A Multi-threshold Secret Image Sharing Scheme Based on MSP

A multi-threshold secret image sharing scheme based on MSP

Cheng Guo

a

, Chin-Chen Chang

b,c,⇑

, Chuan Qin

b

a

Department of Computer Science, National Tsing-Hua University, Hsinchu 30013, Taiwan b

Department of Information Engineering and Computer Science, Feng Chia University, Taichung 40724, Taiwan c

Department of Biomedical Imaging and Radiological Science, Chinese Medical University, Taichung 40402, Taiwan

a r t i c l e

i n f o

Article history:

Received 28 November 2011 Available online 27 April 2012 Communicated by I. Svalbe Keywords:

Multi-threshold secret sharing Access structure

Secret image sharing Monotone span programs

a b s t r a c t

In this paper, we consider the problem of secret image sharing in groups with multi-threshold access structure. In such a case, multiple secret images can be shared among a group of participants, and each secret image is associated with a (potentially different) access structure. We employ Hsu et al.’s multi-secret sharing scheme based on monotone span programs (MSP) to propose a multi-threshold multi-secret image sharing scheme. In our scheme, according to the real situation, we pre-defined the corresponding access structures. Using Hsu et al.’s method, we can achieve shadow data from multiple secret images according to these access structures. Then, we utilize the least significant bits (LSB) replacement to embed these shadow data into the cover image. Each secret image can be reconstructed losslessly by col-lecting a corresponding qualified subset of the shadow images. The experimental results demonstrate that the proposed scheme is feasible and efficient.

Ó 2012 Published by Elsevier B.V.

1. Introduction

Secret sharing was introduced in 1979 byShamir (1979)and

Blakley (1979), who developed two different methods to construct threshold secret sharing schemes based on the Lagrange interpo-lating polynomials and the linear projective geometry, respec-tively. By using a secret sharing scheme, a secret can be protected among a finite set of participants in such a way that only qualified sets of participants, which form the access structure of the scheme, can jointly reconstruct the secret.

Noar and Shamir (1995)developed visual cryptography that encrypts a secret image into some shares (transparencies) such that the secret image can be revealed to visual perception only by stacking any qualified subset of the shares without performing any cryptographic computations. However, in their scheme, the shadow images that are comprised of black and white pixels are meaningless. The interested reader can find more information about visual cryptography in (Yang, 2004; Wang and Su, 2006; Wang et al., 2007). In 2004,Lin and Tsai (2004)proposed a novel method for sharing secret images based on a (t, n) threshold scheme that had additional steganographic capabilities. In their scheme, shadow images are meaningful, and they look like the camouflage image. Furthermore, an image watermarking

technique is employed to embed fragile watermark signals into the shadow images. Therefore, during the secret image reconstruc-tion process, each shadow image can be verified for its fidelity. In 2007,Yang et al. (2007)presented a scheme to improve authenti-cation ability and improve the quality of shadow images. However, the improved scheme resulted in the distortion of the visual qual-ity of the shadow images. In 2009,Lin et al. (2009)employed the modulus operator to embed secret data into a cover image. In their scheme, some meaningful shadow images with satisfactory quality were obtained, and both the secret image and the cover image could be reconstructed losslessly. In addition, they utilized Rabin’s signature to generate a certificate aimed at detecting cheaters. The above-mentioned schemes all proposed an authentication ability to protect the integrity of the shadow images. In 2010,Lin and Chan (2010)proposed an invertible secret image sharing scheme that almost satisfied all of the essential criteria of the secret image sharing mechanism. Also, their scheme offered a large embedding capacity compared with related secret image sharing schemes.

However, most researchers have focused on how to improve the visual quality of the shadow images and enlarge the embedding capacity, and very few people have paid any attention to research on the access structure of secret image sharing. In 2002,Tsai et al. (2002)proposed a multiple secret sharing method, in which multi-ple secret images can be shared among participants and each pair of shadow images can share a different secret image. But, their meth-od can retrieve the secret image from only combinations of two shadow images. This is not a generalized secret image sharing scheme. In 2005,Feng et al. (2005)proposed a scheme to achieve sharing multiple secrets according to any access structure, and each

0167-8655/$ - see front matter Ó 2012 Published by Elsevier B.V.

http://dx.doi.org/10.1016/j.patrec.2012.04.010

⇑Corresponding author. Address: Department of Information Engineering and Computer Science, Feng Chia University, No. 100 Wenhwa Rd., Seatwen, Taichung 40724, Taiwan. Tel.: +886 4 24517250x3790; fax: +886 4 27066495.

E-mail addresses: guo8016@gmail.com (C. Guo), alan3c@gmail.com (C.-C. Chang).

Contents lists available atSciVerse ScienceDirect

Pattern Recognition Letters

qualified set of the shadow images can share different secret images independently. However, Feng et al.’s scheme has following weak-nesses. Firstly, the secret image cannot be recovered without dis-tortion since all the pixels larger than 250 need to be modified to 250 in the secret sharing phase. Secondly, Feng et al.’s secret image sharing scheme is not perfect. That is, an attacker has a prob-ability to get a correct secret image from an incomplete qualified subset of shadow images. Thirdly, the embedding capability of their scheme is instability. The radio of total secret capacity is within [1/ 2, 1]. In 2008,Feng et al. (2008)also proposed a visual secret sharing scheme for hiding multiple secret images into two share images.

The access structureCof a secret sharing scheme is the collec-tions of subsets of participant set P that can jointly compute the se-cret from their shadows. The characterization of the access structures of secret sharing schemes is one of the most important remaining problems in secret sharing. Due to the difficulty of find-ing efficient secret sharfind-ing schemes with generalized access struc-tures, it is worthwhile to find families of access structures that have other useful properties for the applications of threshold cryptology. However, there are very few known constructions of secret image sharing schemes with generalized access structures. Therefore, we believe that it will be an interesting and challenging problem.

In the introductory work (Shamir, 1979), Shamir made the first attempt to propose a way to construct weighted threshold secret sharing. In his scheme, one positive weight is associated with each participant, and the secret can be reconstructed if, and only if, the sum of the weights assigned to participants who are reconstructing the secret is greater than or equal to a fixed threshold.Brickell (1990a,b) proposed a method for constructing secret sharing schemes for multi-level and compartmented access structures. These two kinds of access structures were also proposed by Sim-mons (1990). In 2007,Farràs et al. (2007)presented a characteriza-tion of matroid-related, multipartite access structures in terms of discrete polymatroids. Also, they proposed an ideal multipartite se-cret sharing scheme. In 2007,Tassa (2007)proposed a hierarchical threshold secret sharing scheme based on the Birkhoff interpola-tion. In his scheme, the secret is shared by a set of participants par-titioned into several levels, and the secret can be reconstructed by satisfying a sequence of threshold requirements.

In 1996,Jackson et al. (1996)considered a kind of secret sharing scheme that permits a number of different secrets to be shared among a group of participants. Each secret is associated with a (potentially different) access structure, and a certain secret can be reconstructed by any group of participants from its associated access structure.Barwick and Jackson (2005)talked about the con-struction of a multi-secret threshold scheme in 2005. In 2011,Hsu et al. (2011a,b)proposed an ideal multi-threshold secret sharing scheme based on monotone span programs (MSP). Later, they uti-lized the multi-threshold secret sharing scheme to provide secure and efficient group communication in wireless mesh networks (Hsu et al., 2011a,b). Some secret sharing applications must protect more than one secret, possibly with different access structures associated with each secret. Also, secret image sharing has the same applications. For example, there are several secret images that must be shared among a group of people in such a way that different subsets of the group can cooperate to reconstruct the cor-responding secret image. Inspired by the multi-threshold secret sharing scheme, we want to construct a multi-threshold secret im-age sharing scheme.

To the best of our knowledge, very few papers have discussed secret image sharing with a generalized access structure. In this paper, we study the characterization of the multi-threshold access structure and propose a new multi-threshold secret image sharing scheme based on MSP. In the process of driving shadow images, according to the real situation, we pre-defined the corresponding access structures. Then, we utilized Hsu et al.’s multi-threshold

se-cret sharing scheme based on MSP to generate the corresponding shadow data. Then, we used the least significant bits (LSB) replace-ment to embed the shadow data into the cover image, aiming to generate the shadow images. According to the access structures, each secret image is associated with a certain subset of shadow images. The main contribution of this paper is to propose a novel multi-threshold secret image sharing scheme based on MSP. What’s more, the shared multiple secret images can be recovered losslessly, and the embedding capability and the quality of shadow images are satisfactory.

2. Preliminary

In this section, first, we introduce monotone span programs (MSP), and then, we briefly review the multi-secret sharing scheme based on MSP proposed byHsu et al. (2011a), which is the major building blocks of our scheme.

2.1. Monotone span programs

In 1993,Karchmer and Wigderson (1993)introduced monotone span programs (MSP) as a linear algebraic model that computes a function. Let Mð

j

;M; wÞ be an MSP, where M is a d  l matrix over a finite field

j

and

w

: {1, 2, . . . , d} ? P{P1, P2, . . . , Pn} is a surjective

labeling map. We call d the size of the MSP. For any subset A # {P1, P2, . . . , Pn}, there is a corresponding characteristic vector

dA

!

¼ ðd1;d2; . . . ;dnÞ 2 f0; 1gn. If, and only if, Pi2 A, di= 1. As to a

tar-get vector!

v

2

j

l_{n ð0; 0; . . . ; 0Þ, if, and only if, a monotone Boolean}

function f:{0, 1}n_{?{0, 1}, f ðd} A

!

Þ ¼ 1, we can say that!

v

2 spanfMAg,

where MA consists of the rows e of M with

w

(e)

e

A, and

v

!_{2 spanfM}

Ag means that a vector w! exists such that!

v

¼ w!MA.

2.2. Hsu et al.’s multi-secret sharing scheme

Hsu et al. (2011a,b) proposed an ideal multi-secret sharing scheme based on MSP. They generalized the definition of an MSP to permit more than one target vector. Their scheme consists of three phases:

(1) The set up phase

Assume that m secrets s1, s2, . . . , smare shared among a set of

participants P = {P1, P2, . . . , Pn} and that si2

j

. Let

-

be the

collec-tion of all non-empty subsets of P. Suppose that

u

: {s1, s2, , sm} ?

-

is a bijection that associates each element in

-

. We can define such an m-tuple!C¼ ðC1;C2; . . . ;CmÞ of access

structures as follows:

ð

C

jÞmin¼ f

u

ðsjÞg; 1 6 j 6 m:

Denote V ¼

j

n_{as the n-dimensional linear space over}

_j

_{. Given a}

basis {e1, e2, . . . , en} of V, the mapping v :

j

! V can be constructed

by vðxÞ ¼Pn

i¼1xi1ei. Let u!i2 fvðxÞ : x 2

j

g, for i = 1, 2, . . . , n, be the

n-dimensional vector associated with the participant Pi, where u!i

is the row vector distributed to participant Pi, for 1 6 i 6 n. Let

v

!

j¼P_{i 2}

_u

_ðjÞ

xi2

j

xi!ui, for j = 1, 2, . . . , m, be the m target vectors.

(2) The distribution phase

First, the dealer computes a vector r!2

j

n_{that satisfies the}

in-ner product ð!

v

j;!rÞ ¼ sj, for j = 1, 2, . . . , m. Then, the dealer

com-putes Mi!rs for participant Piand transmits Mi!rs to each Pias a

shadow, for i = 1, 2, . . . , n, where ‘‘

s

’’ is the transpose and Midenotes

(3) The reconstruction phase

As to a qualified set of participants A, since!

v

j2Pi2AVi, where

Viis the space spanned by the row vectors of M distributed to

par-ticipants i according to

w

, a vector w! exists such that!

v

j¼ w!MA.

The participants in A can compute sj¼ ð!

v

j;rÞ ¼!

v

j r!s¼

ðw!MAÞ r!s¼ w!ðMA!rsÞ: Therefore, the secret sj can be

recon-structed by a linear combination of the participants’ shadows.

3. The proposed scheme

In the proposed scheme, we introduce MSP-based, multi-threshold secret sharing into secret image sharing, aiming at con-structing a multi-threshold secret image sharing scheme in which there are multiple access structures on the set of shadow images, and the multiple secret images are shared among the shadow images in such a way that a different secret image is related to a corresponding access structure. That is, a different set of shadow images is likely to reconstruct different secret images.

Based on Hsu et al.’s multi-secret sharing scheme, we define the multi-threshold secret image sharing as follows:

Definition 1. Let I be a set of n shadow images and let

C

!

¼ ðC1;C2; . . . ;CmÞ be an m-tuple of access structures on the

set of I = {I1, I2, . . . , In}. There are m secret images s1, s2, . . . , sm, and

each secret image siis associated with an access structureCion I,

for 1 6 i 6 m. A qualified set of shadow images can reconstruct the corresponding secret image jointly.

For instance, assume that there is one set of shadow images I = {I1, I2, I3}, and there is a set of three secret images

S = {S1, S2, S3}, which are shared in such a 3-tupleC= (C1,C2,C3)

of access structures on I as follows:

ð

C

1Þmin¼ ffI1;I2gg; ð

C

2Þmin¼ ffI2;I3gg; and ð

C

3Þmin¼ ffI1;I3gg:

That is, shadow image I1and shadow image I2can jointly

recon-struct the secret image S1, shadow image I2and shadow image I3

can jointly reconstruct the secret image S2, and shadow image I1

and shadow image I3can jointly reconstruct the secret image S3.

Obviously, a subset A 2 I is likely to reconstruct more than one se-cret image.

Assume that the cover image O has M  N pixels, O = {Oi|i

= 1, 2, . . . , (M  N)}, and a set of secret images S = {S1, S2, . . . , Sm},

and each secret image has MS NSpixels. A dealer is responsible

for constructing the access structures according to the real-life sit-uation and generating related shadow images. In Section3.1, we introduce a method to generate the shadow data for different se-cret images and corresponding access structures, and the embed-ding phase is presented in Section3.2. Section3.3discusses how to retrieve the corresponding secret images from the qualified sets of shadow images according to different access structures.

3.1. Shadow data generation phase

Without loss of generality, s11, s21, . . . , sm1, for 0 6 sj16255,

1 6 j 6 m, denote the first pixel values of secret images S = {S1, S2, . . . , Sm}, respectively, and C

!

¼ ðC1;C2; . . . ;CmÞ denote

the corresponding access structures. In our scheme, we continue to use some parameters from Hsu et al.’s scheme. The dealer per-forms the following steps:

Step 1: Let V ¼

j

n _{be the n-dimensional linear space over}

_j

_.

Given a basis {e1, e2, . . . , en} of V, the mapping v :

j

! V can

be constructed by vðxÞ ¼Pni¼1xi1ei.

Step 2: Let u!i2 fvðxÞ : x 2

j

g, for 1 6 i 6 n, be the

n-dimen-sional vector associated with the ith shadow image. Let

v

j

!_¼ X

i 2

u

ðjÞ xi2

j

xi! for j ¼ 1; 2; . . . ; m;ui ð1Þ

be the m target vectors.

Step 3: The dealer can build an MSP Mð

j

;M; wÞ, where M is an n  n matrix over

j

with the ith row vector u!.i

Step 4: The dealer can compute a vector r!2

j

n_{that satisfies}

the inner product ð!

v

j;!rÞ ¼ sj, for j = 1, 2, . . . , m. Then, the dealer

computes Mi!rsfor each shadow image, for i = 1, 2, . . . , n, where

‘‘

s

’’ is the transpose and Midenotes the matrix M restricted to

the row i. The Mi!rsis the corresponding shadow data for each

shadow image Ii, for i = 1, 2, . . . , n, in view of the first pixel values

s11, s21, . . . , sm1 of secret images and multi-threshold access

structures!C¼ ðC1;C2; . . . ;CmÞ.

Step 5: By repeating Steps 1–4, the dealer can compute all sha-dow data according to the secret images and the access structures.

In Section3.2, we will talk about how to embed these shadow data into the cover image. In the following, we will give an exam-ple to illustrate how to generate the shadow data.

Example 1. Let!C¼ ðC1;C2;C3Þ be a 3-tuple of access structures

on the set of shadow images I = {I1, I2, I3}. There are three secret

images S1, S2, S3, and each secret image Siis associated with an

access structureCion I. Let s11, s21 and s31 denote the first pixel

values of the three secret images, respectively. The 3-tuple

C

!

¼ ðC1;C2;C3Þ of access structures on I is constructed as follows:

C

1¼ ffI1;I2gg;

C

2¼ ffI2;I3gg and

C

3¼ ffI1;I3gg:

Assume that s11= 5, s21= 100 and s31= 50. Give a basis

{e1, e2, e3} of V such that e1= (1, 0, 0), e2= (0, 1, 0) and e3= (0, 0, 1).

The mapping

v

can be defined by vðxÞ ¼Pn_i¼1xi1_e i. Then, v(x) = (1, 0, 0) + (0, 1, 0)x + (0, 0, 1)x2_{, and} M ¼ vð1Þ vð2Þ vð3Þ 2 6 4 3 7 5 ¼ 1 1 1 1 2 4 1 3 9 2 6 4 3 7 5:

Associate I1 with u!1¼ vð1Þ, I2 with u!2¼ vð2Þ and I3 with

u !

3¼ vð3Þ. According to (1), we can compute three target vectors

ð!

v

1;!

v

2;!

v

3Þ

v

!

1¼ ð2; 3; 5Þ!

v

2¼ ð2; 5; 13Þ and!

v

3¼ ð2; 4; 10Þ:

According to the equation ð!

v

i;!rÞ ¼ si1, for i = 1, 2, 3, we can

com-pute r!¼ ð155 2 ; 115 2 ; 5 2Þ.

Then, the shadow data SDifor each shadow image Iican be

com-puted as follows: SD1¼ M1!rs¼ ð1; 1; 1Þ 155 2 155 2 5 2 0 B @ 1 C A ¼ 45 2; SD2¼ M2!rs¼552; SD3¼ M3!rs¼145₂ :

We can see that the corresponding pixel value of the secret image si1, for i = 1, 2, 3, can be reconstructed by computing a linear

combi-nation of their shadow data.

s11¼ SD1þ SD2¼ 5; s21¼ SD2þ SD3¼ 100; and s31¼ SD1þ SD3

¼ 50:

3.2. Embedding phase

As was mentioned above, according to the secret images and the corresponding access structures, the dealer can compute

shadow data for n shadow images. So far, the two most popular steganographic embedding methods are the modular operation and the least significant bits (LSB) replacement. Herein, we utilize the LSB-based steganographic method to embed the shadow data into the cover image.

From the example in Section3.1, we can find that these shadow data are real numbers. In order to embed more shadow data into the cover image and recover the secret image without distortion, we correct the shadow data to 1 decimal place. As we know, the pixel value of the secret image can be reconstructed by a linear combination of the corresponding shadow data, and the pixel value is an integer. Therefore, if we correct the shadow data to 1 decimal place, the reconstructed pixel values will be complete and correct. And then, the secret image can be recovered losslessly.

Firstly, the shadow data is divided into two parts: the integral part and the decimal part. We utilize Lena, Baboon, and Airplane as the test images, and we can find that the integral part of the cor-responding shadow data are within [78, 200], [90, 171], and [45, 205], respectively. So, 10 bits are enough to represent the integral part of the shadow data and 4 bits are enough to represent the decimal part of the shadow data. In this paper, in order to sim-plify the proposed method, we utilize a simple 3-LSB substitution to embed shadow data into the cover image. Therefore, five-pixel blocks are enough to represent shadow data. Let oibe the grayscale

value of the cover image O and its binary representation be (oi1, oi2, . . . , oi8), where oi6, oi7, oi8 are the LSB bits. Let (sdi1,

s-di2, . . . , sdi10) be the binary representation of the integral part of

the shadow data SDi, (di1, di2, di3, di4) be binary representation of

the decimal part of the shadow data SDi, and o0ibe the grayscale

va-lue of the corresponding shadow image.Fig. 1shows one five-pixel square block of the cover image.

Fig. 2demonstrates the five-pixel square block of the shadow image. Note that

v

irepresents the sign of the corresponding

sha-dow data: The symbol ‘‘0’’ means negative and ‘‘1’’ means positive. The last four bits of the five-pixel square block are used to hide the decimal part of the shadow data (di1, di2, di3, di4), and other LSB bits

are replaced by sdi1, sdi2, . . . , sdi10.

We embed the generated shadow data into the cover image in this manner. Repeat the above procedure until all shadow data are embedded.

3.3. Protection phase

One fraudulent participant may provide a false shadow image and fool the other participants during the recovery of the secret image. Therefore, it is important to verify the integrity of the sha-dow images. In our scheme, the dealer can publish a little public information for shadow images that can be used to prevent the dis-honest participants.

Step 1: Choose a public collision-free one-way hash function h(x) and a large prime number q such that h(x) < q.

Step 2: Compute T ¼Pn_i¼1hð~OiÞq2ði1ÞþPn1i¼1cq2i1, where eOi

denotes the ith shadow image, and c is a positive constant ran-domly chosen over GF(q).

Step 3: Publish T, h(x) and q.

3.4. Secret image retrieving phase

Firstly, each involved participant can perform the following steps to determine the validity of the shadow images. Let G be a qualified subset of shadow images.

Step 1: Compute T

¼P_e

Oi2G

hð eOiÞq2ði1Þ.

Step 2: For each shadow image eOi2 G, check whether

bTT

q2ði1ÞcðmodqÞ ¼ 0.

Step 3: If the equation holds, the shadow image is valid; other-wise, the shadow image is tampered.

In this paper, we will not iterate the mathematical background of this authentication mechanism. Readers can refer to the detail in

Wu and Wu (1995).

According to access structures, given any qualified subset of shadow images, the corresponding secret image can be recon-structed. Extract the shadow data from the given shadow images, and the pixel value of the related secret image can be recon-structed by computing a linear combination of their shadow data. By repeating these processes, all pixel values of the secret image can be computed, and, the secret image can be reconstructed losslessly.

Example 2. Assume that the access structures are C1= {{I1, I2}},

C2= {{I1, I3}} andC3= {{I1, I2, I3}}. The ith pixel values of the three

secret images are denoted as s1i, s2iand s3i, respectively, and the

corresponding shadow data are SDi1, SDi2 and SDi3, respectively.

Then, the ith pixel values of the three secret images, s1i, s2iand s3i,

can be computed as follows:

Fig. 1. The five-pixel square block of the cover image.

s1i¼ SDi1þ SDi2;

s2i¼ SDi1þ SDi3;

s3i¼ SDi1þ SDi2þ SDi3:

4. Experimental results and analysis

In this section, we conduct simulations to demonstrate the fea-sibility of the proposed scheme, and the results of these simula-tions are discussed.

4.1. Simulation results

In the experiments, we assumed that there were three secret images that are shared in 3-tuple !C¼ ðC1;C2;C3Þ access

struc-tures on shadow images I = (I1, I2, I3) as follows:

ð

C

1Þmin¼ ffI1;I2gg; ð

C

2Þmin¼ ffI2;I3gg; and ð

C

3Þmin¼ ffI1;I3gg:

As shown inFig. 3, the test images contain 15 gray-level images with sizes of 512  512 pixels.Fig. 4shows three secret images, i.e., Lena, Baboon, and Airplane, that are 200  200 pixels. Herein, the criterion for the visual quality of the shadow images is the peak-signal-to-noise ratio (PSNR), which is defined as:

PSNR ¼ 10log10

2552

MSE !

dB; ð2Þ

where MSE is the mean-square error between the cover image and the shadow image. If the cover image consists of M  N pixels, MSE is defined as:

Fig. 3. The test images.

MSE ¼ 1 M  N X MN j¼1 ðpj p0jÞ 2 ; ð3Þ

where pjis the original pixel value, and p0jis the pixel value of the

shadow image.

Table 1lists the PSNR values of the shadow images with various test images using the given access structures. Since we utilize a simple LSB substitution to embed the shadow data into the cover image, the pixel values of the shadow images in the proposed scheme are slightly lower than those of the existing secret image sharing methods. However, our scheme presents a generalized threshold access structure for secret image sharing. Furthermore, the distortion between the shadow images and the cover image is acceptable.

In the experiment, we designed a specific access structure in which shadow image 1 and shadow image 2 can cooperate to reconstruct secret image 1, ‘‘Lena.’’ Similarly, shadow image 2 and shadow image 3 can cooperate to reconstruct secret image 2, ‘‘Baboon,’’ and shadow image 1 and shadow image 3 can cooperate to reconstruct secret image 3, ‘‘Airplane.’’ Of course, depending on the situation at hand, we also can design other access structures.

Fig. 5shows the extracted secret images. We can see that the secret images can be reconstructed losslessly.

4.2. Validity and security analysis

In this subsection, we analyze the validity and the security of the proposed multi-threshold secret image sharing scheme.

Theorem 1. Any subset A 2Cjof shadow data can reconstruct the

pixel value of the secret image Sjby a linear combination of their

shadow data.

Proof. Observe that Vi¼ spanf u!ig for 1 6 i 6 n, and

v

!

j¼P_{i 2}

_u

_ðjÞ

xi2

j

xi!uifor 1 6 j 6 m, where!

v

jis a target vector

asso-ciated with a pixel value of the secret image. They imply that there must exist a linear combination of the vectors inP_i2uðjÞVisuch that

it equals to !

v

j¼P_{i 2}

_u

_ðjÞ xi2

j

xi!ui. Namely, !

v

j¼P_{i 2}

_u

_ðjÞ xi2

j

xi!ui2 P

i2uðjÞVi. Therefore, the pixel value of the secret image can be

reconstructed by a linear combination of a qualified subset of sha-dow data. h

Theorem 2. The proposed scheme is a perfect multi-threshold secret image sharing scheme, that is, any subset B RCjof shadow

images cannot obtain any information on the secret image Sj.

Proof. Due to the fact that u!i for 1  i  n is the form v(x), where

the vectors v(x) have Vandermonde coordinates with respect to the given basis of V, and every set of at most n vectors of the form v(x) is independent, we obtain that u!1;!u2; . . . ;!un are linearly

inde-pendent. Furthermore, Vi¼ spanf u!ig for 1 6 i 6 n, and the target

vector !

v

j¼P_{i 2}

_u

_ðjÞ

xi2

j

xi!ui. It implies that there is not a linear

combination of their shadow data such that it equals to the corresponding pixel value of the secret image. Therefore, any subset B RCj of shadow images cannot reconstruct the secret

image Sj. h

5. Discussion

In the traditional (t, n) secret image sharing schemes, the secret image is shared among n shadow images, and only t or more dow images can reconstruct the secret image; if the number of sha-dow images is equal to or less than (t  1), the shasha-dow images cannot recover the secret image. However, a generalized threshold access structure could have other useful properties for the applica-tion. In the proposed scheme, we introduced multiple threshold ac-cess structures in secret image sharing. In our scheme, we define multiple threshold access structures according to the real situation, and every secret image is associated with a qualified subset of sha-dow images. Different qualified subsets of shasha-dow images with dif-ferent access structures can reconstruct difdif-ferent secret images.

The procedure of generating shadow images consists of two phases, i.e. the shadow data generation phase and the embedding phase. In the shadow data generation phase, we utilized Hsu et al.’s scheme based on MSP to generate shadow data with the properties of multiple threshold access structures. Then, in order

Table 1

The PSNR value (dB) of the shadow images for test images. Test images PSNR (dB)

Shadow image 1 Shadow image 2 Shadow image 3

Bird 40.27 40.29 40.28 Woman 40.21 40.17 40.23 Lake 40.28 40.27 40.28 Man 40.28 40.28 40.27 Tiffany 40.33 40.34 40.33 Peppers 40.26 40.28 40.26 Lena 40.27 40.27 40.27 Fruits 40.26 40.27 40.26 Baboon 40.26 40.26 40.27 Airplane 40.30 40.34 40.30 Couple 40.27 40.27 40.27 Crowd 40.20 40.15 40.21 Cameraman 40.29 40.27 40.29 Boat 40.29 40.30 40.29 House 39.94 39.71 39.99

to simplify the proposed scheme, we used a simple 3-LSB substitu-tion to embed shadow data into the cover image. Since the corre-sponding shadow data are real numbers, we divided these shadow data into two parts: the integral part and the decimal part, to deal with. Meanwhile, correcting the shadow data to 1 decimal place is able to effectively ensure that the secret image can be reconstructed losslessly. Of course, many variations based on LSB substitution also can be utilized to embed shadow data. It may be possible for these steganographic methods to improve the vi-sual quality of shadow images and enlarge the embedding capac-ity. However, it is beyond the scope of this paper to provide all of the details associated with this issue.

Table 2gives the functionality comparison of our scheme and the related schemes. As presented inTable 2, the shadow images are meaningful, the visual quality of the shadow images is accept-able, as is the embedding capacity, and the secret image can be recovered without distortion.Tsai et al.’s scheme (2002)andFeng et al.’s scheme (2005)proposed two effective ways to share multi-ple secret images, respectively. These image sharing schemes had some additional advantages, but they also had to withstand some shortcomings, such that the secret hidden capacity is limited and their schemes did not provide the authentication ability. Compared withTsai et al.’s scheme (2002)andFeng et al.’s scheme (2005), our proposed scheme achieves higher flexibility in various applica-tions, and the secret image can be recovered losslessly. In addition, our proposed scheme provides authentication ability by publishing a little public information. The related works (Yang et al., 2007; Chang et al., 2008) achieved the authentication ability to verify the integrity of the shadow images by embedding some authenti-cation bits into the shadow images. ForLin et al.’s scheme (2009), they prevented the dishonest participants by generating an addi-tional certificate for each shadow image. In order to improve the quality of shadow images, increase the capacity of the embedded secret data, and retrieve the lossless secret image,Lin and Chan’s scheme (2010)did not consider the authentication ability that pre-vents dishonest participants from cheating.

Compared with related schemes, our scheme not only satisfies all of these essentials, but also can share multiple secret images simultaneously and provide multiple threshold access structures.

6. Conclusions

In this paper, we proposed a multi-threshold secret image shar-ing scheme based on MSP. The main objective was to construct a multi-threshold access structure in secret image sharing. In our scheme, we can pre-define different access structures, and each se-cret image is associated with an access structure on shadow images. Meanwhile, in the secret image retrieving phase, we also provide an authentication mechanism to verify the integrity of the shadow images. And, each authorized subset of shadow images can reconstruct the corresponding secret image without distortion.

The experimental results showed that the proposed scheme is fea-sible and that it also can achieve both the high visual quality of the shadow images and high embedding capacity.

It would be worthwhile to conduct research to determine how to construct an efficient secret sharing scheme for every given ac-cess structure. However, the problem of setting up secret image sharing schemes with generalized access structures has been lar-gely ignored by researchers in this area. We hope that some inno-vative and ingenious approaches will be found by investigating and studying this problem.

References

Barwick, S.G., Jackson, W.A., 2005. An optimal multisecret threshold scheme construction. Des. Codes Crypt. 37 (3), 367–389.

Blakley, G.R., 1979. Safeguarding cryptographic keys. In: Proc. AFIPS National Comput. Conf., 48, 313–317.

Brickell, E.F., 1990a. Some ideal secret sharing schemes. Adv. Cryptol.: Eurocrypt’. Springer-Verlag, Berlin, pp. 468–475.

Brickell, E.F., 1990b. Some ideal secret sharing schemes. Adv. Cryptol.: Eurocrypt’89. Springer-Verlag, Berlin, pp. 468-475.

Chang, C.C., Hsieh, Y.P., Lin, C.H., 2008. Sharing secrets in stego images with authentication. Pattern Recognition 41 (10), 3130–3137.

Farràs, O., Farré, J.M., Padró, C., 2007. Ideal multipartite secret sharing schemes. Adv. Cryptol. Eurocrypt’ 2007. Springer-Verlag, Berlin, pp. 448–465.

Feng, J.B., Wu, H.C., Tsai, C.S., Chang, Y.F., 2008. Visual secret sharing for multiple secrets. Pattern Recognition 41 (12), 3572–3581.

Feng, J.B., Wu, H.C., Tsai, C.S., Chu, Y.P., 2005. A new multi-secret images sharing scheme using Largrange’s interpolation. J. Systems Software 76 (3), 327–339. Hsu, C.F., Cheng, Q., Tang, X.M., Zeng, B., 2011a. An ideal multi-secret sharing

scheme based on MSP. Inf. Sci. 181 (7), 1403–1409.

Hsu, C.F., Cui, G.H., Cheng, Q., Chen, J., 2011b. A novel linear multi-secret sharing scheme for group communication in wireless mesh networks. J. Network Comput. Appl. 34 (2), 464–468.

Jackson, W.A., Martin, K.M., O’Keefe, C.M., 1996. Ideal secret sharing schemes with multiple secrets. J. Cryptol. 9 (4), 233–250.

Karchmer, M., Wigderson, A., 1993. On span programes. In: Proc. the Eighth Annual Conf. on Structure in Complexity, San Diego, CA, 102–111.

Lin, P.Y., Chan, C.S., 2010. Invertible secret image sharing with steganography. Pattern Recognition Lett. 31 (13), 1887–1893.

Lin, P.Y., Lee, J.S., Chang, C.C., 2009. Distortion-free secret image sharing mechanism using modulus operator. Pattern Recognition 42 (5), 886–895.

Lin, C., Tsai, W., 2004. Secret image sharing with steganography and authentication. J. Systems Software 73 (3), 405–414.

Noar, N., Shamir, A., 1995. Visual cryptography. Adv. Cryptol. Eurocrypt’94. Springer-Verlag, Berlin. 1–12.

Shamir, A., 1979. How to share a secret. Commun. ACM 22 (11), 612–613. Simmons, G.J., 1990. How to (really) share a secret. Adv. Cryptol.: Crypto’88.

Springer-Verlag, Berlin, pp. 390–448.

Tassa, T., 2007. Hierarchical threshold secret sharing. J. Cryptol. 20 (2), 237–264. Tsai, C.S., Chang, C.C., Chen, T.S., 2002. Sharing multiple secrets in digital images. J.

Systems Software 64 (2), 163–170.

Wang, R.Z., Su, C.H., 2006. Secret image sharing with smaller shadow images. Pattern Recognition Lett. 27 (6), 551–555.

Wang, D., Zhang, L., Ma, N., Li, X., 2007. Two secret sharing schemes based on Boolean operations. Pattern Recognition 40 (10), 2776–2785.

Wu, T.C., Wu, T.S., 1995. Cheating detection and cheater identification in secret sharing schemes. IEE Pro. Comput. Digit. Tech. 142 (5), 367–369.

Yang, C.N., 2004. New visual secret sharing schemes using probabilistic method. Pattern Recognition Lett. 25 (4), 481–494.

Yang, C.N., Chen, T.S., Yu, K.H., Wang, C.C., 2007. Improvements of image sharing with steganography and authentication. J. Systems Software 80 (7), 1070–1076. Table 2

Comparisons of the related secret image sharing schemes.

Functionality Tsai et al. (2002) Feng et al. (2005) Yang et al. (2007) Chang et al. (2008) Lin et al. (2009) Lin and Chan (2010) Ours

Multi-secret image sharing Yes Yes No No No No Yes

Multi-threshold access structures

No Yes No No No No Yes

Meaningful shadow image Yes Yes Yes Yes Yes Yes Yes

Quality of shadow images 39 dB 42 dB 41 dB 41 dB 44 dB 43 dB 40 dB

Lossless secret image Yes No Yes No Yes Yes Yes

Authentication No No Yes Yes Yes No Yes

Embedding capacity MN 9  nðn1Þ 2 ½ 1 2;1  M  N MN4 MN4 ðt3ÞMN3 ðt1ÞMN dlogr255e MN 5  m