# Tamper and Clone-Resistant Authentication Scheme for Medical Image Systems
## 5 Watermarking Analysis and Security Evaluation
### Security Analysis of the Proposed Protocols
#### 5.1.3 Tampering Attacks  
In this proposed scheme, tampering attacks refer to an adversary who tries to make changes to the original medical image [38] and then produces a valid signed watermark \(Z\).  
For instance, in the proposed protocol 1, a successful tampering attack is equivalent to the successful prediction of \(x_{A_{i}}\) for a specific \(WM_{1}\) in \(E_{x_{A_{i}}}(WM_{1})=Z\). In this case, the adversary can produce a valid signed watermark \(Z^{\prime}\) for a tampered WM by using the predicted \(x_{A_{i}}\). The following theorem shows that the adversary has a negligible advantage to recover \(x_{A_{i}}\). However, the definition of pseudorandom functions (PRFs) is required for the proof of the theorem. In [39], [PERSON] et al. presented the concept of PRFs as follows:  
**Definition 1**.: _PRF is a family of functions \(F\) with the following properties:_  
* _Every function_ \(F_{K}\in\Gamma\) _can be uniquely identified by a specific key_ \(K\)_._
* _Every probabilistic polynomial time (p.p.t.) adversary has a negligible advantage to distinguish between the output of_ \(F_{K}(.)\) _and a random value._  
**Theorem 1**.: _The success probability of tampering attack a WM generated by device \(A\) with an embedded SUC is negligible for every adversary._  
Proof.: For the proposed protocol.1, an adversary \(\Psi\) interacts with a challenger. The challenger performs the following security experiment (Game) that acts as follows:  
* The challenger arbitrarily selects one bit \(b\ \stackrel{{ U}}{{\leftarrow}}\ \{0,1\}\).
* The challenger returns \(P\ \stackrel{{ U}}{{\leftarrow}}\ \{0,1\}^{n}\), if \(b=1\) to \(\Psi\); otherwise, it returns \(P\ \leftarrow\ E_{x_{Ai}}(.)\), within time \(t\).  
The adversary \(\Psi\) then sends a limited number (polynomial number) of queries (\(q\)) to the challenger such as \(y_{A_{i}}\), where \(i=1,\cdots,\ q\). Then, the adversary returns \(b\
u\). Thus, the advantage of \(\Psi\) to distinguish the output of \(E_{x_{Ai}}(.)\) from a random value is defined as:  
\[adv_{PRF}^{E}(\Psi)=\left|\Pr[b=b\
u]=1\right| \tag{10}\]  
Here, \(\Psi\) is a probabilistic polynomial time algorithm, i.e., p.p.t. adversary.  
Now, assume by contradiction that there is an adversary \(\Psi\) who can predict \(x_{A_{i}}\), for every \(i>0\), with non-negligible probability in the protocol.1 and then the adversary \(\Psi\) can tamper the original image generated by medical device \(A\). According to this assumption, the adversary \(\Psi\) sends \(y_{A_{i}}\) to medical device \(A\) and collects the corresponding \(E_{x_{A_{i}}}(WM_{1})\) for \(i=0,1,\cdots,\ q\) as \(\Psi\) has full access to steps 3, 6, and 7 in protocol 1. After that, the adversary recovers \(x_{A_{i}}\) with non-negligible probability. This means that the adversary \(\Psi\) has a non-negligible advantage to distinguish between the output of \(E_{x_{Ai}}(.)\) and a random value. Apparently, this contradicts the indistinguishability and the pseudo randomness of the chosen standard cipher \(E\). Therefore, the adversary has a negligible advantage to recover \(x_{A_{i}}\) as:  
\[adv_{PRF}^{E}(\Psi)\ \leq\ 2^{-n} \tag{11}\]  
where \(2^{n}\) is the number of the all possible \(x_{A_{i}}\). \(\Box\)  
It turns out that the adversary cannot tamper a medical image generated by a device with an embedded SUC. Therefore, the SUC provides a MIS with a security bound of \(O(2^{n})\).