Watermarking: a step closer to secure health data

In the near future, watermarking data could be the best traceability technique in the healthcare domain. It involves hidding information into medical images with the aim at reinforcing data security for patients and healthcare professionals. After being developed for nearly ten years in the laboratories of IMT Atlantique and Medecom, watermarking has now reached a level of maturity that allows its integration into professional products. Yet it still must be approved by standardization bodies.

Are you sure that is really your body on the latest X-ray from your medical exam? The question may seem absurd, yet it is crucial that you, your doctor and the radiologist can all answer this question with a resounding “yes”. To ensure this level of certainty, healthcare professionals must rely on the latest technological advances. This is a matter of ensuring the right patient gets the right diagnosis—no one wants an X-ray of their lungs to be switched with one from a chain-smoker!

To ensure an X-ray is correctly associated with the patient and to return a lost X-ray to its rightful owner, the name printed on the X-ray film is not sufficient. An ill-intentioned individual or an administrative error could cause the unfortunate exchange of two patients’ images. Medecom and researchers from IMT Atlantique, part of the Télécom & Société Numérique Carnot Institute, have been working on a more secure system based on the watermarking. For over ten years the two entities have been collaborating on this technology and four years ago they inaugurated SePEMeD, a joint laboratory focused on this area, with support from the French National Agency for Research (ANR).  Since then, the maturity and viability of the watermark technology have become increasingly convincing.

A Secret Message

“The watermark draws on the principle of steganography, the art of hidden writing, which is almost as old as cryptography,” explains Gouenou Coatrieux, a researcher in imagery and information processing at IMT Atlantique. “In the case of X-rays, we change some pixels in the image to hide a message and leave an invisible mark,” he continues (see box below). The value of the watermark is that the protection is independent from the storage format. The X-ray can therefore be exchanged between departments and hospitals, each with its own unique system for processing X-ray images, yet this will not affect the watermark, which will continue to contain the information related to the patient.

[box type=”info” align=”” class=”” width=””]

The watermark: a message hidden in the pixels

The secret to watermarking X-rays is in the pixels, which can be encoded in 8, 16 or 32 bits. If a pixel is encoded in 8 bits, this means its color is indicated by a series of 8 bits—a bit is a 0 or 1 in the binary code. There are 256 possible 8-bit combinations: 00000000, 00000001, etc. There are therefore 256 possible colors for a pixel encoded in 8 bits, or 256 different shades of gray for a pixel in a black and white image.

Watermarking an image involves modifying certain pixels by changing one of their bits. This means the color, or shade of gray, is altered. To prevent this from being noticeable on the X-ray, the bit containing the least amount of information—the one located at the end of the 8-bit sequence—is modified. The colors related to bits 00110101 and 00110100 are very similar, whereas those related to bits 00000000 and 10110110 are very different. The more two series of bits are dissimilar, the less similar the colors.

The changed bits in the pixels form a message, which could be a patient’s name or the doctors’ authorization to access the X-ray. To discover which bits bear this message, the X-ray recipient must have the watermark key associated with the medical image. This ensures the secrecy of the message.[/box]

In addition to traceability, watermarking has other advantages. First, it can help detect insurance fraud. If an X-ray is tampered with by an ill-intentioned individual, for example to fake a disease, the secretly watermarked pixels will also be modified, revealing the attempted fraud. Next, the watermark can be added to data that is already encrypted using a method that has been patented by Medecom and IMT Atlantique. It is therefore possible to ensure traceability while maintaining the confidentiality of medical information the image contains. This also makes it possible to write information about certain doctors’ access authorizations directly on the encrypted data.

Moving towards standardization?

While this watermark technology is now mature, it still must pass the test of standardization procedures in order to be implemented in software and the information systems of healthcare professionals. “Our goal now is to show that altering the image with the watermark does not have any effect on the quality of the image and the doctors’ diagnostic capacity,” says Michel Cozic, R&D director at Medecom. The SePEMeD team is therefore working to conduct qualitative studies on watermarked data with physicians.

At the same time, they must convince certain healthcare professionals of the value of watermarking.  The protection of personal data, and medical data in particular, is not always viewed the same way throughout the healthcare world. “In the hospital environment, professionals tend to believe that the environment is necessarily secure, which is not always the case,” Michel Cozic explains. In France, and in Europe in general, attitudes about data security are changing. The new General Data Protection Regulation (GDPR) established by the European Commission is proof of this. However, it will be some time before the entire medical community systematically takes data protection into account.

Ten years of research… and ten more to come?

Since there is still a long way to go before healthcare professionals begin using watermarks, the SePEMeD story is not over yet. Founded in 2014 to solidify the collaboration between IMT Atlantique and Medecom, which has lasted over ten years, SePEMeD was originally intended to run only three years. However, following the success of the research which led to promising applications, this first joint laboratory accredited by the ANR on data security will continue its work until at least 2020. Beyond data traceability, SePEMeD is also seeking to improve the security of remotely processed encrypted images in cloud storage.

“We update our focus areas based on our results,” Gouenou Coatrieux notes, explaining why the SePEMeD laboratory has been extended. Michel Cozic agrees: “We are currently focusing our research on issues related to browsers’ access to data, and the integration of watermarking modules in existing products used by professionals.” The compatibility of algorithms with healthcare institutions’ computer configurations and systems will be a major issue involved in the adoption of this technology. Last but not least: ease of use.  “No one wants to have to enter passwords in the software,” observes Medecom’s R&D Director. We must therefore succeed in integrating watermarking as a security solution that is straightforward for doctors.

[divider style=”normal” top=”20″ bottom=”20″]

The benefit of collaborating with IMT Atlantique: “The human aspect”

Michel Cozic

One of Télécom & Société Numérique Carnot Institute’s objectives is to professionalize the relationships between companies and researchers.  Michel Cozic, Medecom’s R&D Director shares his experience: “There is also a human aspect to these collaborations. Our exchanges with IMT Atlantique go very smoothly, we understand each other. On both sides we accept our differences, constraints and we compromise. We come from two different environments and this means we must have discussions. There must be an atmosphere of trust, a good relationship and a common understanding of the objectives. This is what we have been able to accomplish through the SePEMeD laboratory.”

[divider style=”normal” top=”20″ bottom=”20″]

[box type=”shadow” align=”” class=”” width=””]

The TSN Carnot institute, a guarantee of excellence in partnership-based research since 2006

Having first received the Carnot label in 2006, the Télécom & Société numérique Carnot institute is the first national “Information and Communication Science and Technology” Carnot institute. Home to over 2,000 researchers, it is focused on the technical, economic and social implications of the digital transition. In 2016, the Carnot label was renewed for the second consecutive time, demonstrating the quality of the innovations produced through the collaborations between researchers and companies.

The institute encompasses Télécom ParisTech, IMT Atlantique, Télécom SudParis, Télécom École de Management, Eurecom, Télécom Physique Strasbourg and Télécom Saint-Étienne, École Polytechnique (Lix and CMAP laboratories), Strate École de Design and Femto Engineering.

[/box]