Prediction error expansion‐based reversible data hiding in encrypted images with public key cryptosystem

IET Image ProcessingVolume 13, Issue 10 p. 1705-1713 Research ArticleFree Access Prediction error expansion-based reversible data hiding in encrypted images with public key cryptosystem Mohsin Shah, Mohsin Shah orcid.org/0000-0003-2227-9797 School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorWeiming Zhang, Corresponding Author Weiming Zhang zhangwm@ustc.edu.cn School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorHonggang Hu, Honggang Hu School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorXiaojuan Dong, Xiaojuan Dong School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorNenghai Yu, Nenghai Yu School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this author Mohsin Shah, Mohsin Shah orcid.org/0000-0003-2227-9797 School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorWeiming Zhang, Corresponding Author Weiming Zhang zhangwm@ustc.edu.cn School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorHonggang Hu, Honggang Hu School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorXiaojuan Dong, Xiaojuan Dong School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this authorNenghai Yu, Nenghai Yu School of Information Science and Technology, University of Science and Technology of China, Hefei, 230026 People's Republic of ChinaSearch for more papers by this author First published: 15 July 2019 https://doi.org/10.1049/iet-ipr.2018.6120Citations: 4AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Advances in signal processing in the encrypted domain and cloud computing have given rise to privacy-preserving technologies. In recent years, reversible data hiding in encrypted images (RDH-EI) has received attention from the research community because additional data can be embedded into an encrypted image without accessing its original content, and the encrypted image can be losslessly recovered after extracting the embedded data. Although the recent development of RDH-EI compatible with homomorphic public key cryptosystems has intensified research interest, most of the existing mature RDH schemes cannot be transplanted to the encrypted domain due to the limitations of the underlying cryptosystems. In this paper, prediction error expansion based RDH-ED using probabilistic and homomorphic properties of the Paillier cryptosystem is presented. This work implements non-integer mean value computation in the encrypted domain without any interactive protocol between the content owner and the cloud server. This work presents mathematical detail of pixel prediction (mean), prediction error, error expansion and data embedding in the encrypted domain and data extraction and content recovery in the plain domain. Experimental results from standard test images reveal that the proposed scheme outperforms other state-of-the-art encrypted domain schemes. 1 Introduction Reversible data hiding (RDH) is a special type of information hiding method that embeds confidential data into a cover image in such a way that the embedded data can be extracted error free and the original image content can be restored losslessly [1-3]. The lossless restoration property of RDH is pertinent to sensitive applications such as military, law forensics and medicine. Generally, the classic RDH methods are categorised into difference expansion (DE) [2], histogram shifting [3] and lossless compression [4, 5]. These classic RDH methods are further investigated towards high payload and better image quality [6-8]. In recent years, the demand for outsourcing the bulk amount of multimedia data to the cloud, for the purpose of storage and processing has increased. However, the increasing volume of cloud utilisation has led to growing concerns about data protection. Encryption, which is used to reversibly convert plaintext data into unintelligible cipher data, is a standard solution for content protection at the cloud. The content owner encrypts his multimedia data and then transmits it to the cloud server for further processing. The server would first decrypt the data and then process it or embed his management data. This has led to secure signal processing in the encrypted domain [9, 10]. This solution assumes that the content owner and the cloud server trust each other and encryption is used only to protect the data against attackers. However, there can be application scenarios in which a content owner would not trust the cloud server and, therefore, would not want to expose the content of his multimedia data to the cloud server. The cloud server would embed additional data into the encrypted multimedia such as file category, notation information and authentication data which may be used for ownership identification, data management in cloud servers and content integrity. So we need the technique of RDH-EI. Recently, numerous RDH-EI methods have been proposed. Zhang in [11] used stream cipher to encrypt the host image and divided the encrypted image into non-overlapping blocks and further pseudo-randomly divided pixels in each block into two sets. One bit is embedded into each block by flipping three least significant bits (LSBs) of each pixel in the corresponding set. At the receiver side, embedded data is extracted with the help of a fluctuation function. Zhang's method was improved by Hong et al. using a better fluctuation function employing side match [12] and using unbalanced bit flipping [13] to achieve a much lower error rate. In [14], Zhang proposed separable RDH-EI for extracting embedded data directly in the encrypted domain. Separable methods are those that allow data extraction in both encrypted and plain domains. The RDH-EI methods mentioned so far required to vacate the room in the encrypted images directly for data embedding which resulted in low payloads and high error rates on data extraction and image restoration. Ma et al. in [15] proposed to vacate the room before encryption using self-embedding and then used these vacated positions for data embedding after image encryption. Zhang et al. in [16] proposed a method for improved reversibility, payload and image quality by utilising estimation errors for data embedding. Besides uncompressed images, some RDH-EI methods for compressed images have been proposed. RDH-EI for JPEG images has been proposed in [17] and in [18] RDH-EI for Absolute Moment Block Truncation Coding (AMBTC) images has been proposed. In [19], two RDH-EI methods are proposed namely joint and separable based on prediction errors. Both the methods achieved good visual quality of the recovered image with high payload but suffered from errors in data extraction. A high capacity RDH-EI method based on the most significant bit (MSB) prediction is proposed in [20]. A separable RDH-EI method combining alpha channel and LSB embedding in the encrypted domain is proposed in [21]. The content owner encrypts the image and combines an alpha channel with the encrypted image. Data hider divides the secret data into 8-bits chunks and then embeds one bit into the LSB of encrypted image and seven bits into the alpha channel. The alpha channel is then encrypted twice for ensuring security. In [22], a separable RDH-EI employing run-length coding (RLC) and LSB compression is proposed. The image is encrypted in a blockwise manner and then RLC is used to categorise all the encrypted blocks according to their encoded lengths. Based on the encoded lengths, different compression algorithms are used for compressing the pixel differences in a block and compressing the LSB layers. In this way, a large embedding room is vacated which is used by the data hider for data embedding. The RDH-EI methods mentioned so far are based on private key cryptosystems which require the private key to be pre-shared between the sender and receiver securely. Images encrypted with such cryptosystems are hardly used in cloud computing. In contrast to private key cryptosystems, public key cryptosystems do not require the establishment of secure secret key sharing between the sender and the receiver. A public key cryptosystem is said to be homomorphic if it allows to perform some mathematical operations directly on the ciphertext. Homomorphic cryptosystems are of great help in cloud-based application scenarios where sensitive data is processed by semi-trusted third parties. Another important property of homomorphic cryptosystems is that it should be probabilistic or semantically secure, that it, encrypting two same plaintexts produce different ciphertexts and it is not possible to decide that the two ciphertexts correspond to the same plaintexts. With this property, statistical information of the original signal is not disclosed after encryption. Since the first work on homomorphic encryption by Rivest et al. [23], several homomorphic cryptosystems have been proposed e.g. Paillier cryptosystem [24], Elgamal cryptosystem [25] and Damgård–Jurik cryptosystem [26]. These cryptosystems are called partial homomorphic cryptosystems because they allow only addition or multiplication operations on encrypted data. Gentry and Halevi in [27] proposed a fully homomorphic cryptosystem which provides a theoretical background for computing any polynomial in the encrypted domain. However, Gentry's scheme has practical implementation issues due to its complexity and large data expansion. RDH-EI methods with probabilistic and homomorphic public key cryptosystems have been investigated in [28-33]. Chen et al. in [28] divided each pixel into two parts: an even integer and a bit and encrypted both parts using Paillier encryption and transmitted the encrypted parts to the data hider. The data hider embedded additional data by modifying the magnitude relationship between the encrypted bit parts of two neighbouring pixels. Chen et al.'s method have the problem of pixel overflow. Shiu et al. in [29] and Wu et al. in [30] improved Chen et al.'s method [28] by solving the overflow problem. The RDH-EI methods in [28-30] perform data extraction and content recovery in the plain domain, i.e. the image content is revealed before data extraction. Such methods are called non-separable methods. Zhang et al. in [31] proposed a separable RDH-EI method by using histogram shrinking for vacating the room and wet paper code (WPC) [34] for data embedding in the encrypted domain. Most recently, a new separable RDH-EI method introducing the concept of mirroring ciphertext group (MCG) is proposed in [32]. The method randomly selects groups of neighbouring pixels. Each group consists of a reference pixel and host pixels. As a pre-processing step before encryption, LSBs of reference pixels are emptied out and then encrypted host pixels are replaced by the encrypted reference pixels to form MCG. MCGs are modified for data embedding. This method requires pre-processing operation before encryption and data embedding. In [33], another separable and efficient RDH-EI method is proposed which embedded data into an encrypted image without any pre-processing operations. Additional data is embedded by shifting the histogram of the absolute difference of adjacent pixels in the homomorphic encrypted domain. Prediction errors expansion (PEE) is one of the most classic RDH methods [7]. The mentioned methods in [19] adopted prediction errors for embedding additional data into host images encrypted with private key cryptosystems. To the best of our knowledge and literature review, PEE has not been used for data embedding with the homomorphic public key cryptosystems. This is due to the limitations of the partial homomorphic cryptosystems as only a few mathematical operations in the encrypted domain can be translated into corresponding operations in the plain domain. In this paper, we propose a method to compute non-integer mean in the Paillier homomorphic encrypted domain without any interactive protocol between the content owner and the cloud server, based on which we implement PEE-based RDH-EI. The content owner encrypts the original image by the Paillier encryption and then transmits the encrypted image to the data hider. The data hider embeds additional data into the encrypted image. At the receiver side, the marked encrypted image is firstly decrypted and then modified extended Euclidean algorithm is applied on the directly decrypted image for reducing pixel values to the range of [0, 255]. Embedded data is then extracted and original image content is recovered. The remaining part of this paper is organised as follows. Section 2 briefly describes Paillier cryptosystem, its properties and reviews rhombus pattern-based PEE for RDH in the plain domain. Implementation of the proposed PEE-based RDH-EI is elaborated in Section 3. Experimental results and discussion are presented in Section 4. Finally, the conclusion is drawn in Section 5. 2 Preliminaries 2.1 Homomorphic Paillier cryptosystem The proposed method is compatible with both the Paillier cryptosystem [24] and the Damgård–Jurik cryptosystem [26]. In this paper, we adopt Paillier cryptosystem for image encryption and decryption. The Paillier cryptosystem, which holds both probabilistic and homomorphic properties [35], is based on the computational hardness of Nth residue modulo of a number. We direct the readers to [24] for a complete mathematical description of the Paillier cryptosystem. Here we discuss only key setup, encryption and decryption. Key setup: Select two large prime integers p and q , where N is the modulus of the cryptosystem. Let be the set of integers modulo N, is a subset of such that the elements of are relatively prime to N, be the set of integers modulo and is a subset of relatively prime to . Randomly select an integer g from . g and N together makes the public key. At the receiver side, given p and q, the receiver first computes , where stands for least common multiple, and then computes . The modular multiplicative inverse of k denoted by is computed by the following equation: (1) is the private key. Encryption: Let be the plaintext, is the corresponding ciphertext. Randomly select r from , then encryption is computed as (2) Decryption: Given the private key and ciphertext, decryption is computed as (3) 2.2 Homomorphic properties of the Paillier cryptosystem The Paillier cryptosystem makes use of the Carmichael's Theorem [36] and has several interesting homomorphic properties which are given as follows: (4) (5) (6) (7) (8)where is the modular multiplicative inverse of k and P is an integer relatively prime to N. The property given in (8) is termed as self-blinding property. Although the Paillier cryptosystem does not allow division operation with a non-encrypted divisor on encrypted data because division can lead to floating results, we are still able to perform division operation when the divisor k is a plain value. The property in (7) holds if The modular multiplicative inverse of k exists, i.e. m is perfectly divisible by k, i.e. the quotient after division is an integer. Previous methods cannot transplant PEE to the homomorphic encrypted domain because of the limitations of homomorphic cryptosystems to compute non-integer mean in the encrypted domain. In this paper, we propose a method to perform non-integer mean computation using (4) and (7). We can still obtain the correct result from (7) even if m is not perfectly divisible by k which will be discussed in Section 3.5. 2.3 Rationale of rhombus pattern-based PEE In this section, we review the existing rhombus pattern-based PEE for RDH in the plain domain [37]. The pixels of an image are divided into overlapping cells of pixels. Pixels of a cell are further divided into ‘Cross’ and ‘Dot’ sets. Pixels of Cross set are used for data embedding and pixels of Dot set are used for prediction. Fig. 1 illustrates that a pixel in the Cross set is predicted by its four neighbouring pixels in the Dot set. The embedding, extraction and recovery procedures are given as follows. Fig. 1Open in figure viewerPowerPoint Pixel prediction procedure for a single cell [37] The predicted value is the mean of the neighbouring pixel values and is computed by The following equation: (9)where is the floor function that rounds towards negative infinity. The prediction error is the difference between the original pixel and the predicted pixel . (10)The DE method proposed by Tian [2] is employed to expand the prediction error for data embedding. Equation (11) is used for PEE (11)where is the modified prediction error after data embedding and b is one bit of the message to be embedded. Hence each cell can embed one bit of information. The modified pixel value after data embedding is given as (12)The PEE data embedding may cause overflow/underflow. A location map can be used to avoid embedding into pixels that cause overflow/underflow. Substitute from (10) and from (11) into (12) we obtain (13)From (13) it is clear that pixels that do not cause overflow/underflow satisfy the condition in the following equation: (14)A location map to record the positions of invalid cells can be created by pre-processing the original image. Each cell of the original image is checked for (14) and creates a binary array adding for valid cells and for invalid cells. The binary array will have more 0‱s and less 1‱s which is compressed and then embedded into the image. The extraction procedure is the inverse of the embedding procedure. As mentioned earlier, pixels of the Dot set are not modified, so at the receiver side, the predicted pixel value of the Cross set is the same as it was at the sender side. Given the value of the modified pixel value and predicted value , the modified prediction error is computed using (12) and the embedded bit is extracted as (15)Equation (16) is used for computing the original prediction error (16)The original pixel value is recovered using (10). 3 PEE-based RDH-EI In this section, we provide implementation details of PEE-based RDH-EI in the homomorphic encrypted domain. A sketch of the proposed RDH-EI framework is illustrated in Fig. 2 which is composed of three entities: a content owner, a data hider and a receiver. The receiver first generates a set of public and private key pairs and shares his public key with the content owner. The content owner, then encrypts the original image using the public key of the receiver and transmits the encrypted image to the data hider. The data hider, without knowing the original content of the image, embeds additional data directly into the encrypted image using the probabilistic and homomorphic properties of the cryptosystem. The receiver, having the encrypted image with hidden data, first decrypts the encrypted image using its private key to retrieve an image similar to the original image and then performs data extraction and image recovery to obtain the original image. The following sections elaborate each step in detail. Fig. 2Open in figure viewerPowerPoint Sketch of the PEE-based RDH-EI 3.1 Image encryption Let the content owner have the original image I with size . Referring to (2), the content owner randomly selects from and encrypts each pixel of the original image using the public key of the Paillier cryptosystem [24]. (17)where is the corresponding ciphertext pixel for each plaintext pixel and , are the pixel locations. The encrypted image is denoted by . 3.2 Data embedding After receiving the encrypted image from the content owner, the data hider may embed additional data into the encrypted image. The plain domain procedure of dividing the image into Cross and Dot sets is employed for the encrypted image as demonstrated in Fig. 3. Fig. 3Open in figure viewerPowerPoint Error prediction in the encrypted domain Using the homomorphic properties given in (4) and (7), the prediction value in the encrypted domain can be computed by (18) as (18)where mod N is the modular multiplicative inverse of 4. It is worth mentioning to establish the fact that the modular multiplicative inverse of 4 and its multiples always exist given the modulus of the Paillier cryptosystem N. The modular multiplicative inverse of a number x exists if the number is relatively prime to modulus N, i.e. . According to the Euler's totient function , the set of integers that are relatively prime to N is given as (19)and where is the set of positive integers and . From (19) it is concluded that if p or q is not equal to 2 then the relative prime set will contain 4 and its multiples. Hence, the modular multiplicative inverse of 4 and its multiples will always exist. The encrypted prediction error is computed in the encrypted domain using the following equation: (20)The encrypted prediction error is expanded in the encrypted domain to embed one encrypted bit. The modified prediction error is computed as (21)Finally, the modified pixel value in the encrypted domain after embedding one encrypted bit is computed as (22)After all the cells of the encrypted image are utilised for data embedding, we obtain the encrypted image with hidden data and denote by which then is transmitted to a legal receiver. 3.3 Location map As mentioned in Section 2.3, a location map can be used to avoid embedding into invalid cells. As the data hider performs the data embedding in the encrypted domain, he has no information about the validity of cells. The location map needs to be transmitted to the data hider and also to the receiver. The following two strategies can be adopted to transmit a location map to the data hider and receiver. The content owner encrypts the location map and transmits it as side information with the encrypted image . The data hider decrypts the encrypted compressed location map and uses it to avoid embedding into an invalid cell. This strategy is adopted in [29]. The content owner embeds the compressed location map into the encrypted image in a way which will not modify the corresponding pixels upon decryption at the receiver side. The encrypted pixels of the original image can be modified using the self-blinding property of the Paillier cryptosystem as (23) Location map bits can be embedded as (24)Note that according to the self-blinding property (refer to (8)) this modification does not affect the corresponding plaintext pixel value. Different random integers can be iteratively selected from to satisfy (24). The data hider and the receiver can extract the embedded bits of location map using (25)To compare with previous methods under the same condition, we use the first strategy. 3.4 Data extraction and image recovery After receiving an encrypted image containing additional data, the receiver first decrypts the encrypted image to obtain an image similar to the original image. Having the private key of the Paillier cryptosystem [24] and the encrypted image with hidden data , the receiver performs the decryption as (26)However, the directly decrypted image is not similar to the original image as some modified pixels values of cells are outside the intensity range of [0, 255]. This is due to the fact that the division operation may not result in integer quotient. That is to say that the dividend is not an integer multiple of the divisor. The decryption of homomorphic division operation (refer to (7)) will result in a correct quotient if the dividend is perfectly divisible by the divisor, otherwise, it will lead to a large integer making no sense. The same rule applies to homomorphic mean computation (refer to (18)) which upon decryption will lead to a large integer if the sum of the neighbouring pixel values in a cell is not an integer multiple of the number of neighbouring pixels involved in predicting a pixel. In the same way, the modified pixel (refer to (22)) upon decryption may result in a pixel ranging in [0, 255] or a large integer outside the pixel intensity range depending on the predicted pixel . This phenomenon is illustrated in Fig. 4 which shows only pixels taken from directly decrypted Lena image. Fig. 4Open in figure viewerPowerPoint pixels of directly decrypted Lena image. Cells with normal modified pixel values are highlighted by light grey colour and those with large modified pixel values are highlighted by dark grey colour After a thorough investigation, we conclude that the directly decrypted large pixel values do make sense. This is where the lattice theory and the extended Euclidean algorithm come into play. The large integer values can be mapped to integers in the range [0, 255] by reducing them using the modified extended Euclidean algorithm. 3.5 Image restoration based on modified extended Euclidean algorithm In this section, we elaborate on the reduction of large pixels values by using lattice theory and modified extended Euclidean algorithm. A lattice is a discrete set of regular arrangement of points in a vector space. A vector space defined over real numbers is a collection of vectors such that vectors can be added together and multiplied by real numbers. A lattice is also a collection of vectors but the vectors can be multiplied by integers only. Let be a set of linearly independent vectors in . The linear combination of the vectors is called a lattice basis. Basis reduction is the problem of finding a basis with short and almost orthogonal vectors. Basis reduction is proved invaluable in the fields of cryptology [38] and many other fields of mathematics and computer science. Lenstra et al. in [39] used lattice reduction to decompose a polynomial with rational coefficients to irreducible factors. Ritter and Rössner in [40] used lattice reduction for factoring large composite numbers. In [41], Poupard and Stern proposed a recovery system for RSA keys using lattice reduction and rationals. Lattice basis reduction is a geometric generalisation of finding the greatest common divisor (GCD) by the Euclidean algorithm. The extended Euclidean algorithm is used to compute integers such that , where and g is the GCD of and . Algorithm 1 (see Fig. 5) presents the extended Euclidean algorithm. Readers are directed to [42] for a detailed explanation of Algorithm 1 (Fig. 5). The extended Euclidean algorithm computes GCD of integer numbers, we modify the algorithm to take vector inputs and reduce the basis vectors for lattice reduction. We consider the modulus of Paillier cryptosystem and modified large pixel value as independent points in a lattice space L. Given and , it can be deduced that the vectors and form a basis for the lattice L. These two basis vectors can be reduced for optimal values. Algorithm 2 (see Fig. 6) adapts the extended Euclidean algorithm for computing the reduced value of . is the ceil function that rounds towards positive infinity. Algorithm 2 (Fig. 6) starts with first taking the basis vectors and and computes the quotient q. In the first round, the algorithm computes and , and then updates by , by , by and by . The basis vector is reduced if . The algorithm goes further if until we get the reduced basis vectors and . Finally, the reduced pixel value is computed using step 15 of the algorithm. Fig. 5Open in figure viewerPowerPoint Algorithm 1 Extended Euclidean algorithm Fig. 6Open in figure viewerPowerPoint Algorithm 2 Pixel value reduction based on modified extended Euclidean algorithm After reducing large pixel values to normal pixel intensity range, (12), (15), (16) and (10) can be used for computing the modified prediction error , data extraction, prediction error and original pixel . When all the data are extracted the original image I is recovered. Example.In order to facilitate understanding of the reduction process, we elaborate it with an example. For the brevity of the demonstration, we use small prime numbers and . Let the pixel to be reduced is taken from the first cell as shown in Fig. 4. According to Algorithm 2 (Fig. 6), we let and and . Compute and , , then update , and , . Since , we compute and , , then update , and , . Again since , we repeat the process and compute and , , then updat