PaperlayerView exact revision on arXiv

Source-linked AI summary

DeepEDN: A Deep Learning-based Image Encryption and Decryption Network for Internet of Medical Things

Yi Ding, Guozheng Wu, Dajiang Chen, Ning Zhang, Linpeng Gong, Mingsheng Cao, Zhiguang Qin

arXiv:2004.05523v2cs.CRcs.CVeess.IV

TL;DR

Protecting patient images in IoMT requires encryption that preserves security and efficiency while supporting clinical use. The paper proposes DLEDNet, which uses Cycle-GAN translation and reconstruction for encryption and decryption, plus ROI mining directly on ciphertext. Experiments on chest X-rays report high security and efficiency, including resistance to several attacks.

  • Problem

    Medical images contain sensitive patient information, while existing methods struggle to balance security performance and encryption efficiency.

  • Method

    DLEDNet uses Cycle-GAN to translate medical images into a hidden-factor target domain, reconstructs plaintext images, and mines ROIs directly from ciphertext.

  • Results

    Experiments report high security and efficiency, including resistance to attacks and failure of decryption when only about 5% of key parameters are modified.

  • Takeaways & Limitations

    DLEDNet supports encryption, decryption, and privacy-protected ROI extraction within the encrypted-image environment.

Abstract

from arXiv · show

Internet of Medical Things (IoMT) can connect many medical imaging equipments to the medical information network to facilitate the process of diagnosing and treating for doctors. As medical image contains sensitive information, it is of importance yet very challenging to safeguard the privacy or security of the patient. In this work, a deep learning based encryption and decryption network (DeepEDN) is proposed to fulfill the process of encrypting and decrypting the medical image. Specifically, in DeepEDN, the Cycle-Generative Adversarial Network (Cycle-GAN) is employed as the main learning network to transfer the medical image from its original domain into the target domain. Target domain is regarded as a "Hidden Factors" to guide the learning model for realizing the encryption. The encrypted image is restored to the original (plaintext) image through a reconstruction network to achieve an image decryption. In order to facilitate the data mining directly from the privacy-protected environment, a region of interest(ROI)-mining-network is proposed to extract the interested object from the encrypted image. The proposed DeepEDN is evaluated on the chest X-ray dataset. Extensive experimental results and security analysis show that the proposed method can achieve a high level of security with a good performance in efficiency.

I. INTRODUCTION

IoMT connects medical imaging systems to clinical information networks, but protecting sensitive patient images remains difficult. DLEDNet applies deep learning to encrypt and decrypt medical images while supporting ROI extraction directly from ciphertext.

  • Motivation: IoMT connects medical imaging equipment with PACS and HIS systems to support doctors’ diagnosis and treatment workflows.Medical images are stored in PACS and retrieved to doctors’ workstations alongside patient information from HIS.
  • Motivation: Existing encryption methods struggle to balance security performance and encryption efficiency for medical images.The paper discusses DES, AES, hash functions, and chaotic systems as prior approaches with this limitation.
  • Proposed method: DLEDNet uses Cycle-GAN image-to-image translation, treating a target domain as hidden factors that guide medical-image encryption.A reconstruction network restores the encrypted image to the original plaintext image.
  • Proposed method: The ROI-mining-network extracts an interested segmentation region directly from encrypted medical images without first decrypting them.This supports data mining in a privacy-protected environment and can avoid revealing other patient information.
  • Evaluation: Experiments on chest X-ray data report high security and efficiency, with resistance to various attacks including known key-generation processes.The paper presents this comparison against existing medical image encryption methods.

A. Medical Image Encryption

Prior medical-image encryption methods include mathematical, AES-, Blowfish-, hiding-, chaotic-, and GAN-based approaches. The paper motivates DLEDNet as a deep-learning method intended to address security–efficiency limitations in existing approaches.

  • A. Medical Image Encryption: Prior work applies cosine number transforms, AES, Blowfish, and LSB hiding to encrypt or conceal medical images.These methods target properties including exact recovery, reduced processing time, speed, or image hiding.
  • A. Medical Image Encryption: Chaotic-map methods use pseudorandom, ergodic, and initial-value-sensitive sequences as security keys for medical-image encryption.One described approach scrambles pixel locations and disturbs pixel values using a four-dimensional chaotic system.
  • B. Image-to-Image Transfer by Generative Adversarial Networks: GAN-based image translation learns mappings between image domains using adversarial training, with CycleGAN supporting unpaired image translation.The adversarial loss encourages translated images to resemble the target domain.
  • B. Image-to-Image Transfer by Generative Adversarial Networks: Existing algorithms have difficulty balancing security and efficiency, while one-dimensional chaotic systems may be vulnerable to nonlinear prediction.The paper identifies these limitations as motivation for using deep learning in medical-image encryption.
  • B. Image-to-Image Transfer by Generative Adversarial Networks: DLEDNet treats deep-learning network parameters as encryption and decryption keys to target high security with high efficiency.The paper attributes this intended performance to the model’s large key space and complex structure.

1) Encryption Network and Decryption Network:

DLEDNet combines an encryption generator, a discriminator, and a decryption network in an adversarial image-translation framework. The generator targets a ciphertext domain while reconstruction preserves recoverability of the original image.

  • 1) Encryption Network and Decryption Network: The mapping G: X →Y transforms original medical images into a target ciphertext domain, while F maps encrypted images back toward the original domain.The discriminator evaluates whether generated images resemble real images from domain Y.
  • 1) Encryption Network and Decryption Network: The reconstruction loss enforces the cycle x →G(x) →F(G(x)) ≈x so decrypted images retain information from the original image.The loss measures the difference between the reconstructed output and the original image.
  • 1) Encryption Network and Decryption Network: The discriminator architecture uses convolutional blocks to reduce image resolution and encode local features for discrimination.A feature-construction block and a 3×3 convolutional layer produce the final result.
  • 1) Encryption Network and Decryption Network: Adversarial training makes G generate images similar to target-domain ciphertext while D learns to distinguish generated and real ciphertext images.At equilibrium, D has 50% classification accuracy for generated and real ciphertext-domain images.

3) The key generation process:

DLEDNet generates encryption and decryption keys from trained network parameters. Alternating adversarial and reconstruction training refines these parameters, while GAN instability is used as a cryptographic property.

  • 3) The key generation process: All convolutional-layer parameters of G form the encryption privacy key, while parameters of F form the decryption privacy key.The keys are obtained after training the corresponding networks.
  • 3) The key generation process: The encryption key is updated through forward propagation using adversarial loss against the target hidden factors.Back-propagation and gradient descent further update layer parameters during training.
  • 3) The key generation process: The decryption key is generated similarly, but its input is the encryption network’s predicted result and its loss is reconstruction loss.G and F are trained alternately until the loss becomes stable.
  • 3) The key generation process: After key generation, G encrypts the patient’s medical image and F decrypts it back to the original image.The trained networks serve as the operational encryption and decryption algorithm.
  • 3) The key generation process: Different training runs can produce different network parameters, allowing the method to be regarded as an one-Time Pad method.The paper identifies GAN instability as a weakness for vision tasks but an advantage for cryptography.

B. ROI Mining Network in Ciphertext Environments

The ROI-mining-network extracts regions of interest directly from encrypted medical images, enabling segmentation without prior decryption. It uses a deeper ResNet-50-based structure and pixel-level supervision to learn semantic features in the ciphertext environment.

  • The ROI-mining-network addresses the challenge of extracting useful information, such as a desired ROI, directly from ciphertext medical images.
  • The network uses ResNet-50 as its backbone and adopts a deeper structure to learn semantic features for accurate target segmentation.
  • Encrypted images pass through five blocks with down-sampling convolutions, progressing from local information to increasingly abstract semantic features.
  • Training uses encrypted images as inputs and corresponding pixel-level segmentation labels as supervision.
  • The final model produces high-quality segmentation of medical images without decryption, supporting secure extraction of clinically relevant objects in untrusted environments.

C. Adversary Model

The adversary model considers attacks based on leakage of hidden factors, network architecture, or both. These scenarios test whether attackers can train alternative networks that decrypt ciphertext images.

  • Imitation learning attacks exploit leaked model structure or hidden factors to train a similar encryption or decryption network.
  • The strongest scenario assumes that both the network architecture and hidden factors are leaked to the attacker.
  • Under hidden-factors leakage, the attacker knows the encryption factors and trains networks with different architectures to attempt decryption.
  • Under network-architecture leakage, the attacker knows the network structure but not the hidden factors and trains that structure with alternative factors.

3) Both Hidden Factors and Network Architecture Leakage:

The method treats trained network parameters as private keys and evaluates security against simultaneous leakage of architecture and hidden factors. Repeated training produces distinct keys and different ciphertexts for the same image.

  • 3) Both Hidden Factors and Network Architecture Leakage:: The strongest adversary model assumes that both the network architecture and hidden factors are leaked, requiring substantially different parameters after each training.
  • 3) Both Hidden Factors and Network Architecture Leakage:: The encryption and decryption networks each contain 24 layers and 2,757,936 parameters, while the ROI-mining-network uses ResNet-50.
  • 1) Key Space Analysis:: The encryption key space is defined by 2,757,936 floating-point parameters, with each parameter represented using 32 bits and approximately 10 significant decimal digits.
  • 1) Key Space Analysis:: The security analysis evaluates the encryption/decryption network structure and the ROI-mining-network structure in separate tables.
  • 2) Key Randomness Analysis:: Four independently trained networks provide Keys A–D, and encrypting the same image with them produces different encrypted images.

3) Key Sensitivity Analysis:

Key sensitivity analysis examines error propagation and statistical properties of encrypted images. Small parameter changes prevent correct decryption, while the encrypted images’ entropy approaches the ideal value for random grayscale distributions.

  • 3) Key Sensitivity Analysis:: Errors propagate through convolutional layers and increase exponentially during up-sampling, amplifying the effect of parameter changes.
  • 3) Key Sensitivity Analysis:: Changing about 5% of key parameters prevents the network from correctly decrypting the ciphertext image.
  • 3) Key Sensitivity Analysis:: The key space is described as (10^10)^2757936, making recovery of at least 95% of the correct parameters difficult for attackers.
  • 3) Key Sensitivity Analysis:: Encrypted and original images have very different pixel distributions, indicating substantial transformation of grayscale statistics.
  • 2) Entropy Analysis:: The encrypted image’s information entropy is close to the ideal value of 8, and experiments report resistance to statistical attacks.

C. Security Analysis under Different Adversary Models

The security analysis tests whether leaked hidden factors, network architectures, or trained parameters enable decryption. Across these adversary settings, unauthorized networks fail to recover the ciphertext correctly.

  • Security analysis: Three adversary models evaluate whether attackers can generate decryption keys under different leakage assumptions.The experiments cover network-structure variation, hidden-factor variation, and repeated training under identical conditions.
  • Network architecture leakage: Only the decryption network paired with network A correctly restores an image encrypted by network A.Networks B, C, and D produce visually unrecognizable results, even when attackers know the hidden factors.
  • Hidden factors leakage: Different hidden factors prevent mutual decryption even when encryption networks share the same architecture.A network trained with Hidden Factors B cannot decrypt ciphertext generated using Hidden Factors A.
  • Combined leakage: Repeated training under identical architecture, hidden factors, and conditions produces different parameters that cannot decrypt one another’s ciphertext.The resulting secure keys differ across networks A, B, C, and D.
  • Ciphertext-only attack: A ciphertext-only attacker faces a key space of (10^10)^2757936 and complex privacy keys generated through iterations and diffusions.The paper therefore reports ciphertext-only cracking as difficult.

1) Ciphertext Only Attack:

The proposed encryption and decryption networks are evaluated against chosen-plaintext and chosen-ciphertext attacks using pixel-change diffusion measurements. Small one-percent input changes produce large output changes.

  • Attack models: Chosen-plaintext attacks give attackers selected plaintexts and corresponding ciphertexts, whereas chosen-ciphertext attacks give attackers selected ciphertexts and corresponding plaintexts.These attack models define the information available to the adversary.
  • Chosen plaintext attack: NPCR measures the ratio of pixels differing at corresponding positions between two ciphertext images.The metric is used to quantify image changes after slight plaintext or ciphertext perturbations.
  • Chosen plaintext attack: 94.21% average NPCR follows a one-percent plaintext pixel change, indicating strong diffusion and plaintext sensitivity.The paper links this result to resistance against chosen-plaintext differential attacks.
  • Chosen ciphertext attack: 94.87% average NPCR follows a one-percent ciphertext pixel change, indicating strong diffusion and ciphertext sensitivity.The experiment uses the decryption network and is reported as effective against chosen-ciphertext attacks.

V. EXPERIMENT

Experiments assess encryption, decryption, and direct ROI mining from protected medical images. The method obscures pathology information while reconstructing image detail and extracting regions of interest without prior decryption.

  • Performance of Encryption and Decryption: The encryption output is visually different from the original, while the decryption network restores detailed information from the ciphertext.The visual comparison presents original, encrypted, and decrypted medical images.
  • Performance of Encryption and Decryption: PSNR and SSIM are used to evaluate decryption effectiveness and encryption-decryption image similarity.SSIM compares brightness, contrast, and structure, with values closer to 1 indicating greater resemblance.
  • Performance of Encryption and Decryption: The reconstructed image is compared with a one-half compressed image to assess whether reconstruction affects diagnostic performance.The comparison is motivated by medical-image compression practices intended to reduce storage without affecting diagnosis.
  • Performance of ROI-Mining-Network: The ROI-mining-network segments a patient’s interested organ tissue directly from ciphertext without first decrypting the image.This supports data mining in a privacy-protected environment.
  • Performance of ROI-Mining-Network: 0.967 DICE is reported for the segmentation network trained on plaintext images.The ciphertext-trained network is evaluated under the same training conditions for comparison.
  • Performance of ROI-Mining-Network: The correct ROI extraction matches the ground truth, whereas an attacker’s extraction is erroneous.The attack experiment compares the original image, ciphertext, ground truth, correct extraction, and attacker result.

C. Efficiency

The proposed method is evaluated for encryption and decryption speed across medical-image resolutions and against five chaotic encryption algorithms. It achieves the fastest reported speed while meeting stated clinical-efficiency requirements.

  • 14.28 medical images per second are encrypted or decrypted at 256*256 resolution, versus 3.65 images/second at 512*512 resolution.These speeds are stated to basically meet efficiency requirements in clinical practice.
  • The proposed method achieves the fastest encryption speed on both 512×512 and 256×256 resolution images compared with five chaotic encryption algorithms.FPS denotes the number of images encrypted or decrypted in one second.
  • The method remains more efficient despite using more keys than the chaotic encryption methods.The comparison passage attributes this to shorter processing time.
  • Experiments on chest X-ray datasets report higher encryption/decryption efficiency than other state-of-the-art medical image encryption methods.
Loading 2004.05523v2…