Multi Secret Image Sharing Scheme of General Access Structure with Meaningful Shares

Abstract

A Multi Secret Image sharing scheme can share several secret images among certain participators securely. Boolean-based secret sharing schemes are one kind of secret sharing method with light-weighted computation compared to the previous complex algebraic-based methods, which can realize the sharing of multi secret images. However, the existing Boolean-based multi secret sharing schemes are mostly restricted to the particular case of (2, n) and (n, n), only few Boolean-based multi secret sharing schemes study the general access structure, and the shares are mostly meaningless. In this paper, a new Boolean-based multi secret sharing scheme with the general access structure is proposed. All the shares are meaningful, which can avoid attracting the attention of adversaries, and the secret images can be recovered in a lossless manner. The feasibility of the scheme is proven, the performance is validated by the experiments on the gray images, and the analysis of the comparison with other methods is also given out.

1. Introduction

The secret sharing scheme was firstly proposed by Shamir [1] and Blakley [2] in 1979. Unlike the traditional encryption methods such as RSA which encrypt a piece of original plaintext into a piece of ciphertext, in the secret sharing scheme, the secret information is split into several pieces called shares using the secret sharing method and distributed between a group of participants, and only the participants in the qualified set can retrieve the secret information. Secret sharing can be used in many fields, such as the key management [3], access control [4], intelligent transportation [5], distributed computing in the cloud [6], and so forth. Recently, a new kind of secret division and sharing method called cognitive cryptography [7,8,9,10] was developed; it is a novel approach with the individual biometric features of each participator, which is an innovative solution in the sharing process allowing the owner of one share to be verified using the biometric feature, and can improve the security of the secret sharing.

In 1994, Shamir developed Visual Cryptography (VC) [11] which can encrypt binary images into several shares with random black and white pixels. The basic idea of VC is to use different binary matrices to represent the black and white pixel; the shares are generated based on the binary matrices by each pixel and printed on the transparencies, and the secret image can be recovered by simply overlapping the transparencies and can be recognized by the Human Vision System (HVS). The advantage of VC is that is can easily recover the secret image without any compute device, but it also has the disadvantage of pixel expansion which means the size of the shares is always much bigger than the original secret image, and another drawback is the low contrast, which means the recovered image is always has low recovery quality.

To deal with the problem of pixel expansion, probabilistic Visual Cryptography [12] was firstly proposed by Yang. With this method, the size of the share can be reduced to be the same as the secret image, but the quality of the recovered image is still low. Another secret sharing method which is based on the random grid [13] also can deal with the pixel expansion problem, but it is in fact equivalent to the probabilistic Visual Cryptography, so the quality of the recovered image is also poor.

Another way to overcome the problem of VC is polynomial-based Image Secret Sharing (ISS) [14], which introduced the Lagrange polynomial method into the image sharing. The pixel value of the shares is generated by the polynomial, and the secret is recovered by the polynomial interpolation. It overcomes the pixel expansion problem; the shares are even smaller than the secret image, and the recovered image is mostly the same as the secret image. However, the drawback is its highly complex computation due to the polynomial operation.

Boolean-based Image Secret sharing can achieve a better tradeoff between the pixel expansion, image quality, and the computation complex. In 2006, Wang et al. [15] proposed two XOR-based Image Secret Sharing Schemes for a single secret image; one is a probabilistic (2, n) threshold scheme for the binary image, and the other is a deterministic (n, n) threshold scheme for the gray-scale image. The size of the shares is the same as the secret image, and the recovered secret image is the same as the original secret image. Some other Boolean-based Image Secret sharing schemes are developed in [16,17,18,19,20], all these schemes have no or little pixel expansion, and the decryption is easy.

To realize sharing several secret images simultaneously, multi secret sharing schemes are developed. Some works focus on the particular (n, n) or the (k, n) threshold multi secret sharing scheme, only a few works focus on the multi secret sharing with the general access structure. The literature on the multi secret sharing schemes is covered in Section 2.

2. Related Work

Multi secret sharing schemes can share many secret images at one time. There are many kinds of the multi secret sharing scheme using different methods. In [21], the paradigm of the multi secret sharing was given out by Padiya et al. and the genetic method was developed as a kind of encryption. Weir et al. [22] proposed a scheme based on Visual Cryptography method, but the quality of the recovered secret images was very poor. Aarti et al. [23] used the extended Visual Cryptography method and mixing method to realize multi secret sharing.

Another way to construct the multi secret sharing is to use the matrix methods. Wang et al. [24] used the matrix projection methods to share multi secret images, and Fereshte et al. [25] used matrix multiplication method to realize the construction.

Some other research has been developed based on the polynomial methods or modulo method. Yang et al. [26] used the Lagrange interpolation polynomial method to share multi secret images, while Adachi et al. [27] constructed a (t, n) multi secret sharing scheme by Hermite interpolation, which can analyze the image more precisely than the Lagrange interpolation, but is more complex. Harn et al. [28] used another polynomial method which is the bivariate polynomial to share the multi secrets which can generate keys between the pair of the share owners. Chang et al. [29] applied the Chinese remainder method and the Lagrange Interpolation method in the sharing. Deshmukh et al. [30] realized the multi secret sharing combining with XOR operation. Mohit et al. [31] used the additive modulo method to realize the (n, n + 1) multi secret sharing scheme.

The researchers mentioned above constructed multi secret sharing schemes based on the different methods. Different kinds of schemes have their advantage, but they each also have some drawbacks. For example, the schemes based on the visual cryptography have the advantage of low computation complexity, but they always suffer from the problem of the poor recovery quality and the pixel expansion. The schemes based on the algebraic methods such as matrix methods, polynomial methods, and Chinese remainder method can get much better recovery quality, but they always have the disadvantage of the high computation complexity.

Boolean-based multi secret sharing schemes are the new method of multi secret sharing using simple Boolean operations with high recovered quality and no pixel expansion. Some research focused on the threshold scheme. Chen [32] gave out the first Boolean-based multi secret sharing scheme; all the shares are random, and it has (n + 1, n + 1) threshold which means all the n + 1 shares are necessary in the recovery of the n secret images. Later, Chen [33] proposed (n, n) multi secret sharing based on XOR operation and bit shift method. Yang et al. [34] constructed an n out of n multi secret sharing scheme, where no information can be recovered when there are less than n participants. Chen et al. [35] proposed a novel multi secret sharing scheme using Boolean operation and the hash method which can share different sizes of secret images. Deshmukh [36] proposed the (n, n) multi secret sharing scheme based on the XOR operation and modulo operation. Kabirirad et al. [37] developed a scheme with the random shares with low complexity based on Boolean operations. Prasetyo and Guo [38] proposed a multi secret sharing scheme based on the XOR and the Chinese remainder method which can share n secret images using n shares.

Some other research works focus on the secret sharing scheme with the general access structure. There are several works about sharing one secret with the general access structure [39,40]. Only a few works concern the multi secret sharing scheme with the general access structure. Das [41] proposed a multi secret sharing scheme with general access through the hash method. Yan [42] proposed the progressive sharing with general access structure using the Boolean operation. In 2019, Nag [43] proposed a multi secret sharing scheme with general access based on the Boolean operation; the shares are meaningless, and the concept of the public share is introduced, which come from the idea in [44]—the public share having high privilege participates in the recovery together with the owners’ meaningless shares, which does not violate the basic principle of secret sharing. Meghrajani et al. [45] shared multi secret sharing using Boolean operation using the public share. In 2020, Chen [46] proposed a multi secret sharing scheme with the general access structure, which does not need to collect all the shares, and where the defined qualified participators can recover the secret images, and the shares are meaningless.

From the literature survey, we notice that there are many multi secret sharing schemes with different characteristics, but there is no multi secret sharing scheme with the general access structure that can recover the secret exactly and at the same time the shares are all meaningful. As such, in this paper, we propose a multi secret image sharing scheme with general access structure and meaningful shares based on the Boolean operation.

3. Preliminary

3.1. General Access Structure

Suppose there are $N$ participators, $O=\{1,2,3,\dots ,N\}$, which is the identity number of the participators, each participator will own one share, $OW=\left\{O{W}_i\right\}$ is the owners of the shares, $i\in [1,n]$.

Suppose the qualified part is $P_{qual}$, $P_{qual}=\{Q{S}_1,Q{S}_2,\dots ,Q{S}_n\}$, where $Q{S}_i$ is the ith qualified subset $i\in [1,n]$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, which means the ith qualified subset $Q{S}_i$ consists of the t owners whose identity number is $i_1,i_2,\dots ,i_t$, so the $O{W}_{i_1}$, $O{W}_{i_2}$,…, $O{W}_{i_t}$ can recover the ith secret. The forbidden part is $P_{forbid}$, $P_{forbid}=\{F{S}_1,F{S}_2,\dots ,F{S}_m\}$, where $F{S}_i$ is the ith forbidden subset $i\in [1,m]$, $F{S}_j=\{j_1,j_2,\dots ,j_r\}$, which means the $j_1$th, $j_2$th, …, $j_r$th owner are forbidden to recover the secret. $P_{qual}$ and $P_{forbid}$ is not empty, $P_{qual}\subset 2^O$, $P_{forbid}\subset 2^O$, and $P_{qual}\cap P_{forbid}=\varnothing$.

Denote $P_0$ as the set of the minimum qualified set:

$$P_0=\{Q\in P_{qual}:Q^{\prime }\notin P_{qual},\forall Q^{\prime }\subset Q\}$$

(1)

As such, each element of $P_{qual}$ is the minimum qualified subset.

The element C in O is called as the valid element, when there is at least one qualified subset concluding this element, i.e.,

$$\{D|D\cup \left\{C\right\}\in P_{qual},D\notin P_{qual}\}\ne \varnothing$$

(2)

In this paper, we suppose all the elements or owners are valid, there is no element not participating in the sharing.

3.2. Relationship between the Operation on GF(2^m) and Bit-Wise XOR Operation

As we know, the pixels of the image can be expressed by m bits. For example, the pixels of the black-and-white image are expressed by 1 bit, and the pixels of the 256 gray level image are always expressed by 8 bits. For the 256 gray level image, the gray value is in fact isomorphic to the element over GF(2⁸). Thus, the operations of the pixels of the images are executed on the GF(2⁸). The operation on the Galois field can be found in [47].

In this paper, the additional operation on the GF(2^m) is used in the secret sharing process and the recovery process, and the addition operation on the different elements is in fact the XOR operation of the coefficients of the polynomials for the different elements; so, for the pixel of m bits, the addition operation between the images is equivalent to the m bit-wise XOR operation.

Suppose there are two images X and Y which are m gray level and the size of each image A × B, the pixel value in the $row$th row and the $col$th column of OS_i is $p{x}_{(row,col)}^X$, which is integer, $p{x}_{(row,col)}^X\in [0,2^m-1]$, $row\in [1,A]$, and $col\in [1,B]$. As each pixel of the image X can be turned into ${\log }_{2}m$ bits, suppose $p{x}_{(row,col)}^X=\{b{x}_1,b{x}_2,\dots ,b{x}_{{\log }_2\mathrm{m}}\}$, similarly, each pixel of the image Y can be expressed by $p{x}_{(row,col)}^Y=\{b{y}_1,b{y}_2,\dots ,b{y}_{{\log }_2\mathrm{m}}\}$, so the addition operation between the pixel of the image X and Y in the same position is defined as below,

$$\begin{array}{cc}\hfill p{x}_{(row,col)}^X\oplus p{x}_{(row,col)}^Y& =\{b{x}_1,b{x}_2,\dots ,b{x}_{{\log }_2\mathrm{m}}\}\oplus \{b{y}_1,b{y}_2,\dots ,b{y}_{{\log }_2\mathrm{m}}\}\hfill \\ & =\{b{x}_1\oplus b{y}_1,b{x}_2\oplus b{y}_2,\dots ,b{x}_{{\log }_2\mathrm{m}}\oplus b{y}_{{\log }_2\mathrm{m}}\}\hfill \end{array}$$

(3)

And the image X can be expressed by the matrix $M{X}_{A\times B}$.

$$M{X}_{A\times B}^{}=\left[\begin{array}{ccc}p{x}_{(1,1)}^{\mathrm{X}}& \dots & p{x}_{(1,\mathrm{B})}^X\\ \dots & p{x}_{(row,col)}^X& \dots \\ p{x}_{(\mathrm{A},1)}^X& \dots & p{x}_{(A,B)}^X\end{array}\right]$$

(4)

The image Y can be expressed by the matrix $M{Y}_{A\times B}$.

$$M{Y}_{A\times B}^{}=\left[\begin{array}{ccc}p{x}_{(1,1)}^Y& \dots & p{x}_{(1,\mathrm{B})}^Y\\ \dots & p{x}_{(row,col)}^Y& \dots \\ p{x}_{(\mathrm{A},1)}^Y& \dots & p{x}_{(A,B)}^Y\end{array}\right]$$

(5)

As such, the addition of the image X and Y can be expressed by the XOR between the matrix $M{X}_{A\times B}$ and $M{Y}_{A\times B}$,

$$\begin{array}{cc}\hfill M{X}_{A\times B}^{} \oplus M{Y}_{A\times B}^{}& =\left[\begin{array}{ccc}p{x}_{(1,1)}^X& \dots & p{x}_{(1,\mathrm{B})}^X\\ \dots & p{x}_{(row,col)}^X& \dots \\ p{x}_{(A,1)}^X& \dots & p{x}_{(A,B)}^X\end{array}\right] \oplus \left[\begin{array}{ccc}p{x}_{(1,1)}^Y& \dots & p{x}_{(1,\mathrm{B})}^Y\\ \dots & p{x}_{(row,col)}^Y& \dots \\ p{x}_{(\mathrm{A},1)}^Y& \dots & p{x}_{(A,B)}^Y\end{array}\right]\hfill \\ & =\left[\begin{array}{ccc}p{x}_{(1,1)}^X\oplus p{x}_{(1,1)}^Y& \dots & p{x}_{(1,\mathrm{B})}^X\oplus p{x}_{(1,\mathrm{B})}^Y\\ \dots & p{x}_{(row,col)}^X\oplus p{x}_{(row,col)}^Y& \dots \\ p{x}_{(\mathrm{A},1)}^X\oplus p{x}_{(\mathrm{A},1)}^Y& \dots & p{x}_{(A,B)}^X\oplus p{x}_{(A,B)}^Y\end{array}\right] \hfill \end{array}$$

(6)

For each $p{x}_{(row,col)}^X\oplus p{x}_{(row,col)}^Y$, $row\in [1,A]$, and $col\in [1,B]$, the addition is executed as the definition above.

4. Proposed Scheme

4.1. Multi Secret Sharing Process

Suppose there are m secret gray images to be shared, the secret images are OS₁, OS₂, … OS_n. All the secret images are 256 gray level and share the same size. There are $n$ participators and $n$ qualified subsets, The qualified part is $P_{qual}$, $P_{qual}=\{Q{S}_1,Q{S}_2,\dots ,Q{S}_n\}$, where $Q{S}_i$ is the ith qualified subset $i\in [1,n]$, and the ith qualified subset $Q{S}_i$ have access to recover the ith secret image OS_i. $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$ means that the $i_1$th, $i_2$th,…, $i_t$th participators can be recover the secret image OS_i. Moreover, the forbidden part is $P_{forbid}$, $P_{forbid}=\{F{S}_1,F{S}_2,\dots ,F{S}_{\mathrm{m}}\}$.

In the multi secret sharing process the universal shares and the personal shares of the same size as the secret images will be generated. The personal shares are owned by the individual owners and the universal shares are kept by the committee members with high privilege. In the recovery process, the personal owners and the committee members with universal shares will participate in the recovery. The process about the secret sharing process is described as Algorithm 1.

Algorithm 1: The secret sharing process of the proposed scheme.

Input: The secret images OS1, OS2, …, OSn; for the general access structure, the qualified part is $P_{qual}$, $P_{qual}=\{Q{S}_1,Q{S}_2,\dots ,Q{S}_n\}$, and the forbidden part is $P_{forbid}$, $P_{forbid}=\{F{S}_1,F{S}_2,\dots ,F{S}_m\}$

Output: The personal shares PS1, PS2, …, PSn; the universal shares US1, US2, …, USn.

Step 1: Suppose the size of each secret image OSi is A × B, the pixel value in the $row$th row and the $col$th column of OSi is $px{O}_{(row,col)}^i$, and $px{O}_{(row,col)}^i$ is integer, $px{O}_{(row,col)}^i\in [0,255]$, $row\in [1,A]$, and $col\in [1,B]$. As each pixel can be expressed into an element with 8 bits in GF(28), suppose $px{O}_{(row,col)}^i=\{b{o}_1,b{o}_2,b{o}_3,b{o}_4,b{o}_5,b{o}_6,b{o}_7,b{o}_8\}$, split the bits of each pixel into the 4 MSB bits and the 4 LSB bits, $pxO{M}_{(row,col)}^i=\{b{o}_1,b{o}_2,b{o}_3,b{o}_4\}$, and $pxO{L}_{(row,col)}^i=\{b{o}_5,b{o}_6,b{o}_7,b{o}_8\}$. Thus, the MSB part of the secret image OSi can be regarded as the matrix $S{M}_{{}_{A\times B}}^i$. $$S{M}_{A\times B}^i=\left[\begin{array}{ccc}pxO{M}_{(1,1)}^i& \dots & pxO{M}_{(1,B)}^i\\ \dots & pxO{M}_{(row,col)}^i& \dots \\ pxO{M}_{(A,1)}^i& \dots & pxO{M}_{(A,B)}^i\end{array}\right]$$ (7) And the LSB part of the secret image OSi can be regarded as the matrix $S{L}_{{}_{A\times B}}^i$. $$S{L}_{A\times B}^i=\left[\begin{array}{ccc}pxO{L}_{(1,1)}^i& \dots & pxO{L}_{(1,\mathrm{B})}^i\\ \dots & pxO{L}_{(row,col)}^i& \dots \\ pxO{L}_{(\mathrm{A},1)}^i& \dots & pxO{L}_{(A,B)}^i\end{array}\right]$$ (8)

Step 2: Select n gray images {PO1, PO2, …, POn} from a mass of images randomly which are the same size and the same gray level with the secret images, and select another n gray images {UO1, UO2, …, UOn} from a mass of images randomly which are the same size and the same gray level with the secret images, {UO1, UO2, …, UOn} need to be different with {PO1, PO2, …, POn}.

Step 3: Find out the essential id for each qualified subset $Q{S}_i$ in $P_{qual}$ by Algorithm 2, $i\in [1,n]$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, the essential id is specific element of the set $Q{S}_i$, denote it as $i{d}_i$.

Step 4: For the images {PO1, PO2, …, POn}, for each image POi with the size A × B, suppose the pixel value in the $row$th row and the $col$th column of POi is $px{P}_{(row,col)}^i$, and $px{P}_{(row,col)}^i$ is the integer, $px{P}_{(row,col)}^i\in [0,255]$, $row\in [1,A]$, and $col\in [1,B]$. Each pixel can be expressed as $px{P}_{(row,col)}^i=\{b{p}_1,b{p}_2,b{p}_3,b{p}_4,b{p}_5,b{p}_6,b{p}_7,b{p}_8\}$, separate 4 MSB bits and the 4 LSB bits of each pixel, $pxP{M}_{(row,col)}^i=\{b{p}_1,b{p}_2,b{p}_3,b{p}_4\}$, and $pxP{L}_{(row,col)}^i=\{b{p}_5,b{p}_6,b{p}_7,b{p}_8\}$. Thus, the matrix of the MSB is denoted as $P{M}_{{}_{A\times B}}^i$. $$P{M}_{A\times B}^i=\left[\begin{array}{ccc}pxP{M}_{(1,1)}^i& \dots & pxP{M}_{(1,\mathrm{B})}^i\\ \dots & pxP{M}_{(row,col)}^i& \dots \\ pxP{M}_{(\mathrm{A},1)}^i& \dots & pxP{M}_{(A,B)}^i\end{array}\right]$$ (9) And the matrix about LSB is denoted as $S{L}_{{}_{A\times B}}^i$. $$P{L}_{A\times B}^i=\left[\begin{array}{ccc}pxP{L}_{(1,1)}^i& \dots & pxP{L}_{(1,\mathrm{B})}^i\\ \dots & pxP{L}_{(row,col)}^i& \dots \\ pxP{L}_{(\mathrm{A},1)}^i& \dots & pxP{L}_{(A,B)}^i\end{array}\right]$$ (10)

Step 5: For the images {UO1, UO2, …, UOn}, suppose the pixel value in the $row$th row and the $col$th column of POi is $px{U}_{(row,col)}^i$, and $px{U}_{(row,col)}^i$ is integer, $px{U}_{(row,col)}^i\in [0,255]$, $row\in [1,A]$, and $col\in [1,B]$. Each pixel can be expressed as $px{U}_{(row,col)}^i=\{b{u}_1,b{u}_2,b{u}_3,b{u}_4,b{u}_5,b{u}_6,b{u}_7,b{u}_8\}$, separate 4 MSB bits and the 4 LSB bits of each pixel, $pxU{M}_{(row,col)}^i=\{b{u}_1,b{u}_2,b{u}_3,b{u}_4\}$, and $pxU{L}_{(row,col)}^i=\{b{u}_5,b{u}_6,b{u}_7,b{u}_8\}$. The matrices are denoted as the $U{M}_{A\times B}^i$ for the MSB part and $U{L}_{A\times B}^i$ for the LSB part. $$U{M}_{A\times B}^i=\left[\begin{array}{ccc}pxU{M}_{(1,1)}^i& \dots & pxU{M}_{(1,\mathrm{B})}^i\\ \dots & pxU{M}_{(row,col)}^i& \dots \\ pxU{M}_{(\mathrm{A},1)}^i& \dots & pxU{M}_{(A,B)}^i\end{array}\right]$$ (11) And the matrix of LSB $S{L}_{{}_{A\times B}}^i$ is as below. $$U{L}_{A\times B}^i=\left[\begin{array}{ccc}pxU{L}_{(1,1)}^i& \dots & pxU{L}_{(1,\mathrm{B})}^i\\ \dots & pxU{L}_{(row,col)}^i& \dots \\ pxU{L}_{(\mathrm{A},1)}^i& \dots & pxU{L}_{(A,B)}^i\end{array}\right]$$

Step 6: For the secret image OSi and the qualified subset is $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, perform the following operation about the MSB part of the secret image OSi: $$T{U}_{A\times B}^i={\displaystyle \sum S{M}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$$ (12) The addition operation is defined as in Section 3.2. Suppose $T{U}_{A\times B}^i$ is shown as below, $$T{U}_{A\times B}^i=\left[\begin{array}{ccc}pxT{U}_{(1,1)}^i& \dots & pxT{U}_{(1,\mathrm{B})}^i\\ \dots & pxT{U}_{(row,col)}^i& \dots \\ pxT{U}_{(\mathrm{A},1)}^i& \dots & pxT{U}_{(A,B)}^i\end{array}\right]$$ (13) Apply the Arnold transform [48] method to each matrix $T{U}_{A\times B}^i$ to realize the element scrambling, and the scrambled matrix is denoted as $ET{U}_{A\times B}^i$, $$ET{U}_{A\times B}^i=\left[\begin{array}{ccc}pxET{U}_{(1,1)}^i& \dots & pxET{U}_{(1,\mathrm{B})}^i\\ \dots & pxET{U}_{(row,col)}^i& \dots \\ pxET{U}_{(\mathrm{A},1)}^i& \dots & pxET{U}_{(A,B)}^i\end{array}\right]$$ (14) Perform another operation for the LSB part of the secret image OSi: $$T{P}_{A\times B}^{i{d}_i}={\displaystyle \sum S{L}_{A\times B}^i+P{M}_{A\times B}^{i_{g_1}}+\dots +P{M}_{A\times B}^{i_{g_{t-1}}}+U{M}_{A\times B}^i}$$ (15)

where $\{i_{g_1},\dots ,i_{g_{t-1}}\}=G{P}_i$, $G{P}_i=\left\{G{P}_i|G{P}_i\cup i{d}_i=Q{S}_i,i{d}_i\notin G{P}_i\right\}$, $Q{S}_i=\{i_1,\dots i_t\}$. Suppose $T{P}_{A\times B}^{i{d}_i}$ is shown as below, $$T{P}_{A\times B}^{i{d}_i}=\left[\begin{array}{ccc}pxT{P}_{(1,1)}^i& \dots & pxT{P}_{(1,\mathrm{B})}^i\\ \dots & pxT{P}_{(row,col)}^i& \dots \\ pxT{P}_{(A,1)}^i& \dots & pxT{P}_{(A,B)}^i\end{array}\right]$$ (16) Apply the Arnold transform method to each matrix $T{P}_{A\times B}^{i{d}_i}$ to realize the element scrambling, and the scrambled matrix is denoted as $ET{P}_{A\times B}^{i{d}_i}$, $$ET{P}_{A\times B}^{i{d}_i}=\left[\begin{array}{ccc}pxET{P}_{(1,1)}^i& \dots & pxET{P}_{(1,\mathrm{B})}^i\\ \dots & pxET{P}_{(row,col)}^i& \dots \\ pxET{P}_{(\mathrm{A},1)}^i& \dots & pxET{P}_{(A,B)}^i\end{array}\right]$$ (17)

Step 7: For the images {UO1, UO2, …, UOn}, replace the 4 LSBs of each pixel of UOi with the element of $ET{U}_{A\times B}^i$ in the same position, which means join each element $pxU{M}_{(row,col)}^i$ of $U{M}_{A\times B}^i$ and $pxET{U}_{(row,col)}^i$ of $T{U}_{A\times B}^i$ together, and get the pixel matrix expression $U{S}_{A\times B}^i$ of USi, $$U{S}_{A\times B}^i=\left[\begin{array}{ccc}pxU{M}_{(1,1)}^i\cup pxET{U}_{(1,1)}^i& \dots & pxU{M}_{(1,\mathrm{B})}^i\cup pxET{U}_{(1,\mathrm{B})}^i\\ \dots & pxU{M}_{(row,col)}^i\cup pxET{U}_{(row,col)}^i& \dots \\ pxU{M}_{(\mathrm{A},1)}^i\cup pxET{U}_{(\mathrm{A},1)}^i& \dots & pxU{M}_{(A,B)}^i\cup pxET{U}_{(A,B)}^i\end{array}\right]$$ (18) Suppose $pxU{M}_{(row,col)}^i=\{b{u}_1,b{u}_2,b{u}_3,b{u}_4\}$, and $pxT{U}_{(row,col)}^i=\{bt{u}_1,bt{u}_2,bt{u}_3,bt{u}_4\}$, so $$\begin{array}{cc}\hfill pxU{M}_{(row,col)}^i\cup pxT{U}_{(row,col)}^i& =\{b{u}_1,b{u}_2,b{u}_3,b{u}_4\}\cup \{bt{u}_1,bt{u}_2,bt{u}_3,bt{u}_4\}\hfill \\ & =\{b{u}_1,b{u}_2,b{u}_3,b{u}_4,bt{u}_1,bt{u}_2,bt{u}_3,bt{u}_4\}\hfill \end{array}$$ (19) The renewed images are the universal shares {US1, US2, …, USn}.

Step 8: For the images {PO1, PO2, …, POn}, replace the 4 LSBs of each pixel of POi with the element of $ET{P}_{A\times B}^i$ in the same position, which means join each element $pxP{M}_{(row,col)}^i$ of $P{M}_{A\times B}^i$ and $pxET{P}_{(row,col)}^i$ of $ET{P}_{A\times B}^i$ together, and get the pixel matrix expression $P{S}_{A\times B}^i$ of PSi, $$P{S}_{A\times B}^i=\left[\begin{array}{ccc}pxP{M}_{(1,1)}^i\cup pxET{P}_{(1,1)}^i& \dots & pxP{M}_{(1,\mathrm{B})}^i\cup pxET{P}_{(1,\mathrm{B})}^i\\ \dots & pxP{M}_{(row,col)}^i\cup pxET{P}_{(row,col)}^i& \dots \\ pxP{M}_{(\mathrm{A},1)}^i\cup pxET{P}_{(\mathrm{A},1)}^i& \dots & pxP{M}_{(A,B)}^i\cup pxET{P}_{(A,B)}^i\end{array}\right]$$ (20) The element joint operation is the similar as the last step, and the renewed images are the personal shares {PS1, PS2, …, PSn}.

Algorithm 2: The essential id selection process for the qualified subset of the general access.

Input: The general access structure, the qualified part is $P_{qual}$, $P_{qual}=\{Q{S}_1,Q{S}_2,\dots ,Q{S}_n\}$, where $Q{S}_i$ is the ith qualified subset $i\in [1,n]$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, $\{i_1,i_2,\dots ,i_t\}\in \{1,2,\dots ,n\}$.

Output: The essential id $EID=\{i{d}_1,i{d}_2,\dots ,i{d}_n\}$

Step 1: For each qualified subset $Q{S}_i$, $i\in [1,n]$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, denote the essential id of the set $Q{S}_i$ as $i{d}_i$. Construct the vector of length n where all the elements are 0, set the $i_1$th, $i_2$th, …, $i_t$th elements according to $\{i_1,i_2,\dots ,i_t\}$ to be 1, the vector is denoted as $V_i$. As such, the vector $V_i$ is the logical presentation of the qualified subset $Q{S}_i$.

Step 2: Regard the vector $V_i$ as the ith row of the matrix $QM$, so the matrix $QM$ is the presentation of the qualified access subsets.

Step 3: $Q{M}^1$ is the start point of the searching, and $Q{M}^1=QM$. For k = 1: n, calculate the hamming weights of each column and row of the matrix $Q{M}^k$, the hamming wights of the columns are denoted as {$hm{c}_1,hm{c}_2,\dots ,hm{c}_n$}, and the hamming weights of the rows are denoted as {$hm{r}_1,hm{r}_2,\dots ,hm{r}_n$}, search for the smallest hamming weight of the column vector. There are different cases. Case 1: If the smallest hamming weight of the column is 1 and unique, the non-zero element is the ($sr,sc$) element in the matrix $QM$, it shows that the essential id for the srth qualified subset $Q{S}_{sr}$ is $sc$. Case 2: If the smallest hamming weight is not 1 and unique, compare the rows’ hamming weights of the non-zero elements, select the element ($sr,sc$) which has the smallest hamming weight; if the rows’ hamming weights are the same, select the element in which the row number is smaller, so the essential id for the srth qualified subset $Q{S}_{sr}$ is $sc$. Case 3: If the smallest hamming weight is not 1 and not unique, compare all the rows’ hamming weights of the non-zero elements in the different columns, select the element ($sr,sc$) which has the smallest hamming weight; if the rows’ hamming weights are the same, select the element in which the row number is smallest, so the essential id for the srth qualified subset $Q{S}_{sr}$ is $sc$.

Step 4: Set all the elements of the srth row and the scth column to be zero, $Q{M}^k$ is renewed as $Q{M}^{k+1}$.

Step 5: For the renewed matrix $Q{M}^{k+1}$, execute the same operations as in Step 3 to fix the essential id for the other row, it is stopped when all the essential id for all the rows are fixed.

Step 6: The final essential id is denoted as $EID=\{i{d}_1,i{d}_2,\dots ,i{d}_n\}$, which means the idith element is the essential element for the ith qualified subset $Q{S}_i$.

Some observations and details for the steps are given below:

In step 1, as each pixel of the 256 gray secret image $O{S}_i$ is expressed by 8 bits in the computer science, so the secret image $O{S}_i$ can be regarded as the matrix $M_{{}_{A\times B}}^i$ from the point of the mathematics, where the element is the bit expression of pixel value in GF(2⁸). If we divide the pixel into 4 MSBs and 4 LSBs part, the secret image $O{S}_i$ can be regarded as the combination of matrix $S{M}_{{}_{A\times B}}^i$ about the MSB part and $S{L}_{{}_{A\times B}}^i$ about the LSB part, and all the elements of $S{M}_{{}_{A\times B}}^i$ and $S{L}_{{}_{A\times B}}^i$ is in GF(2⁴).

In step 2, the n gray images {PO₁, PO₂, …, PO_n} are the prepared images for the personal shares, and the n gray images {UO₁, UO₂, …, UO_n} are the prepared images for the universal shares; they are all selected randomly from a mass of images, so it is hard to predict which one is selected.

In step 3, the essential id is determined by Algorithm 2, the essential id $i{d}_i=i_c$ for $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$ must be the id of the essential participator for the qualified subset $Q{S}_i$, and the essential id for the different qualified subset is different. For the essential id $i{d}_i$ for $Q{S}_i$ and $i{d}_j$ for $Q{S}_j$, $i{d}_i\ne i{d}_j$, if $j\ne i$.

In steps 4 and 5, the images {PO₁, PO₂, …, PO_n} and the images {UO₁, UO₂, …, UO_n} are divided into MSB and LSB part. $P{M}_{A\times B}^i$ for the MSB part and $P{L}_{A\times B}^i$ for the LSB part of PO_i, $U{M}_{A\times B}^i$ for the MSB part and $U{L}_{A\times B}^i$ for the LSB part of UO_i are generated from the point of matrix.

In step 6, in Equation (12), there are three parts taking part in the addition computation to generate $T{U}_{A\times B}^i$, the first part is the MSB part of the secret image $S{M}_{{}_{A\times B}}^i$, the second part is $P{M}_{A\times B}^{i_j}$ ($j\in \{1,\dots ,t\}$) which are the MSB part of the images {PO_i1, POi₂, …, PO_it} according to the qualified subset $Q{S}_j$, the third part is $U{M}_{A\times B}^i$ which is the MSB part of UO_i. A similar operation is executed as shown in Equation (15) to get $T{P}_{A\times B}^{i{d}_i}$,where the set $G{P}_i$ is in fact the subset of $Q{S}_i$ removing the element id_i. The Arnold transform method is applied to $T{U}_{A\times B}^i$ and $T{P}_{A\times B}^{i{d}_i}$ to scramble the pixels, which is important for enhancing the security. If $A=B$, the image is square, we can use the transform in [48] directly, if $A\ne B$, the image is not square, it needs to be extended to be square by supplying some zero pixel. Then, the Arnold transform method is carried out.

In step 7, the 4 LSBs of the each pixel of UO_i are replaced by the elements of $ET{U}_{A\times B}^i$, and the renewed image is the final universal share US_i. The id_ith personal share PS_idi can be obtained as shown in Equation (15) by replacing the LSBs of PS_idi bythe elements of $ET{P}_{A\times B}^{i{d}_i}$.

Then the generated personal share PS_i is distributed to the owner OW_i, and the universal shares US_i are kept by the committee members having high privilege.

The example 1 is an example of the secret sharing process and the size of the image is small for the convenience to show the sharing process using the matrices.

Example 1.

Suppose there are 4 participants, the qualified part $P_{qual}=\{Q{S}_1,Q{S}_2,Q{S}_3,Q{S}_4\}$, and $Q{S}_1=\{1,2,3\}$, $Q{S}_2=\{1,4\}$, $Q{S}_3=\{2,4\}$, $Q{S}_4=\{3,4\}$. The secret images with 256 gray level are OS₁, OS₂, OS₃, OS₄, and the size of the secret image is 2 × 2. As such, the participants in $Q{S}_i$ have access to recover the secret image OS_i.

The secret sharing process is described below:

• For the secret images, suppose the matrices of the pixel value is shown as below:

  $$\left(\begin{array}{cc}154& 35\\ 69& 247\end{array}\right)\left(\begin{array}{cc}227& 141\\ 165& 46\end{array}\right)\left(\begin{array}{cc}142& 64\\ 237& 37\end{array}\right)\left(\begin{array}{cc}118& 148\\ 49& 97\end{array}\right)$$
• For each $Q{S}_i$, there is one corresponding essential id id_i and universal share, so we take the generation of the personal share $P{S}_{i{d}_1}$ and the universal $U{S}_1$ for example. First, turn the pixel value of the first secret image OS₁ into 8 bits, to get:

  $$O{M}_{2\times 2}^1=\left(\begin{array}{cc}10011010& 00100011\\ 01000101& 11110111\end{array}\right)$$

  (21)
• Divide the MSB part and the LSB part of $O{M}_{2\times 2}^1$, So $S{M}_{{}_{A\times B}}^i$ about the MSB parts and $S{L}_{{}_{A\times B}}^i$ about LSB is shown below:

  $$S{M}_{2\times 2}^1=\left(\begin{array}{cc}1001& 0010\\ 0100& 1111\end{array}\right)$$

  (22)

  $$S{L}_{2\times 2}^1=\left(\begin{array}{cc}1010& 0011\\ 0101& 0111\end{array}\right)$$

  (23)
• Select 4 gray images randomly {PO₁, PO₂, PO₃, PO₄} with the same size as the secret image from a set of thousands of images, and select another 4 gray images randomly {UO₁, UO₂, UO₃, UO₄} with the same size as the secret image.
• Find out the essential id for the qualified subset based on Algorithm 2, the essential id for the qualified subsets is {$i{d}_1,i{d}_2,i{d}_3,i{d}_4$} = {2, 1, 4, 3}.
• For the image {PO₁, PO₂, PO₃, PO₄}, suppose $P{M}_{2\times 2}^i$ is the matrix for the MSB part of PO_i. As such, the matrices of the MSB parts of the images are as below:

  $$P{M}_{2\times 2}^1=\left(\begin{array}{cc}0101& 1100\\ 0110& 1001\end{array}\right)$$

  (24)

  $$P{M}_{2\times 2}^2=\left(\begin{array}{cc}1110& 1000\\ 1010& 0010\end{array}\right)$$

  (25)

  $$P{M}_{2\times 2}^3=\left(\begin{array}{cc}0100& 0110\\ 0111& 1100\end{array}\right)$$

  (26)

  $$P{M}_{2\times 2}^4=\left(\begin{array}{cc}1100& 0110\\ 0101& 0111\end{array}\right)$$

  (27)
• For the image UO₁, the matrix $U{M}_{2\times 2}^1$ of the MSB parts is as below:

  $$U{M}_{2\times 2}^1=\left(\begin{array}{cc}0111& 1000\\ 1001& 0101\end{array}\right)$$

  (28)
• Thus, according to Equation (15) we can get $T{U}_{2\times 2}^1$:

  $$\begin{array}{cc}\hfill T{U}_{2\times 2}^1& ={\displaystyle \sum _{}S{M}_{2\times 2}^1+P{M}_{2\times 2}^1+P{M}_{2\times 2}^2+P{M}_{2\times 2}^3+U{M}_{2\times 2}^1}\hfill \\ & =\left(\begin{array}{cc}1001& 0010\\ 0100& 1111\end{array}\right)+\left(\begin{array}{cc}0101& 1100\\ 0110& 1001\end{array}\right)+\left(\begin{array}{cc}1110& 1000\\ 1010& 0010\end{array}\right)+\left(\begin{array}{cc}0100& 0110\\ 0111& 1100\end{array}\right)+\left(\begin{array}{cc}0111& 1000\\ 1001& 0101\end{array}\right)\hfill \\ & =\left(\begin{array}{cc}0001& 1000\\ 0110& 1101\end{array}\right)\hfill \end{array}$$

  (29)
• Apply the Arnold transform method to each matrix $T{U}_{2\times 2}^1$ to realize the element scrambling, and the scrambled matrix is denoted as $ET{U}_{2\times 2}^1$,

  $$ET{U}_{2\times 2}^1=\left(\begin{array}{cc}1101& 0001\\ 1000& 0110\end{array}\right)$$

  (30)
• Similarly, we can get:

  $$T{P}_{2\times 2}^{i{d}_1}=T{P}_{2\times 2}^2={\displaystyle \sum S{L}_{2\times 2}^1+P{M}_{2\times 2}^1+P{M}_{2\times 2}^3+U{M}_{2\times 2}^1}=\left(\begin{array}{cc}0101& 1110\\ 1100& 0110\end{array}\right)$$

  (31)
• Apply the Arnold transform method to each matrix $T{P}_{2\times 2}^2$ to realize the element scrambling, and the scrambled matrix is denoted as $ET{P}_{2\times 2}^2$,

  $$ET{P}_{2\times 2}^2=\left(\begin{array}{cc}0110& 0101\\ 1110& 1100\end{array}\right)$$

  (32)
• So, for the image UO₁, replace the 4 LSBs of each pixel with the element in $ET{U}_{2\times 2}^1$ to obtain the matrix of the universal share US₁ as below:

  $$U{g}_{2\times 2}^1=\left(\begin{array}{cc}01111101& 10000001\\ 10011000& 01010110\end{array}\right)$$

  (33)
• The pixel presentation matrix is:

  $$U{G}_{2\times 2}^1=\left(\begin{array}{cc}125& 129\\ 152& 86\end{array}\right)$$

  (34)
• For the images {PO₁, PO₂, PO₃, PO₄}, select the essential id id₁ for the qualified subset $Q{S}_1$ (the algorithm about the essential id for the qualified subset is shown in Algorithm 2), as id₁ = 2, so for the image PO₂, replace the 4 LSBs with $ET{P}_{2\times 2}^{i{d}_1}$, $i{d}_1=2$ to get one personal share PS₂.

  $$P{S}_{2\times 2}^2=\left(\begin{array}{cc}11100110& 10000101\\ 10101110& 00101100\end{array}\right)$$

  (35)

  $$P{G}_{2\times 2}^2=\left(\begin{array}{cc}230& 133\\ 174& 44\end{array}\right)$$

  (36)
• The other universal shares UO₂, UO₃, UO₄ and the personal shares PO₁, PO₃, PO₄ can be obtained in the same way.

In the following, the definition of the essential id for the qualified subset and the algorithm for the determination of the essential id is given out.

As described in the beginning of Section 4.1, the number of the minimal qualified subset is the same as the number of the participants, so each participant is in one minimal qualified subset. The essential id $i{d}_i$ for the subset $Q{S}_i$ is defined as the representative element id in $Q{S}_i$, for each qualified subset, there is one essential id and it is different from the essential id of other subsets; that is, the $i{d}_i$ for the subset $Q{S}_i$ is not equal to the $i{d}_j$ for the subset $Q{S}_j$, $i{d}_i\ne i{d}_j$ if $i\ne j$. Thus, the id of each participator can be assigned as the essential id for one minimal qualified subset, and each essential id can be assigned to one secret image according to one qualified subset. The algorithm about the selection of the essential id is described below.

In step 1, the qualified subset $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$ means that the $i_1$th, $i_2$th, …, $i_t$th participators have the ability to recovery the ith secret image, so the vector $V_i$ is in fact the logical express of the qualified subset.

In step 2, the matrix $QM$ is the binary matrix presentation of the general access structure, and the ith row is according to the ith qualified subset $Q{S}_i$, and the jth column is corresponding to the jth participator, so the $(i,j)$ element of $QM$ is not zero shows that the jth participator takes part in the recovery the ith secret image.

In step 3, the essential id for each qualified subset is determined according to the comparison of the column hamming weights and the row hamming weights, and the matrix is renewed continuously in the iteration. After step 5, we can get the final essential id for all the qualified subsets.

The following is the example of the determination process of the essential id.

Example 2.

Suppose there are 4 participants, the qualified part $P_{qual}=\{Q{S}_1,Q{S}_2,Q{S}_3,Q{S}_4\}$, and $Q{S}_1=\{1,2,3\}$, $Q{S}_2=\{1,4\}$, $Q{S}_3=\{2,4\}$, $Q{S}_4=\{3,4\}$.

• The vectors of the $Q{S}_i$ are shown as below:

  $$\begin{gathered} V_1=[1,1,1,0] \\ {V}_2=[1,0,0,1] \\ {V}_3=[0,1,0,1] \\ {V}_4=[0,0,1,1] \end{gathered}$$

  (37)
• As such, the matrix $QM$ of the qualified access is shown as below:

  $$Q{M}^{}=\left(\begin{array}{cccc}1& 1& 1& 0\\ 1& 0& 0& 1\\ 0& 1& 0& 1\\ 0& 0& 1& 1\end{array}\right)$$

  (38)
• Let $Q{M}^1=QM$ as the start point, calculate the hamming weight of each column, {$hm{c}_1,hm{c}_2,hm{c}_3,hm{c}_4$} = {2, 2, 2, 3}, and the hamming weight of each row is {$hm{r}_1,hm{r}_2,hm{r}_3,hm{r}_4$} = {3, 2, 2, 2}. As 2 is the smallest column hamming weight and not unique, compare all the {1, 2, 3} rows’ hamming weights, {$hm{r}_1,hm{r}_2,hm{r}_3,hm{r}_4$} = {3, 2, 2, 2}, since the element (2, 1) element has the row number that is smallest in the rows with a smaller row hamming weight of 2, the essential id for the qualified subset $Q{S}_2$ is 1;
• Then all the elements in the 2th row and the 1th column are set to be zero, the renewed matrix $Q{M}^2$ is as below:

  $$Q{M}^2=\left(\begin{array}{cccc}0& 1& 1& 0\\ 0& 0& 0& 0\\ 0& 1& 0& 1\\ 0& 0& 1& 1\end{array}\right)$$

  (39)
• Compare the hamming weight of the non-zero columns in $Q{M}^2$, {$hm{c}_2,hm{c}_3,hm{c}_4$} = {2, 2, 2}, as all the columns hamming weight is the same, so compare the row hamming weight, {$hm{r}_1,hm{r}_3,hm{r}_4$} = {2, 2, 2}, so select the (1, 2) element whose row number is smallest in the rows with hamming weight 2, which means the essential id for the qualified subset $Q{S}_1$ is 2;
• Then, the 1th row and the 2rd column is set to be zero, the renewed matrix $Q{M}^3$ is as blow:

  $$Q{M}^3=\left(\begin{array}{cccc}0& 0& 0& 0\\ 0& 0& 0& 0\\ 0& 0& 0& 1\\ 0& 0& 1& 1\end{array}\right)$$

  (40)
• The hamming weight of the non-zero columns {$hm{c}_3,hm{c}_4$} = {1, 2}, the smallest rows’ hamming weight is 1 and unique, so select the element (4, 3), the essential id for the qualified subset $Q{S}_4$ is 3;
• Then the 4th row and the 3th column is set to be zero, the renewed matrix $Q{M}^4$ is as blow:

  $$Q{M}^4=\left(\begin{array}{cccc}0& 0& 0& 0\\ 0& 0& 0& 0\\ 0& 0& 0& 1\\ 0& 0& 0& 0\end{array}\right)$$

  (41)
• Thus, it is easy to confirm the essential id for the qualified subset $Q{S}_3$ is 4;
• At last, we can obtain the essential id $EID=\{i{d}_1,i{d}_2,\dots ,i{d}_n\}=\{2,1,4,3\}$.

4.2. Secret Recovery Process

In the secret sharing process, the personal shares {PS₁, PS₂, …, PS_n} are distributed to the personal owners and the universal shares {US₁, US₂, …, US_n} are kept by the privileged committee members. As per the definition of the general access structure, the qualified owners can recover the ith secret image use the personal shares {PS_i1, PSi₂, …, PS_it} according to the qualified subset $Q{S}_i$, $i\in [1,n]$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$. The recovery process is shown in Algorithm 3.

Algorithm 3: The secret recovery process of the proposed scheme.

Input: The personal shares PS1, PS2, …, PSn; the universal shares US1, US2, …, USn.; the general access structure, the qualified part is $P_{qual}$, and the forbidden part is $P_{forbid}$.

Output: The secret images RS1, RS2, …, RSn

Step 1: Take the recovery of the ith secret image as the example. Retrieve the universal image UOi from the committee after verification, or else the committee members can participate in the recovery taking the universal share UOi. Extract the 4 LSBs of the each pixel to get the matrix $ET{U}_{A\times B}^i$ over GF(24), and 4 MSBs of the pixels of UOi form the matrix $U{M}_{A\times B}^i$;

Step 2: Collect the qualified personal shares {PSi1, PSi2, …, PSit} based on the qualified subset $Q{S}_i$, $i\in [1,n]$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$. For each qualified personal share, extract the 4 MSBs of each pixel of the share, as in Algorithm 1. Obtain the matrix $P{M}_{A\times B}^{i_j}$ over GF(24), $j\in [1,t]$, as $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, so we can get the matrices $\{P{M}_{A\times B}^{i_1},P{M}_{A\times B}^{i_2},\dots ,P{M}_{A\times B}^{i_t}\}$;

Step 3: Apply the Arnold inverse transform on $ET{U}_{A\times B}^i$ to get $T{U}_{A\times B}^i$, and perform the following operation: $$S{M}_{A\times B}^i={\displaystyle \sum T{U}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$$ (42)

$S{M}_{A\times B}^i$ is shown as below: $$S{M}_{A\times B}^i=\left[\begin{array}{ccc}pxS{M}_{(1,1)}^i& \dots & pxS{M}_{(1,\mathrm{B})}^i\\ \dots & pxS{M}_{(row,col)}^i& \dots \\ pxS{M}_{(\mathrm{A},1)}^i& \dots & pxS{M}_{(A,B)}^i\end{array}\right]$$ (43) where $pxS{M}_{(row,col)}^i=\{b{m}_1,b{m}_2,b{m}_3,b{m}_4\}$.

Step 4: Calculate the essential id $i{d}_i$ for the qualified set $Q{S}_i$ using Algorithm 2, and extract the 4 LSBs of each pixel in the $i{d}_i$th personal share to get the matrix $ET{P}_{A\times B}^{i{d}_i}$, and apply the Arnold inverse transform on $ET{P}_{A\times B}^{i{d}_i}$ to get $T{P}_{A\times B}^{i{d}_i}$;

Step 5: From the construction of $T{P}_{A\times B}^{i{d}_i}$, perform the following operation to get $S{L}_{A\times B}^i$: $$S{L}_{A\times B}^i={\displaystyle \sum T{P}_{A\times B}^{i{d}_i}+P{M}_{A\times B}^{i_{g_1}}+\dots +P{M}_{A\times B}^{i_{g_{t-1}}}+U{M}_{A\times B}^i}$$ (44) where $\{i_{g_1},\dots ,i_{g_{t-1}}\}=GP$, $GP=\left\{GP|GP\cup i{d}_i=Q{S}_i,i{d}_i\notin GP\right\}$, $Q{S}_i=\{i_1,\dots i_t\}$ and $S{L}_{A\times B}^i$ is shown as below: $$S{L}_{A\times B}^i=\left[\begin{array}{ccc}pxS{L}_{(1,1)}^i& \dots & pxS{L}_{(1,\mathrm{B})}^i\\ \dots & pxS{L}_{(row,col)}^i& \dots \\ pxS{L}_{(\mathrm{A},1)}^i& \dots & pxS{L}_{(A,B)}^i\end{array}\right]$$ (45) where $pxS{L}_{(row,col)}^i=\{b{l}_1,b{l}_2,b{l}_3,b{l}_4\}$.

Step 6: For each element in matrix $S{M}_{A\times B}^i$ and $S{L}_{A\times B}^i$, join the element of the matrix $S{M}_{A\times B}^i$ and the element of the matrix $S{L}_{A\times B}^i$ in the same position to form a new matrix $R{M}_{{}_{A\times B}}^i$: $$R{M}_{A\times B}^i=\left[\begin{array}{ccc}pxS{M}_{(1,1)}^i\cup pxS{L}_{(1,1)}^i& \dots & pxS{M}_{(1,\mathrm{B})}^i\cup pxS{L}_{(1,\mathrm{B})}^i\\ \dots & pxS{M}_{(row,col)}^i\cup pxS{L}_{(row,col)}^i& \dots \\ pxS{M}_{(\mathrm{A},1)}^i\cup pxS{L}_{(\mathrm{A},1)}^i& \dots & pxS{M}_{(A,B)}^i\cup pxS{L}_{(A,B)}^i\end{array}\right]$$ (46) where $pxS{M}_{(row,col)}^i\cup pxS{L}_{(row,col)}^i=\{b{m}_1,b{m}_2,b{m}_3,b{m}_4,b{l}_1,b{l}_2,b{l}_3,b{l}_4\}$.

Step 7: Transform each element of the matrix $R{M}_{{}_{A\times B}}^i$ into the decimal number, which is the pixel value of the ith recovered secret image RSi which is 256 gray level. For example, if the element of $R{M}_{{}_{A\times B}}^i$ is $\{b{m}_1,b{m}_2,b{m}_3,b{m}_4,b{l}_1,b{l}_2,b{l}_3,b{l}_4\}$, the pixel value is in fact $\{2^7\cdot b{m}_1+2^6\cdot b{m}_2+2^5\cdot b{m}_3+2^4\cdot b{m}_4+2^3\cdot b{l}_1+2^2\cdot b{l}_2+2^1\cdot b{l}_3+2^0\cdot b{l}_4\}$. Finally, we can get the recovered ith secret image, and the recovery of other secret images can be realized in the same manner.

In step 1 and 2, we collect the qualified personal shares responding to $Q{S}_i$, and the universal share is also collected. The matrices of the shares are divided into the MSB part and the LSB part, and the recovery can be realized by Equations (42) and (44). The example is shown as below.

Example 3.

As shown in example 1, in the secret sharing process, the personal shares {PS₁, PS₂, PS₃, PS₄} are distributed to the personal owners and the universal shares {US₁, US₂,US₃, US₄} are kept by the committee members with high privilege. The qualified access is $P_{qual}=\{Q{S}_1,Q{S}_2,Q{S}_3,Q{S}_4\}$, and $Q{S}_1=\{1,2,3\}$, $Q{S}_2=\{1,4\}$, $Q{S}_3=\{2,4\}$, $Q{S}_4=\{3,4\}$, which is the same as the sharing process. The secret image recovery process is shown as below, take the recovery of the first secret image for example.

Get the according universal share UO₁, change the pixel expression value into the bits expression.

$$U{G}_{2\times 2}^1=\left(\begin{array}{cc}125& 129\\ 152& 86\end{array}\right)$$

(47)

$$U{g}_{2\times 2}^1=\left(\begin{array}{cc}01111101& 10000001\\ 10011000& 01010110\end{array}\right)$$

(48)

Split each pixel into 2 parts, so the matrix about MSB and LSB is as shown below:

$$U{M}_{2\times 2}^1=\left(\begin{array}{cc}0111& 1000\\ 1001& 0101\end{array}\right)$$

(49)

$$ET{U}_{2\times 2}^1=\left(\begin{array}{cc}1101& 0001\\ 1000& 0110\end{array}\right)$$

(50)

Apply the Arnold inverse transform on $ET{U}_{A\times B}^i$ to get $T{U}_{A\times B}^i$, and $T{U}_{A\times B}^1=\left(\begin{array}{cc}0001& 1000\\ 0110& 1101\end{array}\right)$.

As the qualified subset $Q{S}_1=\{1,2,3\}$, collect the 1st, 2nd, and 3rd personal shares, and obtain the matrices of MSBs:

$$P{M}_{2\times 2}^1=\left(\begin{array}{cc}0101& 1100\\ 0110& 1001\end{array}\right)$$

(51)

$$P{M}_{2\times 2}^2=\left(\begin{array}{cc}1110& 1000\\ 1010& 0010\end{array}\right)$$

(52)

$$P{M}_{2\times 2}^3=\left(\begin{array}{cc}0100& 0110\\ 0111& 1100\end{array}\right)$$

(53)

Thus, we can get $S{M}_{2\times 2}^1$ based on the Equation (42).

$$\begin{array}{cc}\hfill S{M}_{2\times 2}^1& ={\displaystyle \sum _{}T{U}_{2\times 2}^1+P{M}_{2\times 2}^1+P{M}_{2\times 2}^2+P{M}_{2\times 2}^3+U{M}_{2\times 2}^1}\hfill \\ & =\left(\begin{array}{cc}0001& 1000\\ 0110& 1101\end{array}\right)+\left(\begin{array}{cc}0101& 1100\\ 0110& 1001\end{array}\right)+\left(\begin{array}{cc}1110& 1000\\ 1010& 0010\end{array}\right)+\left(\begin{array}{cc}0100& 0110\\ 0111& 1100\end{array}\right)+\left(\begin{array}{cc}0111& 1000\\ 1001& 0101\end{array}\right)\hfill \\ & =\left(\begin{array}{cc}1001& 0010\\ 0100& 1111\end{array}\right)\hfill \end{array}$$

(54)

Additionally, as the essential id $i{d}_1=2$, extract the 4 LSBs of the 2nd personal share to get $ET{P}_{2\times 2}^2=\left(\begin{array}{cc}0110& 0101\\ 1110& 1100\end{array}\right)$. Apply the Arnold inverse transform on $ET{P}_{2\times 2}^2$ to get $T{P}_{2\times 2}^2$, and $T{P}_{2\times 2}^2=\left(\begin{array}{cc}0101& 1110\\ 1100& 0110\end{array}\right)$, and we can get $S{L}_{2\times 2}^1$ based on Equation (44).

$$S{L}_{2\times 2}^1={\displaystyle \sum T{P}_{2\times 2}^2+P{M}_{2\times 2}^1+P{M}_{2\times 2}^3+U{M}_{2\times 2}^1}=\left(\begin{array}{cc}1010& 0011\\ 0101& 0111\end{array}\right)$$

(55)

Then, join the element of the matrix $S{M}_{2\times 2}^1$ and the element of the matrix $S{L}_{2\times 2}^1$ in the same position to get the bits expression of the first secret RS₁,

$$O{M}_{2\times 2}^1=\left(\begin{array}{cc}10011010& 00100011\\ 01000101& 11110111\end{array}\right)$$

(56)

Finally, transform the element of $O{M}_{2\times 2}^1$ into a decimal number to obtain the pixel value matrix of the first secret image:

$$R{S}_1=\left(\begin{array}{cc}154& 35\\ 69& 247\end{array}\right)$$

(57)

The other secret images can be recovered in the same way according to their qualified subsets.

5. Proof and Analysis

5.1. Correctness Proof

Theorem 1.

The secret images can be successfully recovered by the personal shares in the qualified subset in$P_{qual}$and the universal shares.

In other words, we need to prove that each secret image OS_i can be recovered by the personal shares according to the qualified subset $Q{S}_i$, $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$ and the universal share US_i, $i\in [1,n]$.

As shown in the secret sharing process, all the images are turned into the matrix form after transforming the pixel between 0 to 255 into the element with 8 bits in GF(2⁸) from the point of mathematics. The matrix $O{M}_{{}_{A\times B}}^i$ about the secret image OS_i is divided into two matrix $S{M}_{{}_{A\times B}}^i$ about the MSB part and $S{L}_{{}_{A\times B}}^i$ about the LSB part. Thus, in the recovery process we need to recover the two matrices.

Each of the prepared random selected images PO_i corresponding to $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$ are also divided into two parts in the same way as the secret image. The MSB matrices are denoted as the $P{M}_{A\times B}^{i_j}$, and the LSB matrices are $P{L}_{A\times B}^{i_j}$, $j\in [1,n]$. The matrix $P{M}_{A\times B}^{i_j}$ of the MSB part will participate in the sharing, and the LSB space is reserved.

Another prepared image for the universal share UO_i is also divided into $U{M}_{A\times B}^i$ and $U{L}_{A\times B}^i$ respectively.

The matrices’ computation for the secret image and the prepared images for the personal shares and the universal share are shown as below in Equation (12),

$$T{U}_{A\times B}^i={\displaystyle \sum S{M}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$$

Then the Arnold transform is applied on $T{U}_{A\times B}^i$ and the scrambling matrix $ET{U}_{A\times B}^i$ is generated. Based on the basic idea that the LSBs have the little effect on the image quality, the LSBs of the UO_i can be replaced by $ET{U}_{A\times B}^i$ and will not effect on the meaning of the image, so we can get the universal share US_i.

Another operation for the LSB part of the secret image is executed as below in Equation (15):

$$T{P}_{A\times B}^{i{d}_i}={\displaystyle \sum S{L}_{A\times B}^i+P{M}_{A\times B}^{i_{g_1}}+\dots +P{M}_{A\times B}^{i_{g_{t-1}}}+U{M}_{A\times B}^i}$$

where $\{i_{g_1},\dots ,i_{g_{t-1}}\}=GP$, $GP=\left\{GP|GP\cup i{d}_i=Q{S}_i,i{d}_i\notin GP\right\}$, $Q{S}_i=\{i_1,\dots i_t\}$.

And the matrix $T{P}_{A\times B}^{i{d}_i}$ is scrambled into $ET{P}_{A\times B}^{i{d}_i}$ by the Arnold transform.

From the definition of the essential id, each $Q{S}_i$ has an only essential id, and the $i{d}_i$ for the $Q{S}_i$ is different from the others; if $i\ne j$, $i{d}_i\ne i{d}_j$, then each $Q{S}_i$ has a different essential $i{d}_i$, so for each qualified subset, the 4-bits elements of $T{P}_{A\times B}^{i{d}_i}$ can be used to replace the LSBs of the $i{d}_i$th image in {PO₁, PO₂, …, PO_n}, so we can get the final $i{d}_i$th personal share $P{S}_{i{d}_i}$.

In the recovery process, the owners of personal shares of $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$ participate in the recovery, they offer the personal shares PS_i1, PS_i2, …, PS_it, and the corresponding universal share US_i is obtained from the universal panel, so we can get the matrices $P{M}_{A\times B}^{i_1},P{M}_{A\times B}^{i_2},\dots ,P{M}_{A\times B}^{i_t}$ from PS_i1, PS_i2, …, PS_it, and $T{U}_{A\times B}^i,U{M}_{A\times B}^i$ can be obtained from the US_i.

As shown in Equation (12), the share generation can be expressed as follows:

$$0={\displaystyle \sum T{U}_{A\times B}^i+S{M}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$$

(58)

Move $S{M}_{A\times B}^i$ to another side of the equation to get the expression of $S{M}_{A\times B}^i$ as shown below:

$$S{M}_{A\times B}^i={\displaystyle \sum T{U}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$$

(59)

In fact, Equation (59) used in the recovery, by which we can retrieve the MSB part of the secret image of OS_i.

As in Equation (15), the share generation can be expressed as below:

$$0={\displaystyle \sum T{P}_{A\times B}^{i{d}_i}+S{L}_{A\times B}^i+P{M}_{A\times B}^{i_{g_1}}+\dots +P{M}_{A\times B}^{i_{g_{t-1}}}+U{M}_{A\times B}^i}$$

(60)

Move $S{L}_{A\times B}^i$ to another side of the equation to get the expression of $S{L}_{A\times B}^i$ as shown below:

$$S{L}_{A\times B}^i={\displaystyle \sum T{P}_{A\times B}^{i{d}_i}+P{M}_{A\times B}^{i_{g_1}}+\dots +P{M}_{A\times B}^{i_{g_{t-1}}}+U{M}_{A\times B}^i}$$

(61)

where $\{i_{g_1},\dots ,i_{g_{t-1}}\}=GP$, $GP=\left\{GP|GP\cup i{d}_i=Q{S}_i,i{d}_i\notin GP\right\}$, $Q{S}_i=\{i_1,\dots i_t\}$.

In fact, Equation (44) is used in the recovery, by which we can retrieve the LSB part of the secret image of OS_i.

Combining the $S{M}_{A\times B}^i$ and $S{L}_{A\times B}^i$ together, we can get the exact pixel value of the secret image, and the secret image RS_i is recovered, which is the same as the original secret image OS_i.

5.2. Security Analysis

In this section, we will discuss the security of the proposed multi secret sharing scheme through theoretical analyses.

Theorem 2.

The personal are meaningful and the security of the share are reasonably good.

Regarding the personal shares, they are generated by the prepared meaningful images {PO₁, PO₂, …, PO_n} which are selected randomly from lots of images. Although all the shares are not meaningless shares in which the pixels values are random, they still have strong randomness, so it is hard to know which images will be selected from a set of images.

From the point of the visual assessment, the replacement of LSBs has little influence on the visual quality of the image; the change is so minuscule it can barely be detected by the human visual system. An example of the original image and the modified image of 4 LSBs is shown in Figure 1.

From the comparison in Figure 1, we can see that the modified image is still a meaningful image that looks like a nature image and it is almost the same as the original image.

The high security of the personal shares can be ensured by two aspects.

Firstly, the personal shares with 4 LSBs replaced by the elements in the matrix $ET{P}_{A\times B}^i$ are meaningful as the nature images, so they can avoid attracting any adversary’s attention more so than the random meaningless shares.

Secondly, from the point of the computation analysis, the MSBs of the personal share are the original bits of the original image, and the LSBs are $ET{P}_{A\times B}^i$ which is the random permutation result of $T{P}_{A\times B}^i$, $T{P}_{A\times B}^{i{d}_i}={\displaystyle \sum S{L}_{A\times B}^i+P{M}_{A\times B}^{i_{g_1}}+\dots +P{M}_{A\times B}^{i_{g_{t-1}}}+U{M}_{A\times B}^i}$; if one participant intends to analyze the single personal share to get some information about $S{L}_{A\times B}^i$, from the generation of $T{P}_{A\times B}^i$, he needs to get the MSB information {$P{M}_{A\times B}^{i_2},\dots ,P{M}_{A\times B}^{i_t}$} about the other qualified personal shares and the MSB information {$U{M}_{A\times B}^i$} about the according universal share. Without the help of this information, only use {$T{P}_{A\times B}^{i{d}_i},P{M}_{A\times B}^{i{d}_i}$}, the single personal share cannot retrieve the secret information, so it is not possible to analyze the content or the bits of the single personal share to get any information about the secret image. Furthermore, the result of Equation (15) is permuted and embedded; the embedded bits are scrambled, and it is hard to get the original bits because it is not known which transform is used.

Theorem 3.

The universal shares are meaningful, and the security of the shares are reasonably good.

For the universal shares, they still have strong randomness because the prepared images {UO₁, UO₂, …, UO_n} are selected randomly from lots of images. Also, the universal share UO_i is still meaningful image as a nature image and is almost the same as the original image US_i, $i\in [1,n]$.

The high security of the universal shares can be ensured by three point.

First, the universal shares are kept by the committee members with high privilege, who are trusted. The universal share for each qualified subset only can be used after the authentication, or in the recovery where the committee members take the universal share and participate in the recovery.

Secondly, the universal share looks like the nature image, which can avoid attracting the adversary’s attention more so than the random meaningless shares.

Thirdly, from the point of the computation analysis, the LSBs of the pixels are $ET{U}_{A\times B}^i$ which is the random permutation result of $T{U}_{A\times B}^i$. They are scrambled and it is hard to get the original bits because the transform is unknown. From the generation of $T{U}_{A\times B}^i$, $T{U}_{A\times B}^i={\displaystyle \sum S{M}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$, the MSB part $S{M}_{A\times B}^i$ the MSB information {$P{M}_{A\times B}^{i_1},P{M}_{A\times B}^{i_2},\dots ,P{M}_{A\times B}^{i_t}$} about the other qualified personal shares and the MSB information {$U{M}_{A\times B}^i$} about the according universal share take part in the generation. If one committee member intends to analyze the single universal share to get some information about $S{M}_{A\times B}^i$, from the generation of $T{U}_{A\times B}^i$, he can get the MSB information {$U{M}_{A\times B}^i$} about the universal share, he still needs to get the MSB information {$P{M}_{A\times B}^{i_1},P{M}_{A\times B}^{i_2},\dots ,P{M}_{A\times B}^{i_t}$} about the qualified personal shares. Without the information of personal share, he can only use {$T{U}_{A\times B}^i,U{M}_{A\times B}^i$} about the single universal share and cannot retrieve the secret information. It is established that even the qualified subset is very simple. Since there must be an essential id id_i for the qualified subset $Q{S}_i$, there is at least one matrix $P{M}_{A\times B}^{i{d}_i}$ and the $U{M}_{A\times B}^i$ participating in the generation of $T{U}_{A\times B}^i$, so $T{U}_{A\times B}^i\ne S{M}_{A\times B}^i$. After applying the Arnold transform to $T{U}_{A\times B}^i$, the embedded bits are the scrambling bits, so the MSB bits of the secret images will not be revealed directly and are hard to be calculated.

It is also not possible to use different universal shares to reveal some information about the secret images, because each $T{U}_{A\times B}^i$ is scrambling by the Arnold transform and XOR. Two or more universal shares only can get some useless random permutation result on $ET{U}_{A\times B}^i$.

Theorem 4.

The shares of the part of each subset$Q{S}_i$cannot reveal the information about the secret image.

Suppose the qualified subset is $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, and the subset of $Q{S}_i$ is $\{i_1,i_2,\dots ,i_w\}$, where $w<t$, $\{i_1,i_2,\dots ,i_w\}\subset \{i_1,i_2,\dots ,i_t\}$. From the definition of the minimum qualified subset, $\forall Q^{\prime }\subset Q$, and $Q\in P_{qual}$, $Q^{\prime }\notin P_{qual}$. As the $P_{qual}$ is the minimum qualified subset, for any part of the subset of the qualified subset $Q{S}_i$, it is not possible to be a qualified access.

From the generation equation of the personal shares for the subset $Q{S}_i=\{i_1,i_2,\dots ,i_t\}$, $T{U}_{A\times B}^i={\displaystyle \sum _{}S{M}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_t}+U{M}_{A\times B}^i}$, we can derive that, for the $\{i_1,i_2,\dots ,i_w\}$, where $w<t$, $S{M}_{A\times B}^i\ne {\displaystyle \sum _{}T{U}_{A\times B}^i+P{M}_{A\times B}^{i_1}+P{M}_{A\times B}^{i_2}+\dots +P{M}_{A\times B}^{i_w}}$; thus, it cannot recover the secret image OS_i for $\{i_1,i_2,\dots ,i_w\}$, where $w<t$ for the secret image.

Theorem 5.

The shares according to the forbidden subset$F{S}_i$cannot reveal any information about the secret image.

From the definition of the forbidden subset, $P_{forbid}=\{F{S}_1,F{S}_2,\dots ,F{S}_m\}$, where $F{S}_i$ is the ith forbidden subset $i\in [1,m]$, $F{S}_j=\{j_1,j_2,\dots ,j_r\}$, which means the $j_1$th, $j_2$th, …, $j_r$th owner is forbidden from recovering the secret, so we can know that the shares in the forbidden subset obviously cannot retrieve any information about the secret images.

6. Experiments

In this part, some experiments about the performance of the sharing and the recovery are given to evaluate the proposed multi secret sharing scheme with general access structure.

6.1. Secret Sharing and Recovery

Suppose there are 4 secret images with 256 gray level {OS₁, OS₂, OS₃, OS₄} to be shared, there are 4 participators $OW=\{O{W}_1,O{W}_2,O{W}_3,O{W}_4\}$, the qualified part $P_{qual}=\{Q{S}_1,Q{S}_2,Q{S}_3,Q{S}_4\}$, and $Q{S}_1=\{1,2,3\}$, $Q{S}_2=\{1,4\}$, $Q{S}_3=\{2,4\}$, $Q{S}_4=\{3,4\}$ as shown in Example 2.

The secret images are shown in Figure 2.

Randomly select 4 gray images {PO₁, PO₂, PO₃, PO₄} with the same size as the secret image. The images are shown in Figure 3.

Select another 4 gray images randomly {UO₁, UO₂, UO₃, UO₄} with the same size. The images are shown in Figure 4.

Select the essential id of the qualified subsets, {$i{d}_1,i{d}_2,i{d}_3,i{d}_4$} = {2, 1, 4, 3}.

Transform the secret images {OS₁, OS₂, OS₃, OS₄} and the randomly selected images {PO₁, PO₂, PO₃, PO₄} and {UO₁, UO₂, UO₃, UO₄} into the matrix format over GF(2⁸), get the matrix $S{M}_{{}_{A\times B}}^i$ about the MSB part of the secret image OS_i, the matrix $S{L}_{{}_{A\times B}}^i$ about the LSB part of the secret image OS_i, the matrix $P{M}_{A\times B}^i$ about the MSB part of the image PO_i, the matrix $U{M}_{A\times B}^i$ about the MSB part of the secret image US_i, $i\in [1,4]$, and execute the additional operation as per Equations (12) and (15) to get $T{U}_{A\times B}^i$ and $T{P}_{A\times B}^{i{d}_i}$. After the Arnold transform and the bits replacement in Algorithm 1, we can get the final personal shares {PS₁, PS₂, PS₃, PS₄} and the universal shares{US₁, US₂, US₃, US₄}, which are shown in Figure 5 and Figure 6.

The universal shares are shown in Figure 6.

The personal shares are distributed to the owners; each owner OW_i owns a personal share PS_i, and the universal shares US_i are kept by the committee members with high privilege.

In the recovery process, each secret image can be recovered based on the qualified subset. To recover the ith secret image, the owners according to the qualified subset $Q{S}_i$ offer their share images {PS_i1, PSi₂, …, PS_it}, and retrieve the universal share UO_i after the verification, or the committee members participate in the recovery by taking the universal share UO_i and execute the matrix operation as shown in Algorithm 3. The retrieved secret images are shown in Figure 7a–d. Figure 7a is the recovered 1th secret image QS₁ used the personal shares{PS₁, PS₂, PS₃} and the universal share US₁, Figure 7b is the recovered 2th secret image QS₂ used the personal shares{PS₁, PS₄} and the universal share US₂, Figure 7c is the recovered 3th secret image QS₃ used the personal shares{PS₂, PS₄} and the universal share US₃, Figure 7d is the recovered 4th secret image QS₄ used the personal shares{PS₃, PS₄} and the universal share US_4.

From the experiments results, we can see that all the personal share images and the universal share images are meaningful and look like the nature image, and the recovered secret image is exactly the same as the original secret image.

6.2. Analysis about the Experiments

Although all the shares and the recovered secret image can be recognized easily by the human visual system, we still evaluate the performance of the quality of the shares and the recovered secret images by quantitative analysis. To measure the quality of the share images and the recovered images, the peak signal-to-noise rate (PSNR) is used. The PSNR can evaluate the quality of the modified image compared to the original image, and in general the quality of the image is better if the PSNR is higher.

$$PSNR=10{\log }_{10}(\frac{{255}^2}{MSE})dB$$

(62)

where MSE is the mean-square error of the image with the size of $row\times col$. Suppose the pixel value of the modified image and the original image are $p(i,j)$ and $P(i,j)$ respectively, MSE can be expressed as:

$$MSE=\frac{1}{row\times col}{\displaystyle \sum _{i=1}^{row}{\displaystyle \sum _{j=1}^{col}{\left(P(i,j)-p(i,j)\right)}^2}}$$

(63)

The PSNR of the personal share images in the experiments are shown in

Table 1. The quality evaluation of the personal shares by peak signal-to-noise rate (PSNR).

The Personal Share	PSNR
PS1	31.62 dB
PS2	32.02 dB
PS3	31.84 dB
PS4	30.58 dB

.

Moreover, the PSNR of the universal share images in the experiment are shown in

Table 2. The quality evaluation of the universal shares by PSNR.

The Universal Share	PSNR
US1	31.83 dB
US2	31.84 dB
US3	31.75 dB
US4	31.63 dB

.

From the result we can see that the PSNR value of the shares which the 4 LSBs are replaced is about 32 dB. From the point of image process, if PSNR is bigger than 30 dB, we generally consider the quality is good enough to be recognized, and there is tiny difference between the original prepared images and the generated personal share images as shown in Figure 3 and Figure 5, and the original images and the universal shares is also almost looks like the same as shown in Figure 4 and Figure 6.

The quality of the recovered secret images are shown as the

Table 3. The quality evaluation of the recovered secret images by PSNR.

The Recovered Secret Images	PSNR
RS1	$\infty$
RS2	$\infty$
RS3	$\infty$
RS4	$\infty$

.

From Table 3, we can see that all the PSNR of the recovered secret images result is $\infty$; this is because that the recovered secret images can be exactly the same as the original secret images from the theoretical analysis and the experiment results, which means there is no lossless in the recovery as shown in Figure 7.

In the secret sharing scheme, to measure the correlation between the secret image and the share image, we use the SSIM (structural similarity index measure) [49] to evaluate the similarity between the different images. SSIM uses the structure combined with the luminance and the contrast to measure the similarity. The value of SSIM is between 0 to 1, and the lower SSIM means that there is less similarity. In this part, we evaluate the similarity between the secret images and all the personal and universal shares. The result is shown in

Table 4. The structural similarity index measure (SSIM) between the secret images and the shares.

	PS1	PS2	PS3	PS4	US1	US2	US3	US4
OS1	0.0421	0.0591	0.0528	0.0231	0.0560	0.0620	0.0543	0.0602
OS2	0.0163	0.0250	0.0342	0.0196	0.0280	0.0776	0.0322	0.0261
OS3	0.0678	0.0782	0.0874	0.0406	0.0992	0.0715	0.0882	0.0842
OS4	0.0816	0.0679	0.0811	0.0445	0.0758	0.0693	0.0841	0.0883

.

From the table, we can observe that the similarity between the secret images and the share images are very low and close to 0, so the shares have nearly no similarity with the secret images.

7. Discussion

There are different methods to construct the different kinds of multi secret sharing schemes with different properties; as such, in this part we will compare our proposed scheme with the typical multi secret sharing schemes from the secret image type, the pixel expansion, access type, the operation type, meaningful share, and lossless recovery.

The secret image type means that the secret images can be binary or gray or color image; the pixel expansion means if the size of the share is bigger than the size of the secret image; access type means that the access is the threshold access or the general access; the operation means that the mathematics computation methods are used in the schemes; meaningful share determines if the shares are meaningful or not; and the lossless recovery determines if the quality of the recovered secret images is lossless or not. The comparison is shown in

Table 5. The comparison about the different multi secret sharing schemes.

The Schemes	Secret Image	Pixel Expansion	Access type	Operation	Meaningful Share	Lossless Recovery
Weir, J [22]	Binary	yes	(n, n)	OR	no	no (low quality)
Chang C C [29]	Gray or color	no	(k, n)	Chinese remainder mathod and Lagrange interpolation	no	yes
Rajput M [31]	Gray or color	no	(n, n+1)	Additive Modulo(256)	no	no
Chen [32]	Binary or gray	no	(n+1, n+1)	XOR	no	yes
Chen [33]	Gray	no	(n, n)	XOR	no	yes
Yang C N [34]	Gray	no	(n, n)	XOR and bit shift	no	yes
Chen C C [35]	Gray (different size)	no	(n, n)	XOR and hash	no	yes
Deshmukh M [36]	Gray	no	(n, n)	XOR and arithmetic modulo	no	yes
Kabirirad S [37]	Gray	no	(n, n)	XOR	no	yes
Nag A [43]	Gray	no	General access	XOR	no	yes
Chen T [46]	Gray	no	General access	XOR	no	yes
Proposed scheme	Gray or color	no	General access	XOR	yes (good enough)	yes

.

From the comparison of the schemes we can see that, compared with the multi secret sharing schemes based on the visual cryptography, our proposed multi image secret sharing scheme has better performance in terms of the pixel expansion, recovery quality, secret image type, meaningful share, and more general access. It is not like visual cryptography, which does not need any external device and the secret is obtained by overlapping the printed transparent shares. The proposed scheme need to execute the Boolean operations for the pixels of the images with the help of the computers, so it is more complex than the visual cryptography method. Compared with the multi secret sharing schemes based on the polynomial or other algebraic method, it also has the advantages of more simple computation, meaningful share, and more general access. Compared with other Boolean based multi secret sharing schemes, our method can realize more flexible general access not restricted on the fixed (n, n) or other threshold, and all the shares are meaningful which is not achieved in other methods. Moreover, the quality of the share images is higher than 30 dB which is good enough, the recovery is lossless and is exactly the same as the original secret images. In this paper, we focus on describing the construction of the sharing and recovery process from the point of mathematics operation. However, there are still some point in the proposed scheme that can be improved for example, the 4 LSBs of the original prepared images are replaced in the generation of personal shares and the universal share. In the future we can use some method to reduce the embedded data and obtain a better steganography method to make the embedding more unnoticeable.

8. Conclusions

In this paper, we proposed a multi secret sharing scheme with the general access structure based on the Boolean operation. There is no pixel expansion as in visual cryptography, and the recovery is lossless. Also, there is no distortion in the recovered secret images, and one secret image can be recovered by the owners in the qualified subset, or all the secret images can be recovered by all the owners. All the shares including the personal shares and the universal shares are meaningful and the quality is good enough which will not attract the attention of any adversaries. Furthermore, our scheme can be easily extended to the color images, which will be the focus of our future work.