# An Intragroup and Intergroup Multiple Secret Images’ Sharing Scheme with Each Participant Holding One Shadow Image

Authors: Jiayu Wang; Xuehu Yan; Jia Chen; Yongqiang Yu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

In some particular situations, participants need to recover different secrets both within a group (i.e., intragroup) and between two groups (i.e., intergroup). However, most of the existing multilevel secret sharing (MLSS) and multigroup secret sharing (MGSS) schemes mainly focus on how to protect a secret between one or more groups. In this paper, we propose a polynomial-based scheme to share multiple secret images both within a group and between groups. The random elements’ utilization model of integer linear programming is used to find polynomial coefficients that meet certain conditions so that each participant holds only one shadow image and some of them can recover secrets of both intergroup and intragroup. In addition, our scheme based on polynomials has the advantage of low computational complexity. Theoretical analysis and experiments show that the proposed scheme is feasible and effective.


---

## Body

## 1. Introduction

With the popularization of digital media technology, the transmission of information is more and more convenient and fast. At the same time, many malicious participants appear on the network to intercept or tamper with the information. So how to safely transmit secret information has become a problem of increasing concern. With the development of cloud technology, more and more attention has been paid to information security, especially image security. The secret image sharing (SIS) technique is an excellent way to keep secret images secure among specific participants.Thek,n threshold SS scheme was firstly proposed by Adi [1] and Blakley [2], respectively. In Shamir’s scheme, the secret is shared into n shadow images and distributed to n participants. At least k participants are needed to recover the secret, while less than k participants cannot obtain any information of the secret. The Lagrange interpolation method is used to recover the secret. The SS scheme based on polynomial can be applied to SIS for grayscale images and color images.The technology of visual cryptography (VC) has gradually developed as digital images are used more and more widely in daily life. This technique is also known as visual secret sharing (VSS). The visual cryptography scheme was first proposed by Noar and Shamir [3] in 1995. In their scheme, the secret can be revealed by a human visual system without any cryptographic computations, and the scheme is very useful when there is no lightweight computation device. The secret image can be recovered by stacking shares, and when the computation device is available, we can also choose the XOR operation to recover the secret image in a lossless manner [4, 5]. At present, the research on VC is mainly divided into basis matrix based [3, 6, 7] and random grid based [8–10]. However, the image quality recovered by this scheme is poor [11], so we choose a polynomial-based scheme as our scheme.In 2002, Thien and Lin [12] firstly applied the polynomial-based SS technique to SIS. In their scheme, instead of setting the coefficients to be random, they embedded the secret image pixel values into all the coefficients. In order to avoid information leakage, the scheme permuted the secret image. Later, many people studied the polynomial-based SIS (PSIS) scheme from different perspectives. Li et al. [13] proposed an SIS scheme using derivative polynomial and Birkhoff interpolation. Kanso and Ghebleh [14] improved Thien and Lin’s [12] scheme by cyclically shifting the bits of the secret image; and there are some studies on essential SIS [15–17].In some practical application scenarios, secret recovery requires a hierarchical limit of participants. Some multilevel secret sharing (MLSS) schemes were proposed [18–20]. The MLSS schemes are also called schemes with hierarchical threshold access structure. In MLSS, shares are divided into different levels. Shadow images of different levels will reach different thresholds to recover the secret image. Guo et al. [21] proposed an MLSS scheme based on Tassa’s [18] hierarchical SIS scheme. Pakniat et al. [22] improved the security of the scheme proposed by Guo et al.For sharing secrets in groups, there are lots of multigroup secret sharing (MGSS) schemes. Li et al. [23] proposed a threshold MGSS scheme based on the Chinese Remainder Theorem (CRT). In their scheme, secrets of multiple groups are packed into a group of large secrets and shared with participants. Wu et al. [24] proposed a hierarchical SIS scheme with multigroup joint management. In their scheme, participants in different groups have to meet different threshold conditions to recover the secret, while all of the shadow images have the same weight. Meng et al. [25] proposed an MGSS scheme without hierarchy. A secret is shared between groups and all the participants are equal. A tightly coupled SS scheme proposed by Meng et al. can resist illegal participant attacks and share capture attacks.However, all of the above schemes mainly focus on how to keep one secret image secure between one or more groups. Yang et al. [26] proposed a multiple secret images sharing (MSIS) scheme between multiple groups for the first time. They constructed a base matrix to embed the information of multiple secret images into the coefficients of m polynomials. However, participants in their scheme are required to hold more than one shadow image.In practical applications, a participant may need to participate in intragroup and intergroup SS. Holding multiple shadow images is not convenient for the distribution and transmission of the shadow images. Consider the following application scenario. In the professional field, often some experts’ research fields are crossed, and the number of experts in some fields is limited. Two groups of engineering designers have designed two kinds of products, respectively, and each of the two teams holds a draft of a product. At the same time, some members of the first group work with some members of the second group to design a third product. In this case, intragroup designers should be able to restore their own group’s draft; intergroup designers working on two products should be able to restore both drafts. The intragroup recovery and the intergroup recovery should be distinct. Designers working on only one product cannot restore the intergroup secret image.In order to realize MSIS within one group and between groups and to transmit and save shadow images more conveniently in practical application, we propose an intragroup and intergroup MSIS scheme with each participant holding one shadow image. Our scheme is based on the polynomial; and we use the random elements utilization model to screen the coefficients of the sharing polynomial. The coefficients satisfying the condition can be solved by solving the matrix equation. The contributions of our work are as follows:(1)
Multiple secret images can be shared within a group and between groups(2)
Each participant holds only one shadow image(3)
Our scheme has low computational complexityThe structure of this paper is as follows. In Section2, we present the PSIS scheme and the concepts of intragroup and intergroup SIS. In Section 3, we describe the sharing and restoring processes of the proposed scheme in detail and take the value of a pixel as an example to illustrate the scheme. Related theoretical analyses are given in Section 4. In Section 5, we present the experimental results and comparison. Finally, conclusions are drawn in Section 6.


## 2. Preliminaries

In this section, we review the PSIS scheme and then introduce the concepts of intragroup and intergroup SIS.


### 2.1. Polynomial-Based SIS Scheme

Shamir proposed ak,n threshold secret sharing scheme based on the polynomial and it can be applied to SIS. The PSIS scheme shares a secret image into n shadow images and distributes them to n participants. When k or more participants participate in the recovery, the secret image can be recovered. The specific implementation principle is as follows. For secret a0, construct a polynomial in equation (1). a1,a2,…,ak−1 are random numbers taken in the prime number field p, and all operations are carried out in the field of GFp. The value of fx is the value of the shadow pixel.(1)fx=a0+a1x+a2x2+⋯+ak−1xk−1mod¯p.When recovering the secret, at leastk participants are needed, for there are k unknown coefficients and we need k equations. The Lagrange interpolation method shown in (2) is used to recover the secret xi≠xj,i,j=1,2,…,n. The secret can be recovered by calculating a0=f0.(2)fx=∑i=1kfxi∏j=1,j≠ikx−xjxi−xjmod¯p.In the PSIS scheme, the influence of the coefficient value on the shadow image can be seen intuitively. In order to screen the coefficients more intuitively and find the appropriate combination of coefficients in the solution space, we adopted the PSIS scheme. We can list the conditions that need to be satisfied for the coefficients of the polynomial and solve the matrix equation to find the values of the coefficients. What is more, we choose to operate on the field ofGF251, for it has low computational complexity. However, the pixel value between 251 and 255 is changed to 250, and the scheme is lossy.


### 2.2. Intragroup and Intergroup SIS

As mentioned in the application scenario, the secret recovery involves recovering the secret across groups. Intragroup SIS means sharing and recovering a secret image within a group; intergroup SIS means sharing and recovering a secret image between two groups.In our scheme, there is no hierarchy between the groups or the participants. There are two groups in our scheme. Every participant can participate in the intragroup secret recovery of his own group, and some predetermined participants can participate in the intergroup secret recovery.Participants who are authorized to participate in the intergroup secret recovery can participate in the recovery of two different secret images with the one shadow image in their hands. Participants within one group cannot recover intergroup secrets, and participants without permissions cannot participate in the intergroup secret recovery. Secret recovery within one group and that between groups do not affect each other.Take the intragroup (3, 4) and intergroup (4, 4) thresholds scheme as an example.P1,P2,P3,P4 in G1 can participate in the recovery of S1; P5,P6,P7,P8 in G2 can participate in the recovery of S2; P1,P2,P5,P6 can participate in the recovery of S1,2. The relationship between the participants and the groups is shown in Figure 1.Figure 1
The relationship between the participants and the groups.


## 2.1. Polynomial-Based SIS Scheme

Shamir proposed ak,n threshold secret sharing scheme based on the polynomial and it can be applied to SIS. The PSIS scheme shares a secret image into n shadow images and distributes them to n participants. When k or more participants participate in the recovery, the secret image can be recovered. The specific implementation principle is as follows. For secret a0, construct a polynomial in equation (1). a1,a2,…,ak−1 are random numbers taken in the prime number field p, and all operations are carried out in the field of GFp. The value of fx is the value of the shadow pixel.(1)fx=a0+a1x+a2x2+⋯+ak−1xk−1mod¯p.When recovering the secret, at leastk participants are needed, for there are k unknown coefficients and we need k equations. The Lagrange interpolation method shown in (2) is used to recover the secret xi≠xj,i,j=1,2,…,n. The secret can be recovered by calculating a0=f0.(2)fx=∑i=1kfxi∏j=1,j≠ikx−xjxi−xjmod¯p.In the PSIS scheme, the influence of the coefficient value on the shadow image can be seen intuitively. In order to screen the coefficients more intuitively and find the appropriate combination of coefficients in the solution space, we adopted the PSIS scheme. We can list the conditions that need to be satisfied for the coefficients of the polynomial and solve the matrix equation to find the values of the coefficients. What is more, we choose to operate on the field ofGF251, for it has low computational complexity. However, the pixel value between 251 and 255 is changed to 250, and the scheme is lossy.


## 2.2. Intragroup and Intergroup SIS

As mentioned in the application scenario, the secret recovery involves recovering the secret across groups. Intragroup SIS means sharing and recovering a secret image within a group; intergroup SIS means sharing and recovering a secret image between two groups.In our scheme, there is no hierarchy between the groups or the participants. There are two groups in our scheme. Every participant can participate in the intragroup secret recovery of his own group, and some predetermined participants can participate in the intergroup secret recovery.Participants who are authorized to participate in the intergroup secret recovery can participate in the recovery of two different secret images with the one shadow image in their hands. Participants within one group cannot recover intergroup secrets, and participants without permissions cannot participate in the intergroup secret recovery. Secret recovery within one group and that between groups do not affect each other.Take the intragroup (3, 4) and intergroup (4, 4) thresholds scheme as an example.P1,P2,P3,P4 in G1 can participate in the recovery of S1; P5,P6,P7,P8 in G2 can participate in the recovery of S2; P1,P2,P5,P6 can participate in the recovery of S1,2. The relationship between the participants and the groups is shown in Figure 1.Figure 1
The relationship between the participants and the groups.


## 3. The Proposed Scheme

In this section, we propose an intragroup and intergroup SIS scheme with each participant holding one shadow image. Secret images are shared into multiple shadow images by the random elements utilization model. Participants who can participate in the recovery of the secret between groups are identified in advance.A participant who is authorized to participate in intergroup secret recovery can recover the intergroup secret together with other participants according to the shadow image he holds; he could use the same shadow image to recover the group’s secret image with the intragroup participants. Intragroup and intergroup secrets are different and independent. Participants who do not have permission to participate in intergroup secret recovery have no access to get the intergroup secret image; they can only recover the intragroup secret together with intragroup participants. Those who participate in the secret image recovery within their own group are called local participants, while those who participate in the secret recovery between groups are called shared participants. The meanings of each symbol are shown in Table1. The process of sharing and restoring is shown in Figure 2.Table 1
Meanings of the symbols.
SymbolMeaningGii=1,2Group 1, Group 2Pii=1,…,n1+n2The participantxi,yi,ziThe order number ofPiSCii=1,…,n1+n2The shadow image held byPiSii=1,2The intragroup secret image ofGiS1,2The intergroup secret image of Group 1 and Group 2Si′i=1,2The recovered intragroup secret image ofGiS1,2′The recovered intergroup secret image of Group 1 and Group 2ki,nii=1,2The threshold of intragroup SIS ofGik3,n3The threshold of intergroup SIS of Group 1 and Group 2a0A pixel value ofS1b0A pixel value ofS2c0A pixel value ofS1,2Figure 2
The flowchart of our proposed scheme.


### 3.1. The Sharing Phase

The sharing process is based on the PSIS scheme proposed by Shamir. The random elements utilization model is used to screen the polynomial coefficients that satisfy specific conditions. All the following operations are performed in the field ofGF251. Assume that the size of the secret image is A×B. The steps are shown in Algorithm 1.Algorithm 1:The shadow image generation process of SIS within one group and between groups.
Input: the secret imagesS1,S2,S1,2 and the order numbers of the participants xii=1,2,…,n1+n2Output: the shadow imagesSCii=1,2,…,n1+n2Step 1: repeat Steps 2–7 for each pixel of the secret imagesS1a,b,S2a,b, and S1,2a,b, where a,b∈a,b|1≤a≤A,1≤b≤BStep 2: write the polynomial expressions for SIS within and between groupsStep 3: find the equations that the sharing coefficients need to satisfyStep 4: count the variablesk1+k2+k3−3 and the number of equations that need to be satisfied n3Step 5: pickn3−k1+k2+k3−3 coefficients randomly and assign them to a random number between 0 and 250Step 6: use the inverse matrix method to solve the system and find the values of the remaining unspecified coefficientsStep 7: calculate the values of the shadow pixel based on the sharing polynomial, in which the polynomial coefficients are knownFor the shared participants, the shadow images obtained by this method satisfy both the intragroup sharing polynomials and the intergroup sharing polynomials. As a result, a shared participant can join in the intragroup and intergroup secret recovery with the same shadow image. It is worth noting that the shared participants are assigned in advance.To find a suitable combination of the coefficients, the brute-force cracking method can be used, in which we traverse the solution space for all possible values until we find a solution that satisfies the condition. Obviously, this algorithm has high time complexity. We adopt the random elements utilization model of integer linear programming and find the solution by multiplying inverse matrix, and the calculation efficiency is greatly improved.


### 3.2. The Recovery Phase

In the recovery phase, we adopt Lagrangian interpolation to obtain the pixel values of the secret images. At leastk1k2 local participants in G1G2 are required to recover S1S2; at least k3 shared participants between G1 and G2 are required to recover S1,2. The steps are shown in Algorithm 2.Algorithm 2:The recovery process of the SIS within one group and between groups.
Input: the shadow imagesSCii=1,2,…,n1+n2, the order numbers of the participants xii=1,2,…,n1+n2 and the order numbers of the authorized shared participants.Output: the recovered imagesS1′,S2′,S1,2′Step 1: determine the shadow images participating in the recovery ofS1,S2,S1,2, respectively.Step 2: repeat Steps 3 and 4 for each pixel of the corresponding shadow images in each group.SCia,bi=1,…,n1SCia,bi=n1+1,…,n2 are used to recover S1S2; intergroup shadow images are used to recover S1,2, where a,b∈a,b|1≤a≤A,1≤b≤B.Step 3: calculatefx in the field of GF251 by the Lagrange interpolation formula fx=∑i=1kfxi∏j=1,j≠ikx−xj/xi−xj.Step 4: setx=0 to calculate the recovered secret pixel value in each group.Step 5: output the recovered imagesS1′,S2′,S1,2′.When recovering the intergroup secret image, we require a dealer to collect shadow images from participants and recover the secret image. This is to prevent intergroup participants from gaining access to intragroup secret information of the other group. For example, intergroup participants inG1 cannot obtain the shadow image of participants in G2.


### 3.3. An Example of a Pixel

In this section, we give an example of the sharing and recovery processes of a pixel.a0 is the value of a pixel in S1, b0 is the pixel value of the corresponding position in S2, and c0 is the pixel value of the corresponding position in S1,2. The secret pixel values are a0,b0,c0=123,135,146. Intragroup (3, 4) and intergroup (4, 4) thresholds are assumed. P1,P2,P3,P4 are the local participants in G1 and P5,P6,P7,P8 are the local participants in G2. We designate that P1,P2,P5,P6 can participate in the recovery of secret images between groups in advance. The order numbers of P1,P2,P3,P4,P5,P6,P7,P8 are 1,2,3,4,5,6,7,8, that is, x1=1,x2=2,x3=3,x4=4,y1=5,y2=6,y3=7,y4=8. The sharing polynomials of the secret images are shown as follows:(3)S1f1x1=a0+a1x1+a2x12mod251,f1x2=a0+a1x2+a2x22mod251,f1x3=a0+a1x3+a2x32mod251,f1x4=a0+a1x4+a2x42mod251,S2f2y1=b0+b1y1+b2y12mod251,f2y2=b0+b1y2+b2y22mod251,f2y3=b0+b1y3+b2y32mod251,f2y4=b0+b1y4+b2y42mod251,S1,2f3z1=c0+c1z1+c2z12+c3z13mod251,f3z2=c0+c1z2+c2z22+c3z23mod251,f3z3=c0+c1z3+c2z32+c3z33mod251,f3z4=c0+c1z4+c2z42+c3z43mod251,where z1,z2,z3,z4 represent the order numbers of the participants of the intergroup, which are the same as the order numbers of the selected participants from G1 and G2.The polynomial coefficients need to satisfy (4). The random elements utilization model of integer linear programming is shown in equation (5).(4)a0+a1x1+a2x12≡c0+c1x1+c2x12+c3x13mod251,a0+a1x2+a2x22≡c0+c1x2+c2x22+c3x23mod251,b0+b1y1+b2y12≡c0+c1y1+c2y12+c3y13mod251,b0+b1y2+b2y22≡c0+c1y2+c2y22+c3y23mod251,(5)s.t.f1xi=f3xi,i=1,2f2yi=f3yi,i=1,2,al,bm,cn∈z,al,bm,cn∈0,250,l=1,2,m=1,2,n=1,2,3.There are four equations and seven variables. We choose to assign values for37−4=3 variables: c1,c2,c3. The values assigned are randomly selected between 0 and 250 and the result is c1,c2,c3=35,163,5. After c1,c2, and c3 are determined as constants, we can obtain (6) by placing the constant terms in the equation on one side and obtain (7) by putting the values of the parameters into the equation and writing it in matrix form.(6)a1x1+a2x12≡−a0+c0+c1x1+c2x12+c3x13mod251,a1x2+a2x22≡−a0+c0+c1x2+c2x22+c3x23mod251,b1y1+b2y12≡−b0+c0+c1y1+c2y12+c3y13mod251,b1y2+b2y22≡−b0+c0+c1y2+c2y22+c3y23mod251,(7)110024000052500636a1a2b1b2=22632117141.In equation (7), we can multiply both sides of the equation by the inverse of the coefficient matrix on the left-hand side, and we get that the values of a1,a2,b1,b2 are 185,41,48,226. So far, we have determined all the coefficients of the sharing polynomial. We can get the value of the shadow pixels by putting the values of the coefficients and the order numbers of the participants into equation (3). The results are as follows: the shadow pixel values of G1 are 98,155,43,13 and the shadow pixel values of G2 are 1,25,250,174.When recovering the secrets, we use the Lagrange interpolation method. We choseP2,P3,P4 to recover a0, P6,P7,P8 to recover b0, and P1,P2,P5,P6 to recover c0. The results are 123,135,146, which are equal to a0,b0,c0, respectively.


## 3.1. The Sharing Phase

The sharing process is based on the PSIS scheme proposed by Shamir. The random elements utilization model is used to screen the polynomial coefficients that satisfy specific conditions. All the following operations are performed in the field ofGF251. Assume that the size of the secret image is A×B. The steps are shown in Algorithm 1.Algorithm 1:The shadow image generation process of SIS within one group and between groups.
Input: the secret imagesS1,S2,S1,2 and the order numbers of the participants xii=1,2,…,n1+n2Output: the shadow imagesSCii=1,2,…,n1+n2Step 1: repeat Steps 2–7 for each pixel of the secret imagesS1a,b,S2a,b, and S1,2a,b, where a,b∈a,b|1≤a≤A,1≤b≤BStep 2: write the polynomial expressions for SIS within and between groupsStep 3: find the equations that the sharing coefficients need to satisfyStep 4: count the variablesk1+k2+k3−3 and the number of equations that need to be satisfied n3Step 5: pickn3−k1+k2+k3−3 coefficients randomly and assign them to a random number between 0 and 250Step 6: use the inverse matrix method to solve the system and find the values of the remaining unspecified coefficientsStep 7: calculate the values of the shadow pixel based on the sharing polynomial, in which the polynomial coefficients are knownFor the shared participants, the shadow images obtained by this method satisfy both the intragroup sharing polynomials and the intergroup sharing polynomials. As a result, a shared participant can join in the intragroup and intergroup secret recovery with the same shadow image. It is worth noting that the shared participants are assigned in advance.To find a suitable combination of the coefficients, the brute-force cracking method can be used, in which we traverse the solution space for all possible values until we find a solution that satisfies the condition. Obviously, this algorithm has high time complexity. We adopt the random elements utilization model of integer linear programming and find the solution by multiplying inverse matrix, and the calculation efficiency is greatly improved.


## 3.2. The Recovery Phase

In the recovery phase, we adopt Lagrangian interpolation to obtain the pixel values of the secret images. At leastk1k2 local participants in G1G2 are required to recover S1S2; at least k3 shared participants between G1 and G2 are required to recover S1,2. The steps are shown in Algorithm 2.Algorithm 2:The recovery process of the SIS within one group and between groups.
Input: the shadow imagesSCii=1,2,…,n1+n2, the order numbers of the participants xii=1,2,…,n1+n2 and the order numbers of the authorized shared participants.Output: the recovered imagesS1′,S2′,S1,2′Step 1: determine the shadow images participating in the recovery ofS1,S2,S1,2, respectively.Step 2: repeat Steps 3 and 4 for each pixel of the corresponding shadow images in each group.SCia,bi=1,…,n1SCia,bi=n1+1,…,n2 are used to recover S1S2; intergroup shadow images are used to recover S1,2, where a,b∈a,b|1≤a≤A,1≤b≤B.Step 3: calculatefx in the field of GF251 by the Lagrange interpolation formula fx=∑i=1kfxi∏j=1,j≠ikx−xj/xi−xj.Step 4: setx=0 to calculate the recovered secret pixel value in each group.Step 5: output the recovered imagesS1′,S2′,S1,2′.When recovering the intergroup secret image, we require a dealer to collect shadow images from participants and recover the secret image. This is to prevent intergroup participants from gaining access to intragroup secret information of the other group. For example, intergroup participants inG1 cannot obtain the shadow image of participants in G2.


## 3.3. An Example of a Pixel

In this section, we give an example of the sharing and recovery processes of a pixel.a0 is the value of a pixel in S1, b0 is the pixel value of the corresponding position in S2, and c0 is the pixel value of the corresponding position in S1,2. The secret pixel values are a0,b0,c0=123,135,146. Intragroup (3, 4) and intergroup (4, 4) thresholds are assumed. P1,P2,P3,P4 are the local participants in G1 and P5,P6,P7,P8 are the local participants in G2. We designate that P1,P2,P5,P6 can participate in the recovery of secret images between groups in advance. The order numbers of P1,P2,P3,P4,P5,P6,P7,P8 are 1,2,3,4,5,6,7,8, that is, x1=1,x2=2,x3=3,x4=4,y1=5,y2=6,y3=7,y4=8. The sharing polynomials of the secret images are shown as follows:(3)S1f1x1=a0+a1x1+a2x12mod251,f1x2=a0+a1x2+a2x22mod251,f1x3=a0+a1x3+a2x32mod251,f1x4=a0+a1x4+a2x42mod251,S2f2y1=b0+b1y1+b2y12mod251,f2y2=b0+b1y2+b2y22mod251,f2y3=b0+b1y3+b2y32mod251,f2y4=b0+b1y4+b2y42mod251,S1,2f3z1=c0+c1z1+c2z12+c3z13mod251,f3z2=c0+c1z2+c2z22+c3z23mod251,f3z3=c0+c1z3+c2z32+c3z33mod251,f3z4=c0+c1z4+c2z42+c3z43mod251,where z1,z2,z3,z4 represent the order numbers of the participants of the intergroup, which are the same as the order numbers of the selected participants from G1 and G2.The polynomial coefficients need to satisfy (4). The random elements utilization model of integer linear programming is shown in equation (5).(4)a0+a1x1+a2x12≡c0+c1x1+c2x12+c3x13mod251,a0+a1x2+a2x22≡c0+c1x2+c2x22+c3x23mod251,b0+b1y1+b2y12≡c0+c1y1+c2y12+c3y13mod251,b0+b1y2+b2y22≡c0+c1y2+c2y22+c3y23mod251,(5)s.t.f1xi=f3xi,i=1,2f2yi=f3yi,i=1,2,al,bm,cn∈z,al,bm,cn∈0,250,l=1,2,m=1,2,n=1,2,3.There are four equations and seven variables. We choose to assign values for37−4=3 variables: c1,c2,c3. The values assigned are randomly selected between 0 and 250 and the result is c1,c2,c3=35,163,5. After c1,c2, and c3 are determined as constants, we can obtain (6) by placing the constant terms in the equation on one side and obtain (7) by putting the values of the parameters into the equation and writing it in matrix form.(6)a1x1+a2x12≡−a0+c0+c1x1+c2x12+c3x13mod251,a1x2+a2x22≡−a0+c0+c1x2+c2x22+c3x23mod251,b1y1+b2y12≡−b0+c0+c1y1+c2y12+c3y13mod251,b1y2+b2y22≡−b0+c0+c1y2+c2y22+c3y23mod251,(7)110024000052500636a1a2b1b2=22632117141.In equation (7), we can multiply both sides of the equation by the inverse of the coefficient matrix on the left-hand side, and we get that the values of a1,a2,b1,b2 are 185,41,48,226. So far, we have determined all the coefficients of the sharing polynomial. We can get the value of the shadow pixels by putting the values of the coefficients and the order numbers of the participants into equation (3). The results are as follows: the shadow pixel values of G1 are 98,155,43,13 and the shadow pixel values of G2 are 1,25,250,174.When recovering the secrets, we use the Lagrange interpolation method. We choseP2,P3,P4 to recover a0, P6,P7,P8 to recover b0, and P1,P2,P5,P6 to recover c0. The results are 123,135,146, which are equal to a0,b0,c0, respectively.


## 4. Theoretical Analysis

In this section, we give the feasibility and security analysis of the proposed scheme and give the conditions for each parameter to be satisfied.


### 4.1. Feasibility and Security Analysis

#### 4.1.1. Feasibility Analysis

The following details are the sharing process of one pixel.a0,b0,c0 are the secret pixels to be shared. The three pixels are shared into shadow image pixels as shown in (8)–(10):(8)S1f1x1=a0+a1x1+⋯+ak1−1x1k1−1mod251,f1x2=a0+a1x2+⋯+ak1−1x2k1−1mod251,⋮f1xn1=a0+a1xn1+⋯+ak1−1xn1k1−1mod251,(9)S2f2y1=b0+b1y1+⋯+bk2−1y1k2−1mod251,f2y2=b0+b1y2+⋯+bk2−1y2k2−1mod251,⋮f2yn2=b0+b1yn2+⋯+bk2−1yn2k2−1mod251,(10)S1,2f3z1=c0+c1z1+⋯+ck3−1z1k3−1mod251,f3z2=c0+c1z2+⋯+ck3−1z2k3−1mod251,⋮f3zn3=c0+c1zn3+⋯+ck3−1zn3k3−1mod251.In the basic sharing scheme, the polynomial coefficients are random. We use the randomness to make the coefficients meet certain conditions, so that the shadow images can carry more information. The shadow pixel value held by local participants inG1 participating in intergroup secret sharing shall satisfy equations (8) and (10), while the shadow pixel value held by local participants in G2 participating in intergroup secret sharing shall satisfy equations (9) and (10). So, the coefficients shall satisfy equation (11). The random elements utilization model of integer linear programming is shown in equation (12).(11)a0+a1x1+⋯+ak1−1x1k1−1≡c0+c1x1+⋯+ck3−1x1k3−1mod251,a0+a1x2+⋯+ak1−1x2k1−1≡c0+c1x2+⋯+ck3−1x2k3−1mod251,⋮b0+b1xn3−1+⋯+bk2−1xn3−1k2−1≡c0+c1xn3−1+⋯+ck3−1xn3−1k3−1mod251,b0+b1xn3+⋯+bk2−1xn3k2−1≡c0+c1xn3+⋯+ck3−1xn3k3−1mod251,(12)s.t.f1xi=f3xi,f2yi=f3yi,i=1,2,…,n3,xi,yi∈Zxi,yi∈0,250,al,bm,cn∈Z,al,bm,cn∈0,250,l=1,2,…,k1−1,m=1,2,…,k2−1,n=1,2,…,k3−1.We write equation (11) as matrix multiplication, as shown in the following equation:(13)x1x12…x1k1−100…0−x1−x12…−x1k3−1x2x22…x2k1−100…0−x2−x22…−x2k3−1⋮00…0xn3xn32…xn3k2−1−xn3−xn32…−xn3k3−1a1a2⋮ak1−1b1b2⋮bk2−1c1c2⋮ck3−1=c0−a0c0−a0⋮c0−b0.There aren3 equations and k1+k2+k3−3 variables in the system k1+k2+k3−3≥n3. Each coefficient has 251 possible values. The size of the solution space is 251k1+k2+k3−3−n3. We pick k1+k2+k3−3−n3 coefficients at random and assign them to a random number between 0 and 250. Then the system has a unique solution, and we can use the matrix inverse method to solve for the coefficients. According to the coefficients we get, we can get the shadow image pixel value that satisfies our requirements. After the sharing of one pixel, the sharing of the whole image can be completed by traversing all the pixels of the secret image.


#### 4.1.2. Security Analysis

When restoring the secret image within a group, less thank1k2 participants could not recover S1S2; when restoring the secret image between groups, less than k3 participants could not recover S1,2.Participants without permission cannot participate in the intergroup secret recovery, and even if they do, they cannot recover the secret information. The reason is that the coefficients are calculated according to the order numbers of the legal participants, and if an unauthorized participant participates in the recovery, the Lagrange interpolation method will not be able to recover the true secret.There is no information leakage when the shared participants recover the intergroup secret image, for all the shadow images are sent to the dealer. A shared participant cannot get access to the shadow image of the other group.


### 4.2. Parametric Constraint

k1+k2+k3−3≥n3. For secret sharing between groups, the number of equations that the coefficients need to satisfy is n3. When sharing a pixel, the sharing polynomial of S1S2 has k1−1k2−1 variable coefficients; the sharing polynomial of S1,2 has k3−1 variable coefficients. The total number of variable coefficients is shown in the following equation:(14)k1−1+k2−1+k3−1=k1+k2+k3−3.In order for the solution space not to be empty, the number of variables should be greater than or equal to the number of equations (i.e.,k1+k2+k3−3≥n3).k3 should be greater than the number of participants in each group who are permitted to join in intergroup secret sharing. This requirement is put forward from a practical point of view. Local participants in each group are able to recover their group’s secret, and shared participants are able to recover the secret between groups. But participants in one group should not have permission to get the intergroup secret. k3 is the minimum number of participants to recover the secret between the groups. As a result, k3 should be greater than the number of participants in each group who are allowed to join in secret sharing between groups.ni≥kii=1,2,3. The polynomial secret sharing scheme requires the threshold number to meet this requirement.n1+n2≥n3. The total number of participants should be greater than or equal to the number of participants in secret sharing between groups.


## 4.1. Feasibility and Security Analysis

### 4.1.1. Feasibility Analysis

The following details are the sharing process of one pixel.a0,b0,c0 are the secret pixels to be shared. The three pixels are shared into shadow image pixels as shown in (8)–(10):(8)S1f1x1=a0+a1x1+⋯+ak1−1x1k1−1mod251,f1x2=a0+a1x2+⋯+ak1−1x2k1−1mod251,⋮f1xn1=a0+a1xn1+⋯+ak1−1xn1k1−1mod251,(9)S2f2y1=b0+b1y1+⋯+bk2−1y1k2−1mod251,f2y2=b0+b1y2+⋯+bk2−1y2k2−1mod251,⋮f2yn2=b0+b1yn2+⋯+bk2−1yn2k2−1mod251,(10)S1,2f3z1=c0+c1z1+⋯+ck3−1z1k3−1mod251,f3z2=c0+c1z2+⋯+ck3−1z2k3−1mod251,⋮f3zn3=c0+c1zn3+⋯+ck3−1zn3k3−1mod251.In the basic sharing scheme, the polynomial coefficients are random. We use the randomness to make the coefficients meet certain conditions, so that the shadow images can carry more information. The shadow pixel value held by local participants inG1 participating in intergroup secret sharing shall satisfy equations (8) and (10), while the shadow pixel value held by local participants in G2 participating in intergroup secret sharing shall satisfy equations (9) and (10). So, the coefficients shall satisfy equation (11). The random elements utilization model of integer linear programming is shown in equation (12).(11)a0+a1x1+⋯+ak1−1x1k1−1≡c0+c1x1+⋯+ck3−1x1k3−1mod251,a0+a1x2+⋯+ak1−1x2k1−1≡c0+c1x2+⋯+ck3−1x2k3−1mod251,⋮b0+b1xn3−1+⋯+bk2−1xn3−1k2−1≡c0+c1xn3−1+⋯+ck3−1xn3−1k3−1mod251,b0+b1xn3+⋯+bk2−1xn3k2−1≡c0+c1xn3+⋯+ck3−1xn3k3−1mod251,(12)s.t.f1xi=f3xi,f2yi=f3yi,i=1,2,…,n3,xi,yi∈Zxi,yi∈0,250,al,bm,cn∈Z,al,bm,cn∈0,250,l=1,2,…,k1−1,m=1,2,…,k2−1,n=1,2,…,k3−1.We write equation (11) as matrix multiplication, as shown in the following equation:(13)x1x12…x1k1−100…0−x1−x12…−x1k3−1x2x22…x2k1−100…0−x2−x22…−x2k3−1⋮00…0xn3xn32…xn3k2−1−xn3−xn32…−xn3k3−1a1a2⋮ak1−1b1b2⋮bk2−1c1c2⋮ck3−1=c0−a0c0−a0⋮c0−b0.There aren3 equations and k1+k2+k3−3 variables in the system k1+k2+k3−3≥n3. Each coefficient has 251 possible values. The size of the solution space is 251k1+k2+k3−3−n3. We pick k1+k2+k3−3−n3 coefficients at random and assign them to a random number between 0 and 250. Then the system has a unique solution, and we can use the matrix inverse method to solve for the coefficients. According to the coefficients we get, we can get the shadow image pixel value that satisfies our requirements. After the sharing of one pixel, the sharing of the whole image can be completed by traversing all the pixels of the secret image.


### 4.1.2. Security Analysis

When restoring the secret image within a group, less thank1k2 participants could not recover S1S2; when restoring the secret image between groups, less than k3 participants could not recover S1,2.Participants without permission cannot participate in the intergroup secret recovery, and even if they do, they cannot recover the secret information. The reason is that the coefficients are calculated according to the order numbers of the legal participants, and if an unauthorized participant participates in the recovery, the Lagrange interpolation method will not be able to recover the true secret.There is no information leakage when the shared participants recover the intergroup secret image, for all the shadow images are sent to the dealer. A shared participant cannot get access to the shadow image of the other group.


## 4.1.1. Feasibility Analysis

The following details are the sharing process of one pixel.a0,b0,c0 are the secret pixels to be shared. The three pixels are shared into shadow image pixels as shown in (8)–(10):(8)S1f1x1=a0+a1x1+⋯+ak1−1x1k1−1mod251,f1x2=a0+a1x2+⋯+ak1−1x2k1−1mod251,⋮f1xn1=a0+a1xn1+⋯+ak1−1xn1k1−1mod251,(9)S2f2y1=b0+b1y1+⋯+bk2−1y1k2−1mod251,f2y2=b0+b1y2+⋯+bk2−1y2k2−1mod251,⋮f2yn2=b0+b1yn2+⋯+bk2−1yn2k2−1mod251,(10)S1,2f3z1=c0+c1z1+⋯+ck3−1z1k3−1mod251,f3z2=c0+c1z2+⋯+ck3−1z2k3−1mod251,⋮f3zn3=c0+c1zn3+⋯+ck3−1zn3k3−1mod251.In the basic sharing scheme, the polynomial coefficients are random. We use the randomness to make the coefficients meet certain conditions, so that the shadow images can carry more information. The shadow pixel value held by local participants inG1 participating in intergroup secret sharing shall satisfy equations (8) and (10), while the shadow pixel value held by local participants in G2 participating in intergroup secret sharing shall satisfy equations (9) and (10). So, the coefficients shall satisfy equation (11). The random elements utilization model of integer linear programming is shown in equation (12).(11)a0+a1x1+⋯+ak1−1x1k1−1≡c0+c1x1+⋯+ck3−1x1k3−1mod251,a0+a1x2+⋯+ak1−1x2k1−1≡c0+c1x2+⋯+ck3−1x2k3−1mod251,⋮b0+b1xn3−1+⋯+bk2−1xn3−1k2−1≡c0+c1xn3−1+⋯+ck3−1xn3−1k3−1mod251,b0+b1xn3+⋯+bk2−1xn3k2−1≡c0+c1xn3+⋯+ck3−1xn3k3−1mod251,(12)s.t.f1xi=f3xi,f2yi=f3yi,i=1,2,…,n3,xi,yi∈Zxi,yi∈0,250,al,bm,cn∈Z,al,bm,cn∈0,250,l=1,2,…,k1−1,m=1,2,…,k2−1,n=1,2,…,k3−1.We write equation (11) as matrix multiplication, as shown in the following equation:(13)x1x12…x1k1−100…0−x1−x12…−x1k3−1x2x22…x2k1−100…0−x2−x22…−x2k3−1⋮00…0xn3xn32…xn3k2−1−xn3−xn32…−xn3k3−1a1a2⋮ak1−1b1b2⋮bk2−1c1c2⋮ck3−1=c0−a0c0−a0⋮c0−b0.There aren3 equations and k1+k2+k3−3 variables in the system k1+k2+k3−3≥n3. Each coefficient has 251 possible values. The size of the solution space is 251k1+k2+k3−3−n3. We pick k1+k2+k3−3−n3 coefficients at random and assign them to a random number between 0 and 250. Then the system has a unique solution, and we can use the matrix inverse method to solve for the coefficients. According to the coefficients we get, we can get the shadow image pixel value that satisfies our requirements. After the sharing of one pixel, the sharing of the whole image can be completed by traversing all the pixels of the secret image.


## 4.1.2. Security Analysis

When restoring the secret image within a group, less thank1k2 participants could not recover S1S2; when restoring the secret image between groups, less than k3 participants could not recover S1,2.Participants without permission cannot participate in the intergroup secret recovery, and even if they do, they cannot recover the secret information. The reason is that the coefficients are calculated according to the order numbers of the legal participants, and if an unauthorized participant participates in the recovery, the Lagrange interpolation method will not be able to recover the true secret.There is no information leakage when the shared participants recover the intergroup secret image, for all the shadow images are sent to the dealer. A shared participant cannot get access to the shadow image of the other group.


## 4.2. Parametric Constraint

k1+k2+k3−3≥n3. For secret sharing between groups, the number of equations that the coefficients need to satisfy is n3. When sharing a pixel, the sharing polynomial of S1S2 has k1−1k2−1 variable coefficients; the sharing polynomial of S1,2 has k3−1 variable coefficients. The total number of variable coefficients is shown in the following equation:(14)k1−1+k2−1+k3−1=k1+k2+k3−3.In order for the solution space not to be empty, the number of variables should be greater than or equal to the number of equations (i.e.,k1+k2+k3−3≥n3).k3 should be greater than the number of participants in each group who are permitted to join in intergroup secret sharing. This requirement is put forward from a practical point of view. Local participants in each group are able to recover their group’s secret, and shared participants are able to recover the secret between groups. But participants in one group should not have permission to get the intergroup secret. k3 is the minimum number of participants to recover the secret between the groups. As a result, k3 should be greater than the number of participants in each group who are allowed to join in secret sharing between groups.ni≥kii=1,2,3. The polynomial secret sharing scheme requires the threshold number to meet this requirement.n1+n2≥n3. The total number of participants should be greater than or equal to the number of participants in secret sharing between groups.


## 5. Experiment and Comparison

In this section, we give three examples. The first example realizes the secret sharing of the intragroup2,3 thresholds and intergroup 3,3 thresholds, the second example realizes the secret sharing of the intragroup 2,4 thresholds and intergroup 3,3 thresholds, and the third example realizes the secret sharing of the intragroup 3,4 thresholds and intergroup 4,4 thresholds. In Section 5.1, the feasibility of the scheme is verified; in Section 5.2, the experimental analysis is given; and in Section 5.3, we compare our scheme with other secret sharing schemes within one group and between groups.


### 5.1. Introduction of the Experiment

#### 5.1.1. Experiment One

In the first experiment, we realized the SIS of the intragroup2,3 thresholds and intergroup 3,3 thresholds. The experimental process is as follows. There are two groups with six participants. There are three local participants P1,P2,P3 in G1 and three local participants P4,P5,P6 in G2. The order numbers of P1,P2,P3,P4,P5,P6 are 1,2,3,4,5,6, respectively; and there are three shared participants P1,P2,P4 in intergroup secret sharing. Each participant has only one shadow image.All participants in their own group can participate in the SIS within the group, and specific participants can participate in the SIS between the groups. In this example,P1,P2,P3 can participate in recovering the secret of G1, P4,P5,P6 can participate in recovering the secret of G2, and P1,P2,P4 can participate in recovering the intergroup secret. When recovering the secret image within the group, at least two local participants are required; when recovering the secret image between groups, all three shared participants are required. The size of the intragroup and intergroup secret images is 256 × 256. The membership is shown in Table 2.Table 2
The membership of the experiment.
ParticipantGroupWhether to participate in intergroup secret sharingP1G1YesP2G1YesP3G1NoP4G2YesP5G2NoP6G2NoThe sharing process is as follows. The intragroup secret image ofG1 is shared into three shadow images by our proposed screening method, and they are distributed to participants P1,P2, and P3. The secret image of G2 is also shared into three shadow images, which are distributed to participants P4,P5, and P6.Figure3 shows the intragroup secret images of G1,G2, the intergroup secret image of G1 and G2, and the shadow images. The secret image of G1 is given in Figure 3(a), and Figures 3(d)～3(f) display the shadow images held by P1,P2, and P3; the secret image of G2 is given in Figure 3(b), and Figures 3(g)～3(i) display the shadow images held by P4,P5, and P6. The intergroup secret images of G1 and G2 are given in Figure 3(c).Figure 3
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. SC1∼SC3 are the shadows of G1. SC4∼SC6 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)When recovering the secret image within a group, at least two participants are required. By using Shamir polynomial scheme, any two ofP1,P2,P3 can recover the secret of G1, and any two of P4,P5,P6 can recover the secret of G2. When recovering intergroup secret, it takes three participants to join in. The secret image can be recovered if all P1,P2,P4 are involved. The recovered secret image is shown in Figure 4.Figure 4
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


#### 5.1.2. Experiment Two

In the second experiment, we realized the SIS of the intragroup2,4 thresholds and intergroup 3,3 thresholds. The membership of the experiment is shown in Table 3. Each of the two groups has four participants P1,P2,P3,P4 in G1, P5,P6,P7,P8 in G2. The order numbers of P1,P2,P3,P4,P5,P6,P7,P8 are 1,2,3,4,5,6,7,8, respectively; and we assigned P1,P4,P7 to participate in the SIS between G1 and G2.Table 3
The membership of the experiment.
ParticipantGroupWhether to participate in intergroup secret sharingP1G1YesP2G1NoP3G1NoP4G1YesP5G2NoP6G2NoP7G2YesP8G2NoThrough our proposed screening method, the secret images ofG1 and G2 are shared into four shadow images, respectively. The intragroup secret images, the intergroup secret image, and the shadow images are shown in Figure 5.Figure 5
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. (j) SC7. (k) SC8. SC1∼SC4 are the shadows of G1. SC5∼SC8 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)When recovering the secret within a group, any two participants can recover the secret image; when recovering the secret between groups, three designated participants are all required to recover the secret image. Any two ofSC1,SC2,SC3,SC4 can recover S1, and any two of SC5,SC6,SC7,SC8 can recover S2. SC1,SC4,SC7 are required to recover S1,2. The images recovered from the shadow images are shown in Figure 6.Figure 6
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


#### 5.1.3. Experiment Three

In the third experiment, we realized the SIS of intragroup3,4 thresholds and intergroup 4,4 thresholds. P1,P2,P3,P4P5,P6,P7,P8 are the local participants of G1G2; and we assigned P1,P2,P5,P6 to participate in the SIS between G1 and G2. The order numbers are the same as those in the second experiment. Three local participants are required to reconstruct the intragroup secret image. Four shared participants participate in intergroup secret sharing and they are all required to reconstruct the secret image.As shown in Figure7, the secret images of G1 and G2 are shared into four shadow images, respectively, by our proposed random elements utilization model.Figure 7
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. (j) SC7. (k) SC8. SC1∼SC4 are the shadows of G1. SC5∼SC8 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)Any three ofSC1,SC2,SC3,SC4 can recover S1, and any three of SC5,SC6, SC7,SC8 can recover S2. SC1,SC2,SC5,SC6 are required to recover S1,2. The images recovered from the shadow images are shown in Figure 8.Figure 8
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


### 5.2. Experimental Analysis

Compared with the first experiment, the intragroup threshold in the second experiment changed from2,3 to 3,3, and the intergroup threshold remained unchanged. The number of shared participants of the two experiments and the structure of the two equation systems are the same. The difference between the two experiments is the number of shadow images in a group, and it does not affect the solution of the system.Compared with the first two experiments, the third experiment has a greater intragroup threshold, which means that there are more variable coefficients in the system. At the same time, the intergroup threshold in the third experiment is greater than those of the first two experiments, which means that there are more restrictions. The threshold parameters in the third experiment satisfy the constraints that need to be satisfied (i.e.,k1=3,k2=3,k3=4,n3=4,k1+k2+k3−3≥n3), so there exists a solution in the system.We use the random elements utilization model to select polynomial coefficients satisfying certain conditions and realize the intragroup and intergroup SIS with each participant holding one shadow image. The experimental results show that the scheme is feasible.


### 5.3. Comparison

In this section, we compare the proposed scheme with other secret sharing schemes within one group and between groups. The comparisons of the main features are shown in Table4.Table 4
Comparisons of the main features.
Guo et al. [21]Pakniat et al. [22]Wu et al. [24]Meng et al. [25]Yang et al.[26]Proposed schemeBased methodPolynomialGF28PolynomialCRTGF28PolynomialNumber of groups112mm2Number of secrets11112m−13The number of shadows held by a participantOneOneOneOneMultipleOneComputational complexityEasyEasyEasyEasyComplicatedEasyIs there a dealer?YesYesNoYesNoYesThe MLSS scheme proposed by Guo et al. [21] realized that each participant has different privileges to restore the secret image and can achieve lossless restoration. Pakniat et al. [22] improved the scheme and enhanced the security. Both two schemes need a dealer to divide the secret into parts with different widths and heights and give each participant a shadow of the corresponding hierarchy. Wu et al. [24] proposed a hierarchical secret sharing scheme between two groups, in which the secret image could not be restored unless participants from both groups joined in the recovery. The SIS with a hierarchical threshold access structure mentioned above all share one secret image within a group or between two groups.The tightly coupled secret sharing scheme based on CRT proposed by Meng et al. [25] is the first time to propose secret sharing among multiple groups without any hierarchy. In this MGSS scheme, participants can go to another group to participate in the secret recovery. The secret image can be restored without loss and the computation is relatively small. However, the same secret is shared within one group and between groups in this scenario and there has to be a dealer to send an extra message to a participant who wants to participate in the secret recovery between groups. In our scheme, secrets within one group and between groups are completely different and independent, which has a different application scenery in real life.For Yang et al.’s [26] scheme, sharing and recovering multiple secrets between multiple groups is proposed for the first time. In the scheme, 2m−1 secret images are shared among m groups, and the recovery is lossless. However, in this scheme, multiple shadow images are held by a participant who participates in both intragroup and intergroup secret sharing. In our scheme, every participant holds only one shadow image, which is easier to manipulate and more secure in practical applications. Besides, Yang et al.’s scheme is proposed on the basis of GF28 domain and needs to calculate the basis matrix, so it requires a large amount of calculation, while our scheme requires a smaller amount of calculation.To sum up, the advantages of our scheme are as follows: compared with the existing MLSS and MGSS schemes, we can share multiple secret images within one group and between groups; compared with Yang et al.’s [26] scheme, each participant only needs to hold one shadow image in the proposed scheme based on the random elements utilization model and there is no information leakage in the process of inter-roup SIS.


## 5.1. Introduction of the Experiment

### 5.1.1. Experiment One

In the first experiment, we realized the SIS of the intragroup2,3 thresholds and intergroup 3,3 thresholds. The experimental process is as follows. There are two groups with six participants. There are three local participants P1,P2,P3 in G1 and three local participants P4,P5,P6 in G2. The order numbers of P1,P2,P3,P4,P5,P6 are 1,2,3,4,5,6, respectively; and there are three shared participants P1,P2,P4 in intergroup secret sharing. Each participant has only one shadow image.All participants in their own group can participate in the SIS within the group, and specific participants can participate in the SIS between the groups. In this example,P1,P2,P3 can participate in recovering the secret of G1, P4,P5,P6 can participate in recovering the secret of G2, and P1,P2,P4 can participate in recovering the intergroup secret. When recovering the secret image within the group, at least two local participants are required; when recovering the secret image between groups, all three shared participants are required. The size of the intragroup and intergroup secret images is 256 × 256. The membership is shown in Table 2.Table 2
The membership of the experiment.
ParticipantGroupWhether to participate in intergroup secret sharingP1G1YesP2G1YesP3G1NoP4G2YesP5G2NoP6G2NoThe sharing process is as follows. The intragroup secret image ofG1 is shared into three shadow images by our proposed screening method, and they are distributed to participants P1,P2, and P3. The secret image of G2 is also shared into three shadow images, which are distributed to participants P4,P5, and P6.Figure3 shows the intragroup secret images of G1,G2, the intergroup secret image of G1 and G2, and the shadow images. The secret image of G1 is given in Figure 3(a), and Figures 3(d)～3(f) display the shadow images held by P1,P2, and P3; the secret image of G2 is given in Figure 3(b), and Figures 3(g)～3(i) display the shadow images held by P4,P5, and P6. The intergroup secret images of G1 and G2 are given in Figure 3(c).Figure 3
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. SC1∼SC3 are the shadows of G1. SC4∼SC6 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)When recovering the secret image within a group, at least two participants are required. By using Shamir polynomial scheme, any two ofP1,P2,P3 can recover the secret of G1, and any two of P4,P5,P6 can recover the secret of G2. When recovering intergroup secret, it takes three participants to join in. The secret image can be recovered if all P1,P2,P4 are involved. The recovered secret image is shown in Figure 4.Figure 4
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


### 5.1.2. Experiment Two

In the second experiment, we realized the SIS of the intragroup2,4 thresholds and intergroup 3,3 thresholds. The membership of the experiment is shown in Table 3. Each of the two groups has four participants P1,P2,P3,P4 in G1, P5,P6,P7,P8 in G2. The order numbers of P1,P2,P3,P4,P5,P6,P7,P8 are 1,2,3,4,5,6,7,8, respectively; and we assigned P1,P4,P7 to participate in the SIS between G1 and G2.Table 3
The membership of the experiment.
ParticipantGroupWhether to participate in intergroup secret sharingP1G1YesP2G1NoP3G1NoP4G1YesP5G2NoP6G2NoP7G2YesP8G2NoThrough our proposed screening method, the secret images ofG1 and G2 are shared into four shadow images, respectively. The intragroup secret images, the intergroup secret image, and the shadow images are shown in Figure 5.Figure 5
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. (j) SC7. (k) SC8. SC1∼SC4 are the shadows of G1. SC5∼SC8 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)When recovering the secret within a group, any two participants can recover the secret image; when recovering the secret between groups, three designated participants are all required to recover the secret image. Any two ofSC1,SC2,SC3,SC4 can recover S1, and any two of SC5,SC6,SC7,SC8 can recover S2. SC1,SC4,SC7 are required to recover S1,2. The images recovered from the shadow images are shown in Figure 6.Figure 6
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


### 5.1.3. Experiment Three

In the third experiment, we realized the SIS of intragroup3,4 thresholds and intergroup 4,4 thresholds. P1,P2,P3,P4P5,P6,P7,P8 are the local participants of G1G2; and we assigned P1,P2,P5,P6 to participate in the SIS between G1 and G2. The order numbers are the same as those in the second experiment. Three local participants are required to reconstruct the intragroup secret image. Four shared participants participate in intergroup secret sharing and they are all required to reconstruct the secret image.As shown in Figure7, the secret images of G1 and G2 are shared into four shadow images, respectively, by our proposed random elements utilization model.Figure 7
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. (j) SC7. (k) SC8. SC1∼SC4 are the shadows of G1. SC5∼SC8 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)Any three ofSC1,SC2,SC3,SC4 can recover S1, and any three of SC5,SC6, SC7,SC8 can recover S2. SC1,SC2,SC5,SC6 are required to recover S1,2. The images recovered from the shadow images are shown in Figure 8.Figure 8
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


## 5.1.1. Experiment One

In the first experiment, we realized the SIS of the intragroup2,3 thresholds and intergroup 3,3 thresholds. The experimental process is as follows. There are two groups with six participants. There are three local participants P1,P2,P3 in G1 and three local participants P4,P5,P6 in G2. The order numbers of P1,P2,P3,P4,P5,P6 are 1,2,3,4,5,6, respectively; and there are three shared participants P1,P2,P4 in intergroup secret sharing. Each participant has only one shadow image.All participants in their own group can participate in the SIS within the group, and specific participants can participate in the SIS between the groups. In this example,P1,P2,P3 can participate in recovering the secret of G1, P4,P5,P6 can participate in recovering the secret of G2, and P1,P2,P4 can participate in recovering the intergroup secret. When recovering the secret image within the group, at least two local participants are required; when recovering the secret image between groups, all three shared participants are required. The size of the intragroup and intergroup secret images is 256 × 256. The membership is shown in Table 2.Table 2
The membership of the experiment.
ParticipantGroupWhether to participate in intergroup secret sharingP1G1YesP2G1YesP3G1NoP4G2YesP5G2NoP6G2NoThe sharing process is as follows. The intragroup secret image ofG1 is shared into three shadow images by our proposed screening method, and they are distributed to participants P1,P2, and P3. The secret image of G2 is also shared into three shadow images, which are distributed to participants P4,P5, and P6.Figure3 shows the intragroup secret images of G1,G2, the intergroup secret image of G1 and G2, and the shadow images. The secret image of G1 is given in Figure 3(a), and Figures 3(d)～3(f) display the shadow images held by P1,P2, and P3; the secret image of G2 is given in Figure 3(b), and Figures 3(g)～3(i) display the shadow images held by P4,P5, and P6. The intergroup secret images of G1 and G2 are given in Figure 3(c).Figure 3
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. SC1∼SC3 are the shadows of G1. SC4∼SC6 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)When recovering the secret image within a group, at least two participants are required. By using Shamir polynomial scheme, any two ofP1,P2,P3 can recover the secret of G1, and any two of P4,P5,P6 can recover the secret of G2. When recovering intergroup secret, it takes three participants to join in. The secret image can be recovered if all P1,P2,P4 are involved. The recovered secret image is shown in Figure 4.Figure 4
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


## 5.1.2. Experiment Two

In the second experiment, we realized the SIS of the intragroup2,4 thresholds and intergroup 3,3 thresholds. The membership of the experiment is shown in Table 3. Each of the two groups has four participants P1,P2,P3,P4 in G1, P5,P6,P7,P8 in G2. The order numbers of P1,P2,P3,P4,P5,P6,P7,P8 are 1,2,3,4,5,6,7,8, respectively; and we assigned P1,P4,P7 to participate in the SIS between G1 and G2.Table 3
The membership of the experiment.
ParticipantGroupWhether to participate in intergroup secret sharingP1G1YesP2G1NoP3G1NoP4G1YesP5G2NoP6G2NoP7G2YesP8G2NoThrough our proposed screening method, the secret images ofG1 and G2 are shared into four shadow images, respectively. The intragroup secret images, the intergroup secret image, and the shadow images are shown in Figure 5.Figure 5
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. (j) SC7. (k) SC8. SC1∼SC4 are the shadows of G1. SC5∼SC8 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)When recovering the secret within a group, any two participants can recover the secret image; when recovering the secret between groups, three designated participants are all required to recover the secret image. Any two ofSC1,SC2,SC3,SC4 can recover S1, and any two of SC5,SC6,SC7,SC8 can recover S2. SC1,SC4,SC7 are required to recover S1,2. The images recovered from the shadow images are shown in Figure 6.Figure 6
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


## 5.1.3. Experiment Three

In the third experiment, we realized the SIS of intragroup3,4 thresholds and intergroup 4,4 thresholds. P1,P2,P3,P4P5,P6,P7,P8 are the local participants of G1G2; and we assigned P1,P2,P5,P6 to participate in the SIS between G1 and G2. The order numbers are the same as those in the second experiment. Three local participants are required to reconstruct the intragroup secret image. Four shared participants participate in intergroup secret sharing and they are all required to reconstruct the secret image.As shown in Figure7, the secret images of G1 and G2 are shared into four shadow images, respectively, by our proposed random elements utilization model.Figure 7
The intragroup and intergroup secret images and the shadow images. (a)S1. (b) S2. (c) S1,2. (d) SC1. (e) SC2. (f) SC3. (g) SC4. (h) SC5. (i) SC6. (j) SC7. (k) SC8. SC1∼SC4 are the shadows of G1. SC5∼SC8 are the shadows of G2.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)Any three ofSC1,SC2,SC3,SC4 can recover S1, and any three of SC5,SC6, SC7,SC8 can recover S2. SC1,SC2,SC5,SC6 are required to recover S1,2. The images recovered from the shadow images are shown in Figure 8.Figure 8
The intragroup and intergroup secret images recovered from the shadow images. (a)S1′. (b) S2′. (c) S1,2′.
(a)(b)(c)


## 5.2. Experimental Analysis

Compared with the first experiment, the intragroup threshold in the second experiment changed from2,3 to 3,3, and the intergroup threshold remained unchanged. The number of shared participants of the two experiments and the structure of the two equation systems are the same. The difference between the two experiments is the number of shadow images in a group, and it does not affect the solution of the system.Compared with the first two experiments, the third experiment has a greater intragroup threshold, which means that there are more variable coefficients in the system. At the same time, the intergroup threshold in the third experiment is greater than those of the first two experiments, which means that there are more restrictions. The threshold parameters in the third experiment satisfy the constraints that need to be satisfied (i.e.,k1=3,k2=3,k3=4,n3=4,k1+k2+k3−3≥n3), so there exists a solution in the system.We use the random elements utilization model to select polynomial coefficients satisfying certain conditions and realize the intragroup and intergroup SIS with each participant holding one shadow image. The experimental results show that the scheme is feasible.


## 5.3. Comparison

In this section, we compare the proposed scheme with other secret sharing schemes within one group and between groups. The comparisons of the main features are shown in Table4.Table 4
Comparisons of the main features.
Guo et al. [21]Pakniat et al. [22]Wu et al. [24]Meng et al. [25]Yang et al.[26]Proposed schemeBased methodPolynomialGF28PolynomialCRTGF28PolynomialNumber of groups112mm2Number of secrets11112m−13The number of shadows held by a participantOneOneOneOneMultipleOneComputational complexityEasyEasyEasyEasyComplicatedEasyIs there a dealer?YesYesNoYesNoYesThe MLSS scheme proposed by Guo et al. [21] realized that each participant has different privileges to restore the secret image and can achieve lossless restoration. Pakniat et al. [22] improved the scheme and enhanced the security. Both two schemes need a dealer to divide the secret into parts with different widths and heights and give each participant a shadow of the corresponding hierarchy. Wu et al. [24] proposed a hierarchical secret sharing scheme between two groups, in which the secret image could not be restored unless participants from both groups joined in the recovery. The SIS with a hierarchical threshold access structure mentioned above all share one secret image within a group or between two groups.The tightly coupled secret sharing scheme based on CRT proposed by Meng et al. [25] is the first time to propose secret sharing among multiple groups without any hierarchy. In this MGSS scheme, participants can go to another group to participate in the secret recovery. The secret image can be restored without loss and the computation is relatively small. However, the same secret is shared within one group and between groups in this scenario and there has to be a dealer to send an extra message to a participant who wants to participate in the secret recovery between groups. In our scheme, secrets within one group and between groups are completely different and independent, which has a different application scenery in real life.For Yang et al.’s [26] scheme, sharing and recovering multiple secrets between multiple groups is proposed for the first time. In the scheme, 2m−1 secret images are shared among m groups, and the recovery is lossless. However, in this scheme, multiple shadow images are held by a participant who participates in both intragroup and intergroup secret sharing. In our scheme, every participant holds only one shadow image, which is easier to manipulate and more secure in practical applications. Besides, Yang et al.’s scheme is proposed on the basis of GF28 domain and needs to calculate the basis matrix, so it requires a large amount of calculation, while our scheme requires a smaller amount of calculation.To sum up, the advantages of our scheme are as follows: compared with the existing MLSS and MGSS schemes, we can share multiple secret images within one group and between groups; compared with Yang et al.’s [26] scheme, each participant only needs to hold one shadow image in the proposed scheme based on the random elements utilization model and there is no information leakage in the process of inter-roup SIS.


## 6. Conclusion

In this paper, we proposed an intragroup and intergroup secret sharing scheme, in which each participant holds one shadow image. There is no need for additional information to participate in secret recovery between groups. Participants who are able to join in the intergroup secret recovery are assigned in advance and when the number of legal participants reaches the threshold, they can recover the intergroup secret. Participants without permission can only participate in the secret recovery within the group but cannot participate in the secret recovery between groups. Even if they participate, they cannot recover the true secret. The secrets within one group and between groups are completely different and the scheme is simple to implement; thus it has a good application prospect in real life. In future work, we will further extend our scheme to SIS between more than two groups.



---

*Source: 9960998-2021-07-02.xml*