Separable and Error-Free Reversible Data Hiding in Encrypted Image with High Payload

This paper proposes a separable reversible data-hiding scheme in encrypted image which offers high payload and error-free data extraction. The cover image is partitioned into nonoverlapping blocks and multigranularity encryption is applied to obtain the encrypted image. The data hider preprocesses the encrypted image and randomly selects two basic pixels in each block to estimate the block smoothness and indicate peak points. Additional data are embedded into blocks in the sorted order of block smoothness by using local histogram shifting under the guidance of the peak points. At the receiver side, image decryption and data extraction are separable and can be free to choose. Compared to previous approaches, the proposed method is simpler in calculation while offering better performance: larger payload, better embedding quality, and error-free data extraction, as well as image recovery.


Introduction
As a kind of technique of hiding data into cover media, for example, a digital image, data hiding might often produce a distorted version of the cover, known as stego-image. Based on whether the original cover can be reconstructed or not, data-hiding techniques can be classified into two kinds: irreversible [1,2] and reversible [3][4][5][6][7][8][9][10][11]. Aiming at recovering the original image with no error, reversible data hiding is generally based on two technologies: difference expansion (DE) [3,6,7] and histogram shifting (HS) [5,[8][9][10]. In general, DE-based methods provide higher payload than HSbased methods at the sacrifice of image quality. As a result, HS-based methods are more popular when the image quality is an issue. Since the maximal embedding capacity of HSbased data-hiding methods equals the number of pixels in the peak point, more peak and zero pairs are required to enhance the payload. However, for most natural images, a few nonoverlapping peak and zero pairs could be found. Therefore, embedding capacity is limited.
Moreover, most of the existing reversible data-hiding methods are only suitable for unencrypted covers. However, in some application scenarios, content owners wish to encrypt the original images for maintaining secrecy or protecting privacy. Meanwhile, an inferior assistant or a channel administrator may desire to append some additional data within the cipher-text images without knowing the decryption key and the plaintext content. As a legal receiver, it is required that the original plaintext content can be recovered error-free after image decryption and data extraction. Reversible data hiding in encrypted image satisfies these needs [12][13][14].
In [13], data is appended by flipping three LSB of ciphertext image encrypted by simple exclusive-OR operation and extracted with the aid of spatial correlation in natural image. The original image can be recovered with no error when embedding payload is not too large. The performance is further improved by Hong et al. [14] using side match with a block-recovery order. In both [13,14], the appended data can only be extracted after image decryption. In other words, a receiver having data-hiding key but no contentowner key cannot extract any information. To overcome this problem, a separable reversible data-hiding scheme [15] is 2 The Scientific World Journal proposed, in which the original image is encrypted using symmetric key and then data can be appended using datahiding key. With an encrypted image containing additional data, a receiver having the data-hiding key can extract the appended data exactly, while a receiver having the symmetric key can decrypt the received data to obtain an image similar to the original one. If the receiver has both keys, he can extract the additional data and recover the original image at the same time.
Method [15] is undoubtedly a great idea. However, there is a limitation in the aspect of embedding payload. Data cannot be extracted exactly and the original image cannot be recovered completely when the payload is more than 0.04 bpp (this maximal value of effective payload may fluctuate along with different cover images). In other words, error appears and error rate rises as the payload increases. Beyond that, many parameters adopted in method [15] make it a little complicated for implementation. To solve these issues, we propose an improved work in this paper. After a cover image is being encrypted with a content-owner key, additional data can be embedded into the encrypted image based on block sorting and block histogram shifting with a data-hiding key. Compared with the existing methods, the proposed scheme has the following advantages: (1) simpler calculation and higher efficiency; (2) larger payload and better embedding quality; and (3) error-free recovery with high payload.

Proposed Scheme
The data extraction methods used in [13,14] require estimating block smoothness. An incorrect estimation may result in the failure of data extraction and image recovery. Although a large block size reduces the extraction error rate, it decreases the payload as well.
The proposed method embeds data by shifting pixels locally in encrypted image. The content owner partitions the cover image into nonoverlapping blocks and encrypts the cover image using multigranularity encryption: coarsegrained encryption permutes blocks in global images while fine-grained encryption permutes the pixels in each block to construct a meaningless encrypted image. Although all pixels are permuted, pixels in each block still preserve the same image histogram. Therefore, the HS method is applicable for embedding data into permuted blocks if pairs of peaks and zeros in each block are properly determined. In our approach, two basic pixels are randomly selected from the permuted block and used to indicate two peak points. Since the pixels having the same values as peaks contribute to the payload, it is likely to embed more than one bit per block to achieve high payload. More importantly, the embedded data bits can be extracted exactly. In addition, since the values of basic pixels are preserved during data embedding, they can be exploited to estimate the smoothness of blocks roughly and indicate the priority of embedding sequence.
The proposed method is described briefly as follows. In image encryption and data embedding phase, the content owner encrypts the original image using a symmetric content-owner key to produce an encrypted image . Then, the data-hider processes image to generate imagê . Additional data is embedded intôwith data-hiding key and marked-encrypted imagêis obtained. In data extraction and image recovery phase, there are three options for legal receivers. Image decryption and data extraction are separable and can be free to choose. The embedded data can be easily extracted from̂with . Since only part of pixels is modified by one grayscale unit to conceal , direct decryption on̂with generates a decrypted image , which is very similar to the original version . If and are both adopted, the cover image can be restored errorfree and the embedded data can be extracted accurately. The framework of the proposed method is shown in Figure 1.
The goal of the proposed method is to improve embedding payload, quality, and efficiency via simple calculation. The last and most important, keep error-free recovery as the payload increases while [13][14][15] cannot.

Image Encryption.
Firstly, the cover image is divided into nonoverlapping blocks { } −1 =0 . Each block is composed of × pixels. Then, multigranularity encryption is adopted by using random permutation to obtain the permuted blocks {̂} −1 =0 : pixels permutation in each block and blocks permutation in the whole cover image. Thus, the encrypted image is generated. Parameters and and the integer adopted as the seed of random permutation compose the content-owner key . . Next, to estimate the smoothness of each block, the differencê= |̂, −̂, | is calculated. Blocks with smaller̂are likely smoother than blocks with larger̂, and it is known that smoother blocks are in favor of HS. As a result, blocks with smaller̂will be chosen to have higher priority for carrying data. Let {̂( ) } −1 =0 be the sorted result of {̂} −1 =0 after being sorted in the ascending order. The sorted sequence { ( )} −1 =0 is then employed as the embedding sequence of blocks. At last, two peakŝ, and̂, in each block are determined as follows:̂, = min(̂, ,̂, ),̂, = max(̂, ,̂, ). To ensure that each block has two distinct peaks, we simply set̂, =̂, + 1 when̂, =̂, .
To avoid saturated pixels (pixels valued 0 or 255) from overflow or underflow during embedding, saturated pixels have to be preprocessed by modifying one grayscale unit and noted in a location map . To do this, visit blocks =0 sequentially and append a bit "1" to when̂( ), ∈ {1, 254}. If̂( ), ∈ {0, 255}, append a bit "0" to and modifŷ( ), tô( ), using the following equation: Let the processed block be ( ) . The embedding capacity of ( ) , denoted by (bits), equals the number of nonbasic pixels valued̂( ), and̂( ), . Continue the preprocessing procedures until the condition ∑ −1 =0 ≥ | | + | | is satisfied, where is the additional data and is the minimal number of blocks that are used for embedding and . We denote the preprocessed encrypted image bŷ. Oncêis obtained, the data hider concatenates and to form a string of message bits and then scans the pixels to conceal as follows. If the scanned pixel ( ), is valued̂( ), or̂( ), , a bit ∈ {0, 1} extracted from is embedded by modifying ( ), to ( ), according to the following equation: Otherwise, pixels are either maintained or shifted by one unit using the following equation: After embedding, blocks , and the marked-encrypted imagêis generated.
The parameters , , | |, | | and the seed used to randomly select basic pixels compose the data-hiding key .

Data Extraction and Image Recovery.
If the receiver has data-hiding key , the embedded additional data can be extracted directly from the marked-encrypted imagê. To extract ,̂is firstly partitioned into blocks The first | | extracted bits compose the location map , and the other | | bits compose the additional data . If the receiver also has , original cover image can be perfectly recovered by firstly restoring the pixelŝ( ), from̂( ), using the following equation:  } −1 =0 is reconstructed accordingly. With the content owner key , can be exactly decrypted to the original cover image . Note that if the receiver only has but no , an image that is very similar to the original one can be obtained.

Experimental Results
A number of gray images sized 512 × 512 were used as original cover images in our experiment.    the additional data and recovered the original image errorfree. Table 1 summarizes the embedding payloads, PSNR in directly decrypted images (PSNRdec), and PSNR in recovered images (PSNRrec) when different block sizes were used for image Lena. Each "+∞" in Table 1 indicates that the mean square errors between the recovered version and the original image are 0 and the cover was reconstructed error-free.
To explore the influence of different parameters (block sizes × ) and different strategies (block sorting or no sorting) on embedding performance of proposed method, we compared different results obtained from a smooth image Lena and a complex image Baboon. In order to obtain enough experimental data and assure validity of conclusions, for each test image, 4 block sizes (2 × 2, 3 × 3, 4 × 4, 5 × 5) are adopted. For each block size, 10 integers are chosen as to generate different . Then, embed 10 distinct into each and crosstest 100 times. After removal of the highest and lowest points, take the average to investigate PSNR-payload curves. Take Lena and Baboon as examples shown in Figure 3. The abscissa represents the pure embedding payload and the ordinate is the value of PSNR between and .
From Figure 3 we can draw some conclusions. (1) The smaller the block size, the better the PSNR. If embedding quality is preferable, block size 2 × 2 is good choice. (2) When block size is larger than 4 × 4, the performance would be worse. If large payload is desirable, either 4 × 4 or 3 × 3 could be chosen.  [13], (c) recovered version by [14], and (d) recovered version by proposed method.  (4) Smooth image Lena provides better performance than complex one, Baboon. It is known that, for HS-based methods, smoother blocks often provide larger capacity than complex ones. Therefore, the full payload of Lena is larger than that of Baboon. For the same nonfull payload, fewer blocks are used in Lena and embedding distortion is smaller. So PSNR is higher. We compared the proposed scheme with methods [13][14][15] in Figure 4, which indicates that the proposed scheme has the best performance. All results are derived from the best parameters under a condition that the original image can be recovered without any error.
Note that the data extraction in [13,14] is not separable from the content decryption. However, using the proposed scheme or method [15], data extraction and image encryption are separable and can be free to choose. With the proposed scheme, since both the similarity of neighboring pixels in local level and block smoothness are fully exploited, more redundant space can be created to carry data. So the performance curve of the proposed scheme is better than those of other methods.
The Scientific World Journal 7  We also compared the proposed scheme under the same block size with the nonseparable method in [13,14]. The results are shown in Table 2, from which we see that the proposed scheme has 2 times gain of payload under the block size 4 × 4 and 7 times gain under block size 8 × 8 together with improvement of PSNR value in directly decrypted image when meeting the perfect recovery condition.
Furthermore, we take Baboon as an example to verify details. Under the same block size 8×8, we compare recovered images generated by different methods in Figure 5, where the incorrect recovered blocks are marked by white.
Comparing Figures 5(b), 5(c), and 5(d), we see that the proposed method recovers the image blocks error-free and more accurate than that of [13,14]. Although the experiments were based on Baboon, experiments on other test images also showed the similar result, which indicates that the proposed method offers a better performance for data extraction and image recovery.
Finally, we summarize maximum payload and corresponding PSNR of Lena, Peppers, Boat, and Baboon in Table 3. For the same cover image, the maximum payload of the proposed scheme is much more than that of [13][14][15] and the embedding quality is the best.

Conclusion
This paper proposed a separable and error-free reversible data-hiding scheme in encrypted image, which significantly outperforms the previous methods in the three aspects of payload, PSNR, and error rate. Compared with [13,14], not only can cover images be reconstructed with no error, but also image decryption and data extraction are separable. Compared with [15], the proposed method improves both PSNR and the effective payload via simpler calculation using few parameters and achieves higher efficiency. The last and most important advantage of our method is that it can keep error-free recovery as the payload increases while the others cannot.