set τ to zero for a JPEG bitstream which is directly compressed from an original gray-level image, or Q(ν) for color images and most other cases.

[0090] In the case where the image is manipulated by adjusting the intensity of all pixels in a given image block (i.e., lightening or darkening an image), the methods described above will not detect such a manipulation. Because the manipulation is performed on a uniform basis, the invariant properties of Theorems 1 and 2 are not violated. In order to detect such a manipulation, the mean value of DCT coefficients of the original image is compared to the mean value of the DCT coefficients of the present image (step 524). If these values are not substantially equal (i.e., within a reasonable tolerance bound of each other), the intensity of the image has been altered. If this form of manipulation is not permitted, a suitable authentication error can be generated.

[0091] A 16×8 image segment (i.e., two 8×8 blocks) is presented to illustrate operation of the present image authenticator. The pixel values of this small image are shown below in Table 1. This image is divided into two 8×8 blocks in the JPEG compression process. Therefore, ρ=2. The DCT coefficients of these two blocks are shown in Table 2. For simplicity, only integer values of them are shown in the table.

[0092] First, the case of N=1 is considered, i.e., only one set which contains the threshold value k=0 is used for feature code generation. Assume the first 10 coefficients (b₁=10) of the two DCT coefficients blocks are compared to generate the feature codes. The length of the features codes, Z, will then be 10 bits. From Table 2, F₁(0,0)=486 and F₂(0,0)=727. This position (0,0) is the first value in the zig-zag order. The two-dimensional representation of F₁(0,0) and F₂(0,0) is transformed to a one-dimensional representation where F₁(1) and F₂(1) and ΔF_1,2(1)=−241<0 is obtained. Therefore, the first bit of the feature codes, Z, is 0. The second coefficients in the zig-zag order are: F₁(2)=91 and F₂(2)=−188, respectively. Since ΔF_1,2(2)=279>0, the second bit of the feature codes is 1. This procedure goes on until ν=10.

[0093] The resulting feature codes, Z, are: 0111100110.

[0094] For an example of a case using longer feature codes, the loop counter can be set at N=4, with values of b_nof b₁=10, b₂=6, b₃=3 and b₄=1. The reason for a decreasing number of b_nis two fold. First, the case of k=0 is the most robust test for authenticity and is therefore weighted with the most number of bits. Second, the lower frequency coefficients need more protection than the higher frequency ones. Following the procedure just described for N=1, the first 10 bits of Z are the same as the previous case. The sign of the threshold values, k's, in the second set of Loop 1 depend on the Z₁codes in the first set. In the first comparison of the second set, k is set to be a negative value, such as −128, because it is known that ΔF_1,2(1)<0 in the calculation of the first set. Since ΔF_1,2(1)=−240.875<−128, the 11th bit of Z is 0. Similarly, in the second comparison, since ΔF_1,2(2)>0 in the first set, the threshold k is assigned a positive value. This assignment of the polarity of k takes place in accordance with equation (8). Therefore, ΔF_1,2(2)=279>128 and the 12th bit of Z is 1. A similar procedure continues until n=4. The resulting feature codes Z are: 01111001100100010110. The length of Z is equal to Σ_n=1⁴b_n=20. Preferably, the feature codes Z obtained are then encrypted by a private key. For the sake of simplicity, the encrypted signature is not shown in this example.

[0095] If the image in Table 1 is compressed by a JPEG compression process with a quantization table Q having a constant matrix with all its values equal to 16, the resulting values of {tilde over (F)}₁and {tilde over (F)}₂are shown in Table 3. The values are entropy encoded and compose a JPEG bitstream {tilde over (B)} which is sent to the authenticator. In the authenticator, {tilde over (F)}₁={tilde over (F)}₁and {tilde over (F)}₂={tilde over (F)}₂. According to the process in FIG. 5, Δ{tilde over (F)}_1,2is compared to the feature codes Z. For instance, since Δ{tilde over (F)}_1,2(1)=−240<0 and Z₁(1)=0, this value is authenticated to be true. If {circumflex over (N)}=4, the comparison of the magnitude of the coefficient difference is performed over four passes through the process. For the case of {circumflex over (N)}=1, only the sign of the coefficients is compared. However, in both situations, all values are authenticated a true in the previous example.

[0096] The following example illustrates where manipulation of the image has taken place. Assume the gray level values illustrated in table 1 of X(0,2) and X(0,3) are modified from 72 and 26 to 172 and 126, respectively. After manipulation, this image is also compressed by JPEG with the same quantization table used as in the previous case. The difference of the DCT coefficients from the compressed bitstream are shown in Table 4. When the compressed bitstream is then sent into the authenticator, the authenticator will indicate the manipulation because the mismatch of the 4th bit of the feature codes Z, 1, and the 4th zig-zag coefficient ΔF_1,2(4)=−16<0 in Table 4. The manipulation can be indicated by a text message on a display unit (not shown), by highlighting the manipulated blocks of the image on the display on by other suitable methods of annunciating an alarm condition.

[0097] The above description is merely illustrative of prepared embodiments and principle involved in the invention. Other modifications of the invention will be obvious to those skilled in the art, and it is intended that the scope of the invention be limited only as set forth in the appended claims.