Pattern Recognition 43 (2010) Contents lists available at ScienceDirect. Pattern Recognition. journal homepage:

Transcription

1 Pattern Recognton 43 (2010) Contents lsts avalable at ScenceDrect Pattern Recognton ournal homepage: Secret mage sharng based on cellular automata and steganography Z. Eslam, S.H. Razzagh, J. Zarepour Ahmadabad Department of Computer Scence, Shahd Behesht Unversty, G.C., Tehran, Iran A R T I C L E I N F O A B S T R A C T Artcle hstory: Receved 29 January 2009 Receved n revsed form 9 June 2009 Accepted 15 June 2009 Keywords: Secret sharng scheme Lnear memory cellular automata Dgtal sgnature Authentcaton Verfablty Recently Ln and Tsa [Secret mage sharng wth steganography and authentcaton, The Journal of Systems and Software 73 (2004) ] and Yang et al. [Improvements of mage sharng wth steganography and authentcaton, The Journal of Systems and Software 80 (2007) ] proposed secret mage sharng schemes combnng steganography and authentcaton based on Shamr's polynomals. The schemes dvde a secret mage nto some shadows whch are then embedded n cover mages n order to produce stego mages for dstrbutng among partcpants. To acheve better authentcaton ablty Chang et al. [Sharng secrets n stego mages wth authentcaton, Pattern Recognton 41 (2008) ] proposed n 2008 an mproved scheme whch enhances the vsual qualty of the stego mages as well and the probablty of successful verfcaton for a fae stego bloc s 1/16. In ths paper, we employ lnear cellular automata, dgtal sgnatures, and hash functons to propose a novel (t, n)-threshold mage sharng scheme wth steganographc propertes n whch a double authentcaton mechansm s ntroduced whch can detect tamperng wth probablty 255/256. Employng cellular automata nstead of Shamr's polynomals not only mproves computatonal complexty from O(n log 2 n) to O(n) but obvates the need to modfy pxels of cover mages unnecessarly. Compared to prevous methods [C. Ln, W. Tsa, Secret mage sharng wth steganography and authentcaton, The Journal of Systems and Software 73 (2004) ; C. Yang, T. Chen, K. Yu, C. Wang, Improvements of mage sharng wth steganography and authentcaton, The Journal of Systems and Software 80 (2007) ; C. Chang, Y. Hseh, C. Ln, Sharng secrets n stego mages wth authentcaton, Pattern Recognton 41 (2008) ], we use fewer number of bts n each pxel of cover mages for embeddng data so that a better vsual qualty s guaranteed. We further present some expermental results Elsever Ltd. All rghts reserved. 1. Introducton Technques to share a secret mage have attracted consderable attenton n the recent years [1 8]. However, there are mportant ssues that such technques should deal wth. The frst one s accdental or ntentonal loss/corrupton of mages that mght occur f only a sngle party has access to the data. On the other hand, f several partcpants share parts of the secret mage, care must be taen to ensure that no malcous shareholder s able to manpulate hs/her data. The second ssue s the need to eep nvaders unaware not only of the content of the secret mage tself but also of the very fact that an mage s beng transferred. Secret sharng schemes whch protect and dstrbute a secret content among a group of partcpants provde solutons to the frst Correspondng author. Tel.: ; fax: E-mal addresses: z_eslam@sbu.ac.r (Z. Eslam), s.razzagh@mal.sbu.ac.r (S.H. Razzagh), J.zarepour@mal.sbu.ac.r zarepouramal@gmal.com (J. Zarepour Ahmadabad). ssue. In ths regard, the basc example, proposed frst by Shamr [9] and Blaley [10], s the concept of a (t, n)-threshold secret sharng scheme whch encodes a secret data set nto n shares and dstrbutes them among n partcpants n such a way that any t or more of the shares can be collected to recover the secret data, but any t 1or fewer of them provdes no nformaton about the secret. Moreover, to ensure recovery of the orgnal secret nformaton some authentcaton process must be employed so that any manpulaton of shares s detected wth hgh probablty. To tacle the second concern, steganographc technques are usually employed [1 3,11 14]. In these methods, frst some nnocentloong mages, called cover mages, are selected. Then the secret data are embedded nto cover mages and the resultng stego mages are dstrbuted among partcpants usng some secret sharng scheme. Clearly, n order not to nvoe suspcon, the embeddng should create hgh-qualty stego mages such that the changes are not vsually perceptble. So far, two most popular steganographc methods are the least sgnfcant bts (LSBs) replacement [15 17] and the modulus operaton [18 20]. For example, Wu et al. [8] proposed a sharng and /$ - see front matter 2009 Elsever Ltd. All rghts reserved. do: /.patcog

2 398 Z. Eslam et al. / Pattern Recognton 43 (2010) hdng method that compresses the secret mage frst and then produces stegos based on the modulus concept. Therefore, although the method can generate smaller stego mages, these mages may be dstorted severely and attract the attenton of malcous attacers. Moreover, the orgnal secret mage cannot be retreved completely n the reconstructon procedure. Ln and Tsa [1] proposed a method of secret mage sharng wth steganography and authentcaton n Ther scheme s an example of a lossy polynomal-based mage sharng and the reconstructed secret mage may be dstorted slghtly. Further, the authentcaton mechansm n ths scheme s rather wea. In 2007, Yang et al. [2] proposed an mproved verson to overcome the defects n Ln and Tsa's scheme. Although Yang et al.'s method can restore a dstorton-free secret mage, t not only reduces the qualty of the stego mages but also allows a sgnfcant probablty that the fae stego mage can be authentcated successfully. In Chang et al. [3], the authors proposed an enhanced scheme n whch the concepts of Then and Ln's secret mage sharng [21] s used to ensure that no dstorton s ntroduced nto the secret mage. Furthermore, an authentcaton method based on the Chnese remander theorem (CRT) s used to mprove authentcaton ablty. However, we can notce the followng shortcomngs n the method of Chang et al. Frst, the use of Shamr's polynomals (as descrbed n Secton 3.1) and the fact that ths scheme changes (at most) 3 bts n each pxel of a gven cover mage can ntroduce a sde effect on the vsual qualty of the resultng stego mages. Furthermore, n order to detect tamperng of data, t may be necessary to process all blocs of a gven stego mage and the probablty of successful verfcaton for a fae stego bloc s 1/16 whch can be consdered hgh n some applcatons. In [22], a partcular type of dscrete dynamcal system called onedmensonal memory cellular automata (CA) s employed to desgn a(t, n)-threshold scheme n whch at least t consecutve shares are needed to reconstruct the secret. To share secret color mages, twodmensonal cellular automata are used n [23]. In ths paper, we employ cellular automata and ntroduce a double authentcaton mechansm to propose a new (t, n)-threshold mage sharng scheme wth steganographc propertes. Our proposed scheme uses 2 bts n each pxel of cover mages for embeddng data and so a better vsual qualty for the produced stego mages s acheved. We ntroduce no dstorton to the secret mage. Moreover, the authentcaton ablty of the scheme can detect a fae stego bloc wth probablty 255/256. In contrast to O(n log 2 n)-complexty of polynomal evaluaton and nterpolaton algorthms [24], the proposed scheme s of order O(n). The rest of ths paper s organzed as follows: related wor s covered n Secton 2. In Secton 3, the proposed scheme as well as our motvaton to employ CA nstead of Shamr's sharng scheme s outlned. Secton 4 provdes comparson between our proposed scheme and other methods n the lterature. Fnally, the conclusons of ths paper are presented n Secton Related wors In ths secton, we brefly revew cellular automata and the scheme of Chang et al. [3] One-dmensonal memory cellular automata One-dmensonal fnte boolean cellular automata are dscrete dynamcal systems formed by a fnte array of N dentcal obects called cells, where each cell can assume a state s {0, 1}, updated synchronously n dscrete tme steps accordng to a local transton functon. The updated state of each cell depends on the varables of ths functon whch are the prevous states of a set of cells, ncludng the cell tself, and consttute ts neghborhood. For the -th cell, denoted by, we consder the symmetrc neghborhood of radus r whch s defned as N ={ r,...,,..., + r }. Leta (T) denote the state of at tme T. Then, the local transton functon of the cellular automata wth radus r has the followng form: a (T+1) = f (a (T) r,...,a(t),...,a (T) ), 0 N 1 (1) +r or equvalently, a (T+1) = f (N (T) ), 0 N 1, (2) where N (T) (Z 2 ) 2r+1 stands for the states of the neghbor cells of at tme T. Furthermore, f (mod N), then t s assumed that a (T) = a (T) to ensure well-defned dynamcs of the CA. The vector C (T) = (a (T) 0,...,a(T) N 1 ) s called the confguraton of CA at tme T and C (0) s the ntal confguraton. Moreover, the sequence {C (T) } 0 T s called the evoluton of order of the CA and the set of all possble confguratons of the CA s denoted by C. The global functon of the CA s a lnear transformaton, Φ : C C, whch determnes the confguraton at the next tme step durng the evoluton of the CA, that s, C (T+1) =Φ(C (T) ). For a CA wth bectve Φ, there exsts another cellular automaton, called ts nverse, wth global functon Φ 1, and the CA tself s called reversble. InsuchCAs the evoluton bacward s possble (see [25]). The local transton functon of a lnear cellular automata (LCA) wth radus r s of the followng form: a (T+1) = r = r α a (T) (mod 2), 0 N 1, (3) + where α Z 2 for every. Snce there are 2r + 1 neghbor cells for, there exst 2 2r+1 LCAs and each of them can be specfed by an nteger w called rule number whch s defned as follows: r w = α 2 r+, (4) = r where 0 w 2 2r+1 1. The CAs consdered so far are memoryless,.e., the updated state of a cell depends on ts neghborhood confguraton only at the precedng tme step. Nevertheless, one can consder cellular automata for whch the state of neghborng cells at tme T as well as T 1, T 2,... contrbutes to determne the state at tme T +1. Ths s the concept of the memory cellular automata (MCA) [26]. Hereafter, by a CA, we mean a partcular type of MCA called the t-th order lnear MCA (LMCA) whose local transton functon taes the followng form: a (T+1) = f 1 (N (T) ) + f 2 (N (T 1) ) + +f t (N (T t+1) )(mod2), 0 N 1, (5) where f s the local transton functon of a partcular LCA wth radus r, for 1 t. In ths case, we requre t ntal confguratons C (0),...,C (t 1) to start the evoluton of LMCA. Furthermore, n order for ths cellular automaton to be reversble, we have the followng proposton. A proof for ths proposton can be found n [22]. Proposton 1. If f t (N (T t+1) ) = a (T t+1), then the LMCA gven by (5) s reversble and ts nverse s another LMCA wth the followng local transton functon: a (T+1) t 2 = f t m 1 (N (T m) ) + a (T t+1) (mod 2), 0 N 1. (6) m= Revew of Chang et al.'s (t, n)-threshold secret mage sharng scheme The scheme dvdes the secret mage, denoted by SI, nto some shadows whch are then embedded n n cover mages CI 1,...,CI n,n

3 Z. Eslam et al. / Pattern Recognton 43 (2010) The proposed scheme In ths secton, we frst outlne why we employ CA and then proceed to descrbe the proposed scheme Our motvaton to use cellular automata nstead of Shamr's sharng scheme Fg. 1. The bloc ˆB of the -th stego mage n Chang et al.'s scheme. order to produce stego mages STG 1,...,STG n, for dstrbutng among partcpants P 1,...,P n, respectvely. There are two procedures: (1) sharng and embeddng, (2) authentcaton and revealng Sharng and embeddng procedure Frst, all pxel values n SI that are greater than or equal to 250 are represented as two values, 250 and the value of the dfference between the pxel value and 250, respectvely. Therefore, a modfed secret mage (MSI) s generated n whch pxel values are ranged from 0 to 250. In addton, a secret ey K s used to generate a random bt-stream as the watermar bts. Ths ey s further splt nto n sub-eys whch are gven to the partcpants. Next, every t pxels n MSI are consdered as a unt. Each unt s used to generate n shared pxels whch must be embedded nto four-pxel blocs of CI to fnally produce STG,1 n. Let U be the (, )-th unt of MSI. Thet pxels of U are consdered as coeffcents of a polynomal functon of degree t 1: q(x) = (c 0 + c 1 x + +c t 1 x t 1 ) (mod 251). (7) Let B ={X, V, W, Z } be the bloc wth poston (, ) n CI wth bnary representaton (x 1,...,x 8 ), (v 1,...,v 8 ), (w 1,...,w 8 ), and (z 1,...,z 8 ), for X, V, W,andZ,1 n, respectvely. Denote the correspondng stego bloc by ˆB.For1 n, nput the decmal value of x 1 x 2,...,x 5 nto q(x) to generate the shared pxel S, wth bnary representaton (s 1,...,s 8 ). Now, the shared pxel S s embedded n the bloc B by replacng the eght bts x 6 x 7 v 6 v 7 w 6 w 7 z 6 z 7 wth s 1,...,s 8. Fnally, to ensure authentcty of stego blocs, four CRT-based authentcaton bts are computed and combned wth the current watermar bts to produce chec bts (p 1, p 2, p 3, p 4 ). The chec bts replace x 8 v 8 w 8 z 8 of B. The bloc ˆB of STG s depcted n Fg. 1. The sharng and embeddng procedure s repeated untl all pxels of MSI are processed. After that, the stego mages are produced and transmtted to P 1,...,P n Authentcaton and revealng procedure In order to restore the secret mage, any group of t or more stego mages wth sub-eys are gathered together. Then, these sub-eys can be used to reveal the secret ey K from whch the watermar bts can be generated. Next, each of the stego mages s dvded nto a set of four-pxel blocs. The authentcaton bts and the watermar bts are used to compute the chec bts correspondng to the bloc. If the chec bts are dentcal to the hdden bts of the stego mage, the bloc s verfed successfully and a shared pxel s retreved. Ths procedure s repeated untl all the hdden shared pxels are retreved. Fnally Lagrange's nterpolaton s used to get the secret mage. Cellular automata are very powerful computatonal tools wth synchronous update mechansm for ther ndvdual components (cells) and are specally adopted for mage related wors. In partcular, n secret mage sharng applcatons n whch Shamr's sharng scheme s used, we must provde dstnct nput values for Shamr's secret polynomal. Now, to economze on the sze of data to be embedded, these values are usually obtaned from pxels of cover mages. Therefore, as the number of partcpants ncreases, t may become necessary to modfy some pxels n cover mages and ths can ntroduce a sde effect on the vsual qualty of the resultng stego mages. Snce we need no nput values to start evolutons of CA, ths effect s removed when usng cellular automata whch means that pxels of the cover mages can be used more effcently. Another drawbac n Shamr-based sharng schemes s that we are forced to calculate mod a prme number p whle CA do not mpose such restrctons. In calculatng mod prmes, we should perform a preprocessng on the secret mage to produce pxel values n proper range (.e ). Ths process results n modfed secret mages whose sze s greater than the orgnal mage (see, e.g. [3,27]). The ncrease n the sze of data to be embedded affects the qualty of stego mages The scheme The scheme conssts of four phases: (1) the setup phase, (2) the sharng phase, (3) the embeddng phase, and (4) the verfcaton and recovery phase. In setup phase, a trusted party called the dealer constructs a reversble LMCA (M)of ordert. The dealer further creates a set of publc/prvate eys that wll later be used to add sgnature on the data for the purpose of authentcaton. In sharng phase, the dealer dvdes the secret mage nto some unts and derves from each unt t ntal confguratons necessary to evolve M. The evolutons of M are used to produce shared pxels for partcpants. These shares plus other nformaton about M and necessary data to reconstruct the secret mage are then sgned by the dealer and embedded n cover mages n the embeddng phase and the resultng stego mages are gven to the partcpants (Fg. 2). The sgnature s used so that manpulaton of stego mages can be detected wthout processng of pxels n verfcaton and recovery phase. Fnally, evolutons of the nverse machne are used to recover the orgnal secret (Fg. 4) Notatons We use the followng notatons to descrbe the scheme. SI the secret mage, U 1,...,U l the (t 1)-pxel unts of SI, U 1,...,Ut 1 the pxels n the -th unt U, Wdth, Heght wdth and heght of SI, P 1,...,P n the partcpants, CI the cover mage correspondng to P, STG the stego mage correspondng to P, Aut authentcaton strng correspondng to P, SH the share of P from unt U, r radus of neghborhood for the LMCA, w s the startng rule number of LMCA, C (T) confguraton of the LMCA at tme T,

4 400 Z. Eslam et al. / Pattern Recognton 43 (2010) Fg. 2. Dagram of the sharng and embeddng procedure n the proposed scheme. btstrng ths operator dvdes btstrng from rght to left nto substrngs of length and then XORs them to obtan a strng of length, wth paddng done f necessary, DS (btstrng) dgtal sgnature on the btstrng wth ey, Ver (Sgn, m) verfcaton functon of the dgtal sgnature on message m and sgnature Sgn wth ey, Seq a unque sequence number assgned to P, H a collson-free hash functon, D the dealer, (PU D, PR D ) publc and prvate eys of the dealer correspondng to sgnature scheme DS, the concatenaton operator for strngs The setup phase In ths phase, the dealer D fxes some parameters and constructs a reversble LMCA of order t through the followng steps: 1. Assgns a cover mage (CI ) and a sequence number Seq to each partcpant P. 2. Generates a set of publc/prvate eys (PU D, PR D ). 3. Constructs a reversble LMCA (M): (a) Selects 1 r 3 as the radus of the symmetrc neghborhood of the LMCA. (b) Selects a random number 0 w s 2 2r+1 t + 1. The rule numbers of the LMCA are then w s, w s + 1,...,w s + t 2. (c) Constructs M of order t by a (T+1) = f ws (N (T) )+ +f ws+t 2(N (T t+2) )+a (T t+1) (mod 2), where 0 7andf ws+ s the local transton functon of the LMCA wth radus r and rule numbers w s +, 0 t 2. The par (PU D, PR D ) wll be used to prohbt tamperng of stego mages. The dealer sgns the embedded data wth PR D and hdes the sgnature together wth the correspondng publc ey PU D n stego mages for the purpose of verfcaton n the recovery phase. Note that n our scheme, we consder 1 byte for each pxel. Therefore, the number of cells n each confguraton of M s 8 and ths s why we assume 1 r 3. Note also that for a rule number w we must have 0 w 2 2r+1 1. Fnally, the evolutons of M areusedtocreaten shares SH 1,...,SH n correspondng to partcpants. The detals are as follows: Step 1. D: 1 Dvdes SI nto (t 1)-pxel unts U 1, U 2,...,U l. 2 Repeats for = 1,...,l. 2.1 Sets ntal confguratons C (0),...,C (t 2) of M as the bnary representaton of t 1 pxels n the unt U : (U 1,...,Ut 1 ). 2.2 Computes C (t 1) as H(C (0),..., C (t 2) ) Computes evolutons of M of order n + t 1, wth these ntal confguratons C (0),...,C (t 1) and obtans C (t),...,c (t+n 1). 2.4 Assgns to each partcpant one of the confguratons as hs/her share,.e. SH 1 = C(t),...,SH n = C (t+n 1). Step 2. D: 1 Repeats for = Seq 1,...,Seq n. 1.1 Sgn = DS PRD (PU D Wdth Heght l Seq w s t r SH 1 SH 2,..., SHl ), 1.2 Aut = PU D Sgn. So far, wth l as the total number of unts of SI, the strng SH 1 SH2,..., SHl, plus other nformaton about M and SI must be embedded n the P 's cover mage (CI ). In ths step, the dealer sgns these nformaton wth hs prvate ey PR D. The sgnature and the correspondng publc ey PU D are concatenated to form the authentcaton strng Aut whch wll also be embedded n CI to prevent P from manpulaton of hs/her share. Consderng the ntal confguraton C (t 1) as H(C (0),..., C (t 2) ) 8 provdes what we call double authentcaton. Even f the cheaters succeed n forgng the dealer's sgnature on stego mages and therefore pass the frst authentcaton chec (wth very small probablty), ther manpulaton wll be revealed by ths technque. We elaborate on how ths s done n the verfcaton and recovery phase. Note that Seq s the sequence number devoted to P n the setup phase. It s used to prevent partcpants from exchangng ther shares or announcng an ncorrect dentfcaton number (that s not consecutve) n the recovery phase The sharng phase The detals of the sharng phase are depcted n Fgs. 2 and 3. Frst, D dvdes SI nto unts U 1, U 2,...,U l, where U conssts of (t 1) pxels U 1,...,Ut 1 (wth paddng done on the last unt f necessary) (Fg. 2). For each U, the dealer employs ts pxels as ntal confguratons C (0),...,C (t 2) of M. Thet-th ntal confguraton C (t 1) s then computed as the hash value of the frst t 1 ntal confguratons The embeddng phase In ths phase, the dealer produces fnal stego mages by embeddng the data obtaned n prevous phases nto the cover mages. The embeddng s such that frst the vsual qualty of the results have no serous downtrend, and second t s dffcult to recognze that any data s hdden n the stego mages. Our embeddng procedures satsfes both of these requrements.

5 Z. Eslam et al. / Pattern Recognton 43 (2010) Fg. 3. Dagram of the sharng phase. Fg. 4. Dagram of the recovery phase. As descrbed n prevous phases, we need to embed n each CI the followng data: Seq, to ensure consecutve orderng of the partcpants n the recovery phase. ws, r, t, for reconstructon of the LMCA M. Wdth, Heght and l, for proper recovery of the secret mage. The shares assgned to P,.e. SH,0 l. The authentcaton strng Aut correspondng to P, for the purpose of authentcaton. We now outlne the detals of embeddng procedure n the - th cover mage CI. The forgong data, wth the same orderng, are consdered as an array of bytes. Each byte of data s embedded nto one bloc of CI consstng of 4 bytes. Let (d 1,...,d 8 ) be the bnary representaton of the byte to be embedded n bloc B of CI wth pxels X, V, W and Z wth bnary representaton as n Fg. 5. The embeddng replaces the least sgnfcant bts of X, V, W and Z wth d 1,...,d 8 as depcted n Fg. 6. Note that the embeddng changes at most two of the LSBs n each byte of B. Ths mantans the qualty of stego mages The verfcaton and recovery phase The detals of ths phase are depcted n Fg. 4. Suppose that t consecutve partcpants, P α, P α+1,...,p α+t 1,1 α n t+1, present the stego mages STG α, STG α+1,...,stg α+t 1 to recover the secret

6 402 Z. Eslam et al. / Pattern Recognton 43 (2010) Comparson and expermental results In [3], the scheme of Chang et al. s shown to outperform the methods presented n [1,2]. Therefore, n ths secton, we compare the proposed scheme and the scheme of Chang et al. The results of ths secton show that our proposed method acheves the followng merts: Fg. 5. One bloc of CI consstng of 4 bytes. Our method employs lnear cellular automata whle best polynomal evaluaton and nterpolaton algorthms are of order O(n log 2 n) [24]. We use at most 2 bts n each pxel of cover mages for embeddng data whle ths number s 3 for Chang et al.'s scheme. Moreover, snce we employ cellular automata, we are not forced to change any more bts n cover mages as Shamr-based methods do. Ths guarantees a better vsual qualty for our stego mages. We perform some experments for llustraton. Gven a stego mage, our scheme detects whether t s tampered or not wthout processng of ts blocs. Other methods may need to process all blocs of the mage to fnd ths. Moreover, each fae stego bloc s verfed successfully wth probablty 1/256 n contrast to 1/16 for Chang et al.'s method. Expermental results are also provded for comparson. Fg. 6. The embeddng of the hdden byte (d 1,...,d 8) n a stego bloc. mage SI. EachSTG s dvded nto a set of blocs wth four pxels from whch the embedded data can be retreved. (1) Retreve from STG, Seq, ws, r, t, Heght, Wdth, l, SH,0 l and Aut = PU D Sgn for each P, α α + t 1, (2) Chec f the derved sequence numbers Seq are consecutve. (3) Each P, α α + t 1 can verfy the nformaton gven by P,, as follows: PU D of P should equal PU D of P, for α α + t 1. Ver PUD (Sgn, PU D Wdth Heght l Seq w s t r SH 1 SH2,..., SH l ) = true. (4) Repeat for = 1,...,l (to reconstruct the -th unt): (4.1) Construct the nverse of M,.e. M, by Eq. (6), wth radus r, rule numbers determned by w s, and ntal confguratons C (0) = SH α+t 1, C (1) = SH α+t 2,..., C (t 1) = SH α, and evolve M, t+α 1 tmes to obtan C (2t+α 2),..., C (t+α 1). (4.2) Chec f Hash( C (2t+α 2),..., C (t+α 2) ) 8 equals C (t+α 1) or not. (4.3) The pxels of the -th unt of SI, that s, U 1,...,Ut 1,are taen as the bnary representaton of C (2t+α 2),..., C (t+α 2), respectvely. The stego mages whch fal the sgnature verfcaton test are tampered. We have the opton to totally reect them and stop, or mar them suspcous and proceed wth the recovery phase. Now, tampered stego blocs whch are nput to M would satsfy, wth probablty 1/256, the test n step 4.2 of the verfcaton phase and the correspondng unt of the secret mage wll be nvaldated wth probablty 255/256. Note that snce the shares presented n recovery phase consttute confguratons of a reversble t-th order LMCA, then at least t shares are requred to compute evolutons of the nverse automata and nowng t 1 or fewer shares s nsuffcent. We frst consder vsual qualty of stego mages. We perform experments for n = 4andt = 3. We tae Jet-F16 wth sze as the secret mage whle Lena, Pepper, Baboon and flower serve as cover mages wth szes (Fg. 7). The crteron for the vsual qualty of the stego mages s the pea-sgnal-to-nose rato (PSNR) defned as (255) 2 PSNR = 10 log 10 db, (8) MSE where MSE s the mean-square error between the cover mage and the stego mage. If the cover mage s szed f g, MSE s defned as MSE = 1 f g f g (x y ) 2, (9) =1 =1 where x and y denote the cover and the stego pxel values, respectvely. The stego mages generated by the scheme of Chang et al. and ther PSNR are gven n Fg. 8(a). The same data are reported for our scheme n Fg. 8(b). The results show that our scheme acheves hgher PSNR. We now compare the two schemes n terms of authentcaton capabltes. In the scheme of Chang et al., the probablty that a fae bloc can be verfed successfully s 1/16. Now, suppose that P modfes a bloc of hs/her stego mage. Therefore, the sgnature Sgn hdden n STG cannot be verfed successfully. Next, the fae blocs n ths stego mage are used to compute the evolutons of M and obtan C (2t+α 2),..., C (t+α 1). The modfcaton maes Hash( C (2t+α 2),..., C (t+α 2) ) 8 dfferent from C (t+α 1) and the fae bloc s detected. Hence, the probablty that a modfed bloc s verfed successfully s about 1/256. Note also that our scheme can detect a tampered stego mage wth a sngle test whle Chang et al.'s scheme should obtan ths nformaton from tampered blocs. We also conducted experments to confrm authentcaton abltes of the two schemes. To do ths, we follow the method used n [3] and consder DR = NTPD/NTP the crteron for ntegrty verfcaton, where NTP s the number of the tampered pxels, and NTPD s the number of the tampered pxels that are detected. We consder agan the stego mage lena constructed by the two schemes and manpulate t twce wth two dfferent mages: flower wth sze , and Pepper of sze These mages are added to the top-left corner of the vctm stego mage, as

7 Z. Eslam et al. / Pattern Recognton 43 (2010) Fg. 7. Test mages. (a) Jet-F16, (b) lena, (c) Baboon, (d) Pepper, and (e) flower. Fg. 8. The expermental results for (3, 4)-threshold secret mage sharng scheme. (a) The stego mages generated by Chang et al.'s scheme and (b) the stego mages generated by the proposed scheme. shown n Fg. 9. The detecton ratos for tamperng wth flower are and for Chang et al.'s scheme and our proposed scheme, respectvely, whle tamperng wth Pepper reports and for the correspondng schemes. 5. Conclusons In ths paper, we propose a new (t, n)-threshold mage sharng scheme wth steganographc propertes. The scheme s based on lnear cellular automata and ntroduces no dstorton to the orgnal secret mage; however, consecutve shares must be provded to recover the secret mage. We change at most 2 bts n each pxel of a gven cover mage to preserve ts vsual qualty. In order to manpulate even a sngle bloc n a stego mage and reman unnotced, a malcous partcpant has to forge a secure dgtal sgnature and even n that case, a double authentcaton mechansm s employed such that the correspondng nformaton n the secret mage wll be nvaldated wth probablty 255/256. Moreover,

8 404 Z. Eslam et al. / Pattern Recognton 43 (2010) Fg. 9. Manpulated stego mages for the two schemes. (a) Chang scheme (DR=0.951), (b) our scheme (DR=0.997), (c) Chang scheme (DR=0.974), (d) our scheme (DR=0.997). the ntegrty of each stego mage can be verfed wthout processng of ts blocs. References [1] C. Ln, W. Tsa, Secret mage sharng wth steganography and authentcaton, The Journal of Systems and Software 73 (2004) [2] C. Yang, T. Chen, K. Yu, C. Wang, Improvements of mage sharng wth steganography and authentcaton, The Journal of Systems and Software 80 (2007) [3] C. Chang, Y. Hseh, C. Ln, Sharng secrets n stego mages wth authentcaton, Pattern Recognton 41 (2008) [4] N. Noar, A. Shamr, Vsual cryptography, Advances n Cryptology: Eurocrypt'94, vol. 48, Sprnger, Berln, 1995, pp [5] D. Stnson, Vsual cryptography and threshold schemes, IEEE Potentals 18 (1999) [6] S. Shyu, Effcent vsual secret sharng scheme for color mages, Pattern Recognton 39 (2006) [7] T.C.C.N. Yang, Aspect rato nvarant vsual secret sharng schemes wth mnmum pxel expanson, Pattern Recognton 26 (2) (2005) [8] Y. Wu, C. Then, J. Ln, Sharng and hdng sector mages wth sze constrant, Pattern Recognton 37 (2004) [9] A. Shamr, How to share a secret, Communcatons of the ACM 22 (1979) [10] G. Blaley, Safeguardng cryptographc eys, AFIPS Conference Proceedngs 48 (1979) [11] C. Chang, T. Chen, L. Chung, A steganographc method based upon JPEG and quantzaton table modfcaton, Informaton Scences 141 (2002) [12] N. Johnson, S. Jaoda, Explorng steganography: seeng the unseen, IEEE Comput. 31 (2) (1998) [13] L.M. Marvel, C.G. Boncelet Jr., C.T. Retter, Spread spectrum mage steganography, IEEE Transactons on Image Process 8 (8) (1999) [14] D. Wu, W. Tsa, A steganographc method for mages by pxel-value dfferencng, Pattern Recognton Letters 24 (9 10) (2003) [15] C. Chan, L. Cheng, Hdng data n mages by smple LSB substtuton, Pattern Recognton 37 (3) (2004) [16] C. Chang, J. Hsao, C. Chan, Fndng optmal least-sgnfcant-bts substtuton n mage hdng by dynamc programmng strategy, Pattern Recognton 36 (7) (2003) [17] R. Wang, C. Ln, J. Ln, Image hdng by optmal LSB substtuton and genetc algorthm, Pattern Recognton 34 (3) (2001) [18] C. Chang, C. Chan, Y. Fan, Image hdng scheme wth modulus functon and dynamc programmng, Pattern Recognton 39 (6) (2006) [19] C. Then, J. Ln, A smple and hgh-hdng capacty method for hdng dgtbydgt data n mages based on modulus functon, Pattern Recognton 36 (12) (2003) [20] S.J. Wang, Steganography of capacty requred usng modulo operator for embeddng secret mage, Appled Mathematcs and Computaton 164 (1) (2005) [21] C. Then, J. Ln, An mage-sharng method wth user-frendly shadow mages, IEEE Transactons on Crcuts Systems (2003) [22] A.M. del Rey, J.P. Mateus, G.R. Sanchez, A secret sharng scheme based on cellular automata, Appled Mathematcs and Computaton 170 (2005) [23] G. Álvarez Marañón, L.H. Encnas, A.M. del Rey, Sharng secret color mages usng cellular automata wth memory, CoRR (2003). [24] A. Aho, J. Hopcroft, J. Ullman, The Desgn and Analyss of Computer Algorthms, Addson-Wesley, Readng, MA, [25] T. Toffol, N. Margolus, Invertble cellular automata: a revew, Physca D 45 (1990) [26] R. Alonso-Sanz, Reversble cellular automata wth memory: two dmensonal patterns from a sngle seed, Physca D 175 (2003) [27] C. Then, J. Ln, Secret mage sharng, Computer Graphcs 26 (5) (2002) About the Author ZIBA ESLAMI receved her B.S., M.S., and Ph.D. n Appled Mathematcs from Tehran Unversty n Iran. She receved her Ph.D. n From 1991 to 2000, she was a resdent researcher n the Insttute for Studes n Theoretcal Physcs and Mathematcs (IPM), Iran. Durng the academc years , she was a Post Doctoral Fellow n IPM. She served as a non-resdent researcher at IPM durng Currently, she s the Head of and a Professor n the Department of Computer Scences at Shahd Behesht Unversty n Iran. Her research nterests nclude desgn theory, combnatoral algorthms, cryptographc protocols, andsteganography. About the Author SEYYED HOSSEIN RAZZAGHI receved hs B.S. degree n Management Informaton System (MIS) n 2006 from Tabrz Unversty. He s currently an M.S. student of Computer Scence n Shahd Behesht Unversty, Tehran, Iran. About the Author JAMAL ZAREPOUR AHMADABADI receved hs B.S. degree n Management Informaton System (MIS) n 2006 from Yazd Unversty. He s currently an M.S. student of Computer Scence n Shahd Behesht Unversty, Tehran, Iran.