Robust watermarking of airborne LiDAR data

Article
  • 17 Downloads

Abstract

This paper presents a novel robust approach developed specially for watermarking airborne LiDAR data, which consist of a large cloud of geo-referenced points and has some unique characteristics. The approach consists of the following steps: (1) Defining the marker circular areas, in which the watermark bit will be embedded; (2) Dividing the marker circular areas uniformly into smaller circular areas by applying the sunflower seed distribution algorithm; (3) Using the points in these smaller circular areas to construct the input values for the Discrete Cosine Transformation (DCT); (4) Changing the last DCT coefficient; (5) Perform Inverse Discrete Cosine Transformation (IDCT), and perturbing the points within smaller circular areas according to the output values from this inverse transformation. Applying our approach, the watermark was dispersed into a set of points within the marker circular areas. The watermark bits are embedded multiple times in different marker circular areas. Thus, the robustness of the watermark was increased against various attacks. The watermark extraction process is practically the same, except in the final step, in which only the sign of each last DCT coefficient is checked, and decisions are made about the value of the watermark bits. Several experiments were performed to analyse the robustness of our watermarking schema against the most probable attacks.

Keywords

3D point-sampled geometry Digital watermarking Security 3D point cloud authentication and identification Data hiding Light Detection And Ranging (LiDAR) 

1 Introduction

Light Detection And Ranging (LiDAR) is an active remote sensing technology that can obtain the positions of points on the Earth’s surface from which a laser pulse was reflected accurately [30]. The LiDAR systems are mounted mostly on an airplane and collect a large amount of geo-referenced points (up to 200,000 points per second), which are usually stored in a standardised exchange data format known as the LAS file [3]. The typical size of the LAS file is from a few 100 Megabytes to over 1 Gigabyte and, therefore, domain-specific compression techniques have been developed [11, 16, 17, 21]. The number of points recorded varies, but can reach up to 30 million points per one LAS file. The coordinates and various other associated scalar attributes are stored for each point. Only the latitudes (x coordinates) and the longitudes (y coordinates) of the points are considered in the proposed watermarking approach.

Because the process of gathering the LiDAR data is costly, these data have a high commercial value; thus, they should be protected effectively and robustly against different unintended, and also malicious, attacks that can break the watermarking scheme. The proposed watermarking scheme can be used for the copyright protection and the data source tracking.

The following attacks are most likely to occur: A random perturbation by a noise, a random removal of points, different cropping attacks, a simplification by down-sampling, and a random rearrangement of the points. Because the LiDAR points are geo-referenced (and represent actual physical locations) the affine transformations, such as scaling, rotating, and translating, are less likely to occur, except maybe only translations of the z coordinates. The points that would be moved by the affine transformations (such as translation and rotation), for example, 200 m away from the actual geographical position and oriented differently, would be practically useless (see Fig. 1). In contrast, 3D point model can be positioned in various coordinate systems in different location.
Fig. 1

Affine transformation attacks can produce totally useless data (see the area on the right within the smaller rectangle)

Although various watermarking techniques have been developed somehow independently for each type of digital data, they share some basic principles and characteristics [6, 7, 31].The digital watermarking requires balancing between robustness (i.e. protecting data against various attacks) and visibility (i.e. the visual degradation of the data has to be minimised). Thus, our method can be characterised as imperceptible (watermarked data are perceptually identical according to the original data), frequency domain-based (the DCT is applied), and private (the locations of the watermark are not known to everyone). The blind watermarking scheme was developed because it is very impractical to transfer huge amounts of original data around for watermark extraction. As the original data and the watermarked (and possibly attacked point cloud) are always at the same or similar position in the identical coordinate system, they are not needed for watermark extraction. Thus, only the size of the watermark is needed as a parameter for watermark extraction.

This paper is organised as follows: Section 2 gives the research background. Section 3 considers our method. The experimental results are presented and discussed in Section 4. Finally, we conclude the paper in Section 5.

2 Background

Digital watermarking is a well-known research topic, usually applied on multimedia data, such as images, audio, and video [6, 31]. Some work was reported on 3D models represented by triangular, quadrangular or arbitrary connected meshes [7, 8, 9], too. However, they are less related to our approach. A comprehensive survey can also be found in [36]. The research on digital watermarking of point-sampled 3D geometry with no connectivity information, described below, has been rare. Moreover, they are developed for a relatively small number of points, and they include preprocessing steps for determining missing topological information. Such preprocessing are computationally intensive for a huge number of points, such as LiDAR data. Only one paper considers the watermarking of LiDAR data up to date. Rames et al. presented a fractal scheme for blind watermarking [27]. Their method embeds the watermark by searching similar patterns. Encoding is accomplished through a look-up table. They used a General-Purpose Graphics Processing Unit (GPGPU) to perform computational intensive searching of similar fractal patterns and processing a huge amount of points. Although their fractal method displaces the positions minimally, the authors claimed that their method was fragile. Actually, they did not analyse, for example, an attack by the noise that can change the points coordinates significantly. Thus, it would be very hard to find the same similarities between fractal patterns.

The data-hiding schemes for the point-sampled geometry in general were considered (not strictly only the watermarking approaches). Unfortunately, they were all applied to 3D point models with a low number of points that are almost uniformly distributed on the models’ surfaces - i.e. the distances between the points are practically the same. Thus, the techniques embedding the watermark bit by perturbing the points between two neighbouring points can be applied). LiDAR data has a non-uniform point distribution due to the diverse terrain features and the process of scanning that is not always ideal. Cotting et al. used a fast hierarchical clustering algorithm and Principal Component Analysing (PCA) to obtain a set of surface patches [5]. Each patch was mapped into the space of eigenvectors of an approximate Laplacian operator to obtain a decomposition of a patch surface into discrete frequency bands. The watermark was then incorporated into the low-frequency components. Luo et al. proposed a reversible data hiding approach for a 3D point cloud [19]. They selected randomly a set of eight neighbouring vertices (cluster) around a randomly selected seed vertex. The integer Discrete Cosine Transformation (DCT) was then performed using the coordinates of these vertices. The watermark was embedded into the highest frequency coefficient in the DCT domain. Then the integer Inverse Discrete Cosine Transformation (IDCT) was applied on all clusters, and the watermark model is obtained. The authors did not provide any analysis of the robustness of their method. For example, a noise attack can rearrange positions of the eight points within the cluster, which can have a significant impact on the value of the last coefficients of a Discrete Cosine Transformation. Wang et al. presented an approach that employs a Principal Component Analysis (PCA) for the point-sampled models [33, 34, 35]. PCA was applied in order to achieve robustness against the affine transformations. The original points were mapped into the PCA-coordinate system and sorted for each axis to produce intervals, which are embedding positions. The watermark was embedded into each interval by changing points’ positions and by using a secret key. Unfortunately, approaches that apply PCA are very vulnerable to cropping attacks. A huge number of LiDAR points with the non-uniform density distribution affect the embedding intervals. Therefore, it is not guaranteed to have enough space between intervals to perform watermarking successfully and to preserve a watermark in the case of the noise attack. Agarwal and Prabhakaran developed a method that constructs a cluster-tree by using the nearest neighbour heuristic [1]. A watermark was embedded inside clusters of points by using an extended 3D quantisation index modulation [4]. Each cluster had at least three points: an encoding point, a cluster head, and a cluster reference point. Unfortunately, their method depended on the distances between points within the cluster. Therefore, it had the same difficulties as the previous approach. Moreover, it has low robustness for simplification and cropping. Ke et al. presented an approach that partitioned a 3D model into patches uniquely using an octree-structure and PCA [13, 14, 15]. Then, a similarity measurement was performed to identify and cluster patches within the alike patch chain. The watermark was embedded into the average local vector of every similar patch. Unfortunately, the optimal patch size depended totally on the geometry of the individual model. Therefore, it cannot be applied directly to the diverse LiDAR data. Recently, Itier et al. proposed fragile data hiding for 3D point cloud [12]. They inserted data on each vertex interactively as a function of the synchronisation method based on Hamiltonian path. Unfortunately, a noise attack can change distances between the points. Consequently, it is difficult or even impossible to construct the same Hamiltonian path.

Table 1 summarises the level of robustness against various most probable attacks according to the techniques used in the different data-hiding approaches and the author’s claims. The highly problematic are down-sampling and cropping attacks. Other approaches, especially PCA-based, have low robustness, or do not provide any robustness at all against these two attacks. Moreover, two approaches are actually characterised as fragile methods [12, 27]. Thus, they differ significantly in comparison with our robust approach.
Table 1

The level of robustness (high, low or non-robust (marked with \(\protect \times \))) against various most probable attacks applying different data-hiding approaches

 

Approach

  

PCA-based

Other

Attack

Our

[5]

[13, 14, 15]

[19]

[33, 34, 35]

[1]

[12]

[27]

local noise

high

high

low

low

high

high

low

low

global noise

low

low

low

low

low

low

\(\protect \times \)

\(\protect \times \)

random removal

high

low

low

low

low

low

\(\protect \times \)

\(\protect \times \)

down-sampling

high

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

cropping

high

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

\(\protect \times \)

low

\(\protect \times \)

\(\protect \times \)

rearrangment

high

high

high

high

high

high

high

low

z-axis translation

high

high

high

high

high

high

low

low

3 The proposed technique

The proposed method was developed because existing methods do not address properly some of the most challenging issues in the watermarking of LiDAR data. All PCA-based methods are fragile to all attacks, that could change the number of points and the centroid of points. Consequently, they are not robust against cropping and random points removal attacks. Moreover, two main characteristics of LiDAR data were considered in developing our method: A large amount of collected data (up to 30 million points) and a very limited topological connectivity. Actually, no information how the points are connected to each other is stored in the LAS file.

The collected terrain data can be very diverse, fetched from various terrain types, e.g. fields, meadows, urban environment, different kinds of vegetation, flatness, mountains, lakes, and rivers. Consequently, the terrain cannot always be scanned adequately. Thus, some non-uniform densities of the points can appear in the collected terrain data [28]. Moreover, the collected data may contain noise (scanners are not exactly accurate and have different resolutions, various atmospheric conditions can affect scanning, the aircraft carrying the scanners are exposed to various disturbances). The need of any preprocessing of LiDAR data should be minimised because of numerous points. The watermarking scheme should also incorporate as many points as possible without any data degradation. The latter can be achieved by embedding the watermark information multiple times at different positions and by spreading it into several points.

To improve robustness and to prevent the watermark extraction, an approach with a pseudo-random generator was applied to determine the marker positions. The DCT was applied to spread the watermark into several points and to minimise a distortion of the points’ coordinates. This is somehow similar to the initial steps in the approach presented by Luo et al. [19], however, completely the different approach was taken for defining input values for the DCT. Figure 2 shows the main steps in our watermarking embedding/extraction approach.
Fig. 2

The scheme of the proposed watermark embedding/extraction process

3.1 Watermark embedding

The watermark embedding procedure consisted of the following steps:
  • Defining an array of marker positions (where the particular watermark bit would be embedded),

  • Inserting a watermark bit within the circular area around the marker positions by DCT, and

  • Modifying the coordinates of the points within this circular area.

Suppose we would like to embed an \(\protect M\)-bit long watermark \(\protect w\):
$$\begin{array}{@{}rcl@{}} w &=& \{w_{0}, w_{1},\ldots, w_{M-1}\}, \quad w_{i} \in \{0, 1\} \\ &&~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\quad \text{and} \quad 0 \le i \le M-1. \end{array} $$
(1)
Let us define a watermark bit stream \(\protect b\):
$$ b = \{b_{0}, b_{1}, \ldots, b_{j}, \ldots, b_{N-1}, \}, \quad 0 \le j \le N-1, $$
(2)
where \(\protect b_{j} = w_{(j \bmod M})\) and \(\protect N\) is the length of the watermark bit stream. Thus, bit \(\protect b_{j}\) is embedded at \(\protect j^{th}\) watermark bit position \(\protect {\mathbf v}_{j} = (x_{j}, y_{j}, 0)\).

Defining marker positions

In general, marker positions (i.e markers) v j = {x j , y j ,0} can be determined in various ways. The following approach was applied. Firstly, their range was defined by (3).
$$\begin{array}{@{}rcl@{}} x_{j} &\in& [x_{min} +r_{out}, x_{max} - r_{out}, 0 ] \\ y_{j} &\in& [y_{min} +r_{out}, y_{max} - r_{out}, 0 ], \end{array} $$
(3)
where \(\protect x_{min}\), \(\protect y_{min}\), \(\protect x_{max}\), \(\protect y_{max}\) define a 2D bounding box around all points (the dimensions of the bounding box are stored in the LAS file header, although it can be determined easily too), and \(\protect r_{out}\) is the radius of the circle area around the marker position \(\protect {\mathbf v}_{j}\).
Secondly, an array of the marker positions \(\protect {\mathbf v} = \{{\mathbf v}_{0}, {\mathbf v}_{1}, \ldots , {\mathbf v}_{N^{*}} \}\) within the range was created by the Mersenne twister pseudo-random generator [20], which was initiated by seed \(\protect \xi \). This pseudo-random generator has a very long period (2219937 − 1), which improve the robustness of the watermarking greatly. \(\protect N^{*}\) is the desired number of the marker positions. It can be arbitrary defined or automatic in order to cover most part of the point cloud. These marker positions \(\protect {\mathbf v}\) were checked further. If the distances between the currently processed marker position and the already checked marker positions were higher than \(\protect r_{in}\) (the exact meaning of this value is explained below), then the watermark bit position is accepted (Fig. 3). Otherwise, it was discarded and not used further. Therefore, the actual number of the marker positions can be a bit smaller (i.e. \(\protect N \leq N^{*}\)). Next, the LiDAR points within the radius of \(\protect r_{out}\) in the \(\protect XY\) plane for each accepted marker position \(\protect {\mathbf v}_{j}\) were searched by the approximate nearest neighbour search (FLANN) [18, 23, 24, 25]. This algorithm was used to speed up the process of finding LiDAR points within the circular marker area. The Point-cloud Library (PCL) was used for this purpose [29]. Thus, a set of points within the radius of \(\protect r_{out}\) from each marker position \(\protect {\mathbf v}_{j}\) were obtained. If this set contained less than \(\protect T/2\) of points (T is the size of the DCT input array) the corresponding marker position \(\protect {\mathbf v}_{j}\) was discarded and the watermark bit is skipped, and it was not embedded. Watermark bit synchronisation was maintained in that way. Thus, the reduced array of the marker positions v = {v0, v1,…,v N } was obtained (NN).
Fig. 3

The circular areas around watermark bit positions v0, v1, v2, and v3

Next, the sunflower seed distribution algorithm was applied to divide the large circular area (i.e marker) uniformly into smaller circular areas (\(\protect {\mathbf s}_{k} = \{{x^{s}_{k}}, {y^{s}_{k}}, 0\}\) (k = 0,…,T − 1) are the centres of these smaller circular areas) (see Fig. 4). This algorithm is based on the following general equation [26, 32]:
$$ \theta = \frac{2 \pi}{\phi^{2}} k \quad \quad \quad r = \eta \sqrt{k}, $$
(4)
where \(\protect \phi = (1+\sqrt {5})/2 \approx 1.618\) and \(\protect \eta \) is an arbitrary constant. After that, the Algorithm 1 was applied. It takes two arguments: \(\protect T\) (the number of seed points \(\protect {\mathbf s}_{k}\)) and \(\protect \alpha \) (a user-defined constant). The latter has an effect on the distribution of the seed points \(\protect {\mathbf s}_{k}\) within the circular area (0 ≤ α ≤ 1). The higher value tended to move the seed points s i away from the centre \(\protect {\mathbf v}_{j}\) of the circular area. The seed points \(\protect {\mathbf s}_{k}\) were used to determine the input values \(\protect d_{k}^{\prime \prime }\) for the DCT. First, let us define the inner radius \(\protect r_{in}\) that can be approximated by the following equation:
$$ r_{in} \approx \frac{ r_{out}}{\sqrt{T}}. $$
(5)
Fig. 4

The sunflower seed point distribution around the marker (i.e the marker position) (T = 64,α = 0.0)

The values \(\protect d_{k}^{\prime \prime }\) were determined as follows. Firstly, the gravitational centre \(\protect {\mathbf c}_{k} = \{{x^{c}_{k}}, {y^{c}_{k}}, 0\}\) of the LiDAR points was calculated in the XY plane. It lays within the circular area of radius \(\protect r_{in}\) from the seed point centre \(\protect {\mathbf s}_{k}\) (see Fig. 6).

Unfortunately, there are rare cases when \(\protect {\mathbf s}_{k}\) coincides with \(\protect {\mathbf c}_{k}\) (\(\protect {x^{s}_{k}} = {x^{c}_{k}}\) and \({y^{s}_{k}} = {y^{c}_{k}}\)) and, therefore, \(\protect d_{k}= 0\). This causes in further calculations a division by zero (see (10)). Thus, s k was moved slightly upward for a distance \(\protect {\Delta } z = 0.1\, r_{in}\) to \(\protect {\mathbf s}_{k}^{\prime }\) (see Fig. 5).
Fig. 5

Distance correction

Next, the distance \(\protect d_{k}^{\prime }\) between \(\protect {\mathbf s}_{k}^{\prime } = \{ {x^{s}_{k}}, {y^{s}_{k}}, {\Delta } z \}\) and \({\mathbf c}_{k} = \{{x^{c}_{k}}, {y^{c}_{k}}, 0\} \) was calculated. This distance is always non-zero between 0.1 r i n and \(\protect 1.049\, r_{in}\). Therefore, the following applies: \(\protect d_{k}^{\prime } \approx d_{k}\). Figure 5 is only an illustration of this calculation (distances are not in true scale). Thus, a vector of the distances \(\protect d_{k}^{\prime }\) for each marker position \(\protect {\mathbf v}_{k}\) was obtained. This vector was further shuffled by the Mersenne twister pseudo-random generator to improve the robustness of the watermarking schema even more. If no points were within radius \(\protect r_{in}\), the distance \(\protect d_{k}^{\prime }\) was set to 0. Experimentally, we found that it was slightly better if the input values \(\protect d_{k}^{\prime \prime }\) for the DCT were formed by the following equation:
$$ d_{k}^{\prime\prime} = d_{k}^{\prime} + k, \qquad 0 \le k \le T - 1. $$
(6)

Inserting a watermark bit

The vector of values \(d_{k}^{\prime \prime }\) was used as an input for the DCT [2]:
$$ F_{t} = \sum\limits_{k = 0}^{T-1} d_{k}^{\prime\prime} cos\left[\frac{\pi}{T} \left( k + \dfrac{1}{2}\right) t \right], \quad \quad 0 \le t \le T - 1. $$
(7)
A watermark bit \(\protect b_{j}\) was embedded in the last DCT coefficient \(\protect F_{T-1}\) as follows:
$$ F_{T-1} = \left\{\begin{array}{ll} + \gamma, & \text{if } b_{j} = 1 \quad \text{ and } \quad F_{T-1} < \gamma\\ - \gamma, & \text{if } b_{j} = 0 \quad \text{ and } \quad F_{T-1} > -\gamma\\ F_{T-1}, & \text{otherwise}, \end{array}\right. $$
(8)
where \(\protect \gamma \) is the experimentally defined bit coding amplitude. If \(\protect F_{T-1} > \gamma \) then \(\protect F_{T-1}\) already represents bit 1. Similarly, if FT− 1 < γ then \(\protect F_{T-1}\) already represents bit 0. In both cases, \(\protect F_{T-1}\) was not changed. Its value depended on the size \(\protect T\) and on how much a watermark should resist to the various attacks. On the one hand, it was desired to modify data as little as possible, but on other hands, the robustness of the watermark against various attacks should be achieved. Thus, only the last DCT coefficient was modified. Moreover, to avoid additionally unwanted data degradation, a watermark bit was set only if \(\protect |F_{T-1}| < 2 \gamma \). Finally, the inverse DCT was performed and the vector of the modified values \(\protect d_{k}^{w^{\prime }}\) was obtained.

Modifying the coordinates of the points

As the input values \(d_{k}^{\prime }\) for the DCT were modified by (6), the values \(\protect d_{k}^{w^{\prime }}\) had firstly to be subtracted by the following equation:
$$ {d_{k}^{w}} = d_{k}^{w^{\prime}} - k, \qquad 0 \le k \le T -1. $$
(9)
If no points were within the radius of \(\protect r_{in}\) from the seed point centre \(\protect {\mathbf s}_{k}\), no modification of the coordinates could be made. Otherwise, the values \(\protect {d_{k}^{w}}\) were used to calculate the vector \(\protect {\Delta } {\mathbf v}_{k} = ({\Delta } x_{k}, {\Delta } y_{k}, 0)\):
$$ {\Delta} {\mathbf v}_{k} = ({\mathbf c}_{k}-{\mathbf s_{k}}) \left( \frac{{d_{k}^{w}}}{d_{k}^{\prime}} -1\right). $$
(10)
Then, each point \(\protect {\mathbf p}_{l} = \{x_{l}, y_{l}, z_{l}\}\) within the \(\protect k\)-th seed circle was modified by the vector \(\protect {\Delta } {\mathbf v}_{k} = \{x_{k}, y_{k}, 0\}\):
$$ {\mathbf p}_{l}^{\prime} ={\mathbf p}_{l} +{\Delta} {\mathbf v}_{k}, \qquad 0 \le l \le U_{k}-1, $$
(11)
where \(\protect U_{k}\) was the number of points \(\protect {\mathbf p}\) within the radius \(\protect r_{in}\) from the seed point centre \(\protect {\mathbf s}_{k}\). Thus, the gravitational centre \(\protect {\mathbf p}_{k}\) was changed to \(\protect {\mathbf c}_{k}^{\prime }\) (see Fig. 6).
Fig. 6

Modifying the points p1, p2, p3, and p4

The circular areas around the marker position \(\protect {\mathbf v}_{j}\) can overlap. In general, the points \(\protect {\mathbf p}_{l}\) can be modified multiple times by embedding different watermark bits. Thus, for each marker position \(\protect {\mathbf p}_{l}^{\prime }\), the distance was measured from its original position. The position of the watermarked point was not changed if this distance exceeded the experimentally defined maximum threshold \(\protect d_{max}\).

Thus, a compromise should be made between the ability to extract a watermark and the level of data modification. Because the directions of the vector \(\protect {\Delta } {\mathbf v}_{k}\) between \(\protect {\mathbf c}_{s}\) and \(\protect {\mathbf s}_{k}\) of each marker varies, the points are moved in the different directions. Moreover, the watermark extraction was also implemented specifically. Therefore, overlapping of the markers was not an issue.

3.2 Watermark extraction

The watermark extraction procedure involved two steps, very similar to the embedding process:
  • Defining an array of marker positions (where particular watermark bit was embedded), and

  • Extracting a watermark bit within these marker positions.

Defining marker positions

The points of a possibly attacked point cloud and the original data must always represent the identical physical terrain. Thus, both must be in the same coordinate system and have approximately similar values of their coordinates according to this coordinate system. Therefore, the affine transformations produce totally unusable data. This is the main difference according to the general point cloud that can be anywhere in various coordinate systems.

The marker positions were determined according to the steps described in Section 3.1. The same parameters \(\protect \xi \), \(\protect N\), \(\protect r_{out}\), \(\protect T\), and \(\protect M\) should be applied. All these parameters constitute a key for watermark extraction. An array of the marker positions \(\protect {\mathbf v} = \{{\mathbf v}_{0}, {\mathbf v}_{1}, \ldots , {\mathbf v}_{N^{*}} \}\).

Extracting/Checking watermark bits

The marker positions were further checked in the same way as described in Section 3.1. Thus, the invalid marker positions were skipped. The error stream \(\protect \epsilon \) was established. All invalid positions are marked in the error stream. Watermark bit synchronisation was maintained in that way. Next, the watermark bit stream \(\protect b^{*}\) was determined. Finally, the vector of values \(\protect d_{k}^{\prime \prime }\) was obtained for each valid marker position \(\protect {\mathbf v}_{k}\) and used as an input for the DCT (7). Next, the watermark bit stream \(\protect b\) was determined and the error stream \(\protect \epsilon \) was obtained as follows. The last DCT coefficient \(\protect F_{k, T-1}\) was observed for each marker position \(\protect {\mathbf v}_{k}\). If \(\protect F_{k, T-1} > 0\), \(\protect b^{*}_{j}\) was set to 1, otherwise \(b^{*}_{j}\) is set to 0. In both cases, the bit value was extracted successfully and \(\protect \epsilon _{j}\) was set to 0. If \(\protect |F_{k, T-1}| > 2* \gamma \), 𝜖 j was set to 1. In that situation, there was a high probability that the marker position \(\protect {\mathbf v}_{j}\) was compromised by some attacks.

An \(\protect M\)-bit long extracted watermark \(\protect w^{*}\) was determined from the watermark bit stream \(\protect b^{*}\) as follows. The two counters \(\protect cw^{+}_{i}\) and \(\protect cw^{-}_{i}\) were defined for each watermark bit \(\protect w^{*}_{i}\) (0 ≤ iM − 1). Each of them counted how many times 1 or 0 occurred within the watermark bit stream \(\protect b^{*}\) at position \(\protect j\) (i = j mod M). If \(\protect b^{*}_{j} = 1\) and \(\protect \epsilon _{j}\) \(\protect =\) 0, \(\protect cw^{+}_{i}\) was incremented. Otherwise, if \(\protect b^{*}_{j} = 0\) and \(\protect \epsilon _{j}\) \(\protect =\) 0, \(\protect cw^{-}_{i}\) was incremented. If \(\protect \epsilon _{j} = 1\), none of them was incremented. Finally, extracted watermark \(\protect w^{*}\) was defined as follows:
$$ w^{*}_{i} = \left\{\begin{array}{ll} 1, & \text{if } cw^{-}_{i} \le cw^{+}_{i}\\ 0, & \text{if } cw^{+}_{i} < cw^{-}_{i} \end{array}\right. \quad \text{ and } \quad 0 \le i \le M-1. $$
(12)

4 Experimental results and discussions

Several experiments were performed for evaluating the proposed approach. Different LAS files were used containing various terrain features, a number of points, sizes of scanned areas, and the densities of the scanned points per square metre (Table 2). These data were processed by the solutions presented in [10, 22]. Figure 7 shows four examples of the testing files. There are diverse data, some of them also contain large gaps.
Table 2

Description of the testing LAS files

File

Number of

Area size

Density

Description

 

points

(m \(\protect \times \) m)

  

F1

2,345,998

750 \(\protect \times \) 500

4.17

hilly terrain; trees

F2

3,581,247

1,000 \(\protect \times \) 1,000

3.58

hilly terrain; trees

F3

13,806,773

1,872 \(\protect \times \) 1,779

4.15

hilly terrain; trees

F4

29,032,708

1,964 \(\protect \times \) 2,965

4.98

hilly terrain

F5

10,689,160

1,000 \(\protect \times \) 1,000

10.69

village; fields; meadows

F6

10,320,707

1,000 \(\protect \times \) 1,000

10.32

village; houses

F7

6,945,259

1,000 \(\protect \times \) 1,000

6.95

village; fields; meadows

F8

3,581,393

1,000 \(\protect \times \) 1,000

3.58

village;hilly terrain; trees

F9

6,312,932

1,000 \(\protect \times \) 1,000

6.31

village; fields; meadows

F10

2,416,252

1,000 \(\protect \times \) 1,000

2.42

flat terrain; forest

F11

3,839,976

1,000 \(\protect \times \) 1,000

3.84

hilly terrain; forest

F12

4,812,500

1,000 \(\protect \times \) 1,000

4.81

city

F13

4,632,923

1,000 \(\protect \times \) 1,000

4.63

mixed: city, hilly terrain

F14

2,388,361

750 \(\protect \times \) 500

6.36

city

F15

1,726,385

750 \(\protect \times \) 500

8.69

city

Fig. 7

Examples of the testing files: a F5 - a village area at 46.377N 15.436E b F6 - a forest area at 46.376N 15.461E c F12 - a city area at 46.376N 15.436E d F14 - a city area at 46.555N 15.618E

The match percentage between the inserted watermark \(\protect w\) and the extracted watermark \(\protect w^{*}\) was calculated as the ratio between the number of equals bits in both watermarks (when \(\protect w_{i}\) = \(\protect w^{*}_{i}\)), and the size of the watermark in bits (M). If no attack was performed, a very high match percentage is achieved (up to 100%). This depended slightly on the parameter values and the input file. The more data were degraded by attacks, lower matching percentage was achieved. We performed two experiments. The match percentage achieved without watermark insertion was determined first. The second experiment was performed when a watermark was extracted by a different random generator seed \(\protect \xi \) than inserted. Table 3 shows the values of the parameters and their default values that were used in both cases. The average match percentage performing all 289 test cases on all testing files was roughly 50% (the straight in the graphs). In approximately \(\protect 4.5\%\) of the test cases, the match percentages were achieved between \(\protect 60\%\) and \(\protect 69.44\%\). Thus, if the watermark was embedded and match percentages between these values were achieved, then it is a very low probability to extract the wrong watermark. Similarly, if a match percentage above \(\protect 69.44\%\) (the straight line on the graphs) was achieved, there is the high probability that a watermark was inserted. Thus, the wrong watermark extractions were extremely rare..
Table 3

The values of parameters (without performing attacks)

Parameter

Range

Default values

N

\(\protect 100-13,000\)

8,000

r o u t

\(\protect 4-16\) m

8 m

T

\(\protect 64-192\)

128

γ

\(\protect 0.10-4.0\)

2.0

d m a x

\(\protect 0.5-90\) cm

10 cm

In most cases, the graphs showed both, an average match percentage and an average displacement performing all test cases on all testing files, except for the result of the rearrangement attack, where results of all test cases are shown. If removal of the points had occurred during the attack, it was impossible to calculate and represent an average displacement. In that situation, only a match percentage is presented in the graphs.

4.1 Changing values of parameters without attacks

These experiments were executed using a set of 289 test cases without performing attacks. Table 3 show the parameter values and their default values. The values of \(\protect r_{out}\) were selected that the number of points on average was between approximately 264 and 3734. This value can also be estimated by taking into account density of the point cloud. The seed value \(\protect \xi = 0\) and the ASCII coded 72-bit watermark “gemma1234” was applied.

Figure 8a shows that the satisfactory match percentage can be achieved by a relatively small number of desired markers \(\protect N^{*}\) (i.e. \(\protect 100-500\)). The robustness against various attacks was achieved by increasing this parameter, but more points were involved in the watermarking process. Thus, the average displacement increased. Changing the radius \(\protect r_{out}\), the match percentage was stable around \(\protect 90\%\), but higher values of this parameter can cause a higher average displacement (Fig. 8b). Increasing the DCT size, the match percentage rose slightly, and the average displacement fell slightly (Fig. 8c). The same figure shows that the lowest match percentage was achieved when the DCT size had the value of 192. This was due to the bit coding amplitude, which is set too low (the default value of bit coding amplitude \(\protect \gamma \) is 2.0). Thus, the displacements of the points were too small. Figure 8d and e show

how the match percentage varied by applying the different maximum displacement values (d m a x ) and the DCT size \(\protect T\), respectively. In both graphs, the best results were achieved using the bit coding values \(\protect \gamma \) from 1.0 to 1.5. Figure 8d also shows that the better match percentage was obtained with the higher maximum allowable displacement (d m a x ), but the average displacement in that situation was higher. Similar observations can be seen from Fig. 8e, where better results were achieved with higher values of the DCT size \(\protect T\). In general, the match percentage was somehow proportional to the average displacement. Ideally, we would have liked to achieve simultaneously the highest match percentage and the lowest displacement. The last Fig. 8f shows that the positive match percentage was obtained when the higher maximum allowable displacement (d m a x ) was set at least to 5 cm. A higher value of the maximum allowable displacement (d m a x ) than 70 cm caused a gradual increase of the average displacement. This was somehow connected to the radius of the inner circle (r i n ), which was approximately, on average, about 70 cm.
Fig. 8

Experimenting with different values of parameters: a Number of desired markers b Marker radius c DCT sizes (numbers of inner circles d) Bit coding amplitudes with different maximum allowable displacements e Bit coding amplitude with different DCT sizes f Maximum allowed displacements

Execution time analysis

Figure 9 shows an average watermark embedding and extracting time. They were measured on a computer with an 8-core Intel Core i7-3770 Processor @ 3.40 Mhz. They show that even a very large number of points (up to 29 millions of points) can be handled adequately. Detail time analysis of the parameter values show that the selection of r o u t has a higher impact on embedding and extracting time. Thus, the watermark embedding/extracting time was approximately 4.5 times higher for \(\protect r_{out} = 4\) than for \(\protect r_{out} = 16\).
Fig. 9

a Average watermark embedding time b Average watermark extracting time

Watermark size analysis

Next, the watermark size was evaluated. The default parameter values from Table 4 were applied in the experiment. Figure 10 shows that slightly better results were obtained with the lower number of watermark bits. The match percentage \(\protect 92.97\%\) was achieved when the 128-bit watermark was embedded.
Table 4

The values of parameters (performing attacks)

Parameter

Range

Default values

N

\(\protect 8,000-12,000\)

\(\protect 8,000\)

r o u t

\(\protect 8-12\) m

8 m

T

\(\protect 64-192\)

128

γ

\(\protect 0.5-5.0\)

2.0

d m a x

\(\protect 5-50\) cm

10 cm

Fig. 10

Average match percentage according to the watermark size

4.2 Different attacks experiments

These experiments were performed using only 44 test cases. The extreme values of parameters can be abandoned (where poor results were obtained), and the steps between two successive parameter values can be increased (see Fig. 8). Table 4 show the parameter values, and their default values applied in the attacks’ experiments. The same default values of parameters, the seed \(\protect \xi = 0\), and the inserted watermark \(\protect w\) were applied.

Noise attack

Figure 11a shows that the match percentage dropped as the amplitude of the random noise was added to the coordinate of all the points. The grey line at the bottom of the graph represents the average displacement of the points due to watermarking process (which was approximately 2 cm). The positive match percentage could be achieved when the noise amplitude was lower than 60 cm. Of course, increasing the noise caused that the overall average displacement raised rapidly.
Fig. 11

a Noise attack b Down-sampling attack (various voxel grid sizes)

Down-sampling attack

In this experiment, all points within a cube were replaced by an average point (Fig. 11). The size of the cube was increased gradually from 50 cm to 200 cm. Thus, various numbers of points were removed from the point cloud. The positive match percentages were obtained when the percentage of the removed points was less than 80% (the size of the cube was, in that situation, 150 cm).

Random removal attack

Next, we prepared experiment where some percentage of points were removed randomly (Fig. 12a, b) shows the average results over all testing files applying different parameter values (Table 4). Similarly, as in the previous experiments, the positive match percentage was obtained when the percentage of removed points was less than 80%. Actually, even better results were achieved in the example presented in Fig. 12a.
Fig. 12

a After random removal attack (default parameters; F14; 60% of random removed points; match percentage: 87.50%) (b) Random removal attack

Cropping attacks

Several attacks were tested to evaluate the robustness of watermark schema against cropping attacks. These kinds of attacks are somehow extreme. The following cropping attack experiments were performed: The removal of the last points, a chess grid removal, and a strip removal. Figures 13b and 14b show the average results over all testing files applying different parameter values (Table 4).
Fig. 13

a Attack by removing the last points (default parameters; F14; 60% of removed points; match percentage: 100%) b Last point removal attack

Fig. 14

a After chess grid removal attack (default parameters; F14; match percentage = 100%) b chess grid removal attack

In the first cropping attack experiment, only some percentage of the points in the input file was kept. Fig. 13a shows an example where 60% of the last points in the input data flow were removed. There was a huge gap in the middle (thus, the points were arranged in the file so that the last points were in the middle). 100% match was achieved in that situation. Figure 13b shows that the acceptable results were obtained even if \(\protect 90\%\) percentage of last points were removed.

In the next cropping experiment, we chose a grid to remove some parts of the points (see Fig. 14a). In this case, approximately 50% of the points were removed and the match percentage 100% was obtained. Figure 14b shows the results when various grid sizes were set. The match percentage decreased slightly as the grid became more coarse.

Rearrangement attacks

The proposed watermarking scheme was also robust against rearrangement attacks. Figure 15a shows that the achieved percentages were practically the same for all 44 test cases.
Fig. 15

a Rearrangement attack b Translate attack

Translate attacks

As the z coordinate of the points was not used in the watermarking process, modification of this coordinate did not have any effect. Only uniform translation of \(\protect x\) and \(\protect y\) was applied. The positive match percentage was achieved if the translation of both coordinates were less than 70 cm (or distance between the original and translated points was approximately less than 99 cm). Thus, it was not even necessary that exact data alignment was achieved to extract the watermark.

Combined attack

We will not present all possible combinations. Only the results for combined random noise and random removal attack are shown (Fig. 16). The combined attack had a double effect on the obtained results. The acceptable percentages were achieved if the data were not compromised too seriously by multiple attacks.
Fig. 16

a Combined random noise and random removal attack b Double watermark inserting (ξ = 0 and ξ = 1)

Double inserting

In this experiment, the watermark was inserted twice by two different initial seeds of the pseudo-random number generator (ξ = 0 and ξ = 1). Other parameters were the same. Figure 16 shows that the match percentages were practically identical through all test cases. The average displacement was twice as much as if the single insertion was performed. Of course, diverse parameters can be used for each watermark insertion. Thus, each inserted watermark can have different robustness.

5 Conclusion

This paper presents a new approach for robust watermarking of LiDAR data. The watermarking bit is embedded randomly into several points by the DCT transformation. The experiments show that the approach is highly robust against various malicious attacks, especially for cropping, random removal and down-sampling attacks that cannot be handled by the existing PCA-based methods. The watermark can be inserted multiple times using different values of parameters. It is also practically undetectable - the positions of the watermark are impossible to determine if the initial seed of the pseudo-random generator, the number of markers, and the original data are unknown and hard to guess.

Notes

Acknowledgements

This work was supported by the Slovenian Research Agency under Grants P2-0041 and J2-6764.

References

  1. 1.
    Agarwal P, Prabhakaran B (2009) Robust blind watermarking of point-sampled geometry. IEEE Trans Inf Forensics Secur 4(1):36–48CrossRefGoogle Scholar
  2. 2.
    Ahmed N, Natarajan T, Rao KR (1974) Discrete cosine transfom. IEEE Trans Comput 23(1):90–93CrossRefMATHGoogle Scholar
  3. 3.
    American Society for Photogrammetry and Remote Sensing (ASPRS) (2016) Las 1.4 format standard. Available online at: www.asprs.org (accessed 25 August 2016)
  4. 4.
    Chen B, Wornell GW (2001) Quantization index modulation: a class of provably good methods for digital watermarking and information embedding. IEEE Trans Inf Theory 47(4):1423–1443MathSciNetCrossRefMATHGoogle Scholar
  5. 5.
    Cotting D, Weyrich T, Pauly M, Gross M (2004) Robust watermarking of point-sampled geometry. In: Shape Modeling Applications, 2004. Proceedings, pp 233–242Google Scholar
  6. 6.
    Cox I, Miller M, Bloom J, Fridrich J, Kalker T (2007) Digital watermarking and steganography. Morgan Kaufmann, BurlingtonGoogle Scholar
  7. 7.
    Dugelay J, Baskurt A, Daoudi M (2008) 3D object processing: compression, indexing and watermarking. Wiley, New YorkCrossRefGoogle Scholar
  8. 8.
    Gao X, Zhang C, Wei Y, Li W (2010) A highly adaptable capacity and invisibility 3d watermarking based on four-points sets. In: Proceedings of the 12th ACM workshop on Multimedia and security. ACM, pp 137–146Google Scholar
  9. 9.
    Gao X, Zhang C, Huang Y, Deng Z (2012) A robust high-capacity affine-transformation-invariant scheme for watermarking 3D geometric models. ACM Trans Multimed Comput Commun Appl (TOMM) 8(2S):34Google Scholar
  10. 10.
    Horvat D, Žalik B, Mongus D (2016) Context-dependent detection of non-linearly distributed points for vegetation classification in airborne LiDAR. ISPRS J Photogramm Remote Sens 116:1–14CrossRefGoogle Scholar
  11. 11.
    Isenburg M (2013) LASZip: lossless compression of Lidar data. Photogramm Eng Remote Sens 79(2):209–217CrossRefGoogle Scholar
  12. 12.
    Itier V, Puech W (2016) High capacity data hiding for 3d point clouds based on static arithmetic coding. Multimed Tool Appl:1–25Google Scholar
  13. 13.
    Ke Q, Dong-Qing X (2011) An high-capacity steganographic scheme for 3D point cloud models using self-similarity partition. Int J Model Optim 1(1):13CrossRefGoogle Scholar
  14. 14.
    Ke Q, Dong-Qing X (2013) A self-similarity based robust watermarking scheme for 3D point cloud models. Information 16(6):3621Google Scholar
  15. 15.
    Ke Q, Dong-Qing X, Da-Fang Z (2010) A robust watermarking scheme for 3D point cloud models using self-similarity partition. In: 2010 IEEE International Conference on Wireless Communications, Networking and Information Security, pp 287–291Google Scholar
  16. 16.
    Lipuš B, Žalik B (2012) Lossy las file compression using uniform space division. Electron Lett 48(20):1278–1279CrossRefGoogle Scholar
  17. 17.
    Lipuš B, Žalik B (2015) Lossless progressive compression of lidar data using hierarchical grid level distribution. Remote Sens Lett 6(3):190–198CrossRefGoogle Scholar
  18. 18.
    Lukač N, Žalik B (2015) Fast approximate k-nearest neighbours search using GPGPU. In: GPU Computing and Applications. Springer, pp 221–234Google Scholar
  19. 19.
    Luo H, Lu ZM, Pan JS (2006) A reversible data hiding scheme for 3D point cloud model. In: International Symposium on Signal Processing and Information Technology, pp 863–867Google Scholar
  20. 20.
    Matsumoto M, Nishimura T (1998) Mersenne twister: a 623-dimensionally equidistributed uniform pseudo-random number generator. ACM Trans Model Comput Simul 8(1):3–30CrossRefMATHGoogle Scholar
  21. 21.
    Mongus D, Žalik B (2011) Efficient method for lossless lidar data compression. Int J Remote Sens 32(9):2507–2518CrossRefGoogle Scholar
  22. 22.
    Mongus D, Lukač N, Žalik B (2014) Ground and building extraction from LiDAR data based on differential morphological profiles and locally fitted surfaces. ISPRS J Photogramm Remote Sens 93:145–156CrossRefGoogle Scholar
  23. 23.
    Muja M, Lowe DG (2009) Fast approximate nearest neighbors with automatic algorithm configuration. In: International Conference on Computer Vision Theory and Application, pp 331–340Google Scholar
  24. 24.
    Muja M, Lowe DG (2012) Fast matching of binary features. In: Computer and Robot Vision, pp 404–410Google Scholar
  25. 25.
    Muja M, Lowe DG (2014) Scalable nearest neighbor algorithms for high dimensional data. IEEE Trans Pattern Anal Mach Intell 36(11):2227–2240CrossRefGoogle Scholar
  26. 26.
    Prusinkiewicz P, Lindenmayer A (2012) The algorithmic beauty of plants. Springer, BerlinMATHGoogle Scholar
  27. 27.
    Rahmes M, Wilder K, Fox K (2013) A multi-resolution fractal additive scheme for blind watermarking of 3D point data. In: SPIE Defense, Security, and Sensing, pp 87,570G–87,570GGoogle Scholar
  28. 28.
    Rupnik B, Mongus D, Žalik B (2015) Point density evaluation of airborne LiDAR datasets. J Universal Comput Sci 21(4):587–603MathSciNetGoogle Scholar
  29. 29.
    Rusu RB, Cousins S (2011) 3D is here: Point cloud library (PCL). In: 2011 IEEE International Conference on Robotics and Automation, pp 1–4Google Scholar
  30. 30.
    Shan J, Toth CK (2009) Topographic laser ranging and scanning: principles and processing. CRC Press, Boca RatonGoogle Scholar
  31. 31.
    Shih FY (2007) Digital watermarking and steganography: fundamentals and techniques. CRC Press, Boca RatonGoogle Scholar
  32. 32.
    Vogel H (1979) A better way to construct the sunflower head. Math Biosci 44 (3-4):179–189CrossRefGoogle Scholar
  33. 33.
    Wang CM, Wang PC (2005) Data hiding approach for point-sampled geometry. IEICE Trans Commun 88(1):190–194CrossRefGoogle Scholar
  34. 34.
    Wang CM, Wang PC (2006) Steganography on point-sampled geometry. Comput Graph 30(2):244–254CrossRefGoogle Scholar
  35. 35.
    Wang PC, Wang CM (2007) Reversible data hiding for point-sampled geometry. J Inf Sci Eng 23(6):1889–1900MathSciNetGoogle Scholar
  36. 36.
    Wang K, Lavoué G, Denis F, Baskurt A (2008) A comprehensive survey on three-dimensional mesh watermarking. IEEE Trans Multimedia 10(8):1513–1527CrossRefGoogle Scholar

Copyright information

© Springer Science+Business Media, LLC, part of Springer Nature 2018

Authors and Affiliations

  1. 1.Faculty of Electrical Engineering and Computer ScienceUniversity of MariborMariborSlovenia

Personalised recommendations