1545-5971 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2016.2634161, IEEE
Transactions on Dependable and Secure Computing
embedding rates and good recovery capability. However, they
all require extra RDH operations before image encryption,
thus contradict the very purpose of RDH-EI, since the extra
operations are performed to the plaintext rather than encrypted
images.
There are also some interesting works based on
commutative encryption and data hiding [24-26], where
commutative means that the orders of encryption and data
hiding/extraction can be swapped. Although some have
separable features, commutative RDH is different from the
framework proposed in the present paper.
B. Joint RDH-EI
In joint RDH-EI, the additional message can only be
extracted by the recipient after image decryption, along with
image recovery, while the data hider cannot perform
extraction.
A feasible method was first proposed in [8], in which the
content owner encrypts an original image using a stream
cipher, and the data hider embeds additional messages into
ciphertext blocks by flipping three least significant bits (LSB)
of half the pixels in each block. When extracting the additional
messages, the recipient decrypts the marked encrypted image
and generates two candidates for each block by flipping LSBs
again. Since the original block is much smoother than the
interfered, the embedded bits can be extracted and the original
image perfectly recovered. This joint RDH-EI method
depends on the size of each block. As long as the block size is
appropriately chosen, errors of extraction and recovery can be
avoided. This method was improved in [9] by exploiting
spatial correlation between neighboring blocks and using a
side-match algorithm to achieve a higher embedding rate. The
flipping based approach was further improved in [10], in
which multiple neighboring pixels in different locations are
used to reduce error rates in extraction and recovery.
Recently, a new joint RDH-EI method was proposed in [11].
Data embedding is realized through a public key modulation
mechanism. On the recipient end, a two-class SVM classifier
is designed to distinguish encrypted and non-encrypted image
patches. Consequently, the recipient can jointly extract the
additional messages and recover the original image. This
method provides a higher embedding capacity.
C. RDH-EI for JPEG Bitstream
As most RDH-EI methods are designed for uncompressed
spatial-domain images, [12] proposes an approach capable of
reversely hiding messages into encrypted JPEG bitstreams.
This scheme aims at encrypting a JPEG bitstream into a
properly organized structure and embedding additional
messages into the encrypted bitstream by slight modifications.
During the bitstream encryption, all appended bits of the
Huffman codes are encrypted with a stream cipher, and all
Huffman codes are kept unchanged. After encryption, the file
size is preserved, and the format is compliant to common
JPEG decoders. On the server side, the bitstream of every
other block is selected as a candidate. If all AC coefficients of
a candidate block are zero, the block is skipped. Additional
bits are then encoded by LDPC-based error correction codes
(ECC), and embedded into the useful candidate bitstream by
flipping the LSBs of the encrypted appended bits of the AC
coefficients in each candidate block. On the recipient side,
LSBs of the appended bits of each candidate bitstream are
flipped again to estimate the additional bits using a predefined
blocking artifact function and an ECC decoder. Meanwhile,
the original bitstream can be losslessly recovered according to
the extracted bits.
In [27] and [28], some interesting ideas of RDH were
proposed for JPEG images by combining image scrambling
and data embedding. By scrambling the JPEG structure,
additional message is embedded into the encrypted bitstream.
However, in these methods data embedding must be combined
with image encryption, which is different from general
RDH-EI framework depicted in Fig. 2.
Limited by JPEG compression, large embedding capacity
cannot be achieved. In [12], about 750 bits are embedded into
the JPEG bitstream of a 512×512 grayscale image. The joint
RDH-EI method requires a combined data extraction and
image recovery. That may become a problem since the
database administrator cannot read the hidden messages from
the marked encrypted bitstream. As format compliance is
required in JPEG encryption [29], it is difficult to design a
secure encryption algorithm for JPEG. The algorithm
previously presented in [12] is not secure enough. Analyses in
[27] show that the principal structure of the original image can
be estimated from the encrypted bitstream if all Huffman
codes are kept unchanged. In view of these drawbacks, we
provide a new encryption scheme for JPEG bitstream, and
propose a separable RDH-EI approach for the encrypted
bitstream. In the proposed method, data extraction and image
recovery are separated, higher embedding capacity is achieved,
and security of JPEG encryption enhanced.
III. PROPOSED FRAMEWORK
The framework of the proposed method is depicted in Fig. 3.
The JPEG RDH-EI workflow includes three parties: content
owner, data hider, and recipient.
Given a JPEG bitstream and an encryption key, the content
owner generates a ciphertext bitstream after syntax parsing
and encryption. In the process, the file size is kept unchanged
and the format is compliant to common JPEG decoders.
When a remote server receives the encrypted bitstream, the
data hider parses the bitstream and hides additional messages
in it using an embedding key. After the marked encrypted
bitstream is constructed, the file size and format compliance
are preserved. In this scheme, the server can extract additional
messages from the marked encrypted bitstream using the
embedding key.
On the recipient side, the additional messages can also be
extracted from the received bitstream if the embedding key is
available. A recipient with only the encryption key can view
an approximate image by a direct decryption. If both the
encryption and embedding keys are available, the recipient can
losslessly recover the original bitstream after decrypting the
marked encrypted JPEG bitstream.