- Email: [email protected]
An efficient high-capacity reversible data hiding scheme for encrypted images
Journal Pre-proofs An Efficient High-Capacity Reversible Data Hiding Scheme for Encrypted Images Bo Guan, Dawen Xu PII: DOI: Reference:
S1047-3203(19)30365-7 https://doi.org/10.1016/j.jvcir.2019.102744 YJVCI 102744
To appear in:
J. Vis. Commun. Image R.
Received Date: Revised Date: Accepted Date:
7 October 2019 6 December 2019 20 December 2019
Please cite this article as: B. Guan, D. Xu, An Efficient High-Capacity Reversible Data Hiding Scheme for Encrypted Images, J. Vis. Commun. Image R. (2019), doi: https://doi.org/10.1016/j.jvcir.2019.102744
This is a PDF file of an article that has undergone enhancements after acceptance, such as the addition of a cover page and metadata, and formatting for readability, but it is not yet the definitive version of record. This version will undergo additional copyediting, typesetting and review before it is published in its final form, but we are providing this version to give early visibility of the article. Please note that, during the production process, errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.
© 2019 Published by Elsevier Inc.
An Efficient High-Capacity Reversible Data Hiding Scheme for Encrypted Images
Bo Guan, Dawen Xu * School of Electronics and Information Engineering, Ningbo University of Technology, Ningbo, 315016, China *
Corresponding author: Dawen Xu
E-mail: [email protected]
Abstract. Reversible data hiding in encrypted images is an effective technique to embed information in encrypted domain, without knowing the original content of the image or the encryption key. In this paper, a high-capacity reversible data hiding scheme for encrypted images based on MSB (most significant bit) prediction is proposed. Since the prediction is not always accurate, it is necessary to identify the prediction error and store this information in the location map. The stream cipher is then used to encrypt the original image directly. During the data hiding phase, up to three MSBs of each available pixel in the encrypted image are substituted by the bits of the secret message. At the receiving end, the embedded data can be extracted without any errors and the original image can be perfectly reconstructed by utilizing MSB prediction. Experimental results show that the scheme can achieve higher embedding capacity than most related methods.
Keywords. Reversible data hiding, Image encryption, Image security, MSB prediction, High capacity
1. Introduction With the rapid development of mobile Internet and smart terminal devices, digital images are growing explosively. Cloud computing provides a more suitable solution for the storage, fast processing and intelligent analysis of massive image data. However, under the existing cloud computing architecture, users have basically lost their absolute control over the data, resulting in a series of security issues such as confidentiality, privacy and so on. Encryption is an important means of protecting the confidentiality and privacy of user data in a cloud computing environment. Users first encrypt sensitive image into unrecognized noise-like format before uploading it. All the processing and computing in the cloud are done in the encrypted domain, and the processing results are then provided to users. Authorized terminal users with decryption keys can obtain the plaintext data after decrypting. However, image data loses its original characteristics after encryption, and the effective management, integrity and reliability protection
of massive ciphertext image data in the cloud has become an urgent and challenging problem. Therefore, data hiding in encrypted domain has become a research hotspot in recent years, which directly embeds some additional messages in the encrypted data, including copyright information, owner identity, or authentication data. For example, when the patient's medical image is encrypted and uploaded to the cloud, the administrator can embed the relevant information into the corresponding ciphertext, such as the owner information, the shooting time, the shooting location, etc. By extracting the embedded information and comparing the corresponding keywords, the fast retrieval of the ciphertext image can be realized. From the past few years, some substantial works have been done for data hiding in encrypted images or videos [1] – [6]. However, one common drawback of these works is the fact that the carrier is inevitably and permanently distorted due to data hiding. Although the distortion is generally quite small, it may not be acceptable for distortion-sensitive applications such as medical imaging, military imaging, law enforcement [7]. Therefore, reversible data hiding in encrypted images (RDH-EI) has become a research hotspot recently. RDH-EI not only ensures the accuracy of the reconstructed image and extracted secret message, but also preserves the privacy of the cover-image. Existing RDH-EI methods can be roughly classified into three categories, namely vacating room after encryption (VRAE) [8] – [14], reserving room before encryption (RRBE) [15] – [20], and the method based on homomorphic encryption [21] – [25]. The early VRAE framework is proposed by Zhang [8, 9]. The entire data of an uncompressed image is encrypted directly by a stream cipher. Then the data-hider embeds the additional data by modifying a small portion of encrypted data. Later, Huang et al. [10] designed a new framework for RDH in encrypted domain, which integrates previous difference histogram shifting based RDH approaches via a new encryption strategy. In general, estimation technique is necessary for the receiver in VRAE framework, because no prior information of the original content is available. When LSB (least significant bit) planes of the encrypted image are modified to accommodate the additional data, the image recovery is based on estimating the original LSB planes. But these estimations are not accurate enough. Due to the local correlation between a pixel and its neighbors, two adjacent pixel values are very close. As estimating MSB is much more accurate than estimating LSB planes, some methods are designed to achieve high embedding payload by combining the MSB estimation. Wu and Sun [11] proposed a separable RDH-EI method, where 1-layer or 2-layer MSBs are emptied for storing the additional bits. The context adaptive
interpolation algorithm is adopted to estimate the MSBs. Qian and Zhang [12] proposed a RDH-EI scheme using distributed source coding (DSC). As estimating MSB is much more accurate than estimating LSB planes, the MSB plane can be recovered by DSC decoding with an acceptable decoding error probability. More recently, high capacity reversible data hiding approach with correction of prediction errors and high capacity reversible data hiding approach with embedded prediction errors are presented in [13, 14]. Ma et al. [15] first proposed a RRBE method. Specifically, by using traditional RDH method, LSBs of some pixels are embedded into other pixels to empty the room, and then the image is encrypted. So the positions of these LSBs in the encrypted image can be used to embed data. Later, Zhang et al. [16] proposed a RDH method in encrypted images based on estimation technique. The additional data is embedded in the encrypted image by modifying the estimating errors. To better explore the correlation between neighbor pixels, Cao et al. [17] propose to hide the secret data with a patch-level sparse representation technique. Wu et al. [18] present a separable reversible data hiding scheme for encrypted palette images with color partitioning and flipping verification. In [19], another RRBE method was proposed by using the interpolation technique to make room for data embedding. Yi et al. [20] proposed an RDH-EI method using parametric binary tree labeling scheme. In general, the RDH-EI methods based on RRBE can achieve larger embedding capacity than those based on VRAE. But it is impracticable, because the data hider should know the vacated room created by the content owner before encryption. In addition to VRAE and RRBE, another RDH-EI method suggests to use homomorphic encryption to encrypt the original image [21-25]. However, the most important problem of homomorphic encryption is that it will suffer from pixel expansion. While most RDH-EI methods are designed for uncompressed spatial-domain images, several works are applicable to JPEG bitstream [26-29]. As described in [13], the prediction of the MSB values is easier to obtain than those of the LSB. In this paper, we present an efficient high-capacity reversible data hiding scheme for encrypted images based on MSB prediction. Because of local correlations present in images, the grayscale values of adjacent pixels are close to each other. Therefore, we design an improved prediction method that uses the decrypted previous pixels to predict the current pixel value. During the data hiding phase, up to three MSBs of each available pixel in the encrypted image are substituted by the secret bits. The rest of the paper is structured as follows. Section 2 describes the details of the proposed scheme including location map generation, image encryption, data embedding, data extraction and original image recovery.
Experimental results and comparisons are provided in Section 3. Finally, the conclusion is drawn and future work is concluded in Section 4.
2. Proposed Scheme The framework of the proposed RDH-EI method based on MSB prediction is illustrated in Fig.1. Although there is local correlation in the image, adjacent pixel values can be used to predict the current pixel values. But sometimes there are errors in the prediction. Therefore, the first step is to identify the prediction error and store its position information in the location map. Then, the content owner encrypts the original image using a standard stream cipher. After that, data embedding can be carried out by substituting up to three MSBs of embeddable pixels in encrypted image with the secret message. At the receiver side, with the help of the location error information, the original image can be reconstructed losslessly.
2.1 MSB Flipping Prediction and Location Map Generation Without loss of generality, assuming that the size of the original grey image is H × W, and the pixel value is represented by 𝑥𝑖,𝑗 ∈ [0,255], 1 ≤ i ≤ H, 1 ≤ j ≤ W. Our method proposes to embed the secret message by MSB substitution. As the original MSB values are lost during the data hiding phase, it is important to be able to predict them without any errors for image reconstruction. Some prediction methods have been designed to estimate pixel values in spatial domain. For example, the median edge detector predictor (MED) used in [30] and [31] is a high-performance predictor already used in JPEGLS standard [32]. With MED, 𝑥̃𝑖,𝑗 , the estimate of pixel 𝑥𝑖,𝑗 , is 𝑚𝑖𝑛(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑥̃𝑖,𝑗 = { 𝑚𝑎𝑥(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑥𝑖,𝑗−1 +𝑥𝑖−1,𝑗 − 𝑥𝑖−1,𝑗−1
𝑖𝑓 𝑥𝑖−1,𝑗−1 ≥ 𝑚𝑎𝑥(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑖𝑓 𝑥𝑖−1,𝑗−1 ≤ 𝑚𝑖𝑛(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒
(1)
where 𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 , and 𝑥𝑖−1,𝑗−1 are the left, upper, and upper-diagonal neighbours of 𝑥𝑖,𝑗 (see Fig.2 (a)). The other is the gradient-adjusted predictor (GAP), which is used in CALIC (context-based, adaptive, lossless image coding ) algorithm [33]. Generally, the prediction accuracy of the GAP predictor is higher than that of MED, and it is also more complex [34]. More precisely, the pixel 𝑥𝑖,𝑗 is estimated by
𝑥𝑖,𝑗+1 𝑥𝑖,𝑗+1 +𝑠 2 𝑥𝑖,𝑗+1 +3𝑠
𝑥̃𝑖,𝑗 =
4
𝑠 𝑥𝑖+1,𝑗 +3𝑠 4 𝑥𝑖+1,𝑗 +𝑠 2
{ 𝑥𝑖+1,𝑗
𝑖𝑓 ∆𝑣 − ∆ℎ > 80 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ (32,80] 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ (8,32] 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ [−8,8]
(2)
𝑖𝑓 ∆𝑣 − ∆ℎ ∈ [−32, −8) 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ [−80, −32) 𝑖𝑓 ∆𝑣 − ∆ℎ < −80
where ∆ℎ = |𝑥𝑖,𝑗+1 − 𝑥𝑖,𝑗+2 | + |𝑥𝑖+1,𝑗−1 − 𝑥𝑖+1,𝑗 | + |𝑥𝑖+1,𝑗 − 𝑥𝑖+1,𝑗+1 | and ∆𝑣 = |𝑥𝑖,𝑗+1 − 𝑥𝑖+1,𝑗+1 | + |𝑥𝑖+1,𝑗−1 − 𝑥𝑖+2,𝑗−1 | + |𝑥𝑖+1,𝑗 − 𝑥𝑖+2,𝑗 | represent the horizontal and vertical gradients (see Fig.2 (b)), and 𝑠 = (𝑥𝑖,𝑗+1 + 𝑥𝑖+1,𝑗 )⁄2 + (𝑥𝑖+1,𝑗−1 − 𝑥𝑖+1,𝑗+1 )⁄4. The third one is the rhombus predictor, which has been used in [35] and [36]. The predicted value 𝑥̃𝑖,𝑗 is computed as follows (see Fig.2 (c)). 𝑥𝑖−1,𝑗 +𝑥𝑖,𝑗−1 +𝑥𝑖+1,𝑗 +𝑥𝑖,𝑗+1
𝑥̃𝑖,𝑗 = ⌊
4
⌋
(3)
Overall, full context rhombus predictor has the best performance among all of these predictors. In rhombus predictor, the prediction is performed using four closest neighbours around the current pixel. However, in our method, the right and lower neighbours of the current pixel are completely unknown during image restoration process. Therefore, only part of the neighbouring pixels can be used as the prediction context, i.e., half direction prediction. According to the prediction mode, all pixels are divided into five categories, that is, 𝑋 𝐼 = {𝑥1,1 }, 𝑋 𝐼𝐼 = {𝑥1,2 , 𝑥1,3 , … , 𝑥1,𝑊 }, 𝑋 𝐼𝐼𝐼 = {𝑥2,1 , 𝑥3,1 , … , 𝑥𝐻,1 }, 𝑋 𝐼𝑉 = {𝑥2,2 , 𝑥2,3 , … , 𝑥2,𝑊 , 𝑥3,2 , 𝑥4,2 , … , 𝑥𝐻,2 , 𝑥3,𝑊 , 𝑥4,𝑊 , … , 𝑥𝐻,𝑊 } , 𝑋 𝑉 = {𝑥𝑖,𝑗 |𝑖 = 3,4, … , 𝐻, 𝑗 = 3,4, … , 𝑊 − 1}. The pixel in 𝑋 𝐼 is located in the upper left corner of the image, and its value will remain unchanged during the data embedding phase. On the other hand, the pixels in 𝑋 𝐼𝐼 , 𝑋 𝐼𝐼𝐼 , and 𝑋 𝐼𝑉 will be approximately predicted by neighbouring pixels via Eq. (4).
𝑥̃𝑖,𝑗
𝑥𝑖,𝑗 𝑥𝑖,𝑗−1 = 𝑥𝑖−1,𝑗 {⌊0.2 ∙ 𝑥𝑖−1,𝑗−1 + 0.4 ∙ 𝑥𝑖,𝑗−1 + 0.4 ∙ 𝑥𝑖−1,𝑗 ⌋
𝑥𝑖,𝑗 ∈ 𝑋 𝐼 𝑥𝑖,𝑗 ∈ 𝑋 𝐼𝐼 𝑥𝑖,𝑗 ∈ 𝑋 𝐼𝐼𝐼
(4)
𝑥𝑖,𝑗 ∈ 𝑋 𝐼𝑉
where is a floor function that maps a real number to the nearest integer in the downward direction, and 𝑥̃𝑖,𝑗 is the predicted value of 𝑥𝑖,𝑗 . It should be noted that the pixels in 𝑋 𝑉 will be predicted in the form of Eq. (2). The difference is that the right pixel (i.e. 𝑥𝑖,𝑗+1 ) will be replaced by the corresponding left pixel (i.e., 𝑥𝑖,𝑗−1 ), and the lower pixel (i.e., 𝑥𝑖+1,𝑗 ) will be replaced by the corresponding upper pixel (i.e., 𝑥𝑖−1,𝑗 ). The calculation of ∆ℎ and ∆𝑣 should be processed in the same way.
Since MSB values are substituted by secret bits during the data embedding phase, original bit values are lost and have to be predictable with the previously scanned pixels and the accurately decrypted bitplanes. Therefore, the first step of our method consists in analyzing the image content to detect the possible prediction errors. The difference between the predicted pixel value and the original pixel value can be calculated as ∆𝑝𝑟 = |𝑥𝑖,𝑗 − 𝑥̃𝑖,𝑗 |. Each pixel 𝑥𝑖,𝑗 with gray value falling into [0, 255] can be represented by 8 bits, 𝑏𝑖,𝑗 (0),𝑏𝑖,𝑗 (1),…, 𝑏𝑖,𝑗 (7), such that 𝑥𝑖,𝑗
𝑏𝑖,𝑗 (𝑘) = ⌊
2𝑘
⌋ 𝑚𝑜𝑑 2 , 𝑘 = 0,1, . . . ,7
(5)
where 𝑚𝑜𝑑( ) represents the modulo operation. It has been observed that, up to three bits, MSB replacement is suitable for maintaining high prediction accuracy along with reasonable auxiliary information. With the increase of MSBs, the prediction accuracy will decrease and the auxiliary information will increase accordingly. Therefore, we will elaborate on three situations: one-layer MSB, two-layer MSB and three-layer MSB.
(1) Case1: One-layer MSB First of all, flipping the MSB of 𝑥𝑖,𝑗 yields the following values. ′ 𝑥̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + ∑6𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘
(6)
′ where 𝑏(𝑖,𝑗) (7) is the flipped value of 𝑏(𝑖,𝑗) (7), i.e., 0 is converted into 1, and vice versa. Then calculate
the difference between 𝑥̅𝑖,𝑗 and 𝑥̃𝑖,𝑗 as ∆̅𝑝𝑟 = |𝑥̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | . If ∆𝑝𝑟 ≥ ∆̅𝑝𝑟 , it means that there is a prediction error. Otherwise, since the original pixel value is closer to its predicted pixel value than the flipped pixel value, there is no prediction error. (2) Case2: Two-layer MSB In this case, the following three values can be obtained according to different types of MSB flips. 1 ′ (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + ∑5𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 𝑥̿𝑖,𝑗 =𝑏𝑖,𝑗
(7)
2 ′ (6) ∙ 26 + ∑5𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 𝑥̿𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗
(8)
3 ′ ′ (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + ∑5𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 𝑥̿𝑖,𝑗 =𝑏𝑖,𝑗
(9)
Similarly, the differences between the predicted value and the flipped values are then calculated as 1 2 3 ∆̿1𝑝𝑟 = |𝑥̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿2𝑝𝑟 = |𝑥̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , and ∆̿3𝑝𝑟 = |𝑥̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | . If ∆𝑝𝑟 ≥ min{ ∆̿1𝑝𝑟 , ∆̿2𝑝𝑟 , ∆̿3𝑝𝑟 } , it means
that there is a prediction error. Otherwise, there is no prediction error because the original pixel value is closer to its predicted pixel value than the flipped values. (3) Case3: Three-layer MSB According to different types of flipping on the three-layer MSB, the following seven values should be calculated as follows. 1 ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(10)
2 ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(11)
3 ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(12)
4 ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(13)
5 ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(14)
6 ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(15)
7 ′ ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(16)
As in the previous two cases, the differences between the predicted value and the flipped values are ̅ ̅ ̅ ̅ ̅ 1 2 3 4 then calculated as ∆̅1𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̅2𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̅3𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 ) | , ∆̅4𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̅5𝑝𝑟 = ̅ ̅ ̅ ̅ ̅ ̅ ̅ ̅ ̅ 5 6 7 |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |, ∆̅6𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |, and ∆̅7𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |. If ∆𝑝𝑟 ≥ min { ∆̅1𝑝𝑟 , ∆̅2𝑝𝑟 , ∆̅3𝑝𝑟 , ∆̅4𝑝𝑟 , ∆̅5𝑝𝑟 , ∆̅6𝑝𝑟 , ∆̅7𝑝𝑟 }, it means that there is a prediction error. Otherwise, there is no prediction error. The location map 𝐿1 is necessary for lossless recovery of the original image. The size of 𝐿1 is the same as that of the original image. If there is a prediction error at a position in the image, the value of the corresponding position in 𝐿1 is marked as “1”. Otherwise, the value is marked as “0”. Finally, the location map is losslessly compressed using arithmetic coding and appended to the front of the payload, along with its size. Given an image size of H × W, the upper limit to represent the size of the location map is ⌈𝑙𝑜𝑔2 (H × W)⌉ bits. For an image size of 512×512, this is 18 bits [37].
2.2 Image Encryption First of all, the encryption key 𝐾𝑒𝑛 is used as a seed for a pseudo-random number generator to obtain a pseudo-random binary sequence of 𝐻 × 𝑊 × 8 bits. Then, decompose pixel 𝑥𝑖,𝑗 into 8 bits 𝑏𝑖,𝑗 (0) ,𝑏𝑖,𝑗 (1) ,…, 𝑏𝑖,𝑗 (7) using Eq. (5). Consequently, the bitwise exclusive-or (XOR) operation is performed between the original bits 𝑏𝑖,𝑗 (𝑘)and pseudo-random bits 𝑟𝑖,𝑗 (𝑘) as follow.
𝐵̂𝑖,𝑗 (𝑘) = 𝑏𝑖,𝑗 (𝑘) ⊕ 𝑟𝑖,𝑗 (𝑘)
(17)
where ⊕ represents a bitwise XOR operator and 𝐵̂𝑖,𝑗 (𝑘) denotes the k-th associated encrypted bit. In the next step, the encrypted bits are concatenated orderly as the encrypted pixel value 𝑥̂𝑖,𝑗 . 𝑥̂𝑖,𝑗 = ∑7𝑘=0(𝐵̂𝑖,𝑗 (𝑘) ⋅ 2𝑘 )
(18)
After generating the encrypted image, the data hider or the third party cannot access the image content without the encryption key, thus preserving the privacy of the image content owner.
2.3 Data Embedding in Encrypted Image Without knowing the encryption key 𝐾𝑒𝑛 , the data hider can complete data embedding step directly in the encrypted domain. Suppose the message to be embedded is a binary sequence. In order to enhance the security, the to-be-embedded message is encrypted by a stream cipher according to the data-hiding key 𝐾𝑑ℎ . Thus, the to-be-embedded binary information, i.e., W = {𝑤(𝑙)|𝑙 = 1,2, … , 𝐾, 𝑤(𝑙) ∈ {0,1}}, is an encrypted version. It is difficult for anyone without a data hiding key to recover the message. During the data hiding phase, the error location map L1 will be used to detect whether the current pixel can be marked by bits of the secret message (i.e. pixels without prediction error). Subsequently, the data hider scans pixels of the encrypted image from left to right, then from top to bottom and substitutes the MSBs of all the available pixels by secret bits. Similar to the prediction process, it is processed in the following three cases. (1) Case1: One-layer MSB For encrypted pixels (except 𝑥̂1,1 ), the data hider embeds the secret bit into the MSB using the bit substitution method, as denoted by ′ 𝑋𝑖,𝑗 =𝑤(𝑙) ∙ 27 + ∑6𝑘=0 𝐵̂𝑖,𝑗 (𝑘) ∙ 2𝑘
(19)
′ where 𝑋𝑖,𝑗 is the marked encrypted pixels. Since one embeddable pixel can carry 1 bit of information,
the maximum embedding rate is 1 bpp. (2) Case2: Two-layer MSB Similarly, for encrypted pixels (except 𝑥̂1,1 ), the secret bits are embedded into the first MSB and the second MSB as following equation. ′ 𝑋𝑖,𝑗 =𝑤(𝑙) ∙ 27 + 𝑤(𝑙 + 1) ∙ 26 + ∑5𝑘=0 𝐵̂𝑖,𝑗 (𝑘) ∙ 2𝑘
(20)
In this case, one embeddable pixel can carry 2 bits of information, so the maximum embedding rate
is 2 bpp. (3) Case3: Three-layer MSB In this case, for encrypted pixels (except 𝑥̂1,1 ), the embedding operation is formulated as ′ 𝑋𝑖,𝑗 =𝑤(𝑙) ∙ 27 + 𝑤(𝑙 + 1) ∙ 26 + 𝑤(𝑙 + 2) ∙ 25 + ∑4𝑘=0 𝐵̂𝑖,𝑗 (𝑘) ∙ 2𝑘
(21)
Since one embeddable pixel can carry 3 bits of information, the maximum embedding rate is 3 bpp. However, not every pixel can be used for data embedding due to the prediction error. Therefore, the actual embedding rate will be less than 3 bpp, which will be verified in subsequent experiments.
2.4 Data Extraction and Original Image Recovery At the receiving end, the receiver can extract the additional message using the data hiding key and reconstruct the original image using the encryption key. There are three possible scenarios, depending on the recipient: only knows the data hiding key, only knows the encryption key, or knows both keys. 1) Data Extraction with Only Data Hiding Key ′ As we know some significant bit-planes of marked encrypted image 𝑋𝑖,𝑗 are marked by bits of the
secret message, a receiver with the data hiding key 𝐾𝑑ℎ can easily extract the hidden message. First of all, the pixels are scanned from left to right, then from top to bottom mentioned above. Similar to the previous process, it will be processed in the following three cases. (1) Case1: One-layer MSB According to the embedding process, in this case, 1-bit information is embedded in each embeddable pixel. Therefore, 1-bit hidden message can be extracted from each embeddable pixel by using the following equation. ′ ̃(𝑙) 𝑤 = ⌊𝑋𝑖,𝑗 /27 ⌋
(22)
(2) Case2: Two-layer MSB In this case, 2-bits hidden message can be extracted from each embeddable pixel as follows. ′ ̃(𝑙) 𝑤 = ⌊𝑋𝑖,𝑗 /27 ⌋ ′ ̃(𝑙 𝑤 + 1) = ⌊𝑚𝑜𝑑(𝑋𝑖,𝑗 , 27 ) ⁄26 ⌋
where 𝑚𝑜𝑑( ) represents the modulo operation. (3) Case3: Three-layer MSB Similarly, 3-bits hidden message can be extracted from each embeddable pixel as follows.
(23) (24)
′ ̃(𝑙) 𝑤 = ⌊𝑋𝑖,𝑗 /27 ⌋
(25)
′ ̃(𝑙 𝑤 + 1) = ⌊𝑚𝑜𝑑(𝑋𝑖,𝑗 , 27 ) ⁄26 ⌋
(26)
′ ̃(𝑙 𝑤 + 2) = ⌊𝑚𝑜𝑑(𝑋𝑖,𝑗 , 26 ) ⁄25 ⌋
(27)
Then, by using the data hiding key 𝐾𝑑ℎ , the corresponding plaintext message can be further obtained by decryption. It can be seen that if the receiver only has the data hiding key, he/she can extract the additional message. But without the encryption key, he/she is unable to access the content of the original image. 2) Image Recovery with Only Encryption Key In the second scenario, if the receiver only has the encryption key 𝐾𝑒𝑛 , the additional message cannot be extracted. But according to the following steps, he/she can directly decrypt the marked encrypted image and restore it to the original image. Step1. Similar to the image encryption process, the encryption key 𝐾𝑒𝑛 is used to generate pseudorandom sequence with 𝐻 × 𝑊 × 8 bits. Step 2. The pixels of the marked encrypted image are scanned from left to right, then from top to bottom, and each pixel can be represented by 8 bits, 𝑏′𝑖,𝑗 (0) , 𝑏′𝑖,𝑗 (1),…, 𝑏′𝑖,𝑗 (7). 𝑏′𝑖,𝑗 (𝑘) = ⌊
′ 𝑋𝑖,𝑗
2𝑘
⌋ 𝑚𝑜𝑑 2, k=0,1,…,7
(28)
Step 3. Image decryption can then be done as follows. 𝑑𝑒 𝐵𝑖,𝑗 (𝑘) = 𝑏′𝑖,𝑗 (𝑘) ⊕ 𝑟𝑖,𝑗 (𝑘)
(29)
where 𝑟𝑖,𝑗 (𝑘) are the key stream bits generated by the encryption key. 𝑑𝑒 Step 4. The decrypted pixel value 𝑥𝑖,𝑗 can be calculated as 𝑑𝑒 𝑑𝑒 𝑥𝑖,𝑗 = ∑7𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(30)
Since the MSBs of each pixel (except 𝑥̂1,1 ) are substituted with the secret bits during data embedding, 𝑑𝑒 these MSBs of 𝑥𝑖,𝑗 are different from the MSBs of the original image. For this reason, the prediction of
MSBs should be performed. Since 𝑥1,1 does not change during the data embedding process, its value can be accurately obtained after decryption. Thus, the estimation of 𝑥𝑖,𝑗 , denoted by 𝑥̃𝑖,𝑗 , can be calculated using the prediction technology described in Section 2.1. Next is the recovery of MSBs in three situations. (1) Case1: One-layer MSB
According to the local correlation of the image, the difference between the original pixel and its neighboring pixel is small. On the contrary, the difference between the marked pixel and its neighboring pixel is relatively large. Therefore, in order to recover the MSBs, the following two values should be first calculated. 𝑝0 𝑑𝑒 𝑋̅𝑖,𝑗 =0*27 + ∑6𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(31)
𝑝1 𝑑𝑒 𝑋̅𝑖,𝑗 =1*27 + ∑6𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(32)
Consequently, the original pixel 𝑥𝑖,𝑗 can be recovered as follows. 𝑥𝑖,𝑗 = {
𝑝0 𝑋̅𝑖,𝑗
𝑝0 𝑝1 𝑖𝑓 |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | < |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |
𝑝1 𝑋̅𝑖,𝑗
𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒
(33)
(2) Case2: Two-layer MSB In this case, in order to recover the MSBs, the following four values should be first calculated. 𝑝0 𝑑𝑒 𝑋̅𝑖,𝑗 =0*27 + 0*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 ) 𝑝1 𝑑𝑒 𝑋̅𝑖,𝑗 =0*27 + 1*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(34) (35)
𝑝2 𝑑𝑒 𝑋̅𝑖,𝑗 =1*27 + 0*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(36)
𝑝3 𝑑𝑒 𝑋̅𝑖,𝑗 =1*27 + 1*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(37)
Then the differences between the predicted value and these four values are calculated as ∆̿0 = 𝑝0 𝑝1 𝑝2 𝑝3 |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿1 = |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿2 = |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | ,and ∆̿3 = |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | . The minimum of these
differences is defined as follows. ∆̿𝑚𝑖𝑛 = 𝑚𝑖𝑛 {∆̿0 , ∆̿1 , ∆̿2 , ̿∆3 }
(38)
Consequently, the original pixel 𝑥𝑖,𝑗 can be recovered as follows.
𝑥𝑖,𝑗 =
𝑝0 𝑋̿𝑖,𝑗
𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿0
𝑝1 𝑋̿𝑖,𝑗 𝑝2 𝑋̿𝑖,𝑗 𝑝3 {𝑋̿𝑖,𝑗
𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿1 𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿2
(39)
𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿3
(3) Case3: Three-layer MSB Similarly, in this case, in order to recover the MSBs, the following eight values should be first calculated. 𝑝0 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 0*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(40)
𝑝1 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 0*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(41)
𝑝2 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 1*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(42)
𝑝3 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 1*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(43)
𝑝4 𝑑𝑒 𝑋̅̿𝑖,𝑗 =1*27 + 0*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(44)
𝑝5 𝑑𝑒 𝑋̅̿𝑖,𝑗 =1*27 + 0*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(45)
𝑝6 𝑑𝑒 𝑋̿̅𝑖,𝑗 =1*27 + 1*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(46)
𝑝7 𝑑𝑒 𝑋̿̅𝑖,𝑗 =1*27 + 1*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(47)
Then the differences between the predicted value and these eight values are calculated as ∆̿̅ 0 = 𝑝0 𝑝1 𝑝2 𝑝3 𝑝4 𝑝5 |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 1 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 2 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 3 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 4 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 5 = |𝑋̅̿𝑖,𝑗 − 𝑝6 𝑝7 𝑥̃𝑖,𝑗 | , ∆̿̅ 6 = |𝑋̿̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , and ∆̿̅ 7 = |𝑋̿̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |. Similarly, the minimum of these differences is defined as
follows. ∆̅̿𝑚𝑖𝑛 = 𝑚𝑖𝑛 {∆̅̿0 , ∆̅̿1 , ∆̅̿2 , ∆̅̿3 , ∆̅̿4 , ∆̅̿5 , ∆̅̿6 , ∆̅̿7 }
(48)
Consequently, the original pixel 𝑥𝑖,𝑗 can be recovered as follows. 𝑝0 𝑋̿̅𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿0
𝑝1 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿1
𝑝2 𝑋̿̅𝑖,𝑗
𝑖𝑓 ∆̿̅ 𝑚𝑖𝑛 = ∆̿̅ 2
𝑝3 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿3
𝑝4 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿4
𝑝5 𝑋̿̅𝑖,𝑗
𝑖𝑓 ∆̿̅ 𝑚𝑖𝑛 = ∆̿̅ 5
𝑝6 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿6
̿ 𝑝7 {𝑋̅𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿7
𝑥𝑖,𝑗 =
(49)
It can be seen that the method is fully reversible and the original image can be completely reconstructed. 3) Data Extraction and Image Recovery with Both Keys. If the receiver has both 𝐾𝑒𝑛 and 𝐾𝑑ℎ , he/she can extract the secret message without error and completely restore the original image at the same time. At first, the receiver extracts the secret message ′ from 𝑋𝑖,𝑗 by applying the above data extraction procedure. Subsequently, the original image can be
further reconstructed by utilizing the above image recovery procedure. Note that data extraction should be carried out before image restoration.
3. Experimental Results and Analysis In this section, we present the experimental results obtained by applying the proposed method and comparisons with several existing related works. Eight standard gray images shown in Fig.3 and 80 images selected from the Miscellaneous gray level images database [38] are selected as test images. The size of all images is 512×512×8. The secret message is a binary sequence created by pseudo random number generator.
3.1 Analysis of scrambling effect The encryption algorithm should be able to encrypt digital images into cipher-images with high security level. Only the correct key can be used to completely recover the original image. Without the correct key, one cannot obtain any information regarding the original image. In order to show the scrambling effect visually, the original images are demonstrated in Fig.3, while the corresponding encrypted results are illustrated in Fig.4. It can be seen that the data hider cannot obtain any available visual information of the original image from the encrypted image. In addition, PSNR (Peak Signal-to-Noise Ratio) is used as an objective metric to evaluate image visual quality. PSNR values of eight encrypted images are 9.5621dB, 9.5562dB, 7.8832dB, 8.4912dB, 8.9646dB, 9.6258dB, 8.0935dB, and 7.6069dB, respectively. We have also applied our proposed method to another 80 images which are selected from the Miscellaneous database [38]. Fig.5 presents the PSNR results of 80 encrypted images. It can be seen that PNSR values of the encrypted images are very low and the visual imperceptibility is guaranteed. Cryptographic security represents the security against cryptographic attacks, which relies on the underlying cipher. The secure stream cipher is used to encrypt sampled pixels, which has been proved its security against attacks. In addition, the pixels of an ideal cipher-image are required to be uniformly distributed to resist statistical attacks. Fig.6 illustrates the histogram of the original image. After encryption, the corresponding histogram is shown in Fig.7. By comparing Fig.6 and Fig.7, it can be observed that the modified distribution appears to be uniform, which suggests that a statistical analysis would not be effective for evaluating the original image content. In addition, the histogram statistics of the original images and the corresponding encrypted images are also given in Table 1.
3.2 Analysis of reconstructed image quality In the proposed method, with the data hiding key, all embedded secret bits can be extracted without error. In addition, with the prediction technology and the location map L1, the original image can be perfectly reconstructed after MSB prediction, as indicated by a PSNR which tends to +∞.
3.3 Analysis of Embedding Capacity The embedding capacity is defined as the maximum number of bits that can be embedded in a given cover image. In general, it is expressed in bit per pixel (bpp) and is expected to be as large as possible in order to hide the maximum amount of information. The actual payload should be the total embedding capacity minus the side information. In the proposed approach, the factor that impact the embedding capacity are the number of prediction errors. For eight standard gray images, the embedding rates with different MSBs are given in Table.2. For the sake of comparison, in addition to providing the test results of the three-layer MSB method proposed in this paper, we also provide the results of the single-layer and two-layer MSB method. The embedding rate of the single-layer MSB method does not exceed 1 bpp, because only one bit of information is embedded in each embeddable pixel by MSB replacement. Compared with the single-layer MSB method, the embedding rate of the two-layer MSB method is improved significantly, because two bits of information can be embedded in each embeddable pixel. In addition, the embedding capacity depends strongly on the characteristics of the original cover image, as each image has a different number of embeddable pixels. Taking the three-layer MSB method as an example, the maximum embedding capacity is 2.8478 bpp, while the minimum value is 2.0398 bpp. The reason is that some pixels cannot be used for information embedding due to prediction errors. In general, for relatively smooth images, the total embedding capacity is large and the encoded auxiliary information is less. On the contrary, for rough images, the total embedding capacity is small and the encoded auxiliary information is relatively large, so the actual payload will be smaller. In addition, 80 images selected from the Miscellaneous database [38] are also tested, and their corresponding total embedding rates are shown in Fig.8. For the one-layer MSB method, the embedding rates in the best and worst cases are 1.00 bpp and 0.9543 bpp, respectively, and the average embedding rate is 0.9905 bpp. For the two-layer MSB method, the embedding rates in the best and worst cases are 1.9971 bpp and
1.6023 bpp, respectively, and the average embedding rate is 1.9034 bpp. Similarly, for the three-layer MSB method, the embedding rates in the best and worst cases are 2.9383 bpp and 1.7001 bpp, respectively, and the average embedding rate is 2.5468 bpp. The actual embedding payload (i.e., after subtracting side information) is also shown in Fig. 9.
3.4 Comparison and Discussion In terms of embedding rate and reconstructed image quality, several comparisons are made between the proposed method and some existing methods [19,12-13]. The comparison of embedding rate is shown in Fig.10. It can be seen that the embedding capacity of our MSBs substitution strategy has been improved. In addition, the original image can be reconstructed losslessly (PSNR→ +∞) using only the encryption key. In conclusion, in addition to being error-free during data extraction, the proposed method can provide better performance in terms of embedding capacity and image restoration quality.
4. Conclusion and Future Work In this paper, we proposed an efficient high-capacity reversible data hiding method in encrypted images based on MSB prediction, which fully exploits the correlation between neighboring pixels in plaintext image. To ensure that the original image can be completely reconstructed, the positions of the prediction errors are stored in the binary location map. Then the original image is converted into encrypted form by using encryption key. After that, the data-hider embeds the secret data into the encrypted image by substituting up to three MSBs of each embeddable pixel with secret bits. Since the data hider cannot access the content of the original image , the confidentiality is guaranteed. In addition, this algorithm can achieve real reversibility, i.e., the original image can be perfectly recovered and the secret message can be extracted without error. Experimental results show that the proposed method can achieve higher embedding capacity compared to most related methods. Future work is aimed at designing new prediction mechanism in order to reduce the number of prediction errors. At the same time, an efficient compression technology should be designed for location map to improve the actual embedding capacity.
Acknowledgements This work is supported by the National Natural Science Foundation of China
(61771270), Zhejiang Provincial Natural Science Foundation of China (LY17F020013, LR20F020001), and Ningbo Natural Science Foundation (2018A610054).
References [1] Subramanyam, A.V.,Emmanuel, S., Kankanhalli, M.S.: Robust watermarking of compressed and encrypted JPEG2000 images. IEEE Transactions on Multimedia, vol.14, no.3, pp. 703 - 716 (2012). [2] Karim, M. S., Wong, K.S.: Universal data embedding in encrypted domain. Signal Processing, vol.94, pp.174182 (2014). [3] Guo, J.T., Zheng, P.J., Huang, J.W.: Secure watermarking scheme against watermark attacks in the encrypted domain. Journal of Visual Communication and Image Representation, vol.30, pp. 125-135 (2015). [4] Xu, D.W., Wang, R.D., Shi, Y. Q.: Data hiding in encrypted H.264/AVC video streams by codeword substitution. IEEE Transactions on Information Forensics and Security, vol.9, no.4, pp.596-606 (2014). [5] Xu, D.W., Wang, R.D., Shi, Y. Q.: An Improved Scheme for Data Hiding in Encrypted H.264/AVC Videos. Journal of Visual Communication and Image Representation, vol.36, pp. 229-242 (2016). [6] Xu, D.W., Wang, R.D., Zhu, Y.N.: Tunable data hiding in partially encrypted H.264/AVC videos. Journal of Visual Communication and Image Representation, vol.45, pp. 34-45 (2017). [7] Shi, Y.Q., Li, X.L., Zhang, X. P., Wu, H. T., and Ma, B.: Reversible data hiding: advances in the past two decades. IEEE Access, vol. 4, pp. 3210-3237 (2016). [8] Zhang, X. P.: Reversible data hiding in encrypted image. IEEE Signal Processing Letters, vol.18, no.4, pp. 255 – 258 (2011). [9] Zhang, X. P.: Separable reversible data hiding in encrypted image. IEEE Transactions on Information Forensics and Security, vol.7, no.2, pp. 826 – 832 (2012). [10] Huang, F.J., Huang, J.W., Shi, Y. Q., New framework for reversible data hiding in encrypted domain. IEEE Transactions on Information Forensics and Security, vol.11, no.12, pp. 2777-2789 (2016). [11] Wu, X.T., Sun, W.: High-capacity reversible data hiding in encrypted images by prediction error. Signal Processing, vol.104, pp. 387-400 (2014). [12] Qian, Z., Zhang, X.: Reversible data hiding in encrypted images with distributed source encoding. IEEE Transactions on Circuits and Systems for Video Technology, vol.26, no.4, pp. 636 - 646 (2016). [13] Puteaux, P., Puech, W.: An efficient MSB prediction-based method for high-capacity reversible data hiding in encrypted images. IEEE Transactions on Information Forensics and Security, vol.13, no.7, pp. 1670-1681 (2018). [14] Puteaux, P., Puech, W.: EPE-based huge-capacity reversible data hiding in encrypted images. 2018 IEEE International Workshop on Information Forensics and Security (WIFS), Hongkong, pp. 11-13 (2018).
[15] Ma, K. D., Zhang, W. M., Zhao, X. F., et al.: Reversible data hiding in encrypted images by reserving room before encryption. IEEE Transactions on Information Forensics and Security, vol.8, no.3, pp. 553-562 (2013). [16] Zhang, W. M., Ma, K. D., Yu, N. H.: Reversibility improved data hiding in encrypted images. Signal Processing, vol.94, pp. 118- 127 (2014). [17] Cao, X.C., Du, L., Wei, X.X., etc.: High capacity reversible data hiding in encrypted images by patch-level sparse representation. IEEE Transactions on Cybernetics, vol.46, no.5, pp. 1132- 1143 (2016). [18] Wu, H.Z., Shi, Y.Q., Wang, H.X., Zhou, L.N.: Separable reversible data hiding for encrypted palette images with color partitioning and flipping verification. IEEE Transactions on Circuits and Systems for Video Technology, vol.27, no.8, pp. 1620 – 1631 (2017). [19] Xu, D.W., Wang R.D.: Separable and error-free reversible data hiding in encrypted images. Signal Processing, vol.123, pp. 9-21 (2016). [20] Yi, S. Zhou, Y.C.: Separable and reversible data hiding in encrypted images using parametric binary tree labeling. IEEE Transactions on Multimedia, vol.21, no.1, pp. 51-64 (2018). [21] Zhang, X.P., Long, J., Wang, Z.C., Cheng, H.: Lossless and Reversible Data Hiding in Encrypted Images with Public Key Cryptography. IEEE Transactions on Circuits and Systems for Video Technology, vol.26, no.9, pp. 1622-1631 (2016). [22] Wu, H. T., Cheung, Y.M., Yang, Z.Y., Tang, S.H.: A high-capacity reversible data hiding method for homomorphic encrypted images. Journal of Visual Communication and Image Representation, vol.62, pp.8796 (2019). [23] Xu, D.W., Chen, K., Wang, R.D., Su, S.B.: Separable Reversible Data Hiding in Encrypted Images Based on Two-Dimensional Histogram Modification. Security and Communication Networks, vol.2018, pp. 1-14 (2018). [24] Xiang, S.J., Luo, X.R.: Reversible data hiding in homomorphic encrypted domain by mirroring ciphertext group. IEEE Transactions on Circuits and Systems for Video Technology, vol.28, no.11, pp. 3099-3110 (2017). [25] Chen, B., Wu, X.T., Lu, W., Ren, H.L.: Reversible data hiding in encrypted images with additive and multiplicative public-key homomorphism. Signal Processing, vol.164, pp. 48-57 (2019). [26] Qian, Z., Zhang, X., Wang, S.: Reversible data hiding in encrypted JPEG bitstream. IEEE Transactions on Multimedia, vol. 16, no.5, pp. 1486 – 1491 (2014). [27] Chang, J.C., Lu, Y.Z,, Wu, H.L.: A separable reversible data hiding scheme for encrypted JPEG bitstreams. Signal Processing, vol.133, pp.135-143 (2017). [28] Qian, Z.X., Xu, H.S., Luo, X.Y., Zhang, X.P.: New framework of reversible data hiding in encrypted JPEG bitstreams. IEEE Transactions on Circuits and Systems for Video Technology, vol.29, no.2, pp. 351 - 362 (2018). [29] Qian, Z.X., Zhou, H., Zhang, X.P., Zhang, W.M.: Separable reversible data hiding in encrypted JPEG bitstreams. IEEE Transactions on Dependable and Secure Computing, vol.15, No.6, pp. 1055 – 1067 (2018).
[30] Thodi, D.M., Rodriguez, J.J.: Expansion embedding techniques for reversible watermarking. IEEE Transactions on Image Processing, vol.16, no.3, pp. 721-730 (2007). [31] Hu, Y.J., Lee, H.K., Li, J.W.: DE-Based Reversible Data Hiding With Improved Overflow Location Map. IEEE Transactions on Circuits and Systems for Video Technology, vol.19, no.2, pp. 250-260 (2009). [32] Weinberger, M., Seroussi, G., Sapiro, G.: The LOCO-I lossless image compression algorithm: principles and standardization into JPEG-LS. IEEE Transactions on Image Processing, vol.9, no.8, pp. 1309-1324 (2000). [33] Wu, X., Memon, N.: Context-based, adaptive, lossless image coding. IEEE Transactions on Communications, vol.45, no.4, pp.437-444 (1997). [34] Coltuc, D.: Improved embedding for prediction-based reversible watermarking. IEEE Transactions on Information Forensics and Security, vol.6, no.3, pp. 873-882 (2011). [35] Sachnev, V., Kim, H.J., Nam, J., Suresh, S., Shi, Y. Q.: Reversible watermarking algorithm using sorting and prediction. IEEE Transactions on Circuits and Systems for Video Technology, vol.19, no.7, pp. 989-999 (2009). [36] Ou, B., Li, X.L., Zhao, Y., Ni, R.R., Shi, Y. Q.: Pairwise prediction-error expansion for efficient reversible data hiding. IEEE Transactions on Image Processing, vol.22, no.12, pp. 5010-5021 (2013). [37] Kim, S., Qu, X.C., Sachnev, V., Kim, H.J.: Skewed histogram shifting for reversible data hiding using a pair of extreme predictions. IEEE Transactions on Circuits and Systems for Video Technology, DOI: 10.1109/TCSVT.2018.2878932. [38] Miscelaneous gray level images, available: http://decsai.ugr.es/cvg/dbimagenes/g512.php
Figure legends Fig.1 The framework of proposed RDH-EI scheme Fig.2 Three prediction algorithms Fig.3 Eight standard gray images Fig.4 The corresponding encrypted images Fig.5 PSNR values of 80 encrypted images Fig.6 Histogram of the original images Fig.7 Histogram of the corresponding encrypted images Fig.8 Total embedding rates of 80 test images Fig.9 Actual embedding rates of 80 test images Fig.10 Comparison of embedding rates between the proposed method and some state-of-the-art methods
19
Table.1 Comparison of histogram statistical characteristics Standard Test Images Lena Baboon Barbara Peppers Boat Truck Airplane Man
Mean 134.40 129.15 126.59 104.21 136.13 106.39 179.20 77.82
Original Image Standard Deviation Median 41.51 141 42.30 130 72.06 127 57.40 108 52.32 158 34.97 109 45.12 200 58.25 74
20
Mean 127.57 127.42 127.47 127.67 127.54 127.43 127.55 127.39
Encrypted Image Standard Deviation Median 73.89 128 73.94 127 73.90 127 73.90 128 74.01 128 73.96 127 73.82 128 73.82 127
Table. 2 Test results of eight standard images Standard Test Images Lena Baboon Barbara Peppers Boat Truck Airplane Man
Total Embedding Rate (bpp) 1-layer MSB 2-layer MSB 3-layer MSB 0.9992 1.9790 2.8478 0.9846 1.7623 2.0398 0.9710 1.7622 2.3032 0.9981 1.9748 2.8258 0.9988 1.9656 2.7596 0.9997 1.9730 2.5879 0.9988 1.9669 2.8196 0.9964 1.9360 2.6303
21
Actual Payload (bpp) 1-layer MSB 2-layer MSB 0.9903 1.9152 0.8775 1.3121 0.8397 1.4384 0.9843 1.8965 0.9859 1.8682 0.9954 1.8738 0.9878 1.8763 0.9647 1.7701
3-layer MSB 2.6492 1.2577 1.8117 2.5734 2.4506 2.0256 2.5885 2.2035
PSNR 9.5621 9.5562 7.8832 8.4912 8.9646 9.6258 8.0935 7.6069
Highlights An improved prediction method is designed to predict the current pixel value. The multi-MSBs substitution is applied to achieve high embedding capacity. The original image can be reconstructed losslessly by utilizing MSB prediction.
22
Authors’ contributions Bo Guan came up with this idea and did some experiments. Dawen Xu were the major contributors in writing the manuscript. All authors read and approved the final manuscript.
23
S1047-3203(19)30365-7 https://doi.org/10.1016/j.jvcir.2019.102744 YJVCI 102744
To appear in:
J. Vis. Commun. Image R.
Received Date: Revised Date: Accepted Date:
7 October 2019 6 December 2019 20 December 2019
Please cite this article as: B. Guan, D. Xu, An Efficient High-Capacity Reversible Data Hiding Scheme for Encrypted Images, J. Vis. Commun. Image R. (2019), doi: https://doi.org/10.1016/j.jvcir.2019.102744
This is a PDF file of an article that has undergone enhancements after acceptance, such as the addition of a cover page and metadata, and formatting for readability, but it is not yet the definitive version of record. This version will undergo additional copyediting, typesetting and review before it is published in its final form, but we are providing this version to give early visibility of the article. Please note that, during the production process, errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.
© 2019 Published by Elsevier Inc.
An Efficient High-Capacity Reversible Data Hiding Scheme for Encrypted Images
Bo Guan, Dawen Xu * School of Electronics and Information Engineering, Ningbo University of Technology, Ningbo, 315016, China *
Corresponding author: Dawen Xu
E-mail: [email protected]
Abstract. Reversible data hiding in encrypted images is an effective technique to embed information in encrypted domain, without knowing the original content of the image or the encryption key. In this paper, a high-capacity reversible data hiding scheme for encrypted images based on MSB (most significant bit) prediction is proposed. Since the prediction is not always accurate, it is necessary to identify the prediction error and store this information in the location map. The stream cipher is then used to encrypt the original image directly. During the data hiding phase, up to three MSBs of each available pixel in the encrypted image are substituted by the bits of the secret message. At the receiving end, the embedded data can be extracted without any errors and the original image can be perfectly reconstructed by utilizing MSB prediction. Experimental results show that the scheme can achieve higher embedding capacity than most related methods.
Keywords. Reversible data hiding, Image encryption, Image security, MSB prediction, High capacity
1. Introduction With the rapid development of mobile Internet and smart terminal devices, digital images are growing explosively. Cloud computing provides a more suitable solution for the storage, fast processing and intelligent analysis of massive image data. However, under the existing cloud computing architecture, users have basically lost their absolute control over the data, resulting in a series of security issues such as confidentiality, privacy and so on. Encryption is an important means of protecting the confidentiality and privacy of user data in a cloud computing environment. Users first encrypt sensitive image into unrecognized noise-like format before uploading it. All the processing and computing in the cloud are done in the encrypted domain, and the processing results are then provided to users. Authorized terminal users with decryption keys can obtain the plaintext data after decrypting. However, image data loses its original characteristics after encryption, and the effective management, integrity and reliability protection
of massive ciphertext image data in the cloud has become an urgent and challenging problem. Therefore, data hiding in encrypted domain has become a research hotspot in recent years, which directly embeds some additional messages in the encrypted data, including copyright information, owner identity, or authentication data. For example, when the patient's medical image is encrypted and uploaded to the cloud, the administrator can embed the relevant information into the corresponding ciphertext, such as the owner information, the shooting time, the shooting location, etc. By extracting the embedded information and comparing the corresponding keywords, the fast retrieval of the ciphertext image can be realized. From the past few years, some substantial works have been done for data hiding in encrypted images or videos [1] – [6]. However, one common drawback of these works is the fact that the carrier is inevitably and permanently distorted due to data hiding. Although the distortion is generally quite small, it may not be acceptable for distortion-sensitive applications such as medical imaging, military imaging, law enforcement [7]. Therefore, reversible data hiding in encrypted images (RDH-EI) has become a research hotspot recently. RDH-EI not only ensures the accuracy of the reconstructed image and extracted secret message, but also preserves the privacy of the cover-image. Existing RDH-EI methods can be roughly classified into three categories, namely vacating room after encryption (VRAE) [8] – [14], reserving room before encryption (RRBE) [15] – [20], and the method based on homomorphic encryption [21] – [25]. The early VRAE framework is proposed by Zhang [8, 9]. The entire data of an uncompressed image is encrypted directly by a stream cipher. Then the data-hider embeds the additional data by modifying a small portion of encrypted data. Later, Huang et al. [10] designed a new framework for RDH in encrypted domain, which integrates previous difference histogram shifting based RDH approaches via a new encryption strategy. In general, estimation technique is necessary for the receiver in VRAE framework, because no prior information of the original content is available. When LSB (least significant bit) planes of the encrypted image are modified to accommodate the additional data, the image recovery is based on estimating the original LSB planes. But these estimations are not accurate enough. Due to the local correlation between a pixel and its neighbors, two adjacent pixel values are very close. As estimating MSB is much more accurate than estimating LSB planes, some methods are designed to achieve high embedding payload by combining the MSB estimation. Wu and Sun [11] proposed a separable RDH-EI method, where 1-layer or 2-layer MSBs are emptied for storing the additional bits. The context adaptive
interpolation algorithm is adopted to estimate the MSBs. Qian and Zhang [12] proposed a RDH-EI scheme using distributed source coding (DSC). As estimating MSB is much more accurate than estimating LSB planes, the MSB plane can be recovered by DSC decoding with an acceptable decoding error probability. More recently, high capacity reversible data hiding approach with correction of prediction errors and high capacity reversible data hiding approach with embedded prediction errors are presented in [13, 14]. Ma et al. [15] first proposed a RRBE method. Specifically, by using traditional RDH method, LSBs of some pixels are embedded into other pixels to empty the room, and then the image is encrypted. So the positions of these LSBs in the encrypted image can be used to embed data. Later, Zhang et al. [16] proposed a RDH method in encrypted images based on estimation technique. The additional data is embedded in the encrypted image by modifying the estimating errors. To better explore the correlation between neighbor pixels, Cao et al. [17] propose to hide the secret data with a patch-level sparse representation technique. Wu et al. [18] present a separable reversible data hiding scheme for encrypted palette images with color partitioning and flipping verification. In [19], another RRBE method was proposed by using the interpolation technique to make room for data embedding. Yi et al. [20] proposed an RDH-EI method using parametric binary tree labeling scheme. In general, the RDH-EI methods based on RRBE can achieve larger embedding capacity than those based on VRAE. But it is impracticable, because the data hider should know the vacated room created by the content owner before encryption. In addition to VRAE and RRBE, another RDH-EI method suggests to use homomorphic encryption to encrypt the original image [21-25]. However, the most important problem of homomorphic encryption is that it will suffer from pixel expansion. While most RDH-EI methods are designed for uncompressed spatial-domain images, several works are applicable to JPEG bitstream [26-29]. As described in [13], the prediction of the MSB values is easier to obtain than those of the LSB. In this paper, we present an efficient high-capacity reversible data hiding scheme for encrypted images based on MSB prediction. Because of local correlations present in images, the grayscale values of adjacent pixels are close to each other. Therefore, we design an improved prediction method that uses the decrypted previous pixels to predict the current pixel value. During the data hiding phase, up to three MSBs of each available pixel in the encrypted image are substituted by the secret bits. The rest of the paper is structured as follows. Section 2 describes the details of the proposed scheme including location map generation, image encryption, data embedding, data extraction and original image recovery.
Experimental results and comparisons are provided in Section 3. Finally, the conclusion is drawn and future work is concluded in Section 4.
2. Proposed Scheme The framework of the proposed RDH-EI method based on MSB prediction is illustrated in Fig.1. Although there is local correlation in the image, adjacent pixel values can be used to predict the current pixel values. But sometimes there are errors in the prediction. Therefore, the first step is to identify the prediction error and store its position information in the location map. Then, the content owner encrypts the original image using a standard stream cipher. After that, data embedding can be carried out by substituting up to three MSBs of embeddable pixels in encrypted image with the secret message. At the receiver side, with the help of the location error information, the original image can be reconstructed losslessly.
2.1 MSB Flipping Prediction and Location Map Generation Without loss of generality, assuming that the size of the original grey image is H × W, and the pixel value is represented by 𝑥𝑖,𝑗 ∈ [0,255], 1 ≤ i ≤ H, 1 ≤ j ≤ W. Our method proposes to embed the secret message by MSB substitution. As the original MSB values are lost during the data hiding phase, it is important to be able to predict them without any errors for image reconstruction. Some prediction methods have been designed to estimate pixel values in spatial domain. For example, the median edge detector predictor (MED) used in [30] and [31] is a high-performance predictor already used in JPEGLS standard [32]. With MED, 𝑥̃𝑖,𝑗 , the estimate of pixel 𝑥𝑖,𝑗 , is 𝑚𝑖𝑛(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑥̃𝑖,𝑗 = { 𝑚𝑎𝑥(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑥𝑖,𝑗−1 +𝑥𝑖−1,𝑗 − 𝑥𝑖−1,𝑗−1
𝑖𝑓 𝑥𝑖−1,𝑗−1 ≥ 𝑚𝑎𝑥(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑖𝑓 𝑥𝑖−1,𝑗−1 ≤ 𝑚𝑖𝑛(𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 ) 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒
(1)
where 𝑥𝑖,𝑗−1 , 𝑥𝑖−1,𝑗 , and 𝑥𝑖−1,𝑗−1 are the left, upper, and upper-diagonal neighbours of 𝑥𝑖,𝑗 (see Fig.2 (a)). The other is the gradient-adjusted predictor (GAP), which is used in CALIC (context-based, adaptive, lossless image coding ) algorithm [33]. Generally, the prediction accuracy of the GAP predictor is higher than that of MED, and it is also more complex [34]. More precisely, the pixel 𝑥𝑖,𝑗 is estimated by
𝑥𝑖,𝑗+1 𝑥𝑖,𝑗+1 +𝑠 2 𝑥𝑖,𝑗+1 +3𝑠
𝑥̃𝑖,𝑗 =
4
𝑠 𝑥𝑖+1,𝑗 +3𝑠 4 𝑥𝑖+1,𝑗 +𝑠 2
{ 𝑥𝑖+1,𝑗
𝑖𝑓 ∆𝑣 − ∆ℎ > 80 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ (32,80] 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ (8,32] 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ [−8,8]
(2)
𝑖𝑓 ∆𝑣 − ∆ℎ ∈ [−32, −8) 𝑖𝑓 ∆𝑣 − ∆ℎ ∈ [−80, −32) 𝑖𝑓 ∆𝑣 − ∆ℎ < −80
where ∆ℎ = |𝑥𝑖,𝑗+1 − 𝑥𝑖,𝑗+2 | + |𝑥𝑖+1,𝑗−1 − 𝑥𝑖+1,𝑗 | + |𝑥𝑖+1,𝑗 − 𝑥𝑖+1,𝑗+1 | and ∆𝑣 = |𝑥𝑖,𝑗+1 − 𝑥𝑖+1,𝑗+1 | + |𝑥𝑖+1,𝑗−1 − 𝑥𝑖+2,𝑗−1 | + |𝑥𝑖+1,𝑗 − 𝑥𝑖+2,𝑗 | represent the horizontal and vertical gradients (see Fig.2 (b)), and 𝑠 = (𝑥𝑖,𝑗+1 + 𝑥𝑖+1,𝑗 )⁄2 + (𝑥𝑖+1,𝑗−1 − 𝑥𝑖+1,𝑗+1 )⁄4. The third one is the rhombus predictor, which has been used in [35] and [36]. The predicted value 𝑥̃𝑖,𝑗 is computed as follows (see Fig.2 (c)). 𝑥𝑖−1,𝑗 +𝑥𝑖,𝑗−1 +𝑥𝑖+1,𝑗 +𝑥𝑖,𝑗+1
𝑥̃𝑖,𝑗 = ⌊
4
⌋
(3)
Overall, full context rhombus predictor has the best performance among all of these predictors. In rhombus predictor, the prediction is performed using four closest neighbours around the current pixel. However, in our method, the right and lower neighbours of the current pixel are completely unknown during image restoration process. Therefore, only part of the neighbouring pixels can be used as the prediction context, i.e., half direction prediction. According to the prediction mode, all pixels are divided into five categories, that is, 𝑋 𝐼 = {𝑥1,1 }, 𝑋 𝐼𝐼 = {𝑥1,2 , 𝑥1,3 , … , 𝑥1,𝑊 }, 𝑋 𝐼𝐼𝐼 = {𝑥2,1 , 𝑥3,1 , … , 𝑥𝐻,1 }, 𝑋 𝐼𝑉 = {𝑥2,2 , 𝑥2,3 , … , 𝑥2,𝑊 , 𝑥3,2 , 𝑥4,2 , … , 𝑥𝐻,2 , 𝑥3,𝑊 , 𝑥4,𝑊 , … , 𝑥𝐻,𝑊 } , 𝑋 𝑉 = {𝑥𝑖,𝑗 |𝑖 = 3,4, … , 𝐻, 𝑗 = 3,4, … , 𝑊 − 1}. The pixel in 𝑋 𝐼 is located in the upper left corner of the image, and its value will remain unchanged during the data embedding phase. On the other hand, the pixels in 𝑋 𝐼𝐼 , 𝑋 𝐼𝐼𝐼 , and 𝑋 𝐼𝑉 will be approximately predicted by neighbouring pixels via Eq. (4).
𝑥̃𝑖,𝑗
𝑥𝑖,𝑗 𝑥𝑖,𝑗−1 = 𝑥𝑖−1,𝑗 {⌊0.2 ∙ 𝑥𝑖−1,𝑗−1 + 0.4 ∙ 𝑥𝑖,𝑗−1 + 0.4 ∙ 𝑥𝑖−1,𝑗 ⌋
𝑥𝑖,𝑗 ∈ 𝑋 𝐼 𝑥𝑖,𝑗 ∈ 𝑋 𝐼𝐼 𝑥𝑖,𝑗 ∈ 𝑋 𝐼𝐼𝐼
(4)
𝑥𝑖,𝑗 ∈ 𝑋 𝐼𝑉
where is a floor function that maps a real number to the nearest integer in the downward direction, and 𝑥̃𝑖,𝑗 is the predicted value of 𝑥𝑖,𝑗 . It should be noted that the pixels in 𝑋 𝑉 will be predicted in the form of Eq. (2). The difference is that the right pixel (i.e. 𝑥𝑖,𝑗+1 ) will be replaced by the corresponding left pixel (i.e., 𝑥𝑖,𝑗−1 ), and the lower pixel (i.e., 𝑥𝑖+1,𝑗 ) will be replaced by the corresponding upper pixel (i.e., 𝑥𝑖−1,𝑗 ). The calculation of ∆ℎ and ∆𝑣 should be processed in the same way.
Since MSB values are substituted by secret bits during the data embedding phase, original bit values are lost and have to be predictable with the previously scanned pixels and the accurately decrypted bitplanes. Therefore, the first step of our method consists in analyzing the image content to detect the possible prediction errors. The difference between the predicted pixel value and the original pixel value can be calculated as ∆𝑝𝑟 = |𝑥𝑖,𝑗 − 𝑥̃𝑖,𝑗 |. Each pixel 𝑥𝑖,𝑗 with gray value falling into [0, 255] can be represented by 8 bits, 𝑏𝑖,𝑗 (0),𝑏𝑖,𝑗 (1),…, 𝑏𝑖,𝑗 (7), such that 𝑥𝑖,𝑗
𝑏𝑖,𝑗 (𝑘) = ⌊
2𝑘
⌋ 𝑚𝑜𝑑 2 , 𝑘 = 0,1, . . . ,7
(5)
where 𝑚𝑜𝑑( ) represents the modulo operation. It has been observed that, up to three bits, MSB replacement is suitable for maintaining high prediction accuracy along with reasonable auxiliary information. With the increase of MSBs, the prediction accuracy will decrease and the auxiliary information will increase accordingly. Therefore, we will elaborate on three situations: one-layer MSB, two-layer MSB and three-layer MSB.
(1) Case1: One-layer MSB First of all, flipping the MSB of 𝑥𝑖,𝑗 yields the following values. ′ 𝑥̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + ∑6𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘
(6)
′ where 𝑏(𝑖,𝑗) (7) is the flipped value of 𝑏(𝑖,𝑗) (7), i.e., 0 is converted into 1, and vice versa. Then calculate
the difference between 𝑥̅𝑖,𝑗 and 𝑥̃𝑖,𝑗 as ∆̅𝑝𝑟 = |𝑥̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | . If ∆𝑝𝑟 ≥ ∆̅𝑝𝑟 , it means that there is a prediction error. Otherwise, since the original pixel value is closer to its predicted pixel value than the flipped pixel value, there is no prediction error. (2) Case2: Two-layer MSB In this case, the following three values can be obtained according to different types of MSB flips. 1 ′ (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + ∑5𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 𝑥̿𝑖,𝑗 =𝑏𝑖,𝑗
(7)
2 ′ (6) ∙ 26 + ∑5𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 𝑥̿𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗
(8)
3 ′ ′ (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + ∑5𝑘=0 𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 𝑥̿𝑖,𝑗 =𝑏𝑖,𝑗
(9)
Similarly, the differences between the predicted value and the flipped values are then calculated as 1 2 3 ∆̿1𝑝𝑟 = |𝑥̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿2𝑝𝑟 = |𝑥̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , and ∆̿3𝑝𝑟 = |𝑥̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | . If ∆𝑝𝑟 ≥ min{ ∆̿1𝑝𝑟 , ∆̿2𝑝𝑟 , ∆̿3𝑝𝑟 } , it means
that there is a prediction error. Otherwise, there is no prediction error because the original pixel value is closer to its predicted pixel value than the flipped values. (3) Case3: Three-layer MSB According to different types of flipping on the three-layer MSB, the following seven values should be calculated as follows. 1 ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(10)
2 ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(11)
3 ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(12)
4 ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(13)
5 ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(14)
6 ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(15)
7 ′ ′ ′ 𝑥̅̅𝑖,𝑗 =𝑏𝑖,𝑗 (7) ∙ 27 + 𝑏𝑖,𝑗 (6) ∙ 26 + 𝑏𝑖,𝑗 (5) ∙ 25 + ∑4𝑘=0(𝑏𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(16)
As in the previous two cases, the differences between the predicted value and the flipped values are ̅ ̅ ̅ ̅ ̅ 1 2 3 4 then calculated as ∆̅1𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̅2𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̅3𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 ) | , ∆̅4𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̅5𝑝𝑟 = ̅ ̅ ̅ ̅ ̅ ̅ ̅ ̅ ̅ 5 6 7 |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |, ∆̅6𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |, and ∆̅7𝑝𝑟 = |𝑥̅̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |. If ∆𝑝𝑟 ≥ min { ∆̅1𝑝𝑟 , ∆̅2𝑝𝑟 , ∆̅3𝑝𝑟 , ∆̅4𝑝𝑟 , ∆̅5𝑝𝑟 , ∆̅6𝑝𝑟 , ∆̅7𝑝𝑟 }, it means that there is a prediction error. Otherwise, there is no prediction error. The location map 𝐿1 is necessary for lossless recovery of the original image. The size of 𝐿1 is the same as that of the original image. If there is a prediction error at a position in the image, the value of the corresponding position in 𝐿1 is marked as “1”. Otherwise, the value is marked as “0”. Finally, the location map is losslessly compressed using arithmetic coding and appended to the front of the payload, along with its size. Given an image size of H × W, the upper limit to represent the size of the location map is ⌈𝑙𝑜𝑔2 (H × W)⌉ bits. For an image size of 512×512, this is 18 bits [37].
2.2 Image Encryption First of all, the encryption key 𝐾𝑒𝑛 is used as a seed for a pseudo-random number generator to obtain a pseudo-random binary sequence of 𝐻 × 𝑊 × 8 bits. Then, decompose pixel 𝑥𝑖,𝑗 into 8 bits 𝑏𝑖,𝑗 (0) ,𝑏𝑖,𝑗 (1) ,…, 𝑏𝑖,𝑗 (7) using Eq. (5). Consequently, the bitwise exclusive-or (XOR) operation is performed between the original bits 𝑏𝑖,𝑗 (𝑘)and pseudo-random bits 𝑟𝑖,𝑗 (𝑘) as follow.
𝐵̂𝑖,𝑗 (𝑘) = 𝑏𝑖,𝑗 (𝑘) ⊕ 𝑟𝑖,𝑗 (𝑘)
(17)
where ⊕ represents a bitwise XOR operator and 𝐵̂𝑖,𝑗 (𝑘) denotes the k-th associated encrypted bit. In the next step, the encrypted bits are concatenated orderly as the encrypted pixel value 𝑥̂𝑖,𝑗 . 𝑥̂𝑖,𝑗 = ∑7𝑘=0(𝐵̂𝑖,𝑗 (𝑘) ⋅ 2𝑘 )
(18)
After generating the encrypted image, the data hider or the third party cannot access the image content without the encryption key, thus preserving the privacy of the image content owner.
2.3 Data Embedding in Encrypted Image Without knowing the encryption key 𝐾𝑒𝑛 , the data hider can complete data embedding step directly in the encrypted domain. Suppose the message to be embedded is a binary sequence. In order to enhance the security, the to-be-embedded message is encrypted by a stream cipher according to the data-hiding key 𝐾𝑑ℎ . Thus, the to-be-embedded binary information, i.e., W = {𝑤(𝑙)|𝑙 = 1,2, … , 𝐾, 𝑤(𝑙) ∈ {0,1}}, is an encrypted version. It is difficult for anyone without a data hiding key to recover the message. During the data hiding phase, the error location map L1 will be used to detect whether the current pixel can be marked by bits of the secret message (i.e. pixels without prediction error). Subsequently, the data hider scans pixels of the encrypted image from left to right, then from top to bottom and substitutes the MSBs of all the available pixels by secret bits. Similar to the prediction process, it is processed in the following three cases. (1) Case1: One-layer MSB For encrypted pixels (except 𝑥̂1,1 ), the data hider embeds the secret bit into the MSB using the bit substitution method, as denoted by ′ 𝑋𝑖,𝑗 =𝑤(𝑙) ∙ 27 + ∑6𝑘=0 𝐵̂𝑖,𝑗 (𝑘) ∙ 2𝑘
(19)
′ where 𝑋𝑖,𝑗 is the marked encrypted pixels. Since one embeddable pixel can carry 1 bit of information,
the maximum embedding rate is 1 bpp. (2) Case2: Two-layer MSB Similarly, for encrypted pixels (except 𝑥̂1,1 ), the secret bits are embedded into the first MSB and the second MSB as following equation. ′ 𝑋𝑖,𝑗 =𝑤(𝑙) ∙ 27 + 𝑤(𝑙 + 1) ∙ 26 + ∑5𝑘=0 𝐵̂𝑖,𝑗 (𝑘) ∙ 2𝑘
(20)
In this case, one embeddable pixel can carry 2 bits of information, so the maximum embedding rate
is 2 bpp. (3) Case3: Three-layer MSB In this case, for encrypted pixels (except 𝑥̂1,1 ), the embedding operation is formulated as ′ 𝑋𝑖,𝑗 =𝑤(𝑙) ∙ 27 + 𝑤(𝑙 + 1) ∙ 26 + 𝑤(𝑙 + 2) ∙ 25 + ∑4𝑘=0 𝐵̂𝑖,𝑗 (𝑘) ∙ 2𝑘
(21)
Since one embeddable pixel can carry 3 bits of information, the maximum embedding rate is 3 bpp. However, not every pixel can be used for data embedding due to the prediction error. Therefore, the actual embedding rate will be less than 3 bpp, which will be verified in subsequent experiments.
2.4 Data Extraction and Original Image Recovery At the receiving end, the receiver can extract the additional message using the data hiding key and reconstruct the original image using the encryption key. There are three possible scenarios, depending on the recipient: only knows the data hiding key, only knows the encryption key, or knows both keys. 1) Data Extraction with Only Data Hiding Key ′ As we know some significant bit-planes of marked encrypted image 𝑋𝑖,𝑗 are marked by bits of the
secret message, a receiver with the data hiding key 𝐾𝑑ℎ can easily extract the hidden message. First of all, the pixels are scanned from left to right, then from top to bottom mentioned above. Similar to the previous process, it will be processed in the following three cases. (1) Case1: One-layer MSB According to the embedding process, in this case, 1-bit information is embedded in each embeddable pixel. Therefore, 1-bit hidden message can be extracted from each embeddable pixel by using the following equation. ′ ̃(𝑙) 𝑤 = ⌊𝑋𝑖,𝑗 /27 ⌋
(22)
(2) Case2: Two-layer MSB In this case, 2-bits hidden message can be extracted from each embeddable pixel as follows. ′ ̃(𝑙) 𝑤 = ⌊𝑋𝑖,𝑗 /27 ⌋ ′ ̃(𝑙 𝑤 + 1) = ⌊𝑚𝑜𝑑(𝑋𝑖,𝑗 , 27 ) ⁄26 ⌋
where 𝑚𝑜𝑑( ) represents the modulo operation. (3) Case3: Three-layer MSB Similarly, 3-bits hidden message can be extracted from each embeddable pixel as follows.
(23) (24)
′ ̃(𝑙) 𝑤 = ⌊𝑋𝑖,𝑗 /27 ⌋
(25)
′ ̃(𝑙 𝑤 + 1) = ⌊𝑚𝑜𝑑(𝑋𝑖,𝑗 , 27 ) ⁄26 ⌋
(26)
′ ̃(𝑙 𝑤 + 2) = ⌊𝑚𝑜𝑑(𝑋𝑖,𝑗 , 26 ) ⁄25 ⌋
(27)
Then, by using the data hiding key 𝐾𝑑ℎ , the corresponding plaintext message can be further obtained by decryption. It can be seen that if the receiver only has the data hiding key, he/she can extract the additional message. But without the encryption key, he/she is unable to access the content of the original image. 2) Image Recovery with Only Encryption Key In the second scenario, if the receiver only has the encryption key 𝐾𝑒𝑛 , the additional message cannot be extracted. But according to the following steps, he/she can directly decrypt the marked encrypted image and restore it to the original image. Step1. Similar to the image encryption process, the encryption key 𝐾𝑒𝑛 is used to generate pseudorandom sequence with 𝐻 × 𝑊 × 8 bits. Step 2. The pixels of the marked encrypted image are scanned from left to right, then from top to bottom, and each pixel can be represented by 8 bits, 𝑏′𝑖,𝑗 (0) , 𝑏′𝑖,𝑗 (1),…, 𝑏′𝑖,𝑗 (7). 𝑏′𝑖,𝑗 (𝑘) = ⌊
′ 𝑋𝑖,𝑗
2𝑘
⌋ 𝑚𝑜𝑑 2, k=0,1,…,7
(28)
Step 3. Image decryption can then be done as follows. 𝑑𝑒 𝐵𝑖,𝑗 (𝑘) = 𝑏′𝑖,𝑗 (𝑘) ⊕ 𝑟𝑖,𝑗 (𝑘)
(29)
where 𝑟𝑖,𝑗 (𝑘) are the key stream bits generated by the encryption key. 𝑑𝑒 Step 4. The decrypted pixel value 𝑥𝑖,𝑗 can be calculated as 𝑑𝑒 𝑑𝑒 𝑥𝑖,𝑗 = ∑7𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(30)
Since the MSBs of each pixel (except 𝑥̂1,1 ) are substituted with the secret bits during data embedding, 𝑑𝑒 these MSBs of 𝑥𝑖,𝑗 are different from the MSBs of the original image. For this reason, the prediction of
MSBs should be performed. Since 𝑥1,1 does not change during the data embedding process, its value can be accurately obtained after decryption. Thus, the estimation of 𝑥𝑖,𝑗 , denoted by 𝑥̃𝑖,𝑗 , can be calculated using the prediction technology described in Section 2.1. Next is the recovery of MSBs in three situations. (1) Case1: One-layer MSB
According to the local correlation of the image, the difference between the original pixel and its neighboring pixel is small. On the contrary, the difference between the marked pixel and its neighboring pixel is relatively large. Therefore, in order to recover the MSBs, the following two values should be first calculated. 𝑝0 𝑑𝑒 𝑋̅𝑖,𝑗 =0*27 + ∑6𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(31)
𝑝1 𝑑𝑒 𝑋̅𝑖,𝑗 =1*27 + ∑6𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(32)
Consequently, the original pixel 𝑥𝑖,𝑗 can be recovered as follows. 𝑥𝑖,𝑗 = {
𝑝0 𝑋̅𝑖,𝑗
𝑝0 𝑝1 𝑖𝑓 |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | < |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |
𝑝1 𝑋̅𝑖,𝑗
𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒
(33)
(2) Case2: Two-layer MSB In this case, in order to recover the MSBs, the following four values should be first calculated. 𝑝0 𝑑𝑒 𝑋̅𝑖,𝑗 =0*27 + 0*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 ) 𝑝1 𝑑𝑒 𝑋̅𝑖,𝑗 =0*27 + 1*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(34) (35)
𝑝2 𝑑𝑒 𝑋̅𝑖,𝑗 =1*27 + 0*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(36)
𝑝3 𝑑𝑒 𝑋̅𝑖,𝑗 =1*27 + 1*26 + ∑5𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(37)
Then the differences between the predicted value and these four values are calculated as ∆̿0 = 𝑝0 𝑝1 𝑝2 𝑝3 |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿1 = |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿2 = |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | ,and ∆̿3 = |𝑋̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | . The minimum of these
differences is defined as follows. ∆̿𝑚𝑖𝑛 = 𝑚𝑖𝑛 {∆̿0 , ∆̿1 , ∆̿2 , ̿∆3 }
(38)
Consequently, the original pixel 𝑥𝑖,𝑗 can be recovered as follows.
𝑥𝑖,𝑗 =
𝑝0 𝑋̿𝑖,𝑗
𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿0
𝑝1 𝑋̿𝑖,𝑗 𝑝2 𝑋̿𝑖,𝑗 𝑝3 {𝑋̿𝑖,𝑗
𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿1 𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿2
(39)
𝑖𝑓 ∆̿𝑚𝑖𝑛 = ∆̿3
(3) Case3: Three-layer MSB Similarly, in this case, in order to recover the MSBs, the following eight values should be first calculated. 𝑝0 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 0*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(40)
𝑝1 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 0*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(41)
𝑝2 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 1*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(42)
𝑝3 𝑑𝑒 𝑋̅̿𝑖,𝑗 =0*27 + 1*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(43)
𝑝4 𝑑𝑒 𝑋̅̿𝑖,𝑗 =1*27 + 0*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(44)
𝑝5 𝑑𝑒 𝑋̅̿𝑖,𝑗 =1*27 + 0*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(45)
𝑝6 𝑑𝑒 𝑋̿̅𝑖,𝑗 =1*27 + 1*26 + 0*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(46)
𝑝7 𝑑𝑒 𝑋̿̅𝑖,𝑗 =1*27 + 1*26 + 1*25 + ∑4𝑘=0(𝐵𝑖,𝑗 (𝑘) ∙ 2𝑘 )
(47)
Then the differences between the predicted value and these eight values are calculated as ∆̿̅ 0 = 𝑝0 𝑝1 𝑝2 𝑝3 𝑝4 𝑝5 |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 1 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 2 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 3 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 4 = |𝑋̅̿𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , ∆̿̅ 5 = |𝑋̅̿𝑖,𝑗 − 𝑝6 𝑝7 𝑥̃𝑖,𝑗 | , ∆̿̅ 6 = |𝑋̿̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 | , and ∆̿̅ 7 = |𝑋̿̅𝑖,𝑗 − 𝑥̃𝑖,𝑗 |. Similarly, the minimum of these differences is defined as
follows. ∆̅̿𝑚𝑖𝑛 = 𝑚𝑖𝑛 {∆̅̿0 , ∆̅̿1 , ∆̅̿2 , ∆̅̿3 , ∆̅̿4 , ∆̅̿5 , ∆̅̿6 , ∆̅̿7 }
(48)
Consequently, the original pixel 𝑥𝑖,𝑗 can be recovered as follows. 𝑝0 𝑋̿̅𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿0
𝑝1 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿1
𝑝2 𝑋̿̅𝑖,𝑗
𝑖𝑓 ∆̿̅ 𝑚𝑖𝑛 = ∆̿̅ 2
𝑝3 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿3
𝑝4 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿4
𝑝5 𝑋̿̅𝑖,𝑗
𝑖𝑓 ∆̿̅ 𝑚𝑖𝑛 = ∆̿̅ 5
𝑝6 𝑋̅̿𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿6
̿ 𝑝7 {𝑋̅𝑖,𝑗
𝑖𝑓 ∆̅̿𝑚𝑖𝑛 = ∆̅̿7
𝑥𝑖,𝑗 =
(49)
It can be seen that the method is fully reversible and the original image can be completely reconstructed. 3) Data Extraction and Image Recovery with Both Keys. If the receiver has both 𝐾𝑒𝑛 and 𝐾𝑑ℎ , he/she can extract the secret message without error and completely restore the original image at the same time. At first, the receiver extracts the secret message ′ from 𝑋𝑖,𝑗 by applying the above data extraction procedure. Subsequently, the original image can be
further reconstructed by utilizing the above image recovery procedure. Note that data extraction should be carried out before image restoration.
3. Experimental Results and Analysis In this section, we present the experimental results obtained by applying the proposed method and comparisons with several existing related works. Eight standard gray images shown in Fig.3 and 80 images selected from the Miscellaneous gray level images database [38] are selected as test images. The size of all images is 512×512×8. The secret message is a binary sequence created by pseudo random number generator.
3.1 Analysis of scrambling effect The encryption algorithm should be able to encrypt digital images into cipher-images with high security level. Only the correct key can be used to completely recover the original image. Without the correct key, one cannot obtain any information regarding the original image. In order to show the scrambling effect visually, the original images are demonstrated in Fig.3, while the corresponding encrypted results are illustrated in Fig.4. It can be seen that the data hider cannot obtain any available visual information of the original image from the encrypted image. In addition, PSNR (Peak Signal-to-Noise Ratio) is used as an objective metric to evaluate image visual quality. PSNR values of eight encrypted images are 9.5621dB, 9.5562dB, 7.8832dB, 8.4912dB, 8.9646dB, 9.6258dB, 8.0935dB, and 7.6069dB, respectively. We have also applied our proposed method to another 80 images which are selected from the Miscellaneous database [38]. Fig.5 presents the PSNR results of 80 encrypted images. It can be seen that PNSR values of the encrypted images are very low and the visual imperceptibility is guaranteed. Cryptographic security represents the security against cryptographic attacks, which relies on the underlying cipher. The secure stream cipher is used to encrypt sampled pixels, which has been proved its security against attacks. In addition, the pixels of an ideal cipher-image are required to be uniformly distributed to resist statistical attacks. Fig.6 illustrates the histogram of the original image. After encryption, the corresponding histogram is shown in Fig.7. By comparing Fig.6 and Fig.7, it can be observed that the modified distribution appears to be uniform, which suggests that a statistical analysis would not be effective for evaluating the original image content. In addition, the histogram statistics of the original images and the corresponding encrypted images are also given in Table 1.
3.2 Analysis of reconstructed image quality In the proposed method, with the data hiding key, all embedded secret bits can be extracted without error. In addition, with the prediction technology and the location map L1, the original image can be perfectly reconstructed after MSB prediction, as indicated by a PSNR which tends to +∞.
3.3 Analysis of Embedding Capacity The embedding capacity is defined as the maximum number of bits that can be embedded in a given cover image. In general, it is expressed in bit per pixel (bpp) and is expected to be as large as possible in order to hide the maximum amount of information. The actual payload should be the total embedding capacity minus the side information. In the proposed approach, the factor that impact the embedding capacity are the number of prediction errors. For eight standard gray images, the embedding rates with different MSBs are given in Table.2. For the sake of comparison, in addition to providing the test results of the three-layer MSB method proposed in this paper, we also provide the results of the single-layer and two-layer MSB method. The embedding rate of the single-layer MSB method does not exceed 1 bpp, because only one bit of information is embedded in each embeddable pixel by MSB replacement. Compared with the single-layer MSB method, the embedding rate of the two-layer MSB method is improved significantly, because two bits of information can be embedded in each embeddable pixel. In addition, the embedding capacity depends strongly on the characteristics of the original cover image, as each image has a different number of embeddable pixels. Taking the three-layer MSB method as an example, the maximum embedding capacity is 2.8478 bpp, while the minimum value is 2.0398 bpp. The reason is that some pixels cannot be used for information embedding due to prediction errors. In general, for relatively smooth images, the total embedding capacity is large and the encoded auxiliary information is less. On the contrary, for rough images, the total embedding capacity is small and the encoded auxiliary information is relatively large, so the actual payload will be smaller. In addition, 80 images selected from the Miscellaneous database [38] are also tested, and their corresponding total embedding rates are shown in Fig.8. For the one-layer MSB method, the embedding rates in the best and worst cases are 1.00 bpp and 0.9543 bpp, respectively, and the average embedding rate is 0.9905 bpp. For the two-layer MSB method, the embedding rates in the best and worst cases are 1.9971 bpp and
1.6023 bpp, respectively, and the average embedding rate is 1.9034 bpp. Similarly, for the three-layer MSB method, the embedding rates in the best and worst cases are 2.9383 bpp and 1.7001 bpp, respectively, and the average embedding rate is 2.5468 bpp. The actual embedding payload (i.e., after subtracting side information) is also shown in Fig. 9.
3.4 Comparison and Discussion In terms of embedding rate and reconstructed image quality, several comparisons are made between the proposed method and some existing methods [19,12-13]. The comparison of embedding rate is shown in Fig.10. It can be seen that the embedding capacity of our MSBs substitution strategy has been improved. In addition, the original image can be reconstructed losslessly (PSNR→ +∞) using only the encryption key. In conclusion, in addition to being error-free during data extraction, the proposed method can provide better performance in terms of embedding capacity and image restoration quality.
4. Conclusion and Future Work In this paper, we proposed an efficient high-capacity reversible data hiding method in encrypted images based on MSB prediction, which fully exploits the correlation between neighboring pixels in plaintext image. To ensure that the original image can be completely reconstructed, the positions of the prediction errors are stored in the binary location map. Then the original image is converted into encrypted form by using encryption key. After that, the data-hider embeds the secret data into the encrypted image by substituting up to three MSBs of each embeddable pixel with secret bits. Since the data hider cannot access the content of the original image , the confidentiality is guaranteed. In addition, this algorithm can achieve real reversibility, i.e., the original image can be perfectly recovered and the secret message can be extracted without error. Experimental results show that the proposed method can achieve higher embedding capacity compared to most related methods. Future work is aimed at designing new prediction mechanism in order to reduce the number of prediction errors. At the same time, an efficient compression technology should be designed for location map to improve the actual embedding capacity.
Acknowledgements This work is supported by the National Natural Science Foundation of China
(61771270), Zhejiang Provincial Natural Science Foundation of China (LY17F020013, LR20F020001), and Ningbo Natural Science Foundation (2018A610054).
References [1] Subramanyam, A.V.,Emmanuel, S., Kankanhalli, M.S.: Robust watermarking of compressed and encrypted JPEG2000 images. IEEE Transactions on Multimedia, vol.14, no.3, pp. 703 - 716 (2012). [2] Karim, M. S., Wong, K.S.: Universal data embedding in encrypted domain. Signal Processing, vol.94, pp.174182 (2014). [3] Guo, J.T., Zheng, P.J., Huang, J.W.: Secure watermarking scheme against watermark attacks in the encrypted domain. Journal of Visual Communication and Image Representation, vol.30, pp. 125-135 (2015). [4] Xu, D.W., Wang, R.D., Shi, Y. Q.: Data hiding in encrypted H.264/AVC video streams by codeword substitution. IEEE Transactions on Information Forensics and Security, vol.9, no.4, pp.596-606 (2014). [5] Xu, D.W., Wang, R.D., Shi, Y. Q.: An Improved Scheme for Data Hiding in Encrypted H.264/AVC Videos. Journal of Visual Communication and Image Representation, vol.36, pp. 229-242 (2016). [6] Xu, D.W., Wang, R.D., Zhu, Y.N.: Tunable data hiding in partially encrypted H.264/AVC videos. Journal of Visual Communication and Image Representation, vol.45, pp. 34-45 (2017). [7] Shi, Y.Q., Li, X.L., Zhang, X. P., Wu, H. T., and Ma, B.: Reversible data hiding: advances in the past two decades. IEEE Access, vol. 4, pp. 3210-3237 (2016). [8] Zhang, X. P.: Reversible data hiding in encrypted image. IEEE Signal Processing Letters, vol.18, no.4, pp. 255 – 258 (2011). [9] Zhang, X. P.: Separable reversible data hiding in encrypted image. IEEE Transactions on Information Forensics and Security, vol.7, no.2, pp. 826 – 832 (2012). [10] Huang, F.J., Huang, J.W., Shi, Y. Q., New framework for reversible data hiding in encrypted domain. IEEE Transactions on Information Forensics and Security, vol.11, no.12, pp. 2777-2789 (2016). [11] Wu, X.T., Sun, W.: High-capacity reversible data hiding in encrypted images by prediction error. Signal Processing, vol.104, pp. 387-400 (2014). [12] Qian, Z., Zhang, X.: Reversible data hiding in encrypted images with distributed source encoding. IEEE Transactions on Circuits and Systems for Video Technology, vol.26, no.4, pp. 636 - 646 (2016). [13] Puteaux, P., Puech, W.: An efficient MSB prediction-based method for high-capacity reversible data hiding in encrypted images. IEEE Transactions on Information Forensics and Security, vol.13, no.7, pp. 1670-1681 (2018). [14] Puteaux, P., Puech, W.: EPE-based huge-capacity reversible data hiding in encrypted images. 2018 IEEE International Workshop on Information Forensics and Security (WIFS), Hongkong, pp. 11-13 (2018).
[15] Ma, K. D., Zhang, W. M., Zhao, X. F., et al.: Reversible data hiding in encrypted images by reserving room before encryption. IEEE Transactions on Information Forensics and Security, vol.8, no.3, pp. 553-562 (2013). [16] Zhang, W. M., Ma, K. D., Yu, N. H.: Reversibility improved data hiding in encrypted images. Signal Processing, vol.94, pp. 118- 127 (2014). [17] Cao, X.C., Du, L., Wei, X.X., etc.: High capacity reversible data hiding in encrypted images by patch-level sparse representation. IEEE Transactions on Cybernetics, vol.46, no.5, pp. 1132- 1143 (2016). [18] Wu, H.Z., Shi, Y.Q., Wang, H.X., Zhou, L.N.: Separable reversible data hiding for encrypted palette images with color partitioning and flipping verification. IEEE Transactions on Circuits and Systems for Video Technology, vol.27, no.8, pp. 1620 – 1631 (2017). [19] Xu, D.W., Wang R.D.: Separable and error-free reversible data hiding in encrypted images. Signal Processing, vol.123, pp. 9-21 (2016). [20] Yi, S. Zhou, Y.C.: Separable and reversible data hiding in encrypted images using parametric binary tree labeling. IEEE Transactions on Multimedia, vol.21, no.1, pp. 51-64 (2018). [21] Zhang, X.P., Long, J., Wang, Z.C., Cheng, H.: Lossless and Reversible Data Hiding in Encrypted Images with Public Key Cryptography. IEEE Transactions on Circuits and Systems for Video Technology, vol.26, no.9, pp. 1622-1631 (2016). [22] Wu, H. T., Cheung, Y.M., Yang, Z.Y., Tang, S.H.: A high-capacity reversible data hiding method for homomorphic encrypted images. Journal of Visual Communication and Image Representation, vol.62, pp.8796 (2019). [23] Xu, D.W., Chen, K., Wang, R.D., Su, S.B.: Separable Reversible Data Hiding in Encrypted Images Based on Two-Dimensional Histogram Modification. Security and Communication Networks, vol.2018, pp. 1-14 (2018). [24] Xiang, S.J., Luo, X.R.: Reversible data hiding in homomorphic encrypted domain by mirroring ciphertext group. IEEE Transactions on Circuits and Systems for Video Technology, vol.28, no.11, pp. 3099-3110 (2017). [25] Chen, B., Wu, X.T., Lu, W., Ren, H.L.: Reversible data hiding in encrypted images with additive and multiplicative public-key homomorphism. Signal Processing, vol.164, pp. 48-57 (2019). [26] Qian, Z., Zhang, X., Wang, S.: Reversible data hiding in encrypted JPEG bitstream. IEEE Transactions on Multimedia, vol. 16, no.5, pp. 1486 – 1491 (2014). [27] Chang, J.C., Lu, Y.Z,, Wu, H.L.: A separable reversible data hiding scheme for encrypted JPEG bitstreams. Signal Processing, vol.133, pp.135-143 (2017). [28] Qian, Z.X., Xu, H.S., Luo, X.Y., Zhang, X.P.: New framework of reversible data hiding in encrypted JPEG bitstreams. IEEE Transactions on Circuits and Systems for Video Technology, vol.29, no.2, pp. 351 - 362 (2018). [29] Qian, Z.X., Zhou, H., Zhang, X.P., Zhang, W.M.: Separable reversible data hiding in encrypted JPEG bitstreams. IEEE Transactions on Dependable and Secure Computing, vol.15, No.6, pp. 1055 – 1067 (2018).
[30] Thodi, D.M., Rodriguez, J.J.: Expansion embedding techniques for reversible watermarking. IEEE Transactions on Image Processing, vol.16, no.3, pp. 721-730 (2007). [31] Hu, Y.J., Lee, H.K., Li, J.W.: DE-Based Reversible Data Hiding With Improved Overflow Location Map. IEEE Transactions on Circuits and Systems for Video Technology, vol.19, no.2, pp. 250-260 (2009). [32] Weinberger, M., Seroussi, G., Sapiro, G.: The LOCO-I lossless image compression algorithm: principles and standardization into JPEG-LS. IEEE Transactions on Image Processing, vol.9, no.8, pp. 1309-1324 (2000). [33] Wu, X., Memon, N.: Context-based, adaptive, lossless image coding. IEEE Transactions on Communications, vol.45, no.4, pp.437-444 (1997). [34] Coltuc, D.: Improved embedding for prediction-based reversible watermarking. IEEE Transactions on Information Forensics and Security, vol.6, no.3, pp. 873-882 (2011). [35] Sachnev, V., Kim, H.J., Nam, J., Suresh, S., Shi, Y. Q.: Reversible watermarking algorithm using sorting and prediction. IEEE Transactions on Circuits and Systems for Video Technology, vol.19, no.7, pp. 989-999 (2009). [36] Ou, B., Li, X.L., Zhao, Y., Ni, R.R., Shi, Y. Q.: Pairwise prediction-error expansion for efficient reversible data hiding. IEEE Transactions on Image Processing, vol.22, no.12, pp. 5010-5021 (2013). [37] Kim, S., Qu, X.C., Sachnev, V., Kim, H.J.: Skewed histogram shifting for reversible data hiding using a pair of extreme predictions. IEEE Transactions on Circuits and Systems for Video Technology, DOI: 10.1109/TCSVT.2018.2878932. [38] Miscelaneous gray level images, available: http://decsai.ugr.es/cvg/dbimagenes/g512.php
Figure legends Fig.1 The framework of proposed RDH-EI scheme Fig.2 Three prediction algorithms Fig.3 Eight standard gray images Fig.4 The corresponding encrypted images Fig.5 PSNR values of 80 encrypted images Fig.6 Histogram of the original images Fig.7 Histogram of the corresponding encrypted images Fig.8 Total embedding rates of 80 test images Fig.9 Actual embedding rates of 80 test images Fig.10 Comparison of embedding rates between the proposed method and some state-of-the-art methods
19
Table.1 Comparison of histogram statistical characteristics Standard Test Images Lena Baboon Barbara Peppers Boat Truck Airplane Man
Mean 134.40 129.15 126.59 104.21 136.13 106.39 179.20 77.82
Original Image Standard Deviation Median 41.51 141 42.30 130 72.06 127 57.40 108 52.32 158 34.97 109 45.12 200 58.25 74
20
Mean 127.57 127.42 127.47 127.67 127.54 127.43 127.55 127.39
Encrypted Image Standard Deviation Median 73.89 128 73.94 127 73.90 127 73.90 128 74.01 128 73.96 127 73.82 128 73.82 127
Table. 2 Test results of eight standard images Standard Test Images Lena Baboon Barbara Peppers Boat Truck Airplane Man
Total Embedding Rate (bpp) 1-layer MSB 2-layer MSB 3-layer MSB 0.9992 1.9790 2.8478 0.9846 1.7623 2.0398 0.9710 1.7622 2.3032 0.9981 1.9748 2.8258 0.9988 1.9656 2.7596 0.9997 1.9730 2.5879 0.9988 1.9669 2.8196 0.9964 1.9360 2.6303
21
Actual Payload (bpp) 1-layer MSB 2-layer MSB 0.9903 1.9152 0.8775 1.3121 0.8397 1.4384 0.9843 1.8965 0.9859 1.8682 0.9954 1.8738 0.9878 1.8763 0.9647 1.7701
3-layer MSB 2.6492 1.2577 1.8117 2.5734 2.4506 2.0256 2.5885 2.2035
PSNR 9.5621 9.5562 7.8832 8.4912 8.9646 9.6258 8.0935 7.6069
Highlights An improved prediction method is designed to predict the current pixel value. The multi-MSBs substitution is applied to achieve high embedding capacity. The original image can be reconstructed losslessly by utilizing MSB prediction.
22
Authors’ contributions Bo Guan came up with this idea and did some experiments. Dawen Xu were the major contributors in writing the manuscript. All authors read and approved the final manuscript.
23