Abstract
In some particular scenes, the shadows need to be given different weights to represent the participants’ status or importance. And during the reconstruction, participants with different weights obtain various quality reconstructed images. However, the existing schemes based on visual secret sharing (VSS) and the Chinese remainder theorem (CRT) have some disadvantages. In this paper, we propose a weighted polynomial-based SIS scheme in the field of GF (257). We use threshold polynomial-based secret image sharing (SIS) to generate shares and assign them corresponding weights. Then, the remaining shares are randomly filled with invalid value 0 or 255. When the threshold is satisfied, the number and weight of share can affect the reconstructed image’s quality. Our proposed scheme has the property of lossless recovery. And the average light transmission of shares in our scheme is identical. Experiments and theoretical analysis show that the proposed scheme is practical and feasible. Besides, the quality of the reconstructed image is consistent with the theoretical derivation.
1. Introduction
With the development of Internet technology and digital multimedia technology, digital images are more and more widely used. Meanwhile, security is also threatened. In particular, personal privacy images, confidential commercial images, medical images, and military drawings are easy to be intercepted, tampered, and destroyed in the process of storage and transmission. Cryptography [1, 2] and steganography [3, 4] are commonly used to protect images. A normal image is converted into a noise-like image through encryption technology. We cannot understand the secret image, but we can tamper with or destroy it, because it is clear that the image has been encrypted. Steganography improves the security of images, making it difficult for attackers to detect the existence of secret information. But steganography is the single-channel transmission, and if part of the area of data hiding is lost in transmission, the secret message could not be recovered.
Secret sharing (SS) is another technology to protect data with the features of multichannel transmission and loss tolerance. In 1979, Shamir [5] and Blakley [6] independently proposed the -threshold SS scheme. The extension of SS to images is called secret image sharing (SIS). The secret image can be distributed among participants by dividing it into shadow images (also called shares or shadows). The secret can be reconstructed from any or more authorized shadow images, while any or fewer shadow images could not recover the secret. At present, in the SIS research field, visual cryptography schemes (VCS), also called visual secret sharing (VSS), schemes based on the CRT, and polynomial-based SIS schemes are the primary branches.
In 1995, Noar and Shamir [7] first proposed the -threshold VCS. In general VCS, a binary image is encrypted to shadow images on transparencies. The secret image can be obtained by superposing any or more shadow images. The recovery process relies on the human visual system (HVS) and does not require cryptographic computation or device [8, 9]. According to the implementation principle, the VCS can be divided into schemes based on the basis matrix [7] and the random grid [10]. In the VCS field, current researches focus on these areas, including improving the visual quality of reconstructed images [11, 12], implementing general access structures [13, 14], share authentication [15], and meaningful shadow images [16–18].
Mignotte [19] first proposed the -threshold SS scheme based on the CRT in 1982. Then, Asmuth and Bloom [20] proposed a threshold SS scheme based on the CRT with random factors . In their scheme, a set of integers is chosen subject to certain conditions. Then, , where is a prime number, . Yan et al. [21] first applied the CRT to SIS. But the scheme has slight information leakage, and the recovery is lossy. Yan et al. [22] proposed a -threshold SIS based on CRT for grayscale images. The scheme is lossless recovery and without auxiliary encryption. After that, most of the SIS schemes [23, 24] based on the CRT were studied based on Asmuth and Mignotte’s scheme.
Thien and Lin [25] applied SS proposed by Shamir to SIS and first proposed a -threshold SIS scheme. For the polynomial-based SIS, the sharing and recovery processes are simple, efficient, and easy to implement and have fewer public parameters. Therefore, polynomial-based SIS schemes are widely used [26–28]. However, most polynomial-based SIS schemes are slightly lossy. To achieve lossless recovery, many polynomial-based SIS schemes have been studied. We can segment pixel values greater than 250, operate in the field of , or choose a prime number greater than 255. In this paper, we choose the prime number 257 and use the screening operation to achieve lossless recovery.
In the above SIS schemes, the participants have the same weight and importance. However, in some scenarios, to indicate the status or importance of the participants, the shadow images need to be given different weights. Hou et al. [29] proposed a privilege-based VSS model. The model implemented a -threshold VSS without pixel expansion. The participants of their scheme have the same size and different privileges. In the recovery phase, the greater the shadows’ weight, the better the quality of the reconstructed image. But the average light transmissions of shares are not equal. Yang et al. [30] extended Hou et al.’s scheme with a correct privilege level, achieving the consistency of the average light transmission and the sum of privilege levels. Both Hou and Yang’s schemes require a codebook and are lossy in recovery. Liu et al. [31] proposed a weighted -threshold random grid VSS(RG-VSS) with lossless recovery. Each share has a weight in their scheme, and the secret image can be recovered by OR and XOR operations. Especially, the recovered image is lossless when using XOR operations. The secret image format of the weighted VSS schemes is only binary image. Tan et al. [23] proposed a weighted -threshold SIS scheme based on the CRT for sharing grayscale images. Tan et al.’s scheme requires a weight generation modulus. And the average light transmissions of shares of their scheme are also unequal. To sum up, the weighted schemes based on VSS are lossy and can only share the binary images, not grayscale images. For the weighted schemes based on the CRT, we need to set parameters according to requirements in advance, and the number of participants is limited. Compared with VSS and CRT, polynomial-based SIS has some advantages. Therefore, we consider combining polynomial-based SIS with different weights to overcome the above disadvantages.
In this paper, we propose a weighted polynomial-based SIS scheme with lossless recovery. Each share is assigned to a weight. We improve Thien and Lin’s scheme, choosing the prime number 257 and using the screening operation to achieve lossless recovery. A polynomial generates the share pixel values, and then of them are selected according to their weights. The remaining shadows are randomly filled with invalid value 0 or 255. In the recovery phase, when the threshold is satisfied, the greater the weight of one of the shadows or the number of shadows, the better the quality of the recovery secret image.
The contributions of our work are summarized as follows:(1)We propose a weighted polynomial-based SIS scheme in the field of .(2)When the threshold is satisfied, the number and weight of share can affect the quality of the reconstructed image. And the reconstructed image is lossless when all shares are selected.(3)The scheme overcomes the problem that the average light transmissions of shares are not identical.
The rest of this paper is organized as follows. In Section 2, we review Shamir’s scheme and Thien and Lin’s scheme and then introduce the definition of the correct recovery probability (CRP). The proposed scheme and the theoretical analyses are described in Section 3. Section 4 gives experimental results and comparisons. Finally, conclusions are drawn in Section 5.
2. Preliminaries
In this section, we review the polynomial-based SIS schemes proposed by Shamir and Thien and Lin. Then, the evaluation parameter CRP of the reconstructed secret images of our scheme is given.
2.1. Review of Shamir’s Scheme
In 1997, Shamir [5] proposed the -threshold SS scheme based on polynomial properties. If a plane has points, there exists a unique degree polynomial. Shamir shared a secret into different shares based on this property. Then, shares were distributed to participants . The secret was chosen from the field of , where is a prime greater than and . The polynomial of Shamir’s scheme was defined as shown in where the coefficient was the secret , and the other coefficients are chosen from the field of . In the sharing phase, we set and then obtain , where . The pair of points were generated according to the above polynomial.
After obtaining pair of points, any or more of which can recover the secret , while any or fewer pairs cannot recover the secret. The secret can be reconstructed by using Lagrange’s interpolation as shown in equation (2). When x = 0, the secret was reconstructed by calculating , i. e., .where , and .
2.2. Review of Thien and Lin’s Scheme
Thien and Lin [25] first applied the SS scheme to share a secret grayscale image in 2002. In their scheme, a secret image was shared to shadow images , and any or more of which can recover the secret image. In Thien and Lin’s scheme, all the coefficients were used to share the secret image’s pixels. Then, the successive pixels of the secret image were shared through a polynomial presents two problems. The first is that each shadow image size is of the original secret image. Second, there may be information leakage because of the correlation among pixels. Therefore, the secret image pixels should be encoded before the sharing phase to increase security. In Thien and Lin’s scheme, the value of prime was taken as 251. However, the range of the 8-bit grayscale image pixel value was . The pixels between 251 and 255 were truncated to 250, resulting in the fact that all the pixels were within . Therefore, the reconstructed secret images were lossy. At the same time, the method of lossless recovery was provided in their scheme. The secret pixel values of more than 250 required additional operations, and that led to the expansion of shadow images.
There are 256 pixels of the 8-bit grayscale image between 0 and 255. To achieve lossless recovery, all need to be included in the sharing phase. A prime number greater than 256 is 257, . But 256 also belongs to , and the sharing process needs to be redone if a pixel value is shared to 256. Random numbers are generated to update the other coefficients in the polynomial except until all the share pixel values are within . Thus, the probability of an invalid value occurring when sharing a pixel is . At the same time, in the weighted SIS scheme, we filled in 0 and 255 as invalid values. That is to say, there may be three invalid values, i.e., 0, 255, and 256, during the sharing of a pixel value. The probability of an invalid value occurring per share operation is . This can achieve lossless recovery, and the efficiency of sharing is not greatly affected, which is within the acceptable range. Therefore, in our scheme, we choose the prime number 257 and use the screening operation.
2.3. Correct Recovery Probability (CRP)
For the quality evaluation of the reconstructed image in the general SIS schemes, the most commonly used is mean squared error (MSE) and peak sign-to-noise value relation (PSNR). MSE is used to assess the distinction between the recovered image and the secret image. The lower MSE value indicates that the reconstructed image is close to the original image. PSNR represents the reconstructed image’s quality. The higher the PSNR value is, the closer the reconstructed image is to the original image.
In our weighted SIS scheme, we adopt the correct recovery probability (CRP) [32] to evaluate the reconstructed image’s quality. CRP is the ratio of the number of identical pixels in the same locations between the reconstructed image and the secret image to the image’s total pixels. The higher the CRP value is, the more the number of pixel values is recovered correctly, that is, the closer the reconstructed image is to the secret image. The reconstructed image is lossless when CRP = 1.
For a secret image with the size of , the CRP of its reconstructed image is calculated by where is the number of identical pixels in the same locations in both two images.
3. The Proposed Scheme
In this section, we propose a weighted polynomial-based SIS scheme based on Shamir’s scheme. To achieve lossless recovery, we choose the prime number 257 and use the screening operation. Each participating shadow image is assigned a weight, and the sum of these weights is equal to 1. Each pixel of the secret image generates share pixel values by a polynomial, and we assign them weights. The remaining shares are randomly filled with invalid value 0 or 255.
When recovering the secret image, we adopt Lagrangian interpolation to obtain the secret pixel values. The secret image cannot be recovered from less than shares. When more than shares are collected, the higher the weights of the shares are, the better the recovered secret image’s quality is. At the same time, our scheme can achieve lossless recovery when all the shadow images are used to participate in the recovery. The design idea of the sharing phase of our scheme is shown in Figure 1.
3.1. The Sharing Phase
In the sharing phase of our scheme, for each pixel of the original secret image, share pixels are generated by the polynomial-based SIS scheme with a -threshold . Then, shares are distributed to participants through a certain probability determined by the weights of the participants, and the shares of the other participants are filled with invalid values. The detailed steps are described in Algorithm 1.
|
In the sharing phase, each shadow image is assigned a certain weight. Suppose that the weights of shares are , where . Then, we set corresponding weight interval for each shadow image in the interval of as shown in Figure 2. The proportion of the interval in the whole interval is . We randomly generate any real numbers in the interval of . If , participant is selected, i.e., . If the interval has been selected before that, i.e., has been set to 1, then random real number will be generated to perform the above operation. This process is repeated until different participants are selected. By performing this operation, shares have been distributed to of the participants according to a certain probability, while the remaining participants have been distributed to invalid values.
3.2. The Recovery Phase
Our scheme is based on the polynomial-based SIS scheme and can be recovered by Lagrangian interpolation. The secret image cannot be recovered from less than shares. When more than shares are collected, the higher the weights of the shares are, the better the recovered secret image’s quality is. If all the shares participate in the restoration of the secret image, the reconstructed image is lossless. The specific recovery steps are shown in Algorithm 2.
|
3.3. Theoretical Analyses
In this subsection, some theoretical analyses of our scheme are presented. First, our weighted polynomial-based SIS scheme is based on Shamir’s scheme. The constant coefficient of the polynomial is replaced with the pixel value of the secret image. And all the operations are performed in the field of . There are 256 pixels of grayscale image, and . Therefore, our scheme can be applied to grayscale images. According to the principle of polynomial and Lagrange interpolation algorithm, any less than k equations cannot obtain the polynomial coefficients. Thus, or fewer shares could not recover the pixel value of the secret image. Because we fill in invalid values to represent different weights of shares, when shares are involved in reconstruction, some pixel values cannot be correctly recovered. When all shares are involved in reconstruction, we can exclude all invalid values and then use the remaining valid values to recover the secret image’s corresponding pixel value. Therefore, our scheme can achieve lossless recovery.
Then, we theoretically analyze the quality and the effect factors of the reconstructed secret image. Each share is assigned a weight in the proposed scheme, and . The reconstructed secret image’s quality is related to the weights of the shares involved in the reconstruction. To evaluate the quality of the reconstructed secret image, we compared the pixels in the corresponding positions of the two images, counted the number of identical pixels in the same positions, and combined them with the weights. Then, we calculated the CRP of the reconstructed secret image in our scheme with -threshold theoretically as according to where are threshold parameters, and denotes the number of shares involved in the reconstruction. is the th share in the th combination, denotes the weight of share , and . The number of combinations of arbitrary of shares is denoted by . denotes the probability sum that arbitrary of shares are selected. The probability sum that arbitrary of shares are selected is denoted by .
Intuitively, we can guess that the number and weight of shadows can affect the reconstructed secret image’s quality. Theoretically, if the threshold is satisfied, and the number of shadows is increased, the recovery quality of the secret image will be better. When all shadows participate in reconstruction, the secret image can be recovered in a lossless way. That is to say, our scheme is progressive in reconstruction. Second, if the threshold is satisfied, and the weight of one of the shadows in the set increases, the recovery quality of the secret image will be better.
Assuming that there are shadows in the set, the secret image could be recovered when these shadows participate in the recovery. The CRP of the reconstructed image is shown in equation (4). If another shadow l is added in the set to participate in the recovery, and the weight of shadow l is , then the CRP of the reconstructed image of t + 1 shadows recovery as is calculated by
When comparing the two reconstructed images’ quality, it can be determined by subtracting and . The result is shown in
According to the properties of combinatorial numbers, equation (7) holds.where .
Therefore, equation (6) can be rewritten as where .
In equation (8), is greater than . That is to say, the quality of the reconstructed secret image from shadows is better than that of shadows. Therefore, if the threshold is satisfied, the reconstructed image’s quality will improve with the increase in the number of shadows involved in the recovery.
Assuming that there are shadows in the set, the secret image could be recovered when these shadows participate in the recovery. The shadow is replaced by the more heavily weighted shadow , where . According to equations (8) and (7), we can get equations (9) and (10).where ;where .
Then, the result of subtracting equations (9) from (10) is shown in
As shown in equation (11), is greater than . Therefore, if the threshold is satisfied, the reconstructed image’s quality will improve with increasing the weight of one of the shadows.
4. Experiment and Evaluation
In this section, we give two examples to verify the feasibility of the scheme in the Subsection 4.1 and evaluate the reconstructed image’s quality in the Subsection 4.2. Then, we compare other weighted SIS schemes in the Subsection 4.3.
4.1. Image Illustration
To verify the feasibility of our scheme, two examples with and thresholds are given using Python in a PC with Windows 10. Figure 3 illustrates our -threshold SIS scheme. A Cameraman image with the size of 256256 is tested as the secret image as shown in Figure 3(a). The weights of the shares are . Figures 3(b)3(e) show four shares generated by a polynomial. When two shares are collected, the secret image could be recovered. Figures 3(f)3(p) show the results of different weights of shares participating in recovery, and the sum of weights goes from low to high. When all shares participate in reconstruction, the secret image can be recovered in a lossless way as shown in Figure 3(p). The subscript of the name indicates the number of shadows involved in the reconstruction.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
(k)
(l)
(m)
(n)
(o)
(p)
Figure 4 shows our -threshold SIS scheme. The secret image is the blonde woman image with the size of 256256 as shown in Figure 4(a). The weights of the shares are . The three shares are shown in Figures 4(b)4(d). Figures 4(e)4(g) display the reconstructed images recovered from two shares. Figure 4(h) presents the reconstructed lossless image recovered from all shares. The subscript of the name indicates the number of shadows involved in the reconstruction.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
4.2. Quality of the Reconstructed Images
In our scheme, each share is assigned a weight in the sharing phase, and the recovery phase is progressive. Both the weight and the number of shadows affect the quality of the reconstructed image. The CRP is used to evaluate the quality of the reconstructed images. The greater the CRP value, the better the quality of the reconstructed image, and the more effective our scheme. Equations (4) and (5) are used to compute and . represents the actual value of the experiment for our proposed scheme. denotes the theoretical value. The results of our and threshold weighted schemes are shown in Tables 1 and 2.
From Figure 3 and Table 1, we can draw the following conclusions:(1)Our weighted polynomial-based SIS scheme is effective, and the shadows have weights that can affect the quality of the recovered secret image.(2)The quality of the reconstructed image is consistent with theoretical estimates.(3)When the numbers of shares involved in reconstruction are the same, the greater the sum of the weights is, the better the reconstructed image’s quality is. When the sums of the weights of the shares are the same, the more shares involved in the reconstruction are, the better the quality of the reconstructed image is. When the number and weights sum of shares involved in the reconstruction are the same, the reconstructed image’s quality is judged according to the identical pixels in two images.
4.3. Comparison with Other Weighted SIS Schemes
In this subsection, we compare our scheme with other weighted SIS schemes from several relevant features. Figure 5 shows Tan’s -threshold scheme based on the CRT with . The weights of shares are also . Figure 5(a) shows the secret image Lena with the size of 256256. Figures 5(b)5(e) are four shares. Figures 5(f)5(p) are reconstructed secret images by collecting different shares, in which Figure 5(p) is lossless by collecting all shares. Each share has a weight in both our scheme and Tan’s scheme, and the reconstructed secret image can be recovered in a lossless way.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
(k)
(l)
(m)
(n)
(o)
(p)
From Table 1, we can find that the theoretical values are the same between our scheme and Tan’s scheme. And our experimental values are similar to those of Tan’s scheme, which are consistent with the theoretical values. This is because the same method is used to give weight to each share in our scheme and Tan’s scheme. The obvious difference between the two schemes is the average light transmission of shares as shown in Figure 6. There is no obvious difference for the average light transmission of four shares in our scheme. For the remaining shares, we fill with invalid value 0 or 255 randomly. However, the average light transmissions of four shares in Tan’s scheme are different. In their scheme, the remaining shares are filled with the corresponding privacy modulus. As the weight increases, the shadow image gets darker. Obviously, this phenomenon will leak out the importance of shadow images and reduce the security of the weighted scheme to some extent.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
In general, SIS schemes have many features. Table 3 shows the main characteristics and comparisons of our scheme with related weighted schemes. All schemes listed are weighted schemes. Liu et al.’s, Tan et al.’s, and our schemes with -threshold are more flexible than -threshold of Hou et al. and Yang et al. Image format, lossless recovery, and additional information are related to the sharing method. Compared to the methods based on VSS and the CRT, our polynomial-based scheme has many advantages, such as less computation, less additional information, and lossless recovery. Meanwhile, compared with Tan’s scheme, we overcome the problem that the average light transmissions of shares are not identical.
5. Conclusion
In this paper, a weighted SIS scheme with lossless recovery is proposed. Each share has a weight. The larger the weight is, the greater the influence on the reconstructed image’s quality is, when it participates in the recovery. When the threshold of secret image recovery is satisfied, the number and weight of share can affect the reconstructed image’s quality. When all shares are involved in the reconstruction, the reconstructed image can be lossless. And we overcome the problem that the average light transmissions of shares are not identical. Theoretical analysis and experimental results show the effectiveness of the scheme. In future work, we will extend our weighted SIS scheme for color images and study the polynomial-based SIS scheme in the field of .
Data Availability
Some or all data, models, or code generated or used during the study are available from the corresponding ([email protected]) author upon request.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This work is funded by the Program of the National University of Defense Technology and the National Natural Science Foundation of China (number: 61602491). The authors are thankful to the reviewers for their valuable comments and suggestions to improve the manuscript.