# Medical Image Encryption Based on 2D Zigzag Confusion and Dynamic Diffusion

Authors: Shanshan Li; Li Zhao; Na Yang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

For the security of medical image, a new algorithm of medical image encryption is designed. The novel algorithm is based on a chaotic system composed of the two-dimensional Sine Logistic modulation map (2D-SLMM) and the two-dimensional Hénon-Sine map (2D-HSM). The main encryption procedure includes zigzag scan scramble, pixel grey value transformation, and dynamic diffusion. On the pixel grey value transformation stage, a password feedback is added. This makes the relationship between password and key more complicated. The proposed scheme is lossless for medical image encryption and decryption. It avoids the problems of low-dimensional chaotic map such as narrow interval and few parameters, as well as the problem of the special texture and contour of medical images. The key space of the novel algorithm is big enough, and the encryption and decryption processing are sensitive to the key. Simulation and experiments validate the effectiveness and efficiency of the novel algorithm. Security analysis proves the algorithm is resistant to common attacks.


---

## Body

## 1. Introduction

Medical images contain important personal privacy information of patients. To protect the confidential content, medical images are usually encrypted. The conventional encryption methods, such as Advanced Encryption Standard (AES) [1], Data Encryption Standard (DES) [2, 3], International Data Encryption Algorithm (IDEA), and Triple-DES [4], are usually employed to protect the text data. Medical image data have uneven distribution of image pixels, obvious regional features, and high resolution. Traditional encryption methods are not suitable for protecting Digital Imaging and Communications in Medicine (DICOM) images due to the lack of efficiency for bulk data [5]. Chaotic maps have been widely used in several medical image cryptosystems because of the prominent characters, such as tremendous high ergodicity, unpredictability, and sensitivity to initial values [6, 7]. Tremendous chaotic encryption algorithms and various improved methods have been proposed [8–10]. DNA-based coding has also been adopted for image encryption [11]. DNA-based coding had been proved to be inadequate to withstand chosen-cipher attacks and known-plaintext analysis. The main drawback of chaotic systems was their limited accuracy in digital computers. Kumar et al. [12] proposed a new encryption scheme for medical data. It applied the fractional discrete cosine transform (FrDCT) on the image and performed chaotic mapping on the FrDCT coefficients. Ye et al. [13] proposed a new meaningful image encryption algorithm based on compressive sensing and information hiding technology, which reduced the possibility of attack by hiding the presence of a common image. Researchers combined various classical algorithms in chaotic systems. Ye et al. [14] proposed an asymmetric image encryption algorithm based on the RSA cryptosystem and fractional chaotic system. Different keys for encryption and decryption were designed under an asymmetric architecture. The RSA algorithm and fractional chaotic system were combined to encrypt images. The chaotic system was combined with phase-truncated short-time fractional Fourier transform (PTSTFrFT), two-dimensional linear canonical transform (2D LCT), and quaternion discrete fractional Hartley transform (QDFrHT) [15–17].The existing medical image encryption methods hardly achieved a balance between security and efficiency. The reason is that most of the algorithm did not consider the medical image texture characteristics. Medical image encryption with hyperchaotic systems and high-dimensional chaotic systems were secure enough while introducing more complexity. This paper proposed a medical image encryption based on 2D zigzag confusion and dynamic diffusion. The chaotic system used in the novel encryption scheme is composed of two-dimensional chaotic map. Compared with high-dimensional chaotic systems, its structure is relatively simple, and the time complexity is reduced. Compared with the low-dimensional chaotic map, its structure is more complex, so it is more difficult to predict and analyse. These characters of the system balance security and effectiveness of the proposed method. The algorithm could be used to encrypt grayscale images of any size. And it is easy to be implemented for colorful images when they are represented by different color channels.The rest of this article is organized as follows. Section2 will introduce the related concepts applied in the proposed algorithm and analyse the contribution of the proposed algorithm. In Section 3, we will introduce the encryption process and decryption process of the scheme in detail. Section 4 will provide simulation results and safety analysis, and Section 5 will present conclusions.


## 2. Related Concepts

In this section, we introduce the two-dimensional zigzag confusion, random selection chaotic system, and improved cat map involved in the proposed scheme.


### 2.1. Two-Dimensional Zigzag Confusion

The 2D zigzag scan [18, 19] was used to scramble the pixel positions of the medical image to destroy the high correlation between adjacent pixels. The operation started from the first pixel of the medical image matrix, the subsequent pixels were traversed in 2D zigzag mode [20], and the traversing process stretched the two-dimensional matrix into a one-dimensional sequence; the specific process is shown in Figure 1. For example, for a matrix of size5×5, the starting position is 1,1, and the scrambling matrix starts at element 45. The original matrix and one-dimensional sequence after 2D zigzag scan are shown in Figure 2.Figure 1
The zigzag path.Figure 2
Zigzag confusion result with the starting position1,1.


### 2.2. Chaotic System

This paper chooses two two-dimensional chaotic maps to form a random selection system for image pixel grey value disturbance and diffusion: 2D Sine Logistic modulation map (2D-SLMM) and 2D Hénon-Sine map (2D-HSM). Their parameter settings determine the nonlinear systems’ behaviour.


#### 2.2.1. Two-Dimensional Sine Logistic Modulation Map

The 2D-SLMM is composed of two typical one-dimensional Logistic map [21–23] and Sine map. The Logistic and Sine chaotic maps are nonlinear transformations with simple structure. Therefore, they are easy to be analysed and predicted. Researchers have confirmed that it has security problems [24]. In order to solve this problem, Hua et al. [25] designed a 2D Sine Logistic modulation map and further proved it has greater advantages in security and efficiency than other high-dimensional chaotic systems. The two-dimensional Sine Logistic modulation map is defined as follows:(1)xi+1=αsinπyi+βxi1−xi,yi+1=αsinπxi+1+βyi1−yi,where xi,yi∈0,1, α∈0,1, and β∈0,3. When parameter α∈0.905,1 and β is close to be 3, the 2D Sine Logistic map will be hyperchaotic.


#### 2.2.2. Two-Dimensional Hénon-Sine Map

Wu et al. [26] proposed a 2D Hénon-Sine map consisting of Hénon map and Sine map by studying two-dimensional Hénon map and one-dimensional Sine map. Compared with the original two chaotic maps, the 2D Hénon-Sine map has more complex trajectories, which makes it more unpredictable. Its mathematical expression is defined as follows:(2)xi+1=1−φsin2xi+yimod1,yi+1=γximod1,where the value ranges of parameters φ and γ are extended to−∞,+∞. When parameterφ∈−∞,−0.71∪0.71,+∞ and γ=0.7, or φ∈R and γ∉−1,1, the 2D Hénon-Sine map is chaotic, and the chaotic range is larger.


#### 2.2.3. Improved Cat Map

Cat map [27, 28] was proposed by Russian mathematician Vladimir Igorevich Arnold, also known as Arnold map. Because the image of cats is often used as an example, it is called “cat map.” This is a chaotic map method that performs repeated folding and stretching transformation in a limited area and is generally applied to multimedia chaotic encryption. In order to better hide the statistical characteristics of medical images, the cat map is improved to make it nonlinear. Assuming the size of the medical image matrix is M×N, the improved cat map is defined as(3)xi+1yi+1=1abqabq+1xiyi+0xi+12modMN,where a,b,c,d∈Z+, and q=N/gcdM,N, Z+ represents the positive integer, and gcd⋅ represents the greatest common divisor. xi,yi is the pixel position before mapping. According to the theorem that the reversible transformation of the finite integer transformation must have a transformation period, the improved cat map has periodic reversibility. The original image can be restored according to this characteristic.


### 2.3. Performance Evaluation

The proposed chaotic system possesses good chaotic behaviours. In this subsection, the trajectory and Lyapunov exponent are used to evaluate the chaotic performance of the chaotic system.


#### 2.3.1. Trajectory

We set the initial values of 2D-SLMM and 2D-HSM to be the same as the 2D Logistic map [25], Hénon map [26], two-dimensional logistic tent modular map (2D-LTMM) [29], and improved Hénon map [30], and the initial value is set to 0.528,0.135. Their parameters are set to the values that ensure six maps to have excellent chaotic behaviours. Figures 3(c)–3(f) show the trajectories of 2D-SLMM, 2D-HSM, improved Hénon map, and 2D-LTMM, respectively. Compared with the phase diagrams of the 2D Logistic map and Hénon map shown in Figures 3(a) and 3(b), 2D-SLMM and improved Hénon have a larger distribution area. 2D-HSM and 2D-LTMM are distributed across the entire phase plane. This observation shows that 2D-SLMM, 2D-HSM, improved Hénon, and 2D-LTMM have better ergodicity and more random output.Figure 3
Trajectories of six 2D chaotic maps: (a) the 2D Logistic map with parametersr=1.19, (b) the Hénon map with parameter a=1.4 and b=0.3, (c) the 2D-SLMM with parameter α=1 and β=3, (d) the 2D-HSM with parameter φ=8 and γ=3, (e) the improved Hénon map with parameter a=50 and b=50, and (f) the 2D-LTMM with parameter a=50 and b=50.
(a)(b)(c)(d)(e)(f)


#### 2.3.2. Lyapunov Exponent

An important feature of chaos is that a small uncertainty of the initial state will cause the high-speed output to increase exponentially. In a nonchaotic system, trajectories close to each other converge exponentially or diverge at an exponential rate. The rate of convergence or divergence of the system’s trajectory can be described by Lyapunov exponent (LE)λ [31, 32]. Lyapunov exponent of 2D-SLMM and 2D-HSM is calculated in this subsection. Positive LE means that even if the initial state changes slightly, the final output is completely different. Therefore, when λ>0, the dynamic system is chaotic and has hyperchaotic behaviors when it has more than one positive LE values. Figures 4(a)–4(f) show the LE spectrum of 2D Logistic map, Hénon map, 2D-SLMM, 2D-HSM, improved Hénon map, and 2D-LTMM with their corresponding parameters, respectively. 2D-HSM has chaotic behavior when γ∉−1,1, φ∈R. The maximum Lyapunov exponent of 2D-HSM is greater than 0. When α∈0.78,0.89, 2D-SLMM has chaotic behaviors because its LE value is positive. And when α∈0.89,1., 2D-SLMM has hyperchaotic behaviors because its two LE values are positive. Both values become greater when α is close to 1. Compared with the LE values of other 2D chaotic maps shown in Figure 4, the 2D-HSM and 2D-SLMM have wider chaotic range, a larger LE value, and therefore a more complex trajectory. Its output is also more unpredictable.Figure 4
The LE distributions of six 2D chaotic maps: (a) the 2D Logistic map, (b) the Hénon map (b=0.3), (c) the 2D-SLMM (β=3), (d) the 2D-HSM (γ=3), (e) the improved Hénon map (b=50), and (f) the 2D-LTMM (b=50).
(a)(b)(c)(d)(e)(f)


### 2.4. Major Contribution of the Study

In the proposed encryption algorithm, the chaotic system is composed of two two-dimensional chaotic maps. Compared with the low-dimensional chaotic map, its structure is more complex, so it is difficult to predict and analyse, which improves the security of the system. Compared with the high-dimensional chaotic map, its structure is relatively simple, and the time complexity is therefore reduced, which improves the execution efficiency of the algorithm. A cipher feedback is applied at pixel grey value transformation processing. The coefficient of cat map transformation is generated by chaotic sequence, which makes the relationship between cipher and secret key more complicated. Cipher feedback and chaotic iteration are adopted in diffusion process. The effect of diffusion is related not only to the secret key, but also to the plaintext itself. The proposed algorithm considers the texture characteristics of medical images and chaotic mapping characteristics to achieve a balance between security and effectiveness.


## 2.1. Two-Dimensional Zigzag Confusion

The 2D zigzag scan [18, 19] was used to scramble the pixel positions of the medical image to destroy the high correlation between adjacent pixels. The operation started from the first pixel of the medical image matrix, the subsequent pixels were traversed in 2D zigzag mode [20], and the traversing process stretched the two-dimensional matrix into a one-dimensional sequence; the specific process is shown in Figure 1. For example, for a matrix of size5×5, the starting position is 1,1, and the scrambling matrix starts at element 45. The original matrix and one-dimensional sequence after 2D zigzag scan are shown in Figure 2.Figure 1
The zigzag path.Figure 2
Zigzag confusion result with the starting position1,1.


## 2.2. Chaotic System

This paper chooses two two-dimensional chaotic maps to form a random selection system for image pixel grey value disturbance and diffusion: 2D Sine Logistic modulation map (2D-SLMM) and 2D Hénon-Sine map (2D-HSM). Their parameter settings determine the nonlinear systems’ behaviour.


### 2.2.1. Two-Dimensional Sine Logistic Modulation Map

The 2D-SLMM is composed of two typical one-dimensional Logistic map [21–23] and Sine map. The Logistic and Sine chaotic maps are nonlinear transformations with simple structure. Therefore, they are easy to be analysed and predicted. Researchers have confirmed that it has security problems [24]. In order to solve this problem, Hua et al. [25] designed a 2D Sine Logistic modulation map and further proved it has greater advantages in security and efficiency than other high-dimensional chaotic systems. The two-dimensional Sine Logistic modulation map is defined as follows:(1)xi+1=αsinπyi+βxi1−xi,yi+1=αsinπxi+1+βyi1−yi,where xi,yi∈0,1, α∈0,1, and β∈0,3. When parameter α∈0.905,1 and β is close to be 3, the 2D Sine Logistic map will be hyperchaotic.


### 2.2.2. Two-Dimensional Hénon-Sine Map

Wu et al. [26] proposed a 2D Hénon-Sine map consisting of Hénon map and Sine map by studying two-dimensional Hénon map and one-dimensional Sine map. Compared with the original two chaotic maps, the 2D Hénon-Sine map has more complex trajectories, which makes it more unpredictable. Its mathematical expression is defined as follows:(2)xi+1=1−φsin2xi+yimod1,yi+1=γximod1,where the value ranges of parameters φ and γ are extended to−∞,+∞. When parameterφ∈−∞,−0.71∪0.71,+∞ and γ=0.7, or φ∈R and γ∉−1,1, the 2D Hénon-Sine map is chaotic, and the chaotic range is larger.


### 2.2.3. Improved Cat Map

Cat map [27, 28] was proposed by Russian mathematician Vladimir Igorevich Arnold, also known as Arnold map. Because the image of cats is often used as an example, it is called “cat map.” This is a chaotic map method that performs repeated folding and stretching transformation in a limited area and is generally applied to multimedia chaotic encryption. In order to better hide the statistical characteristics of medical images, the cat map is improved to make it nonlinear. Assuming the size of the medical image matrix is M×N, the improved cat map is defined as(3)xi+1yi+1=1abqabq+1xiyi+0xi+12modMN,where a,b,c,d∈Z+, and q=N/gcdM,N, Z+ represents the positive integer, and gcd⋅ represents the greatest common divisor. xi,yi is the pixel position before mapping. According to the theorem that the reversible transformation of the finite integer transformation must have a transformation period, the improved cat map has periodic reversibility. The original image can be restored according to this characteristic.


## 2.2.1. Two-Dimensional Sine Logistic Modulation Map

The 2D-SLMM is composed of two typical one-dimensional Logistic map [21–23] and Sine map. The Logistic and Sine chaotic maps are nonlinear transformations with simple structure. Therefore, they are easy to be analysed and predicted. Researchers have confirmed that it has security problems [24]. In order to solve this problem, Hua et al. [25] designed a 2D Sine Logistic modulation map and further proved it has greater advantages in security and efficiency than other high-dimensional chaotic systems. The two-dimensional Sine Logistic modulation map is defined as follows:(1)xi+1=αsinπyi+βxi1−xi,yi+1=αsinπxi+1+βyi1−yi,where xi,yi∈0,1, α∈0,1, and β∈0,3. When parameter α∈0.905,1 and β is close to be 3, the 2D Sine Logistic map will be hyperchaotic.


## 2.2.2. Two-Dimensional Hénon-Sine Map

Wu et al. [26] proposed a 2D Hénon-Sine map consisting of Hénon map and Sine map by studying two-dimensional Hénon map and one-dimensional Sine map. Compared with the original two chaotic maps, the 2D Hénon-Sine map has more complex trajectories, which makes it more unpredictable. Its mathematical expression is defined as follows:(2)xi+1=1−φsin2xi+yimod1,yi+1=γximod1,where the value ranges of parameters φ and γ are extended to−∞,+∞. When parameterφ∈−∞,−0.71∪0.71,+∞ and γ=0.7, or φ∈R and γ∉−1,1, the 2D Hénon-Sine map is chaotic, and the chaotic range is larger.


## 2.2.3. Improved Cat Map

Cat map [27, 28] was proposed by Russian mathematician Vladimir Igorevich Arnold, also known as Arnold map. Because the image of cats is often used as an example, it is called “cat map.” This is a chaotic map method that performs repeated folding and stretching transformation in a limited area and is generally applied to multimedia chaotic encryption. In order to better hide the statistical characteristics of medical images, the cat map is improved to make it nonlinear. Assuming the size of the medical image matrix is M×N, the improved cat map is defined as(3)xi+1yi+1=1abqabq+1xiyi+0xi+12modMN,where a,b,c,d∈Z+, and q=N/gcdM,N, Z+ represents the positive integer, and gcd⋅ represents the greatest common divisor. xi,yi is the pixel position before mapping. According to the theorem that the reversible transformation of the finite integer transformation must have a transformation period, the improved cat map has periodic reversibility. The original image can be restored according to this characteristic.


## 2.3. Performance Evaluation

The proposed chaotic system possesses good chaotic behaviours. In this subsection, the trajectory and Lyapunov exponent are used to evaluate the chaotic performance of the chaotic system.


### 2.3.1. Trajectory

We set the initial values of 2D-SLMM and 2D-HSM to be the same as the 2D Logistic map [25], Hénon map [26], two-dimensional logistic tent modular map (2D-LTMM) [29], and improved Hénon map [30], and the initial value is set to 0.528,0.135. Their parameters are set to the values that ensure six maps to have excellent chaotic behaviours. Figures 3(c)–3(f) show the trajectories of 2D-SLMM, 2D-HSM, improved Hénon map, and 2D-LTMM, respectively. Compared with the phase diagrams of the 2D Logistic map and Hénon map shown in Figures 3(a) and 3(b), 2D-SLMM and improved Hénon have a larger distribution area. 2D-HSM and 2D-LTMM are distributed across the entire phase plane. This observation shows that 2D-SLMM, 2D-HSM, improved Hénon, and 2D-LTMM have better ergodicity and more random output.Figure 3
Trajectories of six 2D chaotic maps: (a) the 2D Logistic map with parametersr=1.19, (b) the Hénon map with parameter a=1.4 and b=0.3, (c) the 2D-SLMM with parameter α=1 and β=3, (d) the 2D-HSM with parameter φ=8 and γ=3, (e) the improved Hénon map with parameter a=50 and b=50, and (f) the 2D-LTMM with parameter a=50 and b=50.
(a)(b)(c)(d)(e)(f)


### 2.3.2. Lyapunov Exponent

An important feature of chaos is that a small uncertainty of the initial state will cause the high-speed output to increase exponentially. In a nonchaotic system, trajectories close to each other converge exponentially or diverge at an exponential rate. The rate of convergence or divergence of the system’s trajectory can be described by Lyapunov exponent (LE)λ [31, 32]. Lyapunov exponent of 2D-SLMM and 2D-HSM is calculated in this subsection. Positive LE means that even if the initial state changes slightly, the final output is completely different. Therefore, when λ>0, the dynamic system is chaotic and has hyperchaotic behaviors when it has more than one positive LE values. Figures 4(a)–4(f) show the LE spectrum of 2D Logistic map, Hénon map, 2D-SLMM, 2D-HSM, improved Hénon map, and 2D-LTMM with their corresponding parameters, respectively. 2D-HSM has chaotic behavior when γ∉−1,1, φ∈R. The maximum Lyapunov exponent of 2D-HSM is greater than 0. When α∈0.78,0.89, 2D-SLMM has chaotic behaviors because its LE value is positive. And when α∈0.89,1., 2D-SLMM has hyperchaotic behaviors because its two LE values are positive. Both values become greater when α is close to 1. Compared with the LE values of other 2D chaotic maps shown in Figure 4, the 2D-HSM and 2D-SLMM have wider chaotic range, a larger LE value, and therefore a more complex trajectory. Its output is also more unpredictable.Figure 4
The LE distributions of six 2D chaotic maps: (a) the 2D Logistic map, (b) the Hénon map (b=0.3), (c) the 2D-SLMM (β=3), (d) the 2D-HSM (γ=3), (e) the improved Hénon map (b=50), and (f) the 2D-LTMM (b=50).
(a)(b)(c)(d)(e)(f)


## 2.3.1. Trajectory

We set the initial values of 2D-SLMM and 2D-HSM to be the same as the 2D Logistic map [25], Hénon map [26], two-dimensional logistic tent modular map (2D-LTMM) [29], and improved Hénon map [30], and the initial value is set to 0.528,0.135. Their parameters are set to the values that ensure six maps to have excellent chaotic behaviours. Figures 3(c)–3(f) show the trajectories of 2D-SLMM, 2D-HSM, improved Hénon map, and 2D-LTMM, respectively. Compared with the phase diagrams of the 2D Logistic map and Hénon map shown in Figures 3(a) and 3(b), 2D-SLMM and improved Hénon have a larger distribution area. 2D-HSM and 2D-LTMM are distributed across the entire phase plane. This observation shows that 2D-SLMM, 2D-HSM, improved Hénon, and 2D-LTMM have better ergodicity and more random output.Figure 3
Trajectories of six 2D chaotic maps: (a) the 2D Logistic map with parametersr=1.19, (b) the Hénon map with parameter a=1.4 and b=0.3, (c) the 2D-SLMM with parameter α=1 and β=3, (d) the 2D-HSM with parameter φ=8 and γ=3, (e) the improved Hénon map with parameter a=50 and b=50, and (f) the 2D-LTMM with parameter a=50 and b=50.
(a)(b)(c)(d)(e)(f)


## 2.3.2. Lyapunov Exponent

An important feature of chaos is that a small uncertainty of the initial state will cause the high-speed output to increase exponentially. In a nonchaotic system, trajectories close to each other converge exponentially or diverge at an exponential rate. The rate of convergence or divergence of the system’s trajectory can be described by Lyapunov exponent (LE)λ [31, 32]. Lyapunov exponent of 2D-SLMM and 2D-HSM is calculated in this subsection. Positive LE means that even if the initial state changes slightly, the final output is completely different. Therefore, when λ>0, the dynamic system is chaotic and has hyperchaotic behaviors when it has more than one positive LE values. Figures 4(a)–4(f) show the LE spectrum of 2D Logistic map, Hénon map, 2D-SLMM, 2D-HSM, improved Hénon map, and 2D-LTMM with their corresponding parameters, respectively. 2D-HSM has chaotic behavior when γ∉−1,1, φ∈R. The maximum Lyapunov exponent of 2D-HSM is greater than 0. When α∈0.78,0.89, 2D-SLMM has chaotic behaviors because its LE value is positive. And when α∈0.89,1., 2D-SLMM has hyperchaotic behaviors because its two LE values are positive. Both values become greater when α is close to 1. Compared with the LE values of other 2D chaotic maps shown in Figure 4, the 2D-HSM and 2D-SLMM have wider chaotic range, a larger LE value, and therefore a more complex trajectory. Its output is also more unpredictable.Figure 4
The LE distributions of six 2D chaotic maps: (a) the 2D Logistic map, (b) the Hénon map (b=0.3), (c) the 2D-SLMM (β=3), (d) the 2D-HSM (γ=3), (e) the improved Hénon map (b=50), and (f) the 2D-LTMM (b=50).
(a)(b)(c)(d)(e)(f)


## 2.4. Major Contribution of the Study

In the proposed encryption algorithm, the chaotic system is composed of two two-dimensional chaotic maps. Compared with the low-dimensional chaotic map, its structure is more complex, so it is difficult to predict and analyse, which improves the security of the system. Compared with the high-dimensional chaotic map, its structure is relatively simple, and the time complexity is therefore reduced, which improves the execution efficiency of the algorithm. A cipher feedback is applied at pixel grey value transformation processing. The coefficient of cat map transformation is generated by chaotic sequence, which makes the relationship between cipher and secret key more complicated. Cipher feedback and chaotic iteration are adopted in diffusion process. The effect of diffusion is related not only to the secret key, but also to the plaintext itself. The proposed algorithm considers the texture characteristics of medical images and chaotic mapping characteristics to achieve a balance between security and effectiveness.


## 3. Proposed Scheme

### 3.1. Permutation Process

Image pixel position scrambling refers to the pixel position shuffle and rearrangement. The goal of pixel position scrambling is to destroy the correlation between adjacent pixels of the image and make the scrambling image chaos-like. It makes the algorithm resistant to plaintext attack and cipher attack. In this paper, the medical image pixel position is scrambled according to the following steps:(i)
Step 1: the original medical image is a two-dimensional matrixP. Let us say that the size of the two-dimensional matrix P is M×N, where i=1,2,3,…,M and j=1,2,3,…,N.(ii)
Step 2: separating the even-numbered and odd-numbered rows of the image matrixP where i=1,2,3,…,M/2. For elements in even rows, the rule is to exchange the element in row 2i with element in row M+2−2i. All even-numbered row elements are scrambled according to this rule. For elements in odd row, the rule is to exchange the element in row 2i−1 with element in row M+1−2i until all rows of all image matrices are scrambled. Let us call the scrambled two-dimensional matrix P1.(iii)
Step 3: separating the even and odd columns of the image matrixP1 where j=1,2,3,…,N/2. The odd column exchanges the element in column 2j−1 with the element in column N+1−2j. All odd-numbered column elements are scrambled according to this rule. For elements in even column, the rule is to exchange the element in column 2j with element in column N+2−2j until all columns of all image matrices are scrambled. Get a two-dimensional matrix P2 after a round of scrambling.(iv)
Step 4: the 2D zigzag scan is used to scramble the image matrixP2 after one round of scrambling. The scrambling method is shown in Figure 1, and the before and after changes of the scrambling are shown in Figure 2. After scrambling, the two-dimensional image matrix P2 is stretched to the one-dimensional image sequence S.


### 3.2. Image Pixel Grey Value Disruption Process

The transformation of image pixel grey value can diffuse the pixel value to confuse the relationship between cipher and plaintext, especially to eliminate the texture features of medical images such as the distribution of pixels in the grey histogram of medical images. The more uniform the distribution of pixels, the stronger the ability to resist statistical attacks. The specific process of disruption is described as follows:(i)
Step 1: the chaotic map selected when disturbing the elements in the image sequenceS after scrambling is as described in equation (4). Here, Ki is the random selection of the chaotic system map mentioned earlier:(4)Ki=αsinπy+βx1−x,αsinπx+βy1−y,1−φsin2w+zmod1,γwmod1.(ii)
Step 2: the chaotic initial value is input, and four pseudorandom sequences are generated through iteration of equation (4) for M×N+200 times. In order to eliminate the transient effect, the first 200 numbers of each sequence are discarded to obtain pseudorandom sequences k1, k2, k3, and k4.(iii)
Step 3: selecting the pseudorandom sequencek1 and k2 to combine, and a new pseudorandom sequence k5 is generated by using equation (6). Two positive integers m1 and m2 are input. Equations (5), (6), and (7) are used to select the elements corresponding to the pixels to be scrambled in the image vector from the chaotic sequence k5 to generate the control coefficient of cat map form the cat map coefficient matrix E reflected in equation (8), where i=1,2,3,…,M×N/2, and floor refers to rounding down:(5)key1=m1mod30,key2=m2mod30,(6)k52i−1=k12i−1+k22i−1−floork12i−1+k22i−1,k52i=k12i+k22i−floork12i+k22i,(7)a=floork52i−1×10key1mod10,b=floork52i×10key2mod10,(8)E=1abqabq+1.(iv)
Step 4: equation (9) is used to transform the grey value of the pixels in the one-dimensional image sequence S, until all the pixels are transformed to obtain the transformed one-dimensional image sequence D where E is the coefficient matrix of the cat map during the encryption process and L is the grey level:(9)d2i−1d2i=Es2i−1s2i+0d2i−12modL.


### 3.3. Diffusion Process

In this paper, the logic of dynamic diffusion is used to carry out diffusion operation on image pixels, and the following is a description of the specific process. The cipher feedback involved can effectively diffuse the influence of the current cipher value to all subsequent cipher values. Based on this idea, it is also possible to associate the current cipher value with a pseudorandom integer sequence and combine chaotic iteration and cipher feedback to diffuse image pixels. In this way, the confusion and diffusion effects of the image are not only related to the characteristics of the image but also related to the encryption key, which further improves the diffusion performance of the algorithm:(i)
Step 1: similarly, the pseudorandom integer sequencesk1 and k3 are combined, k2 and k4 are combined, two positive integers m3 and m4 are input, and new pseudorandom integer sequences k6 and k7 are generated by using equations (10) and (11), where i=1,2,3,…M×N, and floor refers to rounding down:(10)key3=m3mod256,key4=m4mod256,(11)k6=floork1i+k3i−floork1i+k3i×10key3mod256,k7=floork2i+k4i−floork2i+k4i×10key4mod256.(ii)
Step 2: wheni=1, the first pixel of the image sequence is encrypted according to equation (12), and ⊕ represents bitwise XOR operation:(12)sum1=∑i=2M×Ndi,sum2=0,c1=d1⊕k61⊕k71⊕modsum1+k61,256.(iii)
Step 3: wheni=i+1, the i-th pixel of the image sequence is encrypted according to(13)sum1=sum1−di,sum2=sum2+ci−1,ci=di⊕modsum1+k6i,256⊕modsum2+k7i,256.(iv)
Step 4: ifi<M×N, return to step 9 to continue execution. Otherwise, the final encrypted one-dimensional sequence C is obtained. The one-dimensional sequence C is reconstructed into a two-dimensional matrix C1 with size M×N in a column-by-column manner which is the encrypted image, and the encryption process ends.


### 3.4. Procedures of Proposed Schemes

#### 3.4.1. Encryption Process

The encryption process of the proposed scheme is shown in Figure5. The specific process of encryption is presented in Algorithm 1.Figure 5
The encryption process of the proposed algorithm.Algorithm 1: The proposed encryption algorithm.
Input: the original medical image Po of size M×N, the secret keys x0, y0, w0, z0, m1, m2, m3, m4.Output: the cipher image Pc(1)
S← Permute Po with the rules in Section 3.1.(2)
Obtain pseudorandom sequencesk1, k2, k3, and k4 using equation (4) with initial values xo, yo, wo, zo.(3)
q←N/gcdM,Nkey1,key2← use equation (5) with control parameters m1, m2.fori from 1 to M×N/2k5← use equation (6) with pseudorandom sequences k1, k2.a,b← use equation (7) with k5 and key1,key2.Se2i−1←S2i−1+aS2imod256.Se2i←bqS2i−1+abq+1S2i+Se22i−1mod256.end for(4)
key3,key4← use equation (10) with control parameters m3, m4.(5)
Cipher imagePe← Diffuse Se with the steps in Section 3.3.


#### 3.4.2. Decryption Process

The decryption process of the proposed scheme is shown in Figure6. The specific process of decryption is presented in Algorithm 2.Figure 6
The decryption process of the proposed algorithm.Algorithm 2: The proposed decryption algorithm.
Input: the cipher image Pc of size M×N, the secret keys m1, m2, m3, m4, x0, y0, w0, z0.Output: the decrypted image Pd(1)
Sc← Stretch Pc in a column-by-column manner.(2)
Obtain pseudorandom sequencesk1, k2, k3, and k4 using equation (4) with initial values xo, yo, wo, zo.(3)
key3,key4← use equation (10) with control parameters m3, m4.fori from M×N to 1k6,k7← use equation (11) with pseudorandom sequences k1, k2, k3, k4, and key3,key4.ifi←M×Nsum1←0, sum2←∑i=2M×NSciSdM×N←ScM×N⊕modsum1+k6M×N,256⊕modsum2+k7M×N,256else ifi←1sum1←sum1+Sdi+1, sum2←∑i=2M×NSciSd1←Sc1⊕k61⊕k71⊕modsum1+k61,256elsesum1←sum1+Sdi+1,sum2←sum2−SciSdi←Sci⊕modsum1+k6i,256⊕modsum2+k7i,256end ifend for(4)
q←N/gcdM,Nkey1,key2← use equation (5) with control parameters m1, m2.fori from 1 to M×N/2k5.← use equation (6) with pseudorandom sequences k1, k2.a,b.← use equation (7) with pseudorandom sequences and control parameters k5 and key1,key2.Sd12i−1=abq+1Sd2i−1−aSd2i−Sd22i−1mod256Sd12i=−bqSd2i−1+Sd2i−Sd22i−1+256mod256end for(5)
Cd← Permute Sd1 with the inverse process of 2D zigzag scan.(6)
Decrypted imagePd← Permute Cd with the rules of step 2 and step 3 in Section 3.1.


## 3.1. Permutation Process

Image pixel position scrambling refers to the pixel position shuffle and rearrangement. The goal of pixel position scrambling is to destroy the correlation between adjacent pixels of the image and make the scrambling image chaos-like. It makes the algorithm resistant to plaintext attack and cipher attack. In this paper, the medical image pixel position is scrambled according to the following steps:(i)
Step 1: the original medical image is a two-dimensional matrixP. Let us say that the size of the two-dimensional matrix P is M×N, where i=1,2,3,…,M and j=1,2,3,…,N.(ii)
Step 2: separating the even-numbered and odd-numbered rows of the image matrixP where i=1,2,3,…,M/2. For elements in even rows, the rule is to exchange the element in row 2i with element in row M+2−2i. All even-numbered row elements are scrambled according to this rule. For elements in odd row, the rule is to exchange the element in row 2i−1 with element in row M+1−2i until all rows of all image matrices are scrambled. Let us call the scrambled two-dimensional matrix P1.(iii)
Step 3: separating the even and odd columns of the image matrixP1 where j=1,2,3,…,N/2. The odd column exchanges the element in column 2j−1 with the element in column N+1−2j. All odd-numbered column elements are scrambled according to this rule. For elements in even column, the rule is to exchange the element in column 2j with element in column N+2−2j until all columns of all image matrices are scrambled. Get a two-dimensional matrix P2 after a round of scrambling.(iv)
Step 4: the 2D zigzag scan is used to scramble the image matrixP2 after one round of scrambling. The scrambling method is shown in Figure 1, and the before and after changes of the scrambling are shown in Figure 2. After scrambling, the two-dimensional image matrix P2 is stretched to the one-dimensional image sequence S.


## 3.2. Image Pixel Grey Value Disruption Process

The transformation of image pixel grey value can diffuse the pixel value to confuse the relationship between cipher and plaintext, especially to eliminate the texture features of medical images such as the distribution of pixels in the grey histogram of medical images. The more uniform the distribution of pixels, the stronger the ability to resist statistical attacks. The specific process of disruption is described as follows:(i)
Step 1: the chaotic map selected when disturbing the elements in the image sequenceS after scrambling is as described in equation (4). Here, Ki is the random selection of the chaotic system map mentioned earlier:(4)Ki=αsinπy+βx1−x,αsinπx+βy1−y,1−φsin2w+zmod1,γwmod1.(ii)
Step 2: the chaotic initial value is input, and four pseudorandom sequences are generated through iteration of equation (4) for M×N+200 times. In order to eliminate the transient effect, the first 200 numbers of each sequence are discarded to obtain pseudorandom sequences k1, k2, k3, and k4.(iii)
Step 3: selecting the pseudorandom sequencek1 and k2 to combine, and a new pseudorandom sequence k5 is generated by using equation (6). Two positive integers m1 and m2 are input. Equations (5), (6), and (7) are used to select the elements corresponding to the pixels to be scrambled in the image vector from the chaotic sequence k5 to generate the control coefficient of cat map form the cat map coefficient matrix E reflected in equation (8), where i=1,2,3,…,M×N/2, and floor refers to rounding down:(5)key1=m1mod30,key2=m2mod30,(6)k52i−1=k12i−1+k22i−1−floork12i−1+k22i−1,k52i=k12i+k22i−floork12i+k22i,(7)a=floork52i−1×10key1mod10,b=floork52i×10key2mod10,(8)E=1abqabq+1.(iv)
Step 4: equation (9) is used to transform the grey value of the pixels in the one-dimensional image sequence S, until all the pixels are transformed to obtain the transformed one-dimensional image sequence D where E is the coefficient matrix of the cat map during the encryption process and L is the grey level:(9)d2i−1d2i=Es2i−1s2i+0d2i−12modL.


## 3.3. Diffusion Process

In this paper, the logic of dynamic diffusion is used to carry out diffusion operation on image pixels, and the following is a description of the specific process. The cipher feedback involved can effectively diffuse the influence of the current cipher value to all subsequent cipher values. Based on this idea, it is also possible to associate the current cipher value with a pseudorandom integer sequence and combine chaotic iteration and cipher feedback to diffuse image pixels. In this way, the confusion and diffusion effects of the image are not only related to the characteristics of the image but also related to the encryption key, which further improves the diffusion performance of the algorithm:(i)
Step 1: similarly, the pseudorandom integer sequencesk1 and k3 are combined, k2 and k4 are combined, two positive integers m3 and m4 are input, and new pseudorandom integer sequences k6 and k7 are generated by using equations (10) and (11), where i=1,2,3,…M×N, and floor refers to rounding down:(10)key3=m3mod256,key4=m4mod256,(11)k6=floork1i+k3i−floork1i+k3i×10key3mod256,k7=floork2i+k4i−floork2i+k4i×10key4mod256.(ii)
Step 2: wheni=1, the first pixel of the image sequence is encrypted according to equation (12), and ⊕ represents bitwise XOR operation:(12)sum1=∑i=2M×Ndi,sum2=0,c1=d1⊕k61⊕k71⊕modsum1+k61,256.(iii)
Step 3: wheni=i+1, the i-th pixel of the image sequence is encrypted according to(13)sum1=sum1−di,sum2=sum2+ci−1,ci=di⊕modsum1+k6i,256⊕modsum2+k7i,256.(iv)
Step 4: ifi<M×N, return to step 9 to continue execution. Otherwise, the final encrypted one-dimensional sequence C is obtained. The one-dimensional sequence C is reconstructed into a two-dimensional matrix C1 with size M×N in a column-by-column manner which is the encrypted image, and the encryption process ends.


## 3.4. Procedures of Proposed Schemes

### 3.4.1. Encryption Process

The encryption process of the proposed scheme is shown in Figure5. The specific process of encryption is presented in Algorithm 1.Figure 5
The encryption process of the proposed algorithm.Algorithm 1: The proposed encryption algorithm.
Input: the original medical image Po of size M×N, the secret keys x0, y0, w0, z0, m1, m2, m3, m4.Output: the cipher image Pc(1)
S← Permute Po with the rules in Section 3.1.(2)
Obtain pseudorandom sequencesk1, k2, k3, and k4 using equation (4) with initial values xo, yo, wo, zo.(3)
q←N/gcdM,Nkey1,key2← use equation (5) with control parameters m1, m2.fori from 1 to M×N/2k5← use equation (6) with pseudorandom sequences k1, k2.a,b← use equation (7) with k5 and key1,key2.Se2i−1←S2i−1+aS2imod256.Se2i←bqS2i−1+abq+1S2i+Se22i−1mod256.end for(4)
key3,key4← use equation (10) with control parameters m3, m4.(5)
Cipher imagePe← Diffuse Se with the steps in Section 3.3.


### 3.4.2. Decryption Process

The decryption process of the proposed scheme is shown in Figure6. The specific process of decryption is presented in Algorithm 2.Figure 6
The decryption process of the proposed algorithm.Algorithm 2: The proposed decryption algorithm.
Input: the cipher image Pc of size M×N, the secret keys m1, m2, m3, m4, x0, y0, w0, z0.Output: the decrypted image Pd(1)
Sc← Stretch Pc in a column-by-column manner.(2)
Obtain pseudorandom sequencesk1, k2, k3, and k4 using equation (4) with initial values xo, yo, wo, zo.(3)
key3,key4← use equation (10) with control parameters m3, m4.fori from M×N to 1k6,k7← use equation (11) with pseudorandom sequences k1, k2, k3, k4, and key3,key4.ifi←M×Nsum1←0, sum2←∑i=2M×NSciSdM×N←ScM×N⊕modsum1+k6M×N,256⊕modsum2+k7M×N,256else ifi←1sum1←sum1+Sdi+1, sum2←∑i=2M×NSciSd1←Sc1⊕k61⊕k71⊕modsum1+k61,256elsesum1←sum1+Sdi+1,sum2←sum2−SciSdi←Sci⊕modsum1+k6i,256⊕modsum2+k7i,256end ifend for(4)
q←N/gcdM,Nkey1,key2← use equation (5) with control parameters m1, m2.fori from 1 to M×N/2k5.← use equation (6) with pseudorandom sequences k1, k2.a,b.← use equation (7) with pseudorandom sequences and control parameters k5 and key1,key2.Sd12i−1=abq+1Sd2i−1−aSd2i−Sd22i−1mod256Sd12i=−bqSd2i−1+Sd2i−Sd22i−1+256mod256end for(5)
Cd← Permute Sd1 with the inverse process of 2D zigzag scan.(6)
Decrypted imagePd← Permute Cd with the rules of step 2 and step 3 in Section 3.1.


## 3.4.1. Encryption Process

The encryption process of the proposed scheme is shown in Figure5. The specific process of encryption is presented in Algorithm 1.Figure 5
The encryption process of the proposed algorithm.Algorithm 1: The proposed encryption algorithm.
Input: the original medical image Po of size M×N, the secret keys x0, y0, w0, z0, m1, m2, m3, m4.Output: the cipher image Pc(1)
S← Permute Po with the rules in Section 3.1.(2)
Obtain pseudorandom sequencesk1, k2, k3, and k4 using equation (4) with initial values xo, yo, wo, zo.(3)
q←N/gcdM,Nkey1,key2← use equation (5) with control parameters m1, m2.fori from 1 to M×N/2k5← use equation (6) with pseudorandom sequences k1, k2.a,b← use equation (7) with k5 and key1,key2.Se2i−1←S2i−1+aS2imod256.Se2i←bqS2i−1+abq+1S2i+Se22i−1mod256.end for(4)
key3,key4← use equation (10) with control parameters m3, m4.(5)
Cipher imagePe← Diffuse Se with the steps in Section 3.3.


## 3.4.2. Decryption Process

The decryption process of the proposed scheme is shown in Figure6. The specific process of decryption is presented in Algorithm 2.Figure 6
The decryption process of the proposed algorithm.Algorithm 2: The proposed decryption algorithm.
Input: the cipher image Pc of size M×N, the secret keys m1, m2, m3, m4, x0, y0, w0, z0.Output: the decrypted image Pd(1)
Sc← Stretch Pc in a column-by-column manner.(2)
Obtain pseudorandom sequencesk1, k2, k3, and k4 using equation (4) with initial values xo, yo, wo, zo.(3)
key3,key4← use equation (10) with control parameters m3, m4.fori from M×N to 1k6,k7← use equation (11) with pseudorandom sequences k1, k2, k3, k4, and key3,key4.ifi←M×Nsum1←0, sum2←∑i=2M×NSciSdM×N←ScM×N⊕modsum1+k6M×N,256⊕modsum2+k7M×N,256else ifi←1sum1←sum1+Sdi+1, sum2←∑i=2M×NSciSd1←Sc1⊕k61⊕k71⊕modsum1+k61,256elsesum1←sum1+Sdi+1,sum2←sum2−SciSdi←Sci⊕modsum1+k6i,256⊕modsum2+k7i,256end ifend for(4)
q←N/gcdM,Nkey1,key2← use equation (5) with control parameters m1, m2.fori from 1 to M×N/2k5.← use equation (6) with pseudorandom sequences k1, k2.a,b.← use equation (7) with pseudorandom sequences and control parameters k5 and key1,key2.Sd12i−1=abq+1Sd2i−1−aSd2i−Sd22i−1mod256Sd12i=−bqSd2i−1+Sd2i−Sd22i−1+256mod256end for(5)
Cd← Permute Sd1 with the inverse process of 2D zigzag scan.(6)
Decrypted imagePd← Permute Cd with the rules of step 2 and step 3 in Section 3.1.


## 4. Experimental Results and Security Analysis

Three digital medical images of ultrasound, CT, and MRIk7with size 512×512 involved in the experiment are collected from the National Library of Medicine’s Open Access Biomedical Images Search Engine (https://openi.nlm.nih.gov). The two medical images of X-ray and CT-kidney with size 1024×1024 are from AI studio (https://aistudio.baidu.com/aistudio). The configuration environment of the experimental host is CPU of Intel Core I7-6700, with 8 GB RAM, 3.40 GHz processor, and 64 bit Windows 7 operating system. The experiment uses MATLAB (R2019b) software to realize the simulation test. In the experiment, the initial value of the chaotic system reflected by equation (4) is x0=0.106, y0=0.204, w0=0.301, andz0=0.203, and the parameter setting values used in equations (5) and (10) are m1=2, m2=3, m3=4, and m4=3.


### 4.1. Encryption and Decryption Effect and Analysis

The algorithm presented in this paper is used to encrypt the test image. The encryption and decryption results are shown in Figure7. The first column is plaintext images, the second is cipher image, and the third is decryption image. It can be seen the second column of Figure 7 that the cipher images appear noise-like. It also can be observed that the algorithm presented by this paper can effectively solve the obvious contour problem. From the third column of Figure 7, when the encryption and decryption keys are the same and the image is not tampered, the decryption algorithm can restore the original medical image without distortion.Figure 7
Samples of the original digitized image on the left, the cipher image on the middle, and the decrypted digitized medical image on the right.


### 4.2. Statistical Attack

Statistical attack mainly refers to illegal intruder trying to predict and analyse plaintext image and their encryption and decryption keys based on the distribution of pixel grey value. The analysis of statistical attack could be performed as correlation coefficient analysis and grey histogram analysis.


#### 4.2.1. Correlation Coefficient Analysis

The correlation of adjacent pixels in an image refers to the relationship between two adjacent elements in the three directions of horizontal, vertical, and diagonal. It is specifically reflected by the covariance, with a range in interval−1,1. The correlation of adjacent pixels is proportional to the value of correlation coefficient. The closer the value of correlation coefficient to 1 indicates stronger correlation between image pixels. Otherwise the correlation is weak. The calculation of correlation coefficient is defined by(14)Dx=1n∑i=1nxi−Ex2,covx,y=1n∑i=1nxi−Exyi−Eyr=covx,yDxDy,,where Ex and Ey are the mathematical expectations of x and y, respectively, n is the number of pixels, covx,y is the covariance of x and y, and r is the correlation coefficient.Table1 shows the correlation coefficients of adjacent pixels of plaintext and cipher of some medical images. The correlation coefficients of adjacent pixels of plaintext of medical images are close to 1, while the correlation coefficients of adjacent pixels of cipher images tend to 0. It indicates that the adjacent pixels of plaintext image have strong correlation, and the adjacent pixels of cipher image are basically no longer correlated. The algorithm is effective for scrambling.Table 1
Correlation coefficient of the original images and its encrypted image.
ImagesDirectionCorrelation coefficientOriginal imageEncrypted imageCT (512 × 512)Horizontal0.98090.0012Vertical0.9597−1.8721e-04Diagonal0.94934.3539e-04MRI (512 × 512)Horizontal0.99130.0027Vertical0.9907−4.8855e-04Diagonal0.9829−7.9588e-04Ultrasound (512 × 512)Horizontal0.99663.4296e-04Vertical0.98896.9743e-04Diagonal0.98588.5018e-04X-ray (1024 × 1024)Horizontal0.9956−1.7713e-04Vertical0.99440.0015Diagonal0.99140.0016CT-kidney (1024 × 1024)Horizontal0.9984−0.0009Vertical0.9987−0.0017Diagonal0.99720.0006Figure8 shows the adjacent pixel distribution of the CT image and its encrypted image in the horizontal, vertical, and diagonal directions. It can be found that the pixels of the plaintext image are basically distributed around the diagonal, indicating that the correlation between adjacent pixels of the plaintext image is very strong, while the distribution of pixels of the cipher image is irregular. The correlation between adjacent pixels of the cipher image is low.Figure 8
(a, b) Original images and cipher images, (c, d) horizontal correlation of original images and cipher images, (e, f) vertical correlation of original images and cipher images, and (g, h) diagonal correlation of original images and cipher images.
(a)(b)(c)(d)(e)(f)(g)(h)


#### 4.2.2. Histogram Analysis

Image histogram is one of the commonly used metrics for evaluating the robustness of the cipher algorithm against statistical attacks. The histogram is a graph drawn according to the frequency of each grey value in the image, which reflects the most basic statistical characteristics of the image. The histogram of encrypted images should be different from the histogram of original images and have uniform level grayscale values to resist the statistic attack. The first column of Figure9 is the original image of 4 medical images, the second column is the grey histogram of the original image, the third column is the grey histogram corresponding to the encrypted image, and the fourth column is the grey histogram corresponding to the decrypted image. The pixel distribution of the original medical image is uneven, while the pixel distribution of the encrypted medical image is uniform. The histogram of the original medical image is the same as that of the decrypted medical image, but they are completely different from that of the encrypted medical image. The histogram of encrypted images is resistant to statistical attack.Figure 9
(a) Original digitized image, histogram of (b) original digitized image, (c) cipher image, and (d) decrypted digitized medical image.
(a)(b)(c)(d)The histogram of encrypted image can also be analysed quantitatively by calculating the variance of original, encrypted, and decrypted images. The low value of variance shows high grayscale uniformity, and inversely, the high value of variance shows low grayscale uniformity. The variance can be calculated as(15)VarV=1M×N∑i=1M∑j=1Nvi−vj22,where V is the vector of all vi’s and vj’s, M×N is the size of the image, vi and vj are the number of pixels for a particular grayscale values i, and j is the testing image which are the values of the i-th and j-th bins of the corresponding histogram. VarV is the variance of array V.Table2 compares the variance of different plain images, the corresponding cipher images, and decryption images. In Table 2, the encrypted image variance is greatly differed from the original image. This shows that the histograms of encrypted images are different from the original. For each row, the variance of the encrypted image is much smaller than that of the original image. It shows that the histogram of the encrypted image has greater consistency. The decrypted image variance is equal to the original image. This shows that the original image and the decrypted image are the same, and there is no information loss during the encryption and decryption process. From this discussion, it could be concluded that the proposed algorithm is resistant to statistical attack.Table 2
Histogram variance of images using the proposed scheme.
Images (grey)OriginalEncryptedDecryptedCT (512 × 512)55231643.71091017.625055231643.7109MRI (512 × 512)23507412.33591031.742223507412.3359Ultrasound (512 × 512)21233944.16411058.054721233944.1641X-ray (1024 × 1024)6310177.80474175.56256310177.8047CT-kidney (1024 × 1024)24031572.71884102.835924031572.7188We further verify the uniformity of grayscale value distribution of encrypted images using the chi-square test. The low value of chi-square shows high uniformity. It is defined as(16)X2=∑i=1Lobsi−expi2expi,expi=M×NL,obsii=niM×N,where obsi is the observed frequency of i, ni is the total number of occurrences of i, expi is the expected frequency of i, M×N is the size of the image, and L is the grey level. Small value of X2 shows that the pixel distribution is uniform. The chi-square values for the test images are tabulated in Table 3. It is obvious that X2<Xth2256,0.05=293.247893 [33], reflecting the efficiency of the proposed cipher to conceal the spatial redundancy of the plain image.Table 3
Comparison of the chi-square value between our proposed approach and the other proposals.
ImagesSizeOriginalEncryptedDecryptedCT512 × 51213807910.9277254.406313807910.9277MRI512 × 5125876853.0840257.93555876853.0840Ultrasound512 × 5125308486.0410264.51375308486.0410X-ray1024 × 1024394386.1128260.9727394386.1128CT-kidney1024 × 10241501973.2949256.42721501973.2949


### 4.3. Global Information Entropy Analysis

Global information entropy is an important index used to measure whether the grey value distribution is uniform in an image. The greater the global information entropy of the image, the more uniform the grey value distribution of the image, and the greater the possibility of resisting entropy attacks. The theoretical global entropy value of the original random image with 256 grey levels is 8. The global information entropy of the image in the algorithm is calculated by [34](17)HG=∑i=1L−1PGilog21PGi,where Gi is the grey value of the image pixels, PGi is the probability of Gi appearing in the image, and L is the grey level.Table4 shows the global entropy values of different medical plaintext images and the corresponding global entropy values of encrypted cipher images. The global entropy values of original images are in the 4-th column. All of them are smaller than 8, which means that the original images are meaningful. The last column of Table 4 presents the global entropy values of encrypted images by the proposed algorithm. The values are close to 8, which means that the encrypted images are more random-like.Table 4
Global entropy values of different images.
ImagesTypeSizeGlobal entropy valuesOrig. imageEncrypted imageCTGrey512×5124.81507.9993MRIGrey512×5125.46727.9993UltrasoundGrey512×5126.29477.9993X-rayGrey1024×10247.67447.9998CT-kidneyGrey1024×10247.04757.9998


#### 4.3.1. Local Shannon Entropy Analysis

The global information entropy is unfair for the comparisons between images of different sizes, and failure to discern image randomness before and after image shuffling. Local Shannon entropy overcomes these weaknesses of the global Shannon entropy. It measures the exact randomness of pixels in encrypted images [6]. It is the mean value of entropy of several nonoverlapping blocks of the image. The local Shannon entropy is defined as [35](18)Hk,TBS¯=∑i=1kHSik,where k is the number of nonoverlapping blocks of an information source S, TB is the total number of pixels in each of the nonoverlapping blocks, and S1,S2,…,Sk are the nonoverlapping blocks having information entropies HS1,HS2,…,HSk, respectively.In this paper, we set the number of nonoverlapping blocksk=30 and the total number of pixels in each of the block TB=1936. The k,TB-local Shannon entropy is used as the measurement describing the randomness over the entire test image. The local entropy also has optimal value for various significance levels such as 5%, 1%, and 0.1% [36]. Table 5 provides the acceptance interval of the local entropy test under various significance levels of the proposed algorithm. The local Shannon entropy value of all the images is within the range of acceptance interval of 0.05, 0.01, and 0.001 significance levels. This proves the high randomness of pixel values in the encrypted images using the proposed scheme. Table 6 presents the obtained experimental values for different cipher images, and they come from the existing method and our method, respectively. It is obvious that these values are extremely nearby to the maximum value of 8. It indicates the information leakage from the proposed cipher algorithm insignificant.Table 5
Local Shannon entropy values of different images.
Images (grey)SizeLocal Shannon entropy (reference range) [37, 38]Local Shannon entropyResultCT512 × 512α = 0.05 (7.901901305,7.903037329)7.9024PassMRI512 × 512α = 0.01 (7.901722822,7.903215812) α = 0.001 (7.901515698,7,903422936)7.9030PassUltrasound512 × 5127.9028PassX-ray1024 × 10247.9030PassCT-kidney1024 × 10247.9027PassTable 6
Comparison of information entropy results.
AlgorithmsImagesGlobal Shannon entropyLocal Shannon entropy (k=30TB=1936)OursCT7.99937.9024MRI7.99937.9030Ultrasound7.99937.9028X-ray7.99987.9030Ravichandran et al. [6]MR_17.99927.9020CT_17.99937.9023Chai et al. [39]Brone7.99947.9015


### 4.4. Differential Attack

Differential attack means that the attacker can extract the information of the original image through the research of the cipher image. It is analysed and verified by the unified average change intensity (UACI) and the number of changing pixel rate (NPCR). NPCR measures the number of changed pixel values between the two encrypted images by changing one pixel value in the original image. The range of NPCR is0,1. It is defined as equation (19). UACI measures the average changing intensity between the two encrypted images by changing one pixel value in the original image. The range of UACI is 0,1 as well, which is defined in equation (20):(19)NPCR=∑i=1M∑j=1NDi,jM×N,Di,j=0,ci,j=c′i,j,1,ci,j≠c′i,j,(20)UACI=∑i=1M∑j=1Nci,j−c′i,j/L−1M×N,where M and N are, respectively, the width and height of the medical image, L is the grey level, and ci,j and ci,j′ are the encrypted image and the encrypted image corresponding after changing a pixel grayscale value, respectively.In this section, we randomly change the value of a pixel in a grayscale image, and Tables7 and 8 show the NPCR and UACI results of the test image, respectively. The optimal value of NPCR and UACI is related to the size and type of the image. Wu et al. [40] proposed the theoretical critical value of NPCR and UACI. In Tables 7 and 8, the NPCR and UACI values of all images are slightly below the critical value. This indicates that the protection against differential attacks of the proposed scheme is not very strong. We will work on this problem in our future study.Table 7
NPCR results for test images.
Tested image size M-by-N 512-by-512NPCR critical value [40]N0.05∗=99.5893%N0.01∗=99.5810%N0.001∗=99.5717%NameNPCR (%)NPCR test results0.05-level0.01-level0.001-levelCT98.6767FailFailFailMRI98.2585FailFailFailUltrasound98.6725FailFailFailTested image size M-by-N 1024-by-1024NPCR critical value [40]N0.05∗=99.5994%N0.01∗=99.5952%N0.001∗=99.5906%Name (size)NPCR (%)NPCR test results0.05-level0.05-level0.05-levelX-ray98.2576FailFailFailCT-kidney98.7677FailFailFailTable 8
UACI results for test images.
Tested image size M-by-N 512-by-512UACI critical value [40]N0.05∗−=33.3730%N0.01∗−=33.3445%N0.001∗−=33.3115%N0.05∗+=33.5541%N0.01∗+=33.5826%N0.001∗+=33.6156%NameUACI (%)UACI test results0.05-level0.01-level0.001-levelCT32.3884FailFailFailMRI31.4729FailFailFailUltrasound32.4262FailFailFailTested image size M-by-N 1024-by-1024UACI critical value [40]N0.05∗−=33.4183%N0.01∗−=33.4040%N0.001∗−=33.3875%N0.05∗+=33.5088%N0.01∗+=33.5231%N0.001∗+=33.5396%Name (size)UACI(%)UACI test results0.05-level0.05-level0.05-levelX-ray31.5516FailFailFailCT-kidney32.8412FailFailFail


### 4.5. Mean Square Error (MSE) and Peak Signal-to-Noise Ratio (PSNR) Analysis

Mean square error (MSE) measures the difference between original and encrypted images. And also it measures the difference between original and decrypted images. Greater value of MSE indicates greater difference between two images [41]. It can be calculated as(21)MSEOC=1M×N∑i=0N−1∑j=0M−1Oi,j−Ci,j2,MSEOD=1M×N∑i=0N−1∑j=0M−1Oi,j−Di,j2,where M is the width and N is the height of the image. Oi,j, Ci,j, and Di,j represent the pixel grey value of the plaintext image, the cipher image, and the decrypted image in the i-th row and j-th column, respectively.Peak signal-to-noise ratio (PSNR) measures the fidelity of an image [41]. Smaller value of PSNR indicates greater difference between original and encrypted images [41]. The mathematical expression for the calculation of PSNR is given in(22)PSNROC=20×log10MAXIMSEOC,PSNROD=20×log10MAXIMSEOD,where MAXI represents the pixel grey level of the image. MSEOC is the MSE between the original image and the encrypted image, and MSEOD is the MSE between the original image and the decrypted image. Table 9 presents the MSE and PSNR results of the test images. The results show that there is a great difference between the original image and the encrypted image, and no difference between the original image and the decrypted image. The large MSEOC value proves that the proposed scheme is secure and robust against different statistical attacks.Table 9
MSE and PSNR results of the test images using the proposed schemes.
ImagesSizeMSEOCMSEODPSNROCPSNROECT512 × 51217124.062605.7947∞MRI512 × 51216892.886505.8538∞Ultrasound512 × 51213338.427506.8798∞X-ray1024 × 102410290.187608.0066∞CT-kidney1024 × 102410039.202508.1138∞


### 4.6. Exhaustive Attack

#### 4.6.1. Key Space Analysis

With the rapid development of computer technology, the key space of encryption algorithms must be large enough to withstand exhaustive attacks, and a key space of 2128 or more is required for an algorithm [42]. The secret keys involved in this algorithm have three parts: 4 initial values needed to generate the chaotic sequence, 2 secret keys needed to generate the cat map control coefficient, and 2 initial values used for dynamic diffusion. The whole system is under the condition of double precision, grey value of 256, and 64 bit Windows7 Operating System. According to the IEEE floating point standard, the calculation precision of 64 bit double data is 1015 [43]. So, the secret key space of the algorithm can be reached 10158=10120. The algorithm has a large enough secret key space. It is computationally unfeasible to crack the secret key by exhaustive search.


#### 4.6.2. Key Sensitivity Analysis

Secret key sensitivity ensures that the attacker cannot use a secret key close to the actual secret key to decrypt the original image. Any small change in the secret key should get very different encryption results. There are 8 security keys in our scheme, which are the initial valuesx0, y0, w0, and z0 of the chaotic system in equation (4), the parameters m1 and m2 in equation (5), and the parameters m3 and m4 in equation (10). The 8 security keys are slightly changed according to the following rules. One of secret key is updated by Δk and other keys unchanged. Due to the selection of the initial values x0, y0, w0, and z0 during the test is in the range of 0,1, Δk is selected as 0.001. Since m1, m2, m3, and m4 are random positive integers, the Δk is ±1.In order to analyse the key sensitivity, NPCR and UACI are calculated to evaluate the difference between cipher text images. The original medical image is encrypted using the key distributed as the same as before, and the corresponding cipher image is denoted asC. Then, we use the modified keys k′=k+Δk to encrypt the original image and denote the generated cipher as C″. Some of the test results are shown in Figure 10, and the NPCR and UACI between the cipher text images generated by two security keys with only 1 bit difference are shown in Table 10. The results clearly show that the proposed image cryptosystem has sufficient key sensitivity.Figure 10
Key sensitivity analysis ofx0. (a), (e), (l), and (o) original images, (b), (f), (m), and (p) cipher images C, (c), (g), (i), and (q) cipher images C″, and (d), (h), (n), and (r) images of C−C″.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)Table 10
Results of NPCR and UACI between cipher text images.
Cipher imagex0=106y0=0.204w0=0.301z0=0.203m1=2m2=3m3=4m4=3x0′=107y0=0.205w0=0.302z0=0.204m1=3m2=4m3=5m4=4CTNPCR (%)99.615599.614099.608699.634998.658498.179699.617099.6071UACI (%)33.461933.449733.395033.528832.578331.950033.428033.4726X-rayNPCR (%)99.615399.594999.613099.599298.995298.543199.614099.6110UACI (%)33.495433.465333.446733.472833.297332.680633.459033.4543


### 4.7. Classical Types of Attacks

According to the attacker’s acquisition of information, cryptanalysis can be divided into four categories [33]:Cipher only. The attacker only knows part of the encrypted text.Known plaintext. The attacker has obtained some given plaintext and corresponding cipher.Chosen plaintext. The attacker not only knows the encryption algorithm but also can select the plaintext message and can get the corresponding encrypted cipher.Chosen cipher. The attacker has access to the decryption machine and can construct the plaintext corresponding to any cipher.The most powerful attack is to chosen plaintext attack. If a cryptographic system is resistant to this kind of attack, then it is resistant other types of attacks.The sensitivity of the proposed algorithm to the initial parameters (m1, m2, m3, and m4) and the initial values (x0, y0, w0, z0) has been verified in detail in Section 4.6.2. If one of them is changed, the chaotic sequence, the cat mapping coefficient matrix, and the pseudorandom integer sequence will be completely different. In addition, in the dynamic diffusion stage, the encrypted value is not only related to the original pixel grey value and the key, but also related to the previous original value and the previous encrypted value. Different encrypted images have different chaotic iterations and cipher feedback. Therefore, the proposed algorithm is resistant to chosen plaintext attack.


### 4.8. Robustness to Noise and Data Loss

When the encrypted medical images are transmitted or stored via the network, they are easily contaminated by various noises, and data loss is extremely likely to occur. Image encryption algorithms should be robust against noise and data loss. In the proposed algorithm, the encryption and decryption processes are symmetrical. During the encryption process, a change in one pixel in the plaintext image will affect multiple pixels in the ciphertext image. In the decryption process, the change of one pixel in the ciphertext image also affects multiple pixels in the plaintext image. Therefore, the proposed algorithm has an avalanche effect. Figure11 shows the robustness analysis results of the proposed algorithm against noise and data loss. When the ciphertext image is contaminated by salt and pepper noise or data lost, the decryption process can recover part of the original image. Although there is some noise in the restored image, we can still identify most of the image information. When the ciphertext image is contaminated by Gaussian noise or speckle noise, the decryption process of the proposed algorithm cannot restore the original image. The novel encryption algorithm is sensitive to noise and data loss. We will work on this problem in our future study.Figure 11
Robustness analysis results of noise and the data loss. (a) The ciphertext imageC and its decrypted image; (b) the ciphertext image C1 with 0.0005% salt and pepper noise and its decrypted result; (c) the ciphertext image C2 with 0.0005% Gaussian noise and its decrypted result; (d) the ciphertext image C3 with 0.0005% speckle noise and its decrypted result; (e) the ciphertext image C4 with 0.390625% data loss and its decrypted result; (f) the ciphertext image C5 with 1.5625% data loss and its decrypted result.
(a)(b)(c)(d)(e)(f)


### 4.9. Computational Complexity Analysis

The time-consuming parts of the proposed encryption algorithm are the generation of chaotic sequences, permutation operations, pixel grey value transformation, and diffusion operations. In the permutation stage, the time complexity of the first round of cross-ranking scrambling isΘM/2 and ΘN/2. The time complexity of the second round of scanning using zigzag is ΘM×N−1. In the chaotic sequence generation stage, two two-dimensional maps are used to form a new chaotic system. The time complexity of generating the chaotic sequence is Θ4×M×N. In the phase of pixel grey value transformation, the time complexity of adopting cat mapping transformation is ΘM×N/2. In the diffusion stage, the dynamic diffusion operation is adopted the same time, and its time complexity is ΘM×N. The total time complexity of the proposed algorithm is Θ4×M×N.


### 4.10. Computational Time Analysis

The efficiency of an encryption algorithm refers to the running speed of the algorithm. Table11 shows the time taken for the encrypting and decrypting of 5 test images, and the data of which are the average value obtained by performing 11 times on the image. The data in Table 11 reflect that the time required for the proposed algorithm to encrypt a medical image with a size of 512×512 is about 1.3s, and the time it takes to encrypt a size of 1024×1024 is about 5s.Table 11
Results for total encryption time and decryption time using the proposed algorithm.
ImagesTypeSizeEncryption time (seconds)Decryption time (seconds)CTGrey512 × 5121.29331.1230MRIGrey512 × 5121.27061.0865UltrasoundGrey512 × 5121.28021.1032X-rayGrey1024 × 10245.08804.4282CT-kidneyGrey1024 × 10245.09384.4502


### 4.11. Random Analysis

In the proposed method, a chaotic system is used to iteratively generate sequences for pixel grey value transformation and dynamic diffusion. In order to prove the effectiveness of the algorithm, a comprehensive statistical randomness test is performed on this subsection. The National Institute of Standards and Technology (NIST) statistical test suite [44] and the standard randomness test FIPS 140-2 [45] are employed for analysis.


#### 4.11.1. NIST Analysis

The National Institute of Standards and Technology (NIST) is a United States (US) based company that provides guidelines for the protection of data. The NIST has outlined 15 significant statistical tests for cryptographic applications, which are used to determine the strength of any cryptographic algorithm and estimate the actual randomness produced by the system [46, 47]. The test was applied to the chaotic system of the proposed algorithm. And the results are shown in Table 12. All of the randomness tests have been passed. Hence, the chaotic system of the proposed scheme is chaotic enough.Table 12
Test results of the sequences generated by the chaotic system with NIST SP800 suite.
TestsP value (xn)ResultsFrequency test0.5356076801062PassBlock frequency test0.2006251972896PassCusum-forward test0.1534611103969PassCusum-reverse test0.6665945788960PassRuns test0.5484500143314PassLongest run test0.2257749928343PassRank test0.2495050092582PassFFT test0.8695796767915PassNonoverlapping template test0.1578386990554PassOverlapping template test0.8425140482030PassUniversal test0.3708348754012PassApproximate entropy test0.5610349492218PassRandom-excursion test (x = -1)0.7857937272818PassRandom-excursion variant test (x = 1)0.2084575927756PassSerial1 test0.1392589354394PassSerial2 test0.5800257861316PassLinear complexity test0.4039596243759Pass


#### 4.11.2. NISTFIPS 140-2 Test Analysis

The test uses coin toss equation (23) proposed by Li et al. [48] to construct a bit sequence. Table 13 lists the randomness test results of the bit stream generated by the following different mappings and equation (23). For the bit stream generated by the chaotic map used by the algorithm, the mono bit test is 10,001. When the driving length is less than or equal to 2 or greater than or equal to 6, the run test cannot be satisfied. Other tests are satisfied. The algorithm used for pixel grey value transformation and the dynamic diffusion sequence is basically random:(23)bi=1,ei≥averageE,0,else,where E is a chaotic sequence generated by chaos iteration, ei is the i-th element in E, and averageE denotes average value of all elements in E.Table 13
Test results of the sequences generated by the chaotic system with FIPS 140-2 test suite.
FIPS 140-2 testTheoretical value2D-SLMM2D-HSMProposed in equation (4)Mono bit test9,725–10,72510,88810,03310,001Poker test2.16–46.17466.4896481.693012.9664Run test of length 1 for ‘0’2,315 - 2,685287436653285Run test of length 1 for ‘1’2,315 - 2,685422736843261Run test of length 2 for ‘0’1,114 - 1,386137217721384Run test of length 2 for ‘1’1,114 - 1,386181317781389Run test of length 3 for ‘0’527–723682909653Run test of length 3 for ‘1’527–7231093972642Run test of length 4 for ‘0’240–384414500318Run test of length 4 for ‘1’240–384487554327Run test of length 5 for ‘0’103–209221291150Run test of length 5 for ‘1’103–209333324144Run test of length 6 for ‘0’103–20915817378Run test of length 6 for ‘1’103–20918119575Longest run test≤26151512


### 4.12. Comparison Analysis

The proposed algorithm is compared with other existing algorithms to verify its performances. The comparison is based on the entropy, correlation coefficient, NPCR, UACI, and key space. The performance of algorithms is tabulated in Table14. By analysing the algorithms, the key space of the proposed algorithm is larger, and the maximum entropy is greater than some existing encryption algorithms [5, 11, 12, 36, 39, 49, 50]. The proposed method has achieved a strong resistance to differential, statistical, and brute force attack.Table 14
Performance comparisons.
MetricsHCVCDcNPCR (%)UACI (%)EntropyKeyspaceBanu et al. [5]0.00190.00340.001899.6833.477.99810128Liu et al. [11]0.00690.02160.003999.6033.447.99929< 2128Kumar et al. [12]0.08600.02400.020499.1432.544.74531060Lakshmi et al. [36]0.0037−0.00380.000699.633.417.9910112Chai et al. [39]−0.02930.0079−0.016099.6033.427.99911098Banu et al. [49]0.001630.002250.0006599.606733.477.997610206Rajagopalan et al. [50]0.00980.0051−0.0013——7.9972>2128Proposed0.00147.2233e− 40.000298.53632.107.999310120


## 4.1. Encryption and Decryption Effect and Analysis

The algorithm presented in this paper is used to encrypt the test image. The encryption and decryption results are shown in Figure7. The first column is plaintext images, the second is cipher image, and the third is decryption image. It can be seen the second column of Figure 7 that the cipher images appear noise-like. It also can be observed that the algorithm presented by this paper can effectively solve the obvious contour problem. From the third column of Figure 7, when the encryption and decryption keys are the same and the image is not tampered, the decryption algorithm can restore the original medical image without distortion.Figure 7
Samples of the original digitized image on the left, the cipher image on the middle, and the decrypted digitized medical image on the right.


## 4.2. Statistical Attack

Statistical attack mainly refers to illegal intruder trying to predict and analyse plaintext image and their encryption and decryption keys based on the distribution of pixel grey value. The analysis of statistical attack could be performed as correlation coefficient analysis and grey histogram analysis.


### 4.2.1. Correlation Coefficient Analysis

The correlation of adjacent pixels in an image refers to the relationship between two adjacent elements in the three directions of horizontal, vertical, and diagonal. It is specifically reflected by the covariance, with a range in interval−1,1. The correlation of adjacent pixels is proportional to the value of correlation coefficient. The closer the value of correlation coefficient to 1 indicates stronger correlation between image pixels. Otherwise the correlation is weak. The calculation of correlation coefficient is defined by(14)Dx=1n∑i=1nxi−Ex2,covx,y=1n∑i=1nxi−Exyi−Eyr=covx,yDxDy,,where Ex and Ey are the mathematical expectations of x and y, respectively, n is the number of pixels, covx,y is the covariance of x and y, and r is the correlation coefficient.Table1 shows the correlation coefficients of adjacent pixels of plaintext and cipher of some medical images. The correlation coefficients of adjacent pixels of plaintext of medical images are close to 1, while the correlation coefficients of adjacent pixels of cipher images tend to 0. It indicates that the adjacent pixels of plaintext image have strong correlation, and the adjacent pixels of cipher image are basically no longer correlated. The algorithm is effective for scrambling.Table 1
Correlation coefficient of the original images and its encrypted image.
ImagesDirectionCorrelation coefficientOriginal imageEncrypted imageCT (512 × 512)Horizontal0.98090.0012Vertical0.9597−1.8721e-04Diagonal0.94934.3539e-04MRI (512 × 512)Horizontal0.99130.0027Vertical0.9907−4.8855e-04Diagonal0.9829−7.9588e-04Ultrasound (512 × 512)Horizontal0.99663.4296e-04Vertical0.98896.9743e-04Diagonal0.98588.5018e-04X-ray (1024 × 1024)Horizontal0.9956−1.7713e-04Vertical0.99440.0015Diagonal0.99140.0016CT-kidney (1024 × 1024)Horizontal0.9984−0.0009Vertical0.9987−0.0017Diagonal0.99720.0006Figure8 shows the adjacent pixel distribution of the CT image and its encrypted image in the horizontal, vertical, and diagonal directions. It can be found that the pixels of the plaintext image are basically distributed around the diagonal, indicating that the correlation between adjacent pixels of the plaintext image is very strong, while the distribution of pixels of the cipher image is irregular. The correlation between adjacent pixels of the cipher image is low.Figure 8
(a, b) Original images and cipher images, (c, d) horizontal correlation of original images and cipher images, (e, f) vertical correlation of original images and cipher images, and (g, h) diagonal correlation of original images and cipher images.
(a)(b)(c)(d)(e)(f)(g)(h)


### 4.2.2. Histogram Analysis

Image histogram is one of the commonly used metrics for evaluating the robustness of the cipher algorithm against statistical attacks. The histogram is a graph drawn according to the frequency of each grey value in the image, which reflects the most basic statistical characteristics of the image. The histogram of encrypted images should be different from the histogram of original images and have uniform level grayscale values to resist the statistic attack. The first column of Figure9 is the original image of 4 medical images, the second column is the grey histogram of the original image, the third column is the grey histogram corresponding to the encrypted image, and the fourth column is the grey histogram corresponding to the decrypted image. The pixel distribution of the original medical image is uneven, while the pixel distribution of the encrypted medical image is uniform. The histogram of the original medical image is the same as that of the decrypted medical image, but they are completely different from that of the encrypted medical image. The histogram of encrypted images is resistant to statistical attack.Figure 9
(a) Original digitized image, histogram of (b) original digitized image, (c) cipher image, and (d) decrypted digitized medical image.
(a)(b)(c)(d)The histogram of encrypted image can also be analysed quantitatively by calculating the variance of original, encrypted, and decrypted images. The low value of variance shows high grayscale uniformity, and inversely, the high value of variance shows low grayscale uniformity. The variance can be calculated as(15)VarV=1M×N∑i=1M∑j=1Nvi−vj22,where V is the vector of all vi’s and vj’s, M×N is the size of the image, vi and vj are the number of pixels for a particular grayscale values i, and j is the testing image which are the values of the i-th and j-th bins of the corresponding histogram. VarV is the variance of array V.Table2 compares the variance of different plain images, the corresponding cipher images, and decryption images. In Table 2, the encrypted image variance is greatly differed from the original image. This shows that the histograms of encrypted images are different from the original. For each row, the variance of the encrypted image is much smaller than that of the original image. It shows that the histogram of the encrypted image has greater consistency. The decrypted image variance is equal to the original image. This shows that the original image and the decrypted image are the same, and there is no information loss during the encryption and decryption process. From this discussion, it could be concluded that the proposed algorithm is resistant to statistical attack.Table 2
Histogram variance of images using the proposed scheme.
Images (grey)OriginalEncryptedDecryptedCT (512 × 512)55231643.71091017.625055231643.7109MRI (512 × 512)23507412.33591031.742223507412.3359Ultrasound (512 × 512)21233944.16411058.054721233944.1641X-ray (1024 × 1024)6310177.80474175.56256310177.8047CT-kidney (1024 × 1024)24031572.71884102.835924031572.7188We further verify the uniformity of grayscale value distribution of encrypted images using the chi-square test. The low value of chi-square shows high uniformity. It is defined as(16)X2=∑i=1Lobsi−expi2expi,expi=M×NL,obsii=niM×N,where obsi is the observed frequency of i, ni is the total number of occurrences of i, expi is the expected frequency of i, M×N is the size of the image, and L is the grey level. Small value of X2 shows that the pixel distribution is uniform. The chi-square values for the test images are tabulated in Table 3. It is obvious that X2<Xth2256,0.05=293.247893 [33], reflecting the efficiency of the proposed cipher to conceal the spatial redundancy of the plain image.Table 3
Comparison of the chi-square value between our proposed approach and the other proposals.
ImagesSizeOriginalEncryptedDecryptedCT512 × 51213807910.9277254.406313807910.9277MRI512 × 5125876853.0840257.93555876853.0840Ultrasound512 × 5125308486.0410264.51375308486.0410X-ray1024 × 1024394386.1128260.9727394386.1128CT-kidney1024 × 10241501973.2949256.42721501973.2949


## 4.2.1. Correlation Coefficient Analysis

The correlation of adjacent pixels in an image refers to the relationship between two adjacent elements in the three directions of horizontal, vertical, and diagonal. It is specifically reflected by the covariance, with a range in interval−1,1. The correlation of adjacent pixels is proportional to the value of correlation coefficient. The closer the value of correlation coefficient to 1 indicates stronger correlation between image pixels. Otherwise the correlation is weak. The calculation of correlation coefficient is defined by(14)Dx=1n∑i=1nxi−Ex2,covx,y=1n∑i=1nxi−Exyi−Eyr=covx,yDxDy,,where Ex and Ey are the mathematical expectations of x and y, respectively, n is the number of pixels, covx,y is the covariance of x and y, and r is the correlation coefficient.Table1 shows the correlation coefficients of adjacent pixels of plaintext and cipher of some medical images. The correlation coefficients of adjacent pixels of plaintext of medical images are close to 1, while the correlation coefficients of adjacent pixels of cipher images tend to 0. It indicates that the adjacent pixels of plaintext image have strong correlation, and the adjacent pixels of cipher image are basically no longer correlated. The algorithm is effective for scrambling.Table 1
Correlation coefficient of the original images and its encrypted image.
ImagesDirectionCorrelation coefficientOriginal imageEncrypted imageCT (512 × 512)Horizontal0.98090.0012Vertical0.9597−1.8721e-04Diagonal0.94934.3539e-04MRI (512 × 512)Horizontal0.99130.0027Vertical0.9907−4.8855e-04Diagonal0.9829−7.9588e-04Ultrasound (512 × 512)Horizontal0.99663.4296e-04Vertical0.98896.9743e-04Diagonal0.98588.5018e-04X-ray (1024 × 1024)Horizontal0.9956−1.7713e-04Vertical0.99440.0015Diagonal0.99140.0016CT-kidney (1024 × 1024)Horizontal0.9984−0.0009Vertical0.9987−0.0017Diagonal0.99720.0006Figure8 shows the adjacent pixel distribution of the CT image and its encrypted image in the horizontal, vertical, and diagonal directions. It can be found that the pixels of the plaintext image are basically distributed around the diagonal, indicating that the correlation between adjacent pixels of the plaintext image is very strong, while the distribution of pixels of the cipher image is irregular. The correlation between adjacent pixels of the cipher image is low.Figure 8
(a, b) Original images and cipher images, (c, d) horizontal correlation of original images and cipher images, (e, f) vertical correlation of original images and cipher images, and (g, h) diagonal correlation of original images and cipher images.
(a)(b)(c)(d)(e)(f)(g)(h)


## 4.2.2. Histogram Analysis

Image histogram is one of the commonly used metrics for evaluating the robustness of the cipher algorithm against statistical attacks. The histogram is a graph drawn according to the frequency of each grey value in the image, which reflects the most basic statistical characteristics of the image. The histogram of encrypted images should be different from the histogram of original images and have uniform level grayscale values to resist the statistic attack. The first column of Figure9 is the original image of 4 medical images, the second column is the grey histogram of the original image, the third column is the grey histogram corresponding to the encrypted image, and the fourth column is the grey histogram corresponding to the decrypted image. The pixel distribution of the original medical image is uneven, while the pixel distribution of the encrypted medical image is uniform. The histogram of the original medical image is the same as that of the decrypted medical image, but they are completely different from that of the encrypted medical image. The histogram of encrypted images is resistant to statistical attack.Figure 9
(a) Original digitized image, histogram of (b) original digitized image, (c) cipher image, and (d) decrypted digitized medical image.
(a)(b)(c)(d)The histogram of encrypted image can also be analysed quantitatively by calculating the variance of original, encrypted, and decrypted images. The low value of variance shows high grayscale uniformity, and inversely, the high value of variance shows low grayscale uniformity. The variance can be calculated as(15)VarV=1M×N∑i=1M∑j=1Nvi−vj22,where V is the vector of all vi’s and vj’s, M×N is the size of the image, vi and vj are the number of pixels for a particular grayscale values i, and j is the testing image which are the values of the i-th and j-th bins of the corresponding histogram. VarV is the variance of array V.Table2 compares the variance of different plain images, the corresponding cipher images, and decryption images. In Table 2, the encrypted image variance is greatly differed from the original image. This shows that the histograms of encrypted images are different from the original. For each row, the variance of the encrypted image is much smaller than that of the original image. It shows that the histogram of the encrypted image has greater consistency. The decrypted image variance is equal to the original image. This shows that the original image and the decrypted image are the same, and there is no information loss during the encryption and decryption process. From this discussion, it could be concluded that the proposed algorithm is resistant to statistical attack.Table 2
Histogram variance of images using the proposed scheme.
Images (grey)OriginalEncryptedDecryptedCT (512 × 512)55231643.71091017.625055231643.7109MRI (512 × 512)23507412.33591031.742223507412.3359Ultrasound (512 × 512)21233944.16411058.054721233944.1641X-ray (1024 × 1024)6310177.80474175.56256310177.8047CT-kidney (1024 × 1024)24031572.71884102.835924031572.7188We further verify the uniformity of grayscale value distribution of encrypted images using the chi-square test. The low value of chi-square shows high uniformity. It is defined as(16)X2=∑i=1Lobsi−expi2expi,expi=M×NL,obsii=niM×N,where obsi is the observed frequency of i, ni is the total number of occurrences of i, expi is the expected frequency of i, M×N is the size of the image, and L is the grey level. Small value of X2 shows that the pixel distribution is uniform. The chi-square values for the test images are tabulated in Table 3. It is obvious that X2<Xth2256,0.05=293.247893 [33], reflecting the efficiency of the proposed cipher to conceal the spatial redundancy of the plain image.Table 3
Comparison of the chi-square value between our proposed approach and the other proposals.
ImagesSizeOriginalEncryptedDecryptedCT512 × 51213807910.9277254.406313807910.9277MRI512 × 5125876853.0840257.93555876853.0840Ultrasound512 × 5125308486.0410264.51375308486.0410X-ray1024 × 1024394386.1128260.9727394386.1128CT-kidney1024 × 10241501973.2949256.42721501973.2949


## 4.3. Global Information Entropy Analysis

Global information entropy is an important index used to measure whether the grey value distribution is uniform in an image. The greater the global information entropy of the image, the more uniform the grey value distribution of the image, and the greater the possibility of resisting entropy attacks. The theoretical global entropy value of the original random image with 256 grey levels is 8. The global information entropy of the image in the algorithm is calculated by [34](17)HG=∑i=1L−1PGilog21PGi,where Gi is the grey value of the image pixels, PGi is the probability of Gi appearing in the image, and L is the grey level.Table4 shows the global entropy values of different medical plaintext images and the corresponding global entropy values of encrypted cipher images. The global entropy values of original images are in the 4-th column. All of them are smaller than 8, which means that the original images are meaningful. The last column of Table 4 presents the global entropy values of encrypted images by the proposed algorithm. The values are close to 8, which means that the encrypted images are more random-like.Table 4
Global entropy values of different images.
ImagesTypeSizeGlobal entropy valuesOrig. imageEncrypted imageCTGrey512×5124.81507.9993MRIGrey512×5125.46727.9993UltrasoundGrey512×5126.29477.9993X-rayGrey1024×10247.67447.9998CT-kidneyGrey1024×10247.04757.9998


### 4.3.1. Local Shannon Entropy Analysis

The global information entropy is unfair for the comparisons between images of different sizes, and failure to discern image randomness before and after image shuffling. Local Shannon entropy overcomes these weaknesses of the global Shannon entropy. It measures the exact randomness of pixels in encrypted images [6]. It is the mean value of entropy of several nonoverlapping blocks of the image. The local Shannon entropy is defined as [35](18)Hk,TBS¯=∑i=1kHSik,where k is the number of nonoverlapping blocks of an information source S, TB is the total number of pixels in each of the nonoverlapping blocks, and S1,S2,…,Sk are the nonoverlapping blocks having information entropies HS1,HS2,…,HSk, respectively.In this paper, we set the number of nonoverlapping blocksk=30 and the total number of pixels in each of the block TB=1936. The k,TB-local Shannon entropy is used as the measurement describing the randomness over the entire test image. The local entropy also has optimal value for various significance levels such as 5%, 1%, and 0.1% [36]. Table 5 provides the acceptance interval of the local entropy test under various significance levels of the proposed algorithm. The local Shannon entropy value of all the images is within the range of acceptance interval of 0.05, 0.01, and 0.001 significance levels. This proves the high randomness of pixel values in the encrypted images using the proposed scheme. Table 6 presents the obtained experimental values for different cipher images, and they come from the existing method and our method, respectively. It is obvious that these values are extremely nearby to the maximum value of 8. It indicates the information leakage from the proposed cipher algorithm insignificant.Table 5
Local Shannon entropy values of different images.
Images (grey)SizeLocal Shannon entropy (reference range) [37, 38]Local Shannon entropyResultCT512 × 512α = 0.05 (7.901901305,7.903037329)7.9024PassMRI512 × 512α = 0.01 (7.901722822,7.903215812) α = 0.001 (7.901515698,7,903422936)7.9030PassUltrasound512 × 5127.9028PassX-ray1024 × 10247.9030PassCT-kidney1024 × 10247.9027PassTable 6
Comparison of information entropy results.
AlgorithmsImagesGlobal Shannon entropyLocal Shannon entropy (k=30TB=1936)OursCT7.99937.9024MRI7.99937.9030Ultrasound7.99937.9028X-ray7.99987.9030Ravichandran et al. [6]MR_17.99927.9020CT_17.99937.9023Chai et al. [39]Brone7.99947.9015


## 4.3.1. Local Shannon Entropy Analysis

The global information entropy is unfair for the comparisons between images of different sizes, and failure to discern image randomness before and after image shuffling. Local Shannon entropy overcomes these weaknesses of the global Shannon entropy. It measures the exact randomness of pixels in encrypted images [6]. It is the mean value of entropy of several nonoverlapping blocks of the image. The local Shannon entropy is defined as [35](18)Hk,TBS¯=∑i=1kHSik,where k is the number of nonoverlapping blocks of an information source S, TB is the total number of pixels in each of the nonoverlapping blocks, and S1,S2,…,Sk are the nonoverlapping blocks having information entropies HS1,HS2,…,HSk, respectively.In this paper, we set the number of nonoverlapping blocksk=30 and the total number of pixels in each of the block TB=1936. The k,TB-local Shannon entropy is used as the measurement describing the randomness over the entire test image. The local entropy also has optimal value for various significance levels such as 5%, 1%, and 0.1% [36]. Table 5 provides the acceptance interval of the local entropy test under various significance levels of the proposed algorithm. The local Shannon entropy value of all the images is within the range of acceptance interval of 0.05, 0.01, and 0.001 significance levels. This proves the high randomness of pixel values in the encrypted images using the proposed scheme. Table 6 presents the obtained experimental values for different cipher images, and they come from the existing method and our method, respectively. It is obvious that these values are extremely nearby to the maximum value of 8. It indicates the information leakage from the proposed cipher algorithm insignificant.Table 5
Local Shannon entropy values of different images.
Images (grey)SizeLocal Shannon entropy (reference range) [37, 38]Local Shannon entropyResultCT512 × 512α = 0.05 (7.901901305,7.903037329)7.9024PassMRI512 × 512α = 0.01 (7.901722822,7.903215812) α = 0.001 (7.901515698,7,903422936)7.9030PassUltrasound512 × 5127.9028PassX-ray1024 × 10247.9030PassCT-kidney1024 × 10247.9027PassTable 6
Comparison of information entropy results.
AlgorithmsImagesGlobal Shannon entropyLocal Shannon entropy (k=30TB=1936)OursCT7.99937.9024MRI7.99937.9030Ultrasound7.99937.9028X-ray7.99987.9030Ravichandran et al. [6]MR_17.99927.9020CT_17.99937.9023Chai et al. [39]Brone7.99947.9015


## 4.4. Differential Attack

Differential attack means that the attacker can extract the information of the original image through the research of the cipher image. It is analysed and verified by the unified average change intensity (UACI) and the number of changing pixel rate (NPCR). NPCR measures the number of changed pixel values between the two encrypted images by changing one pixel value in the original image. The range of NPCR is0,1. It is defined as equation (19). UACI measures the average changing intensity between the two encrypted images by changing one pixel value in the original image. The range of UACI is 0,1 as well, which is defined in equation (20):(19)NPCR=∑i=1M∑j=1NDi,jM×N,Di,j=0,ci,j=c′i,j,1,ci,j≠c′i,j,(20)UACI=∑i=1M∑j=1Nci,j−c′i,j/L−1M×N,where M and N are, respectively, the width and height of the medical image, L is the grey level, and ci,j and ci,j′ are the encrypted image and the encrypted image corresponding after changing a pixel grayscale value, respectively.In this section, we randomly change the value of a pixel in a grayscale image, and Tables7 and 8 show the NPCR and UACI results of the test image, respectively. The optimal value of NPCR and UACI is related to the size and type of the image. Wu et al. [40] proposed the theoretical critical value of NPCR and UACI. In Tables 7 and 8, the NPCR and UACI values of all images are slightly below the critical value. This indicates that the protection against differential attacks of the proposed scheme is not very strong. We will work on this problem in our future study.Table 7
NPCR results for test images.
Tested image size M-by-N 512-by-512NPCR critical value [40]N0.05∗=99.5893%N0.01∗=99.5810%N0.001∗=99.5717%NameNPCR (%)NPCR test results0.05-level0.01-level0.001-levelCT98.6767FailFailFailMRI98.2585FailFailFailUltrasound98.6725FailFailFailTested image size M-by-N 1024-by-1024NPCR critical value [40]N0.05∗=99.5994%N0.01∗=99.5952%N0.001∗=99.5906%Name (size)NPCR (%)NPCR test results0.05-level0.05-level0.05-levelX-ray98.2576FailFailFailCT-kidney98.7677FailFailFailTable 8
UACI results for test images.
Tested image size M-by-N 512-by-512UACI critical value [40]N0.05∗−=33.3730%N0.01∗−=33.3445%N0.001∗−=33.3115%N0.05∗+=33.5541%N0.01∗+=33.5826%N0.001∗+=33.6156%NameUACI (%)UACI test results0.05-level0.01-level0.001-levelCT32.3884FailFailFailMRI31.4729FailFailFailUltrasound32.4262FailFailFailTested image size M-by-N 1024-by-1024UACI critical value [40]N0.05∗−=33.4183%N0.01∗−=33.4040%N0.001∗−=33.3875%N0.05∗+=33.5088%N0.01∗+=33.5231%N0.001∗+=33.5396%Name (size)UACI(%)UACI test results0.05-level0.05-level0.05-levelX-ray31.5516FailFailFailCT-kidney32.8412FailFailFail


## 4.5. Mean Square Error (MSE) and Peak Signal-to-Noise Ratio (PSNR) Analysis

Mean square error (MSE) measures the difference between original and encrypted images. And also it measures the difference between original and decrypted images. Greater value of MSE indicates greater difference between two images [41]. It can be calculated as(21)MSEOC=1M×N∑i=0N−1∑j=0M−1Oi,j−Ci,j2,MSEOD=1M×N∑i=0N−1∑j=0M−1Oi,j−Di,j2,where M is the width and N is the height of the image. Oi,j, Ci,j, and Di,j represent the pixel grey value of the plaintext image, the cipher image, and the decrypted image in the i-th row and j-th column, respectively.Peak signal-to-noise ratio (PSNR) measures the fidelity of an image [41]. Smaller value of PSNR indicates greater difference between original and encrypted images [41]. The mathematical expression for the calculation of PSNR is given in(22)PSNROC=20×log10MAXIMSEOC,PSNROD=20×log10MAXIMSEOD,where MAXI represents the pixel grey level of the image. MSEOC is the MSE between the original image and the encrypted image, and MSEOD is the MSE between the original image and the decrypted image. Table 9 presents the MSE and PSNR results of the test images. The results show that there is a great difference between the original image and the encrypted image, and no difference between the original image and the decrypted image. The large MSEOC value proves that the proposed scheme is secure and robust against different statistical attacks.Table 9
MSE and PSNR results of the test images using the proposed schemes.
ImagesSizeMSEOCMSEODPSNROCPSNROECT512 × 51217124.062605.7947∞MRI512 × 51216892.886505.8538∞Ultrasound512 × 51213338.427506.8798∞X-ray1024 × 102410290.187608.0066∞CT-kidney1024 × 102410039.202508.1138∞


## 4.6. Exhaustive Attack

### 4.6.1. Key Space Analysis

With the rapid development of computer technology, the key space of encryption algorithms must be large enough to withstand exhaustive attacks, and a key space of 2128 or more is required for an algorithm [42]. The secret keys involved in this algorithm have three parts: 4 initial values needed to generate the chaotic sequence, 2 secret keys needed to generate the cat map control coefficient, and 2 initial values used for dynamic diffusion. The whole system is under the condition of double precision, grey value of 256, and 64 bit Windows7 Operating System. According to the IEEE floating point standard, the calculation precision of 64 bit double data is 1015 [43]. So, the secret key space of the algorithm can be reached 10158=10120. The algorithm has a large enough secret key space. It is computationally unfeasible to crack the secret key by exhaustive search.


### 4.6.2. Key Sensitivity Analysis

Secret key sensitivity ensures that the attacker cannot use a secret key close to the actual secret key to decrypt the original image. Any small change in the secret key should get very different encryption results. There are 8 security keys in our scheme, which are the initial valuesx0, y0, w0, and z0 of the chaotic system in equation (4), the parameters m1 and m2 in equation (5), and the parameters m3 and m4 in equation (10). The 8 security keys are slightly changed according to the following rules. One of secret key is updated by Δk and other keys unchanged. Due to the selection of the initial values x0, y0, w0, and z0 during the test is in the range of 0,1, Δk is selected as 0.001. Since m1, m2, m3, and m4 are random positive integers, the Δk is ±1.In order to analyse the key sensitivity, NPCR and UACI are calculated to evaluate the difference between cipher text images. The original medical image is encrypted using the key distributed as the same as before, and the corresponding cipher image is denoted asC. Then, we use the modified keys k′=k+Δk to encrypt the original image and denote the generated cipher as C″. Some of the test results are shown in Figure 10, and the NPCR and UACI between the cipher text images generated by two security keys with only 1 bit difference are shown in Table 10. The results clearly show that the proposed image cryptosystem has sufficient key sensitivity.Figure 10
Key sensitivity analysis ofx0. (a), (e), (l), and (o) original images, (b), (f), (m), and (p) cipher images C, (c), (g), (i), and (q) cipher images C″, and (d), (h), (n), and (r) images of C−C″.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)Table 10
Results of NPCR and UACI between cipher text images.
Cipher imagex0=106y0=0.204w0=0.301z0=0.203m1=2m2=3m3=4m4=3x0′=107y0=0.205w0=0.302z0=0.204m1=3m2=4m3=5m4=4CTNPCR (%)99.615599.614099.608699.634998.658498.179699.617099.6071UACI (%)33.461933.449733.395033.528832.578331.950033.428033.4726X-rayNPCR (%)99.615399.594999.613099.599298.995298.543199.614099.6110UACI (%)33.495433.465333.446733.472833.297332.680633.459033.4543


## 4.6.1. Key Space Analysis

With the rapid development of computer technology, the key space of encryption algorithms must be large enough to withstand exhaustive attacks, and a key space of 2128 or more is required for an algorithm [42]. The secret keys involved in this algorithm have three parts: 4 initial values needed to generate the chaotic sequence, 2 secret keys needed to generate the cat map control coefficient, and 2 initial values used for dynamic diffusion. The whole system is under the condition of double precision, grey value of 256, and 64 bit Windows7 Operating System. According to the IEEE floating point standard, the calculation precision of 64 bit double data is 1015 [43]. So, the secret key space of the algorithm can be reached 10158=10120. The algorithm has a large enough secret key space. It is computationally unfeasible to crack the secret key by exhaustive search.


## 4.6.2. Key Sensitivity Analysis

Secret key sensitivity ensures that the attacker cannot use a secret key close to the actual secret key to decrypt the original image. Any small change in the secret key should get very different encryption results. There are 8 security keys in our scheme, which are the initial valuesx0, y0, w0, and z0 of the chaotic system in equation (4), the parameters m1 and m2 in equation (5), and the parameters m3 and m4 in equation (10). The 8 security keys are slightly changed according to the following rules. One of secret key is updated by Δk and other keys unchanged. Due to the selection of the initial values x0, y0, w0, and z0 during the test is in the range of 0,1, Δk is selected as 0.001. Since m1, m2, m3, and m4 are random positive integers, the Δk is ±1.In order to analyse the key sensitivity, NPCR and UACI are calculated to evaluate the difference between cipher text images. The original medical image is encrypted using the key distributed as the same as before, and the corresponding cipher image is denoted asC. Then, we use the modified keys k′=k+Δk to encrypt the original image and denote the generated cipher as C″. Some of the test results are shown in Figure 10, and the NPCR and UACI between the cipher text images generated by two security keys with only 1 bit difference are shown in Table 10. The results clearly show that the proposed image cryptosystem has sufficient key sensitivity.Figure 10
Key sensitivity analysis ofx0. (a), (e), (l), and (o) original images, (b), (f), (m), and (p) cipher images C, (c), (g), (i), and (q) cipher images C″, and (d), (h), (n), and (r) images of C−C″.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)Table 10
Results of NPCR and UACI between cipher text images.
Cipher imagex0=106y0=0.204w0=0.301z0=0.203m1=2m2=3m3=4m4=3x0′=107y0=0.205w0=0.302z0=0.204m1=3m2=4m3=5m4=4CTNPCR (%)99.615599.614099.608699.634998.658498.179699.617099.6071UACI (%)33.461933.449733.395033.528832.578331.950033.428033.4726X-rayNPCR (%)99.615399.594999.613099.599298.995298.543199.614099.6110UACI (%)33.495433.465333.446733.472833.297332.680633.459033.4543


## 4.7. Classical Types of Attacks

According to the attacker’s acquisition of information, cryptanalysis can be divided into four categories [33]:Cipher only. The attacker only knows part of the encrypted text.Known plaintext. The attacker has obtained some given plaintext and corresponding cipher.Chosen plaintext. The attacker not only knows the encryption algorithm but also can select the plaintext message and can get the corresponding encrypted cipher.Chosen cipher. The attacker has access to the decryption machine and can construct the plaintext corresponding to any cipher.The most powerful attack is to chosen plaintext attack. If a cryptographic system is resistant to this kind of attack, then it is resistant other types of attacks.The sensitivity of the proposed algorithm to the initial parameters (m1, m2, m3, and m4) and the initial values (x0, y0, w0, z0) has been verified in detail in Section 4.6.2. If one of them is changed, the chaotic sequence, the cat mapping coefficient matrix, and the pseudorandom integer sequence will be completely different. In addition, in the dynamic diffusion stage, the encrypted value is not only related to the original pixel grey value and the key, but also related to the previous original value and the previous encrypted value. Different encrypted images have different chaotic iterations and cipher feedback. Therefore, the proposed algorithm is resistant to chosen plaintext attack.


## 4.8. Robustness to Noise and Data Loss

When the encrypted medical images are transmitted or stored via the network, they are easily contaminated by various noises, and data loss is extremely likely to occur. Image encryption algorithms should be robust against noise and data loss. In the proposed algorithm, the encryption and decryption processes are symmetrical. During the encryption process, a change in one pixel in the plaintext image will affect multiple pixels in the ciphertext image. In the decryption process, the change of one pixel in the ciphertext image also affects multiple pixels in the plaintext image. Therefore, the proposed algorithm has an avalanche effect. Figure11 shows the robustness analysis results of the proposed algorithm against noise and data loss. When the ciphertext image is contaminated by salt and pepper noise or data lost, the decryption process can recover part of the original image. Although there is some noise in the restored image, we can still identify most of the image information. When the ciphertext image is contaminated by Gaussian noise or speckle noise, the decryption process of the proposed algorithm cannot restore the original image. The novel encryption algorithm is sensitive to noise and data loss. We will work on this problem in our future study.Figure 11
Robustness analysis results of noise and the data loss. (a) The ciphertext imageC and its decrypted image; (b) the ciphertext image C1 with 0.0005% salt and pepper noise and its decrypted result; (c) the ciphertext image C2 with 0.0005% Gaussian noise and its decrypted result; (d) the ciphertext image C3 with 0.0005% speckle noise and its decrypted result; (e) the ciphertext image C4 with 0.390625% data loss and its decrypted result; (f) the ciphertext image C5 with 1.5625% data loss and its decrypted result.
(a)(b)(c)(d)(e)(f)


## 4.9. Computational Complexity Analysis

The time-consuming parts of the proposed encryption algorithm are the generation of chaotic sequences, permutation operations, pixel grey value transformation, and diffusion operations. In the permutation stage, the time complexity of the first round of cross-ranking scrambling isΘM/2 and ΘN/2. The time complexity of the second round of scanning using zigzag is ΘM×N−1. In the chaotic sequence generation stage, two two-dimensional maps are used to form a new chaotic system. The time complexity of generating the chaotic sequence is Θ4×M×N. In the phase of pixel grey value transformation, the time complexity of adopting cat mapping transformation is ΘM×N/2. In the diffusion stage, the dynamic diffusion operation is adopted the same time, and its time complexity is ΘM×N. The total time complexity of the proposed algorithm is Θ4×M×N.


## 4.10. Computational Time Analysis

The efficiency of an encryption algorithm refers to the running speed of the algorithm. Table11 shows the time taken for the encrypting and decrypting of 5 test images, and the data of which are the average value obtained by performing 11 times on the image. The data in Table 11 reflect that the time required for the proposed algorithm to encrypt a medical image with a size of 512×512 is about 1.3s, and the time it takes to encrypt a size of 1024×1024 is about 5s.Table 11
Results for total encryption time and decryption time using the proposed algorithm.
ImagesTypeSizeEncryption time (seconds)Decryption time (seconds)CTGrey512 × 5121.29331.1230MRIGrey512 × 5121.27061.0865UltrasoundGrey512 × 5121.28021.1032X-rayGrey1024 × 10245.08804.4282CT-kidneyGrey1024 × 10245.09384.4502


## 4.11. Random Analysis

In the proposed method, a chaotic system is used to iteratively generate sequences for pixel grey value transformation and dynamic diffusion. In order to prove the effectiveness of the algorithm, a comprehensive statistical randomness test is performed on this subsection. The National Institute of Standards and Technology (NIST) statistical test suite [44] and the standard randomness test FIPS 140-2 [45] are employed for analysis.


### 4.11.1. NIST Analysis

The National Institute of Standards and Technology (NIST) is a United States (US) based company that provides guidelines for the protection of data. The NIST has outlined 15 significant statistical tests for cryptographic applications, which are used to determine the strength of any cryptographic algorithm and estimate the actual randomness produced by the system [46, 47]. The test was applied to the chaotic system of the proposed algorithm. And the results are shown in Table 12. All of the randomness tests have been passed. Hence, the chaotic system of the proposed scheme is chaotic enough.Table 12
Test results of the sequences generated by the chaotic system with NIST SP800 suite.
TestsP value (xn)ResultsFrequency test0.5356076801062PassBlock frequency test0.2006251972896PassCusum-forward test0.1534611103969PassCusum-reverse test0.6665945788960PassRuns test0.5484500143314PassLongest run test0.2257749928343PassRank test0.2495050092582PassFFT test0.8695796767915PassNonoverlapping template test0.1578386990554PassOverlapping template test0.8425140482030PassUniversal test0.3708348754012PassApproximate entropy test0.5610349492218PassRandom-excursion test (x = -1)0.7857937272818PassRandom-excursion variant test (x = 1)0.2084575927756PassSerial1 test0.1392589354394PassSerial2 test0.5800257861316PassLinear complexity test0.4039596243759Pass


### 4.11.2. NISTFIPS 140-2 Test Analysis

The test uses coin toss equation (23) proposed by Li et al. [48] to construct a bit sequence. Table 13 lists the randomness test results of the bit stream generated by the following different mappings and equation (23). For the bit stream generated by the chaotic map used by the algorithm, the mono bit test is 10,001. When the driving length is less than or equal to 2 or greater than or equal to 6, the run test cannot be satisfied. Other tests are satisfied. The algorithm used for pixel grey value transformation and the dynamic diffusion sequence is basically random:(23)bi=1,ei≥averageE,0,else,where E is a chaotic sequence generated by chaos iteration, ei is the i-th element in E, and averageE denotes average value of all elements in E.Table 13
Test results of the sequences generated by the chaotic system with FIPS 140-2 test suite.
FIPS 140-2 testTheoretical value2D-SLMM2D-HSMProposed in equation (4)Mono bit test9,725–10,72510,88810,03310,001Poker test2.16–46.17466.4896481.693012.9664Run test of length 1 for ‘0’2,315 - 2,685287436653285Run test of length 1 for ‘1’2,315 - 2,685422736843261Run test of length 2 for ‘0’1,114 - 1,386137217721384Run test of length 2 for ‘1’1,114 - 1,386181317781389Run test of length 3 for ‘0’527–723682909653Run test of length 3 for ‘1’527–7231093972642Run test of length 4 for ‘0’240–384414500318Run test of length 4 for ‘1’240–384487554327Run test of length 5 for ‘0’103–209221291150Run test of length 5 for ‘1’103–209333324144Run test of length 6 for ‘0’103–20915817378Run test of length 6 for ‘1’103–20918119575Longest run test≤26151512


## 4.11.1. NIST Analysis

The National Institute of Standards and Technology (NIST) is a United States (US) based company that provides guidelines for the protection of data. The NIST has outlined 15 significant statistical tests for cryptographic applications, which are used to determine the strength of any cryptographic algorithm and estimate the actual randomness produced by the system [46, 47]. The test was applied to the chaotic system of the proposed algorithm. And the results are shown in Table 12. All of the randomness tests have been passed. Hence, the chaotic system of the proposed scheme is chaotic enough.Table 12
Test results of the sequences generated by the chaotic system with NIST SP800 suite.
TestsP value (xn)ResultsFrequency test0.5356076801062PassBlock frequency test0.2006251972896PassCusum-forward test0.1534611103969PassCusum-reverse test0.6665945788960PassRuns test0.5484500143314PassLongest run test0.2257749928343PassRank test0.2495050092582PassFFT test0.8695796767915PassNonoverlapping template test0.1578386990554PassOverlapping template test0.8425140482030PassUniversal test0.3708348754012PassApproximate entropy test0.5610349492218PassRandom-excursion test (x = -1)0.7857937272818PassRandom-excursion variant test (x = 1)0.2084575927756PassSerial1 test0.1392589354394PassSerial2 test0.5800257861316PassLinear complexity test0.4039596243759Pass


## 4.11.2. NISTFIPS 140-2 Test Analysis

The test uses coin toss equation (23) proposed by Li et al. [48] to construct a bit sequence. Table 13 lists the randomness test results of the bit stream generated by the following different mappings and equation (23). For the bit stream generated by the chaotic map used by the algorithm, the mono bit test is 10,001. When the driving length is less than or equal to 2 or greater than or equal to 6, the run test cannot be satisfied. Other tests are satisfied. The algorithm used for pixel grey value transformation and the dynamic diffusion sequence is basically random:(23)bi=1,ei≥averageE,0,else,where E is a chaotic sequence generated by chaos iteration, ei is the i-th element in E, and averageE denotes average value of all elements in E.Table 13
Test results of the sequences generated by the chaotic system with FIPS 140-2 test suite.
FIPS 140-2 testTheoretical value2D-SLMM2D-HSMProposed in equation (4)Mono bit test9,725–10,72510,88810,03310,001Poker test2.16–46.17466.4896481.693012.9664Run test of length 1 for ‘0’2,315 - 2,685287436653285Run test of length 1 for ‘1’2,315 - 2,685422736843261Run test of length 2 for ‘0’1,114 - 1,386137217721384Run test of length 2 for ‘1’1,114 - 1,386181317781389Run test of length 3 for ‘0’527–723682909653Run test of length 3 for ‘1’527–7231093972642Run test of length 4 for ‘0’240–384414500318Run test of length 4 for ‘1’240–384487554327Run test of length 5 for ‘0’103–209221291150Run test of length 5 for ‘1’103–209333324144Run test of length 6 for ‘0’103–20915817378Run test of length 6 for ‘1’103–20918119575Longest run test≤26151512


## 4.12. Comparison Analysis

The proposed algorithm is compared with other existing algorithms to verify its performances. The comparison is based on the entropy, correlation coefficient, NPCR, UACI, and key space. The performance of algorithms is tabulated in Table14. By analysing the algorithms, the key space of the proposed algorithm is larger, and the maximum entropy is greater than some existing encryption algorithms [5, 11, 12, 36, 39, 49, 50]. The proposed method has achieved a strong resistance to differential, statistical, and brute force attack.Table 14
Performance comparisons.
MetricsHCVCDcNPCR (%)UACI (%)EntropyKeyspaceBanu et al. [5]0.00190.00340.001899.6833.477.99810128Liu et al. [11]0.00690.02160.003999.6033.447.99929< 2128Kumar et al. [12]0.08600.02400.020499.1432.544.74531060Lakshmi et al. [36]0.0037−0.00380.000699.633.417.9910112Chai et al. [39]−0.02930.0079−0.016099.6033.427.99911098Banu et al. [49]0.001630.002250.0006599.606733.477.997610206Rajagopalan et al. [50]0.00980.0051−0.0013——7.9972>2128Proposed0.00147.2233e− 40.000298.53632.107.999310120


## 5. Conclusions

Based on the analysis of existing methods, this paper fully considers the characteristics of medical images. A medical image encryption based on 2D zigzag scan and dynamic diffusion is proposed. This method mainly uses zigzag scan, improved cat map, and dynamic diffusion algorithm. With the help of feedback mechanism and chaotic iteration, the diffusion performance of the algorithm is improved, and the contour problem in the encrypted image is solved. The performance analysis illustrates that the proposed algorithm enhances the security level and it is resistant to differential, exhaustive, and statistical attacks.



---

*Source: 6624809-2021-05-08.xml*