Robust Watermarking Algorithm for Medical Volume Data in Internet of Medical Things

The advancement of 5G technology, big data and cloud storage has promoted the rapid development of the Internet of Medical Things (IoMT). Based on the strict security requirements and high level of accuracy required for disease diagnosis and pathological analysis, 3D medical volume data have been created in large numbers. The IoMT facilitates the rapid transfer of medical information and also makes the protection of pathological information and privacy information of patients increasingly prominent. To solve the security problem, a robust zero-watermarking algorithm based on 3D hyperchaos and 3D dual-tree complex wavelet transform is proposed according to the selected feature of medical volume data. The feature combines human visual features with improved perceptual hashing techniques. It is a robust and efﬁcient binary sequence. When implementing the proposed algorithm, the watermark is ﬁrst scrambled with 3D hyperchaos to enhance security. Then, 3D DTCWT-DCT transformation is applied to medical volume data, and the low-frequency coefﬁcients that can represent the features are selected and binarized to generate the secret key to complete the watermark embedding and extraction. Zero embedding and blind extraction ensure that the original medical volume data is not altered in any form, which meets the special requirements for diagnosis. Simulation results show that the algorithm is robust and can effectively resist common attacks and geometric attacks. It used fewer robust features to effectively bound medical volume data and watermark information, saved bandwidth, and satisﬁed the security of transmission and storage of medical volume data in the Internet of medical things. In particular, compared with state-of-the-art technology, the proposed algorithm improves the average NC value by 46.67% under geometric attacks.


I. INTRODUCTION
In recent years, the rapid development of 5G communication technology, big data technology, cloud computing and cloud storage technology has changed people's traditional way of life. Especially in the Internet of medical things (IoMT), new types of diagnosis and treatment modes such as telemedicine, Internet medicine, hierarchical diagnosis, The associate editor coordinating the review of this manuscript and approving it for publication was Marcin Woźniak . and intelligent medicine are constantly emerging. Increasingly advanced diagnosis and treatment terminals, medical sensors, medical virtual reality technology, simulated surgery, etc. enable doctors to use not only CT, MRI, ultrasound and other medical auxiliary equipment for disease judgment and diagnosis, but also medical image clouds and remote image centers, image archiving and communication systems (PACS) for cloud reading, remote consultation and health management [1], [5], [26]. However, medical images are different from traditional images. In order to ensure the VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ accuracy of diagnosis, doctors usually embed the patient's name, gender, age and other personal privacy information into the medical images, and these images are an important source for doctors to obtain and diagnose the patient's physical disease information [1]- [3], [28]. In the medical field, the quality of medical data used for diagnosis is very strict and no changes to the original data are allowed. Digital watermarking technology is designed to embed watermark information such as authentication information and any other information directly in the image or other signals. During the embedding process of watermark signal, distortion of the original image will inevitably be caused. This distortion is not acceptable for diagnostic medical imaging. In addition, with the development of information technology, in particular the substantial improvement of the communication speed by 5G technology, the transmission of medical images is more rapid and efficient. Previously, only a series of two-dimensional gray images in the same direction were used for disease diagnosis, and it was difficult to obtain the spatial relative position relationship between organs. Increasingly, medical images are being presented to doctors and patients in the form of three-dimensional models, and various operations are performed on such images, such as zoom, rotate, move, etc. This has allowed doctors to more intuitively observe whether the tissues or organs represented by the image have lesions, the location and size of the lesions, etc., so as to help them to conduct comprehensive pathological inquiry, technical communication, demonstration and simulated surgery. Most of today's existing medical images are comprised of threedimensional volume data, in particular 80% of the digital images generated by the new generation of medical devices are three-dimensional volume data, such as CT, MRI, ultrasound imaging and PET [4], [6], [20]. Fig. 1 provides some common medical equipment and images. These medical volume data carry more pathological information and patient's personal privacy information. Therefore, how to apply watermark technology to medical images, especially to medical volume data, is an urgent problem that the IoMT needs to be able to solve under big data and cloud environments. It must ensure the undistortion of the three-dimensional medical volume data, and solve the malicious tampering or attacks that may occur during the transmission of the three-dimensional medical volume data, especially geometric attacks. This protects the patient's private information from being leaked. Moreover, it has to meet the demand of coping with a large volume of medical data, which makes the watermarking algorithm have good robustness [5], [8], [14]. At present, most of the medical watermarking algorithms are based on two-dimensional images. The research on medical volume data are relatively few, which are mainly divided into three classes, the first of which is 1) Medical image watermarking based on RONI. Considering the sensitivity and intolerable changes in medical image content, watermark embedding information is often chosen to be embedded in the non-region of interest (RONI) [1], [4]- [6]. A medical image region of interest (ROI) refers to a lesion area that contains important pathological features or diagnostic and therapeutic information. For example, Priyanka and Maheshkar [7] proposed a hybrid medical image watermarking (MIW) scheme based on detecting and locating ROI tampering with high accuracy. It calculated the position and correlation bits in the pixel direction and embedded multiple robust watermarks into RONI at the same time through the IWT-SVD hybrid transform. Mousavi et al. [8] proposed a novel spatial robust medical watermarking algorithm. It used channel coding and noise filtering to embed EPR information into RONI, which improves the robustness of salt and pepper noise and compression attack. Among them, the encoding of EPR bit is determined according to the ROI pixel of LSB, and it is valid for medical images with a single region of interest. Ishtiaq et al. [9] designed a hybrid predictor that represents images in four stages to maximize the prediction context variance and improve prediction accuracy. The watermark can be adaptively and reversibly embedded. Swaraja et al. [10] designed an optimized blind double medical image watermarking framework that hid the double watermark in the noninterest area (RONI) block of the medical image to obtain tampering identification and authenticity for secure remote medical tampering location and content authentication. However, the capacity to embed watermarks in medical volume data is limited because most areas of non-interest are black backgrounds. It often takes people a long time and effort to find ROI. And if the RONI is chosen wrong, it will interfere with the doctor's diagnosis. The second research class is 2) Reversible watermarking. Priya and Sadasivam [11] combined digital signature technology, compression, and hashing to embed the watermark with a reversible least significant bit. This uses compressed region of interest to recover and create content-related watermarks. Qasim et al. [12] proposed a new blind reversible watermarking scheme for brain magnetic resonance imaging (MRI) based on the reversible watermarking technique of difference expansion (DE). It encoded the watermark data to the region of interest, and the imperceptibility is poor. Liu et al. [13] designed a reversible medical watermarking method based on recursive jitter modulation (RDM), which combined RDM with Slantlet transform and singular value decomposition to generate ROI and RONI watermarking respectively, reducing the risk of spatial segmentation and avoiding diagnostic errors by lossless ROI recovery. However, it is not robust to geometric attacks such as rotation. Zhong and Shih [14] proposed a reversible watermarking scheme for medical images with large capacity. Based on shape decomposition, it combined the frequency domain watermarking with the region of interest method of arbitrary shape, which significantly improves the watermark capacity. Once the embedded information is read, the watermark is removed and returned to the original medical volume data [6], [24], [30], [32]. Most reversible watermarks are fragile, hence their robustness is poor and their embedding capacity is less than that of non-reversible watermarks. 3) Classical watermarking. These methods embed the watermark information in the least significant bit (LSB) of the spatial domain [15], or into the medium-frequency or low-frequency coefficients of the frequency domain, DCT, DFT, or DWT [22], [25], [26], [33]. Thabit and Khoo [16] performed Slantlet transformation (SLT) on the non-overlapping blocks of the main image, and then modified the difference value of the average SLT coefficient in the high-frequency subband to embed data bits. It can be used for color medical images, and the three RGB channels increase the embedding capacity. Then, Thabit and Khoo [17] improved the watermarking algorithm by embedding the watermark into ROI and RONI using Slantlet transform (SLT), and recovering the watermark information by the ROI of integer wavelet transform (IWT) coefficient. The scheme is robust to unintentional attacks. Loan et al. [18] proposed a secure blind watermarking scheme in the DCT domain. The algorithm divided the host image into 8 non-overlapping blocks, and embedded the watermark by modifying the difference between the coefficients of adjacent intermediate frequencies.
It is robust to median filtering, sharpening, compression, and cropping. Bamal and Kasana [19] used the Walsh-slantlet transform to embed dual-mixed medical watermarks in ROI to achieve robust data hiding. Chauhan et al. [20] proposed an improved watermarking for medical images based on wavelet transform, which quantified multiple medical information watermarks to achieve secure electronic health. However, compared with the previous two types of methods, the watermark capacity embedded by this method will affect the content of the region of interest. Therefore, in order to avoid doctors making a wrong diagnosis, it is also necessary to control the amount of information to be embedded. In addition, the robustness of classical watermarking is poor, especially in resisting geometric attacks. Besides, for 3D volume data, there exist some medical volume data watermarking algorithms based on grid template [21], or new watermarking algorithms combined with other technologies [22], [23], [31], [34].
In general however, the research on medical volume data watermarking technology is sparse and is still in its infancy [21], [23], [24], [34]. Medical volume data has its own characteristics, and it still presents many problems to be solved, including: (1) how to prevent distortion of medical images and ensure the accuracy of doctors' diagnoses; (2) how to solve the problem of large capacity; (3) how to design the watermarking algorithm so that it can balance robustness and invisibility, and have strong robustness to both common attacks and geometric attacks; (4) how to optimize the watermarking algorithm according to the features of medical volume data and reduce its computational complexity; (5) how to meet the higher requirements for the security of the transmission and storage of medical volume data in the new environment such as cloud storage and cloud transmission in the IoMT [19], [20], [22], [32].
In order to solve the above problems as far as possible, combining with the characteristics of medical volume data, a robust watermarking algorithm for medical volume data in the IoMT is proposed. This uses 3D hyperchaos to encrypt watermark in advance to improve security, and applies lowfrequency information of 3D double-tree complex wavelet transform (3D DTCWT) and 3D discrete cosine transform (3D DCT) to extract a sequence of features by drawing on the concept of perceptual hash and human visual features to meet the special requirements of medical volume data. Then, the algorithm is combined with the encrypted watermark information to form a secret key to complete the embedding and extraction. The main contributions of this paper are as follows: 1. A new algorithm for extracting features of medical volume data based on human visual characteristics is proposed. This algorithm does not need to divide the region of interest (ROI) in the original image, and does not make any changes to the original medical volume data, in order to effectively protect the integrity of the medical image and meet the strict requirements of medical volume data for diagnosis.
2. The watermark encryption uses the Lorenz threedimensional hyperchaotic system, which has richer initial conditions and is extremely sensitive to the initial value, thus enhancing the security of watermarking.
3. The watermark embedding and extraction algorithm design combines the features of perceptual hash, and uses logical operations to generate a set of secret keys that can be stored in a third party to complete the watermark embedding and extraction. It achieves zero watermarking and blind extraction.
4. Each MRI, CT and other medical volume data can be represented by a 32-bit feature vector, which greatly reduces the storage volume of medical volume data and better solves the problem of transmission and storage of massive medical volume data in the IoMT. The algorithm is robust and can effectively resist both common attacks and geometric attacks.

A. LORENZ 3D HYPERCHAOS
Compared with 2D medical images, 3D medical volume data contains more information than the former [27]. Traditional encryption methods, such as DES and RSA, have VOLUME 8, 2020 the disadvantages of complex structure, single key and slow encryption speed, which make it difficult to meet the encryption requirements of medical body data with such a large amount of data [28]. In view of the limitations of traditional image encryption and low-dimensional chaotic encryption, this paper proposes an improved perceptive hash method to encrypt watermark information by using Lorenz system to generate hyperchaotic sequence for 3D displacement.
Applying the Lorenz 3d hyperchaos system, its dynamic equation is: where β, σ, ρ are the system parameter, and all of them greater than 0. When β = 10, σ = 28, ρ = 8/3, the Lorenz system enters chaotic state. At this point, a double vortex attractor appears, as shown in Fig. 2. The Lorenz system is a classical three-dimensional chaotic system. The advantages of using Lorenz system to generate encrypted chaotic sequences are as follows: first, the structure of Lorenz system is relatively complex and the generated real numerical sequences are more unpredictable. Second, the three initial values and three parameters of the system can be used as seed keys to generate encrypted chaotic sequences. Its key space is much higher than that of low-dimensional chaotic system. Third, either a single or multi-variable combination of the encryption chaotic sequence can be used to process the real value of the system output chaotic sequence, so that the design of sequence cipher is more flexible.

B. 3-D DUAL-TREE COMPLEX WAVELET TRANSFORM
The dual-tree complex wavelet transform (DTCWT) is proposed to overcome the defects of the usual discrete wavelet transform [29]. When the corresponding wavelet basis (approximate) satisfies the Hilbert transformation relation, it can greatly reduce the translation sensitivity in the normal real wavelet transform and improve the direction selectivity [33], [34].
The 3D DTCWT is similar to the 2D DTCWT. Suppose that ϕ g (t) is approximately the Hilbert transform of ϕ h (t), where, the real part is: We define: In the 3D case, four separable wavelet transforms need to be combined, instead of two in the 2D case. Equation 5 gives the orthogonal combination matrix of four separable 3D DTCWT: By applying this combination matrix to each of the seven subbands, the 3-D dual-tree complex wavelet transform as shown in Fig. 3 is obtained. In the 3D DTCWT, each level has 28 wavelet subbands. Fig. 4 shows the volume data of a normal human brain and the low-frequency subband coefficients after 3D DTCWT-DCT transformation.

III. PROPOSED ALGORITHM
Medical volume data, such as CT and MRI, are different from ordinary two-dimensional images. When they are used for disease analysis and diagnosis in the form of threedimensional model, the data volume is large and the analysis is relatively difficult. If they are transmitted in the network, due to the need of real-time diagnosis, the transmission speed cannot be sacrificed and the security of transmission and the robustness of watermark must be guaranteed. Hence, to meet the feature and special requirements of 3D medical volume data, a robust watermarking algorithm for medical volume data based on 3D DTCWT-DCT and hyperchaos scrambling is proposed here. It is designed according to the human visual perception model, combined with the concepts of hyperchaos scrambling algorithm, 3D DTCWT, perceptual hash and cryptography, and applies the contour features of medical volume data to embed and extract watermark information. The details are as follows.

A. EXTRACT THE FEATURE VECTOR OF MEDICAL VOLUME DATA
In the watermarking algorithm, the key is to extract a perceptive hash value that reflects the geometric feature of medical volume data. According to the characteristics of perceptive hash, the perceptive hash value of medical volume data will not change significantly when there is a small geometric transformation. Moreover, the 3D DTCWT can perform better directional selectivity and translation invariance when being attacked, hence it is more suitable for finding the feature vector of medical volume data. To extract the feature vector of medical volume data, the two-layer 3D DTCWT is first applied to the medical volume data, then the global 3D DCT transform is performed on its low frequency coefficients. Some examples of attacks are applied to the medical volume data, as shown in Figure 6 and Figure 7. The coefficient values that are obtained through the same transformation in various attacks are compared with the original medical volume data.
The original volume data used for testing is a standard MRI brain volume data in the software of Matlab R2019b, as shown in Fig. 5. The tenth slice was taken in this simulation. Table 1 lists the performance of the brain volume data in the 3D DTCWT-DCT domain under several attacks and their related images are shown in Fig. 6 and Fig. 7. By observing these coefficient data, we found that although    illustration, only the first nine symbol sequences are listed in table 1.
We then randomly selected 12 groups of volume data from 1,000 groups of different volume data which dataset comes from Osirix DICOM image library, and 3D modeling them, as shown in Fig. 8. Then we calculated the NC values between them respectively by using the method explained above. The results of table 2 show that the NC of the given 3D volume data is equal to 1.00 only when the shape is consistent, and the correlation coefficient between different contours is very low. Combining the properties of perceptual hashing, this effectively verified that the coefficient symbol sequences of 3D DTCWT-DCT can be used as important visual features of volume data to obtain their feature vectors. It can represent well the three-dimensional contour features of medical volume data.
to be used as a watermark to embed into medical volume data in the simulation, and an MRI brain volume data as the original medical volume data.
Apply the Lorenz 3D hyperchaos scrambling algorithm to encrypt the watermark, as shown in Fig. 9.
The process is as follows: (1) Generate chaotic sequence using the Lorenz 3D hyperchaos method; (2) Obtain the watermark with chaotic scrambling. First, the values in the chaotic sequence are sorted in ascending order from small to large, then the position space of the  watermark pixels are scrambled according to the position changes before and after the sorting of the values in the chaotic sequence to obtain the chaotic watermark.

C. WATERMARK EMBEDDING AND EXTRACTION
The watermark is embedded and effectively extracted by feature vectors that can represent the external contour of medical volume data. The robust watermark embedding and extraction algorithm process of medical volume data is as follows: (1) Apply the 3D DTCWT-DCT operation and symbol transform on the original medical volume data to obtain the 32 bits feature vectors: (2) Embed the chaotic watermark BW (i, j) into the medical volume data by XOR operation to obtain the secret key. Then save the Key (i, j) for later extraction of the watermark. This key can be stored on a third party: (3) The receiver then obtains the contour features of the volume data V (j). The attacked volume data obtained by the receiver is expressed as F (i, j, k) , and the contour vector is obtained according to the method of step (1) above.
(4) Get the watermark contained in the receiver data BW (i, j). Apply the key Key (i, j) saved above, then V (j) is obtained by the receiver to retrieve the watermark BW (i, j) contained in it through the character of the hash function.
The watermark is a hyperchaos image, which can be restored to obtain the information in the watermark. Fig. 10 and Fig. 11 illustrate the watermark embedding and extraction process.

D. WATERMARK RESTORATION
Apply the Lorenz 3D hyperchaos scrambling algorithm to restore the watermark, the details are as follows:  (1) Generate chaos sequences via Lorenz 3D hyperchaos. This generation method is the same as in the previous step 1.
(2) Recover the extracted watermark by using the opposite method of step 2. The ownership of the data to be measured is determined by the degree of correlation between W (i, j) and W (i, j). Fig. 12 shows this restoration process.

IV. SIMULATION AND DISCUSSION
This simulation selected the three-dimensional MIR image volume data F (i, j, k) of Matlab R2019b, with the size of 128 pixels x 128 pixels x 27 pixels, as shown in Fig. 13 (a) and other different medical volume data, as shown in Fig. 8 to test. The tenth slice of the medical brain data is shown in Fig. 13 (b). The image containing specific information is used as the original watermark, denoted as W = Fig. 13 (c). The watermark image size is 32 pixels × 32 pixels. The watermark after Lorenz 3D hyperchaos scrambling is applied is shown in Fig. 13 (d). It can be clearly seen that the watermark becomes chaotic and it is not possible to obtain effective information from it, hence it is highly concealed. If the watermark is modified to the wrong initial parameters of 3D Lorenz hyperchaos, it cannot be extracted correctly. The watermarks extracted after hyperchaos encryption with incorrect initial values are shown in Fig. 13 (e) and Fig. 13 (f). After the watermark W (i, j) is obtained from the volume data with this algorithm, NC is calculated. The robustness of this watermarking method is judged according to the peak signal to noise ratio (PSNR) and the NC value. Fig. 14 is the volume data without any attacks and the obtained watermark. It can be seen that the medical volume data embedded with a watermark is visually identical to the original data without any watermark, which indicated that the embedding of the watermark has no impact on the original data and meets the requirement of zero watermarking.
In the following specific experiments, the resistance and robustness of the watermarking algorithm were determined by performing common attacks and geometric attacks on the twelve different watermarked medical volume data.

A. COMMON ATTACKS
First we applied different degrees of common attacks to the medical volume data. Fig. 15 shows the brain volume data, a slice of the brain and the images under three different Gaussian noise disturbances. Fig. 15 (a) is the watermarked brain volume data, Fig. 15 (b) is a slice of the brain volume data, Fig. 15 (c), Fig. 15 (d), and Fig. 15 (e) portray the brain slice with different Gaussian noise disturbances applied. Their VOLUME 8, 2020  noise intensities are 0.01, 0.15 and 0.40, respectively. It can be seen from the figures that when the noise intensity is 0.01, the brain slice has noise interference that can be observed with the naked eye, the PSNR value is 12.5281dB. With the increase of noise intensity, the image quality decreases obviously. When the noise intensity reaches 0.4, the PSNR value of the brain data is only 0.2076dB. The image of the brain in Fig. 15 (e) is almost indistinguishable from the noise. However, it can be seen from the table 3 that at this time, the NC value of the brain data is still up to 0.96. Its noise image and extracted watermark are shown in Fig. 16 (a), and the watermark is clear and recognizable. The performance of various medical volume data under Gaussian noise are shown in table 3 and Fig. 16. In general, the proposed watermarking algorithm performs well under Gaussian noise attacks. Even when the noise intensity data goes up to 0.4, the NC value of the watermark is still above 0.95, and eighty percent of the NC values are as high as 1.00.
We perform compression operation on each of the watermarked medical volume data. Taking the brain volume data as an example, Fig. 17 shows the slice images with compression quality of 1%, 3%, and% 6. By comparing Fig. 17 and Fig. 18 (a), it can be seen that when the compression quality is 6%, the image has obvious block effect. With the decrease of the compression quality, the block effect becomes more and more obvious. When the compression quality is 1%, the stereo square effect of the brain volume data has spread all over the three-dimensional image with a PSNR value  of only 16.5622dB. Compared with Fig. 17 (a), the compressed Fig. 18 (a) undergoes significant changes. However, the watermark can still be correctly extracted under such a low compression quality, and the NC value is 0.90. Table 4 shows the other watermarked medical volume data under different compression attacks. From these data, it is concluded that the performance of each of them is robust under compression attacks. Even if the compression quality is reduced to 1%, their average NC values are all above 0.94. Fig. 18 shows the images and the extracted watermarks under such compression. They all showed good extraction results.
Median filtering attacks with different window sizes and filtering times are added to the twelve different watermarked medical volume data. Observing Fig. 19 and Fig. 20, it can be seen that when the median filtering window size is 5 × 5 and the filtering time is 1 time, the slice contour of the watermarked brain volume data has begun to blur. When the window size is kept unchanged and the number of filtering times are increased to 10 times, the degree of blurring of the image is particularly obvious, and the details of the sliced image are almost invisible. When the window size is adjusted to 11×11 and the number of filtering times are 20, Fig. 19 (e) has become a white elliptical contour that is almost impossible to recognize when compared to the original image. It changes dramatically both in shape and in detail, and the edges are extremely blurry. Table 4 shows the simulation data of each set of watermarked medical volume data under different window sizes and filtering times. Fig. 20 shows the three-dimensional images against their volume data and the extracted watermark when the window size is 11× 11 and the number of filtering times are 20. By observing them, it can be concluded that with the increase of the window size and the filter times, the PSNR value and the NC value of the image both show a decreasing trend. Moreover, under the parameters in Fig. 20, the appearance of each watermarked medical volume data has undergone great changes, and the filtering effect is obvious. Still, the watermarks they extracted were clear, with an average NC value of 0.93. Hence, the algorithm is robust under median filter attacks.

B. GEOMETRIC ATTACKS
Next, we performed five geometric attacks on these watermarked medical volume data, including clockwise rotation, scaling, warping, cropping, and translation. At present, the solutions posed in existing literature generally have a weak resistance to geometric attacks, especially to the aboved several geometric attacks. They have almost no resistance or do not mention their ability to resist geometric attacks in related literature. Therefore, we focus on the simulation and discussion of these five geometric attacks.
The watermarked medical volume data were sequentially rotated clockwise from 5 • to 75 • . As shown in Table 6, with the increases of rotation angle, the image quality decreases sharply, and the NC values also decreases. Figure 21 shows a slice of brain volume data rotated by 5 • , 30 • and 45 • , respectively. Especially when the rotation degree reaches  45 • , the position of the brain slice has changed a lot. The stereogram of the slice after rotation of 75 • is shown in Fig. 22(a). The three-dimensional images of the other watermarked medical volume data with a clockwise rotation of 75 • are shown in Fig. 22. Intuitively, compared with the common attacks mentioned above, the watermark images extracted by clockwise rotation of 75 • have some scattered distortion pixels. Nonetheless it can still completely present the information content in the watermark. In addition, it should be noted that these three-dimensional images can keep the average NC value above 0.76, much larger than 0.5, even when rotating clockwise by such a large angle as 75 • . This function is unachievable by many other existing algorithms, which fully illustrates that the proposed algorithm has strong robustness against clockwise rotation attacks. 93950 VOLUME 8, 2020   [11 × 11], 20times: (a) brain and the extract watermark; (b) spine and the extract watermark; (c) liver 1 and the extract watermark; (d) heart and the extract watermark; (e) brain 2 and the extract watermark; (f) brain tissue and the extract watermark; (g) abdomen and the extract watermark; (h) knee and the extract watermark; (i) liver 2 and the extract watermark; (j) foot and the extract watermark; (k) kidney and the extract watermark; (l) pelvis and the extract watermark. The scaling attacks experiments were carried out on each set of watermarked medical volume data. Fig. 23 shows schematic images of brain slices with scaling factors of 0.1, 0.2, and 80. When it is reduced, the patch effect of the image is obvious, and obvious pixel distortion is apparent. When reduced to a size of 0.1 times, a distorted image composed VOLUME 8, 2020  of individual pixel blocks can be seen. Fig. 24 shows the rendered volume image and extracted watermark when the volume data is reduced by half. According to table 7, the NC values of the watermarked medical volume data are all equal to 1.0, except for the image of the knee, which is 0.96. The watermarks were extracted 100% correctly. In addition, they can still maintain a high level of NC values after being subjected to 0.1 times of scaling attack and 8.0 times of amplification. All these good performance indicators prove that the algorithm is robust under scaling attacks.
We set different distortion parameters ranging from 2 to 87 for each watermarked medical volume data. As shown  in table 8, the larger the distortion factor, the higher the distortion frequency. The slice image of the brain volume data with a distortion factor of 2 is shown in Figure 25 (c). In comparison with the original image, it produces a significant distortion effect. The distortion factor in Figure 25 (d) is 13, and it can be seen that the increase in distortion frequency has a great impact on the image. When the distortion factor is 87, the resulting image is shown in Fig. 25 (e). The distorted image has completely turned into a twist-like shape, making it impossible to discern the original image. Fig. 26 shows in detail the distorted stereograms of each set of watermarked medical volume data and the extracted watermarks when the distortion factor is 13. From these images, we found that even if the distortion factor is only 13, each of the watermarked medical volume data has already undergone a huge distortion effect, and the image contour has become unrecognizable. The extracted watermark also has many pixel distortion points, however the original watermark data and shape can still be discerned. The NC value of most medical watermarks is much higher than 0.80. Even if the distortion factor is as high as 87, the NC value of these volume data can remain around 0.70. This is a very robust data result.
We perform X-axis and Z-axis cropping attacks on all kinds of watermarked medical volume data with the X-axis VOLUME 8, 2020   cropping ranging from 5% to 25%, and the Z-axis cropping ranging from 10% to 48%. Fig. 27 shows a slice of brain with X-axis 5%, X-axis 25%, and Z-axis 20%. In any kind of the cropping operations, the size and content of the image  Table 9 lists the simulation data results under different cropping attacks. Obviously, with the increase of the cropping percentage, the NC value of the image becomes smaller, which is caused by the change of the size and appearance of the image. Fig. 28 is the watermarked medical volume data with 40% Z-axis cropping. Compared with the original image, the rendered volume data images after the attacks undergo a big change in the outer contour, and a large part of the information is lost at the top. Some medical volume data, such as the heart, can no longer be seen in its original form. However, the extracted watermark images are still clear and easy to identify, and the NC value is high, almost reaching 0.90. Thus, the performance of the algorithm is very robust under the X-axis cropping attacks and Z-axis cropping attacks. Fig. 29 used watermarked brain volume data as an example, and showed the corresponding brain slice images when it is translated to the left by 20%, 25%, and vertically downward by 25%. When moving left by 20%, the brain image has been moved from the original position in the middle of the image to the left edge, and a small part of the left brain content has been moved to the outside of the visible area so can no longer be seen. When the percentage of translation reached 25%, nearly a quarter of the entire brain image is lost to the left of the image. Similarly, by moving down 25 percent vertically, the lower part of the original brain has been removed from the image, and the black part of the upper half has increased significantly. For the convenience of observation, Fig. 30 shows the watermarked medical volume data images and their extracted watermarks when they are shifted to the left by 28%. Among them, two different livers were adjusted for viewing angles in order to facilitate observation. Their image quality and NC values under translation attack are listed in Table 10. Observing the tables 10 and Fig. 20, it is easily concluded that their NC values perform well regardless of whether they are shifted significantly to the left or vertically. And when the left shift range reached 28%, the average value of NC was still as high as 0.84. The vertical shift can also keep the NC value around 0.70 at 25%. They therefore show a good watermark extraction effect under translation attack.

C. COMPARISON
To further verify the robustness of the proposed algorithm, the standard brain volume data provided by matlab R2019b was used for a simulation comparison test. We compare the proposed algorithm with the anti-salt-and-noise-resistant brain magnetic resonance image watermarking method proposed by Mousavi et al. [8], the robust watermarking scheme using coefficient difference and chaotic encryption proposed by Loan et al. [18], and the reversible watermarking scheme based on recursive jitter modulation (RDM) proposed by Liu et al. [13] Some data results are shown in table 11, and their detailed comparison performance are shown in Fig. 31. When the same attack intensity is applied to the four algorithms, our proposed algorithm shows obvious advantages in the attacks of clockwise rotation, Z-axis cropping, warping, left translation and all the common attacks, with the NC values much higher than other algorithms. Even when the intensity of attacks increased, the curve of the NC values under these attacks are still very stable. The greater the intensity, the more obvious the difference between the curve and the curve of the other three algorithms is. There is no rapid downward trend, and the algorithm showed strong robustness and ability to resist high intensity geometric attacks. It is worth mentioning that although the proposed algorithm has no obvious curve change in the scaling attacks, compared with other algorithms, it has been kept on the straight line of NC, which is equal to 1.0. In addition, when zooming at a low factor, the smaller the size the image is reduced to, the more obvious its robustness advantage is. Especially when the scaling factor is as low as 0.1, its watermark can still be fully extracted with the NC value 1.0, which performs much better than other algorithms. In addition, in the comparison results of the downward translation, as shown in figure 31(g), the NC value of the proposed algorithm is slightly higher than the algorithm proposed by Liu et al. [13] and Loan et al. [18] When the downward translation exceeds 13%, the algorithm proposed in literature [13] and [18] are slightly higher than our algorithm after moving downwards by 15% and 20%, respectively. From the analysis of the introduction, the algorithm proposed by Loan et al. [18] embedded the watermark by pre-selecting and setting the difference of the IF coefficient and its range, which effectively managed the IF coefficient of the image and enabled it to perform well in the downward translation. The algorithm proposed by Liu et al. [13] generated watermarks for ROI and RONI respectively, and designed a recovery function for ROI, which ensured that when the percentage of downward vertical translation became larger, the watermark can still be efficiently extracted. In general however, the descent curve of the proposed algorithm is stable without obvious fluctuations, and when the downward vertical translation reached 25%, the NC value is slightly higher than the algorithm proposed by Liu et al. [13] and Loan et al. [18], and significantly higher than the algorithm proposed by Mousavi et al. [8]. In the downward translation attacks, the overall performance of our proposed algorithm is better than that of the existing algorithms.
In the IoMT, geometric attacks on medical volume data are much more common than ordinary attacks, and most algorithms will cause a certain degree of damage to the original VOLUME 8, 2020 FIGURE 26. Different watermarked medical volume data and their extracted watermark images under warping attacks with distortion factor 13: (a) brain and the extract watermark; (b) spine and the extract watermark; (c) liver 1 and the extract watermark; (d) heart and the extract watermark; (e) brain 2 and the extract watermark; (f) brain tissue and the extract watermark; (g) abdomen and the extract watermark; (h) knee and the extract watermark; (i) liver 2 and the extract watermark; (j) foot and the extract watermark; (k) kidney and the extract watermark; (l) pelvis and the extract watermark. data after geometric attacks. In addition, the scheme proposed by Loan et al. [18] required the host image to be segmented in advance, and the DCT coefficients of non-overlapping adjacent blocks to be modified to complete the watermarking operation. The algorithm has good performance on twodimensional images, but when applied to three-dimensional medical volume data, the robustness of the algorithm directly depends on the large amount of calculation and the quality of the segmentation. Compared with the algorithm proposed by Loan et al. [18], the algorithm proposed by Mousavi et al. [8] focused on against the pepper and salt attack for brain MRI images. It is very effective for two-dimensional medical images. However, the algorithm is based on RONI and spatial domain, which not only increased the complexity of the algorithm and generated additional computational overhead, but also brought risks to the robustness of the algorithm. They cannot adapt to different medical volume data, nor can they effectively meet the strict requirements of medical diagnosis for medical volume data to not be changed as much as possible. A reversible watermarking algorithm based on recursive dither modulation (RDM) designed by Liu et al. [13] embedded the watermark into RONI and ROI, reducing the watermark error. However, when applying it to medical volume data, it is necessary to consider how to accurately and quickly locate the area and reduce data calculation.
By analyzing the overall simulation results, it can be concluded that the proposed algorithm perfectly avoids the above shortcomings, meets the requirements of the Internet FIGURE 28. Different watermarked medical volume data and their extracted watermark images under 40% Z-axis cropping attacks: (a) brain and the extract watermark; (b) spine and the extract watermark; (c) liver 1 and the extract watermark; (d) heart and the extract watermark; (e) brain 2 and the extract watermark; (f) brain tissue and the extract watermark; (g) abdomen and the extract watermark; (h) knee and the extract watermark; (i) liver 2 and the extract watermark; (j) foot and the extract watermark; (k) kidney and the extract watermark; (l) pelvis and the extract watermark. of medical things transmission and storage, has simple calculations and good robustness, and can effectively resist various attacks while ensuring diagnostic accuracy. Especially in geometric attacks, it has not only strong robustness, but also can effectively resist high-intensity attacks. It has the following advantages: first, the watermarking scheme is based on the 3D DTCWT-DCT, which embeds and obtains the watermark through the transform domain. The comparative experimental data proved that this algorithm has a good ability to resist data manipulation. Secondly, the watermark embedded in the medicla volume data is scrambled by 3D hyperchaos. The content of the watermark has become confusing and does not contain any useful information. This encryption method is extremely sensitive to the initial value.   . Different watermarked medical volume data and their extracted watermark images under 28% left translation attacks: (a) brain and the extract watermark; (b) spine and the extract watermark; (c) liver 1 and the extract watermark; (d) heart and the extract watermark; (e) brain 2 and the extract watermark; (f) brain tissue and the extract watermark; (g) abdomen and the extract watermark; (h) knee and the extract watermark; (i) liver 2 and the extract watermark; (j) foot and the extract watermark; (k) kidney and the extract watermark; (l) pelvis and the extract watermark.   Without the correct key, the watermark cannot be extracted correctly. Finally, the design of the algorithm adopted zero watermarking and blind extraction technology, which enabled the embedded watermarking medical volume data to have a good visual effect, solved the contradiction between invisibility and robustness and satisfied the special requirements of medical image for watermarking. The watermark in this scheme does not affect the content of the original carrier data, and it can be correctly extracted without the original image.

V. CONCLUSION
In this paper, a novel robust watermarking algorithm is proposed to solve the problem of information security during the storage and transmission of medical volume data in 5G, cloud technology and Internet of medical things. The algorithm used the good direction selectivity and translation invariance of the three-dimensional double-tree complex wavelet transform, and combined human visual features and perceptual hashing to design the robust medical volume data feature extraction function. By using the cryptography technology and the third party concept, zero watermarking and blind extraction were realized without changing the medical volume data, which guaranteed the reliability of doctors' diagnoses and improved the diagnostic efficiency. Moreover, the 3D hyperchaos which is sensitive to the initial value was used to encrypt the watermark, enhancing the security of the algorithm. Simulation results show that the algorithm makes up for the shortcomings of the existing algorithms, and can effectively resist common attacks and geometric attacks. It has high security, low complexity, strong robustness, can better solve the problem of storage and transmission of massive medical data, and has a broad application prospect in the medical field in the future.