Secret Image Sharing Scheme with Threshold Changeable Capability

In secret image sharing schemes, the threshold may have to be adjusted in case of changes in the security policy and the adversary structure before recovering the secret image. For example, if participants leave the group, their stego images are useless to them and may not be kept safely. As a result, these images can be easily stolen and utilized by intruders, which reduces the security of the scheme. To solve this problem, we propose a novel threshold changeable secret image sharing scheme withN potential changeable thresholds t 1 , t 2 , . . . , t N . By preparing advance shares for thresholds t 1 , t 2 , . . . , t N and using the two-variable one-way function to generate the identification value, we can change the threshold when necessary. The experiments show that the quality of the stego images in our scheme is satisfactory and the secret image can be recovered without distortion.Moreover, the security analysis shows that we can change the threshold safely.


Introduction
The rapid development of Internet has brought much more convenience to people's daily lives, but it has also brought security risks.In the open communication networks, it is easy to intercept, modify, fabricate, and even destroy data.Modern cryptography provides an effective solution to ensure the security of information.Since the design details of most cryptography algorithms are public, the security of the encrypted information depends on the security of the key.Thus, it is important that the key be kept safely.
In order to solve this secret key protecting problem, Shamir [1] and Blakley [2] proposed (, ) threshold secret sharing schemes independently.Shamir constructed his scheme based on polynomial interpolation, while Blakley provided a geometric construction.In a (, ) threshold secret sharing scheme, a dealer encodes and divides the secret into  shares that are distributed to  participants, and then  or more participants can recover the secret, but less than  participants cannot get any information about the secret.In 1994, Naor and Shamir [3] proposed a visual secret image sharing scheme.Utilizing the (, ) threshold secret sharing technique, the secret image is encoded and divided into  random-noise-like images (called share images), and these share images are distributed to the participants, so that any  or more participants can see the secret image by stacking their share images together.However, the random-noise-like images, which are meaningless, can easily attract malicious intruders' attention.To solve this problem, Lin and Tsai [4] provided a (, ) threshold image sharing scheme using steganography.In their scheme, the shares are camouflaged in a cover image to form the stego images, which cannot be distinguished by the human eye, so these shares can be concealed from intruders.At the same time, their scheme embeds watermarks into the stego images for verification.
In recent years, various secret image sharing techniques have been developed rapidly.In 2007, Yang et al. [5] proposed an image sharing scheme that can improve the authentication ability, but it degraded the quality of the stego images.In 2009, Lin et al. [6] utilized the modulo operation to camouflage the secret data in the cover image to overcome this drawback.Their scheme guarantees higher quality stego images, and it can reconstruct the secret image and the cover image without distortion.In 2010, Lin and Chan [7] proposed an invertible secret image sharing scheme with satisfactory quality of the stego images.It can recover the secret image and the cover image without distortion, and it allows for a large capacity of secret data embedding.In reality, the single (, ) threshold access structure cannot satisfy the demand of complex applications.To solve this problem, Guo et al. [8] first proposed a hierarchical secret image sharing, based on polynomial interpolation in 2012, which divided the secret share images into different hierarchies and set different threshold values.Also in 2012, Guo et al. [9] proposed another novel hierarchical secret image sharing scheme based on monotone span programs (MSPs).In 2013, Ulutas et al. [10] proposed an invertible secret image sharing scheme using modification direction and the modulo operation.Their scheme can improve the quality of the stego images effectively when grey-scale cover image is used, and it can also obtain acceptable quality stego images when dithered cover image is used.In 2014, Pakniat et al. [11] used cellular automata and Birkhoff interpolation to propose a novel secret image sharing scheme with hierarchical threshold access structure.In this scheme, each authorized subset of participants is able to recover the secret image and the cover image without distortion, and they can also check the validity of the secret image.
Before recovering the secret image, the security policies and adversary structures may change, so it may be necessary to adjust the threshold.For example, (1) the importance level of the secret image is increased or decreased; (2) some participants join or leave the group; (3) the mutual trust of participants is strengthened or weakened; (4) the adversary might have corrupted more than  −  participants.Currently, there is not a secret image sharing scheme that can change the threshold after distributing the stego images and before recovering the secret image.Therefore, it is necessary to set up a changeable threshold secret image sharing scheme.
Currently, many researchers are interested in secret sharing schemes, especially threshold changeable secret sharing schemes.In 1991, Laih et al. [12] proposed the first threshold changeable secret sharing scheme.In recent years, some researchers have been developing threshold changeable secret sharing schemes based on various techniques, such as (1) the share redistributing technique in [13][14][15]; (2) the lattice basis reduction technique in [16][17][18]; (3) the redundant shares technique in [19,20]; and (4) the advance shares technique in [21].In 1997, Desmedt and Jajodia [13] used the share redistributing technique to propose a threshold changeable secret sharing scheme without the dealer's participation after the initialization phase.Some similar schemes can be found in [14,15].In these schemes, if the threshold needs to be adjusted, each original share is split into smaller shares which are then redistributed to all participants in the new access structure.Each participant   can combine all received smaller shares into one new share   by a suitable linear combination; thus each participant only has to store   .Note that all participants must simultaneously keep mutual secure communication channels.However, this may be impractical when the threshold changes, especially in the event of an urgent threshold change, so many schemes based on broadcasting have been proposed.In 1999, Martin et al. [22] provided a general model for threshold changeable secret sharing schemes and also provided two threshold schemes which were based on polynomial interpolation and geometric construction.In 2005, Barwick et al. [23] proposed a novel threshold changeable secret sharing scheme based on broadcasting, which can minimize the storage space required for secret sharing and limit the size of the broadcast information in low-bandwidth environment.In 2007, Steinfeld et al. [18] provided a lattice-based threshold changeable secret sharing scheme in which the threshold can be increased by partial updating of shares.In 2012, Zhang et al. [21] also proposed two threshold changeable secret sharing schemes.
In their schemes, the advance shares, which have a one-toone relationship with all potential thresholds, are prepared in the initialization phase, and then the new threshold can be validated by broadcasting related information.
Inspired by Zhang et al. 's work [21], we propose a novel ({ 1 ,  2 , . . .,   }, ) threshold changeable secret image sharing scheme that can adjust the threshold to   (1 ≤  ≤ ) dynamically by broadcasting information.Since the novel characteristic of our scheme is not available in the existing secret image sharing schemes, it has the potential to work in many applications.Our scheme has the following characteristics: (1) The quality of stego images is satisfactory, and the secret image can be recovered without distortion.
(2) The problem with Zhang et al. 's scheme, that is, that the encrypted shares are too large to be camouflaged in the cover image to form the stego images, is solved by our scheme.
(3) The threshold can be adjusted in case of changes in the security policy or the adversary structure, and our scheme remains secure after these changes are made.
The rest of this paper is organized as follows.We describe Shamir's secret sharing scheme and the two-variable one-way function in Section 2, and we present our novel ({ 1 ,  2 , . . .,   }, ) threshold changeable secret image sharing scheme in Section 3. Our experiments, the performance of our scheme, and the security analysis are presented in Section 4. Section 5 presents our conclusions.

Preliminaries
This section describes the concept of Shamir's (, ) threshold secret sharing scheme [1] and the two-variable one-way function.
2.1.Shamir's (, ) Threshold Secret Sharing Scheme.Let  = () be the secret domain, where  is a big prime number.Secret  ∈  is shared amongst  participants  1 ,  2 , . . .,   and  is the threshold value.Each participant gets a piece of secret called share.Then,  or more participants can cooperate to reconstruct the secret by polynomial interpolation, and less than  participants cannot get any information about the secret.Shamir's (, ) secret sharing scheme [1] can work as follows.

Two-Variable One-Way Function.
If each participant's share data generated according to the secret image is sent directly, it can easily attract malicious intruders' attention, because it is meaningless.To solve this problem, in our scheme, each participant's share data is camouflaged in a cover image to form corresponding stego image.Since each stego image and cover image cannot be distinguished by the human eye, each participant's share data can be concealed from intruders.In Zhang et al. 's ({ 1 ,  2 , . . .,   }, ) threshold changeable secret sharing scheme [21], they prepare advance shares for all potential changeable thresholds  1 ,  2 , . . .,   and encrypt the advance shares by the symmetric encryption algorithm in the sharing procedure.But their encrypted shares are too large to be camouflaged in the cover image.To solve this problem, we used the two-variable one-way function to generate the identification values, which are fed into the polynomial to generate the shares.The details will be given in Section 3.For the reader's convenience, we introduce the two-variable oneway function represented by Chien et al. [24] as follows.
Function ℎ(, ) is a two-variable one-way function that can map variables  and  into a value with a fixed length.The features of ℎ(, ) are as follows: (1) Given  and , ℎ(, ) is easy to calculate.
(3) Given  and ℎ(, ), it is not feasible to calculate .(4) It is not feasible to calculate ℎ(, ) for any  without .
(8) Given any pairs of (  , (  , )), it is not feasible to calculate ℎ(  , ) when   ̸ =   .In our scheme, the pixels of  and  are read from left to right and from top to bottom.Assume that the dealer knows  potential thresholds  1 ,  2 , . . .,   to which the threshold may be changed in the future, and these thresholds satisfy the condition 0 <  +1 −   <  1 (1 ≤  ≤  − 1).This condition can be achieved easily by adding new potential thresholds to shorten the difference between the two potential thresholds.For a univariate polynomial () = ∑ ≥0     , the degree operator deg(⋅) is used to compute the degree of the polynomial, and the coefficient operator [  ] is defined, such that [  ]() =   .Our threshold changeable secret image sharing scheme can be divided into two procedures, that is, sharing and recovery.These procedures are described as follows.

Proposed Scheme
3.1.Sharing Procedure.In the sharing procedure, the dealer derives shares from secret image  and generates  stego images  1 ,  2 , . . .,   for  participants  1 ,  2 , . . .,   .Figure 1 displays the flowchart of this procedure.We describe how to generate the shares in Section 3.1.1and how to camouflage these shares into the cover image to form the stego images in Section 3.1.2.
For convenience, assume that   converted digits, which are selected from the converted data, are  1 ,  2 , . . .,    , and then  polynomials, which are used to hide these converted digits, can be constructed as follows: Algorithm 1: Polynomial generator (Zhang et al. [21]).
where    is the th advance shares of participant   and ℎ(  ,   ) is the fake identification that is computed by feeding key   and real identification   into two-variable one-way function ℎ(, ).

Camouflage.
In this phase, shares are camouflaged in cover image  to form stego images  1 ,  2 , . . .,   , and then they are distributed to corresponding participants.
For convenience, assume that  pixels, which are selected from cover image , are  1 , where    is th camouflaged pixel of participant   and ⌊⋅⌋ is the floor function.
If all of the converted digits have been camouflaged in cover image , the dealer can obtain each participant's stego image   (1 ≤  ≤ ), and then the dealer distributes real identification   and stego image   to corresponding participant   through secure communication channel.

Recovery
Procedure.Before recovering secret image , if security policy and adversary structure are changed, the threshold can be adjusted to a suitable threshold   which is one of potential thresholds  1 ,  2 , . . .,   , and the scheme can remain secure after these changes are made.Then,   or more participants can use their own stego images to recover secret image  without distortion.In this section, we describe how to change the threshold in Section 3.2.1 and how to recover secret image  without distortion in Section 3.2.2.

Secret Image Recovery.
In this section, we describe how to recover secret image  with threshold   .The procedure for doing so is shown in Figure 2.
By repeating these processes, all converted digits can be extracted, and then secret image  can be recovered by transforming these converted digits to decimal representation.

Experiment and Analysis
In this section, we describe the tests we conducted to determine the feasibility and performance of our scheme using simulations and experiments, and then we discuss the security of our scheme.
To estimate the quality of the stego images, we used peak signal-to-noise ratio (PSNR): The mean square error (MSE) of an image with  ×  pixels is defined as where  V is the original pixel value of the cover image and   V is the camouflaged pixel value of the stego image.Therefore, the higher the PSNR value, the smaller the difference between the cover image and the stego image.If the PSNR value is less than 35 dB, some of the important characteristics of the signal may be lost.When the PSNR value is less than 30 dB, the quality is unacceptable.But it is difficult for people to distinguish the original cover image from the stego image when the PSNR value is greater than 35 dB [26].
To compare the quality of the stego images for different cover images, we selected twelve gray-scale test cover images with 512 × 512 pixels to conduct the experiment.The twelve cover images are shown in Figure 4.
Table 1 displays the corresponding PSNR values of the stego images for the test cover images by our ({2, 3, 4}, 6) threshold changeable secret image sharing scheme.
Table 1 indicates that the cover image has little effect on the quality of the stego images.All of the PSNR values of our experiments are about 40 dB, which is greater than 35 dB, indicating that the quality of the stego images is satisfactory.
In the recovery procedure of our ({2, 3, 4}, 6) scheme, we set  2 = 3 as the threshold value, and we broadcast the corresponding secret keys  2 ,  3 .For convenience, we used stego images (a), (b), and (c) to reconstruct the secret image.Figure 5 shows cover image Lena, six stego images, and reconstructed secret image Baboon.The average PSNR value of the six stego images (i.e., images (a), (b), (c), (d), (e), and (f)) is 40.02 dB.We observe that each stego image shown in Figure 5 has a natural appearance and cannot leak any information about the secret image.The secret image recovered by stego images (a), (b), and (c) is displayed as image (g), which is the same as the original secret image.

Performance Analysis.
Factors  and  potential thresholds  1 ,  2 , . . .,   are important in our scheme's ability to maximize the secret capacity and preserve the fidelity of the stego images.The influence of these two factors is discussed in this section.
Table 2 displays the relationship of capacity and distortion for different  values.Image Baboon is used as the secret image in all of those experiments, and Lena is used as the cover image.The parameters are as follows:  = 3,  = 6,  1 = 2,  2 = 3, and  3 = 4. Table 2 indicates that (1) the number of influenced bits is increased as the value of factor  increases; (2) the capacity of the embedded converted data is increased as the value of factor  increases; and (3) the value of PSNR is decreased as the value of factor  increases.Since the difference between the original pixel in the cover image and the camouflaged pixel in the stego image is limited to [0,  − 1], it becomes smaller as the value of factor  decreases; that is, the quality of the stego images increases as factor  decreases.But a smaller  value can increase the number of converted digits; that is, the capacity of the embedded converted data is decreased.Different from Lin and Chan's scheme [7] which constructs one polynomial, we construct  polynomials to embed   converted digits into  pixels of the cover image in one iteration of polynomial calculation.Assuming that this cover image has   ×   pixels, it can embed   ×   ×   / converted digits (i.e.,   ×   ×   /(×⌈log  255⌉) pixels).Table 2 indicates that the values of the PSNR are greater than 35 dB when the values of  are set as 5 and 7. Since the capacity when  is 7 is greater than that when  is 5, setting  as 7 is more suitable in this situation.
The selection of  potential thresholds  1 ,  2 , . . .,   is another critical factor that influences the quality of the stego images.Table 3 shows the performance comparisons of different potential thresholds.In these experiments, we set test potential thresholds as [2,3], [3,4], [4,5], [3,5], and [4,6], and we set factor  = 5.As in the above experiments, image Baboon is used as the secret image, and image Lena is the cover image.
In our ({ 1 ,  2 , . . .,   }, ) threshold changeable secret image sharing scheme, since we camouflage   converted   increases, which were indicated in Table 3).At the same time, we focus on the performance when the potential thresholds were set as [3,5] and [4,5], and we observed that different potential thresholds had little effect on the quality of the stego images when   and  were fixed.In our scheme, we need to construct   ×   × ⌈log  255⌉/  polynomials and    [6], Lin and Chan's scheme (2010) [7], and Ulutas et al. 's scheme (2013) [10].We still use image Baboon as the secret image and image Lena as the cover image, and set  = 5.Table 4 indicates that our scheme has the unique threshold changeable characteristic and can recover the secret image without distortion.Since we camouflaged   converted digits in  pixels of the cover image in each iteration, which requires much more modification of the cover image, our scheme has lower quality of stego images and capacity of embedded converted digits.However, the average PSNR value of our scheme is 40 dB, which indicates that the quality of our stego images is acceptable.In addition, in practice,  is usually a small integer (such as  = 3) corresponding to the "low, middle, and high" level of security in computers while   could be linearly related to , so the capacity of embedded converted digits usually is acceptable.
In some situation, we need to share important secret image using sensitive cover images (such as medical, military, or artistic images) and these cover images need to be recovered without distortion.To satisfy this requirement, our scheme can embed the recovery information of the cover image pixels into the polynomials as Lin and Chan's scheme [7] does.But in this situation, we can only embed   −  converted digits into  pixels of the cover image in one iteration, which weakens the quality of the stego images and reduces the capacity to   ×   × (  − )/( × ⌈log  255⌉), where   and   are the height and width of gray-scale cover image , respectively.

Security Analysis.
In this section, we analyze the security of our scheme.
First, we notice that our scheme can only change the threshold once.After the dealer broadcasts keys   ,  +1 , . . .,   to validate threshold   (1 ≤  ≤ ), then it takes at least   cooperating participants to recover the secret image without distortion.If the new threshold must be changed to   (1 ≤  < ), the dealer broadcasts keys   ,  +1 , . . .,  −1 to achieve this.On the contrary, if  <  ≤ , the shares must be updated.In schemes that have strict security requirements, it is inevitable that shares are updated.For instance, the threshold in schemes [27,28] can be changed many times, but, when one participant leaves the group, the shares should be updated simultaneously.
Theorem 1.Before broadcasting the keys, no participant can recover secret image .
Proof.Without loss of generality, assume that there are   − 1 participants in set   = { 1 ,  2 , . . .,    −1 } who want to recover the secret image.Assume that they want to recover the first   converted digits that are hidden in polynomial   ().Then, the participants in   can obtain According to the features of the two-variable one-way function ℎ(, ), we know the following: (1) If   and   ( ̸ = ) are fed into ℎ(, ) with the same key , ℎ(,   ) ̸ = ℎ(,   ).

Figure 5 :
Figure 5: Six stego images, recovered secret image Baboon, and cover image Lena.

Table 1 :
− 1)-degree polynomial   (), the order of polynomial   () increases as   increases, which means that, for the same secret image and factor , the number of camouflaged pixels decreases as   increases (i.e., the value of PSNR increases as   increases, and the capacity of embedding converted data in the cover image increases as PSNR values (dB) of the stego images tested in 12 cover images.Cover images PNSR of stego 1 PNSR of stego 2 PNSR of stego 3 PNSR of stego 4 PNSR of stego 5 PNSR of stego 6 Average

Table 2 :
Relationship of the capacity distortion for different  values.

Table 3 :
Performance comparisons of different potential thresholds.  ×   ×  × ⌈log  255⌉/  pixels of the cover image, where   and   are the height and width of gray-scale secret image , respectively.Thus, the difference of potential thresholds cannot influence the quality of the stego images when   and  were fixed.Table 4 compares our scheme with Chang et al. 's scheme (2008) [25], Lin et al. 's scheme (2009)

Table 4 :
Comparisons of the related secret image sharing mechanisms.