A Reversible Data-Hiding Method for Encrypted Images Based on Adaptive Quadtree Partitioning and MSB Prediction

Abstract

To address the vulnerability of the widely used block permutation and co-XOR (BPCX) encryption algorithm in reversible data-hiding in the encrypted domain (RDH-ED), which is susceptible to known-plaintext attacks (KPAs), and to enhance embedding capacity, we propose a novel technique of reversible data-hiding in encrypted images (RDH-EI). This method incorporates adaptive quadtree partitioning and most significant bit (MSB) prediction. To counteract KPAs, we introduce pixel modulation specifically targeting pixels within blocks of the same level during the encryption phase. During data embedding, we utilize tagging bits to indicate the state of the pixel blocks, capitalizing on pixel redundancy within those blocks to augment embedding capacity. Our experimental results demonstrate that our method not only achieves reversibility and separability but also significantly boosts embedding capacity and method security. Notably, the average embedding rate across the 10,000 images tested stands at 2.4731, surpassing previous methods by 0.2106 and 0.037, respectively.

1. Introduction

Data-hiding encompasses steganography and watermarking techniques, primarily leveraging the information redundancy of carrier data, to embed additional data. This embedding serves to fulfill security functions, including privacy protection, covert communication, digital signatures, and copyright authentication. Among modern data-hiding technologies, reversible data-hiding in the encrypted domain (RDH-ED) stands out as a prominent branch. Its defining characteristic lies in the encryption of the carrier used for data embedding. This approach mandates that the embedded data is not only precisely extracted from the ciphertext but also allows for the reversible restoration of the original plaintext [1]. RDH-ED addresses the dual security concerns of content privacy and secure communication, emerging as a crucial encrypted domain signal-processing technique. Its applications are wide-ranging, spanning telemedicine diagnosis, cloud services, and data security management in judicial or military contexts [2].

Many RDH-ED methods have been proposed [3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25], depending on the different sources of redundancy. The prevailing RDH-ED technologies can be categorized into three primary types: vacating room after encryption (VRAE), vacating room before encryption (VRBE), and vacating redundancy in encryption (VRIE) [23,24]. In 2011, ref. [4] introduced an RDH-ED approach based on stream cipher encryption. During the calculation, the fluctuations within each image block are calculated, but the pixels along the four boundaries are ignored. To address this limitation, a novel and enhanced function was proposed in [5], to assess the complexity of each image block more accurately, thereby effectively reducing the average extraction error rate. Ref. [15] first proposed the RDH-ED method of VRBE. Before encryption, the owner segments the cover image into two distinct sets, S and T. They embed the least significant bits (LSBs) from set S into set T, creating space for additional data embedding, followed by the encryption of the cover image. This approach enables the data hider to embed additional data into the encrypted image, ensuring error-free data extraction and image restoration, thus achieving genuine reversibility. Subsequently, ref. [17] introduced a novel method termed high-capacity separable reversible data-hiding in encrypted images (HC-SRDHEI). Compared to Ma’s methodology, it offers superior embedding capacity and improved decryption image quality. In 2018, ref. [18] introduced the most significant bit (MSB) prediction technique as a substitute for the conventional LSB-replacement embedding approach. Their method involves predicting pixels before image encryption and presenting two techniques: correcting prediction error (CPE) and embedding prediction error (EPE). While these effectively enhance embedding capacity, they fall short of fully reversibly restoring the original image. Later that year, ref. [20] refined the EPE method through a recursive approach, achieving complete reversible recovery of the original image and boosting embedding capacity. Following this, ref. [13] put forth a novel reversible data-hiding in encrypted images (RDH-EI) method based on adaptive MSB prediction. This advanced technique takes full advantage of pixel correlations within blocks, thereby achieving an optimal capacity increase while ensuring reversibility and separability. To further refine the method proposed [13], ref. [14] introduced a new approach that combines adaptive quadtree partitioning (AQP) with MSB prediction. In this method, regions characterized by smooth textures exhibit superior embedding performance, whereas regions with more intricate textures demonstrate poorer embedding capabilities. Furthermore, it has been highlighted that the block permutation and co-XOR (BPCX) encryption algorithm, which is frequently employed in this type of methodology, exhibits vulnerabilities against certain known-plaintext attacks (KPAs) [26].

In summary, the design objectives of our scheme were to endow it with complete reversibility, separability, a substantial embedding capacity, and robust resistance against the KPA outlined in [26]. Leveraging AQP and MSB prediction, we introduce a novel RDH-EI approach. In the encryption phase, pixel bit modulation is incorporated, to bolster the security of the BPCX encryption algorithm. Throughout the data embedding process, tagging bits serve to denote the state of the pixel block, optimizing the utilization of inter-pixel redundancy and, thereby, elevating the embedding capacity. Our experimental findings demonstrate the proposed approach’s efficacy in withstanding the KPA attack outlined in [26]. Additionally, our method achieved maximum embedding capacity for 8056 images, with an average embedding rate of 2.4731 across 10,000 tested images, surpassing the results reported in [13,14]. In summary, the primary contributions of this paper can be outlined as follows:

• The paper integrates adaptive quadtree partitioning and MSB prediction, to propose an innovative RDH-EI technique that overcomes the KPA vulnerability of the BPCX algorithm in RDH-ED and improves the embedding capacity.
• During the encryption phase, Arnold permutation is introduced for pixel bit modulation, enhancing the security of the BPCX encryption algorithm and defending against KPA attacks.
• Throughout the data embedding process, tagging bits serve to denote the state of the pixel block, optimizing the utilization of inter-pixel redundancy and, thereby, elevating the embedding capacity.

The remainder of this paper is structured as follows: Section 2 offers a concise overview and analysis of the methodologies presented by [13,14]. Section 3 delves into the detailed exposition of our proposed method. Our experimental outcomes are presented in Section 4, while Section 5 concludes the paper with a summary.

2. Related Works

2.1. Adaptive MSB Prediction

After the data hider receives the encrypted image, by adaptive MSB prediction the upper-left pixel is used as the target pixel for each pixel block, to predict the MSB shared among the remaining pixels, so that the remaining pixels can adaptively retain the remaining unshared bits to free up the embedding space, thereby increasing embedding capacity.

In this section, the methods of Wang et al. [13] and Qi et al. [14] are introduced and analyzed. In [13], the M $\times$ N sized image is first divided into several non-overlapping 2 × 2 sized pixel blocks. All the pixels in the block are decomposed into eight-bit binary pixels, and then the block-level encryption is performed, using the encryption key and the classic stream cipher, thereby maintaining the correlation between the pixels in the block, to a certain extent; $b_m^k(i,j)$ denotes that the kth bit of the pixel at position $(i,j)$ in the pixel block is encrypted as through (1):

$$e_m^k(i,j)=b_m^k(i,j)\oplus r^k(i,j),k=0,1,\dots ,7$$

(1)

where $r^k(i,j)$ denotes the kth value of the element at $(i,j)$ in the pseudo-random matrix. The final encrypted image is then obtained by permuting each 2 $\times$ 2 sized image block, using the permutation key. Upon receiving the encrypted image, data-hiding will be implemented. Initially, the encrypted image is partitioned into several non-overlapping 2 $\times$ 2 pixel blocks. Subsequently, pixel bit reconstruction is carried out, utilizing adaptive MSB prediction, which uses a 2 $\times$ 2 pixel block as the processing unit. The structure of the 2 $\times$ 2 pixel block is shown in Figure 1:

Each pixel block contains four elements: P, $C_1$, $C_2$, $C_3$. P will be used to predict other pixels. The four pixels are decomposed into eight bits, then the three variables, $d_1$, $d_2$, $d_3$, are obtained by (2):

$$d_i=dif(P,C_i),i=1,2,3$$

(2)

where $dif(a,b)$ returns the maximum number of least significant bit differences between two pixel values. Subsequently, the computation of (3) yields the variable md, which represents the MSBs shared by four pixels:

$$md=8-max(d_1,d_2,d_3)$$

(3)

Pixel blocks with md > 0 are selected as usable blocks for embedding data. Note that since $\mathit{md}\in [1,8]$, the value of MD = md-1 can be expressed as three bits. A binary matrix of size $⌊{\displaystyle \frac{\mathrm{M}}{2}}⌋\times ⌊{\displaystyle \frac{\mathrm{N}}{2}}⌋$ is employed as a location map, to differentiate between usable blocks and unusable blocks. Based on the binary values of P, $C_1$, $C_2$, $C_3$, and md, the usable blocks are reconstructed in pixel bits, thus vacating space for embedding data and being able to reversibly recover elemental pixel values when reconstructing the image. The procedure is divided into three steps:

1.

Eight bits of the upper-left pixel P and three bits of MD.

2.

Arrange the prediction errors $e_i$, respectively, where $e_i$ ($i=1,2,3$) is the remainder of $C_i$ after removing the shared MSBs.

3.

The remaining three × MD bits are the space available for data-hiding represented by $n_c$.

The result after pixel bit reconstruction is shown in Figure 2.

In Figure 3, an example illustrates pixel bit reconstruction for a 2 × 2 pixel block: $P=162={\left(10100010\right)}_2$, $C_1=161={\left(10100001\right)}_2$, $C_2=162={\left(10100010\right)}_2$, $C_3=161={\left(10100001\right)}_2$. Here, we can figure out that the md = 6, and then we can infer that $MD=5={\left(101\right)}_2$, $e_1={\left(01\right)}_2,e_2={\left(10\right)}_2,e_3={\left(01\right)}_2$, and the remaining 3 × (md − 1) bits are the space available for data-hiding represented by $n_c$.

Upon completion of pixel bit reconstruction, block permutation is executed, to rearrange the usable and unusable blocks in a raster scan order and reverse raster scan order, respectively. In a given location map, where ‘0’ represents an unusable block and ‘1’ represents a usable block, the inversion of this rearrangement is enabled, which also spends more redundant space to represent the location map.

The method [14] proposed by Qi et al. combines AQP with MSB prediction. The basic idea of quadtree segmentation is to iteratively and adaptively divide the square image (if the carrier image is not square, it can be extended by filling in the background) according to pre-set rules until all sub-blocks of the image satisfy these rules. The entire quadtree partitioning structure can be depicted using a binary group (I, rule). In each iteration, the current image is partitioned into four sub-blocks: upper left, upper right, lower left, and lower right. Each sub-block corresponds to a node within the quadtree partitioning structure. Sub-blocks that do not meet the predefined rules are further divided into the next node level, while those that meet the rules remain undivided and become leaf nodes. This process continues until the division stops at the smallest unit, resulting in the final quadtree partitioning structure. The rule is set, such that if the pixel difference within a block is less than or equal to the threshold (T) then no further partitioning occurs. If it exceeds T, further partitioning continues until blocks of size 2 × 2 are reached, which are not subdivided further, 2 × 2 blocks being the smallest units. T represents the minimum number of MSB bits shared by all pixels in the pixel block with the upper-left pixel. As shown in Figure 4, when T is set to 3, (a) depicts an 8 × 8 pixel block from the top-left corner of the Peppers image before partitioning, and (b) shows the block after quadtree partitioning. Through such a threshold setting, blocks of different sizes can be divided according to the different smoothness of the image. Compared with simply dividing the image into 2 × 2 sub-blocks, more embedding space can be freed up based on the different texture distributions of each image.

During the encryption, an M $\times$ N sized image is divided into 64 × 64 pixel blocks. For each 64 × 64 pixel block, after AQP based on a given T, the blocks are assigned four sizes: 16 × 16, 8 × 8, 4 × 4, and 2 × 2, represented by dim. Subsequently, the image is encrypted at the block level. Next, four blocks of the same level within each 64 × 64 sub-block are permuted according to the permutation key, which serves to resist analysis of the encrypted image and enhance its security. After receiving the encrypted image, the data hider initially employs adaptive MSB prediction, in conjunction with AQP, to vacate space for data-hiding. We discuss here [14], the case where the partition size is larger than 2 after AQP. The pixel bit reconstruction for a pixel block of this kind is divided into the following three steps:

1.

Eight bits of the upper-left pixel P, two bits of dim type (the sizes 16 × 16, 8 × 8, 4 × 4, 2 × 2 are denoted by 00, 01, 10, 11, respectively), and three bits of MD.

2.

Arrange the prediction errors $e_i$ ($i=1,...,$$di{m}^2-1$), respectively, where $e_i$ is the remainder of $C_i$ after removing the shared MSBs.

3.

The remaining $[md\times (di{m}^2-1)-5]$ bits are the space available for data-hiding represented by $n_c$.

A 4 × 4 sized block of pixels is used as an example, to specifically discuss pixel bit reconstruction. As shown in Figure 5, $P=162={\left(10100010\right)}_2$, $dim={\left(10\right)}_2$, $MD=md-1=5={\left(101\right)}_2$. In method [13], the same situation requires 56 tagging bits to represent the same pixel block after pixel bit reconstruction, while [14] only needs 43 bits. Because the pixel P and MD are used to predict other pixels, both necessitate arranging four times, in contrast to [14], wherein such an arrangement is only once. This means that fewer tagging bits can be used to represent the same pixel block, thus vacating more space for data-hiding. Additionally, since MSB prediction embedding is reversible, the extracting party can recover the original image without distortion while correctly extracting confidential information.

2.2. BPCX Analysis

The traditional stream encryption is not secure enough: it is easily attacked by key repetition, and it has limited key space, which affects the security. New encryption techniques, such as the PSO-based image encryption scheme using a modular integrated logistic exponential map, aim to enhance security through optimization and chaos theory, providing robust and complex encryption processes. Designs of two-dimensional hyperchaotic systems and the use of fractional-order 3D Lorenz chaotic systems and 2D discrete polynomial hyper-chaotic maps offer high-performance multi-image encryption. Additionally, methods like image encryption algorithms based on plane-level image filtering and discrete logarithmic transform have introduced novel approaches to increasing encryption complexity and security. These advancements aim to address the limitations of traditional stream ciphers and provide more secure and efficient encryption methods for modern needs. It bears emphasis that the BPCX encryption algorithm commonly employed during the encryption phase exhibits three salient characteristics:

1.

The maximum number of 0-bit and 1-bit values within an image block remains constant before and after encryption.

2.

The arrangement of pixels within a block does not alter the average value of the block.

3.

The arrangement of pixels within a block does not effectively cover the low frequency information in the image, resulting only in a transformation to a high-definition and fuzzy image.

In response to the first two properties, Qu et al. [26] proposed a KPA based on bit-block inversion and mean equivalent division (MED), to estimate the block permutation key for BPCX image encryption. The experimental results indicated that even for the smallest 2 × 2 blocks the average estimated accuracy of the block arrangement sequence was over 40%. When the block size exceeded 3 × 3, the accuracy of the block permutation key estimation surpassed 50%. This suggests that utilizing the BPCX encryption algorithm may pose certain security concerns. Based on the data, it is evident that using stream encryption alone is insecure. In recent years, new image encryption technologies have developed rapidly, such as PSO-based image encryption using modular integrated logistic exponential maps [27]; the MILE map addresses issues of low performance and the narrow chaos range in existing chaotic maps; the encryption efficiency is enhanced by optimizing the key, using the particle swarm optimization (PSO) algorithm. The novel 2D Rosenbrock map, based on the Rosenbrock function with excellent oscillating characteristics, is a two-dimensional hyperchaotic system that works through the optimization benchmark function [28]. Its application in multimedia encryption demonstrates outstanding chaotic capability, due to its regenerative and oscillating properties. Additionally, a newly designed fractional-order 3D Lorenz chaotic system and a 2D sine-constrained polynomial hyper-chaotic map (2D-SCPM) have been exploited for high-performance multi-image encryption [29]. Effective encryption of multiple images has been achieved, enhancing image encryption efficiency.

3. Proposed Method

To enhance the embedding performance, and against the KPA attack proposed in [26], a novel RDH-ED method is proposed. The framework of the method is outlined in Figure 6, which consists of three primary stages: A. Image Encryption. The cover image is encrypted by the image owner using the encryption key, yielding the encrypted image; B. Data-Hiding. Upon receipt of the encrypted image, the data hider employs the data-hiding key, to encrypt the data and embed it; C. Data Extraction and Image Recovery. Based on the type of key retained, the receiver can either extract the embedded information, decrypt the original image, or extract the data and decrypt the original image concurrently.

3.1. Image Encryption

In the stage of encryption, the image of size M $\times$ N is divided into four 256 × 256 pixel blocks, for each 256 × 256 size pixel block, and AQP is employed. The quadtree partitioning rule proposed in this paper is denoted as T. T represents the minimum number of MSB bits shared by all pixels in the pixel block with the upper-left pixel. Subsequently, based on the pre-set T, the image is further divided into 128 × 128, 64 × 64, 32 × 32, 16 × 16, 8 × 8, 4 × 4, and 2 × 2 pixel blocks of varying sizes. The specific process code of adaptive quadtree partitioning is in Algorithm 1:

Algorithm 1 Adaptive quadtree partitioning

Input:  I: image to be segmented; T: threshold  1:  procedure BUILDQUADTREE($node,x_1,y_1,x_2,y_2$);  2:      if The data difference is less than $threshold$. then  3:          $node$ indicates a leaf node;  4:          save data;  5:          return;  6:      else  7:            computation midpoint $mx\leftarrow (x_1+x_2)/2$, $my\leftarrow (y_1+y_2)/2$;  8:            BUILDQUADTREE($node.topLeft,x_1,y_1,mx,my$);  9:            BUILDQUADTREE($node.topRight,mx,y_1,x_2,my$);  10:          BUILDQUADTREE($node.bottomLeft,x_1,my,mx,y_2$);  11:          BUILDQUADTREE($node.bottomRight,mx,my,x_2,y_2$);  12:      end if  13:  end procedure  14:  Initializes the $root$ node;  15:  BUILDQUADTREE($root,x_1,y_1,x_2,y_2$) build a quadtree; Output:  S: segmented image; $block\_s$: block type

Block-level encryption is then performed, using the encryption key ${\mathrm{K}}_{\mathrm{e}}$ and the classical stream cipher. This process ensures that the partitioning structure S, obtained through the encrypted image, remains identical to that obtained before encryption, which ensures the reversibility of the method. To counteract the KPA attack proposed in [26], pixel modulation is performed after block-level encryption. An example of pixel modulation is shown in Figure 7. For an encrypted image, according to the S derived from AQP, a round of Arnold permutation is first executed. According to md, this paper defines that for pixel values converted to eight bits binary, the high bits are the md bits starting from the highest bit, and the remaining 8-md bits are the low bits. Thereafter, using the permutable keys ${\mathrm{K}}_1$ and ${\mathrm{K}}_2$, the high and low bits of the pixels within each block are permuted, respectively. Next, we swap the high bits and low bits and, finally, based on the permutable key ${\mathrm{K}}_{\mathrm{p}}$, n rounds of Arnold permutation are applied to the pixel blocks of the same dim type, to generate the final encrypted image. When performing the Arnold permutation, the transformation of the positions is calculated by (4):

$$\left[\begin{array}{c}x{ }^{\prime }\\ y{ }^{\prime }\end{array}\right]=\left[\begin{array}{cc}1& b\\ a& ab+1\end{array}\right]\left[\begin{array}{c}x\\ y\end{array}\right]\left(modN\right)$$

(4)

where a and b are two scrambling parameters, n is the image sizes, and mod denotes the modulo operation.

3.2. Data-Hiding

After receiving the encrypted image, the data hider performs AQP according to the pre-set T. Due to the reversible nature of the operations in pixel modulation and the block-level encryption, the results S obtained from the partitioning process are identical to those derived in the encryption stage. Considering that the high and low bits of pixels are swapped during encryption, firstly, adaptive LSB prediction should be performed, the minimum number of shared LSB bits, thus md, should be obtained, and then the pixel bits, to vacate space for data-hiding and sending it to the receiver, should be reconstructed. Subsequently, pixel bit reconstruction is performed for different dim types, defining a set D = {000, 001, 010, 011, 100, 101, 110, 111} based on seven pixel block sizes $dim\times dim$: 128 × 128, 64 × 64, 32 × 32, 16 × 16, 8 × 8, 4 × 4, and 2 × 2. A class of partitioning sizes is mapped into three-bits binary representation by (5):

$$Dim=D\left(i\right),2^i=dim(i=0\dots 7)$$

(5)

In the process of pixel bit reconstruction, for cases of md = 0 or 1 use $MD=0={\left(000\right)}_2$ to represent it. It is necessary to consider two distinct situations: dim > 2 and dim = 2.

When dim > 2, the pixel bit reconstruction is performed in the following three steps:

1.

Eight bits of the upper-left pixel P, three bits of Dim (according to the value of dim obtained through (5)), and three bits of MD.

2.

Arrange the prediction errors $e_i$ ($i=1,...,$$di{m}^2-1$), respectively, where $e_i$ is the remainder of $C_i$ after removing the shared LSBs.

3.

The remaining $[md\times (di{m}^2-1)-6]$ bits are the space available for data-hiding, represented by $n_c$.

As shown in Figure 8, when dim = 4, the reconstruction of its pixel bits is as follows: $P=35={\left(00100011\right)}_2$, $Dim=D\left(2\right)={\left(010\right)}_2$, md = 5, $MD={\left(100\right)}_2$, e₁ = (001)₂, e₂ = (100)₂, e₃ = (010)₂, e₄ = (010)₂, e₅ = (010)₂, e₆ = (001)₂, e₇ = (001)₂, e₈ = (000)₂, e₉ = (000)₂, e₁₀ = (001)₂, e₁₁ = (011)₂, e₁₂ = (000)₂, e₁₃ = (000)₂, e₁₄ = (010)₂, e₁₅ = (001)₂, and the remaining bits are the space available for data-hiding represented by $n_c$.

When dim = 2, there will be usable blocks and unusable blocks. Specifically, when md = 0 or 1, the current 2 × 2 pixel block is deemed unusable. In practice, for images possessing more complex textures, the resulting partitioning S comprises a considerable number of 2 × 2 size pixel blocks. It should be noted that the occurrence of 2 × 2 size pixel blocks is not isolated; their surrounding must also consist of 2 × 2 size pixel blocks, as shown in Figure 9. Therefore, the four 2 × 2 size pixel blocks will serve as the processing units. To take full advantage of the redundancy that exists between pixels, the operation of pixel bit reconstruction will be divided into the following two cases:

Case 1: As shown in Figure 10, there are unusable blocks within the four 2 × 2 pixel blocks. These blocks are processed hierarchically, processed in an order from left to right and top to bottom. For each 2 × 2 sized pixel block, pixel bit reconstruction is performed in the following three steps in the given processing order:

1.

Determine whether it is the first 2 × 2 pixel block to be processed; if so, perform step a; otherwise, perform step b.

(a)

Eight bits of the upper-left pixel P, three bits of Dim (for the case where there are unusable blocks, it is encoded as $D\left(0\right)$).

(b)

Eight bits of the upper-left pixel P.

2.

Determine whether the current block is a usable block; if yes then perform step c; otherwise, perform step d.

(c)

Arrange a tagging bit ‘1’ to represent a usable block, three bits of MD. Next are the prediction errors $e_i$ ($i=1,2,3$), where $e_i$ is the remainder of $C_i$ after removing the shared LSBs.

(d)

Arrange a tagging bit ‘0’ to represent an unusable block. Next are the original values of the remaining three pixels.

3.

The remaining bits are the space available for data-hiding, represented by $n_c$.

Case 2: As shown in Figure 11, all four 2 × 2 pixel blocks are usable for processing. For each pixel block with a size of 2 × 2, pixel bit reconstruction is performed in the same processing order as in Case 1 through the following three steps:

1.

Determine whether it is the first 2 × 2 pixel block to be processed; if so, perform step a; otherwise, perform step b.

(a)

Eight bits of the upper-left pixel P, three bits of Dim (for this case, it is encoded as D(1)), and three bits of MD.

(b)

Eight bits of the upper-left pixel P and three bits of MD.

2.

Arrange the prediction errors $e_i$ ($i=1,2,3$), respectively, where $e_i$ is the remainder of $C_i$ after removing the shared LSBs.

3.

The remaining bits are the space available for data-hiding, represented by $n_c$.

3.3. Data Extraction and Image Recovery

The receiver can reconstruct the encrypted image and the encrypted embedded data after receiving the marked image. Each pixel within the image is firstly decomposed into eight bits binary, obtains the binary sequence of the image, represented by Q, and then a retrieval operation is performed, moving the retrieval pointer backward by n $-1$ bits after each n bits retrieval, and stopping the operation when the end tagging is retrieved. The specific retrieval operation is as follows:

1.

Retrieve eight bits to obtain P and three bits to obtain Dim, according to the mapping relationship between Dim and dim in (5), which can be derived from the current retrieval of the pixel block size; if dim > 2 then perform the second step; otherwise, perform the third step.

2.

Then, retrieve three bits to obtain MD, which gives md; then, retrieve $(di{m}^2-1)$ number of 8-md bits to obtain $e_i$ ($i=1,...,$ $di{m}^2-1$), and recover the pixel value $C_i$ according to (6).

3.

When dim = 2, four pixel blocks of 2 × 2 size are taken as processing units and for each pixel block of 2 × 2 size, if Dim = D(0) execute step a; otherwise, execute step b.

(a)

Next, one bit is retrieved. If it is ‘1’, it means that the current 2 × 2 pixel block is usable, and if it is ‘0’, it is unusable. Then, retrieve three bits to obtain MD, which gives md; next, retrieve three 8-md bits to obtain $e_i$ ($i=1,2,3$), and restore the pixel value $C_i$ according to (7).

(b)

Next, retrieve three bits to obtain MD, which gives md, then retrieve three 8-md bits to obtain $e_i$ ($i=1,2,3$), and restore the pixel value $C_i$ according to (7).

$$\begin{array}{cc}\hfill C_i& =Trunc(P,md)+e_i\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill C_i& =Trunc(tag,P,md)+e_i\hfill \end{array}$$

(7)

Figure 12 shows an example of reconstructed encrypted image pixels, where Dim = D(2) in a, Dim = D(1) in b, and Dim = D(0) in c. By performing the above operations until the end tag is retrieved, the receiver will reconstruct the encrypted image, which previously embeds the data, and the remaining data in Q is the encrypted embedded data; then, the corresponding data is decrypted based on the type of key employed.

4. Experimental Result and Analysis

In order to assess the efficacy of the proposed method, a set of experiments was conducted, encompassing evaluations of reversibility, security analysis, and comparison of embedding capacity. For the purpose of comparison of embedding capacity, 10,000 images used in the experiments were downloaded from the BOSSbase1.01 image database [30]. The experiments were carried out on a computer equipped with an Intel i9-10980HK 2.40 GHz CPU, 64 GB RAM, and MATLAB R2023a.

4.1. Separability and Reversibility

In the experiment, the grayscale image of size 512 × 512 shown in Figure 13 was taken as embedded data. Taking the image Tiffany as the cover image, Figure 14 shows the original image, original encrypted image, encrypted image after pixel modulation, marked image, extracted data, and recovered image, respectively. From Figure 14e,f, it can be seen that the extracted data are consistent with the embedded data while the recovered image is identical to the original image. As shown in Figure 14d,b, even if the encrypted original image and embedded data were obtained from the marked image without the corresponding key, the corresponding data could not be decrypted. This indicates that the proposed method achieves separability. Figure 15 shows the embedding rate–PSNR (peak signal-to-noise ratio) comparison on the image Peppers for the existing methods [5,8,10,16,17,19,24]. For any given embedding rate, the PSNR of the proposed method was ∞, which indicates that the proposed method achieves reversibility in recovering the original image. Notably, in the contrasting papers, due to the performance of some papers, which did not reach the corresponding embedding rate, we only drew a few short line segments for the representation of the paper in Figure 15.

4.2. Security

1.

Shannon entropy

In the RDH-EI method, Shannon entropy is one of the important indexes used to evaluate the performance security of the scheme, and it is usually used to evaluate the amount of information about the randomness of the pixel distribution of the encrypted image. It is calculated through (8):

$$H\left(\beta \right)=-\sum _{i=1}^{h}P\left({\beta }_i\right){log}_{2}P\left({\beta }_i\right)$$

(8)

where h denotes the total number of different symbols in the source, $\beta$ denotes the ith symbol, and $P\left({\beta }_i\right)$ denotes the probability of occurrence of the pixel-valued symbol ${\beta }_i$. For an image with a grayscale of 256 and eight bits depth, the theoretical maximum information entropy is 8. The closer the Shannon entropy of the encrypted image approaches 8, the more uniformly distributed are the pixels, indicating the higher source security and improved encryption performance of the algorithm.

Table 1. Comparison of Shannon entropy of encrypted images of two methods.

Image	Barbara	Boat	F16	Goldhill	House	Lake	Peppers	Splash	Tiffany
Original image	7.4664	7.1914	6.7140	7.4778	7.2336	7.4845	7.5925	7.2541	6.6009
Method [14]	7.9965	7.9947	7.9915	7.9977	7.9861	7.9981	7.9914	7.9901	7.9899
Proposed method	7.9979	7.9956	7.9912	7.9985	7.9869	7.9983	7.9944	7.9924	7.9913

demonstrates the comparison of Shannon entropy between the encrypted image under the BPCX encryption method presented in [14] and the encryption approach based on pixel bit modulation in this paper. From Table 1, the Shannon entropy values of the two methods are similar, both close to 8. Based on our experimental results, except for image F16, the proposed method in this paper demonstrates superior Shannon entropy compared to [14], thereby enhancing algorithm security.

2.

Histogram analysis

Figure 16a–c present the histograms of the original images of Tiffany, Peppers, and Barbara, respectively. Figure 16d–f display the histograms of their encrypted versions, while Figure 16g–i show the histograms of the marked images. As we can see from Figure 16a–c, the pixels are unevenly distributed, the information of the images can be easily analyzed, and the correlation between pixels is strong. As can be easily seen in Figure 16d–i, it is difficult to analyze the related information of the images, the correlation between the pixels is weak, and the security of the image is strong. It can be concluded that the pixel correlation between the encrypted image obtained by the proposed method and the marked encrypted image is weak; that is, the proposed scheme can resist statistical analysis attacks.

3.

KPA attack

This part of the experiment was used to check whether the encrypted image in the method could intuitively access the main content of the original image after being subjected to the attack method proposed in [26]. From Figure 17, it can be seen that the encrypted images of the eight standard test images examined can visually reveal the main content of the image contour after the KPA attack, which indicates that the BPCX encryption method has difficulty resisting some of the KPA. To demonstrate the proposed method’s efficacy in resisting KPA attack, the attack method proposed in [26] was evaluated on the encrypted image of the same original images. As shown in Figure 18, the encrypted images after the attack are all noise-like images that do not reveal any information about the content of the images. This suggests that the proposed method can withstand the KPA attack proposed by [26].

4.3. Embedded Capacity

The embedding capacity of the proposed method is calculated as follows:

$$Capacity=\sum _{i=1}^{7}Cap\left(2^i\right),$$

(9)

where $Cap\left(2^i\right)$ ($i=1,2,3,4,5,6,7$) denotes the embedding capacity provided by each partition category of the cover image. $Cap\left(2^i\right)$ is calculated in two cases:

Case 1: When $2^i$ > 2, the embedded capacity vacated by each block of size dim is calculated as follows:

$$Cap\left(2^i\right)=\sum _{j=1}^n(2^i\times 2^i-1)\times m{d}_j-6$$

(10)

where n denotes the number of partition in the cover image with dim (dim = $2^i$) size, and where $m{d}_j$ is the shared MSBs in the jth $dim\times dim$ sized pixel block.

Case 2: When calculating $Cap\left(2\right)$, since four 2 × 2 sized pixel blocks are used as processing units, the embedding capacity is calculated in two cases: where there are unusable blocks in the four 2 × 2 sized pixel blocks or where all four 2 × 2 sized pixel blocks are usable. The embedding capacity of a pixel block with a partition size of 2 × 2 in the cover image is calculated as follows:

$$\begin{array}{cc}\hfill & Cap\left(2\right)=Cap2\left(0\right)+Cap2\left(1\right)\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill & Cap2\left(0\right)=\sum _{k_1=1}^{n_1}(m{d}_{k_1}\times 3)-(t\times 3)-7\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill & Cap2\left(1\right)=\sum _{k_2=1}^{n_2}(m{d}_{k_2}\times 3)-15\hfill \end{array}$$

(13)

Equation (12) is used to compute the embedding capacity in the presence of unusable blocks, and (13) is used to compute the embedding capacity when both are usable, in units, where $n_1$ is the number of units where there are unusable blocks and $n_2$ is the number of units without unusable blocks; $m{d}_{k_1}$ is the result of summing the shared MSBs of the usable blocks in the $k_1^{th}$ unit, and $m{d}_{k_2}$ is the result of summing the shared MSBs of all blocks in the $k_2^{th}$ unit; t is the number of blocks usable in the unit.

To evaluate the efficacy of the proposed method in enhancing the embedding capacity, a comparative analysis with prior methods was conducted. As shown in

Table 2. Comparison of embedding capacity among the proposed method and prior methods.

EC (bit)
Image	[13]	[14]	[16]	[20]	[25]	Proposed method
Barbara	327,263	349,297	34,342	253,567	25,180	347,916
Boat	334,343	386,905	27,262	259,864	29,561	376,904
F16	492,674	534,581	73,139	260,208	48,722	551,018
House	419,121	440,927	44,009	261,024	26,058	446,916
Lake	306,395	349,582	29,750	259,896	25,137	346,679
Peppers	384,993	445,527	41,419	260,304	46,686	435,966

, where EC represents the embedding capacity, it can be seen that the proposed method exhibits superior embedding capacity for the majority of the images, except Barbara, Boat, Lake, and Peppers, for which the method proposed by [14] yielded the highest capacity. To further substantiate the effectiveness of the proposed method in improving embedding performance, an experimental setup involving 10,000 images selected from the BOSSbase1.01 dataset [30] was conducted. Among the 10,000 images, for 8056 images the largest embedding capacity was obtained by the proposed method; for 1333 images the largest embedding capacity was obtained by [14], and for 1301 of those 1333 images the largest embedding capacity was obtained by the proposed method rather than by [13], and the largest embedding capacity was obtained by [13] for only 610 images.

Table 3. Comparison of the embedding performance on 10,000 images seclected from the BOSSbase1.01 database between the three methods.

	Average		Highest		Lowest
	$\mathbf{EC}$ (bit)	$\mathbf{ER}$ (bpp)	$\mathbf{EC}$ (bit)	$\mathbf{ER}$ (bpp)	$\mathbf{EC}$ (bit)	$\mathbf{ER}$ (bpp)
Method [13]	593,090	2.2625	1,351,139	5.1542	50,273	0.1918
Method [14]	638,698	2.4364	2,045,606	7.8034	15,444	0.0589
Proposed method	648,298	2.4731	2,045,750	7.8039	16,150	0.0616

shows the experimental data for the 10,000 images extracted, where $\mathrm{ER}$ represents the embedding rate. It can be seen that the average embedding rate of the proposed method is 2.4731, which is better than the other two methods. Compared to [13], the average improved embedding rate of the proposed method in this paper is 0.2106, which is 0.0367 higher than that of [14], which is 0.1739.

In

Table 4. The embedding performance analysis of the proposed method compared with method [13] and method [14].

	The Proposed Method Compared with [13]	The Proposed Method Compared with [14]
${\mathrm{EC}}_1$	674,057	669,028
${\mathrm{EC}}_2$	272,838	535,398
$\Delta {\mathrm{EC}}_1$	59,565	12,347
$\Delta {\mathrm{EC}}_2$	8311	5381

, the embedding performance analysis of the proposed method compared with [13,14] is shown. ${\mathrm{EC}}_1$ represents the average embedding capacity of these images with improved embedding capacity compared with other methods, while $\Delta {\mathrm{EC}}_1$ represents the average increase in the embedding capacity of these images. As shown in these images, compared with [13], the average embedding capacity of the proposed method was 674,057 bits, and the average embedding capacity was increased by 59,565 bits. Compared with [14], the average embedding capacity was increased by 12,347 bits. ${\mathrm{EC}}_2$ represents the average embedding capacity of these images with decreased embedding capacity compared with other methods, while $\Delta {\mathrm{EC}}_2$ represents the average reduction of the embedding capacity of these images. In these images, the average embedding capacity of the proposed method is 272,838 bits, and we can see a reduction of 8311 bits in the average embedding capacity compared to [13]. In addition, compared with [14], the average embedding capacity of the proposed method was 535,398 bits, and the average embedding capacity was reduced by 5381 bits. This shows that compared with [13,14], the proposed method reduces the embedding performance in some cases but can improve the embedding performance in most cases. In summary, the proposed method exceeds the other two, in terms of embedding capacity, and exhibits superior embedding performance.

Our experiments show that for images with complex textures there are a large number of 2 × 2 sized pixel blocks in the block structure after AQP. Since four 2 × 2 sized pixel blocks are used as the processing unit in the proposed method, when all four 2 × 2 sized pixel blocks are usable for the same pixel blocks, the proposed method requires 15 tagging bits, and [13] requires 12 tagging bits, while [14] requires 18 tagging bits. The increase in the number of tagging bits will lead to a reduction in the embedding capacity. Since the proposed method requires three fewer tagging bits than [14] for the same pixel block, the amount of reduction in the proposed method is lower than [14] when both embedding capacities are reduced, compared to [13]. When there are unusable blocks in four 2 × 2 sized pixel blocks for the same pixel blocks, the tagging bits required by the proposed method are calculated as in (14), 12 tagging bits are required by [13] and the tagging bits required by [14] are calculated as in (15):

$$tb=7+t\times 3$$

(14)

$$tb=6+t\times 3$$

(15)

where t is the number of usable blocks in the unit. It can be concluded that when the number of usable blocks is 1, compared with [13] the proposed method uses fewer tagging bits, but one more tagging bit than the [14]. Therefore, in the same case, compared with [13] the embedding capacity can be improved, and compared with [14] the embedding capacity will be reduced by one bit. When the number of usable blocks is greater than or equal to 2, the proposed method will use $(t\times 3-5)$ more tagging bits than [13] and also one more tagging bit than [14]. Therefore, in the same case, compared with [13] the embedding capacity will be reduced $(t\times 3-5)$ bits, and compared with [14] the embedding capacity will be reduced by 1 bit.

5. Conclusions

Based on the AQP and MSB prediction method, this paper proposes a large-capacity RDH-ED method. According to the pre-set threshold T and the texture complexity of the image, the AQP is used to make full use of the redundancy between pixels and vacate more embedding space. Pixel modulation is carried out for the KPA attack, which improves the security of the method. The proposed method also achieves reversibility and separability, which is more practical than the previous methods. However, the increase of tagging bits during pixel bit reconstruction leads to the decrease of the embedding capacity of some images. In the future, further improvement will be tried, to improve the embedding capacity. Furthermore, advanced encryption schemes can be integrated, to enhance security further, enabling resistance against stronger attacks.