The rise of technology has opened up a slew of new possibilities for digital content creation and distribution. Web publishing and digital repositories/libraries are only a few examples of the many uses of this technology. However, the most critical matter with these applications is protecting users’ data. For digital data, current copyright laws are inadequate, according to experts. Consequently, the protection and enforcement of intellectual property rights for digital media have become a significant concern. As a result, researchers are working to devise new ways to keep copies from being produced. The use of digital watermarking techniques is one attempt that has gained significant attention. Stenciling and watermarking are two different techniques, but they both focus on the message’s durability and its ability to withstand removal attacks, such as image manipulations like cropping and filtering. For several different reasons, including copy protection and control, digital watermarking involves embedding information (the “watermark”) into digital multimedia content so that it may later be recovered or recognized. As digital content continues to increase at an ever-increasing rate, new watermarking techniques are being developed and commercialized to address some of these difficulties.

Medical images are playing an important role in the field of assisted medical diagnosis and telemedicine. Fast advanced network technology provides a good transmission channel for telemedicine and medical image information sharing, solving the problem of uneven distribution of medical resources, and improving the utilization rate of medical data. At the same time, medical image information sharing also faces problems such as illegal copying and tampering [1]. As an important basis for physicians to access patient information, the security and copyright protection of medical images is particularly important for the patient. Techniques used to protect the copyright of medical images are still required to explore for the security of data.

Digital watermarking technology [2], an effective way for traditional encryption techniques, enables the concealment of information and performs well on copyright protection for medical images [3]. Digital watermarking technology produces encrypted images by embedding watermarks with identification significance (such as author information, product serial number, trademark pattern, etc.) into the digital image without information value loss and usage effect of the digital image. Due to the good concealment, security and robustness, the watermark persists invariability even after various attacks, thereby determining the copyright confirmation of the digital image. As a basis for physicians’ diagnosis, medical images are more rigorous and complete. To ensure the accuracy and objectivity of the physician’s diagnosis, the copyright information of watermark embedded medical images should be clarified even under medical image attacking. The above-mentioned watermark embedding algorithms are not suitable for the digital watermarking scheme for medical images. Consequently, robust watermarking algorithms for medical images are required for security against different attacks.

The main digital watermarking algorithms can be classified into two types, spatial domain digital watermarking and transform domain digital watermarking. The spatial domain digital watermarking algorithm alters the image pixel directly by embedding the watermark information, which is simple and easy to implement with low robustness. The transform domain digital watermarking is a reversible mathematical transformation of the image before the watermark is embedded, and the watermark information is embedded in the transformed data and then inverted when the watermark is extracted. Compared to the spatial domain watermarking, watermark energy has an even distribution in the transformed image, making the watermark information more concealed to improve the embedding strength of the watermark information greatly [4].

Cox et al. [5] proposed a spread-spectrum digital watermarking algorithm that first transforms the discrete cosine transform (DCT) of the carrier image and then embeds the watermark information into the low-frequency sub-band, improving the watermark’s resistance to compression. Kang et al. [6] proposed a robust watermarking algorithm based on discrete wavelet transform (DWT) against geometric attacks; they introduce a distance measure between the distorted and undistorted images to determine the distortion before the image recovers by reversing the geometric distortion. The watermarking algorithm is resistant to geometric attacks such as rotation, scaling, translation, clipping, cropping, dithering attacks, and linear transformations. Cedillo-Hernandez et al. [7] proposed a robust watermarking algorithm for medical images based on the discrete Fourier transform (DFT), which embeds the watermark into the DFT domain of medical images ensuring the quality of medical images and improving the robustness of the watermark. The above algorithms realized the embedding and extraction of the watermark, but the extraction processes of image features were complex, and the algorithms were less resistant to high-intensity geometric attacks.

The core of digital watermarking technology is image feature extraction; however, the method of extracting data features manually is complicated. Therefore, we can automatically learn the potential attributes of data through deep learning (DL). In recent years, the research of deep learning has become a hot spot again, and its applications are all over the fields of computer vision, natural language processing, speech recognition, and so on. Based on the research on deep learning, Cheng et al. [8] proposed a lightweight multiscale information fusion network (MIFNet), which solved the two problems of accurate segmentation and efficient reasoning and improved the performance of semantic segmentation technology. Among the typical deep learning networks, deep learning models such as convolutional neural networks (CNN) [9], deep residual networks (DRN) [10], generative adversarial networks (GAN) [11], and U-Net [12] have achieved outstanding results in various fields. Adding attention mechanisms with deep learning approaches also increases the performance of classification and recognition [13]. Zhao et al. [14] used cross model attention mechanism for character recognition and show the performance of the machine learning method improves with the attention mechanism. Yuan et al. [15] applied a deep residual network (DRN) to fingerprint liveness detection (FLD) for the first time and proposed an FLD algorithm combining region of interest (ROI) extraction and DRN based on adaptive learning (ALDRN). The experimental results of the algorithm are better than the most advanced FLD method.

Convolutional neural networks (CNN) are a widely used neural network architecture. It is an effective algorithm for automatic learning and recognition of required features. It plays an important role in speech recognition, image detection, and image classification [16]. Leonid et al. [17] realized the classification of elephant sounds through CNN by concatenating parallel convolution layers and then extracting features from different feature sets. Lee [18] used CNN to simulate the structure of the human optic nerve and completed the classification and detection of small moths through automatic learning and recognition. Sudha et al. [19] trained deep CNN VGG-19, which extracted features from 20000 image training sets and extracted features from 5000 image test sets, and achieved automatic labeling and classification of diabetic retinopathy (DR) grades. The sensitivity and accuracy of the algorithm were 82% and 96%, respectively. Rajakumari et al. [20] extracted the features and realized the detection and classification of breast cancer by introducing the reconstructed image into the CNN GoogleNet model. Zhang et al. proposed a 3D watermarking algorithm based on wavelet-based transform with improved security [21] and used a similar approach for soft tissue processing [22].

As mentioned above, a deep learning network has obvious advantages in the automatic extraction and recognition of speech and image features. Therefore, in recent years, the research on digital watermarking technology is also closely combined with deep learning networks. Through the integration of the two technologies, the research in the field of digital watermarking technology has achieved creative results [23]. Jin et al. [24] proposed a digital watermarking algorithm based on CNN, which firstly divides the original image into 8 × 8 image blocks, and then uses CNN to learn the texture properties and luminance properties of the image and adaptively determine the embedding strength of the watermark, the algorithm balances the invisible rows and robustness of the watermark. Kandi et al. [25] proposed a novel learning-based auto-encoder CNN for image watermarking that outperforms traditional image watermarking techniques in terms of imperceptibility and robustness. Fierro-Radilla et al. [26] proposed a reinforcement learning model to ensure the robustness of watermarking. The learning process consists of three stages: watermark embedding, attack simulation and weight update, and experiments demonstrate that reinforcement learning is more competitive than supervised learning. Hayes et al. [27] applied adversarial neural networks to digital watermarking, and the network model can determine whether an image contains watermarked information. Baluja et al. [28] trained a neural network to hide a full-color image within another image of the same size, the watermarked image has a very good visual effect, and the algorithm can embed not only images of different sizes but also text and audio. Meng et al. [29] and Liu et al. [30] developed an irreversible watermarking scheme using wavelet transform and U-net based machine learning method. Fang et al. [31] proposed an information hiding technique based on adversarial generative networks to effectively secure data in data sharing. Uchida et al. [32] embedded watermarking information in the network model without affecting the performance of the network to ensure the intellectual property of the shared neural network model.

By considering the above studies, we can conclude that watermark algorithms performing directly on the original image cannot avoid affecting the image quality and the watermarks are unstable to geometric attacks. Aiming to address the intolerable problem of the watermark algorithm of medical images, this paper proposes an algorithm based on the combination of CNN Inception V3 and DCT to process the medical image and extract the image feature vectors. The algorithm combines logistic map and hash functions to scrambled encryption of watermarks. The “third party” concept to achieve zero embedding and blind extraction of multiple watermarks is also combined to improve the performance of medical image watermarking techniques.

The main contributions of this research are: (1)

A CNN-based image feature extraction method is proposed, extracting the fully connected layer data (predictions) of the Inception V3 network as processing data and extracting image features through the DCT transform. The algorithm achieves algorithmic innovation by combining deep learning theory with traditional image transformation theory.

The theoretical basis of this paper is the combination of the CNN Inception V3 and the traditional transform DCT to achieve the embedding and extraction of digital watermarks of the medical image through watermark encryption techniques.

This study proposed a watermarking algorithm based on a CNN Inception V3 combined with DCT, generating a key sequence using chaotic encryption during the watermarking process. We found that in most of the relevant literature on watermarks, whether single watermark or multi watermark, the content of watermark information used is mostly text type. To test the robustness of the algorithm based on Inception V3 and DCT from multiple angles and all aspects, we use multiple watermarking schemes where the watermark information includes three types of text, graphics and symbols to achieve zero watermarking and blind extraction in the following experiments.

The algorithm consists of five parts: Inception V3-based feature extraction, watermark encryption, watermark embedding, watermark extraction and watermark decryption. First, the original medical images are convolved and pooled using the Inception V3 network to obtain the fully connected layer data (predictions). Then, a global discrete cosine transform is applied to the fully connected layer data and the low-frequency data is selected from the matrix obtained by DCT as the visual feature vector of the medical image. Finally, a new feature sequence based on perceptual hashing was found in the DCT domain to participate in the watermark operation. In the design of the algorithm, watermark technology is combined with chaotic encryption, cryptography and the third-party concept, which not only allows the digital watermark to resist conventional and geometric attacks but also makes the algorithm robust. Meanwhile, the use of multiple watermarks also enhances the security of medical image transmissions, protecting the privacy of patients.

This experiment used Matlab 2019a as the test platform and selected an abdominal CT image as the study object. We choose three different types of images as watermarks (as shown in Fig. 11). Verify the robustness of the algorithm from multiple perspectives. Fig. 12 shows the encrypted watermarks effect. The encrypted watermarks change greatly and are completely unrecognizable to the naked eye, which improves the security of the watermark information.

This article presents a multi-watermarking technique based on Inception V3 and DCT that combines deep learning and classical transforms. A CNN is firstly used to automatically extract the fully connected layer coefficients (predictions) of the medical image. Then, the DCT transform is applied to extract features. To protect the security of the watermarks, the watermarks are scrambled and encrypted using the logistic map system. This algorithm uses a hash function to implement a zero-watermarking technique by storing the key through a third platform, achieving blind extraction of the watermarks during watermarks extraction. To verify the feasibility of the algorithm and promote its generalization using, three different types of watermarks (text, image, symbol) were selected for this experiment. The experimental data shows that the algorithm is more robust to conventional attacks and performs better than traditional watermarking algorithms against geometric attacks. Therefore, the algorithm is important for the medical field, where image quality is very demanding.