A reversible information hiding method for the ciphertext field based on multi-key threshold decryption

Abstract

This invention discloses a method for reversible information hiding in the ciphertext domain based on multi-key threshold decryption, comprising: generating a system public key and a private key share through a key server, and distributing the private key share to a decryption end; acquiring an original image through an image provider, encrypting the original image according to the system public key to obtain an encrypted image; dividing the embedded message into a first message and a second message through a data hiding end, embedding the first message into the encrypted image using a value expansion embedding algorithm, and embedding the second message into the encrypted image containing the first message using a random number refresh embedding algorithm to obtain a ciphertext image containing the ciphertext; extracting messages from the ciphertext image containing the ciphertext to obtain the second message through a decryption end, and decrypting the ciphertext image containing the ciphertext to obtain a distributed decrypted image; and jointly decrypting several distributed decrypted images through an image receiver to obtain a plaintext image, extracting messages from the plaintext image and recovering the original image to obtain the first message and the original image.

Description

Technical Field

[0001] This invention belongs to the field of data encryption and transmission technology, and particularly relates to a method for reversible information hiding in ciphertext fields based on multi-key threshold decryption. Background Technology

[0002] In the information age, the covert transmission and secure storage of data have become increasingly prominent demands. Traditional data hiding (DH) achieves covert transmission by embedding information into a specific carrier. Its core objective is to ensure the concealment of information and accurate retrieval at the receiving end, which inevitably leads to distortion of the original carrier. In fields with extremely high requirements for data integrity, such as medical image analysis and military intelligence transmission, distortion of the original carrier is unacceptable, in addition to ensuring accurate message transmission.

[0003] With the rapid development of cloud computing technology, many organizations are uploading data to the cloud to maximize its value. Medical institutions are also leveraging cloud platforms to provide patients with better services. However, due to privacy concerns and industry regulations, medical data must be encrypted before uploading. Reversible Data Hiding on Encrypted Domain (RDHED) technology allows for the embedding of additional information within an encrypted domain, enabling lossless recovery of the original data after decryption, making it a hot research topic.

[0004] Essentially, RDHED research primarily involves designing schemes that combine encryption and information hiding techniques. Based on the encryption scheme employed, RDHED can be divided into two categories. The first category uses symmetric encryption schemes, designing RDHED schemes based on symmetric cryptosystems such as stream ciphers or block ciphers. The advantages of this method are fast encryption and decryption speeds and minimal ciphertext expansion; however, both communicating parties need to share the same key, but establishing secure key channels between every two participants is impractical. The second category uses public-key encryption schemes, which can compensate for the shortcomings of symmetric encryption. Its security can be reduced to a specific difficult problem, theoretically guaranteeing higher security.

[0005] In recent years, research on the RDHED public-key encryption algorithm has mainly focused on homomorphic encryption technology. The advantage of homomorphic encryption lies in allowing direct arithmetic operations on data within the encrypted domain, which is suitable for processing encrypted data in the cloud. Related technologies have primarily studied the redundancy of plaintext and ciphertext in Paillier ciphers, a semi-homomorphic encryption domain. By reserving space before encryption and utilizing the homomorphism and randomness of Paillier ciphers after encryption, the ciphertext value can be precisely altered to embed the message.

[0006] The above RDHED schemes based on homomorphic encryption all utilize the properties of public-key cryptography. The sender uses the receiver's public key to encrypt the carrier (or a carrier containing embedded information), and the receiver uses its (unique) private key to decrypt the encrypted carrier. Depending on the embedding timing, the receiver extracts the embedded information before or after decryption, ultimately achieving the goal of transmitting the message and recovering the original carrier without loss. For ease of description, the above system is referred to as a Single Key-pair Homomorphic System (SKHS). However, with the increasing demand for data sharing among multiple participants in network environments, the security problems caused by centralized private key management are becoming increasingly apparent. System security heavily depends on the security of the private key; if the private key is leaked or misused, the security of the entire system will be seriously threatened. Centralized management of private keys can also lead to single points of failure; once the private key custodian encounters a problem, the reliability of the entire system will be affected. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention proposes a reversible information hiding method for the ciphertext domain based on multi-key threshold decryption. This method aims to improve the security and reliability of the system in a secure multi-party computation environment, enabling each participant to verify the legitimacy of the received data and reliably transmit messages in the ciphertext domain while recovering the carrier without loss, thus solving the problems existing in the prior art.

[0008] To achieve the above objectives, this invention provides a method for reversible information hiding in the ciphertext field based on multi-key threshold decryption, comprising:

[0009] The system public key and private key shares are generated through the key server, and the private key shares are distributed to several decryption terminals;

[0010] The original image is obtained from the image provider, and then encrypted using the system's public key to obtain an encrypted image.

[0011] The embedded message is divided by the data hiding end to obtain the first message and the second message. The value expansion embedding algorithm is used to embed the first message into the encrypted image, and the random number refresh embedding algorithm is used to embed the second message into the encrypted image containing the first message, so as to obtain the encrypted image containing the ciphertext.

[0012] The message is extracted from the encrypted image by the decryption terminal to obtain the second message, and the encrypted image is decrypted using the private key share to obtain the distributed decrypted image;

[0013] The image receiving end performs joint decryption on several distributed decryption images to obtain a plaintext image. The plaintext image is then used to extract and restore messages to obtain the first message and the original image.

[0014] Optionally, the process of generating system public and private key shares includes:

[0015] Security parameters are input through the key server. Two distinct secure prime numbers are generated based on these parameters. Subprime numbers are then obtained from the secure prime numbers. A semi-random constant and a random constant are randomly selected. The public key is obtained based on the secure prime numbers, subprime numbers, and the selected constants. The public key is pk = (N, g, Δ, v), where N = pq, p and q are secure prime numbers of equal length, g is the selected semi-random constant, Δ = n!, and v represents the selected random constant. g satisfies: And gcd(L(g λ modN 2 ),N)=1,λ=p'q',n is the number of private key shares;p' and q' represent different subprime numbers, satisfying: p=2p''+1,q=2q'+1.

[0016] The decryption key is calculated using the Chinese Remainder Theorem, where d satisfies: d = 1 mod N and d = 0 mod λ;

[0017] Private key sk = (d), and private key shares are obtained by dividing private key sk using the Shamir secret sharing method.

[0018] Optionally, the process of encrypting the original image includes:

[0019] The image provider uses a probabilistic multinomial-time algorithm with the system public key to encrypt the original image, generating an encrypted image. This is achieved by encrypting each plaintext pixel in the original image through a raster scan sequence to obtain ciphertext pixels, and then summing the ciphertext pixels to obtain the encrypted image.

[0020] Optionally, the process of embedding the first message into the encrypted image includes:

[0021] The embedding rate t of the value extension embedding algorithm is obtained through the data hiding end. The first message is grouped according to the embedding rate of the value extension embedding algorithm to obtain the first message group. Each t-bit long binary array in the first message group corresponds to a ciphertext pixel of the encrypted image. When the last group is less than t bits, it is padded with 0 in the high bits.

[0022] Based on the raster scanning order, the last ciphertext pixel is reserved, and the new ciphertext value c' is calculated for the other ciphertext pixels:

[0023] Where c represents the ciphertext pixel, g and N represent the semi-random constant and part of the public key selected in the system public key, mod represents the modulo function, and b represents the t-bit binary array corresponding to the ciphertext pixel;

[0024] The embedding rate t of the value-extended embedding algorithm is represented by a 12-bit binary number, and the last ciphertext pixel c is processed using the value-extended embedding algorithm. l Encryption is performed, i.e., the calculation of the new ciphertext value:

[0025]

[0026] Among them, c l ' represents the new ciphertext value of the last ciphertext pixel; summing up all the recalculated ciphertext pixels yields an encrypted image embedded with the first message.

[0027] Optionally, the process of embedding the second message into an encrypted image that embeds the first message includes:

[0028] The embedding rate s of the random number refresh embedding algorithm is obtained through the data hiding end. The second message is grouped according to the embedding rate of the random number refresh embedding algorithm. Each s-bit long binary array in the second message group corresponds to a ciphertext pixel of the encrypted image embedded in the first message. When the last group is less than s bits, it is padded with 0 in the high bits.

[0029] Based on the raster scanning order, reserve the last encrypted pixel and arbitrarily select an integer. Calculate the new ciphertext value c for the other ciphertext pixels:

[0030] c”=c'r' N modN 2

[0031] For each s-bit long binary array b' = b'1b2'...b to be embedded s ',judge:

[0032] c"mod2 s =b1'b'2...b' s

[0033] Check if the condition is met. If not, select r' again; if met, use c” as the new ciphertext.

[0034] The embedding rate 's' of the random number refresh embedding algorithm is represented by a 4-bit binary number. The last ciphertext pixel is then encrypted using the random number refresh embedding algorithm to obtain the new ciphertext value 'c'. l The calculation of "":

[0035] c l =c l 'r l 'modN 2

[0036] By continuously reselecting r l ',judge:

[0037] c l mod2 4 =s

[0038] After the match is found, cl” is used as the new ciphertext value of the last ciphertext pixel. All the recalculated ciphertext pixels are then summed to obtain the ciphertext image.

[0039] Optionally, the process of message extraction from an image containing ciphertext includes:

[0040] The message is extracted from the ciphertext image using a deterministic polynomial-time algorithm at the decryption end.

[0041] Based on the raster scanning order, the ciphertext value c of the last ciphertext pixel in the image containing ciphertext is... l Perform the calculation:

[0042] s = cl" mod 2 4

[0043] Where s represents the embedding rate of the random number refresh embedding algorithm;

[0044] The embedding rate of the random number-based embedding algorithm is used to calculate the remaining ciphertext pixels:

[0045] b' = c"mod2 s

[0046] Here, b' represents each s-bit long binary array, and concatenating each s-bit long binary array yields the second message.

[0047] Optionally, the process of decrypting a ciphertext image using a share of the private key includes:

[0048] The encrypted image is decrypted in a distributed manner using a probabilistic multinomial-time algorithm at the decryption end.

[0049] Specifically, for each encrypted pixel c” in the ciphertext image, the distributed decryption value c is calculated. i :

[0050]

[0051] The distributed decryption values ​​of each encrypted pixel are aggregated to obtain the distributed decrypted image;

[0052] And calculate the verification value v i :

[0053] Where i is an integer and 1 ≤ i ≤ n, v represents the chosen random constant, Δ represents the common parameter, and S i This represents the share of the private key.

[0054] Optionally, the process of jointly decrypting several distributed decryption images includes:

[0055] The image receiver employs a deterministic polynomial-time algorithm to jointly decrypt several distributed decryption images, where:

[0056] Validate based on the validation value:

[0057]

[0058] Among them, c i This represents any selected pixel in the distributed decryption image, where c is the corresponding ciphertext pixel, and v is a common parameter. i This is for verification purposes.

[0059] If the verification passes, this share of the distributed decryption image is untrusted, and the distributed decryption image share needs to be collected again; if the verification passes, each pixel in the distributed decryption image is decrypted, and the following calculations are performed:

[0060]

[0061] m'=L(c”'modN 2 )(4Δ 2 ) -1

[0062] The decrypted plaintext pixel m' is obtained, where Δ is a common parameter, i is the private key share number, i' represents the counter, and S is the set of collected private key share numbers;

[0063] The plaintext image is obtained by summing up the plaintext pixels.

[0064] Optionally, the process of extracting and restoring messages from a plaintext image includes:

[0065] The plaintext image is extracted and restored using a deterministic polynomial-time algorithm at the image receiver.

[0066] According to the raster scanning order, for the last pixel m of the plaintext image l 'Calculations are performed to obtain the embedding rate t of the value extension embedding algorithm:'

[0067] t = m l 'mod2 12

[0068] pass Get the original pixel value of the last pixel;

[0069] The remaining pixels m' of the plaintext image are decrypted using the embedding rate t of the value-extended embedding algorithm, yielding an embedded t-bit binary array and the original pixel values ​​of the remaining pixels:

[0070] b = m'mod2 t

[0071]

[0072] Where b is a t-bit binary array.

[0073] Concatenate each t-bit binary array to obtain the first message;

[0074] The original image is obtained by summing up all the original pixel values.

[0075] Compared with the prior art, the present invention has the following advantages and technical effects:

[0076] The proposed solution enhances system security and flexibility by assigning an independent decryption key to each decryptor. It allows secure data sharing between different participants without concerns about the leakage of a single private key. Furthermore, distributed key management reduces the risk of single points of failure, improving system reliability and stability. Attached Figure Description

[0077] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0078] Figure 1 This is a schematic diagram illustrating an example of the application of the ciphertext field reversible information hiding method based on multi-key threshold decryption in a multi-party consultation according to an embodiment of the present invention.

[0079] Figure 2 This is a flowchart of the three types of RDHED embedding methods according to an embodiment of the present invention;

[0080] Figure 3 This is a schematic diagram of the ciphertext field reversible information hiding method based on multi-key threshold decryption according to an embodiment of the present invention;

[0081] Figure 4 This is a schematic diagram of test images according to an embodiment of the present invention;

[0082] Figure 5 These are schematic diagrams of different images generated during the process of the ciphertext domain reversible information hiding method based on multi-key threshold decryption in an embodiment of the present invention. Detailed Implementation

[0083] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0084] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0085] The use of reversible ciphertext hiding for privacy protection and secure multi-party communication in secure multi-party environments has attracted increasing attention. Addressing security issues such as private key leakage and single point of failure associated with single public-private key pairs, this invention proposes a secure multi-party reversible ciphertext hiding scheme, RDHED-SMMTD, based on multi-key threshold decryption. This invention utilizes the Paillier threshold cryptography algorithm, supporting one encryption public key and multiple decryption private keys. The message is embedded twice in the ciphertext domain; part of the embedded message is extracted in the ciphertext domain, and part is extracted in the decrypted plaintext domain. Both extractions can completely extract the message, and the carrier can be recovered without loss. During decryption, decryption is successful only when the number of decryptors with different keys reaches a threshold; smaller subsets of decryptors obtain no useful information. Experiments verify the effectiveness of the scheme. Compared with state-of-the-art embedding algorithms, it compresses the storage space of auxiliary information, achieving the highest overall embedding capacity among similar algorithms. The maximum embedding rate reaches 14 bpp in the ciphertext domain and 10¹⁵ bpp in the decrypted plaintext domain.

[0086] The proposed solution enhances system security and flexibility by assigning an independent decryption key to each decryptor. It allows for secure data sharing and collaborative work among different participants without the risk of a single private key being compromised. Furthermore, distributed key management reduces the risk of single points of failure, improving system reliability and stability. Figure 1 The application of this solution is described using a multi-party consultation within a hospital as an example.

[0087] In this scenario, this scheme generates a shared public key for encryption and assigns a private key share to each participating physician. The medical imaging center first encrypts the patient's medical images using the public key. The data center then securely embeds the patient's medical information and authentication information into the encrypted domain before transmitting it to all participating physicians, without worrying about data analysis or decryption during transmission. Each physician can then extract authentication information from the encrypted domain to verify the information's origin and decrypt the data using their own private key share. During the hospital consultation, once all designated physicians are present, they collect all decrypted shares, verify them, and, upon successful verification, jointly decrypt to extract the complete medical data and reconstruct the patient's medical images for collaborative analysis and discussion. After the consultation, the patient receives a diagnosis that integrates multiple opinions. Throughout this process, the data provided by the data center, consulting physicians, and the consulting hospital can be verified for legitimacy by the recipient, and all processes are completed while protecting privacy.

[0088] The innovative aspects of this solution are summarized as follows:

[0089] (1) A reversible information hiding scheme for secure multi-party ciphertext domain based on multi-key threshold decryption is proposed. Decryption can only be successful when the subset of decryptors is large enough, while smaller subsets of decryptors cannot obtain any useful information. The system can resist collusion attacks by (k-1) participants, effectively solving the security problems of private key leakage and single point of failure. (2) By combining two embedding algorithms, value expansion and random number refresh, reversible embedding and extraction under secure multi-party computation conditions are realized, and each participant can verify the source of the data. The embedded information is partially extracted in the ciphertext domain and partially extracted in the plaintext domain after decryption. The scheme is flexible and highly practical. (3) Compared with the existing RDHED method, the overall embedding capacity of this scheme reaches the highest level among similar algorithms. Experimental results show that the maximum embedding rate reaches 14 bpp in the ciphertext domain and 1015 bpp in the plaintext domain. In addition, compared with similar schemes, our method compresses the storage space of auxiliary information, and the algorithm has a higher effective load capacity.

[0090] 1. Explain the relevant work and the related principles:

[0091] First, the Paillier cipher scheme is introduced, followed by additive homomorphism and Shamir's secret-sharing algorithm. Finally, the threshold Paillier cipher scheme is presented. The symbols used in the scheme are shown in Table 1.

[0092] Table 1

[0093]

[0094]

[0095] 1-1. Paillier Cipher Scheme:

[0096] The Paillier cryptosystem is a public-key cryptosystem supporting additive homomorphism, first proposed by Paillier. It satisfies semantic security, meaning it is indistinguishable from the original ciphertext under chosen-plaintext attacks (IND-CPA). The security of the scheme can be reduced to the Decisional Composite Residuos Assumption (DCRA) problem. The Paillier cryptosystem consists of the following algorithm:

[0097] (1) Key generation. First, select two large prime numbers p and q of equal length but different values, and calculate the product of p and q, N = pq; then, randomly select an integer. And satisfy gcd(L(g λ modN 2 ),N)=1, where the auxiliary function L(x) is:

[0098] L(x)=(x-1) / N (1)

[0099] x is the independent variable.

[0100] calculate:

[0101] λ=lcm(p-1,q-1) (2)

[0102] μ=(L(g λ modN 2 )) -1 modN (3)

[0103] Where mod is the modulo function, the public key pk = (N, g) and the private key sk = (λ, μ).

[0104] (2) Encryption. Choose any integer. Given plaintext m∈Z N Encryption is performed using the public key pk, and the corresponding ciphertext c is:

[0105] c = Enc(m, r) = g m r N mod N2 (4)

[0106] (3) Decryption. The plaintext m can be obtained by decrypting the ciphertext c as follows:

[0107] m = Dec(c) = L(c) λ mod N 2 )·μmod N (5)

[0108] If the Paillier cryptography algorithm is used to encrypt the digital image, each pixel needs to be encrypted using equation (4), resulting in a large integer array. Each large integer in this array is then decrypted using equation (5), and the original image is obtained by summing the results. The prerequisite for successful decryption is that the pixel values ​​of the digital image are located within the Z-axis. N This condition is usually met. For example, for a grayscale image, the pixel value is [0, 255], and the Paillier cryptographic public key N only needs to be longer than 8 bits to decrypt it correctly.

[0109] 1-2. Additive Homomorphism in the Paillier Cipher

[0110] The Paillier cipher exhibits additive homomorphism. Assume that for different plaintexts m, m1, m2, the corresponding ciphertext is: c = Enc(m) = g m r N mod N 2 c1 = Enc(m1) = g m1 r1 N mod N 2 , It can be calculated that:

[0111]

[0112] c k mod N 2 =(g m r N ) k mod N2=g km (r k ) N mod N 2 (7)

[0113] cg k mod N 2 =g m r N g k mod N 2 =g m+k r N mod N 2 (8)

[0114] As can be seen, c1c2, c k ,cg k These are the valid ciphertexts of m1+m2, km, and m+k, respectively.

[0115] There are already some RDHED schemes based on Paillier additive homomorphism, which can double the corresponding plaintext pixel value by multiplying the ciphertext value by itself in the cryptographic field. In addition, ciphertext multiplied by 1 can embed 1, and ciphertext without any operation or multiplied by 0 can embed 0.

[0116] 1-3, Shamir's Secret Sharing

[0117] The Shamir secret sharing algorithm is a cryptographic primitive that distributes a secret among multiple participants, and the secret can only be recovered when certain conditions are met. Specifically, Shamir secret sharing includes the following steps:

[0118] (1) Parameter selection: Select a large prime number p, determine the number of participants n and the threshold k, and satisfy: p≥n, in the prime number field F p Randomly generate a1, a2, ... a k-1 , which serves as the coefficient of the non-constant term of the (k-1) degree polynomial f(x).

[0119] (2) Secret Distribution: Assuming the secret to be shared is S, construct the polynomial:

[0120] f(x) = (S + a1x + ... + a) k-1 x k-1 )mod p

[0121] Calculate different polynomial values ​​f(1), f(2), ... f(n), and each of the n participants holds a secret share (i, f(i)), where i represents the participant number. Destroy the polynomial f(x) and S.

[0122] (3) Secret Recovery: Assuming at least k secret shares have been obtained, the secret S can be reconstructed using the following Lagrange interpolation formula:

[0123]

[0124] Where i represents the private key share sequence number, and i′ represents the counter, which also represents a private key share sequence number different from i.

[0125] 1-4. Threshold Paillier Cryptography Scheme

[0126] The threshold Paillier cipher scheme is a generalized extension of the standard Paillier cipher. Assume the set of participants is P = {P1, P2, ..., P...} n}, with n participants, the threshold Paillier scheme is composed of the following algorithm:

[0127] (1) Key generation. Select two large, secure prime numbers p and q, i.e., p = 2p′ + 1, q = 2q′ + 1, where p′ and q′ are prime numbers of equal length; calculate N = pq, λ = p′q′. Select g = N + 1, calculate the public parameter Δ and the decryption key d, where Δ = n!, and d satisfies d = 1 mod N and d = 0 mod λ. In addition, the system needs to share a public constant v among all parties, specifying the public key pk = (N, g, Δ, v) and the private key sk = (d).

[0128] (2) Encryption. Random selection. The ciphertext c is calculated according to equation (4), and the encryption process is the same as that of standard Paillier encryption.

[0129] (3) Secret Sharing. Using d as a constant, the Shamir secret sharing algorithm is used to construct a (k,n) threshold for secret sharing, generating secret shares (i,S). i ), where i represents the sequence number of each participant, n is the number of secret shares, and k is the threshold for secret recovery.

[0130] (4) Share decryption. Each participant provides ciphertext c and secret share S. i And the system public key, the i-th participant calculates the share decryption value c. i and verification value v i :

[0131]

[0132] (5) Joint decryption. Given k shares of the decryption value c i Verification value v i Given the set S corresponding to i, and the system public key, each participant is first verified as follows:

[0133]

[0134] If the verification passes, continue; otherwise, terminate.

[0135] Continue calculating intermediate results:

[0136]

[0137] Then calculate the merged ciphertext c':

[0138]

[0139] After simplification:

[0140]

[0141] Finally, calculate the plaintext m:

[0142] m = L(c'modN) 2 )(4Δ 2 ) -1 (16)

[0143] Thus, the plaintext m is obtained.

[0144] 1-5. Three Types of RDHED

[0145] Depending on when the information is embedded, existing RDHED algorithms can be divided into three types: Vaping Room Before Encryption (VRBE), Vaping Room After Encryption (VRAE), and Vaping Redundancy In Encryption (VRIE).

[0146] The RDHED algorithm based on VRBE utilizes redundant information in the original image to free up space in the original image before encryption and data embedding, resulting in a high embedding capacity. While the VRBE algorithm boasts a high embedding capacity, its complex preprocessing increases the computational burden on content owners, leading to many limitations in practical applications.

[0147] VRAE technology frees up space in the ciphertext domain, requiring no preprocessing of the original carrier by the content owner. However, the information entropy of the original carrier is close to its limit after encryption, making it very challenging to modify the ciphertext to embed information without compromising decryption functionality. By selecting specific encryption schemes, the embedding capacity of the VRAE-based RDHED algorithm is now comparable to that of the VRBE-based RDHED algorithm.

[0148] VRIE (Reversible Embedding) technology utilizes redundancy generated during the encryption process for reversible embedding, with embedding and encryption occurring simultaneously. Existing VRIE-type ciphertext redundancy primarily originates from the LWE (Lattice Weaving) ciphertext encryption algorithm. Introduced into the RDHED (Reversible Hierarchical Cryptography) domain, it quantizes the ciphertext field space of LWE encryption and re-encodes the LWE ciphertext based on the redundancy generated during ciphertext expansion, thus loading additional information. VRIE-type algorithms offer good reversibility, strong security, and large ciphertext embedding capacity. Their design is based on in-depth analysis of cryptographic algorithms, representing an emerging research direction.

[0149] As can be seen from the above analysis, the three types of embedding methods each have their own advantages and limitations, and have different applicable scopes, providing different design paths for RDHED. A suitable embedding method can be designed based on actual conditions. Figure 2 The flowchart shows the three types of embedding methods.

[0150] 2. The technical solution proposed in this invention:

[0151] This section proposes a secure multi-party ciphertext field reversible information hiding scheme, RDHED-SMMTD, based on the threshold Paillier cryptographic algorithm and multi-key threshold decryption.

[0152] 2-1. System architecture involved in the above technical solution during encrypted transmission

[0153] This scheme includes five participating entities: Key Server, ImageProvider, DataHider, Decryptors (multiple), and ImageReceiver. For example... Figure 3 As shown in (a), the key server is responsible for generating the system public key and private key shares, and distributing the private key shares to the decryption end; as Figure 3 As shown in (b), the image provider encrypts the original image using the system's public key before transmitting it to the data hiding end; as Figure 3 As shown in (c), the data hiding end distributes the encrypted image to the decryption end after embedding the message twice in different ways within the encrypted domain; as... Figure 3 As shown in (d), the decryption end can extract a portion of the message from the encrypted domain and generate a distributed decryption image using its respective private key share; as shown in (d). Figure 3 As shown in (e), after the image receiver collects at least k distributed decrypted images, it performs joint decryption, extracts the remaining messages in the plaintext domain, and recovers the original image. Figure 3 This is the system flowchart for this solution.

[0154] 2-2. Scheme Design

[0155] The technical solution proposed in this invention includes the following stages:

[0156] 2-2-1 Key Generation

[0157] via KeyGen(1) λ’ The system public key and private key shares are generated. This step mainly uses the Probabilistic Polynomial-time (PPT) algorithm and is executed by the key server. In the key server, a security parameter λ' is input, and the output is the system public key pk = (N, g, Δ, v) and the private key share set {(i, S...}. i The plaintext space of the system is Z, where |1≤i≤n}. N The ciphertext space is The key server determines the decryption endpoint P = {P1, P2, ..., P}.n The number of decryption ends is n. Based on the security parameter λ', arbitrarily choose two secure prime numbers p and q of equal length such that p = 2p' + 1, q = 2q' + 1, where p' and q' are also prime numbers of equal length. Calculate N = pq, λ = p'q', and the public parameter Δ = n!. Choose any constant v and calculate d using the Chinese Remainder Theorem, such that d = 1 mod N and d = 0 mod λ. Then choose g = N + 1. The public key k = (N, g, Δ, v), and the private key sk = (d). sk is divided using the Shamir secret sharing method, with a threshold value k set, and d set as a constant term. The generated private key shares (i, S) are... i The polynomial and private key sk are stored by n decryption terminals and finally destroyed. It's important to note that the key server only appears during the key generation phase and does not participate in subsequent phases.

[0158] 2-2-2, Encryption

[0159] The encrypted image EI is generated using Enc(I,pk). This step mainly uses the PPT algorithm and is executed by the image provider. Given the plaintext image I and the system public key pk, each plaintext pixel m∈I is processed in the raster scan order, and the encrypted pixel is calculated according to equation (4): c=Enc(m,pk). Finally, all encrypted pixels are summarized to obtain the encrypted image EI, and EI is passed to the data hiding end.

[0160] 2-2-3. Message Embedding

[0161] via Emb(EI,m) A ,m B Generate embedded message m A and m B EI image containing ciphertext AB This step primarily uses the PPT algorithm and is executed by the data hiding endpoint (such as a cloud server). Given an encrypted image EI, the first message m to be embedded... A Second message m B By combining the Value Expansion (VE) embedding algorithm and the Random Number Refresh (RNR) embedding algorithm, the final embedding m is obtained. A and m B EI image containing ciphertext AB The specific embedding algorithm is as follows:

[0162] (1) The data hiding end divides the message to be embedded into two parts: the first message m A Second message m BThe first part uses value expansion embedding to extract in the ciphertext field, and the second part uses random number refresh embedding to extract in the decrypted plaintext field; the following steps (2)-(5) are VE embedding, and (6)-(9) are RNR embedding.

[0163] (2) Determine the embedding rate t (1≤t≤10¹⁵) of the value extension embedding algorithm VE, and then... A The data is grouped into t-bit groups, with each t-bit binary array corresponding to one pixel. When the last group is less than t bits, it is padded with 0s in the high bits. Here, 1015 is the maximum embedding rate of the VE algorithm.

[0164] (3) For the encrypted image EI containing ciphertext, according to the raster scan order, reserve the last ciphertext pixel, and for the other ciphertext pixels c'∈EI, use the VE algorithm to calculate the new ciphertext value:

[0165]

[0166] Where b is the t-bit binary array to be embedded, i.e., b = b1b2...b t .

[0167] Based on the additive homomorphism of Paillier's algorithm, it can be proved from equations (6), (7), and (8) that c' is 2. t The valid ciphertext of m+b, that is,

[0168]

[0169] Therefore, the result of equation (17) is the result of embedding t bits of information into each ciphertext pixel;

[0170] (4) Represent the embedding rate t in 12-bit binary as t = t1t2...t 12 Similarly, using the VE algorithm, the last ciphertext pixel value c l Encryption, computation:

[0171]

[0172] Embed the t value into the last pixel c. l In the middle; the 12 here is a constant specified according to the embedding rate bit length.

[0173] (5) Finally, all encrypted pixels are summarized to form a sequence containing m A Encrypted image EI A .

[0174] (6) Determine the RNR embedding rate s (1≤s≤14), and embed the message m to be embedded. BGroup the data into s-bit groups, so that each s-bit binary array in a group corresponds to a ciphertext pixel. When the last group is less than s bits, pad it with 0s in the high bits.

[0175] (7) For EI A Following the raster scan order, the last pixel is reserved, and for each of the remaining ciphertext pixels c'∈EI... A Choose any integer The newly encrypted text "c" is calculated as follows:

[0176] c”=c'r' N mod N 2 (20)

[0177] Assume the binary array to be embedded is b' = b'1b2'...b s ',judge:

[0178] c"mod2 s =b1'b2'...b s ' (twenty one)

[0179] If the condition is true, the algorithm continues; otherwise, another condition is selected. Recalculate the ciphertext until equation (21) holds true, then each pixel will embed s bits of message.

[0180] Note that the result of equation (21) is also a valid ciphertext of plaintext m, because: from equations (4) and (20), we can obtain: c” = g m (rr') N modN 2 ,here (rr') can be viewed modulo N as The random number is one of the numbers in the string, so "c" is also a valid ciphertext of m.

[0181] (8) Represent the s value as a 4-bit binary number s = s1s2s3s4. Similarly, using the RNR algorithm, for the last ciphertext pixel c l ', any choice Calculate the new ciphertext c l "for:

[0182] c l =c l 'r l 'modN 2 (twenty two)

[0183] By repeatedly refreshing r l ', to make the ciphertext match:

[0184] c l mod2 4 =S (23)

[0185] After conforming to equation (23), i.e., by using equation (22), s is embedded into the ciphertext pixel c. l ”;

[0186] (9) Finally, summarize all encrypted pixels to generate an embedded m A and m B EI image containing ciphertext AB .

[0187] 2-2-4. Extracting messages from the ciphertext field

[0188] via Ext1(EI) AB Extract message m B Ext1(EI) AB The algorithm is a Deterministic Polynomial-time (DPT) algorithm, executed separately by each decryption end. Given a ciphertext image EI... AB Extract the embedded message m from the ciphertext field B .

[0189] (1) Each decryption terminal receives the encrypted image EI. AB Then, following the raster scan sequence, the last encrypted pixel c is processed. l ", Application formula:

[0190] s=c l mod2 4

[0191] Extract the embedded message s;

[0192] (2) Using the extracted s, apply the formula to each of the remaining ciphertext pixels:

[0193] b' = c"mod2 s

[0194] Extract the embedded s-bit messages b' = b'1b2'...b s ';

[0195] (3) Connecting these messages together yields the embedded message m. B .

[0196] 2-2-5. Share Decryption

[0197] via ShareDec(EI) AB ,{S i |1≤i≤n},Δ,v) yields a distributed decryption image set {EI} ABi ,v i|1≤i≤n}. The ShareDec() algorithm is a PPT algorithm, executed by n decryption endpoints respectively. Given a ciphertext image EI... AB Private key share S i Using common parameters Δ and v, distributed decryption is performed to obtain n distributed decrypted images EI. Ai and the corresponding verification value v i (1≤i≤n). Note the embedded m at this point. B It has been corrupted and cannot be extracted further. The specific method is as follows:

[0198] (1) For each encrypted pixel c”∈EI AB Calculate its distributed decryption value c i for:

[0199]

[0200] (2) The distributed decryption results of each pixel are summed up to obtain the distributed decryption image EI. Ai .

[0201] (3) Calculate the verification value v i for:

[0202]

[0203] Finally, the distributed decryption image EI will be used. Ai and verification value v i They are sent together to the image receiving end.

[0204] 2-2-6, Joint Decryption

[0205] via ComDec({(i,EI) Ai The decrypted plaintext image I is obtained by processing the plaintext image I ... A The ComDec() algorithm is a DPT algorithm, executed by the image receiver. Given k distributed decryption images EI... Ai Verification value v i Together with the corresponding private key share number i, and the public parameters Δ and v, perform joint decryption to obtain the embedded m. A Plaintext image I A The specific method is as follows:

[0206] (1) For each decrypted image EI Ai Randomly select a pixel c i ∈EI Ai According to c i and verification value v i Verify EI Ai Source reliability, i.e., calculation:

[0207]

[0208] If the above equation holds true, the verification passes; otherwise, the verification fails, and the distributed decryption image is collected again.

[0209] (2) For k verified decrypted images EI Ai Following the raster scan order, for each encrypted pixel c i ∈EI Ai The plaintext pixel m' is decrypted using equations (13)-(16) with the set S corresponding to i and the common parameter Δ.

[0210] (3) By summing up all the decrypted plaintext pixels, we obtain the result containing m. A Plaintext image I A .

[0211] 2-2-7. Extracting Messages and Restoring Images

[0212] Ext2_Res(I A )→(m A The Ext2_Res() algorithm is a DPT algorithm, executed by the image receiver. Given a plaintext image I... A Extract the embedded message m from the plaintext field A And recover the plaintext image. The specific algorithm is as follows:

[0213] (1) According to the raster scanning order, for I A For the last pixel m1', apply the formula:

[0214] t = m1'mod2 12

[0215] Extract the embedded message t;

[0216] (2) Using the formula:

[0217]

[0218] Restore original pixel m l ;

[0219] (3) Using the extracted t, I A The first to the second to last pixel m'∈I A Apply the formula:

[0220] b = m'mod2 t

[0221] Extract the embedded t-bit message;

[0222] (4) Applying the formula:

[0223]

[0224] Recover the original pixels of the corresponding carrier;

[0225] (5) Concatenate the messages t extracted in (3) to obtain the embedded message m. A ;

[0226] (6) By summing up all the plaintext pixels m, the original image I can be recovered.

[0227] 3. Experimental Results and Analysis

[0228] To evaluate the functional performance of the proposed scheme, we selected four natural images with different textures. Figure 4 (a)(b)(c)(d)) and 4 medical images ( Figure 4 (e)(f)(g)(h)) are used as test images, such as Figure 4 As shown. All test images were converted to grayscale, but with different resolutions, where... Figure 4 The resolution of (a) Man and (b) Plane is 512×512 pixels, the size of (c) Lake and (d) Peppers is 256×256 pixels, the size of (e) Med1 and (f) Med2 is 256×512 pixels, and the size of (g) Med3 and (h) Med4 is 512×256 pixels.

[0229] Experimental environment: All experimental programs were developed based on Python 3.6, and the running platform was a 64-bit Windows 10 (Professional Edition) operating system. The hardware environment was an Intel(R) Core(TM) i7-8565U CPU@1.80GHz and 8.00GB RAM.

[0230] Parameter settings: When implementing the threshold Paillier cryptosystem, the security parameter λ' = 1024 is set, and p and q are selected as 512-bit secure prime numbers. In addition, the Shamir secret sharing algorithm is tested with (n,k) = {(7,5),(5,3),(4,3),(3,3)}. The embedding rate of the VE algorithm is set to t = {1,128,256,512,1015}, and the embedding rate of the RNR algorithm is set to s = {1,2,4,8,12,14}. The embedded messages are all randomly generated to match the maximum embedding amount of the embedding rate.

[0231] For the RDHED algorithm, different performance metrics need to be evaluated, including payload (i.e., embedding rate) and reconstructed image quality. The embedding rate is represented by bits per pixel (bpp), and it is expected to be as large as possible to embed the maximum amount of information. To evaluate the quality of the restored image, we use two reference metrics: peak signal-to-noise ratio (PSNR) and structural similarity (SSIM).

[0232] Below, we analyze and evaluate the performance of this scheme, conduct extensive comparisons with some classic RDHED schemes, compare this scheme with the recent Paillier-based RDHED scheme in terms of auxiliary information, and finally conduct a security analysis.

[0233] 3-1. Correctness Assessment

[0234] 3-1-1 Correctness Analysis

[0235] This scheme can be broadly divided into: key distribution, encryption, threshold decryption, two embeddings, and two extractions. These processes are performed alternately. The two embeddings utilize two different embedding methods: value expansion and random number refresh embedding. Therefore, the correctness of this scheme is primarily determined by encryption / decryption and the two embedding methods.

[0236] The correctness of multi-key threshold decryption is based on the correctness of Paillier encryption / decryption and Shamir secret sharing: key distribution mainly involves dividing the private key d into n secret shares S using the Shamir secret sharing method. i The system encryption employs standard Paillier public-key encryption. During share decryption, each Si is used as an exponent to raise the ciphertext c to a power. During joint decryption, d is recovered from the exponent using the Lagrange interpolation formula. The correctness of Shamir's secret distribution and secret recovery ensures that the recovery of d from the exponent can be performed correctly. Of course, due to the difficulty of the discrete logarithm problem, this d is difficult to calculate. Finally, the plaintext m can be recovered using the binomial theorem and the L-function.

[0237] Both embedding methods, taken individually, are based on the probabilistic and additive homomorphic design of Paillier encryption. The random number refresh embedding method modulo 2 changes the random number. s This embeds information in the low s bits of the ciphertext, by performing the same modulo 2 operation on the ciphertext. sThe embedded message can be extracted through computation; the value-expansion embedding method modifies the ciphertext using homomorphic operations, expanding the corresponding plaintext value to embed the information. After decryption, performing the reverse operation on the plaintext allows extraction of the information and recovery of the plaintext. Both methods execute correctly because the ciphertext after embedding the information is valid, and therefore both can be decrypted using the Paillier threshold to obtain the correct result.

[0238] In this scheme, the combination of the two embedding methods does not disrupt their respective embedding spaces. The random number refresh method does not change the encrypted plaintext; embedding only depends on the specific form of the ciphertext. However, if the ciphertext is corrupted by subsequent embedding operations, the embedded message cannot be extracted losslessly. The value expansion embedding method, on the other hand, changes both the ciphertext value and the decrypted plaintext value. Therefore, the value expansion method cannot be used after the random number refresh method. In this scheme, the first embedding uses the value expansion method, and the second embedding uses the random number refresh method. This ensures that the data from both embeddings can be completely extracted, and the plaintext can be recovered losslessly.

[0239] 3-1-2. Accuracy of Information Extraction

[0240] This scheme employs two forms of information embedding and extraction: ① The decryptor extracts additional information embedded using the RNR method from the ciphertext field; ② The receiver extracts additional information embedded using the VE method from the plaintext field after decryption. Experiments were conducted under different settings. The Shamir secret sharing parameters were set to {(7,5),(5,3),(4,3),(3,3)}, the embedding rate of the VE algorithm was t = {1,128,256,512,1015}, and the embedding rate of the RNR algorithm was s = {1,2,4,8,12,14}. The embedded messages were all randomly generated, representing the maximum embedding amount at the corresponding embedding rate. The experiments tested the information embedding and extraction functions separately, and compared the accuracy of the extracted information bit by bit. The results showed that under all settings, the accuracy of information extraction in both cases was 100%, indicating that the embedded information could be completely extracted.

[0241] 3-1-3 Reversibility of Plaintext Recovery

[0242] Tests were conducted using different images, and the experimental results verified that the proposed scheme can correctly complete key distribution, encryption, and sequential embedding of message m. A and m B Complete extraction of m from the ciphertext field B Threshold decryption, complete extraction of m from the decrypted plaintext domain A Furthermore, plaintext images can be recovered without distortion through reversible recovery. Figure 5 This is a verification experiment using "Man" as the test image for reversible recovery.

[0243] Figure 5 In this context, 'a' represents the original image. Figure 5 b. in the image is the one encrypted using the Paillier algorithm. Figure 5 c. and Figure 5 In the text, d represents the embedding of m. A and m B The following image illustrates this. Paillier homomorphic encryption expands the image's pixel size, and the larger the security parameter, the greater the ciphertext expansion. When the security parameter is 1024, for demonstration purposes, we use 256 bytes to represent one ciphertext pixel, thus increasing the width and height of the ciphertext image to 16 times that of the original image. Note that the increase in image size is solely due to the ciphertext expansion; the actual number of pixels in the image remains unchanged. Figure 5 For aesthetic reasons, encrypted images and images containing encrypted text are presented at the same size as the original images.

[0244] The image after decryption of the ciphertext image, such as Figure 5 As shown in e., the PSNR of the decrypted image is denoted as PSNR1, and the SSIM is denoted as SSIM1. Because the VE method performs value expansion on the plaintext pixels, resulting in different representation ranges for the decrypted pixels, PSNR1 is meaningless in this case. Figure 5 f in the figure represents the restored plaintext image. The PSNR of the restored image is denoted as PSNR2 and the SSIM is denoted as SSIM2. In the experiment, the PSNR2 value approaches +∞ and the SSIM2 value approaches 1, indicating that the original image was restored without distortion.

[0245] 3-2. Embedding Capability Assessment

[0246] This section first analyzes the embedding capability of the algorithm, and then evaluates the embedding capability through experiments. The results are as follows:

[0247] 3-2-1 Embedding Capability Analysis

[0248] One of the key metrics for evaluating an RDHED algorithm is its maximum embedding capability. Following the steps in Part 2, the embedding capability of this scheme's embedding algorithm comprises two parts: the embedding capability of the value expansion method in the decrypted plaintext field and the embedding capability of the random number refresh method in the ciphertext field.

[0249] The embedding capability of the value expansion algorithm depends on the extent of plaintext expansion. In this scheme, the encrypted plaintext *m* is a grayscale image pixel value, *m* ∈ [0, 255], thus requiring only 8 bits to represent. According to the parameters of the Paillier algorithm, the plaintext range is [0, N). Experimental results show that when N is 1024 bits, each plaintext pixel can be expanded from 8 bits to a maximum of 1023 bits, and decryption is still successful. Therefore, the maximum embedding rate of the value expansion algorithm is 10¹⁵ bpp. Note that when expanded to 1024 bits, if the pixel value *m* > N, decryption will fail.

[0250] Theoretically, there is no upper limit to the embedding capability of the random number refresh embedding algorithm. However, as the number of embedding bits increases, the time complexity of the algorithm increases exponentially. Therefore, the specific number of embedding bits can only be determined in experiments within the time and space constraints, depending on the available computing resources. In this experimental environment, the maximum embedding rate of the random number refresh embedding algorithm reached 14 bpp.

[0251] 3-2-2 Experimental Results

[0252] This experiment tested the above 8 images, which were divided into 4 groups and processed to different resolutions (N = 1024 bits). The test results are shown in Table 2:

[0253] Table 2

[0254]

[0255] The table above uses two methods to represent the embedding rate: plaintext embedding rate and ciphertext embedding rate. Plaintext embedding rate refers to the number of bits of payload information per pixel in the decrypted plaintext domain, while ciphertext embedding rate refers to the number of bits of payload information per pixel in the ciphertext domain. As shown in the table, verification was performed on eight test images of different sizes. When N is set to 1024 bits, the maximum ciphertext embedding rate can reach 14 bpp, and the maximum plaintext embedding rate can reach 1015 bpp. Simultaneously, the PSNR values ​​of the recovered images all approach +∞, and the SSIM is 1, indicating that the plaintext image can be recovered without distortion.

[0256] 3-3. Comparison with other embedding algorithms

[0257] 3-3-1 Comparison of Embedding Performance

[0258] The proposed method was compared with the typical RDHED embedding algorithm using different images.

[0259] Among the known literature, the proposed scheme is the first RDHED scheme based on multi-key decryption. Regarding embedding rates, the first three methods in Table 3, using stream cipher encryption, achieve maximum embedding rates of 1 bpp, 1 bpp, and 4.78 bpp, respectively; methods 4-9 in Table 3, using Paillier cipher encryption, achieve a maximum ciphertext embedding rate of 14 bpp and a maximum plaintext embedding rate of 1022 bpp. All algorithms can achieve lossless restoration of the original image. Since some algorithms can only embed in the plaintext domain, such as the Random Element Substitute (RES) algorithm proposed in method 9, the plaintext domain embedding rate after decryption reaches 1022 bpp; while this scheme can embed messages in both the plaintext and ciphertext domains simultaneously, the overall embedding rate (plaintext domain embedding rate + ciphertext domain embedding rate) of this scheme reaches the highest level in the currently known literature.

[0260] Besides the embedding rate, some methods result in decryption results that are close to the original image, with a high PSNR value. This is because the embedding method alters the original image relatively little, but on the other hand, the embedding rate is relatively low. Other methods, such as method 6, significantly expand the range of plaintext values, making PSNR1 statistically insignificant. The second embedding scheme proposed in method 9 has ciphertext field embedding rates of 5bpp and 6bpp, respectively, and a plaintext field embedding rate of 255bpp. This scheme combines two embedding methods, with the value expansion algorithm being the same as method 6, significantly expanding the plaintext range; therefore, PSNR1 is not statistically significant. The comparison results are shown in Table 3.

[0261] Table 3

[0262]

[0263] 3-3-2 Comparison of Auxiliary Information

[0264] In most known RDHED algorithms, auxiliary information (also known as side information) needs to be generated and embedded into a fixed space in order for the receiver to correctly extract the message. The receiver first extracts the auxiliary information and then extracts the useful embedded message. However, the real purpose of information hiding is to hide the useful information, and the storage of auxiliary information inevitably occupies some redundant space in the carrier.

[0265] To correctly extract information, the embedding method in this scheme also requires processing auxiliary information. Specifically, in the random number refresh algorithm, the embedding rate needs to be stored in a fixed location. Other methods reserve the last 4 pixels for storage, with each pixel storing one bit of the embedding rate. Analysis shows that in the random number refresh algorithm, the capacity of a single pixel is limited only by computational resources. According to experimental results, the maximum embedding rate of the random number refresh algorithm is only 14. Therefore, this scheme uses the last pixel for storage, improving its ability to carry effective information compared to similar methods. Similarly, the value expansion algorithm also needs to pass the embedding rate to the receiving end for extraction. Other value expansion algorithms reserve the last 12 pixels to store the embedding rate. However, considering that the maximum embedding rate of the value expansion algorithm can reach 1015, this scheme uses the last pixel to free up 12 bits to store the embedding rate. In summary, compared to similar algorithms, this scheme compresses the storage space of auxiliary information, freeing up more space for embedding effective information. The comparison results are shown in Table 4.

[0266] Table 4

[0267] Scheme / method SizeofauxiliaryinformationinRNR SizeofauxiliaryinformationinVE wu2023 4pixels - wu2016 4pixels 12 pixels wu2019 4pixels 12 pixels proposed 1 pixel 1 pixel

[0268] 3-4 Security Analysis

[0269] Security is a crucial aspect that must be considered when designing the RDHED algorithm. This scheme's encryption and decryption process is based on Paillier cipher encryption and threshold decryption. Its security relies on the difficulty of three problems: RSA large integer factorization, discrete logarithms, and the decisional composite residues hypothesis. Based on current knowledge, these three problems are computationally difficult, therefore the encryption and decryption process is secure.

[0270] The value expansion and random number refresh embedding methods used in this scheme are based on the probabilistic nature of Paillier encryption and additive homomorphism. The ciphertext obtained after embedding the message is always valid, and the embedding process does not reduce the security of Paillier cipher.

[0271] More importantly, the threshold decryption method employed in this scheme transforms the secret sharing of private keys into multi-key decryption. Only the decryption share that meets the threshold can complete the decryption, while smaller subsets cannot obtain any useful information. This effectively solves the security problems of private key leakage and single point of attack, enabling the system to resist collusion attacks by (k-1) decryptors.

[0272] In addition, during the threshold decryption process, based on the difficulty of solving the discrete logarithm problem, the distributed decryption value of each decryption end does not reveal any information about the private key share, so the private key share is secure.

[0273] Finally, each participant can authenticate the source of the received data. Specifically, the image hiding end embeds authentication information in the image, and the decryption end extracts the authentication message from the ciphertext domain to verify the legitimacy of the image source. The image receiving end verifies each distributed decrypted image collected, ensuring the reliability and validity of each distributed decrypted image.

[0274] This paper proposes a novel reversible information hiding scheme for the ciphertext domain based on multi-key threshold decryption, overcoming the single point of failure problem caused by a single public-private key pair in previous ciphertext domain information hiding schemes. It verifies the feasibility and potential value of reversible information hiding in the ciphertext domain within a secure multi-party environment. The embedding algorithm employed in this scheme utilizes the plaintext representation redundancy and plaintext-ciphertext mapping redundancy of the Paillier cryptosystem, employing value expansion and random number refresh embedding methods. The overall embedding capability reaches the highest level currently available, and the original image can be recovered without loss of quality. The embedded message part is extracted in the ciphertext domain, and part is extracted in the decrypted plaintext domain, making the scheme highly practical and flexible. The limitation of the scheme is that the embedding algorithm significantly expands the range of plaintext value representations, requiring a recovery algorithm after direct decryption to ensure lossless reconstruction of the image. Future research will focus on reversible information hiding in the ciphertext domain under different secure multi-party computation frameworks.

[0275] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for reversible information hiding in the ciphertext field based on multi-key threshold decryption, characterized in that, include: The system public key and private key shares are generated through the key server, and the private key shares are distributed to several decryption terminals; The original image is obtained from the image provider, and then encrypted using the system's public key to obtain an encrypted image. The embedded message is divided by the data hiding end to obtain the first message and the second message. The value expansion embedding algorithm is used to embed the first message into the encrypted image, and the random number refresh embedding algorithm is used to embed the second message into the encrypted image containing the first message, so as to obtain the encrypted image containing the ciphertext. The message is extracted from the encrypted image by the decryption terminal to obtain the second message, and the encrypted image is decrypted using the private key share to obtain the distributed decrypted image; The image receiving end performs joint decryption on several distributed decryption images to obtain a plaintext image. The plaintext image is then used to extract and restore messages to obtain the first message and the original image.

2. The method according to claim 1, characterized in that, The process of generating system public and private key shares includes: Security parameters are input through the key server. Two distinct secure prime numbers are generated based on these parameters. Subprime numbers are then obtained from the secure prime numbers. A semi-random constant and a random constant are randomly selected. The public key is obtained based on the secure prime numbers, subprime numbers, and the selected constants. The public key is pk = (N, g, Δ, v), where N = pq, p and q are secure prime numbers of equal length, g is the selected semi-random constant, Δ = n!, and v represents the selected random constant. g satisfies: And gcd(L(g λ mod N 2 ),N)=1,λ=p'q',n is the number of private key shares; p' and q' represent different subprimes, satisfying: p=2p'+1,q=2q'+1; The decryption key is calculated using the Chinese Remainder Theorem, where d satisfies: d = 1 mod N and d = 0 mod λ; Private key sk = (d), and private key sk is divided into private key shares by Shamir secret sharing method.

3. The method according to claim 1, characterized in that, The process of encrypting the original image includes: The image provider uses a probabilistic multinomial-time algorithm with the system public key to encrypt the original image, generating an encrypted image. This is achieved by encrypting each plaintext pixel in the original image through a raster scan sequence to obtain ciphertext pixels, and then summing the ciphertext pixels to obtain the encrypted image.

4. The method according to claim 1, characterized in that, The process of embedding the first message into the encrypted image includes: The embedding rate t of the value extension embedding algorithm is obtained through the data hiding end. The first message is grouped according to the embedding rate of the value extension embedding algorithm to obtain the first message group. Each t-bit long binary array in the first message group corresponds to a ciphertext pixel of the encrypted image. When the last group is less than t bits, it is padded with 0 in the high bits. Based on the raster scanning order, the last ciphertext pixel is reserved, and the new ciphertext value c' is calculated for the other ciphertext pixels: Where c represents the ciphertext pixel, g and N represent common parameters, mod represents the modulo function, and b represents the t-bit binary array corresponding to the ciphertext pixel; The embedding rate t of the value-extended embedding algorithm is represented by a 12-bit binary number, and the last ciphertext pixel c is processed using the value-extended embedding algorithm. l Encryption is performed, i.e., the calculation of the new ciphertext value: Among them, c' l This represents the new ciphertext value of the last ciphertext pixel; summing up all the recalculated ciphertext pixels yields an encrypted image embedded with the first message.

5. The method according to claim 1, characterized in that, The process of embedding the second message into an encrypted image that embeds the first message includes: The embedding rate s of the random number refresh embedding algorithm is obtained through the data hiding end. The second message is grouped according to the embedding rate of the random number refresh embedding algorithm. Each s-bit long binary array in the second message group corresponds to a ciphertext pixel of the encrypted image embedded in the first message. When the last group is less than s bits, it is padded with 0 in the high bits. Based on the raster scanning order, reserve the last encrypted pixel and arbitrarily select an integer. Calculate the new ciphertext value c for the other ciphertext pixels: c”=c'r' N modN 2 For each s-bit long binary array b' = b'1b2'...b to be embedded s ',judge: c”mod2 s =b1'b'2...b' s If the condition is not met, then r' is selected again; if the condition is met, then c” is used as the new ciphertext. The embedding rate 's' of the random number refresh embedding algorithm is represented by a 4-bit binary number. The last ciphertext pixel is then encrypted using the random number refresh embedding algorithm to obtain the new ciphertext value 'c'. l The calculation of "": c″ l =c' l r' l mod N 2 By continuously reselecting r l ',judge: c″ l mod 2 4 =s After meeting the requirements, c' l The new ciphertext value, which is the last ciphertext pixel, is used to summarize all the recalculated ciphertext pixels to obtain the ciphertext image.

6. The method according to claim 1, characterized in that, The process of message extraction from a ciphertext image includes: The message is extracted from the ciphertext image using a deterministic polynomial-time algorithm at the decryption end. Based on the raster scan order, the ciphertext value c' of the last ciphertext pixel in the image containing ciphertext is... l Perform calculations: s=c″ l mod 2 4 Where s represents the embedding rate of the random number refresh embedding algorithm; The embedding rate s of the embedding algorithm is refreshed based on the obtained random number, and the remaining ciphertext pixels are then calculated: b'=c″mod 2 s Here, b' represents each s-bit long binary array, and concatenating each s-bit long binary array yields the second message.

7. The method according to claim 1, characterized in that, The process of decrypting a ciphertext image using a share of the private key includes: The encrypted image is decrypted in a distributed manner using a probabilistic multinomial-time algorithm at the decryption end. Specifically, for each encrypted pixel c” in the ciphertext image, the distributed decryption value c is calculated. i : The distributed decryption values ​​of each encrypted pixel are aggregated to obtain the distributed decrypted image; And calculate the verification value v i : Where i is an integer and 1≤i≤n, v and Δ represent common parameters, and S i This represents the share of the private key.

8. The method according to claim 1, characterized in that, The process of jointly decrypting several distributed decryption images includes: The image receiver employs a deterministic polynomial-time algorithm to jointly decrypt several distributed decryption images, where: Validate based on the validation value: Among them, c i Let c represent any selected pixel in the i-th distributed decryption image, c be the corresponding ciphertext pixel, and v be a common parameter. i For verification purposes; If the verification passes, this share of the distributed decryption image is untrusted, and the distributed decryption image share needs to be collected again; if the verification passes, each pixel in the distributed decryption image is decrypted, and the following calculations are performed: m'=L(c”'modN 2 )(4Δ 2 ) -1 The decrypted plaintext pixel m' is obtained, where Δ is a common parameter, i is the private key share number, i' represents the counter, and also represents a private key share number different from i, and S is the set of collected private key share numbers; The plaintext image is obtained by summing up the plaintext pixels.

9. The method according to claim 1, characterized in that, The process of extracting and restoring messages from a plaintext image includes: The plaintext image is extracted and restored using a deterministic polynomial-time algorithm at the image receiver. According to the raster scanning order, for the last pixel m of the plaintext image l 'Calculations are performed to obtain the embedding rate t of the value extension embedding algorithm:' t=m l 'mod2 12 pass Get the original pixel value of the last pixel; The remaining pixels m' of the plaintext image are decrypted using the embedding rate t of the value-extended embedding algorithm, yielding an embedded t-bit binary array and the original pixel values ​​of the remaining pixels: b=m'mod 2 t Where b is a t-bit binary array. Concatenate each t-bit binary array to obtain the first message; The original image is obtained by summing up all the original pixel values.

Images