Ciphertext domain reversible information hiding method based on multi-key threshold decryption

Abstract

The invention discloses a ciphertext domain reversible information hiding method based on multi-key threshold decryption, which comprises the following steps: generating a system public key share and a private key share through a key server, and distributing the private key share to a decryption end; obtaining an original image through an image providing end, and encrypting the original image according to the system public key to obtain an encrypted image; dividing the embedded message into a first message and a second message through the data hiding end, embedding the first message into the encrypted image by adopting a value expansion embedding algorithm, and embedding the second message into the encrypted image embedded with the first message by adopting a random number refreshing embedding algorithm to obtain a ciphertext-containing image; performing message extraction on the image containing the secret ciphertext through a decryption end to obtain a second message, and decrypting the image containing the secret ciphertext to obtain a distributed decrypted image; and performing joint decryption on the plurality of distributed decryption images through an image receiving end to obtain a plaintext image, and performing message extraction and recovery on the plaintext image to obtain a first message and an original image.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption transmission, and in particular relates to a ciphertext domain reversible information hiding method based on multi-key threshold decryption. Background Art

[0002] In the information age, the secret transmission and secure storage of data have become increasingly prominent needs. Traditional information hiding (DH) embeds information into a specific carrier to achieve secret transmission. Its core goal is to ensure the confidentiality of information and accurate extraction by the receiving end, which usually inevitably causes distortion of the original carrier. In fields such as medical image analysis and military intelligence transmission that have extremely high requirements for data integrity, in addition to completing the accurate transmission of messages, the distortion of the original carrier is unacceptable.

[0003] With the rapid development of cloud computing technology, in order to make data more valuable, many units upload data to the cloud, and medical institutions also use cloud platforms to provide patients with better services. However, due to the need for privacy protection and industry regulations, medical data needs to be encrypted before uploading. Reversible Data Hiding on Encrypted Domain (RDHED) technology allows additional information to be embedded in the encrypted domain and the original data to be restored losslessly after decryption, which has become a hot topic of research.

[0004] In essence, the research on RDHED is mainly to design schemes by combining encryption and information hiding technology. According to the encryption system adopted, RDHED can be divided into two categories. The first category adopts a symmetric encryption system and designs RDHED schemes based on symmetric cryptographic systems such as stream ciphers or block ciphers. The advantages of this method are fast encryption and decryption speed and small ciphertext expansion; however, the communicating parties need to share the same key, but it is unrealistic to establish a secure key channel between every two participants. The second category adopts a public key encryption system, which can make up for the shortcomings of symmetric encryption. Its security can be reduced to a certain difficult problem, and it is theoretically guaranteed to provide higher security.

[0005] In recent years, the research on RDHED algorithm based on public key encryption has mainly focused on homomorphic encryption technology. The advantage of homomorphic encryption is that it allows arithmetic operations on data directly in the encryption domain, which is suitable for processing encrypted data in the cloud. Its related technologies mainly study the redundancy of plaintext and ciphertext in the carrier of Paillier encryption in the semi-homomorphic encryption domain. By reserving space before encryption and using the homomorphism and randomness of the Paillier cipher after encryption, the ciphertext value is accurately changed to embed the message.

[0006] The above RDHED schemes based on homomorphic encryption all utilize the properties of public key cryptography. The sender encrypts the carrier (or the carrier containing embedded information) with the public key of the receiver, and the receiver decrypts the encrypted carrier with the (unique) private key; depending on the embedding timing, the receiver extracts the embedded information before or after decryption, and finally achieves the purpose of transmitting the message and recovering the original carrier without loss. For the convenience of description, the above system is called a single key pair homomorphic system (SKHS). With the increasing demand for data sharing among multiple participants in the network environment, the security issues caused by the centralized management of private keys are becoming increasingly apparent. The security of the system is heavily dependent on the security of the private key. If the private key is leaked or abused, the security of the entire system will be seriously threatened. The centralized management of private keys may also lead to single point failures. Once there is a problem with the custodian of the private key, the reliability of the entire system will be affected. Summary of the invention

[0007] In order to solve the above technical problems, the present invention proposes a reversible information hiding method in the ciphertext domain based on multi-key threshold decryption, so as to improve the system security and reliability in a secure multi-party computing environment, enable each participant to verify the legitimacy of the received data, and be able to reliably transmit messages in the ciphertext domain and restore the carrier without loss, thereby solving the problems existing in the above-mentioned prior art.

[0008] To achieve the above object, the present invention provides a ciphertext domain reversible information hiding method based on multi-key threshold decryption, comprising:

[0009] Generate system public key and private key shares through the key server, and distribute the private key shares to several decryption terminals;

[0010] The original image is obtained through the image provider, and the original image is encrypted according to the system public key to obtain an encrypted image;

[0011] The embedded message is divided by the data hiding end to obtain a first message and a second message, the first message is embedded into the encrypted image by using a value extension embedding algorithm, and the second message is embedded into the encrypted image embedded with the first message by using a random number refresh embedding algorithm to obtain a ciphertext image;

[0012] The decryption end extracts the message from the encrypted ciphertext image to obtain the second message, and uses the private key share to decrypt the encrypted ciphertext image to obtain a distributed decrypted image;

[0013] A plurality of distributed decrypted images are jointly decrypted by an image receiving end to obtain a plaintext image, and messages are extracted and restored from the plaintext image to obtain a first message and an original image.

[0014] Optionally, the process of generating system public and private key shares includes:

[0015] Input security parameters through the key server, generate two different security prime numbers according to the security parameters, and obtain sub-primes according to the security primes, and arbitrarily select a semi-random constant and a random constant; obtain the public key according to the security primes, sub-primes and the selected constants; the public key pk=(N,g,Δ,v), where N=pq, p and q are respectively security primes of equal length, g is the selected semi-random constant, Δ=n!, and v represents the selected random constant; g satisfies: And gcd(L(g λ modN 2 ),N)=1,λ=p'q',n is the number of private key shares; p',q' represent different sub-prime numbers, satisfying: p=2p''+1,q=2q'+1.

[0016] The decryption key is calculated by the Chinese remainder theorem, where d satisfies: d = 1 mod N and d = 0 mod λ;

[0017] Private key sk = (d), the private key sk is divided by Shamir's secret sharing method to obtain private key shares.

[0018] Optionally, the process of encrypting the original image includes:

[0019] The original image is encrypted using the system public key through the image provider using a probabilistic polynomial time algorithm to generate an encrypted image, wherein each plaintext pixel in the original image is encrypted in a raster scanning order to obtain a ciphertext pixel, and the ciphertext pixels are aggregated to obtain the encrypted image.

[0020] Optionally, the process of embedding the first message into the encrypted image includes:

[0021] Obtaining an embedding rate t of the value extension embedding algorithm through the data hiding end, grouping the first message according to the embedding rate of the value extension embedding algorithm to obtain a first message group, wherein each t-bit-long binary array in the first message group corresponds to a ciphertext pixel of the encrypted image, and when the last group is less than t bits, the high bits are padded with 0;

[0022] According to the raster scanning order, the last ciphertext pixel is reserved, and the new ciphertext value c' is calculated for the other ciphertext pixels:

[0023] Where c represents a ciphertext pixel, g and N represent the selected semi-random constant and part of the public key in the system public key, mod represents the remainder function, and b represents the t-bit-long binary array corresponding to the ciphertext pixel;

[0024] The embedding rate t of the value extension embedding algorithm is expressed as a 12-bit binary number, and the last ciphertext pixel c is embedded in the value extension embedding algorithm. l Encryption is the calculation of the new ciphertext value:

[0025]

[0026] Among them, c l ' represents the new ciphertext value of the last ciphertext pixel; all recalculated ciphertext pixels are summarized to obtain the encrypted image embedded with the first message.

[0027] Optionally, the process of embedding the second message into the encrypted image embedded with the first message includes:

[0028] Obtaining an embedding rate s of a random number refresh embedding algorithm through a data hiding end, and grouping the second message according to the embedding rate of the random number refresh embedding algorithm, wherein each s-bit-long binary array in the second message group corresponds to a ciphertext pixel embedded in the encrypted image of the first message, and when the last group is less than s bits, the high bits are padded with 0;

[0029] According to the raster scan order, the last ciphertext pixel is reserved and an integer is arbitrarily selected. Calculate the new ciphertext value c" for other ciphertext pixels:

[0030] c"=c'r' N modN 2

[0031] For each s-bit long binary array b'=b'1b2'...b s ',judge:

[0032] c"mod2 s =b1'b'2...b' s

[0033] Is it true? If not, reselect r'; if true, use c" as the new ciphertext;

[0034] The embedding rate s of the random number refresh embedding algorithm is represented by a 4-bit binary number, and the last ciphertext pixel is encrypted by the random number refresh embedding algorithm, which is the new ciphertext value c l ” calculation:

[0035] c l ”=c l 'r l 'modN 2

[0036] By constantly reselecting r l ',judge:

[0037] c l "mod2 4 =s

[0038] After the match, cl” is used as the new ciphertext value of the last ciphertext pixel, and all the recalculated ciphertext pixels are summarized to obtain the encrypted ciphertext image.

[0039] Optionally, the process of extracting a message from a ciphertext image includes:

[0040] The message is extracted from the encrypted ciphertext image using a deterministic polynomial time algorithm at the decryption end, where:

[0041] According to the raster scanning order, the ciphertext value c of the last ciphertext pixel of the ciphertext image is l ” to calculate:

[0042] s=cl”mod2 4

[0043] Where s represents the embedding rate of the random number refresh embedding algorithm;

[0044] The remaining ciphertext pixels are calculated according to the embedding rate of the random number refresh embedding algorithm:

[0045] b'=c"mod2 s

[0046] b' represents each s-bit long binary array, and each s-bit long binary array is connected to obtain the second message.

[0047] Optionally, the process of decrypting the encrypted ciphertext image using the private key share includes:

[0048] The decryption end uses a probabilistic polynomial time algorithm to perform distributed decryption on the ciphertext image;

[0049] Among them, for each encrypted pixel c'' of the ciphertext image, the distributed decryption value c is calculated i :

[0050]

[0051] Aggregating the distributed decrypted values ​​of each encrypted pixel to obtain a distributed decrypted image;

[0052] And calculate the verification value v i :

[0053] Where i is an integer and 1≤i≤n, v represents a random constant, Δ represents a common parameter, S i Represents a private key share.

[0054] Optionally, the process of jointly decrypting a plurality of distributed decrypted images includes:

[0055] The image receiving end uses a deterministic polynomial time algorithm to jointly decrypt several distributed decrypted images, where:

[0056] Validate based on validation value:

[0057]

[0058] Among them, c i represents an arbitrarily selected pixel in the distributed decrypted image, c is the corresponding ciphertext pixel, v is the public parameter, and v i is the verification value.

[0059] If the verification is successful, the distributed decrypted image of this share is untrustworthy and the distributed decrypted image shares need to be collected again; if the verification is successful, each pixel in the distributed decrypted image is decrypted and calculated:

[0060]

[0061] m'=L(c'modN 2 )(4Δ 2 ) -1

[0062] Get the decrypted plaintext pixel m', where Δ is the public parameter, i is the private key share number, i' represents the counter, and S is the set of collected private key share numbers;

[0063] The plaintext pixels are aggregated to obtain the plaintext image.

[0064] Optionally, the process of extracting the message and restoring the plaintext image includes:

[0065] The image receiving end uses a deterministic polynomial time algorithm to extract and restore the plaintext image:

[0066] According to the raster scanning order, the last pixel m of the plaintext image l 'Calculate and obtain the embedding rate t of the value expansion embedding algorithm:

[0067] t=m l 'mod2 12

[0068] pass Get the original pixel value of the last pixel;

[0069] The remaining pixels m' of the plaintext image are decrypted by the embedding rate t of the value extension embedding algorithm to obtain the embedded t-bit long binary array and the original pixel values ​​of the remaining pixels:

[0070] b=m'mod2 t

[0071]

[0072] Where b is a t-bit long binary array,

[0073] Connect each t-bit-long binary array to obtain a first message;

[0074] All original pixel values ​​are summed up to get the original image.

[0075] Compared with the prior art, the present invention has the following advantages and technical effects:

[0076] The solution proposed by the present invention enhances the security and flexibility of the system by assigning independent decryption keys to each decryption party. It allows secure data sharing between different parties without worrying about the leakage of a single private key. In addition, by decentralizing key management, the risk of single point failure is reduced, and the reliability and stability of the system are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0078] Figure 1 It is a schematic diagram of an example of applying the ciphertext domain reversible information hiding method based on multi-key threshold decryption according to an embodiment of the present invention to multi-party consultation;

[0079] Figure 2 Flow chart of the three types of RDHED embedding method according to an embodiment of the present invention;

[0080] Figure 3 It is a schematic flow chart of a method for reversible information hiding in a ciphertext domain based on multi-key threshold decryption according to an embodiment of the present invention;

[0081] Figure 4 A schematic diagram of a test image according to an embodiment of the present invention;

[0082] Figure 5 Schematic diagram of different images generated during the process of the ciphertext domain reversible information hiding method based on multi-key threshold decryption according to an embodiment of the present invention. DETAILED DESCRIPTION

[0083] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0084] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0085] At present, reversible information hiding in ciphertext domain has attracted more and more attention for privacy protection and secret transmission in a secure multi-party environment. In view of the security issues such as private key leakage and single point failure caused by a single public-private key pair, this paper proposes a secure multi-party ciphertext domain reversible information hiding scheme RDHED-SMMTD based on multi-key threshold decryption. The present invention uses the threshold Paillier cryptographic algorithm, supports one encryption public key and multiple decryption private keys, embeds the message twice in the ciphertext domain, and the embedded message is partially extracted in the ciphertext domain and partially extracted in the plaintext domain after decryption. The message can be completely extracted twice, and the carrier can be restored losslessly at last. During decryption, only when the number of decryptors with different keys reaches the threshold can the decryption be successful, while a smaller subset of decryptors cannot obtain any useful information. The experiment verifies the effectiveness of the scheme. Compared with the most advanced known embedding algorithm, the storage space of auxiliary information is compressed, and the comprehensive embedding capacity reaches the highest level of similar algorithms. The maximum embedding rate reaches 14bpp in the ciphertext domain and 1015bpp in the plaintext domain after decryption.

[0086] The solution proposed by the present invention enhances the security and flexibility of the system by assigning independent decryption keys to each decryption party. It allows different parties to share data securely and work together without worrying about the leakage of a single private key. In addition, by decentralizing key management, the risk of single point failure is reduced, and the reliability and stability of the system are improved. Figure 1 The application of this solution is described using a multi-party consultation in a hospital as an example.

[0087] In this scenario, this solution generates a shared public key for encryption and assigns a private key share to each doctor participating in the consultation. The medical imaging center first encrypts the patient's medical image with the public key, and the data center then securely embeds the patient's medical information and authentication information in the ciphertext domain, and then transmits it to all doctors participating in the consultation without worrying about the data being analyzed or cracked during transmission. Then, each doctor can extract the authentication information in the ciphertext domain to verify the source of the information, and then decrypt the data with his or her own private key share. During the hospital consultation process, when the designated doctors arrive, all the decryption shares are collected together, and the decryption shares are first verified. After the verification is passed, the complete medical data is jointly extracted through joint decryption, and the patient's medical images are restored for collaborative analysis and discussion. After the consultation, the patient can get a diagnosis result that integrates the opinions of multiple parties. In this process, the data provided by the data center, consulting doctors, and consulting hospitals can be verified by the recipient for their legitimacy, and all processes are completed under the premise of protecting privacy.

[0088] The innovative points of this solution are summarized as follows:

[0089] (1) A secure multi-party reversible information hiding scheme in the ciphertext domain based on multi-key threshold decryption is proposed. The decryption can only be successful when the decryptor subset is large enough, while a smaller decryptor subset cannot obtain any useful information. The system can resist the collusion attack of (k-1) participants, effectively solving the security problems of private key leakage and single point failure. (2) By combining the two embedding algorithms of value expansion and random number refresh, reversible embedding and extraction under the conditions of secure multi-party computing are realized, and each participant can verify the source of the data. The embedded information is partially extracted in the ciphertext domain and partially extracted in the plaintext domain after decryption. The scheme is flexible and practical. (3) Compared with the existing RDHED method, the comprehensive embedding capacity of this scheme reaches the highest level of similar algorithms. Experimental results show that the maximum embedding rate reaches 14bpp in the ciphertext domain and 1015bpp in the plaintext domain. In addition, compared with similar schemes, our method compresses the storage space of auxiliary information, and the algorithm has a higher payload capacity.

[0090] 1. Explain the relevant work and the relevant principles involved:

[0091] First, the Paillier cipher scheme is introduced, then the additive homomorphism and Shamir secret sharing algorithm of the Paillier cipher are introduced, and finally the threshold Paillier cipher scheme is introduced. The symbols used in the scheme are shown in Table 1.

[0092] Table 1

[0093]

[0094]

[0095] 1-1. Paillier cipher scheme:

[0096] The Paillier cipher is a public key cryptographic scheme that supports additive homomorphism. It was first proposed by Paillier and meets semantic security, namely, ciphertext indistinguishability under chosen plaintext attacks (IND-CPA). The security of the scheme can be reduced to the Decisional Composite Residuosity Assumption (DCRA) problem. The Paillier cipher scheme consists of the following algorithms:

[0097] (1) Key generation. First, select two large prime numbers p and q of equal length but different values, and calculate the product of p and q N = pq; then select an integer And satisfy gcd(L(g λ modN 2 ),N)=1, where the auxiliary function L(x) is:

[0098] L(x)=(x-1) / N (1)

[0099] x is the independent variable.

[0100] calculate:

[0101] λ=lcm(p-1,q-1) (2)

[0102] μ=(L(g λ modN 2 )) -1 modN (3)

[0103] Among them, mod is the remainder function, then the public key pk = (N, g), and the private key sk = (λ, μ).

[0104] (2) Encryption. Any integer Given a plaintext m∈Z N , encrypted by the public key pk, the corresponding ciphertext c is:

[0105] c=Enc(m,r)=g m r N mod N2 (4)

[0106] (3) Decryption. The ciphertext c can be decrypted as follows to obtain the corresponding plaintext m:

[0107] m=Dec(c)=L(c λ mod N 2 )·μmod N (5)

[0108] If the Paillier cipher algorithm is used to encrypt a digital image, each pixel needs to be encrypted using formula (4), and finally a large integer array is obtained. Each large integer in this array is decrypted using formula (5), and the original image can be obtained by summing up. The premise of the correctness of decryption is that the pixel value of the digital image is located in Z N , which is usually satisfied. For example, for grayscale images, the pixel value is [0, 255], and the bit length of the Paillier cipher public key N only needs to be greater than 8 bits to be correctly decrypted.

[0109] 1-2. Additive Homomorphism of Paillier Cipher

[0110] The Paillier cipher has additive homomorphism. Assume that for different plaintexts m, m1, m2, the corresponding ciphertexts are: c = Enc(m) = g m r N mod N 2 , c1=Enc(m1)=g m1 r1 N mod N 2 , It can be calculated that:

[0111]

[0112] c k mod N 2 =(g m r N ) k mod N2=g km (r k ) N mod N 2 (7)

[0113] cg k mod N 2 =g m r N g k mod N 2 =g m+k r N mod N 2 (8)

[0114] As you can see, c1c2, c k , cg k They are the legal ciphertexts of m1+m2, km, and m+k respectively.

[0115] There are already some RDHED schemes based on Paillier additive homomorphism. By multiplying the ciphertext value by itself in the encryption domain, the corresponding plaintext pixel value can be doubled. In addition, the ciphertext value multiplied by 1 can be embedded with 1, and the ciphertext without any operation or multiplied by 0 can be embedded with 0.

[0116] 1-3. Shamir Secret Sharing

[0117] The Shamir secret sharing algorithm is a cryptographic primitive that distributes a secret to multiple parties, and the secret can only be recovered when certain conditions are met. Specifically, Shamir secret sharing includes the following steps:

[0118] (1) Parameter selection: Select a large prime number p, determine the number of participants n and the threshold k, and satisfy: p ≥ n, in the prime field F p Randomly generate a1, a2, ...a k-1 , as the non-constant coefficient of the (k-1)th degree polynomial f(x).

[0119] (2) Secret distribution: Assuming that the secret to be shared is S, construct the polynomial:

[0120] f(x)=(S+a1x+…a k-1 x k-1 )mod p

[0121] Calculate different polynomial values ​​f(1), f(2), ... f(n), with n participants holding secret shares (i, f(i)) respectively, where i represents the participant sequence number, and destroy the polynomials f(x) and S.

[0122] (3) Secret recovery: Assuming that at least k secret shares are obtained, the secret S can be reconstructed using the following Lagrange interpolation formula:

[0123]

[0124] Among them, i represents the private key share serial number, i′ represents a counter, and also represents a private key share serial number different from i.

[0125] 1-4. Threshold Paillier Cipher Scheme

[0126] The threshold Paillier cipher scheme is a generalized extension of the standard Paillier cipher. Assume that the set of participants is P = {P1, P2, ..., P n}, the number of participants is n, and the threshold Paillier scheme consists of the following algorithm:

[0127] (1) Key generation. Select two large secure prime numbers p and q, that is, p and q satisfy: p = 2p′+1, q = 2q′+1, where p′ and q′ are prime numbers of equal length; calculate N = pq, λ = p′q′. Select g = N+1, calculate the public parameter Δ and the decryption key d, where: Δ = n!, d satisfies: d = 1 modN and d = 0 modλ. In addition, the system also needs to share a common constant v among all parties, specifying the public key pk = (N, g, Δ, v), and the private key sk = (d).

[0128] (2) Encryption. Random selection The ciphertext c is calculated according to formula (4). The encryption process is the same as the standard Paillier encryption.

[0129] (3) Secret sharing. Take d as a constant term and use the Shamir secret sharing algorithm to construct a (k,n) threshold for secret sharing and generate a secret share (i,S i ), i represents the serial number of each participant, n is the number of secret shares, and k is the threshold for secret recovery.

[0130] (4) Share decryption. Each participant is given a ciphertext c and a secret share S i , and the system public key, the i-th participant calculates the shared decryption value c i and the verification value v i :

[0131]

[0132] (5) Joint decryption. Given k shared decryption values ​​c i 、Verification value v i And the set S corresponding to i, as well as the system public key, first verify for each participant:

[0133]

[0134] If the verification passes, continue, otherwise terminate.

[0135] Continue to calculate the intermediate results:

[0136]

[0137] Then calculate the combined ciphertext c':

[0138]

[0139] After simplification:

[0140]

[0141] Finally, calculate the plaintext m:

[0142] m=L(c'modN 2 )(4Δ 2 ) -1 (16)

[0143] Thus, the plaintext m is obtained.

[0144] 1-5. Three types of RDHED

[0145] According to the timing of embedding information, the existing RDHED algorithms can be divided into three types: vacating room before encryption (VRBE), vacating room after encryption (VRAE), and vacating redundancy in encryption (VRIE).

[0146] The VRBE-based RDHED algorithm utilizes the redundant information in the original image and frees up space from the original image before encrypting and embedding data, which has a higher embedding capacity. Although the VRBE algorithm has a higher embedding capacity, the complex preprocessing process increases the computational burden of the content owner and has many limitations in practical applications.

[0147] VRAE technology implements space-freeing operations in the ciphertext domain, and does not require content owners to preprocess the original carrier. However, after the original carrier is encrypted, the information entropy is close to the limit value, and it is very challenging to modify the ciphertext to embed information without destroying the decryption function. By choosing a specific encryption scheme, the embedding capacity of the RDHED algorithm based on VRAE is now comparable to that of the RDHED algorithm based on VRBE.

[0148] VRIE technology uses the redundancy generated in the encryption process for reversible embedding, and the embedding and encryption processes are completed simultaneously. The existing VRIE-type ciphertext redundancy mainly comes from the lattice cipher LWE encryption algorithm. After being introduced into the RDHED field, the LWE encrypted ciphertext domain space is quantified, and the LWE encrypted ciphertext is re-encoded based on the redundancy generated in the LWE encrypted ciphertext expansion, so that it carries additional information. VRIE-type algorithms have good reversibility, strong security, and a large amount of ciphertext embedding. The algorithm design is based on an in-depth analysis of the cryptographic algorithm and is an emerging research direction.

[0149] From the above analysis, it can be seen that the above three types of embedding methods each have their own advantages and limitations and different scopes of application, which provide different design paths for RDHED. The appropriate embedding method can be designed in combination with the actual situation. Figure 2 Flowcharts of the embedding methods for the three types.

[0150] 2. The technical solution proposed by the present invention:

[0151] This part is based on the threshold Paillier cryptographic algorithm and proposes a secure multi-party reversible information hiding scheme RDHED-SMMTD based on multi-key threshold decryption.

[0152] 2-1. System structure involved in the encrypted transmission process of the above technical solution

[0153] This solution includes five participants: key server (Key Server), image provider (ImageProvider), data hiding end (DataHider), decryption end (Decryptors) (multiple) and image receiver (ImageReceiver). Figure 3 As shown in (a) in the figure, the key server is responsible for generating system public keys and private key shares, and distributing the private key shares to the decryption end; Figure 3 As shown in (b) in the figure, the image provider uses the system public key to encrypt the original image and then transmits it to the data hiding end; Figure 3 As shown in (c) in the figure, the data hiding end embeds the message twice in different ways in the encryption domain and distributes the ciphertext image to the decryption end; Figure 3 As shown in (d) in , the decryption end can extract part of the message in the encryption domain and generate a distributed decryption image using each private key share; Figure 3 As shown in (e), after the image receiver collects at least k distributed decrypted images, it performs joint decryption, extracts the remaining message in the plaintext domain, and restores the original image. Figure 3 This is the system flow chart of this solution.

[0154] 2-2. Solution Design

[0155] The technical solution proposed by the present invention includes the following stages:

[0156] 2-2-1. Key Generation

[0157] Through KeyGen(1 λ’ ) Generate the system public key and private key shares. This step mainly uses the Probabilistic Polynomial-time (PPT) algorithm and is executed by the key server. In the key server, a security parameter λ' is input, and the system public key pk=(N,g,Δ,v) is output, and the private key share set {(i,S i )|1≤i≤n}. The plaintext space of the system is Z N , the ciphertext space is The key server determines the decryption end P = {P1, P2, ..., Pn}, the number of decryption terminals is n. According to the security parameter λ', arbitrarily select two secure prime numbers p and q of equal length, so that p = 2p'+1, q = 2q'+1, where p' and q' are also prime numbers of equal length, calculate N = pq, λ = p'q', public parameter Δ = n!, select any constant v, use the Chinese remainder theorem to calculate d, so that d satisfies d = 1modN and d = 0modλ, and then select g = N+1. Public key k = (N, g, Δ, v), private key sk = (d). sk is split using the Shamir secret sharing method, setting the threshold value k, setting d to a constant term, and generating the private key share (i, S i ) is kept by n decryption terminals, and finally the polynomial and private key sk are destroyed. It should be noted that the key server only appears in the key generation phase and no longer participates in the subsequent phases.

[0158] 2-2-2. Encryption

[0159] Generate the encrypted image EI through Enc(I,pk). This step mainly uses the PPT algorithm and is performed by the image provider. Given the carrier plaintext image I and the system public key pk, process each plaintext pixel m∈I in raster scanning order, calculate the encrypted pixel according to formula (4): c=Enc(m,pk), and finally aggregate all encrypted pixels to obtain the encrypted image EI, which is passed to the data hiding end.

[0160] 2-2-3. Message Embedding

[0161] By Emb(EI,m A ,m B ) Generate embedded message m A and m B The encrypted ciphertext image EI AB This step mainly uses the PPT algorithm and is performed by the data hiding end (such as a cloud server). Given an encrypted image EI, the first message m to be embedded A and the second message m B , combined with the value expansion embedding algorithm (Value Expansion, VE) and the random number refresh (Random Number Refresh, RNR) embedding algorithm, finally get the embedding m A and m B The encrypted ciphertext image EI AB The specific embedding algorithm is:

[0162] (1) The data hiding end divides the message to be embedded into two parts: the first message m A and the second message m BThe first part is embedded using value extension and extracted in the ciphertext domain, and the second part is embedded using random number refresh and extracted in the decrypted plaintext domain; the following steps (2)-(5) are VE embedding, and (6)-(9) are RNR embedding.

[0163] (2) Determine the embedding rate t (1≤t≤1015) of the value extension embedding algorithm VE, and convert m A The pixels are grouped into groups of t bits. Each group of t-bit-long binary arrays corresponds to one pixel. When the last group is less than t bits, the high bits are padded with 0. Here, 1015 is the maximum embedding rate of the VE algorithm.

[0164] (3) For the encrypted image EI containing secrets, the last ciphertext pixel is reserved in the raster scanning order, and for other ciphertext pixels c'∈EI, the new ciphertext value is calculated using the VE algorithm:

[0165]

[0166] Where b is the t-bit-long binary array to be embedded, that is, b = b1b2...b t .

[0167] According to the additive homomorphism of Paillier's algorithm, it can be proved from equations (6), (7), and (8) that c' is 2 t The legal ciphertext of m+b is,

[0168]

[0169] Therefore, the result of formula (17) is the result of embedding t bits of information into each ciphertext pixel;

[0170] (4) The embedding rate t is expressed as a 12-bit binary number as t = t1t2...t 12 , also using the VE algorithm, the last ciphertext pixel value c l Encryption, calculation:

[0171]

[0172] Embed the t value into the last pixel c l Here 12 is a constant specified according to the embedding rate bit length.

[0173] (5) Finally, all encrypted pixels are aggregated to form m A The ciphertext image EI A .

[0174] (6) Determine the RNR embedding rate s (1≤s≤14), and embed the message m BGroup them into groups of s bits, so that each group of s-bit binary arrays corresponds to one ciphertext pixel, and when the last group is less than s bits, the high bits are padded with 0;

[0175] (7) EI A According to the raster scanning order, the last pixel is reserved, and for each remaining ciphertext pixel c'∈EI A , choose an arbitrary integer Calculate the new ciphertext c' as:

[0176] c"=c'r' N mod N 2 (20)

[0177] Assume that the binary array to be embedded is b'=b'1b2'...b s ',judge:

[0178] c"mod2 s =b1'b2'...b s ' (twenty one)

[0179] Is it true? If it is true, the algorithm continues; if it is not true, choose another Recalculate the ciphertext until equation (21) holds true, and then each pixel embeds an s-bit message.

[0180] Note that the result obtained by equation (21) is also the legal ciphertext of plaintext m, because: From equation (4) (20), we can get: c” = g m (rr') N modN 2 ,here (rr') can be regarded as So c” is also a legal ciphertext of m.

[0181] (8) The s value is expressed as a 4-bit binary number s = s1s2s3s4. The RNR algorithm is also used to calculate the last ciphertext pixel c. l ', any choice Calculate the new ciphertext c l "for:

[0182] c l ”=c l 'r l 'modN 2 (twenty two)

[0183] By repeatedly refreshing r l ', so that the ciphertext conforms to:

[0184] c l "mod2 4 =S (23)

[0185] After conforming to formula (23), s is embedded into the ciphertext pixel c through formula (22): l ”;

[0186] (9) Finally, all encrypted pixels are summarized to generate the embedding m A and m B The encrypted ciphertext image EI AB .

[0187] 2-2-4. Extracting messages from the ciphertext domain

[0188] Through Ext1(EI AB ) Extract the message m B . Ext1(EI AB ) algorithm is a Deterministic Polynomial-time (DPT) algorithm, which is executed by each decryption end. Given a ciphertext image EI AB , extract the embedded message m in the ciphertext domain B .

[0189] (1) Each decryption end receives the encrypted ciphertext image EI AB After that, according to the raster scanning order, the last ciphertext pixel c l ", apply the formula:

[0190] s=c l "mod2 4

[0191] Extract the embedded message s;

[0192] (2) Using the extracted s, apply the formula to each remaining ciphertext pixel:

[0193] b'=c"mod2 s

[0194] Extract the embedded s-bit message b'=b'1b2'...b s ';

[0195] (3) Connect these messages together to get the embedded message m B .

[0196] 2-2-5. Share Decryption

[0197] Through ShareDec(EI AB ,{S i |1≤i≤n},Δ,v) to obtain the distributed decrypted image set {EI ABi ,v i|1≤i≤n}. The ShareDec() algorithm is a PPT algorithm, which is executed by n decryption terminals respectively. Given a ciphertext image EI AB 、Private key share S i And public parameters Δ, v, perform distributed decryption to obtain n distributed decrypted images EI Ai and the corresponding verification value v i (1≤i≤n). Note that the embedded m B It has been destroyed and cannot be extracted later. The specific method is:

[0198] (1) For each encrypted pixel c”∈EI AB , calculate its distributed decryption value c i for:

[0199]

[0200] (2) Summarizing the distributed decryption results of each pixel to obtain the distributed decrypted image EI Ai .

[0201] (3) Calculate the verification value v i for:

[0202]

[0203] Finally, the distributed decrypted image EI Ai and the verification value v i Sent together to the image receiving end.

[0204] 2-2-6. Joint decryption

[0205] By ComDec({(i,EI Ai ,vi)|1≤i≤k},Δ,v)) get the decrypted plaintext image I A The ComDec() algorithm is a DPT algorithm and is executed by the image receiving end. Given k distributed decrypted images EI Ai 、Verification value v i and the corresponding private key share number i, as well as the public parameters Δ and v, to obtain the embedded m A The plaintext image I A The specific method is:

[0206] (1) For each decrypted image EI Ai , randomly select a pixel c i ∈EI Ai , according to c i and the verification value v i , verify EI Ai Source reliability, i.e. calculation of:

[0207]

[0208] If the above equation holds true, the verification is successful, otherwise the verification fails and the distributed decrypted image is collected again.

[0209] (2) For k verified decrypted images EI Ai , according to the raster scan order, for each encrypted pixel c i ∈EI Ai And the set S corresponding to i, as well as the public parameter Δ, use equations (13)-(16) to decrypt the plaintext pixel m'.

[0210] (3) By summing up all the decrypted plaintext pixels, we get the A The plaintext image I A .

[0211] 2-2-7. Extract messages and restore images

[0212] Ext2_Res(I A )→(m A ,I). The Ext2_Res() algorithm is a DPT algorithm, which is executed by the image receiving end. Given a plaintext image I A , extract the embedded message m in the plaintext domain A , and restore the plaintext image. The specific algorithm is:

[0213] (1) According to the raster scanning order, I A For the last pixel m1', apply the formula:

[0214] t=m1'mod2 12

[0215] Extract the embedded message t;

[0216] (2) Using the formula:

[0217]

[0218] Restore the original pixel m l ;

[0219] (3) Using the extracted t, I A The first to the second to last pixel m'∈I A , apply the formula:

[0220] b=m'mod2 t

[0221] Extract the embedded t-bit message;

[0222] (4) Application formula:

[0223]

[0224] Restore the corresponding original pixels of the carrier;

[0225] (5) Connect the messages t extracted from (3) to get the embedded message m A ;

[0226] (6) All the plaintext pixels m are aggregated together to restore the original image I.

[0227] 3. Experimental results and analysis

[0228] In order to evaluate the functional performance of the proposed scheme, we selected four natural images with different textures ( Figure 4 (a)(b)(c)(d)) and 4 medical images ( Figure 4 (e)(f)(g)(h)) in is used as the test image. Figure 4 All test images are converted to grayscale images, but with different resolutions, where Figure 4 The resolution of (a) Man and (b) Plane is 512×512 pixels, the size of (c) Lake and (d) Peppers is 256×256 pixels, the size of (e) Med1 and (f) Med2 is 256×512 pixels, and the size of (g) Med3 and (h) Med4 is 512×256 pixels.

[0229] Experimental environment: All experimental programs are developed based on Python 3.6, the operating platform is a 64-bit Windows 10 (Professional Edition) operating system, and the hardware environment is Intel (R) Core (TM) i7-8565U CPU @ 1.80GHz, 8.00GB RAM.

[0230] Parameter setting: When implementing the threshold Paillier cryptosystem, the security parameter λ' is set to 1024, p and q are selected as 512-bit secure prime numbers, and (n, k) = {(7, 5), (5, 3), (4, 3), (3, 3)} are tested in the Shamir secret sharing algorithm respectively. The embedding rate of the VE algorithm is set to t = {1, 128, 256, 512, 1015}, and the embedding rate of the RNR algorithm is set to s = {1, 2, 4, 8, 12, 14}. The embedded messages are all randomly generated with the maximum embedding amount matching the embedding rate.

[0231] For the RDHED algorithm, different performances need to be evaluated, including payload (i.e., embedding rate) and reconstructed image quality. The embedding rate is expressed in bits per pixel (bpp), and it is expected to be as large as possible to embed the maximum amount of information. In order to evaluate the quality of the restored image, we used two reference indicators, namely Peak signal-to-noise ratio (PSNR) and structural similarity (SSIM).

[0232] Below, we analyze and evaluate the performance of our scheme, make extensive comparisons with some classic RDHED schemes, compare our scheme with the recent Paillier-based RDHED scheme in terms of auxiliary information, and finally perform a security analysis.

[0233] 3-1. Correctness Assessment

[0234] 3-1-1. Correctness Analysis

[0235] This scheme can be generally divided into: key distribution, encryption, threshold decryption, two embeddings and two extractions. The above processes are carried out alternately, and the two embeddings use two embedding methods, namely value expansion and random number refresh embedding. Therefore, the correctness of this scheme is mainly determined by encryption and decryption and the two embedding methods.

[0236] The correctness of multi-key threshold decryption is based on the correctness of Paillier encryption and decryption and Shamir secret sharing: key distribution mainly divides the private key d into n secret shares S using Shamir secret sharing method i The system encryption adopts the standard Paillier public key encryption. When decrypting shares, each Si is used as an exponent to exponentiate the ciphertext c. When decrypting jointly, d is recovered from the exponent through the Lagrange interpolation formula. The correctness of Shamir's secret distribution and secret recovery ensures that d can be correctly recovered from the exponent. Of course, due to the difficulty of the discrete logarithm problem, this d is difficult to calculate. Finally, the binomial theorem and L function can be used to recover the plaintext m.

[0237] The two embedding methods are both based on the probabilistic and additive homomorphic design of Paillier encryption. The random number refresh embedding method is to change the random number and modulo 2 s , so that the ciphertext embeds information in the lower s bits, by performing the same modulo 2 sThe embedded message can be extracted by operation; the value expansion embedding method is to change the ciphertext through homomorphic operation, so that the corresponding plaintext value is expanded to embed information, and the information can be extracted and the plaintext can be restored by performing the opposite operation on the plaintext after decryption. Both methods can be executed correctly because the ciphertext after the embedded information is legal ciphertext, so both can get the correct result through threshold Paillier decryption.

[0238] The combination of the two embedding methods in this scheme does not destroy each other's embedding space. The random number refresh method does not change the encrypted plaintext. The embedding can only be performed in a specific form that depends on the ciphertext. However, if the ciphertext is destroyed by subsequent embedding operations, the embedded message cannot be extracted losslessly. The value expansion embedding method changes both the ciphertext value and the decrypted plaintext value at the same time. Therefore, the value expansion method cannot be used after the random number refresh method. In this scheme, the value expansion method is used for the first embedding, and the random number refresh method is used for the second embedding. This ensures that the data embedded twice can be completely extracted and the plaintext can be restored losslessly.

[0239] 3-1-2. Accuracy of information extraction

[0240] There are two forms of information embedding and extraction in this scheme: ① The decryptor extracts the additional information embedded by the RNR method in the ciphertext domain; ② The receiver extracts the additional information embedded by the VE method in the plaintext domain after decryption. The experiment tested the situations under different settings, setting the Shamir secret sharing parameters (n, k) = {(7, 5), (5, 3), (4, 3), (3, 3)}, the embedding rate of the VE algorithm t = {1, 128, 256, 512, 1015}, the embedding rate of the RNR algorithm s = {1, 2, 4, 8, 12, 14}, and the embedded messages are all randomly generated with the maximum embedding amount under the corresponding embedding rate. The experiment tested the embedding and extraction functions of the information respectively, and compared the accuracy of the extracted information bit by bit. The results showed that under all settings, the accuracy of information extraction in the above two situations was 100%, indicating that the embedded information can be completely extracted.

[0241] 3-1-3. Reversibility of Plaintext Recovery

[0242] The experiment was conducted with different images, and the experimental results verified that the proposed scheme can correctly complete key distribution, encryption, and embedding of message m in sequence. A and m B , completely extract m in the ciphertext domain B , threshold decryption, and completely extract m in the decrypted plaintext domain A , and the plaintext image can be restored without distortion through reversible recovery. Figure 5 This is a verification experiment of reversible recovery using "Man" as the test image.

[0243] Figure 5 a. in is the original image, Figure 5 b. in the figure is the image encrypted using the Paillier algorithm. Figure 5 c. and Figure 5 d. in are respectively embedded in m A and m B The image after that. Paillier homomorphic encryption expands the pixel size of the image, and the larger the security parameter, the greater the expansion of the ciphertext. When the security parameter is 1024, for demonstration purposes, we use 256 bytes to represent one ciphertext pixel, so the width and height of the ciphertext image are increased to 16 times of the original image. Note that the increase in image size is only due to the expansion of the ciphertext, and the number of pixels in the image has not actually changed. Figure 5 In the figure, for aesthetics, the encrypted image and the ciphertext image are presented in the same size as the original image.

[0244] The image after decryption of the ciphertext image is as follows Figure 5 As shown in e. in , the PSNR of the decrypted image is recorded as PSNR1, and the SSIM is recorded as SSIM1. Because the VE method expands the value of the plaintext pixels, the representation range of the decrypted pixels is different, so PSNR1 is meaningless in this case. Figure 5 f. in is the restored plaintext image. The PSNR of the restored image is denoted as PSNR2, and the SSIM is denoted as SSIM2. In the experiment, the PSNR2 value approaches +∞, and the SSIM2 value approaches 1, indicating that the original image is restored without distortion.

[0245] 3-2. Embedded Capability Assessment

[0246] This section first analyzes the embedding ability of the algorithm, and then evaluates the embedding ability through experiments. The results are as follows:

[0247] 3-2-1. Embedding Capability Analysis

[0248] One of the key indicators for evaluating an RDHED algorithm is the maximum embedding capability. According to the steps in Part 2, the embedding capability of the embedding algorithm of this scheme includes two parts, namely, the embedding capability of the value expansion method in the plaintext domain after decryption and the embedding capability of the random number refresh method in the ciphertext domain.

[0249] The embedding ability of the value expansion algorithm depends on the degree of expansion of the plaintext. The encrypted plaintext m in this scheme is the grayscale image pixel value, m∈[0,255], so only 8 bits are needed to represent it; and according to the parameter setting of the Paillier algorithm, the range of the plaintext is: [0,N). According to the experimental results, when N is 1024 bits, each plaintext pixel can be expanded from 8 bits to 1023 bits at most, and it can still be correctly decrypted at this time, so the maximum embedding rate of the value expansion algorithm is 1015bpp. Note that when expanded to 1024 bits, if the pixel value m>N, it cannot be decrypted correctly.

[0250] Theoretically, there is no upper limit to the embedding capacity of the random number refresh embedding algorithm. However, as the number of embedded bits increases, the time complexity of the random number refresh algorithm increases exponentially. Therefore, the specific number of embedded bits can only be determined in the experiment according to different computing resources within the range allowed by time and space. The maximum embedding rate of the random number refresh embedding algorithm tested in this experimental environment can reach 14bpp.

[0251] 3-2-2 Experimental Results

[0252] This experiment tested the above 8 images respectively. The 8 images were divided into 4 groups and processed to different resolutions (N is 1024 bits). The test results are shown in Table 2:

[0253] Table 2

[0254]

[0255] In the above table, two methods are used to express the embedding rate, namely the plaintext embedding rate and the ciphertext embedding rate. The plaintext embedding rate refers to the number of bits of information per unit pixel in the plaintext domain after decryption, and the ciphertext embedding rate refers to the number of bits of information per unit pixel in the ciphertext domain. From the above table, it can be seen that when N is set to 1024 bits, the maximum ciphertext embedding rate can reach 14bpp and the maximum plaintext embedding rate can reach 1015bpp when verified on 8 test images of different sizes. At the same time, the PSNR values ​​of the restored images are close to +∞, and the SSIM is 1, indicating that the plaintext image can be restored without distortion.

[0256] 3-3. Comparison with other embedding algorithms

[0257] 3-3-1. Comparison of Embedding Performance

[0258] The proposed method is compared with the typical RDHED embedding algorithm using different images.

[0259] Among the known literature, the scheme proposed in this paper is the first RDHED scheme based on multi-key decryption. In terms of embedding rate, the stream cipher encryption adopted by the first three methods in Table 3 has a maximum embedding rate of 1bpp, 1bpp, and 4.78bpp respectively; the Paillier cipher encryption adopted by the 4th to 9th methods in Table 3 has a maximum ciphertext embedding rate of 14bpp and a maximum plaintext embedding rate of 1022bpp. All algorithms can achieve lossless restoration of the original image. Since some algorithms can only embed in the plaintext domain, such as the Random Element Substitute (RES) algorithm proposed in the 9th method, the plaintext domain embedding rate reaches 1022bpp after decryption; and since this scheme can embed messages in both the plaintext domain and the ciphertext domain at the same time, it can be seen from the comparison that the comprehensive embedding rate of this scheme (plaintext domain embedding rate + ciphertext domain embedding rate) reaches the highest level in the known literature.

[0260] In addition to the embedding rate, some methods are close to the original image after direct decryption, and the PSNR value is large. This is because the embedding method has a relatively small change on the original image, but on the other hand, the embedding rate is relatively low. Some methods have greatly expanded the range of plaintext value representation, and PSNR1 is not statistically significant at this time, such as the sixth method. The two other embedding schemes proposed in the ninth method have ciphertext domain embedding rates of 5bpp and 6bpp, respectively, and a plaintext domain embedding rate of 255bpp. This scheme combines two embedding methods, and the value expansion algorithm is the same as the sixth method, which greatly expands the plaintext range, so PSNR1 is not statistically significant. The comparison results are shown in Table 3:

[0261] Table 3

[0262]

[0263] 3-3-2. Comparison of auxiliary information

[0264] In most known RDHED algorithms, in order for the receiver to correctly extract the message, it is necessary to generate auxiliary information (also known as side information) and embed the auxiliary information into a fixed space. The receiver first extracts the auxiliary information and then extracts the useful embedded message. The real purpose of information hiding is to hide useful information, and the storage of auxiliary information will inevitably occupy part of the redundant space of the carrier.

[0265] The embedding method of this scheme also needs to process auxiliary information in order to correctly extract information. Specifically, in the random number refresh algorithm, the embedding rate needs to be stored in a fixed position. In other methods, the last 4 pixels are reserved for storage, and each pixel stores one bit of the embedding rate. After analysis, in the random number refresh algorithm, the capacity of a pixel is only limited by computing resources. According to the experimental results, the maximum embedding rate of the random number refresh algorithm is only 14, so this scheme uses the last pixel for storage, which improves the ability to load effective information compared with similar methods; similarly, the embedding rate needs to be passed to the receiving end in the value expansion algorithm for extraction. In other value expansion algorithms, the last 12 pixels are reserved to save the embedding rate. However, considering that the embedding rate of the value expansion algorithm can reach a maximum of 1015, this scheme uses the last pixel to free up 12 bits to store the embedding rate. In summary, compared with similar algorithms, this scheme compresses the storage space of auxiliary information and frees up more space for embedding effective information. The comparison results are shown in Table 4:

[0266] Table 4

[0267] Scheme / method SizeofauxiliaryinformationinRNR SizeofauxiliaryinformationinVE wu2023 4pixels - wu2016 4pixels 12pixels wu2019 4pixels 12pixels proposed 1pixels 1pixels

[0268] 3-4 Safety Analysis

[0269] Security is an important aspect that must be considered when designing the RDHED algorithm. The encryption and decryption process of this scheme is based on Paillier cipher encryption and threshold decryption, and its security is based on the difficulty of three problems: RSA large integer factorization, discrete logarithm, and deterministic composite remainder hypothesis. According to current knowledge, these three problems are computationally difficult problems, so the encryption and decryption process is secure.

[0270] The value expansion and random number refresh embedding methods used in this scheme are both based on the probabilistic and additive homomorphic nature of Paillier encryption. The ciphertexts obtained after embedding the message are all legal ciphertexts, and the embedding process does not reduce the security of the Paillier cipher.

[0271] More importantly, the threshold decryption adopted by this scheme transforms the secret sharing of private keys into multi-key decryption. Only the decryption shares that meet the threshold can complete the decryption, and smaller subsets cannot obtain any useful information. This effectively solves the security issues of private key leakage and single-point attack, making the system resistant to collusion attacks by (k-1) decryptors.

[0272] In addition, during the threshold decryption process, also based on the difficulty of the discrete logarithm problem, the distributed decryption value of each decryption end does not leak any information about the private key share, so the private key share is safe.

[0273] Finally, each participant can authenticate the source of the received data. Specifically, the image hiding end embeds authentication information in the image, and the decryption end extracts the authentication message in the ciphertext domain to verify the legitimacy of the image source; the image receiving end verifies each distributed decrypted image collected, ensuring the reliability and validity of each distributed decrypted image.

[0274] This paper proposes a new secure multi-party ciphertext domain reversible information hiding scheme based on multi-key threshold decryption, which overcomes the single point failure problem caused by a single public-private key pair in previous ciphertext domain information hiding schemes, and verifies the feasibility and potential value of reversible information hiding in the ciphertext domain in a secure multi-party environment. The embedding algorithm used in this scheme utilizes the redundancy of plaintext representation and plaintext-ciphertext mapping in the Paillier cryptographic system, and adopts value expansion and random number refresh embedding methods. The comprehensive embedding ability reaches the highest level at present, and the original image can be restored without distortion. The embedded message is partially extracted in the ciphertext domain and partially extracted in the plaintext domain after decryption. The scheme has strong practicality and flexibility. The limitation of the scheme is that the embedding algorithm used has greatly expanded the plaintext value representation range, so that the image after direct decryption must be restored by the recovery algorithm to ensure distortion-free reconstruction. The next step will be to study the encryption domain reversible information hiding of different secure multi-party computing frameworks.

[0275] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A reversible information hiding method in ciphertext domain based on multi-key threshold decryption, characterized in that: include: Generate system public key and private key shares through the key server, and distribute the private key shares to several decryption terminals; The original image is obtained through the image provider, and the original image is encrypted according to the system public key to obtain an encrypted image; The embedded message is divided by the data hiding end to obtain a first message and a second message, the first message is embedded into the encrypted image by using a value extension embedding algorithm, and the second message is embedded into the encrypted image embedded with the first message by using a random number refresh embedding algorithm to obtain a ciphertext image; The decryption end extracts the message from the encrypted ciphertext image to obtain the second message, and uses the private key share to decrypt the encrypted ciphertext image to obtain a distributed decrypted image; A plurality of distributed decrypted images are jointly decrypted by an image receiving end to obtain a plaintext image, and messages are extracted and restored from the plaintext image to obtain a first message and an original image.

2. The method according to claim 1, characterized in that The process of generating system public and private key shares includes: Input security parameters through the key server, generate two different security prime numbers according to the security parameters, and obtain sub-primes according to the security primes, and arbitrarily select a semi-random constant and a random constant; obtain the public key according to the security primes, sub-primes and the selected constants; the public key pk=(N,g,Δ,v), where N=pq, p and q are respectively security primes of equal length, g is the selected semi-random constant, Δ=n!, and v represents the selected random constant; g satisfies: And gcd(L(g λ mod N 2 ),N)=1,λ=p'q',n is the number of private key shares; p',q' represent different sub-prime numbers, satisfying: p=2p'+1,q=2q'+1; The decryption key is calculated by the Chinese remainder theorem, where d satisfies: d = 1 mod N and d = 0 mod λ; Private key sk = (d), the private key sk is divided by Shamir's secret sharing method to obtain private key shares.

3. The method according to claim 1, characterized in that The process of encrypting the original image includes: The original image is encrypted using the system public key through the image provider using a probabilistic polynomial time algorithm to generate an encrypted image, wherein each plaintext pixel in the original image is encrypted in a raster scanning order to obtain a ciphertext pixel, and the ciphertext pixels are aggregated to obtain the encrypted image.

4. The method according to claim 1, characterized in that: The process of embedding the first message into the encrypted image includes: Obtaining an embedding rate t of the value extension embedding algorithm through the data hiding end, grouping the first message according to the embedding rate of the value extension embedding algorithm to obtain a first message group, wherein each t-bit-long binary array in the first message group corresponds to a ciphertext pixel of the encrypted image, and when the last group is less than t bits, the high bits are padded with 0; According to the raster scanning order, the last ciphertext pixel is reserved, and the new ciphertext value c' is calculated for the other ciphertext pixels: Where c represents the ciphertext pixel, g and N represent the public parameters, mod represents the remainder function, and b represents the t-bit-long binary array corresponding to the ciphertext pixel; The embedding rate t of the value extension embedding algorithm is expressed as a 12-bit binary number, and the last ciphertext pixel c is embedded in the value extension embedding algorithm. l Encryption is the calculation of the new ciphertext value: Among them, c' l The new ciphertext value representing the last ciphertext pixel is summed up for all the recalculated ciphertext pixels to obtain the encrypted image embedded with the first message.

5. The method according to claim 1, characterized in that The process of embedding the second message into the encrypted image embedded with the first message includes: Obtaining an embedding rate s of a random number refresh embedding algorithm through a data hiding end, and grouping the second message according to the embedding rate of the random number refresh embedding algorithm, wherein each s-bit-long binary array in the second message group corresponds to a ciphertext pixel embedded in the encrypted image of the first message, and when the last group is less than s bits, the high bits are padded with 0; According to the raster scan order, the last ciphertext pixel is reserved and an integer is arbitrarily selected. Calculate the new ciphertext value c" for other ciphertext pixels: c”=c'r' N modN 2 For each s-bit long binary array b'=b'1b2'...b s ',judge: c”mod2 s =b1'b'2...b' s Is it true? If not, reselect r'. If true, use c" as the new ciphertext. The embedding rate s of the random number refresh embedding algorithm is represented by a 4-bit binary number, and the last ciphertext pixel is encrypted by the random number refresh embedding algorithm, which is the new ciphertext value c l Calculation of : c″ l =c' l r' l mod N 2 By constantly reselecting r l ',judge: c″ l mod 2 4 =s After the match, c' l 'As the new ciphertext value of the last ciphertext pixel, all recalculated ciphertext pixels are summarized to obtain the encrypted ciphertext image.

6. The method according to claim 1, characterized in that The process of extracting messages from a ciphertext image includes: The message is extracted from the encrypted ciphertext image using a deterministic polynomial time algorithm at the decryption end, where: According to the raster scanning order, the ciphertext value c' of the last ciphertext pixel of the ciphertext image is l 'Calculate: s=c″ l mod 2 4 Where s represents the embedding rate of the random number refresh embedding algorithm; The remaining ciphertext pixels are calculated based on the embedding rate s of the random number refresh embedding algorithm: b'=c″mod 2 s b' represents each s-bit long binary array, and each s-bit long binary array is connected to obtain the second message.

7. The method according to claim 1, characterized in that The process of decrypting a ciphertext image using a private key share includes: The decryption end uses a probabilistic polynomial time algorithm to perform distributed decryption on the ciphertext image; Among them, for each encrypted pixel c'' of the ciphertext image, the distributed decryption value c is calculated i : Aggregating the distributed decrypted values ​​of each encrypted pixel to obtain a distributed decrypted image; And calculate the verification value v i : Where i is an integer and 1≤i≤n, v and Δ represent common parameters, and S i Represents a private key share.

8. The method according to claim 1, characterized in that The process of jointly decrypting several distributed decrypted images includes: The image receiving end uses a deterministic polynomial time algorithm to jointly decrypt several distributed decrypted images, where: Validate based on validation value: Among them, c i represents an arbitrarily selected pixel in the i-th distributed decrypted image, c is the corresponding ciphertext pixel, v is the public parameter, and v i is the verification value; If the verification is successful, the distributed decrypted image of this share is untrustworthy and the distributed decrypted image shares need to be collected again; if the verification is successful, each pixel in the distributed decrypted image is decrypted and calculated: m'=L(c”'modN 2 )(4Δ 2 ) -1 The decrypted plaintext pixel m' is obtained, where Δ is a public parameter, i is a private key share number, i' represents a counter, which also represents a private key share number different from i, and S is a set of collected private key share numbers; The plaintext pixels are aggregated to obtain the plaintext image.

9. The method according to claim 1, characterized in that: The process of extracting messages and recovering plaintext images includes: The image receiving end uses a deterministic polynomial time algorithm to extract and restore the plaintext image: According to the raster scanning order, the last pixel m of the plaintext image l 'Calculate and obtain the embedding rate t of the value expansion embedding algorithm: t=m l 'mod2 12 pass Get the original pixel value of the last pixel; The remaining pixels m' of the plaintext image are decrypted by the embedding rate t of the value extension embedding algorithm to obtain the embedded t-bit long binary array and the original pixel values ​​of the remaining pixels: b=m'mod 2 t Where b is a t-bit long binary array, Connect each t-bit-long binary array to obtain a first message; All original pixel values ​​are summed up to get the original image.

Images