# Secret Image-Sharing Scheme Based on Multinode Authentication in the Internet of Things

Authors: Lina Zhang; Tong Wang; Xiangqin Zheng; Junhan Yang; Liping Lv
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Internet of things (IoT) has been developed and applied rapidly because of its huge commercial value in recent years. However, security problem has become a key factor restricting the development of IoT. The nodes of IoT are easy to be impersonated or replaced when attacked, which leads to the mistake of the uploaded data, the abnormal use of the application, and so on. Identifying the authenticity of the data submitted by the nodes is the top priority. We propose a scheme to verify the authenticity of multinode data. In this scheme, the authenticity of node data is checked through visual secret recovery and XOR operation together. The least significant bit (lsb) operation converts data from nodes into a bit, which improves the efficiency of data verification and reduces the risk of data leakage. This scheme achieves the purpose of verifying the data provided by the node, which avoids malicious attacks from illegal nodes. By analyzing the experiment result and comparing with other works, our scheme has the advantages of high verification efficiency, lightweight storage of nodes, and security verification.


---

## Body

## 1. Introduction

IOT (Internet of things) is a network based on information carriers such as the Internet and traditional telecommunications networks, allowing all ordinary physical objects that can be independently addressed to achieve interconnection [1]. It is an important part of a new generation of information technology, which has developed rapidly in recent years and has broad application prospects. With the upgrade of communication networks and the continuous development of IoT technology, its related services and related technologies [2–3] have been rapidly developed and popularized in all walks of life [4–8]. In IoT-related business, the label technology for identifying objects with unique identifiers has also received attention and a lot of research. Although IoT adopts the form of connecting things, it must rely on Internet technologies such as computer communication and information transmission. Therefore, in the IoT environment, there are security risks such as technical security issues, signal interference, malicious intrusion, and communication. In recent years, as an information carrier, images are widely used in various fields. Especially, in the related applications of IoT, image security is particularly important.The sensor node is an important part of IoT [9–11], mainly responsible for information collection, data transmission, and data fusion. Its important function has attracted the attention of criminals; physical packet capture and brute force cracking have become important ways of attacking the IoT. Once a node in the IoT is cracked, the attacker has a legal identity and can attack inside the IoT, pouring massive amounts of redundant data and causing network congestion. From this perspective, malicious nodes take a great threat for the IoT.In scheme [12], an integrated approach for authentication and access control is presented for communication with wireless sensor nodes in IoT networks, which provides strong protection against known attacks such as energy exhausting and Man-In-The-Middle. Li et al. [13] utilize blockchain technology, which serves as a secure tamper-proof distributed ledger to IoT devices. The processing method is to assign a unique ID for each individual device, recording them into the blockchain so that they can authenticate each other without a central authority. Lau et al. [14] use blockchain technology to authenticate IoT devices before it joins an IoT network. Based on the characteristics of blockchain, this method can be used to create the digital identification of IoT devices and authenticate them. However, the abovementioned schemes only verify the node and do not verify data stored by the nodes, so the attack of data tampering cannot be completely avoided.At present, the idea of protecting image security is to use secret sharing; secret shares can be stored in sensing nodes. In order to restore the original secret completely and effectively, we must check the legitimacy of shares from nodes. For this reason, we propose a nodes’ authentication in the IoT, which can reduce the storage space of every node and complete mutual authentication between nodes.Image security prevents the adversary from getting any information about the original image in transmission or storage. Encryption algorithm, information hiding, and secret sharing have been used in the field of image security [15–17]. Encryption [18] is using mature cryptographic algorithms to process digital images. However, the processed image is very different from the normal image, which may be attacked by adversary. Information hiding technology [19] is that it hides secret information in an image carrier. If the carrier is processed during transmission, the origin secret information can still be recovered with a low failure rate. However, if the image carrier is damaged or lost, secret information cannot be recovered. Fortunately, secret sharing plays an important role in preventing carriers from being lost, damaged, maliciously destroyed, or operated by criminals. Secret sharing is processing the secret image into multiple shares, and multiple participants commonly save the shares. The secret image can be reconstructed when the number of participants comes to the threshold. Even if part of the share destroyed or lost, the secret image still can be reconstructed. Obviously, secret sharing can solve the shortcomings of encryption algorithms and information hiding technologies. With the deepening of research, many secret-sharing schemes [20–23] have been designed and improved.Schemes [20–23] do not mention the share authentication. Many applications need identity authentication ability for program security, such as online banking [24], electronic voting [25], and e-commerce [26]. The verification-type secret-sharing scheme is that the processor processes the secret into several shares, and participants can verify the received shares. Therefore, the risk of the original secret and shares being leaked can be avoided. Chor [27] first proposes the concept of verification-type secret sharing. The verification work is mainly done through real-time webcasting. With the secret image-sharing scheme (SISS) widely used, share authentication has become especially important. Stadler [28] proposed an open verification-type secret-sharing scheme. Each participant in the scheme can verify the authenticity of the share; in addition, it will not cause any leakage of the original secret and share information. Unfortunately, the algorithm designed by Stadler cannot satisfy the real program requirements.In addition, there are many new verification-type schemes [22, 29–33]. Feldman [29] proposes a SISS. The method of this scheme is that the third party compares the submitted data with the original data and completes the purpose of authenticating the data. If the submitted data are found to be false, the secret recovery work will be stopped. Unfortunately, this scheme requires a large amount of information to be disclosed in advance, and there is a risk of information leakage. The scheme [30] divides the secret image into nonoverlapping L blocks with containing 2k−2 pixels. The processor constructs two k−1 degree polynomials for each block, calculating shares by relying on these two polynomials. In the verification phase, the processor checks the reconstructed two polynomials. If the same common integer exists between the two polynomials, the group of shares is correct; otherwise, the group of shares is forged. In fact, the scheme has some drawbacks, such as it cannot accurately screen out the forged shares and the reconstructed image is lossy. The scheme [22] is based on the symmetry of bivariate polynomial and the linearity of interpolation polynomial. However, this scheme has the disadvantages of lots of data calculation and low verification efficiency, and the verification accuracy is low.This paper focuses on nodes’ verification problem with/without a third party. The key of scheme is the combination of SISS and visual secret-sharing (VSS), which cleverly realizes nodes’ authentication under different occasions. The scheme involves two types of images: public binary image that is used as an authentication password image and secret image is shared as secret information. The scheme has the advantages of no pixel expansion, lossless recovery, and high certification accuracy. In addition, this scheme can reduce the amount of calculation to save storage space. It allows users to choose a model in the scheme according to their needs, which effectively increases the flexibility and practicability of the scheme.The rest of this article is organized as follows. Section2 introduces some preliminaries. Section 3 describes the motivation and contribution of our proposed schemes. Section 4 proposes a share verifiable image secret-sharing scheme. Section 5 analyzes the correctness and security of proposed scheme and compares with related work. Section 6 is a conclusion of the article.


## 2. Preliminaries

In this section, we represent many related concepts and schemes. Shamir’s secret-sharing scheme [34] based on Lagrange polynomials and the visual secret-sharing scheme based on random grids [35, 36] are introduced in this section. We combine these two schemes to achieve the purpose of share verification. In addition, we introduced related symbols that can be used in the scheme.


### 2.1. Shamir’s Secret-Sharing Scheme

In scheme [34], there are n shareholders U=U1,U2,…,Un and a mutually trusted dealer D. The scheme consists of two algorithms: share generation and secret reconstruction.Share generation: the dealerD selects a prime number p and random a degree polynomial fx=a0+a1x1+a2x2+⋯+ak−1xk−1modp, where all coefficients ai,i=1,2,…,k−1, are in zp. The secret S is equal to the constant term of fx, i.e., S=f0=a0; D picks n different positive integers x1,x2,…,xn from zp and computes Si=fxi for i=1,2,…,n. Finally, D distributes each share Si to the corresponding shareholder Ui securely and xi is public information associated with Ui.Secret reconstruction: suppose thatmm≥t shareholders U1,U2,…,Um team up for secret reconstruction. Each shareholder Ui sends his private share Si to the other shareholders. After that, a shareholder has m shares S1,S2,…,Sm, and it can use Lagrange interpolation polynomial to evaluate the secret S as(1)S=f0=∑i=1mSi∏j=1,j≠imxjxj−ximodp.


### 2.2. Random Grids (RG)-Based Visual Secret-Sharing (VSS) Scheme

RG-VSS [35] is a probabilistic visual secret-sharing scheme. 2,2 threshold RG-VSS is generally divided into two stages: the sharing stage and the recovery stage. At the same time, the black and white in the secret image are represented by 1 and 0, respectively.


#### 2.2.1. Secret Generation

Pseudorandom generations1c1 calculated s1c2 by(2)s1c2h,w=s1c2h,w,ifs1h,w=0,s1c2h,w¯,ifs1h,w=1,where s1h,w is the position of each pixel in the binary image s1, h represents the column coordinate of s1, w is that the row coordinate of s1, and s1c1h,w¯ denotes the negation of s1c1h,w.


#### 2.2.2. Secret Reconstruction

In equation (3), s1h,w=s1c1h,w⊗s1c2h,w. If s1h,w=1, the reconstruction result s1c1h,w⊗s1c2=h,w=s1c1h,w⊗s1c1h,w¯=1 is determined to be black. If secret pixel is s1=s1h,w=0, then the restored result s1c1⊗s1c2=s1c1h,w⊗s1c1h,w has a 50% chance to be black or white. Because s1c1 is pseudorandomly generated,(3)s1h,w=s1c1h,w⊗s1c2h,w=s1c2h,w,ifs1h,w=0,s1c2h,w¯,ifs1h,w=1,where the symbol ⊗ represents the meaning of stacking; other symbols have the same meaning as in equation (2).In fact, equation (2) can be seen as s1h,w=s1c1⊕s1c2h,w; thus, we can recover s1h,w in this way. ⊕ expresses the exclusive XOR operation.


### 2.3.K,N VSS-Based Random Grids (RG)

The scheme [36] proposes a k,n VSS scheme based on random grids. The sharing stage of the algorithm is as follows:Input: AM×N binary secret image S and a pair of threshold parameters k,n.Output:n shadows SCi,i=1,2,…,n.Step 1:
for each positionh,w∈h,w|1≤h≤M,1≤w≤N, repeat Steps 2 to 4Step 2:
sequentially calculateb1,b2,…,bk repeatedly using equation (2), where bx is the provisional pixels, x=1,2,…,nStep 3:
setbk+1=b1,bk+2=b2,…,b2k=bk,b2k+1=b1,… if nmodk=0,bn=bk, else bn=bnmodkStep 4:
arrangeb1,b2,…,bn to SC1,SC2,…,SCnStep 5:
outputn shadows SC1,SC2,…,SCn


### 2.4. Related Symbols

In this part, we give a table of summarizing the main used symbols in this paper for easy reading. They are shown in Table1.Table 1
Related symbols.
NumberSymbolsDescription1S2Secret image2S1Authentication image3pDivisible parameters4lsbxLeast significant bit processing5⊗Stacking operation6⊕XOR operation7WImage width8HImage height9⌞⌟Round down10s2ciShares generated byS211s1ciShadows ofS112thirShare of third party13blockiSubimage of secret image14amodpThe remainder ofa divided by p


## 2.1. Shamir’s Secret-Sharing Scheme

In scheme [34], there are n shareholders U=U1,U2,…,Un and a mutually trusted dealer D. The scheme consists of two algorithms: share generation and secret reconstruction.Share generation: the dealerD selects a prime number p and random a degree polynomial fx=a0+a1x1+a2x2+⋯+ak−1xk−1modp, where all coefficients ai,i=1,2,…,k−1, are in zp. The secret S is equal to the constant term of fx, i.e., S=f0=a0; D picks n different positive integers x1,x2,…,xn from zp and computes Si=fxi for i=1,2,…,n. Finally, D distributes each share Si to the corresponding shareholder Ui securely and xi is public information associated with Ui.Secret reconstruction: suppose thatmm≥t shareholders U1,U2,…,Um team up for secret reconstruction. Each shareholder Ui sends his private share Si to the other shareholders. After that, a shareholder has m shares S1,S2,…,Sm, and it can use Lagrange interpolation polynomial to evaluate the secret S as(1)S=f0=∑i=1mSi∏j=1,j≠imxjxj−ximodp.


## 2.2. Random Grids (RG)-Based Visual Secret-Sharing (VSS) Scheme

RG-VSS [35] is a probabilistic visual secret-sharing scheme. 2,2 threshold RG-VSS is generally divided into two stages: the sharing stage and the recovery stage. At the same time, the black and white in the secret image are represented by 1 and 0, respectively.


### 2.2.1. Secret Generation

Pseudorandom generations1c1 calculated s1c2 by(2)s1c2h,w=s1c2h,w,ifs1h,w=0,s1c2h,w¯,ifs1h,w=1,where s1h,w is the position of each pixel in the binary image s1, h represents the column coordinate of s1, w is that the row coordinate of s1, and s1c1h,w¯ denotes the negation of s1c1h,w.


### 2.2.2. Secret Reconstruction

In equation (3), s1h,w=s1c1h,w⊗s1c2h,w. If s1h,w=1, the reconstruction result s1c1h,w⊗s1c2=h,w=s1c1h,w⊗s1c1h,w¯=1 is determined to be black. If secret pixel is s1=s1h,w=0, then the restored result s1c1⊗s1c2=s1c1h,w⊗s1c1h,w has a 50% chance to be black or white. Because s1c1 is pseudorandomly generated,(3)s1h,w=s1c1h,w⊗s1c2h,w=s1c2h,w,ifs1h,w=0,s1c2h,w¯,ifs1h,w=1,where the symbol ⊗ represents the meaning of stacking; other symbols have the same meaning as in equation (2).In fact, equation (2) can be seen as s1h,w=s1c1⊕s1c2h,w; thus, we can recover s1h,w in this way. ⊕ expresses the exclusive XOR operation.


## 2.2.1. Secret Generation

Pseudorandom generations1c1 calculated s1c2 by(2)s1c2h,w=s1c2h,w,ifs1h,w=0,s1c2h,w¯,ifs1h,w=1,where s1h,w is the position of each pixel in the binary image s1, h represents the column coordinate of s1, w is that the row coordinate of s1, and s1c1h,w¯ denotes the negation of s1c1h,w.


## 2.2.2. Secret Reconstruction

In equation (3), s1h,w=s1c1h,w⊗s1c2h,w. If s1h,w=1, the reconstruction result s1c1h,w⊗s1c2=h,w=s1c1h,w⊗s1c1h,w¯=1 is determined to be black. If secret pixel is s1=s1h,w=0, then the restored result s1c1⊗s1c2=s1c1h,w⊗s1c1h,w has a 50% chance to be black or white. Because s1c1 is pseudorandomly generated,(3)s1h,w=s1c1h,w⊗s1c2h,w=s1c2h,w,ifs1h,w=0,s1c2h,w¯,ifs1h,w=1,where the symbol ⊗ represents the meaning of stacking; other symbols have the same meaning as in equation (2).In fact, equation (2) can be seen as s1h,w=s1c1⊕s1c2h,w; thus, we can recover s1h,w in this way. ⊕ expresses the exclusive XOR operation.


## 2.3.K,N VSS-Based Random Grids (RG)

The scheme [36] proposes a k,n VSS scheme based on random grids. The sharing stage of the algorithm is as follows:Input: AM×N binary secret image S and a pair of threshold parameters k,n.Output:n shadows SCi,i=1,2,…,n.Step 1:
for each positionh,w∈h,w|1≤h≤M,1≤w≤N, repeat Steps 2 to 4Step 2:
sequentially calculateb1,b2,…,bk repeatedly using equation (2), where bx is the provisional pixels, x=1,2,…,nStep 3:
setbk+1=b1,bk+2=b2,…,b2k=bk,b2k+1=b1,… if nmodk=0,bn=bk, else bn=bnmodkStep 4:
arrangeb1,b2,…,bn to SC1,SC2,…,SCnStep 5:
outputn shadows SC1,SC2,…,SCn


## 2.4. Related Symbols

In this part, we give a table of summarizing the main used symbols in this paper for easy reading. They are shown in Table1.Table 1
Related symbols.
NumberSymbolsDescription1S2Secret image2S1Authentication image3pDivisible parameters4lsbxLeast significant bit processing5⊗Stacking operation6⊕XOR operation7WImage width8HImage height9⌞⌟Round down10s2ciShares generated byS211s1ciShadows ofS112thirShare of third party13blockiSubimage of secret image14amodpThe remainder ofa divided by p


## 3. Motivation and Contributions

In our life, digital images are used widely, such as copyrighted pictures and QR codes. At this stage, how to ensure the correctness and completeness of the digital image has become very important. In order to solve problems mentioned, we use secret image sharing to solve image security issues, which can more effectively guarantee the integrity and correctness of the image. We propose a scheme combining the traditional SISS with visual secret sharing. It can complete the verification of the share verification work in a visual way. At the same time, considering the interactive and noninteractive protocols, we design two types of algorithms that satisfy real-life scenarios and the needs of different users.The strategy is that nodes in the Internet of things are regarded as participants in our scheme. The shares of participants are considered nodes’ data. In the data fusion stage, verifying data submitted by the participants to ensure that the final result is correct.We have four pictures to explain the purpose of our scheme. The scheme involves two roles: participants and a third party. In order to allow readers to better understand the application scenarios of the scheme, assume that there is only one dishonest participant in the scheme to carry out the attack, and all cases are based on3,4 threshold. In addition, we also analyze the processing ideas when there are multiple dishonest participants.For Case 1:3,4 secret sharing with a third party when there is no dishonest participant, in Figure 1, the third party can recover the original secret by obtaining the shadows of any three participants.Figure 1
Case 1:3,4 threshold SISS with a third party.Figure2 describes Case 2: 3,4 secret sharing with a third party when there is a dishonest participant. Any three participants send their shadows to the third party; if the third party finds a false share, it stops recovering the secret and broadcast dishonest participants to others.Figure 2
Case 2:3,4 threshold SISS with a third party when there is a fake participant.For Case 3:3,4secret-sharing scheme without a third party when there is not fake participant, in figure 3, any three participants send their private shares to other participants and authenticate each other. Actually, each participant can receive two shares from others if all the shares are verified to be correct, and the original secret can be recovered.Figure 3
Case 3:3,4 threshold SISS without a third party when there is no fake participant.For Case 4:3,4 threshold secret sharing without a third party when there is a fake participant, in Figure 4, for dishonest participant P1, participant P2, and participant P3, they send their private shares to each other, and then, each participant verifies the shares of the other two participants. P2 and P3 detected that the fake share is sent by P1, then stopped refactoring the secret, and broadcasted the fake behavior of P1 to P4.Figure 4
Case 4:3,4 threshold SISS without a third party when there is a fake participant.The above cases only describe the existence of one forger, which should be done if there are multiple forgers.The third-party verification model is still feasible; however, the model of mutual authentication between participants must rely on the voting mechanism.Suppose thatk participants complete the secret reconstruction work. Each participant authenticates other k−1 participant’s shadow and votes for them. If any participant gains k−1 votes (note: dishonest participants are afraid of revealing their identities and give up voting opportunities), we determine that the participants in the group are honest. If any participant gains less than k−1 votes, we let the remaining n−k participants perform auxiliary verification. The remaining participants vote for the k participants. If any of the k participants gains less than T=⌊n−1/2⌋ votes from n−1 participants, we determine that this participant is dishonest. In contrast, if the number of votes more than T=⌊n−1/2⌋, we judge that if more than half of the T votes are true; the participant is considered to be honest; otherwise, the participant is dishonest. Therefore, the scheme stipulates more than T=⌊n/2⌋+1 honest participants among all n participants to achieve the threshold.


## 4. Secret Image-Sharing Scheme with Shares’ Verifiable

In this section, we describe the specific algorithms for the two types of models. The first model is designed for batch verification. In the secret-sharing phase, we first process then shares generated by the secret image S2. Then, let the n shadows generated by the authentication image S1 match the processed n shares. If the matching is unsuccessful, let S1 regenerate new shadows with the help of the k,n VSS scheme and perform the matching again until it succeeds. After the match is successful, one of the n shadows is selected and sent to the third party (since the k,n VSS scheme can only generate k kinds of shadows, and n is an integer multiple of k), denoted as thir. Assuming that we want to know quickly whether there is a dishonest participant among a group of participants, the third party uses the private shadow thir and the submitted share to calculate for judgment. If equation lsbs2c1⊕,…,⊕ lsb s2ci⊕thir≜⊘ for i∈i,k (s2ci represents the submitted shares) holds, there is no dishonest participant in this group; on the contrary, there is a dishonest participant.The second model is that participants verify each other, which can screen out dishonest participants. Each participant in a group sends private share to otherk−1 participants. Next, participants use their own computing power to judge the received shares and then vote on them. Finally, judging dishonesty by voting results, the specific voting mechanism has been specified in the third part, so we will not describe it in detail here.The specific steps of the two models have been described in Algorithm 1 and Algorithm 2 as follows.


### 4.1. Algorithm 1

Input: a secret imageS2 with H×W, a authentication image S1 with H×W/k, and the threshold parameters k,n, 2≦k≦⌊n/2⌋.Output: shadowss2c1,s2c2,…,s2cn and a binary authentication shadow thir.Step 1:
a prime numberp=257. Dividing S2 into L nonoverlapping subimages of size is H×W/k, and subimages are expressed as block1,block2,…,blockL.Step 2:
construct a polynomial of degreek−1, which is shown as(4)fx=a0+a1x1+⋯+ak−1xk−1modp.Then, calculates2ci=fx, i∈1,n, where the coefficient a0,a1,…,ak−1 is taken from blocki,i∈1,L.Step 3:
utilizek,n RG-VSS to split S1h,w to n temporary bits and denote as b1,b2,…,bn. Assign b1,b2,…,bn to s1c1,s1c2,…,s1cn.Note:1≤h≤H,1≤w≤W/k.Step 4:
define a sequenceseq=1,2,…,n, scrambling seq to generate an new sequence seq1=u1,u2,…,un. Going to execute Step 5, otherwise execute Step3.Where lsbx means that it gets the least significant bit of x.Step 5:
if a third party exists, go to execute step 6, otherwise execute Step 7.Step 6:
randomly pick a numbers fromb1,b2,…,bk, denoted as thir. thir is assigned to the third party.Step 7:
assign specify sharess2cj,j=u1,u2,…,un, to s2ci,i∈1,n.For Algorithm 1,(1)
We set a prime numberp=257 to guarantee the value of the shadows pixel is within [0, 255] and lossless recovery by effective shares.(2)
use polynomials to ensure that there is no pixel expansion.(3)
Step 4 and Step 5 cooperate to achieve shares’ authentication when a third party exists.(4)
have restrictions on the relationship betweenk and n, in which suggestion is n/k≤3/5.


### 4.2. Algorithm 2

Input: obtaink shares from s2ci,i∈1,n, the public password binary image S1, and verification share thir held by the third party.Output: recovered secret imageS2.Step 1:
if the third party verifies shares, firstly, calculate the result of theK shares, and they are expressed as lscj= lsb s2ci,j∈1,k,i∈1,n. Then, through the stacking or XORing operation the number of lscj and thir, the result is recorded as S1∗. If S1∗ is recognized as S1 by HVS or S1∗=S1, the shares are valid, and go to Step 3. Otherwise, there is forgery among the k participants, and it broadcasts the dishonest person’s message to other participants in the group.Step 2:
if participants authenticate each other, each participant sends his shares2ci to other k−1 participants. All participants process received k−1 shares; the processing result is expressed as lscj= lsb s2ci,j∈1,k,i∈1,n. Next, each participant relies on stacking or XOR to complete the processing of all lscj,j∈1,k−1 and own share s2ci,i∈1,n. The processing result is recorded as S1∗. If S1∗ is recognized as S1 by HVS or S1∗=S1, the k participants are all honest and go to Step 3; Otherwise, use voting mechanism to complete shares’ authentication.Step 3:
recovering all subimagesblocki,i∈1,L, repeat Step 4 to Step 5.Step 4:
constructing the interpolation polynomial (5) through valid shares,(5)fi1=a0+a1i11+⋯+ak−1i1k−1modp,fi2=a0+a1i21+⋯+ak−1i2k−1modp,⋮fik=a0+aik1+⋯+ak−1ikk−1modp,where1≤i≤L.Step 5:
computinga0,a1,…,ak−1.Step 6:
outputting reconstruction secretsS2.For Algorithm 2,(1)
In Step 2, every participant authenticates otherk−1 participants here. If k number of S1∗ is recognized as S1 by HVS or S1∗=S1, the authentication result is true, and go to Step 3.(2)
The authentication ways of the two models are different. When participants authenticate each other, the voting mechanism will be carried out.


## 4.1. Algorithm 1

Input: a secret imageS2 with H×W, a authentication image S1 with H×W/k, and the threshold parameters k,n, 2≦k≦⌊n/2⌋.Output: shadowss2c1,s2c2,…,s2cn and a binary authentication shadow thir.Step 1:
a prime numberp=257. Dividing S2 into L nonoverlapping subimages of size is H×W/k, and subimages are expressed as block1,block2,…,blockL.Step 2:
construct a polynomial of degreek−1, which is shown as(4)fx=a0+a1x1+⋯+ak−1xk−1modp.Then, calculates2ci=fx, i∈1,n, where the coefficient a0,a1,…,ak−1 is taken from blocki,i∈1,L.Step 3:
utilizek,n RG-VSS to split S1h,w to n temporary bits and denote as b1,b2,…,bn. Assign b1,b2,…,bn to s1c1,s1c2,…,s1cn.Note:1≤h≤H,1≤w≤W/k.Step 4:
define a sequenceseq=1,2,…,n, scrambling seq to generate an new sequence seq1=u1,u2,…,un. Going to execute Step 5, otherwise execute Step3.Where lsbx means that it gets the least significant bit of x.Step 5:
if a third party exists, go to execute step 6, otherwise execute Step 7.Step 6:
randomly pick a numbers fromb1,b2,…,bk, denoted as thir. thir is assigned to the third party.Step 7:
assign specify sharess2cj,j=u1,u2,…,un, to s2ci,i∈1,n.For Algorithm 1,(1)
We set a prime numberp=257 to guarantee the value of the shadows pixel is within [0, 255] and lossless recovery by effective shares.(2)
use polynomials to ensure that there is no pixel expansion.(3)
Step 4 and Step 5 cooperate to achieve shares’ authentication when a third party exists.(4)
have restrictions on the relationship betweenk and n, in which suggestion is n/k≤3/5.


## 4.2. Algorithm 2

Input: obtaink shares from s2ci,i∈1,n, the public password binary image S1, and verification share thir held by the third party.Output: recovered secret imageS2.Step 1:
if the third party verifies shares, firstly, calculate the result of theK shares, and they are expressed as lscj= lsb s2ci,j∈1,k,i∈1,n. Then, through the stacking or XORing operation the number of lscj and thir, the result is recorded as S1∗. If S1∗ is recognized as S1 by HVS or S1∗=S1, the shares are valid, and go to Step 3. Otherwise, there is forgery among the k participants, and it broadcasts the dishonest person’s message to other participants in the group.Step 2:
if participants authenticate each other, each participant sends his shares2ci to other k−1 participants. All participants process received k−1 shares; the processing result is expressed as lscj= lsb s2ci,j∈1,k,i∈1,n. Next, each participant relies on stacking or XOR to complete the processing of all lscj,j∈1,k−1 and own share s2ci,i∈1,n. The processing result is recorded as S1∗. If S1∗ is recognized as S1 by HVS or S1∗=S1, the k participants are all honest and go to Step 3; Otherwise, use voting mechanism to complete shares’ authentication.Step 3:
recovering all subimagesblocki,i∈1,L, repeat Step 4 to Step 5.Step 4:
constructing the interpolation polynomial (5) through valid shares,(5)fi1=a0+a1i11+⋯+ak−1i1k−1modp,fi2=a0+a1i21+⋯+ak−1i2k−1modp,⋮fik=a0+aik1+⋯+ak−1ikk−1modp,where1≤i≤L.Step 5:
computinga0,a1,…,ak−1.Step 6:
outputting reconstruction secretsS2.For Algorithm 2,(1)
In Step 2, every participant authenticates otherk−1 participants here. If k number of S1∗ is recognized as S1 by HVS or S1∗=S1, the authentication result is true, and go to Step 3.(2)
The authentication ways of the two models are different. When participants authenticate each other, the voting mechanism will be carried out.


## 5. Experimental Results and Analysis

In this part, we will give some experiments to verify the feasibility and effectiveness of the proposed scheme. In addition, we also analyze and compare our scheme with other schemes in detail.


### 5.1. Experimental Results

The operating environment required for this experiment is as follows: Windows10, CPU (2.60 GHz inter(R) i7-9750H CPU), 64G RAM, and Matlab application.Due to the characteristics of no pixel expansion of the proposed SIS, the size of the secret image is 132× 132 in our experiments. Here, we introduce the experimental results of 4,8 threshold.Figure5 shows the experimental results of different verification modes. As we can see all, the secret S2 is a in Figure 5, the authentication image S1 is b in Figure 5, and picture c−j denotes the output shares s2c1,s2c2,s2c3,s2c4,s2c5,s2c6,s2c7,s2c8. Result of s2c1,s2c2,s2c3,s2c4,s2c5,s2c6,s2c7,s2c8 processed by lsb  is displayed in pictures k−r.Figure 5
S2 generated shares and the processing results of all shares. (a) S2. (b) S1. (c) s2c1. (d) s2c2 (e) s2c3 (f) s2c4. (g) s2c5 (h) s2c6 (i) s2c7 (j) s2c8. (k) lsb(s2c1) (l) lsb(s2c2) (m) lsb(s2c3) (n) lsb(s2c4). (o) lsb(s2c5) (p) lsb(s2c6) (q) lsb(s2c7) (r) lsb(s2c8)
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)Figure6 of a−h represent many shadows s1c1,s1c2,s1c3,s1c4,s1c5,s1c6,s1c7,s1c8 produced by S1, satisfying s1cih,w= lsb s2cj,i∈1,8,j∈u1,u8, and s1c4 is sent to the third party as a verification password. Picture i illustrates a fake share which is denoted by wro. Picture j−m denotes results through the XORing operations of S1 and s2c1,s2c2,s2c3,s2c4; finally, the recovered result can be well recognized. Thus, the shares s2c1,s2c2,s2c3,s2c4 have passed the third-party verification; shares s2c1,s2c2,s2c3,s2c4 can be used in secret reconstruction work.Figure 6
The shadow generated byS1 and the verification result of the submitted shares. (a) s1c1. (b) s1c2 (c) s1c3 (d) s1c4. (e) s1c5 (f) s1c6 (g) s1c7 (h) s1c8. (i) wro (j) lsb (s2c1), (k) lsb (s2c1) ⊕ lsb (s2c2), (l) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3), (m) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3) ⊕ lsb (s2c4), (n) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3) ⊕ lsb (wro), (o) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3) ⊕ lsb (s2c4), (p) lsb (s2c2) ⊕ lsb (s2c1) ⊕ lsb (s2c3) ⊕ lsb (s2c4), (q) lsb (s2c3) ⊕ lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c4), (r) lsb (s2c4) ⊕ lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3).
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)Supposing there is a dishonest participant, which is shown in Figure6 of i is wro and shares s2c1,s2c2,s2c3 want to join the secret S2 reconstruction work, the third party verifies the provided shares s2c1,s2c2,s2c3,wro. The result is presented in Figure 6 of n. So, there are faked shares in this group. The third party stops the recovery of the secret S2 and looks for new effective shares.Each participant acts as a restructioner; they will verify the received sharesk−1. Suppose the share s2c1 saved by participant P1, the share s2c2 saved by participant P2, the share s2c3 saved by participant P3, and the share s2c4 saved by participant P4. P1,P2,P3,P4 verify the received k−1 shares; results are shown in figure of 0−r. So, shares provided by the participants P1,P2,P3,P4 are valid. If P1 provided a forged, we use the voting mechanism to vote for P1,P2,P3,P4 and finally screen out dishonest participants P1.


### 5.2. Safety and Correctness Analysis

We analyze the security and correctness of the proposed scheme. Note that the gray secret imageS2 and binary password image S1 are not related in the scheme. In addition, the obtained k restored pixel values are expressed as s2ci,i∈1,k; the third party is expressed as sk and holds data ths. The attacker is represented as ak.Lemma 1.
Since the pixel value in the gray secret imageS2 is limited to [0,255], the shadows s2ci,i∈1,k required to be generated are limited to [0,255].Proof.
Because the pixel value of the secret image isS2 limited in[0,255], in the S2 sharing stage, the generated shadows s2ci must satisfy s2ci<p−1,i∈1,n,p=257. Therefore, the pixel of sharing shadows s2ci is limited in [0,255].Theorem 1.
When the data saved by the node is attacked, a single data cannot reveal any information ofS2.Proof.
Since the scheme in this paper is based on Lagrange secret sharing.S2 is shared into n data that are stored by nodes; these data do not carry any information of S2. At the same time, the security features are derived from the threshold, and only k valid data can recover the secret S2.Theorem 2.
The two types’ modes in the scheme can realize the legitimacy detection of node data, ensuring that the recovered secretS2 is correct.Proof.
The scheme stipulates that more than 51% of the node data will not be attacked, and the third party is credible. When the third party verifies the data, avoidsk colluding with ak to tamper with the verification result of data. When participants authenticate each other and when the voting mechanism is used to determine the accuracy of the data, since the proportion of the attacked data is set, malicious participants can be prevented from jointly affecting the accuracy of the data verification result. Therefore, both verification modes are safe during data verification.Theorem 3.
The secret imageS2 can be restored lossless through k shadows s2ci,i∈1,k.Proof.
In the recovery phase,a0 and ai,i∈1,k−1 can be calculated by the Lagrange interpolation formula. Because Lemma 1 has proved that all shadows s2ci<p−1; finally, the secret reconstructed by shadows is also lossless.Theorem 4.
Both the third-party verification model and the participant’s mutual verification model can run correctly, completing the task of efficiently and accurately screening forged data.Proof.
In the first mode, the verification key is held bysk; in addition, sk is honest in the scheme. During the verification phase, we just need to judge whether lsb s2ci⊕ths≠⊘,i∈1,k or lsb s2ci⊕ths=⊘. If the final result is not ⊘, the data are judged to be forged. In the second mode, each participant submits data to other k−1 people, and the participants vote for each other. The algorithm stipulates that dishonest persons cannot vote, and there are more than 51% honest persons among n participants. The principle of the voting mechanism is that the minority obeys the majority. We record the number of votes among the k participants, and the number of votes is equal k−1; we judge the participant to be honest; otherwise, let the remaining n−k participants help with authentication. Finally, by determining the proportion of all votes that is true for each participant, participants who have true votes more than half of the total votes are considered honest.


### 5.3. Experimental Example

Let us take the threshold (4,8) as an example. Supposing the secret imageS2 is composed of block=153,154,154,152, the authentication image S1 is S1h,w=0.In shares’ generation phase, first of all, we construct the polynomial, which isfx=153+154x1+154x2+152x3. Next, the processor goes to calculate the eight shares; they are s2c1=f1, s2c2=f2, s3c2=f3, s2c4=f4, s2c5=f5, s2c6=f6, s2c7=f7, and s2c8=f8 and are generated by the secret image S2. And, the processor uses (4,8) RG-VSS to generate shadows s1c1h,w=1,s1c2h,w=0,s1c3h,w=0,s1c4h,w=1,s1c5h,w=1,s1c6h,w=0,s1c7h,w=0,ands1c8h,w=1 from S1h,w. Next, the dealer executes the most important step that determine whether requirement s1cih,w= lsb s2cj, for i∈1,8andj∈u1,u8 is satisfied. If the result is not satisfied, the requirement re-executes (4,8) RG-VSS until the requirement is satisfied. If the result is a match, S1 is assigned to the third party, assuming that the calculated result satisfies the requirement.In the shares’ authentication phase, when the third party is responsible for verifying and recovering secret imageS2, the third party uses the verification algorithm to calculate that lsb s2c1⊕ lsb s2c2⊕ lsb s2c3⊕ lsb s2c4⊕S1=1⊕0⊕0⊕1⊕0=⊘, and the remaining shares, that is, lsb s2c5⊕ lsb s2c6⊕ lsb s2c7⊕ lsb s2c8⊕S1=1⊕0⊕0⊕1⊕0=⊘, as we know that these shares s2c1,s2c2,s2c3,s2c4,s2c5,s2c6,s2c7,s2c8 are valid. If the result of the third-party calculation is not ⊘, it means that there are one or more invalid shares in the group. When participants authenticate each other, each participant will receive shares sent by 3 people. Participants verify the received shares and then vote for the owners of the shares. If each of the 4 participants gets 3 votes, the 4 participants are judged to be honest. If any of the 4 participants gets less than 3 votes, then the remaining 4 participants will be requested to give auxiliary verification. Finally, if any of the 4 participants gets less than 3 votes, the participant is considered dishonest. If 4 participants get more than 3 votes, we check whether the proportion of true in the total votes exceeds half. If it exceeds 50%, we judge that the participant is honest; otherwise, the participant is dishonest.If the four sharess2c1=99,s2c2=237,s2c2=194,s2c2=111 pass verification, they can be used for secret S2 reconstruction work. Using equation (6) to calculate S2 pixel,(6)f1=a0+a1+a2+a3mod257,f2=a0+a121+a222+a323mod257,f3=a0+a131+a232+a333mod257,f4=a0+a141+a242+a343mod257,the result is a0=153,a1=154,a2=154,anda3=152 by Lagrange interpolation. Thus, the secret S2 is successfully restored.


### 5.4. Comparisons with Relative Schemes

In this part, we compare the proposed scheme with related schemes [22, 30] from many aspects, showing the advantages of our proposed scheme. First of all, we discuss the size of share. In the secret-sharing scheme, the degree of the constructed polynomial depends on the threshold of the scheme. In addition, there are also different ways to select coefficients in polynomials. In our scheme, the coefficient values in the constructed polynomial all come from the secret image. Thus, the size of the generated share is 1/k times original secret, expressed as 1/k×H×W. In the scheme [30], the scheme is dividing the original image into L nonoverlapping blocks, and each block contains 2k pixels. The processor constructs two polynomials of degree k−1 for each block, and the coefficients of each polynomial all come from this block. In this way, the size of the share is 1/k times the original image, denoted as 1/k−1×H×W. In the scheme [22], only one coefficient in the polynomial comes from the secret image, and the remaining k−1 coefficients are obtained from the processor data so that the size of the share is the same as the original image, which is H×W.Analyzing the efficiency of share generation in the encryption phase, in our scheme, first, we perform lsb processing on the calculated share s2ci, and the processed results are matched with shadows from the authentication image S1. Ideally, the matching can be done only once, and in the worst case, it takes times to complete. In the scheme [30], the first step is to divide the secret image into nonrepeated blocks Bi,i∈1,L,Bi=ai,0,…,ai,k−1,bi,0,…,bi,k−1, and then, the processor randomly selects an integer ri to satisfy riai,0+bi,0=0andriai,1+bi,1=0. Fortunately, it only needs one time; in the worst case, it needs n times. In scheme [22], the processor chooses a symmetric bivariate polynomial Fx,y of degree k−1. The secret S2 is hidden in the constant term by Fx,y. In any case, encryption can be completed at one time.We discuss the certification efficiency of the certification party. In scheme [22], the verifier holds the share size as H×W, who only needs to use the private share to compare with the provided share. Here, we mark the authentication efficiency of the scheme is ef1. In our scheme, the third party determines whether the provided share is true or false through an exclusive OR operation. The share size saved by the third party is H×W/k; therefore, the verification efficiency will be improved. Because our scheme has the same verification way as scheme [22], and the size of the share held by the verifier is reduced. Marking certification efficiency is ef2=k×ef1 in our scheme. In scheme, the size of the private share stored by authenticator is H×W/k−1; obviously, the verification efficiency in [30] also is improved, denoted as ef3=k−1×ef1.Table2 shows the differences between our scheme and related schemes in three aspects: verification efficiency, encryption efficiency, and share size. Table 2 visually shows the performance comparison between our scheme and related schemes [22, 30] (note: here, we mark both the encryption efficiency and verification efficiency of Scheme [22] as 100%).Table 2
Performance comparison between our scheme and related schemes [22, 30].
SchemeOur scheme[30][22]Verification efficiencyk×100%k−1×100%100%Encryption efficiencyk×100%2k−2×100%100%Share sizeH×W/kH×W/k−1H×WTable3 covers four aspects. Readers can see differences between our scheme and related schemes more intuitively. Our scheme includes the advantages of simple share authentication method, no pixel expansion, and lossless recovery of secret.Table 3
Comparison of our scheme, scheme [30], and scheme [22].
SchemeOur scheme[30][22]Authentication operationVCS (XOR/OR)Common valueCommon valuePixel expansionNONOYESRestructureLagrangeLagrangeLagrangeReconstruction qualityLossesLossLossWe compare related schemes [12, 14, 22, 30] with our scheme from multisecurity perspectives, as shown in Table 4.Table 4
Security comparison.
SchemeOur scheme[30][22][12][13][14]Information hidingYESYESYESNONONODecentralizedNONONOYESYESYESChannel securityYESYESNONONONOImpersonation attackYESYESYESYESYESYESReplay attackYESYESYESYESYESYESHierarchical accessYESNONONONONOWe assume that the size of the secret image is132×132 PX and calculate the specific size of the shadow of the related scheme according to the conclusion in Table 2. The bar chart shows result in Figure 7, the comparison of the shares’ size in three schemes. Readers can see the difference more intuitively. We select the thresholds k are 4, 5, 6, 7, 8, and 9 and then accurately obtain the results of the corresponding schemes.Figure 7
Bar graph of shadow size under different thresholds.In our scheme, the coefficient values in the constructed polynomial all come from the secret image. Thus, the size of the generated shadow is1/k times original secret. In the scheme [30], the scheme is dividing the original image into L nonoverlapping blocks, and each block contains 2k−2 pixels. The processor constructs two polynomials of degree k−1 for each block, and the coefficients of each polynomial all come from this block. In this way, the size of the share is 1/k times the original image. In the scheme [22], only one coefficient in the polynomial comes from the secret image, and the remaining k−1 coefficients are obtained from the processor data so that the size of the share is the same as the original image, which is H×W. In the final equivalent size secret analysis result, the encryption efficiency of our scheme is kf, scheme [30] is f (note: assume that the encryption efficiency of [30] is f), and [22] is k+1f. Figure 8 reflects the result. Here, we take the scheme [30] as a benchmark to better present the encryption effect of our scheme and scheme [22]. We adopt the thresholds k are 4, 5, 6, 7, 8, and 9, respectively. It achieves the purpose of readers to understand the comparison results of related schemes more quickly and effectively.Figure 8
Line graph of shadow encryption efficiency under different thresholds.


## 5.1. Experimental Results

The operating environment required for this experiment is as follows: Windows10, CPU (2.60 GHz inter(R) i7-9750H CPU), 64G RAM, and Matlab application.Due to the characteristics of no pixel expansion of the proposed SIS, the size of the secret image is 132× 132 in our experiments. Here, we introduce the experimental results of 4,8 threshold.Figure5 shows the experimental results of different verification modes. As we can see all, the secret S2 is a in Figure 5, the authentication image S1 is b in Figure 5, and picture c−j denotes the output shares s2c1,s2c2,s2c3,s2c4,s2c5,s2c6,s2c7,s2c8. Result of s2c1,s2c2,s2c3,s2c4,s2c5,s2c6,s2c7,s2c8 processed by lsb  is displayed in pictures k−r.Figure 5
S2 generated shares and the processing results of all shares. (a) S2. (b) S1. (c) s2c1. (d) s2c2 (e) s2c3 (f) s2c4. (g) s2c5 (h) s2c6 (i) s2c7 (j) s2c8. (k) lsb(s2c1) (l) lsb(s2c2) (m) lsb(s2c3) (n) lsb(s2c4). (o) lsb(s2c5) (p) lsb(s2c6) (q) lsb(s2c7) (r) lsb(s2c8)
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)Figure6 of a−h represent many shadows s1c1,s1c2,s1c3,s1c4,s1c5,s1c6,s1c7,s1c8 produced by S1, satisfying s1cih,w= lsb s2cj,i∈1,8,j∈u1,u8, and s1c4 is sent to the third party as a verification password. Picture i illustrates a fake share which is denoted by wro. Picture j−m denotes results through the XORing operations of S1 and s2c1,s2c2,s2c3,s2c4; finally, the recovered result can be well recognized. Thus, the shares s2c1,s2c2,s2c3,s2c4 have passed the third-party verification; shares s2c1,s2c2,s2c3,s2c4 can be used in secret reconstruction work.Figure 6
The shadow generated byS1 and the verification result of the submitted shares. (a) s1c1. (b) s1c2 (c) s1c3 (d) s1c4. (e) s1c5 (f) s1c6 (g) s1c7 (h) s1c8. (i) wro (j) lsb (s2c1), (k) lsb (s2c1) ⊕ lsb (s2c2), (l) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3), (m) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3) ⊕ lsb (s2c4), (n) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3) ⊕ lsb (wro), (o) lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3) ⊕ lsb (s2c4), (p) lsb (s2c2) ⊕ lsb (s2c1) ⊕ lsb (s2c3) ⊕ lsb (s2c4), (q) lsb (s2c3) ⊕ lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c4), (r) lsb (s2c4) ⊕ lsb (s2c1) ⊕ lsb (s2c2) ⊕ lsb (s2c3).
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)Supposing there is a dishonest participant, which is shown in Figure6 of i is wro and shares s2c1,s2c2,s2c3 want to join the secret S2 reconstruction work, the third party verifies the provided shares s2c1,s2c2,s2c3,wro. The result is presented in Figure 6 of n. So, there are faked shares in this group. The third party stops the recovery of the secret S2 and looks for new effective shares.Each participant acts as a restructioner; they will verify the received sharesk−1. Suppose the share s2c1 saved by participant P1, the share s2c2 saved by participant P2, the share s2c3 saved by participant P3, and the share s2c4 saved by participant P4. P1,P2,P3,P4 verify the received k−1 shares; results are shown in figure of 0−r. So, shares provided by the participants P1,P2,P3,P4 are valid. If P1 provided a forged, we use the voting mechanism to vote for P1,P2,P3,P4 and finally screen out dishonest participants P1.


## 5.2. Safety and Correctness Analysis

We analyze the security and correctness of the proposed scheme. Note that the gray secret imageS2 and binary password image S1 are not related in the scheme. In addition, the obtained k restored pixel values are expressed as s2ci,i∈1,k; the third party is expressed as sk and holds data ths. The attacker is represented as ak.Lemma 1.
Since the pixel value in the gray secret imageS2 is limited to [0,255], the shadows s2ci,i∈1,k required to be generated are limited to [0,255].Proof.
Because the pixel value of the secret image isS2 limited in[0,255], in the S2 sharing stage, the generated shadows s2ci must satisfy s2ci<p−1,i∈1,n,p=257. Therefore, the pixel of sharing shadows s2ci is limited in [0,255].Theorem 1.
When the data saved by the node is attacked, a single data cannot reveal any information ofS2.Proof.
Since the scheme in this paper is based on Lagrange secret sharing.S2 is shared into n data that are stored by nodes; these data do not carry any information of S2. At the same time, the security features are derived from the threshold, and only k valid data can recover the secret S2.Theorem 2.
The two types’ modes in the scheme can realize the legitimacy detection of node data, ensuring that the recovered secretS2 is correct.Proof.
The scheme stipulates that more than 51% of the node data will not be attacked, and the third party is credible. When the third party verifies the data, avoidsk colluding with ak to tamper with the verification result of data. When participants authenticate each other and when the voting mechanism is used to determine the accuracy of the data, since the proportion of the attacked data is set, malicious participants can be prevented from jointly affecting the accuracy of the data verification result. Therefore, both verification modes are safe during data verification.Theorem 3.
The secret imageS2 can be restored lossless through k shadows s2ci,i∈1,k.Proof.
In the recovery phase,a0 and ai,i∈1,k−1 can be calculated by the Lagrange interpolation formula. Because Lemma 1 has proved that all shadows s2ci<p−1; finally, the secret reconstructed by shadows is also lossless.Theorem 4.
Both the third-party verification model and the participant’s mutual verification model can run correctly, completing the task of efficiently and accurately screening forged data.Proof.
In the first mode, the verification key is held bysk; in addition, sk is honest in the scheme. During the verification phase, we just need to judge whether lsb s2ci⊕ths≠⊘,i∈1,k or lsb s2ci⊕ths=⊘. If the final result is not ⊘, the data are judged to be forged. In the second mode, each participant submits data to other k−1 people, and the participants vote for each other. The algorithm stipulates that dishonest persons cannot vote, and there are more than 51% honest persons among n participants. The principle of the voting mechanism is that the minority obeys the majority. We record the number of votes among the k participants, and the number of votes is equal k−1; we judge the participant to be honest; otherwise, let the remaining n−k participants help with authentication. Finally, by determining the proportion of all votes that is true for each participant, participants who have true votes more than half of the total votes are considered honest.


## 5.3. Experimental Example

Let us take the threshold (4,8) as an example. Supposing the secret imageS2 is composed of block=153,154,154,152, the authentication image S1 is S1h,w=0.In shares’ generation phase, first of all, we construct the polynomial, which isfx=153+154x1+154x2+152x3. Next, the processor goes to calculate the eight shares; they are s2c1=f1, s2c2=f2, s3c2=f3, s2c4=f4, s2c5=f5, s2c6=f6, s2c7=f7, and s2c8=f8 and are generated by the secret image S2. And, the processor uses (4,8) RG-VSS to generate shadows s1c1h,w=1,s1c2h,w=0,s1c3h,w=0,s1c4h,w=1,s1c5h,w=1,s1c6h,w=0,s1c7h,w=0,ands1c8h,w=1 from S1h,w. Next, the dealer executes the most important step that determine whether requirement s1cih,w= lsb s2cj, for i∈1,8andj∈u1,u8 is satisfied. If the result is not satisfied, the requirement re-executes (4,8) RG-VSS until the requirement is satisfied. If the result is a match, S1 is assigned to the third party, assuming that the calculated result satisfies the requirement.In the shares’ authentication phase, when the third party is responsible for verifying and recovering secret imageS2, the third party uses the verification algorithm to calculate that lsb s2c1⊕ lsb s2c2⊕ lsb s2c3⊕ lsb s2c4⊕S1=1⊕0⊕0⊕1⊕0=⊘, and the remaining shares, that is, lsb s2c5⊕ lsb s2c6⊕ lsb s2c7⊕ lsb s2c8⊕S1=1⊕0⊕0⊕1⊕0=⊘, as we know that these shares s2c1,s2c2,s2c3,s2c4,s2c5,s2c6,s2c7,s2c8 are valid. If the result of the third-party calculation is not ⊘, it means that there are one or more invalid shares in the group. When participants authenticate each other, each participant will receive shares sent by 3 people. Participants verify the received shares and then vote for the owners of the shares. If each of the 4 participants gets 3 votes, the 4 participants are judged to be honest. If any of the 4 participants gets less than 3 votes, then the remaining 4 participants will be requested to give auxiliary verification. Finally, if any of the 4 participants gets less than 3 votes, the participant is considered dishonest. If 4 participants get more than 3 votes, we check whether the proportion of true in the total votes exceeds half. If it exceeds 50%, we judge that the participant is honest; otherwise, the participant is dishonest.If the four sharess2c1=99,s2c2=237,s2c2=194,s2c2=111 pass verification, they can be used for secret S2 reconstruction work. Using equation (6) to calculate S2 pixel,(6)f1=a0+a1+a2+a3mod257,f2=a0+a121+a222+a323mod257,f3=a0+a131+a232+a333mod257,f4=a0+a141+a242+a343mod257,the result is a0=153,a1=154,a2=154,anda3=152 by Lagrange interpolation. Thus, the secret S2 is successfully restored.


## 5.4. Comparisons with Relative Schemes

In this part, we compare the proposed scheme with related schemes [22, 30] from many aspects, showing the advantages of our proposed scheme. First of all, we discuss the size of share. In the secret-sharing scheme, the degree of the constructed polynomial depends on the threshold of the scheme. In addition, there are also different ways to select coefficients in polynomials. In our scheme, the coefficient values in the constructed polynomial all come from the secret image. Thus, the size of the generated share is 1/k times original secret, expressed as 1/k×H×W. In the scheme [30], the scheme is dividing the original image into L nonoverlapping blocks, and each block contains 2k pixels. The processor constructs two polynomials of degree k−1 for each block, and the coefficients of each polynomial all come from this block. In this way, the size of the share is 1/k times the original image, denoted as 1/k−1×H×W. In the scheme [22], only one coefficient in the polynomial comes from the secret image, and the remaining k−1 coefficients are obtained from the processor data so that the size of the share is the same as the original image, which is H×W.Analyzing the efficiency of share generation in the encryption phase, in our scheme, first, we perform lsb processing on the calculated share s2ci, and the processed results are matched with shadows from the authentication image S1. Ideally, the matching can be done only once, and in the worst case, it takes times to complete. In the scheme [30], the first step is to divide the secret image into nonrepeated blocks Bi,i∈1,L,Bi=ai,0,…,ai,k−1,bi,0,…,bi,k−1, and then, the processor randomly selects an integer ri to satisfy riai,0+bi,0=0andriai,1+bi,1=0. Fortunately, it only needs one time; in the worst case, it needs n times. In scheme [22], the processor chooses a symmetric bivariate polynomial Fx,y of degree k−1. The secret S2 is hidden in the constant term by Fx,y. In any case, encryption can be completed at one time.We discuss the certification efficiency of the certification party. In scheme [22], the verifier holds the share size as H×W, who only needs to use the private share to compare with the provided share. Here, we mark the authentication efficiency of the scheme is ef1. In our scheme, the third party determines whether the provided share is true or false through an exclusive OR operation. The share size saved by the third party is H×W/k; therefore, the verification efficiency will be improved. Because our scheme has the same verification way as scheme [22], and the size of the share held by the verifier is reduced. Marking certification efficiency is ef2=k×ef1 in our scheme. In scheme, the size of the private share stored by authenticator is H×W/k−1; obviously, the verification efficiency in [30] also is improved, denoted as ef3=k−1×ef1.Table2 shows the differences between our scheme and related schemes in three aspects: verification efficiency, encryption efficiency, and share size. Table 2 visually shows the performance comparison between our scheme and related schemes [22, 30] (note: here, we mark both the encryption efficiency and verification efficiency of Scheme [22] as 100%).Table 2
Performance comparison between our scheme and related schemes [22, 30].
SchemeOur scheme[30][22]Verification efficiencyk×100%k−1×100%100%Encryption efficiencyk×100%2k−2×100%100%Share sizeH×W/kH×W/k−1H×WTable3 covers four aspects. Readers can see differences between our scheme and related schemes more intuitively. Our scheme includes the advantages of simple share authentication method, no pixel expansion, and lossless recovery of secret.Table 3
Comparison of our scheme, scheme [30], and scheme [22].
SchemeOur scheme[30][22]Authentication operationVCS (XOR/OR)Common valueCommon valuePixel expansionNONOYESRestructureLagrangeLagrangeLagrangeReconstruction qualityLossesLossLossWe compare related schemes [12, 14, 22, 30] with our scheme from multisecurity perspectives, as shown in Table 4.Table 4
Security comparison.
SchemeOur scheme[30][22][12][13][14]Information hidingYESYESYESNONONODecentralizedNONONOYESYESYESChannel securityYESYESNONONONOImpersonation attackYESYESYESYESYESYESReplay attackYESYESYESYESYESYESHierarchical accessYESNONONONONOWe assume that the size of the secret image is132×132 PX and calculate the specific size of the shadow of the related scheme according to the conclusion in Table 2. The bar chart shows result in Figure 7, the comparison of the shares’ size in three schemes. Readers can see the difference more intuitively. We select the thresholds k are 4, 5, 6, 7, 8, and 9 and then accurately obtain the results of the corresponding schemes.Figure 7
Bar graph of shadow size under different thresholds.In our scheme, the coefficient values in the constructed polynomial all come from the secret image. Thus, the size of the generated shadow is1/k times original secret. In the scheme [30], the scheme is dividing the original image into L nonoverlapping blocks, and each block contains 2k−2 pixels. The processor constructs two polynomials of degree k−1 for each block, and the coefficients of each polynomial all come from this block. In this way, the size of the share is 1/k times the original image. In the scheme [22], only one coefficient in the polynomial comes from the secret image, and the remaining k−1 coefficients are obtained from the processor data so that the size of the share is the same as the original image, which is H×W. In the final equivalent size secret analysis result, the encryption efficiency of our scheme is kf, scheme [30] is f (note: assume that the encryption efficiency of [30] is f), and [22] is k+1f. Figure 8 reflects the result. Here, we take the scheme [30] as a benchmark to better present the encryption effect of our scheme and scheme [22]. We adopt the thresholds k are 4, 5, 6, 7, 8, and 9, respectively. It achieves the purpose of readers to understand the comparison results of related schemes more quickly and effectively.Figure 8
Line graph of shadow encryption efficiency under different thresholds.


## 6. Conclusion

With the rapid development of network science and technology, virtual demand-based products are designed to meet people’s daily convenience. At this stage, there are many applications based on IoT in the living environment, and most of them have become our daily necessities, such as intelligent transportation medical security and agriculture. We are eager to use these IoT applications without data attacks.Our scheme satisfies the identity authentication function and the requirements of different application scenarios. The scheme can accurately screen out dishonest participants, so as to ensure that the final reconstruction result is correct. In addition, the scenarios where the scheme can be applied are online banking business processing, facial attendance electronic voting, and e-commerce. However, our scheme also has many shortcomings. The maximum threshold depends on the number of nodes, leading to a high correlation between the threshold and the number of nodes. If the number of tampered nodes exceeds 50%, the second pattern in the proposed scheme will not be able to complete the authentication work. These issues are what we will focus on in the next stage.



---

*Source: 1721925-2021-11-12.xml*