A Novel (2, 3)-Threshold Reversible Secret Image Sharing Scheme Based on Optimized Crystal-Lattice Matrix

: The ( k , n )-threshold reversible secret image sharing (RSIS) is technology that conceals the secret data in a cover image and produces n shadow versions. While k ( k ≤ n ) or more shadows are gathered, the embedded secret data and the cover image can be retrieved without any error. This article proposes an optimal (2, 3) RSIS algorithm based on a crystal-lattice matrix. Sized by the assigned embedding capacity, a crystal-lattice model is ﬁrst generated by simulating the crystal growth phenomenon with a greedy algorithm. A three-dimensional (3D) reference matrix based on translationally symmetric alignment of crystal-lattice models is constructed to guide production of the three secret image shadows. Any two of the three different shares can cooperate to restore the secret data and the cover image. When all three image shares are available, the third share can be applied to authenticate the obtained image shares. Experimental results prove that the proposed scheme can produce secret image shares with a better visual quality than other related works.


Introduction
With the rapid development of the information technology, people can transmit data to each other through the internet. However, plaintext transmitted in the network is very easy to access, duplicate, temper, or even destroy by malicious attackers. Thus, the concern of data transmission security emerged. Therefore, image steganography techniques, for instance reversible and irreversible data hiding, have been introduced to conceal the secret data in cover images. Currently we have, according to the technique core, data hiding schemes which can be roughly categorized into the LSB substation [1,2], the difference expansion (DE) [3,4], the histogram shifting (HS) [5,6], the reference matrix-based [7][8][9][10], and the pixel-value differencing (PVD) [11,12] approaches. Since the modification of the cover image is very subtle, the constructed marked images cannot be distinguished from the cover one visually. Therefore, these data hiding techniques have significantly enhanced the security level of data transmission.
Instead of hiding secret data in a single cover image, the visual cryptography proposed by Naor and Shamir [13] hides secret data in multiple image shadows. Their method consists of two phases. First, in the dealing phase, a dealer divides the secret data in n image shadows and distributes the data to different participants. Secondly, in the reconstruction phase, k or more than k shadows are gathered and stacked together. The secret data can be retrieved without any error. However, the visual cryptography suffers from two problems. First, each image share looks meaningless and may catch the eavesdroppers' attention during transmission. Secondly, the produced image shadows are larger than the secret image in scale.
Later, many different secret image sharing (SIS) schemes [14][15][16][17] have been proposed. The method in [14] preserves the image scale and the secret image can be retrieved di-
Guarantee the reversibility using any two of the three image shadows; 3.
Perform an excellent cheating detection ratio.
The rest of this article is organized as follows. Section 2 introduces the method proposed by Gao et al. in [30]. Section 3 presents the proposed crystal-lattice matrix and the image shadow production process in detail. Our experimental results are illustrated in Section 4. Finally, the conclusions are summarized in Section 5.

Review of Gao et al.'s Method
The (2,3) reversible secret sharing scheme proposed by Gao et al. [30] is composed of three steps, including the fractal matrix construction phase, the image shadow production phase, and the data extraction together with the image recovery phase, as introduced in Sections 2.1-2.3, respectively.

Fractal Matrix Construction Phase
In the method implemented by Gao et al., they defined two types of fractal groups which are composed of four 2 × 2 × 2 fractal models and nine 3 × 3 × 3 fractal models, respectively, as shown in Figures 1-3. The projections of both fractal models on the three axial planes are a perfect square, as shown in Figures 4 and 5. As shown in the figure, each location at a square projection is occupied by a unique model element. Furthermore, the same conclusion can be found in the projections of the two fractal groups on the three axial planes, shown in Figures 6 and 7. posed by Gao et al. in [30]. Section 3 presents the proposed crystal-lattice matrix and the image shadow production process in detail. Our experimental results are illustrated in Section 4. Finally, the conclusions are summarized in Section 5.

Review of Gao et al.'s Method
The (2,3) reversible secret sharing scheme proposed by Gao et al. [30] is composed of three steps, including the fractal matrix construction phase, the image shadow production phase, and the data extraction together with the image recovery phase, as introduced in Sections 2.1-2.3, respectively.

Fractal Matrix Construction Phase
In the method implemented by Gao et al., they defined two types of fractal groups which are composed of four 2 × 2 × 2 fractal models and nine 3 × 3 × 3 fractal models, respectively, as shown in Figures 1-3. The projections of both fractal models on the three axial planes are a perfect square, as shown in Figures 4 and 5. As shown in the figure, each location at a square projection is occupied by a unique model element. Furthermore, the same conclusion can be found in the projections of the two fractal groups on the three axial planes, shown in Figures 6 and 7.   Section 4. Finally, the conclusions are summarized in Section 5.

Review of Gao et al.'s Method
The (2, 3) reversible secret sharing scheme proposed by Gao et al. [30] i of three steps, including the fractal matrix construction phase, the image shad tion phase, and the data extraction together with the image recovery phase, as in Sections 2.1-2.3, respectively.

Fractal Matrix Construction Phase
In the method implemented by Gao et al., they defined two types of fra which are composed of four 2 × 2 × 2 fractal models and nine 3 × 3 × 3 frac respectively, as shown in Figures 1-3                  The fractal matrix sized 256 × 256 × 256 is constructed by arranging fractal groups consecutively along the main diagonal direction. Since the sizes of Type I and Type II fractal groups are 4 × 4 × 4 and 9 × 9 × 9, respectively, the fractal matrix contains ⌊256/4⌋ = 64 adjacent Type I fractal groups or ⌊256/9⌋ = 28 adjacent Type II fractal groups, where ⌊•⌋ denotes the floor function. Without the loss of generality, the fractal matrix with Type II fractal model sized 3 × 3 × 3 is applied in the following description.

Image Shadow Production Phase
Based on a cover image , their scheme produces three image shadows, 1 , 2 , and 3 , with the guidance of the fractal matrix. The given cover image sized × is first rearranged into a pixel sequence = { , = 1,2, … , × } in the raster scan order. Then, the pixels in the sequence are consecutively processed. Each time, a pixel is duplicated into a triplet ( , , ) and the triplet is modified into ( 1 , 2 , 3 ) according to the given secret digit and the fractal matrix. The pixel values of the modified triplet are then separately recorded in the three image shadows of the corresponding spatial location.
The rules of modification are as follows. First, the triplet ( , , ) is treated as the 3D coordinates of an element in the fractal matrix. Since the coordinates of the three axes are identical, the located element lays on the main diagonal line of the fractal matrix. Recall that if the main diagonal line is consecutively arranged with fractal groups, the located element must be within a fractal group. The index of the located fractal group can be determined by = ⌊ /9⌋, where ⌊•⌋ denotes the floor operation. The 9 × 9 × 9 space occupied by a fractal group contains nine main diagonal elements as well as nine fractal models. To ensure the reversibility, a one-to-one mapping between the nine main diagonal elements and the nine fractal models is preassigned. An example of numbering the fractal models is shown in Figure 7. Thus, the target fractal model ( , , ) sized 3 × 3 × 3 for data embedding can be determined by = mod 9, where mod is the modulo operation. The exact target element of embedding is determined by the 9-based secret digit , which satisfies ( , , ) = . Finally, the shadow pixels ( 1 , 2 , 3 ) can be obtained by   The fractal matrix sized 256 × 256 × 256 is constructed by arranging fractal groups consecutively along the main diagonal direction. Since the sizes of Type I and Type II fractal groups are 4 × 4 × 4 and 9 × 9 × 9, respectively, the fractal matrix contains 256/4 = 64 adjacent Type I fractal groups or 256/9 = 28 adjacent Type II fractal groups, where · denotes the floor function. Without the loss of generality, the fractal matrix with Type II fractal model sized 3 × 3 × 3 is applied in the following description.

Image Shadow Production Phase
Based on a cover image I, their scheme produces three image shadows, S 1 , S 2 , and S 3 , with the guidance of the fractal matrix. The given cover image I sized W × H is first rearranged into a pixel sequence I V = {p i , i = 1, 2, . . . , W × H} in the raster scan order. Then, the pixels in the sequence are consecutively processed. Each time, a pixel p i is duplicated into a triplet (p i , p i , p i ) and the triplet is modified into (p i1 , p i2 , p i3 ) according to the given secret digit q k and the fractal matrix. The pixel values of the modified triplet are then separately recorded in the three image shadows of the corresponding spatial location.
The rules of modification are as follows. First, the triplet (p i , p i , p i ) is treated as the 3D coordinates of an element in the fractal matrix. Since the coordinates of the three axes are identical, the located element lays on the main diagonal line of the fractal matrix. Recall that if the main diagonal line is consecutively arranged with fractal groups, the located element must be within a fractal group. The index of the located fractal group can be determined by n G = p i /9 , where · denotes the floor operation. The 9 × 9 × 9 space occupied by a fractal group contains nine main diagonal elements as well as nine fractal models. To ensure the reversibility, a one-to-one mapping between the nine main diagonal elements and the nine fractal models is preassigned. An example of numbering the fractal models is shown in Figure 7. Thus, the target fractal model F n M (x, y, z) sized 3 × 3 × 3 for data embedding can be determined by n M = p i mod 9, where mod is the modulo operation. The exact target element of embedding is determined by the 9-based secret digit q k , which satisfies F n M (x t , y t , z t ) = q k . Finally, the shadow pixels (p i1 , p i2 , p i3 ) can be obtained by A simple example is elaborated for a better understanding of the embedding phase of Gao et al.'s method. Suppose the cover pixel p i = 16 and the 9-based secret digit q k = 3. The index of the target fractal group is n G = p i /9 = 1, and the number of the fractal model used for data embedding is determined by n M = 16 mod 9 = 7. According to Figure 7, the target fractal model located by n M = 7 is F n M (3 : 5, 6 : 8, 6 : 8), as circled in red in 3D and 2D projected versions. To embed the secret digit q k = 3, the exact matched element is F n M (4, 8,8) = 3, as shown in Figure 5. Thus, the shadow pixels (p i1 , p i2 , p i3 ) can be obtained by Finally, the shadow pixels are recorded into shadow images S 1 , S 2 , and S 3 . Notice that 9 is not a factor of 256, so four pixel values are not covered by any fractal group. In their method, the pixel values 0, 1, 254, and 255 are left intact. To simplify explanation, the pixel values 0 and 1 are not excluded from fractal groups in our demonstration.

Data Extraction and Cover Image Restoration Phase
By using any two of the three shadows, Gao et al.'s method can extract secret data and restore the cover image. Without a loss of generality, suppose shadows S 1 and S 2 are applied to decrypt secret data and cover image. The pixels in both images are rearranged into vector sequences S V1 = {p 1i , i = 1, 2, . . . , W × H} and S V2 = {p 2i , i = 1, 2, . . . , W × H} first. Then, consecutively process the pixel pair (p i1 , p i2 ) to decrypt data. Take the pixel pair (p i1 , p i2 ) = (13, 17) as an example. Its corresponding fractal group is located by n G = p 1i /9 = 1. Then, its projected coordinates in the fractal group can be obtained by R x , R y = (13 mod 9, 17 mod 9) = (4, 8), which belongs to the fractal model  (4,8) map to model index n M = 7, whose range of z-coordinate can be further determined by referring to yz or xz projection. The secret digit can be extracted by applying the modulo operation R x2 , R y2 = (13 mod 3, 17 mod 3)=(1, 2) and mapping to the fractal model, as shown in Figure 9. The mapped value at (1, 2) of xy-projection is q k = 3. Finally, the cover pixel value can be restored by p i = 9 × n G + n M = 9 × 1 + 7 = 16.  (2) Finally, the shadow pixels are recorded into shadow images 1 , 2 , and 3 . Notice that 9 is not a factor of 256, so four pixel values are not covered by any fractal group. In their method, the pixel values 0, 1, 254, and 255 are left intact. To simplify explanation, the pixel values 0 and 1 are not excluded from fractal groups in our demonstration.

Data Extraction and Cover Image Restoration Phase
By using any two of the three shadows, Gao et al.'s method can extract secret data and restore the cover image. Without a loss of generality, suppose shadows 1 and 2 are applied to decrypt secret data and cover image. The pixels in both images are rearranged into vector sequences 1 = { 1 , = 1,2, … , × } and 2 = { 2 , = 1,2, … , × } first. Then, consecutively process the pixel pair ( 1 , 2 ) to decrypt data. Take the pixel pair ( 1 , 2 ) = (13,17) as an example. Its corresponding fractal group is located by = ⌊ 1 /9⌋ = 1. Then, its projected coordinates in the fractal group can be obtained by ( , ) = (13 mod 9, 17 mod 9) = (4,8), which belongs to the fractal model (3: 5,6: 8,6: 8). Note that the range of the -coordinate is unique by referring to Figure   8. The coordinates (4,8) map to model index = 7, whose range of -coordinate can be further determined by referring to or projection. The secret digit can be extracted by applying the modulo operation ( 2 , 2 ) = (13 mod 3, 17 mod 3)=(1,2) and mapping to the fractal model, as shown in Figure 9. The mapped value at (1, 2) of projection is = 3. Finally, the cover pixel value can be restored by = 9 × + = 9 × 1 + 7 = 16.  Based on the 9 × 9 × 9 fractal group, a reversible (2, 3) secret image sharing scheme can be realized. Two 9 × 9 × 9 fractal groups and their projections on the , , and planes are plotted in Figure 10, where each group contains 9 fractal models displayed with different colors. Recall that the original cover pixel triplet ( , , ) lays on the main Based on the 9 × 9 × 9 fractal group, a reversible (2, 3) secret image sharing scheme can be realized. Two 9 × 9 × 9 fractal groups and their projections on the xy, yz, and zx-planes are plotted in Figure 10, where each group contains 9 fractal models displayed with different colors. Recall that the original cover pixel triplet (p i , p i , p i ) lays on the main diagonal line. To embed secret data, the pixel values are modified into the space occupied by the fractal groups. The deviation of the target element from the main diagonal line directly influences the distortion of pixel values in the image shadows. To produce image shadows with a minimum distortion, the target elements should be arranged to the surroundings of the main diagonal line. Observe that the vicinity of the conjunction

Proposed Scheme
The proposed reversible (2, 3) threshold secret image sharing scheme is based on the same frame structure as the fractal matrix-based scheme. The crystal-lattice matrix is proposed to address the weakness of the fractal matrix. Construction of the crystal-lattice matrix is firstly introduced in Section 3.1, where the growth of a crystal lattice and the construction of a crystal-lattice matrix are also presented. The shadow image generation phase and the decryption phase are explained in Sections 3.2 and 3.3, respectively.

Crystal-Lattice Matrix
To reduce the distortion of secret image shadows, the fundamental model associated with each element on the main diagonal line of the 3D reference matrix should be arranged closely around it. To achieve this goal, a greedy algorithm is proposed to construct an optimal fundamental model. Inspired by the growth of a crystal material, we treated the elements on the main diagonal line as the seeds for crystallization. The fundamental models are the lattices grown simultaneously and crowdedly toward the radial directions from the stream of seeds. Meanwhile, the projections of the lattices on each axial plane should be unique to meet the requirement of (2, 3)-threshold secret sharing. Subject to these constraints, the greedy algorithm is applied to append the nearest element, one at a time, to each lattice at the same relative location until the predefined range is fully searched. Suppose the seed elements are (x, y, z) = (p, p, p), p ∈ [w : 255 − w] and w is the window width of the search range. The candidate elements to be appended are To ensure a greedy choice that minimizes the distortion each time, the candidates within the search range are fully listed and sorted in the ascending order of Euclidean distance. Table 1 lists the sorted processing queue of w = 1 together with their square Euclidean distance The crystal growth Algorithm 1 is summarized as follows.
The lattice model M and the crystal-lattice matrix C are equivalent. The former records the deviation vectors from the seed of all elements in a crystal lattice; the latter is a fully sized matrix which labels the lattice index of each matrix element. The two versions can be converted into each other through simple manipulations. In Step 1, switching the order of scanning the elements in the predefined search range may change the queue list and the resulting output. As shown in Table 1, the elements indexed 1 to 6 in the queue are equidistant from the seed. Switching scanning order may change the order of these elements and thus change the greedy selection. Some possible results are mutually spatial symmetric. However, this factor does not lead to significant influence on the output performance.
A fully sized matrix C is created in Step 2 to record the lattice index of each occupied element. The initial value v max is used to indicate an unoccupied state. Three two-dimensional matrices P xy , P yz , and P zx are created in Step 3 to record the projected locations of included elements. In Step 4, we check the simultaneous growth of all models by including the new greedy choice that do not overlap each other in 3D space and the projected axial planes first. When the choice is available, it is recorded to the lattice model and the labeling matrices. Note that Equation (6) is not necessary, since Equations (7)-(9) are stricter constraints.
The final volume of the lattice model is determined by the required payload of each cover pixel. When the payload of each cover pixel is s bits, the final lattice volume is 2 n . A proper window width w should be set to ensure a sufficient range of searching. A slightly oversized window width is alright. Table 2 lists the set of deviation vectors for the lattice model with 2 n = 16. The 3D view of its corresponding crystal-lattice matrix together with projections on the three axial planes are provided in Figure 11. The embeddable elements are translationally symmetric duplications of the crystal-lattice model along the main diagonal line. The distribution is approximately a cylindrical shape, as expected. In addition, the projection views demonstrate the uniqueness at each location. As shown in the figures, the elements of a crystal lattice are not connected. An element that violates any of Equations (7)-(9) is not available for embedding. This strict rule results in a sparse distribution of the lattice elements.
Initialize the three projection matrices P xy , P yz , and P zx sized 256 × 256 by

4.
Retrieve an element dk x ,d k y ,d k z from Q. If Equations (6)-(9) hold, record dk x ,d k y ,d k z to M, mark the matrix elements by Equations (10)-(13), and update the counter m = m + 1; else, skip this element.
C p +d k x , p +d k y , p +d k z = m, p ∈ [w : 255 − w] P xy p +d k x , p +d k y = m, p ∈ [w : 255 − w] P yz p +d k y , p +d k z = m, p ∈ [w : 255 − w]

Repeat
Step 4 until the required queue volume 2 n is satisfied.

6.
Fill each lattice model with a random permutation of 0 to 2 n − 1 generated by key K  Recall that a lattice model is the embeddable space of its corresponding seed element. Before the crystal-lattice matrix can be applied as the 3D reference matrix for data embedding, a random permutation of distinct integer values from 0 to 2 n − 1 should be assigned to the elements of each lattice model. The random permutation can be determined by a secret key K shared in advance.

Shadow Image Generation
As mentioned above, the proposed data hiding scheme shares the same scenario as the fractal matrix-based scheme proposed by Gao et al. in [30]. The system diagram of the new proposed scheme is shown in Figure 12. Through the cover of a regular image, three indistinguishable data-embedded shadows are generated and separately distributed to three participants. Any two participants can cooperate to decrypt the secret data and the cover image losslessly. When all three shadows are available, the third shadow can be exploited to check the integrity of these shadows. The shadow generation Algorithm 2 is given as follows.

Algorithm 2. The shadow generation algorithm
Input: The cover image I, the binary secret stream S, the parameters n, w, and the key K. Output: Three image shadows S 1 , S 2 , and S 3 .

1.
Construct the crystal-lattice matrix C according to n, w, and the key K.

4.
For each pixel in I V , do Retrieve a secret digit s k . Find C(p i1 , p i2 , p i3 ) = s k subject to C(p i1 , p i2 , p i3 ) ∈ M(p i , p i , p i ).

Else
Record p i , p i , p i to S 1 , S 2 , S 3 , respectively. End

5.
Terminate Step 4 when the secret sequence is exhausted. 6.
Copy the remaining cover pixel values to the image shadows directly and close all files.
. . , 2 n , whose seed element is C(p i , p i , p i ). To further elaborate the key process in Step 4, an example has been provided. Suppose the cover pixels are I V = {5, 10, 11}, n = 4, w = 7, and the secret digits are S 16 = {7, 5}. The detail of processing the three cover pixels are as follows.  Figure 13a, whose projections on the three axial planes are displayed in Figure 13b-d. Its seed element valued 2 is squared in blue in the projection views. Since the secret digit to be embedded is s k = 7, the element C(10, 8, 13) = 7, circled in yellow, is the targeted. The pixel values 10, 8, 13 are recorded to S 1 , S 2 , S 3 , respectively. (3) Pixel p i = 11: This pixel value also belongs to the embeddable range, the next digit s k = 5 is retrieved from S 16 . The translated lattice model M (11,11,11) is the group of yellow elements displayed in Figure 13. Its seed element valued 10 is squared in blue in the projection views. Since the secret digit to be embedded is s k =5, the element C(11, 6, 16) = 5, circled in red, is the targeted. The pixel values 11, 6, 16 are recorded to S 1 , S 2 , S 3 , respectively. The resulting shadows are S 1 = {5, 10

Secret Decryption, Image Recovery, and Authentication
Recall that any two shadows among the three can decrypt the secret and restore the cover image for a (2, 3) threshold RSIS scheme. Without a loss of generality, suppose the shadows S 1 and S 2 are available; the following Algorithm 3 can be applied to decrypt the secret digits and restore the cover image.

Algorithm 3. The secret decryption and image recovery algorithm
Input: Two image shadows S 1 and S 2 , the matrix parameters n, w, the key K. Output: The cover image I, the binary secret stream S.

1.
Construct the crystal-lattice matrix C according to n, w, and the key K.

2.
Create the projection matrix P xy and fill in the element values by referring to C.

4.
For each pixel pair (p i1 , p i2 ) in S 1V and S 2V , do Find the secret digit and the cover pixel value by p i = p j , subject to P xy (p i1 , p i2 ) ∈ M xy p j , p j (15) Record the secret digit s k to S n ; record p i to I End

5.
Convert S n into the binary secret stream S.
In the process of secret image generation, pixel values are in fact the spatial coordinates of the model elements. Recall that the crystal-lattice models are all seeded at the main diagonal line of the crystal-lattice matrix. Therefore, the embeddable elements are confined around the line. By leveraging data integrity of the image shadows, we can authenticate a suspected shadow based on a faithful share. Suppose we hold the faithful shadow S 1 . The authentication of the suspected shadow S 2 is given in Algorithm 4.
Based on the same concept, we can devise an authentication algorithm for three image shadows. Since the secret binary stream and the cover image can be restored with two secret shares, the pixel values of the additional third share are uniquely determined. The data integrity of three shares provides a strong restriction to detect tampered shadows. The authentication for three image shadows is given in Algorithm 5.
Note that the two authentication algorithms are both based on the data integrity of image shadows. The tampered shares can only be detected based on faithful shares. When we only get a faithful share in hand, Algorithm 4 can be applied first to check data integrity. In case the integrity check is failed, we can detect the tampered share by using Algorithm 5. However, the detection rate of the two-shadow version is slightly weaker, which will be further discussed in the next section.

Algorithm 4. The authentication algorithm for two image shadows
Input: Two image shadows S 1 and S 2 , the matrix parameters n, w, and the key K. Output: Authentication report.

1.
Construct the crystal-lattice matrix C according to n, w, and the key K.

2.
Create the projection matrix P xy and fill in the element values by referring to C.

4.
For each pixel pair (p i1 , p i2 ) in S 1V and S 2V , do Else Authentication failed and program stop. End

Algorithm 5. The authentication algorithm for three image shadows
Input: Three image shadows S 1 , S 2 , and S 3 , the matrix parameters n, w, and the key K. Output: Authentication report.

1.
Construct the crystal-lattice matrix C according to n, w, and the key K. For each pixel triplet (p i1 , p i2 , p i3 ) in S 1V , S 2V , and S 3V , do : 255]), Current pixel passed.

Else
If C(p i1 , p i2 , p i3 ) ∈ U, current pixel passed, Else Authentication failed and program stop. End

Experimental Results
This section demonstrates the performance of the proposed scheme by some simulations. The programs are all implemented by MATLAB R2017b software running on a MacBook Pro (Retina, 15-inch, Late 2013) computer. The macOS High Sierra operating system is loaded in the computer, and its CPU and RAM are 2.3 GHZ Intel Core i7 and 16 GB, respectively. Eight standard grayscale test images of size 512 × 512 are applied in our experiment, as shown in Figure 14.
Commonly, the PSNR, defined in Equation (18), is exploited to evaluate the quality of the generated shadows. PSNR = 10 × log 10 255 2 e MSE , (dB) (18) where e MSE , defined in Equation (19), is the mean square error between the cover image and the compared shadow.
where represents the total length of embedded secret stream and is the number of shadows. Although three image shadows are generated, the restoration of secret data and cover image requires only two shares. We apply = 2 to calculate EC in the following experimental data.

Visual Quality of Image Shadows
The matrix parameter controls the volume of the lattice model 2 and thus determines the embedding capacity. To embed integer number of secret bits for each cover pixel, we apply the values = 2, 3, and 4 in our experiments. According to Equation (20), EC values are 1, 1.5, and 2, respectively. The average PSNR values of the three image shadows, over the eight test images, are listed in Table 3. As the value increases, the visual quality of image shadows degrades. Besides, the average PSNR values of three shadows are not the same. The worst case for = 2, 3, and 4 are , , and , respectively. Note that the PSNR value is calculated from the deviation of modified pixelvalue. By referring to Table 2, we can obtain the four leading entries that applied in the case of = 2, where the maximum deviation −2 occurs at . That is why the worst PSNR occurs at the shadow . The other cases can be explained in the same way. Recall that the scanning order of candidate elements may alter the queue sequence; thus the resulting list in the lattice model can affect the PSNR relationship of three shadows.

Comparison with Gao et al.'s Scheme
In this subsection, we compare our scheme with the (2, 3) threshold secret image sharing scheme proposed by Gao et al. [30]. In their scheme, two fractal models sized where W and H are the width and the height of the images. I ij and S ij are the pixel values at the location (i, j) of the cover image and the shadow, respectively. The metric EC, defined in Equation (20), is the embedding capacity measured in bits per pixel (bpp), where N S represents the total length of embedded secret stream and k is the number of shadows. Although three image shadows are generated, the restoration of secret data and cover image requires only two shares. We apply k = 2 to calculate EC in the following experimental data.

Visual Quality of Image Shadows
The matrix parameter n controls the volume of the lattice model 2 n and thus determines the embedding capacity. To embed integer number of secret bits for each cover pixel, we apply the values n = 2, 3, and 4 in our experiments. According to Equation (20), EC values are 1, 1.5, and 2, respectively. The average PSNR values of the three image shadows, over the eight test images, are listed in Table 3. As the value n increases, the visual quality of image shadows degrades. Besides, the average PSNR values of three shadows are not the same. The worst case for n = 2, 3, and 4 are S 2 , S 3 , and S 2 , respectively. Note that the PSNR value is calculated from the deviation of modified pixel-value. By referring to Table 2, we can obtain the four leading entries that applied in the case of n = 2, where the maximum deviation −2 occurs at d y . That is why the worst PSNR occurs at the shadow S 2 . The other cases can be explained in the same way. Recall that the scanning order of candidate elements may alter the queue sequence; thus the resulting list in the lattice model can affect the PSNR relationship of three shadows. In this subsection, we compare our scheme with the (2, 3) threshold secret image sharing scheme proposed by Gao et al. [30]. In their scheme, two fractal models sized 2 × 2 × 2 and 3 × 3 × 3 are provided. The two models comprise four and nine embeddable elements, respectively. Fortunately, the volume of our lattice model is adjustable. To make a fair comparison, we set the same volumes and calculate experimental data as listed in Tables 4 and 5. As shown in the tables, the visual quality of image shadows produced by our scheme outperforms Gao et al.'s scheme with a gap about 3 dB. The improvement, as expected, can be explained by referring to Figures 10 and 11, where the embeddable elements are distributed in lumped shapes and in a uniform cylindrical shape, respectively. In addition, the total embedded bits are also listed in the tables. Due to different solutions for the boundary problem of 3D reference matrices, the total payload of the proposed scheme is slightly greater than Gao et al.'s scheme.

Authentication
In this section, we conduct a series of experiments to verify the applicability of the proposed Algorithms 4 and 5 for authentication, which are based on the integrity check of two shadows and three shadows, respectively. The secret image shadows are generated with a lattice model M of 2 n = 16.
Verification of Algorithms 4: A demonstration of two-shadow authentication is given in Figure 15. By using image Boat as the cover image, the shadow generation algorithm produces three image shadows. Suppose we hold a faithful shadow S 1 , as shown in Figure 15a, while shadow S 2 has been tampered with a window region replaced by image Cameraman, as shown in Figure 15b. The tamper detection result by applying Algorithm 4 to the shadows S 1 andŜ 2 is displayed in Figure 15c, where black pixels in the window region fail to pass the integrity check. Only a small portion of pixels displayed in white has passed. Verification of Algorithm 5: A demonstration of two-shadow authentication is presented in Figure 16, where real shadows S 1 , S 2 and tampered shadowŜ 3 are displayed in Figure 16a-c, respectively. The tamper detection result by applying Algorithms 5 is displayed in Figure 16d. Verification of Algorithm 5: A demonstration of two-shadow authentication is presented in Figure 16, where real shadows , and tampered shadow are displayed in Figure 16a-c, respectively. The tamper detection result by applying Algorithms 5 is displayed in Figure 16d. The detection rate (DR) to evaluate the performance of integrity check is defined by where denotes the total number of tampered pixels and denotes the number of detected ones. To investigate the performance of our authentication algorithms, the detection rates for the eight cover images are listed in Table 6. The DR value is above 90 percent for the two-shadow version and above 99 percent for the three-shadow version. The high DR value is not surprising, since the embeddable elements just occupy a small The detection rate (DR) to evaluate the performance of integrity check is defined by where N T denotes the total number of tampered pixels and N D denotes the number of detected ones. To investigate the performance of our authentication algorithms, the detection rates for the eight cover images are listed in Table 6. The DR value is above 90 percent for the two-shadow version and above 99 percent for the three-shadow version. The high DR value is not surprising, since the embeddable elements just occupy a small portion of the 3D crystal-lattice matrix. As the volume of lattice model increases, the DR value slightly decreases. Nonetheless, in any case, it is almost impossible for a tampered shadow to pass the authentication algorithms.

Comparison with Other Related Schemes
In this section, we compare the features of the proposed scheme with other different secret image sharing schemes, including Chang et al.'s scheme in 2014 [10], Chang et al.'s scheme in 2020 [28], and Li et al.'s scheme [29]. As shown in Table 7, the schemes proposed in [10] and [28] use multiple cover images, and these cover images cannot be recovered after extracting secret data. While the proposed scheme and Li et al.'s scheme [29] use a single cover image to generate multiple image shares, the cover image can be recovered by the recipient. Besides, our new scheme provides two versions of authentication. When the third faithful shadow is available, the detection rate of our scheme is the highest among all. Even if one of the three shadows is not available, the proposed scheme can still reach a cheating detection ratio of 95 percent.  Table 8 shows the execution time for the embedding and extracting phases of our scheme when P is set as 4 and 9. The execution time is less than 0.2 s for the embedding phase and less than 0.4 s for the extraction phase. We can conclude that the proposed scheme is computationally efficient and suitable for real time applications.

PDH Analysis
The pixel-value differencing histogram (PDH) is a histogram which is constructed based on the frequency of the difference between every two adjacent elements in an image. For a natural image, the PDH should exhibit a peak at the zero-difference value and gradually descend outward as the blue curves, as shown in Figure 17. The PDH of four cover images together with their corresponding shadows are plotted in Figure 17, where the high embedding mode of P = 9 is applied. Obviously, the normal PDH shape of a natural image is well preserved for all the image shadows.

Conclusions
This paper uses a crystal-lattice matrix to improve the visual quality of image shadows of the (2, 3) threshold RSIS scheme. A greedy algorithm is proposed to automatically generate the lattice modFel, which is the fundamental unit of the crystal-lattice matrix. The volume of the lattice model is adjustable to meet the desired embedding capacity. In addition, two authentication algorithms are devised based on the data integrity. Experimental results demonstrate the applicability of the proposed scheme. Besides, the visual quality of image shadows is significantly improved, as expected.
The (k, n)-threshold RSIS schemes with k < n is a novel frame structure that is more flexible in application than the conventional approach of (n, n)-threshold RSIS. We will try to find better solutions to improve the overall performance of the secret image sharing scheme.