A novel cloud-tamper-resistant medical image encryption algorithm with integrated signature watermarking

Abstract Medical images carry patients’ privacy and serve as critical evidence for clinical diagnosis, making the security of their cloud transmission of paramount importance. To address the limitations of existing encryption schemes, including the lack of integrity verification, difficulty in tampering localization, insufficient identity traceability, and weak encryption strength, this paper proposes a security protection scheme integrating chaotic encryption, watermark embedding, and block hash verification. First, an improved two-dimensional chaotic system (2D-ICBHM) is constructed, and experimental results demonstrate that its chaotic performance is significantly superior to that of the original system and other chaotic systems reported in recent years. Second, an encryption mechanism is designed based on this system: pixel-wise encryption is implemented on images decomposed by bit-plane through n -group index scrambling and dual chaotic sequence substitution, and global block-level encryption is accomplished by combining block swap-rotation permutation and block diffusion algorithms. Third, a block hash verification (BHT) mechanism is introduced, which achieves accurate block-level localization of tampered regions by matching the hash features of segmented sub-blocks. In addition, binary doctor signatures generated via chaotic encryption are converted into watermark data streams, which serve dual purposes of identity recognition and integrity verification. The proposed scheme integrates pixel-level and block-level encryption to enhance encryption effectiveness, and combines signature watermarking with the BHT mechanism to realize source traceability, tampering detection, and fine-grained block localization. Security evaluation confirms that the scheme exhibits robust anti-attack capability and reliable tampering detection and localization performance, which can effectively mitigate medical security risks and provide a feasible solution for secure data transmission.