Sharing and hiding secret images with size constraint

(1)

Sharing and hiding secret images with size constraint

Yu-Shan Wu, Chih-Ching Thien, Ja-Chen Lin

∗

Department of Computer and Information Science, National Chiao Tung University, 1001, Ta Hsueh Road, Hsinchu 300, Taiwan, ROC Received 13 January 2003; received in revised form 8 January 2004; accepted 8 January 2004

Abstract

This paper presents a method for sharing and hiding secret images. The method is modi/ed from the (t; n) threshold scheme. (Comput.Graph. 26(5)(2002)765) The given secret image is shared and n shadow images are thus generated. Each shadow image is hidden in an ordinary image so as not to attract an attacker’s attention. Any t of the n hidden shadows can be used to recover the secret image. The size of each stego image (in which a shadow image is hidden) is about 1=t of that of the secret image, avoiding the need for much storage space and transmission time (in the sense that the total size of t stego images is about the size of the secret image). Experimental results indicate that the qualities of both the recovered secret image and the stego images that contain the hidden shadows are acceptable. The photographers who work in enemy areas can use this system to transmit photographs.

1. Introduction

Thien and Lin [1] developed a sharing method (a (t; n) threshold scheme, t 6 n) for sharing a secret image among n participants, suchthat any t participants could cooperate to reconstruct the secret image, while t−1 or fewer participants could not . In Ref. [1], after the secret image was shared, each shadow image contained partial information about the secret image, and the size of each shadow was 1=t of that of the secret image. However, the shadow images looked like random noise images rather than ordinary images. There-fore, some data-hiding methods [2–10] must be utilized to transform the shadow images to stego images (by hiding the shadow images in some ordinary images) so as not to attract any attacker’s attention. However, eachstego image was usually two or four times larger than each shadow image.

_{This work was supported by National Science Council, Taiwan,}

ROC under Grant NSC 91-2213-E009-097.

∗_{Corresponding} _author. _Tel.: _{+886-03-5715900;} _fax:

+886-03-5721490.

E-mail address:jclin@cis.nctu.edu.tw(J.-C. Lin).

Accordingly, the size of each stego image was 2=t or 4=t of that of the secret image. To solve the problem of size ex-pansion, we present in this work a new method in which the size of the stego image (which contains the hidden shadow) is still about 1=t of that of the secret image. This requirement is met by shrinking the range of shadow values (which are the output values of the sharing phase in Ref. [1]); hence, the input values (which are the gray values of the secret image) must also be quantized. Therefore, a pre-processing quantization procedure is developed for narrowing the range of gray values of the secret image. The pre-processing pro-cedure /rstly quantizes the secret image using two types of blocks, producing a record of block types, namely, an S–E table. The S–E table is then embedded in the quan-tized image to prevent size expansion. After it has been pre-processed, the image is shared among n participants. Fi-nally, a simple hiding procedure is proposed for hiding each shadow image in an ordinary image. The rest of this paper is organized as follows. Section2describes the proposed method. Section 3 presents the experimental results and compares them with those obtained by reported methods. Finally, Section4draws conclusions and discusses practical applications.

(2)

Nomenclature

t threshold number, such that any t shadows can be used to recover the secret image, while t − 1 shadows recover nothing n number of shadows generated from the

se-cret image, (n ¿ t)

pij value of the jthpixel in the ithblock of the

secret image

S the block is a smooth block E the block is an edge block

dij value of the jthpixel in the ithdiGerential

block

qlj value of the jthpixel in the lth

quantized block (either quantized or quantized-embedded)

gi value of the ith pixel in the shadow image

Hi value of the ith pixel in the host image

Ri value of the ithpixel in the stego image

2. Proposed method

As indicated in Fig. 1, the proposed method has three major parts: (a) quantization, (b) sharing, and (c) hiding shadows. These three procedures are introduced in Sections 2.1–2.3, respectively.

The quantization procedure quantizes the original secret image, and yield a quantized-embedded image. The quanti-zation procedure is complicated and so is divided into two sub-procedures (Sections2.1.1–2.1.2) to facilitate explana-tion. The quantized-embedded image is then shared using the sharing procedure (Section2.2), which generates n shadow images. Finally, the hiding shadows procedure (described in Section2.3) hides the n shadow images in n cover images (also called host images) to yield n stego images. The secret image can be later retrieved from t of the n stego images by reverse operations.

2.1. Quantization (with Embedding of S–E table) The quantization procedure consists of two stages. The /rst stage (Section2.1.1) quantizes the secret image using a variable size quantization (VSQ) sub-procedure. The output of the VSQ sub-procedure includes a quantized image and an S–E table, which records the order of the smooth and edge blocks. The second stage (Section2.1.2) embeds the S–E table in the quantized image to yield a quantized-embedded image.

2.1.1. Sub-procedure for variable size quantization This section introduces the variable size quantization sub-procedure to quantize the original secret image and produce a quantized image and an S–E table. First, the orig-inal secret image is divided into numerous non-overlapping blocks, eachof whichis 1 × 2 and is called an unclassi/ed

Input the secret image (Lena)

Section 2.1.1 Variable Size Quantization

Section 2.1.2 (Shrinking Quantization Result)

Embedding S_E Table

Section 2.2 Sharing to generate n shadows

Section 2.3 Hiding n shadows in n hosts

Output n stego images

Fig. 1. Flowchart of proposed method.

block. Then, the /rst not-yet-processed 1 × 2 unclassi/ed block i is examined to determine whether it is smooth or an edge block (according to the diversity of gray values in the block). If it is determined to be an edge block, then the edge quantization method is applied. Conversely, if it is determined to be a smooth block, then the next 1 × 2 un-classi/ed block (i + 1) is read and determined to be smooth or an edge block. If the unclassi/ed block (i + 1) is an edge block, then we go back to the unclassi/ed block i and reset it as an edge block, then it is quantized using the edge quantization method; otherwise, the two unclassi/ed blocks i and i + 1 are merged to yield a 1 × 4 block, which is treated as a smoothblock, and quantized using the smooth quantization method. (Hence, eachsmoothblock is 1 × 4, while each edge block is 1 × 2.) The next not-yet-processed 1 × 2 unclassi/ed block is processed in the above manner,

(3)

and the process repeated until all unclassi/ed blocks have been processed. Of course, to retrieve the quantized image at a later date, an S–E table is also generated to track the smoothand edge blocks. Withthe S–E table, a block that is being decoded can be known to be smooth(1 × 4) or an edge (1 × 2) block, and so the appropriate method can be used to decode it.

In summary, the size of a smooth block must be four pixels, and that of an edge block must be two pixels. Note that, because the S–E table uses one bit to mark each block (where ‘1’ indicates an edge block and ‘0’ indicates a smooth block), the mergence of smooth blocks (turning two 1 × 2 blocks into one 1 × 4 block) helps in reducing the size of the S–E table. (In most natural images, most of the blocks are smooth, and merging them can reduce the size of the ta-ble without damaging the image quality excessively.) The complete sub-procedure for variable size quantization is pre-sented below.

Sub-procedure for variable size quantization (VSQ) Input: Secret image (suchas “Lena”, for example). Output: Quantized image and S–E table.

Step 1: Divide the input image into numerous non-overlapping blocks, eachof size 1 × 2. Set bothcounters i and l to the initial value of zero. (i is the block index for the input image, while l is the block index for the quantized image.)

Step 2: Increase the counters i and l by one. Then, read the ith block of the input image. Assume that the two pixels in the block i are (pi1; pi2).

Step 3: Assume that the two pixels of previous block, i −1, are (p(i−1)1; P(i−1)2). Subtract p(i−1)2from eachof the

two current pixels to yield the ithdiGerential block (di1; di2).

In other words, evaluate

dij= pij− p(i−1)2; j = 1; 2: (1)

(Initially, let p(i−1)2= 0 for i = 1.)

Step 4: (Classi/cation)

If Max{|di1|; |di2|} 6 8, then Block i is a smoothblock

candidate, so go to Step 5.

If Max{|di1|; |di2|} ¿ 8, then Block i is an edge block, so

go to Step 6.

Step 5: Read the next block (i + 1), and evaluate the (i + 1)thdiGerential block

(d(i+1)1; d(i+1)2) where

d(i+1)j= p(i+1)j− pi2 with j = 1; 2:

If Max{|d(i+1)1|; |d(i+1)2|} 6 8, then

qlj= dij+ 8 for j = 1; 2; (2)

ql(j+2)= d(i+1)j+ 8 for j = 1; 2; (3)

a ‘0’ (smooth) record is added to S–E table; then, increase the counter i by one and go to Step 7.

(Note that we merge two 1 × 2 blocks in this case, so the quantized block (ql1; ql2; ql3; ql4) is 1 × 4).

If Max{|d(i+1)1|; |d(i+1)2|} ¿ 8, then cancel the “smooth”

candidacy of Block i, that is, treat Block i as an edge block, and go to Step 6.

Step 6: (Quantizing an edge block). For j = 1, set qlj= pij=17 if pij− p₁₇ij × 17 6pij− p₁₇ij × 17 : (4)

Otherwise, set qlj= pij=17. Repeat for j = 2. (Notably,

the retrieved value 17 × qljcan be viewed as a rounding of

pij to its nearest multiple of 17.) Now, reset the value of

pi2for future reference (since it will be used in Step 3) by

assigning pi2= ql2× 17;

and then insert a ‘1’ (edge) into the S–E table to indicate that the quantized block l is a 1 × 2 edge block.

Step 7: Repeat 2–6 until all blocks have been processed. 2.1.2. Sub-procedure for Embedding S–E table

The VSQ sub-procedure creates an S–E table to ensure that the positions of smooth and edge blocks are traceable. If the S–E table is attached to the quantized image, then the quantized image will be expanded. Therefore, the S–E table should be embedded into the quantized image. The sub-procedure is described as follows: Note that 0 and 1 are used in the S–E table to represent smooth and edge blocks, respectively, so the S–E table is a series of zeroes and ones . Hence, an attempt is made to embed these 0s and 1s into the quantized image to yield the quantized-embedded image, such that the size of the quantized-embedded image (which contains the S–E table) is the same as that of the quan-tized image. First, eachrow of the quanquan-tized image is parti-tioned into several non-overlapping blocks, called quantized blocks, eachwitha size of 1 × 3. The three quantized val-ues of a quantized block l are represented by (ql1; ql2; ql3).

Also, without loss of generality, assume that the secret im-age, and hence the quantized imim-age, are both 512 × 512.

The embedding method reads 510 pixels (one row) of the quantized image and evaluates the (ql1⊕ ql2⊕ ql3) mod 2

value 170(=510=3) times (with l=1–170), in the hope that these 170 values are identical to the expected 170 se values (0 or 1) taken from the S–E table. If so, the 170 entries of the S–E table are already embedded into the quantized image. Of course, if some values of l exist suchthat (ql1⊕

ql2⊕ql3) mod 2 = se value, then the quantized image must

be adjusted in some way. In that case, a quantized value qlkis selected from (ql1; ql2; ql3), and modi/ed by adding or

subtracting 1, suchthat (ql1⊕ ql2⊕ ql3) mod 2 = se value.

The technique by which one pixel is selected from the three (to ensure that modi/cation error is small) is complicated, and omitted here to reduce the length of the paper. Sub-procedure for Embedding S–E table in quantized image

(4)

Output: the quantized-embedded image (which contains the S–E table).

Step 1: Set the row index r to the initial value r = 1. Step 2. Read the rthrow of the quantized image. Partition the /rst 510 pixels into 170 non-overlapping 1 × 3 blocks. (The table is embedded only in the /rst 510 pixels of each 512-pixel row.) Set block counter l to the initial value l=0. Step 3: Increase the value of l by 1. Then read the lth quantized block (ql1; ql2; ql3) of row r.

Step 4: Read the next record (a ‘0’ or a ‘1’) of the S–E table. Call this record an se value.

Step 5: Embed this se value in quantized block l. If (ql1⊕

ql2⊕ql3) mod 2 equals se value, then do nothing. Otherwise,

select a pixel qlk from (ql1; ql2; ql3), and then change qlk to

qlk+ 1 or qlk− 1—whichever is associated with the smaller

error. The detail is omitted for paper length.

Step 6: Repeat Steps 2–5 until all quantized blocks of row r are processed.

Step 7: Increase the value of r by 1 and go to Step 2. 2.2. Sharing

Section2.1described the quantization procedure (with ta-ble embedding) for processing the original image and out-putting the quantized-embedded image. This section em-ploys the image sharing procedure, which was proposed by the authors in Ref. [1], to share the quantized-embedded im-age. The procedure used in Ref. [1] was a (t; n) threshold scheme that generated n shadows, such that any t(t 6 n) of these shadows could be used in the reconstruction phase. The (slightly modi/ed) sharing procedure is as follows: Procedure for sharing

Input: the quantized-embedded image.

Parameter settings: Let n and t be two given integers (t 6 n). Set the prime number P to the value 17. (Notably, P is 17 here, rather than 251, as was used in Ref. [1].)

Output: n shadow images.

Step 1: Divide the quantized-embedded image into non-overlapping blocks, eachof size 1 × t. Set counter l to the initial value l = 0.

Step 2: Increase the value of l by 1 and then read the lthblock of the quantized-embedded image. Assume that the t quantized-embedded values of the block are (ql1; ql2; : : : ; qlt).

Step 3: Use the polynomial

f(x) = (ql1+ ql2x + : : : + qltxt−1) mod 17 (5)

to generate n(n 6 17) shadow-values f(1)–f(n). Step 4: Use the n shadow-values f(1)–f(n) as th e lth pixel value of the n shadow images F1–Fn, respectively.

Step 5: Repeat Steps 2–4 until all blocks have been pro-cessed.

In Step 3 above, the prime number P was set to 17, the reasons for which choice are detailed below. In Ref. [1], the prime number P was 251. The shadow values in Ref. [1]

0 17 34 . . .

. . .

238 255

level_0 level_1 level_14

Fig. 2. Fifteen levels in the procedure for hiding shadows (Section

2.3).

were therefore in the range 0–250. This range makes each shadow image diRcult to hide in an ordinary image of the same size. (The host image is commonly larger than the shadow image.) The new setting (P = 17) ensures that all shadow values are in the range 0–16 (which is the range of pixel values of the quantized–embedded image), such that each shadow image can be hidden in an ordinary host image without requiring that the size of the host image exceeds the size of the shadow image. Notably, besides setting P to 17, the pixel values of the image must be quantized into the range 0–16 (as described in Section2.1) before sharing. Without quantization, the gray values would be in the range 0–255, so f(1)–f(n) could not be used to retrieve the gray values (when the t coeRcients in Eq. (5) are replaced by gray values), because the mod 17 operation in Eq. (5) would make the set of the retrieved gray values non-unique. 2.3. Hiding shadows in host images

As mentioned in the preceding section, the quantized-embeded image is divided into n shadows. Each shadow looks like random noise that will attract an attacker’s atten-tion, increasing its probability of being destroyed. A hiding shadow procedure is proposed to solve this problem. First, n ordinary gray-value images (non-secret images) are spec-i/ed as host images, each of which has the same size as the shadow image (and is therefore smaller than the secret image). Second, the n shadow images are respectively hid-den in the n selected host images, in each case yielding a stego image. All n stego images still appear to be ordinary images, reducing the probability that they will be attacked. The hiding shadow procedure presented below employs sim-ple arithmetic to hide the shadow images. For each given host image and shadow image, the procedure /rst divides the gray values {Hi} of the host image into 15 possible

lev-els according to Eq. (6). (Also see Fig.2.) Then, the ith shadow-value gi of the given shadow is hidden in Hi by

simple mathematical operations. (See Steps 4 and 5 below.) Notably, 8 is subtracted from gi to obtain the new value gi

(i.e. g

i= gi− 8) before hiding (Eq. (7)). The original range

of gi is 0–16, so the range of giis −8–8. Hence, the gray

value Ri of the stego image will not be too diGerent from

the gray value Hi of the host image, when gi is added to

Hi. Also, after Ri1and Ri2 are evaluated according to Eqs.

(8) and (9), these two values are compared to Hi, to

deter-mine which of Ri1 and Ri2is closer to Hi (Eq. (10)). The

closer value is used as the gray value Ri in the stego

im-age. At a later date, g

i can be recovered from Riby letting

g

(5)

Procedure for hiding shadows

Input: a shadow image and a host image. Output: a stego image.

Step 1: Set pixel counter i to the initial value i = 0. Step 2: Increase the value of i by 1. Then, read the ith pixel value Hiof the host image.

Step 3: Read the ithshadow-value giof the shadow image.

Step 4: Assume that Ridenotes the ithpixel value in the

stego image. Before hiding giin Hito yield Ri, conduct the

following evaluation. (i) Q = Hi=17: (6) (ii) g i= gi− 8: (7) (iii) Ri1= Q × 17 + gi: (8) (iv) Ri2= (Q + 1) × 17 + gi: (9)

Step 5: (Select from Ri1and Ri2the one closer to Hi.)

If |Hi− Ri1| 6 |Hi− Ri2|; then Ri= Ri1; (10)

otherwise, Ri= Ri2.

Step 6: Repeat Steps 2–5 until all pixels have been pro-cessed.

A stego image can be generated based on the above tech-nique. The procedure can be repeated n times (using n dis-tinct host images and n shadow images) to generate the n desired stego images. Notably, the n stego images will still appear to be general images.

3. Experimental (ndings and comparison with results of reported sharing methods

The parameter values n = 6 and t = 4 are set in the ex-periments performed herein. Accordingly, six stego images are generated and the secret image can be reconstructed by collecting any four of the six stego images. Fig.3(a) dis-plays the secret image Lena, and Figs.3(b1)–(b6) display the six host images. Notably, the sizes of the secret image and the host image are 512 × 512 and 256 × 256 pixels, re-spectively; hence, the size of each host image is 1=t = 1=4 of the size of the secret image. Figs.4(a1)–(a6) present the six stego images obtained by implementing the proposed method. All of them have a size of 256 × 256 pixels. The PSNRs of the six stego images are not identical, but all are about 34 dB. The secret image can be retrieved by collecting any four of the six stego images, and applying the mecha-nism for reconstructing the secret image. (The major part of the reconstruction mechanism is the transformation of each of the four shadow values [f(1)–f(4) de/ned in Eq. (5), for example] back to the four quantized–embedded values ql1 –ql4.) Fig. 4(b) shows the reconstructed secret image,

witha PSNR of 37:9 dB. Notably, Fig4(b) is independent of which four of (a1)–(a6) are employed. Any combination yields the same image with 37:9 dB.

Other 512×512 secret images are tested, and their PSNR values are listed in Table 1. Notably, the image quality (PSNR) of eachrecovered secret image is high(37:66– 41:64 dB), and the stego images are small (256 × 256) and of acceptable quality (34 dB).

The visual quality of the retrieved images is discussed be-low. To get high quality retrieval of a given secret image, some readers may, for example, expect just to hide the se-cret image in eight 512 × 512 host images using the 1-bit LSB (Least Signi/cant Bit) hiding method [6], suchthat they can have the error-free recovery of the given 512×512 secret image at a later date. However, the hiding method alone (without image sharing) is useless, because the (t; n) fault-tolerant property does not then apply (meaning that the reconstruction system cannot tolerate the absence of any stego image), and eachindividual stego image may reveal a small part of the secret image after decryption. Therefore, this study focuses on methods (both the newly proposed one and others) that use sharing. In the proposed approach, the distortion in the gray value at eachsmoothpixel of the secret image cannot exceed one, while at eachnon-smoothpixel, it usually does not exceed eight; the visual quality is there-fore acceptable. If the readers are very strict about the vi-sual quality of the retrieved secret image, they may quantize all edge blocks using a /ner scale value suchas 8 instead of 17 (in other words, replace all those 17s written in Step 6 of Section2.1.1by 8s), and slightly increase the size of eachhost image (to 1:1=t for Lena [to 1:07=t for Jet], which is still very close to 1=t), because, for eachedge pixel, an extra bit is required to indicate the more precise quantiza-tion value, due to the use of a /ner quantizaquantiza-tion scale. (This extra bit is processed separately suchthat eachpixel [each number] that is shared in the sharing procedure is still in the range 0–16). The retrieved secret images Lena and Jet will then have PSNRs of 44.36 and 45:79 dB, respectively. Similarly, if the quantization scale value 17 is replaced by a much /ner scale value 4, then the retrieved secret images Lena and Jet will have PSNRs of 49.21 and 50:47 dB, re-spectively. The size of each host image is 1:2=t (of that of the secret image) for Lena, and 1:14=t for Jet. The PSNR of each stego image is still around 34 dB. Although this 34 dB value may be improved by using other image hiding methods of smaller hiding capacity, the size of each host image will be further increased. Finally, if absolutely no distortion of the retrieved secret image is allowed, then certain well-known error-free compression methods, such as JPEG, S+P trans-form, or SCAN-based Compression [10], should be applied to compress the secret image. After the compressed /le is transformed into a base-17 /le (a numeric /le in which each digit is in the range 0–16), the proposed sharing and hiding procedures are applied to that base-17 /le. The size of each stego image will be greater than 1=t (but not 2=t) of that of the secret image.

The quality of the image retrieved by the proposed method is compared to that of the images retrieved by re-ported image-sharing methods. In relation to image sharing,

(6)

(a)

(b1) (b2) (b3)

(b4) (b5) (b6)

Fig. 3. Inputs: (a) 512 × 512 secret image, Lena; (b) 256 × 256 host images.

readers may examine the visual cryptography approach (in-troduced by Naor and Shamir [11] in 1994, and extended by several other authors such as in Refs. [12] and [13]) and the vector quantization (VQ) approach introduced by Chang [14,15]. The advantage of the visual cryptography approachis its simplicity. It is frequently implemented with black-and-white secret images (1 bit per pixel) rather than gray-value secret images (8 bits per pixel), since the idea that underlies the approach is that it operates as a direct extension of the stacking of several transparent sheets, on eachof whichare scattered black dots in a special pattern. Verheul and van Tilberg [12], developed an extended tech-nique for treating gray-value images, but the decoded image obtained by their method is extremely large. Lin and Tsai [13], employed dithering [16] to convert the gray-value

secret image into a binary image, and then applied a visual cryptographic technique to the binary version to alleviate the waste of storage space due to image size. However, their shadow images were still too large (although much smaller than those obtained in Ref. [12]), and their retrieved secret images were binary images that exhibited a dithering eGect; hence the quality of their images was poorer than of the images obtained herein. (See their Fig. 14 in Ref. [13].) With regard to the vector quantization approach, the earlier work of Chang and Hwang [14], in which the PSNR of the retrieved secret images was 31:26 dB for Lena and 30:12 dB for Jet, was improved later in Ref. [15] by authors in the same research group. In Ref. [15], the reconstructed secret image Jet had a PSNR of 36:96 dB, when all six stego images (each of which was one quarter

(7)

(a1) (a2) (a3)

(a4) (a5) (a6)

(b)

Fig. 4. Outputs: (a) 256 × 256 stego images (all withPSNRs of about 34 dB), and (b) recovered 512 × 512 secret image (withPSNR of 37:9 dB) obtained using any four of the six stego images.

of the size of the secret image) were received. The secret image Jet, reconstructed according to the method proposed herein, had a PSNR of 39:3 dB, when any four of the n stego images (eachof whichwas also one quarter of the size of the secret image) were received. In fact, using the /ner-quantization technique introduced in preceding para-graph(replacing the quantization scale value 17 by a much /ner scale value 4), the PSNR of the reconstructed secret image Jet can be increased to 50:47 dB, at the price of re-quiring the size of each stego image be 1.14 quarter of that of the Jet image. The total size of the stego images needed to reconstruct the 50:47 dB Jet by the proposed approach is therefore 1:14=4 × 4 = 1:14 times the size of Jet, while the total size of the stego images required to reconstruct the 36:96 dB Jet in Ref. [15] was 1=4 × 6 = 1:5 times the size of Jet. Although our reconstructed secret image is of higher quality than that in Ref. [15], the stego images therein are of better quality than those herein, because the amount of

shared data was smaller in Ref. [15], and so could be better hidden in host images using the single bit LSB method. Finally, the reconstruction of the secret image in Ref. [15] relies on all n stego images, whereas n − t stego images can be lost in our reconstruction. (Therefore, in our approach, n − t channels may be disconnected during wartime.) In summary, a comparison of the proposed approachwiththat in Ref. [15] indicates that both provide own advantages. 4. Concluding remarks

This work proposed a method for generating n stego im-ages (eachof whichcontains one shadow image of lim-ited size such that the size of each stego image is only [or nearly] 1=t of that of the secret image). Any t of the n stego images can be used to recover the secret image with good quality. The proposed method /rst applies the quantization

(8)

Table 1

PSNRs of the recovered secret images in some other experiments (when the 512 × 512 Lena in Fig.3(a) is replaced by other 512 × 512 images listed in the table, and all six host images are still 256 × 256)

Recovered secret image House Jet Peppers Milk TiG Woman

PSNR(dB) 41.64 39.36 37.66 40.74 38.79 40.52

procedure to pre-process the secret image. (The quantization procedure not only quantizes the secret image but also em-beds the generated S–E table.) The secret sharing procedure was then employed to generate shadow images that appeared noisy (not displayed here). Finally, the hiding shadow pro-cedure was used to hide each shadow image in an ordinary host image.

Experimental /ndings indicate that the image quality of the retrieved secret images is appropriate (37.66–41:64 dB), and the visual quality is satisfactory for human vision (Fig. 4(b)). The stego images (which contain hidden shadow im-ages) are also of acceptable quality and so are unlikely to attract the attention of an attacker. Most importantly, the size of eachstego image is just 1=t of that of the secret im-age (or nearly 1=t of that of the secret imim-age if the PSNR of the recovered secret image is increased to 50 dB), while the size of the stego image size obtained by the method in Ref. [1] is muchlarger (at least 2=t).

The proposed method is eGective for individuals who must send secret images from a restricted area. For exam-ple, news photographers or spies who work in sensitive ar-eas may send collected images to their companies or gov-ernments. Using the proposed method, they can transform secret images into several smaller stego images. They can then send “small” and “ordinary” stego images (for example, of a natural scene or landscape) in diGerent ways (includ-ing e-mail, ftp and even through public web-sites on which people may post photographs) without being suspected by enemies or agents of other companies. The receiver can re-cover the secret image by gathering suRcient stego images via various channels. Notably, not all stego images need to be collected. Even if some stego images are lost or damaged, the receiver can still recover the secret image. The system is therefore fault-tolerant, increasing the chance of the suc-cessful transmission of secret images. (This characteristic is of utmost importance to governments or news companies that are waiting for secret images.)

Government’s concern (how to receive secret images) is addressed in the preceding paragraph. Privacy issues are dis-cussed below withreference to preventing the enemy (or an agent of another company) from obtaining the secret im-ages. Even if the enemy intercepts some channels and sus-pects that some stego images contain hidden information, such that he can extract some shadow images from the stego images, the enemy nevertheless cannot determine the secret image from these extracted shadow images unless he has ex-tracted t shadow images from various channels. The level of

security can be further increased by utilizing some security keys to encrypt the secret image, or by changing the order of pixels in the secret image before applying the quantiza-tion procedure introduced in Secquantiza-tion2.1. (See SCAN-based encryption [10], introduced by Bourbakis and Dollas, which can use 1075000 _{keys with confusion functions.) The}

pho-tographers can also apply diGerent keys to diGerent chan-nels, or even apply n diGerent keys to encrypt the n shadow images before hiding the n shadows in the n hosts. They can also replace our hiding algorithm—which does not need the original host images to recover the shadow values—by some other hiding algorithms that do need the original host images to recover the shadow values (thereby requiring the receiver to keep a copy of the host images). Evidently, many optional approaches to increasing the security level exist, making successful breakthrough by an enemy very diRcult. In relation to the preceding paragraph, although encryp-tion can improve the security, encrypencryp-tion cannot completely replace the sharing of images. Without image sharing, an en-emy can intercept a single channel and obtain the encrypted data and recover the secret image by repeatedly guessing the keys. Also, corruption of the single channel would pre-vent the secret image from being received. Using multiple channels and image sharing increases the probability that the friendly receiver can receive the secret image, while main-taining the diRculty to the enemy of obmain-taining the secret image, especially in a short period. (If each stego image is transmitted through its own channel [but with some coy im-ages], then the enemy must intercept at least t channels; after intercepting and recognizing which t stego images are use-ful, the enemy must still extract the shadow images and re-construct the secret images, which tasks will require plenty of time if the secret image or shadow images have been en-crypted, as mentioned in the paragraph above.)

Acknowledgements

The authors would like to thank the referee whose com-ments have greatly improved this paper.

References

[1] C.C. Thien, J.C. Lin, Secret image sharing, Comput. Graph. 26 (5) (2002) 765–770.

[2] W. Bender, D. Gruhl, N. Morimoto, A. Lu, Techniques for data hiding, IBM Syst. J. 35 (3–4) (1996) 313–316.

(9)

[3] W. Bender, F.J. Paiz, W. Butera, S. Pogreb, D. Gruhl, R. Hwang, Applications for data hiding, IBM Syst. J. 39 (3–4) (2000) 547–568.

[4] E. Adelson, Digital signal encoding and decoding apparatus, U.S. Patent No. 4,939,515, 1990.

[5] L.F. Turner, Digital data security system, Patent IPN WO 89/08915, 1989.

[6] R.Z. Wang, C.F. Lin, J.C. Lin, Image hiding by optimal LSB substitution and genetic algorithm, Pattern Recognition 34 (3) (2001) 671–683.

[7] W.N. Lie, L.C. Chang, Data hiding in images with adaptive numbers of least signi/cant bits based on the human visual system, International Conference on Image Processing, Kobe, Japan, Vol. 4, October 1999, pp. 286–290.

[8] Y.C. Hou, P.M. Chen, Y.F. Chiao, Stegonography: an eRcient data hiding method, Proceedings of CVPRIP’98, Durham, Vol. 4, October 1998, pp. 211–214.

[9] F.A.P. Petitcolas, R.J. Anderson, M.G. Kuhn, Information hiding—a survey, Proc. IEEE 87 (7) (1999) 1062–1078.

[10] N. Bourbakis, A. Dollas, SCAN-based compression-encryp-tion-hiding for video on demand, IEEE Multimedia Mag. 10 (2003) 79–87.

[11] M. Naor, A. Shamir, Visual Cryptography, Advances in Cryptography-EUROCRYPT’94, Lecture Notes in Computer Science, Vol. 950, Springer, Berlin, 1994, pp. 1–12. [12] E.R.Verheul, H.C.A. van Tilborg, Construction and properties

of k out of n visual secret sharing schemes, Design Code. Crytogr. 11 (1997) 179–196.

[13] C.C. Lin, W.H. Tsai, Visual cryptography for gray-level images by dithering technique, Pattern Recogn. Lett. 24 (2003) 349–358.

[14] C.C. Chang, R.J. Hwang, Sharing secret images using shadow codebooks, Inform. Sci. 111 (1998) 335–345.

[15] T.S. Chen, C.C. Chang, New methods for secret image sharing based upon vector quantization, J. Electron. Imaging 10 (4) (2001) 988–997.

[16] Y. Zhang, Space-/lling curve ordered dither, Comput. Graph. 22 (4) (1998) 559–563.

About the Author—YU-SHAN WU was born in 1978 in Taiwan, Republic of China. She received her B.S. degree in Computer Science and Information Engineering from Tamkang University in 2000. Then she received her M.S. degree in Computer and Information Science from National Chiao Tung University in 2002. Her recent research interests include pattern recognition and image processing. She is a member of the Phi-Tau-Phi Scholastic Honor Society.

About the Author—CHIH-CHING THIEN was born in 1975 in Taiwan, R.O.C. He received his B.S. and Ph.D. in 1997 and 2003, respectively, from the computer and information science department of National Chiao Tung University, Taiwan R.O.C. His recent research interests include data hiding, image compression, and information security. Dr. Thien is a member of Phi Tau Phi Scholastic Honor Society. About the Author—JA-CHEN LIN was born in 1955 in Taiwan, Republic of China. He received his B.S. degree in computer science in 1977 and M.S. degree in applied mathematics in 1979, both from National Chiao Tung University, Taiwan. In 1988 he received his Ph.D. degree in mathematics from Purdue University, U.S.A. In 1981–1982, he was an instructor at National Chiao Tung University. From 1984 to 1988, he was a graduate instructor at Purdue University. He joined the Department of Computer and Information Science at National Chiao Tung University in August 1988, and is currently a professor there. His recent research interests include pattern recognition and image processing. Dr. Lin is a member of the Phi-Tau-Phi Scholastic Honor Society.