# SEAIS: Secure and Efficient Agricultural Image Storage Combining Blockchain and Satellite Networks
## 4 System Design and Methodology
### Image Encryption and Verification  
After denoising and enhancing the image, we ensure data security and integrity using homomorphic encryption and zero-knowledge proof. First, we encrypt the denoised and enhanced image data with the Paillier homomorphic encryption algorithm. Given two large prime numbers \(p\) and \(q\), compute \(z=p\cdot q\) and \(\gamma=lcm(p-1,q-1)\), and choose a random number \(g\in\mathbb{Z}_{z^{2}}^{*}\) to satisfy Equation (12), where \(f(\tau)\) is a function in the homomorphic encryption algorithm, denoted as \(f(\tau)=\frac{\tau-1}{2}\). Then, the server keys with the public key \((z,g)\) and private key \((\gamma,\mu)\) are generated.  
\[\mu=(f(g^{\gamma}\bmod z^{2}))^{-1}\bmod z \tag{12}\]  
For the denoised and enhanced image data \(I_{enhanced}(u,v)\), selective encryption strategies are applied to minimize the computational load. Let \(Mask(u,v)\) represent a binary mask where sensitive data is marked as 1 and non-sensitive data as 0, as shown in Equation (13).  
\[I_{selective}(u,v)=Mask(u,v)\cdot I_{enhanced}(u,v) \tag{13}\]  
Thus, only pixels marked as sensitive by \(Mask(u,v)\) are encrypted, reducing the number of pixels requiring encryption. Then, encrypt each pixel in \(I_{selective}\) using the Paillier encryption scheme, as shown in Equation (14).  
\[Encrypt(I_{selective}(u,v))=g^{I_{selective}(u,v)}\cdot r\bmod z^{2} \tag{14}\]Next, the server needs to generate proof for the image receiver to verify. Assuming that we need to prove that the encrypted image data \(Encrypt(I_{selective}(u,v))\) is indeed generated from the original denoised and enhanced image data \(I_{selective}(u,v)\), we use non-interactive zero-knowledge proof to achieve this. To reduce computational costs, we optimized the traditional modular exponentiation used to generate the commitment value \(c\). In the original implementation, \(c=g^{r}\bmod q\), which can be computationally expensive for large-scale data. We applied precomputation and exponentiation decomposition techniques to optimize this process. We assume the random number \(r\) can be represented in binary form, see Equation (15). Thus, the commitment value \(c=g^{r}\bmod q\) can be decomposed into \(\varphi\) smaller powers of \(g\), as shown in Equation (16). Then, the hash value of the encrypted image \(hash_{d}=H(Encrypt(I_{selective}(u,v)))\) is computed.  
\[r=r_{0}+2r_{1}+2^{2}r_{2}+\ldots+2^{\varphi}r_{\varphi}, \tag{15}\]  
\[c=\prod_{\alpha=0}^{q}g^{2^{\pi}r_{\alpha}}\bmod q \tag{16}\]  
After that, the server performs a hash calculation with the commitment value to obtain \(hash_{c}=H(c||hash_{d})\). Then, it computes the response value \(s\), see Equation (17). Finally, to minimize transmission overhead, we applied compression techniques to the proof components \(c\) and \(s\), while keeping the cryptographic integrity intact. Thus, the proof \(\pi=(compress(c),compress(s),hash_{c})\) is generated, where \(compress()\) represents the compression function.  
\[s=r+c\cdot I_{selective}(u,v)\bmod q \tag{17}\]  
The final image receiver will verify the authenticity and integrity of the image data. First, the receiver extracts \(c\), \(s\), and \(hash_{c}\) from the proof \(\pi\). Then, the receiver computes the hash value of the encrypted image \(hash^{\prime}_{d}=H(Encrypt(I_{selective}(u,v)))\) and calculates \(c^{\prime}\) using Equation (18), followed by computing \(hash^{\prime}_{c}=H(c^{\prime}||hash^{\prime}_{d})\). If \(hash^{\prime}_{c}=hash_{c}\), it confirms that \(Encrypt(I_{selective}(u,v))\) was indeed generated by \(I_{selective}(u,v)\) and that the data maintained its integrity and authenticity during encryption and transmission.  
\[c^{\prime}=g^{s}\cdot(Encrypt(I_{selective}(u,v)))^{-hash_{c}}\bmod q \tag{18}\]