pixels by the elaborate selection, which leads to the significant
improvement for the visual quality of decrypted, marked image.
On the other hand, a new adaptive judging function based on the
distribution characteristic of image local contents is utilized in
the procedures of secret extraction and image recovery, which
can effectively decrease the errors of extracted secret bits and
recovered image.
The rest of the paper is organized as follows. Section 2 briefly
introduces previous works about the RDH in encrypted images.
The proposed RDH scheme with the capability of privacy protection
is detailedly described in Section 3. Experimental results and com-
parisons are given in Section 4, and Section 5 concludes the paper.
2. Previous works
The scheme in [20] proposed by Zhang first employed the
stream cipher to encrypt all bits of original image. Then, the
data-hiding room can be vacated by flipping the three LSBs for half
of the pixels, and one secret bit can be embedded into each divided
block of the encrypted image. After decryption, the receiver can
extract the embedded bits and recover original image with the
aid of spatial correlation. Hong et al. improved Zhang’s method
by fully exploiting the pixels in the smoothness evaluation for each
block and by considering pixel correlations in the border of neigh-
boring blocks based on the side-match between recovered blocks
and unrecovered blocks, which can decrease the error rate of the
extracted bits for smaller block size [21]. Zhang extended his pre-
vious work [20] into a separable scheme [22], in which the LSBs of
the encrypted image was compressed to create a sparse space for
the accommodation of embedding bits. On the receiver side, this
scheme can realize the independent operations of data extraction
and image decryption individually.
Unlike the schemes in [20–23] that vacated the room of data
hiding after image encryption, Ma et al. proposed to reserve the
room of data hiding before image encryption [24]. In their scheme,
before encryption, original image was divided into two partitions
and the LSBs of one partition were embedded into the other parti-
tion by a traditional RDH algorithm. Thus, the LSBs of the first par-
tition were reserved and used for data embedding with simple LSB
replacement after encryption. Following the idea of reserving room
before encryption, the scheme in [25] first estimated some chosen
pixels in original image, and then, the shifted and encrypted esti-
mation errors, which can be further utilized for RDH, were incorpo-
rated with the remaining encrypted pixels to produce the final
encrypted image. Because the data hiding process of this scheme
was essentially based on the shifting for PE histogram, the data
extraction and image recovery were free of errors.
Chen et al. proposed a RDH scheme for encrypted signals based
on public key cryptosystem and homomorphic encryption, and
applied digital images as an example for description [26]. In this
scheme, during image encryption, each pixel value was segmented
into two parts, i.e., seven most significant bits (MSBs) and one LSB,
and these two parts were encrypted respectively. Then, two
encrypted LSBs of each encrypted pixel pair were modified to
reversibly embed one secret bit according to the properties of
homomorphism. The receiver can easily extract the embedded bits
and recover the original image by judging the relationship of the
two decrypted LSBs in each pixel pair.
3. Proposed scheme
In the proposed scheme, there are three kinds of roles, i.e., con-
tent owner, data hider, and receiver. The content owner encrypts
his/her original image by an encryption key, and then, submits
the encrypted image to the data hider. The data hider embeds
the secret message to the encrypted image by a data-hiding key.
Note that the data hider has no idea about the original content of
the image. The marked, encrypted image is transmitted to the
receiver through a public channel. The receiver can utilize
the encryption key authorized by the content owner to obtain
the decrypted image, which is visually similar to the original
image, and then, can utilize the data-hiding key authorized by
the data-hider to further extract the secret message and recover
the original image. The flowchart of the proposed scheme is
illustrated in Fig. 1.
3.1. Image encryption
Suppose that the size of original image I is M N, and the gray
value I(i,j) of each pixel in I can be represented by 8 bits, i.e., b
i,j,0
,-
b
i,j,1
,...,b
i,j,7
, see Eqs. (1) and (2).
b
i;j;k
¼
Iði; jÞ
2
k
mod 2; k ¼ 0; 1; ...; 7; ð1Þ
Iði; jÞ¼
X
7
k¼0
ð2
k
b
i;j;k
Þ; ð2Þ
where the integers i and j denote the pixel coordinates belonging to
[1,M] and [1,N], respectively. Before submitting the image to the
data hider, in order to protect privacy, the content owner encrypts
the image content using a stream cipher way. Different with the
schemes in [20,21], in our scheme, eight different random binary
matrices all sized M N, i.e., E
(k)
={e
i,j
(k)
}
MN
, k =0,1,...,7, are gen-
erated according to the encryption key of the content owner, and
are used for image encryption by following Eqs. 3–5 orderly.
b
0
i; j;k
¼ b
i; j;k
k ¼ 0; 1; ...; 7; ð3Þ
b
0
i; j;3
¼ b
i; j;3
e
ð3Þ
i; j
; ð4Þ
b
0
i; j;k
¼ b
0
i; j;k
e
ðkÞ
i; j
; k ¼ 0; 1; ...; 7; ð5Þ
where the symbol denotes the exclusive-or operation and b
’
i,j,k
is
the encrypted version of b
i,j,k
except for the case k = 3. In other
words, except for the fourth LSB layer, all the other seven bit layers
of the original image I are encrypted by the random binary
matrices. Then, all b
’
i,j,k
are collected to produce the final encrypted
image I
e
:
I
e
ði; jÞ¼
X
7
k¼0
ð2
k
b
0
i; j;k
Þ; ð6Þ
where I
e
(i,j) represents the pixel value at the coordinate (i,j) of the
encrypted image I
e
.
It should be noted that, in the image encryption procedure of
our scheme, according to a number of observations, the unen-
crypted fourth LSB layer does not disclose the contents of original
image, because the fourth LSB layer is usually nearly random and
reflects very few contents of the image. This unencrypted fourth
LSB layer will assist the subsequent data embedding procedure
by flipping the lower LSB layers. However, if the bit layer that is
higher than the fourth is chosen as the unencrypted, better image
recovery performance may be obtained, but, visual quality of
decrypted image becomes worse and the contents of original
image will be disclosed after the replacement attack (all the seven
encrypted layers are set to a constant value), because higher bit
layers are more relevant to image contents. Therefore, we recom-
mend the fourth LSB layer to be unencrypted and utilized to assist
for data embedding.
After image encryption, I
e
is submitted to the data hider for data
embedding. Note that the potential attackers including the data
156 C. Qin, X. Zhang / J. Vis. Commun. Image R. 31 (2015) 154–164