Efficient reversible data hiding in encrypted image with public key cryptosystem

Abstract

This paper proposes a new reversible data hiding scheme for encrypted images by using homomorphic and probabilistic properties of Paillier cryptosystem. The proposed method can embed additional data directly into encrypted image without any preprocessing operations on original image. By selecting two pixels as a group for encryption, data hider can retrieve the absolute differences of groups of two pixels by employing a modular multiplicative inverse method. Additional data can be embedded into encrypted image by shifting histogram of the absolute differences by using the homomorphic property in encrypted domain. On the receiver side, legal user can extract the marked histogram in encrypted domain in the same way as data hiding procedure. Then, the hidden data can be extracted from the marked histogram and the encrypted version of original image can be restored by using inverse histogram shifting operations. Besides, the marked absolute differences can be computed after decryption for extraction of additional data and restoration of original image. Compared with previous state-of-the-art works, the proposed scheme can effectively avoid preprocessing operations before encryption and can efficiently embed and extract data in encrypted domain. The experiments on the standard image files also certify the effectiveness of the proposed scheme.

1 Introduction

Reversible data hiding (RDH) is an efficient technology for cover authentication or content integrity verification [1–3] in which the hidden data can be extracted completely and the original carrier can be recovered losslessly after data extraction. With this property, reversible data hiding is widely applied in such areas as medical imagery, military imagery, and law forensics. Reversible data hiding algorithms are generally classified into three categories by using lossless compression [4, 5], difference expansion [6, 7], and histogram shifting [8, 9]. RDH technique is further developed by making good use of new prediction error algorithms and embedding strategies [10–12], which have higher payload and better image quality.

For the sake of information security and privacy protection, data are usually encrypted before upload and transmission. Encryption, which is one of the most powerful method for content protection, can convert original data into unintelligible ciphertexts. It is especially useful in scenarios that content owner is unwilling to expose their sensitive data or private information to untrusted channel and database. On the administrator side, additional data such as content-related keywords, information features, or authentication data are desired to be embedded directly into the encrypted data for the convenience of management and security protection. What is more, content owner still expects that the original cover can be restored perfectly since any distortion is tolerated in many applications. To this end, reversible data hiding in encrypted images (RDHEI) emerges. RDHEI is a technology which implements data hiding procedure in encrypted domain and can recover the original plaintext without error after decryption and data extraction. Owning to this merit, RDHEI has been a research hotspot in information security community recently. In [13], Zhang encrypted image with a standard stream cipher and further divided the encrypted image into blocks, each of which contains two groups. One bit can be embedded by flipping three LSBs of each pixel in the corresponding group. Zhang’s method was improved by using a different estimation equation so as to better exploit the spatial correlation [14] and different flipping rates [15]. In order to extract the hidden data directly in encrypted domain, Zhang proposed a separable RDHEI which compresses the LSBs of encrypted image with a source coding method to accommodate additional data [16]. Besides, RDHEI for JPEG image has been presented in [17]. To improve the embedding performance, spare room for data hiding was created by implementing self-embedding or compression before encryption [18, 19]. In [20], Qian et al. vacated room after encryption with a distributed source encoding operation, which can avoid to pre-process original image before encryption and has a high capacity. The RDHEI methods mentioned above focus on symmetric cryptosystem. The data encrypted with stream cipher symmetric cryptosystem is hardly for the cloud computing.

Different from symmetric cryptosystem, public key cryptosystem with probabilistic and homomorphic properties, which allows us to conduct operations directly on ciphertexts to generate the expected result, is more powerful in secure signal processing. For example, mass data of an enterprise can be uploaded to the cloud after encryption for statistical analysis services from the third party, e.g., the enterprise can get corresponding annual turnover (sum of plain data) and growth (difference of plain data) from the cloud without any information leakage by utilizing Paillier cryptosystem [21]. Secure signal processing with public key cryptosystem can bring us great benefits.

In the literature, there are a few works on signal processing in encrypted domain with public key cryptosystem [22–26], and two of them have applied Paillier public key cryptosystem for reversible data hiding [25, 26]. In [25], Chen et al. first raised a novel RDHEI method with public key cryptography by dividing a pixel into two parts: LSB and the rest. Image owner encrypted these two parts with Paillier mechanism and transmitted them to data hider. In this way, the transmitted data in size will be twice of the directly encrypted image. One bit can be embedded in encrypted domain by modifying magnitude relationships between the encrypted LSB values of two adjacent pixels with homomorphic multiplication. Since the magnitude relationships can not be kept for the corresponding ciphertexts, the hidden data cannot be extracted before decryption. Aiming at retrieving the hidden data in encrypted domain, Zhang et al. proposed a new reversible data hiding algorithm with public key cryptosystem [26] by using a pre-procession operation to shrink histogram of original image to vacate room for data hiding. After encryption, data hider first embedded additional data into the reserved room so that additional data can be extracted in the plaintext domain. In order to extract data in the encrypted domain in [26], the authors ingeniously applied probabilistic property of Paillier cryptosystem with multi-layer wet paper code (WPC) [27] strategy so that the additional data can be hidden into and extracted from the bit-planes of ciphertexts.

This paper proposes a new reversible data hiding scheme in the homomorphic encrypted domain with public key cryptosystem. The main idea is that groups of two selected pixels are encrypted in a way that two pixels in a group are encrypted with two selected parameters by exploiting the probabilistic property. In such a way, the absolute differences of groups of two pixels are reserved and can be retrieved from encrypted domain by implementing a modular multiplicative inverse method and looking for a mapping table. After that, additional data can be embedded into encrypted image by using the homomorphic property to shift histogram of the absolute differences. On the receiver side, legal receiver can extract the marked histogram in encrypted domain in the same way as data hiding procedure. The hidden data can be extracted from the marked histogram and the encrypted image without hiding data can be restored by using an inverse operations of histogram shifting. Besides, the marked absolute difference can be computed after decryption, and then data extraction and image restoration operations can be accomplished perfectly. By using standard example images as data set, extensive testing has been implemented for performance evaluation. The proposed scheme has the following highlights:

• 1. Preprocessing operations on original image for data hiding can be effectively avoided before encryption. This is beneficial to protect image content privacy in preprocessing procedure. More importantly, the proposed scheme is more scalable due to the avoidance of preprocessing operations.

• 2. The data can be directly inserted into and extracted from encrypted images with private key. This is useful for cloud computing services while protecting image privacy in the cloud. In the literature, it is a dilemma to extract the hidden data in encrypted domain with public key cryptosystem. In this paper, we have presented a solution.

• 3. Compared with the previous work [26], the hidden data in the proposed one has stronger security performance in encrypted domain because the data are embedded into plaintexts by using the homomorphic property instead of embedded into the information into bit-planes of ciphertexts [26].

This paper is very useful since the data hiding scheme can be used for both privacy protection and cloud computing due to homomorphic and probabilistic properties of Paillier cryptosystem.

The remainder of this paper is organized as follows. A brief introduction of Paillier cryptosystem is given in Section 2. Then, the details of the proposed reversible data hiding scheme is elaborated in Section 3. Experiment results and performance comparison are given in Section 4. Finally, we draw a conclusion in Section 5.

2 Paillier cryptosystem and modular multiplicative inverse method

2.1 Paillier cryptosystem

Paillier cryptosystem [21], which has homomorphic and probabilistic properties, has been widely used in secure computation fields. In Paillier cryptosystem, a plaintext is encrypted with the same public key and different ciphertexts can be obtained since the parameter is selected randomly. The same plaintext, of course, can be retrieved after decrypting corresponding ciphertexts with private key. Hence, Paillier cryptosystem can achieve semantic security. Besides, homomorphic multiplication is permitted in Paillier cryptosystem, meaning that decrypted product of two ciphertexts is equal to the sum of two corresponding plaintexts. It provides an efficient approach to process the original data in encrypted domain. The following is the details of Paillier cryptography.

Key generation: Select two large primes p and q randomly. Compute N=pq and λ=lcm(p−1,q−1), where lcm(·) is a function for calculating the least common multiple of two inputs. And then, randomly select $g\in \mathbb {Z}_{N^{2}}^{*}$, which meanwhile satisfies

$$ gcd\left(L\left(g^{\lambda}\text{ mod }N^{2}\right),N\right)=1 $$

(1)

and

$$ L(x)=\frac{x-1}{N} $$

(2)

where gcd(·) is to derive the greatest common divisor of two inputs, $\mathbb {Z}_{N^{2}}^{*}$ is denoted as the subset of $\mathbb {Z}_{N^{2}}$ in which elements are all relatively prime with N ² and $\mathbb {Z}_{N^{2}} = \left \{0,1,2,\ldots,N^{2} -1\right \}$. Finally, we get the public key (N,g) and corresponding private key λ respectively.

Encryption For each original data $m\in \mathbb {Z}_{N}$, select an integer $r\in \mathbb {Z}_{N}^{*}$ randomly. Denote encryption function as E[·]. The corresponding ciphertext c can be obtained by

$$ c = E\left[m,r\right]=g^{m} r^{N}\text{ mod }N^{2} $$

(3)

According to the property of Paillier cryptosystem, the ciphertext c is still in $\mathbb {Z}_{N^{2}}^{*}$.

Decryption Denote the decryption function as D[ ·]. With corresponding private key λ, the original plaintext m can be derived by

$$ m = D[\!c]= \frac{L\left(c^{\lambda}\text{ mod }N^{2}\right)}{L(g^{\lambda}\text{ mod }N^{2})}\text{mod}N $$

(4)

Furthermore, the two important properties of Paillier cryptosystem (which have been applied in the proposed method) are introduced as follows:

Lemma one: The function E[m,r] is bijective when g obeys Eq. (1). For two plaintexts $m_{1},m_{2}\in \mathbb {Z}_{N}$, compute corresponding ciphertexts c ₁,c ₂ with r ₁,r ₂ according to Eq. (1). The Eq. c ₁=c ₂ holds if and only if m ₁=m ₂ and r ₁=r ₂.

Homomorphic multiplication: For $\forall r_{1},r_{2}\in \mathbb {Z}_{N}^{*}$, two plaintexts $m_{1}, m_{2}\in \mathbb {Z}_{N}$ and corresponding ciphertexts $E\left [m_{1},r_{1}\right ], E\left [m_{2},r_{2}\right ] \in \mathbb {Z}_{N^{2}}^{*}$ satisfy:

$$ E\left[m_{1},r_{1}\right]\cdot E\left[m_{2},r_{2}\right]=g^{m_{1}+m_{2}}\cdot (r_{1}\cdot r_{2})^{N}\text{ mod }N^{2} $$

(5)

and

$$ D\left[E\left[m_{1},r_{1}\right]\cdot E\left[m_{2},r_{2}\right]\text{ mod }N^{2}\right]=m_{1}+m_{2}\text{ mod }N $$

(6)

2.2 Modular multiplicative inverse method

For better description, we introduce the principle of modular multiplicative inverse (MMI) method first. For two coprime integers y and z, there exists an integer Θ satisfying

$$ \Theta\cdot y = 1\text{ mod }z, $$

(7)

where Θ is called as the modular multiplicative inverse of y. With a given y, the corresponding Θ can be computed efficiently via an Extended Euclidean algorithm [28]. According to the properties of MMI, the division operation can be implemented after modular operation. Assume another integer x and denote v as the product of x and y to the modulo z. x can be derived from the product v by multiplying y’s corresponding modular multiplicative inverse Θ,

$$ v\cdot \Theta = x\cdot y\cdot \Theta = x\text{ mod }z. $$

(8)

3 Reversible data hiding scheme with public key cryptosystem

Figure 1 plots the sketch of the proposed scheme, which is composed of four main phases: image encryption, data hiding, data extraction and image restoration. Firstly, image owner selects two pixels as a group with a key K _g to form groups of two pixels for encryption with Paillier cryptosystem by using public key K _p with two selected parameters (r ₁ and r ₂) for a group. Two pixels in a group are encrypted with r ₁ (randomly selected as descripted in Section 2) first. Then, one of the two pixels is further encrypted with r ₂ (controlled by a secret key K _s ). With K _g and K _s , data hider can calculate absolute differences of groups of two pixels by exploiting modular multiplicative inverse method and looking for a mapping table in encrypted domain. Then, additional data, after encryption, are embedded into the encrypted image by shifting histogram of the calculated absolute differences with a data hiding key K _d . With K _g , K _s , and K _d , receiver can extract the additional data from the histogram of absolute differences (which are computed in the same manner as data hiding procedure). With the private key K _c only, receiver can obtain an image similar to the original image after decryption. With both K _d and K _c , receiver can retrieve the hidden data from the histogram of absolute differences of pixel groups after decryption and recover the original image by implementing an inverse operation of histogram shifting. The remainder of this section elaborates the details of the proposed scheme.

Fig. 1

Sketch of the proposed reversible data hiding scheme with public key cryptography

3.1 Image encryption

According to the probabilistic property of Paillier cryptosystem, the parameter $r\in \mathbb {Z}_{N}^{*}$ is selected randomly for each plaintext to achieve semantic security. Since magnitude relationships among plaintexts can not be kept to the corresponding ciphertexts, it is still a dilemma to embed additional data directly into an encrypted image with such a cryptosystem. In this work, with the probabilistic property, we design a strategy to encrypt two pixels in a group by using a random parameter so as to reserve the difference of two plaintexts for data hiding in encrypted domain.

Firstly, groups of two selected pixels are chosen from original image I by using a key K _g . Denote the two pixels in k ^th group as P ₁(k) and P ₂(k), respectively. Data hider first randomly selects an integer $r_{1}{(k)}\in \mathbb {Z}_{N}^{*}$ and encrypts P ₁(k) and P ₂(k) with the public key (N,g) and Paillier cryptosystem.

$$ c_{1}{(k)} = E\left[P_{1}{(k)},r_{1}{(k)}\right]=g^{P_{1}{(k)}}{r_{1}{(k)}}^{N} \text{ mod }N^{2} $$

(9)

$$ c_{2}{(k)} = E\left[P_{2}{(k)},r_{1}{(k)}\right]=g^{P_{2}{(k)}}{r_{1}{(k)}}^{N} \text{ mod }N^{2} $$

(10)

where c ₁(k) and c ₂(k) are the corresponding ciphertexts of P ₁(k) and P ₂(k), respectively. To void the effect of using the same parameter for encrypting a group of two pixels, image owner selects another integer $r_{2}{(k)}\in \mathbb {Z}_{N}^{*}$ with a secret key K _s and implement a homomorphic multiplication operation on c ₂(k),

$${} c_{2}{(k)}{'} = c_{2}{(k)}\cdot E\left[0,r_{2}{(k)}\right]=g^{P_{2}{(k)}}{(r_{1}{(k)}\cdot r_{2}{(k)})}^{N} \text{ mod }N^{2} $$

(11)

Let D[c ₂(k)^′] be the decrypted version of c ₂(k)^′. According to Eqs. (5) and (6), D[c ₂(k)^′] satisfies

$$ D\left[c_{2}{(k)}{'}\right] = P_{2}{(k)}\text{ mod }N $$

(12)

Therefore, c ₂(k)^′ is still an encrypted version of P ₂(k). Data hider obtains c ₁(k) and c ₂(k)^′ as the cyphertexts of the k ^th group. Denote the encrypted image as E [ I].

3.2 Data hiding

With the encrypted image E [ I] and the group selection key K _g and the secret key K _s , data hider can retrieve ciphertext of the absolute difference of two plaintexts with a modular multiplicative inverse method, and then extract the absolute difference from the corresponding ciphertexts by looking for a mapping table (see Fig. 2) without private key K _c . Additional data can be embedded into E [ I] by shifting histogram of the absolute differences with a data hiding key K _d . Firstly, data hider divides E [ I] into groups in the same manner as image encryption procedure, and then retrieves the ciphertext group {c ₁(k),c ₂(k)^′}.

Fig. 2

Mapping table between an absolute difference and its ciphertext

3.2.1 Data embedding

With the property of MMI, ciphertext of the absolute difference between the two plaintexts P ₁(k) and P ₂(k) in the k ^th group can be calculated in encrypted domain. As described in Section 2, ciphertext c=E[m,r] can be obtained for each $m\in \mathbb {Z}_{N}$ according to Eq. (3) and $c\in \mathbb {Z}_{N^{2}}^{*}$. It means that E[0,r ₂(k)], c ₁(k) and c ₂(k) are coprime to N ². Denote the modular multiplicative inverse of E[0,r ₂(k)] as Θ _Er . Data hider first calculates Θ _Er (k) with the Extended Euclidean algorithm and Θ _Er (k) satisfies

$$ \Theta_{Er}{(k)}\cdot E\left[0,r_{2}{(k)}\right] = 1 \text{ mod }N^{2}. $$

(13)

Since c ₂(k)^′ is the product of c ₂(k) and E[0,r ₂(k)] according to Eq. (11), data hider derives c ₂(k) by multiplying c ₂(k)^′ with Θ _Er (k),

$${} c_{2}{(k)}{'}\cdot \Theta_{Er}=c_{2}{(k)}\cdot E\left[0,r_{2}{(k)}\right]\cdot \Theta_{Er}{(k)} = c_{2}{(k)} \text{ mod }N^{2}. $$

(14)

Furthermore, data hider computes the corresponding modular multiplicative inverse of c ₁(k) and c ₂(k), denoted as Θ ₁(k) and Θ ₂(k) respectively. Θ ₁(k) and Θ ₂(k) satisfy

$$ \left\{\begin{array}{ll} \Theta_{1}{(k)}\cdot c_{1}{(k)}=\Theta_{1}\cdot g^{P_{1}{(k)}}\cdot r_{1}{(k)}^{N} = 1\text{ mod }N^{2}\\ \Theta_{2}{(k)}\cdot c_{2}{(k)}=\Theta_{2}\cdot g^{P_{2}{(k)}}\cdot r_{1}{(k)}^{N} = 1\text{ mod }N^{2} \end{array}\right. $$

(15)

With Θ ₁(k) and Θ ₂(k), data hider calculates c ₁ k·Θ ₂(k), c ₂ k·Θ ₁(k), and the results are denoted as $c_{d_{1}}{(k)}$, $c_{d_{2}}{(k)}$,

$${} \left\{\begin{array}{ll} c_{d_{1}}{(k)}=c_{1}{(k)}\cdot\Theta_{2}{(k)}=g^{P_{1}{(k)}}\cdot r_{1}{(k)}^{N}\cdot \Theta_{2}{(k)}\text{ mod }N^{2}\\ c_{d_{2}}{(k)}=c_{2}{(k)}\cdot\Theta_{1}{(k)}=g^{P_{2}{(k)}}\cdot r_{1}{(k)}^{N}\cdot \Theta_{1}{(k)}\text{ mod }N^{2} \end{array}\right. $$

(16)

According to Carmichael’s theorem, Eq. (17) holds for any $\alpha \in \mathbb {Z}_{N^{2}}^{*}$ [21]

$$ \alpha^{N\lambda}=1\text{ mod }N^{2}, $$

(17)

where N is the product of two large primes p and q and λ=lcm(p−1,q−1). Hence, in the Paillier cryptosystem described in Section (2), $g\in \mathbb {Z}_{N^{2}}^{*}$ and $r_{1}\in \mathbb {Z}_{N}^{*}$ satisfy

$$ \left\{\begin{array}{ll} g^{N\lambda}=1\text{ mod }N^{2}\\ r_{1}^{N\lambda}=1\text{ mod }N^{2} \end{array}\right. $$

(18)

and

$$ g^{N\lambda}\cdot r_{1}^{N\lambda}=1\text{ mod }N^{2} $$

(19)

Combining Eq. (15) with Eq. (19), we can derive specific expressions of Θ ₁(k) and Θ ₂(k)

$$ \left\{\begin{array}{ll} \Theta_{1}{(k)}=g^{N\lambda-P_{1}{(k)}}\cdot r_{1}^{N(\lambda-1)}\text{ mod }N^{2}\\ \Theta_{2}{(k)}=g^{N\lambda-P_{2}{(k)}}\cdot r_{1}^{N(\lambda-1)}\text{ mod }N^{2} \end{array}\right. $$

(20)

With Eq. (18) and the expressions of Θ ₁(k), Θ ₂(k), Eq. (16) can be further simplified as (21) and (22) by considering the magnitude relation of P ₁(k) and P ₂(k),if P ₁(k)≥P ₂(k)

$$ \left\{\begin{array}{ll} c_{d_{1}}{(k)}=g^{P_{1}{(k)}-P_{2}{(k)}}\text{ mod }N^{2}\\ c_{d_{2}}{(k)}=g^{N\lambda +P_{2}{(k)}-P_{1}{(k)}}\text{ mod }N^{2} \end{array}\right. $$

(21)

else

$$ \left\{\begin{array}{ll} c_{d_{1}}{(k)}=g^{N\lambda +P_{1}{(k)}-P_{2}{(k)}}\text{ mod }N^{2}\\ c_{d_{2}}{(k)}=g^{P_{2}{(k)}-P_{1}{(k)}}\text{ mod }N^{2} \end{array}\right. $$

(22)

As a result, $c_{d_{1}}{(k)}$ in Eq. (21) and $c_{d_{2}}{(k)}$ in Eq. (22) are the encrypted version of the absolute difference between P ₁(k) and P ₂(k). Denote probable value of the absolute difference as d _p . Since data hider has the public key K _p =(N,g) and d ranges from 0 to 255, a one-to-one mapping table between d _p and $c_{d}=g^{d_{p}}\phantom {\dot {i}\!}$ can be obtained by

$$ c_{d_{p}}=g^{d_{p}}\text{ mod }N^{2}, d_{p}=0,1,\ldots,255 $$

(23)

The mapping table is given in Fig. 2. Without the private key K _c , data hider can look for this table to get a match of $c_{d_{1}}{(k)}$ if P ₁(k)≥P ₂(k) or $c_{d_{2}}{(k)}$ if P ₁(k)<P ₂(k). Denote the matched result as d(k), which is the corresponding absolute difference between the two plaintexts P ₁(k) and P ₂(k). Besides, data hider can get the magnitude relationships between P ₁(k) and P ₂(k). If $c_{d_{1}}{(k)}$ is matched with the mapping table, we have P ₁(k)≥P ₂(k); Otherwise, we have P ₂(k)>P ₁(k). Consequently, a histogram of the absolute differences between groups of two plaintexts is obtained as shown in Fig. 3 a.

Fig. 3

Data hiding by shifting the histogram of absolute differences. a Histogram of absolute difference. b Creating rooms for data hiding. c Data hiding with histogram shifting

Additional data can be embedded into the encrypted image E [ I] by shifting histogram of the absolute differences in several rounds. Assume n _e rounds are implemented and EP is the embedding bin in each round in referring to data hiding key K _d . To achieve a better performance, we suggest to select the peak point of the histogram as EP in each round. Data hiding procedure is accomplished as follows:If P ₁(k)≥P ₂(k),

$$ c_{1}^{w}{(k)}= \left\{\begin{array}{ll} c_{1}{(k)}\cdot g^{w}=g^{P_{1}{(k)}+w}\cdot r_{1}^{N}, & if~d(k)=EP\\ c_{1}{(k)}\cdot g^{1}=g^{P_{1}{(k)}+1}\cdot r_{1}^{N}, & if~d(k)\geq EP+1\\ c_{1}{(k)}, &else \end{array}\right. $$

(24)

$$ c_{2}^{w}{(k)}=c_{2}{(k)} $$

(25)

else

$$ c_{1}^{w}{(k)}=c_{1}{(k)} $$

(26)

$$ c_{2}^{w}{(k)}=\left\{\begin{array}{ll} c_{2}{(k)}\cdot g^{w}=g^{P_{2}{(k)}+w}\cdot r_{1}^{N}, &if~d(k)=EP\\ c_{2}{(k)}\cdot g^{1}=g^{P_{2}{(k)}+1}\cdot r_{1}^{N}, &if~d(k)\geq EP+1\\ c_{2}{(k)}, &else \end{array}\right. $$

(27)

where $c_{1}^{w}{(k)}$ and $c_{2}^{w}{(k)}$ are the ciphertexts after data hiding in k ^th group and w is one bit of the additional data. Denote decrypted versions of $c_{1}^{w}{(k)}$ and $c_{2}^{w}{(k)}$ as $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$ respectively. The effect of data hiding on plaintexts is to change P ₁(k), P ₂(k) to $P_{1}^{w}{(k)}$, $P_{2}^{w}{(k)}$:If P ₁(k)≥P ₂(k),

$$ P_{1}^{w}{(k)}=\left\{\begin{array}{ll} P_{1}{(k)}+w, &if~d(k)=EP\\ P_{1}{(k)}+1, &if~d(k)\geq EP+1\\ P_{1}{(k)}, &else \end{array}\right. $$

(28)

$$ P_{2}^{w}{(k)}=P_{2}{(k)} $$

(29)

else

$$ P_{1}^{w}{(k)}=P_{1}{(k)} $$

(30)

$$ P_{2}^{w}{(k)}=\left\{\begin{array}{ll} P_{2}{(k)}+w, &if~d(k)=EP\\ P_{2}{(k)}+1, &if~d(k)\geq EP+1\\ P_{2}{(k)}, &else \end{array}\right. $$

(31)

Here, we denote $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$ as the marked versions of P ₁(k) and P ₂(k). Obviously, we keep the relative magnitude of two pixels in each group unchanged after data hiding: $P_{1}^{w}{(k)}\geq P_{2}^{w}{(k)}$ if P ₁(k)≥P ₂(k) or $P_{1}^{w}{(k)}<P_{2}^{w}{(k)}$ if P ₁(k)<P ₂(k). Denote the absolute difference after data hiding as d _w (k). According to Eqs. (28), (29), (30) and (31), when d(k)≥EP+1, let d _w (k)=d(k)+1 create room for data hiding, as shown in Fig. 3 b. Let d _w (k)=d(k)+w hide the additional data if d(k)=EP, as shown in Fig. 3 c. If the receiver has the EP in each round, he/she can extract the hidden data and recover the original pixels with the inverse operation of embedding procedure.

Finally, data hider multiplies $c_{2}^{w}{(k)}$ with corresponding E[0,r ₂(k)] to encrypt the absolute difference properties according to K _s ,

$$ c_{2}^{w}{(k)}'=c_{2}^{w}{(k)}\cdot E\left[0,r_{2}{(k)}\right]\text{ mod }N^{2} $$

(32)

Denote the encrypted image with hidden data as E[I _w ].

By employing Paillier cryptosystem to encrypt a group of two pixels with two selected parameters, we have successfully reserved the absolute differences of plaintexts in encrypted domain. Data hider can retrieve the absolute differences and embed additional data directly into the encrypted image by shifting histogram of the absolute differences.

3.2.2 Security of image content in encrypted domain

Security of image content in encrypted domain is an important aspect that users are most concerned about. Here, we discussed the security problem by considering whether an attacker is with the secret key K _s :

Case one: If the user does not have K _s , there is no extra information can be extracted from the encrypted image since P ₁(k) and P ₂(k) were encrypted with two random integers r ₁(k) and r ₁(k)·r ₂(k). In this case, the proposed image encryption strategy has the same security performance as the standard encryption method in Eq. (3).

Case two: If someone (like the data hider) has the secret key K _s , he or she can extract the absolute differences of groups of two plaintext pixels. In this case, the differences of groups of two adjacent pixels may expose the high-frequency information of original image, as shown in Fig. 4 b. To solve this problem, we apply the following two group selection strategies:

Fig. 4

a Original image. b Absolute differences of groups of two adjacent pixels. c Absolute differences of groups of two adjacent pixels after a permutation operation on the encrypted image. d Absolute differences of groups of two randomly selected pixels

Strategy 1: Select two adjacent pixels as a group for encryption. This is followed by a permutation operation on groups of two encrypted pixels. With the permutation operation, the high-frequency information can be effectively covered, as shown in Fig. 4 c. Correspondingly, an inverse operation of permutation need to be implemented during the image restoration procedure.

Strategy 2: Randomly select two pixels as a group for encryption. The permutation operation in the strategy 1 is not needed. By randomly select two pixels as a group, there is no any information leaked from the absolute differences, as shown in Fig. 4 d.

3.3 Data extraction and image restoration

In the proposed scheme, data extraction and image restoration can be completed together by inverse operations of histogram shifting. For a receiver, there are two ways to extract the hidden data and restore original ciphertext image or plaintext image.

3.3.1 Extract hidden data and restore original ciphertext image in encrypted domain

With the data hiding key K _d and secret key K _s , receiver can retrieve the hidden data w and recover the directly encrypted image E [ I] from the received image E[I _w ]. The extraction and restoration procedures are described as follows:

• 1. For a legal receiver, the same group selection operation is first implemented on the received ciphertext image E[I _w ]. Denote the k ^th ciphtext group by $\left (c_{1}^{w}{(k)},c_{2}^{w}{(k)}'\right)$, which contains the hidden data w.

• 2. With the secret key K _s , receiver can get the corresponding parameter r ₂(k), and then compute E[0,r ₂(k)] referring to Eq. (3). Furthermore, Θ _Er (k), which is modular multiplicative inverse of E[0,r ₂(k)], is calculated with Extended Euclidean algorithm. Referring to Eqs. (13) and (32), $c_{2}^{w}{(k)}$ (which is the ciphertext of $P_{2}^{w}{(k)}$) is derived by

  $$ c_{2}^{w}{(k)}=c_{2}^{w}{(k)}'\cdot \Theta_{Er}{(k)}\text{ mod }N^{2} $$

  (33)

  Using the same method, receiver further computes $\Theta _{1}^{w}{(k)}$ and $\Theta _{2}^{w}{(k)}$, which are the corresponding modular multiplicative inverse of $c_{1}^{w}{(k)}$ and $c_{2}^{w}{(k)}$. Similar to extract the absolute difference in the data hiding procedure, receiver calculates $c_{d_{1}}^{w}{(k)}$ and $c_{d_{2}}^{w}{(k)}$ by referring to Eq. (16)

  $$ \left\{\begin{array}{ll} c_{d_{1}}^{w}{(k)}=c_{1}^{w}{(k)}\cdot\Theta_{2}^{w}{(k)}\text{ mod }N^{2}\\ c_{d_{2}}^{w}{(k)}=c_{2}^{w}{(k)}\cdot\Theta_{1}^{w}{(k)}\text{ mod }N^{2}, \end{array}\right. $$

  (34)

  and computes the mapping table beforehand by referring to Eq. (23). After searching $c_{d_{1}}^{w}{(k)}$ and $c_{d_{2}}^{w}{(k)}$ in the mapping table, we can retrieve d ^w(k), which is the absolute difference of the k ^th marked group $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$). This can be done to obtain the histogram of the absolute differences of all the groups. Besides, the magnitude relationships between $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$) are obtained by: If $c_{d_{1}}^{w}{(k)}$ is matched with the table, $P_{1}^{w}{(k)}\geq P_{2}^{w}{(k)}$; Otherwise, $P_{2}^{w}{(k)}> P_{1}^{w}{(k)}$.

• 3). With the data hiding key K _d , receiver can obtain the rounds of embedding n _e and the embedding point in each round EP. According to the corresponding EP and the magnitude relationships between $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$, additional data w can be extracted from the histogram,

  $$ w=\left\{\begin{array}{ll} 0, &if~d^{w}(k)=EP\\ 1, &if~d^{w}(k)= EP+1\\ \end{array}\right. $$

  (35)

  Accompanied with data extraction, the directly encrypted image E [ I] can be recovered without any error. Receiver calculates the modular multiplicative inverse of g via Extended Euclidean algorithm, denoted as Θ _g . Θ _g satisfies

  $$ \Theta_{g}\cdot g=1\text{ mod }N^{2} $$

  (36)

  According to the property of MMI, ciphertexts c ₁(k) and c ₂(k) before hiding data can be restored as follows:

  If $P_{1}^{w}{(k)}\geq P_{2}^{w}{(k)}$,

  $$ c_{1}{(k)}=\left\{\begin{array}{ll} c_{1}^{w}{(k)}\cdot \Theta_{g}\text{ mod }N^{2} &if~d^{w}(k)\geq EP+1\\ c_{1}^{w}{(k)}, &else \end{array}\right. $$

  (37)
  $$ c_{2}{(k)}=c_{2}^{w}{(k)} $$

  (38)

  else

  $$ c_{1}{(k)}=c_{1}^{w}{(k)} $$

  (39)
  $$ c_{2}{(k)}=\left\{\begin{array}{ll} c_{2}^{w}{(k)}\cdot \Theta_{g}\text{ mod }N^{2}, &if~d^{w}(k)\geq EP+1\\ c_{2}^{w}{(k)}, &else \end{array}\right. $$

  (40)

  where $c_{1}^{w}{(k)}\cdot \Theta _{g}$ in Eq. (37) is equal to $g^{P_{1}^{w}{(k)}-1}\cdot r_{1}{(k)}^{N}$ and $c_{2}^{w}{(k)}\cdot \Theta _{g}$ in Eq. (39) is equal to $g^{P_{2}^{w}{(k)}-1}\cdot r_{1}{(k)}^{N}$.Therefore, inverse operations of histogram shifting can be implemented.

• 4). After n _e rounds of data extraction and inverse operations of histogram shifting, the hidden data can be extracted perfectly and the original ciphertext image E [ I] can be restored.

3.3.2 Extract the hidden data and restore the original image after decryption

With the private key K _c and data hiding key K _d , receiver can extract the hidden data and recover the original image after decryption.

As described in Section 2, the ciphertext group $\left \{c_{1}^{w}{(k)},c_{2}^{w}{(k)}\right \}$ in the received encrypted image E[I _w ] can be decrypted by private key K _c =λ, formulated as

$$ P_{1}^{w}{(k)}=D\left[c_{1}^{w}{(k)}\right]= \frac{L\left(c_{1}^{w}{(k)}^{\lambda}\text{ mod }N^{2}\right)}{L\left(g^{\lambda}\text{ mod }N^{2}\right)}\text{ mod }N $$

(41)

and

$$ P_{2}^{w}{(k)}=D\left[c_{2}^{w}{(k)}\right]= \frac{L\left(c_{2}^{w}{(k)}^{\lambda}\text{ mod }N^{2}\right)}{L(g^{\lambda}\text{ mod }N^{2})}\text{ mod }N $$

(42)

where $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$ are the corresponding plaintexts of $c_{1}^{w}{(k)}$ and $c_{2}^{w}{(k)}$. This can be done for all the groups to obtain a decrypted version of E[I _w ], denoted as I _w . In the applications, there are two possible scenarios on the decrypted result I _w .

Scenario 1: The receiver extracts the hidden data and recover the original image immediately. Firstly, the receiver divide I _w into groups in the same manner as in the image encryption procedure and get $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$. Then, d ^w k (the absolute difference between $P_{1}^{w}{(k)}$ and $P_{2}^{w}{(k)}$) is calculated

$$ d^{w}{(k)}=\left|P_{1}^{w}{(k)}-P_{2}^{w}{(k)}\right| $$

(43)

In this way, the receiver can obtain histogram of the absolute differences. With the data hiding key K _d , the receiver can get n _e (embedding rounds) and PZ (embedding point in each round). Referring to PZ, the hidden data w can be retrieved by

$$ w=\left\{\begin{array}{ll} 0, &if~d^{w}(k)=EP\\ 1, &if~d^{w}(k)=EP+1.\\ \end{array}\right. $$

(44)

Meanwhile, original image pixels can be recovered by the following formulations.If $P_{1}^{w}{(k)}\geq P_{2}^{w}{(k)}$,

$$ P_{1}{(k)}= \left\{\begin{array}{ll} P_{1}^{w}{(k)}-1, &if~d^{w}(k)\geq EP+1\\ P_{1}^{w}{(k)}, &else \end{array}\right. $$

(45)

$$ P_{2}{(k)}=P_{2}^{w}{(k)} $$

(46)

else

$$ P_{2}{(k)}= \left\{\begin{array}{ll} P_{2}^{w}{(k)}-1, &if~d^{w}(k)\geq EP+1\\ P_{2}^{w}{(k)}, &else \end{array}\right. $$

(47)

$$ P_{1}{(k)}=P_{1}^{w}{(k)} $$

(48)

After n _e rounds of data extraction and image restoration, the hidden data can be retrieved perfectly and the original image can be restored without any error.

Scenario 2: Receiver wants to store or deliver a marked version of plaintext image. If needed, the hidden data can be extracted and the original image can be recovered. This case is possible in cloud computing application. For example, a company may upload the encrypted image to the cloud for watermarking service from the third party. After decryption, the company can deliver the watermarked image to legal users for business. The user can get the original image according to the data hiding key K _d and the hidden data can be extracted for copyright authentication.

Due to the effect of data hiding, pixel oversaturation in plaintext domain could be caused. Denote P ^w(i,j) by a plaintext in I _w , where (i,j) indicates the position. Receiver can scans I _w in order to find overflowed pixels (if P ^w(i,j)≥255). Then, the overflowed part of the P ^w(i,j) can be calculated as

$$ o{(l)}=P^{w}{(i,j)}-255 $$

(49)

where P ^w(i,j) is the l ^th plaintext which is greater than or equal to 255, and o(l) is the overflowed part of P ^w(i,j).

Since the effect of data hiding in each round is to add 1 or a binary bit to the corresponding plaintexts, receiver uses L (L=⌈log ₂(n _e )⌉) bits to represent o(l) as o ₁(l),o ₂(l),…,o _L (l),

$$ o_{i}{(l)}=\left\lfloor {\frac{o{(l)}}{2^{i-1}} }\right\rfloor\text{ mod }2, i=1,2,\ldots,L. $$

(50)

When there are Q overflowed pixels, we can get a $L_{S_{a}}$ ($L_{S_{a}}=L\times Q$) bits of sequence, denoted by S _a .

For the overflow problem, we can modify pixels greater than 255 as 255 and restore their position information. All the appendix information including L, S _a and the positions of the overflowed pixels, can be reversibly embedded into I _w to generate $\phantom {\dot {i}\!}I_{w'}$. In this way, receiver could deliver $\phantom {\dot {i}\!}I_{w'}$ to his clients for business. For copyright problem, the receiver can extract the inserted appendix information and reconstruct I _w . With the data hiding key, the hidden data w can be extracted from I _w and the original image I can be restored, as described in Scenario 1 above.

4 Experimental results

In Section 3.2.2, we have presented two group selection strategies. The two group selection strategies is applied to form the proposed two reversible data hiding methods:

Method 1: We choose two adjacent pixels as a group for encryption. This is followed by a permutation operation on the encrypted image so as to avoid the difference of the adjacent pixels to leak image content.

Method 2: We randomly select two pixels as a group for encryption. The permutation operation in the Method 1 is not needed.

In this section, we will discuss the performance of the proposed reversible data hiding methods with several standard images (see Fig. 5). Then, the embedding distortion of the proposed methods is evaluated by using Lena as example image. Last part is a comprehensive comparison of the proposed two methods against previous schemes with Paillier cryptosystem.

Fig. 5

Six standard test images sized by 512×512. a Lena. b Man. c Plane. d Lake. e Baboon. f Room

4.1 Embedding distortion

Embedding distortion in the proposed scheme is from histogram shifting operation in encrypted domain. As embedding capacity increases, the more groups are needed and more rounds of histogram shifting will be implemented for data embedding. As a result, the distortion increases.

With the Method 1, the PSNR value of Lena is 44.914 dB for 40,960 bits of additional information, and the distortion is imperceptible, as shown in Fig. 6 b. The basic reason is that a great number of the absolute differences of groups of two adjacent pixels range from 0 to 4 due to strong correlation among neighboring pixels. In the Method 2, since two randomly selected pixels in magnitude are often different, only a small number of the absolute differences are smaller than 4 in magnitude. For 4960 bits of additional data, the PSNR value with the Method 2 is 41.754 dB, as shown in Fig. 6 c.

Fig. 6

Embedding distortion (in PSNR) with two group selection methods. a Lena. b Embedding 40,960 bits with Method 1 (44.914 dB). c Embedding 4960 bits with Method 2 (41.754 dB)

4.2 Performance comparison

In the literature, there are two existing works to reversibly hide data into Homomorphic encrypted image [25, 26] by using Paillier cryptosystem (which is a public key cryptosystem with both homomorphic and probabilistic properties). With Paillier cryptosystem, one of the advantages is that the encrypted image can be processed by the third party in encrypted domain.

Table 1 lists a comprehensive comparison results of the proposed methods against the two previous schemes by considering (1) if a preprocessing operation is needed before encryption, (2) if the image after encryption is bigger than the directly encrypted image, (3) if data extraction and image restoration is separable, and (4) security of hidden data in encrypted domain, which are described as follows:

• 1. To reserve room before encryption for data hiding in encrypted domain is good idea proposed by Ma et al. in [18]. In [25, 26], preprocessing image before encryption is important step so that additional can be hidden into encrypted image. In the proposed scheme, the use of two selected pixels as a group is directly encrypted with a genuine encryption strategy to transmit the absolute differences of groups of the two plaintext pixels to encrypted domain for data hiding. In other words, without any preprocessing operations are needed in the proposed scheme. This is beneficial to reduce risk of image content exposed. Besides, the scheme without preprocessing has better scalability.

  Table 1 Comprehensive comparison between the proposed schemes and two previous methods

• 2. The method [25] introduced an extra data expansion due to the fact that original pixel has been divided into two parts (LSB and the rest) for encryption. Such a way will make delivered ciphertext data double. The method [26] and the proposed scheme has no extra data expansion introduced.

• 3. The proposed method embedded additional data by shifting histogram of the absolute differences of groups of two pixels in encrypted domain. Since the histogram can be derived in encrypted domain, data extraction is separable from the content decryption. The method in [25] is on the opposite side, where the data can not be extracted before encryption. In [26], additional data were inserted twice in a reversible way and a lossless way, so that the data can be extracted in both encrypted and plaintext domains.

• 4. The security of hidden data in encrypted domain is one of the features that people are most concerned about. Method in [26] utilized WPC and probabilistic properties of Paillier cryptosystem to embed bits into bit-planes of the ciphertexts, where WPC mechanism was applied to protect the hidden data. Since the bit-planes of ciphertext are exposed in encrypted domain, there exists a risk that an illegal client may embed fake information into the bit-planes. Besides, when the same data are embedded into different images, the hidden data could be found in statistical way. In the proposed scheme, additional data are embedded into histogram of the absolute differences of groups of two selected pixels by using homomorphic properties in encrypted domain. Since the hidden data are capsuled with homomorphic and probabilistic properties of Paillier cryptosystem, an illegal receiver without the data hiding key can hardly crack those encrypted pixels, meaning that the hidden data in the proposed scheme is secure in encrypted domain.

Finally, we report the PSNR values of the proposed scheme with two group selection methods and the previous two schemes at different embedding rates. With six standard images (as shown in Fig. 5), we plot the corresponding comparison results of embedding capacity versus embedding distortion. We can see from Fig.7 that the proposed method 1 with the group selection strategy 1 (by selecting two adjacent pixels as a group for encryption followed by a permutation operation) can provide the best performance since the use of two adjacent pixels as a group is beneficial to generate a great number of the differences with smaller magnitude. Also, we can see from this figure that the proposed method 2 with the group selection strategy 2 (by randomly selecting two pixels as a group for encryption) has lower PSNR value at the same embedding rate due to the fact that only a small number of the differences with smaller magnitude can be achieved. Furthermore, we compute the average PSNR values of 50 standard test images at different embedding rates, as shown in Fig. 8. We can see from this figure that the simulation results are similar.

Fig. 7

Comparison of Embedding capacity versus embedding distortion in six different images against two existing works. a Lena. b Man. c Plane. d Lake. e Baboon. f Room

Fig. 8

Comparison of embedding capacity versus average embedding distortion in 50 standard test images against two existing works

5 Conclusions

In this paper, we proposed a new reversible data hiding scheme in encrypted domain with public key cryptosystem. In the proposed method, groups of two pixels are selected for encryption in a way that two pixels in the same group are encrypted with a random integer r ₁ to obtain two ciphertexts first. Then, one of the two ciphertexts is further encrypted with another parameter r ₂ (controlled by a key) so that their difference can be transmitted to encrypted domain. Owing to the encryption strategy, data hider can retrieve absolute differences of groups of two plaintext pixels by combining a modular multiplicative inverse method and a mapping table. And, additional data can be embedded into encrypted image by shifting histogram of the retrieved absolute differences by using the homomorphic property. With the proposed embedding strategy, there is no preprocessing on original image before encryption. On the receiver side, legal receiver can extract the modified histogram in encrypted domain with the same method as data hiding procedure. The hidden data can be further extracted from the marked histogram by performing inverse operations of histogram shifting. After decryption, the marked absolute differences can be computed in plaintext domain. Then, data extraction and image restoration can be accomplished perfectly. Experimental results have shown superiority of the proposed scheme by comparing with two previous schemes.

Also, we have discussed the security of original image and the hidden data in encrypted domain, and the conclusion is satisfied. Since the proposed scheme with Paillier public key cryptosystem is separable and without any preprocessing operations on original image, we suggest that the proposed scheme is useful for privacy protection and cloud computing.