Joint Hamming Coding for High Capacity Lossless Image Encryption and Embedding Scheme †

: Encryption is a widely used solution to prevent privacy leakage and illegal spread when sensitive images are uploaded to cloud storage. Hiding technology also allows conﬁdential data to be embedded into encrypted images for secret communication. As image accuracy without distortion is essential within certain ﬁelds (such as medicine and the military), sensitive images must be completely decrypted back into the original images. However, an encrypted image is a noise-like pattern that is meaningless to a user; thus, it is difﬁcult for a user to ﬁnd the accurate image they desire. Take keywords as search indexes and embed them in encrypted images for encrypted image retrieval as an example. This idea has been extended by Chen and Line’s scheme to achieve higher capacity with reversibility. The proposed scheme adjusts the coding results according to smooth and complex images to increase its hiding capacity. In addition, two thresholds are designed to adjust the predicted pixel value to be close to the original one. Experiments show that compared with the other schemes, the proposed method achieves superior results. In addition, a hidden encrypted image can be extracted from the cover image. Afterward, the hidden secrets can be completely extracted, and sensitive images can also be perfectly restored.


Introduction
Private web albums rely on a cloud service for owners to back up personal photos. This is a convenient but insecure platform that enables malicious users to illegally log in and obtain sensitive content for illegal dissemination. Image encryption offers a feasible solution to this potential security risk by allowing users to encrypt sensitive content into meaningless content before uploading it. To confirm the security and validity of image encryption, several techniques, such as compound homogeneous hyper-chaotic [1], Chaotic Map [2], and Rubik's cube method [3], are applied to image encryption. An encrypted image exists in a kind of noise-like mode. Data cannot be obtained without the secret keys, even through statistical calculations. However, meaningless image content is difficult for the owner to manage. Data hiding can cleverly embed the search index into an encrypted image for subsequent image retrieval so that owners can efficiently find specific photos from a large number of encrypted images. In addition, privileged data, such as patient name or identity, can be embedded in encrypted images to preserve a patient's privacy.
For some specific fields, such as medical and military fields, image distortion is unacceptable. Therefore, after extracting the hidden data, the medical image must be completely restored. Such methods are referred to as Reversible Data Hiding (RDH) methods [4][5][6][7]. When reversibility is applied to encrypted images, it is called the RDHEI method .
Zhang's scheme [25] encrypts the most significant five bits (MSB) in the original pixel through XOR operation with the random bit stream. Later, it compresses the least significant bit (LSB) of the encrypted image to create space for embedding the secret. However, the embedding rate of the test image "Lena" is very low, only 0.017 bpp (bits per pixel). The decrypted image is similar to but not the same as the original image. Hong et al. [11] applied side matching information to improve the quality of restoration, which is about 1.21% higher than Zhang's [25]. Qian et al. [16] used a progressive method to achieve concealment and recovery quality of 0.043 bpp and 38.1 dB, respectively. To increase confidentiality, Zhang [33] generated two different keys to encrypt images and hide messages in images; the keys were then distributed to different authorized users.
To achieve reversibility, Ma et al. [14] proposed a reversible data embedding scheme utilizing histogram shifting technology in encrypted images. Qian et al. [17] used error correction codes in Huffman coding to increase the amount of hidden information. Based on the pixel concept, which is similar to surrounding pixels, Cao et al. [8] compressed the image to make room for data embedding. However, the spatial correlation changed after the image was encrypted [12]. To resolve this shortcoming, Huang et al. [12] unitized a key design to maintain the spatial correlation even after image encryption. Zhou et al. [32] predicted pixels using neighboring pixels for secret embedding. Unfortunately, the pixels could be fully restored. In order to improve the security, the scheme [10,30] uses homomorphic encryption to encrypt the image. However, the scheme in [10,30] has low hiding capacity and encounters the problem of pixel expansion. Using the histogram shifting technique, Huang et al. [12] regard the MSB as the secret embedded in the LSB of the encrypted block.
To increase the hiding capacity, Yi et al. [22] utilized parameter binary tree labels to mark the redundant relationship between pixels and blocks. In Yi et al.'s scheme [22], the average hidden payload displayed based on the 2 × 2 and 3 × 3 block sizes were 1.752 and 2.003 bpp, respectively. Yin et al. [24] observed that the MSB of the original pixel and the predicted pixel are usually the same, which can be used to make room for secret embedding. In addition, Huffman coding is applied to reduce the size of the indicator, which is used to indicate the number of MSBs that can be leveraged to embed secrets per pixel. Yin et al.'s scheme [24] provides good pixel predictions to improve the hidden payload. However, an image encrypted through MSB prediction is easily decoded through statistical analysis [34]. To address this issue, a hiding and encryption method [35] integrated with Hamming coding is proposed in this paper. The MSB prediction can be shuffled using Hamming coding with a secret key. To achieve good pixel prediction, the proposed scheme designs two thresholds used in [24] to flexibly adjust the predicted value to be close to the original one. To improve the hiding capacity of the technique in [35], the Hamming code encoding is based on two different image types: smooth and complex images.

Proposed Scheme
The proposed scheme includes a secret embedding and encryption stage (in Section 2.1) and a secret extraction and decryption stage (in Section 2.2).

Secret Embedding and Encryption Stage
For clarity, the stage is divided into four steps, namely prediction, difference calculation, Hamming coding calculation and shuffling, and secret embedding and encryption. The details of each step are described as follows.
In the prediction step, since pixels are similar to their neighboring pixels, the pixels located in the first row and first column are regarded as unchanged seed pixels, named reference pixels, which are used to predict the neighboring pixels. Aside from the reference pixels, the predicted pixels represented byp(i, j) are calculated via Equation (1) based on the neighboring pixels of the pixel p(i, j), where (i, j) is the location of the pixel in the given image O, t 1 and t 2 are thresholds that control the predicted value close to p(i, j). For example, as shown in Figure 1, the neighboring pixels of p(2, 2) are p(1, 1), p(1, 2) and p(2, 1) and the corresponding pixel values are 100, 102 and 105, respectively. Because p(1, 1) is less than p(1, 2) and p(2, 1),p(2, 2) will be 106 when t 1 is 1. Next, in the difference calculation step, we use Equation (2) to convert p(i, j) and p(i, j) into two bitstreams. The k-th bits corresponding to p(i, j) andp(i, j) are respectively expressed as p k (i, j) andp k (i, j), where "mod" is a modular operation. For example, if p(2, 2) is equal to 108, then p 8 (2, 2) is 0. Then, Equation (3) is used to calculate the difference between the two numbers p(i, j) andp(i, j), where ⊕ is the exclusive OR operation. As for the example shown in Figure 1, if p(2, 2) andp(2, 2) are 108 and 106, the result of Equation (3) is 00000110, denoted by x(2, 2). With Equation (4), the kth most significant bit of x(i, j) equal to 1 is denoted by c d (i, j). In the same example, if x(2, 2) is equal to 00000110, the value c d (2, 2) will be 3. Next, c * (i, j) is calculated with Equation (5) to represent the number of consecutive MSBs of the original pixel equal to that of its predicted pixel. For example, the value of c * (2, 2) is 5. In other words, in the example, five MSBs of the pixel p(2, 2) can be predicted byp (2,2). The value of the 6th MSB of p(i, j) can be recovered as the flipped value ofp (2,2). Thus, the c * (i, j) + 1 MSB of the pixel p(i, j) can be used to hide the secret.
In the Hamming coding calculation and shuffling step, when applying Hamming coding matrix [36], we convert the c * (i, j) into a bit stream as an indicator, depicted by (w 1 w 2 w 3 ). Noted that since (w 1 w 2 w 3 ) can only appear in eight cases, but there are actually nine cases in the difference calculation, the cases are defined according to smooth and complex images. The image judges the type of image based on the higher capacity in the smooth type encoding or complex one. The image type (smooth and complex are marked as "s" and "c", respectively) is treated as a parameter saved in the database. If it is a smooth image, values of c * (i, j) equal to 0 and 1 fall into the same case. Therefore, with regard to the smooth image, the decimal value of the indicator (w 1 w 2 w 3 ) is the value of c * (i, j) − 1 if c * (i, j) is larger than 0 (the fallen cases are recorded under "Label" in Table 1). If it is a complex image, the values of c * (i, j) equal to 7 and 8 fall into the same case; in such a situation, if c * (i, j) is equal to 8, then the decimal value of (w 1 w 2 w 3 ) is adjusted to 7 (also recorded under "Label" in Table 1). For example, in Figure 1, the value c * (i, j) generates the indicator (w 1 w 2 w 3 ) as 101 if the image is a complex image.
Essentially, the value w 1 w 2 w 3 can represent which case the pixel has fallen into, which indicates the hiding capacity. Next, the value of w 1 w 2 w 3 is assigned to Equation (7), and the values of w * 1 , w * 2 and w * 3 can be found to make the condition mC satisfy the value of w 1 w 2 w 3 (as shown in Equation (7)). The Hamming coding matrix is used as the first round to shuffle the original values of w 1 w 2 w 3 to produce the values of w * 1 , w * 2 and w * 3 . For example, if c * (2, 2) is equal to 5, w 1 w 2 w 3 will be 101. While satisfying Equation (7)), the values of w * 1 , w * 2 and w * 3 will be 1, 1, and 0, respectively. Subsequently, the value w * 1 w * 2 w * 3 is recalculated as w 1 w 2 w 3 for the second round of shuffling with Equation (8), where r 1 r 2 r 3 is generated by a random number generator with the key s 1 . In the previous example, if the value of r 1 r 2 r 3 is 001, w 1 w 2 w 3 will be 110 ⊕ 001 = 111.
In the secret embedding and encryption step, the bit stream of the embedded pixel consists of three parts as shown in Figure 2, in which the embedded pixel is represented by p (i, j). The first part is for the Hamming encoding code, which expresses which case the given pixel p(i, j) falls into. The first three MSBs of the embedded pixel equate to the second-round shuffling result w 1 w 2 w 3 .
As for the second part in Figure 2, the values of the "Payload" column in Table 1, depicted by payload(i, j), indicate the number of secret bits to-be embedded to the pixel p(i, j). In this part, the hiding capacity for different types of images is listed in Table 1. Here, the fallen cases, the capacity, the code length, and pure payload are denoted by "Label", "Capacity", "Code length" and "Payload", respectively. The column "Label" indicates the decimal value of the indicator (w 1 w 2 w 3 ), "Capacity" refers to the amount of changeable bits for a given pixel, "Code length" is the code length of Hamming codes, and "Payload" represents the pure hiding capacity (i.e., the result of "Capacity" value minus the "Code length" value). For example, for a complex image, the payload is 3 if Label is 5 (i.e., 6 − 3 = 3). If payload(i, j) is less than 0, no secret data are hidden. In addition, the original |payload(i, j)| MSBs of the pixel p(i, j) are regarded as part of the to-be hidden secret data, where |b| is the absolute value of b. When payload(i, j) is larger than 0, the second part of the p (i, j), bits of the secret data, are equal to the values from the 4th MSB bit to the payload(i, j) + 3-th MSB bits of the p (i, j). The third part is the last (5 − payload(i, j)) bits of p(i, j) if payload(i, j) is larger than 0; otherwise, the last five bits of the embedded pixel are kept the same as those of p(i, j).
In the same example, p (i, j) can be constructed as 11100100, and the first 3 MSBs w 1 w 2 w 3 as 111; the second part for embedding payload(i, j) bits of secret data (e.g., obtain three bits of the to-be hidden data (001 in this example), owing to the w 1 w 2 w 3 equal to 101 in Table 1); and the third part as the last (i.e., 5 − 3 = 2) bits of the original pixel (i.e., the last two bits of original pixel p(2, 2) are 00). If payload(i, j) is less than 0, no data are hidden in this situation, and the 4th MSB onward to the last bit of p(i, j) is equal to that of p (i, j). For clarity, the k position of the pixel p (i, j) is represented by p k (i, j). In the image encryption stage, the key s 2 generates a random number r(i, j), where the k bit of r(i, j) is represented as r k (i, j). Finally, p (i, j) can be encrypted via Equation (9) with key s 2 . For example, if r k (2, 2) is 01011001, the encrypted pixel p * (2, 2) will be (10111101) 2 = 189.

Capacity Code Length Payload Capacity Code Length Payload
Let

Secret Extraction and Decryption Phases
This phase consists of three steps: the decryption step, data extraction step, and recovery step.
In the decryption step, the keys s 1 and s 2 will generate random bits r 1 r 2 r 3 and r(i, j). Using Equation (9), the encrypted pixel p * k (i, j) can be decrypted as p k (i, j), where r k (i, j) is the random bit used to decrypt the k bits of pixel p k (i, j). Thus, the p k (i, j) can be reconstructed as 10111101 ⊕ 01011001 = 11100100.
In the data extraction step, the value of w * 1 w * 2 w * 3 can be obtained through Equation (8) key s 1 . In the same example, the values of w 1 w 2 w 3 and r 1 r 2 r 3 are 111 and 001, which output w * 1 w * 2 w * 3 as 111 ⊕ 001 = 110. After that, the first 3 MSBs of the decrypted image are integrated as w * 1 w * 2 w * 3 with predicted pixelsp 5 (i, j),p 6 (i, j),p 7 (i, j) andp 8 (i, j) using Equation (7) to calculate mC. mC determines w 1 w 2 w 3 . The decimal of w 1 w 2 w 3 represents the indicator in column "Label" of Table 1. Mapping to a fallen case, if the corresponding value of payload(i, j) is larger than 0, we can obtain the hidden data from the 4th MSB to the 3 + payload(i, j)th MSB of p (i, j) as shown in the second piece of Figure 2. In contrast, if payload(i, j) is less than 1, no secret data are extracted.
The algorithm for the recovery step is shown in Algorithm 1. The value of "Capacity" in Table 1 (for clarity, the value depicted by payload(i, j), represents the number of bits that can be recovered from the predicted pixel). Furthermore, two recovery situations are for smooth images and complex images. For the smooth image, if payload(i, j) equals 0, no bits of the predicted pixelp(i, j) can be used to recover the original pixel p(i, j), and the original 3 MSBs of p(i, j) are recovered through the hidden data extracted by other pixels. As for a complex image, if payload(i, j) is less than 1, the |payload(i, j)| MSBs are also recovered by the hidden data extracted by other pixels. The 4th MSB onward to the last bit of p(i, j) is recovered by that of p (i, j).
If payload(i, j) is larger than 0, the first payload(i, j) − 1 MSBs of the predicated pixel are the same as the first payload(i, j) − 1 MSBs of the original pixel. In addition, the payload(i, j)th MSB of p(i, j) is recovered by the flipped value ofp(i, j). The last 5 − payload(i, j) bits of p (i, j) can be used to recover those of p(i, j). That is, the payload(i, j)th MSB of p(i, j) is equal to 1 −p 8−payload(i,j) (i, j).

5:
the last 5 − payload(i, j) bits of p(i, j) are recovered by that of p (i, j). 6: else if payload(i, j) ≤ 0 then 7: if Image is tagged as s then 8: the original 3 MSBs of p(i, j) can be recovered by the other pixels. 9: else if Image is tagged as c then 10: |payload(i, j)| MSBs are recovered by the other pixels. 11: the last 5 bits of p(i, j) are recovered by that of p (i, j).

Experimental Results
This section shows the experimental results and compares them with the results of [9,15,22,35,37,38]. Three test images: Lena, Baboon and Jetplane, as shown in Figure 3. In addition, the measured metric PSNR (Peak Signal-to-Noise Ratio), as seen in Equation (10), is used to evaluate the visual quality. After the image is encrypted, the encrypted results of  Hidden capacity is expressed in bits per pixel (bpp). Table 2 shows the hiding capacity of the test images Lena, Baboon and Jetplane. Here, the field "Label" is mapped to the falling case according to the value of c * (i, j) and the image type (smooth or complex image), and the "distribution" is the number of pixels classified into the same "Label". "Payload" refers to pure payload. The payloads of the images Lena, Baboon and Jetplane are 2.58, 1.19 and 3.43 bpp, respectively, which are higher than those in [35]. In addition, the experiments showed that the prediction results for smooth images (such as Lena and Jetplane) were better than those for complex images (such as Baboon), which resulted in smooth images having greater hiding capacity than complex images did. Moreover, thresholds t 1 and t 2 settings are the flexible factors for different images to make the prediction pixel close to the original ones. The close prediction causes a better hiding capacity. Table 3 compares the payload (bpp) of the proposed scheme with the methods in [9,15,22,35,37,38]. The results show that the proposed method outperforms the six other algorithms. Table 2. The pure payloads of images "Lena", "Baboon" and "Jetplane".

Conclusions
Image encryption aims to encrypt sensitive data to protect privacy for the image owner. This paper proposes a reversible data embedding scheme using Hamming coding in encrypted images. On average, the code length is 3 bpp to expand the hiding capacity. In the experiment, the hiding capacity of the proposed scheme is greater than that in [9,15,22,35,37,38] for both smooth and complex types of images. In addition, the proposed technique enables an encrypted image to be completely restored to its original state after the hidden data are extracted.