Ramp secret image sharing

1.   Introduction

Secret image sharing (SIS) belongs to but differs from secret sharing, and image is widely used and covers many privacies ^[2,1], thus, SIS should be specially studied and designed. In a $(k, n)$ threshold SIS scheme, it aims at splitting a secret image into $n$ shadows, i.e., shares or shadow images, which are then assigned to $n$ participants. The secret can be disclosed by any $k$ or more shadows while less than $k$ shadows gain nothing of the secret. SIS can be applied to many scenarios, such as key management, access control, information hiding, authentication, watermarking, transmitting passwords, and distributed storage and computing in cloud computing ^{[3,4,5,6,7,8]}. In the field of SIS research, there are mainly Shamir's polynomial-based scheme ^[9] and visual secret sharing (VSS) ^[10] also called visual cryptography scheme (VCS) ^[11].

Shamir's original polynomial-based SIS ^[9,12] for $(k, n)$ threshold splits a secret image into the constant coefficient of a random $(k-1)$-degree polynomial to generate $n$ shadows, which are then assigned to $n$ participants. The secret image can be disclosed with high-resolution by means of Lagrange interpolation with any $k$ or more shadows. Inspired by Shamir's original scheme, some researchers ^{[13,14,15,16,17,18]} proposed more polynomial-based schemes to possess more features. Although polynomial-based SIS only needs $k$ shadows for disclosing the distortion-less secret image, it has high computational complexity because of Lagrange interpolation and "all-or-nothing".

In $(k, n)$ threshold VSS ^{[19,20,21,22,23,24]}, the outputted $n$ shadows are printed onto transparencies and then assigned to $n$ participants. The beauty of VSS is that the secret image is disclosed by superposing any $k$ or more shadows with human native eyes and no cryptographic computation. Collecting less than $k$ shadows will in general give no clue about the secret image even a watchdog owns infinite computation power. Unfortunately, original VSS suffers from codebook design, pixel expansion problem, low contrast and "all-or-nothing", which are taken into account by the following works ^{[23,25,26,27,28,29,30,31,32]}. Furthermore, most of the existing VSS schemes have limitations of lossy recovery and "all-or-nothing" ^[29,33,34].

In contrast to "all-or-nothing", progressive secret image sharing (PSIS) ^{[33,35,36,37,38]} achieves the characteristic that the more shadows the better disclosed secret image quality. PSIS is useful in many multimedia applications, such as art work image vending, Pay-TV/Music, multi-level representation and degraded encryption, where we need to intentionally disclose the multimedia with a degraded but recognizable quality so as to protect the details in addition to multimedia content. Unfortunately, conventional PSIS may be lossy recovery. Progressiveness can be divided into global progressiveness and regional progressiveness. Global progressive PSIS mainly protects the detail of the secret image progressively, while regional progressive PSIS mainly protects the secret image region by region. Since the paper intends to protect the detail of the secret image, we focus on global progressiveness in this article. However, PSIS is mainly for $(k, n)$ threshold, where lossless recovery is seldom achieved.

Based on above analyses, conventional SIS has the drawback of "all-or-nothing" and conventional PSIS has the limitation of lossy recovery. Thus, we intend to propose ramp SIS which achieves both progressive and lossless recovery by a unique disclosing method.

In this article, first we introduce ramp SIS definition according to image features and ramp secret sharing ^[39,40,41]. Then we propose $(k_1, k_2, n)$ ramp SIS based on the Chinese remainder theorem (CRT) ^[42,43,44]. In the proposed ramp, i.e., $(k_1, k_2, n)$ threshold, CRT-based SIS, when we collect any $k_1$ or more and less than $k_2$ shadows, the secret image will be disclosed in a progressive way ^[45]. On the other hand, when we collect any $k_2$ or more shadows, the secret image will be disclosed losslessly. Furthermore, the disclosing method is only modular arithmetic resulting in ability in real-time application. We give theoretical analyses and experiments to display the effectiveness of our method.

Our method allows the purchaser to review the secret with a degraded quality by collecting less shadows prior to buying them. Then the purchaser can obtain the lossless version by collecting more shadows after he decides to buy it. Image generally differs from data, thus the progressive feature with poor quality of image makes sense to some applicable scenarios. The progressive feature achieves that the quality of the image can be partially degraded. Such perceptibility makes it possible for the potential purchasers to view low-quality copies of the image prior to buying them.

A detailed scenario is given as follows. In the process of displaying and selling an art image, since the details are very important for the art image, details should be protected. After sharing the art image once, the owner can disclose and present different image qualities to different people on different occasions, instead of sharing again. For example, in an exhibition, first the owner can demonstrate a low quality of the art image with any $k_1$ or more shadows to prove the copyright of the art, then after reaching a purchase agreement he shows the lossless quality with any $k_2$ or more shadows.

The detailed advantages and contributions of the proposed approach are as follows.

$1.$ A formal definition of ramp SIS is first introduced.

$2.$ $(k_1, k_2, n)$ ramp SIS based on CRT is proposed. We use CRT due to the following advantages comparing to polynomial-based SIS. On one hand, CRT-based SIS can achieve lossless recovery, while most of the polynomial-based SIS schemes are in general lossy. On the other hand, the disclosed operation of polynomial-based SIS is Lagrange's interpolation ($O(k\log ^2 k)$), while that of CRT-based SIS is only modular operation ($O(k)$) ^[44], therefore, CRT-based SIS has lower computational cost than polynomial-based SIS to disclose the secret image.

$3.$ The secret image is decoded by only modular operation. When we collect any $k_2$ or more shadows, the secret image will be disclosed losslessly, which outperforms polynomial-based SIS due to lossy recovery for secret pixel value larger than 250 if 251 is selected as the prime value in polynomial-based SIS.

The rest of the paper is organized as follows. Section 2 introduces ramp SIS definition and some basic requirements for the proposed method. In section 3, the proposed method and its analyses are presented in detail. Section 4 gives the security analyses of typical SIS schemes. Section 4 is devoted to experimental results. Finally, section 5 concludes this paper.

2.   Preliminaries

In this section, we will give some preliminaries. In conventional $(k, n)$ threshold SIS, an original secret image $S$ is encrypted into $n$ shadows $SC_1, SC_2, \cdots SC_n$, and the decrypted secret image ${S}'$ is disclosed from any $t$ ($k \le t \le n, t \in {\rm Z}^ +$) shadows.

2.1.   Chinese remainder theorem (CRT)

CRT was first exploited in the Western han dynasty of China as well as formally introduced in the southern and northern dynasties. It intends to solve a set of linear congruence equations.

When we choose a set of integers ${m_i }(i = 1, 2, \cdots, k)$ satisfying $\gcd \left({m_i, m_j } \right)$$= 1, i \ne j$, then there is a unique solution $y \equiv \left({a_1 M_1 M_1^{ - 1} + a_2 M_2 M_2^{ - 1} + \cdots + a_k M_k M_k^{ - 1} } \right)\left({\bmod \; M} \right)$, $y \in \left[ {0, M - 1} \right]$) to Eq. (2.1).

where $M = \prod\nolimits_{i = 1}^k {m_i }$, ${{M}_{i}}={{M}_{/{{m}_{i}}}}$ and $M_i M_i^{ - 1} \equiv 1\left({\bmod \; m_i } \right)$.

Proof. Since $\gcd \left({m_i, m_j } \right) = 1, i \ne j$, $\gcd \left({m_i, M_i } \right) = 1$ and we have $M_i^{ - 1}$ subject to $M_i M_i^{ - 1} \equiv 1\left({\bmod \; m_i } \right)$.

For $a_1 M_1 M_1^{ - 1}$, we have

According to Eqs. (2.2) and (2.3), $y \equiv \left({a_1 M_1 M_1^{ - 1} + a_2 M_2 M_2^{ - 1} + \cdots + a_k M_k M_k^{ - 1} } \right)\left({\bmod \; M} \right)$, $y \in \left[ {0, M - 1} \right]$ subject to Eq. (2.1).

Thus, on one hand, $y$ is one solution to Eq. (2.1).

On the other hand, if both $y_1$ and $y_2$ are solutions to Eq. (2.1), we have $y_1 -y_2 \equiv 0\left({\bmod \; m_i } \right)$. Since $\gcd \left({m_i, m_j } \right) = 1, i \ne j$, $M$ is exactly divided by $y_1 -y_2$. In addition, $y$ is one solution to Eq. (2.1), thus, the set of solutions to Eq. (2.1) is $\left\{ {zM + y\left| {z \in \bf{Z}} \right.} \right\}$.

Therefore, there is a unique solution $y \equiv \left({a_1 M_1 M_1^{ - 1} + a_2 M_2 M_2^{ - 1} + \cdots + a_k M_k M_k^{ - 1} } \right)\left({\bmod \; M} \right)$, $y \in \left[ {0, M - 1} \right]$) to Eq. (2.1).

CRT will be utilized in the proposed scheme to possess $(k_x, n)$ threshold, where $2 \le k_1 \le k_x \le k_2 \le n$. Both Polynomial-based SIS and CRT-based SIS are well studied. We use CRT in our scheme due to the following advantages and differences.

● The shadow size of polynomial-based SIS is easier to be reduced.

● CRT-based SIS easily achieves lossless reconstruction, while most polynomial-based SIS schemes are not lossless.

● The disclosing operation is Lagrange's interpolation ($O(k log^2 k)$ in polynomial-based SIS, while that is modular operation ($O(k)$ ^[46]) in CRT-based SIS, thus CRT-based SIS has lower computational complexity than polynomial-based SIS to disclose the secret image.

● The principle of CRT-based SIS is complex and hard to be understood.

● The number of owners is in general not limited in polynomial-based SIS, while that in CRT-based SIS is small like n ≤ 6, because as n increases the available value of mi decreases, which will affect the distribution of the values of the shadow pixels and therefore further may lead to secure issue.

2.2.   The characteristic analyses of image

Digital image differs from pure electronic data, where the differences mainly have:

● An image includes many pixels, which have correlations between adjacent ones, such as structure, texture, edge and other related information. The correlations are important to security and hence need to be considered in SIS algorithm design. Thus, SIS should encrypt not only the pixel values but also the correlations between adjacent pixels.

● There are lots of pixels in an image so that computational complexity of SIS should be considered.

● An image owns special file storage structure. Using grayscale image as an example, its pixel value is in the range of $\left[ {0,255} \right]$, which should be satisfied in SIS design, e.g., the output value, the input value, and other relative parameters, should lie in the range. For example, the secret pixel value range and the shadow pixel value range should not exceed the range. In addition, we have ${m_i } \le 256$ when applying to CRT.

● An image is a specific form of the data, where each grayscale (binary) pixel is represented as one byte (bit), so SIS is easily to be applied to secret sharing.

● In general, secret data is available only if it is losslessly recovered. Whereas, an image may be useful when recovered with some errors because of human eyes' low pass filter feature, thus, progressiveness makes sense to SIS.

The above differences lead to that in general traditional secret sharing cannot be directly applied to SIS. In particular, CRT-based ramp secret sharing cannot be directly applied to CRT-based ramp SIS.

2.3.   Ramp SIS Definition

Definition 1. A SIS splits a secret image, denoted as $S$, into $n$ shadow images, denoted as $SC_1, SC_2, \cdots SC_n$. We say the SIS is a $(k_1, k_2, n)$ ramp SIS subject to:

● security condition. The secret image cannot be reconstructed with any less than $k_1$ shares.

● ramp recovery condition. The secret image will be reconstructed progressively with any $k_1$ or more and less than $k_2$ shares. The reconstructed image quality increases with the number of shares from $k_1$ to $k_2$.

● decodable condition. The secret image is decoded with any $k_2$ or more shares.

If $k_1 = k_2 = k$, $(k_1, k_2, n)$ ramp SIS will reduce to $(k, n)$-threshold SIS. The ramp SIS is called linear ramp SIS if the reconstructed image quality increases linearly with the number of shares from $k_1$ to $k_2$.

2.4.   Quality evaluation metrics of the reconstructed secret image

In VSS, contrast is generally used, which is also adopted in this paper to evaluate the quality in VSS. In polynomial-based SIS, in general due to lossless recovery the metrics are seldom considered. In the research field of image processing, there are many metrics to evaluate image quality, where some typical metrics will be directly adopted in this paper.

The visual quality in VSS, which can decide how well human eyes can recognize the disclosed image, of the disclosed secret image $S'$ corresponding to secret image $S$ can be overall evaluated by contrast as follows ^[28].

Definition 2.

Where $\alpha$ is contrast, $P_0$ (resp., $P_1$) means the probability of white pixels in the disclosed image ${S}'$ for the corresponding white (resp., black) area in secret image $S$, that is, $P_0$ denotes correctly decrypted probability corresponding to white area in secret image $S$, and $P_1$ denotes wrongly decrypted probability corresponding to black area in secret image $S$.

Since lossless disclose or nothing, i.e., "all-or-nothing", conventional SIS for grayscale image omits to discuss quality evaluation of disclosed secret image. Progressiveness differs from "all-or-nothing", therefore, we should discuss the quality evaluation of the disclosed gray secret image. The following typical objective metrics will be adopted to evaluate the image quality between $S'$ and $S$.

$1.$ Peak signal-to-noise-ratio (PSNR): PSNR, in Eq. (2.5), between the primary image $I$ with size of M$\times$N and modified image $I'$ is adopted to measure the image similarity, where MSE as Eq. (2.6) denotes the mean square error.

$2.$ Structural similarity index measure (SSIM) ^[47] is to assess the visual impact of three characteristics in an image, i.e., luminance, contrast and structure, which gains a multiplicative combination of the above three terms, as Eq. (2.7). The value of SSIM is in -1 and 1. The larger SSIM results in higher image similarity.

where

$l\left({x, y} \right) = \frac{{2\mu _x \mu _y + C_1 }}{{\mu _x^2 + \mu _y^2 + C_1 }} \\ c\left({x, y} \right) = \frac{{2\sigma _x \sigma _y + C_2 }}{{\sigma _x^2 + \sigma _y^2 + C_2 }} \\ s\left({x, y} \right) = \frac{{2\sigma _{xy} + C_3 }}{{\sigma _x \sigma _y + C_3 }} \\ $

$\mu _x, \mu_y, \sigma_x, \sigma_y, and\; \sigma_{xy}$ are the local means, standard deviations, and cross-covariance for images $x, y$. In this paper, we set $C_3 = \frac{{C_2 }}{2}, \alpha = \beta = \gamma = 1$.

$3.$ NC is to evaluate the quality between the original secret image and the disclosed secret image, as Eq. (2.8).

$4.$ The universal quality index (UQI) ^[48] can reflect the distortion of the disclosed secret image with its original secret image, whose value is between -1 and 1. The larger UQI means better quality. The block size of UQI is 8 in this paper. For details please refer to ^[48].

In addition, contrast can decide how well human eyes recognize the disclosed binary secret, so that it is expected to be as great as possible to obtain better visual quality. About how the contrast values map to the quality of the disclosed image, please refer to ^[49]. Herein, in order to show some intuitions about the expected performance, we have the followings.

$1.$ When $\alpha \in$ [0, 0.03], one cannot recognize the secret image.

$2.$ When $\alpha \in$ (0.03, 0.14], one can see a little information of the secret image.

$3.$ When $\alpha \in$ (0.14, 0.21], the secret image is recognized with acceptable quality.

$4.$ When $\alpha \in$ (0.21, 1], the secret image is fast recognized with good quality.

About how the PSNR values map to the image quality ^[50], we may refer to the followings.

$1.$ When PSNR $\in$ [28.5, $+ \infty$], the image quality is very good.

$2.$ When PSNR $\in$ [23.0, 28.5), the image quality is good.

$3.$ When PSNR $\in$ [19.5, 23.0), the image quality is medium.

$4.$ When PSNR $\in$ [17.0, 19.5), the image quality is poor.

$5.$ When PSNR $\in$ [0, 17.0), the image quality is bad.

3.   The proposed $(k_1, k_2, n)$ ramp SIS

3.1.   Our method

We give the proposed $(k_1, k_2, n)$ ramp SIS based on CRT in Algorithm 1 with an original secret image $S$ leading to $n$ output shadows $SC_1, SC_2, \cdots SC_n$ and private corresponding integers $m_1, m_2, \cdots m_n$. The recovery Steps are described in Algorithm 2.

In Algorithm 1 and Algorithm 2, we find that.

$1.$ In Step 1 of the proposed Algorithm 1, $\left\{ {128 \le p < m_1 < m_2 \cdots < m_n \le 256} \right\}$ is given due to image pixel value range and $pN_{k_x} < M_{k_x}$. We suggest here that $p$ is as small as possible for security and $m_i$ is as large as possible, thus, the pixel values of shadow will be randomly distributed in large range.

$2.$ $\gcd \left({m_i, m_j } \right) = 1$ and $\gcd \left({m_i, p} \right) = 1$ intend to satisfy CRT conditions, where $m_i$ may be preserved as the private key for participant $i$ or may be public. $\gcd \left({m_i, p} \right) = 1$ is on account of not only applicable CRT but also containing all possible pixel values in range $[0, m_i)$ for shadow $SC_i$. We note that, our method can accommodate only a constant number of participants because in Step 1 of Algorithm 1 one has to choose $n+1$ integers between 128 and 256, which must be pairwise relatively prime and whose available numbers are more than 23 but less than 128. However, these numbers can satisfy general applications.

$3.$ In Step 2 of Algorithm 1, $T_{k_x}$ divides interval $\left[ {\left\lceil {\frac{N_{k_x}}{p}} \right\rceil, \left\lfloor {\frac{M_{k_x}}{p} - 1} \right\rfloor } \right]$ into two parts with a view to classify $0 \le x < p$ or $p \le x \le 255$ according to Step 4 of Algorithm 2. As a result, $s$ can be losslessly disclosed for arbitrary $x \in \left[ {0,255} \right]$.

$4.$ In Step 4 of our Algorithm 1, we know $A$ is randomly picked up from $\left[ {\left\lceil {\frac{N_{k_x}}{p}} \right\rceil, \left\lfloor {\frac{M_{k_x}}{p} - 1} \right\rfloor } \right]$, thus, $N_{k_x} \le y < M_{k_x}$ in order to obtain $(k_x, n)$ threshold for $y$ as explained in Section 2.1.

$5.$ In Step 4 of Algorithm 1, $A$ is randomly selected for every secret pixel $s$, hence $y = s + Ap$ can enlarge $s$ value in order to scramble both the correlations between adjacent pixels and the secret pixel value without auxiliary encryption.

$6.$ In Step 4 of Algorithm 1, $y = s + Ap$ and $s < p$ will determine a unique $s$ according to $s \equiv y\left({\bmod \; p} \right)$.

$7.$ In the recovery phase, for the current processing location $(h, w)$, we do not know its threshold, thus, in Steps 4–5 of Algorithm 2 we search for the minimum threshold satisfying losslessly recovering the original secret pixel $s$, denoted as ${k_x}^*$.

$8.$ Our $(k_1, k_2, n)$ threshold extension method may be also suitable for other SIS, such as polynomial-based SIS.

Moreover, we explain the differences between Algorithm 1 and the classical ones as follows.

$1.$ Ramp SIS has not been formally introduced before our work.

$2.$ CRT is first applied to Algorithm 1 to achieve ramp SIS.

$3.$ Steps 1–4 of Algorithm 1 are different from the classical CRT-based SIS schemes since Steps 1–4 will achieve ramp SIS proved in Section 3.2.

3.2.   Security and progressiveness analyses

We will show performances of the proposed method by theoretically analyzing the security, visual recognition and valid ramp threshold construction. In Theorem 1, we will prove that the proposed scheme is a valid $(k_1, k_2, n)$ ramp SIS construction. Prior to the proof of Theorem 1, some Lemmas are given. Without loss of generality, in the following analyses, we assume that ${{k_x}^*} = {{k_0}}$ threshold is selected in Step 3 of Algorithm 1 for now processing pixel value $s = S(h, w)$.

Lemma 1. Each shadow generated by our method gives no clue about the secret image.

Proof.

From $y = s + Ap$ or $y = s-p + Ap$ and $a_i \equiv y\left({\bmod \; m_i } \right)$, we will prove $SC_i(h, w) = a_i$ is random in range $[0, m_i)$.

If $A$ is fixed, since $s$ represents the pixel value of secret image, we assume $s$ and $s-p$ is random in range $[0,255]$. Due to $a_i \equiv (s + Ap)\left({\bmod \; m_i } \right)$, we have $a_i$ is random in range $[0, m_i)$.

On the other hand, if $s$ is fixed, $\gcd \left({m_i, p} \right) = 1$, thus, $Ap\left({\bmod \; m_i} \right)$ will cover all possible values in range $[0, m_i)$. We have $s+Ap\left({\bmod \; m_i} \right)$ will cover all possible values in range $[0, m_i)$ as well. As a result, we have $a_i$ is random in range $[0, m_i)$.

Thus, the Lemma is proved to be met.

Lemma 2. In the proposed scheme, any $k_0$ or more shadow pixels can disclose the secret pixel losslessly.

Proof. Since $s$ represents the pixel value of secret image, we will prove any $k_0$ or more shadows can disclose $s$ losslessly.

In order to disclose $s$, we only need to find $y$ due to $s \equiv y\left({\bmod \; p} \right)$ or $s \equiv y\left({\bmod \; p} \right)+p$.

When $a_{i_1}, a_{i_2 }, \cdots a_{i_{k_0} }$ are given, according to CRT, there exists only solution $y$ modulo $N_1 = \prod\nolimits_{j = 1}^{k_0} {m_{i_j } }$ since $N_1 \ge M_{k_0}$. Finally we can uniquely determine $y$ and thus, $s$ based on Steps 4-5 of our Algorithm 2.

Lemma 3. In the proposed scheme, any $k_0-1$ or less shadows give no clue about secret.

Proof. When ${k_0}-1$ shadow pixels $a_{i_1}, a_{i_2 }, \cdots a_{i_{{k_0}-1} }$ are given, according to CRT then all we have is $y_0$ modulo $N_2 = \prod\nolimits_{j = 1}^{{k_0} - 1} {m_{i_j } }$, where $y_0 \in [0, N_2-1]$. On one hand, the true $y \in [N_{k_0}, M_{k_0}-1]$, which is absolutely different from $y_0$. On the other hand, since $N_{k_0} \ge N_2$, $N_{k_0} \le y < M_{k_0}$ and $\gcd \left({N_2, p} \right) = 1$, in $[N_2, M_{k_0}-1]$, $y_0+b\prod\nolimits_{j = 1}^{{k_0}-1} {m_{i_j} }$ for $b = 1, 2, \cdots, {m_{i_{k_0}} -1}$ are also the solutions for the collected ${k_0}-1$ equations in Eq. (3.1). Thus, there are another ${m_{i_{k_0}} -1}$ solutions in $[N_2, M_{k_0}-1]$, other than only one. Thus ${k_0}-1$ or less shadows give no clue about secret.

Theorem 1. Our method is a valid $(k_1, k_2, n)$ ramp SIS construction.

Proof. Based on the above Lemmas, we know for now processing pixel value $s = S(h, w)$ $(k_0, n)$ threshold is achieved by our method.

Since ${{sc}_{1}}, {{sc}_{2}}, \cdots{{sc}_{{n}}}$ are generated according to the secret pixel $s$ with $(k_0, n)$ threshold, we can disclose the secret $s$ when we collect any $k_0$ or more shadow pixels.

Since in Step 3 of Algorithm 1, for every processing pixel value $s = S(h, w)$, a threshold $k_x$ in $[k_1, k_2]$ is selected randomly, when we collect more than $k_1$ shadows, more secret pixels will be disclosed losslessly so that the progressive quality of disclosed secret image will be gained. On the other hand, when we collect any $k_2$ or more shadows, every pixel of the secret image is disclosed losslessly, thus, the secret image is disclosed losslessly. As a result, our method is a valid $(k_1, k_2, n)$ ramp SIS construction.

4.   Experimental results and analyses

In this section, experiments and analyses are taken into account to evaluate the effectiveness of the proposed scheme.

4.1.   Image illustration

Figure 1 is one experimental result of our proposed $(k_1, k_2, n)$ ramp CRT-based SIS, where $p = 128, m_1 = 245, m_2 = 247, m_3 = 249, m_4 = 251, m_5 = 253$, $k_1 = 2, k_2 = 4, n = 5$ and its employed grayscale secret image is in Figure 1(a). Figures 1(b–f) are the generated 5 shadows, which are noise-like. Figures 1(g–j) display the disclosed grayscale secret image with any $t\left({2 \le t \le 5} \right)$ shadows by our recovery method, where $S'_{1, 2, \cdots, t}$ is the disclosed secret image $S'$ from $SC _{1}, SC_{2}, \cdots, SC_{t}$ and for saving pages we only give the disclosed results with the first $t$th shadows. When more shadows are used, better disclosed secret image is obtained in $[k_1, k_2]$, thus, the proposed $(k_1, k_2, n)$ ramp SIS is progressive in $[k_1, k_2]$. The disclosed secret images with any $k_2$ or more shadows, as Figures 1 (i)-(j), are the same as the original secret image in Figure 1 (a), since $\sum\limits_{h = 1}^H {\sum\limits_{w = 1}^W {\left| {S(h, w) - S'(h, w)} \right|} } = 0$.

Furthermore, progressive rate can be adopted to evaluate the progressive effect of the disclosed secret image ^[51]. In Figure 1, taking PSNR as an example, the progressive rate at $t = 2$ is 3.0746 and the progressive rate at $t = 3$ is $+ \infty$.

In addition, Figure 2 shows shadows histogram analyses of proposed $(k_1, k_2, n)$ ramp SIS corresponding to Figure 1. For each shadow, the pixel values are approximately uniformly distributed in range $[0, m_i-1]$, which tells that each shadow gives no clue about the secret image. In the following experiments, we will omit the shadows histogram analyses for saving pages.

Figure 3 is the further experimental result of our proposed $(k_1, k_2, n)$ ramp CRT-based SIS, where $p = 128, m_1 = 245, m_2 = 247, m_3 = 249, m_4 = 251, m_5 = 253$, $k_1 = 3, k_2 = 5, n = 5$ and its employed grayscale secret image is in Figure 3(a). Figures 3(b–f) are the generated 5 shadows, which are noise-like. Figures 3(g–j) display the disclosed grayscale secret image with any $t\left({2 \le t \le 5} \right)$ shadows by our recovery method. When less than $k_1$ shadows are inspected, nothing of the secret image can be obtained. When $k_1$ or more shadows are collected, the secret image can be disclosed in a degree. When more shadows are used, better disclosed secret image is obtained as well in $[k_1, k_2]$, thus, the proposed $(k_1, k_2, n)$ ramp SIS is progressive in $[k_1, k_2]$ as well. The disclosed secret images with any $k_2$ shadows as Figure 3(j) is the same as the original secret image Figure 3(a) as well.

Based on the above results we conclude that:

$1.$ The shadows are noise-like, thus, every single shadow is secure.

$2.$ When any $t < k_1$ shadows are inspected, there is no information on the secret image is leaked except for image size, which shows security of our method.

$3.$ When any $t (k_1 \le t \le k_2)$ shadows are collected, the secret image will be disclosed by our recovery method in a progressive way.

$4.$ When we collect any $k_2$ or more shadows, the secret image is disclosed losslessly by our recovery method.

$5.$ $(k_1, k_2, n)$ ramp SIS is achieved.

4.2.   Available parameters

Some available parameters of ${p, m_1, m_2 \cdots, m_n }$ for different participant numbers are suggested in Table 1, some of which are applied to our experiments as well. The user can also search other parameters according to specific applications.

4.3.   Comparisons with related works

Herein, we compare the proposed scheme with other related schemes especially VSS ^[28] and polynomial-based scheme ^[12], since they are typical SIS schemes. Furthermore, VSS in ^[28] is progressive without codebook design and pixel expansion based on stacking recovery. Polynomial-based scheme in ^[12] is fully lossless.

We note that, as stated in section 2.2, in general secret sharing is hard to be directly applied to SIS, thus, we omit the comparisons to ramp secret sharing.

Figure 4 is one experimental result of our proposed $(k_1, k_2, n)$ ramp CRT-based SIS, where $p = 131, m_1 = 251, m_2 = 253, m_3 = 254, m_4 = 255$, $k_1 = 2, k_2 = 4, n = 4$ and its employed grayscale secret image is in Figure 4(a). Figures 4(b–e) are the generated 4 shadows, which are noise-like. Figures 4(f–h) display the disclosed grayscale secret image with any $t\left({2 \le t \le 4} \right)$ shadows by our recovery method. When more shadows are used, better disclosed secret image is obtained as well in $[k_1, k_2]$, thus, the proposed $(k_1, k_2, n)$ ramp SIS is progressive in $[k_1, k_2]$. The disclosed secret image with $k_2$ shadows as Figure 4 (h) is the same as the original secret image Figure 4 (a), since $\sum\limits_{h = 1}^H {\sum\limits_{w = 1}^W {\left| {S(h, w) - S'(h, w)} \right|} } = 0$ as well.

Figure 5 is further experimental result of our proposed $(k_1, k_2, n)$ ramp CRT-based SIS, where $p = 131, m_1 = 251, m_2 = 253, m_3 = 254, m_4 = 255$, $k_1 = 2, k_2 = 2, n = 4$ and its employed grayscale secret image is in Figure 5(a). Figures 5(b–e) are the generated 4 shadows, which are noise-like. Figures 5(f–h) display the disclosed grayscale secret image with any $t\left({2 \le t \le 4} \right)$ shadows by our recovery method. When two or more shadows are used, the secret image is losslessly disclosed so that our proposed $(k_1, k_2, n)$ ramp SIS reduces to $(k, n)$ ramp SIS if $k_1 = k_2$.

Then Figure 6 illustrates one experimental result of VSS for $(k, n)$ threshold in ^[28], where $k = 2, n = 4$ and its employed binary secret image is in Figure 6(a). Figures 6(b–e) are the generated 4 shadows, which are noise-like as well. Figures 6(f–h) display the disclosed grayscale secret image with any $t\left({2 \le t \le 4} \right)$ shadows by stacking recovery. When 2 or more shadows are used, better disclosed secret image is obtained as well in $[k, n]$, thus, VSS for $(k, n)$ threshold in ^[28] is progressive in $[k, n]$.

According to Figure 4, Figure 5 and Figure 6, comparisons between VSS and our method are given as follows.

$1.$ Our method is for $(k_1, k_2, n)$ ramp threshold due to random threshold selection in Step 3 of our method while VSS is only for $(k, n)$ threshold, where $(k, n)$ threshold is one special case of our method.

$2.$ Our disclosing method is modular arithmetic since CRT while VSS is stacking, thus, our disclosing method needs more computation than VSS.

$3.$ The secret image is disclosed in a progressive way by our method when $t(k_1 \le t \le k_2)$ shadows are collected due to random threshold selection in Step 3 of our method, while VSS is progressive in $[k, n]$.

$4.$ Our method discloses the secret image losslessly when we collect any $k_2$ or more shadows since Steps 4–5 of our method, while VSS is lossy.

$5.$ Our method is suitable for grayscale secret image as well as possible color secret image due to image characteristic analyses and CRT parameters design, while VSS is for binary secret image.

Figure 7 is one experimental result of $(k, n)$ threshold polynomial-based SIS ^[12], where $k = 2, n = 4$ and its employed grayscale secret image is in Figure 7(a). Figures 7(b–e) are the generated 4 shadows, which are noise-like. Figures 7(f–h) display the same disclosed grayscale secret images with high-resolution with any $k = 2$ or more shadows by Lagrange interpolation.

According to Figure 4, Figure 5 and Figure 7, comparisons between our method and polynomial-based SIS are given as follows.

$1.$ Our method is for $(k_1, k_2, n)$ ramp threshold due to random threshold selection in Step 3 of our method while polynomial-based SIS is only for $(k, n)$ threshold, where $(k, n)$ threshold is one special case of our method.

$2.$ Our disclosing method is modular arithmetic ($O(k)$ operations ^[44]) since CRT while polynomial-based SIS is Lagrange interpolation ($O(k\log ^2 k)$ operations ^[44]), thus, our disclosing method needs less computation than polynomial-based SIS.

$3.$ The secret image is disclosed in a progressive way by our method when any $t(k_1 \le t \le k_2)$ shadows are gained due to random threshold selection in Step 3 of our method, while polynomial-based SIS is "all-or-nothing".

$4.$ In some polynomial-based SIS schemes, it is generally lossy recovery since secret image is decoded by modular 251 which is less than max grayscale value 255. The recovering image will be lossy if the pixel value of the secret image exceeds 251 and some polynomial-based SIS schemes have a little bit of loss. By contrast, our method is lossless because of CRT. We further analyze this issue as follows. In polynomial-based SIS, the primes near 255 are 257 and 251. In most polynomial-based SIS, 251 is used. If 257 is used, we cannot store the i-th shadow pixel for the value of 256; otherwise 251 is used, we cannot disclose the value of the secret pixel greater than 250. Although some methods are given to solve the 251 problem, such as selecting the prime 257 ^[52], primitive polynomial for $GF(2^8)$, splitting the secret pixel greater than 250 into two pixels and so on, they are achieved at some other costs. Taking ^[53] as one example, Huffman coding and image differencing process are employed to reduce the size of each shadow and to avoid auxiliary encryption. Primitive polynomial for $GF(2^8)$ is adopted to avoid quality degradation. However, primitive polynomial for $GF(2^8)$ has larger computational complexity.

In addition, actually, when $k_1 = k_2 = k$, the $(k_1, k_2, n)$ ramp SIS will be a $(k, n)$-SIS. Progressiveness is studied in some degree in VSS while that is seldom discussed in polynomial-based SIS. However, VSS is only suitable for binary image rather than grayscale image.

In a word, based on image characteristics and CRT, the proposed $(k_1, k_2, n)$ ramp SIS has the features of $(k_1, k_2, n)$ threshold with only modular arithmetic recovery method and no auxiliary encryption, which outperforms conventional $(k, n)$ threshold SIS.

4.4.   Quality of disclosed secret image

For the above experiments, the quality evaluation metrics of the disclosed secret image are given in Table 2. According to Table 2, the proposed method achieves progressive characteristic in general $(k_1, k_2, n)$ threshold when more shadows are collected, which outperforms conventional SIS as well.

5.   Conclusion

In this paper, based on the study of image characteristics, the Chinese remainder theorem (CRT) and secret image sharing (SIS), we proposed $(k_1, k_2, n)$ ramp SIS. Our method realizes $(k_1, k_2, n)$ threshold and lossless recovery for grayscale image without auxiliary encryption. When we collect any $k_1$ or more shadows, the secret image will be disclosed in a progressive way. On the other hand, when we collect any $k_2$ or more shadows, the secret image will be disclosed losslessly. Furthermore, the disclosing method is only modular arithmetic resulting in ability in real-time application. Theoretical analyses and experiments are performed to display the effectiveness of our method. Applying our method to other SIS schemes like polynomial-based SIS and comparing to related ramp secret sharing will be our future work.

Acknowledgments (All sources of funding of the study must be disclosed)

The authors would like to thank the anonymous reviewers for their valuable comments. This work is supported by the National Natural Science Foundation of China (Grant Numbers: 61602491, 61501148) and the Key Program of the National University of Defense Technology (Grant Number: ZK-17-02-07).

Conflict of interest

We have no conflicts of interest to declare.