Chapter 2 Visual Cryptography in Turnover Style
2.6 Summary
(e) (f)
Fig. 2.8 Another experiment for the perturbed version. (a) and (b) are the two original images; (c) and (d) are the two generated transparencies S1 and S2; whereas (e) and (f) are the two recovered images ((e) is from stacking {(c),(d)}, while (f) is from stacking {(d)turnover , (c)}).
2.6. Summary
turnover style, has been proposed in this chapter. After the analysis using Fig. 2.3, we set up Equations (1)-(4) as the requirement for the design. Then we designed in Fig.2.4 the 16 basic combinations of pattern blocks to handle the 16 possible cases WWWW, WWWB,…,BBBB. In order to reduce the original-image-related contours from appearing in transparencies, we used the perturbation technique (Fig. 2.6) to get a perturbed version. The final result was shown in Fig. 2.7 and 2.8. The major contributions of this chapter might be stated as: a) the back-view of the transparency was also used; and b) the design showed that two noisy transparencies (S1 and S2) could share more than one secret image. In the future, we may try to find more efficient ways to perturb the patterns in Figures 2.4 and 2.6 to deal with the contour problem. It is also an interesting challenge to reduce the left-to-right discontinuity behavior across the vertical middle line {(x,y) | x=128 and y=1,2,…,256} of the stacked results (assuming that the input images are 256-by-256).
Below, we explain why all the blocks used in this chapter are 3-by-3 instead of 2-by-2. Let PT be the number of black elements in a transparency block (i.e. a block in either transparency S1 or S2), Pb be the number of black elements in a recovered image’s black block (i.e. a black block in LENA or PEPPERS), and Pw be the number of black elements in a recovered image’s white block (i.e. a white block in LENA or PEPPERS). For example, if the blocks being used are 3-by-3, then PT =5, Pw=6, and
Pb=8 in Fig. 2.4. Now, if the blocks used in the method are all n-by-n, then, regardless of the value of n, the constraints stated in Eq. (2.5)-(2.6) below must always be satisfied.
Since the number of black elements in any n-by-n block must not exceed n×n, we have
n n
0<PT< × (2.5) In Eq. (2.5), the value of PT cannot be 0 or n×n. If PT is 0, then all of the blocks in
the whole transparency has no black elements at all, so the whole transparency S1 is white everywhere (so is S2). If one stacks the two transparencies, one will only yield an image which is white everywhere. Therefore, PT cannot be 0. Analogous argument also explains why PT cannot be n×n. Now, consider what will happen when a transparency block of S1 is stacked with a transparency block of S2. If none of the PT
black elements of S1 overlap the PT black elements of S2, then the stacked result will have 2PT black elements. On the other hand, if all black elements overlap in pairs when the two transparency blocks are stacked, then the stacked result will have only PT black elements. Therefore, after stacking, the black elements appearing in the resulting block must be in the range between PT and 2PT . As a result, the values of Pb
and Pw must satisfy
≤
<
≤
Here, Pw < Pb is due to the natural requirement that the number of black elements appearing in a white block of the stacked results is always smaller than that appearing in a black block.
With the requirements (2.5) and (2.6) above, if we use 2×2 blocks in the method, then PT cannot be 0 and 4 by Eq. (2.5). Since PT is 1, 2, or 3, Eq. (2.6) implies that the only possible cases of (PT, Pw ,Pb) are (1,1,2), (2,2,3), (2,2,4), (2,3,4), and (3,3,4). After checking Eq. (2.1)-(2.4) carefully, we find that none of the (PT, Pw ,Pb)-triples in the candidate set {(1,1,2), (2,2,3), (2,2,4), (2,3,4), (3,3,4)} can generate all the 16 expected cases listed in Fig. 2.4. For example, the (W,W,W,B) case cannot be generated when (PT, Pw ,Pb)=(1,1,2), i.e. we cannot find the four 2-by-2 blocks {α1,β1,α2,β2} such that each block has only one black element (because PT =1), and the stacked results defined by Eq. (2.1)-(2.4) are W,W,W, and B, respectively. We therefore abandoned 2×2 blocks and used 3×3 blocks in this chapter. With the decision of using 3×3 blocks, we have tried several other kinds of settings to satisfy Eq. (2.5)-(2.6) (for example, using PT =6, Pw =7, Pb =8). However, we found that designing the pattern blocks to satisfy Eq. (1)-(4) for all 16 cases was hard for most of these settings. For example, the (PT =7, Pw =7, Pb =9) setting cannot generate the pattern blocks needed for the (W,W,W,B) case. As for the (PT =6, Pw =7, Pb =8) setting, although we did obtain some pattern blocks (for each of the 16 cases) that meet all the requirements in Eq.
(2.1)-(2.4), the recovered images are darker and have smaller contrast values than those appeared in Fig. 2.5, 2.7, and 2.8. We therefore still used PT =5, Pw=6, and Pb=8 in our design.
Chapter 3
Visual Cryptography in Two-level Style: the VC with Extra Ability of Hiding
Confidential Data
We try to design in this chapter a VC scheme whose decoding has two levels, and these two levels are of distinct importance. The proposed VC scheme shares an image Lena of moderate confidentiality using two transparencies; and these two transparencies together can also extract a more confidential text data file describing the image Lena. More specifically, simply stacking the two transparencies can show the image Lena directly; meanwhile, after certain computations (or after shifting one of the transparencies before stacking), one can also extract the more sensitive text data.
Of course, none of the transparencies alone can reveal anything about the image Lena or the more sensitive text.
There are several kinds of application for this scheme. Perhaps the most direct application is to store or transmit an image of moderate confidentiality (for example, the photo of an employee, a suspect, or a VIP member) using the two generated transparencies, whose stacking together can yield the image. In addition, the background description of the image (for example, the employee’s name, address,
birthday, nationality, salary, and professional training) can only be extracted from joint information of the two transparencies by a high-ranking officer who knows the decoding key discussed in Sec. 3.3. As a result, if the two shares are collected, both of the lower rank officers and their commander can view the image; however, only the commander can decrypt the background text.
Another application is to authenticate the transparencies generated by the VC system so that the combination containing faked transparencies can be identified, as will be discussed later in Sec. 3.3.
The rest of this chapter is organized as follows: the method is stated in Sec. 3.1;
the experimental results are in Sec. 3.2; the application to the authentication of the transparencies is in Sec. 3.3; the security concern is discussed in Sec. 3.4; an alternative version, whose decoding does not need any computer, is given in Sec. 3.5;
finally, the conclusions are in Sec. 3.6. Throughout the chapter, ″Lena″ is an input image of size 256-by-256, whereas ″LENA″ is the corresponding 512-by-512 stacking result obtained from stacking the two transparencies (both are 512-by-512) generated by the proposed method.
3.1. The method
need to introduce six fundamental blocks (Type 0 - Type 5, see Fig. 3.1) and the combinations to expand a white pixel or a black pixel (see Fig. 3.2 and 3.3, respectively) of a given image Lena.
The simplest design is to use 2x2 as the expansion rate, i.e. each share is 2x2 times greater than the input image Lena in size. Then, to define the fundamental blocks, we consider all possible cases in which a 2-by-2 block has 2 white elements and 2 black elements. Therefore, we obtain C(4,2)=4x3/2=6 types of fundamental blocks, called Types 0,1,2,3,4,5, as shown in Fig. 3.1.
Fig.3.1. The six types of fundamental blocks (Types 0-5)
When we stack two shares and obtain the stacking result, it is an image 2x2 times greater than the input image Lena; for each pixel of Lena is expanded to a 2-by-2 block of the stacking image LENA. In order to maintain the black-and-white distribution (and hence the visual appearance) of the input image, the number of black elements in each black block of the stacking result LENA (a 2-by-2 block expanded from a black pixel of Lena) should be more than that of each white block of the stacking result LENA (a 2-by-2 block expanded from a white pixel of Lena). For simplicity of the design, we assume that each black block has four black elements,
and each white block has two white elements. (This obviously meets the rule that each black block has more black elements than each white block has.) Under this assumption, it is easy to see that if we want to share a white pixel of Lena, we may use one of the six combinations {(0,0),(1,1),(2,2),(3,3),(4,4),(5,5)} sketched in Fig.
3.2 to paint the corresponding position of the two shares. For example, the combination (3,3) means that , when we encode a white pixel, we may paint both Shares 1 and 2 (at the block position corresponding to the white pixel being processed) using the fundamental block of Type 3. Then in the decoding process, stacking these two shares will generate a white block (a 2-by-2 block having 2 white elements and 2 black elements) at the corresponding position. Analogously, we may use Fig. 3.3 to encode a black pixel of the input image Lena.
Also note that, in order to hide the more sensitive text file, we first transfer the text file to a sequence of digits of base 6, since we have six types of fundamental blocks.
(Therefore, all digits are in the range 0-5.) Then this sequence is hidden.
Combinations (0,0) (1,1) (2,2) (3,3) (4,4) (5,5)
Fig.3. 2 The pairs whose stacking results represent white blocks.
Combinations (0,1) (1,0) (2,3) (3,2) (4,5) (5,4) Fig. 3.3 The pairs whose stacking results represent black blocks.
Below is the algorithm of the proposed method. The more sensitive text file is
hidden first using Part I of the algorithm; the input image Lena is then hidden using Part II.
Encoding algorithm.
Part I. (To hide the confidential text data d = (d1,d2, d3,…, d8 , d9,…) where each di is a digit in the range 0-5.)
Step 1. Split each digit di into two parts xi and yi so that if a person only acquires one of the two numbers in {xi , yi}, he cannot extract di . More precisely, we randomly select a number xi in the range 0-5, then find the corresponding yi
in the range 0-5 so that (xi + yi)= di mod 6. For example, if the confidential text data d = (d1 , d2, d3,…, d8 , d9,…) = (1035004234…), then we may decompose d as
1=3+4 mod 6 , 0=1+5 mod 6 , 3=1+2 mod 6 , 5=0+5 mod 6, 0=2+4 mod 6, 0=0+0 mod 6 , etc.
each of the two transparencies. For instance, 1=3+4 mod 6, 0=1+5 mod 6, and 3=1+2 mod 6 in the above example, so the 2-by-2 fundamental blocks of Types 3, 1, 1 are the 1st , 3rd , and 5th blocks of Transparency 1, while the 2-by-2 fundamental blocks of Types 4, 5, 2 are the 2nd, 4th, and 6th blocks of Transparency 2. As for the remaining blocks, they are to be determined later in Part II to share the image Lena. In other words, as is shown in Fig. 3.4, right now we have
Transparency 1 : 3 ? 1 ? 1 ? 0 ? 2 ? 0 ? …, Transparency 2: ? 4 ? 5 ? 2 ? 5 ? 4 ? 0 …., Part II. (To share the input image Lena)
Step 3.To determine the block types of the remaining blocks (the question marks written at the end of Step 2 above) of the two transparencies, we sequentially read the pixel values of the input image Lena. Without the loss of generality, assume that, according to the scanning order, the pixel values are BBWBWB…. Since the desired visual decoding property requires that, after stacking, the 2-by-2 blocks had better also appear in the sequence BBWBWB…, thus the block types of the ″?″ can be determined by looking up the table in Fig. 3.2 (or Fig. 3.3) if a ″W″ (or a ″B″) is the current pixel value of Lena. This results in the two transparencies shown in Fig. 3.5; in other words, we now have:
Transparency 1: 3 5 1 4 1 3 …, Fig. 3.4 Hiding the confidential text file (see Steps 1 and 2 of the encoding algorithm).
Fig. 3.5 Sharing the secret image Lena (see Step 3 of the encoding algorithm) by filling in the undetermined parts of Fig. 3.4.
In the decoding phase, directly stacking the two transparencies can reveal the
(enlarged) image LENA without any computation, while the hidden text file d = (d1 ,
d2, d3,…, d8 , d9,…) = 1035004234…can be extracted by the formula (xi + yi)= di
mod 6 from the two transparencies. Here, xi is the block type of the (2i-1)-th block of
Transparency 1, and yi is the block type of the (2i)-th block of Transparency 2.
3.2 Experimental results
The experimental results are shown in Fig. 3.6. The size of each transparency is 512x512, which is 2x2 times larger than the 256x256 input image Lena. The transparencies are noise like. If we stack them, then we can get the visible image directly as shown in Fig 3.6(d). The two transparencies can also cooperate together to extract a sequence of 128x256 digits (each digit is in the range 0-5) hidden earlier, and this sequence is the confidential text for the purpose of validity-verification or background-description. The contrast (defined in Ref. [HKS2000]) of our stacked result (Fig. 3.6(d)) is always (4-2)/(2x2)4=50% because each 2-by-2 block of our stacked result always has 4 black elements if it is a black block, and 2 black elements if it is a white block. Notably, according to Ref [HKS2000], the contrast is good if it reaches 50%. Therefore, the visual quality of our stacked result is not worse than those obtained using reported VC methods, while we have the extra advantage to hide the confidential text describing the unveiled image.
a b c
d e f
g
Fig. 3.6 An example illustrating the proposed method.
(a) is the original halftone secret image ″Lena″; (b) and (c) are the two transparencies generated by our method; (d) is the image ″LENA″ obtained by stacking (b) and
a faked halftone image ″Girl″ owned by a hacker; (f) is a faked transparency; (g) is the faked image ″GIRL″ obtained by stacking (b) and (f). (However, by extracting the hidden text from (b) and (f), our ally can know that (g) is faked.)
3.3 Application to the authentication of the transparencies
As mentioned in Sec. 3.1, one of the applications of the proposed scheme is to authenticate the transparencies so that the combination of faked transparencies can be identified. This is explained below. We only have to transform an authentication message to a sequence d of digits in the range 0-5, and then hide this sequence according to Part I of the algorithm to obtain Shares 1 and 2. Now, assume that a hacker intercepts Share 1 (Fig 3.6(b)). Using Share 1 and his own faked input image″Girl″ (Fig. 3.6(e)), the hacker may create a faked share (Fig. 3.6(f)), called Share 2’, so that stacking Shares 1 and 2’ will yield the faked stacking result ″GIRL″ (Fig.
3.6(g)). However, the hacker cannot fool our agent/ally who is waiting at the receiver end of our network, since the faked pair {Share 1, Share 2’} cannot extract d (and hence, cannot extract our authentication message).
3.4 Techniques to improve the security
Because Shares 1 and 2 are transmitted using two distinct channels or stored in two different places, the chance that both shares are intercepted is very low. However, to
reduce the damage that might be caused by a super-hacker (or an internal betrayer of a company) who might intercept or access both Shares 1 and 2, the security department can modify our algorithm by using their own manner to reassign the locations of the {xi} in Share 1 and {yi} in Share 2. ({xi} are not necessarily in the odd positions of Share 1, and {yi} are not necessarily in the even positions of Share 2 [see the final sentence of Step 2 of the algorithm].) For example, to paint the two shares (also called
transparencies), the sequence (x1, y1 , x2 , y2 , x3 , y3 , x4 , y4 , x5 , y5 , …) can be permuted by a random-position generator using a security seed. For
instance, it becomes (x1, x2 , x3 , y3 , y2 , y4 , x7 , y1 , y5 , x4 , x8 , x9 , …) after the permutation. Then the last two lines of Step 2 becomes
Transparency 1: x1 x2 x3 ? ? ? x7 ? ? x4 x8 x9
…
, Transparency 2: ? ? ? y3 y2 y4 ? y1 y5 ? ? ? ….In the hidden-message extraction phase, the inverse of the random position generator
is applied using the same seed in order to reverse the sequence (x1 , x2 , x3 , y3 , y2 , y4 , x7 , y1 , y5 , x4 , x8 , x9 , …) back to ( x1 , y1 , x2 , y2 , x3 , y3 , x4 , y4 , x5 , y5 , …) . Then, as usual, (xi + yi)= di mod 6 are utilized to generate (d1 ,
d2 , d3 , …). Because the super-hacker does not know how the designer
distributes the {xi} and {yi}, two things can be assured even if both Shares 1 and 2 are
Second, the super-hacker is very unlikely to use the information grabbed from the two intercepted shares {Shares 1 and 2) to produce two faked shares {Shares 1’ and 2’}
which can also pass our authentication test. (In addition, stacking them yield a faked image similar to the ″GIRL″ image in Fig. 3.6(g).) Of course, if the pixels of the input image Lena are also permuted using a random-position generator, then the image LENA itself is also free from being viewed by the super-hacker intercepting both Shares 1 and 2. But this operation (permuting pixels of Lena) is seldom used unless the image Lena itself is also highly confidential, because this operation reduces the advantages of visual cryptography: the image LENA can no longer be viewed by simply stacking the shares. (Recall that VC is a tool that balances between security and the benefit of ″without-a-computer visual decoding″ of images. If we only
permute the locations of {xi,yi}, the disclosure of the image LENA still does not need a computer; although the disclosure of the confidential text d will then need a computer.)
3.5 When a decoding-computer is not available
In the above approach, the decoding of the Lena image by VC does not need a computer, but the decoding of the confidential text d does. Therefore, the method can be used in an environment in which the decoding-computer is not always available.
For example, consider a system in which a single decoding-computer serves, say, 100
teams, in turn. Then, each team can decode its own moderately-confidential image immediately (and begin the within-team discussion about the visually-decoded image immediately); although each team leader must wait (until it is his turn) for the computer server to help him to decode the confidential text.
Below, we discuss how to modify the design so that the two new transparencies (generated by the modified design) can decode both Lena and the confidential text without using a decoding-computer.
Apparently, if the confidential text can also be visually decoded, then there is no need to use a decoding-computer. In this kind of approach, we have two images to deal with: the Lena image, and its background description image. What we can do is to create two transparencies T1 and T2 having the following two properties: 1) stacking T1 with T2 yields Lena; 2) after the stacking mentioned in 1, if we fix T1, and then shift T2 by u units horizontally and v units vertically, then the stacking result becomes the confidential text image. Notably, the values of the u and v are kept by the higher-ranking officer. If the higher-ranking officer thinks that it is not easy to shift a transparency by u units horizontally and v units vertically in the decoding phase, then he may use an auxiliary ″non-noisy″ transparency T3 prepared earlier, in which only the boundaries of the transparency T1 and T2 are sketched.
description example and an experiment. In the algorithm, the image C is either a confidential text image describing Lena, or a logo image for authentication purpose.
The coordinate (i,j) indicates a pixel at location (i,j) of the image Lena (or the image C), or equivalently, the 2-by-2 block at location (i,j) of the transparency T1 (or the transparency T2).
The Modified Encoding Algorithm (No decoding-computer is needed later)
Input: Two natural numbers u and v (u is the Horizontal-shift-amount, and v is the Vertical-shift-amount), an image Lena of size 256-by-256, and a confidential text image C.
Output: two noise-like transparencies T1 and T2 (both are of size 512-by-512) useful in visually decoding of both Lena and C.
Steps:
Step 1: For each coordinate (i,j) in the ″easier-to-construct″ areas, namely, {(i,j):0≤i<u, 0≤j≤255} and {(i,j): u≤i≤255, 0≤j<v}, do the following:
1a. Randomly assign one of the six fundamental block types to T1(i,j);
1b. If Lena(i,j) is a white pixel, then copy the block type of T1(i,j) to T2(i,j);
else copy the complement of the block type of T1(i,j) toT2(i,j).
Step 2: (for the remaining area whose construction is a little more complicated):
2a: Initially, let the value of the counter k be 0 .
2b: For each (i,j) satisfying u x k≤i<u x (k+1) and 0≤j<255-v, do the following:
2b-1: If C(i,j) is a white pixel, then copy the block type of T2(i,j) to T1(i+u,j+v);
else copy the complement of the block type of T2(i,j) to T1(i+u,j+v).
2b-2: If Lena(i+u,j+v) is a white pixel, then copy the block type of T1(i+u,j+v) to T2(i+u,j+v); else copy the complement of the block type of T1 (i+u,j+v) to T2(i+u,j+v).
2c:
2c-1: Add 1 to the value of k.
2c-2. If k<(256/u)-1, then go to 2b; else stop the algorithm.
——End of the Algorithm—
To help the readers understand Step 2, we give below an example. In the example, assume that T1⊕T2 means stacking T1 with T2, i.e. ″⊕″ is the stacking operator.
Example.
To make the explanation easier, we assume that the horizontal-shift-amount is u=3, and the vertical-shift-amount is v = 0.Without the loss of generality, assume that the pixel values of the input image Lena and confidential text image C are
Lena: BWBWBBBWWWBW…
Because the horizontal-shift-amount is u=3, we split Lena and C into sectors of 3 pixels each. Therefore, we have
Lena: BWB WBB BWW WBW…
Image C: WWB WBW BWB …
Iteration 0a. Initially, because u=3, randomly assign the block types to the three blocks of the first sector of T1; for example, assign (0,4,3). So we have
Transparency T1 : 0 4 3 ? ? ? ? ? ? ? ? ? … Transparency T2 : ? ? ? ? ? ? ? ? ? ? ? ? …
Iteration 0b. In order that the first three blocks of the stacking result (T1⊕T2) can be (B,W,B), which are the 3 blocks in the first sector of Lena, the first sector of T2 should be (~0
, 4, ~3
), due to the fact that the first sector of T1 is
), due to the fact that the first sector of T1 is