A ( k , n ) -Threshold Secret Image Sharing Scheme Based on a Non-Full Rank Linear Model

: Secret image sharing is a hot issue in the research ﬁeld of data hiding schemes for digital images. This paper proposes a general ( k , n ) threshold secret image sharing scheme, which distributes secret data into n meaningful image shadows based on a non-full rank linear model. The image shadows are indistinguishable from their corresponding distinct cover images. Any k combination of the n shares can perfectly restore the secret data. In the proposed scheme, the integer parameters ( k , n ) , with k ≤ n , can be set arbitrarily to meet the application requirement. The experimental results demonstrate the applicability of the proposed general scheme. The embedding capacity, the visual quality of image shadows, and the security level are satisfactory.


Introduction
With the rapid development of portable devices and wireless communication, a huge amount of information is transmitted via the Internet in daily life. To protect the security of private information, encryption techniques are applied [1,2], which transform the private data into a meaningless ciphertext with a secret key. However, the meaningless ciphertext may arouse the eavesdropper's suspicion. Researchers turn to develop some techniques which hide private data into meaningful media such as digital images or videos. The technique of embedding secret data in a digital cover image to produce a stego image is called image steganography. Conventional methods for image steganography include the least significant bits (LSB) substitution [3], the exploiting modifying direction (EMD) method [4], the difference expansion (DE) [5], the histogram shifting (HS) [6], and some other approaches [7,8]. The secret data are transmitted under the cover of a meaningful digital image, without attracting the eavesdropper's suspicion.
The current image steganography techniques suffer from a problem that the stego images are vulnerable to tampering attack. Slight changes to a stego image may completely disrupt the decryption result. To improve the flexibility of decryption, in 1995, Naro and Shamir [9] proposed the visual secret sharing (VSS), also called visual cryptography, in which they encrypted a secret image into n shares and recovered the secret image through stacking not less than t shares. Later, many improved versions of visual secret sharing were proposed [10][11][12][13]. The main weakness of such schemes is the low quality of the restored secret image.
As a result, a series of secret image sharing schemes was proposed [14][15][16][17][18][19] that used mathematical computation to recover the secret image instead of stacking. A common approach is to apply the polynomial-based secret sharing scheme. In a (k, n) polynomialbased secret image sharing scheme, the dealer divides a pixel or a pixel block of the secret image into n shadows via a polynomial function. In such schemes, we can consider that the

(k, n)-Threshold Secret Sharing Scheme Based on Non-Full Rank Linear Model
In this section, we first discuss the solution of a non-full rank linear model over a finite integer field. Then, an application of recovering a solution vector with missing entries is introduced. Based on this mathematical model, we propose a generalized (k, n)-threshold secret sharing scheme based on a non-full rank linear model.

Non-Full Rank Linear Model over a Finite Integer Field
Assume p is a prime number, z p is a field of integers modulo p; n and k are two positive integers with n ≥ k. The equations π 1 , π 2 , · · · , π n−k are (n − k) linearly independent equations of n variables over the field z p , which are formulated as π i : a i,1 x 1 + a i,2 x 2 + · · · + · · · a i,n x n = b i mod p, i = 1, 2, · · · , n − k. (1) a 1,1 a 2,1 a 1,2 a 2,2 · · · · · · a i,n a 2,n . . . a n−k,1 . . . Then, the solution space of the (n − k) linear equations Equation (1) is given by This system of linear equations can also be written in matrix form as      a 1,1 a 2,1 a 1,2 a 2,2 · · · · · · a i,n a 2,n . . . a n−k,1 . . . a n−k,2 . . . · · · . . . a n−k,n According to linear algebra, a system of n linearly independent equations with n variables x = (x 1 , x 2 , · · · , x n ) T , a unique solution vector x can be determined. The current non-full rank (n − k < n) system of linearly independent equations leads to a solution space of rank n − (n − k) = k.
We can manipulate the augmented matrix (A|b) by using elementary row operations over field z p to obtain the simplest row form as Then, we obtain an equivalent system of linearly independent equations x n−k = −c n−k,n−k+1 x n−k+1 − c n−k,n−k+2 x n−k+2 − · · · − c n−k,n x n + c n−k,n+1 mod p .
To solve a set of linearly independent homogeneous solutions of Equation (6), let the k homogeneous solutions be To solve the unknown entries of each solution α i , we can substitute them into the homogeneous equation that corresponds to Equation (6) and obtain The solution space H can be defined by using the homogeneous and particular solutions as Suppose a particular solution vector with missing entries x = x 1 , x 2 , · · · , x k T is given, where (n − k) entries of a solution x = (x 1 , x 2 , · · · , x n ) T ∈ H are missing. We can recover the missing entries by the following procedures. Without the loss of generality, let us assume the available entries are the first k entries. We first manipulate the original augmented matrix (A|b) with elementary row operations into the following form Then, the missing entries can be obtained by Each solution vector can be represented as By substituting the obtained particular and homogeneous solutions into Equation (13), we can get By expanding the last k rows, we can also get the coefficients of the given vector x .

of 19
From the above analysis, Equations (5)- (7) give the solution steps to obtain a particular solution, and Equations (8) and (9) give the solution steps to obtain a set of linearly independent homogeneous solutions. Thus, any solution vector of the given (n − k) linearly independent equations of n variables can be represented with a linear combination of homogeneous and particular solutions as Equation (10). In addition, Equations (11) and (12) give the solution steps to recover the missing (n − k) entries of a solution vector from k available entries; Equations (13)- (15) give a one-to-one mapping between a solution vector and the coefficients of the linear combination. Based on this model, suppose coefficients (m 1 , m 2 , · · · , m k ) are the secret, we can produce a vector (x 1 , x 2 , · · · , x n ) T , which includes n secret shares, using Equation (13). When k shares among n are available, we can restore the remaining shares and calculate the secret from the restored complete set of shares.

(k, n). -Threshold Secret Sharing Scheme Based on the Non-Full Rank Linear Model
A general scheme for (k, n) threshold secret sharing based on a non-full rank linear model is proposed in this section. It is divided into three phases: the setup, the share generation, and the secret extraction with authentication.

Setup
The scenario is that a dealer embeds secret data S into n shares X 1 , X 2 , · · · , X n and distributes them to n participants. To recover secret data, at least k participants should cooperate by providing their shares. The dealer first selects (n − k) linearly independent equations with n variables over the field z p as π i : a i,1 x 1 + a i,2 x 2 + · · · + · · · a i,n x n = b i mod p, i = 1, 2, · · · , n − k.

Share Generation
The secret data S to be shared is divided into l secret segments of k entries denoted by m j = m j,1 , m j,2 , · · · , m j,k , where m j,r (1 ≤ r ≤ k) ∈ z p , 1 ≤ j ≤ l. For each secret message segment m j , a solution vector x j can be generated by x j = F m j = (m j,1 + γ j,1 )α 1 + (m j,2 + γ j,2 )α 2 + · · · + m j,k + γ j,k α k + β mod p, (17) where γ j,r (1 ≤ r ≤ k) is a series of integers over z p generated by a pre-shared data hiding key. This integer series encrypt each secret entry by adding a random offset. By rearranging the collection of synthesized vectors x j (1 ≤ j ≤ l), the dealer generates n secret shares as where x j (i) denotes the i-th entry of the j-th synthesized vector x j . Finally, these shares are distributed to the n participants.

Secret Extraction with Authentication
Suppose k faithful participants provide their shares as X 1 , X 2 , · · · , X k . The combiner first rearranges the k shares into l vectors as where x j (i) denotes the j-th entry of the i-th share. Then, the vector x j with missing entries can be restored into the complete solution x j by using Equations (11) and (12).
To extract secret data, the combiner first reproduces the random sequence γ j,r (1 ≤ r ≤ k) by the shared data hiding key. Then, the secret segments m j (1 ≤ j ≤ l) can be extracted by substituting the complete solution vectors x j (1 ≤ j ≤ l) back into Equation (17), as . . .
By expanding the last k rows, we can get the secret segments When additional doubtful shares are available, they can be authenticated by using the restored missing entries based on the trustworthy shares.

Secret Recovery
To restore secret data, the combiner first manipulates the given linear equations to obtain the particular and homogeneous solutions as the share generation phase. Thus, the solution vectors should be Therefore, the secret segments can be obtained by substituting the restored shares X 3 , X 4 and the integer series γ j,r , 1 ≤ j ≤ 2, 1 ≤ r ≤ 2, generated by the shared data hiding key into the last two rows of Equation (35), as The recovered secret segments are m 1 = (4, 0), m 2 = (1, 1), m 3 = (4, 2), which are the same as embedded.

(k, n)-Threshold Secret Image Sharing Scheme Based on Linear Model
In this section, the (k, n)-threshold secret sharing scheme discussed above is applied to the platform of digital image transmission. By using the proposed secret sharing scheme, we can hide secret data in three distinct meaningful images and produce three shadows with imperceptible changes. While the shadow images are transmitted to n different participants, the secret data can be recovered only if more than k participants share their shadows. We present our scheme with the following subsections: system overview, setup, shadow image generation, secret data extraction with authentication, and a demonstration.

System Overview
The flowchart of the proposed scheme is shown in Figure 1. In the proposed scheme, secret data S are converted into a sequence of p-ary digits first. Then, this sequence is divided into segments denoted by S = m j m j = m j,1 , m j,2 , · · · , m j,k T ∈ z k p , j = 1, 2, · · · , l , where l is the total number of secret segments. We randomly choose n distinct meaningful cover images I 1 , I 2 , . . . , I n with size w × h > l. A vector sequence is produced from the cover images and denoted by I vec = y j y j = y j (1), y j (2), . . . , y j (n) where each vector y j is a collection of n pixel values retrieved from corresponding positions of the n images. To embed secret data, we apply the proposed (k, n)-threshold secret sharing scheme to generate a vector x j = x j (1), x j (2), . . . x j (n) T of n digits using a secret segment m j of k digits. After all secret segments are converted, the resulting vector sequence X = x j j = 1, 2, · · · , l , is applied to modulate I vec = y j j = 1, 2, · · · , w × h and obtain the sequenceÎ vec = ŷ j j = 1, 2, · · · , w × h , correspondingly. Finally, the secret image shadows are generated by distributing the modulated sequence back into n meaningful imageŝ I 1 ,Î 2 , . . . ,Î n sized w × h. In the secret data recovery phase, at least k trustworthy shadows should be available. These k shadows are rearranged into a vector sequence with missing entriesÎ vec = ŷ j ŷ j = ŷ j (1),ŷ j (2), . . . ,ŷ j (k) T , j = 1, 2, · · · , w × h . Then, a sequence of vectors with missing entriesX = x j x j = x j (1),x j (2), . . . ,x j (k) T , j = 1, 2, · · · , l are demodulated. The missing entries can be recovered by using Equations (11) and (12). If there are suspicious participants, the one who provides a share that mismatches the reproduced shadow is a cheater. Finally, the secret data can be recovered using Equations (20) and (21). quence = = 1,2, ⋯ , , is applied to modulate = = 1,2, ⋯ , × ℎ and obtain the sequence = = 1,2, ⋯ , × ℎ , correspondingly. Finally, the secret image shadows are generated by distributing the modulated sequence back into meaningful images , , … , sized × ℎ. In the secret data recovery phase, at least trustworthy shadows should be available. These shadows are rearranged into a vector sequence with missing entries = = ( (1), (2), … , ( )) , = 1,2, ⋯ , × ℎ . Then, a sequence of vectors with missing entries = = ( (1), (2), … , ( )) , = 1,2, ⋯ , are demodulated. The missing entries can be recovered by using Equations (11) and (12). If there are suspicious participants, the one who provides a share that mismatches the reproduced shadow is a cheater. Finally, the secret data can be recovered using Equations (20) and (21).

Setup
The dealer decides the number of the participants , the threshold , and the prime number . He/she selects ( − ) linearly independent equations of variables over the field

Setup
The dealer decides the number of the participants n, the threshold k, and the prime number p. He/she selects (n − k) linearly independent equations of n variables over the field z p π i : a i,1 x 1 + a i,2 x 2 + · · · + a i,n x n = 0 mod p, where i = 1, 2, · · · , (n − k).

Shadow Image Generation
Let us assume that the secret data to be embedded are denoted as S and the n distinct meaningful cover images with size w × h are denoted as I 1 , I 2 ,· · · , I n . The shadow images can be generated by the following steps.
Step 1. Rearrange the cover images I 1 , I 2 ,· · · , I n into vector sequence as Step 2. Convert the secret data stream S into a sequence of p-ary digits and divide them into segments denoted by S = m j m j = m j,1 , m j,2 , · · · , m j,k T ∈ z k p , j = 1, 2, · · · , l , where l ≤ w × h is the total number of secret segments.

Secret Data Extraction with Authentication
Suppose the n meaningful shadow imagesÎ 1 ,Î 2 , . . . ,Î n sized w × h are transmitted to n participants and now k faithful participants provide their shadow images to a combiner. The combiner can recover secret data and authenticate the rest shadows by the following steps. Without loss of generality, let us suppose that the k trustworthy shadows areÎ 1 ,Î 2 , . . . ,Î k .
For the secret segments m 1 and m 2 , we generate their corresponding solution vectors by using Equation (17) and obtain The residual vectors are Then, the stego vectors arê Then, the missing entries can be recovered using Equations (11,12). For the current case, manipulations are demonstrated in Equation (31) as To extract secret data, the random segments γ 1 = (4, 0) and γ 2 = (1, 2) are generated by the shared data hiding key first. The secret data can be extracted using Equation (21) as (57)

Experimental Results and Discussions
In this section, we use two secret image sharing schemes with different combinations of (k, n) values to demonstrate the applicability of the proposed approach. Performance evaluation based on the embedding capacity and the visual quality of image shadows are given. The security level of the proposed scheme is also analyzed.

Demonstration of Applicability
In this subsection, we implement a (2,4)-threshold and a (3,5)-threshold secret image sharing schemes to verify the applicability and the generalizability of the proposed approach.

(2,4)-Threshold Secret Image Sharing Scheme
In our first implementation, the parameter settings are k = 2, n = 4, p = 5, and the two linearly independent equations given in Equation (47)
: 3 + 4 + 3 + 4 + = 3 mod 5. (60) The solution space of and over is formulated as To fit the parameter settings, the pixels of the secret image are divided into groups of four pixels each. Thirty-two bits of each pixel group are converted into fourteen 5-ary digits and then grouped into seven secret segments of two digits. Each secret segment is applied to generate a solution vector of four entries and used to modulate four cover pixels. Therefore, four pixel-values of the secret image are distributed in fourteen pixels for each cover image. The generated image shadows are shown in Figure 2f-i. The changes with respect to their corresponding cover images are imperceptible. The peak-signal-to-noise-ratio (PSNR) given below the figures is defined by PSNR = 10 log 10 ( where e mse denotes the mean-square-error between the cover image I j and the shadow imageÎ j defined by The recovered secret images by using different combinations of image shadow pairs are given in Figure 2j-m. In all cases, the secret image can be perfectly recovered.
(60) The solution space H of π 1 and π 2 over z 5 is formulated as where c 1 , c 2 , c 3 ∈ z 5 . Then, solution vector generation function is given by The secret image sized 512 × 438 is given in Figure 3a; the five distinct cover images sized 512 × 512 are given in Figure 3b-f. To fit the parameter settings, pixels of the secret image are divided into groups of six pixels each. Forty-eight bits of each pixel group are converted into twenty-one 5-ary digits, and then grouped into seven secret segments of three digits. Each secret segment is applied to generate a solution vector of five entries and is used to modulate five cover pixels. Therefore, six pixel-values of the secret image are distributed in thirty-five pixels for each cover image. The generated image shadows are shown in Figure 3g-k. The changes with respect to their corresponding cover images are again imperceptible. The recovered secret images using different combinations of image shadows are given in Figure 3l-p. In all cases, the secret image can be perfectly recovered.

Performance Evaluation
In our (k, n) threshold secret image sharing scheme, k digits of p-ary numbers are embedded in n pixels of each image shadow. The embedding capacity (EC) can therefore be measured in bits per pixel (bpp) of an image shadow by EC = log 2 p k (bpp).
When the total number of shares n increases, the total amount of image shadows to be transmitted also increases. However, an increase in the number of shares can improve the flexibility of secret recovery. Recall that any k shares among the n shadows can perfectly recover the secret.
For each cover pixel, Equation (43) always modulates the pixel value with an integer deviation within the range of [−(p − 1)/2 : (p − 1)/2]. Suppose the deviation value is randomly distributed, the mean-square-error e mse of modulation distortion can be estimated by The secret image sized 512 × 438 is given in Figure 3a; the five distinct cover images sized 512 × 512 are given in Figures 3b-f. To fit the parameter settings, pixels of the secret image are divided into groups of six pixels each. Forty-eight bits of each pixel group are converted into twenty-one 5-ary digits, and then grouped into seven secret segments of three digits. Each secret segment is applied to generate a solution vector of five entries and is used to modulate five cover pixels. Therefore, six pixel-values of the secret image are distributed in thirty-five pixels for each cover image. The generated image shadows are shown in Figures 3g-k. The changes with respect to their corresponding cover images are again imperceptible. The recovered secret images using different combinations of image shadows are given in Figures 3l-p. In all cases, the secret image can be perfectly recovered.  When the pixels of a cover image are not fully exploited to embed secret data, we define the payload ratio as where N e and N t denote the number of pixels exploited and the number of total pixels, respectively. For the two schemes implemented in Section 4.1, the payload ratios can be calculated by Under the payload ratio r, the mean-square-error e mse is proportionally corrected to r × e mse . Thus, the expected PNSR value of an image shadow with a payload ratio r is given by PSNR(r) = 10 log 10 255 2 r × e mse = 10 log 10 12 × 255 2 r(p − 1)(p + 1) (dB).
The expected PSNR values with respect to different payload ratios and prime numbers are listed in Table 1. The corresponding evolution curves are plotted in Figure 4, where the curves for four different prime numbers are given. According to the theoretic analysis, the expected PSNR values of the two implemented cases are 45.1889 dB and 45.1290 dB, respectively, which sharply coincide with our experimental values.

Security Analysis
Various steganalysis techniques [29][30][31][32] have been proposed to detect the existence of secret information in a digital image. The general idea of steganalysis is to detect the abnormal statistical feature of a doubtful image. However, there are various types of data hiding methods for images. To successfully detect the embedding of secret, special steganalysis techniques are devised to deal with each target steganography. For example, the RS steganalysis [29] is applied to detect the LSB substitution. For data hiding in encrypted images, people usually use pixel value entropy or gray level histogram to analyze the existence of a secret message.
The data hiding method of the proposed secret sharing scheme is essentially based on the modulus function. Two steganalysis tools, relative entropy [30] and pixel-value differencing [31,32], are suitable for testing the security level of our scheme. The first tool is the relative entropy proposed by Cachin [30]. To measure the difference between cover image and image shadow , we accumulate their probability distributions ( ) and ( ), respectively. Then, their relative entropy ( , ) is calculated by

Security Analysis
Various steganalysis techniques [29][30][31][32] have been proposed to detect the existence of secret information in a digital image. The general idea of steganalysis is to detect the abnormal statistical feature of a doubtful image. However, there are various types of data hiding methods for images. To successfully detect the embedding of secret, special steganalysis techniques are devised to deal with each target steganography. For example, the RS steganalysis [29] is applied to detect the LSB substitution. For data hiding in encrypted images, people usually use pixel value entropy or gray level histogram to analyze the existence of a secret message.
The data hiding method of the proposed secret sharing scheme is essentially based on the modulus function. Two steganalysis tools, relative entropy [30] and pixel-value differencing [31,32], are suitable for testing the security level of our scheme. The first tool is the relative entropy proposed by Cachin [30]. To measure the difference between cover image I c and image shadow I s , we accumulate their probability distributions P c (x) and P s (x), respectively. Then, their relative entropy D(I c , I s ) is calculated by If D(I c , I s ) ≤ ε, by definition, the data hiding scheme is ε-secure against passive attacking. A smaller value of ε means a better security level. We apply the relative entropy measure to our (3,5)-threshold secret image sharing scheme with p = 5. The experimental results are listed in Table 2, where the relative entropy values for half embedded and fully embedded cases are given. All values listed in the table are very close to zero, which implies the image shadows of the proposed scheme are robust under a passive attack. The second steganalysis applied is the pixel-value differencing analysis [31,32]. The neighboring pixel-values of a natural image are highly continuous. The continuity is disrupted by most data hiding schemes. If the pixel-value differencing histogram (PDH) of an image is unusually flat, it is highly doubtful. To investigate the security level of the proposed scheme, we apply the PDH analysis to a set of five image shadows produced by our (3,5)-threshold secret image sharing scheme with p = 5. The secret image given in Figure 5a is embedded into five distinct cover images. The PDHs of the five pairs of cover images and their corresponding image shadows are plotted in Figure 5b-f. The PDH curves of image shadows are very close to their corresponding cover images, which indicates the proposed scheme is secure under PDH steganalysis.

Half Embedded Fully Embedded Cover images
The second steganalysis applied is the pixel-value differencing analysis [31,32]. The neighboring pixel-values of a natural image are highly continuous. The continuity is disrupted by most data hiding schemes. If the pixel-value differencing histogram (PDH) of an image is unusually flat, it is highly doubtful. To investigate the security level of the proposed scheme, we apply the PDH analysis to a set of five image shadows produced by our (3,5)-threshold secret image sharing scheme with = 5. The secret image given in Figure 5a is embedded into five distinct cover images. The PDHs of the five pairs of cover images and their corresponding image shadows are plotted in Figures 5b-f. The PDH curves of image shadows are very close to their corresponding cover images, which indicates the proposed scheme is secure under PDH steganalysis.

Conclusions
In this paper, we propose a general ( , )-threshold secret image sharing scheme with meaningful image shadows. We first present a ( , )-theshold secret sharing scheme

Conclusions
In this paper, we propose a general (k, n)-threshold secret image sharing scheme with meaningful image shadows. We first present a (k, n)-theshold secret sharing scheme based on a non-full rank linear model. It is then applied to the platform of image transmission system. Using n secret shares to modulate n distinct cover images, we can produce n image shadows. A combiner can completely recover the secret message by collecting at least k image shadows.
To demonstrate the applicability to any combination of (k, n) parameter values, we use two example models (2,4) and (3,5) to demonstrate our scheme. Experimental results confirm the applicability of the proposed scheme. Moreover, the embedding capacity and visual quality of image shadows are satisfactory. Embedding capacity and theoretic image quality under different parameter settings are also analyzed. Finally, we use two steganalysis tools to show the security level of our scheme.
The proposed scheme is based on the pixel-value modification in the spatial domain, which is suitable for digital images of a bitmap format. Our future work will focus on the implementation of the general secret sharing scheme to different cover media, such as JPEG images, encrypted images, and QR code images, which are more commonly applied in Internet applications.

Conflicts of Interest:
The authors declare no conflict of interest.

Appendix A
The elementary row operations over the field z p include row switching, row multiplication, and row addition as in conventional linear algebra, except that each resulting integer number should be modulated by p as ∀a, b ∈ z p , a + ba + b mod p∀a, b ∈ z p , a × ba × b mod p (A1) For the addition operation, if a, b ∈ z p and a + b = 0 mod p, then −a = b mod p; for the multiplication operation, if a, b ∈ z p and a × b = 1 mod p, then a −1 = b mod p. Next, we use the derivation of Equation (23) in Section 2.3.1 to demonstrate the details of the elementary row operations. The two linearly independent equations are π 1 : 1x 1 + 3x 2 + 1x 3 + 2x 4 = 1 mod 5,π 2 : 2x 1 + 4x 2 + 0x 3 + 1x 4 = 3 mod 5. (A2) That is, A = 1 3 1 2 2 4 0 1 and b = To transfer the first two columns into an identity matrix, first multiply row 1 by 3 and add to row 2 as 1 3 1 2 2 4 0 1