Using Two Meaningful Shadows to Share Secret Messages with Reversibility

: A subtopic of visual secret sharing (VSS) is information hiding-based VSS (IH-VSS), which embeds secret messages into images using an information hiding technique. In the IH-VSS scheme, stego-images are divided into shadows under the guidance and constraint of some predetermined approaches. In order to achieve the purpose of security and reliability, the hidden information cannot be recovered unless a certain amount or all of the credible shadows work together. In this paper, we propose a (2, 2) IH-VSS scheme with reversibility and friendliness. In the shadow generation phase, two meaningful shadow images are produced and then distributed. In the extraction and restoration phase, the hidden secret information and cover image, respectively, can be reconstructed credibly and correctly. No complex computation of shadow generation is involved, but high security is achieved. Moreover, a satisfying peak-signal-to-noise ratio (PSNR) is obtained with the high embedding capacity of 1.59 bpp in a very simple and effective way.


Introduction
Nowadays, in the open network environment, effectively managing and protecting digital multimedia content, as well as preventing increasingly serious computer crimes and information from being illegally leaked, deleted, and modified, have become a research hotspot in the field of information security.People first turn to traditional cryptography [1], which ensures the message cannot be overheard or destroyed by using secret keys with different algorithms [2][3][4]; consequently, the eavesdropper cannot see or understand the secret information.Nevertheless, at the same time, distinctive and meaningless secret key-based encryption results may unintentionally attract intruders' attention.Furthermore, encryption algorithms are always very complicated, and the processes of encryption and decryption requires huge space and time complexity.To solve these problems, people have been looking for new solutions as an effective complement to the traditional cryptographic system.In such efforts, secret sharing and information hiding are significantly concerned.
Secret sharing serves to enhance security features and prevent authority fraud by avoiding the loss, modification, or destruction of important hidden information.The first secret sharing scheme is the threshold secret sharing scheme based on the Lagrange interpolating polynomial and finite geometry, which was proposed in 1979 by Shamir [5] and Blakley [6], independently.In their schemes, a dealer partitions a secret into n shadows, which are distributed to n participants.It takes at least k (k ≤ n) participants to work together to recover the secret, and less than k will not release any Recently, an adaptive method with a greatly enhanced embedding capacity under less execution time was proposed; it is obviously superior to many current algorithms in performance efficiency [28].
The algorithms described thus far are all related to IH-VSS and have distinctive approaches that differ from one another, yet none of them are exempt from considering the trade-off between the embedding capacity and image quality of the generated shadows.In this paper, with no time-consuming mathematical operations involved, we proposed a 2-2 threshold IH-VSS scheme using a meaningful image as the cover image through which the avoidance of the pixel expansion problem caused by the noisy-like shadows of the traditional Shamir's algorithm can be realized.In the algorithm, we first append part of the information from the cover image to the end of the secret and hide the secret using Kim et al.'s M matrix.Next, pixel pairs of the cover image with partial modification and stego-image are switched according to the sequence of {0, 1} generated by a random number generator.During the extraction and restoration phase, when the two participants collect the valid shadows, they can calculate the random number Num according to the pre-determined algorithm and then generate the corresponding {0, 1} string to recover the hidden secret information and further obtain the intact cover image.In this way, the embedding rate of 1.59 bpp (bits per pixel) along with PSNR of 54.34 dB are realized.Moreover, a good balance between the high embedding capacity and PSNR is achieved.Furthermore, if one participant provides a fake shadow or maliciously wants to obtain information about another participant, the Num, which is key information for pixel switching between the two shadows, cannot be derived correctly.In other words, the security of the hidden secret is guaranteed.Experimental results show that, by increasing the embedded payload of secret information, the PSNR value remains above 50 dB, which is quite high; furthermore, the small distortion between shadow1 and shadow2 and the cover image adds a lot of imperceptibility and security to our proposed IH-VSS scheme.It is also noted that our proposed IH-VSS scheme is completely reversible and friendly, with highly execution efficiency, which makes the application of our proposed scheme more extensive.
The rest of this paper is organized as follows.Section 2 discusses Shamir's secret sharing system and Kim et al.'s EMD-2 scheme.The IH-VSS scheme we propose is introduced in Section 3, followed by the experimental results and performance analysis in Section 4. Finally, the conclusions are presented in Section 5.

Related Works
To give readers enough background knowledge for our proposed scheme, Section 2 briefly reviews Shamir's secret sharing [2], and Kim et al.'s EMD-2 scheme [29].

Shamir's Secret Sharing
Shamir [5] and Blakley [6] independently proposed the first secret sharing scheme in 1979, focusing on the concept of the (k, n) threshold secret sharing scheme.Some important notions were defined in their schemes.For example, the image held by a participant is called a secret share or a sub-secret and shadow.Secret sharing schemes are usually established by trusted distributors who calculate all the shares and distribute them over secure channels to participants.The threshold k has the important meaning that the possible values for secret S seem as likely as with no knowledge when the number of shares does not reach the lower limit k.In other words, the secret S cannot be reconstructed with fewer than k pieces.If k = n, then every shadow derived from the original secret S is required to reconstruct the secret.In Shamir's (k, n) [5] (where 1≤ k ≤ n, k and nareinteger) threshold secret sharing scheme, the secret data can be converted to (or can be made) a number, which we call I.The domain of secrets and shares is the elements of a finite filed F p , where p is a prime number (p > I).To split I into n shares, the dealer determines and constructs a (k − 1)-degree polynomial as then uses it through the following steps: Step 1. Make a 0 = I.
Step 3. Select freely for the ith (1 ≤ i ≤ n) share a value of x, denoted as x i , and all x i must be distinct from one another.Step 4. Calculate a corresponding value of f (x i ) for each chosen x i , using Equation (1): ( Step 5. Sent the corresponding (x i , y i )-the generated share SH i -to the ith participant.
Step 6. Perform Step 3 to Step 5 until each of the n participants gets the corresponding share SH j (1 The following figure is the flow chart of Shamir's secret sharing scheme (Figure 1).Step 1. Make 0 a = I.
Step 2. Choose (k -1) integer values Step 3. Select freely for the ith (1 ≤ i ≤ n) share a value of x, denoted as i x , and all xi must be distinct from one another.
Step 4. Calculate a corresponding value of ( ) i f x for each chosen xi, using Equation (1): ( ).
Step 5. Sent the corresponding ( i x , i y )-the generated share SHi-to the ith participant.
Step 6. Perform Step 3 to Step 5 until each of the n participants gets the corresponding share SHj (1 ≤ j ≤ n).The following figure is the flow chart of Shamir's secret sharing scheme (Figure 1).Thus, the secret share formation and distribution phase is completed.When necessary, the following steps can be performed to extract secret information.
Step 1. Collect at least k( ≤ ) secret shares SHj (1 ≤ j ≤ k) from the n participants to form the following equations: where i x and ( ) i f x are 2k known values from the k secret shares.
Step 2. Use the Lagrange polynomial interpolation method to solve the k unknowns values  Thus, the secret share formation and distribution phase is completed.When necessary, the following steps can be performed to extract secret information.
Step 1. Collect at least k (k ≤ n) secret shares SH j (1 ≤ j ≤ k) from the n participants to form the following equations: where x i and f (x i ) are 2k known values from the k secret shares.Step 2. Use the Lagrange polynomial interpolation method to solve the k unknowns values a 1 , a 2 , . . . ,a k−1 and a 0 in the k equations in Equation (3) and regenerate the (k − 1)-degree polynomial function f (x) given by Equation (1) to be: Symmetry 2019, 11, 79 5 of 21 Step 3. Figure out the solution for the secret value a 0 according to Equation ( 4) Hence, the secret message I = a 0 is revealed.According to Shamir's (k, n) [5], if fewer than k shares are collected, the k unknown coefficients cannot be figured out and the desired secret data a 0 cannot be extracted.
Example: Assume that the threshold is k = 3, we will generate a function f (x) = a 0 + a 1 x + a 2 x 2 which f (0) = I, where I = 1234 is the secret number derived from secret data.Therefore, a 0 = I = 1234.Then at random we obtain a 1 = 166, a 2 = 94.Our polynomial which is used to produce secret shares is therefore: f (x) = 1234 + 166x + 94x 2 .In order to have 6 valuable information of the secret, we select freely for the ith (1 ≤ i ≤ n) share a value of x, denoted as x i , which is distinct from one another, and calculate 6 values on the function f (x).Thus, we get 6 shares as (5,4414) and SH 6 = (x 6 , f (x 6 )) = (6, 5614), which will be delivered to n = 6 participants.
Regarding the characteristics of our proposed IH-VSS, we use the (2, 2) threshold for example in this paper.It can be extended to an (n, n) threshold.

Kim et al.'s EMD-2 Scheme
In 2006, Zhang and Wang proposed the first exploiting modification direction (EMD) scheme [30] providing good stego-image quality with the PSNR of more than 52dB and a considerable embedding rate of R = (log 2 (2n + 1))/n by modifying at most one least-significant bit of n pixel value.In 2010, Kim et al. developed the novel information hiding method called EMD-2 [29], which improved EMD by allowing at most two pixels to be modified and using different directions of modification to represent different secret data.
In Kim et al.'s EMD-2 scheme, a pixel group is defined as P n = (p 1 , p 2 , . . ., p n ), where n ≥ 2. Follow Kim et al.'s definition, we think that in the case of n = 1, the processing is carried out with a pixel as the unit, without forming a pixel group.Under such a condition, it can be reduced to the LSB (least significant bits) [31] information hiding algorithm; and we will not discuss it in detail for we have benefited from a lot of treatises which have made detailed exposition to this problem.P n is an n-dimensional space that can be mapped to a value by function f (P n ).The basic elements b i where i ∈ [0, 8] is used as an input to the function f as a weighted sum with modulo (2ω + 1).where [1, 2, 3, 11, 16, 21, . . ., 6 + 5(n − 3)] n > 2. (7) and Here d is the secret data to be hidden, and f is the value calculated by Equation ( 6) associated with the pixel group P n .The subscript value v is calculated using Equation (9).
The vector of the treated pixel value P n can be acquired using Equation (10).
where C v is the exponential vector when the number v is associated with the basis vector B n which has been defined in Equation (7).Actually, when n = 2, the best choice of the basis vector is B 2 = [1, 3] (see Equation ( 7)); meanwhile, ω = 4 (see Equation ( 8)).We use these parameters in our proposed scheme because we use (2, 2) threshold as an example in this paper.This basis vector can produce numbers from 0 to 8. Table 1 summarizes the details of the nine numbers and the corresponding coefficient vectors named C i , where i ∈ [0, 8].Combine the lowest three digits Note that the number 0 can be generated by the basis vector as 0 = C 0 •B T 2 = (0 × 1 + 0 × 3)mod9.In addition, C 1 is [1, 0]; thus, the number 1 is generated by 1 = (1 × 1 + 0 × 3)mod9.All nine numbers from 0 to 8 can be generated using Equation (6) by the linear combination of the basic elements with their associated coefficients.

Basic Number
Ci In order to make it more intuitive and convenient to apply in our subsequent processes of the IH-VSS scheme, the calculation process we just mentioned can be projected as the generation of a matrix called M. In the matrix, under the function of mod 9, the difference value between the two adjacent elements in the same row of the reference matrix M is set to 1, and the difference value between the two adjacent elements in the same column is set to 3.An example of the reference matrix M with a size of 256 × 256 is shown in Figure 2. The column value p i and the row value p i+1 in M represent the grayscale values of the pixel pair (p i , p i+1 ) in the cover image.
Symmetry 2019, 11, 79 7 of 21 IH-VSS scheme, the calculation process we just mentioned can be projected as the generation of a matrix called M. In the matrix, under the function of mod 9, the difference value between the two adjacent elements in the same row of the reference matrix M is set to 1, and the difference value between the two adjacent elements in the same column is set to 3.An example of the reference matrix M with a size of 256 × 256 is shown in Figure 2. The column value pi and the row value pi+1 in M represent the grayscale values of the pixel pair (pi, pi+1) in the cover image., , mod 9 3 ) mod 9

Proposed Scheme
This section presents a (2, 2)-threshold IH-VSS scheme based on Kim et al.'s M matrix, which has the feature of high embedding capacity, without distortion and low computational complexity.In our scheme, three entities are involved: dealer D and two participants (i.e., participant 1 and participant 2).Given a secret message and a meaningful cover image, two meaningful shadows are created and distributed to participants by dealer D. At the time of need, the two shadows are given According to Equations ( 6)-( 8), each pixel pair (p i , p i+1 ) is located in the element function M(p i , p i+1 ) in M. By using Equation ( 11), we can calculate all the values of the matrix.

Proposed Scheme
This section presents a (2, 2)-threshold IH-VSS scheme based on Kim et al.'s M matrix, which has the feature of high embedding capacity, without distortion and low computational complexity.In our scheme, three entities are involved: dealer D and two participants (i.e., participant 1 and participant 2).Given a secret message and a meaningful cover image, two meaningful shadows are created and distributed to participants by dealer D. At the time of need, the two shadows are given by the designated legal participants, and their secret information can be extracted using our proposed extracting algorithm; at the same time, the cover image is restored.The concealment and sharing process will be introduced in Sections 3.2 and 3.3, respectively.The hidden secret extraction procedure will proceed when the involved participants gather all shadows together.Meanwhile, the cover image can be reconstructed without loss.The corresponding process is discussed in Section 3.4.

Preliminary Phase
Here, a secret data S, which is (or can be transferred into) a binary string, will be concealed.An H × W grayscale image, denoted as O = {o i |i = 1, 2, . . ., H × W} is used as the cover image, where o i ∈ [0, 255], H is the height and W is the width of the image.Our proposed IH-VSS scheme applies a reversible data hiding scheme to embed secret data S along with the lowest three digits of the first four pixels in the original cover image into two meaningful grayscale images.Once the concealment phase is complete, each pixel pair in the stego-image carries one secret digit in the 9-base system; hence, the maximum hiding capacity using the proposed IH-VSS scheme is n = 415,498 (512 × 512 × log 2 9/2) bits when the cover grayscale image has 512 × 512 pixels and the embedding rate is 1.59 = 0.5 × log 2 9 bpp.
In the proposed (2, 2) IH-VSS scheme, the pre-process is listed as follows.
Step 1: Design a pixel value random diffusion function Rand3LSB(p i ).Here 3LSB means the three least significant bits of a pixel value, and Rand means that the 3LSBs are given a value between '000' and '111' in a binary system with equal probability, as shown in Figure 3.This function makes the three LSBs of a pixel value p i of a cover image slightly altered with randomness on a small scale.Such an arrangement can keep the pixel value still in the range of [0, 255], and the underflow and overflow problems do not exist in our IH-VSS scheme.Thus, the least significant three bits of the binary number are randomly changed to a new value that differs from the original value in the range [0, 7].As a result, the severe pixel distortion problem can also be avoided.
In the proposed (2, 2) IH-VSS scheme, the pre-process is listed as follows.
Step 1: Design a pixel value random diffusion function . Here 3LSB means the three least significant bits of a pixel value, and Rand means that the 3LSBs are given a value between '000' and '111' in a binary system with equal probability, as shown in Figure 3.This function makes the three LSBs of a pixel value i p of a cover image slightly altered with randomness on a small scale.Such an arrangement can keep the pixel value still in the range of [0, 255], and the underflow and overflow problems do not exist in our IH-VSS scheme.Thus, the least significant three bits of the binary number are randomly changed to a new value that differs from the original value in the range [0, 7].As a result, the severe pixel distortion problem can also be avoided.Step 2: Process the first four pixels of the cover image O with the random diffusion function   Step 3: Consider the pixel values of a grayscale image, which range between [0, 255] , as a onedimensional array. 1 p is the first pixel value and 2 p is the second pixel value.The subscript of p increases continuously until the maximum value is H W × .Define pixel pair   Step 3: Consider the pixel values of a grayscale image, which range between [0, 255], as a one-dimensional array.p 1 is the first pixel value and p 2 is the second pixel value.The subscript of p increases continuously until the maximum value is H × W. Define pixel pair (p i , p i+1 ) that is constituted by the grayscale values of two adjacent pixels p i and p i+1 .For example, pixel p i has a pixel grayscale value of 42 and pixel p i+1 has grayscale value of 41.The resulting pixel pair is (p i , p i+1 ) = (42, 41), as shown in Figure 5. , as shown in Figure 5. Step 4: Define a matrix M with the size of 256 × 256 according to Kim et al.'s EMD-2 algorithm.In the matrix M, any 3 × 3 square, for example, the green, blue and purple square demonstrated in Figure 6, has 9 numbers that can be used to conceal a secret value ranging from 0 to 8, as shown in Table 2 according to Figure 6.

( , )
i i p p + after being hidden.
Since each pixel pair we processed is targeted at the pixel pairs with the same position in the cover image and stego-image, their subscripts are one-to-one correspondence.Step 4: Define a matrix M with the size of 256 × 256 according to Kim et al.'s EMD-2 algorithm.In the matrix M, any 3 × 3 square, for example, the green, blue and purple square demonstrated in Figure 6, has 9 numbers that can be used to conceal a secret value ranging from 0 to 8, as shown in Table 2 according to Figure 6.(p i , p i+1 ) is pixel pair of (p i , p i+1 ) after being hidden.Since each pixel pair we processed is targeted at the pixel pairs with the same position in the cover image and stego-image, their subscripts are one-to-one correspondence.

Concealment Phase
A secret data S and an H × W grayscale cover image are given, then the concealment phase can

Concealment Phase
A secret data S and an H × W grayscale cover image are given, then the concealment phase can be executed as the flowchart of Figure 7.   represented by a number in 9-base system is (5602450) 9 .We specify that S is in the binary number, S is the 9-base number corresponding to S, and actually, they have the same value.In addition, we express S in this form S = s 1 s 2 . . .s n , where n = |S | is the length of the number string S , and s k (k ∈ [1, n]) is every digit in this number.This preprocessing procedure is illustrated in Figure 8.
Step 3: Conduct the function RNG(Num) to generate the seed of the randi() function, where RNG(Num) function controls random number generation so that the same string of {0, 1} will be generated by randi() on the secret distributor and receiver, which allows encrypt and decrypt participants to use the same {0, 1} string.
Step 4: Pair each of the remaining pixels in image O with their adjacent pixels to form non-overlapping pixel pairs, such as (o i , o i+1 ).Thus, there will be H × W /2 − 2 pixel pairs that can be used to embed secret information S .As the cover image can be selected at will, the number of pixels of its height and width do not have to be even, so their product may be odd.Thus, we get the maximum number of the pixel pairs through floor function on H × W.
Step 5: Embed secret information S into each pixel pair with the concealment algorithm according to the following four sub-steps. Step

H W ×
pixel pairs that can be used to embed secret information S ′ .As the cover image can be selected at will, the number of pixels of its height and width do not have to be even, so their product may be odd.Thus, we get the maximum number of the pixel pairs through floor function on H W × .
Step 5: Embed secret information S ′ into each pixel pair with the concealment algorithm according to the following four sub-steps.
Step 5.1: ) to obtain the value m by mapping i o ′ and to matrix M defined in Figure 2 and Equation (11).Example: To give a clear demonstration of our concealment phase, here, two pixel pair (o i , o i+1 ) of O , set as (5, 8) and (8, 3), the secret digit s 1 = 6 and s 2 = 7 are used.Since (o 5 , o 6 ) = (5, 8), 5 is mapped to column x and 8 is mapped to row y of matrix M. In other words, a base-9 digit '2' can be found by using M (5, 8) = 2, which is demonstrated as the center of the red rectangle in Figure 9.But the base-9 digit '2' is not the same as s 1 = 6 which is the number we need to hide at present, therefore, a 3 × 3 sized square is set as the search area around the center (5,8), and a new pair (6, 9) = M −1 (6) can be found because its intersection of column 6 and row 9 in matrix M is 6.Thus, the pixel pair (o 5 , o 6 ) = (5,8) in O is changed to ( o 5 , o 6 ) = (6,9) in O to carry secret digit s 1 = 6.For the next pixel pair (8, 3), we can get the center of blue square M (8, 3) = 8 in Figure 9, which will be used to hide s 2 = 7.Thus, we have to find 7 in the 3 × 3 search area around the center M (8, 3) = 8.Then a new pair ( o 7 , o 8 ) = (7, 3) = M −1 (7) can be found and set as the pixel pair to represent (o 7 , o 8 ) = (8, 3) to carry secret digit s 2 = 7.The detail is illustrated in Figure 9.
a 3 × 3 sized square is set as the search area around the center (5,8), and a new pair (6, 9) = M (6) can be found because its intersection of column 6 and row 9 in matrix M is 6.Thus, the pixel pair (

Shadow Generation Phase
Once stego-image O  is constructed, it can cooperate with image O ′ to generate two meaningful shadows by conducting the following six steps.

Shadow Generation Phase
Once stego-image O is constructed, it can cooperate with image O to generate two meaningful shadows by conducting the following six steps.Example: We execute sequential processing of pixel pairs according to the ascending order of the subscript in the image and Rnum, thus O  , we make O  , we make  Step 5: Set the LSB of the last pixel of shadow O 1 to 0 and name the final result shadow1.Set the LSB of the last pixel of shadow O 2 to 1 and name the final result shadow2.Send shadow1 to participant 1 and shadow2 to participant 2.

Extraction and Restoration Phase
Step 1. Collect shadows O 1 and O 2 from participants 1 and 2. Here, we assume two participants are credible and the received shadows are also reliable.According to the LSB of the past pixel of received shadows, shadows O 1 and O 2 can be determined, respectively.From the first pixel pair of O 1 and the second pixel pair of O 2 , the random number seed Num can be derived.The RNG(Num) function can then be performed, and images O and O can be restored according to the generated strings of 0 and 1.The restoration procedure is the inverse operation of Figure 10.If the participant provides a forged image, the Num and the string of 0 and 1 based on the received forged image will be incorrect.Ultimately, the hidden secret message cannot be extracted.
In addition to the hiding capacity, the security and visual quality of shadows are crucial criteria used to evaluate the performance of VSS.The following subsections discuss the security analysis and Symmetry 2019, 11, 79 14 of 21 visual quality.Comparisons among the four representative VSS schemes and our proposed scheme are demonstrated in Section 4.3 to confirm the performance of our proposed IH-VSS on both hiding capacity and visual quality.

Security Analysis
This subsection examines the security capability of our proposed scheme.As previously discussed, the proposed IH-VSS scheme is a (2, 2)-threshold secret sharing scheme, in which the core idea is clearly defined that no single share can release any knowledge of the hidden secret message.However, it is possible that malicious users conduct a brute-force attack by randomly selecting pixel pairs from received shadows (i.e., O 1 , O 2 ) to try to reconstruct stego-image O.To this end, the user must get the correct {0, 1} string.In a brute-force attack, the probability that a user will obtain the exact {0, 1} string is the reciprocal of 2 (M×N)/2 = 2 (512×512)/2 = 2 131072 , which is quite small and almost impossible to solve in real time.Thus, the security of the hidden secret message with our proposed IH-VSS scheme is guaranteed.

Visual Quality
In general, the PSNR is used to measure the visual quality of the image after secret information is embedded into the cover image.PSNR is defined as: where MSE is the mean square error between the cover image and the shadow.For an H × W size grayscale cover image, MSE is defined as: Here p ij denotes the pixel value of the original image, and p ij denotes the shadow's pixel value at position (i, j).Without a loss of generality, we believe that the difference between the cover image and shares is invisible to the naked eye when the PSNR value exceeds 30 dB, and we conclude that the visual quality of shadows reaches an ideal level [32].
The PSNR is often discussed with the embeddable secret capacity because they are the two major measurements of the performance of the VSS using the information hiding approach.The following figures show the contrasted PSNR value of images involved.Figure 11a shows the original Lena.The two shadows shown in Figure 11c,d have PSNR values of 55.98 dB and 55.91 dB, respectively, which are both meaningful images of size 512 × 512.As it is an accepted fact that when the value of PSNR is greater than 30, no difference can be detected directly through the human visual system.However, in the proposed scheme, PSNR value is often close to or more than 50 that makes the imperceptibility all the more salient.Furthermore, as is known to all, the pixel expansion is caused by shadows smaller than the cover image, which obviously does not exist in our scheme because shadows are the same size as the cover.Even when a large amount of the secret information is hidden, shares are visually no different from the original.greater than 30, no difference can be detected directly through the human visual system.However, in the proposed scheme, PSNR value is often close to or more than 50 that makes the imperceptibility all the more salient.Furthermore, as is known to all, the pixel expansion is caused by shadows smaller than the cover image, which obviously does not exist in our scheme because shadows are the same size as the cover.Even when a large amount of the secret information is hidden, shares are visually no different from the original.Another topic worth discussing is improvements to the produced shadow size.As we know, if the size of generated shadows is similar to or smaller than the size of the cover image, it is easier to manage and transmit the generated shadows.However, a tradeoff must be made between the size of the shadows and the size of the hidden secret.Smaller generated shadows may limit the size of hidden secret data even when relatively easier to manage and transmit.Thus, in the proposed IH-VSS scheme, the share size we define is the same as the cover image to keep the balance between the transmission efficiency and the size of the hidden secret message.Moreover, to enhance the security of the hidden secret message, the generated shadows are meaningful with the proposed IH-VSS scheme.
To enhance the security of the hidden secret message, the pixel pairs of the two generated intermediated shadows are switched with each other according to a binary random number string, Another topic worth discussing is improvements to the produced shadow size.As we know, if the size of generated shadows is similar to or smaller than the size of the cover image, it is easier to manage and transmit the generated shadows.However, a tradeoff must be made between the size of the shadows and the size of the hidden secret.Smaller generated shadows may limit the size of hidden secret data even when relatively easier to manage and transmit.Thus, in the proposed IH-VSS scheme, the share size we define is the same as the cover image to keep the balance between the transmission efficiency and the size of the hidden secret message.Moreover, to enhance the security of the hidden secret message, the generated shadows are meaningful with the proposed IH-VSS scheme.
To enhance the security of the hidden secret message, the pixel pairs of the two generated intermediated shadows are switched with each other according to a binary random number string, except for the first four pixels, as shown in Step 5 of shadow generation phase and Figure 10.To further prove that such an arrangement does not affect the visual quality of the final generated shadows, Table 3 shows the PSNRs of intermediate shadows and final shadows under different ECs, which increase from 13,000 to 415,485 bits.The column named image O (before exchange) shows the PSNR of image O before the exchange method, and it is as high as 84.99 dB when the EC is 415,485 bits because only four pixel values have changed, as we demonstrated in Section 3.3.The column named image O 1 (after exchange) indicates the PSNR of the stego-image, which carries the secret using Kim et al.'s EMD-2 algorithm.The PSNR is larger than 52 dB when the EC is over 400,000 bits, which is significantly higher than 30 dB because the difference between the two pixel values before and after the hidden information is controlled between [0, 7] using Kim et al.'s EMD-2 algorithm.We also found that the PSNR of image O 2 increased with the happening of the exchange because the exchange of the original image pixel pairs making image O 2 contains not only the stego-pixel pairs, but also some original pixel pairs.Therefore, the PSNR of image O 2 remains at a very high level, as shown in Table 3.To demonstrate that the histograms of the original image "Lena" and its two shadows are similar, even when the size of our hidden secret message reaches the upper bound with our proposed IH-VSS, pixel values ranging from 125 to 175 is selected and demonstrated in Figure 12.The reason we selected such pixel range because it is the middle range of the pixel value [0, 255] for a given grayscale image, and most of the pixels of the image are in this range, which makes the detailed phenomenon of the frequencies of the cover image and shadows can be shown.In general, the stego-pixel values could be different from the cover image after shadows carried the secret message.However, Figure 12 shows that the difference of the frequencies is considerably small.This conclusion is further supported by Figures 13 and 14  before and after the hidden information is controlled between [0, 7] using Kim et al.'s EMD-2 algorithm.We also found that the PSNR of image 2 O  increased with the happening of the exchange because the exchange of the original image pixel pairs making image 2 O  contains not only the stegopixel pairs, but also some original pixel pairs.Therefore, the PSNR of image 2 O  remains at a very high level, as shown in Table 3.To demonstrate that the histograms of the original image "Lena" and its two shadows are similar, even when the size of our hidden secret message reaches the upper bound with our proposed IH-VSS, pixel values ranging from 125 to 175 is selected and demonstrated in Figure 12.The reason we selected such pixel range because it is the middle range of the pixel value [0, 255] for a given grayscale image, and most of the pixels of the image are in this range, which makes the detailed phenomenon of the frequencies of the cover image and shadows can be shown.In general, the stegopixel values could be different from the cover image after shadows carried the secret message.However, Figure 12 shows that the difference of the frequencies is considerably small.This conclusion is further supported by Figures 13 and 14      Table 4 also demonstrates the pixel values with the top eight highest number of pixels of the cover image and the two shadows.The data of first line, colored in blue, tells that the pixel value 155 has the maximum number of 2723 in the cover image, correspondingly, the number in shadow1 and shadow2 is 2711 and 2714.These three numbers have similar values.On the other hand, the pixel value 130 has the 5th largest number of pixels (colored in light brown), 2493, 2572 and 2519 are the numbers in the cover image, shadow1 and shadow2, respectively.These three numbers are very close too.The same thing happens to the top eight, as shown in Figure 14, in fact, to all the pixel values.Such results indicate that the proposed IH-VSS scheme is not only visually imperceptible, but also quantitatively negligible.Table 4 also demonstrates the pixel values with the top eight highest number of pixels of the cover image and the two shadows.The data of first line, colored in blue, tells that the pixel value 155 has the maximum number of 2723 in the cover image, correspondingly, the number in shadow1 and shadow2 is 2711 and 2714.These three numbers have similar values.On the other hand, the pixel value 130 has the 5th largest number of pixels (colored in light brown), 2493, 2572 and 2519 are the numbers in the cover image, shadow1 and shadow2, respectively.These three numbers are very close too.The same thing happens to the top eight, as shown in Figure 14, in fact, to all the pixel values.Such results indicate that the proposed IH-VSS scheme is not only visually imperceptible, but also quantitatively negligible.Table 4 also demonstrates the pixel values with the top eight highest number of pixels of the cover image and the two shadows.The data of first line, colored in blue, tells that the pixel value 155 has the maximum number of 2723 in the cover image, correspondingly, the number in shadow1 and shadow2 is 2711 and 2714.These three numbers have similar values.On the other hand, the pixel value 130 has the 5th largest number of pixels (colored in light brown), 2493, 2572 and 2519 are the numbers in the cover image, shadow1 and shadow2, respectively.These three numbers are very close too.The same thing happens to the top eight, as shown in Figure 14, in fact, to all the pixel values.Such results indicate that the proposed IH-VSS scheme is not only visually imperceptible, but also quantitatively negligible.Figure 15a-h uses the cover image to generate the corresponding shadow1 and shadow2 with different schemes.Again, it is proved that the proposed IH-VSS offers the highest PSNRs for two shadows no matter which cover image is adopted.Two reasons can explain this result.First, a finite change of pixel values is caused during the embedding procedure of Kim et al.'s EMD-2 algorithm.Second, the stego-pixel pairs of the two generated intermediate shadows are further switched by using the uniformly distributed pseudo-random string of {0, 1} generated by the function randi() at the end of the shadow generation phase.Thus, no matter which image is served as the cover image, PSNRs of the two shadows can be guaranteed to be greater than 50 and be very close.
Figure 16 shows the average execution time of four schemes.Compared with schemes of Qin et al. [33] and Liu et al. [25], our proposed scheme requires less execution time, but takes more time than scheme of Chang et al. [28].Consider the average PNSR of generated shadows with our proposed scheme is 1.3 times more than that of Chang et al.'s scheme.We believe the execution time of our proposed scheme is acceptable.

Conclusions and Future Work
This paper presents a distortion-free friendly IH-VSS scheme.In the shadow generation phase, using Kim et al.'s M matrix and a random number, two meaningful shadows are produced and distributed to participants.In the extraction and restoration phase, the hidden secrecy information and cover image can be credibly and correctly extracted and reconstructed, respectively.Experimental results confirm that no valuable secret information can be obtained with invalid shadows.The switching strategy conducted on pixel pairs between two intermediate shadows during the shadow generation phase makes the hidden and non-hidden pixel pairs of the two final shadows appear to be randomly distributed, making the difference between the two final shadows quite small.
The shadow images are friendly and meaningful, and the reversibility can be achieved.A relatively good balance can be achieved between the high embedding capacity and the satisfying PSNR of the meaningful shadows.The shadow generation phase is quite efficient; therefore, the proposed IH-VSS scheme is quite suitable for real-time applications.To enhance the practicality of our proposed scheme, our future work will focus on designing the hiding strategy so that the tampered areas of the shadows can be identified at the extraction and restoration phase.Combined with Table 5, it can be concluded that Chang et al.'s scheme sacrifices PSNR to achieve higher execution efficiency, while Qin et al.'s and Liu et al.'s work has the disadvantage of relatively smaller storage volume but higher PSNR.The proposed scheme, which makes a compromise between the amount of EC and PSNR, makes the PSNR close to or in most cases greater than 50 dB, while at the same time, the EC reaches more than 400,000 bits, and the execution efficiency is quite good.

Conclusions and Future Work
This paper presents a distortion-free friendly IH-VSS scheme.In the shadow generation phase, using Kim et al.'s M matrix and a random number, two meaningful shadows are produced and distributed to participants.In the extraction and restoration phase, the hidden secrecy information and cover image can be credibly and correctly extracted and reconstructed, respectively.Experimental results confirm that no valuable secret information can be obtained with invalid shadows.The switching strategy conducted on pixel pairs between two intermediate shadows during the shadow generation phase makes the hidden and non-hidden pixel pairs of the two final shadows appear to be randomly distributed, making the difference between the two final shadows quite small.
The shadow images are friendly and meaningful, and the reversibility can be achieved.A relatively good balance can be achieved between the high embedding capacity and the satisfying PSNR of the meaningful shadows.The shadow generation phase is quite efficient; therefore, the proposed IH-VSS scheme is quite suitable for real-time applications.To enhance the practicality of our proposed scheme, our future work will focus on designing the hiding strategy so that the tampered areas of the shadows can be identified at the extraction and restoration phase.

Figure 1 .
Figure 1.Flowchart of the share generation process of Shamir's scheme.
a in the k equations in Equation (3) and regenerate the (k − 1)-degree polynomial function ( ) f x given by Equation (1) to be:

Figure 1 .
Figure 1.Flowchart of the share generation process of Shamir's scheme.
+ in M. By using Equation (11), we can calculate all the values of the matrix.
being handled, collect the four processed pixels and the rest of the original pixels of the cover image O and denote them as image O ′ .The first four pixels of image O ′ are called 1 o ′ , 2 o ′ , 3 o ′ and 4 o ′ .The relevant preprocessing is illustrated in Figure 4.

Figure 3 .Step 2 :
Figure 3. Rand3LSB(p i ) function.Step 2: Process the first four pixels of the cover image O with the random diffusion function Rand3LSB(p i ).After being handled, collect the four processed pixels and the rest of the original pixels of the cover image O and denote them as image O .The first four pixels of image O are called o 1 , o 2 , o 3 and o 4 .The relevant preprocessing is illustrated in Figure 4. Symmetry 2019, 11, x FOR PEER REVIEW 9 of 21

Figure 4 .
Figure 4.The preprocessing procedure of the cover image O .
that is constituted by the grayscale values of two adjacent pixels i p and 1 i p + .For example, pixel i p has a pixel grayscale value of 42 and pixel 1 i p + has grayscale value of 41.The resulting pixel pair is

Figure 5 .
Figure 5.The definition of pixel pair.

Figure 4 .
Figure 4.The preprocessing procedure of the cover image O.

1 p
is the first pixel value and 2 p is the second pixel value.The subscript of p increases continuously until the maximum value is H W × .Define pixel pair that is constituted by the grayscale values of two adjacent pixels i p and 1 i p + .For example, pixel i p has a pixel grayscale value of 42 and pixel 1 i p + has grayscale value of 41.The resulting pixel pair is

Figure 5 .
Figure 5.The definition of pixel pair.

Figure 5 .
Figure 5.The definition of pixel pair.

Figure 8 .
Figure 8.The preprocessing procedure of the secret information S ′ .

Figure 7 .Step 1 : 2 :
Figure 7. Flowchart of the embedding phase.Step 1: Name the first four pixels of cover image O as o 1 , o 2 , o 3 , and o 4 .Step 2: Combine the lowest three digits of o 1 , o 2 , o 3 , and o 4 to form R = (101 011 001 110) 2 .Define the sign of operation as a concatenate function.Following the previous example, if S = 001011011111, then S = S R = (001011011111101011001110) 2 , and the final number Srepresented by a number in 9-base system is (5602450) 9 .We specify that S is in the binary number, S is the 9-base number corresponding to S, and actually, they have the same value.In addition, we express S in this form S = s 1 s 2 . . .s n , where n = |S | is the length of the number string S , and s k (k ∈ [1, n]) is every digit in this number.This preprocessing procedure is illustrated in Figure8.

Figure 8 .
Figure 8.The preprocessing procedure of the secret information S ′ .Step 3: Conduct the function RNG Num ( ) to generate the seed of the () randi function, where RNG Num ( ) function controls random number generation so that the same string of {0, 1} will be generated by () randi on the secret distributor and receiver, which allows encrypt and decrypt participants to use the same {0, 1} string.Step 4: Pair each of the remaining pixels in image O ′ with their adjacent pixels to form nonoverlapping pixel pairs, such as 1 ( , ) i i o o + ′ ′ .Thus, there will be   2 -2

Figure 8 .
Figure 8.The preprocessing procedure of the secret information S

Figure 9 .
Figure 9. Example of the concealment phase with matrix M.

Figure 9 .
Figure 9. Example of the concealment phase with matrix M.

Step 1 : 4 : 2 O 1 O
Combine the three LSBs of the first and second pixels of O to form a 6-bits of binary string.Then transform the 6-bits binary string into the decimal number system and name it Num1.Next, combine the three LSBs of the third and fourth pixels of O to form Num2. Finally, a decimal value named Num, which is the sum of Num1 and Num2, is derived.Step 2: Set RNum = randi([0 1], H × W /2 − 2, 1) to get a binary string, such as (100010100110 1001 . . . . . .00101110) 2 , of which the length is not greater than H × W /2 − 2. Step 3: Generate the two shadows O 1 and O 2 .For shadow O 1 , the first two pixels are the same as those of image O, but the following two pixels are derived from the Rand3LSB(pi) function with the third and the fourth pixels of image O. On the contrary, the third and the fourth pixels of shadow O 2 are the same as those of image O.But the first two pixels of shadow O 2 are derived from the Rand3LSB(p i ) function with the first two pixels of image O. Step Pair the adjacent pixels of image O and image O , except the first four pixels, to form non-overlapping pixel pairs.Use RNum as symbolic bits to decide to copy pixel pairs of O and O to shadow1 O 1 or shadow2 O 2 .When the current bit of RNum is '0', the pixel pair of image O is copied to the corresponding position of shadow1 O 1 , and the pixel pair of image O is copied to the corresponding position of shadow2 O 2 .When the symbolic bit of RNum is '1', the pixel pair of image O is copied to the corresponding position of shadow2 O 2 , and the pixel pair of image O is replicated to the corresponding position of shadow1 O 1 .The detailed shadow generation procedure is shown in Figure 10.Step 4 will be repeated until all pixel pairs of images O and O are processed.image O  is copied to the corresponding position of shadow2 2 O  .When the symbolic bit of RNum is '1', the pixel pair of image O ′ is copied to the corresponding position of shadow2  , and the pixel pair of image O  is replicated to the corresponding position of shadow1  .The detailed shadow generation procedure is shown in Figure 10.Step 4 will be repeated until all pixel pairs of images O ′ and O  are processed.
o o ′ ′ =(71, 65)in O′ , 5 6 ( , ) o o   =(73, 66)in O  , '1' in Rnum (all colored in red) are the first two pixel pairs and the first random bit we use to do with.As the symbolic bit is '1', for 1 )(see the red arrow).And then, the next bit is '0' of Rnum (colored in blue), for 1

Step 2 .
Search in Kim et al.'s M matrix according to images O , O, and the function M −1 ; the embedded information in each pixel pair can then be derived sequentially.Step 3. Copy the last 12 bits of the secret information S back to image O derived in Step 1.Thus, the original image O is restored exactly.
which show the pixel values ranging from 180 to 200 and 0 to 255 (all possible pixel values of an image), respectively.
which show the pixel values ranging from 180 to 200 and 0 to 255 (all possible pixel values of an image), respectively.

Figure 12 .
Figure 12.The histogram of the cover image and the two shadows (pixel values: 125-175).Figure 12.The histogram of the cover image and the two shadows (pixel values: 125-175).

Figure 12 .
Figure 12.The histogram of the cover image and the two shadows (pixel values: 125-175).Figure 12.The histogram of the cover image and the two shadows (pixel values: 125-175).

Figure 13 .
Figure 13.The histogram of the cover image and the two shadows (pixel values: 180-200).

Figure 14 .
Figure 14.The histogram of the cover image and the two shadows (pixel values: 0-255).

Figure 14 .
Figure 14.The histogram of the cover image and the two shadows (pixel values: 0-255).

Figure 14 .
Figure 14.The histogram of the cover image and the two shadows (pixel values: 0-255).

Figure 16 .
Figure 16.Average execution time of schemes.

Figure 16 .
Figure 16.Average execution time of schemes.

Table 3 .
PSNRs of two generated shadows with the increasing EC (EC: Embedding capacity; BE: Before Exchange; AE: After Exchange).

Table 3 .
PSNRs of two generated shadows with the increasing EC (EC: Embedding capacity; BE: Before Exchange; AE: After Exchange).

Table 5 .
[28]arison of PSNR among different VSS schemes when the EC is 415,484 bits (all the data except the proposed scheme come from[28]).