Two-stage embedded ciphertext domain reversible information hiding method

Abstract

The invention discloses a two-stage embedded ciphertext domain reversible information hiding method, and belongs to the technical field of information hiding. A pixel prediction redundant space is improved by improving a median edge detector (PMED), embedding and share segmentation of initial information by a task distributor are realized in combination with polynomial secret sharing, secondary embedding is performed in a ciphertext share by using a (7, 4) cyclic code, and the problems of low embedding capacity and limited application scenarios of a traditional scheme are solved. Experimental results show that the method has good performance in the aspects of embedding rate, safety, reversibility, calculation complexity and the like.

Description

Technical Field

[0001] The present invention belongs to the technical field of information hiding, and in particular relates to a two-stage embedded ciphertext domain reversible information hiding method. Background Art

[0002] Image information hiding is a hot research topic in multimedia security. Reversible data hiding (RDH) is a data hiding technique that allows users to embed additional information into a carrier medium. RDH-ED embeds additional information into an encrypted carrier, characterized by the fact that the carrier used for embedding is encrypted. The key to RDH-ED lies in discovering and utilizing redundant space in the carrier. Based on the method of generating redundancy, embedding algorithms can be divided into three categories: vacating room after encryption (VRAE), vacating room before encryption (VRBE), and vacating room in encryption (VRIE).

[0003] Most existing solutions only perform a single embedding operation and are suitable for relatively simple scenarios such as secret storage and transmission. However, in practice, the "task decomposition - parallel execution - aggregate decision-making" model is common. Summary of the Invention

[0004] This invention aims to propose a two-stage embedding method for reversible information hiding in the ciphertext domain for the above application scenarios. The first stage embeds the tasks assigned to each group by the task distributor, and the second stage embeds the results of each group's execution. The image owner uses an improved MED predictor to predict the carrier image to free up redundant space. After obtaining the carrier, the task distributor uses the MSB to embed the additional information to be distributed. Secret sharing is used to split the carrier to embed the additional information into multiple shares and distribute them to different participants. After receiving the secret shares, the participants embed the execution results based on the corresponding task completion status and send them to the recipient. The recipient can extract the secret information embedded twice as needed.

[0005] To achieve the above object, the present invention provides the following solution: a two-stage embedding ciphertext domain reversible information hiding method, comprising the following steps:

[0006] S1. The image owner predicts the carrier image based on the improved MED predictor to obtain a predicted image; and obtains label information based on the carrier image and the predicted image;

[0007] S2. Obtain auxiliary information and reserved information based on the tag information; embed the auxiliary information and the reserved information into the predicted image to obtain a first embedded image; and encrypt the first embedded image to obtain an encrypted image;

[0008] S3. The information hider decrypts the encrypted image to obtain a first decrypted image; determines an information embedding position of the first decrypted image based on the auxiliary information, and embeds the secret information Secret 1 into the information embedding position to obtain a second embedded image;

[0009] S4. Encrypt the auxiliary information and calculate a secret share based on a pre-constructed polynomial; and divide the encrypted auxiliary information and the secret share into n share images;

[0010] S5. Decrypt the auxiliary information in the share image and restore the secret information Secret 1 based on the decrypted auxiliary information; after the user completes the corresponding task according to the secret information Secret 1, embed the secret information Secret 2 in the share image to obtain the Mshare image;

[0011] S6. The receiver extracts secret information Secret 2 and secret information Secret 1 from the Mshare image to obtain the carrier image.

[0012] Further preferably, in S1, the method of predicting the carrier image based on the improved MED predictor to obtain the predicted image includes:

[0013]

[0014] Where i, j represent the row and column numbers of pixel p(i,j), i≥1, j≥1; p′(i,j) is the predicted pixel; p(i-1,j-1), p(i-1,j) and p(i,j-1) are the upper left, left and upper pixels of p(i,j), respectively.

[0015] Further preferably, in S1, the predicted image and the carrier image are compared pixel by pixel to obtain the same number of MSB bits, and the same number of MSB bits are Huffman encoded to obtain the marking information.

[0016] Further preferably, in S2, the auxiliary information includes: the tag information M, the total length L of the tag information M , encoding rule R, total length of encoding rule L R ; The reserved information N includes: the last 7-h LSB bits of the predicted pixel;

[0017] Using the seed key hi and a pseudo-random number generator to generate an encryption key k1, use k1 to perform XOR encryption on the first embedded image to obtain the encrypted image, and transmit the seed key to the information hider through a secure channel.

[0018] Further preferably, in S4, the seed key h is used i and a pseudo-random number generator to generate an encryption key k2, and encrypt the auxiliary information using a stream cipher;

[0019] The pre-built polynomials include:

[0020] f(x)=a0+…+a q-1 x q-1 +b q x q +…+b k-1 x k-1 mod2 8 ,

[0021] Where a0, a1, ..., a q-1 is q adjacent pixels, q ≥ 2; b q , b q+1 ,…,b k-1 is kq random numbers;

[0022] The secret share s i =f(i), i=1, 2,...,n.

[0023] Further preferably, in S5, a (7,4) cyclic code is used to embed secret information Secret2 in the share image to obtain the Mshare image; the method includes:

[0024] S51, determine the code length t=7 and the information bit length r=4, and the check bit length tr=3;

[0025] S52, find x t Factorization of -1 over finite fields: x 7 -1=(x+1)(x 3 +x+1)(x 3 +x 2 +1), the generating polynomial g(x) is x 7 A factor of -1 with power 3;

[0026] S53, select the generating polynomial g(x)=x 3 +x 2 +1, the check polynomial is:

[0027] h(x)=(x 7 -1) / g(x)=x 4+x 2 +x+1;

[0028] S54, determine the corresponding generator matrix G and check matrix H:

[0029]

[0030] S55. Select 3 consecutive bits of the share image as an embedding vector x = {x1, x2, x3}, select 7 bits from the secret information Secret 2 as m = {m1, m2, ..., m7}, calculate m-xH = EH, where E is the error pattern; then calculate y = x + E to complete the embedding of m into x; where the total length of E padding is (L N +L E ) / q,L N To retain the length of the information; L E The length of the secret information Secret 2.

[0031] Further preferably, in S6, the method by which the receiving party obtains the carrier image includes:

[0032] According to the auxiliary information, the length of the compressed part of the encrypted secret sharing is (L N +L E ) / q, calculate yH=(x+E)H=xH+EH, and yH=m by m-xH=EH; then directly extract the secret information Secret2 embedded in the Mshare image;

[0033] According to the length (L N +L E ) / q extracts the padded E, calculates yE to obtain the carrier x before embedding the m information; reconstructs the pre-constructed polynomial from the k Mshare images, obtains the coefficients of the polynomial, and then obtains the restored image; then, decrypts the restored image and extracts the first 20 bits of the first decrypted image to obtain the length L of the tag information M , according to L M The Huffman codeword M can be extracted; then the next 72 bits are extracted to obtain the encoding rule R; the h sequence of the predicted image is restored according to the Huffman encoding rule and the codeword length, the embedded secret information Secret1 is obtained according to the h sequence and the retained information N, and the encrypted carrier image is restored according to the encoding rule R and the Huffman codeword M.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] The present invention improves the MED prediction method and also takes non-first pixels in the first row and first column as prediction objects, effectively increasing the redundant space generated by pixel prediction, thereby improving the MSB embedding rate. A large-capacity embedding algorithm is proposed using cyclic codes to directly embed information in the ciphertext image. 7 bits of additional information can be embedded in a 3-bit ciphertext pixel, and the embedded content is the mapped error image, rather than the secret information itself, which has higher security and a larger embedding rate. The proposed two-stage embedding algorithm can be applied to scenarios where multiple users jointly complete tasks in a distributed environment, effectively improving the application value of reversible information hiding in the ciphertext domain. Experimental results show that the algorithm has a high embedding capacity, reliable security and reversibility, and uses lightweight secret sharing to segment the carrier image, effectively reducing the algorithm's computational complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 This is a framework diagram of a two-stage embedded ciphertext domain reversible information hiding method according to an embodiment of the present invention;

[0038] Figure 2 This is a prediction graph of a MED predictor according to an embodiment of the present invention;

[0039] Figure 3 This is a diagram of the process of generating initial label information for a single pixel according to an embodiment of the present invention;

[0040] Figure 4 A diagram illustrating a process of generating tag information for a single image according to an embodiment of the present invention;

[0041] Figure 5 This is a diagram showing the operation of Data hider 1 according to an embodiment of the present invention;

[0042] Figure 6 This is a comparison chart of embedding rates according to an embodiment of the present invention;

[0043] Figure 7: This is a histogram distribution diagram of an embodiment of the present invention; wherein, (a) is Goldhill's original image; (b) is the plane histogram of Goldhill's original image; (c) is the distribution diagram of Goldhill's original image; (d) is the three-dimensional histogram of Goldhill's original image; (e) is the image after the first information embedding; (f) is the plane histogram of the image after the first information embedding; (g) is the distribution diagram of the image after the first information embedding; (h) is the three-dimensional histogram of the image after the first information embedding; (i) is the first secret share after secret sharing; (j) is the plane histogram of the first secret share after secret sharing; (k) is the distribution graph of the first secret share after secret sharing; (l) is the three-dimensional histogram of the first secret share after secret sharing; (m) is the secret share after the cyclic code is embedded in the information; (n) is the plane histogram of the secret share after the cyclic code is embedded in the information; (o) is the distribution graph of the secret share after the cyclic code is embedded in the information; (p) is the three-dimensional histogram of the secret share after the cyclic code is embedded in the information; (q) is the restored image; (r) is the plane histogram of the restored image; (s) is the distribution graph of the restored image; (t) is the three-dimensional histogram of the restored image;

[0044] Figure 8 Schematic diagram of pixel correlation after the first embedding according to an embodiment of the present invention; (a) is a horizontal angle; (b) is a vertical angle; (c) is 45°; (d) is 135°;

[0045] Figure 9 Schematic diagram of pixel correlation after secret sharing according to an embodiment of the present invention; (a) is a horizontal angle; (b) is a vertical angle; (c) is 45°; (d) is 135°;

[0046] Figure 10 Schematic diagram of pixel correlation after cyclic code embedding according to an embodiment of the present invention; (a) is a horizontal angle; (b) is a vertical angle; (c) is 45°; (d) is 135°;

[0047] Figure 11 The error graphs are formed by comparing the extracted additional information with the embedded secret information bit by bit after Goldhill is secretly embedded in the (3,4) scheme in an embodiment of the present invention; (a) is the S1 error graph; (b) is the S2 error graph. DETAILED DESCRIPTION

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] Example 1:

[0051] like Figure 1 FIG. 1 is a framework diagram of a two-stage embedded ciphertext domain reversible information hiding method provided by this embodiment, which specifically includes the following steps:

[0052] S1. The image owner predicts the carrier image based on the improved MED predictor to obtain a predicted image; and obtains label information based on the carrier image and the predicted image.

[0053] In order to ensure that there is a large amount of redundancy in the encrypted image for embedding information, the carrier image I is first predicted. The median edge detector (MED) is an efficient predictor that predicts the value of a pixel based on the values ​​of the pixels surrounding the current pixel in the image. The prediction process of the MED predictor is as follows:

[0054]

[0055] Where i, j represent the row and column numbers of pixel p(i, j), respectively, and i≥2, j≥2; p′(i, j) is the predicted pixel, p(i-1, j-1), p(i-1, j) and p(i, j-1) are the upper left, left and upper pixels of p(i, j), respectively; Figure 2 shown.

[0056] Since the MED predictor requires the pixels in the first row and first column of the image, these pixels can only be used as auxiliary information and cannot participate in subsequent information embedding. To fully utilize all pixels, this embodiment improves the MED predictor and predicts all pixels in the first row and first column (except the first one). An efficient MED predictor (PMED) is proposed to improve pixel utilization. For pixel p(i, j), the PMED prediction calculation formula is as follows:

[0057]

[0058] Where i ≥ 1, j ≥ 1; through formula (2), only p(1, 1) is the reference pixel, and other pixels can participate in information embedding.

[0059] To verify the superiority of the PMED predictor, we compared it with the MED predictor. Six 512×512 test images were predicted, and the highest MSB of p′(i, j) that matched p(i, j) was counted as an evaluation metric. The results are shown in Table 1. For all test images, the PMED predictor achieved better prediction results.

[0060] Table 1

[0061]

[0062] S2. Obtain auxiliary information and reserved information based on the tag information; embed the auxiliary information and the reserved information into the predicted image to obtain a first embedded image; and encrypt the first embedded image to obtain an encrypted image.

[0063] After obtaining the predicted image PI, PI is compared with the carrier image I pixel by pixel, and the number of bits with the same MSB is recorded as the initial marking information, such as Figure 3 As shown, the initial tag information is Huffman coded to generate tag information. For example: p(i,j) is 146, p′(i,j) is 150, first convert 146 and 150 into binary 10010010 and 10010110, the same MSB bit number is 5, so p′(i,j) can be marked as h=101, and its embeddable space is 6 bits. Therefore, the value of h is 0-8. In order to achieve reversible recovery of the carrier image, the tag information needs to be embedded in the redundant space. Huffman coding is used to compress the tag information. Huffman coding is a lossless coding algorithm that constructs a coding tree based on character frequency to achieve data compression. By giving high-frequency characters short codes and low-frequency characters long codes, the overall code length is kept to a minimum, which is efficient and lossless.

[0064] The test image Goldhill is used as an example to illustrate the generation process of marker information. After testing, the distribution of the same MSB bit h predicted by the PMED predictor for Goldhill is shown in Table 2. According to the Huffman coding rules, the corresponding Huffman codeword can be generated, which is called marker information M. The total length of M is L. M , use 20 bits to record L M The encoding rule is represented by R, and the total length of R is L R , 3 bits are used to represent the length of each code, and 5 bits are used to represent each code, so a total of 72 bits are required to record R. For pixel p'(i,j), since its mark information is h bits, the last 7-h LSB bits need to be retained (the h+1th bit is opposite to the original pixel and does not need to be recorded), which is called the retained information N, and the length is recorded as L NThe number of bits that can be used to embed information in p′(i,j) is h+1. After completing the above operations, L M , M, L R and R are sequentially embedded into the predicted image as auxiliary information Aux1, and the retained information N is embedded after Aux1. The label information generation process is as follows Figure 4 To improve the security of the first embedded image (Markedimage), the seed key h is used i The encryption key k1 is generated by a pseudo-random number generator, the first embedded image is XOR-encrypted using k1 to obtain an encrypted image, and the seed key is transmitted to the information hider through a secure channel.

[0065] Table 2

[0066]

[0067] S3. The information hider decrypts the encrypted image to obtain a first decrypted image; determines an information embedding position of the first decrypted image based on the auxiliary information, and embeds the secret information Secret 1 into the information embedding position to obtain a second embedded image.

[0068] After receiving the encrypted image, the information hider first decrypts the encrypted image and then extracts the first 20 bits of the first decrypted image to obtain the length L of the marking information. M , according to L M The Huffman codeword M can be extracted; the next 72 bits are then extracted to obtain the encoding rule R. The predicted image's h sequence can be recovered based on the Huffman coding rule and the codeword length. The redundant space embedded in the secret information Secret 1 can be obtained based on the h sequence and the retained information N. To improve the security of the embedded secret information Secret 1, the information hider can encrypt additional information before embedding.

[0069] S4. Encrypt the auxiliary information and calculate the secret share based on a pre-constructed polynomial; and divide the encrypted auxiliary information and the secret share into n share images.

[0070] For the scenario of secondary embedding in a distributed environment, Datahider 1, as the task distributor, needs to use secret sharing to split the first decrypted image after embedding the task information, that is, the secret information Secret 1, into multiple parts and distribute them to different participants. The operations performed by Datahider 1 are as follows: Figure 6 As shown, Datahider 1 decrypts the received encrypted image using the decryption key k1, and then extracts the auxiliary information Aux1 ( Figure 5 The orange and blue parts in the figure), the location where the information is embedded can be obtained according to Aux1. Figure 5The white position in the image is used to embed the secret information Secret 1 into the white position. The space after the embedded information is represented by gold. The length of the embedded information is recorded as L E .

[0071] After completing the above operations, Datahider 1 first uses the seed key h i The encryption key k2 is generated by the pseudo-random number generator and Aux1 is encrypted using a stream cipher. For the retained pixel information and the embedded secret information Secret 1, (k,n) secret sharing is used to divide it into n shares. Datahider 1 first constructs a k-1 degree polynomial:

[0072] f(x)=a0+…+a q-1 x q-1 +b q x q +…+b k-1 x k-1 mod2 8 , (3)

[0073] Where a0, a1, ..., a q-1 is q adjacent pixels, q ≥ 2; b q , b q+1 ,…,b k-1 is kq random numbers. Then calculate the secret share s i =f(i), i=1,2,…,n, and the encrypted Aux1 and s i Distribute to n different users P i , called Datahider 2. Since Equation (3) generates a certain amount of compression when encrypting an image, the length of the secret shared compressed part is (L N +L E ) / q, so the size of the shared image after secret sharing is related to q. To ensure that the shared image is the same size as the original image, random numbers are used to fill in the missing parts caused by compression. Data hider 1 can securely distribute task information to multiple different participants. Different encryption methods are used for Aux1 and other information to reduce computational complexity while ensuring security. Using secret sharing for all information would increase algorithmic complexity.

[0074] S5. Decrypt the auxiliary information in the share image and restore the secret information Secret 1 based on the decrypted auxiliary information; after the user completes the corresponding task according to the secret information Secret 1, embed the secret information Secret 2 in the share image to obtain the Mshare image.

[0075] After receiving the share image distributed by Data hider 1, Data hider 2 can decrypt Aux1 using the decryption key. Based on Aux1, Data hider 1's embedded secret information, Secret 1, can be recovered. After completing the task based on the task information, Data hider 2 embeds the corresponding completion result, Secret 2, in its share. The embedded share is called the Mshare image. Because Mshare is a ciphertext image, the encryption process severely destroys the correlation between pixels, resulting in less redundancy space, making it impossible to generate redundancy using pixel prediction techniques. To fully exploit this redundancy, Data hider 2 uses a (7,4) cyclic code to directly embed Secret 2 in the share image. This process is called cyclic code embedding (LC-embedding). This algorithm can quickly extract additional information directly from the newly generated shadow image, facilitating the independent labeling, management, and retrieval of ciphertext images by multiple users. The (7,4) cyclic code construction process is as follows:

[0076] S51, determine the code length t=7 and the information bit length r=4, and the check bit length tr=3;

[0077] S52, find x t Factorization of -1 over finite fields: x 7 -1=(x+1)(x 3 +x+1)(x 3 +x 2 +1), the generating polynomial g(x) is x 7 A factor of -1 with power 3;

[0078] S53, select the generating polynomial g(x)=x 3 +x 2 +1, the check polynomial is:

[0079] h(x)=(x 7 -1) / g(x)=x 4 +x 2 +x+1;

[0080] S54, determine the corresponding generator matrix G and check matrix H:

[0081]

[0082] S55. Select 3 consecutive bits of the shared image as an embedding vector x = {x1, x2, x3}, select 7 bits from the secret information Secret 2 as m = {m1, m2, ..., m7}, and calculate m-xH = EH, where E is the error pattern. Thus, a one-to-one mapping relationship is established between the secret information and the error image. Then calculate y = x + E to complete the embedding of m into x. According to the LC-embedding rule, the total length of E padding is (L N +L E ) / q,L N To retain the length of the information; L E is the length of the secret information Secret 2. Therefore, every 3 bits of a Share pixel can embed 7 bits of additional information. To achieve reversible image recovery, the error image E is used as auxiliary information to replace the padding portion of the Share image. This process is called E-paddding. If the padding portion is not yet full, it can also be filled with the encrypted additional information. The resulting Share image is called the Mshare image.

[0083] S6. The receiver extracts secret information Secret 2 and secret information Secret 1 from the Mshare image to obtain the carrier image.

[0084] The receiver can extract Secret2, Secret 1 and reconstruct the original image based on any k Mshare images. First, according to Aux1, the length of the secret shared compressed part is (L N +L E ) / q, the total length of E filling is also (L N +L E ) / q. The receiver first calculates yH=(x+E)H=xH+EH. Knowing that m-xH=EH, so yH=m, the receiver can directly extract the embedded secret information Secret2 from the Mshare image. According to the length (L N +L E ) / q extracts the padded E, calculates yE to obtain the carrier x before embedding m information. According to Theorem 1, k Mshare images can reconstruct Equation (3), so each coefficient of Equation (3) is known. Therefore, the receiver can use the Mshare image after extracting Secret2 and E to extract the image before reconstructing secret sharing. Then, the receiver decrypts the recovered image and extracts the first 20 bits of the decrypted image to obtain the length L of the tag information M , according to L MThe Huffman codeword M can be extracted; the next 72 bits are then extracted to obtain the encoding rule R. Based on the Huffman coding rule and the codeword length, the predicted image's h sequence can be recovered. The embedded secret information, Secret1, can be obtained from the h sequence and the retained information N. Furthermore, the encrypted carrier image can be recovered using the encoding rule R and the Huffman codeword M. Decryption yields the original carrier image. In summary, the receiver can completely and correctly extract Secret1 and Secret2 and losslessly reconstruct the original carrier image.

[0085] Theorem 1: Choose k different ones (x i ,f(x i ), the k-1 degree polynomial can be uniquely determined by the Lagrange interpolation formula:

[0086]

[0087] Secret distribution: The sender constructs a k-1 degree polynomial:

[0088] f(x)=a0+a1x+a2x 2 +…+a k-1 x k-1 , (5)

[0089] Usually a0 is the secret information, a1, a2, ..., a k-1 is a random number. If the information to be shared is an image, the polynomial coefficient can be set to the pixel value. The sender calculates the secret share s i =f(i), i=1,2,…,n, and s i Distribute to n different users P i From Theorem 1, we can know that any collection of k s i , f(x) can be reconstructed, and accordingly, all coefficients of the polynomial can be recovered. However, existing polynomial-based secret sharing schemes do not have diffusion properties and cannot effectively resist various attacks such as differential attacks and chosen plaintext attacks. CFSS can effectively solve this problem, and its expression is:

[0090]

[0091] Where, F i (x) represents CFSS for the i-th image block, where d0, d1, ..., d l-1 ,F0 is a random number, F i-1(j) represents the jth share randomly selected from the secret shares shared in the i-1th block. That is, when constructing the polynomial for each image block, one coefficient comes from the shared shares of the previous block, with the first block containing a random number. This feedback strategy ensures that if a single bit in the secret image is tampered with, the remaining shares will undergo significant changes, effectively resisting various attacks, including differential attacks. Therefore, the CFSS scheme effectively addresses the shortcomings of traditional schemes and offers high security.

[0092] Example 2:

[0093] This embodiment uses experiments to illustrate the effect of the method proposed in the present invention. The experiment was conducted on a Windows 10 operating system, using Matlab R2021b programming, and the experimental equipment configuration was Intel(R) Core(TM) i7-10875H CPU @ 2.30GHz, 32GB. The test data selected for the experiment were 6 512×512 grayscale images as shown in the figure. Figure 4 As shown, the embedded additional information is the AES encrypted bit stream.

[0094] (1) Embedding rate:

[0095] Embedding capacity (EC) and embedding rate (ER) are important indicators for evaluating RDH-ED performance. EC refers to the maximum total number of bits of additional information embedded in the carrier, and ER refers to the average number of bits of additional information embedded per pixel. The larger the ER, the more information the algorithm can embed per pixel, that is, the stronger the algorithm's ability to hide information. The relationship between the two is shown in Equation (7):

[0096]

[0097] The maximum embedding rate refers to the maximum number of additional information bits embedded per pixel. The embedding rate of the present invention is composed of the first embedding rate (ER1) and the second embedding rate (ER2). Embedding rate tests were conducted on six test images. When k = 3 and n = 4, the embedding rate test results for different q values ​​are shown in Table 3. As shown in Table 3, the embedding rate decreases as q increases. This is because a larger q results in a smaller fraction of the generated image, resulting in a smaller portion of the cyclic code being embedded. In order to prove the superiority of the embedding rate of the proposed algorithm, the algorithm of the present invention is compared with similar algorithms: reversible information hiding algorithm for encrypted images based on difference expansion and histogram shift (DD-RDHEI), reversible information hiding algorithm for encrypted images based on difference expansion (SOK-RDHEI), reversible information hiding algorithm for encrypted images based on finite field secret sharing (RDHEI-SH), reversible information hiding algorithm for encrypted images based on matrix secret sharing (MSS-RDHEI), reversible information hiding algorithm for image ciphertext domain based on polynomial secret sharing (SIS-RDHED), and reversible information hiding algorithm for ciphertext domain based on adaptive MSB prediction and secret sharing (MSB-RDHED). The comparison results are shown in the figure. Figure 6 As shown. The comparison schemes are all based on the secret sharing type RDH-ED algorithm, among which DD-RDHEI, SOK-RDHEI, RDHEI-SH, and MSS-RDHEI are all one-time embedding algorithms with low embedding rates. MSB-RDHED and the algorithm of the present invention are both secondary embedding algorithms. The first embedding is polynomial coefficient embedding, and the second embedding is (7, 4) cyclic code. Although the embedding rate is significantly improved compared with other algorithms, MSB-RDHED uses the homomorphism of secret sharing to implement embedding, and its information extraction process is very complicated. In addition, the embedding rate of the algorithm proposed in the present invention is also significantly superior to it. MSS-RDHEI and the scheme of the present invention both combine secret sharing and MSB technology. Since the algorithm of the present invention improves MED and reasonably uses the secret share to implement secondary embedding, the embedding rate of the algorithm of the present invention is greater than that of the other threshold schemes.

[0098] Table 3

[0099]

[0100] (2) Safety analysis:

[0101] 1) Information entropy:

[0102] Information entropy can be used to describe the uncertainty or randomness of data. The entropy value can be calculated using the Shannon information entropy formula, which is as follows:

[0103]

[0104] where H(X) denotes the entropy of random variable X, and P(x) denotes the probability of X. For a grayscale image, Z is 256. When all pixels appear with equal probability, H(X) reaches the maximum value of 8. Therefore, for a grayscale image, the closer H(X) is to 8, the safer the image is. Table 4 shows the entropy of different stages of the six test images. For all test images, the entropy of the original image is far from 8, and the entropy of the Marked image, the secret share after secret sharing, and the image after embedding information with the cyclic code are all close to 8, indicating that the algorithm has good resistance to entropy attack. Moreover, no matter how large the difference between the entropy of the original image and 8 is, the entropy of the ciphertext image is close to 8, indicating that the algorithm has good high-entropy attack ability for all test images.

[0105] Table 4

[0106]

[0107] 2) Histogram:

[0108] Figure 7 The test histogram of Goldhill is shown. To more clearly show the pixel distribution, the pixel plane histogram, pixel scatter plot, and three-dimensional pixel distribution histogram are tested from multiple dimensions. Figure 7 (a), (e), (i), (m), (q) are the original image of Goldhill, the image after the first information embedding Marked image, the first secret share St-share1 after secret sharing, the secret share Nd-share1 after embedding information with the cyclic code, and the restored image, respectively. The last three images in each row are the corresponding plane histogram, scatter plot, and three-dimensional histogram. It can be seen from Figure 7 that the histogram distribution of Marked image, St-share1, and Nd-share1 is relatively uniform, and it is difficult to analyze the relevant information of the image from various histograms, indicating that the encryption process and embedding process of the algorithm achieve good security, and attackers cannot conduct pixel feature statistical attack on the algorithm. In addition, the three histogram distributions of the restored image and the original image are completely consistent, indicating that the algorithm has good reversibility.

[0109] 3) Differential attack:

[0110] Differential attacks study how differences in plaintext affect differences in ciphertext and are an effective cryptanalysis method. To resist differential attacks, small changes in the plaintext can result in significant differences in the ciphertext. We use the NPCR (Number of Pixels Changed) and the Uniform Average Change Intensity (UACI) to test a cryptosystem's resistance to differential attacks. The NPCR represents the difference between the encrypted image and the original image. Therefore, the closer the value is to 100%, the greater the mismatch between the two images and the corresponding higher visual security level. The UACI is the average difference between the pixels in the two images. Existing research shows that the ideal NPCR and UACI values ​​for 8-bit grayscale images are 99.6094% and 33.4635%, respectively. Table 5 shows the NPCR and UACI values ​​for the four shares generated by Goldhill secret sharing in the k=3, n=4 scheme. As shown in Table 5, the proposed scheme can achieve NPCR and UACI values ​​very close to the theoretical values, demonstrating its good security and strong resistance to differential attacks. Since the present invention adopts a secret sharing scheme in a password feedback mode, a small change in the plaintext will produce a large change in the ciphertext, thus solving the defect that traditional secret sharing does not have a diffusion characteristic and having a strong ability to resist differential attacks.

[0111] Table 5

[0112]

[0113] 4) Correlation of adjacent coefficients:

[0114] Correlation between adjacent pixels refers to the dependency or similarity between pixel values ​​at adjacent locations in an image. Typically, multiple pairs of adjacent pixels are randomly sampled from the encrypted image in different directions, such as horizontally, vertically, and diagonally. Analysis of these sampled pixel pairs reveals whether the encryption or embedding process effectively destroys the correlation between adjacent pixels in the original image. An intuitive approach is to plot a scatter plot of adjacent pixels. If the correlation between pixels is strong, the scatter plot will exhibit a clear linear trend; if the correlation is extremely weak, the scatter plot will appear as a randomly distributed point cloud. Furthermore, this can be quantified using the correlation coefficient, which measures the degree of linear correlation between two variables (in this case, the pixel values ​​of adjacent pixels). The correlation coefficient ranges from [-1, 1], where 1 indicates perfect positive correlation, -1 indicates perfect negative correlation, and 0 indicates no linear correlation. In a ciphertext image, when the absolute value of the correlation coefficient between adjacent pixels is close to 0, it indicates that the encryption or embedding process has effectively reduced the correlation between pixels, improving the statistical security of the ciphertext image. The formula for calculating the correlation coefficient is as follows:

[0115]

[0116] Among them, r represents the correlation coefficient, (x, y) is the adjacent pixel pair, N is the number of samples, D is the variance, and Cov is the covariance (deletion). By analyzing the correlation coefficient and scatter plot, the effectiveness of the encryption and embedding algorithm in destroying the correlation between adjacent pixels of the image can be evaluated. The closer the correlation between adjacent pixels in the ciphertext image is to 0, the more secure the algorithm is. The experiment tested the correlation coefficient of adjacent pixels of Goldhill images at different stages from four angles: horizontal, vertical, 45° and 135°. The corresponding correlation coefficients are recorded as r and y, respectively. h 、r v 、r d and r id The experiment tested the adjacent pixel correlation of Goldhill's Mark image, St-share1 and Nd-share1, respectively. Figure 8 、 Figure 9 and Figure 10 As shown in Figure 2, the pixel correlation coefficients in the four directions of the three-stage images are all close to 0, indicating that the TSE-RDHED algorithm has a secure encryption and embedding process.

[0117] (3) Reversibility:

[0118] 1) PSNR and SSIM:

[0119] Peak Signal-to-Noise Ratio (PSNR) can be used to measure the quality of the reconstructed image, measured in dB. In the RDH-ED algorithm, PSNR is primarily used to calculate the similarity between the encrypted image and the original image, as well as the similarity between the restored image and the original image. For grayscale images, the PSNR calculation formula is as follows:

[0120]

[0121] Where A×B represents the image size, and i and j represent the row and column numbers of the image, respectively. A larger SNR value indicates that the two images are closer together. When PSNR > 35dB, the human eye cannot perceive a significant difference between the two images. When PSNR = +∞, the two images are completely identical. Structural Similarity (SSIM) is a metric that measures the similarity between two images. Compared to other objective evaluation metrics, SSIM is more consistent with the perceptual characteristics of the human visual system. It is calculated as follows:

[0122]

[0123] Where, E M and E N are the average values ​​of the two images, D M and D Nare their standard deviations, Cov MN represents the covariance, C1 and C2 are constants. The closer the SSIM value is to 1, the closer the two images are. When SSIM = 1, it means that the two images are completely identical.

[0124] Reversibility tests were conducted on six test images. First, the PSNR and SSIM of the images reconstructed using the proposed TES-RDHED algorithm were tested. The results are shown in Table 6. The PSNR for all reconstructed images was +∞, and the SSIM was 1. The results show that the reconstructed images of all test images were identical to the original images. The information extraction and image restoration processes show that the TES-RDHED algorithm can completely restore the original images, demonstrating that the DPSIS-RDHED algorithm is fully reversible.

[0125] Table 6

[0126]

[0127] 2) Error rate:

[0128] The error rate is an important metric for measuring the accuracy of secret information extraction or image restoration. Lower error rates indicate better performance in information extraction or image reconstruction. Error rates are often expressed using error plots. These plots compare the processed data bit by bit with the original data, with equality being 0 and negativity being 1. To further demonstrate the reversibility of the TES-RDHED algorithm, the extracted secret was compared bit by bit with the embedded secret. Figure 11 The figure shows the error graph formed by comparing the extracted additional information with the embedded secret information bit by bit after Goldhill is secretly embedded in the k=3, n=4 scheme. Figure 11 It can be seen that the error graph between the re-extracted additional information and the embedded secret is 0, indicating that the extracted additional information is completely correct, that is, the TES-RDHED algorithm of the present invention is completely reversible.

[0129] (4) Expansion rate:

[0130] Data expansion refers to the size of the ciphertext image being larger than the original image size, and the data expansion rate refers to the ratio of the ciphertext image size to the original image size. The TSE-RDHED algorithm is compared with similar algorithms: DD-RDHEI, SOK-RDHEI, RDHEI-SH, Ciphertext Domain Reversible Information Hiding Based on Password Feedback Secret Sharing (CFSS-RDHEI), Ciphertext Image Reversible Information Hiding Based on Preconditioning-Free Matrix Secret Sharing (PFMSS-RDHEI), MSS-RDHEI, SIS-RDHED, and MSB-RDHED. All algorithms utilize secret sharing to generate secret shares. SOK-RDHEI employs multiple secret sharing and lightweight encryption, generating only one encrypted image. Its relative and total expansion rates are both 1. RDHEI-SH, CFSS-RDHEI, MSS-RDHEI, MSB-RDHED, and PFMSS-RDHEI all utilize secret sharing to generate n secret shares. Their total expansion rates are all n times the relative expansion rate. SIS-RDHED first performs adaptive MSB prediction on the original image and then uses secret sharing to split the secret image into n encrypted images, each of which is 2 / (r-1) the size of the original image. Since data embedding does not result in data expansion, the total size of the n labeled encrypted images is 2n / (r-1) the size of the original image. The TSE-RDHED algorithm performs two embedding operations before secret sharing. The expansion rate of the first embedding is 1, and the size of the encrypted image during the second embedding is 2 / q of the original image. Therefore, the relative expansion rate is 2 / q, and the total expansion rate is 2n / q. Since q ≥ 2 in the general case, the expansion rate of the TSE-RDHED algorithm is relatively small. Table 7 shows the data expansion rate comparison results of each algorithm.

[0131] Table 7

[0132]

[0133] (5) Time complexity:

[0134] Time complexity is an important metric for evaluating the security of a scheme. To further analyze the security of the proposed algorithm, Table 8 lists the theoretical time complexities of different SIS-RDHED schemes and compares them with several state-of-the-art secret sharing techniques: DD-RDHEI, SOK-RDHEI, RDHEI-SH, CFSS-RDHEI, MSS-RDHEI, MSB-RDHED, and PFMSS-RDHEI. Table 8 lists the theoretical time complexity comparison results from relevant literature. For a single pixel, RDHEI-SH, CFSS-RDHEI, MSS-RDHEI, MSB-RDHED, and TSE-RDHED algorithms have the same computational complexity. However, for images of size M1×N1, RDHEI-SH and CFSS-RDHEI have higher computational complexity because they only share one pixel at a time. MSS-RDHEI and SIS-RDHED have the lowest computational complexity because they share k pixels at a time. From a cryptographic perspective, encrypting too many pixels at a time reduces the security of secret sharing. Therefore, the TSE-RDHED algorithm sets a parameter q to control the number of pixels shared each time. The appropriate parameter can be selected according to different security environments. The TSE-RDHED algorithm shares q pixels each time, and its computational complexity is moderate and within an acceptable range.

[0135] Table 8

[0136]

[0137] The embodiments described above are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by persons skilled in the art should fall within the scope of protection defined by the claims of the present invention.

Claims

1. A two-stage embedding method for reversible information hiding in ciphertext domain, characterized in that: The following steps are involved: S1. The image owner predicts the carrier image based on the improved MED predictor to obtain a predicted image; and obtains label information based on the carrier image and the predicted image; S2. Obtain auxiliary information and reserved information based on the tag information; embed the auxiliary information and the reserved information into the predicted image to obtain a first embedded image; and encrypt the first embedded image to obtain an encrypted image; S3. The information hider decrypts the encrypted image to obtain a first decrypted image; determines an information embedding position of the first decrypted image based on the auxiliary information, and embeds the secret information Secret 1 into the information embedding position to obtain a second embedded image; S4. Encrypt the auxiliary information and calculate a secret share based on a pre-constructed polynomial; and divide the encrypted auxiliary information and the secret share into n share images; S5. Decrypt the auxiliary information in the share image and restore the secret information Secret 1 based on the decrypted auxiliary information; after the user completes the corresponding task according to the secret information Secret 1, embed the secret information Secret 2 in the share image to obtain the Mshare image; S6. The receiver extracts secret information Secret 2 and secret information Secret 1 from the Mshare image to obtain the carrier image.

2. The two-stage embedding ciphertext domain reversible information hiding method according to claim 1 is characterized in that: In S1, the carrier image is predicted based on the improved MED predictor, and the method for obtaining the predicted image includes: Where i, j represent the row and column numbers of pixel p(i,j), i≥1, j≥1; p′(i,j) is the predicted pixel; p(i-1,j-1), p(i-1,j) and p(i,j-1) are the upper left, left and upper pixels of p(i,j), respectively.

3. The two-stage embedding ciphertext domain reversible information hiding method according to claim 1 is characterized in that: In S1, the predicted image and the carrier image are compared pixel by pixel to obtain the same number of MSB bits, and the same MSB bits are Huffman encoded to obtain the marking information.

4. The two-stage embedding ciphertext domain reversible information hiding method according to claim 2 is characterized in that: In S2, the auxiliary information includes: the tag information M, the total length L of the tag information M , encoding rule R, total length of encoding rule L R ; The reserved information N includes: the last 7-h LSB bits of the predicted pixel; Using the seed key h i and a pseudo-random number generator to generate an encryption key k1, use k1 to perform XOR encryption on the first embedded image to obtain the encrypted image, and transmit the seed key to the information hider through a secure channel.

5. The two-stage embedding ciphertext domain reversible information hiding method according to claim 4 is characterized in that: In S4, the seed key h is used i and a pseudo-random number generator to generate an encryption key k2, and encrypt the auxiliary information using a stream cipher; The pre-built polynomials include: f(x)=a0+…+a q-1 x q-1 +b q x q +…+b k-1 x k-1 mod2 8 , Where a0, a1, ..., a q-1 is q adjacent pixels, q ≥ 2; b q , b q+1 ,…,b k-1 is kq random numbers; The secret share s i =f(i), i=1, 2,...,n.

6. The two-stage embedding ciphertext domain reversible information hiding method according to claim 5, characterized in that: In S5, a (7,4) cyclic code is used to embed secret information Secret 2 in the share image to obtain the Mshare image. The method includes: S51, determine the code length t=7 and the information bit length r=4, and the check bit length tr=3; S52, find x t Factorization of -1 over finite fields: x 7 -1=(x+1)(x 3 +x+1)(x 3 +x 2 +1), the generating polynomial g(x) is x 7 A factor of -1 with power 3; S53, select the generating polynomial g(x)=x 3 +x 2 +1, the check polynomial is: h(x)=(x 7 -1) / g(x)=x 4 +x 2 +x+1; S54, determine the corresponding generator matrix G and check matrix H: S55. Select 3 consecutive bits of the share image as an embedding vector x = {x1, x2, x3}, select 7 bits from the secret information Secret2 as m = {m1, m2, ..., m7}, calculate m-xH = EH, where E is the error pattern; then calculate y = x + E to complete the embedding of m into x; where the total length of E padding is (L N +L E ) / q,L N To retain the length of the information; L E The length of the secret information Secret 2.

7. The two-stage embedding ciphertext domain reversible information hiding method according to claim 6, characterized in that: In S6, the method for the receiver to obtain the carrier image includes: According to the auxiliary information, the length of the compressed part of the encrypted secret sharing is (L N +L E ) / q, calculate yH=(x+E)H=xH+EH, and yH=m by m-xH=EH; then directly extract the secret information Secret2 embedded in the Mshare image; According to the length (L N +L E ) / q extracts the padded E, calculates yE to obtain the carrier x before embedding the m information; reconstructs the pre-constructed polynomial from the k Mshare images, obtains the coefficients of the polynomial, and then obtains the restored image; then, decrypts the restored image and extracts the first 20 bits of the first decrypted image to obtain the length L of the tag information M , according to L M The Huffman codeword M can be extracted; then the next 72 bits are extracted to obtain the encoding rule R; the h sequence of the predicted image is restored according to the Huffman encoding rule and the codeword length, the embedded secret information Secret1 is obtained according to the h sequence and the retained information N, and the encrypted carrier image is restored according to the encoding rule R and the Huffman codeword M.

Images