Abstract
Due to the advantages of larger content and error correction capability, quick response (QR) code is commonly used as a tagging technology for the Internet of Things (IoT) recently. However, the cover message of QR code can be easily decoded by a QR code reader, which causes the security and privacy of the cover message to raise the important issues. In this paper we present a new secret hiding scheme based on QR code. The proposed scheme has low computational complexity and is suitable for low-power devices in IoT systems because of utilizing the error correction property of QR code to hide secret information. The proposed scheme hides the secret information without changing the cover message of QR code and the user can get the cover message by using a general scanner, which contributes to reducing attacker’s curiosity. The hidden secret information can be read by a special scanner with the help of the user key. One thing which is better than other known schemes is that the proposed scheme can resist contrast analysis attack. In addition, experimental results show the proposed scheme has feasibility, low computational complexity, and high hiding payload.
1. Introduction
The Internet of Things (IoT) interconnects physical and digital objects that are identifiable and may interact with each other and with users. These objects, each with its own identity, are well beyond only computers and they are our cars, luggage, household applicants, humans, and so on. This was made possible by different tagging technologies like radio frequency identification (RFID) and two-dimensional (2D) barcode which allow physical objects to be identified and refer over the IoT. Due to the less complexity and a cheap solution of 2D barcodes, they have become popular for building an IoT system. Quick response (QR) code, as a 2D barcode with the advantages of larger QR content and error correction capability, is commonly used recently.
QR code can store rich information including text, URL link, and other types of data. They can be used as a data carrier to allow users to access the system more conveniently in an IoT system. However, the cover message of the QR code can be easily read by a barcode reader [1], such as a mobile phone with a camera. This may lead to leaking of privacy. Another important issue is the security of QR code when we use a QR code to communicate secret information.
The traditional method of encrypting secret information into cipher texts makes it impossible for an attacker to obtain secret information, thereby achieving confidentiality [2–4]. This method requires a lot of computation and is sometimes not suitable for the objects of IoT system. It also clearly points out what is important information and easily attracts the attention of the attacker to increase the possibility of being attacked [5]. Information hiding technologies based on QR code have emerged to solve these new problems. The image hiding schemes [6–8] are mainly to convert the secret into a QR code tag and then embed the secret QR code into the image. However, these schemes require complicated image processing operations to recover the hidden QR code. Most watermarking algorithms, which use Discrete Cosine Transform, Discrete Wavelet Transform, and Discrete Fourier Transform algorithms to hide the watermark in the QR code [9–12], have high computational complexity and limited hidden information caused by the length and width of QR code. Therefore, due to the high computational complexity of these methods, they are not suitable for low-power mobile devices.
To meet the demands of applications of QR code to low-power mobile devices in IoT systems, some schemes have been presented which used the code characteristic of the QR code to hide secret [13–17]. Chiang et al. proposed a scheme [14] to hide the secret information being confused by the pseudo-random binary stream generated by the user key. To increase the hiding payload, [16] proposed a data hiding method which is an extended version of [13]. However, these methods can not resist the contrast analysis attack. Under such an attack scenario, the attacker can contrast the codewords of QR codes which have different cover message and hide the same secret information with the same user key. These methods insert some data related to the secret information into the original codewords and make positions of secret message unchanged when the secret and key do not change. The attacker can get the data which are the same part of these codewords. Even the attacker can not recover the secret from the data they got without the key, they can create a new QR code with embedding these data which hide secret information. When these secret schemes are used for copyright protection, by this method the attacker can forge copyright information containing the legal copyright information.
In order to resist the contrast analysis attack, we design a new QR code secret hiding scheme. The proposed scheme makes the changed codewords of original QR code related to the cover message using the simple XOR operation. Compared with original QR code, QR codes have different changed codewords if they have the different cover message and hide the same secret information with the same key. So the attacker can not find the same data related to the secret information and key through the contrast analysis attack. In addition, the proposed scheme utilizes the biggest error correction ability of QR code to resist brute force attack. With higher security than the known schemes, the proposed scheme has the low computational complexity and high hiding payload.
The paper is organized as follows. Section 2 introduces QR code technique. The proposed secret hiding scheme is described in Section 3. The simulation, performance comparisons, and security analysis are discussed in Section 4. Finally, Section 5 concludes the paper.
2. The Technology of QR Code
QR code is one of the most popular 2D barcodes [18]. It consists of white and black square modules which are equal to the binary values 0 and 1. Figure 1 depicts an instance of QR code symbol. The number of modules increases with QR code version. There are 40 QR code standard versions among which Version 1 has the smallest modules and Version 40 has the largest modules. The data payload becomes larger as the version evolves. There is 208 data modules in Version 1 and 29648 data modules in Version 40. The message bit stream shall be divided into codewords. All codewords are 8 bits in length.
To achieve the recovery ability, the error correction algorithm has been used in QR code to generate a series of error correction codewords which are added to the data codeword sequence. The error up to 30% can be corrected. Each version has four error correction levels L, M, Q, and H as shown in Table 1. Depending on the version and error correction level, the data codeword sequence is subdivided into one or more blocks, to each of which the error correction algorithm shall be applied separately to the data codeword. To show this, the error correction characteristics of QR code of Version 1, 20, and 40 are listed in Table 2, where is the total number of codewords, is the number of data codewords, and is the number of error correction capacity. For Version 20 with error correction level L, as an example, 1085 codewords are divided into 8 blocks in which 3 blocks apply error correction codewords (135,107,14) and 5 blocks apply error correction codewords (136,108,14).
The process to construct a QR code is structured into seven steps.
Step 1 (data analysis). The input data stream is analyzed to identify the variety of different characters to be encoded and the version and error correction level are selected.
Step 2 (data encodation). Data characters are converted to a bit stream which is split into 8-bit codewords.
Step 3 (error correction coding). The codeword sequence is divided into the required number of blocks and the error correction codewords are calculated for each block with being appended to the end of the data codeword sequence.
Step 4 (structure final messages). The final sequence is assembled by taking data and error correction codewords from each block in turn.
Step 5 (module placements in matrix). The codeword modules are placed in the matrix together with other patterns.
Step 6 (masking). To optimize the dark/light module balance and minimize the occurrence of undesirable patterns, the masking pattern is applied.
Step 7 (format and version information). The format and version information are created.
3. The Proposed Scheme
The proposed scheme utilizes the code characteristic of QR code to hide secret information. It includes two procedures, secret hiding procedure and secret extraction procedure, whose flowcharts are shown in Figures 2 and 3. Secret hiding procedure is integrated with the QR code generation for a cover message and secret extraction procedure is integrated with the QR code scanning, as we will describe in detail.
3.1. Secret Hiding Procedure
For the secret information to be hidden, its code can be given according to the coding principle of the QR code. is expanded to a longest sequence whose length is related to error correction of the QR code version. Suppose be the number of error correction capacity. The length of is . In order to resist QR contrast attack, will be confused by a sequence related to the cover message. The following are details of secret hiding procedure.
Step 1. Perform the normal QR code encoding procedure for the secrete information and cover message until their codewords are generated.
Step 2. Use user’s key as input to generate a location sequence , where , such that with being a subset of and , for all .
Step 3. Use user’s key as input to generate a sequence with , such that the th codeword is one of data codewords for all .
Step 4. Let be the length of the secret codewords and the length of the code of be . Sequence with length is added to code , and then the code of is added at the end. The resulting sequence is .
Step 5. According to , find the data of the block on the position , that is, the th data of the th codeword, for all . Then get a sequence .
Step 6. Generate a sequence with for .
Step 7. Embed the sequence into the cover message codewords according to the position sequence . For with , look for the th bit of the th block in the cover message codewords and replace it with .
Step 8. Continue the process of encoding the QR code with hidden secret information.
3.2. Secret Extraction Procedure
To extract the secret information, we design the special scanner in which the secret extraction is integrated with scanning process. The common scanner only can read the cover message by scanning the QR code. Using the special scanner, the authorized user can get the cover message and the secret information with inputting the key . Secret extraction procedure includes the following steps.
Step 1. Scan QR code to get data block information before error correction.
Step 2. Use user’s key as input to generate a location sequence .
Step 3. According to the location sequence , for any with , find the th bit data of the th codeword in the QR code and get the sequence .
Step 4. Finish error correction and use user’s key as input to generate a sequence .
Step 5. According to , find the data on the position of the block and get the sequence corresponding with , .
Step 6. Generate sequence with for .
Step 7. Calculate the length of the secret according to the last th bits and then get the secret codewords .
4. Simulation Results and Analysis
To assess the feasibility and suitability of the scheme, we implement the proposed secret hiding scheme using Python language which has a powerful operation library of QR code.
4.1. Experimental Results and Practicability
The results of the proposed scheme for the 1-H QR versions are shown in Figure 4. Figure 4(a) is the original QR code image with the cover message “Data”. Figure 4(b) is the QR code image which has the same cover message with Figure 4(a) and hides the secret message “Secret” with the user key “google”. Figures 4(c) and 4(d) hide the same secret and use the same user key as Figure 4(b), but have the different cover message “Escher” and “Linux”.
(a)
(b)
(c)
(d)
To show the hiding procedure, we introduce which denote the coding function of QR code including step 1 and step 2 of constructing QR code and denote the coding function of QR code with secret hidden. For simplicity, we use a decimal number to represents an 8-bit binary sequence. In Figure 4(a), “Data” is the cover message of the QR code. With using the mask type 7, we get ( “Data”) as follows: (Data) = , 68, 70, 23, 70, 16, 236, 17, 236, 97, 53, 255, 172, 71, 43, 105, 94, 82, 129, 51, 201, 118, 131, 139, 97, .
In Figure 4(b), the cover message of the QR code is “Data”, the user key is “google”, the secret message is “Secret”, and the mask type is 0. According to secret hiding procedure, we get = . = . = , (18, 0), (6, 5), (18, 2), (23, 3), (15, 4), (18, 1), (6, 6), (4, 3), (15, 6), (7, 1), (7, 0), (25, 2), (23, 5), (6, 1), (25, 3), (23, 1), (18, 4), (4, 4), (12, 3), (18, 7), (4, 5), (7, 2), (25, 1), (6, 3), (23, 0), (15, 5), (12, 6), (4, 2), (15, 3), (23, 2), (25, 7), (25, 6), (23, 6), (6, 7), (7, 4), (12, 4), (4, 1), (12, 7), (7, 6), (18, 3), (18, 5), (4, 7), (25, 0), (4, 6), (7, 7), (7, 5), (25, 4), (12, 0), (15, 1), (15, 2), (6, 2), (7, 3), (23, 4), (15, 0), (23, 7), (12, 2), (12, 1), (6, 0), (12, 5), (4, 0), (6, 4), (25, 5), . (Data)= , 68, 70, 23, 139, 16, 122, 7, 236, 97, 53, 255, 70, 71, 43, 230, 94, 82, 107, 51, 201, 118, 131, 216, 97, 54.
Comparing (“Data”) and (“Data”), we get that the positions of changed codewords are , in which the numbers such as 4 are position numbers of the codewords with underline.
Now we turn to Figure 4(c). In Figure 4(c), the cover message of the QR code is “Escher”. The user key and the secret to be hidden are the same as in Figure 4(b) and the mask type is 0. (Escher) = , 100, 87, 54, 54, 134, 87, 32, 236, 147, 246, 165, 169, 32, 81, 187, 30, 0, 51, 111, 72, 5, 181, 71, 33, . and are the same as in Figure 4(b). But is different from Figure 4(b). (“Escher”) = , 100, 87, 54, 202, 134, 7, 193, 236, 147, 246, 165, 10, 32, 81, 18, 30, 0, 188, 111, 72, 5, 181, 114, 33, 214. Comparing (“Escher”) and (“Escher”), the position number of the changed codewords also are .
In Figure 4(d), under inputting the same key with Figure 4(b), the same secret is hidden in the QR code with the cover message “Linux” and the mask type 0. (“Linux”) = , 84, 198, 150, 231, 87, 128, 236, 17, 7, 55, 171, 236, 178, 92, 79, 9, 79, 217, 71, 42, 143, 106, 227, 208, . As the cover message is changed, is changed to be . So the final (“Linux”) = , 84, 198, 150, 159, 87, 152, 220, 17, 7, 55, 171, 188, 178, 92, 185, 9, 79, 2, 71, 42, 143, 106, 225, 208, 201 which has different data on the same changed codewords with Figure 4(c).
4.2. Schemes Performance
Considering the noise, compression, damage, etc., caused by the propagation and printing methods in practical applications, we analyzed the performances in Gaussian noise, salt and pepper noise, JPG lossy compression, damage, and rotation of QR codes generated by the proposed scheme hidden secret. As shown in Table 3, the QR code generated by the proposed scheme can be read correctly when being subjected to various distortions.
Table 4 shows a general comparison between the related schemes [6–12, 14, 16, 19] and the proposed scheme. Unlike the conventional hiding and watermarking schemes [6–12, 19], the proposed scheme utilizes the code character of the QR code and embeds the secret into the modules of the QR code directly. Hence, the QR code with the hidden secret information can be easily scanned by barcode readers, which make it suitable to the low-power mobile device applications.
Table 5 shows the tolerant secret capacity of the proposed scheme with different QR versions and error correction levels. The proposed scheme can embed at most secret bits into the QR tag. Here, the maximum secret capacity is decided by the version and error correction level of the QR code. For example, in QR Version 1-H, the proposed scheme can embed at most 64 bits secret into the QR tag.
4.3. Security Analysis
In what follows we discuss the resistance of the proposed scheme to two QR code attacks.
Secret hiding payload in schemes [14–16] is not fixed; that is to say, the length of the secret to be embedded (which may be the original secret or the secret with confusion) is decided by the original secret, which result in their schemes being vulnerable to one kind of QR code attacks. Under this attack, when attackers have the information of the version of a QR code, they can generate a QR code in the same version with the same cover message and compare this QR code with the QR code embedding the secret and then get their different part including the secret information. If the payload of the hidden secret is not high, for example, in [15], secret could be leaked when being subjected to brute force attacks. The proposed scheme extends the length of the original secret to the maximum length by adding all 0 sequences to the code of the original secret. After confusion the extended secrets are embedded into the QR code. No matter how long the length of the secret is, the attacks get their different part with the longest length when they compare the original cover QR code with the new QR code embedding the secret. Hence, the scheme has the best resistance to brute force attack even if the original secret is short.
The position and confusion of secret to be embedded are decided only by the user key in schemes [14–16]. Hence, QR codes hiding the same secret with the different cover message and the same key have some same data. These same data can be exploited by contrast analysis attack. The proposed scheme achieves confusing secret using the codewords of the cover message. So when the cover message changes, the data of the changed codewords will be different. For example, as shown in Section 4.1, compared with original QR code in Figure 4(b), QR codes in Figures 4(c) and 4(d) have changed codewords of cover messages on the same position but have different data. Contrasting (“Escher”) and (“Linux”), there are not the same codewords which will leak the secret information. Hence the attacker can not find position where the secret information was embedded by contrasting the code of the QR codes hiding the same secret information with the different cover message and the same key.
5. Conclusion
The QR code secret hiding scheme designed in this paper can hide up to 9720 bits of secret information as needed and does not affect the readability of the cover message. The secret information can be extracted by the authorized user with the right key in the proposed scheme. Hence when the QR code is copied by the attacker, the attacker can not extract the secret without the key. The proposed scheme has low computational complexity and high secret payload and is suitable for low-power devices. In addition, the basic point is that, unlike the other known schemes, the proposed scheme can resist contrast analysis attack, which can prevent forgery if the scheme is applied for e-ticket, copyright protection, and brand anticounterfeit in IoT systems.
Data Availability
No data were used to support this study.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This work was supported by the National Natural Science Foundation of China under Grants nos. 61472472, 61672414, and 61772418, the Natural Science Basic Research Plan in Shaanxi Province of China under Grant no. 2016JM6033, and the Key Laboratory of Applied Mathematics of Fujian Province University (Putian University) under Grant no. SX201807. Qinglan Zhao is supported by the Innovation Ability Support Program in Shaanxi Province of China under Grant no. 2017KJXX-47.