Secret Image Sharing Based on Encrypted Pixels Source:  IEEE Access. March, 2018. doi: 10.1109/ACCESS.2018.2811722. Authors: ZHILI ZHOU, CHING-NUNG YANG, (Senior Member, IEEE), YI CAO AND XINGMING SUN AND XINGMING SUN, (Senior Member) Speaker: LiLin (李琳) Date: 2019.05.09

Outline Related Work The perfect secret sharing The existing polynomial based secret image sharing The problems of the existing SIS (SIS: Secret Image Sharing) The proposed Scheme A secure (k, n)-SIS scheme A modified (k, n)-SIS scheme Proof Conclusions

Related Works -- The perfect secret sharing(1/3) Shamir[1] and Blakley[2] independently proposed the first secret sharing scheme in 1979. The embedding procedure: [1]. Shamir A. How to share a secret. Commun ACM 1979, Volume. 22, no. 11, pp. 612–613. [2]. Blakley G.R. Safeguarding cryptographic keys. Managing Requirements Knowledge, International Workshop on(AFIPS) 1979, pp. 313–317.

The extraction procedure: Related Works -- The perfect secret sharing(2/3) The extraction procedure: Using the Lagrange polynomial interpolation method

Related Works -- The perfect secret sharing(3/3) The perfect secret sharing is applied to secret image sharing(SIS): a0 = pix_value(i, j ) a0 = pix_value(i*, j* ) secret image Shadow size: secret image size

…… The sharing phase Related works --Polynomial based secret image sharing scheme(1/2) r pixels divided into section (1≤𝑗≤M×N/r) permuted image …… a permutation sequence (M×N/r)th SH1 SH2 SHn shadow size = 1/r×size of secret image The sharing phase

apply inverse-permutation operation to all the M×N/r Related works --Polynomial based secret image sharing scheme(2/2) coefficients a0-ar-1 r pixel values of the permuted image Lagrange’s interpolation block j ≥r shares apply inverse-permutation operation to all the M×N/r blocks …… SHn SH1 SH2 The revealing phase

The problem of the existing SIS(1/3) Partial secret pixels can be reconstructed from less than k shadows the threshold properties of those (k, n)-SIS schemes. Permutation only ciphers are insecure and correct permutation mapping can be recovered completely by a chosen-plaintext attack[3]. The permutation key for Thien and Lin’s (k, n)-SIS scheme can be easily obtain based on the fact that the permutation of pixels does not change histogram[4]. [3]. A. Jolfaei, X.-W. Wu, and V. Muthukkumarasamy, ‘‘On the security of permutation-only image encryption schemes,’’ IEEE Trans. Inf. Forensics Security, vol. 11, no. 2, pp. 235–246, Feb. 2016. [4]. C.-N. Yang, W.-J. Chang, S.-R. Cai, and C.-Y. Lin, “Secret image sharing without keeping permutation key.” in Proc. Int. Conf. Commun. Technol., 2014, pp. 410–416.

The problem of the existing SIS(2/3)

Example: The problem of the existing SIS(3/3) (1). For (3, n)-SIS scheme: Take three permutated secret pixels (a0, a1, a2) (over finite field GF(251) ) (2). For (4, n)-SIS scheme: All coefficients are used for embedding. The permutation is not secure enough. Finally, the partial pixels of a secret image will be reconstructed from k-1 shadows, and this compromises the threshold properties of those existing (k, n)-SIS scheme.

The proposed (k, n)-SIS scheme(1/5) Based on encrypted pixels Combines the perfect secret, the existing secret image and encryption Shadow size is the 1/k size of a secret image plus a short piece of key

Notation and description The proposed (k, n)-SIS scheme(2/5) Notation and description XTS-AES

Distribution: The proposed (k, n)-SIS scheme(3/5) K--> a0 every k encrypted pixels as (128-bit key for AES encryption) , F1 F2 Fn-1 Fn

…… Reconstruction: The proposed (k, n)-SIS scheme(4/5) S1 S2 Sk 𝐼 =𝐶 𝑆 𝑘,𝑛 −1 ( 𝐹 1 , 𝐹 2 ,..., 𝐹 𝑘

The proposed (k, n)-SIS scheme(5/5)

The modified (k, n)-SIS scheme(1/3) 128 super blocks Change one bit in SBi to let 128 blocks 128 blocks S1 S2 Sn-1 Sn 128 super blocks

The modified (k, n)-SIS scheme(2/3) for i = 1:128 { if XOR( ) = ki; continue; else { for j = 1: b = Changed_ LSB(Bi,j); if XOR( ) = ki; break; else undo_change; } }} The modified (k, n)-SIS scheme(2/3)

Proof: The modified (k, n)-SIS scheme(3/3) The probability of success is 1- (0.5)16*b , PSNR between I and : When b = 128( for a 512*512 size image) 1 – (0.5)16*128 = 1 – (0.5)16*128 ≈ 100% For small-size image, e.g. 64*32-pixel image Also divide it into 128 super blocks, each of which is 16 blocks For this case, b = 1 The probability is 1 – (0.5)16 = 99.998% Also can change two LSBs in a block, The probability is 100% PSNR between I and : 78.2dB

Conclusion Address the weakness that the threshold properties of existing (k, n)- SIS schemes are compromised. Propose a (k, n)-SIS scheme based on encrypted pixels. Propose a (k, n)-SIS with the same shadow size of Thien and Lin’s scheme. Computationally secure.

Thanks for your listening!