Abstract
In order to effectively increase embedding capacity and completely extract the watermarking information in information hiding of encrypted images, a new reversible watermarking embedding algorithm based on rhombus prediction model and difference histogram shifting ideas is proposed. Firstly, the images are pretreated according to rhombus prediction model. Then, the watermarking information is embedded in encrypted images by effective combination of homomorphism encryption scheme and reversible watermarking techniques. Finally, the watermarking information is completely extracted and the images are recovered based on computed difference histogram from left to right and from top to bottom. So, the efficiency and reversibility are ensured when watermarking information is embedded in encrypted image. Experiment results show that the proposed algorithm is simple and easy to realize, the embedding capacity is effectively increased, watermarking information is completely reversible, and the image can be recovered with no distortion.
1. Introduction
With the advent of the digital age, media content gradually changes from analog to digital. Digital technology makes the multimedia data (image, video, and text) storage, replication, and communication become very convenient. Therefore, how to implement effective copyright protection and information security measures in the network environment has become an urgent realistic problem.
At present, there are three types of reversible watermarking methods: (1) compression based reversible watermarking [1–3]; (2) expansion based reversible watermarking [4–6]; (3) histogram modification based reversible watermarking [7–9].
Encryption technology [10] and digital watermarking [11] are all with different maintenance information security function. So, they are often used together. In traditional way, the watermarking information is embedded in the multimedia works, and then the multimedia works that contain the watermarking information are encrypted. However, in some occasions, we must first encrypt the image and then embed watermarking. So there is the digital watermarking in encryption images. Reference [12] has proposed the corresponding algorithm, but the algorithm is all irreversible. However, in the military, medicine, and so on, the fidelity of the occasion possesses high demand, and any distortion of the multimedia data is not allowed. So, the encryption technique of reversible watermarking is developed. Zhang et al. [13] have truly realized the combination of encryption and watermarking. They embed watermarking by flipping the cipher image pixels’ three least significant bits (LSBs), and then the same operation is performed in the decrypted image. Using the correlation between the nature image spaces, it can extract watermarking information. But the amount of data and image watermarking extraction rate is not optimistic, especially when the block is smaller and the error rate is higher. Hong et al. [14] have proposed an algorithm of reversible data hiding in encrypted images by fully considering the images edge pixel and using edge match technology, so that the extraction accuracy is increased some. However, errors still exist in the restored image, and algorithm is not reversible. Zhang et al. have put forward a new idea [15, 16] that uses the method of matrix calculation compressing the encrypted images LSB (least significant bit) to make the room for hiding information. In the receiver, the data extraction and image restoration can be separated. However, watermarking extraction still uses the characteristics of the relationship of the nature image pixel and so does not guarantee the ability to completely extract the watermarking information. Reference [17] has proposed reserving room before encryption. However, this method is not handled in the encrypted domain, because it is the original place to fill the data. Zheng et al. [18] have proposed using wonton scrambling to image encryption, in the cipher image; based on histogram shift algorithm, watermarking information is embedded in the cipher image. Reference [19] has proposed hiding algorithm based on cipher image lossless compression, but the watermarking extraction is still using the relationship of the nature image pixels characteristics, so it dose not guarantee the ability to completely extract the watermarking information. Others like [20–25] are also about data hiding in encrypted images.
According to the problem above, we propose a new reversible watermarking embedding algorithm in encrypted image. Figure 1 gives a sketch of reversible data hiding in encrypted image. The image is first pretreated and encryption key is embedded before the image is encrypted, then the sender encrypts image by this encryption key, the administrator embeds addition bits through this embedded encryption key, and finally the receiver can get the encrypted image with embedded bits. In the same ways, when the watermarking is extracted and the image is recovered, the encrypted image is first preoperated with embedded bits, and then embedded encryption key is gotten, and finally the receiver decrypts image through decryption key and gets the decrypted image with embedded bits; accordingly legitimate watermarking information application can extract encryption key and addition bits, and it can also recover image.
Our reversible watermarking embedding algorithm is based on rhombus prediction model and difference histogram shifting ideas; it can effectively increase embedding capacity and completely extract the watermarking information in information hiding of encrypted images while the efficiency and reversibility can be ensured. In order to achieve this innovation, we first pretreat the images according to rhombus prediction model, and then we embed the watermarking information in encrypted images by effective combination of homomorphism encryption scheme and reversible watermarking techniques; the watermarking information can be completely extracted and the images are recovered based on computed difference histogram from left to right and from top to bottom.
The remainder of this paper is organized as follows. In Section 2, the theory of homomorphic encryption and the information entropy of the encrypted image are analyzed. The proposed algorithm is presented in Section 3. Section 4 shows our experimental results and analysis. Finally, in Section 5, we summarize our results and present the conclusion.
2. Theory Analysis
2.1. Homomorphic Encryption
The characteristics of homomorphic encryption are for some operations in plaintext and then encryption effect is equivalent to some operation directly in the ciphertext [26–30]. The general definition of homomorphic encryption iswhere represents the operation in the plaintext , represents the operation in the ciphertext , and “” represents “homomorphic encryption can be directly obtained by calculating from the ciphertext”; namely, it does not exist in the middle of the decryption process.
But the encryption methods and the corresponding homomorphism (addition, subtraction, multiplication, and division) must satisfy the image encryption. In order to make the image encryption have a low complexity, we choose the RC4 encryption [30]; thus the corresponding homomorphism satisfies the additive homomorphic, and the encryption mechanism is specified as follows.
Record is a gray image pixel in plaintext, a key seed is selected to generate RC4 random key stream that encrypts per pixel in , and then the encrypted image is gotten. In the following formula, represents encryption operation and represents decryption operation.
The encryption method is shown as follows:where is the number of pixels in the image and , respectively, show the th plaintext pixel, the key stream of random number, and the ciphertext pixel.
The decryption method is shown as follows: Suppose that are, respectively, for two different pixels in gray image and are the random numbers from the key stream used to encrypt . According to definition (1), if is the arithmetic plus, is the modular addition; then
So, this encryption method satisfies the additive homomorphism. Correspondingly, use to description , which is The security of this encryption mechanism depends on the use of the stream cipher, and RC4 is a mature encryption mechanism [30].
2.2. Analysis Information Entropy of the Encrypted Image
The information entropy is used to measure the amount of information lost in the signal transmission process before it is received. After the image is encrypted, if the chaos degree of its pixels reaches maximum, then the image information entropy tends to the maximum value. Reference [31] has proposed a general parser, and the encrypted signal bit stream is divided into a series of nonoverlapping fixed length fields, called the fictional codeword. Supposing that the length of each fictional codeword is bits and the total length of the encryption signals is bits, so the total number of fictional codewords is calculated, which is The generic parser is a partition function , and it will divide into nonoverlapping ordered tuples and each tuple contains symbols in , which isBelow, we give the definition of the information entropy of the dependent on .
Suppose that is a collection of discrete uniform distribution of elements, the probability of each element satisfies , then a genera parser segmentation is shown as follows:So, for and , the information entropy of tuple and are and satisfying the follow formula, which isEquation (9) shows that the sum of self information of should greater than the length of the self information of .
That is to say, the information entropy of is greater than , which is shown as follows.
Suppose that a general parser divides into and , such as (8), so, where is a discrete uniform distribution of symbol set and and are, respectively, the information entropy for a set of tuples of and , .
Proof. According to the definition in [32], the initial iswhere is the probability of tuple in , is the codeword length that the encoded tuple needs, because is a discrete uniform distribution, and for are constant, which areSo, (11) can be written as follows:becauseSoAccording to (13), (15) can be rewritten as follows:Because is fixed, at least it can eliminate redundancy in the parsed signal through the information entropy coding method. Namely, the encrypted image information still exists in redundancy, which means the encrypted image still exists in the information entropy that can be used, and we call it the information entropy difference. In order to make better use of this part of the information entropy difference, we propose a rhombus prediction scheme and use the difference histogram shifting scheme.
3. The Proposed Algorithm
In the proposed algorithm, the sender will encrypt image and embed data, but the encryption section should be divided into two parts, which are pretreatment phase and encryption phase. When the receiver gets an encrypted image containing embedded data, he can decrypt image, extract the additional data, and recover the original image.
3.1. The Sender
This section is divided into three parts: part (1) is image pretreatment; part (2) is image encryption; part (3) is embedding watermarking information.
(1) Image Pretreatment. The image is pretreated before it is encrypted; Figure 2 shows the pixel division scheme in the rhombus prediction. Firstly, the pixels of the image are divided into two categories according to Figures 2(a) or 2(b), and white dots and black dots represent the two types of divided pixels. In Figure 2(a), the four black pixels adjacent to the white pixels form a rhombus pattern, the four black pixels are located in the four corners of the rhombus, and the white pixels are located in the center of the rhombus, and the middle white pixel value can be predicted by using the four black pixel values. In Figure 2(b), the four white pixels are located in the four corners of the rhombus, and the black pixels are located in the center of the rhombus; the middle black pixel value can be predicted by using the four white pixel values. In this paper, we use Figure 2(a) to divide the pixels. For the all white pixels in the intermediate rhombus, through its four adjacent black points, we can get corresponding prediction value , which iswhere , , , and are four adjacent pixels (up, down, left, and right) of the . watermarking embedding is only to operate on the , so the values of , , , and are not changed; namely, the value of is not changed. Therefore, we can restore image according to the lowest effective bit of . Then, we can get the corresponding prediction error, which isIn (17), we compute all white pixel corresponding prediction error values that satisfy the condition, generate histogram , and find the difference error, which are the top of the difference errors and .
Then, the predicted value of all pixels is divided into two categories according to Figure 3. The error value is in the middle of the diamond and the error value is in the diamond-four angle. Each type of histogram is generated according to the following method. Firstly, the histogram is pretreated, secondly, the watermarking information is embedded in it, and finally, the histogram is encrypted by the RC4 encryption.
We compute all white pixel corresponding error that satisfy the condition and generate two parts of histograms of the two categories difference; then, the same operation is performed in each histogram. we find the maximum vertex in the the histogram of the difference between the corresponding and second values . In order to facilitate the narrative, remember , and represents the least significant bit of the . We introduce location map Lm1 and location map Lm2; they are a series of binary sequences. Among them, Lm1 is used to mark the location information which can be embedded (0 represents no embedded location and 1 represents embedded location), and Lm2 is used to record the embedding watermarking information (binary 0 and 1). For the white point of satisfying the rhombus conditions, they are adjusted from left to right and from top to bottom, and the operation is shown as follows.
Case 1. If then (), Lm1 = 0, Lm2 not marked.
Case 2. If and then Lm1 = 1, Lm2 = 0.
Case 3. If and then (), Lm1 = 0, Lm2 not marked.
Case 4. If and then Lm1 = 1, Lm2 = 1.
Case 5. If and then (), Lm1 = 0, Lm2 not marked.
Case 6. If then (), Lm1 = 0, Lm2 not marked.
In this way, we can get the two parts of the different histogram corresponding to the two location maps. The temporary maps Lm1 and Lm2 are encrypted and compressed; then they are transferred to the user of legitimate embedding watermarking. Once finishing the embedding watermarking at the sender, two temporary maps are immediately destroyed.
(2) Image Encryption. We encrypt each pixel in by the RC4’s random key stream and get encrypted image (the specific method is in accordance with (2)).
(3) Embedding Watermarking Information
Case 1. Legitimate user of the embedding watermarking information gets location maps Lm1 and Lmp2; he can find the embedding watermarking location according to Lm1; then, Lm1 is read by scanning from left to right and from top to bottom of the sequence of operation; if Lm1 = 1, directly operate Case ; otherwise, skip position and go next judgment.
Case 2. Embedding watermarking information , read Lm2, If corresponding Lm2 = 0, then , (where represents the encryption image with watermarking and represents ciphertext); if corresponding Lm2 = 1, then ; embedding watermarking information , read Lm2; if corresponding Lm2 = 0, then ; if corresponding Lm2 = 1, then .
Case 3. Until all the watermarking information is embedded, Lm1 and Lm2 are destructed; end and the encrypted image with watermarking is formed.
3.2. The Receiver
This section is divided into two parts: part (1) is image decryption; part (2) is extraction watermarking and restoration image.
(1) Image Decryption. The receiver gets the encrypted image with watermarking and the same random seed and decrypts image by the RC4 decryption after the key sequence is generated (the specific method according to (3)).
(2) Extraction Watermarking and Restoration Image
(i) Preoperation. Preoperation is done before the extraction watermarking and restoration image. We introduce location map Lm3; it is used to mark the location where watermarking information is embedded or the location where it is not embedded (Lm3 = 1 represents the location where location is embedded and Lm3 = 0 represents the location where it is not embedded). The steps are shown as follows.
Step 1. The sender divides the same pixel as one group and calculates each part of the different error value ( represents the pixel of the decrypted image) which is calculated by late the corresponding location pixel ( represents plaintext with watermarking information). Then, a difference histogram is generated after the image is decrypted; we can find the difference error value at the top of the difference histogram and the other difference error value .
Step 2. To process the plaintext with watermarking, it is shown as follows.
Case 1. If , then , Lm3 not marked.
Case 2. If , then , Lm3 = 0.
Case 3. If , then Lm3 = 1.
Case 4. If , then , Lm3 = 0.
Case 5. If , then , Lm3 not marked.
So, we can get the decrypted image with watermarking information; therefore, we send Lm3 (Lm3 has been compressed and encrypted) to the legitimate user who can extract the watermarking information.
Step 3. In the algorithm, due to difference histogram change, corresponding pixels will change and cause overflow or underflow phenomenon. This phenomenon is not much; it can be processed according to the following.
Case 1. If , then .
Case 2. If , then .
Case 3. If , then is unchanged.
Case 4. If , then .
Case 5. If , then .
Case 6. If , then unchanged.
(ii) Image Recovery. Image recovery steps are shown as follows.
Step 1. Applying to Lm3, the legitimate user extracts the watermarking information and divides image again at the same sender’s pixel group. is calculated by the corresponding white point pixel , according to the order from top to bottom and from left to right. Then, a difference histogram is generated, and we can find the difference error value at the top of the difference histogram and the other difference error value and ; at this time , represents the lowest significant bit of , and represents the restoration pixel.
Step 2. If , read the corresponding Lm3, and when Lm3 = 1, extract watermarking ; however, when , then ; when , then .
Step 3. If , read the corresponding Lm3, and when Lm3 = 1, extract watermarking ; however, when , then ; when , then .
Step 4. In other cases, we directly judge the next embedding watermarking information and go to Step 1.
Step 5. When all the watermarking information is extracted, the two-part watermark information is extracted according to the first diamond inner, and then the diamond-four angle is connected. We can get all the watermark information, and the image gets recovery; end.
(iii) Overflow or Underflow Processing. All the watermarking information extraction is finished and the image is recovered; there will also be a small amount of pixels overflow or underflow, and it is processed as follows.
Case 1. If then , .
Case 2. If then , .
4. Experimental Results and Analysis
4.1. The Data Confidentiality
The RC4 encryption is stream ciphering algorithm with alterable length of key stream ; it accepts a key from 1 to 256 bytes. As shown in (1) to (5), the RC4 encryption satisfies the confidentiality requirements when the key stream is long enough and complex enough.
Supposing the length of key stream is 16 bytes (128 bits), the time of performing an encryption is 1 μs, so the number of the keys is , and the time of exhausting half key space is It is not feasible on computation for an attacker to analyze the key by the sender and receiver’s decrypted image. Also, the middle man cannot analyze the key based on the decrypted image that is transferred over the channel.
4.2. Resisting Rotation Attack
We adopt the rotation angle (RA) of , , , , , , , and to test the rotation attack. Table 1 gives the successful extracting times (SET) of the watermarking information in encrypted images against the rotation attack; here the testing times (TT) are 12 times. It shows that this reversible date-hiding algorithm has good resisting rotation attack. The main reason is that the rotation cannot change the relative coordinate value of any pixel of the encrypted images, and there is no essential influence on the embedded watermarking information.
4.3. The Embedding Capacity and PSNR
In order to verify the effectiveness of our method, simulation experiments are conducted by using MATLAB7.0 platform. We use the peak signal-to-noise (PSNR) and the embedding rate (ER) to evaluate the quality of the encrypted image and embedding capacity. For the gray image, it iswhere MSE represents mean squared errors.
Then, the ER iswhere represents the number of binary bits of watermarking information and represents the number of pixels of the image.
We select a standard test image Lean to test, as shown in Figure 4(a), and the encrypted image as shown in Figure 4(b); obviously, the image is incomprehensible and completely covers the contents of the original image. In order to further illustrate the problem, we generate the histogram of the image before and after encryption; we can see that the encrypted images histogram is flat from Figure 4(d); it also shows great regularity and uncertainty compared to Figure 4(c); the information entropy tends to maximize.
(a)
(b)
(c)
(d)
After 15000 bits watermarking information is embedded in the encrypted image, we can get PSNR = 62.36 (dB) when it is decrypted, as shown in Figure 5(a); the effect is very satisfactory looking from the perspective; Figure 5(b) represents the complete recovering image after the watermarking information is extracted; this image and the original image are completely consistent by comparing the data; namely, the proposed algorithm is completely reversible. In order to further experiment, we select four images as test images from the image database USC-SIPI: Lena, Plane, Milkdrop, and Woman2, as shown in Figure 6. Table 2 lists the four test images’ PSNR in different ER, and we can see from the table, with the ER increasing, the PSNR of the image decreases gradually. When the ER is 0.06, PSNR can be maintained at more than 62 dB; it not only shows that the images’ PSNR can be maintained at a high level by using this algorithm in different ER to calculate the PSNR but also reflects that the image distortion is still not perceived when PSNR is 62 dB in theory; then it explains the feasibility of this algorithm.
(a)
(b)
(a)
(b)
(c)
(d)
4.4. The Experimental Contrast
We use PSNR value to measure direct decrypted image with hidden information. For the images Lena, Plane, Milkdrop, and Woman2, we compare our algorithm with Zhang et al. [13] and Ma’s algorithm [17] from the ER and PSNR, as shown in Figure 7. We assume that Ma and Zhang’s algorithm is perfectly correct in extraction. When the ER is greater than 0.015, we use Zhangs algorithm to make the experiment; the image will appear as serious distortion; that is to say, when the ER is greater than 0.015, the test will lose its meaning, so we only take the ER at 0.005, 0.01, and 0.015. When the ER is between 0 and 0.02 bpp, we use a least significant bit, and when it is more than 0.02 bpp, we use the least two significant bits. We can see that the PSNR gradually decreases with the ER increasing, but our algorithm’s curve is located above Ma and Zhang’s algorithm; namely, our algorithms PSNR is significantly big in the same ER; it further not only shows that this algorithm is more feasible but also illustrates that this algorithm is better than other algorithms.
(a) Test image Lena
(b) Test image Plane
(c) Test image Milkdrop
(d) Test image Woman2
5. Conclusion
The cipher image embedding technique is combined with the advantage of encryption technology and information hiding technology. It can be satisfied with the need of important privacy protection and become a new field. This paper presents a novel reversible watermarking embedding algorithm in encrypted image; the algorithm adopts rhombus prediction thought and histogram modification scheme. It truly realizes reversible watermarking extraction and image lossless recovery. Experiments show that the proposed algorithm is better than other algorithms.
Competing Interests
The authors declare that they have no competing interests.
Acknowledgments
This work was supported by the National Nature Science Foundation of China (no. 61562059 and no. 61461027).