Abstract
Digitized forms of images do widely used for medical diagnostics. To maintain the privacy of an individual in e-health care applications, securing the medical image becomes essential. Hence exclusive encryption algorithms have been developed to protect the confidentiality of medical images. As an alternative to software implementations, the realization of image encryption architectures on hardware platforms such as FPGA offers significant benefit with its reconfigurable feature. This paper presents a lightweight image encryption scheme for medical image security feasible to realize as concurrent architectural blocks on reconfigurable hardware like FPGA to achieve higher throughput. In the proposed encryption scheme, Lorentz attractor’s chaotic keys perform the diffusion process. Simultaneously, the pseudo-random memory addresses obtained from a Linear Feedback Shift Register (LFSR) circuit accomplishes the confusion process. The proposed algorithm implemented on Intel Cyclone IV FPGA (EP4CE115F29C7) analyzed the optimal number of concurrent blocks to achieve a tradeoff among throughput and resource utilization. Security analyses such as information entropy, histogram, correlation, and PSNR confirms the algorithm’s encryption quality. The strength of diffusion keys was ensured by randomness verification through the standard test suite from the National Institute of Standards and Technology (NIST). The proposed scheme has a larger keyspace of 2384 that guarantees good confusion through near-zero correlation, and successful diffusion with a PSNR of <5 dB towards the statistical attacks. Based on the hardware analysis, the optimal number of concurrent architectural blocks (2 N) on the chosen FPGA to achieve higher throughput (639.37 Mbps), low power dissipation (138.85 mW), minimal resource utilization (1268 Logic Elements) and better encryption quality for the proposed algorithm is recommended as 4 (with N = 2).
Introduction
Employing e-health security solutions has become an emerging trend globally due to the fascinating evaluation of telemedicine applications [1]. Digital Imaging and Communications in Medicine (DICOM) is one among the medical image format that has been recommended by the National Electrical Manufacturers Association (NEMA) [2–4]. When shared across a wide range of network, these medical images become vulnerable to several attacks such as side-channel, man in the middle, occulation, cropping, etc. [5, 6]. Usually, medical images are considered in larger sizes having grater pixel depth with more redundancy and strong correlation between its adjacent pixels. Hence, the conventional encryption algorithms like AES, DES, and IDEA are regarded as less suitable to secure medical images[5, 7–10]. Nowadays, image-specific cryptographic solutions specifically designed to preserve medical images have captivated researchers’ attention [8].
The researchers proposed several techniques addressing medical images’ security by implementing encryption algorithms on the software platform, such as Matlab. Dhivya et al. [11] proposed a scheme for encrypting colour DICOM images. In [11] the use of chaotic keys generated from coupled logistic tent and sine map results in a larger keyspace of 10268 with nearly zero correlation among the adjacent pixels of the encrypted image achieved via DNA based diffusion process. The Edge Map-based Medical Image Encryption (EMMIE) algorithm proposed by Weijia cao et al. [12] suggests combining biplane decomposition, random sequence generation and permutation processes at an enhanced keyspace in the order of 10327 to mitigate brute force attack. The algorithm by Jeyamala Chandrasekaran et al. [13] proposed the integration of number theory and chaotic Henon map to generate a unique random key to encrypt each pixel of the DICOM image. Though this approach has offered a higher level of encryption which has been resulted in accomplishing low PSNR value of 6.7370 dB, the reduced entropy of 7.1023 (against the maximum value of 8) measured on the encrypted image shows the lack of randomness in the encrypted pixel values. The use of permutation-substitution-diffusion sequence with logistic-Chebyshev, DNA encoding and sine-Chebyshev was developed by AkramBelazi et al. [14] for the encryption of medical images. This approach has offered almost a zero correlation (0.0008) with a global entropy value of 7.9993 and a larger keyspace (2716).
Software implementation of security architectures achieves better performance with limitations in terms of time complexity, flexibility and vulnerability to attacks [15]. Reconfigurable / resource-constrained hardware platforms like FPGA and microcontrollers are preferred predominantly to build prototypes with faster time to market for image security through lightweight watermarking and encryption schemes [16–18]. Further, embedded hardware platforms such as FPGAs also address the issues concerned with software implementations.
In [7], The chaotic RGB image encryption algorithm implemented in cyclone II FPGA in [7], encrypts a 256×256 RGB image in 28.22 ms when operated at 50 MHz and dissipates 210 mW of power. Sundararaman et al. [6] performed similar RGB image encryption with Lorentz and l? chaotic attractor. Implementing on the same cyclone II FPGA hardware could minimize the encryption time by approximately 50% (14.73 ms) against [7] while offering better correlation and entropy with improved keyspace. A Penta layer security scheme by Dhivya et al. [19] used the chaotic clocks generated by PLL of the cyclone II FPGA and four other PRNG schemes to generate multiple secured keys. Despite its better encryption, the increase in consumption of logic elements (2480) and high-power dissipation (278.65 mW) are viewed as significant drawbacks of this implementation.
Cheng chen et al. [20] designed a Chua circuit based image encryption scheme and implemented in EP4CE15F17C8 FPGA chip. The encryption scheme used 20 ns clock. The chaotic sequences were obtained from the Chua -chaotic system based on the fourth-order Runge- Kutta method, which utilizes more LEs on FPGA. This method produced good randomness when simulated using MATLAB software. In [21], Samar M. Ismail et al. designed a logistic map-based image encryption scheme. The encryption scheme was implemented on Virtex-5 FPGA (Xilinx - XC5VLX50T) and operated at the maximum clock frequency of 58.358 MHz. The encryption scheme was realized using VHDL (Very high speed integrated circuit Hardware Description Language), where the image was stored in the internal RAM of the FPGA. The encryption scheme prototype was implemented with different bus sizes such as 11, 16 and 20-bits. Though the scheme achieves good statistical properties, it suffers due to the lower chaotic span.
A three-layer medical image encryption scheme implemented by padmapriya praveenkumar et al. [22] used Latin Square Image Cipher (LSIC), Discrete Gould Transform (DGT) and Rubik’s encryption. Here, DGT ensured the tamper-proofing, LSIC performed both diffusion and confusion process while Rubik model permutated the DICOM image pixels. This encryption algorithm was simulated under MATLAB software, and its security strength was confirmed with statistical analysis, differential analysis, key sensitivity tests and cropping attack analysis. This scheme offered a larger keyspace and had good resistance against the brute force attacks. However, this scheme requires multiple rounds of operation to yield better encryption quality which affects the throughput. A similar kind of medical image encryption technique was performed by J.B. Lima [23] wherein the scheme utilized the cosine number transform, which has the effect of quantization at decryption. This scheme was designed to encrypt uncompressed DICOM images. Chosen plain text attack analysis, cropping attack analysis and differential attacks analyses were carried out to validate the results.
Concurrency has been emerging as a useful technology in modern computing systems to meet the demand for higher performance with cost-effectiveness for real-time embedded applications. Concurrency aims at handling multiple tasks at the same time. Realizing architectures on reconfigurable hardware such as FPGAs can be supported with concurrency through Hardware Description Language (HDL). This paper’s primary goal is to realize a lightweight Chao-cryptic architecture suitable for concurrent FPGA realization to secure medical images. The features on the use of chaotic keys in crypto architectures are: Chaotic systems are Non –linear system that brings randomness in its output due to its high sensitivity to initial conditions. The initial conditions and control parameters of the chaotic architecture can be perturbed in high volume that offers larger keyspace. The use of chaotic keys offers higher security when utilized in crypto architecture.
Apart from the standard set of security analysis, this paper also analyses the hardware performance of concurrent architectural blocks on FPGA to achieve an optimal tradeoff between the resource utilization, power dissipation and throughput.
Preliminaries
Linear feedback shift register (LFSR)
LFSR is a shift register whose input bit is a linear function of its previous state. The initial value of the LFSR is called the seed [14, 25]. The LFSR circuit comprises D Flip-Flops with external or internal feedback through Ex-Nor or Ex-Or gates generates distinct values in a pseudo-random order. The tapings of an n-bit LFSR, when chosen adequately for the feedback, ensures the output sequence with the maximum length of 2n - 1.
Lorentz chaotic attractor
The sensitive nature of chaotic attractors to their initial conditions and input values makes them highly relevant to generate random numbers used as keys in cryptography applications [5, 26–31]. The proposed medical image encryption uses the 3 Dimensional Lorentz chaotic attractor to generate keys for the diffusion process. The Equations (1–3) provide the mathematical representation of the 3D Lorentz chaotic attractor [18].
The two-dimensional portraits [26] obtained by implementing the 3D Lorentz system [Equations (1–3)] on MATLAB platform with initial conditions x = 0.1, y = 5.0000000001, z = 25 and control parameters σ = 10,

Two-dimensional phase portraits of Lorenz chaotic attractor.
The proposed architecture has four central units, namely block separation, chaotic key generation, PRNG and diffusion unit, that encrypt medical images. A 256×256 DICOM image with 16-bit pixel values has been chosen as input for the proposed algorithm. Initially, the 256×256 input image gets divided into four blocks (B0 to B3) of each having 128×128 pixels. Each separated block is then subjected to the diffusion process using the distinct set of keys generated by the Lorentz attractor. The initial and control values for the Lorentz attractor have been taken in IEEE 754 single-precision (32-bit) format to build the chaotic key generation unit.
The first three sets of chaotic keys used to encrypt the blocks B0 - B2 is formed from the three output planes of the Lorentz attractor. XORing the Lorenz output from all the three planes produces the key to encrypt the block B3.
Further, each block’s diffusion process performs an XOR operation between the pixel value and the chaotic key. The resultant diffused image pixels are stored in random addresses of the block RAM generated by an LFSR circuit constructed using the D-FF and XOR gates to induce randomness. Finally, reading the pixels from the block RAM addresses in a sequential order essentially achieves the pixel diffusion that completes the encryption process.
The proposed algorithm has been developed as Verilog HDL code and implemented on reconfigurable hardware, Cyclone IV FPGA (EP4CE115F29C7), Fig. 2 depicts the overall block diagram of the proposed lightweight concurrent architecture for DICOM image encryption. Figure 3a and 3b show the structure of LFSR based confusion key generator circuit and hardware model of the Lorenz chaotic key generator, respectively.

Block diagram of the proposed medical encryption architecture with 2 N concurrent blocks (N = 2).

Hardware model of the chaotic key generator (Lorenz attractor).
Algorithm for decryption
Results and discussions
The proposed algorithm used 256×256 grayscale DICOM images as input to analyze its security and performance aspects on cyclone IV FPGA (EP4CE115F29C7). The 16-bit pixels of the DICOM images have been read as a hexadecimal byte stream and loaded in the internal block RAM of FPGA. The pre-processing and post-processing of DICOM images which involves the extraction of pixel values from images and the reconstruction of images from the pixels were carried out using the open-source Python 3.7 on a desktop PC. Security aspects of the proposed scheme have been analyzed with various statistical, randomness tests and keyspace analysis. The proposed architecture’s FPGA performance with varying concurrent crypto blocks has been validated through hardware parameters such as resource utilization, power dissipation and throughput. The ten different DICOM images used for testing and the corresponding encrypted images are shown in Fig. 4a and Fig. 4b, respectively.

Encrypted images.
The list of statistical parameters and metrics for randomness, including PSNR, entropy, correlation, histogram, and NIST, has been analyzed to ensure the proposed algorithm’s competency level to secure DICOM images. Table 1 lists the purpose, critical values for validation, and reference from literature as proof for various statistical metrics used in this section.
Metrics for statistical analysis
Metrics for statistical analysis
Claude Shannon stated a parameter called entropy which is adopted to measure the information quantitatively. As the proposed algorithm takes a 16-bit information source, from Equation (4), the maximum entropy given to obtain uniform probability is 16. Any encrypted image that achieves an entropy value closer to the maximum value is said to have better randomness [33]. The entropy values for various images encrypted through the proposed algorithm with 2 N concurrent blocks on FPGA are calculated and tabulated in Table 2. The proposed method achieves lower entropy values for the encrypted images due to the same keys used to encrypt multiple concurrent blocks (when N > 2). Further, the comparison graph for average entropy in Fig. 5 validates the randomness achieved by the proposed concurrent encryption scheme against a similar method for encrypting the 16-bit DICOM image on FPGA.
Information entropy for concurrent encryption blocks (2 N)
Information entropy for concurrent encryption blocks (2 N)

Comparison on average entropy of encrypted images.
In any grayscale image having m-bit pixel values, the maximum pixel intensity value is given by 2m - 1. In Equation (4), Pi is the probability of the grayscale intensity level ‘i’ in the image. Entropy,
The histogram plots the number of pixels at each intensity level to give a visual form of interpretation for the pixel distribution in images [1]. Figure 6a depicts a histogram of original images. As shown in Fig. 6b –6d, the histogram plot for the images encrypted with the proposed concurrent approach with N = 0 to 4 gives nearly flat top that implies the equal number of occurrences of all pixels intensity levels.

Histogram of Encrypted Images (N = 4).
The correlation coefficient is one of the fundamental metrics to evaluate the strength of an encrypted image. The lower value of correlation coefficients in horizontal, vertical and diagonal axes of an encrypted image indicates the encryption algorithm’s ability to break the adjacent pixels’ dependency [34]. As the adjacent pixels in any DICOM image are highly correlated, it requires an efficient encryption mechanism to provide near-zero or negative correlation. The correlation values obtained from Equation (5) for the original and encrypted images are plotted in Figs. 7 and 8, respectively. Correlation,

Correlation graph for the original image (DICOM 1).

Correlation analysis for encrypted image (DICOM 1) with (2 N) concurrent blocks.
Where x and y are grayscale values of two adjacent pixels in the image. σ x and σ y are the Standard deviation of (x, y). cov (x, y) is the covariance of (x, y).
In image encryption, PSNR gives the ratio between the peak signal and noise power between the original image and its encrypted form [35]. The Mean Square Error (MSE) in Equation (6) is involved in the estimation of PSNR value as given by the Equation (7). The image encryption algorithm that achieves a low PSNR value (<10 dB) maximizes the difference between plain and encrypted image. The PSNR values estimated from Equation (7) for the proposed concurrent image encryption scheme are listed in Table 3. The PSNR value of <5 dB shown in the average PSNR comparison graph in Fig. 9 confirms the proposed scheme’s strength against the one available in the literature [35].
PSNR analysis
PSNR analysis

Comparison of average PSNR values.
In an image with M rows and N columns, Iij & Cij represent a pixel from the original and cipher image respectively with row, column position given by (i,j).
Larger keyspace provides high security and helps the encryption algorithm resist brute force attack [8, 30]. The confusion and diffusion unit of the proposed image encryption scheme uses distinct keys. In an implementation with 2 N concurrent blocks; the confusion unit uses 2 N independent LFSRs with different seed values to arrive at unique random keys to confuse each block’s pixels. The length of the LFSR circuit gets determined according to the block size. Considering the input image of size 256×256 and number of concurrent blocks as 4 (N = 2 makes the block size as 128×128), four independent LFSRs (2 N) each with a length of 14-bit is used. Thus, LFSR’s keyspace for confusion becomes larger when multiple concurrent blocks are used (214×4 for N = 2). The diffusion unit’s key gets generated from the Lorentz attractor described in section 1.2.2, which uses six float variables as inputs in the form of initial conditions and constants. As each of these float variables is represented in 32-bit IEEE 754 format when implemented on the FPGA hardware, the diffusion keyspace becomes 232×6, independent of the number of concurrent blocks used.
The linear increase in the keyspace achieved on combining the keys from confusion and diffusion units based on the number of concurrent architectural blocks used are tabulated in Table 4. The proposed architecture achieves the maximum keyspace of 2384 (with N = 4) guarantees larger keyspace against the similar image encryption schemes reported in the literature are tabulated in Table 5.
Keyspace analysis for concurrent blocks
Keyspace analysis for concurrent blocks
Comparison of the keyspace
NIST SP 800-22 provides a set of useful procedures to ensure the randomness in a binary sequence [36, 37]. In the proposed concurrent architecture, the encrypted DICOM images’ pixel values reside in the on-chip RAM of cyclone IV FPGA. These encrypted pixel values are converted into a binary bitstream after extraction and subjected to various statistical randomness tests under the NIST SP 800-22 test suite.
The minimum pass rate for each statistical test except for the random excursion (variant) test is P ≈ 8 for a binary block size of 10. The NIST SP 800-22 test report obtained on evaluating the pixels’ randomness in the encrypted image (DICOM 1) obtained from the proposed scheme is presented in Table 6. The NIST SP 800-22 evaluation report for all input DICOM images encrypted with the different number of concurrent blocks (2 N) with p-value ensures the cipher images’ randomness resulted from the proposed concurrent image encryption architecture.
Randomness evaluation of encrypted image (DICOM 1) under NIST SP 800-22
Randomness evaluation of encrypted image (DICOM 1) under NIST SP 800-22
The proposed medical image encryption scheme realized as Verilog HDL (Hardware Description Language) code, synthesized through Quartus II IDE (Integrated Development Environment) and implemented on Cyclone IV FPGA. The major on-chip features of EP4CE115F29C7 FPGA utilized in this implementation includes the 114,480 Logic Elements (LEs), 432M9K memory blocks, 3,888 Kbits of embedded memory and 4 PLL’s (Phase Locked Loop).
The snapshot of internal block RAM in cyclone IV FPGA containing a part of image pixels (DICOM1) encrypted by the proposed concurrent architecture (N = 2) has been shown in Fig. 10. The Section of Register Transfer Level (RTL) schematic in Figs. 11 and 12 depicts the abstract design of the data flow between the hardware registers for the confusion and diffusion units in the proposed implementation.

Snapshot of internal Block RAM in cyclone IV FPGA with encrypted pixels.

A Section of RTL View - Confusion unit.

A Section of RTL view - Diffusion unit.
Table 7 presents the HDL code’s synthesis report for the proposed encryption scheme listing the rise in the utilization of various resources against multiple concurrent blocks. Table 8 compares the resource utilization by the similar image encryption schemes implemented on cyclone II FPGA with the proposed scheme implemented on Cyclone IV FPGA.
Resource utilization analysis for concurrent blocks
Resource utilization analysis for concurrent blocks
Resource utilisation comparison
The amount of power dissipated by any FPGA hardware gets influenced by the factors such as device switching speed, memory utilization and operations concerned with the algorithm implemented. The total power dissipation can be expressed [19] as, Fig. 13 analyses the various kind of power dissipation for the proposed concurrent architecture. It can be observed from Fig. 13 that, the amount of static and I/O power dissipation remains constant irrespective of the number of concurrent blocks used.

Power Dissipation Comparison for (2 N) concurrent blocks.
Conversely, a slight increase in the dynamic power dissipation is detected using more concurrent blocks resulting from the rise in the consumption of logic elements. On referring the Table 9, it is evident that the maximal total power dissipation measured for the proposed scheme with the highest number of concurrent blocks (16 for N = 4) is significantly lower than the earlier image encryption implementations on FPGA.
Power dissipation comparison
Total thermal power dissipation = Static power dissipation + Dynamic power dissipation + I/O power dissipation
For a DICOM image of size 256×256 with 16-bit depth pixel values as input, incorporating concurrency on the proposed image encryption architecture enhances the system throughput. Independent of the input DICOM image (with identical sizes) the proposed architecture offers a throughput of 159.84 Mbps without concurrency (2N = 1) when the Cyclone IV FPGA was operated at a frequency of 50 MHz. Based on the inference from Table 10, the throughput offered by proposed encryption architecture approximately gets multiplied by a factor of 2 N against the one obtained without concurrency.
Time vs Throughput
Time vs Throughput
The computational time has been captured by interfacing the ZEROPLUS logic analyzer with the FPGA board. The screenshot of the same is shown in Fig. 14.

Timing analysis for N = 2.
This paper presented a lightweight Chao-cryptic architecture that supports concurrent realization on FPGA to secure grayscale medical images. Each pixel of the input image undergoes an instantaneous diffusion with a chaotic key from the Lorenz attractor. The diffused pixels gets confused inline during their storage in the on-chip block RAM of the chosen FPGA at the pseudo-random addresses generated from an LFSR. With its larger keyspace of 2384, the proposed concurrent architecture achieves an average PSNR of below 5 dB with the disparate relationship among the encrypted images’ pixels though its strong diffusion and confusion processes. The various numbers of concurrent architectures (2 N with N = 0 to 4), consuming less than 3% of its total LEs when implemented on Cyclone IV FPGA (EP4CE115F29C7) substantiates the lightweight property of the algorithm. It was inferred that the proposed encryption scheme achieves a higher throughput of around 160 Mbps per concurrent block with an approximate rise in the utilization of logic elements by 20%. Further, degradation on encryption quality was observed in terms of low entropy values of the encrypted images with the number of concurrent architectural blocks (2 N) on FPGA being more than 4 (with N > 2). Unlike similar works reported in the literature, the proposed scheme achieves optimality through good encryption with higher throughput (639.37 Mbps), low power dissipation (138.85 mW) and minimal resource utilization (1268 LEs) when the number of concurrent architectural blocks on FPGA is limited to 4 (N = 2). The future work will reduce dynamic power dissipation in the larger off-chip memory of FPGA to support the encryption of larger grayscale images and colour images.
Footnotes
Acknowledgments
Authors thank Department of Science & Technology, New Delhi for the FIST funding (SR/FST/ET-II/2018/221). Also, Authors wish to thank the Intrusion Detection Lab at School of Electrical & Electronics Engineering, SASTRA Deemed University for providing infrastructural support to carry out this research work.
