Meaningful secret image sharing for JPEG images with arbitrary quality factors

1.   Introduction

Taking Russia's control method of nuclear weapons in the 1990s as an example, Russia designed a similar "two out of three" access mechanism with the president, the defense secretary, and the defense official. Any two of the three participants jointly authorize nuclear weapons, while no single participant can use nuclear weapons. A secret sharing scheme can solve this kind of access control problem. This example is a typical $(2, 3)$ threshold secret sharing scheme.

Blakley ^[1] and Shamir ^[2] first proposed the concept of secret sharing in 1979. The basic idea of secret sharing is to encrypt secret information into multiple shadow images or shares and distribute them to multiple participants. Only a subset of authorized participants can decrypt the secret, while nonauthorized subsets cannot. In the secret sharing scheme composed of multiple participants, the secret is divided into multiple shadow images and distributed to the corresponding participants. A secret sharing algorithm generally includes two stages: share or generate and recover.

The original secret sharing scheme only focused on the bitstream without considering the specific meaning of these bits. With the increasing emphasis on multimedia security, the relationship between multimedia and encryption is becoming closer and closer. As one of the most important digital media carriers, image-sharing technology is becoming more and more popular. Secret image sharing(SIS) originates from secret sharing, which extends the object of secret sharing to digital images. Secret image sharing is a technology that links secret sharing and images.

Inspired by Shamir's work, Thien and Lin ^[3] first used Shamir's polynomial-based secret sharing to process digital images in 2002. Thien and Lin embed secret pixels in all $k-1$ polynomial coefficients and encrypt the secret image into a shadow image whose size is $1/k$ times that of the original image. This scheme reduces the size of noise like shadow images and is more suitable for fast transmission in the distributed storage environment. After Thien and Lin, polynomial based secret image sharing methods with more properties have been proposed, such as general access structure ^[4], extended shadow images ^[5,6], lossless recovery ^[7,8,9], multi secret sharing ^[10,11], two in one recovery ^[12,13], authentication function ^[14], no pixel expansion ^[15,16,17], etc.

Traditional SIS schemes generate noise like shadow images, which are challenging to manage and easily arouse the suspicion of attackers in network channel transmission. More and more researchers begin to consider making secret image sharing schemes generate understandable and meaningful shadow images, that is, extended secret image sharing (ESIS) schemes with understandable shadow images. The initial ESIS scheme is a combination of SIS and steganography. Generally, the method used encodes the noise-like shadow images generated by SIS into the cover images ^[18,19,20]. Lin and Chan ^[18] generate shadow images based on polynomial SIS and embed the shadow images into the lowest bit of the cover image. He et al. ^[19] used LOCOI compression to reduce the statistical correlation of adjacent pixels, generated the shadow image based on polynomial SIS, and embedded the shadow image into the cover image by steganography. The disadvantage of this method is that the generated shadow image looks like an image, the capacity of the secret image is small, and the information needs to be extracted before decryption. Different from the above schemes, the author's team also designed the SIS scheme ^[5] for comprehensible shadow images by using the random number screening mechanism. The general idea is to randomly screen the polynomial coefficients until it is obtained that the first $\delta$ bit of the shadow pixel is equal to the first $\delta$ bit of the cover image. On the basis of the Shamir polynomial, $P$ is required. Unlike most other secret image sharing schemes that set $P = 251$, the author's team set $P = 257$, limiting all values to $[0,256]$. Even if the shadow value is $[251,255]$, the pixel value within the range can be recovered normally, which improves the quality of the shadow image to a certain extent, especially for extreme images.

At present, most secret image sharing schemes deal with spatial images (such as BMP format images), while there are very few secret sharing schemes for the compressed domain. JPEG image is the most popular digital image format on the Internet. The field of JPEG image steganography is developing in full swing ^{[21,22,23,24,25]}, but there is little research on secret image sharing of JPEG images. The author's team has made a preliminary exploration of JPEG secret image sharing. Sun of the author's team first proposed a secret image sharing scheme for JPEG images. Sun's scheme ^[26] has the following disadvantages: the translation value of the DCT coefficient is 1024, $P = 2053$, which makes the complexity of sharing algorithm very high; When selecting the sharing area, the scheme is 8 in the upper left corner $8 \times 8$ or $4 \times 4$, and for the quantized coefficients, most of the signals are concentrated in the middle and low-frequency components in the upper left corner, and their arrangement is more in line with the zigzag arrangement while selecting a square block will cause a waste of resources; The most significant disadvantage of the scheme is that sun's scheme ^[26] only aims at the color JPEG image with $QF = 100$, and the sharing effect is good. The values of the quantization table with $QF = 100$ are all 1. Before quantization, the DCT coefficient is equal to the DCT coefficient after quantization, and there is no loss caused by rounding.

The existing SIS scheme for JPEG images only performs well for JPEG images with $QF = 100$. In contrast, the shadow image quality generated for JPEG images with other QF is poor. Besides, the algorithm complexity is very high.

Our motivation is to propose a $(k, n)$ threshold SIS meaningful secret image sharing scheme for JPEG images with arbitrary quality factors to overcome the above problems. To overcome the problem of the high algorithm complexity of the existing JPEG secret image sharing scheme, we made improvements. We calculate the minimum prime number P according to the specific secret image and cover images, reduce p to the minimum value, reduce the screening space of random numbers, and reduce the complexity of the algorithm in the secret image sharing based on polynomial. This paper selects the first 4, 9, or 16 bits after the zigzag arrangement of DCT coefficients when selecting the sharing area, which is more in line with the arrangement law of DCT coefficients after quantization and avoids the waste of computing resources. The most crucial point is that the existing technology only works well for JPEG images with $QF = 100$, and the technology has significant limitations and cannot be popularized and applied. The compression factor of JPEG images targeted in this application can be any value between 0–100. A secret image sharing scheme for JPEG images with arbitrary compression factors is proposed, and shadow images with high image quality and restored secret images are obtained.

The following sections are organized as follows. Section 2 introduces the encoding process of JPEG images, polynomial-based SIS, and random elements utilization model. The proposed $(k, n)$ threshold SIS meaningful secret image sharing scheme for JPEG images with arbitrary quality factors is presented in Section 3. Section 5.1 illustrates the details of the experiments and comparisons. And Section 6 is the conclusion.

2.   Preliminaries

2.1.   JPEG images

To study the SIS scheme for JPEG images, we must start with JPEG image coding. Here we introduce the process of JPEG coding.

The first process of JPEG image coding is preprocessing, including color space transformation, downsampling, and block segmentation. JPEG image coding first converts the color space of the spatial image into $Y^{'}cbcr$ color space. $Y^{'}$ component represents the brightness of pixels, and cb and cr components represent chromaticity (divided into blue and red components). Then, the image is effectively compressed by reducing cb and cr components (called "downsampling"). The gray image is discussed later, which does not consider the process of color conversion and downsampling, but only the rest of the compression process. The image is segmented to $8 \times 8$, which is processed separately in the following compression process.

Next are the core steps of JPEG image coding: value translation, discrete cosine transform (DCT), quantization, and entropy coding. Value translation is to move the spatial pixel value from the positive range to the range centered on zero before calculating the DCT of the $8 \times 8$ block. For gray-scale images, each pixel in the original spatial block is $[0,255]$, the translation value is 128, and the range of spatial pixel block after translation is $[-128,127]$. $\mathit{\boldsymbol{S}}$ represents the spatial pixel matrix, and $\mathit{\boldsymbol{M}}$ represents the matrix after value translation, then the formula of value translation is shown in Eq (2.1).

DCT transform gathers most signals in one corner of the result. The element in the top left corner is the DC coefficient, which is quite large compared with other values. The remaining 63 coefficients are AC coefficients. DCT transform can concentrate the low-frequency component in the upper left corner and the high-frequency component in the lower right corner. The primary information is concentrated in the medium and low-frequency components. Let $\mathit{\boldsymbol{M}}$ be the $8 \times 8$ spatial matrix for DCT transformation, then the matrix representation of DCT transformation is shown in Eq (2.2). $\mathit{\boldsymbol{F}}$ represents the matrix after DCT transformation. The DC component in the upper left corner of $\mathit{\boldsymbol{F}}$ saves a large value, and the AC component is close to 0.

Where $\mathit{\boldsymbol{T}}$ is the discrete cosine transform matrix and $\mathit{\boldsymbol{T^{T}}}$ is the transpose matrix of $\mathit{\boldsymbol{T}}$. The discrete cosine transform matrix $\mathit{\boldsymbol{T}}$ is shown in Eq (2.3).

Human eyes are good at seeing slight differences in brightness in large areas but not at distinguishing high-frequency brightness changes. Reducing the amount of information in high-frequency components can effectively compress pictures. Quantization is to divide each DCT coefficient by the corresponding constant in the quantization table. The quantization table $\mathit{\boldsymbol{QM}}$ used in actual quantization is calculated by the standard quantization matrix and the specified quality factor (QF) (The calculation method is shown in Eq (2.4)). The elements in the quantization table control the compression ratio, and larger values produce more extensive compression. Then round to the nearest whole number. Many high-frequency components are rounded to zero, while many other components become small positive or negative numbers. The rounding operation is the only lossy operation in the whole compression process.

$Q_{0}\left(u, v\right)$ represents the quantization step at the position $\left(u, v\right)$ in the standard quantization table.

Finally, the quantized value is entropy coded. Entropy coding is a lossless coding that differentially encodes the quantized DC coefficients. The quantized AC coefficients are arranged in a zigzag, then the data is compressed by 0 run-length coding, and finally, the compressed JPEG image code stream is obtained by Huffman coding.

JPEG image decoding is the inverse of the encoding process. The core steps include entropy decoding, inverse quantization, inverse discrete cosine transform (IDCT), and value translation. Firstly, the JPEG entropy is decoded to obtain the quantized DCT coefficient, then multiplied by the DCT coefficient from the quantization table before quantization. The inverse discrete cosine transform is performed and rounded, and finally, each element of the DCT coefficient is added with 128 to obtain the decompressed spatial image.

2.2.   Polynomial-based SIS

The scheme proposed in this paper is to share some DCT coefficients of JPEG images as secret information based on polynomial-based SIS. This section introduces polynomial-based SIS.

In 1979, Shamir ^[2] and Blakley ^[1] independently proposed a secret sharing scheme based on polynomials, then Thien and Lin ^[3] applied polynomial-based secret sharing to SIS for the first time in 2002. In $(k, n)$ threshold polynomial-based SIS, any $k$ or more shares can recover the secret, while any $k-1$ or fewer shares couldn't reconstruct the secret. Equation (2.5) shows the definition of the polynomial, where $a_0$ is the secret, and the remaining $k-1$ coefficients are randomly chosen from the field of $GF(P)$. Lagrange interpolation is used in the recovery phase to reconstruct the secret, as shown in Eq (2.6).

Using polynomial-based SIS for JPEG images is different from the spatial domain. The quantized DCT coefficients of JPEG images have negative numbers, which can not be dealt with in the traditional polynomial-based SIS schemes. It is necessary to translate the quantized DCT coefficients to the positive range. In addition, the modulus $P$ in the polynomial is generally taken as 257 for grayscale images because the pixel value range is [0–255]. However, in the polynomial-based SIS scheme for JPEG images, the quantized DCT coefficients range from -1024 to 1023. Therefore, the $P$ value needs to select the appropriate prime number according to the situation.

2.3.   Random elements utilization model

We will use the random elements utilization model to generate meaningful shadow images in the following. Here we introduce the random elements utilization model.

According to the principle of polynomial-based SIS, coefficients $a_t$ $(1\leq t \leq k-1)$ are selected randomly to obtain shared values, and different coefficients $a_t$ can get different shared values. Coefficients $a_t$ can be regarded as random elements to obtain a specific shared value in the sharing process.

To get meaningful shadow images, we establish random elements utilizing model as Eq (2.7). Where $f_{i}(s, a_{1}, \cdots, a_{k-1})$ is the $i-$th shared value of secret $s$ with random elements $a_t, t = 1, 2 \cdots k-1$, and $c_i$ represents the corresponding value in the cover image. $B_{\delta}\left(f_{i}\left(s, a_{1}, \cdots, a_{k-1}\right)-c_{i}\right)$ denotes that there are $\delta$ similar bits between $f_{i}(s, a_{1}, \cdots, a_{k-1})$ and $c_i$, from high to low bit plane.

In the sharing process, meaningful shadow images can be obtained if the above model conditions can be met. Moreover, the larger the value of $\delta$ is, the more similar the shadow image is to the cover image. The branch and bound method or Monte Carlo method can solve the above model.

3.   The proposed scheme

This section proposes a $(k, n)$ threshold meaningful SIS scheme for JPEG images, including sharing and recovery processes. The object of the operation is the quantized DCT coefficients of JPEG images in the process of compression coding.

In the sharing phase, given a secret JPEG image and chosen $n$ cover JPEG images, the proposed scheme is to operate on the DCT coefficients of the JEPG image in the process of compression coding. Firstly, a secret JPEG image and $n$ cover JPEG images are entropy decoded to obtain the corresponding quantized DCT coefficients, and the quantized DCT coefficients are divided into $8 \times 8$ blocks. Then, each block is zigzag arranged, and the first $num$ bits of the data after the zigzag arrangement are extracted as the secret to be shared. The sharing process of the proposed scheme is shown in Figure 1, the schematic diagram of processing DCT coefficients is shown in Figure 2, and the specific algorithm is shown in Algorithm 1.

In the recovery phase, we first obtain the quantized DCT coefficients by entropy decoding $k$ or more than $k$ shares and divide them into blocks of $8 \times$8. Then zigzag arranges each block and extracts the first $num$ bit of the data after zigzag arrangement as a candidate recovery object. Next, all DCT coefficients are translated to the positive range according to $\left|min\right|$ determined in the sharing process. The secret $num$ bits of each block are recovered by Lagrange interpolation and translated inversely. Then add $64-num$ zeros in each DCT block. Finally, entropy encoded the DCT blocks to obtain the recovered JPEG image. The recovery process of the proposed scheme is shown in Figure 3.

4.   Performance analysis

4.1.   Security analysis

Because the proposed $(k, n)$ threshold meaningful SIS scheme for JPEG images is constructed based on Shamir's traditional polynomial-based secret sharing, it retains the unconditional security of traditional polynomial-based secret sharing.

Theorem 1. When $k$ or less than $k$ shadows are collected, the secret DCT coefficients can't be recovered.

Proof. According to the polynomial secret sharing principle, the secret value is obtained by calculating a $k-1$-degree polynomial expression with a $k$ unknown variable. If $k$ or less than $k$ shadows participate in the recovery, there are be $k$ values that satisfy the Lagrange interpolation expression. Therefore, the secret DCT coefficients can not be recovered when $k$ or less than $k$ shadows are collected.

4.2.   Visual quality analysis

For the proposed scheme, the parameters affecting the quality of the shadows and the recovered secret image are expressed as a quintuple $(k, n, \delta, num, QF)$. Where $(k, n)$ represents the threshold parameter, and $\delta$ denotes the number of similar bits in the DCT coefficient between the shares and the cover images, $num$ represents the number of shared coefficients in each block, $QF$ is the compression factor of the secret JPEG image.

In the proposed scheme, the secret recovery image is lossy. There are two reasons as follows:

● The secret image is distorted in the sharing process. The DCT block of each secret JPEG image only shares the first $num$ bit data after the zigzag arrangement, not all DCT coefficients. For the convenience of calculation, $num$ is usually a square number. In addition, the quantized DCT coefficient matrix signal is concentrated in the upper left part, so $num$ is preferably less than 32. Therefore, $num$ is generally set to 4, 9, or 16.

● The secret image is distorted in the recovery process. There are 64 bits in each DCT block, while $num$ bits can be recovered, and the remaining $64 - num$ DCT coefficients are filled with zeros.

Based on the above analysis, we discuss the following three situations:

1) When $(k, n, \delta, QF)$ is set as non-constant, the smaller the $num$ is, the fewer DCT coefficients are shared, and the more DCT coefficients of the cover image are retained. The higher the similarity between the shadow image and the cover image is. However, the smaller the $num$ is, the more zeros will be filled, so the lower the quality of the restored secret image.

2) When $(k, n, num, QF)$ is fixed, the higher the $\delta$ is, the higher the quality of the shadow image is. Because there are more similar bits in DCT coefficient between the shares and the cover images, the $\delta$ is limited by the $(k, n)$ threshold to generate meaningful shadow images. When the prime number is set to $P$, there are $(P-1)^{k-1}$ possible shadow value sequences for the DCT coefficients currently processed. The relationship between $(k, n, P, \delta)$ should satisfy Eq (4.1).

3) When $(num, P, QF)$ is non-constant, the PSNR of the restored secret image is the same no matter how $(k, n, \delta)$ changes. The number of DCT coefficients of each block shared determines the amount of secret information carried by the shadow image carries. The amount of secret information in the recovered secret image is also constant.

5.   Experimental results and analysis

To verify the effectiveness of the proposed scheme, we implemented some experiments. The performance results will be exhibited in Subsection 5.1. The experimental images in the section are chosen from BOSSbase1.0.5 ^[27]. Grayscale images with $256 \times 256$ are randomly selected and converted into JPEG images with compression factors of 40, 50, 60, 70, 75, and 80. The function of read() and write() in the JPEGIO package is used to simulate entropy decoding and entropy coding. In addition, the proposed scheme is compared with Yan et al.'s scheme in Subsection 5.2.

5.1.   Experimental results

To show the effect of the proposed scheme more comprehensively, we carried out experiments from the following two aspects in this subsection. First, different thresholds should be taken into consideration. Besides, the quintuple $(k, n, \delta, num, QF)$ may also influence the performance of the experiments.

Figure 4 illustrates the results of $(3, 4)$-threshold meaningful SIS scheme for JPEG images, where $\delta = 3$, $num = 9$, $id = [11, 13, 19, 21]$ ($id$ is actually the value of $x$ in the polynomial, which refers to $x_i$ in Eq (2.6)), $QF = 75$. The secret grayscale JPEG image with the size of $256 \times 256$ and $QF = 75$ is shown in Figure 4a. Figure 4c–f show the four grayscale JPEG images with the size $256 \times 256$ as the input cover images. Four shadow JPEG images changed from cover images are shown in Figure 4g–j. Figure 4b shows the recovered secret JPEG image.

Figure 5 exhibits the results of $(3, 3)$-threshold meaningful SIS scheme for JPEG image, where $\delta = 4$, $num = 9$, $id = [11, 13, 19]$, $QF = 75$. Figure 5a is a secret grayscale JPEG image with the size of $256 \times 256$ and $QF = 75$. Figure 5b–d show the three grayscale JPEG images with the size $256 \times 256$ as the input cover images. Figure 5e–g show three shadow JPEG images. The recovered secret JPEG image is displayed in Figure 5h.

Figure 5 shows our $(2, 2)$-threshold scheme, where $\delta = 3$, $num = 9$, $id = [11, 13]$, $QF = 75$. Figure 6a displays the secret grayscale JPEG image of $256 \times 256$ and $QF = 75$. Figure 6b, c show the grayscale JPEG cover images with the size $256 \times 256$. Figure 6d, e show two JPEG shadow images. The recovered secret JPEG image is shown in Figure 6f.

Table 1 shows visual quality of shadow images under different parameter selections. The variation trend of PSNR of shadow images and recovered secret image with parameters $num$ and $QF$ are shown in Figures 7 and 8, respectively.

From Figures 4–8 and Table 1, we can draw the following conclusions:

1) Our proposed SIS scheme for JPEG images is effective, and the shadow images are meaningful.

2) The factors affecting the visual quality of shadow images and recovered secret image are consistent with the performance analysis in Subsection 4.2.

3) When $(k, n, \delta)$ is fixed, the larger the $num$ is, the lower the PSNR of the shadow images are, and the higher the recovered secret image's quality.

4) When $num$ is the same, the PSNR of the recovered secret image remains unchanged.

5) With the increase of $QF$, the visual quality of the shadow images is better, while the recovered secret image's quality decreases slightly.

5.2.   Comparison with Yan et al.'s works

In a sense, the work proposed in this paper can be regarded as a robust secret image sharing scheme for spatial images against JPEG compression, as shown in Figure 9. Our $(3, 3)$ threshold JPEG oriented secret image sharing scheme can be regarded as follows: the spatial image "S.bmp" is first compressed into "S.jpg" by the channel with $QF = 75$; "S.jpg" generates "SC1.jpg", "SC2.jpg" and "SC3.jpg" after the SIS for JPEG images generation algorithm proposed in this paper. These three images are equivalent to "SC1.bmp", "SC2.bmp" and "SC3.bmp" through channel compression with $QF = 75$. During restoration, "SC1.jpg", "SC2.jpg", "SC3.jpg" restore the secret image through the restoration algorithm of the scheme proposed in this paper to obtain "S*.jpg" and finally compresses it to the airspace to obtain "S*.bmp". This restoration process is equivalent to restoring the secret image from the decompressed spatial image "SC1.bmp", "SC2.bmp" and "SC3.bmp" to obtain "S*.bmp". The whole process corresponds to the scheme proposed by Yan et al. (As shown in Figure 10).

Therefore, here we compare our scheme with Yan et al.'s work ^[28]. Yan et al. implemented a robust secret image sharing scheme with $(k, n)$ threshold without pixel expansion based on the Chinese Remainder Theorem and error-correcting codes. The scheme uses the method of random screening mechanism to integrate the process of shadow image generation with the process of generating error correction code and generating error correction code while generating shadow so that the generated shadow image itself has internal error correction ability. Considering that the general noise or attack will affect the lower bits of the shadow pixel, such as the lower four bits, the scheme forms an error correction relationship between the lower four bits of the previous pixel and the upper four bits of the next adjacent pixel in the process of generating the shadow, so when the lower four bits of the second pixel are wrong, The high four bits of the previous pixel can correct its error (provided that the noise or attack has little impact on the high four bits, and the high four bits are relatively stable and will not change). In this way, the pixels of the shadow image are generated in turn. And a cascading error correction relationship is formed between the pixels. A slight disadvantage is that the error of the lower four bits of the last pixel cannot be corrected. The scheme realizes the $(k, n)$ threshold and is robust to JPEG compression.

Figure 11 shows the results of the robust $(3,3)$ threshold SIS scheme proposed by Yan et al., where $m1 = 253$, $m2 = 254$, $m3 = 255$, $HL = 8$, $QF=100$. Figure 11(a) is the secret image. One shadow image generated is shown in Figure 11(b). The image of the shadow image after JPEG compression with $QF = 100$ is shown in Figure 11(c). Figure 11(d) displays the difference between the shadow image and the compressed image. The recovered secret image is shown in Figure 11(e).This paper proposes the $(k,n)$-threshold SIS scheme for JPEG images with meaningful shares. The proposed scheme can be regarded as a robust SIS scheme for spatial images against JPEG compression. As shown in Figure 5, the PSNR of the recovered secret image in our proposed with $QF = 75$ is higher than that in Yan et al.'s scheme with $QF = 100$. So the proposed SIS scheme for JPEG images has better robustness to JPEG compression. In addition, compared with the Yan et al.'s scheme, the shadow image in our scheme is meaningful and can be applied to JPEG images of any $QF$.

The scheme of Yan et al. ^[28] is not powerfully robust to JPEG compression because its scheme is designed on the premise that the attack has little impact on the higher bits of the pixel (relatively stable and will not change). This assumption is more consistent with Gaussian noise's impact on the pixel than the impact of JPEG compression on the image. JPEG compression will affect all pixels of the shadow image; When the pixel values before and after compression do not change, there is a specific error correction capability between adjacent pixels. If one of them changes, the error correction capability will be destroyed.

6.   Conclusions

This paper proposed a $(k, n)$ threshold meaningful SIS scheme for JPEG images, which can apply to JPEG images of any $QF$. Starting with the study of JPEG image encoding and decoding, this paper realizes the SIS scheme for JPEG images. Besides, we analyze the reasons for the loss of recovered secret images. We further analyze the impact of the parameters $(k, n, \delta, num, QF)$ on the quality of shadow images and recovered secret image. The experimental results indicate the effectiveness of the scheme. The scheme has good characteristics, such as $(k, n)$ threshold and extended shadow images. It can effectively share JPEG images with arbitrary compression factors. In future work, we will focus on a robust SIS scheme against JPEG recompression.

Acknowledgments

This research is funded by the National Natural Science Foundation of China (Grant Number: 61602491).

Conflict of interest

The authors declare there is no conflict of interest.