Research Article  Open Access
Separable and ErrorFree Reversible Data Hiding in Encrypted Image with High Payload
Abstract
This paper proposes a separable reversible datahiding scheme in encrypted image which offers high payload and errorfree data extraction. The cover image is partitioned into nonoverlapping blocks and multigranularity encryption is applied to obtain the encrypted image. The data hider preprocesses the encrypted image and randomly selects two basic pixels in each block to estimate the block smoothness and indicate peak points. Additional data are embedded into blocks in the sorted order of block smoothness by using local histogram shifting under the guidance of the peak points. At the receiver side, image decryption and data extraction are separable and can be free to choose. Compared to previous approaches, the proposed method is simpler in calculation while offering better performance: larger payload, better embedding quality, and errorfree data extraction, as well as image recovery.
1. Introduction
As a kind of technique of hiding data into cover media, for example, a digital image, data hiding might often produce a distorted version of the cover, known as stegoimage. Based on whether the original cover can be reconstructed or not, datahiding techniques can be classified into two kinds: irreversible [1, 2] and reversible [3–11]. Aiming at recovering the original image with no error, reversible data hiding is generally based on two technologies: difference expansion (DE) [3, 6, 7] and histogram shifting (HS) [5, 8–10]. In general, DEbased methods provide higher payload than HSbased methods at the sacrifice of image quality. As a result, HSbased methods are more popular when the image quality is an issue. Since the maximal embedding capacity of HSbased datahiding methods equals the number of pixels in the peak point, more peak and zero pairs are required to enhance the payload. However, for most natural images, a few nonoverlapping peak and zero pairs could be found. Therefore, embedding capacity is limited.
Moreover, most of the existing reversible datahiding methods are only suitable for unencrypted covers. However, in some application scenarios, content owners wish to encrypt the original images for maintaining secrecy or protecting privacy. Meanwhile, an inferior assistant or a channel administrator may desire to append some additional data within the ciphertext images without knowing the decryption key and the plaintext content. As a legal receiver, it is required that the original plaintext content can be recovered errorfree after image decryption and data extraction. Reversible data hiding in encrypted image satisfies these needs [12–14].
In [13], data is appended by flipping three LSB of ciphertext image encrypted by simple exclusiveOR operation and extracted with the aid of spatial correlation in natural image. The original image can be recovered with no error when embedding payload is not too large. The performance is further improved by Hong et al. [14] using side match with a blockrecovery order. In both [13, 14], the appended data can only be extracted after image decryption. In other words, a receiver having datahiding key but no contentowner key cannot extract any information. To overcome this problem, a separable reversible datahiding scheme [15] is proposed, in which the original image is encrypted using symmetric key and then data can be appended using datahiding key. With an encrypted image containing additional data, a receiver having the datahiding key can extract the appended data exactly, while a receiver having the symmetric key can decrypt the received data to obtain an image similar to the original one. If the receiver has both keys, he can extract the additional data and recover the original image at the same time.
Method [15] is undoubtedly a great idea. However, there is a limitation in the aspect of embedding payload. Data cannot be extracted exactly and the original image cannot be recovered completely when the payload is more than 0.04 bpp (this maximal value of effective payload may fluctuate along with different cover images). In other words, error appears and error rate rises as the payload increases. Beyond that, many parameters adopted in method [15] make it a little complicated for implementation. To solve these issues, we propose an improved work in this paper. After a cover image is being encrypted with a contentowner key, additional data can be embedded into the encrypted image based on block sorting and block histogram shifting with a datahiding key. Compared with the existing methods, the proposed scheme has the following advantages: (1) simpler calculation and higher efficiency; (2) larger payload and better embedding quality; and (3) errorfree recovery with high payload.
2. Proposed Scheme
The data extraction methods used in [13, 14] require estimating block smoothness. An incorrect estimation may result in the failure of data extraction and image recovery. Although a large block size reduces the extraction error rate, it decreases the payload as well.
The proposed method embeds data by shifting pixels locally in encrypted image. The content owner partitions the cover image into nonoverlapping blocks and encrypts the cover image using multigranularity encryption: coarsegrained encryption permutes blocks in global images while finegrained encryption permutes the pixels in each block to construct a meaningless encrypted image. Although all pixels are permuted, pixels in each block still preserve the same image histogram. Therefore, the HS method is applicable for embedding data into permuted blocks if pairs of peaks and zeros in each block are properly determined. In our approach, two basic pixels are randomly selected from the permuted block and used to indicate two peak points. Since the pixels having the same values as peaks contribute to the payload, it is likely to embed more than one bit per block to achieve high payload. More importantly, the embedded data bits can be extracted exactly. In addition, since the values of basic pixels are preserved during data embedding, they can be exploited to estimate the smoothness of blocks roughly and indicate the priority of embedding sequence.
The proposed method is described briefly as follows. In image encryption and data embedding phase, the content owner encrypts the original image using a symmetric contentowner key to produce an encrypted image . Then, the datahider processes image to generate image . Additional data is embedded into with datahiding key and markedencrypted image is obtained. In data extraction and image recovery phase, there are three options for legal receivers. Image decryption and data extraction are separable and can be free to choose. The embedded data can be easily extracted from with . Since only part of pixels is modified by one grayscale unit to conceal , direct decryption on with generates a decrypted image , which is very similar to the original version . If and are both adopted, the cover image can be restored errorfree and the embedded data can be extracted accurately. The framework of the proposed method is shown in Figure 1.
The goal of the proposed method is to improve embedding payload, quality, and efficiency via simple calculation. The last and most important, keep errorfree recovery as the payload increases while [13–15] cannot.
2.1. Image Encryption
Firstly, the cover image is divided into nonoverlapping blocks . Each block is composed of pixels. Then, multigranularity encryption is adopted by using random permutation to obtain the permuted blocks : pixels permutation in each block and blocks permutation in the whole cover image. Thus, the encrypted image is generated. Parameters and and the integer adopted as the seed of random permutation compose the contentowner key .
2.2. Data Embedding
After receiving together with block size , the data hider partitions into blocks . For each block , two basic pixels and are randomly selected and other pixels are denoted by ; that is, . Next, to estimate the smoothness of each block, the difference is calculated. Blocks with smaller are likely smoother than blocks with larger , and it is known that smoother blocks are in favor of HS. As a result, blocks with smaller will be chosen to have higher priority for carrying data. Let be the sorted result of after being sorted in the ascending order. The sorted sequence is then employed as the embedding sequence of blocks. At last, two peaks and in each block are determined as follows: , . To ensure that each block has two distinct peaks, we simply set when .
To avoid saturated pixels (pixels valued 0 or 255) from overflow or underflow during embedding, saturated pixels have to be preprocessed by modifying one grayscale unit and noted in a location map . To do this, visit blocks sequentially and append a bit “1” to when . If , append a bit “0” to and modify to using the following equation:
Let the processed block be . The embedding capacity of , denoted by (bits), equals the number of nonbasic pixels valued and . Continue the preprocessing procedures until the condition is satisfied, where is the additional data and is the minimal number of blocks that are used for embedding and . We denote the preprocessed encrypted image by . Once is obtained, the data hider concatenates and to form a string of message bits and then scans the pixels in to conceal as follows. If the scanned pixel is valued or , a bit extracted from is embedded by modifying to according to the following equation: Otherwise, pixels are either maintained or shifted by one unit using the following equation:
After embedding, blocks are modified to , and the markedencrypted image is generated. The parameters and the seed used to randomly select basic pixels compose the datahiding key .
2.3. Data Extraction and Image Recovery
If the receiver has datahiding key , the embedded additional data can be extracted directly from the markedencrypted image . To extract , is firstly partitioned into blocks sized . Peaks and and the differences are then determined. Block smoothness is sorted in ascending order and the result is denoted by . The sorted sequence is then employed as the extracting sequence of blocks. At last, the embedded data can be extracted from pixels in block using the following equation: The first extracted bits compose the location map , and the other bits compose the additional data . If the receiver also has , original cover image can be perfectly recovered by firstly restoring the pixels from using the following equation:
To recover from , if , extract a bit from . If the extracted bit , set . Otherwise; that is, , set when ; set when . Repeat until the encrypted image is reconstructed accordingly. With the content owner key , can be exactly decrypted to the original cover image . Note that if the receiver only has but no , an image that is very similar to the original one can be obtained.
3. Experimental Results
A number of gray images sized were used as original cover images in our experiment. Figures 2(a) and 2(b) show the original image Lena and its encrypted version (, ). After embedding 33910 bits of additional data into Figure 2(b), the stegoencrypted image was obtained, as shown in Figure 2(c) in which the embedding rateis 0.13 bpp. With the image shown as Figure 2(c), the receiver having the datahiding key could extract the embedded data from it. The directly decrypted image only using the symmetric cryptographic key is given as Figure 2(d), and the value of PSNR between (a) and (d) is 50.51 dB. Using both the datahiding key and cryptographic key, we successfully extracted the additional data and recovered the original image errorfree.
(a)
(b)
(c)
(d)
Table 1 summarizes the embedding payloads, PSNR in directly decrypted images (PSNRdec), and PSNR in recovered images (PSNRrec) when different block sizes were used for image Lena. Each “” in Table 1 indicates that the mean square errors between the recovered version and the original image are 0 and the cover was reconstructed errorfree.

To explore the influence of different parameters (block sizes ) and different strategies (block sorting or no sorting) on embedding performance of proposed method, we compared different results obtained from a smooth image Lena and a complex image Baboon. In order to obtain enough experimental data and assure validity of conclusions, for each test image, 4 block sizes () are adopted. For each block size, 10 integers are chosen as to generate different . Then, embed 10 distinct into each and crosstest 100 times. After removal of the highest and lowest points, take the average to investigate PSNRpayload curves. Take Lena and Baboon as examples shown in Figure 3. The abscissa represents the pure embedding payload and the ordinate is the value of PSNR between and .
From Figure 3 we can draw some conclusions. (1) The smaller the block size, the better the PSNR. If embedding quality is preferable, block size is good choice. (2) When block size is larger than , the performance would be worse. If large payload is desirable, either or could be chosen. (3) Under the same block size, the performance of block sorting strategy is better than that of no sorting strategy. Taking image Lena as an example, with 26214 bits of pure payload and block size, the PSNR is 52.17 dB (sorting) and 51.94 dB (no sorting), respectively. Looking into the reason, smoother blocks are in favor of HS and have higher priority for carrying data in block sorting strategy. So, for appending the same amount of bits into the same encrypted image based on HS, fewer pixels are modified by using block sorting strategy. That is the reason leading to higher PSNR. (4) Smooth image Lena provides better performance than complex one, Baboon. It is known that, for HSbased methods, smoother blocks often provide larger capacity than complex ones. Therefore, the full payload of Lena is larger than that of Baboon. For the same nonfull payload, fewer blocks are used in Lena and embedding distortion is smaller. So PSNR is higher.
We compared the proposed scheme with methods [13–15] in Figure 4, which indicates that the proposed scheme has the best performance. All results are derived from the best parameters under a condition that the original image can be recovered without any error.
Note that the data extraction in [13, 14] is not separable from the content decryption. However, using the proposed scheme or method [15], data extraction and image encryption are separable and can be free to choose. With the proposed scheme, since both the similarity of neighboring pixels in local level and block smoothness are fully exploited, more redundant space can be created to carry data. So the performance curve of the proposed scheme is better than those of other methods.
We also compared the proposed scheme under the same block size with the nonseparable method in [13, 14]. The results are shown in Table 2, from which we see that the proposed scheme has 2 times gain of payload under the block size and 7 times gain under block size together with improvement of PSNR value in directly decrypted image when meeting the perfect recovery condition.
Furthermore, we take Baboon as an example to verify details. Under the same block size , we compare recovered images generated by different methods in Figure 5, where the incorrect recovered blocks are marked by white.
(a)
(b)
(c)
(d)
Comparing Figures 5(b), 5(c), and 5(d), we see that the proposed method recovers the image blocks errorfree and more accurate than that of [13, 14]. Although the experiments were based on Baboon, experiments on other test images also showed the similar result, which indicates that the proposed method offers a better performance for data extraction and image recovery.
Finally, we summarize maximum payload and corresponding PSNR of Lena, Peppers, Boat, and Baboon in Table 3. For the same cover image, the maximum payload of the proposed scheme is much more than that of [13–15] and the embedding quality is the best.
4. Conclusion
This paper proposed a separable and errorfree reversible datahiding scheme in encrypted image, which significantly outperforms the previous methods in the three aspects of payload, PSNR, and error rate. Compared with [13, 14], not only can cover images be reconstructed with no error, but also image decryption and data extraction are separable. Compared with [15], the proposed method improves both PSNR and the effective payload via simpler calculation using few parameters and achieves higher efficiency. The last and most important advantage of our method is that it can keep errorfree recovery as the payload increases while the others cannot.
Conflict of Interests
The authors declare that there is no conflict of interests regarding the publication of this paper. The authors of the paper do not have a direct financial relation that might lead to a conflict of interests for each other.
Acknowledgments
This research work is supported by the National Natural Science Foundation of China under Grant no. 61073116, Excellent Young Talents Fund Program of Higher Education Institutions of Anhui Province under Grant no. 2012SQRL014, and Youth Research Foundation of Anhui University under Grant no. 02303305. The paper has not been previously published, is not currently submitted for review to any other journal, and will not be submitted elsewhere before a decision is made by this journal.
References
 J. M. Bahi, J. F. Couchot, and C. Guyeux, “Steganography: a class of secure and robust algorithms,” The Computer Journal, vol. 55, pp. 653–666, 2012. View at: Google Scholar
 W. Hong and T. Chen, “A novel data embedding method using adaptive pixel pair matching,” IEEE Transactions on Information Forensics and Security, vol. 7, no. 1, pp. 176–184, 2012. View at: Publisher Site  Google Scholar
 J. Tian, “Reversible data embedding using a difference expansion,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 13, no. 8, pp. 890–896, 2003. View at: Publisher Site  Google Scholar
 M. U. Celik, G. Sharma, A. M. Tekalp, and E. Saber, “Lossless generalizedLSB data embedding,” IEEE Transactions on Image Processing, vol. 14, no. 2, pp. 253–266, 2005. View at: Publisher Site  Google Scholar
 Z. Ni, Y. Shi, N. Ansari, and W. Su, “Reversible data hiding,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 16, no. 3, pp. 354–362, 2006. View at: Publisher Site  Google Scholar
 H. J. Kim, V. Sachnev, Y. Q. Shi, J. Nam, and H. Choo, “A novel difference expansion transform for reversible data embedding,” IEEE Transactions on Information Forensics and Security, vol. 3, no. 3, pp. 456–465, 2008. View at: Publisher Site  Google Scholar
 Y. Hu, H. Lee, and J. Li, “DEbased reversible data hiding with improved overflow location map,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 19, no. 2, pp. 250–260, 2009. View at: Publisher Site  Google Scholar
 W. Tai, C. Yeh, and C. Chang, “Reversible data hiding based on histogram modification of pixel differences,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 19, no. 6, pp. 906–910, 2009. View at: Publisher Site  Google Scholar
 P. Tsai, Y. Hu, and H. Yeh, “Reversible image hiding scheme using predictive coding and histogram shifting,” Signal Processing, vol. 89, no. 6, pp. 1129–1143, 2009. View at: Publisher Site  Google Scholar
 X. Gao, L. An, Y. Yuan, D. Tao, and X. Li, “Lossless data embedding using generalized statistical quantity histogram,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 21, no. 8, pp. 1061–1070, 2011. View at: Publisher Site  Google Scholar
 W. Hong, “Adaptive reversible data hiding method based on error energy control and histogram shifting,” Optics Communications, vol. 285, no. 2, pp. 101–108, 2012. View at: Publisher Site  Google Scholar
 W. Puech, M. Chaumont, and O. Strauss, “A reversible data hiding method for encrypted images,” in Security, Forensics, Steganography, and Watermarking of Multimedia Contents X, vol. 6819 of Proceedings of SPIE, p. 9, 2008. View at: Publisher Site  Google Scholar
 X. Zhang, “Reversible data hiding in encrypted image,” IEEE Signal Processing Letters, vol. 18, no. 4, pp. 255–258, 2011. View at: Publisher Site  Google Scholar
 W. Hong, T. S. Chen, and H. Y. Wu, “An improved reversible data hiding in encrypted images using side match,” IEEE Signal Processing Letters, vol. 19, no. 4, pp. 199–202, 2012. View at: Publisher Site  Google Scholar
 X. Zhang, “Separable reversible data hiding in encrypted image,” IEEE Transactions on Information Forensics and Security, vol. 7, no. 2, pp. 826–832, 2012. View at: Publisher Site  Google Scholar
Copyright
Copyright © 2014 Zhaoxia Yin et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.