# Image Encryption with Double Spiral Scans and Chaotic Maps

Authors: Zhenjun Tang; Ye Yang; Shijie Xu; Chunqiang Yu; Xianquan Zhang
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Image encryption is a useful technique of image content protection. In this paper, we propose a novel image encryption algorithm by jointly exploiting random overlapping block partition, double spiral scans, Henon chaotic map, and Lü chaotic map. Specifically, the input image is first divided into overlapping blocks and pixels of every block are scrambled via double spiral scans. During spiral scans, the start-point is randomly selected under the control of Henon chaotic map. Next, image content based secret keys are generated and used to control the Lü chaotic map for calculating a secret matrix with the same size of input image. Finally, the encrypted image is obtained by calculating XOR operation between the corresponding elements of the scrambled image and the secret matrix. Experimental result shows that the proposed algorithm has good encrypted results and outperforms some popular encryption algorithms.


---

## Body

## 1. Introduction

Some well-known security events, such as PRISM and Xkeyscore, make people pay much attention to information security. Since digital images are widely used in the Internet, how to protect image content [1, 2] has become an issue to be urgently solved. Image encryption is a useful technique of image content protection [3]. It converts images into noise-like encrypted images by disrupting pixel positions or changing pixel values. In recent years, researchers have developed many useful image encryption algorithms. These algorithms can be roughly divided into two categories as follows.The first direction is to manipulate image pixels in the spatial domain. This kind of algorithm usually scrambles pixel positions through matrix transformation and destroys spatial correlation between pixels of the original image, so as to convert input image into chaotic image. For example, Tang et al. [4] proposed an encryption algorithm based on Arnold transform and three random strategies. This encryption technique is a secure algorithm and can overcome size limitation of the Arnold transform. In another study, Tang et al. [5] divided input image into overlapping blocks, conducted random block shuffling, and exploited Arnold transform and a chaotic map to generate secure matrix for block-wise encryption. In [6], Zhang and Liu used skew-tent chaotic map to achieve permutation and diffusion without changing pixel information. This method has high efficiency and a large key space, but it is not secure enough from the viewpoint of histogram [5]. In [7], Li et al. exploited reversible data hiding (RDH) and compressive sensing to design a meaningful image encryption algorithm. This algorithm encrypts a secret image into a meaningful image by RDH and reaches a high embedding rate. Recently, Wang et al. [8] designed an efficient image encryption algorithm based on two-dimensional partitioned cellular automaton. This algorithm supports parallel computing and is easy for VLSI implementation. In another work, Wang et al. [9] exploited multiple mixed hash functions, cyclic-shift function, and piece-wise linear chaotic maps to achieve image encryption. This scheme can overcome security flaw of the well-known chaotic image encryption called Baptista’s algorithm and its improved versions. In [10], Hayat and Azam proposed a useful image encryption technique using a dynamic S-box and pseudo-random numbers over an elliptic curve. This technique can resist known plaintext attack and chosen plaintext attack.Since chaotic systems have many sensitive properties (e.g., sensitivity to initial conditions and system parameters) and show better performance than traditional encryption techniques (e.g., AES [11] and DES [12]), many researchers have tried to design image encryption with chaotic maps [13–19]. In general, chaos-based image encryption algorithms consist of two steps: pixel permutation and pixel diffusion. The pixel permutation changes pixel position, while the pixel diffusion alters pixel values where a change in a pixel will spread almost to other pixels of entire image. Contributed by the sensitivity properties of chaotic system, chaos-based image encryption algorithms generally achieve good security performance. Some representative chaos-based encryption algorithms are introduced here. Amin et al. [20] proposed a new image encryption algorithm based on chaotic block cipher. This algorithm jointly uses cryptographic primitive operations, nonlinear transformation functions, and chaotic tent map to achieve encryption. It is secure against brute-force attack. Abd El-Latif et al. [21] presented a novel image encryption with linear feedback shift register and chaotic maps in time and frequency domains. This method can resist differential attack. In another study, Abd El-Latif and Niu [22] proposed a hybrid image encryption by using chaotic system and cyclic elliptic curve. This method reaches good security. In [23], Tang et al. exploited Henon map, logistic map, and bit-plane decomposition to design an algorithm for multiple-image encryption. This algorithm can convert four gray-scale images into an encrypted PNG image. In another work, Wang et al. [24] used two chaotic systems to develop a hybrid color image encryption scheme. In [25], Abanda and Tiedeu proposed a fast and simple image encryption algorithm by combining two kinds of chaotic maps to meet real-time application. Belazi et al. [26] presented a novel selective image encryption by using DWT with AES s-box and chaotic permutation. This method can resist differential and statistical attacks. In another study, Belazi et al. [27] designed an efficient image encryption with substitution-permutation network and chaotic systems. This algorithm has good performances in security and speed.Recently, Tang et al. [28] proposed an image encryption algorithm by using random projection partition and chaotic system. This algorithm is secure and has a fast speed. Li et al. [29] introduced a quantum color image encryption scheme. This scheme exploits quantum controlled-NOT image generated by multiple chaotic maps to control the XOR operation in the encryption process. It can resist the attack of histogram analysis. Parvaz and Zarebnia [30] defined a combination chaotic system with logistic, sine, and tent systems and applied it to image encryption. To improve security, Liu et al. [31] proposed to use a randomly sampled noise signal as initial value of chaotic map. Chen and Hu [32] designed an adaptive encryption algorithm based on improved chaotic mapping for medical images. However, the encryption results of this algorithm have obvious block effect. In [33], Chai et al. jointly used chaotic system, elementary cellular automata, and compressive sensing to design efficient image encryption. This algorithm can resist known-plaintext attack and chosen-plaintext attack. Wu et al. [34] proposed a new image encryption algorithm by pixel diffusion with DNA approach and pixel permutation by a two-dimensional Hénon-Sine map. This algorithm can resist statistical attack, differential attack, and noise attack, but has limitation in encrypting color images.The other direction is to conduct encryption in the transform domain [35, 36]. Generally, this kind of encryption algorithms firstly transforms input image from spatial domain to transform domain, then modifies those coefficients in the transform domain with some well-defined rules, and finally converts coefficients to spatial domain. For example, Singh et al. [35] exploited Arnold transform and singular value decomposition to make phase image encryption in the fractional Hartley domain. Vashisth et al. [36] conducted image encryption in the fractional Mellin transform domain by using structured phase filters and phase retrieval. Naeem et al. [37] presented novel image encryption algorithms with a cyclic shift and the 2D chaotic Baker map in transform domains, such as the Integer Wavelet Transform (IWT) domain, the Discrete Wavelet Transform (DWT) domain, and the Discrete Cosine Transform (DCT) domain. The algorithm in DWT domain shows better performance than those in other transform domains. In another work, Belazia et al. [38] proposed a novel partial image encryption approach based on permutation-substitution-diffusion (PSD) network and multiple chaotic maps in wavelet transform domain. Recently, Annaby et al. [39] integrated random fractional Fourier transforms, phase retrieval, and chaotic maps to design a scheme for color image encryption. Zhang and Tong [40] exploited IWT and set partitioning in hierarchical trees (SPIHT) to make image encryption and compression. This method has good performances in security and compression. Li et al. [41] exploited two-dimensional DWT to decompose original images and conducted encryption in DWT domain by Arnold transform and robust chaotic map. This algorithm can convert four grayscale images with the same size into an encrypted image. Wu et al. [42] introduced an asymmetric multiple-image encryption method via compressed sensing and nonlinear operations in cylindrical diffraction domain. This method can encrypt eight images and resist ciphertext-only attack.In this paper, we propose an image encryption algorithm based on double spiral scans and chaotic maps. The proposed algorithm jointly exploits random overlapping block partition, double spiral scans, Henon chaotic map, and Lü chaotic map to calculate encrypted image. Compared with previous image encryption algorithms based on chaotic map, a key contribution of our algorithm is the double spiral scans, which can efficiently scramble pixels of image block. Many experiments are conducted and the results show that the proposed algorithm is effective and outperforms some popular encryption algorithms. The rest of this paper is organized as follows. In Section2, we introduce the proposed algorithm. In Section 3, we present key space analysis. In Section 4, we discuss experimental results. Finally, conclusions of this paper are made in Section 5.


## 2. Proposed Algorithm

Figure1 shows the block diagram of our image encryption. The main steps of our algorithm include random overlapping block partition, double spiral scans, and XOR operation. In the first step, the input image is randomly divided into overlapping blocks under the control of secret keys. In the second step, we shuffle image pixels of every overlapping block by double spiral scans, where a secret keyk1 is used to determine the order of encrypting image blocks. To improve security, the Henon chaotic map is exploited to generate random start-points for double spiral scans. In the third step, we generate keys based on the content of input image and use the keys to control the Lü chaotic map for generating a secret matrix. Finally, we calculate the XOR operation between the shuffled image and the secret matrix, and the result is the final encrypted image. In the following sections, we first introduce the random overlapping-block partition, then describe the double spiral scans and the used chaotic maps in our algorithm, and finally explain the key generation and the detailed steps of our encryption scheme and decryption scheme.Figure 1
Block diagram of our image encryption.


### 2.1. Random Overlapping Block Partition

We exploit random overlapping-block partition scheme [5] to divide input image into overlapping blocks. And then we shuffle every image block by double spiral scans to complete the scrambling operation. The detailed process of the random overlapping-block partition is explained as follows. Assume that the size of input image is M×N, the selected block size is S×S, and tx and ty are the overlapping sizes between adjacent blocks along thex-axis and they-axis, respectively, where tx∈[1,S) and ty∈[1,S). Let nx and ny be the numbers of image blocks in thex-axis and they-axis, respectively. Thus, nx and ny can be calculated as follows.(1)nx=N-txS-tx,IfmodN-tx,S-tx=0N-txS-tx+1,Otherwise(2)ny=M-tyS-ty,IfmodM-ty,S-ty=0M-tyS-ty+1,Otherwisewhere · means rounding down operation and mod(·,·) means modulo operation. Therefore, the total number of random overlapping blocks is Ntotal=nx×ny. The coordinate of thei-th image block in thex-axis direction is denoted by X[i], and the coordinate of thej-th image block in they-axis direction is denoted by Y[i], where i=1,2,…,nx and j=1,2,…,ny. Then, X[i] and Y[j] can be determined as follows. If mod(N −tx,S −tx) = 0, X[i]=(i-1)(S-tx), where i=1,2,…,nx. Otherwise, thex-coordinates of the firstnx − 1 blocks are calculated byX[i] = (i − 1)(S −tx), where i=1,2,…,nx-1, and thex-coordinate of the last block isX[nx] =N −S + 1. Similarly, if mod(M −ty,S −ty) = 0,Y[j] = (j − 1)(S −ty), where y=1,2,…,ny. Otherwise, they-coordinates of the firstny − 1 blocks areY[j] = (j − 1)(S −ty), where y=1,2,…,ny-1. And they-coordinate of the last block isY[ny] =M −S+1. Here, image blocks are numbered from left to right and top to bottom, and the coordinates of thei-th image block are represented by (X[ui],Y[vj]). The random block pattern depends on the block sizeS and the overlapping sizes txandty, where the theoretical range ofS is (1, min (M,N)]. In the experiment, it is found that a smallS value will make more image blocks and thus lead to a slow speed. Therefore, we randomly select theS value from the range [32,min(M,N)) in this study. As the ranges oftx andty are both [1,S), the total number of our random block patterns is minM,N-31S-12. Note that the parametersS,tx, andty are determined by the user and thus they can be taken as secret keys in practice.


### 2.2. Double Spiral Scans

The scheme of double spiral scans proposed in this paper is used to scramble position of every pixel in an overlapping block. Details of our double spiral scans for pixel scrambling in a block are explained as follows.As shown in Figure2, our double spiral scans consist of two parts. Firstly, a start-point is randomly selected. Then, we visit block pixels from the start-point with a spiral scan as shown in Figure 2(a) and obtain a pixel sequence according to the order of visit. Similarly, we visit block pixels from the start-point with another spiral scan as shown in Figure 2(b) and obtain another pixel sequence according to the order of the visit. Next, we concatenate the first pixel sequence and the second pixel sequence to make a new pixel sequence. Finally, we can generate the encrypted image block by filling image block from left to right and top to bottom via picking pixel from the new sequence one by one. Note that all block pixels are visited, and every pixel is scanned only once.Figure 2
Diagram of double spiral scans.
(a)
The first scanning direction (b)
The second scanning directionMore specifically, we first randomly select start-point for the double spiral scans. Here, coordinates of the random start-point are randomly generated by the Henon chaotic map. The detailed calculation will be described in Section2.3. As shown in Figure 2, the solid circle is the start-point of double spiral scans in a block. The scanning process can be divided into two directions. For the first scanning direction, as shown in Figure 2(a), we scan block pixels starting from the start-point and follow the below scanning direction: right, up, left, and down. When scanning to block border or the scanned pixel, we turn the scanning direction. If there is no pixel for scanning, the first scanning process is finished and then the first pixel sequence is obtained. For the second scanning direction, as shown in Figure 2(b), we scan block pixels starting from the start-point and follow the below scanning direction: left, up, right, and down. Similarly, when scanning to block border or the scanned pixel, we turn the scanning direction. If there is no pixel for scanning, the second scanning process is also finished and then the second pixel sequence is obtained. Next, a new pixel sequence can be generated by concatenating the first and the second pixel sequences. Finally, the encrypted block can be obtained by filling it with the new pixel sequence from left to right and top to bottom. Clearly, the encrypted block can be accurately decrypted once the start-point is known by filling pixels back according to the visiting order of double spiral scans.An example of our double spiral scans is illustrated here. Figure3(a) is a 5×5 image block. We scan pixels from left to right and top to bottom and then get a pixel sequence 1, as shown in Figure 4. Suppose that coordinates of the start-point are (3, 4), i.e., the location of ‘N’ as shown in Figure 3(a). We visit block pixels by the double spiral scans and generate the pixel sequence 2, as shown in Figure 4. Then, we fill pixels back to image block with the pixel sequence 2 and obtain the encrypted block as shown in Figure 3(b). Similarly, suppose that coordinates of the start-point are (5, 2), i.e., the location of ‘Q’ as shown in Figure 3(a). We visit block pixels by the double spiral scans and generate the pixel sequence 3, as shown in Figure 4. Then, we fill pixels back to image block with the pixel sequence 3 and obtain the encrypted block as shown in Figure 3(c). Obviously, different start-points lead to different encrypted results. In this study, we choose different start-points for different image blocks by using Henon chaotic map. This strategy can improve security of our algorithm.Figure 3
Original block and different encrypted blocks.
(a)
Original block (b)
Encrypted block started from ‘N’ (c)
Encrypted block started from ‘Q’Figure 4
Original pixel sequence and the pixel sequences generated by double spiral scans with different start-points.


### 2.3. Chaotic Maps

This section describes the chaotic maps used in our algorithm. Henon chaotic map is a typical two-dimensional discrete chaotic map. We use it to generate the start-points for double spiral scans. The Henon chaotic map is defined as follows.(3)xk+1=1-ax2k+ykyk+1=bxkwherea andbare control parameters. When a∈(0.54,2) and b∈(0,1), the Henon chaotic map will reach chaotic state. In this study, we select a=1.4 and b=0.3 and take the initial valuesx(0) andy(0) as keys. We repeatedly calculate (3) Ntotal times and then obtain two chaotic sequences: x=[x(1),x(2),…,x(Ntotal)] and y=[y(1),y(2),…,y(Ntotal)]. Since elements of the chaotic sequences are decimals and pixel coordinates of image block are integers, the two sequences are mapped to integer sequences as follows.(4)Di=modxi∗248,S,i=1,2,…,Ntotal(5)Fi=modyi∗248,S,i=1,2,…,NtotalwhereD(i) is thei-th element of the arrayD used to record thex-coordinate of the start-point of thei-th image block andF(i) is thei-th element of the arrayF used to record they-coordinate of the start-point of thei-th image block.Moreover, we exploit Lü chaotic map to generate secret matrix for XOR operation. The classical Lü chaotic map [43] is a three-dimensional discrete chaotic map that characterizes the transition between the Lorenz system [44] and the Chen system. The Lü chaotic map is calculated as follows.(6)x′=ay-xy′=cy-xzz′=xy-bzwherex0,y0, andz0 are initial values of the Lü chaotic system anda,b, andcare its control parameters. The system is in chaos whena = 36,b = 3, andc = 20. Note thatx0,y0, andz0 are also taken as keys.


### 2.4. Key Generation

We generate content-based keys based on input image and use them to control the Lü chaotic map. This strategy can make our algorithm resistant to differential attack. To do so, the initial valuesx0,y0, andz0 are calculated by the following equations.(7)x0=I1,1⊕I1,2⊕⋯⊕Ii,j255y0=1/MN∑i=1N∑j=1MIi,j255z0=x0+y0where M×N is the size of input image and I(i,j) is the pixel value of input imageI, where i∈[1,N] and j∈[1,M]. Obviously,x0 is the decimal result of XOR operation between all image pixel values, andy0 is the decimal result of mean value of all image pixels. Therefore, if an image pixel in the plaintext image is changed, the calculated results ofx0,y0, andz0 are also changed and then the chaotic sequences controlled by these keys will be different. This means that a changed input image will lead to a different encrypted result.


### 2.5. Encryption Scheme

The steps of our encryption scheme are as follows.Step 1.
The input imageI is divided into random overlapping blocks according to the block sizeSand the overlapping sizestx andty. Calculate the total number of the overlapping blocks Ntotal and use a pseudo-random generator controlled by a keyk1 to generate Ntotal random numbers. Sort these random numbers and record the original positions of the sorted numbers in an arrayP[Ntotal], which is used to determine the order of encrypting image blocks.Step 2.
Use Henon chaotic map to generate two arrays:D[Ntotal] and F[Ntotal]. Note thatD(i) andF(i) are thex-coordinate andy-coordinate of the start-point of theP[i]-th block, respectively, where 1≤i≤Ntotal. Take (D(i),F(i)) as the start-point of theP[i]-th block, encrypt theP[i]-th block by double spiral scans, and write the encrypted result to the image. Repeatedly conduct block encryption starting fromi = 1 toi = Ntotal. After all blocks are processed, a scrambled imageJ is available.Step 3.
Calculate content-based keysx0,y0, andz0 from input image and use them to control the Lü chaotic map to generate a secret matrixG sizedM×N. Then calculate E=J⊕G, where ⊕ represents the XOR operation of the corresponding elements of the matrices, and the matrixE is the encrypted image.


### 2.6. Decryption Scheme

The decryption scheme is a reverse process of our encryption scheme. Note that the keys of the Lü system are transmitted to the receiver via secure channel. Therefore, calculations of initial chaotic parametersx0,y0, andz0 are not required at the receiver’s side. Detailed decryption process is as follows.Step 1.
Usex0,y0, andz0 to control the Lü chaotic map to generate a secret matrixG. Calculate J=E⊕G.Step 2.
According to the block sizeS and the overlapping sizestx andty, the image matrixJ is divided into random overlapping blocks. Compute the number of the overlapping blocks Ntotal and use a pseudo-random generator controlled by a keyk1 to generate Ntotal random numbers. Sort these random numbers and record the original positions of the sorted numbers in an array P[Ntotal].Step 3.
Use Henon map to calculate the arraysD[Ntotal] and F[Ntotal]. Take (D(i),F(i)) as the start-point of theP[i]-th block, decrypt theP[i]-th block by double spiral scans, and write the decrypted result to the image. Repeatedly conduct block decryption starting from i=Ntotal to i=1. After all blocks are processed, the decrypted imageI is obtained. Note that this step is similar to the second step of encryption scheme. The major difference is the order of processing image blocks.


## 2.1. Random Overlapping Block Partition

We exploit random overlapping-block partition scheme [5] to divide input image into overlapping blocks. And then we shuffle every image block by double spiral scans to complete the scrambling operation. The detailed process of the random overlapping-block partition is explained as follows. Assume that the size of input image is M×N, the selected block size is S×S, and tx and ty are the overlapping sizes between adjacent blocks along thex-axis and they-axis, respectively, where tx∈[1,S) and ty∈[1,S). Let nx and ny be the numbers of image blocks in thex-axis and they-axis, respectively. Thus, nx and ny can be calculated as follows.(1)nx=N-txS-tx,IfmodN-tx,S-tx=0N-txS-tx+1,Otherwise(2)ny=M-tyS-ty,IfmodM-ty,S-ty=0M-tyS-ty+1,Otherwisewhere · means rounding down operation and mod(·,·) means modulo operation. Therefore, the total number of random overlapping blocks is Ntotal=nx×ny. The coordinate of thei-th image block in thex-axis direction is denoted by X[i], and the coordinate of thej-th image block in they-axis direction is denoted by Y[i], where i=1,2,…,nx and j=1,2,…,ny. Then, X[i] and Y[j] can be determined as follows. If mod(N −tx,S −tx) = 0, X[i]=(i-1)(S-tx), where i=1,2,…,nx. Otherwise, thex-coordinates of the firstnx − 1 blocks are calculated byX[i] = (i − 1)(S −tx), where i=1,2,…,nx-1, and thex-coordinate of the last block isX[nx] =N −S + 1. Similarly, if mod(M −ty,S −ty) = 0,Y[j] = (j − 1)(S −ty), where y=1,2,…,ny. Otherwise, they-coordinates of the firstny − 1 blocks areY[j] = (j − 1)(S −ty), where y=1,2,…,ny-1. And they-coordinate of the last block isY[ny] =M −S+1. Here, image blocks are numbered from left to right and top to bottom, and the coordinates of thei-th image block are represented by (X[ui],Y[vj]). The random block pattern depends on the block sizeS and the overlapping sizes txandty, where the theoretical range ofS is (1, min (M,N)]. In the experiment, it is found that a smallS value will make more image blocks and thus lead to a slow speed. Therefore, we randomly select theS value from the range [32,min(M,N)) in this study. As the ranges oftx andty are both [1,S), the total number of our random block patterns is minM,N-31S-12. Note that the parametersS,tx, andty are determined by the user and thus they can be taken as secret keys in practice.


## 2.2. Double Spiral Scans

The scheme of double spiral scans proposed in this paper is used to scramble position of every pixel in an overlapping block. Details of our double spiral scans for pixel scrambling in a block are explained as follows.As shown in Figure2, our double spiral scans consist of two parts. Firstly, a start-point is randomly selected. Then, we visit block pixels from the start-point with a spiral scan as shown in Figure 2(a) and obtain a pixel sequence according to the order of visit. Similarly, we visit block pixels from the start-point with another spiral scan as shown in Figure 2(b) and obtain another pixel sequence according to the order of the visit. Next, we concatenate the first pixel sequence and the second pixel sequence to make a new pixel sequence. Finally, we can generate the encrypted image block by filling image block from left to right and top to bottom via picking pixel from the new sequence one by one. Note that all block pixels are visited, and every pixel is scanned only once.Figure 2
Diagram of double spiral scans.
(a)
The first scanning direction (b)
The second scanning directionMore specifically, we first randomly select start-point for the double spiral scans. Here, coordinates of the random start-point are randomly generated by the Henon chaotic map. The detailed calculation will be described in Section2.3. As shown in Figure 2, the solid circle is the start-point of double spiral scans in a block. The scanning process can be divided into two directions. For the first scanning direction, as shown in Figure 2(a), we scan block pixels starting from the start-point and follow the below scanning direction: right, up, left, and down. When scanning to block border or the scanned pixel, we turn the scanning direction. If there is no pixel for scanning, the first scanning process is finished and then the first pixel sequence is obtained. For the second scanning direction, as shown in Figure 2(b), we scan block pixels starting from the start-point and follow the below scanning direction: left, up, right, and down. Similarly, when scanning to block border or the scanned pixel, we turn the scanning direction. If there is no pixel for scanning, the second scanning process is also finished and then the second pixel sequence is obtained. Next, a new pixel sequence can be generated by concatenating the first and the second pixel sequences. Finally, the encrypted block can be obtained by filling it with the new pixel sequence from left to right and top to bottom. Clearly, the encrypted block can be accurately decrypted once the start-point is known by filling pixels back according to the visiting order of double spiral scans.An example of our double spiral scans is illustrated here. Figure3(a) is a 5×5 image block. We scan pixels from left to right and top to bottom and then get a pixel sequence 1, as shown in Figure 4. Suppose that coordinates of the start-point are (3, 4), i.e., the location of ‘N’ as shown in Figure 3(a). We visit block pixels by the double spiral scans and generate the pixel sequence 2, as shown in Figure 4. Then, we fill pixels back to image block with the pixel sequence 2 and obtain the encrypted block as shown in Figure 3(b). Similarly, suppose that coordinates of the start-point are (5, 2), i.e., the location of ‘Q’ as shown in Figure 3(a). We visit block pixels by the double spiral scans and generate the pixel sequence 3, as shown in Figure 4. Then, we fill pixels back to image block with the pixel sequence 3 and obtain the encrypted block as shown in Figure 3(c). Obviously, different start-points lead to different encrypted results. In this study, we choose different start-points for different image blocks by using Henon chaotic map. This strategy can improve security of our algorithm.Figure 3
Original block and different encrypted blocks.
(a)
Original block (b)
Encrypted block started from ‘N’ (c)
Encrypted block started from ‘Q’Figure 4
Original pixel sequence and the pixel sequences generated by double spiral scans with different start-points.


## 2.3. Chaotic Maps

This section describes the chaotic maps used in our algorithm. Henon chaotic map is a typical two-dimensional discrete chaotic map. We use it to generate the start-points for double spiral scans. The Henon chaotic map is defined as follows.(3)xk+1=1-ax2k+ykyk+1=bxkwherea andbare control parameters. When a∈(0.54,2) and b∈(0,1), the Henon chaotic map will reach chaotic state. In this study, we select a=1.4 and b=0.3 and take the initial valuesx(0) andy(0) as keys. We repeatedly calculate (3) Ntotal times and then obtain two chaotic sequences: x=[x(1),x(2),…,x(Ntotal)] and y=[y(1),y(2),…,y(Ntotal)]. Since elements of the chaotic sequences are decimals and pixel coordinates of image block are integers, the two sequences are mapped to integer sequences as follows.(4)Di=modxi∗248,S,i=1,2,…,Ntotal(5)Fi=modyi∗248,S,i=1,2,…,NtotalwhereD(i) is thei-th element of the arrayD used to record thex-coordinate of the start-point of thei-th image block andF(i) is thei-th element of the arrayF used to record they-coordinate of the start-point of thei-th image block.Moreover, we exploit Lü chaotic map to generate secret matrix for XOR operation. The classical Lü chaotic map [43] is a three-dimensional discrete chaotic map that characterizes the transition between the Lorenz system [44] and the Chen system. The Lü chaotic map is calculated as follows.(6)x′=ay-xy′=cy-xzz′=xy-bzwherex0,y0, andz0 are initial values of the Lü chaotic system anda,b, andcare its control parameters. The system is in chaos whena = 36,b = 3, andc = 20. Note thatx0,y0, andz0 are also taken as keys.


## 2.4. Key Generation

We generate content-based keys based on input image and use them to control the Lü chaotic map. This strategy can make our algorithm resistant to differential attack. To do so, the initial valuesx0,y0, andz0 are calculated by the following equations.(7)x0=I1,1⊕I1,2⊕⋯⊕Ii,j255y0=1/MN∑i=1N∑j=1MIi,j255z0=x0+y0where M×N is the size of input image and I(i,j) is the pixel value of input imageI, where i∈[1,N] and j∈[1,M]. Obviously,x0 is the decimal result of XOR operation between all image pixel values, andy0 is the decimal result of mean value of all image pixels. Therefore, if an image pixel in the plaintext image is changed, the calculated results ofx0,y0, andz0 are also changed and then the chaotic sequences controlled by these keys will be different. This means that a changed input image will lead to a different encrypted result.


## 2.5. Encryption Scheme

The steps of our encryption scheme are as follows.Step 1.
The input imageI is divided into random overlapping blocks according to the block sizeSand the overlapping sizestx andty. Calculate the total number of the overlapping blocks Ntotal and use a pseudo-random generator controlled by a keyk1 to generate Ntotal random numbers. Sort these random numbers and record the original positions of the sorted numbers in an arrayP[Ntotal], which is used to determine the order of encrypting image blocks.Step 2.
Use Henon chaotic map to generate two arrays:D[Ntotal] and F[Ntotal]. Note thatD(i) andF(i) are thex-coordinate andy-coordinate of the start-point of theP[i]-th block, respectively, where 1≤i≤Ntotal. Take (D(i),F(i)) as the start-point of theP[i]-th block, encrypt theP[i]-th block by double spiral scans, and write the encrypted result to the image. Repeatedly conduct block encryption starting fromi = 1 toi = Ntotal. After all blocks are processed, a scrambled imageJ is available.Step 3.
Calculate content-based keysx0,y0, andz0 from input image and use them to control the Lü chaotic map to generate a secret matrixG sizedM×N. Then calculate E=J⊕G, where ⊕ represents the XOR operation of the corresponding elements of the matrices, and the matrixE is the encrypted image.


## 2.6. Decryption Scheme

The decryption scheme is a reverse process of our encryption scheme. Note that the keys of the Lü system are transmitted to the receiver via secure channel. Therefore, calculations of initial chaotic parametersx0,y0, andz0 are not required at the receiver’s side. Detailed decryption process is as follows.Step 1.
Usex0,y0, andz0 to control the Lü chaotic map to generate a secret matrixG. Calculate J=E⊕G.Step 2.
According to the block sizeS and the overlapping sizestx andty, the image matrixJ is divided into random overlapping blocks. Compute the number of the overlapping blocks Ntotal and use a pseudo-random generator controlled by a keyk1 to generate Ntotal random numbers. Sort these random numbers and record the original positions of the sorted numbers in an array P[Ntotal].Step 3.
Use Henon map to calculate the arraysD[Ntotal] and F[Ntotal]. Take (D(i),F(i)) as the start-point of theP[i]-th block, decrypt theP[i]-th block by double spiral scans, and write the decrypted result to the image. Repeatedly conduct block decryption starting from i=Ntotal to i=1. After all blocks are processed, the decrypted imageI is obtained. Note that this step is similar to the second step of encryption scheme. The major difference is the order of processing image blocks.


## 3. Key Space Analysis

Kerckhoffs’s principle is a basic principle of the modern cryptography. It illustrates that “A cryptographic system should be secure even if everything about the system, except the key, is public knowledge” [45]. This implies that security of a cryptographic system is only dependent on secret keys, not the algorithm itself. In other words, security of an encryption algorithm mainly depends on the size of key space. In general, the larger the key space, the more secure the algorithm. The key space of our algorithm includes three parts. The first part is the initial values of the Henon chaotic mapx(0) andy(0), and the random block pattern determined by the block sizeS and the overlapping sizestx andty. Asx(0) andy(0) are floating numbers and require 64 bits’ storage, their key space is 264×2 = 2128. The space of random block pattern is minM,N-31S-12. The second part is the random key used to control the pseudo-random generator for block selection. The precision of the key is 64 bits. Since the key is used to randomly select block and the permutation number of blocks is Ntotal!, the valid key space is min(264, Ntotal!). When the block number Ntotal≥21, the following expression Ntotal! > 264 holds. In this case, the key space is 264. Otherwise, the key space is Ntotal!. The third part is the initial values of the Lü chaotic map. These three parameters are all floating numbers. Therefore, the key space of this part is 264×3 = 2192.In summary, the key space of our algorithm is 2128 × (min(M,N) − 31)(S− 1)2 × min(264, Ntotal!) × 2192 = (min(M,N) − 31)(S − 1)2 × min(264, Ntotal!) × 2320. For example, for a 512 × 512 image, ifS = 150,tx = 70, andty = 70, the total number of image blocks is 36. Consequently, our key space is 481 × 1492 × 264 × 2320 = 481 × 1492 × 2384 ≈ 4.2 × 10122, which is large enough to resist brute-force attacks [6]. For reference, the key spaces of the encryption algorithms reported in [6, 18, 19, 31] are 2104, 2265, 10117, and 1059, respectively, which are much smaller than our key space.


## 4. Experimental Results

In the experiment, the parameters of our algorithm are set as follows. The initial values of Henon map arex(0) = 0.1 andy(0) = 0.3. The block size isS = 150 and the overlapping sizes aretx = 70 andty = 70. The key of the pseudo-random generator isk1 = 2.


### 4.1. Encrypted Results

To validate our algorithm, some gray-scale images and color images are selected as test images. Figure5 presents these test images and their detailed information is listed in Table 1. We apply our encryption scheme to these images and find that all encrypted images are chaotic images. Figures 6(a)–6(f) are the encrypted versions of the six test images generated by our encryption scheme. From the encryption results, it is observed that our encryption scheme can encrypt different size images, and all the encrypted images are noise-like images and meaningless. This means that our algorithm can effectively encrypt images.Table 1
Test images.
Image Lena Fingerprint Woman Lake Goldhill ChestXray Size 512×512 256×256 256×256 512×512 576×720 418×602 Type Grayscale Grayscale Color Color Grayscale GrayscaleFigure 5
Six original images.
(a)
Lena (b)
Fingerprint (c)
Woman (d)
Lake (e)
Goldhill (f)
ChestXrayFigure 6
Encrypted images.
(a)
Encrypted Lena (b)
Encrypted Fingerprint (c)
Encrypted Woman (d)
Encrypted Lake (e)
Encrypted Goldhill (f)
Encrypted ChestXray


### 4.2. Correlation Analysis

The pixel correlation is the degree of association of the gray values between pixels. Generally, the smaller the correlation between adjacent pixels of the encrypted image is, the better the performance of the encryption algorithm is. When calculating the pixel correlation in a certain direction (horizontal, vertical, or diagonal direction), several adjacent pixel pairs are randomly selected, and then the correlation coefficient is calculated. The formula of correlation coefficient is defined as follows.(8)corrx,y=Ex-μxy-μyσxσywhere μx and μy represent mean values ofx andy, σx and σy are the standard deviations of x and y, and E[·] is the expectation function. The correlation coefficient is ranging from −1 to 1. The larger the correlation coefficient, the stronger the correlation between two pixel sequences. For a plaintext image, any two adjacent pairs of pixels usually have a strong correlation. A good performance encryption algorithm should break such correlation.In the experiments, we randomly select 3000 pairs of adjacent pixels in horizontal, vertical, and diagonal directions, respectively, and calculate their correlation coefficients to verify the performance of our algorithm. Table2 presents the correlation coefficients of original images and their encrypted versions. It can be found that the correlation coefficients of the original image are close to 1, while the correlation coefficients of the encrypted image are near 0. For space limitation, some typical visual results of distribution of adjacent pixels are illustrated in Figure 7. Figures 7(a)–7(d) are the pixel pair distribution of the test images (i.e., Fingerprint, Woman, Lake, and Goldhill) in horizontal direction, and Figures 7(e)–7(h) are the pixel pair distribution of their encrypted versions in the horizontal direction. The comparison shows that the pixel pairs of original images are concentrated around the diagonal with 45 degrees, showing high correlation coefficients, while the pixel pairs of the encrypted image are uniformly distributed over the entire value interval. This illustrates that our encryption scheme can effectively break the correlation between adjacent pixels.Table 2
Correlation coefficients of the original images and their encrypted images.
Test image Horizontal direction Vertical direction Diagonal direction Original image Encrypted image Original image Encrypted image Original image Encrypted image Lena 0.9757 −0.0685 0.9692 0.0857 0.8820 0.0059 Fingerprint 0.9142 0.0933 0.9738 0.0616 0.8050 −0.0101 Woman 0.9655 0.0334 0.9758 0.1030 0.8825 −0.0007 Lake 0.9677 −0.0062 0.9638 −0.0137 0.9144 −0.0214 Goldhill 0.9780 −0.0351 0.9625 0.0556 0.6915 0.0330 ChestXray 0.9974 0.1183 0.9969 −0.0403 0.9364 −0.0059Figure 7
Distribution of adjacent pixels in horizontal direction.
(a)
Fingerprint (b)
Woman (c)
Lake (d)
Goldhill (e)
Encrypted Fingerprint (f)
Encrypted Woman (g)
Encrypted Lake (h)
Encrypted Goldhill


### 4.3. Key Sensitivity Analysis

A good encryption algorithm should be sensitive to the change of secret keys. This means that a slight difference of the keys should result in a great change in the decrypted image. If the difference between two encrypted images is very large, it is very difficult for attackers to break the algorithm through differential attacks. In the experiment, we change the initial valuesx(0) ory(0) of the Henon chaos system slightly and keep other decryption keys unchanged. We use these wrong keys to decrypt Figures 6(c)–6(f) and obtain the decrypted images as shown in Figure 8 and Figure 9, where Figure 8 uses a wrong keyx(0) = 0.100001 (10−6 added) and Figure 9 uses a wrong keyy(0) = 0.300001 (10−6 added). Obviously, the decrypted results with a wrong key are still noise-like images. This indicates that our algorithm is key-sensitive.Figure 8
Decrypted images with a wrong key:x(0) = 0.100001.
(a)
Decrypted Woman (b)
Decrypted Lake (c)
Decrypted Goldhill (d)
Decrypted ChestXrayFigure 9
Decrypted images with a wrong key:y(0) = 0.300001.
(a)
Decrypted Woman (b)
Decrypted Lake (c)
Decrypted Goldhill (d)
Decrypted ChestXray


### 4.4. Histogram Analysis

Histogram is an important statistical feature used to show distribution of pixel values. It is often exploited to measure performance of image encryption algorithms. In general, an efficient encryption algorithm is expected to generate encrypted image with uniformly distributed histogram. Figures10(a)–10(c) are the histograms of red, green, and blue components of the color image Lake (Figure 5(d)), and Figure 10(d) is the histogram of the grayscale image Goldhill (Figure 5(e)). Figure 11 presents the histograms of the encrypted images generated by our algorithm, and Figure 12 shows the histograms of the encrypted results generated by the encryption algorithm [6]. It can be observed that our histograms are almost uniformly distributed and those histograms generated by the encryption algorithm [6] are rugged. Therefore, from the viewpoint of histogram, our algorithm is also secure.Figure 10
Histograms of original images.
(a)
Red component of Lake (b)
Green component of Lake (c)
Blue component of Lake (d)
GoldhillFigure 11
Histograms of our encrypted images.
(a)
Red component of Lake (b)
Green component of Lake (c)
Blue component of Lake (d)
GoldhillFigure 12
Histograms of the encrypted images generated by [6].
(a)
Red component of Lake (b)
Green component of Lake (c)
Blue component of Lake (d)
GoldhillTo quantitatively analyze histograms, the variance of histogram [46] is exploited to analyze performance, which is defined as follows.(9)VZ=1L2∑i=0L-1∑j=0L-112zi-zj2where Z={z1,z2,…,zL-1},zi (0 ≤i≤L − 1),zi is the total number of pixels with gray value equal toi, andL = 256 for the grayscale image. In general, the smaller the histogram variance, the more secure the encrypted image. Table 3 is histogram variance comparison between our algorithm and other algorithms [6, 25, 31]. From the results, it is observed that our results are all smaller than those of the compared algorithms, except two cases. Specifically, our results of Fingerprint and ChestXray are bigger than those of [25, 31]. However, for the average variance of histogram, our result is much smaller than those of the compared algorithms. It means that our algorithm has better performance than the compared algorithms [6, 25, 31] in terms of variance of histogram.Table 3
Comparison of the variance of histogram among different algorithms.
Image Original variance Variance of histogram of the encrypted result [6] [25] [31] Our Lena 0.9725×106 0.1681×106 607.3 1339 1052.4 Fingerprint 1.5573×106 0.6517×106 34.96 277.51 329.11 Woman 0.1696×106 0.0793×106 369.33 260.1 245.37 Lake 0.7899×106 0.1514×106 3515.0 2146.5 1030.3 Goldhill 1.5506×106 0.9906×106 5538.7 2519.7 1737.4 ChestXray 6.1454×106 3.5074×106 1164.6 1164.1 1356.9  Average 1.8643×106 0.9248×106 2421.6 1284.5 958.58


### 4.5. Entropy Analysis

Entropy [47] is often used to describe the uncertainty or randomness of an image. It is a useful metric for measuring security of image encryption. It is defined as follows.(10)HE=-∑i=0L-1Peilog2⁡Peiwhere E={e0,e1,…,eL-1} andP(ei) is the possibility of the occurrence ofei. For an image with 256 gray-level (e.g.,L = 256), the theoretical maximum of the entropy is 8. In general, a bigger entropy means a more secure encryption algorithm. Table 4 lists entropy comparisons between our algorithm and the compared encryption algorithms [6, 25, 31]. It can be seen that the entropies of our algorithm are all close to 8 and are bigger than those of the compared algorithms [6, 25, 31]. Therefore, our algorithm is more secure than the compared algorithms [6, 25, 31] from the viewpoint of entropy.Table 4
Entropy comparisons among different algorithms.
Image Original [6] [25] [31] Our Lena 7.2185 7.3634 7.9974 7.9991 7.9992 Fingerprint 5.1141 6.9960 7.9963 7.9963 7.9964 Woman 6.8981 7.4099 7.9972 7.9986 7.9991 Lake 7.7610 7.9427 7.9985 7.9993 7.9997 Goldhill 7.5195 7.6788 7.9984 7.9993 7.9995 ChestXray 5.8733 7.3865 7.9991 7.9985 7.9989  Average 6.7308 7.4629 7.9978 7.9985 7.9988


### 4.6. Differential Attack

Differential attack is an effective method for analyzing security of cryptographic system. Generally, attacker slightly changes pixels of a plaintext image, generates a slightly altered encrypted image, and then analyzes the relationship between the generated encrypted image and the normal encrypted image. In practice, NPCR (Number of Pixels Change Rate) and UACI (Unified Average Changing Intensity) [48, 49] are often used to evaluate the capability of resisting differential attack. UACI and NPCR are defined as follows.(11)UACIR,G,B=1W×H∑i,jCR,G,Bi,j-C′R,G,Bi,j255×100%(12)NPCRR,G,B=∑i,jDR,G,Bi,jW×H×100%whereW andH are the image width and height and CR,G,B(i,j) and C′R,G,B(i,j) are the pixel values in thei-th row andj-th column of two encrypted images, respectively. If CR,G,B(i,j)≠C′R,G,B(i,j), then DR,G,B(i,j)=1. Otherwise, DR,G,B(i,j)=0. Note that the theoretical values of NPCR and UACI are 100% and 33.33%, respectively. Generally, the closer to the theoretical values the calculated results, the more secure the encryption algorithm.In the experiments, the standard images Lake, Goldhill, and Lena are selected as the test images, where their red components are used. Four locations (i.e., (1, 1), (128, 128), (360, 360), and (512, 512)) are selected in the test images for changing pixel values. For each test image, we just alter one pixel to generate a modified original image and then conduct encryption. Table5 presents NPCR and UACI comparison results among our algorithm and the compared algorithms [6, 31]. It can be found that all NPCR values of our algorithm are greater than or equal to 99.60%, which is a little greater than or equal to those of the compared algorithms [6, 31]. For UACI, all our values are close to the theoretical value 33.33%, which is almost equal to the results of [31] but a little better than those of [6].Table 5
Comparison results of NPCR and UACI (unit: %).
Algorithm Image (1, 1) (128, 128) (360, 360) (512, 512) NPCR/UACI NPCR/UACI NPCR/UACI NPCR/UACI Our Lake 99.61/33.42 99.60/33.37 99.61/33.37 99.61/33.37 Goldhill 99.61/33.75 99.61/33.48 99.62/33.75 99.62/33.71 Lena 99.63/33.47 99.60/33.39 99.62/33.39 99.60/33.39  [6] Lake 99.52/34.40 99.51/34.41 99.51/34.41 99.51/34.41 Goldhill 99.56/34.31 99.59/34.36 99.59/34.36 99.56/34.36 Lena 99.54/34.67 99.55/34.64 99.54/34.68 99.54/34.66  [31] Lake 99.61/33.48 99.60/33.53 99.59/33.55 99.61/33.48 Goldhill 99.60/33.53 99.58/33.52 99.60/33.55 99.61/33.49 Lena 99.61/33.51 99.60/33.48 99.60/33.61 99.58/33.58For space limitation, we only present a typical visual result. In the experiment, we change the pixel of Lena in the coordinate (1, 1) (its value is changed from 169 to 170) to generate the modified Lena and encrypt it with the same key. The encryption result is shown in Figure13(a). The difference image between Figure 13(a) and the original encrypted result of the Lena is shown in Figure 13(b). From the result, it is observed that even if input image is slightly changed, our encryption result will be greatly changed. This indicates that our algorithm is highly sensitive to pixel change. Therefore, our algorithm can resist differential attack.Figure 13
Visual result of differential attack.
(a)
Encryption result of the modified Lena (b)
Difference between (a) and the original encrypted LenaAccording to Kerckhoffs’s principle [45], a successful cryptanalysis should accurately estimate secret keys (equivalent to recovering plaintext). For chosen plaintext attack, attacker can choose some specific plaintexts to calculate their corresponding ciphertexts. In practice, differential attack analysis is the most common way to achieve the chosen plaintext attack [18]. As well-known, diffusion technique can ensure security of a cryptographic algorithm against the chosen-plaintext attack [18]. To resist this attack, in this paper, we achieve diffusion by using content-based keys to control the Lü chaotic map for changing pixel values. In addition, we exploit double spiral scans to randomly scramble pixel positions. These techniques ensure that it is difficult to observe useful trace between secret keys and plaintext/ciphertext. This means that correct key estimation is almost impossible in practice. Therefore, the chosen-plaintext attack is impractical for our algorithm.


### 4.7. Robustness Test

To evaluate robustness performance of our algorithm, we attack many encrypted images with operations of salt & pepper noise and block missing, respectively. It is found that our algorithm can efficiently restore the decrypted images from the attacked encrypted images. For space limitation, typical examples are presented here. Firstly, we add salt & pepper noise with different densities (i.e., 0.01, 0.05, and 0.10) to the encrypted version of Lena (as shown in Figure6(a)), decrypt the attacked encrypted images, and then obtain the decrypted images as shown in Figure 14. It can be observed that image noises are randomly distributed in the decrypted images and image qualities of the decrypted images gradually decrease with the increase of noise density. Secondly, we remove image blocks with different sizes from the encrypted version of Lena to generate the attacked encrypted versions as shown in Figure 15. We decrypt these attacked encrypted images and obtain the recovered results as shown in Figure 16. It is found that when the size of the missing block is small (e.g., 40 × 40), visual quality of the recovered image is good and the recovered image is almost the same as its original image. As the block size becomes large (e.g., 128 × 512), visual quality of the decrypted image decreases. But the appearance of the original image can be easily recognized from the decrypted image. From the above results, it can be concluded that our algorithm is robust against salt & pepper noise attack and block missing.Figure 14
Decrypted images under the attack of salt and pepper noise with different densities.
(a)
Density is 0.01 (b)
Density is 0.05 (c)
Density is 0.10Figure 15
Encrypted images with block missing.
(a)
40 × 40 block (b)
100 × 140 block (c)
128 × 512 blockFigure 16
Decrypted images with block missing.
(a)
40 × 40 block missing (b)
100 × 140 block missing (c)
128 × 512 block missing


### 4.8. Computational Time Evaluation

To compare computational time, we exploit the assessed algorithms to encrypt the six test images, i.e., Lena, Fingerprint, Woman, Lake, Goldhill, and ChestXray, and record the running time of each algorithm. All algorithms are implemented with MATLAB R2014a and run on a computer with 3.4 GHz Intel Core i5-3570 CPU and 4.0 GB RAM. Table6 presents computational time comparison among different algorithms. It is observed that our algorithm runs faster than the compared algorithms [6, 25, 31]. The fast speed of our algorithm is mainly contributed by the low complexity of double spiral scans.Table 6
Computational time comparison among different algorithms (unit: second).
Algorithm Lena Fingerprint Woman Lake Goldhill ChestXray [6] 4.601 2.350 4.065 4.059 5.747 4.444 [25] 7.788 2.984 5.838 13.098 12.231 7.782 [31] 4.821 2.718 5.774 6.514 4.382 5.219 Our 2.792 1.755 3.264 3.860 3.759 2.100


## 4.1. Encrypted Results

To validate our algorithm, some gray-scale images and color images are selected as test images. Figure5 presents these test images and their detailed information is listed in Table 1. We apply our encryption scheme to these images and find that all encrypted images are chaotic images. Figures 6(a)–6(f) are the encrypted versions of the six test images generated by our encryption scheme. From the encryption results, it is observed that our encryption scheme can encrypt different size images, and all the encrypted images are noise-like images and meaningless. This means that our algorithm can effectively encrypt images.Table 1
Test images.
Image Lena Fingerprint Woman Lake Goldhill ChestXray Size 512×512 256×256 256×256 512×512 576×720 418×602 Type Grayscale Grayscale Color Color Grayscale GrayscaleFigure 5
Six original images.
(a)
Lena (b)
Fingerprint (c)
Woman (d)
Lake (e)
Goldhill (f)
ChestXrayFigure 6
Encrypted images.
(a)
Encrypted Lena (b)
Encrypted Fingerprint (c)
Encrypted Woman (d)
Encrypted Lake (e)
Encrypted Goldhill (f)
Encrypted ChestXray


## 4.2. Correlation Analysis

The pixel correlation is the degree of association of the gray values between pixels. Generally, the smaller the correlation between adjacent pixels of the encrypted image is, the better the performance of the encryption algorithm is. When calculating the pixel correlation in a certain direction (horizontal, vertical, or diagonal direction), several adjacent pixel pairs are randomly selected, and then the correlation coefficient is calculated. The formula of correlation coefficient is defined as follows.(8)corrx,y=Ex-μxy-μyσxσywhere μx and μy represent mean values ofx andy, σx and σy are the standard deviations of x and y, and E[·] is the expectation function. The correlation coefficient is ranging from −1 to 1. The larger the correlation coefficient, the stronger the correlation between two pixel sequences. For a plaintext image, any two adjacent pairs of pixels usually have a strong correlation. A good performance encryption algorithm should break such correlation.In the experiments, we randomly select 3000 pairs of adjacent pixels in horizontal, vertical, and diagonal directions, respectively, and calculate their correlation coefficients to verify the performance of our algorithm. Table2 presents the correlation coefficients of original images and their encrypted versions. It can be found that the correlation coefficients of the original image are close to 1, while the correlation coefficients of the encrypted image are near 0. For space limitation, some typical visual results of distribution of adjacent pixels are illustrated in Figure 7. Figures 7(a)–7(d) are the pixel pair distribution of the test images (i.e., Fingerprint, Woman, Lake, and Goldhill) in horizontal direction, and Figures 7(e)–7(h) are the pixel pair distribution of their encrypted versions in the horizontal direction. The comparison shows that the pixel pairs of original images are concentrated around the diagonal with 45 degrees, showing high correlation coefficients, while the pixel pairs of the encrypted image are uniformly distributed over the entire value interval. This illustrates that our encryption scheme can effectively break the correlation between adjacent pixels.Table 2
Correlation coefficients of the original images and their encrypted images.
Test image Horizontal direction Vertical direction Diagonal direction Original image Encrypted image Original image Encrypted image Original image Encrypted image Lena 0.9757 −0.0685 0.9692 0.0857 0.8820 0.0059 Fingerprint 0.9142 0.0933 0.9738 0.0616 0.8050 −0.0101 Woman 0.9655 0.0334 0.9758 0.1030 0.8825 −0.0007 Lake 0.9677 −0.0062 0.9638 −0.0137 0.9144 −0.0214 Goldhill 0.9780 −0.0351 0.9625 0.0556 0.6915 0.0330 ChestXray 0.9974 0.1183 0.9969 −0.0403 0.9364 −0.0059Figure 7
Distribution of adjacent pixels in horizontal direction.
(a)
Fingerprint (b)
Woman (c)
Lake (d)
Goldhill (e)
Encrypted Fingerprint (f)
Encrypted Woman (g)
Encrypted Lake (h)
Encrypted Goldhill


## 4.3. Key Sensitivity Analysis

A good encryption algorithm should be sensitive to the change of secret keys. This means that a slight difference of the keys should result in a great change in the decrypted image. If the difference between two encrypted images is very large, it is very difficult for attackers to break the algorithm through differential attacks. In the experiment, we change the initial valuesx(0) ory(0) of the Henon chaos system slightly and keep other decryption keys unchanged. We use these wrong keys to decrypt Figures 6(c)–6(f) and obtain the decrypted images as shown in Figure 8 and Figure 9, where Figure 8 uses a wrong keyx(0) = 0.100001 (10−6 added) and Figure 9 uses a wrong keyy(0) = 0.300001 (10−6 added). Obviously, the decrypted results with a wrong key are still noise-like images. This indicates that our algorithm is key-sensitive.Figure 8
Decrypted images with a wrong key:x(0) = 0.100001.
(a)
Decrypted Woman (b)
Decrypted Lake (c)
Decrypted Goldhill (d)
Decrypted ChestXrayFigure 9
Decrypted images with a wrong key:y(0) = 0.300001.
(a)
Decrypted Woman (b)
Decrypted Lake (c)
Decrypted Goldhill (d)
Decrypted ChestXray


## 4.4. Histogram Analysis

Histogram is an important statistical feature used to show distribution of pixel values. It is often exploited to measure performance of image encryption algorithms. In general, an efficient encryption algorithm is expected to generate encrypted image with uniformly distributed histogram. Figures10(a)–10(c) are the histograms of red, green, and blue components of the color image Lake (Figure 5(d)), and Figure 10(d) is the histogram of the grayscale image Goldhill (Figure 5(e)). Figure 11 presents the histograms of the encrypted images generated by our algorithm, and Figure 12 shows the histograms of the encrypted results generated by the encryption algorithm [6]. It can be observed that our histograms are almost uniformly distributed and those histograms generated by the encryption algorithm [6] are rugged. Therefore, from the viewpoint of histogram, our algorithm is also secure.Figure 10
Histograms of original images.
(a)
Red component of Lake (b)
Green component of Lake (c)
Blue component of Lake (d)
GoldhillFigure 11
Histograms of our encrypted images.
(a)
Red component of Lake (b)
Green component of Lake (c)
Blue component of Lake (d)
GoldhillFigure 12
Histograms of the encrypted images generated by [6].
(a)
Red component of Lake (b)
Green component of Lake (c)
Blue component of Lake (d)
GoldhillTo quantitatively analyze histograms, the variance of histogram [46] is exploited to analyze performance, which is defined as follows.(9)VZ=1L2∑i=0L-1∑j=0L-112zi-zj2where Z={z1,z2,…,zL-1},zi (0 ≤i≤L − 1),zi is the total number of pixels with gray value equal toi, andL = 256 for the grayscale image. In general, the smaller the histogram variance, the more secure the encrypted image. Table 3 is histogram variance comparison between our algorithm and other algorithms [6, 25, 31]. From the results, it is observed that our results are all smaller than those of the compared algorithms, except two cases. Specifically, our results of Fingerprint and ChestXray are bigger than those of [25, 31]. However, for the average variance of histogram, our result is much smaller than those of the compared algorithms. It means that our algorithm has better performance than the compared algorithms [6, 25, 31] in terms of variance of histogram.Table 3
Comparison of the variance of histogram among different algorithms.
Image Original variance Variance of histogram of the encrypted result [6] [25] [31] Our Lena 0.9725×106 0.1681×106 607.3 1339 1052.4 Fingerprint 1.5573×106 0.6517×106 34.96 277.51 329.11 Woman 0.1696×106 0.0793×106 369.33 260.1 245.37 Lake 0.7899×106 0.1514×106 3515.0 2146.5 1030.3 Goldhill 1.5506×106 0.9906×106 5538.7 2519.7 1737.4 ChestXray 6.1454×106 3.5074×106 1164.6 1164.1 1356.9  Average 1.8643×106 0.9248×106 2421.6 1284.5 958.58


## 4.5. Entropy Analysis

Entropy [47] is often used to describe the uncertainty or randomness of an image. It is a useful metric for measuring security of image encryption. It is defined as follows.(10)HE=-∑i=0L-1Peilog2⁡Peiwhere E={e0,e1,…,eL-1} andP(ei) is the possibility of the occurrence ofei. For an image with 256 gray-level (e.g.,L = 256), the theoretical maximum of the entropy is 8. In general, a bigger entropy means a more secure encryption algorithm. Table 4 lists entropy comparisons between our algorithm and the compared encryption algorithms [6, 25, 31]. It can be seen that the entropies of our algorithm are all close to 8 and are bigger than those of the compared algorithms [6, 25, 31]. Therefore, our algorithm is more secure than the compared algorithms [6, 25, 31] from the viewpoint of entropy.Table 4
Entropy comparisons among different algorithms.
Image Original [6] [25] [31] Our Lena 7.2185 7.3634 7.9974 7.9991 7.9992 Fingerprint 5.1141 6.9960 7.9963 7.9963 7.9964 Woman 6.8981 7.4099 7.9972 7.9986 7.9991 Lake 7.7610 7.9427 7.9985 7.9993 7.9997 Goldhill 7.5195 7.6788 7.9984 7.9993 7.9995 ChestXray 5.8733 7.3865 7.9991 7.9985 7.9989  Average 6.7308 7.4629 7.9978 7.9985 7.9988


## 4.6. Differential Attack

Differential attack is an effective method for analyzing security of cryptographic system. Generally, attacker slightly changes pixels of a plaintext image, generates a slightly altered encrypted image, and then analyzes the relationship between the generated encrypted image and the normal encrypted image. In practice, NPCR (Number of Pixels Change Rate) and UACI (Unified Average Changing Intensity) [48, 49] are often used to evaluate the capability of resisting differential attack. UACI and NPCR are defined as follows.(11)UACIR,G,B=1W×H∑i,jCR,G,Bi,j-C′R,G,Bi,j255×100%(12)NPCRR,G,B=∑i,jDR,G,Bi,jW×H×100%whereW andH are the image width and height and CR,G,B(i,j) and C′R,G,B(i,j) are the pixel values in thei-th row andj-th column of two encrypted images, respectively. If CR,G,B(i,j)≠C′R,G,B(i,j), then DR,G,B(i,j)=1. Otherwise, DR,G,B(i,j)=0. Note that the theoretical values of NPCR and UACI are 100% and 33.33%, respectively. Generally, the closer to the theoretical values the calculated results, the more secure the encryption algorithm.In the experiments, the standard images Lake, Goldhill, and Lena are selected as the test images, where their red components are used. Four locations (i.e., (1, 1), (128, 128), (360, 360), and (512, 512)) are selected in the test images for changing pixel values. For each test image, we just alter one pixel to generate a modified original image and then conduct encryption. Table5 presents NPCR and UACI comparison results among our algorithm and the compared algorithms [6, 31]. It can be found that all NPCR values of our algorithm are greater than or equal to 99.60%, which is a little greater than or equal to those of the compared algorithms [6, 31]. For UACI, all our values are close to the theoretical value 33.33%, which is almost equal to the results of [31] but a little better than those of [6].Table 5
Comparison results of NPCR and UACI (unit: %).
Algorithm Image (1, 1) (128, 128) (360, 360) (512, 512) NPCR/UACI NPCR/UACI NPCR/UACI NPCR/UACI Our Lake 99.61/33.42 99.60/33.37 99.61/33.37 99.61/33.37 Goldhill 99.61/33.75 99.61/33.48 99.62/33.75 99.62/33.71 Lena 99.63/33.47 99.60/33.39 99.62/33.39 99.60/33.39  [6] Lake 99.52/34.40 99.51/34.41 99.51/34.41 99.51/34.41 Goldhill 99.56/34.31 99.59/34.36 99.59/34.36 99.56/34.36 Lena 99.54/34.67 99.55/34.64 99.54/34.68 99.54/34.66  [31] Lake 99.61/33.48 99.60/33.53 99.59/33.55 99.61/33.48 Goldhill 99.60/33.53 99.58/33.52 99.60/33.55 99.61/33.49 Lena 99.61/33.51 99.60/33.48 99.60/33.61 99.58/33.58For space limitation, we only present a typical visual result. In the experiment, we change the pixel of Lena in the coordinate (1, 1) (its value is changed from 169 to 170) to generate the modified Lena and encrypt it with the same key. The encryption result is shown in Figure13(a). The difference image between Figure 13(a) and the original encrypted result of the Lena is shown in Figure 13(b). From the result, it is observed that even if input image is slightly changed, our encryption result will be greatly changed. This indicates that our algorithm is highly sensitive to pixel change. Therefore, our algorithm can resist differential attack.Figure 13
Visual result of differential attack.
(a)
Encryption result of the modified Lena (b)
Difference between (a) and the original encrypted LenaAccording to Kerckhoffs’s principle [45], a successful cryptanalysis should accurately estimate secret keys (equivalent to recovering plaintext). For chosen plaintext attack, attacker can choose some specific plaintexts to calculate their corresponding ciphertexts. In practice, differential attack analysis is the most common way to achieve the chosen plaintext attack [18]. As well-known, diffusion technique can ensure security of a cryptographic algorithm against the chosen-plaintext attack [18]. To resist this attack, in this paper, we achieve diffusion by using content-based keys to control the Lü chaotic map for changing pixel values. In addition, we exploit double spiral scans to randomly scramble pixel positions. These techniques ensure that it is difficult to observe useful trace between secret keys and plaintext/ciphertext. This means that correct key estimation is almost impossible in practice. Therefore, the chosen-plaintext attack is impractical for our algorithm.


## 4.7. Robustness Test

To evaluate robustness performance of our algorithm, we attack many encrypted images with operations of salt & pepper noise and block missing, respectively. It is found that our algorithm can efficiently restore the decrypted images from the attacked encrypted images. For space limitation, typical examples are presented here. Firstly, we add salt & pepper noise with different densities (i.e., 0.01, 0.05, and 0.10) to the encrypted version of Lena (as shown in Figure6(a)), decrypt the attacked encrypted images, and then obtain the decrypted images as shown in Figure 14. It can be observed that image noises are randomly distributed in the decrypted images and image qualities of the decrypted images gradually decrease with the increase of noise density. Secondly, we remove image blocks with different sizes from the encrypted version of Lena to generate the attacked encrypted versions as shown in Figure 15. We decrypt these attacked encrypted images and obtain the recovered results as shown in Figure 16. It is found that when the size of the missing block is small (e.g., 40 × 40), visual quality of the recovered image is good and the recovered image is almost the same as its original image. As the block size becomes large (e.g., 128 × 512), visual quality of the decrypted image decreases. But the appearance of the original image can be easily recognized from the decrypted image. From the above results, it can be concluded that our algorithm is robust against salt & pepper noise attack and block missing.Figure 14
Decrypted images under the attack of salt and pepper noise with different densities.
(a)
Density is 0.01 (b)
Density is 0.05 (c)
Density is 0.10Figure 15
Encrypted images with block missing.
(a)
40 × 40 block (b)
100 × 140 block (c)
128 × 512 blockFigure 16
Decrypted images with block missing.
(a)
40 × 40 block missing (b)
100 × 140 block missing (c)
128 × 512 block missing


## 4.8. Computational Time Evaluation

To compare computational time, we exploit the assessed algorithms to encrypt the six test images, i.e., Lena, Fingerprint, Woman, Lake, Goldhill, and ChestXray, and record the running time of each algorithm. All algorithms are implemented with MATLAB R2014a and run on a computer with 3.4 GHz Intel Core i5-3570 CPU and 4.0 GB RAM. Table6 presents computational time comparison among different algorithms. It is observed that our algorithm runs faster than the compared algorithms [6, 25, 31]. The fast speed of our algorithm is mainly contributed by the low complexity of double spiral scans.Table 6
Computational time comparison among different algorithms (unit: second).
Algorithm Lena Fingerprint Woman Lake Goldhill ChestXray [6] 4.601 2.350 4.065 4.059 5.747 4.444 [25] 7.788 2.984 5.838 13.098 12.231 7.782 [31] 4.821 2.718 5.774 6.514 4.382 5.219 Our 2.792 1.755 3.264 3.860 3.759 2.100


## 5. Conclusions

In this paper, we have proposed an image encryption algorithm based on double spiral scans and chaotic maps. A key contribution is the double spiral scans, which can efficiently scramble pixels of image block. Moreover, content-based keys are generated and used to control the Lü chaotic system, so as to ensure our sensitivity to the change of input image. Many experiments have been done and the results have illustrated that our algorithm has good encryption performance and outperforms some popular image encryption algorithms.



---

*Source: 8694678-2019-01-15.xml*