# Efficient Hyperchaotic Image Encryption Algorithm Based on a Fast Key Generation Method and Simultaneous Permutation-Diffusion Structure

Authors: Bin Ge; Gang Chen; Xu Chen; Zhihua Shen
Journal: Security and Communication Networks
 (2022)

---

## Abstract

To provide faster encryption speed for protecting image data privacy, a highly efficient hyperchaotic image encryption algorithm using a fast key generation method and simultaneous permutation-diffusion structure is proposed in this paper. Firstly, we design a novel fast key generation method to obtain four key matrixes with the size ofW × H (W and H are the width and height of an image) with the hyperchaotic Lorenz system only iterating 2W times. And within the key generation process, the piecewise linear chaotic map serves as a random selector to further enhance the randomness and unpredictability. Secondly, we introduce vectorization technique to parallelize the cipher blockchain-based encryption process. Hence, an image can be fast and sufficiently encrypted row by row and column by column through a four-round and interlinked diffusion process. Furthermore, during the diffusion process, the pixels are simultaneously scrambled by the Chebyshev map to enhance the antiattack capability of the proposed algorithm. Thirdly, we utilize a secure hash function to generate a plaintext-related secret key. Finally, cipher images can successfully pass common security tests with the correlation coefficients on the verge of 0, the entropies are greater than 7.99, and NPCR and UACI values are close to the expected values. Combined with other experimental results and analysis, we can safely conclude that the proposed algorithm has strong robustness against statistical, brute-force, differential, and some other common attacks. Moreover, only 0.009 s of encrypting a 256 × 256 image indicates that our algorithm has extensive application prosperity for real-time communications of massive digital images.


---

## Body

## 1. Introduction

### 1.1. Background

In recent years, the digital image has become the most important information carrier with the vigorous development of information and communication technology. Meanwhile, the increasing complexity of network security problems poses new challenges to protect image data from privacy disclosure and data theft [1, 2]. It is generally known that encryption technique can provide effective protection against illegal access by unauthorized users, but characteristics of digital images, such as high redundancy and strong correlations between adjacent pixels, may lead to unsatisfactory performance using most modern encryption algorithms dealing with image data [3–5]. Plenty of practices indicate that text data-oriented algorithms, such as 3DES (Triple Data Encryption Standard) and AES (Advanced Encryption Standard), may suffer from risks of inadequate encryption and low efficiency when handling image data [6]. Therefore, the implementation of specialized image encryption algorithms has attracted extensive attention. Although in the past few decades, various kinds of techniques, such as DNA (deoxyribonucleic acid) coding [7, 8], CA (cellular automata) [6, 9], CS (compressive sensing) [10, 11], semitensor product [12, 13], and fractal sorting matrix [14, 15], were investigated as potential solutions for an applicable image encryption algorithm, the chaos-based scheme has gradually become the hottest spot on account of its excellent properties.Due to the internal random behaviour, long unpredictability, and high sensitivity to initial conditions, chaotic systems naturally meet the confusion and diffusion requirements of cryptography. Furthermore, benefitting from the breakthroughs of the chaos anticontrol technique in the 1990s, researchers could easily take advantage of chaotic system to construct novel encryption algorithms. Then in 1998, a common permutation-diffusion structure, which could provide sufficient security with simple operations for chaos-based image encryption, was first put forward by Fridirich [16]. Thereafter, more and more low-dimensional chaotic systems, for instance, logistic map [17, 18], Chebyshev map [19, 20], and Henon map [21, 22], were utilized to achieve the purpose of fast encryption for image data. Nonetheless, fatal flaws like small key space and weak resistance against phase space reconstruction made those low-dimensional-chaos-based algorithms vulnerable to cryptanalysis attacks. Then, in 2008, Gao et al. [23] employed a hyperchaotic system, which could exhibit very complex trajectory and contain more initial values, to construct a more secure image encryption algorithm with large enough key space and high complexity against attackers. Henceforth, a tidal wave of chaotic image encryption techniques came forth for a second time. To enhance the resistance against brute-force attacks, Kadir et al. [24] applied a 6D hyperchaotic system to their algorithm to further expand the key space. Li et al. [25] presented a bit-level permutation method to further improve the scramble effect for their 5D hyperchaotic system-based algorithm. For the sake of resisting chosen plaintext attacks, Chai et al. [26] utilized a 4D hyperchaotic system and depended on a secure hash function to associate its initial values with the plain image.Nevertheless, extensive application of hyperchaotic systems not only verified their feasibility for secure image encryption but also exposed their efficiency issues limiting encryption speed [23–28]. Generally, to obtain sufficient pseudorandom numbers for encrypting a plain image with size of W × H (W and H are the width and height of the image), an N-dimensional hyperchaotic system must iterate at least W × H/N times. As a result, the time consumption of the keystream generation phase will even be higher than the encryption phase. At present, there are two types of widely adopted techniques to accelerate the encryption speed of hyperchaos-based algorithms: partial encryption and parallel encryption. By comparison, since the partial encryption technique will cause data loss within the transformation between spatial domain and frequency domain [29–32], parallel encryption has undoubtedly more prospects of applying. In 2020, Rajendran et al. [33] presented a novel preprocess method on hyperchaotic sequence, which can greatly reduce the time consumption of hyperchaotic iterations by extracting four pseudorandom numbers from each chaotic value. Also, in 2020, Liu et al. [34] constructed a 2D hyperchaotic system and then proposed a fast image encryption algorithm depending on a new simultaneous permutation-diffusion structure. However, experimental results and analysis indicate that the efficiency and speed of these two algorithms are still not satisfactory enough. Therefore, although the hyperchaotic system provides a feasible way to design a secure image encryption algorithm, considerable work remains to enhance the practicability of such algorithms.


### 1.2. Contribution and Organization

In this paper, we propose a highly efficient hyperchaotic image encryption algorithm based on a fast key generation method and simultaneous permutation-diffusion structure. The above image encryption algorithms [23–28, 33, 34], which are restricted by the design experiences of text data-oriented encryption algorithms, generally treat the image as one-dimensional data in the design process. This limits the improvement of key generation speed and brings extra time consumption of transformation between one dimension and two dimensions. Therefore, taking the matrix form of an image into consideration, we introduce the vectorization technique to reconstruct a simultaneous permutation-diffusion structure. Hence, our algorithm will be significantly accelerated since the image can be encrypted row by row and column by column in parallel. On the other hand, we also present a fast key generation method to obtain four secure key matrixes for the encryption process, while the employed hyperchaotic system only needs to iterate 2W times. Briefly, the main contributions of our algorithm are summarized as follows:(1)
We propose a novel image encryption algorithm based on a 4D hyperchaotic Lorenz system (HCLS). The high security of the proposed algorithm against common cryptanalytic attacks and its fast execution speed are demonstrated to meet the requirements of confidential real-time communications.(2)
A fast key generation method is presented to reduce the iterations of HCLS. Using the bitwise exclusive OR (bitxor) operation, the circular shift (circshift) operation, and a random selector driven by a piecewise linear chaotic map (PWLCM) on quantified hyperchaotic sequences, we obtain four key matrixes of sizeW × H, while the HCLS only needs to perform 2W iterations. Hence, the method can significantly improve mage encryption speed.(3)
A highly efficient simultaneous permutation-diffusion structure is designed to further accelerate the encryption process. We employ the vectorization technique in a cipher blockchain- (CBC-) based encryption process; thereby, pixels in a row or in a column can be parallel encrypted. And the interlinked four-diffusion process in vertical and horizontal directions ensures that any pixel’s information can diffuse to the final cipher image. Moreover, in the process of diffusion, the image is simultaneously scrambled through a Chebyshev map (CM) to enhance the security of the proposed algorithm.The remainder of this paper is organized as follows. In Section2, we demonstrate the employed chaotic system and their roles in our algorithm; besides, the vectorization technique is also described. Section 3 presents the proposed hyperchaotic image encryption algorithm. Experimental results and analyses are exhibited in Section 3. Finally, Section 4 draws the conclusion of this work.


## 1.1. Background

In recent years, the digital image has become the most important information carrier with the vigorous development of information and communication technology. Meanwhile, the increasing complexity of network security problems poses new challenges to protect image data from privacy disclosure and data theft [1, 2]. It is generally known that encryption technique can provide effective protection against illegal access by unauthorized users, but characteristics of digital images, such as high redundancy and strong correlations between adjacent pixels, may lead to unsatisfactory performance using most modern encryption algorithms dealing with image data [3–5]. Plenty of practices indicate that text data-oriented algorithms, such as 3DES (Triple Data Encryption Standard) and AES (Advanced Encryption Standard), may suffer from risks of inadequate encryption and low efficiency when handling image data [6]. Therefore, the implementation of specialized image encryption algorithms has attracted extensive attention. Although in the past few decades, various kinds of techniques, such as DNA (deoxyribonucleic acid) coding [7, 8], CA (cellular automata) [6, 9], CS (compressive sensing) [10, 11], semitensor product [12, 13], and fractal sorting matrix [14, 15], were investigated as potential solutions for an applicable image encryption algorithm, the chaos-based scheme has gradually become the hottest spot on account of its excellent properties.Due to the internal random behaviour, long unpredictability, and high sensitivity to initial conditions, chaotic systems naturally meet the confusion and diffusion requirements of cryptography. Furthermore, benefitting from the breakthroughs of the chaos anticontrol technique in the 1990s, researchers could easily take advantage of chaotic system to construct novel encryption algorithms. Then in 1998, a common permutation-diffusion structure, which could provide sufficient security with simple operations for chaos-based image encryption, was first put forward by Fridirich [16]. Thereafter, more and more low-dimensional chaotic systems, for instance, logistic map [17, 18], Chebyshev map [19, 20], and Henon map [21, 22], were utilized to achieve the purpose of fast encryption for image data. Nonetheless, fatal flaws like small key space and weak resistance against phase space reconstruction made those low-dimensional-chaos-based algorithms vulnerable to cryptanalysis attacks. Then, in 2008, Gao et al. [23] employed a hyperchaotic system, which could exhibit very complex trajectory and contain more initial values, to construct a more secure image encryption algorithm with large enough key space and high complexity against attackers. Henceforth, a tidal wave of chaotic image encryption techniques came forth for a second time. To enhance the resistance against brute-force attacks, Kadir et al. [24] applied a 6D hyperchaotic system to their algorithm to further expand the key space. Li et al. [25] presented a bit-level permutation method to further improve the scramble effect for their 5D hyperchaotic system-based algorithm. For the sake of resisting chosen plaintext attacks, Chai et al. [26] utilized a 4D hyperchaotic system and depended on a secure hash function to associate its initial values with the plain image.Nevertheless, extensive application of hyperchaotic systems not only verified their feasibility for secure image encryption but also exposed their efficiency issues limiting encryption speed [23–28]. Generally, to obtain sufficient pseudorandom numbers for encrypting a plain image with size of W × H (W and H are the width and height of the image), an N-dimensional hyperchaotic system must iterate at least W × H/N times. As a result, the time consumption of the keystream generation phase will even be higher than the encryption phase. At present, there are two types of widely adopted techniques to accelerate the encryption speed of hyperchaos-based algorithms: partial encryption and parallel encryption. By comparison, since the partial encryption technique will cause data loss within the transformation between spatial domain and frequency domain [29–32], parallel encryption has undoubtedly more prospects of applying. In 2020, Rajendran et al. [33] presented a novel preprocess method on hyperchaotic sequence, which can greatly reduce the time consumption of hyperchaotic iterations by extracting four pseudorandom numbers from each chaotic value. Also, in 2020, Liu et al. [34] constructed a 2D hyperchaotic system and then proposed a fast image encryption algorithm depending on a new simultaneous permutation-diffusion structure. However, experimental results and analysis indicate that the efficiency and speed of these two algorithms are still not satisfactory enough. Therefore, although the hyperchaotic system provides a feasible way to design a secure image encryption algorithm, considerable work remains to enhance the practicability of such algorithms.


## 1.2. Contribution and Organization

In this paper, we propose a highly efficient hyperchaotic image encryption algorithm based on a fast key generation method and simultaneous permutation-diffusion structure. The above image encryption algorithms [23–28, 33, 34], which are restricted by the design experiences of text data-oriented encryption algorithms, generally treat the image as one-dimensional data in the design process. This limits the improvement of key generation speed and brings extra time consumption of transformation between one dimension and two dimensions. Therefore, taking the matrix form of an image into consideration, we introduce the vectorization technique to reconstruct a simultaneous permutation-diffusion structure. Hence, our algorithm will be significantly accelerated since the image can be encrypted row by row and column by column in parallel. On the other hand, we also present a fast key generation method to obtain four secure key matrixes for the encryption process, while the employed hyperchaotic system only needs to iterate 2W times. Briefly, the main contributions of our algorithm are summarized as follows:(1)
We propose a novel image encryption algorithm based on a 4D hyperchaotic Lorenz system (HCLS). The high security of the proposed algorithm against common cryptanalytic attacks and its fast execution speed are demonstrated to meet the requirements of confidential real-time communications.(2)
A fast key generation method is presented to reduce the iterations of HCLS. Using the bitwise exclusive OR (bitxor) operation, the circular shift (circshift) operation, and a random selector driven by a piecewise linear chaotic map (PWLCM) on quantified hyperchaotic sequences, we obtain four key matrixes of sizeW × H, while the HCLS only needs to perform 2W iterations. Hence, the method can significantly improve mage encryption speed.(3)
A highly efficient simultaneous permutation-diffusion structure is designed to further accelerate the encryption process. We employ the vectorization technique in a cipher blockchain- (CBC-) based encryption process; thereby, pixels in a row or in a column can be parallel encrypted. And the interlinked four-diffusion process in vertical and horizontal directions ensures that any pixel’s information can diffuse to the final cipher image. Moreover, in the process of diffusion, the image is simultaneously scrambled through a Chebyshev map (CM) to enhance the security of the proposed algorithm.The remainder of this paper is organized as follows. In Section2, we demonstrate the employed chaotic system and their roles in our algorithm; besides, the vectorization technique is also described. Section 3 presents the proposed hyperchaotic image encryption algorithm. Experimental results and analyses are exhibited in Section 3. Finally, Section 4 draws the conclusion of this work.


## 2. Preliminary

### 2.1. The Hyperchaotic Lorenz System

In this paper, we utilize the HCLS, which has proven to have good randomness and strong robustness in the digital system [33–36], as a pseudorandom sequence generator. Its equation [35] is given by(1)x˙1=ax2−x1+x4,x˙2=cx1−x2−x1x3,x˙3=x1x2−bx3,x˙4=−x2x3+dx4,where x1, x2, x3, and x4 refer to the state values of the HCLS and a, b, c, and d are control parameters of the HCLS. When a = 10, b = 8/3, c = 28, and d = −1, the Lyapunov exponents [37, 38] (as shown in Figure 1) of the HCLS are λ1 = 0.3381, λ2 = 0.1586, λ3 = 0, and λ4 = −15.1725, indicating that the HCLS revolves into the hyperchaotic state. In addition, as we can see in Figure 2, the phase space trajectory of the HCLS is complex and dense. Therefore, we can safely depend on the HCLS to obtain a sequence with good randomness and long periodic unpredictability.Figure 1
The Lyapunov exponents’ diagram of HCLS.Figure 2
Phase space trajectory of HCLS: (a)x1-x2 plane; (b) x2-x3 plane; (c) x3-x4 plane; (d) x1-x2-x3 space; (e) x2-x3-x4 space; (f) x1-x2-x4 space.
(a)(b)(c)(d)(e)(f)The piecewise linear chaotic map (PWLCM) [39] is given by(2)y1i+1=Fy1i=y1ip,y1i∈0,p,y1i−p0.5−p,y1i∈p,0.5,F1−y1i,p,y1i∈0.5,1,where y1(i) and p are the state value and control parameter of the PWLCM. When p ∈ (0, 0.5), the PWLCM is chaotic and surjective (see Figure 3). Due to its simple structure, fast iteration speed, and uniform distribution, the PWLCM can serve as a random selector to further enhance the randomness and unpredictability of the four key matrixes in our algorithm. Note, in this paper, that we set p = 0.3 for the research.Figure 3
The bifurcation and Lyapunov exponent diagrams of PWLCM.
(a)(b)


### 2.2. The Chebyshev Map

As one of the most often used chaotic systems, the CM [40] is given by(3)y2i+1=coswarccosy2i,where y2 (i) and w are the state value and control parameter of CM. As Figure 4 shows, when w ≥ 2, the CM is chaotic and surjective. Hence, in this study, we utilize bitxor and circshift operations controlled by CM (herein, w is set to 4 to let sequence uniform as shown in Figure 4(a)) to randomly shuffle the pixel positions of an image within the diffusion process.Figure 4
The bifurcation and Lyapunov exponent diagrams of CM.
(a)(b)


### 2.3. The Logistic Map

The logistic map (LM) [41] is given by(4)y3i+1=μy3i1−y3i,where y3(i) and μ are the state value and control parameter of the LM. And if μ ∈ [3.56, 4], it comes to chaotic but is only surjective and has the largest Lyapunov exponent when μ = 4 as shown in Figure 5. Being the most famous one-dimensional chaotic system, many pieces of evidence manifest that the LM suffers from a lot of security issues when it is used alone in the image encryption algorithm. However, in the proposed algorithm, we can safely rely on its very fast iteration speed to generate an initial vector to start the CBC-based diffusion process.Figure 5
The bifurcation and Lyapunov exponent diagrams of LM.
(a)(b)


### 2.4. The Vectorization Technique

For the purpose of accelerating the execution speed of programs, modern CPUs provide a powerful tool SIMD (Single Instruction, Multiple Data), which can simultaneously apply an operation on multiple data [42]. And the vectorization technique is the key to activate SIMD. Suppose V1 and V2 are two vectors with length N, then the vectorization technique can achieve the implicit parallel of add operation between V1 and V2 as shown in Figure 6. As we can see, rather than calling for add operation N times in the for-loop, the vectorization technique should only call for add operation once. This can not only simplify programming but also make use of SIMD for other common operations to accelerate the program. Due to the matrix form of digital image, many image processing algorithms have successfully applied the vectorization technique to improve their operating efficiency [43, 44].Figure 6
The effect of adding operation between two vectors after using the vectorization technique.


## 2.1. The Hyperchaotic Lorenz System

In this paper, we utilize the HCLS, which has proven to have good randomness and strong robustness in the digital system [33–36], as a pseudorandom sequence generator. Its equation [35] is given by(1)x˙1=ax2−x1+x4,x˙2=cx1−x2−x1x3,x˙3=x1x2−bx3,x˙4=−x2x3+dx4,where x1, x2, x3, and x4 refer to the state values of the HCLS and a, b, c, and d are control parameters of the HCLS. When a = 10, b = 8/3, c = 28, and d = −1, the Lyapunov exponents [37, 38] (as shown in Figure 1) of the HCLS are λ1 = 0.3381, λ2 = 0.1586, λ3 = 0, and λ4 = −15.1725, indicating that the HCLS revolves into the hyperchaotic state. In addition, as we can see in Figure 2, the phase space trajectory of the HCLS is complex and dense. Therefore, we can safely depend on the HCLS to obtain a sequence with good randomness and long periodic unpredictability.Figure 1
The Lyapunov exponents’ diagram of HCLS.Figure 2
Phase space trajectory of HCLS: (a)x1-x2 plane; (b) x2-x3 plane; (c) x3-x4 plane; (d) x1-x2-x3 space; (e) x2-x3-x4 space; (f) x1-x2-x4 space.
(a)(b)(c)(d)(e)(f)The piecewise linear chaotic map (PWLCM) [39] is given by(2)y1i+1=Fy1i=y1ip,y1i∈0,p,y1i−p0.5−p,y1i∈p,0.5,F1−y1i,p,y1i∈0.5,1,where y1(i) and p are the state value and control parameter of the PWLCM. When p ∈ (0, 0.5), the PWLCM is chaotic and surjective (see Figure 3). Due to its simple structure, fast iteration speed, and uniform distribution, the PWLCM can serve as a random selector to further enhance the randomness and unpredictability of the four key matrixes in our algorithm. Note, in this paper, that we set p = 0.3 for the research.Figure 3
The bifurcation and Lyapunov exponent diagrams of PWLCM.
(a)(b)


## 2.2. The Chebyshev Map

As one of the most often used chaotic systems, the CM [40] is given by(3)y2i+1=coswarccosy2i,where y2 (i) and w are the state value and control parameter of CM. As Figure 4 shows, when w ≥ 2, the CM is chaotic and surjective. Hence, in this study, we utilize bitxor and circshift operations controlled by CM (herein, w is set to 4 to let sequence uniform as shown in Figure 4(a)) to randomly shuffle the pixel positions of an image within the diffusion process.Figure 4
The bifurcation and Lyapunov exponent diagrams of CM.
(a)(b)


## 2.3. The Logistic Map

The logistic map (LM) [41] is given by(4)y3i+1=μy3i1−y3i,where y3(i) and μ are the state value and control parameter of the LM. And if μ ∈ [3.56, 4], it comes to chaotic but is only surjective and has the largest Lyapunov exponent when μ = 4 as shown in Figure 5. Being the most famous one-dimensional chaotic system, many pieces of evidence manifest that the LM suffers from a lot of security issues when it is used alone in the image encryption algorithm. However, in the proposed algorithm, we can safely rely on its very fast iteration speed to generate an initial vector to start the CBC-based diffusion process.Figure 5
The bifurcation and Lyapunov exponent diagrams of LM.
(a)(b)


## 2.4. The Vectorization Technique

For the purpose of accelerating the execution speed of programs, modern CPUs provide a powerful tool SIMD (Single Instruction, Multiple Data), which can simultaneously apply an operation on multiple data [42]. And the vectorization technique is the key to activate SIMD. Suppose V1 and V2 are two vectors with length N, then the vectorization technique can achieve the implicit parallel of add operation between V1 and V2 as shown in Figure 6. As we can see, rather than calling for add operation N times in the for-loop, the vectorization technique should only call for add operation once. This can not only simplify programming but also make use of SIMD for other common operations to accelerate the program. Due to the matrix form of digital image, many image processing algorithms have successfully applied the vectorization technique to improve their operating efficiency [43, 44].Figure 6
The effect of adding operation between two vectors after using the vectorization technique.


## 3. Proposed Hyperchaotic Image Encryption Algorithm

The proposed image encryption algorithm consists of six parts: (1) the secret key generation; (2) the initial vector generation; (3) the generation of four key matrixes; (4) the generation of circshift values; (5) the encryption process; (6) the decryption process. Figure7 shows the flowchart of the proposed encryption algorithm, and the individual processes are detailed in the following subsections.Figure 7
Flowchart of the proposed cryptosystem.


### 3.1. The Secret Key Generation

To enhance the plaintext sensitivity of the proposed algorithm, the hash value of the original image is used to obtain a secret key. Furthermore, an external key with a length of 384 bits is introduced to ensure the unpredictability of the secret key. Since the initial values of chaotic systems are floating-point numbers, we present the overall process as follows:Step 1-1: Use the SHA-384 function to obtain the hash value HV of an original image P with sizeW × HStep 1-2: Generate the secret key by SK = bitxor (HV, Ke), where Ke is the external key, and SK consists of 96 hexadecimal numbersStep 1-3: Transfer SK to the decryption end through a secure channelStep 1-4: According to (5), quantify the initial values of the employed chaotic systems from SK on both the encryption and decryption ends(5)x11=10×hex2decSK1:12248,x21=10×hex2decSK13:24248,x31=10×hex2decSK25:36248,x41=10×hex2decSK37:48248,y11=hex2decSK49:60248,y21=hex2decSK61:72248,y31=hex2decSK73:84248,where x1(1), x2(1), x3(1), and x4(1) are the initial values of HCLS, y1(1), y2(1), and y3(1) are the initial values of the PWLCM, CM, and LM, respectively, and hex2dec is a function that converts hexadecimal number to decimal number. To avoid the possibility of harmful transient states, we use SK to obtain the preiteration times of the chaotic systems by (6) as follows:(6)pre1=modhex2decSK73:78+hex2decSK85:90,256+20,pre2=modhex2decSK79:84+hex2decSK91:96,256+20,pre3=modhex2decSK73:78+hex2decSK91:96,256+20,pre4=modhex2decSK79:84+hex2decSK85:90,256+20,where pre1, pre2, pre3, and pre4 are the preiteration times of HCLS, PWLCM, CM, and LM, respectively.


### 3.2. The Key Matrixes Generation

The proposed algorithm utilizes the HCLS, PWLCM, and the above generated parameters to obtain four key matrixes with sizeW × H for encryption and decryption as shown in Figure 8.Figure 8
The process of key matrixes generation.The detailed process is given as follows:Step 2-1: Initialize an empty sequence A with length 8W.Step 2-2: Input x1(1), x2(1), x3(1), and x4(1), and then iterate HCLS pre1 times.Step 2-3: Continue to iterate HCLS 2W times, and let A = {A, x3(i), x1(i), x4(i), x2(i)}, i = 1, 2, …2W-1, 2W.Step 2-4: Convert the elements of A to integer numbers by(7)A′=modfloorabsAfloorabsA×1015,256.Step 2-5: Split A′ into eight subsequences with lengthW : A '1- A '8.Step 2-6: As shown in (8), construct a lookup table LUT.(8)LUT=1:2:⋯23:24:1,2,3,4;1,2,3,4;⋯;1,2,3,4;1,2,3,4;,where each row presents different arrangement of elements 1, 2, 3, and 4.Step 2-7: Initialize an empty sequence B with length 2H.Step 2-8: Input y1(1), and then iterate the PWLCM pre2 times.Step 2-9: Continue to iterate the PWLCM 2H times, and let B = {B, y1(i)}, i = 1, 2, …2H-1, 2H.Step 2-10: Convert the elements of B to integer numbers by(9)B′=modfloorB×1015,24+1.Step 2-11: Initialize four empty matrixes KM1, KM2, KM3, and KM4 with size W × H.Step 2-12: Fill KM1, KM2, KM3, and KM4 by(10)KM1=bitxorA′LUTB′i,1,A′LUTB'i+H,1+4,thenA′LUTB′i,1=circ shiftA′LUTB′i,1,1,KM2=bitxorA′LUTB′i,2,A′LUTB'i+H,2+4,thenA′LUTB′i,2=circ shiftA′LUTB′i,2,1,KM3=bitxorA′LUTB′i,3,A′LUTB'i+H,3+4,thenA′LUTB′i,3=circ shiftA′LUTB′i,3,1,KM4=bitxorA′LUTB′i,4,A′LUTB'i+H,4+4,thenA′LUTB′i,4=circ shiftA′LUTB′i,4,1,i=1,2,⋯,H−1,H.


### 3.3. The Circshift Values Generation

We used the CM and the above generated parameters to obtain the circshift values for permutation. The detailed process was as follows:Step 3-1: Initialize an empty sequence V with lengthH + W.Step 3-2: Input y2(1), and then iterate the CM pre3 times.Step 3-3: Continue to iterate the CMH + W times, and let V = {V, y2(i)}, i = 1, 2, …, H + W-1, H + W.Step 3-4: Obtain the circshift values RV and CV to permute row and column(11)RV=modfloorV1:H×1015,W,CV=modfloorVH+1:H+W×1015,H.


### 3.4. The Initial Vector Generation

The proposed approach uses the logistic map and the above generated parameters to obtain an initial vector to start the first diffusion round. The process is detailed as follows:Step 4-1: Initialize an empty sequence S with lengthW.Step 4-2: Input y3(1), and then iterate LM pre4 times.Step 4-3: Continue to iterate the LMW times, and let S = {S, y3(i)}, i = 1, 2, …, W-1, W.Step 4-4: Obtain the initial vector IV by(12)IV=modfloorS×1015,256.


### 3.5. The Encryption Process

We use KM1, KM2, KM3, KM4, RV, CV, and IV to encrypt P. The detailed process is given as follows:Step 5-1: Suppose T1 and T2 are two row vectors. Then, in (13), we define the permutation of a row as ShiftRow, mixture of two rows as MixRow, and substitution of a row as SubRow.(13)Shift RowT1,k=circ shiftT1,k,Mix RowT1,T2=modT1+T2,256,Sub RowT1,T2=bitxorT1,T2.Step 5-2: Input P, and use IV, KM1, and RV to finish the row permutation and the first diffusion in the vertical direction as shown in (14). In particular, we use IV to deal with the first row.(14)Temp1=Shift RowP1,:,RVi,Temp2=Mix RowTemp1,TC1i−1,:,TC1i,:=Sub RowTemp2,KM1i,:,i=1,2,⋯,H−1,H.Step 5-3: Input TC1, and use KM2 to finish the second diffusion in the vertical direction as shown in (15). Particularly, we use TC1(H,) to deal with the first row.(15)Temp1=Mix RowTC1i,:,TC2i−1,:,TC2i,:=Sub RowTemp1,KM2i,:,i=1,2,⋯,H−1,H.Step 5-4: SupposeT'1 and T are two column vectors. Then, in (16), we define the permutation of a column as ShiftColumn, mixture of two columns as MixColumn, and substitution of a column as SubColumn.(16)Shift ColumnT1′,k=circ shiftT1′,k,Mix ColumnT1′,T2′=modT′1+T′2,256,Sub ColumnT1′,T2′=bitx orT1′,T2′.Step 5-5: Input TC2, and use KM3 and CV to finish the column permutation and the first diffusion in horizontal direction as shown in (17). Particularly, we use TC2(:, W) to deal with the first column.(17)Temp1=Shift ColumnTC2:,1,CVi,Temp2=Mix ColumnTemp1,TC3:,i−1,TC3:,i=Sub ColumnTemp2,KM3:,i,i=1,2,⋯,W−1,W.Step 5-6: Input TC3, and use KM3 to finish the second diffusion in the horizontal direction as shown in (18). In particular, we use TC3(:, W) to deal with the first column.(18)Temp1=Mix ColumnTC3:,i,TC4:,i−1,TC4:,i=Sub ColumnTemp1,KM4:,i,i=1,2,⋯,W−1,W.Step 5-7: Output TC4 as the final cipher image C.


### 3.6. The Decryption Process

The proposed method uses KM1, KM2, KM3, KM4, RV, CV, and IV to decrypt C as shown in Figure 9.Figure 9
The flowchart of decryption process.The process is detailed as follows:Step 6-1: SupposeT′1 and T′2 are two column vectors. Then, in (19), we define the antipermutation of a column as AntiShiftColumn, the antimixture of two columns as AntiMixColumn, and the antisubstitution of a column as AntiSubColumn.(19)Anti Shift ColumnT1′,k=circ shiftT1′,−k,Anti Mix ColumnT1′,T2′=modT1′+256−T1′,256,Anti Sub ColumnT1′,T1′=bitxorT1′,T1′.Step 6-2: Input C, and use KM4 to finish the first antidiffusion in horizontal direction as shown in (20). In particular, we use TD1(:, W), which equals TC3(:, W), to deal with the first column.(20)Temp1=Anti Sub ColumnC:,i,KM4:,i,TD1:,i=Anti Mix ColumnTemp1,TD1:,i−1,i=W,W−1,⋯,2,1.Step 6-3: Input TD1, and use KM3 and CV to finish the second antidiffusion in the horizontal direction and the column antipermutation as shown in (21). Particularly, we use TD2(:, W), which equals TC2(:, W), to deal with the first column.(21)Temp1=Anti Sub ColumnTD1:,i,KM3:,i,Temp2=Anti Mix ColumnTemp1,TD2:,i−1,TD2:,i=Anti Shift ColumnTemp2,CVi,i=W,W−1,⋯,2,1.Step 6-4: Suppose T1 and T2 are two row vectors. Then, in (22), we define the antipermutation of a row as AntiShiftRow, the antimixture of two rows as AntiMixRow, and the antisubstitution of a row as AntiSubRow.(22)Anti Shift RowT1,k=circ shiftT1,−k,Anti Mix RowT1,T2=modT1+256−T2,256,Anti Sub RowT1,T2=bit xorT1,T2.Step 6-5: Input TD2, and use KM2 to finish the first antidiffusion in the vertical direction as shown in (23). Particularly, we use TD3(H,), which equals TC1(H,), to deal with the first row.(23)Temp1=Anti Sub RowTD2i,:,KM2i,:,TD3i,:=Anti Mix RowTemp1,TD3i−1,:,i=H,H−1,⋯,2,1.Step 6-6: Input TD3, and use KM1 and IV to finish the second antidiffusion in the vertical direction as shown in (23). In particular, we use IV to deal with the first row.(24)Temp1=Anti Sub RowTD3i,:,KM1i,:,Temp2=Anti Mix RowTemp1,TD4i−1,:,TD4i,:=Anti Shift RowTemp2,RVi,i=H,H−1,⋯,2,1.Step 6-7: Output TD4 as the final decrypted imageD.


## 3.1. The Secret Key Generation

To enhance the plaintext sensitivity of the proposed algorithm, the hash value of the original image is used to obtain a secret key. Furthermore, an external key with a length of 384 bits is introduced to ensure the unpredictability of the secret key. Since the initial values of chaotic systems are floating-point numbers, we present the overall process as follows:Step 1-1: Use the SHA-384 function to obtain the hash value HV of an original image P with sizeW × HStep 1-2: Generate the secret key by SK = bitxor (HV, Ke), where Ke is the external key, and SK consists of 96 hexadecimal numbersStep 1-3: Transfer SK to the decryption end through a secure channelStep 1-4: According to (5), quantify the initial values of the employed chaotic systems from SK on both the encryption and decryption ends(5)x11=10×hex2decSK1:12248,x21=10×hex2decSK13:24248,x31=10×hex2decSK25:36248,x41=10×hex2decSK37:48248,y11=hex2decSK49:60248,y21=hex2decSK61:72248,y31=hex2decSK73:84248,where x1(1), x2(1), x3(1), and x4(1) are the initial values of HCLS, y1(1), y2(1), and y3(1) are the initial values of the PWLCM, CM, and LM, respectively, and hex2dec is a function that converts hexadecimal number to decimal number. To avoid the possibility of harmful transient states, we use SK to obtain the preiteration times of the chaotic systems by (6) as follows:(6)pre1=modhex2decSK73:78+hex2decSK85:90,256+20,pre2=modhex2decSK79:84+hex2decSK91:96,256+20,pre3=modhex2decSK73:78+hex2decSK91:96,256+20,pre4=modhex2decSK79:84+hex2decSK85:90,256+20,where pre1, pre2, pre3, and pre4 are the preiteration times of HCLS, PWLCM, CM, and LM, respectively.


## 3.2. The Key Matrixes Generation

The proposed algorithm utilizes the HCLS, PWLCM, and the above generated parameters to obtain four key matrixes with sizeW × H for encryption and decryption as shown in Figure 8.Figure 8
The process of key matrixes generation.The detailed process is given as follows:Step 2-1: Initialize an empty sequence A with length 8W.Step 2-2: Input x1(1), x2(1), x3(1), and x4(1), and then iterate HCLS pre1 times.Step 2-3: Continue to iterate HCLS 2W times, and let A = {A, x3(i), x1(i), x4(i), x2(i)}, i = 1, 2, …2W-1, 2W.Step 2-4: Convert the elements of A to integer numbers by(7)A′=modfloorabsAfloorabsA×1015,256.Step 2-5: Split A′ into eight subsequences with lengthW : A '1- A '8.Step 2-6: As shown in (8), construct a lookup table LUT.(8)LUT=1:2:⋯23:24:1,2,3,4;1,2,3,4;⋯;1,2,3,4;1,2,3,4;,where each row presents different arrangement of elements 1, 2, 3, and 4.Step 2-7: Initialize an empty sequence B with length 2H.Step 2-8: Input y1(1), and then iterate the PWLCM pre2 times.Step 2-9: Continue to iterate the PWLCM 2H times, and let B = {B, y1(i)}, i = 1, 2, …2H-1, 2H.Step 2-10: Convert the elements of B to integer numbers by(9)B′=modfloorB×1015,24+1.Step 2-11: Initialize four empty matrixes KM1, KM2, KM3, and KM4 with size W × H.Step 2-12: Fill KM1, KM2, KM3, and KM4 by(10)KM1=bitxorA′LUTB′i,1,A′LUTB'i+H,1+4,thenA′LUTB′i,1=circ shiftA′LUTB′i,1,1,KM2=bitxorA′LUTB′i,2,A′LUTB'i+H,2+4,thenA′LUTB′i,2=circ shiftA′LUTB′i,2,1,KM3=bitxorA′LUTB′i,3,A′LUTB'i+H,3+4,thenA′LUTB′i,3=circ shiftA′LUTB′i,3,1,KM4=bitxorA′LUTB′i,4,A′LUTB'i+H,4+4,thenA′LUTB′i,4=circ shiftA′LUTB′i,4,1,i=1,2,⋯,H−1,H.


## 3.3. The Circshift Values Generation

We used the CM and the above generated parameters to obtain the circshift values for permutation. The detailed process was as follows:Step 3-1: Initialize an empty sequence V with lengthH + W.Step 3-2: Input y2(1), and then iterate the CM pre3 times.Step 3-3: Continue to iterate the CMH + W times, and let V = {V, y2(i)}, i = 1, 2, …, H + W-1, H + W.Step 3-4: Obtain the circshift values RV and CV to permute row and column(11)RV=modfloorV1:H×1015,W,CV=modfloorVH+1:H+W×1015,H.


## 3.4. The Initial Vector Generation

The proposed approach uses the logistic map and the above generated parameters to obtain an initial vector to start the first diffusion round. The process is detailed as follows:Step 4-1: Initialize an empty sequence S with lengthW.Step 4-2: Input y3(1), and then iterate LM pre4 times.Step 4-3: Continue to iterate the LMW times, and let S = {S, y3(i)}, i = 1, 2, …, W-1, W.Step 4-4: Obtain the initial vector IV by(12)IV=modfloorS×1015,256.


## 3.5. The Encryption Process

We use KM1, KM2, KM3, KM4, RV, CV, and IV to encrypt P. The detailed process is given as follows:Step 5-1: Suppose T1 and T2 are two row vectors. Then, in (13), we define the permutation of a row as ShiftRow, mixture of two rows as MixRow, and substitution of a row as SubRow.(13)Shift RowT1,k=circ shiftT1,k,Mix RowT1,T2=modT1+T2,256,Sub RowT1,T2=bitxorT1,T2.Step 5-2: Input P, and use IV, KM1, and RV to finish the row permutation and the first diffusion in the vertical direction as shown in (14). In particular, we use IV to deal with the first row.(14)Temp1=Shift RowP1,:,RVi,Temp2=Mix RowTemp1,TC1i−1,:,TC1i,:=Sub RowTemp2,KM1i,:,i=1,2,⋯,H−1,H.Step 5-3: Input TC1, and use KM2 to finish the second diffusion in the vertical direction as shown in (15). Particularly, we use TC1(H,) to deal with the first row.(15)Temp1=Mix RowTC1i,:,TC2i−1,:,TC2i,:=Sub RowTemp1,KM2i,:,i=1,2,⋯,H−1,H.Step 5-4: SupposeT'1 and T are two column vectors. Then, in (16), we define the permutation of a column as ShiftColumn, mixture of two columns as MixColumn, and substitution of a column as SubColumn.(16)Shift ColumnT1′,k=circ shiftT1′,k,Mix ColumnT1′,T2′=modT′1+T′2,256,Sub ColumnT1′,T2′=bitx orT1′,T2′.Step 5-5: Input TC2, and use KM3 and CV to finish the column permutation and the first diffusion in horizontal direction as shown in (17). Particularly, we use TC2(:, W) to deal with the first column.(17)Temp1=Shift ColumnTC2:,1,CVi,Temp2=Mix ColumnTemp1,TC3:,i−1,TC3:,i=Sub ColumnTemp2,KM3:,i,i=1,2,⋯,W−1,W.Step 5-6: Input TC3, and use KM3 to finish the second diffusion in the horizontal direction as shown in (18). In particular, we use TC3(:, W) to deal with the first column.(18)Temp1=Mix ColumnTC3:,i,TC4:,i−1,TC4:,i=Sub ColumnTemp1,KM4:,i,i=1,2,⋯,W−1,W.Step 5-7: Output TC4 as the final cipher image C.


## 3.6. The Decryption Process

The proposed method uses KM1, KM2, KM3, KM4, RV, CV, and IV to decrypt C as shown in Figure 9.Figure 9
The flowchart of decryption process.The process is detailed as follows:Step 6-1: SupposeT′1 and T′2 are two column vectors. Then, in (19), we define the antipermutation of a column as AntiShiftColumn, the antimixture of two columns as AntiMixColumn, and the antisubstitution of a column as AntiSubColumn.(19)Anti Shift ColumnT1′,k=circ shiftT1′,−k,Anti Mix ColumnT1′,T2′=modT1′+256−T1′,256,Anti Sub ColumnT1′,T1′=bitxorT1′,T1′.Step 6-2: Input C, and use KM4 to finish the first antidiffusion in horizontal direction as shown in (20). In particular, we use TD1(:, W), which equals TC3(:, W), to deal with the first column.(20)Temp1=Anti Sub ColumnC:,i,KM4:,i,TD1:,i=Anti Mix ColumnTemp1,TD1:,i−1,i=W,W−1,⋯,2,1.Step 6-3: Input TD1, and use KM3 and CV to finish the second antidiffusion in the horizontal direction and the column antipermutation as shown in (21). Particularly, we use TD2(:, W), which equals TC2(:, W), to deal with the first column.(21)Temp1=Anti Sub ColumnTD1:,i,KM3:,i,Temp2=Anti Mix ColumnTemp1,TD2:,i−1,TD2:,i=Anti Shift ColumnTemp2,CVi,i=W,W−1,⋯,2,1.Step 6-4: Suppose T1 and T2 are two row vectors. Then, in (22), we define the antipermutation of a row as AntiShiftRow, the antimixture of two rows as AntiMixRow, and the antisubstitution of a row as AntiSubRow.(22)Anti Shift RowT1,k=circ shiftT1,−k,Anti Mix RowT1,T2=modT1+256−T2,256,Anti Sub RowT1,T2=bit xorT1,T2.Step 6-5: Input TD2, and use KM2 to finish the first antidiffusion in the vertical direction as shown in (23). Particularly, we use TD3(H,), which equals TC1(H,), to deal with the first row.(23)Temp1=Anti Sub RowTD2i,:,KM2i,:,TD3i,:=Anti Mix RowTemp1,TD3i−1,:,i=H,H−1,⋯,2,1.Step 6-6: Input TD3, and use KM1 and IV to finish the second antidiffusion in the vertical direction as shown in (23). In particular, we use IV to deal with the first row.(24)Temp1=Anti Sub RowTD3i,:,KM1i,:,Temp2=Anti Mix RowTemp1,TD4i−1,:,TD4i,:=Anti Shift RowTemp2,RVi,i=H,H−1,⋯,2,1.Step 6-7: Output TD4 as the final decrypted imageD.


## 4. Experimental Results and Analyses

In this section, we describe the results of experiments conducted to evaluate the proposed image encryption algorithm. A series of all simulations were implemented using MATLAB R2016b. We ran programmes on a personal computer with an Intel(R) Core (TM) i5-6500 CPU @ 3.20 GHz and 16 GB memory, using the Windows 7 Professional Edition operating system. For the simulation, we obtained the Ke = {8932EADFF72428D465DF9C6C2836850F5EDBA7B3AE77E61B5ABD71D57EC39B00FAD1798C921AF79872F2F6093B32F4BC}. We used standard 8-bit grayscale images in the USC-SIPI image database for comparison and analysis. Figure10 shows the encryption and decryption results. Figures 10(a)–10(f) show the conventional original images “Lena” and “Resolution” with a size of 256 × 256 pixels, “Baboon” and “Peppers” with a size of 512 × 512 pixels, and “Airplane” and “Male” with sizes of 1024 × 1024 pixels, while Figures 10(g)–10(l) show the corresponding cipher images, and Figures 10(m)–10(r) show the decrypted images. In the following subsections, we present the results of some common tests performed to demonstrate the security and efficiency of the proposed algorithm.Figure 10
Encryption and decryption results: (a–f) the plain images of “Lena,” “Resolution,” “Baboon,” “Peppers,” “Airplane,” and “Male”; (g–l) the corresponding cipher images; and (m–r) the decrypted images.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)


### 4.1. Histogram Analysis

A histogram of an image is a visualization tool to analyze the distribution of its pixel values. A good cipher image must have a uniform histogram to resist statistical analysis, meaning that each pixel value should appear with roughly the same frequency in the histogram. Figure11 shows the histogram analysis results. Figures 11(s)–11(x) show that the histograms of the cipher images were approximately uniform and significantly differed from those of the original images shown in Figures 11(g)–11(l).Figure 11
Histograms: (a–f) original images; (g–l) corresponding histograms of the original images; (m–r) cipher images; (s–x) corresponding histograms of the cipher images.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)Furthermore, we used the chi-square (χ2) test [34, 39] for the quantitative analysis of the distribution of pixel values; the calculation of x2 is given by(25)χ2=∑i=1Lfi−pi2pi,where L is the pixel level of an image (and in an 8-bit grayscale image, any pixel has 28 levels; thus, L = 256), fi is the occurrence frequency of each pixel value obtained from the observation, and pi is the expected occurrence frequency of each pixel value. An ideal cipher image has a uniform distribution, so pi = W × H/L. Table 1 illustrates the χ2 value of 293.24783 (the significance level α = 0.05). Hence, the cipher images were able to successfully pass the χ2 test, indicating that our algorithm had a strong ability to resist frequency analysis attacks.Table 1
Results of x2 values of the above histograms.
ImageTheoretical valuePlainCipherResultLena293.247383.9869 × 104255.0625PassResolution293.247381.1983 × 107252.5625PassBaboon293.247381.8763 × 105261.2988PassPeppers293.247381.2017 × 105248.5898PassAirplane293.247387.1999 × 106243.5757PassMale293.247387.0934 × 105261.7827Pass


### 4.2. Randomness Analysis

An ideal cipher image should not leak any information not only in visual aspect but also in statistic level. To verify the validation of our algorithm on hiding statistical information as well as the randomness of the key matrixes generated by the proposed key generation method, we apply the SP 800–22 test suit from NIST (which consists of 01: Frequency, 02: Block Frequency, 03: Cumulative Sums, 04: Runs, 05: Longest Runs of Ones, 06: Rank, 07: Spectral DFT, 08: Nonperiodic Template Matchings, 09: Overlapping Template Matchings, 10: Universal Statistical, 11: Approximate Entropy, 12: Random Excursions, 13: Random Excursions Variant, 14: Serial, and 15: Linear Complexity) on the cipher image and its corresponding key matrixes (note: they are converted to binary sequences before test). And we set the significant levelα = 0.01 in this paper; then, if the result P-value>0.01, the sequence can be considered to be random with a confidence of 99%. As we can see in Table 2, all P-values of cipher images and key matrixes are greater than 0.01. Therefore, we can safely conclude that our algorithm has high resistance to statistical attacks.Table 2
Results of the SP 800–22 test suit (setα = 0.01).
Test no.P valueKM1KM1KM1KM1LenaResolutionBaboonPeppersAirplaneMale010.18310.19670.48670.90730.34590.30150.62440.44960.61820.6014020.56190.28050.58840.43610.39020.59010.22230.18390.22930.9339030.69880.54410.77070.04150.51580.09330.17780.07350.05350.9798040.94270.32140.12670.69850.72970.92990.44720.03250.57890.4323050.42370.81550.02650.23210.64640.98190.37340.96150.92110.4005060.51640.33720.72140.92040.47480.03140.57620.89190.28240.8134070.17040.25110.65380.13390.74680.97730.32990.30130.22340.4248080.63620.10840.71510.89570.99140.15840.28310.03250.99010.7867090.86150.95390.15260.21720.56950.47850.43860.56550.16480.1751100.29850.40080.79530.89020.05890.99950.41350.27970.36780.2902110.13210.60320.16590.59040.83150.51250.61980.10230.40730.1038120.52120.83920.31680.24290.96650.18730.54240.48160.34730.6574130.62540.29610.79550.76820.22790.16540.31810.26710.65030.9272140.60460.48260.29890.73320.41360.35190.45490.25120.20630.1946150.51460.20530.81920.82210.52880.73160.46390.38110.60680.3085ResultPassPassPassPassPassPassPassPassPassPass


### 4.3. Correlation Analysis between Adjacent Pixels

A good image encryption algorithm can break the correlation between adjacent pixels, whether in the vertical, horizontal, or diagonal directions. Figure12 shows the correlation distribution of the benchmark image “Lena” and its cipher image in three directions. Using the proposed algorithm, the correlation distribution of adjacent pixels was converted from highly concentrated in the original image into completely random in the cipher image.Figure 12
Correlation distribution of adjacent pixels in (a) vertical, (b) horizontal, and (c) diagonal directions of the original image as well as the (d) vertical, (e) horizontal, and (f) diagonal directions of the cipher image.
(a)(b)(c)(d)(e)(f)In this subsection, we continue to use the correlation coefficientγxy to measure the correlation between adjacent pixels. To some extent, the lower the correlation coefficient in the cipher image is, the higher the security the image encryption algorithm provides.γxy is given by(26)x¯=1N∑i=1Nxi,y¯=1N∑i=1Nyi,γxy=∑i=1Nxi−x¯yi−y¯∑i=1Nxi−x¯2∑i=1Nyi−y¯2,where xi and yi are grey values of two adjacent pixels and N represents the number of pixels.For this test, we randomly selected 10,000 pairs of adjacent pixels from the original images and the corresponding ciphers image in three directions. Table3 shows that the proposed algorithm was able to significantly decrease the correlation between adjacent pixels. Moreover, as Table 4 shows, in comparison to the benchmark digital image “Lena,” our algorithm performed better at resisting statistical analysis attacks than the alternative methods.Table 3
Results of correlation coefficients.
ImageVerticalHorizontalDiagonalPlainCipherPlainCipherPlainCipherLena0.9575–0.00150.92030.00050.91480.0012Resolution0.8668–0.00350.87220.00280.7568–0.0030Baboon0.75240.00220.86530.00120.7210–0.0011Peppers0.97640.00090.97330.00220.9651–0.0006Airplane0.9458–0.00170.96470.00020.94420.0010Male0.9804–0.00040.9769–0.00140.9669–0.0007Table 4
Comparison of correlation coefficients.
AlgorithmOursRef. [33]Ref. [34]Ref. [35]Vertical–0.0015–0.04630.01060.0020Horizontal0.0005–0.0004–0.00120.0035Diagonal0.00120.00100.00090.0027


### 4.4. Shannon Entropy

In this subsection, we utilize the global Shannon entropy and local Shannon entropy to thoroughly verify the resistance against entropy attacks of our algorithm.


#### 4.4.1. Global Shannon Entropy (GSE)

The Shannon entropy is an important indicator to evaluate the degree of uncertainty and diffusion of a cipher image. Commonly, the GSE is calculated to obtain the degree of uncertainty of the whole cipher image, as given by(27)∑i=0L−1pgi=1,Hg=−∑i=0L−1pgilog2pgi,where L = 256 for a grayscale image and p(gi) denotes the probability of each grey value gi. Therefore, as an ideal grayscale cipher image, the theoretical maximum GSE value H(g) = 8. Table 5 shows the GSE results and comparison. Because all entropies of cipher images were remarkably close to 8, we concluded that the proposed algorithm had good diffusion performance.Table 5
Results and comparison of GSE.
ImagePlainCipherOursRef. [33]Ref. [34]Ref. [35]Lena7.44297.99737.99637.99727.9967Resolution1.54837.99727.99687.99687.9963Baboon7.35837.99937.99877.99927.9992Peppers7.59377.99927.99857.99937.9993Airplane5.64157.99987.99927.99977.9997Male7.52377.99987.99937.99997.9998


#### 4.4.2. Local Shannon Entropy (LSE)

However, Wu et al. [45] indicated that GSE had certain limitations on some occasions. Hence, the LSE, which was given by (28), was introduced to strictly verify the diffusion performance,(28)H¯k,TbS=∑i=1kHSik,where S1, S2…Sk are k randomly selected nonoverlapping image blocks with TB pixels from the image and H(Si) is the GSE of Si. When we set (k, TB) = (30, 1936) and significance α = 0.05, the theoretical value of LSE was 7.902469317 [45]. However, when the experimental results fell into the interval (7.901901305, 7.903037329), we considered the tests passed to have passed. As Table 6 shows, the results of the LSE all fell into the significant interval.Table 6
Results of LSE.
ImageLenaResolutionBaboonPeppersAirplaneMaleLSE7.9020434247.9029099897.9023479447.9026970697.9026117137.902244927ResultPassPassPassPassPassPass


### 4.5. Plaintext Sensitivity Analysis

Plaintext sensitivity guarantees the ability of an encryption algorithm to resist differential attack, meaning that two original images with a minor difference will result in two completely different cipher images. The two measurements were used to evaluate the sensitivity of the plain image, including the number of pixel change rate (NPCR) and the unified average changing intensity (UACI). These measures were calculated as given by(29)NPCR=1H×W∑i=1H∑j=1WDi,j×100%,UACI=1H×W∑i=1H∑j=1WC1i,j−C2i,j255×100%,Di,j=0,C1i,j=C2i,j,1,C1i,j≠C2i,j,,where C1 and C2 are the cipher images corresponding to two one-pixel different plane images.For this test, we randomly selected one pixel from a plain image in any position, changed its value by only 1 bit, and then calculated NPCR and UACI. We tested this procedure 100 times, and Table7 shows the average results. We observed that the results were remarkably close to the expected values of NPCRE = 99.6094% and UACIE = 33.4635%. Hence, our algorithm had a strong ability to resist differential attacks.Table 7
NPCR and UACI values of plaintext sensitivity test (unit: %).
ImageNPCRUACIOursRef. [33]Ref. [34]Ref. [35]OursRef. [33]Ref. [34]Ref. [35]Lena99.607399.6099.621699.609433.475133.5433.499433.4303Resolution99.608999.6099.630799.578933.487833.5433.425333.4879Baboon99.609999.6299.636899.617033.485133.4233.470233.4736Peppers99.609299.6299.586599.609433.457933.4233.481533.4289Airplane99.610799.6199.607899.595633.460633.5033.530733.3824Male99.608699.6199.624699.586533.455833.5033.477133.4528


### 4.6. Key Sensitivity Analysis

A secure encryption algorithm must be sensitive to the secret key. This is reflected in two aspects; on the one hand, two encryption keys with small differences will result in two completely different cipher images; on the other hand, a subtle error in the decryption key may be expected to cause the decryption to become utterly incorrect.For this test, we chose “Resolution” as a test image. Hence, we obtained the SK = {9C5C00CFCFB3420A453AF7F35043C1121B4BACE25F0ED6BC7EAD7CC964A2585A5F10476FE09FD648479112FEBA19AFEE} via Step 1-2. According to equations (5) and (6), we split the SK into nine parts.In the first stage, we changed the lowest significant bit of the nine parts and then used it to encrypt the original image. We used NPCR and UACI to evaluate the differences between the two cipher images. Table8 shows that any small change in the encryption key would lead to a radical change in the cipher image. Hence, our proposed encryption algorithm had high sensitivity to the encryption key.Table 8
NPCR and UACI values of encryption key sensitivity test (unit: %).
Secret keyChanged valueNPCRUACI9C5C00CFCFB39C5C00CFCFB299.594133.4227420A453AF7F3420A453AF7F299.612433.41615043C1121B4B5043C1121B4A99.584933.4287ACE25F0ED6BCACE25F0ED6BD99.617033.48817EAD7CC964A27EAD7CC964A399.604833.5054585A5F10476 F585A5F10476 E99.613933.5104E09FD6484791E09FD648479099.624633.496312FEBA12FEBB99.618533.674119AFEE19AFEF99.623133.4679In the second stage, we used the correct secret key and the previous nine secret keys to decrypt the cipher image. Figure13 shows that the cipher image could be recovered only if the decryption key was correct.Figure 13
Decryption result: (a) cipher image decrypted using (b) the correct SK and the incorrect SK where (c) SK (12) = 2; (d) SK (60) = 3; (e) SK (72) = E; (f) SK (84) = 0; (g) SK (90) = B; and (h) SK (96) = F.
(a)(b)(c)(d)(e)(f)(g)(h)Furthermore, we continued to use NPCR and UACI to measure the difference between the cipher image and the incorrect decrypted image. Table9 shows that even minor incorrectness of the decryption key would cause the cipher to be unrecoverable. Therefore, our proposed algorithm had high sensitivity to the decryption key.Table 9
NPCR and UACI values of decryption key sensitivity test (unit: %).
Secret keyModified valueNPCRUACI9C5C00CFCFB39C5C00CFCFB299.592633.5404420A453AF7F3420A453AF7F299.627733.52055043C1121B4B5043C1121B4A99.618533.3798ACE25F0ED6BCACE25F0ED6BD99.572833.42927EAD7CC964A27EAD7CC964A399.620133.5472585A5F10476 F585A5F10476E99.600233.6544E09FD6484791E09FD648479099.609433.604512FEBA12FEBB99.607833.629319AFEE19AFEF99.621633.4723


### 4.7. Key Space Analysis

In general, a large key space could ensure that the encryption algorithm would resist brute-force attacks. We employed HCLS, PWLCM, CM, and LM to design the proposed encryption algorithm. The keys included the initial values x1, x2, x3, x4, y1, y2, and y3 and preiterations pre1, pre2, pre3, and pre4, which were determined by 384-bit SK. In Section 3.5, we prove that any tiny change of SK can influence the results of encryption and decryption. Hence, the key space of our algorithm was 2384>> 2128 [34, 36], which was a sufficiently large key space to resist brute-force attacks.


### 4.8. Resistance Attacks Analysis

For an applicable encryption algorithm, even if all the details of the algorithm are overt, the cryptanalyst could not obtain any useful information from ciphertext without a secret key. Commonly, the attacker has four methods to decode the encryption algorithm, which are ciphertext only attack, known plaintext attack, chosen plaintext attack, and chosen ciphertext attack, from weak to strong. All-black and all-white images are most often employed to perform attacks. The proposed image encryption algorithm depends on the simultaneous permutation-diffusion structure to make any minor changes of any pixel can cause significant changes of the cipher image. Figure14 shows the histogram of pure-white and pure-black images, and Table 10 lists the experimental results of the above security tests on their cipher images. The uniform distribution of encrypted pure-white/black image in Figure 14 indicates that attackers cannot extract any useful information from cipher images. Furthermore, as shown in Table 10, the plaintext sensitivity, entropy, and correlation results are very close to the ideal value. Hence, we can draw a conclusion that even chosen plaintext/ciphertext cannot assist attackers to recover plain image and secret key, and our algorithm has high security to resist the powerful attacks like chosen plaintext attack and chosen ciphertext attack.Figure 14
Histogram results. (a) Pure-white image and its (b) corresponding cipher image. (c) Histogram of pure-white cipher image. (d) Pure-black image and its (e) corresponding cipher image. (f) Histogram of pure-black cipher image.
(a)(b)(c)(d)(e)(f)Table 10
Results of security experiment of pure-white and pure-black images.
Testχ2 testNPCR (%)UACI (%)EntropyCorrelation coefficientMinMaxMinMaxGlobalLocalHorizontalVerticalDiagonalPure-white262.910599.600899.629133.444933.46077.99927.9021−0.00150.00190.0024Pure-black251.683799.588799.615933.450333.47057.99957.90270.00270.0008−0.0035


### 4.9. Time Complexity Analysis

Although security performance is the most important index of an image encryption algorithm, the significance of the execution speed algorithm cannot be ignored in practice. The proposed algorithm mainly consisted of the following five parts: (1) secret key generation; (2) generation of key matrixes; (3) generation of circshift values; (4) initial vector generation; (5) encryption/decryption. However, the secret key generation process could be executed independently, and thus we were able to obtain the secret keys long before the encryption/decryption process. Hence, we discuss the time complexity of the other four parts. The time complexities were as follows. For the key matrix generation, the time complexity was Θ(3H + 2W); for the circshift value generation, it was Θ(H + W); for the initial vector generation, it was Θ(W), and for the encryption/decryption process, the time complexity was Θ(2H + 2W). In summary, the time complexity of the proposed algorithm was Θ(6H + 6W). By comparison with some previously reported algorithms, the apparent advantage of our algorithm was the low time complexity of key generation. Table 11 presents the average execution time for different plain images and different algorithms. It shows that our algorithm was much faster than the alternative methods compared [33–35]. Even by comparison with some partial encryption and low-dimensional chaotic system-based encryption algorithms [32, 41], our algorithm can also achieve faster speed. Therefore, the execution efficiency of our proposed algorithm may be considered acceptable for secure real-time image communications.Table 11
Execution times of different images and different algorithms (unit: s).
ImageSizeOursRef. [33]Ref. [34]Ref. [35]Ref. [32]Ref. [41]Lena256 × 2560.00930.4310.27680.02310.2470—Resolution0.00890.3850.28520.0195Baboon512 × 5120.03111.1861.33230.10990.79050.2441Peppers0.03121.5101.04670.0863Airplane1024 × 10240.11343.5423.98010.3281——Male0.11303.7834.25330.3505


### 4.10. Robustness Analysis

A cipher image transferred on public channels would inevitably suffer from data loss or noise pollution. However, a robust image encryption algorithm could still recover the cipher image with data loss or noise pollution, reconstructing a recognizable image using the correct decryption key.


#### 4.10.1. Robustness against Data Loss

To verify the robustness of our proposed algorithm, the Peppers’ cipher image was cropped with different densities (see Figures15(a)–15(d)(a–d)), and the corresponding decrypted images were examined (see Figures 15(e)–15(h)). Figure 15 shows that the cipher image with less than 50% data loss could be decrypted to a recognizable image. Thus, our image encryption algorithm is robust against data loss that occurs on public channels.Figure 15
Cipher images with data loss (a) 1/16; (b) 1/8; (c) 1/4; (d) 1/2; (e) decrypted image of (a); (f) decrypted image of (b); (g) the decrypted image of (g); (h) the decrypted image of (d).
(a)(b)(c)(d)(e)(f)(g)(h)


#### 4.10.2. Robustness against Noise Pollution

In this test, the cipher image was polluted by salt and pepper noise (uniform distribution) and Gaussian noise (normal distribution) with different intensities.First, we added Gaussian noise to the cipher image with intensities of 0.001, 0.005, and 0.01, and then we used the correct decryption key to recover the polluted images. Figures16(a)–16(c) show that although the decrypted images were affected by the noise, we could still identify the images as “Peppers.” Second, we added salt and pepper noise to the cipher image with intensities of 0.01, 0.05, and 0.1, as shown in Figure 16(d)–16(f)), the decrypted images. We were also able to obtain a readable context. The results indicate that our proposed algorithm is robust against noise pollution on a public channel. We observe that if these decrypted images had some special use, a denoising process would be required to enhance their quality.Figure 16
Decrypted image from the cipher image polluted by Gaussian noise with an intensity of (a) 0.001; (b) 0.005; (c) 0.01 and polluted by salt and pepper noise with an intensity of (d) 0.01; (e) 0.05; (f) 0.1.
(a)(b)(c)(d)(e)(f)


#### 4.10.3. Quality Analysis

Although decrypted images with data loss or noise pollution are recognizable in vision, we adopt PSNR (Peak Signal-to-Noise Ratio) to evaluate their qualities by comparison with the original plain image. The PSNR [36] is defined as(30)PSNR=10lg255×2551/W×H∑i=1W∑j=1HPi,j−Di,j2.Then, as shown in Table12, the PSNR values of decrypted images with different degrees of data loss and noise pollution are all greater than 10 dB, which illustrates that our algorithm has enough robustness to provide protection for image data transmission even over the unstable channel.Table 12
PSNR values of decrypted images with data loss or noise pollution (unit: dB).
TypeData lossGaussianSalt and peppersDegree1/161/81/41/20.0010.0050.010.010.050.1PSNR20.794917.793114.801911.816314.075011.663911.023420.152413.685311.4023


## 4.1. Histogram Analysis

A histogram of an image is a visualization tool to analyze the distribution of its pixel values. A good cipher image must have a uniform histogram to resist statistical analysis, meaning that each pixel value should appear with roughly the same frequency in the histogram. Figure11 shows the histogram analysis results. Figures 11(s)–11(x) show that the histograms of the cipher images were approximately uniform and significantly differed from those of the original images shown in Figures 11(g)–11(l).Figure 11
Histograms: (a–f) original images; (g–l) corresponding histograms of the original images; (m–r) cipher images; (s–x) corresponding histograms of the cipher images.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)Furthermore, we used the chi-square (χ2) test [34, 39] for the quantitative analysis of the distribution of pixel values; the calculation of x2 is given by(25)χ2=∑i=1Lfi−pi2pi,where L is the pixel level of an image (and in an 8-bit grayscale image, any pixel has 28 levels; thus, L = 256), fi is the occurrence frequency of each pixel value obtained from the observation, and pi is the expected occurrence frequency of each pixel value. An ideal cipher image has a uniform distribution, so pi = W × H/L. Table 1 illustrates the χ2 value of 293.24783 (the significance level α = 0.05). Hence, the cipher images were able to successfully pass the χ2 test, indicating that our algorithm had a strong ability to resist frequency analysis attacks.Table 1
Results of x2 values of the above histograms.
ImageTheoretical valuePlainCipherResultLena293.247383.9869 × 104255.0625PassResolution293.247381.1983 × 107252.5625PassBaboon293.247381.8763 × 105261.2988PassPeppers293.247381.2017 × 105248.5898PassAirplane293.247387.1999 × 106243.5757PassMale293.247387.0934 × 105261.7827Pass


## 4.2. Randomness Analysis

An ideal cipher image should not leak any information not only in visual aspect but also in statistic level. To verify the validation of our algorithm on hiding statistical information as well as the randomness of the key matrixes generated by the proposed key generation method, we apply the SP 800–22 test suit from NIST (which consists of 01: Frequency, 02: Block Frequency, 03: Cumulative Sums, 04: Runs, 05: Longest Runs of Ones, 06: Rank, 07: Spectral DFT, 08: Nonperiodic Template Matchings, 09: Overlapping Template Matchings, 10: Universal Statistical, 11: Approximate Entropy, 12: Random Excursions, 13: Random Excursions Variant, 14: Serial, and 15: Linear Complexity) on the cipher image and its corresponding key matrixes (note: they are converted to binary sequences before test). And we set the significant levelα = 0.01 in this paper; then, if the result P-value>0.01, the sequence can be considered to be random with a confidence of 99%. As we can see in Table 2, all P-values of cipher images and key matrixes are greater than 0.01. Therefore, we can safely conclude that our algorithm has high resistance to statistical attacks.Table 2
Results of the SP 800–22 test suit (setα = 0.01).
Test no.P valueKM1KM1KM1KM1LenaResolutionBaboonPeppersAirplaneMale010.18310.19670.48670.90730.34590.30150.62440.44960.61820.6014020.56190.28050.58840.43610.39020.59010.22230.18390.22930.9339030.69880.54410.77070.04150.51580.09330.17780.07350.05350.9798040.94270.32140.12670.69850.72970.92990.44720.03250.57890.4323050.42370.81550.02650.23210.64640.98190.37340.96150.92110.4005060.51640.33720.72140.92040.47480.03140.57620.89190.28240.8134070.17040.25110.65380.13390.74680.97730.32990.30130.22340.4248080.63620.10840.71510.89570.99140.15840.28310.03250.99010.7867090.86150.95390.15260.21720.56950.47850.43860.56550.16480.1751100.29850.40080.79530.89020.05890.99950.41350.27970.36780.2902110.13210.60320.16590.59040.83150.51250.61980.10230.40730.1038120.52120.83920.31680.24290.96650.18730.54240.48160.34730.6574130.62540.29610.79550.76820.22790.16540.31810.26710.65030.9272140.60460.48260.29890.73320.41360.35190.45490.25120.20630.1946150.51460.20530.81920.82210.52880.73160.46390.38110.60680.3085ResultPassPassPassPassPassPassPassPassPassPass


## 4.3. Correlation Analysis between Adjacent Pixels

A good image encryption algorithm can break the correlation between adjacent pixels, whether in the vertical, horizontal, or diagonal directions. Figure12 shows the correlation distribution of the benchmark image “Lena” and its cipher image in three directions. Using the proposed algorithm, the correlation distribution of adjacent pixels was converted from highly concentrated in the original image into completely random in the cipher image.Figure 12
Correlation distribution of adjacent pixels in (a) vertical, (b) horizontal, and (c) diagonal directions of the original image as well as the (d) vertical, (e) horizontal, and (f) diagonal directions of the cipher image.
(a)(b)(c)(d)(e)(f)In this subsection, we continue to use the correlation coefficientγxy to measure the correlation between adjacent pixels. To some extent, the lower the correlation coefficient in the cipher image is, the higher the security the image encryption algorithm provides.γxy is given by(26)x¯=1N∑i=1Nxi,y¯=1N∑i=1Nyi,γxy=∑i=1Nxi−x¯yi−y¯∑i=1Nxi−x¯2∑i=1Nyi−y¯2,where xi and yi are grey values of two adjacent pixels and N represents the number of pixels.For this test, we randomly selected 10,000 pairs of adjacent pixels from the original images and the corresponding ciphers image in three directions. Table3 shows that the proposed algorithm was able to significantly decrease the correlation between adjacent pixels. Moreover, as Table 4 shows, in comparison to the benchmark digital image “Lena,” our algorithm performed better at resisting statistical analysis attacks than the alternative methods.Table 3
Results of correlation coefficients.
ImageVerticalHorizontalDiagonalPlainCipherPlainCipherPlainCipherLena0.9575–0.00150.92030.00050.91480.0012Resolution0.8668–0.00350.87220.00280.7568–0.0030Baboon0.75240.00220.86530.00120.7210–0.0011Peppers0.97640.00090.97330.00220.9651–0.0006Airplane0.9458–0.00170.96470.00020.94420.0010Male0.9804–0.00040.9769–0.00140.9669–0.0007Table 4
Comparison of correlation coefficients.
AlgorithmOursRef. [33]Ref. [34]Ref. [35]Vertical–0.0015–0.04630.01060.0020Horizontal0.0005–0.0004–0.00120.0035Diagonal0.00120.00100.00090.0027


## 4.4. Shannon Entropy

In this subsection, we utilize the global Shannon entropy and local Shannon entropy to thoroughly verify the resistance against entropy attacks of our algorithm.


### 4.4.1. Global Shannon Entropy (GSE)

The Shannon entropy is an important indicator to evaluate the degree of uncertainty and diffusion of a cipher image. Commonly, the GSE is calculated to obtain the degree of uncertainty of the whole cipher image, as given by(27)∑i=0L−1pgi=1,Hg=−∑i=0L−1pgilog2pgi,where L = 256 for a grayscale image and p(gi) denotes the probability of each grey value gi. Therefore, as an ideal grayscale cipher image, the theoretical maximum GSE value H(g) = 8. Table 5 shows the GSE results and comparison. Because all entropies of cipher images were remarkably close to 8, we concluded that the proposed algorithm had good diffusion performance.Table 5
Results and comparison of GSE.
ImagePlainCipherOursRef. [33]Ref. [34]Ref. [35]Lena7.44297.99737.99637.99727.9967Resolution1.54837.99727.99687.99687.9963Baboon7.35837.99937.99877.99927.9992Peppers7.59377.99927.99857.99937.9993Airplane5.64157.99987.99927.99977.9997Male7.52377.99987.99937.99997.9998


### 4.4.2. Local Shannon Entropy (LSE)

However, Wu et al. [45] indicated that GSE had certain limitations on some occasions. Hence, the LSE, which was given by (28), was introduced to strictly verify the diffusion performance,(28)H¯k,TbS=∑i=1kHSik,where S1, S2…Sk are k randomly selected nonoverlapping image blocks with TB pixels from the image and H(Si) is the GSE of Si. When we set (k, TB) = (30, 1936) and significance α = 0.05, the theoretical value of LSE was 7.902469317 [45]. However, when the experimental results fell into the interval (7.901901305, 7.903037329), we considered the tests passed to have passed. As Table 6 shows, the results of the LSE all fell into the significant interval.Table 6
Results of LSE.
ImageLenaResolutionBaboonPeppersAirplaneMaleLSE7.9020434247.9029099897.9023479447.9026970697.9026117137.902244927ResultPassPassPassPassPassPass


## 4.4.1. Global Shannon Entropy (GSE)

The Shannon entropy is an important indicator to evaluate the degree of uncertainty and diffusion of a cipher image. Commonly, the GSE is calculated to obtain the degree of uncertainty of the whole cipher image, as given by(27)∑i=0L−1pgi=1,Hg=−∑i=0L−1pgilog2pgi,where L = 256 for a grayscale image and p(gi) denotes the probability of each grey value gi. Therefore, as an ideal grayscale cipher image, the theoretical maximum GSE value H(g) = 8. Table 5 shows the GSE results and comparison. Because all entropies of cipher images were remarkably close to 8, we concluded that the proposed algorithm had good diffusion performance.Table 5
Results and comparison of GSE.
ImagePlainCipherOursRef. [33]Ref. [34]Ref. [35]Lena7.44297.99737.99637.99727.9967Resolution1.54837.99727.99687.99687.9963Baboon7.35837.99937.99877.99927.9992Peppers7.59377.99927.99857.99937.9993Airplane5.64157.99987.99927.99977.9997Male7.52377.99987.99937.99997.9998


## 4.4.2. Local Shannon Entropy (LSE)

However, Wu et al. [45] indicated that GSE had certain limitations on some occasions. Hence, the LSE, which was given by (28), was introduced to strictly verify the diffusion performance,(28)H¯k,TbS=∑i=1kHSik,where S1, S2…Sk are k randomly selected nonoverlapping image blocks with TB pixels from the image and H(Si) is the GSE of Si. When we set (k, TB) = (30, 1936) and significance α = 0.05, the theoretical value of LSE was 7.902469317 [45]. However, when the experimental results fell into the interval (7.901901305, 7.903037329), we considered the tests passed to have passed. As Table 6 shows, the results of the LSE all fell into the significant interval.Table 6
Results of LSE.
ImageLenaResolutionBaboonPeppersAirplaneMaleLSE7.9020434247.9029099897.9023479447.9026970697.9026117137.902244927ResultPassPassPassPassPassPass


## 4.5. Plaintext Sensitivity Analysis

Plaintext sensitivity guarantees the ability of an encryption algorithm to resist differential attack, meaning that two original images with a minor difference will result in two completely different cipher images. The two measurements were used to evaluate the sensitivity of the plain image, including the number of pixel change rate (NPCR) and the unified average changing intensity (UACI). These measures were calculated as given by(29)NPCR=1H×W∑i=1H∑j=1WDi,j×100%,UACI=1H×W∑i=1H∑j=1WC1i,j−C2i,j255×100%,Di,j=0,C1i,j=C2i,j,1,C1i,j≠C2i,j,,where C1 and C2 are the cipher images corresponding to two one-pixel different plane images.For this test, we randomly selected one pixel from a plain image in any position, changed its value by only 1 bit, and then calculated NPCR and UACI. We tested this procedure 100 times, and Table7 shows the average results. We observed that the results were remarkably close to the expected values of NPCRE = 99.6094% and UACIE = 33.4635%. Hence, our algorithm had a strong ability to resist differential attacks.Table 7
NPCR and UACI values of plaintext sensitivity test (unit: %).
ImageNPCRUACIOursRef. [33]Ref. [34]Ref. [35]OursRef. [33]Ref. [34]Ref. [35]Lena99.607399.6099.621699.609433.475133.5433.499433.4303Resolution99.608999.6099.630799.578933.487833.5433.425333.4879Baboon99.609999.6299.636899.617033.485133.4233.470233.4736Peppers99.609299.6299.586599.609433.457933.4233.481533.4289Airplane99.610799.6199.607899.595633.460633.5033.530733.3824Male99.608699.6199.624699.586533.455833.5033.477133.4528


## 4.6. Key Sensitivity Analysis

A secure encryption algorithm must be sensitive to the secret key. This is reflected in two aspects; on the one hand, two encryption keys with small differences will result in two completely different cipher images; on the other hand, a subtle error in the decryption key may be expected to cause the decryption to become utterly incorrect.For this test, we chose “Resolution” as a test image. Hence, we obtained the SK = {9C5C00CFCFB3420A453AF7F35043C1121B4BACE25F0ED6BC7EAD7CC964A2585A5F10476FE09FD648479112FEBA19AFEE} via Step 1-2. According to equations (5) and (6), we split the SK into nine parts.In the first stage, we changed the lowest significant bit of the nine parts and then used it to encrypt the original image. We used NPCR and UACI to evaluate the differences between the two cipher images. Table8 shows that any small change in the encryption key would lead to a radical change in the cipher image. Hence, our proposed encryption algorithm had high sensitivity to the encryption key.Table 8
NPCR and UACI values of encryption key sensitivity test (unit: %).
Secret keyChanged valueNPCRUACI9C5C00CFCFB39C5C00CFCFB299.594133.4227420A453AF7F3420A453AF7F299.612433.41615043C1121B4B5043C1121B4A99.584933.4287ACE25F0ED6BCACE25F0ED6BD99.617033.48817EAD7CC964A27EAD7CC964A399.604833.5054585A5F10476 F585A5F10476 E99.613933.5104E09FD6484791E09FD648479099.624633.496312FEBA12FEBB99.618533.674119AFEE19AFEF99.623133.4679In the second stage, we used the correct secret key and the previous nine secret keys to decrypt the cipher image. Figure13 shows that the cipher image could be recovered only if the decryption key was correct.Figure 13
Decryption result: (a) cipher image decrypted using (b) the correct SK and the incorrect SK where (c) SK (12) = 2; (d) SK (60) = 3; (e) SK (72) = E; (f) SK (84) = 0; (g) SK (90) = B; and (h) SK (96) = F.
(a)(b)(c)(d)(e)(f)(g)(h)Furthermore, we continued to use NPCR and UACI to measure the difference between the cipher image and the incorrect decrypted image. Table9 shows that even minor incorrectness of the decryption key would cause the cipher to be unrecoverable. Therefore, our proposed algorithm had high sensitivity to the decryption key.Table 9
NPCR and UACI values of decryption key sensitivity test (unit: %).
Secret keyModified valueNPCRUACI9C5C00CFCFB39C5C00CFCFB299.592633.5404420A453AF7F3420A453AF7F299.627733.52055043C1121B4B5043C1121B4A99.618533.3798ACE25F0ED6BCACE25F0ED6BD99.572833.42927EAD7CC964A27EAD7CC964A399.620133.5472585A5F10476 F585A5F10476E99.600233.6544E09FD6484791E09FD648479099.609433.604512FEBA12FEBB99.607833.629319AFEE19AFEF99.621633.4723


## 4.7. Key Space Analysis

In general, a large key space could ensure that the encryption algorithm would resist brute-force attacks. We employed HCLS, PWLCM, CM, and LM to design the proposed encryption algorithm. The keys included the initial values x1, x2, x3, x4, y1, y2, and y3 and preiterations pre1, pre2, pre3, and pre4, which were determined by 384-bit SK. In Section 3.5, we prove that any tiny change of SK can influence the results of encryption and decryption. Hence, the key space of our algorithm was 2384>> 2128 [34, 36], which was a sufficiently large key space to resist brute-force attacks.


## 4.8. Resistance Attacks Analysis

For an applicable encryption algorithm, even if all the details of the algorithm are overt, the cryptanalyst could not obtain any useful information from ciphertext without a secret key. Commonly, the attacker has four methods to decode the encryption algorithm, which are ciphertext only attack, known plaintext attack, chosen plaintext attack, and chosen ciphertext attack, from weak to strong. All-black and all-white images are most often employed to perform attacks. The proposed image encryption algorithm depends on the simultaneous permutation-diffusion structure to make any minor changes of any pixel can cause significant changes of the cipher image. Figure14 shows the histogram of pure-white and pure-black images, and Table 10 lists the experimental results of the above security tests on their cipher images. The uniform distribution of encrypted pure-white/black image in Figure 14 indicates that attackers cannot extract any useful information from cipher images. Furthermore, as shown in Table 10, the plaintext sensitivity, entropy, and correlation results are very close to the ideal value. Hence, we can draw a conclusion that even chosen plaintext/ciphertext cannot assist attackers to recover plain image and secret key, and our algorithm has high security to resist the powerful attacks like chosen plaintext attack and chosen ciphertext attack.Figure 14
Histogram results. (a) Pure-white image and its (b) corresponding cipher image. (c) Histogram of pure-white cipher image. (d) Pure-black image and its (e) corresponding cipher image. (f) Histogram of pure-black cipher image.
(a)(b)(c)(d)(e)(f)Table 10
Results of security experiment of pure-white and pure-black images.
Testχ2 testNPCR (%)UACI (%)EntropyCorrelation coefficientMinMaxMinMaxGlobalLocalHorizontalVerticalDiagonalPure-white262.910599.600899.629133.444933.46077.99927.9021−0.00150.00190.0024Pure-black251.683799.588799.615933.450333.47057.99957.90270.00270.0008−0.0035


## 4.9. Time Complexity Analysis

Although security performance is the most important index of an image encryption algorithm, the significance of the execution speed algorithm cannot be ignored in practice. The proposed algorithm mainly consisted of the following five parts: (1) secret key generation; (2) generation of key matrixes; (3) generation of circshift values; (4) initial vector generation; (5) encryption/decryption. However, the secret key generation process could be executed independently, and thus we were able to obtain the secret keys long before the encryption/decryption process. Hence, we discuss the time complexity of the other four parts. The time complexities were as follows. For the key matrix generation, the time complexity was Θ(3H + 2W); for the circshift value generation, it was Θ(H + W); for the initial vector generation, it was Θ(W), and for the encryption/decryption process, the time complexity was Θ(2H + 2W). In summary, the time complexity of the proposed algorithm was Θ(6H + 6W). By comparison with some previously reported algorithms, the apparent advantage of our algorithm was the low time complexity of key generation. Table 11 presents the average execution time for different plain images and different algorithms. It shows that our algorithm was much faster than the alternative methods compared [33–35]. Even by comparison with some partial encryption and low-dimensional chaotic system-based encryption algorithms [32, 41], our algorithm can also achieve faster speed. Therefore, the execution efficiency of our proposed algorithm may be considered acceptable for secure real-time image communications.Table 11
Execution times of different images and different algorithms (unit: s).
ImageSizeOursRef. [33]Ref. [34]Ref. [35]Ref. [32]Ref. [41]Lena256 × 2560.00930.4310.27680.02310.2470—Resolution0.00890.3850.28520.0195Baboon512 × 5120.03111.1861.33230.10990.79050.2441Peppers0.03121.5101.04670.0863Airplane1024 × 10240.11343.5423.98010.3281——Male0.11303.7834.25330.3505


## 4.10. Robustness Analysis

A cipher image transferred on public channels would inevitably suffer from data loss or noise pollution. However, a robust image encryption algorithm could still recover the cipher image with data loss or noise pollution, reconstructing a recognizable image using the correct decryption key.


### 4.10.1. Robustness against Data Loss

To verify the robustness of our proposed algorithm, the Peppers’ cipher image was cropped with different densities (see Figures15(a)–15(d)(a–d)), and the corresponding decrypted images were examined (see Figures 15(e)–15(h)). Figure 15 shows that the cipher image with less than 50% data loss could be decrypted to a recognizable image. Thus, our image encryption algorithm is robust against data loss that occurs on public channels.Figure 15
Cipher images with data loss (a) 1/16; (b) 1/8; (c) 1/4; (d) 1/2; (e) decrypted image of (a); (f) decrypted image of (b); (g) the decrypted image of (g); (h) the decrypted image of (d).
(a)(b)(c)(d)(e)(f)(g)(h)


### 4.10.2. Robustness against Noise Pollution

In this test, the cipher image was polluted by salt and pepper noise (uniform distribution) and Gaussian noise (normal distribution) with different intensities.First, we added Gaussian noise to the cipher image with intensities of 0.001, 0.005, and 0.01, and then we used the correct decryption key to recover the polluted images. Figures16(a)–16(c) show that although the decrypted images were affected by the noise, we could still identify the images as “Peppers.” Second, we added salt and pepper noise to the cipher image with intensities of 0.01, 0.05, and 0.1, as shown in Figure 16(d)–16(f)), the decrypted images. We were also able to obtain a readable context. The results indicate that our proposed algorithm is robust against noise pollution on a public channel. We observe that if these decrypted images had some special use, a denoising process would be required to enhance their quality.Figure 16
Decrypted image from the cipher image polluted by Gaussian noise with an intensity of (a) 0.001; (b) 0.005; (c) 0.01 and polluted by salt and pepper noise with an intensity of (d) 0.01; (e) 0.05; (f) 0.1.
(a)(b)(c)(d)(e)(f)


### 4.10.3. Quality Analysis

Although decrypted images with data loss or noise pollution are recognizable in vision, we adopt PSNR (Peak Signal-to-Noise Ratio) to evaluate their qualities by comparison with the original plain image. The PSNR [36] is defined as(30)PSNR=10lg255×2551/W×H∑i=1W∑j=1HPi,j−Di,j2.Then, as shown in Table12, the PSNR values of decrypted images with different degrees of data loss and noise pollution are all greater than 10 dB, which illustrates that our algorithm has enough robustness to provide protection for image data transmission even over the unstable channel.Table 12
PSNR values of decrypted images with data loss or noise pollution (unit: dB).
TypeData lossGaussianSalt and peppersDegree1/161/81/41/20.0010.0050.010.010.050.1PSNR20.794917.793114.801911.816314.075011.663911.023420.152413.685311.4023


## 4.10.1. Robustness against Data Loss

To verify the robustness of our proposed algorithm, the Peppers’ cipher image was cropped with different densities (see Figures15(a)–15(d)(a–d)), and the corresponding decrypted images were examined (see Figures 15(e)–15(h)). Figure 15 shows that the cipher image with less than 50% data loss could be decrypted to a recognizable image. Thus, our image encryption algorithm is robust against data loss that occurs on public channels.Figure 15
Cipher images with data loss (a) 1/16; (b) 1/8; (c) 1/4; (d) 1/2; (e) decrypted image of (a); (f) decrypted image of (b); (g) the decrypted image of (g); (h) the decrypted image of (d).
(a)(b)(c)(d)(e)(f)(g)(h)


## 4.10.2. Robustness against Noise Pollution

In this test, the cipher image was polluted by salt and pepper noise (uniform distribution) and Gaussian noise (normal distribution) with different intensities.First, we added Gaussian noise to the cipher image with intensities of 0.001, 0.005, and 0.01, and then we used the correct decryption key to recover the polluted images. Figures16(a)–16(c) show that although the decrypted images were affected by the noise, we could still identify the images as “Peppers.” Second, we added salt and pepper noise to the cipher image with intensities of 0.01, 0.05, and 0.1, as shown in Figure 16(d)–16(f)), the decrypted images. We were also able to obtain a readable context. The results indicate that our proposed algorithm is robust against noise pollution on a public channel. We observe that if these decrypted images had some special use, a denoising process would be required to enhance their quality.Figure 16
Decrypted image from the cipher image polluted by Gaussian noise with an intensity of (a) 0.001; (b) 0.005; (c) 0.01 and polluted by salt and pepper noise with an intensity of (d) 0.01; (e) 0.05; (f) 0.1.
(a)(b)(c)(d)(e)(f)


## 4.10.3. Quality Analysis

Although decrypted images with data loss or noise pollution are recognizable in vision, we adopt PSNR (Peak Signal-to-Noise Ratio) to evaluate their qualities by comparison with the original plain image. The PSNR [36] is defined as(30)PSNR=10lg255×2551/W×H∑i=1W∑j=1HPi,j−Di,j2.Then, as shown in Table12, the PSNR values of decrypted images with different degrees of data loss and noise pollution are all greater than 10 dB, which illustrates that our algorithm has enough robustness to provide protection for image data transmission even over the unstable channel.Table 12
PSNR values of decrypted images with data loss or noise pollution (unit: dB).
TypeData lossGaussianSalt and peppersDegree1/161/81/41/20.0010.0050.010.010.050.1PSNR20.794917.793114.801911.816314.075011.663911.023420.152413.685311.4023


## 5. Conclusion

This paper presents efficient hyperchaotic image encryption based on a fast key generation method and simultaneous permutation-diffusion structure. Due to a secret key generation method adopting the SHA-384 function, the proposed algorithm has strong resistance against chosen plaintext attacks since its secret key can be highly sensitive to even minor changes of the plain image. Then, we introduce a fast key generation method to reduce the iteration times of the HCLS fromW × H/4 to 2W. During the generation process, eight integer sequences, which are obtained from the hyperchaotic sequence, with length W are divided into two groups for bitxor operation and circshift operation. Since the permutation of each group is randomly chosen by the PWLCM, the generated four key matrixes will have strong unpredictability as well as good randomness. Furthermore, taking the matrix form of the image into consideration, we successfully apply the vectorization technique to the encryption process. And within the encryption process consisting of a four-diffusion round, the plain image is not only sufficiently encrypted row by row and column by column interlinked by CBC mode with high efficiency but also randomly scrambled by the CM to further enhance the capability against attacks. In addition, we employ the LM to fast generate an initial vector for the first diffusion round. Experimental results illustrate that the key space of our algorithm is 2384, χ2 values of histograms are less than 293.24738, γ x y values of adjacent pixels are close to 0, entropies of cipher images are more than 7.99, and NPCR and UACI values are close to expected values. By comparison with previous works, we can safely conclude that the proposed algorithm can provide higher security and stronger robustness to resist statistical, brute-force, differential, and some other common attacks. Moreover, the execution times of our algorithm on 256 × 256, 512 × 512, and 1024 × 1024 images are 0.009 s, 0.03 s, and 0.11 s, which indicate that it has extensive applications in real-time communications of massive digital images. However, chaos-based image encryption is under continuous research. In the future, we will focus on migrating the proposed algorithm to a parallel computing platform, which could further accelerate its operation.



---

*Source: 2237525-2022-04-28.xml*