# Reversible Data Hiding in Encrypted Domain Based on the Error-Correction Redundancy of Encryption Process

Authors: Kong Yongjun; Zhang Minqing; Wang Zexi; Ke Yan; Huang Siyuan
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The existing reversible data hiding methods in encrypted domain separate image encryption from information embedding and do not make full use of the redundant space in the process of image encryption. In order to improve the performance of reversible data hiding by using the technical characteristics of image encryption, a reversible data hiding method based on McEliece error correction is proposed. Firstly, the segmentation position of bit plane is determined according to the embedding requirement and texture characteristic, and the image is divided into high and low significant bits. Secondly, because of the error-correcting characteristic of McEliece encryption, reversible data embedding can be realized while encrypting low significant bits. Then, the high significant bits are compressed to reserve space for the ciphertext extension of the low significant bits. Finally, the whole high significant bits information is stream-encrypted. As long as the image receiver has the decryption key, the image can be restored without distortion. By concealing the relationship between error correction and secret information mapping, the concealment of secret information transmission can be realized. In addition, due to different processing for different pixels, it can be efficiently transmitted with low computational complexity for applications that only need general images. The simulation results show that this scheme can not only realize the separable operation of information extraction and image recovery but also resist the noise attack to a certain extent. The maximum embedding rates of 10 standard images from USC-SIPI and 50 standard images from BOSS-BASE are 2.228 and 2.323 bpp, respectively.


---

## Body

## 1. Introduction

The rapid development of 5G technology has greatly improved communication capabilities, while also having a profound impact on digital information processing [1, 2]. With the help of high-speed communication technology, mobile cloud computing, which connects multiple mobile terminals together, has quietly become the mainstream trend for processing digital information [3]. Mobile cloud computing is different from the traditional way of storing information on each terminal and processing it one by one. Users can transfer terminal computing to the cloud computing center for centralized processing in real time, thus effectively reducing the energy consumption of mobile terminal storage and computing. While enjoying the convenience brought by mobile cloud computing, frequent privacy disclosure issues [4, 5] under this framework cannot be ignored. In order to deal with the threat of privacy disclosure, more and more cloud applications need encryption technology [6] to protect sensitive data in all aspects of transmission, storage, and computing. Combined with the actual needs of cloud space environment, how to make more effective use of ciphertext data has become a research hot spot in the field of network security in recent years [7–9].Reversible Data Hiding in Encrypted Domain (RDH-ED) [10] is a technology that studies reversible embedding of secret information using encrypted data as the carrier. This technology can not only protect plaintext data by encryption but also realize application expansion of ciphertext data by using secret information embedded in ciphertext, which plays an important role. Taking encrypted images as an example, using RDH-ED, users with authority can not only ensure the accurate extraction of secret information but also ensure the original data recovery without distortion after extraction and decryption. To achieve the reversible embedding of secret information, RDH-ED schemes must vacate information embedding space. According to the process relationship between space vacation and encryption operation, the existing RDH-ED schemes are mainly divided into two categories: Vacating Room After Encryption (VRAE) and Vacating Room Before Encryption (VRBE) [11]. These two types of RDH-ED scheme frameworks are shown in Figure 1.Figure 1
Two types of RDH-ED. (a) Vacating Room After Encryption (VRAE). (b) Vacating Room Before Encryption (VRBE).
(a)(b)VRAE-type RDH-ED directly performs vacation operation on the redundant space of encrypted images to realize reversible embedding. The whole embedding and extraction operation does not affect the information protection by encryption, so it is suitable for third-party embedding operation [12–16]. Reference [12] uses Advanced Encryption Standard technology to encrypt the image and then divides the pixel block according to the size of the encrypted group. Combined with the pseudorandom generator for information replacement, the scheme realizes 1-bit information reversible embedding for each pixel block by changing texture standard deviation of pixel block. Due to the smoothness of the image texture, the receiver can modify decrypted image, so as to realize the lossless restoration of the original image and accurate extraction of secret information. As pixel block texture can be used to distinguish whether pixel block has changed or not, [13] introduced Support Vector Machine (SVM) to make the judgment of embedding more accurate. Meanwhile, public key adjustment mechanism was introduced in the process of information embedding to improve the performance. To solve inseparability of information extraction and image recovery in [12, 13], [14] uses wet paper coding technology to process encrypted data to achieve space vacation and inserts invisible watermarks into ciphertext state to achieve information embedding. Reference [15] uses the least significant bit (LSB) Hamming distance of ciphertext and preset auxiliary information to compress it, so as to vacate space in the encrypted image for information embedding. However, the schemes proposed in [14, 15] have strict requirements on the operation sequence of information extraction and image restoration. The image may be seriously distorted by direct decryption, which not only exposes the existence of the embedding process but also fails to extract the embedded data accurately. To achieve accurate extraction of embedded information before and after image decryption, [16] carries out key reuse in the same pixel block so that the encrypted pixel block can still retain the correlation of the original block. Then the Pixel Value Ordering (PVO) technique is applied to realize the reversible embedding of the encrypted pixel blocks. In this scheme, the accuracy of information extraction is not affected after decryption. In order to prevent the third party from obtaining valid information from the encrypted data, the correlation of the encrypted image will be severely damaged. Therefore, the space vacated for embedding of VRAE type is small.In order to improve the embedding capacity, many VRBE-type RDH-ED schemes have been proposed to vacate larger embedding space through preprocessing operations before encryption [17–25]. Reference [17] proposed embedding the least significant bit (LSB) information of some specific pixels into the plaintext image by traditional RDH method before image encryption. Then, after encryption, the specific LSB information is directly replaced with secret message, so as to realize the reversible embedding. To further optimize the space vacation effect during the preprocessing operation, VRBE-type RDH-ED scheme based on the prediction mechanism was proposed in [18]. For some specific pixels used for information embedding, the scheme uses the information of surrounding pixels to obtain the prediction error before encryption and then modifies the prediction histogram after encryption to achieve reversible embedding. As the prediction mechanism improves the utilization of redundant space, the image distortion after direct decryption is significantly reduced in [18] compared with [17]. The carrier of RDH-ED is mainly transmitted in encrypted state, so there is no need to consider the image distortion caused by preprocessing on the basis of ensuring the reversible restoration after extraction. To improve the embedding capacity, [19] designed a sampling pixel method to represent images with less information during the preprocessing and then proposed an RDH-ED scheme with high capacity based on the Mirroring Ciphertext Groups (MCG) by using the homogeneity and probability of Paillier algorithm. In [20], patch-level sparse representation is introduced before the encryption for a superior performance. As the sparse coding is an approximation solution, the leading residual errors are encoded and self-embedded in the cover image together with the learned dictionary. Due to the powerful representation of sparse coding, a larger embedding space can be vacated. To solve the problem of the hierarchical data hiding, [21] carried out further research on homomorphic encrypted images. In this scheme, the preprocessed image is encrypted in Paillier cryptosystem and two embedding algorithms are applied on the encrypted image in succession. By conducting data embedding in two phases, the embedded data can be extracted, respectively, in encrypted domain and after decryption. Modifying the most significant bit (MSB) will cause large image distortion, but the strong correlation of MSB is beneficial to improve the embedding performance of Prediction Error Expansion algorithm. As the carrier characteristics of RDH-ED do not consider the image quality preprocessed before encryption, [22] proposed a high-capacity RDH-ED scheme based on MSB prediction mechanism. Since the preprocessing of MSB can vacate a larger embedding space, the selection of the available plane space is optimized in [23] to improve the embedding capacity. In [24], PBTL coding was introduced during the error prediction, and the embedding capacity was further improved by combining with coding technology. In [25], bit plane partition was introduced before the encryption. Combined with an efficient MSB prediction strategy, the embedding capacity was improved by embedding the LSB values into the other bit plane.Since VRBE-type RDH-ED schemes make better use of the correlation in image information, they can obtain higher embedding capacity than VRAE-type ones. However, whether in VRBE or in VRAE, the embedding space is mainly obtained from the redundant space of the image information, so the embedded performance will be constrained by the image carriers. In addition, to achieve lossless recovery, most RDH-ED schemes must have extraction operations to correct distortions caused by embedding. In order to cover up the existence of embedding operation and directly obtain lossless images without extraction, this paper proposes a Vacating Room In Encryption (VRIE) scheme based on McEliece error-correction redundancy. Firstly, the segmentation position of bit plane is determined according to the embedding requirements and texture characteristics. Due to the subsequent error-correcting encryption of the low significant bit information, the ciphertext expansion will occur. In order to enable the encrypted image to be transmitted at its fixed size, the space compressed from the high significant bit information is used to place the extended ciphertext. Secondly, based on the error correction of McEliece encryption process, the secret information can be reversibly embedded while encrypting the low significant bit information. Next, while the high significant bit information is compressed by Huffman code, the extended part of the low significant bit ciphertext fills the space vacated by the compression of the highest significant bit. Finally, the high significant bit information after stream encryption and the low significant bit information after error-correction encryption are integrated to generate the encrypted image embedded with secret information.


## 2. Related Techniques

### 2.1. GOPPA Code

The GOPPA code is a rational fraction code defined by elements over the finite fieldFqm [26]. Because some of its subcodes can achieve the ideal performance of Shannon Channel Coding Theorem and can be quickly decoded, it plays an important role in error control systems and the construction of cryptography.


#### 2.1.1. Construction Process

The construction process of GOPPA code is as follows:(1)Suppose thatL=α1,α2,...,αn is an ordered subset of a finite field GFnqm, where 0<n≤qm, and, for any i≠j, there is always αi≠αj, i,j≤n.(2)Suppose thatGx is the polynomial of degree r over a finite field GFqm, and Gαi≠0i=1,...,r. The array of polynomial coefficients is g1,g2,...,gr.(3)
Suppose thatC=β1,β2,...,βn is the code in n-dimensional linear space, and the rational fraction RCx corresponding to the code is(1)RCx=∑i=1nβix−αi.All codesC, whose corresponding rational fraction satisfies formula (2), form set L, and the GOPPA Code, generated by Gx, is marked as ΓL,Gx.(2)C:RCx≡0modGx.According to the construction process, all the vectors of the GOPPA code can satisfy formula (3); that is, the GOPPA code ΓL,Gx is a linear code.(3)∀a,b∈ΓL,Gx⇒a+b∈ΓL,Gx.


#### 2.1.2. Error-Correcting Decoding

From the definition of GOPPA code construction, it can be inferred that(4)RCx=1x−α1⋯1x−αnβ1⋮βn=HCT=0modGx.Therefore, matrixH can be used as the check matrix of GOPPA code for decoding and error correction. In order to improve the speed of verification and decoding, matrix H needs to be deformed. By multiplying matrix H with an invertible matrix and extending it, we can get matrix H^ to correct the error when GOPPA code has a correctable error.(5)H^=1gα11gα2⋯1gαn⋮⋮⋮α1r−1gα1α2r−1gα2⋯αnr−1gαnα1rgα1α2rgα2⋯αnrgαn⋮⋮⋮α1n−1gα1α2n−1gα2⋯αnn−1gαn.Suppose thatu is the vector to be encoded, and the corresponding GOPPA code c without error can be obtained by the generation matrix G.(6)c=uG.Under the GOPPA coding system, the receiving vectorR can be expressed as(7)R=c+e∈GFnq,where c is the sending vector and e is the error vector.According to formula (8), we can calculate the concomitant formula siR of vector R:(8)siR=∑l=1nRlg−1alali−11≤i≤r.From the definition of GOPPA code construction, it can be deduced that(9)R∈ΓL,Gx⇔siR=0i=1,...,r.If the concomitant formulasiR is not zero, according to (7), errors occur during transmission.(10)sie=siRi≤r−1.The decoder operates as follows:(1)
Calculate the firstr known concomitant formula sequences by the Berlekamp-Massey method [27], and the minimal polynomial of the concomitant formula sie,i=1,…,n can be obtained.(2)
Calculate the remainingn-r unknown concomitant formula sequence sie,i=r+1,…,n by the minimal polynomial.(3)
Calculate the error vectoreT:(11)eT=H^−1s1e,sneT.(4)
Decode to get raw vectoru:(12)u=R−eG−1.


### 2.2. McEliece Encryption

In view of the NP-complete decoding problem of linear codes and the maturity of GOPPA decoding algorithm, McEliece proposed McEliece public key encryption scheme based on binary GOPPA codes [28].


#### 2.2.1. Key Generation

Over the finite fieldF2m, an irreducible polynomial is selected randomly, whose Hamming distance is t. Then, the generating matrix G with GOPPA code parameters [n, k, d] is constructed by this polynomial, where n=2m and d=2∗t−1.(1)
Composition of a private key: an invertible matrixS of k ∗ k dimension, a permutation matrix P of n ∗ n dimension, and GOPPA check code C which can realize bit error correction.(2)
Calculation of the corresponding public keyGpub:(13)Gpub=SGP.


#### 2.2.2. Encryption

To encrypt the message vectorm of length k,(1)
generate a random error vector e of lengthn, and the error vector e must satisfy the condition that the Hamming weight we is less than t, where wx represents the sum of different bits between vector x and the zero vector;(2)
generate the encrypted vector c according to the following formula:(14)c=mGpub+e.


#### 2.2.3. Decryption

To decrypt the encrypted vector c of lengthn, we have the following:(1)
Eliminate the influence of permutation matrix P:(15)c′=cP−1=mSG+eP−1.(2)
Due to the equationwe=weP−1, m′ can be obtained by error correcting with the GOPPA check code C of the private key, where m′=mS.(3)
Calculate the message vector m:(16)m=m′S−1.


### 2.3. Lossless Compression

#### 2.3.1. Run Length Coding (RLC)

Run Length Coding (RLC) rules are as follows:(1)
Record the number of the same symbol from the beginning of the information string until it changes(2)
Represent the original information by the string variations and the length of each same-symbol stringOn the decoding side, only need to restore the string according to the corresponding rules can realize the information decompression without loss. Assume that the information x = 1001110000 to be encoded, and the result of the Run Length CodingRLCx is 1234.


#### 2.3.2. Huffman Coding

Huffman encoding rules are as follows:(1)
Calculate the probability of different characters in the information string to be encoded, and sort the characters according to the probability from small to large(2)
Add the first two characters with the lowest probability and define them as new characters(3)
Reorder the probability of new characters with the remaining characters until all characters can be represented by a new characterA Huffman probability dictionaryDic can be finally generated according to the coding rules. For information x, the Huffman coding result is expressed as HCx. On the decoding side, receiver with the corresponding Huffman probability dictionary Dic can achieve lossless decompression.


## 2.1. GOPPA Code

The GOPPA code is a rational fraction code defined by elements over the finite fieldFqm [26]. Because some of its subcodes can achieve the ideal performance of Shannon Channel Coding Theorem and can be quickly decoded, it plays an important role in error control systems and the construction of cryptography.


### 2.1.1. Construction Process

The construction process of GOPPA code is as follows:(1)Suppose thatL=α1,α2,...,αn is an ordered subset of a finite field GFnqm, where 0<n≤qm, and, for any i≠j, there is always αi≠αj, i,j≤n.(2)Suppose thatGx is the polynomial of degree r over a finite field GFqm, and Gαi≠0i=1,...,r. The array of polynomial coefficients is g1,g2,...,gr.(3)
Suppose thatC=β1,β2,...,βn is the code in n-dimensional linear space, and the rational fraction RCx corresponding to the code is(1)RCx=∑i=1nβix−αi.All codesC, whose corresponding rational fraction satisfies formula (2), form set L, and the GOPPA Code, generated by Gx, is marked as ΓL,Gx.(2)C:RCx≡0modGx.According to the construction process, all the vectors of the GOPPA code can satisfy formula (3); that is, the GOPPA code ΓL,Gx is a linear code.(3)∀a,b∈ΓL,Gx⇒a+b∈ΓL,Gx.


### 2.1.2. Error-Correcting Decoding

From the definition of GOPPA code construction, it can be inferred that(4)RCx=1x−α1⋯1x−αnβ1⋮βn=HCT=0modGx.Therefore, matrixH can be used as the check matrix of GOPPA code for decoding and error correction. In order to improve the speed of verification and decoding, matrix H needs to be deformed. By multiplying matrix H with an invertible matrix and extending it, we can get matrix H^ to correct the error when GOPPA code has a correctable error.(5)H^=1gα11gα2⋯1gαn⋮⋮⋮α1r−1gα1α2r−1gα2⋯αnr−1gαnα1rgα1α2rgα2⋯αnrgαn⋮⋮⋮α1n−1gα1α2n−1gα2⋯αnn−1gαn.Suppose thatu is the vector to be encoded, and the corresponding GOPPA code c without error can be obtained by the generation matrix G.(6)c=uG.Under the GOPPA coding system, the receiving vectorR can be expressed as(7)R=c+e∈GFnq,where c is the sending vector and e is the error vector.According to formula (8), we can calculate the concomitant formula siR of vector R:(8)siR=∑l=1nRlg−1alali−11≤i≤r.From the definition of GOPPA code construction, it can be deduced that(9)R∈ΓL,Gx⇔siR=0i=1,...,r.If the concomitant formulasiR is not zero, according to (7), errors occur during transmission.(10)sie=siRi≤r−1.The decoder operates as follows:(1)
Calculate the firstr known concomitant formula sequences by the Berlekamp-Massey method [27], and the minimal polynomial of the concomitant formula sie,i=1,…,n can be obtained.(2)
Calculate the remainingn-r unknown concomitant formula sequence sie,i=r+1,…,n by the minimal polynomial.(3)
Calculate the error vectoreT:(11)eT=H^−1s1e,sneT.(4)
Decode to get raw vectoru:(12)u=R−eG−1.


## 2.1.1. Construction Process

The construction process of GOPPA code is as follows:(1)Suppose thatL=α1,α2,...,αn is an ordered subset of a finite field GFnqm, where 0<n≤qm, and, for any i≠j, there is always αi≠αj, i,j≤n.(2)Suppose thatGx is the polynomial of degree r over a finite field GFqm, and Gαi≠0i=1,...,r. The array of polynomial coefficients is g1,g2,...,gr.(3)
Suppose thatC=β1,β2,...,βn is the code in n-dimensional linear space, and the rational fraction RCx corresponding to the code is(1)RCx=∑i=1nβix−αi.All codesC, whose corresponding rational fraction satisfies formula (2), form set L, and the GOPPA Code, generated by Gx, is marked as ΓL,Gx.(2)C:RCx≡0modGx.According to the construction process, all the vectors of the GOPPA code can satisfy formula (3); that is, the GOPPA code ΓL,Gx is a linear code.(3)∀a,b∈ΓL,Gx⇒a+b∈ΓL,Gx.


## 2.1.2. Error-Correcting Decoding

From the definition of GOPPA code construction, it can be inferred that(4)RCx=1x−α1⋯1x−αnβ1⋮βn=HCT=0modGx.Therefore, matrixH can be used as the check matrix of GOPPA code for decoding and error correction. In order to improve the speed of verification and decoding, matrix H needs to be deformed. By multiplying matrix H with an invertible matrix and extending it, we can get matrix H^ to correct the error when GOPPA code has a correctable error.(5)H^=1gα11gα2⋯1gαn⋮⋮⋮α1r−1gα1α2r−1gα2⋯αnr−1gαnα1rgα1α2rgα2⋯αnrgαn⋮⋮⋮α1n−1gα1α2n−1gα2⋯αnn−1gαn.Suppose thatu is the vector to be encoded, and the corresponding GOPPA code c without error can be obtained by the generation matrix G.(6)c=uG.Under the GOPPA coding system, the receiving vectorR can be expressed as(7)R=c+e∈GFnq,where c is the sending vector and e is the error vector.According to formula (8), we can calculate the concomitant formula siR of vector R:(8)siR=∑l=1nRlg−1alali−11≤i≤r.From the definition of GOPPA code construction, it can be deduced that(9)R∈ΓL,Gx⇔siR=0i=1,...,r.If the concomitant formulasiR is not zero, according to (7), errors occur during transmission.(10)sie=siRi≤r−1.The decoder operates as follows:(1)
Calculate the firstr known concomitant formula sequences by the Berlekamp-Massey method [27], and the minimal polynomial of the concomitant formula sie,i=1,…,n can be obtained.(2)
Calculate the remainingn-r unknown concomitant formula sequence sie,i=r+1,…,n by the minimal polynomial.(3)
Calculate the error vectoreT:(11)eT=H^−1s1e,sneT.(4)
Decode to get raw vectoru:(12)u=R−eG−1.


## 2.2. McEliece Encryption

In view of the NP-complete decoding problem of linear codes and the maturity of GOPPA decoding algorithm, McEliece proposed McEliece public key encryption scheme based on binary GOPPA codes [28].


### 2.2.1. Key Generation

Over the finite fieldF2m, an irreducible polynomial is selected randomly, whose Hamming distance is t. Then, the generating matrix G with GOPPA code parameters [n, k, d] is constructed by this polynomial, where n=2m and d=2∗t−1.(1)
Composition of a private key: an invertible matrixS of k ∗ k dimension, a permutation matrix P of n ∗ n dimension, and GOPPA check code C which can realize bit error correction.(2)
Calculation of the corresponding public keyGpub:(13)Gpub=SGP.


### 2.2.2. Encryption

To encrypt the message vectorm of length k,(1)
generate a random error vector e of lengthn, and the error vector e must satisfy the condition that the Hamming weight we is less than t, where wx represents the sum of different bits between vector x and the zero vector;(2)
generate the encrypted vector c according to the following formula:(14)c=mGpub+e.


### 2.2.3. Decryption

To decrypt the encrypted vector c of lengthn, we have the following:(1)
Eliminate the influence of permutation matrix P:(15)c′=cP−1=mSG+eP−1.(2)
Due to the equationwe=weP−1, m′ can be obtained by error correcting with the GOPPA check code C of the private key, where m′=mS.(3)
Calculate the message vector m:(16)m=m′S−1.


## 2.2.1. Key Generation

Over the finite fieldF2m, an irreducible polynomial is selected randomly, whose Hamming distance is t. Then, the generating matrix G with GOPPA code parameters [n, k, d] is constructed by this polynomial, where n=2m and d=2∗t−1.(1)
Composition of a private key: an invertible matrixS of k ∗ k dimension, a permutation matrix P of n ∗ n dimension, and GOPPA check code C which can realize bit error correction.(2)
Calculation of the corresponding public keyGpub:(13)Gpub=SGP.


## 2.2.2. Encryption

To encrypt the message vectorm of length k,(1)
generate a random error vector e of lengthn, and the error vector e must satisfy the condition that the Hamming weight we is less than t, where wx represents the sum of different bits between vector x and the zero vector;(2)
generate the encrypted vector c according to the following formula:(14)c=mGpub+e.


## 2.2.3. Decryption

To decrypt the encrypted vector c of lengthn, we have the following:(1)
Eliminate the influence of permutation matrix P:(15)c′=cP−1=mSG+eP−1.(2)
Due to the equationwe=weP−1, m′ can be obtained by error correcting with the GOPPA check code C of the private key, where m′=mS.(3)
Calculate the message vector m:(16)m=m′S−1.


## 2.3. Lossless Compression

### 2.3.1. Run Length Coding (RLC)

Run Length Coding (RLC) rules are as follows:(1)
Record the number of the same symbol from the beginning of the information string until it changes(2)
Represent the original information by the string variations and the length of each same-symbol stringOn the decoding side, only need to restore the string according to the corresponding rules can realize the information decompression without loss. Assume that the information x = 1001110000 to be encoded, and the result of the Run Length CodingRLCx is 1234.


### 2.3.2. Huffman Coding

Huffman encoding rules are as follows:(1)
Calculate the probability of different characters in the information string to be encoded, and sort the characters according to the probability from small to large(2)
Add the first two characters with the lowest probability and define them as new characters(3)
Reorder the probability of new characters with the remaining characters until all characters can be represented by a new characterA Huffman probability dictionaryDic can be finally generated according to the coding rules. For information x, the Huffman coding result is expressed as HCx. On the decoding side, receiver with the corresponding Huffman probability dictionary Dic can achieve lossless decompression.


## 2.3.1. Run Length Coding (RLC)

Run Length Coding (RLC) rules are as follows:(1)
Record the number of the same symbol from the beginning of the information string until it changes(2)
Represent the original information by the string variations and the length of each same-symbol stringOn the decoding side, only need to restore the string according to the corresponding rules can realize the information decompression without loss. Assume that the information x = 1001110000 to be encoded, and the result of the Run Length CodingRLCx is 1234.


## 2.3.2. Huffman Coding

Huffman encoding rules are as follows:(1)
Calculate the probability of different characters in the information string to be encoded, and sort the characters according to the probability from small to large(2)
Add the first two characters with the lowest probability and define them as new characters(3)
Reorder the probability of new characters with the remaining characters until all characters can be represented by a new characterA Huffman probability dictionaryDic can be finally generated according to the coding rules. For information x, the Huffman coding result is expressed as HCx. On the decoding side, receiver with the corresponding Huffman probability dictionary Dic can achieve lossless decompression.


## 3. Proposed Method

In order to cover up the existence of secret information transmission during the RDH-ED scheme, the secret information extraction and embedding can be selectively carried out on the basis of the lossless recovery of original information by encryption key. In this paper, the redundancy in the construction of encryption algorithm is used to realize information embedding, and a VRIE-type RDH-ED scheme based on error-correction redundancy in the encryption process is designed.


### 3.1. VRIE Framework

At the sending terminal, content owner uses encryption keyKen combined with specific encryption to achieve security encryption. During encryption, the embedding space is vacated by mapping the redundancy of ciphertext or encryption key. At the same time, the secret information protected by the hidden key Khide can be selectively embedded in the way of controlling the redundancy during the encryption process, and finally an encrypted image that contains secret information (or not) is obtained.At the receiving terminal, the original image can be decrypted without any distortion as long as keyKen is obtained. If the encrypted image carries additional secret information, authorized users can extract the secret information protected by the hidden key Khide through the redundancy mapping during the decryption process. Then, the extracted information continues to be decrypted by the hidden key Khide, so as to obtain the secret information accurately. The framework of the VRIE type is shown in Figure 2.Figure 2
Vacating Room In Encryption (VRIE).As can be seen in Figure2, compared with the VRAE-type and the VRBE-type frameworks, the VRIE-type framework has the following advantages:(1)
The embedding and extraction operations are optional. No matter whether the transmission of secret information exists or not, for a third party, the receiver only uses the encryption keyKen for the image recovery. Therefore, this framework can realize the concealment of secret information transmission.(2)
Information extraction and image recovery can be separated. No matter whether secret information is extracted or not, the image obtained by direct decryption with encryption keyKen does not have any distortion compared with the original image.(3)
The embedding capacity is not restricted by image carriers. The embedding space mainly depends on the redundancy of the specific encryption process. Selecting an appropriate encryption algorithm can greatly improve the embedding capacity.(4)
Security has been improved. No operation is performed on the image before and after encryption, so the original image can be guaranteed without damaging the security of the encryption algorithm.


### 3.2. Reversible Data Hiding Based on Error-Correction Redundancy

Based on the error correction of GOPPA coding, McEliece encryption introduces random errors during the construction process to establish NP-difficult linear decoding problem to achieve information protection. For data encrypted with the same pair of public and private keys, the introduced random error can produce a large amount of ciphertext redundancy. At the same time, the receiver can eliminate the redundancy with the verification operation of GOPPA code to ensure the accurate recovery. On the basis of not destroying the security of the encryption system, we propose establishing the mapping relationship between the secret information and the random error and then controlling the random error to realize the reversible data hiding.


#### 3.2.1. Error Mapping

Assuming that the McEliece encryption used for encryption is based on GOPPA code with parameter [n, k, d], every time plaintext P with length k can be encrypted, the error vector e with length n can be corrected. The maximum number of error positions in the error vector e is d. The set of all available error vectors is E, and the number of elements CradE in the set can be expressed by the following formula:(17)CradE=Cn1+Cn2+...+Cnd.The information to be embedded is converted into binary representation, and each encryption can map⌊log2CradE+1⌋ bit information with one error vector. In order to make full use of the error-correction redundancy, the sending and receiving terminals can negotiate a bijective mapping relationship in advance. Up to 2⌊log2CradE+1⌋! kinds of mapping relationship are available for each McEliece encryption with specified parameters.So each embedding operation can realize the embedding of 3-bit information, and a maximum of 4 kinds can be agreed.Taking GOPPA code with parameters [1, 4, 7] as an example, there are C71=7 error vectors that can be used for correction. Each encryption operation can embed ⌊log27+1⌋=3 bits of additional information, and a maximum of 8!=40320 kinds of mapping relationship can be available for embedding. Figure 3 illustrates two different error mapping relationships under this parameter condition. eii=1,...,7 represents an error vector, respectively, and e0 indicates that no error occurs. mii=1,...,8 represents the data to be embedded with a size of 3 bits.Figure 3
Two different mapping relationships between error vector and data to be embedded.


#### 3.2.2. Implementation Process

This scheme uses the error-correction redundancy of McEliece encryption to embed and extract information. For the image carrier with lengtha and width b, McEliece encryption based on parameters [n, k, d] is selected to realize the secret information embedding. The specific implementation process is as follows:(1)
Send terminalStep 1: Bit plane segmentationThe pixel information is converted into the eight-bit binary representation, with the bit plane order arranged from left to right. Then, according to the ciphertext expansion generated by embedding requirement and compressible redundancy space, the original pixel matrix is segmented intom-bit LSB I7−m,...,8 and (8-m)-bit MSB information I1,...,8−m.Step 2: Compression of MSB informationFirstly, dimensionality reduction is carried out on the MSB informationI1,...,8−m. Due to the strong correlation of the same bit plane information, a one-dimensional array FI1,...,8−m is arranged according to the order of the bit plane from small to large.(18)FI1,...,8−m=fi|i=1,...,ab∗8−m.Then, RLC and Huffman coding are performed on this array successively to obtain the compression codingDI1,...,8−m of the MSB information.(19)DI1,...,8−m=HCRLCFI1,...,8−m.Step 3: McEliece encryption of LSB information with secret information embeddingFirstly, group the LSB informationI7−m,...,8 in length of k, which can be divided into ⌊abm/k⌋ groups of arrays.Secondly, according to the construction parameters of McEliece encryption, the appropriate generation matrix is selected to calculate the corresponding public and private keys. Then, use the public keyGpub to encrypt each group pi|i=1,...,k. In the process of each array encryption, the preset error mapping relationship can be used to control the correctable error and realize ⌊log2CradE+1⌋ (introduced in 2.2.1) bit information embedding. During the entire encryption of the LSB information, up to ⌊abm/k⌋∗⌊log2CradE+1⌋. bits of additional information can be embedded. Additional information is generated by stream encrypting secret information with a protection key Khide. The first abm bit ciphertext is saved as the low significant bit ciphertext CL, and the remaining ciphertexts are filled into the MSB space as extended ciphertexts.Step 4: Stream encryption of MSB information composed of compressed coding and extended ciphertextsFirstly, the information in the extended ciphertext spaceS1, which is generated from the McEliece encryption, is filled into the redundant space S2 obtained after the MSB compression. At the same time, random information is added to the unfilled part of space S2 to ensure that the image is transferred with the size of the original matrix. Formulas (20) and (21) represent the sizes of S1 and S2, respectively.(20)S1=abmk∗n−abm,S2=ab∗8−m−DI1,...,8−m.Then, the pseudorandom seedKen is used to generate sequences r1,...,rab∗8−m to perform stream encryption on the filled MSB information.Step 5: Generation of encrypted imageThe encrypted information from different-significant-bit space is converted to the specified size and then merged into an encrypted image according to the size of original matrix.(2)
Receive terminalStep 1: Bit plane segmentationUsing the negotiated parameterm, the encrypted pixel matrix is segmented into m-bit and (8-m)-bit MSB information. The original pixel is segmented into m-bit LSB and (8-m)-bit MSB information.Step 2: Stream decryption of MSB informationThe pseudorandom seedKen is used to generate the same sequences r1,...,rab∗8−m. Then, stream decryption is performed on the MSB ciphertext to obtain the compressed most-effective-bit information and the extended ciphertext generated from the LSB encryption.Step 3: McEliece decryption of LSB information with secret information extractingFirstly, the extended ciphertext of McEliece encryption from the MSB space and the ciphertext from the LSB space are combined together and then grouped in units ofn bits. For each group of ciphertexts, the invertible matrix S, permutation matrix P, and check code C in the McEliece private key are used for error correction and decryption. Thus, the LSB plaintext information in units of k bits is obtained. During decryption, specific errors introduced in the encryption can be checked. Therefore, the accurate extraction of additional information can be achieved by combining the mapping relationship. The authorized user with the protection key Khide can stream-decrypt the additional information to get the secret information.Step 4: Decompression of MSB informationDecompressing the compressed most-effective-bit information with RLC and Huffman coding, the MSB plaintext information can be obtained in the form of one-dimensional array.Step 5: Generation of recovered imageThe decrypted information from different-significant-bit space is converted to the specified size and then merged into a recovered image according to the size of original matrix.


#### 3.2.3. Processing of Auxiliary Information

In order to ensure the lossless recovery of the encrypted image, the receive terminal must first get the necessary auxiliary parameters for the decryption process.The auxiliary information consists of the following parts: auxiliary information A lengthL1 (⌈log2A⌉ bit), bit plane segmentation parameter m (3 bits), construction parameters of McEliece encryption [n, k, d] (⌈log2nkd⌉ bit), MSB compression length L2 (log2DI1,...,8−m bit), Huffman probability dictionary Dic length L3 (⌈log2Dic⌉), Huffman probability dictionary (Dic bit), and additional message M length L4 (⌈log2M⌉ bit). Among them, Huffman probability dictionary accounts for the largest proportion of auxiliary information, and other auxiliary parameters with variable lengths have little influence on the embedding scheme. As long as enough space is reserved for parameters, reversible data hiding can be realized.If the image is transmitted without loss, all the auxiliary information can be transferred by substitution after the MSB compression. After the completion of Step 2, the firstL1 bits of compressed MSB information are saved as secret information Mc to be embedded and then replaced with auxiliary information. During the McEliece encryption of the LSB information, Mc is embedded first before the secret information protected by protection key Khide.After the stream decryption of the MSB with keyKen, the receive terminal directly extracts the first L1 bits to obtain the auxiliary information A. With the auxiliary information A, the first L1∗n/⌊log2CradE+1⌋ bits LSB information can be used to extract Mc under McEliece decryption. The extracted information Mc is used to replace the first L1 bit MSB information, and the original MSB information can be obtained after decompression.


### 3.3. Contributions

In order to solve the problem that the embedding performance of VRAE and VRBE is restricted by the image texture, we analyze the encryption process and propose a VRIE-type framework. Furthermore, we use error vectors of the McEliece encryption to establish the mapping relationship. Thus, we can achieve reversible data hiding without texture restriction of original image.The main contributions of the proposed scheme in this paper are as follows:(1)
Under the specified encryption parameter setting, the embedding capacity of the proposed scheme is related to the total number of error vectors that can be corrected, which completely breaks through the information entropy constraint of image texture.(2)
This scheme realizes RDH by establishing the mapping relationship between error vector and data to be embedded. Therefore, by establishing access control over the mapping relationship, we can realize the separable extraction of additional information, so as to realize the concealment of information embedding behavior.(3)
In this scheme, bit plane segmentation is carried out first, and then different encryption operations are carried out, respectively, so as to ensure that images can be transmitted in a fixed size. While McEliece encryption is performed on LSB information, embedding is realized by controlling the encryption process. The MSB information is compressed first and then the stream encryption is performed. The space vacated by compression can be used for ciphertext expansion generated by the LSB encryption.(4)
This scheme supports encryption key management for users with different permissions and can realize quick decryption of general image and lossless recovery of complete image.On the basis of breaking through the texture restriction to improve the embedding capacity, the proposed scheme can meet the authorization management of multiuser content access in the cloud environment by key distribution. Receive terminal can decide to obtain general image or lossless image according to the permissions. At the same time, by virtue of the separability of extraction and lossless recovery, this scheme can be disguised as only encryption and decryption of the original information for the third party. In this way, authentication information can be embedded without being detected, which is of great significance to the authentication of encrypted information.


## 3.1. VRIE Framework

At the sending terminal, content owner uses encryption keyKen combined with specific encryption to achieve security encryption. During encryption, the embedding space is vacated by mapping the redundancy of ciphertext or encryption key. At the same time, the secret information protected by the hidden key Khide can be selectively embedded in the way of controlling the redundancy during the encryption process, and finally an encrypted image that contains secret information (or not) is obtained.At the receiving terminal, the original image can be decrypted without any distortion as long as keyKen is obtained. If the encrypted image carries additional secret information, authorized users can extract the secret information protected by the hidden key Khide through the redundancy mapping during the decryption process. Then, the extracted information continues to be decrypted by the hidden key Khide, so as to obtain the secret information accurately. The framework of the VRIE type is shown in Figure 2.Figure 2
Vacating Room In Encryption (VRIE).As can be seen in Figure2, compared with the VRAE-type and the VRBE-type frameworks, the VRIE-type framework has the following advantages:(1)
The embedding and extraction operations are optional. No matter whether the transmission of secret information exists or not, for a third party, the receiver only uses the encryption keyKen for the image recovery. Therefore, this framework can realize the concealment of secret information transmission.(2)
Information extraction and image recovery can be separated. No matter whether secret information is extracted or not, the image obtained by direct decryption with encryption keyKen does not have any distortion compared with the original image.(3)
The embedding capacity is not restricted by image carriers. The embedding space mainly depends on the redundancy of the specific encryption process. Selecting an appropriate encryption algorithm can greatly improve the embedding capacity.(4)
Security has been improved. No operation is performed on the image before and after encryption, so the original image can be guaranteed without damaging the security of the encryption algorithm.


## 3.2. Reversible Data Hiding Based on Error-Correction Redundancy

Based on the error correction of GOPPA coding, McEliece encryption introduces random errors during the construction process to establish NP-difficult linear decoding problem to achieve information protection. For data encrypted with the same pair of public and private keys, the introduced random error can produce a large amount of ciphertext redundancy. At the same time, the receiver can eliminate the redundancy with the verification operation of GOPPA code to ensure the accurate recovery. On the basis of not destroying the security of the encryption system, we propose establishing the mapping relationship between the secret information and the random error and then controlling the random error to realize the reversible data hiding.


### 3.2.1. Error Mapping

Assuming that the McEliece encryption used for encryption is based on GOPPA code with parameter [n, k, d], every time plaintext P with length k can be encrypted, the error vector e with length n can be corrected. The maximum number of error positions in the error vector e is d. The set of all available error vectors is E, and the number of elements CradE in the set can be expressed by the following formula:(17)CradE=Cn1+Cn2+...+Cnd.The information to be embedded is converted into binary representation, and each encryption can map⌊log2CradE+1⌋ bit information with one error vector. In order to make full use of the error-correction redundancy, the sending and receiving terminals can negotiate a bijective mapping relationship in advance. Up to 2⌊log2CradE+1⌋! kinds of mapping relationship are available for each McEliece encryption with specified parameters.So each embedding operation can realize the embedding of 3-bit information, and a maximum of 4 kinds can be agreed.Taking GOPPA code with parameters [1, 4, 7] as an example, there are C71=7 error vectors that can be used for correction. Each encryption operation can embed ⌊log27+1⌋=3 bits of additional information, and a maximum of 8!=40320 kinds of mapping relationship can be available for embedding. Figure 3 illustrates two different error mapping relationships under this parameter condition. eii=1,...,7 represents an error vector, respectively, and e0 indicates that no error occurs. mii=1,...,8 represents the data to be embedded with a size of 3 bits.Figure 3
Two different mapping relationships between error vector and data to be embedded.


### 3.2.2. Implementation Process

This scheme uses the error-correction redundancy of McEliece encryption to embed and extract information. For the image carrier with lengtha and width b, McEliece encryption based on parameters [n, k, d] is selected to realize the secret information embedding. The specific implementation process is as follows:(1)
Send terminalStep 1: Bit plane segmentationThe pixel information is converted into the eight-bit binary representation, with the bit plane order arranged from left to right. Then, according to the ciphertext expansion generated by embedding requirement and compressible redundancy space, the original pixel matrix is segmented intom-bit LSB I7−m,...,8 and (8-m)-bit MSB information I1,...,8−m.Step 2: Compression of MSB informationFirstly, dimensionality reduction is carried out on the MSB informationI1,...,8−m. Due to the strong correlation of the same bit plane information, a one-dimensional array FI1,...,8−m is arranged according to the order of the bit plane from small to large.(18)FI1,...,8−m=fi|i=1,...,ab∗8−m.Then, RLC and Huffman coding are performed on this array successively to obtain the compression codingDI1,...,8−m of the MSB information.(19)DI1,...,8−m=HCRLCFI1,...,8−m.Step 3: McEliece encryption of LSB information with secret information embeddingFirstly, group the LSB informationI7−m,...,8 in length of k, which can be divided into ⌊abm/k⌋ groups of arrays.Secondly, according to the construction parameters of McEliece encryption, the appropriate generation matrix is selected to calculate the corresponding public and private keys. Then, use the public keyGpub to encrypt each group pi|i=1,...,k. In the process of each array encryption, the preset error mapping relationship can be used to control the correctable error and realize ⌊log2CradE+1⌋ (introduced in 2.2.1) bit information embedding. During the entire encryption of the LSB information, up to ⌊abm/k⌋∗⌊log2CradE+1⌋. bits of additional information can be embedded. Additional information is generated by stream encrypting secret information with a protection key Khide. The first abm bit ciphertext is saved as the low significant bit ciphertext CL, and the remaining ciphertexts are filled into the MSB space as extended ciphertexts.Step 4: Stream encryption of MSB information composed of compressed coding and extended ciphertextsFirstly, the information in the extended ciphertext spaceS1, which is generated from the McEliece encryption, is filled into the redundant space S2 obtained after the MSB compression. At the same time, random information is added to the unfilled part of space S2 to ensure that the image is transferred with the size of the original matrix. Formulas (20) and (21) represent the sizes of S1 and S2, respectively.(20)S1=abmk∗n−abm,S2=ab∗8−m−DI1,...,8−m.Then, the pseudorandom seedKen is used to generate sequences r1,...,rab∗8−m to perform stream encryption on the filled MSB information.Step 5: Generation of encrypted imageThe encrypted information from different-significant-bit space is converted to the specified size and then merged into an encrypted image according to the size of original matrix.(2)
Receive terminalStep 1: Bit plane segmentationUsing the negotiated parameterm, the encrypted pixel matrix is segmented into m-bit and (8-m)-bit MSB information. The original pixel is segmented into m-bit LSB and (8-m)-bit MSB information.Step 2: Stream decryption of MSB informationThe pseudorandom seedKen is used to generate the same sequences r1,...,rab∗8−m. Then, stream decryption is performed on the MSB ciphertext to obtain the compressed most-effective-bit information and the extended ciphertext generated from the LSB encryption.Step 3: McEliece decryption of LSB information with secret information extractingFirstly, the extended ciphertext of McEliece encryption from the MSB space and the ciphertext from the LSB space are combined together and then grouped in units ofn bits. For each group of ciphertexts, the invertible matrix S, permutation matrix P, and check code C in the McEliece private key are used for error correction and decryption. Thus, the LSB plaintext information in units of k bits is obtained. During decryption, specific errors introduced in the encryption can be checked. Therefore, the accurate extraction of additional information can be achieved by combining the mapping relationship. The authorized user with the protection key Khide can stream-decrypt the additional information to get the secret information.Step 4: Decompression of MSB informationDecompressing the compressed most-effective-bit information with RLC and Huffman coding, the MSB plaintext information can be obtained in the form of one-dimensional array.Step 5: Generation of recovered imageThe decrypted information from different-significant-bit space is converted to the specified size and then merged into a recovered image according to the size of original matrix.


### 3.2.3. Processing of Auxiliary Information

In order to ensure the lossless recovery of the encrypted image, the receive terminal must first get the necessary auxiliary parameters for the decryption process.The auxiliary information consists of the following parts: auxiliary information A lengthL1 (⌈log2A⌉ bit), bit plane segmentation parameter m (3 bits), construction parameters of McEliece encryption [n, k, d] (⌈log2nkd⌉ bit), MSB compression length L2 (log2DI1,...,8−m bit), Huffman probability dictionary Dic length L3 (⌈log2Dic⌉), Huffman probability dictionary (Dic bit), and additional message M length L4 (⌈log2M⌉ bit). Among them, Huffman probability dictionary accounts for the largest proportion of auxiliary information, and other auxiliary parameters with variable lengths have little influence on the embedding scheme. As long as enough space is reserved for parameters, reversible data hiding can be realized.If the image is transmitted without loss, all the auxiliary information can be transferred by substitution after the MSB compression. After the completion of Step 2, the firstL1 bits of compressed MSB information are saved as secret information Mc to be embedded and then replaced with auxiliary information. During the McEliece encryption of the LSB information, Mc is embedded first before the secret information protected by protection key Khide.After the stream decryption of the MSB with keyKen, the receive terminal directly extracts the first L1 bits to obtain the auxiliary information A. With the auxiliary information A, the first L1∗n/⌊log2CradE+1⌋ bits LSB information can be used to extract Mc under McEliece decryption. The extracted information Mc is used to replace the first L1 bit MSB information, and the original MSB information can be obtained after decompression.


## 3.2.1. Error Mapping

Assuming that the McEliece encryption used for encryption is based on GOPPA code with parameter [n, k, d], every time plaintext P with length k can be encrypted, the error vector e with length n can be corrected. The maximum number of error positions in the error vector e is d. The set of all available error vectors is E, and the number of elements CradE in the set can be expressed by the following formula:(17)CradE=Cn1+Cn2+...+Cnd.The information to be embedded is converted into binary representation, and each encryption can map⌊log2CradE+1⌋ bit information with one error vector. In order to make full use of the error-correction redundancy, the sending and receiving terminals can negotiate a bijective mapping relationship in advance. Up to 2⌊log2CradE+1⌋! kinds of mapping relationship are available for each McEliece encryption with specified parameters.So each embedding operation can realize the embedding of 3-bit information, and a maximum of 4 kinds can be agreed.Taking GOPPA code with parameters [1, 4, 7] as an example, there are C71=7 error vectors that can be used for correction. Each encryption operation can embed ⌊log27+1⌋=3 bits of additional information, and a maximum of 8!=40320 kinds of mapping relationship can be available for embedding. Figure 3 illustrates two different error mapping relationships under this parameter condition. eii=1,...,7 represents an error vector, respectively, and e0 indicates that no error occurs. mii=1,...,8 represents the data to be embedded with a size of 3 bits.Figure 3
Two different mapping relationships between error vector and data to be embedded.


## 3.2.2. Implementation Process

This scheme uses the error-correction redundancy of McEliece encryption to embed and extract information. For the image carrier with lengtha and width b, McEliece encryption based on parameters [n, k, d] is selected to realize the secret information embedding. The specific implementation process is as follows:(1)
Send terminalStep 1: Bit plane segmentationThe pixel information is converted into the eight-bit binary representation, with the bit plane order arranged from left to right. Then, according to the ciphertext expansion generated by embedding requirement and compressible redundancy space, the original pixel matrix is segmented intom-bit LSB I7−m,...,8 and (8-m)-bit MSB information I1,...,8−m.Step 2: Compression of MSB informationFirstly, dimensionality reduction is carried out on the MSB informationI1,...,8−m. Due to the strong correlation of the same bit plane information, a one-dimensional array FI1,...,8−m is arranged according to the order of the bit plane from small to large.(18)FI1,...,8−m=fi|i=1,...,ab∗8−m.Then, RLC and Huffman coding are performed on this array successively to obtain the compression codingDI1,...,8−m of the MSB information.(19)DI1,...,8−m=HCRLCFI1,...,8−m.Step 3: McEliece encryption of LSB information with secret information embeddingFirstly, group the LSB informationI7−m,...,8 in length of k, which can be divided into ⌊abm/k⌋ groups of arrays.Secondly, according to the construction parameters of McEliece encryption, the appropriate generation matrix is selected to calculate the corresponding public and private keys. Then, use the public keyGpub to encrypt each group pi|i=1,...,k. In the process of each array encryption, the preset error mapping relationship can be used to control the correctable error and realize ⌊log2CradE+1⌋ (introduced in 2.2.1) bit information embedding. During the entire encryption of the LSB information, up to ⌊abm/k⌋∗⌊log2CradE+1⌋. bits of additional information can be embedded. Additional information is generated by stream encrypting secret information with a protection key Khide. The first abm bit ciphertext is saved as the low significant bit ciphertext CL, and the remaining ciphertexts are filled into the MSB space as extended ciphertexts.Step 4: Stream encryption of MSB information composed of compressed coding and extended ciphertextsFirstly, the information in the extended ciphertext spaceS1, which is generated from the McEliece encryption, is filled into the redundant space S2 obtained after the MSB compression. At the same time, random information is added to the unfilled part of space S2 to ensure that the image is transferred with the size of the original matrix. Formulas (20) and (21) represent the sizes of S1 and S2, respectively.(20)S1=abmk∗n−abm,S2=ab∗8−m−DI1,...,8−m.Then, the pseudorandom seedKen is used to generate sequences r1,...,rab∗8−m to perform stream encryption on the filled MSB information.Step 5: Generation of encrypted imageThe encrypted information from different-significant-bit space is converted to the specified size and then merged into an encrypted image according to the size of original matrix.(2)
Receive terminalStep 1: Bit plane segmentationUsing the negotiated parameterm, the encrypted pixel matrix is segmented into m-bit and (8-m)-bit MSB information. The original pixel is segmented into m-bit LSB and (8-m)-bit MSB information.Step 2: Stream decryption of MSB informationThe pseudorandom seedKen is used to generate the same sequences r1,...,rab∗8−m. Then, stream decryption is performed on the MSB ciphertext to obtain the compressed most-effective-bit information and the extended ciphertext generated from the LSB encryption.Step 3: McEliece decryption of LSB information with secret information extractingFirstly, the extended ciphertext of McEliece encryption from the MSB space and the ciphertext from the LSB space are combined together and then grouped in units ofn bits. For each group of ciphertexts, the invertible matrix S, permutation matrix P, and check code C in the McEliece private key are used for error correction and decryption. Thus, the LSB plaintext information in units of k bits is obtained. During decryption, specific errors introduced in the encryption can be checked. Therefore, the accurate extraction of additional information can be achieved by combining the mapping relationship. The authorized user with the protection key Khide can stream-decrypt the additional information to get the secret information.Step 4: Decompression of MSB informationDecompressing the compressed most-effective-bit information with RLC and Huffman coding, the MSB plaintext information can be obtained in the form of one-dimensional array.Step 5: Generation of recovered imageThe decrypted information from different-significant-bit space is converted to the specified size and then merged into a recovered image according to the size of original matrix.


## 3.2.3. Processing of Auxiliary Information

In order to ensure the lossless recovery of the encrypted image, the receive terminal must first get the necessary auxiliary parameters for the decryption process.The auxiliary information consists of the following parts: auxiliary information A lengthL1 (⌈log2A⌉ bit), bit plane segmentation parameter m (3 bits), construction parameters of McEliece encryption [n, k, d] (⌈log2nkd⌉ bit), MSB compression length L2 (log2DI1,...,8−m bit), Huffman probability dictionary Dic length L3 (⌈log2Dic⌉), Huffman probability dictionary (Dic bit), and additional message M length L4 (⌈log2M⌉ bit). Among them, Huffman probability dictionary accounts for the largest proportion of auxiliary information, and other auxiliary parameters with variable lengths have little influence on the embedding scheme. As long as enough space is reserved for parameters, reversible data hiding can be realized.If the image is transmitted without loss, all the auxiliary information can be transferred by substitution after the MSB compression. After the completion of Step 2, the firstL1 bits of compressed MSB information are saved as secret information Mc to be embedded and then replaced with auxiliary information. During the McEliece encryption of the LSB information, Mc is embedded first before the secret information protected by protection key Khide.After the stream decryption of the MSB with keyKen, the receive terminal directly extracts the first L1 bits to obtain the auxiliary information A. With the auxiliary information A, the first L1∗n/⌊log2CradE+1⌋ bits LSB information can be used to extract Mc under McEliece decryption. The extracted information Mc is used to replace the first L1 bit MSB information, and the original MSB information can be obtained after decompression.


## 3.3. Contributions

In order to solve the problem that the embedding performance of VRAE and VRBE is restricted by the image texture, we analyze the encryption process and propose a VRIE-type framework. Furthermore, we use error vectors of the McEliece encryption to establish the mapping relationship. Thus, we can achieve reversible data hiding without texture restriction of original image.The main contributions of the proposed scheme in this paper are as follows:(1)
Under the specified encryption parameter setting, the embedding capacity of the proposed scheme is related to the total number of error vectors that can be corrected, which completely breaks through the information entropy constraint of image texture.(2)
This scheme realizes RDH by establishing the mapping relationship between error vector and data to be embedded. Therefore, by establishing access control over the mapping relationship, we can realize the separable extraction of additional information, so as to realize the concealment of information embedding behavior.(3)
In this scheme, bit plane segmentation is carried out first, and then different encryption operations are carried out, respectively, so as to ensure that images can be transmitted in a fixed size. While McEliece encryption is performed on LSB information, embedding is realized by controlling the encryption process. The MSB information is compressed first and then the stream encryption is performed. The space vacated by compression can be used for ciphertext expansion generated by the LSB encryption.(4)
This scheme supports encryption key management for users with different permissions and can realize quick decryption of general image and lossless recovery of complete image.On the basis of breaking through the texture restriction to improve the embedding capacity, the proposed scheme can meet the authorization management of multiuser content access in the cloud environment by key distribution. Receive terminal can decide to obtain general image or lossless image according to the permissions. At the same time, by virtue of the separability of extraction and lossless recovery, this scheme can be disguised as only encryption and decryption of the original information for the third party. In this way, authentication information can be embedded without being detected, which is of great significance to the authentication of encrypted information.


## 4. Experimental Results

In this paper, MATLAB 2021b software is used to carry out the simulation experiment of the test images selected from the USC-SIPI and BOSS-BASE image library. The images used for performance comparison of each scheme are shown in Figure4.Figure 4
Test images. (a) Lena. (b) Plane. (c) Baboon. (d) Man. (e) Boat. (f) Crowd. (g) Lake. (h) Peppers.
(a)(b)(c)(d)(e)(f)(g)(h)During the simulation in this section, the McEliece structure parameters [n, k, d] are set to [1, 4, 7], and the generating matrix G is set to 1000110010010100100110001111. Kh and Ken are used as pseudorandom seeds to generate pseudorandom numbers in logistic chaotic system with parameter μ=3.822. The iterative formula of the system is(21)yn+1=μyn1−ynyn∈0,1.


### 4.1. Analysis of Image Quality

We use existing RDH-ED schemes [15–19] to embed additional data with the Lena image and decrypt the image directly without extraction. The trend curves of different RDH-ED methods between the embedding rate (ER) and the Peak Signal-to-Noise Ratio (PSNR) are shown in Figure 5.Figure 5
Directly decrypted image’s ER-PSNR comparison of different RDH-ED methods.By changing the order of embedding and encrypting operations, VBRE-type RDH-ED schemes can not only expand the application requirements of RDH-ED but also eliminate the influence of encryption and decryption operations on embedding. With the help of the high-fidelity RDH method in the spatial domain [17, 18], the general image can be obtained by direct decryption without affecting the lossless recovery after extraction. As the carriers of RDH-ED scheme are generally transmitted in encrypted form, some applications have stricter requirements on the embedding capacity than image quality after direct decryption. According to the characteristics of encrypted domain, [19] applied MCG technology to design large-capacity RDH-ED scheme. As can be seen from Figure 5, the image quality after direct decryption by this method is not high under the same embedding capacity.Further analysis of Figure5 leads to the conclusion that different parameters (as shown in [15]) under the same RDH-ED method have an impact on the image quality after direct decryption, but the impact is much smaller compared with the performance of different schemes.Through the simulation experiments of 10 standard images from USC-SIPI and 50 standard images from BOSS-BASE, we obtained the performance results as shown in Figure6 and Table 1. The maximum embedding rates of the two databases were 2.228 and 2.323 bpp, respectively. The VRIE-type RDH-ED uses the redundancy of encryption process for embedding, so the embedding capacity is less restricted by pixel information. Therefore, the maximum embedding capacity is greatly improved compared with [15–19]. In addition, the proposed scheme can selectively extract information embedding with the decryption. Even without the permission to extract secret information, the lossless images also can be obtained by direct decryption. Therefore, the proposed scheme can selectively disclose the protection key Khide according to the permissions. In this way, the proposed scheme can meet the requirements of high quality image transmission and realize the covert transmission of secret information.Figure 6
ER results from different image libraries. (a) USC-SIPI. (b) BOSS-BASE.
(a)(b)Table 1
Experimental results from USC-SIPI and BOSS-BASE.
DatabaseIndicatorsBest caseWorst caseAverageUSC-SIPIER (bpp)2.2280.6071.716PNSR∞∞∞BOSS-BASEER (bpp)2.3230.5881.684PNSR∞∞∞


### 4.2. Analysis of Embedding Capacity

In our scheme, after encrypting everyn bit original pixel information by McEliece encryption, reversible embedding of ⌊log2CradE+1⌋ bit additional information can be realized, and (d-n) bit ciphertext extension will be generated. For communication channel without considering extension, the embedding capacity based on error-correction redundancy is not affected by the original information. For the image carrier with fixed size, we need to carry out bit plane segmentation and then compress the MSB information to solve the problem of LSB ciphertext expansion. Auxiliary information is embedded to achieve parameter negotiation, so it will occupy a certain embedding space. In the composition of auxiliary information, Huffman probability dictionary Dic has great influence on embedding performance. For the Lena image, when the bit plane parameter m is set to 4, the probability dictionary Dic is shown in Table 2.Table 2
Huffman probability dictionary with conditionm set to 4.
Probable sequenceCharacterHuffman code11122[0, 0, 0]33[0, 1, 1]………356537[0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0]357735[0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1]To achieve lossless decompression, we needL3 bit space reserved to represent the Dic.(22)L3=maxSe∗log2maxLa+maxCo.In the above equation,maxSe represents the maximum of the probability sequence, ⌈log2maxLa⌉ represents the maximum binary encoding of a single character, and maxCo represents the maximum Huffman encoding of a single character.For Huffman probability dictionary shown in Table1, L3=357∗⌈log2735⌉+18=9996 bit space should be reserved for representation.When McEliece parameters are determined, bit plane segmentation parameters will influence the embedding performance to some extent. Figure7 illustrates the trend curves of embedding rate corresponding to different bit plane segmentation parameters. As can be seen from Figure 7, for images with complex textures (such as Baboon), bit plane segmentation has little influence on the maximum embedding rate. However, bit plane segmentation has a great influence on the maximum embedding rate for the images with natural texture. When the bit plane segmentation parameter m is set to 3, 4, or 5, the embedding rate can reach the peak.Figure 7
Bit plane segmentation parameter (m)-embedding rate.With further analysis of Table3, we can conclude that the error-correction redundancy space is fixed as long as parameter m is determined. Therefore, if fixed-size images are used as the carrier for data hiding, the embedding capacity is mainly affected by auxiliary information space and compressed space. When m is small, the error-correction redundancy space of LSB information is limited, and the compressed space which is reserved for ciphertext extension cannot be fully utilized. With the increase of m, the error-correction redundancy space increases linearly, while the compressed space decreases correspondingly. When the error-correction redundancy space is close to the compressed space (m is set to 3, 4, or 5), the scheme can obtain the highest embedding capacity. When m is large, the compressed space cannot accommodate the ciphertext expansion generated by the McEliece encryption of the LSB information. The reversible embedding can only be realized in the limited error-correction redundancy space which is smaller than the compressed space. In this case, the embedding performance is greatly affected by the correlation of the image information. In addition, for images with complex textures (such as Baboon), the compressed space under any bit plane segmentation is smaller than the error-correction redundancy space, so the embedding space is only related to the compressed space. In order to ensure the reversible recovery, sufficient space should be reserved for embedding auxiliary information in advance. Huffman probability dictionary Dic occupies a large proportion in the auxiliary information. With the increase of m, the MSB information that needs to be compressed decreases, and the space occupied by auxiliary information also decreases accordingly. Compared with embedding space, auxiliary information space occupies less proportion. For the Baboon image with the least embedding capacity, the proportion of auxiliary information space is always less than 5%, while the embedding space can reach more than 130000 bits, which has practical application value.Table 3
The respective space size under different bit plane segmentation parameterm (bit).
m = 1m = 2m = 3m = 4m = 5m = 6m = 7Error-correction redundancy space19660839321658982478643298304011796481376256LenaAuxiliary information space108391086910627101531017391798507Compressed space521546531933544662563233559971501377377129Embedding space185769382347534035553080549798492198368622PlaneAuxiliary information space9359781578948755852686968696Compressed space552929566128579691586003568903498617369975Embedding space187249385401571797577248560377489921361279BaboonAuxiliary information space6208618163956395660966096609Compressed space140093143430146819152153159876165672148889Embedding space133885137249140424145758153267159063142280ManAuxiliary information space8164810580117783771372317020Compressed space413368425258438108455545464348429043333673Embedding space188444385111430097447762456635421812326653LakeAuxiliary information space376341388286405961428663418049337259183908Compressed space8310772877287641709867756072Embedding space188298380558398233421022410951330484177836CrowdAuxiliary information space482912494800501485486814435136337299205128Compressed space6944700069126912655266506693Embedding space189664386216494573479902428584330649198435LakeAuxiliary information space384884395122407367418387397690322751199363Compressed space7830789076567336707468646325Embedding space188778387232399711411051390616315887193038PeppersAuxiliary information space467115480582502146516006481975381862381862Compressed space9512951295129184885681758175Embedding space187096383704492634506822473119373687373687By comparing the embedding rate in the existing large-capacity RDH-ED schemes [22–25], we analyze the embedding performance of the proposed scheme. As is shown in Figure 8, the embedding space of [22, 23] is reserved before the encryption, so it is less affected by the image information and more suitable for complex images (such as Baboon). Reference [24] reserved embedding space by PBTL coding with high-correlation textures, which is more suitable for smooth image (such as Plane). In [25], bit plane segmentation is also carried out for information, and information embedding is divided into two stages: self-embedding in the preprocessing process and embedding with MSB prediction. Each single embedding stage is restricted by the image texture, so [25] cannot obtain an excellent embedding performance. In this scheme, error-correction redundancy of McEliece encryption is used to realize information embedding. Embedding performance has no relation with LSB information. But the compression of MSB information needs to reserve enough space for the placement of ciphertext expansion. For a specific image, when the compressed space of MSB information is close to the error-correction redundancy space of LSB information with an appropriate segmentation parameter, better embedding performance can be achieved. For images with general texture (such as Lena), this scheme improves the embedding rate by 0.082 bpp compared with [22].Figure 8
Comparison of embedding rate (bpp).


### 4.3. Complexity Analysis

In order to keep the size of the image embedded with secret data consistent with the original image, this scheme firstly performs bit plane segmentation and then compresses the MSB information to solve the ciphertext expansion caused by the LSB information. Since different encryption operations are performed on different bit plane data, their complexity needs to be analyzed, respectively:(1)
After segmentation, it is assumed that the MSB data to be encrypted is ofN1 bits. Since the encryption and decryption of the MSB data are XOR operations on each bit information, the computational complexity of MSB data encryption and decryption is ON1.(2)
After segmentation, it is assumed that the MSB data to be encrypted is ofN2 bits. Since the McEliece encryption and decryption are implemented on the LSB data, the computational complexity of the encryption mainly lies in the quasi-cyclic bivalent matrix multiplied by a one-dimensional vector, and the computational complexity of the bivalent matrix convolution is ON2logN2. The complexity of decryption is mainly determined by decoding complexity. For the decoding of quasi-bivalent GOPPA codes, the computational complexity is close to ON2logN2.The MSB data has low computational complexity but contains more image information. According to this feature, the decryption end can use key distribution to control the access of the image content according to the actual application requirements. Figure9 shows the general image obtained after decryption of MSB data only when parameter m is set to 4, 5, or 6. As can be seen from Figure 9, these images can still convey the main information of the image content. For applications with general images that can meet the requirements, this receiver can decrypt the MSB data only. Thus, only computation with complexity ON1 needs to be carried out, so the communication efficiency is improved.Figure 9
Direct decryption of MSB data under different values of parameterm. (a) m = 4. (b) m = 5. (c) m = 6.
(a)(b)(c)


### 4.4. Security Analysis

In order to analyze other features of the proposed scheme with high embedding capacity, this section conducts information embedding and extraction with the Lena image under the condition that parameterm is set to 4. As illustrated in Figure 10, since the proposed scheme uses error-correction redundancy to realize reliable embedding, image carrier has only three stages: (1) original image, (2) encrypted image (embedded with secret information or not), and (3) decrypted image. Compared with the existing RDH-ED schemes, the proposed scheme has neither the difference between the ciphertexts containing the embedded message or not of type VRAE nor the difference between the plaintexts containing the embedded message or not of type VRBE. For the third party, only image encryption and lossless decryption are carried out by the sender and the receiver. Therefore, the existence of secret message transmission can be concealed.Figure 10
The Lena Image in different stages. (a) Original image. (b) Encrypted image. (c) Decrypted image.
(a)(b)(c)Because the error vector corresponding to secret information is introduced during the McEliece encryption, the same group of plaintext data can be encrypted to generateCnd+...+Cn1+1 groups of ciphertext data with the same key. Therefore, this scheme has the characteristics of probabilistic encryption. Probabilistic encryption can effectively resist the third party from comparing different ciphertexts of the chosen plaintext to deduce the encrypt key, so the scheme has Chosen Ciphertext Attack (CCA) security. MSB information has a great influence on image quality. This scheme destroys the correlation by the chaos of logistic encryption, so as to effectively protect the compressed data of MSB information and the extended data of LSB information. As can be seen from Figures 11 and 12, the statistical characteristics of the image are seriously damaged, so the proposed scheme can effectively protect the original image information.Figure 11
Pixel histogram of original image and encrypted image. (a) Original image. (b) Encrypted image.
(a)(b)Figure 12
Correlation scatter of original image and encrypted image. (a) Original image. (b) Encrypted image.
(a)(b)When parameterm is set to 4, our scheme can embed additional information up to 553080 bits. Under the condition of full embedding, the decrypted image is compared with the original image and the extracted information is compared with the embedded information. The results of their bit error are shown in Figures 13 and 14. We conclude that the scheme can be used to restore the original image reversibly and extract the secret information accurately in lossless channel.Figure 13
Bit error of recovery image.Figure 14
Bit error of extracted data.In the process of encrypted image transmission, interference will occur due to channel instability. Due to the error correction of McEliece encryption, it can resist certain noise interference in the decryption process, so as to improve the accuracy of image recovery. To verify the robustness of the proposed scheme, White Gaussian Noise (WGN) is applied to the encrypted image. During the experiment, Signal-to-Noise Ratio (SNR) is used to modulate the WGN’s intensity. Formula (23) shows the calculation process of SNR.(23)SNR=PowerSoPowerSn,PowerS=∑S2LengthS.S, So, and Sn represent the signal intensity, the original signal intensity, and the noise signal intensity, respectively, and LengthS is the length function of the signal. Figure 15 shows the White Gaussian Noise with the intensity of 5 dB according to the original information of the Lena image.Figure 15
White Gaussian Noise with the intensity of 5 dB.During the experiment, WGN between 0.5 and 5 dB is applied to the encrypted image with embedded information. After comparing the decrypted image disturbed by WGN with the original image, we get the bit error rate (BER) of the image as shown in the following formula:(24)BER=nerrorncorrect+nerror.ncorrect and nerror, respectively, represent the correct and error bits obtained after decryption compared with the original image.As shown in Figure16, the error rate of image restoration decreases linearly with the increase of WGN. Due to the error correction of McEliece encryption, the proposed scheme is robust. For an encrypted group with length n, when the interference caused by the embedding and WGN can be handled by the error-correction capability, that is, when the total number of changing bit positions is less than d, the group with length k can recover correctly. As can be seen from Figure 15, the change of most pixel information caused by 5 dB WGN interference is less than 2. Therefore, the interference of WGN alone will not affect the recovery of original information seriously. If the coding position changed by the error vector is the same as that changed by the WGN, their influence on the image can be eliminated. Only when these two changed encoding positions are different do they lead to the accumulation of error positions, and the error bits will be produced. Further analysis of Figure 16 showed that the intensity of WGN, not the texture of original information, has a great influence on the accuracy of information recovery. When the intensity of WGN is set to 5 dB, the BERs of image restoration in the Lena, Plane, Baboon, Man, Boat, Crowd, Lake, and Peppers images are 15.66%, 15.68%, 15.87%, 15.90%, 16.19%, 15.90%, 15.79%, and 15.83%, respectively. In addition, bit error mainly occurs in low significant bits, and even if a bit error occurs, it has little impact on image quality. Therefore, the robustness of the proposed scheme can meet the requirements of most applications.Figure 16
Bit error rate of image restoration under different WGN intensity.


## 4.1. Analysis of Image Quality

We use existing RDH-ED schemes [15–19] to embed additional data with the Lena image and decrypt the image directly without extraction. The trend curves of different RDH-ED methods between the embedding rate (ER) and the Peak Signal-to-Noise Ratio (PSNR) are shown in Figure 5.Figure 5
Directly decrypted image’s ER-PSNR comparison of different RDH-ED methods.By changing the order of embedding and encrypting operations, VBRE-type RDH-ED schemes can not only expand the application requirements of RDH-ED but also eliminate the influence of encryption and decryption operations on embedding. With the help of the high-fidelity RDH method in the spatial domain [17, 18], the general image can be obtained by direct decryption without affecting the lossless recovery after extraction. As the carriers of RDH-ED scheme are generally transmitted in encrypted form, some applications have stricter requirements on the embedding capacity than image quality after direct decryption. According to the characteristics of encrypted domain, [19] applied MCG technology to design large-capacity RDH-ED scheme. As can be seen from Figure 5, the image quality after direct decryption by this method is not high under the same embedding capacity.Further analysis of Figure5 leads to the conclusion that different parameters (as shown in [15]) under the same RDH-ED method have an impact on the image quality after direct decryption, but the impact is much smaller compared with the performance of different schemes.Through the simulation experiments of 10 standard images from USC-SIPI and 50 standard images from BOSS-BASE, we obtained the performance results as shown in Figure6 and Table 1. The maximum embedding rates of the two databases were 2.228 and 2.323 bpp, respectively. The VRIE-type RDH-ED uses the redundancy of encryption process for embedding, so the embedding capacity is less restricted by pixel information. Therefore, the maximum embedding capacity is greatly improved compared with [15–19]. In addition, the proposed scheme can selectively extract information embedding with the decryption. Even without the permission to extract secret information, the lossless images also can be obtained by direct decryption. Therefore, the proposed scheme can selectively disclose the protection key Khide according to the permissions. In this way, the proposed scheme can meet the requirements of high quality image transmission and realize the covert transmission of secret information.Figure 6
ER results from different image libraries. (a) USC-SIPI. (b) BOSS-BASE.
(a)(b)Table 1
Experimental results from USC-SIPI and BOSS-BASE.
DatabaseIndicatorsBest caseWorst caseAverageUSC-SIPIER (bpp)2.2280.6071.716PNSR∞∞∞BOSS-BASEER (bpp)2.3230.5881.684PNSR∞∞∞


## 4.2. Analysis of Embedding Capacity

In our scheme, after encrypting everyn bit original pixel information by McEliece encryption, reversible embedding of ⌊log2CradE+1⌋ bit additional information can be realized, and (d-n) bit ciphertext extension will be generated. For communication channel without considering extension, the embedding capacity based on error-correction redundancy is not affected by the original information. For the image carrier with fixed size, we need to carry out bit plane segmentation and then compress the MSB information to solve the problem of LSB ciphertext expansion. Auxiliary information is embedded to achieve parameter negotiation, so it will occupy a certain embedding space. In the composition of auxiliary information, Huffman probability dictionary Dic has great influence on embedding performance. For the Lena image, when the bit plane parameter m is set to 4, the probability dictionary Dic is shown in Table 2.Table 2
Huffman probability dictionary with conditionm set to 4.
Probable sequenceCharacterHuffman code11122[0, 0, 0]33[0, 1, 1]………356537[0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0]357735[0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1]To achieve lossless decompression, we needL3 bit space reserved to represent the Dic.(22)L3=maxSe∗log2maxLa+maxCo.In the above equation,maxSe represents the maximum of the probability sequence, ⌈log2maxLa⌉ represents the maximum binary encoding of a single character, and maxCo represents the maximum Huffman encoding of a single character.For Huffman probability dictionary shown in Table1, L3=357∗⌈log2735⌉+18=9996 bit space should be reserved for representation.When McEliece parameters are determined, bit plane segmentation parameters will influence the embedding performance to some extent. Figure7 illustrates the trend curves of embedding rate corresponding to different bit plane segmentation parameters. As can be seen from Figure 7, for images with complex textures (such as Baboon), bit plane segmentation has little influence on the maximum embedding rate. However, bit plane segmentation has a great influence on the maximum embedding rate for the images with natural texture. When the bit plane segmentation parameter m is set to 3, 4, or 5, the embedding rate can reach the peak.Figure 7
Bit plane segmentation parameter (m)-embedding rate.With further analysis of Table3, we can conclude that the error-correction redundancy space is fixed as long as parameter m is determined. Therefore, if fixed-size images are used as the carrier for data hiding, the embedding capacity is mainly affected by auxiliary information space and compressed space. When m is small, the error-correction redundancy space of LSB information is limited, and the compressed space which is reserved for ciphertext extension cannot be fully utilized. With the increase of m, the error-correction redundancy space increases linearly, while the compressed space decreases correspondingly. When the error-correction redundancy space is close to the compressed space (m is set to 3, 4, or 5), the scheme can obtain the highest embedding capacity. When m is large, the compressed space cannot accommodate the ciphertext expansion generated by the McEliece encryption of the LSB information. The reversible embedding can only be realized in the limited error-correction redundancy space which is smaller than the compressed space. In this case, the embedding performance is greatly affected by the correlation of the image information. In addition, for images with complex textures (such as Baboon), the compressed space under any bit plane segmentation is smaller than the error-correction redundancy space, so the embedding space is only related to the compressed space. In order to ensure the reversible recovery, sufficient space should be reserved for embedding auxiliary information in advance. Huffman probability dictionary Dic occupies a large proportion in the auxiliary information. With the increase of m, the MSB information that needs to be compressed decreases, and the space occupied by auxiliary information also decreases accordingly. Compared with embedding space, auxiliary information space occupies less proportion. For the Baboon image with the least embedding capacity, the proportion of auxiliary information space is always less than 5%, while the embedding space can reach more than 130000 bits, which has practical application value.Table 3
The respective space size under different bit plane segmentation parameterm (bit).
m = 1m = 2m = 3m = 4m = 5m = 6m = 7Error-correction redundancy space19660839321658982478643298304011796481376256LenaAuxiliary information space108391086910627101531017391798507Compressed space521546531933544662563233559971501377377129Embedding space185769382347534035553080549798492198368622PlaneAuxiliary information space9359781578948755852686968696Compressed space552929566128579691586003568903498617369975Embedding space187249385401571797577248560377489921361279BaboonAuxiliary information space6208618163956395660966096609Compressed space140093143430146819152153159876165672148889Embedding space133885137249140424145758153267159063142280ManAuxiliary information space8164810580117783771372317020Compressed space413368425258438108455545464348429043333673Embedding space188444385111430097447762456635421812326653LakeAuxiliary information space376341388286405961428663418049337259183908Compressed space8310772877287641709867756072Embedding space188298380558398233421022410951330484177836CrowdAuxiliary information space482912494800501485486814435136337299205128Compressed space6944700069126912655266506693Embedding space189664386216494573479902428584330649198435LakeAuxiliary information space384884395122407367418387397690322751199363Compressed space7830789076567336707468646325Embedding space188778387232399711411051390616315887193038PeppersAuxiliary information space467115480582502146516006481975381862381862Compressed space9512951295129184885681758175Embedding space187096383704492634506822473119373687373687By comparing the embedding rate in the existing large-capacity RDH-ED schemes [22–25], we analyze the embedding performance of the proposed scheme. As is shown in Figure 8, the embedding space of [22, 23] is reserved before the encryption, so it is less affected by the image information and more suitable for complex images (such as Baboon). Reference [24] reserved embedding space by PBTL coding with high-correlation textures, which is more suitable for smooth image (such as Plane). In [25], bit plane segmentation is also carried out for information, and information embedding is divided into two stages: self-embedding in the preprocessing process and embedding with MSB prediction. Each single embedding stage is restricted by the image texture, so [25] cannot obtain an excellent embedding performance. In this scheme, error-correction redundancy of McEliece encryption is used to realize information embedding. Embedding performance has no relation with LSB information. But the compression of MSB information needs to reserve enough space for the placement of ciphertext expansion. For a specific image, when the compressed space of MSB information is close to the error-correction redundancy space of LSB information with an appropriate segmentation parameter, better embedding performance can be achieved. For images with general texture (such as Lena), this scheme improves the embedding rate by 0.082 bpp compared with [22].Figure 8
Comparison of embedding rate (bpp).


## 4.3. Complexity Analysis

In order to keep the size of the image embedded with secret data consistent with the original image, this scheme firstly performs bit plane segmentation and then compresses the MSB information to solve the ciphertext expansion caused by the LSB information. Since different encryption operations are performed on different bit plane data, their complexity needs to be analyzed, respectively:(1)
After segmentation, it is assumed that the MSB data to be encrypted is ofN1 bits. Since the encryption and decryption of the MSB data are XOR operations on each bit information, the computational complexity of MSB data encryption and decryption is ON1.(2)
After segmentation, it is assumed that the MSB data to be encrypted is ofN2 bits. Since the McEliece encryption and decryption are implemented on the LSB data, the computational complexity of the encryption mainly lies in the quasi-cyclic bivalent matrix multiplied by a one-dimensional vector, and the computational complexity of the bivalent matrix convolution is ON2logN2. The complexity of decryption is mainly determined by decoding complexity. For the decoding of quasi-bivalent GOPPA codes, the computational complexity is close to ON2logN2.The MSB data has low computational complexity but contains more image information. According to this feature, the decryption end can use key distribution to control the access of the image content according to the actual application requirements. Figure9 shows the general image obtained after decryption of MSB data only when parameter m is set to 4, 5, or 6. As can be seen from Figure 9, these images can still convey the main information of the image content. For applications with general images that can meet the requirements, this receiver can decrypt the MSB data only. Thus, only computation with complexity ON1 needs to be carried out, so the communication efficiency is improved.Figure 9
Direct decryption of MSB data under different values of parameterm. (a) m = 4. (b) m = 5. (c) m = 6.
(a)(b)(c)


## 4.4. Security Analysis

In order to analyze other features of the proposed scheme with high embedding capacity, this section conducts information embedding and extraction with the Lena image under the condition that parameterm is set to 4. As illustrated in Figure 10, since the proposed scheme uses error-correction redundancy to realize reliable embedding, image carrier has only three stages: (1) original image, (2) encrypted image (embedded with secret information or not), and (3) decrypted image. Compared with the existing RDH-ED schemes, the proposed scheme has neither the difference between the ciphertexts containing the embedded message or not of type VRAE nor the difference between the plaintexts containing the embedded message or not of type VRBE. For the third party, only image encryption and lossless decryption are carried out by the sender and the receiver. Therefore, the existence of secret message transmission can be concealed.Figure 10
The Lena Image in different stages. (a) Original image. (b) Encrypted image. (c) Decrypted image.
(a)(b)(c)Because the error vector corresponding to secret information is introduced during the McEliece encryption, the same group of plaintext data can be encrypted to generateCnd+...+Cn1+1 groups of ciphertext data with the same key. Therefore, this scheme has the characteristics of probabilistic encryption. Probabilistic encryption can effectively resist the third party from comparing different ciphertexts of the chosen plaintext to deduce the encrypt key, so the scheme has Chosen Ciphertext Attack (CCA) security. MSB information has a great influence on image quality. This scheme destroys the correlation by the chaos of logistic encryption, so as to effectively protect the compressed data of MSB information and the extended data of LSB information. As can be seen from Figures 11 and 12, the statistical characteristics of the image are seriously damaged, so the proposed scheme can effectively protect the original image information.Figure 11
Pixel histogram of original image and encrypted image. (a) Original image. (b) Encrypted image.
(a)(b)Figure 12
Correlation scatter of original image and encrypted image. (a) Original image. (b) Encrypted image.
(a)(b)When parameterm is set to 4, our scheme can embed additional information up to 553080 bits. Under the condition of full embedding, the decrypted image is compared with the original image and the extracted information is compared with the embedded information. The results of their bit error are shown in Figures 13 and 14. We conclude that the scheme can be used to restore the original image reversibly and extract the secret information accurately in lossless channel.Figure 13
Bit error of recovery image.Figure 14
Bit error of extracted data.In the process of encrypted image transmission, interference will occur due to channel instability. Due to the error correction of McEliece encryption, it can resist certain noise interference in the decryption process, so as to improve the accuracy of image recovery. To verify the robustness of the proposed scheme, White Gaussian Noise (WGN) is applied to the encrypted image. During the experiment, Signal-to-Noise Ratio (SNR) is used to modulate the WGN’s intensity. Formula (23) shows the calculation process of SNR.(23)SNR=PowerSoPowerSn,PowerS=∑S2LengthS.S, So, and Sn represent the signal intensity, the original signal intensity, and the noise signal intensity, respectively, and LengthS is the length function of the signal. Figure 15 shows the White Gaussian Noise with the intensity of 5 dB according to the original information of the Lena image.Figure 15
White Gaussian Noise with the intensity of 5 dB.During the experiment, WGN between 0.5 and 5 dB is applied to the encrypted image with embedded information. After comparing the decrypted image disturbed by WGN with the original image, we get the bit error rate (BER) of the image as shown in the following formula:(24)BER=nerrorncorrect+nerror.ncorrect and nerror, respectively, represent the correct and error bits obtained after decryption compared with the original image.As shown in Figure16, the error rate of image restoration decreases linearly with the increase of WGN. Due to the error correction of McEliece encryption, the proposed scheme is robust. For an encrypted group with length n, when the interference caused by the embedding and WGN can be handled by the error-correction capability, that is, when the total number of changing bit positions is less than d, the group with length k can recover correctly. As can be seen from Figure 15, the change of most pixel information caused by 5 dB WGN interference is less than 2. Therefore, the interference of WGN alone will not affect the recovery of original information seriously. If the coding position changed by the error vector is the same as that changed by the WGN, their influence on the image can be eliminated. Only when these two changed encoding positions are different do they lead to the accumulation of error positions, and the error bits will be produced. Further analysis of Figure 16 showed that the intensity of WGN, not the texture of original information, has a great influence on the accuracy of information recovery. When the intensity of WGN is set to 5 dB, the BERs of image restoration in the Lena, Plane, Baboon, Man, Boat, Crowd, Lake, and Peppers images are 15.66%, 15.68%, 15.87%, 15.90%, 16.19%, 15.90%, 15.79%, and 15.83%, respectively. In addition, bit error mainly occurs in low significant bits, and even if a bit error occurs, it has little impact on image quality. Therefore, the robustness of the proposed scheme can meet the requirements of most applications.Figure 16
Bit error rate of image restoration under different WGN intensity.


## 5. Conclusion

This paper proposes an RDH-ED scheme based on the error-correction redundancy of encryption process. In this scheme, McEliece encryption is implemented for LSB information, and secret information can be embedded reversibly while encrypting. Huffman and Run Length Coding is used to compress the MSB information to reserve the space for the ciphertext expansion placement, and then logistic chaotic sequence generated by the pseudorandom seedKen is implemented to encrypt the MSB information. Since the embedding performance is not constrained by image carrier, the proposed scheme has better embedding capacity compared with existing schemes. For secret information, it is encrypted to become additional information with the protection key Khide first and then embedded according to the error mapping relationship during encryption process. The extraction operation of secret information does not affect the accurate recovery, so the extraction operation is optional. Access of secret information can be controlled by key distribution. Thus, this scheme can conceal the transmission of secret information on the basis of realizing image lossless recovery. At the same time, after being attacked by noise, most of the information can be recovered correctly with the error correction of decryption, so the proposed RDH scheme is robust. In the future, the construction process of existing encryption algorithms can be further studied and the RDH-ED schemes can be designed according to the redundancy of the specific encryption process. Thus, the application scenarios of existing mature encryption algorithms can be further expanded.


## 6. Future Scope

VRIE-type RDH-ED has the advantages that previous RDH-ED schemes did not have, such as the unconstrained embedding capacity by the image texture, the lossless recovery without extraction, and the undamaged security of the encryption scheme. This paper proposed a specific scheme based on the error-correction redundancy during the process of McElieceencryption. However, there are still the following problems in the specific implementation process:(1)
This proposed method uses the process redundancy of McEliece encryption to embed additional information, which has the problems of large computational complexity and ciphertext expansion inherent in public key encryption.(2)
The robustness of this proposed method can only resist the small noise interference caused by channel transmission. If it faces serious attacks such as shear and rotation, the disaster tolerance ability is not enough.(3)
Whether the information is extracted or not does not affect the lossless recovery of the image, so it will not be found by the third party, as well as realizing the concealment of information embedding behavior, which is of great significance for the forensics and authentication of encrypted data. However, if information extraction is needed, the image decryption key must be obtained first. Therefore, in the proposed scheme, the authority of information extraction must be higher than that of the image recovery, which will have certain application limitations and is not applicable to the applications that need the blind extraction feature of the third party in cloud space.In the future, for specific application requirements, the process redundancy of encryption schemes such as stream encryption with low computational complexity and secret sharing encryption with strong disaster recovery ability can be studied to deal with the above problems. In addition, it is also meaningful to do further research on the extraction methods. On the basis that the existence of extraction operation does not affect the lossless recovery, how to design an embedding scheme that can be extracted blindly is worth considering.



---

*Source: 6299469-2022-05-12.xml*