# A Verifiable Steganography-Based Secret Image Sharing Scheme in 5G Networks

Authors: Shiyue Qin; Zhenhua Tan; Fucai Zhou; Jian Xu; Zongye Zhang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

With the development and innovation of new techniques for 5G, 5G networks can provide extremely large capacity, robust integrity, high bandwidth, and low latency for multimedia image sharing and storage. However, it will surely exacerbate the privacy problems intrinsic to image transformation. Due to the high security and reliability requirements for storing and sharing sensitive images in the 5G network environment, verifiable steganography-based secret image sharing (SIS) is attracting increasing attention. The verifiable capability is necessary to ensure the correct image reconstruction. From the literature, efficient cheating verification, lossless reconstruction, low reconstruct complexity, and high-quality stego images without pixel expansion are summarized as the primary goals of proposing an effective steganography-based SIS scheme. Compared with the traditional underlying techniques for SIS, cellular automata (CA) and matrix projection have more strengths as well as some weaknesses. In this paper, we perform a complimentary of these two techniques to propose a verifiable secret image sharing scheme, where CA is used to enhance the security of the secret image, and matrix projection is used to generate shadows with a smaller size. From the steganography perspective, instead of the traditional least significant bits replacement method, matrix encoding is used in this paper to improve the embedding efficiency and stego image quality. Therefore, we can simultaneously achieve the above goals and achieve proactive and dynamic features based on matrix projection. Such features can make the proposed SIS scheme more applicable to flexible 5G networks. Finally, the security analysis illustrates that our scheme can effectively resist the collusion attack and detect the shadow tampering over the persistent adversary. The analyses for performance and comparative demonstrate that our scheme is a better performer among the recent schemes with the perspective of functionality, visual quality, embedding ratio, and computational efficiency. Therefore, our scheme further strengthens security for the images in 5G networks.


---

## Body

## 1. Introduction

Nowadays, a huge amount of data is available in multimedia forms, such as images and videos. With the growing popularity of multimedia data, multimedia sharing has become one of the most popular Internet services. Meanwhile, the emergence of fifth-generation networks (5G) brings many advantages to supply power to such multimedia sharing services. Compared to the actual 4G technologies, 5G will be more flexible and will provide significantly higher bandwidth, as well as robust integrity, more capacity, and very low latency [1]. Such features are fundamental for facilitating information flow and timeliness of data, thus improving sharing services quality. 5G will undoubtedly drive people and organizations to interact with others more actively and exchange more information in a greater open network environment [2]. However, it may exacerbate the privacy problems intrinsic to multimedia transfer in networks as a result. As image sharing is one of the basic multimedia sharing services, this paper aims to achieve secure image share and storage in 5G networks.Based on the 5G technique advantages, it is foreseen that 5G will have great potential to handle challenges in various fields, such as smart cities [3], healthcare [4], and industrial control [5], and traffic congestion [6]. In such scenarios, medical images, design drawings, military images, and financial reports [7] always contain massive sensitive information. Hence, the sharing and storing of these images can be more vulnerable towards several kinds of attacks, such as eavesdropping and tampering. Secret image sharing (SIS) [8, 9] developing from the traditional secret sharing is a promising way to ensure the privacy and integrity of the secret image for distributed storing and sharing in the network. However, ordinary SIS will generate n shadows in the form of noise-like images [10, 11] which might arise suspicious of the invaders [12] during the shadow dissemination. Therefore, steganography-based SIS will further improve the security of SIS systems in a more open 5G network.A generalk,n-threshold steganography-based SIS scheme enables a dealer to distribute its secret image among a set of untrusted participants via the public channel. Firstly, the dealer generates n noise-like shadows for the secret image. Then, n shadows are embedded into the preselected meaningful images (called cover images) so as to generate n meaningful stego images. Finally, each of the participants is allocated a stego image. When someone requests the secret’s reconstruction, they need to extract enough shadows from the stego images. Only the combination of at least k shadows can perform the lossless reconstruction, and less than k shadows give no clues about the secret image in contrast. Therefore, steganography-based SIS can protect the secret image with higher security because the eavesdroppers cannot detect secret information from meaningful images. However, most of the existed steganography-based SIS schemes have a problem with the pixel expansion, for example, the stego images generated in the schemes of [13–15] are expanded four times the original secret image to realize high-quality steganography. Here, the challenge of proposing steganography-based SIS schemes is to create high-quality stego images so that the modifications are not visually perceptible.Moreover, the verification ability is necessary to check the validity of the stego images for the secret image reconstruction. If a fake stego image is submitted, the reconstructed image will not be exactly the same as originally outsourced. Cheating detection is one of the methods to locate a set of potential invalid shadows. It is easy to design SIS with verification ability by using hash codes [16–18]. However, most steganography-based SIS with cheating detection ability needs to embed these extra authentication bits into the cover image, which unfortunately leads to high recovery (authentication) complexity and pixel expansion. Therefore, an efficiency verification mechanism is needed to be designed.Additionally, in 5G network scenarios, a natural extension of such schemes is to consider the attached proactive feature and dynamic feature. The proactive feature is essential in some circumstances that the secret needs to be kept for a very long time, such as medical image records [19]. It can resist persistent adversaries by updating the shadows periodically. The secret cannot be discovered even from enough shadows, which are mixed with past and present shadows. Especially in 5G network environments, the persistent adversary will be more general who can stay in the network all the time. Moreover, the dynamic feature is also practical which supports efficient secret updating without shadow distribution again. Such a feature is necessary for an SIS scheme to adapt the data flow rate in 5G networks. However, these features are attracted very little attention to SIS.Therefore, in this paper, we are willing to propose a verifiable steganography-based secret image sharing scheme for 5G networks that achieves the following goals: (1) high-quality stego images without pixel expansion; (2) an efficient cheating verification ability to handle the dishonest participant; (3) lossless reconstruction and low reconstruct complexity; and (4) proactive feature and dynamic feature. To meet the design goals described above, we combine Two-Dimensional Reversible Linear Cellular Automata with Memory (2D-RLCAM) and matrix projection together to design the scheme. 2D-RLCAM is a kind of cellular automata additionally with memory and reversible abilities.Our contributions are as follows:(i)
Security enhanced: during the secret distribution procedure, CA is used to preprocess the secret image. Then, the matrix projection-based secret sharing scheme, as introduced in the typical work of Bai and Zou [11], is employed with some changes to generate small shadows. Increased by CA’s security, the secret image security is significantly improved to solve the matrix projection’s weaknesses.(ii)
Needless of the consecutive shadows for reconstruction: the consecutive requirement for reversing in CA is embedded into the secret image’s submatrices, but not directly for the secret image. Hence, the consecutive shadows in this paper are needless for secret reconstruction to overcome CA’s weaknesses.(iii)
High-quality stego images without pixel expansion: matrix encoding is using in this paper for steganography. Our scheme obtains enhancement in both the security of secret image and the visual quality of the stego image, benefiting from smaller shadows and the comparatively slight modification to the cover image.(iv)
Feature optimization for 5G scenarios: for the verifiable feature, a separate verification matrix is used for cheating detection. It can achieve a relatively low verification complexity based on XOR operations. For proactive and dynamic features, they can be realized with only a few times of matrix operations.(v)
Lossless reconstruction and low reconstruct complexity: the experiments over the test images demonstrate the effectiveness and efficiency of the proposed scheme via several indices.The rest of this paper is organized as follows: the related work is given in Section2. The preliminaries of 2D-RLCAM, the typical work of Bai and Zou [11], and matrix encoding are introduced in Section 3. The procedures of the proposed SIS scheme are discussed in detail in Section 4. The security analyses for persistent adversaries are studied in Section 5. The experimental results based on the real images and comparative analysis are given in Section 6. Finally, the paper ends with a conclusion in Section 7.


## 2. Related Work

### 2.1. SIS

From the literature, Shamir’s secret sharing [20] is one of the underlying techniques used to build SIS schemes mostly, but always has the pixel loss problem [21, 22]. In order to solve this problem, several new techniques have been used to devise a new k,n-threshold SIS scheme, such as cellular automata (CA) [23, 24] and matrix projection [25].Compared with Shamir-based SIS, CA-based SIS [12, 15, 26, 27] has more advantages: (1) the computation complexity of CA-based SIS is only On, which is more efficient while Shamir-based SIS needs Onlogn; (2) the consecutive properties in CA provide a stronger security guarantee for the secret image. Nevertheless, most CA-based SIS schemes also exist in some problems: (1) only consecutive shadows can reveal the secret image [15, 26, 27] which limited the availability and (2) the pixel expansion problem still exists. The scheme of Eslami et al. [15] is the first CA-based SIS, which improved tamper detection. However, in this scheme, the shadow’s size is the same as the original secret image. If the steganography of these shadows is performed, the pixel expansion problem will be unavoidable. The scheme of Zarepour-Ahmadabadi et al. [12] is a multistage multisecret image sharing scheme based on CA and Shamir-based sharing algorithm that each secret image has its own access structure. In this scheme, the secrets can be reconstructed based on their own prespecified order, which can apply to more general and flexible scenarios. However, this scheme executed the Shamir-based sharing algorithm multiple times during the secret distribution and reconstruction, which still made a higher computation complexity.Matrix projection-based SIS [11, 16, 28] can significantly reduce the size of the shadows. In the basic matrix projection-based k,n secret sharing scheme [10], for a m×m secret matrix, the generated shadows are vectors with the size of only m×1. Based on it, Bai and Zou [11] construct a proactive secret sharing scheme. The generated shadows in their scheme are m+k×1 vectors. The size of the shadows is still small. Therefore, matrix projection-based SIS can effectively reduce the modifications over the cover images and even create high-quality stego images by avoiding the pixel expansion problem. However, the existing matrix projection-based SIS schemes only generate noise-like image shadows but do not consider combining steganography. Additionally, there are two problems with the existed matrix projection-based SIS schemes: (1) matrix projection-based k,n secret sharing scheme is only a strong ramp secret sharing but not perfect secret sharing [25], which may expose information about the secret proportional to the number of the obtained shadows till enough, and (2) without the verification ability [11, 28]. Although the scheme of Azzahra and Sugeng [16] realized cheating detection with the help of an additional authentication image, the dealer must be involved in the reconstruction process. Therefore, the security and functionality of matrix projection-based SIS need to be improved.In this paper, we combine Two-Dimensional Reversible Linear Cellular Automata with Memory (2D-RLCAM) and matrix projection together to avoid the weaknesses of these techniques but keeping the advantages.


### 2.2. Steganography-Based SIS

The least significant bits (LSB) method is one of the most common solutions for steganography. This method directly replaces the least significant bits of some pixels in the cover image with the shadow, such as in Yang et al.’s Shamir-based scheme [13], Chang et al.’s Chinese remainder-based scheme [14], and Eslami et al.’s linear cellular automata- (LCA-) based scheme [15]. These schemes enable the shadow embedding and concealed shadow extraction in a highly efficient way, without any cryptographic computation. However, the above schemes have a problem with the pixel expansion. One of the key reasons is that the generated shadows’ size is relatively big. Another reason is that the requirement of the steganography space is relatively big for performing LSB so that the stego image generated in the above schemes is expanded four times the original secret image to realize high-quality steganography.Matrix encoding (ME) method is another steganography method mainly based on some XOR operations, rather than direct replacement as in LSB. Hence, the information of the shadow does not directly appear in the pixels of the cover image, which increases the security of the concealed information. Moreover, to hide a 3-bit length secret, at most only 1 bit of a pixel is needed to be changed via the ME method, but usually 3 bits are needed in the LSB method. Hence, ME can realize the comparatively slight modification to the cover image. Compared with LSB, ME needs more computational cost because of some simple XOR operations, but it can obtain enhancement in both the security of secret data and the visual quality of stego images. Therefore, we use ME in our paper to hide the shadow into a cover image.Moreover, Yan et al. [29] introduced the requirement of lossless reconstruction of the cover images in an SIS scheme. The reversible cover images are needed in several scenarios, such as law enforcement, experimental investigations, and remote sensing [30]. However, the traditional SIS approaches have some limitations for the cover image reconstruction, such as the restrictions of the cover image formats and kinds, or loss reconstruction of the cover image. In the scheme of Yan et al. [29], the lossless reconstruction is realized, but the format of cover images is restricted to the binary image. In this paper, we generate a submatrix for the grayscale cover image to recover it losslessly.


### 2.3. Verifiable SIS

It is easy to design SIS with verification ability by using hash codes [16–18] or information hiding [15, 26, 31]. Chang et al. [14] used the Chinese remainder theorem (CRT) to generate four authentication bits by using the hash function in order to obtain better authentication ability. Recently, Liu et al. [17] divided each stego image into nonoverlapping blocks with size 1×3 firstly and then generated two authentication bits for each stego block. This scheme also achieved good visual quality and authentication ability. However, most of the above schemes need to embed these extra authentication bits into the cover image, which unfortunately leads to high recovery (authentication) complexity and pixel expansion. Besides the above solutions, the double verification mechanism [15], the random grid [32], and the extra authentication image [16] were also used to provide a powerful verification of the fake stego images. In the scheme of Azzahra and Sugeng [16], the dealer kept an extra authentication image privately. After the secret reconstruction, the dealer performed the cheating detection by checking if the authentication image is recovered correctly. However, this scheme suffers from drawbacks in that even enough shadows cannot reconstruct the secret image because the dealer must be involved in the reconstruction process. To some degree, the participation of the dealer makes this scheme diverge from the original intention of the secret sharing.In this paper, we embed a verification matrix into the public known information by XOR operations. It can avoid the problems of high recovery complexity and pixel expansion. Moreover, the valid requester can perform an efficient cheating detection via some simple XOR operations but without the additional help from the dealer.


## 2.1. SIS

From the literature, Shamir’s secret sharing [20] is one of the underlying techniques used to build SIS schemes mostly, but always has the pixel loss problem [21, 22]. In order to solve this problem, several new techniques have been used to devise a new k,n-threshold SIS scheme, such as cellular automata (CA) [23, 24] and matrix projection [25].Compared with Shamir-based SIS, CA-based SIS [12, 15, 26, 27] has more advantages: (1) the computation complexity of CA-based SIS is only On, which is more efficient while Shamir-based SIS needs Onlogn; (2) the consecutive properties in CA provide a stronger security guarantee for the secret image. Nevertheless, most CA-based SIS schemes also exist in some problems: (1) only consecutive shadows can reveal the secret image [15, 26, 27] which limited the availability and (2) the pixel expansion problem still exists. The scheme of Eslami et al. [15] is the first CA-based SIS, which improved tamper detection. However, in this scheme, the shadow’s size is the same as the original secret image. If the steganography of these shadows is performed, the pixel expansion problem will be unavoidable. The scheme of Zarepour-Ahmadabadi et al. [12] is a multistage multisecret image sharing scheme based on CA and Shamir-based sharing algorithm that each secret image has its own access structure. In this scheme, the secrets can be reconstructed based on their own prespecified order, which can apply to more general and flexible scenarios. However, this scheme executed the Shamir-based sharing algorithm multiple times during the secret distribution and reconstruction, which still made a higher computation complexity.Matrix projection-based SIS [11, 16, 28] can significantly reduce the size of the shadows. In the basic matrix projection-based k,n secret sharing scheme [10], for a m×m secret matrix, the generated shadows are vectors with the size of only m×1. Based on it, Bai and Zou [11] construct a proactive secret sharing scheme. The generated shadows in their scheme are m+k×1 vectors. The size of the shadows is still small. Therefore, matrix projection-based SIS can effectively reduce the modifications over the cover images and even create high-quality stego images by avoiding the pixel expansion problem. However, the existing matrix projection-based SIS schemes only generate noise-like image shadows but do not consider combining steganography. Additionally, there are two problems with the existed matrix projection-based SIS schemes: (1) matrix projection-based k,n secret sharing scheme is only a strong ramp secret sharing but not perfect secret sharing [25], which may expose information about the secret proportional to the number of the obtained shadows till enough, and (2) without the verification ability [11, 28]. Although the scheme of Azzahra and Sugeng [16] realized cheating detection with the help of an additional authentication image, the dealer must be involved in the reconstruction process. Therefore, the security and functionality of matrix projection-based SIS need to be improved.In this paper, we combine Two-Dimensional Reversible Linear Cellular Automata with Memory (2D-RLCAM) and matrix projection together to avoid the weaknesses of these techniques but keeping the advantages.


## 2.2. Steganography-Based SIS

The least significant bits (LSB) method is one of the most common solutions for steganography. This method directly replaces the least significant bits of some pixels in the cover image with the shadow, such as in Yang et al.’s Shamir-based scheme [13], Chang et al.’s Chinese remainder-based scheme [14], and Eslami et al.’s linear cellular automata- (LCA-) based scheme [15]. These schemes enable the shadow embedding and concealed shadow extraction in a highly efficient way, without any cryptographic computation. However, the above schemes have a problem with the pixel expansion. One of the key reasons is that the generated shadows’ size is relatively big. Another reason is that the requirement of the steganography space is relatively big for performing LSB so that the stego image generated in the above schemes is expanded four times the original secret image to realize high-quality steganography.Matrix encoding (ME) method is another steganography method mainly based on some XOR operations, rather than direct replacement as in LSB. Hence, the information of the shadow does not directly appear in the pixels of the cover image, which increases the security of the concealed information. Moreover, to hide a 3-bit length secret, at most only 1 bit of a pixel is needed to be changed via the ME method, but usually 3 bits are needed in the LSB method. Hence, ME can realize the comparatively slight modification to the cover image. Compared with LSB, ME needs more computational cost because of some simple XOR operations, but it can obtain enhancement in both the security of secret data and the visual quality of stego images. Therefore, we use ME in our paper to hide the shadow into a cover image.Moreover, Yan et al. [29] introduced the requirement of lossless reconstruction of the cover images in an SIS scheme. The reversible cover images are needed in several scenarios, such as law enforcement, experimental investigations, and remote sensing [30]. However, the traditional SIS approaches have some limitations for the cover image reconstruction, such as the restrictions of the cover image formats and kinds, or loss reconstruction of the cover image. In the scheme of Yan et al. [29], the lossless reconstruction is realized, but the format of cover images is restricted to the binary image. In this paper, we generate a submatrix for the grayscale cover image to recover it losslessly.


## 2.3. Verifiable SIS

It is easy to design SIS with verification ability by using hash codes [16–18] or information hiding [15, 26, 31]. Chang et al. [14] used the Chinese remainder theorem (CRT) to generate four authentication bits by using the hash function in order to obtain better authentication ability. Recently, Liu et al. [17] divided each stego image into nonoverlapping blocks with size 1×3 firstly and then generated two authentication bits for each stego block. This scheme also achieved good visual quality and authentication ability. However, most of the above schemes need to embed these extra authentication bits into the cover image, which unfortunately leads to high recovery (authentication) complexity and pixel expansion. Besides the above solutions, the double verification mechanism [15], the random grid [32], and the extra authentication image [16] were also used to provide a powerful verification of the fake stego images. In the scheme of Azzahra and Sugeng [16], the dealer kept an extra authentication image privately. After the secret reconstruction, the dealer performed the cheating detection by checking if the authentication image is recovered correctly. However, this scheme suffers from drawbacks in that even enough shadows cannot reconstruct the secret image because the dealer must be involved in the reconstruction process. To some degree, the participation of the dealer makes this scheme diverge from the original intention of the secret sharing.In this paper, we embed a verification matrix into the public known information by XOR operations. It can avoid the problems of high recovery complexity and pixel expansion. Moreover, the valid requester can perform an efficient cheating detection via some simple XOR operations but without the additional help from the dealer.


## 3. Preliminaries

### 3.1. Reversible Linear Cellular Automata with Memory

Cellular automaton (CA) is a deterministic and discrete system. This paper deals with two-dimensional CA (2D-CA) with the cell space ofSb=0,1,…,7b=8 and with transfer function F depending on Moore neighborhood N. 2D Reversible Linear Cellular Automata with Memory (2D-RLCAM) is a kind of CA additionally with memory and reversible abilities.For ar×s 2D-CA, if ai,jt∈Sb is taken to denote the state of one cell at the position i,j at a certain time t, the state of N of it can be represented as follows:(1)Ni,jt=ai−1,j−1tai−1,jtai−1,j+1tai,j−1tai,jtai,j+1tai+1,j−1tai+1,jtai+1,j+1t.DenoteCt as the CA’s configuration of time t which consisted of all of the ai,jt1≤i≤r,1≤j≤s. C0 is called the initial configuration. When dealing with the iteration of CA, the periodic boundary condition ai,jt=ax,yti≡xmodr,j≡ymods is used in this paper.In 2D-RLCAM of capacityk (2D-k-RLCAM), the state of the configuration Ct+1 evolves as follows:(2)Ct+1=FCt,Ct−1,…,Ct−k+1.More concretely, the state of each cellai,jt+1∈Ct+1 can be computed as (3). Note that k denotes the capability of memory here but not the threshold value of SIS. In this paper, 2D-3-RLCAM is used.(3)ai,jt+1=fw1Ni,jt+fw2Ni,jt−1+⋯+fwk−1Ni,jt−k+2+fwkNi,jt−k+1modb=fw1Ni,jt+fw2Ni,jt−1+⋯+fwk−1Ni,jt−k+2+ai,jt−k+1modb.In equation (3), Ni,jt∈Ct,Ni,jt−1∈Ct−1,…,Ni,jt−k+1∈Ct−k+1 are the Moore neighborhood of the cell ai,j in the time t,t−1,…,t−k+1, respectively. Besides, w1,…,wk is the rule number of the transfer function F and fw is computed by (4). Therefore, the value of w can be represented as w10=λ−1,−1,λ−1,0,λ−1,1,λ0,−1,λ0.0,λ0,1,λ1,−1,λ1,0,λ1,12, where w∈0,29. Notice that, if fwkNi,jt−k+1=ai,jt−k+1 is satisfied, wk should be equal to 16.(4)fwNi,jt=∑λα,β∗ai+α,j+βt,whereα,β=−1,0,1andλα,β∈0,1.A simple example forw=69 of (4): we can obtain 6910=0010001012. Therefore, only the values of λ−1,1,λ1,−1,λ1,1 are equal to 1 and the others are equal to 0. Hence, we can compute fwNi,jt as follows:(5)fwNi,jt=∑λα,β∗ai+α,j+βt=ai−1,j+1t+ai+1,j−1t+ai+1,j+1t.LetC˜t denote a reversion state of time t and a˜i,jt denote the state of one cell in it. N˜i,jt denotes the neighborhood of it. During the reversion of 2D-k-RLCAM after n iterations, the final configuration Ck+n−1 is taken as the initial reversion state C˜0. Therefore, the configuration Ck+n−1−t is taken as the reversion state C˜t. The state reverses as C˜t+1=F′C˜t−k+1,C˜t−k+2,…,C˜t by(6)a˜i,jt+1=−fwk−1N˜i,jt+fwk−2N˜i,jt−1+⋯+fw1N˜i,jt−k+2+a˜i,jt−k+1modb.A simple example for 2D-3-RLCAM: assumen=5 and assume the set of C0,C1,C2 is the initial configuration. Therefore, C3 is the state after the first iteration, and C7 is the final state after 5 iterations after computing (7). During the reversible process, C7,C6,C5 will be taken as the initial reversion state C˜0,C˜1,C˜2, and C4 will be recovered by C˜3=C4 as in (8):(7)C7=fw1C6+fw2C5+C4,(8)C˜3=−fw1C˜1+fw2C˜2+C˜0=−fw1C6−fw2C5+C7=C4.


### 3.2. Bai and Zou’s Proactive Secret Sharing Scheme

Bai and Zou’sk,n-threshold PSS scheme [11] can periodically renew n shadows without modifying the secret. The secrets cannot be discovered from enough shares, which are mixed with past and present shares. The scheme is based on the matrix projection method, and the proactive feature is achieved through Pythagorean triples.Matrix projection: letA be an m×k matrix of rank k0≤k≤m and PA=AATA−1AT is the m×m projection matrix of it. Give k linearly independent k×1 vectors xi and compute θi=Axi. The matrix B=θ1,θ2,…,θk can satisfy PB=BBTB−1BT=PA.Pythagorean triples: randomly choosea,ba,b∈Z∗,a>b>0, and compute the Pythagorean triples Z1=a2−b2,Z2=2ab,Z3=a2+b2 where Z12+Z22=Z32. Based on randomly chosen g,h1≤g≠h≤k, an orthonormal k×k matrix LM can be constructed by (9) where LM−1=LMT. LMi,j denotes the element of position i,j in LM:(9)LMi,j=Z1Z3modp,ifi=j=g,Z1Z3modp,ifi=j=h,Z2Z3modp,ifi=g,j=h,−Z2Z3modp,ifi=h,j=g,0,otherwise.Now suppose the dealer wants to share a secretm×m matrix S0. Then, Bai and Zou’s [11] proactive scheme based on matrix projection method can be constructed in the following three phases. An, Bn, and Cn denote the n-th step in each phase A, B, C.Construction of shadows for a secret matrixS0 (with the size of m×m) at the time period t=0, where m>2k−3:(i)
A1: fillingS0 into a matrix S with the size of LT×LT via random values, where LT=m+k. Take S0=SUL:m×m to denote that m×m matrix S0 can be extracted from the upper left corner of the matrix S.(ii)
A2: construct a set ofLT×1 shadow vectors θii=1,2,..n=Axi based on a random LT×k matrix A and n linearly independent k×1 vectors xi.(iii)
A3: compute the remainder matrixR=PA−Smodp, where PA is the LT×LT projection matrix of A. The remainder matrix R is also with the size of LT×LT.(iv)
A4: distribute shadow vectorsθii=1,2,..n to participants and make the remainder matrix R publicly known.Update shadows at the beginning oft+1t≥0:(i)
B1: generate ank×k orthonormal matrix LM by (9) as the update matrix, and distribute it via a secure channel to each participant.(ii)
B2: each participant updates its shadowθit to θit+1 by (10) and erases the variables θit and LM:(10)θit+1=θit1:mLM∗θitm+1:m+k,θit1:m denotes the top part of θit which contains the first m elements and θitm+1:m+k is the lower part which contains the remaining k elements.Reconstruction of the secret matrixS0:(i)
C1: compute the matrixB=θ1,θ2,…,θk based on any k valid shadows.(ii)
C2: the secretS0=PB−RUL:m×mmodp.When the current time periodt>0, there exists PA≠PB because the shadows are updated. However, equation (11) is still holding based on the matrix projection and the orthonormal update matrix LM. The detailed explanation can be seen in [11].(11)PAUL:m×m=PBUL:m×m.The proposed SIS scheme in this paper is constructed based on Bai and Zou’s [11] scheme. The detailed analysis of the correctness and security of sharing and updating can be seen in [11].


### 3.3. Matrix Encoding

Matrix encoding (ME) is a technology for steganography. Generally, for a secretS, a ME process can be defined as a 3-tuple Cmax,n,k. It denotes that no more than Cmax bits can be changed among n=2k−1 modifiable bits when hiding a k-bit length secret S.Let the set ofa1,a2,…,an denote the steganography cell, where ai is a modifiable bit. Compute f=a1∗1⊕a2∗2⊕⋯⊕an∗n and p=f⊕S. The cell a1,a2,…,an is changed into a1′,a2′,…,an′ by (12). In the secret extraction phase, the secret S can be directly extracted by S′=a1′∗1⊕a2′∗2⊕⋯⊕an′∗n=S.(12)ifp=0:ai′=ai,i=1,…,n,ifp≠0:ap′=1−ap,ai′=ai,i=1,…,ni≠p.1,7,3-ME is used in this paper. It means that the secret value is should be satisfied S∈0,7. For example, assume we want to hide S=610=1002 into a pixel with the value of 10510=11010012=a1,a2,a3,a4,a5,a6,a7 during a 1,7,3-ME process. Compute f=0 and p=6 first. Then, change a6′=1−a6=1 and obtain the pixel value =  a1′,a2′,a3′,a4′,a5′,a6′,a7′=11010112=10710 that embeds with the secret information. Finally, we can recover the secret S′=6=S.Therefore, the secretS is hidden in a pixel, but not appears directly in this pixel. It shows stronger security than the standard least significant bit (LSB) method. Moreover, it at most changes 1 bit to hide a 3-bit length secret in a 1,7,3-ME process. However, at most 7 bits need to be changed in a standard least significant bit (LSB) method. Therefore, the ME method can achieve a slighter modification than the LSB method for the same case.Moreover, in order to achieve a better image steganography, the changed bitap should be controlled among the least significant bits of a pixel. Therefore, the steganography cell is assigned into three pixels X,Y,Z by X=x1,x2,..,x6,a1,a2,Y=y1,y2,..,y6,a3,a4,andZ=z1,z2,..,z5,a5,a6,a7, and take X,Y,Z⟶S to denote the embedding process in this paper.


## 3.1. Reversible Linear Cellular Automata with Memory

Cellular automaton (CA) is a deterministic and discrete system. This paper deals with two-dimensional CA (2D-CA) with the cell space ofSb=0,1,…,7b=8 and with transfer function F depending on Moore neighborhood N. 2D Reversible Linear Cellular Automata with Memory (2D-RLCAM) is a kind of CA additionally with memory and reversible abilities.For ar×s 2D-CA, if ai,jt∈Sb is taken to denote the state of one cell at the position i,j at a certain time t, the state of N of it can be represented as follows:(1)Ni,jt=ai−1,j−1tai−1,jtai−1,j+1tai,j−1tai,jtai,j+1tai+1,j−1tai+1,jtai+1,j+1t.DenoteCt as the CA’s configuration of time t which consisted of all of the ai,jt1≤i≤r,1≤j≤s. C0 is called the initial configuration. When dealing with the iteration of CA, the periodic boundary condition ai,jt=ax,yti≡xmodr,j≡ymods is used in this paper.In 2D-RLCAM of capacityk (2D-k-RLCAM), the state of the configuration Ct+1 evolves as follows:(2)Ct+1=FCt,Ct−1,…,Ct−k+1.More concretely, the state of each cellai,jt+1∈Ct+1 can be computed as (3). Note that k denotes the capability of memory here but not the threshold value of SIS. In this paper, 2D-3-RLCAM is used.(3)ai,jt+1=fw1Ni,jt+fw2Ni,jt−1+⋯+fwk−1Ni,jt−k+2+fwkNi,jt−k+1modb=fw1Ni,jt+fw2Ni,jt−1+⋯+fwk−1Ni,jt−k+2+ai,jt−k+1modb.In equation (3), Ni,jt∈Ct,Ni,jt−1∈Ct−1,…,Ni,jt−k+1∈Ct−k+1 are the Moore neighborhood of the cell ai,j in the time t,t−1,…,t−k+1, respectively. Besides, w1,…,wk is the rule number of the transfer function F and fw is computed by (4). Therefore, the value of w can be represented as w10=λ−1,−1,λ−1,0,λ−1,1,λ0,−1,λ0.0,λ0,1,λ1,−1,λ1,0,λ1,12, where w∈0,29. Notice that, if fwkNi,jt−k+1=ai,jt−k+1 is satisfied, wk should be equal to 16.(4)fwNi,jt=∑λα,β∗ai+α,j+βt,whereα,β=−1,0,1andλα,β∈0,1.A simple example forw=69 of (4): we can obtain 6910=0010001012. Therefore, only the values of λ−1,1,λ1,−1,λ1,1 are equal to 1 and the others are equal to 0. Hence, we can compute fwNi,jt as follows:(5)fwNi,jt=∑λα,β∗ai+α,j+βt=ai−1,j+1t+ai+1,j−1t+ai+1,j+1t.LetC˜t denote a reversion state of time t and a˜i,jt denote the state of one cell in it. N˜i,jt denotes the neighborhood of it. During the reversion of 2D-k-RLCAM after n iterations, the final configuration Ck+n−1 is taken as the initial reversion state C˜0. Therefore, the configuration Ck+n−1−t is taken as the reversion state C˜t. The state reverses as C˜t+1=F′C˜t−k+1,C˜t−k+2,…,C˜t by(6)a˜i,jt+1=−fwk−1N˜i,jt+fwk−2N˜i,jt−1+⋯+fw1N˜i,jt−k+2+a˜i,jt−k+1modb.A simple example for 2D-3-RLCAM: assumen=5 and assume the set of C0,C1,C2 is the initial configuration. Therefore, C3 is the state after the first iteration, and C7 is the final state after 5 iterations after computing (7). During the reversible process, C7,C6,C5 will be taken as the initial reversion state C˜0,C˜1,C˜2, and C4 will be recovered by C˜3=C4 as in (8):(7)C7=fw1C6+fw2C5+C4,(8)C˜3=−fw1C˜1+fw2C˜2+C˜0=−fw1C6−fw2C5+C7=C4.


## 3.2. Bai and Zou’s Proactive Secret Sharing Scheme

Bai and Zou’sk,n-threshold PSS scheme [11] can periodically renew n shadows without modifying the secret. The secrets cannot be discovered from enough shares, which are mixed with past and present shares. The scheme is based on the matrix projection method, and the proactive feature is achieved through Pythagorean triples.Matrix projection: letA be an m×k matrix of rank k0≤k≤m and PA=AATA−1AT is the m×m projection matrix of it. Give k linearly independent k×1 vectors xi and compute θi=Axi. The matrix B=θ1,θ2,…,θk can satisfy PB=BBTB−1BT=PA.Pythagorean triples: randomly choosea,ba,b∈Z∗,a>b>0, and compute the Pythagorean triples Z1=a2−b2,Z2=2ab,Z3=a2+b2 where Z12+Z22=Z32. Based on randomly chosen g,h1≤g≠h≤k, an orthonormal k×k matrix LM can be constructed by (9) where LM−1=LMT. LMi,j denotes the element of position i,j in LM:(9)LMi,j=Z1Z3modp,ifi=j=g,Z1Z3modp,ifi=j=h,Z2Z3modp,ifi=g,j=h,−Z2Z3modp,ifi=h,j=g,0,otherwise.Now suppose the dealer wants to share a secretm×m matrix S0. Then, Bai and Zou’s [11] proactive scheme based on matrix projection method can be constructed in the following three phases. An, Bn, and Cn denote the n-th step in each phase A, B, C.Construction of shadows for a secret matrixS0 (with the size of m×m) at the time period t=0, where m>2k−3:(i)
A1: fillingS0 into a matrix S with the size of LT×LT via random values, where LT=m+k. Take S0=SUL:m×m to denote that m×m matrix S0 can be extracted from the upper left corner of the matrix S.(ii)
A2: construct a set ofLT×1 shadow vectors θii=1,2,..n=Axi based on a random LT×k matrix A and n linearly independent k×1 vectors xi.(iii)
A3: compute the remainder matrixR=PA−Smodp, where PA is the LT×LT projection matrix of A. The remainder matrix R is also with the size of LT×LT.(iv)
A4: distribute shadow vectorsθii=1,2,..n to participants and make the remainder matrix R publicly known.Update shadows at the beginning oft+1t≥0:(i)
B1: generate ank×k orthonormal matrix LM by (9) as the update matrix, and distribute it via a secure channel to each participant.(ii)
B2: each participant updates its shadowθit to θit+1 by (10) and erases the variables θit and LM:(10)θit+1=θit1:mLM∗θitm+1:m+k,θit1:m denotes the top part of θit which contains the first m elements and θitm+1:m+k is the lower part which contains the remaining k elements.Reconstruction of the secret matrixS0:(i)
C1: compute the matrixB=θ1,θ2,…,θk based on any k valid shadows.(ii)
C2: the secretS0=PB−RUL:m×mmodp.When the current time periodt>0, there exists PA≠PB because the shadows are updated. However, equation (11) is still holding based on the matrix projection and the orthonormal update matrix LM. The detailed explanation can be seen in [11].(11)PAUL:m×m=PBUL:m×m.The proposed SIS scheme in this paper is constructed based on Bai and Zou’s [11] scheme. The detailed analysis of the correctness and security of sharing and updating can be seen in [11].


## 3.3. Matrix Encoding

Matrix encoding (ME) is a technology for steganography. Generally, for a secretS, a ME process can be defined as a 3-tuple Cmax,n,k. It denotes that no more than Cmax bits can be changed among n=2k−1 modifiable bits when hiding a k-bit length secret S.Let the set ofa1,a2,…,an denote the steganography cell, where ai is a modifiable bit. Compute f=a1∗1⊕a2∗2⊕⋯⊕an∗n and p=f⊕S. The cell a1,a2,…,an is changed into a1′,a2′,…,an′ by (12). In the secret extraction phase, the secret S can be directly extracted by S′=a1′∗1⊕a2′∗2⊕⋯⊕an′∗n=S.(12)ifp=0:ai′=ai,i=1,…,n,ifp≠0:ap′=1−ap,ai′=ai,i=1,…,ni≠p.1,7,3-ME is used in this paper. It means that the secret value is should be satisfied S∈0,7. For example, assume we want to hide S=610=1002 into a pixel with the value of 10510=11010012=a1,a2,a3,a4,a5,a6,a7 during a 1,7,3-ME process. Compute f=0 and p=6 first. Then, change a6′=1−a6=1 and obtain the pixel value =  a1′,a2′,a3′,a4′,a5′,a6′,a7′=11010112=10710 that embeds with the secret information. Finally, we can recover the secret S′=6=S.Therefore, the secretS is hidden in a pixel, but not appears directly in this pixel. It shows stronger security than the standard least significant bit (LSB) method. Moreover, it at most changes 1 bit to hide a 3-bit length secret in a 1,7,3-ME process. However, at most 7 bits need to be changed in a standard least significant bit (LSB) method. Therefore, the ME method can achieve a slighter modification than the LSB method for the same case.Moreover, in order to achieve a better image steganography, the changed bitap should be controlled among the least significant bits of a pixel. Therefore, the steganography cell is assigned into three pixels X,Y,Z by X=x1,x2,..,x6,a1,a2,Y=y1,y2,..,y6,a3,a4,andZ=z1,z2,..,z5,a5,a6,a7, and take X,Y,Z⟶S to denote the embedding process in this paper.


## 4. Proposed Scheme

The proposedk,n-threshold verifiable SIS scheme is constructed based on 2D-3-RLCAM and matrix projection, and the steganography is realized based on 1,7,3-ME. The system model consists of three entities: a dealer D, a set of participants PSet=P1,P2,…,Pn, and a set of requesters Q1,Q2,… (request for reconstructing the secret image). Moreover, there is a concept of “time period t” for that the entire lifetime of the secret is divided into many short time periods determined by the system-wide clock. The proposed scheme contains four procedures: the secret distribution procedure, the shadow update procedure, the secret reconstruction procedure, and the secret update procedure.The overall procedure of the secret distribution and the secret reconstruction is listed in Figure1. The serial numbers (n) in Figure 1 are corresponding to the serial numbers (n) in each section.Figure 1
Overall procedure of secret distribution and secret reconstruction.


### 4.1. Secret Distribution Procedure

The dealerD owns an original secret image SI for distributed storage, which is an m×m grayscale image. D also owns a set of grayscale meaningful cover images CI Set=CI1,CI2,…,CIn.D generates shadow vectors θSet=θ1,θ2,…,θn and embeds them into preselected CI Set so as to generate a set of stego images GI Set=GI1,GI2,…,GIn. Then, D allocates each participant Pi with a unique stego image GIi in the public channel and makes the public information publicly known.


#### 4.1.1. Generation of Shadows via Matrix Projection

Firstly, Bai and Zou’s scheme [11] is adopted to generate n shadow vectors via matrix projection as described in Section 3.2 (the step of A2). Construct LT×k matrix A and n linearly independent vectors x1,x2,…,xn, and then compute the shadow vectors θSet=θ1,θ2,…,θn. The size of each shadow vector θi is LT×1, where LT=m+k.


#### 4.1.2. Generation of Stego Images via Matrix Encoding and Distribution

In this step, we generate the stego imageGIi by hiding the shadow vector θi into the cover image CIi. Let mc×nc denote the size of the cover image CIi. We restrict 3LT≤mcnc because the cover image is needed to be large enough to hide the LT-length shadow vector θi via 1,7,3-ME in this paper.First of all, construct a chaotic mapping [33] based on CIi to select the steganography cells uniformly. The primary value of the chaotic mapping can be calculated as X0=∑i=15pi/28∗i where p1,p2,p3,p4,andp5 are the first five pixels of CIi and X0∈0,1. Then, compute a l1-length chaotic sequence X=X1,X2,…,Xl1 based on chaotic mapping function and X0, where l1=mcnc−5. A pseudorandom sequence X′ is the ascending order of X. Every three elements in X′ is the positions of a steganography cell and a (1,7,3)-ME for θi can be performed as in Section 3.3. Finally, after embedding the shadow vector θi into the cover image CIi, the stego image GIi is generated.A simple case of embedding the vectorθ1=v1,v2 into a 4×4 cover image CI is shown in Figure 2 (assume the chaotic mapping function is Xi+1=α∗Xi∗1−Xi and the parameter α=4 here, and assume X1=0.63 directly). The five pixels in the grey blocks are used to compute the primary value X0 for the chaotic mapping. The generated pseudorandom sequence X′ is the position for the steganography cells. To skip the first five pixels, the pixel no. should be computed as X′+5. Finally, the embedding is performed as p14,p8,p15⟶v1 and p12,p6,p10⟶v2.Figure 2
An example of embedding in a stego image via (1,7,3)-ME.After generating the stego image setsGI Set for the shadow vectors θSet, distribute each stego image to each participant via a public communication channel.From the description above, we can observe the following facts of the stego images:(i)
Slight and decentralized modification: the steganography cells are chosen uniformly and decentralized over the cover image based on the sensitive chaotic mapping. On this basis, only a trifle statistical difference of cover images will be made via the comparatively slight and decentralized modification of the pixels by using the ME steganography method.(ii)
The constraint for the cover image: the shadow size is onlym+k, so we can assume the cover image is smaller than the secret image (mc,nc≤m) because there is no pixel expansion in our scheme. Therefore, the larger cover image is not necessary for this paper.(iii)
Extract the shadow independently: the positions of the steganography pixels can be directly obtained from the stego image (by using the grey blocks in Figure2). Consequently, the requesters can perform the reconstruction, and the participants can perform the shadow update by themselves.


#### 4.1.3. Preprocessing of the Secret Image

For the secret imageSI, convert it into three m×m submatrices SIM1,SIM2,andSIM3 where SIM1=SI/82,SIM2=SI/8,andSIM3=SImod8, respectively. The submatrices SIM1,SIM2,and SIM3 can satisfy that SIM1∗82+SIM2∗81+SIM3∗80=SI.


#### 4.1.4. Generation of Secret Matrices via RLCAM

Construct a 2D-3-RLCAM with the discrete state setSbb=8. Firstly, define the iteration value u and the rule number w1,w2,w3 of it (notice that w3=16 in RLCAM). Then, take the three submatrices SIM1,SIM2,and SIM3 as the initial configuration C0,C1,C2, and obtain the states of Cu,Cu+1,Cu+2 after u times of iteration by (3). Therefore, the secret image SI is encrypted into three secret matrices Cu,Cu+1,Cu+2.Moreover, makew1,w2,w3 and u to be privately known by each requester, which can be seemed like the internal secret key of the system.


#### 4.1.5. Generation of the Separate Verification Part

For each cover imageCIi, the independent m×m verification matrix VM is generated as in (13). CIMi=CImod8 is the submatrix for CIi. Here, we call the matrices Cu,Cu+1,Cu+2,CIMi,VM are the secret matrices.(13)VM=Cu⊕Cu+1⊕Cu+2⊕CIMimod8.


#### 4.1.6. Generation of the Public Information

As in Bai and Zou’s scheme [11], a publicly known remainder matrix is needed to help with the following secret reconstruction. Notice that we have to additionally verify the secret image and the cover images, so we need to generate a remainder matrix for each cover image. To simplify the notation, take R denotes the remainder matrix for an arbitrary cover image. The same number of the remainder matrices is needed to be generated as the cover images actually.First of all, convert the secret matrices into theLT×LT filling matrices Cu¯,Cu+1¯,Cu+2¯,CIMi¯,VM¯ by filling with random values as (14). In (14), Cu=Cu¯UL:m×m represents that m×m matrix Cu can be extracted from the upper left corner of the matrix Cu¯:(14)Cu=Cu¯UL:m×m,Cu+1=Cu+1¯UL:m×m,Cu+2=Cu+2¯UL:m×m,CIMi=CIMi¯UL:mc×nc,VM=VM¯UL:m×m.Then, compute a projection matrixPA of matrix A (A is already generated in Step 1), where PA is a LT×LT matrix. Calculate intermediate matrices R0,R1,R2,R3,R4 by performing subtraction between PA and Cu¯,Cu+1¯,C¯,CIMi¯,VM¯ as in the following equation:(15)R0=PA−Cu¯,R1=PA−Cu+1¯,R2=PA−Cu+2¯,R3=PA−CIMi¯,R4=PA−VM¯.Finally, the remainder matrixR is computed via R=∑i=04Ri∗84−i, and make the remainder matrices for all cover images publicly known.


### 4.2. Shadow Update Procedure

Letθ1t,θ2t,…,θnt denote the shadow vectors during time period t. The update process to generate θ1t+1,θ2t+1,…,θnt+1 is similar to Bai and Zou’s scheme [11] in Section 3.2.At the beginning of time periodt+1, the dealer D generates a k×k orthonormal matrix LM and distributes it via a secure channel to each participant. After receiving LM, each participant Pi extracts the shadow vectors θit from its stego image and derives its new shadow vector θit+1 by (10). Then, Pi embeds θit+1 into its stego image again and erases all the variables except its current stego image. Because steganography is based on the computationally efficient XOR operation, the shadow updating is efficient even over the stego images.Note that the correctness of the fact that the update shadow vectors generated during the same time period can reconstruct the secret matrix is illustrated clearly in Bai and Zou’s scheme [11]. Moreover, a mixture of the shadows with different time periods cannot recover the secret, while equation (11) in Section 3.2 cannot be obtained. The explanation of this is also described in detail in Bai and Zou’s scheme [11].


### 4.3. Secret Reconstruction Procedure

A requesterQi can reconstruct SI as long as obtaining enough valid stego images GI1t,GI2t,…,GIkt∈GI Set during a single time period as follows.


#### 4.3.1. Extraction of the Shadow Vectors via Matrix Encoding

The requester computes the steganography cells firstly and then extracts the embedding shadow vectorsθ1t,θ2t,…,θkt∈θSett from the stego images by themselves as in Section 3.3. We omit the details here due to space limitations.


#### 4.3.2. Reconstruction of the Secret Matrices via Matrix Projection

The requester selects a remainder matrixR from the public board which corresponds to one of the obtained stego images GIi. The secret image SI and the corresponding cover image CIi can be simultaneously reconstructed.SplitR back into submatrices R0,R1,R2,R3,R4 and generate a project matrix PB over shadow vectors θ1t,θ2t,…,θkt. Then, perform the subtraction as steps C1 and C2 in Section 3.2 between PB and R0,R1,R2,R3,R4. Finally, extract the reconstructed secret matrices RCu,RCu+1,RCu+2,RCIMi,RVM from the obtained matrices as follows:(16)RCu=PB−R0UL:m×m,RCu+1=PB−R1UL:m×m,RCu+2=PB−R2UL:m×m,RCIMi=PB−R3UL:mC×nC,RVM=PB−R4UL:m×m.As shown inSection 3.2, the equation PBUL:m×m=PAUL:m×m is satisfied if there do not exist fake shadows. Therefore, the equation RCu=PB−R0UL:m×m=PA−R0UL:m×m=Cu will also be satisfied.


#### 4.3.3. Verification for Cheating Detection

The separate cheating detection can be performed bythe following equation:(17)RVM=RCu⊕RCu+1⊕RCu+2⊕RCIMimod8.If (17) holds, the requester proceeds with the following steps or stops in this step. The effectiveness of the verification mechanism is proved in Theorem 3.


#### 4.3.4. Reconstruction of the Secret Image via RLCAM

After passing the cheating detection, the requester can recover the secret image withRCu,RCu+1,RCu+2 via 2D-3-RLCAM. Take it as the initial state C˜0,C˜1,C˜2 for the reversion process, and the configurations of C˜u=SIM3′,C˜u+1=SIM2′,C˜u+2=SIM1′ can be obtained by (6) after u iterations.Finally, the reconstructed secret imageSI′=SIM1′∗82+SIM2′∗81+SIM3′∗80 can be obtained.


#### 4.3.5. Reconstruction of the Cover Image

As described previously, the last three bits of some pixels inGIi are changed for steganography, and the secret matrix CIMi just maintains them. Therefore, the cover image Ci′ can be recovered as Ci′=GIi−GIimod8+RCIMi.Notice that, in most of the existed traditional steganography-based SIS schemes, there have some limitations in the reconstruction of the cover images: (1) they input the same cover image for embedding all of the shadows [14, 34], which results in shares with similar content; (2) they cannot losslessly reconstruct the cover image; and (3) the cover recovery method requires more computation. Such limitations make these schemes inapplicable to some scenarios. For example, losslessly reconstructing the cover image can help to share searching with image recognition since a hash function-based searching method is generally sensitive to cover image content including even a slight distortion [29].


### 4.4. Secret Updating Procedure

When a new secret image is to be shared, the dealerD only needs to update the LT×LT public remainder matric R for each cover image. Intuitively in the secret distribution part in Figure 1, only steps (1), (5), and (6) are needed but without the requirement for steps (3) and (4). Therefore, secret updating is very efficient because communication between the dealer and the participants is not required.


## 4.1. Secret Distribution Procedure

The dealerD owns an original secret image SI for distributed storage, which is an m×m grayscale image. D also owns a set of grayscale meaningful cover images CI Set=CI1,CI2,…,CIn.D generates shadow vectors θSet=θ1,θ2,…,θn and embeds them into preselected CI Set so as to generate a set of stego images GI Set=GI1,GI2,…,GIn. Then, D allocates each participant Pi with a unique stego image GIi in the public channel and makes the public information publicly known.


### 4.1.1. Generation of Shadows via Matrix Projection

Firstly, Bai and Zou’s scheme [11] is adopted to generate n shadow vectors via matrix projection as described in Section 3.2 (the step of A2). Construct LT×k matrix A and n linearly independent vectors x1,x2,…,xn, and then compute the shadow vectors θSet=θ1,θ2,…,θn. The size of each shadow vector θi is LT×1, where LT=m+k.


### 4.1.2. Generation of Stego Images via Matrix Encoding and Distribution

In this step, we generate the stego imageGIi by hiding the shadow vector θi into the cover image CIi. Let mc×nc denote the size of the cover image CIi. We restrict 3LT≤mcnc because the cover image is needed to be large enough to hide the LT-length shadow vector θi via 1,7,3-ME in this paper.First of all, construct a chaotic mapping [33] based on CIi to select the steganography cells uniformly. The primary value of the chaotic mapping can be calculated as X0=∑i=15pi/28∗i where p1,p2,p3,p4,andp5 are the first five pixels of CIi and X0∈0,1. Then, compute a l1-length chaotic sequence X=X1,X2,…,Xl1 based on chaotic mapping function and X0, where l1=mcnc−5. A pseudorandom sequence X′ is the ascending order of X. Every three elements in X′ is the positions of a steganography cell and a (1,7,3)-ME for θi can be performed as in Section 3.3. Finally, after embedding the shadow vector θi into the cover image CIi, the stego image GIi is generated.A simple case of embedding the vectorθ1=v1,v2 into a 4×4 cover image CI is shown in Figure 2 (assume the chaotic mapping function is Xi+1=α∗Xi∗1−Xi and the parameter α=4 here, and assume X1=0.63 directly). The five pixels in the grey blocks are used to compute the primary value X0 for the chaotic mapping. The generated pseudorandom sequence X′ is the position for the steganography cells. To skip the first five pixels, the pixel no. should be computed as X′+5. Finally, the embedding is performed as p14,p8,p15⟶v1 and p12,p6,p10⟶v2.Figure 2
An example of embedding in a stego image via (1,7,3)-ME.After generating the stego image setsGI Set for the shadow vectors θSet, distribute each stego image to each participant via a public communication channel.From the description above, we can observe the following facts of the stego images:(i)
Slight and decentralized modification: the steganography cells are chosen uniformly and decentralized over the cover image based on the sensitive chaotic mapping. On this basis, only a trifle statistical difference of cover images will be made via the comparatively slight and decentralized modification of the pixels by using the ME steganography method.(ii)
The constraint for the cover image: the shadow size is onlym+k, so we can assume the cover image is smaller than the secret image (mc,nc≤m) because there is no pixel expansion in our scheme. Therefore, the larger cover image is not necessary for this paper.(iii)
Extract the shadow independently: the positions of the steganography pixels can be directly obtained from the stego image (by using the grey blocks in Figure2). Consequently, the requesters can perform the reconstruction, and the participants can perform the shadow update by themselves.


### 4.1.3. Preprocessing of the Secret Image

For the secret imageSI, convert it into three m×m submatrices SIM1,SIM2,andSIM3 where SIM1=SI/82,SIM2=SI/8,andSIM3=SImod8, respectively. The submatrices SIM1,SIM2,and SIM3 can satisfy that SIM1∗82+SIM2∗81+SIM3∗80=SI.


### 4.1.4. Generation of Secret Matrices via RLCAM

Construct a 2D-3-RLCAM with the discrete state setSbb=8. Firstly, define the iteration value u and the rule number w1,w2,w3 of it (notice that w3=16 in RLCAM). Then, take the three submatrices SIM1,SIM2,and SIM3 as the initial configuration C0,C1,C2, and obtain the states of Cu,Cu+1,Cu+2 after u times of iteration by (3). Therefore, the secret image SI is encrypted into three secret matrices Cu,Cu+1,Cu+2.Moreover, makew1,w2,w3 and u to be privately known by each requester, which can be seemed like the internal secret key of the system.


### 4.1.5. Generation of the Separate Verification Part

For each cover imageCIi, the independent m×m verification matrix VM is generated as in (13). CIMi=CImod8 is the submatrix for CIi. Here, we call the matrices Cu,Cu+1,Cu+2,CIMi,VM are the secret matrices.(13)VM=Cu⊕Cu+1⊕Cu+2⊕CIMimod8.


### 4.1.6. Generation of the Public Information

As in Bai and Zou’s scheme [11], a publicly known remainder matrix is needed to help with the following secret reconstruction. Notice that we have to additionally verify the secret image and the cover images, so we need to generate a remainder matrix for each cover image. To simplify the notation, take R denotes the remainder matrix for an arbitrary cover image. The same number of the remainder matrices is needed to be generated as the cover images actually.First of all, convert the secret matrices into theLT×LT filling matrices Cu¯,Cu+1¯,Cu+2¯,CIMi¯,VM¯ by filling with random values as (14). In (14), Cu=Cu¯UL:m×m represents that m×m matrix Cu can be extracted from the upper left corner of the matrix Cu¯:(14)Cu=Cu¯UL:m×m,Cu+1=Cu+1¯UL:m×m,Cu+2=Cu+2¯UL:m×m,CIMi=CIMi¯UL:mc×nc,VM=VM¯UL:m×m.Then, compute a projection matrixPA of matrix A (A is already generated in Step 1), where PA is a LT×LT matrix. Calculate intermediate matrices R0,R1,R2,R3,R4 by performing subtraction between PA and Cu¯,Cu+1¯,C¯,CIMi¯,VM¯ as in the following equation:(15)R0=PA−Cu¯,R1=PA−Cu+1¯,R2=PA−Cu+2¯,R3=PA−CIMi¯,R4=PA−VM¯.Finally, the remainder matrixR is computed via R=∑i=04Ri∗84−i, and make the remainder matrices for all cover images publicly known.


## 4.1.1. Generation of Shadows via Matrix Projection

Firstly, Bai and Zou’s scheme [11] is adopted to generate n shadow vectors via matrix projection as described in Section 3.2 (the step of A2). Construct LT×k matrix A and n linearly independent vectors x1,x2,…,xn, and then compute the shadow vectors θSet=θ1,θ2,…,θn. The size of each shadow vector θi is LT×1, where LT=m+k.


## 4.1.2. Generation of Stego Images via Matrix Encoding and Distribution

In this step, we generate the stego imageGIi by hiding the shadow vector θi into the cover image CIi. Let mc×nc denote the size of the cover image CIi. We restrict 3LT≤mcnc because the cover image is needed to be large enough to hide the LT-length shadow vector θi via 1,7,3-ME in this paper.First of all, construct a chaotic mapping [33] based on CIi to select the steganography cells uniformly. The primary value of the chaotic mapping can be calculated as X0=∑i=15pi/28∗i where p1,p2,p3,p4,andp5 are the first five pixels of CIi and X0∈0,1. Then, compute a l1-length chaotic sequence X=X1,X2,…,Xl1 based on chaotic mapping function and X0, where l1=mcnc−5. A pseudorandom sequence X′ is the ascending order of X. Every three elements in X′ is the positions of a steganography cell and a (1,7,3)-ME for θi can be performed as in Section 3.3. Finally, after embedding the shadow vector θi into the cover image CIi, the stego image GIi is generated.A simple case of embedding the vectorθ1=v1,v2 into a 4×4 cover image CI is shown in Figure 2 (assume the chaotic mapping function is Xi+1=α∗Xi∗1−Xi and the parameter α=4 here, and assume X1=0.63 directly). The five pixels in the grey blocks are used to compute the primary value X0 for the chaotic mapping. The generated pseudorandom sequence X′ is the position for the steganography cells. To skip the first five pixels, the pixel no. should be computed as X′+5. Finally, the embedding is performed as p14,p8,p15⟶v1 and p12,p6,p10⟶v2.Figure 2
An example of embedding in a stego image via (1,7,3)-ME.After generating the stego image setsGI Set for the shadow vectors θSet, distribute each stego image to each participant via a public communication channel.From the description above, we can observe the following facts of the stego images:(i)
Slight and decentralized modification: the steganography cells are chosen uniformly and decentralized over the cover image based on the sensitive chaotic mapping. On this basis, only a trifle statistical difference of cover images will be made via the comparatively slight and decentralized modification of the pixels by using the ME steganography method.(ii)
The constraint for the cover image: the shadow size is onlym+k, so we can assume the cover image is smaller than the secret image (mc,nc≤m) because there is no pixel expansion in our scheme. Therefore, the larger cover image is not necessary for this paper.(iii)
Extract the shadow independently: the positions of the steganography pixels can be directly obtained from the stego image (by using the grey blocks in Figure2). Consequently, the requesters can perform the reconstruction, and the participants can perform the shadow update by themselves.


## 4.1.3. Preprocessing of the Secret Image

For the secret imageSI, convert it into three m×m submatrices SIM1,SIM2,andSIM3 where SIM1=SI/82,SIM2=SI/8,andSIM3=SImod8, respectively. The submatrices SIM1,SIM2,and SIM3 can satisfy that SIM1∗82+SIM2∗81+SIM3∗80=SI.


## 4.1.4. Generation of Secret Matrices via RLCAM

Construct a 2D-3-RLCAM with the discrete state setSbb=8. Firstly, define the iteration value u and the rule number w1,w2,w3 of it (notice that w3=16 in RLCAM). Then, take the three submatrices SIM1,SIM2,and SIM3 as the initial configuration C0,C1,C2, and obtain the states of Cu,Cu+1,Cu+2 after u times of iteration by (3). Therefore, the secret image SI is encrypted into three secret matrices Cu,Cu+1,Cu+2.Moreover, makew1,w2,w3 and u to be privately known by each requester, which can be seemed like the internal secret key of the system.


## 4.1.5. Generation of the Separate Verification Part

For each cover imageCIi, the independent m×m verification matrix VM is generated as in (13). CIMi=CImod8 is the submatrix for CIi. Here, we call the matrices Cu,Cu+1,Cu+2,CIMi,VM are the secret matrices.(13)VM=Cu⊕Cu+1⊕Cu+2⊕CIMimod8.


## 4.1.6. Generation of the Public Information

As in Bai and Zou’s scheme [11], a publicly known remainder matrix is needed to help with the following secret reconstruction. Notice that we have to additionally verify the secret image and the cover images, so we need to generate a remainder matrix for each cover image. To simplify the notation, take R denotes the remainder matrix for an arbitrary cover image. The same number of the remainder matrices is needed to be generated as the cover images actually.First of all, convert the secret matrices into theLT×LT filling matrices Cu¯,Cu+1¯,Cu+2¯,CIMi¯,VM¯ by filling with random values as (14). In (14), Cu=Cu¯UL:m×m represents that m×m matrix Cu can be extracted from the upper left corner of the matrix Cu¯:(14)Cu=Cu¯UL:m×m,Cu+1=Cu+1¯UL:m×m,Cu+2=Cu+2¯UL:m×m,CIMi=CIMi¯UL:mc×nc,VM=VM¯UL:m×m.Then, compute a projection matrixPA of matrix A (A is already generated in Step 1), where PA is a LT×LT matrix. Calculate intermediate matrices R0,R1,R2,R3,R4 by performing subtraction between PA and Cu¯,Cu+1¯,C¯,CIMi¯,VM¯ as in the following equation:(15)R0=PA−Cu¯,R1=PA−Cu+1¯,R2=PA−Cu+2¯,R3=PA−CIMi¯,R4=PA−VM¯.Finally, the remainder matrixR is computed via R=∑i=04Ri∗84−i, and make the remainder matrices for all cover images publicly known.


## 4.2. Shadow Update Procedure

Letθ1t,θ2t,…,θnt denote the shadow vectors during time period t. The update process to generate θ1t+1,θ2t+1,…,θnt+1 is similar to Bai and Zou’s scheme [11] in Section 3.2.At the beginning of time periodt+1, the dealer D generates a k×k orthonormal matrix LM and distributes it via a secure channel to each participant. After receiving LM, each participant Pi extracts the shadow vectors θit from its stego image and derives its new shadow vector θit+1 by (10). Then, Pi embeds θit+1 into its stego image again and erases all the variables except its current stego image. Because steganography is based on the computationally efficient XOR operation, the shadow updating is efficient even over the stego images.Note that the correctness of the fact that the update shadow vectors generated during the same time period can reconstruct the secret matrix is illustrated clearly in Bai and Zou’s scheme [11]. Moreover, a mixture of the shadows with different time periods cannot recover the secret, while equation (11) in Section 3.2 cannot be obtained. The explanation of this is also described in detail in Bai and Zou’s scheme [11].


## 4.3. Secret Reconstruction Procedure

A requesterQi can reconstruct SI as long as obtaining enough valid stego images GI1t,GI2t,…,GIkt∈GI Set during a single time period as follows.


### 4.3.1. Extraction of the Shadow Vectors via Matrix Encoding

The requester computes the steganography cells firstly and then extracts the embedding shadow vectorsθ1t,θ2t,…,θkt∈θSett from the stego images by themselves as in Section 3.3. We omit the details here due to space limitations.


### 4.3.2. Reconstruction of the Secret Matrices via Matrix Projection

The requester selects a remainder matrixR from the public board which corresponds to one of the obtained stego images GIi. The secret image SI and the corresponding cover image CIi can be simultaneously reconstructed.SplitR back into submatrices R0,R1,R2,R3,R4 and generate a project matrix PB over shadow vectors θ1t,θ2t,…,θkt. Then, perform the subtraction as steps C1 and C2 in Section 3.2 between PB and R0,R1,R2,R3,R4. Finally, extract the reconstructed secret matrices RCu,RCu+1,RCu+2,RCIMi,RVM from the obtained matrices as follows:(16)RCu=PB−R0UL:m×m,RCu+1=PB−R1UL:m×m,RCu+2=PB−R2UL:m×m,RCIMi=PB−R3UL:mC×nC,RVM=PB−R4UL:m×m.As shown inSection 3.2, the equation PBUL:m×m=PAUL:m×m is satisfied if there do not exist fake shadows. Therefore, the equation RCu=PB−R0UL:m×m=PA−R0UL:m×m=Cu will also be satisfied.


### 4.3.3. Verification for Cheating Detection

The separate cheating detection can be performed bythe following equation:(17)RVM=RCu⊕RCu+1⊕RCu+2⊕RCIMimod8.If (17) holds, the requester proceeds with the following steps or stops in this step. The effectiveness of the verification mechanism is proved in Theorem 3.


### 4.3.4. Reconstruction of the Secret Image via RLCAM

After passing the cheating detection, the requester can recover the secret image withRCu,RCu+1,RCu+2 via 2D-3-RLCAM. Take it as the initial state C˜0,C˜1,C˜2 for the reversion process, and the configurations of C˜u=SIM3′,C˜u+1=SIM2′,C˜u+2=SIM1′ can be obtained by (6) after u iterations.Finally, the reconstructed secret imageSI′=SIM1′∗82+SIM2′∗81+SIM3′∗80 can be obtained.


### 4.3.5. Reconstruction of the Cover Image

As described previously, the last three bits of some pixels inGIi are changed for steganography, and the secret matrix CIMi just maintains them. Therefore, the cover image Ci′ can be recovered as Ci′=GIi−GIimod8+RCIMi.Notice that, in most of the existed traditional steganography-based SIS schemes, there have some limitations in the reconstruction of the cover images: (1) they input the same cover image for embedding all of the shadows [14, 34], which results in shares with similar content; (2) they cannot losslessly reconstruct the cover image; and (3) the cover recovery method requires more computation. Such limitations make these schemes inapplicable to some scenarios. For example, losslessly reconstructing the cover image can help to share searching with image recognition since a hash function-based searching method is generally sensitive to cover image content including even a slight distortion [29].


## 4.3.1. Extraction of the Shadow Vectors via Matrix Encoding

The requester computes the steganography cells firstly and then extracts the embedding shadow vectorsθ1t,θ2t,…,θkt∈θSett from the stego images by themselves as in Section 3.3. We omit the details here due to space limitations.


## 4.3.2. Reconstruction of the Secret Matrices via Matrix Projection

The requester selects a remainder matrixR from the public board which corresponds to one of the obtained stego images GIi. The secret image SI and the corresponding cover image CIi can be simultaneously reconstructed.SplitR back into submatrices R0,R1,R2,R3,R4 and generate a project matrix PB over shadow vectors θ1t,θ2t,…,θkt. Then, perform the subtraction as steps C1 and C2 in Section 3.2 between PB and R0,R1,R2,R3,R4. Finally, extract the reconstructed secret matrices RCu,RCu+1,RCu+2,RCIMi,RVM from the obtained matrices as follows:(16)RCu=PB−R0UL:m×m,RCu+1=PB−R1UL:m×m,RCu+2=PB−R2UL:m×m,RCIMi=PB−R3UL:mC×nC,RVM=PB−R4UL:m×m.As shown inSection 3.2, the equation PBUL:m×m=PAUL:m×m is satisfied if there do not exist fake shadows. Therefore, the equation RCu=PB−R0UL:m×m=PA−R0UL:m×m=Cu will also be satisfied.


## 4.3.3. Verification for Cheating Detection

The separate cheating detection can be performed bythe following equation:(17)RVM=RCu⊕RCu+1⊕RCu+2⊕RCIMimod8.If (17) holds, the requester proceeds with the following steps or stops in this step. The effectiveness of the verification mechanism is proved in Theorem 3.


## 4.3.4. Reconstruction of the Secret Image via RLCAM

After passing the cheating detection, the requester can recover the secret image withRCu,RCu+1,RCu+2 via 2D-3-RLCAM. Take it as the initial state C˜0,C˜1,C˜2 for the reversion process, and the configurations of C˜u=SIM3′,C˜u+1=SIM2′,C˜u+2=SIM1′ can be obtained by (6) after u iterations.Finally, the reconstructed secret imageSI′=SIM1′∗82+SIM2′∗81+SIM3′∗80 can be obtained.


## 4.3.5. Reconstruction of the Cover Image

As described previously, the last three bits of some pixels inGIi are changed for steganography, and the secret matrix CIMi just maintains them. Therefore, the cover image Ci′ can be recovered as Ci′=GIi−GIimod8+RCIMi.Notice that, in most of the existed traditional steganography-based SIS schemes, there have some limitations in the reconstruction of the cover images: (1) they input the same cover image for embedding all of the shadows [14, 34], which results in shares with similar content; (2) they cannot losslessly reconstruct the cover image; and (3) the cover recovery method requires more computation. Such limitations make these schemes inapplicable to some scenarios. For example, losslessly reconstructing the cover image can help to share searching with image recognition since a hash function-based searching method is generally sensitive to cover image content including even a slight distortion [29].


## 4.4. Secret Updating Procedure

When a new secret image is to be shared, the dealerD only needs to update the LT×LT public remainder matric R for each cover image. Intuitively in the secret distribution part in Figure 1, only steps (1), (5), and (6) are needed but without the requirement for steps (3) and (4). Therefore, secret updating is very efficient because communication between the dealer and the participants is not required.


## 5. Security Analysis

In the proposed scheme, we consider the dealer and the requesters are fully trusted. Assume parts of the participants can be compromised by a statistical and persistent adversary.A statistical and persistent adversary: in 5G network scenarios, the network environments are more open and flexible. Therefore, we need to consider a stronger potential adversary instead of an ordinary adversary. The ordinary adversary at most can corrupt up tok−1 shadows during the entire lifetime of the secret. In this paper, we consider the adversary can stay on the networks for several time periods and move among the objects.The adversary attempts to reconstruct or destroy the secret image illegally during several time periods. Within a time periodt, the adversary at most can corrupt up to k−1 participants among n participants (restrict that n≤2k−1). If a participant is corrupted, the adversary can learn or tamper with its shadow vector during this time period. At the beginning of the next time period, all participants will be “rebooted” to the safe state, and their shadows are erased and alternated by the new ones. Because the adversary can corrupt up to k−1 participants during each time period, it has more power than the ordinary adversary so that it can corrupt some participants multiple times throughout the entire lifetime of the secret image.


### 5.1. Collusion Attack

Theorem 1 (collusion attack).
During a time period, the adversary compromisesk−1 participants to obtain an unqualified group θ1,θ2,…,θk−1 of shadow vectors, but the adversary still cannot explicitly learn about the secret image.Proof 1.
As proved in Bai and Zou’s scheme [11], the secret sharing using matrix projection is a strong ramp secret sharing (RSS) with k access levels, but not a perfect secret sharing (PSS) such as Shamir’s scheme. Strong RSS also does not reveal any part of the secret explicitly from any k−1 shadows. However, the secret’s exposed information is proportional to the size of the unqualified group of the shadows.
As an improvement, the matrix projection is performed over the secret matrices ofSI after the iterations of RLCAM. The secret matrices can seem like the encryption of SI with the RLCAM. Hence, the privacy-protecting for recovering SI is further protected under the irreversible property of RLCAM when without rule number, and the consecutive requirement of the configurations (secret matrices in this paper) with the correct order.
Therefore, the exposed information cause by the matrix projection is only relative to secret matrices. Based on the security of RLCAM, the configuration after iterations leaks nothing about theSI. Consequently, the adversary cannot get any information about the original secret image from any arbitrarily k−1 shadows, much less the recovery.Theorem 2 (persistent collusion attack).
During an adjacent time periods, the adversary compromisesk−1 participants during each time period, but the adversary still cannot explicitly learn about the secret image.Proof 2.
AssumeP1′ denotes the set of k1 participants compromised only in period t−1, P2′ denotes the set of k2 participants compromised in both of the period t−1 and t, and P3′ denotes the set of k3 participants compromised only in period t, where k1+k2=k2+k3=k−1.
Additionally, the unqualified group of shadow vectors obtained duringt−1 from P1′ and P2′ is denoted as Θ1t−1=θit−1i=1,…,k1 and Θ2t−1=θit−11,…,k2. The unqualified group of shadow vectors obtained during t from the set P2′ and P3′ is denoted as Θ2t=θiti=1,…,k2 and Θ3t=θiti=1,…,k3.
Based onΘ2t−1 and Θ2t, we can construct an equation for the unknown updating matrix LM as follows:(18)LM︸k×k∗θ1m+1:m+kt−1,…,θk2m+1:m+kt−1︸M1:k×k2=θ1m+1:m+kt,…,θk2m+1:m+kt︸M2:k×k2.
However, updating matrixLM cannot be determined by (18) because the matrices M1 and M2 are not full rank matrices (the rank of M1 and M2 is k2 but not k). Since LM cannot be determined, Θ1t−1 cannot be turned into Θ1t and also Θ3t cannot be turned into Θ3t−1. Thereby, enough shadows θi for the same time period cannot be inferred and also the matrix B which is necessary for secret reconstruction cannot be determined.
Consequently, the persistent adversary cannot obtain enough shadows even for multiple time periods, and the privacy of the secret image can be effectively guaranteed.


### 5.2. Shadow Tampering

Theorem 3.
Assume a requester obtains a set of shadow vectorsθ1,θ2,…,θk. If each of the shadow vectors is valid, (17) will be explicitly holding, or holding in a negligibility probability if there exists at least one invalid shadow.Proof 3.
First of all, consider the case that all of the shadow vectors are valid. As proof in [11], there exist PBUL:m×m=PAUL:m×m, and the remainder matrix R is left to be publicly known which cannot be modified by anyone. Hence, the reconstructed secret matrices will be equal to the original secret matrices, obviously. Therefore, equation (17) can be explicitly holding.
In contrast, if there exists at least one invalid shadow vector (whether an older one or a tampered one),PBUL:m×m will be a meaningless matrix, which has no relevance with PAUL:m×m. Therefore, the reconstructed secret matrices RCu,RCu+1,RCu+2,RCIMi,RVM can also seem like random meaningless matrices. Therefore, we should discuss if the probability ProbVM of holding (17) is nearly zero, in this case. For each element x1,x2,x3,x4,x5∈0,7 in each reconstructed secret matrices, there exists x1⊕x2⊕x3⊕x4?=x5 as the same form of (17). The probability of holding this equation is 1/8. Hence, ProbVM=1/8m2 which is effective for verification. For a 10×10 secret image, ProbVM=1/2300 is small enough to be ignored. Therefore, the proposed scheme can effectively detect the tampered shadows.


## 5.1. Collusion Attack

Theorem 1 (collusion attack).
During a time period, the adversary compromisesk−1 participants to obtain an unqualified group θ1,θ2,…,θk−1 of shadow vectors, but the adversary still cannot explicitly learn about the secret image.Proof 1.
As proved in Bai and Zou’s scheme [11], the secret sharing using matrix projection is a strong ramp secret sharing (RSS) with k access levels, but not a perfect secret sharing (PSS) such as Shamir’s scheme. Strong RSS also does not reveal any part of the secret explicitly from any k−1 shadows. However, the secret’s exposed information is proportional to the size of the unqualified group of the shadows.
As an improvement, the matrix projection is performed over the secret matrices ofSI after the iterations of RLCAM. The secret matrices can seem like the encryption of SI with the RLCAM. Hence, the privacy-protecting for recovering SI is further protected under the irreversible property of RLCAM when without rule number, and the consecutive requirement of the configurations (secret matrices in this paper) with the correct order.
Therefore, the exposed information cause by the matrix projection is only relative to secret matrices. Based on the security of RLCAM, the configuration after iterations leaks nothing about theSI. Consequently, the adversary cannot get any information about the original secret image from any arbitrarily k−1 shadows, much less the recovery.Theorem 2 (persistent collusion attack).
During an adjacent time periods, the adversary compromisesk−1 participants during each time period, but the adversary still cannot explicitly learn about the secret image.Proof 2.
AssumeP1′ denotes the set of k1 participants compromised only in period t−1, P2′ denotes the set of k2 participants compromised in both of the period t−1 and t, and P3′ denotes the set of k3 participants compromised only in period t, where k1+k2=k2+k3=k−1.
Additionally, the unqualified group of shadow vectors obtained duringt−1 from P1′ and P2′ is denoted as Θ1t−1=θit−1i=1,…,k1 and Θ2t−1=θit−11,…,k2. The unqualified group of shadow vectors obtained during t from the set P2′ and P3′ is denoted as Θ2t=θiti=1,…,k2 and Θ3t=θiti=1,…,k3.
Based onΘ2t−1 and Θ2t, we can construct an equation for the unknown updating matrix LM as follows:(18)LM︸k×k∗θ1m+1:m+kt−1,…,θk2m+1:m+kt−1︸M1:k×k2=θ1m+1:m+kt,…,θk2m+1:m+kt︸M2:k×k2.
However, updating matrixLM cannot be determined by (18) because the matrices M1 and M2 are not full rank matrices (the rank of M1 and M2 is k2 but not k). Since LM cannot be determined, Θ1t−1 cannot be turned into Θ1t and also Θ3t cannot be turned into Θ3t−1. Thereby, enough shadows θi for the same time period cannot be inferred and also the matrix B which is necessary for secret reconstruction cannot be determined.
Consequently, the persistent adversary cannot obtain enough shadows even for multiple time periods, and the privacy of the secret image can be effectively guaranteed.


## 5.2. Shadow Tampering

Theorem 3.
Assume a requester obtains a set of shadow vectorsθ1,θ2,…,θk. If each of the shadow vectors is valid, (17) will be explicitly holding, or holding in a negligibility probability if there exists at least one invalid shadow.Proof 3.
First of all, consider the case that all of the shadow vectors are valid. As proof in [11], there exist PBUL:m×m=PAUL:m×m, and the remainder matrix R is left to be publicly known which cannot be modified by anyone. Hence, the reconstructed secret matrices will be equal to the original secret matrices, obviously. Therefore, equation (17) can be explicitly holding.
In contrast, if there exists at least one invalid shadow vector (whether an older one or a tampered one),PBUL:m×m will be a meaningless matrix, which has no relevance with PAUL:m×m. Therefore, the reconstructed secret matrices RCu,RCu+1,RCu+2,RCIMi,RVM can also seem like random meaningless matrices. Therefore, we should discuss if the probability ProbVM of holding (17) is nearly zero, in this case. For each element x1,x2,x3,x4,x5∈0,7 in each reconstructed secret matrices, there exists x1⊕x2⊕x3⊕x4?=x5 as the same form of (17). The probability of holding this equation is 1/8. Hence, ProbVM=1/8m2 which is effective for verification. For a 10×10 secret image, ProbVM=1/2300 is small enough to be ignored. Therefore, the proposed scheme can effectively detect the tampered shadows.


## 6. Experimental Results and Performance Evaluation

### 6.1. Implementation

The scheme is implemented in Visual C# 2017 on a computer with an Intel Core i7 1.8 GHz CPU processor and 8 GB RAM that runs a Windows 10 operating system. Different sizes of cover images are considered in this paper, which includes30×30 images chosen from the CIFAR-10 dataset [35], 96×96 images chosen from the STL-10 dataset [36], and the 256×256 standard images Baboon, Lena, and Pepper. Besides, a 256×256 standard image Boat is considered as the secret image. As described above, we do not discuss the case for the larger cover images.


### 6.2. Simulation Experiments

First of all, the effectiveness of the proposed scheme is shown in Table1, where Diff denotes the different pixels between the output image and its corresponding original one. The 256×256 standard image Boat is taken as the secret image (SI). The 256×256 standard images Lena, Pepper, and Baboon are taken as the cover images (CI01, CI02, and CI03). The experimental threshold is set as 2,3.Table 1
The stego images and the reconstructed images.
Secret imageCover imageSICI01CI02CI03Stego imageste01ste02ste03PSNR66.4067.0366.71SSIM0.9999960.9999970.999996Diff227/65536223/65536215/65536Rec imageRec-SIRec-CI01Rec-SI (×)PSNR∞∞—SSIM11—Diff0/655360/6553665420/65536The results of the generated stego images are shown as ste01, ste02, and ste03. It can be seen that there exists no significant difference between the stego image and its corresponding cover image. The indices of PSNR and SSIM of the stego images are good enough (the detailed analyses of PSNR and SSIM are shown in Section 6.3). Therefore, the stego images generated in our proposed scheme have a high quality.The reconstruction results are also shown in Table1 (assume we use the remainder matrix of CI01). Table 1 shows the reconstructed secret image Rec-SI for the secret image SI and the reconstructed cover image Rec-CI01 for the cover image CI01. These reconstructed images are lossless (where PSNR = ∞ and SSIM = 1).Moreover, we also test if there is a tampered shadow for reconstruction. As shown in the image Rec-SI (×), the secret image recovery will be totally failed with a tampered shadow.


### 6.3. Visual Quality

The general criteria to check the visual quality of the stego images are the peak-signal-to-noise ratio (PSNR) and structural similarity (SSIM). Table2 lists the mean value of PSNR and SSIM produced by the proposed scheme for different sizes of the cover images with threshold k=2,3,7,15, respectively.Table 2
PSNR and SSIM of different threshold and cover image.
PSNRSSIM30962563096256k = 247.2157.2966.600.99960.999970.999996k = 347.3957.2966.350.99960.999970.999995k = 747.9257.8865.920.99970.999970.999995k = 1548.1057.9765.630.99970.999960.999995PSNR has explicit physical meanings, which evaluates the similarity between the original image and the output image. The value ofPSNR=+∞ for completely identical images. From Table 2, PSNR is larger than 55 dB for 96×96 and 256×256 cover images, which is almost indistinguishable from the human visual system (HVS).Additionally, the details of the SSIM algorithm can be found in [37]. SSIM is used to estimate the dependencies between neighboring pixels. SSIM = 0 for extremely dissimilar, and SSIM = 1 for completely identical. From Table 2, SSIM shows 90% structural similarity between the original cover image and stego image of the proposed scheme, which is very close to the upper bound.


### 6.4. Embedding Ratio (ER) and Detection Ratio (DR)

Embedding ratio (ER) shows the amount of information embedded in each cover pixel, which is the ratio of the number of share bits to the number of all pixels of a cover image. For resistance against steganography, ER should be less than 0.25 bpp. For30×30 cover images, we can obtain ER = 0.2867 (k=2) and ER = 0.2922 (k=7). For 96×96 cover images, ER = 0.0280 (k=2) and ER = 0.0285 (k=7). Therefore, ER of the proposed scheme is effective enough.Detection ratio (DR) shows the detecting ability of invalid shares, which is the ratio of detected tampered pixels to all tampered pixels. As described above, the verification of our proposed scheme is based on a separatem×m matrix, which is fully covering the stego image. Therefore, as the scheme of Eslami et al. [15], DR in this paper is approximately 256/256, which is effective enough for cheating detection.


### 6.5. Comparative Analysis

In order to further illustrate the performance of the proposed scheme, we compared it with typical works ([10] (2006) and [15] (2010)) and some recent schemes ([16] (2018), [17] (2017), and [12] (2018)). The works described in [10, 15] are the classical schemes designed based on matric projection method and CA, respectively. The comparative analysis is listed in Table 3.Table 3
The comparative analysis.
(1)(2)(3)(4)(5)(6)(7)(8)(9)[10]×××MP and polynomial—m2/k+m———[16]×√×MP and polynomial—m2/k+m———[15]√√×1D-CALSBm21/447.120.99815[17]√√×PolynomialMELH/3kLH/12km249.47—[12]√√×2D-CA and polynomialLSB(Dynamic)(Dynamic)54.550.99996Ours√√√2D-CA and MPMEm+km+k/4m266.350.999996The first five indices in Table3 are the characteristics of these schemes:(1)
If the shares are meaningful images(2)
If it is a verifiable scheme(3)
If it has the features of proactive and dynamic(4)
The underlying techniques for SIS(5)
The underlying techniques for steganography.(6)
The size of the shadows(7)
The average number of modified bits per pixel(8)
PSNR(9)
SSIMHere in this part, the thresholdk=3. As shown in Table 3, our scheme achieves a clear advantage in the perspective of almost all indices.Compared with the MP-based SIS schemes [10, 16], we achieve more functions. Meanwhile, we certainly not expand the shadows’ size and even accomplish a smaller shadow than such schemes. The scheme of Eslami et al. [15] is the first steganography-based SIS constructed by using 1D-CA. It can achieve a higher computation complexity than our proposed scheme because we have the extra MP’s operations. However, viewed from the indices listed in Table 3, we can achieve a better performance of the shadow size and the stego image quality than it. Moreover, this scheme realizes the secret protection based on CA’s security, but only consecutive shadows can reveal the secret image that limits the practicality. As an improvement, our proposed scheme also benefits from the security provided by CA but avoids this weakness.In the scheme of Liu et al. [17], LH is the length of the Huffman code of the difference image of the secret image, where LH=m2 for the straightforward binary image. Hence, only when m2/3k−m+k>0 holding, its generated shadow will be smaller than ours. The solution of m2/3k−m+k>0 is restricted by m≤4k. It means that our scheme will get the stego images with higher quality when m≤4k when both of us using 1,7,3-ME for steganography.The scheme of Zarepour-Ahmadabadi et al. [12] is a multisecret image sharing scheme. Each secret image contains a specific threshold value, and the size of shadows is dynamically relative to it. So that the access structure in [12] is greater than ours. However, it needs to combine the hash values in each shadow, which helps to arrange the shadows according to the desired order to recover the secret image via 2D-CA correctly. These values need a relatively larger space for embedding.Moreover, besides the scheme of Eslami et al. [15], all the other schemes may increase the computational complexity due to several times of Lagrange interpolation operations (Lagrange interpolation is the main operation of polynomial-based secret sharing). In our proposed scheme, the computation complexity is mainly based on matrix operations. Specifically, during the secret distribution procedure and the secret reconstruction procedure, we mainly have the matrix subtraction operations, the matrix XOR operations, and computing the projection matrix. Compared with the calculation of the projection matrix, the computation complexity of the matrix subtraction and the matrix XOR can be ignored because they are lightweight. The calculation of the projection matrix is the heaviest computation in our scheme. However, we only need to compute the projection matrix PA only once during the secret distribution procedure and compute the projection matrix PB only once during the secret reconstruction procedure. Therefore, our proposed scheme has a lower computation complexity than the other schemes.In conclusion, compared with the above schemes, our scheme is more suitable for 5G network environments. First of all, our scheme can adapt to the rapid data changes in 5G network environments with efficient secret distribution and secret updating. In contrast, the above schemes need to reprocess the distribution for the secret update. Secondly, for the potential adversary in the large-scale complex network environment, our scheme prevents the eavesdroppers via the higher quality steganography. Our scheme can also protect the secret against the persistent adversary through the efficient shadows update. We consider the stronger adversary than the above schemes.


## 6.1. Implementation

The scheme is implemented in Visual C# 2017 on a computer with an Intel Core i7 1.8 GHz CPU processor and 8 GB RAM that runs a Windows 10 operating system. Different sizes of cover images are considered in this paper, which includes30×30 images chosen from the CIFAR-10 dataset [35], 96×96 images chosen from the STL-10 dataset [36], and the 256×256 standard images Baboon, Lena, and Pepper. Besides, a 256×256 standard image Boat is considered as the secret image. As described above, we do not discuss the case for the larger cover images.


## 6.2. Simulation Experiments

First of all, the effectiveness of the proposed scheme is shown in Table1, where Diff denotes the different pixels between the output image and its corresponding original one. The 256×256 standard image Boat is taken as the secret image (SI). The 256×256 standard images Lena, Pepper, and Baboon are taken as the cover images (CI01, CI02, and CI03). The experimental threshold is set as 2,3.Table 1
The stego images and the reconstructed images.
Secret imageCover imageSICI01CI02CI03Stego imageste01ste02ste03PSNR66.4067.0366.71SSIM0.9999960.9999970.999996Diff227/65536223/65536215/65536Rec imageRec-SIRec-CI01Rec-SI (×)PSNR∞∞—SSIM11—Diff0/655360/6553665420/65536The results of the generated stego images are shown as ste01, ste02, and ste03. It can be seen that there exists no significant difference between the stego image and its corresponding cover image. The indices of PSNR and SSIM of the stego images are good enough (the detailed analyses of PSNR and SSIM are shown in Section 6.3). Therefore, the stego images generated in our proposed scheme have a high quality.The reconstruction results are also shown in Table1 (assume we use the remainder matrix of CI01). Table 1 shows the reconstructed secret image Rec-SI for the secret image SI and the reconstructed cover image Rec-CI01 for the cover image CI01. These reconstructed images are lossless (where PSNR = ∞ and SSIM = 1).Moreover, we also test if there is a tampered shadow for reconstruction. As shown in the image Rec-SI (×), the secret image recovery will be totally failed with a tampered shadow.


## 6.3. Visual Quality

The general criteria to check the visual quality of the stego images are the peak-signal-to-noise ratio (PSNR) and structural similarity (SSIM). Table2 lists the mean value of PSNR and SSIM produced by the proposed scheme for different sizes of the cover images with threshold k=2,3,7,15, respectively.Table 2
PSNR and SSIM of different threshold and cover image.
PSNRSSIM30962563096256k = 247.2157.2966.600.99960.999970.999996k = 347.3957.2966.350.99960.999970.999995k = 747.9257.8865.920.99970.999970.999995k = 1548.1057.9765.630.99970.999960.999995PSNR has explicit physical meanings, which evaluates the similarity between the original image and the output image. The value ofPSNR=+∞ for completely identical images. From Table 2, PSNR is larger than 55 dB for 96×96 and 256×256 cover images, which is almost indistinguishable from the human visual system (HVS).Additionally, the details of the SSIM algorithm can be found in [37]. SSIM is used to estimate the dependencies between neighboring pixels. SSIM = 0 for extremely dissimilar, and SSIM = 1 for completely identical. From Table 2, SSIM shows 90% structural similarity between the original cover image and stego image of the proposed scheme, which is very close to the upper bound.


## 6.4. Embedding Ratio (ER) and Detection Ratio (DR)

Embedding ratio (ER) shows the amount of information embedded in each cover pixel, which is the ratio of the number of share bits to the number of all pixels of a cover image. For resistance against steganography, ER should be less than 0.25 bpp. For30×30 cover images, we can obtain ER = 0.2867 (k=2) and ER = 0.2922 (k=7). For 96×96 cover images, ER = 0.0280 (k=2) and ER = 0.0285 (k=7). Therefore, ER of the proposed scheme is effective enough.Detection ratio (DR) shows the detecting ability of invalid shares, which is the ratio of detected tampered pixels to all tampered pixels. As described above, the verification of our proposed scheme is based on a separatem×m matrix, which is fully covering the stego image. Therefore, as the scheme of Eslami et al. [15], DR in this paper is approximately 256/256, which is effective enough for cheating detection.


## 6.5. Comparative Analysis

In order to further illustrate the performance of the proposed scheme, we compared it with typical works ([10] (2006) and [15] (2010)) and some recent schemes ([16] (2018), [17] (2017), and [12] (2018)). The works described in [10, 15] are the classical schemes designed based on matric projection method and CA, respectively. The comparative analysis is listed in Table 3.Table 3
The comparative analysis.
(1)(2)(3)(4)(5)(6)(7)(8)(9)[10]×××MP and polynomial—m2/k+m———[16]×√×MP and polynomial—m2/k+m———[15]√√×1D-CALSBm21/447.120.99815[17]√√×PolynomialMELH/3kLH/12km249.47—[12]√√×2D-CA and polynomialLSB(Dynamic)(Dynamic)54.550.99996Ours√√√2D-CA and MPMEm+km+k/4m266.350.999996The first five indices in Table3 are the characteristics of these schemes:(1)
If the shares are meaningful images(2)
If it is a verifiable scheme(3)
If it has the features of proactive and dynamic(4)
The underlying techniques for SIS(5)
The underlying techniques for steganography.(6)
The size of the shadows(7)
The average number of modified bits per pixel(8)
PSNR(9)
SSIMHere in this part, the thresholdk=3. As shown in Table 3, our scheme achieves a clear advantage in the perspective of almost all indices.Compared with the MP-based SIS schemes [10, 16], we achieve more functions. Meanwhile, we certainly not expand the shadows’ size and even accomplish a smaller shadow than such schemes. The scheme of Eslami et al. [15] is the first steganography-based SIS constructed by using 1D-CA. It can achieve a higher computation complexity than our proposed scheme because we have the extra MP’s operations. However, viewed from the indices listed in Table 3, we can achieve a better performance of the shadow size and the stego image quality than it. Moreover, this scheme realizes the secret protection based on CA’s security, but only consecutive shadows can reveal the secret image that limits the practicality. As an improvement, our proposed scheme also benefits from the security provided by CA but avoids this weakness.In the scheme of Liu et al. [17], LH is the length of the Huffman code of the difference image of the secret image, where LH=m2 for the straightforward binary image. Hence, only when m2/3k−m+k>0 holding, its generated shadow will be smaller than ours. The solution of m2/3k−m+k>0 is restricted by m≤4k. It means that our scheme will get the stego images with higher quality when m≤4k when both of us using 1,7,3-ME for steganography.The scheme of Zarepour-Ahmadabadi et al. [12] is a multisecret image sharing scheme. Each secret image contains a specific threshold value, and the size of shadows is dynamically relative to it. So that the access structure in [12] is greater than ours. However, it needs to combine the hash values in each shadow, which helps to arrange the shadows according to the desired order to recover the secret image via 2D-CA correctly. These values need a relatively larger space for embedding.Moreover, besides the scheme of Eslami et al. [15], all the other schemes may increase the computational complexity due to several times of Lagrange interpolation operations (Lagrange interpolation is the main operation of polynomial-based secret sharing). In our proposed scheme, the computation complexity is mainly based on matrix operations. Specifically, during the secret distribution procedure and the secret reconstruction procedure, we mainly have the matrix subtraction operations, the matrix XOR operations, and computing the projection matrix. Compared with the calculation of the projection matrix, the computation complexity of the matrix subtraction and the matrix XOR can be ignored because they are lightweight. The calculation of the projection matrix is the heaviest computation in our scheme. However, we only need to compute the projection matrix PA only once during the secret distribution procedure and compute the projection matrix PB only once during the secret reconstruction procedure. Therefore, our proposed scheme has a lower computation complexity than the other schemes.In conclusion, compared with the above schemes, our scheme is more suitable for 5G network environments. First of all, our scheme can adapt to the rapid data changes in 5G network environments with efficient secret distribution and secret updating. In contrast, the above schemes need to reprocess the distribution for the secret update. Secondly, for the potential adversary in the large-scale complex network environment, our scheme prevents the eavesdroppers via the higher quality steganography. Our scheme can also protect the secret against the persistent adversary through the efficient shadows update. We consider the stronger adversary than the above schemes.


## 7. Conclusion

In this paper, a verifiable secret image sharing scheme is proposed by employing the 2D-RLCAM and the matrix projection, which aims to provide a secure multimedia sharing and storing service in 5G network scenarios. In this paper, 2D-RLCAM and the matrix projection are combined together creatively in handling some existing weaknesses. The combination enhances the security of the secret image and the visual quality of stego image. Furthermore, a matrix encoding-based steganography approach is used to make our scheme more secure when sharing in a public network channel. The security analysis and the performance analysis demonstrate it. Therefore, the proposed scheme can simultaneously support verifiable, dynamical, and proactive features, which is superior to most existing SIS schemes. The efficient secret and shadow updating procedures make the proposed scheme more suitable for deployment in the 5G platform. We aim to optimize the size of public information for a more efficiently secret update in the future.



---

*Source: 6629726-2021-01-28.xml*