A Novel Reversible Data Hiding Method for 3D Model in Homomorphic Encryption Domain

Abstract

Reversible data hiding in the encrypted domain (RDH-ED) is a technique that protects the privacy of multimedia in the cloud service. In order to manage three-dimensional (3D) models, a novel RDH-ED based on prediction error expansion (PEE) is proposed. First, the homomorphic Paillier cryptosystem is utilized to encrypt the 3D model for transmission to the cloud. In the data hiding, a greedy algorithm is employed to classify vertices of 3D models into reference and embedded sets in order to increase the embedding capacity. The prediction value of the embedded vertex is computed by using the reference vertex, and then the module length of the prediction error is expanded to embed data. In the receiving side, the data extraction is symmetric to the data embedding, and the range of the module length is compared to extract the secret data. Meanwhile, the original 3D model can be recovered with the help of the reference vertex. The experimental results show that the proposed method can achieve greater embedding capacity compared with the existing RDH-ED methods.

1. Introduction

Since three-dimensional (3D) models can intuitively display stereoscopic information about the real world, there are potential scenes in many applications, such as human, architectural, organ models, etc. [1,2,3]. With the increasing popularity of cloud-based storage, users often store their 3D models in a third party; thus, they can conveniently access the data. To manage the uploaded 3D model, the cloud administrator may embed additional information for media notation, content verification, and so on [4,5]. Moreover, the cloud administrator is not required to change the 3D models permanently when embedding data [6]. Since reversible data hiding (RDH) can completely recover the original media after the secret data are extracted, the RDH method has received much attention from researchers.

The reversible data hiding (RDH) method can be classified into three types: lossless compression [7], difference expansion (DE) [8], and histogram shifting (HS) [9]. Using lossless compression-based RDH, Fridrich et al. compressed an original image to empty the space in order to embed data [7], but the corresponding embedding capacity was small due to the low compression. Using DE-based RDH, Tian expanded the difference between two adjacent pixels to embed data [8]. However, two adjacent pixels sometimes are not close when they are located at the edges, and this leads to high image distortion. Using the histogram shifting-based RDH, Ni et al. built a pixel histogram, and then used the peak to embed data [9]. The pixel histogram is often the mean distribution and the peak is not sharp, so that the embedding performance is not satisfactory. As an extension of DE, Thodi presented a prediction error expansion (PEE)-based RDH method [10], which is effective. In the following, many improvements are presented for the PEE-based RDH method, such as prediction accuracy, pairwise PEE, sorting, and so on [11,12,13].

The abovementioned RDH methods were designed for images and cannot be directly used for 3D models since the structures of the 3D model and the image are different. Dittmann et al. firstly presented an RDH method for authenticating a 3D model, wherein the concept of a distortion-free 3D model is introduced [14]. Wu et al. embedded secret data by modulating the distances between the face and the 3D model center, so that authentication can be obtained via extracting the data [15]. Moreover, the modulation information is stored in the Stego 3D model; thus, reversibility can be achieved. Jhou et al. selected the last few digits of the vertex coordinate value to embed data, and the original model can be perfectly recovered if it is intact [16]. Sun et al. and Lu et al. embedded data in a predictive vector quantization (PVQ) compressed domain by modifying the prediction mechanism during the compression process [17,18]. Wu et al. designed an RDH method based on DE, which modified differences between the adjacent vertex coordinates to embed data in order to keep the mesh topology unchanged [19]. Wu et al. predicted the vertex position by calculating the centroid of its traversed neighbors and then used PEE to embed data [20]. However, although their method has a large embedding capacity, the 3D model distortion is obvious. Jiang et al. built a three-dimensional prediction error histogram by using recursive construction coding due to the similarities between adjacent vertices, and they then modified the histogram to embed data [21]. Zhang et al. presented an RDH for 3D models based on hybrid prediction, which exploited vertex–vertex correlations to obtain high prediction accuracy to improve the data embedding performance [22].

In reality, before the media is transmitted into the cloud service, it will be encrypted in order to prohibit the cloud administrator from accessing the content of the 3D model [23]. Therefore, the RDH in the encrypted domain (RDH-ED) is more popular in real applications [24,25].

In this paper, an RDH-ED based on PEE is presented for managing the 3D model in the cloud service. Firstly, the user encrypts the 3D model by using the homomorphic Paillier cryptosystem for transmission to the cloud service. Secondly, for embedding data, a greedy algorithm is used to divide the vertices of the 3D model into reference and embedded sets in order to increase the embedding capacity. The reference vertex is employed to compute the prediction error for the embedded vertex, and the module length of the prediction error is expanded to embed data. In parallel with the data embedding, the data extraction in at the receiving end uses the range of the module length to be compared for extracting the secret data; meanwhile, the original 3D model is recovered by using the reference vertex completely. The experimental results show that the proposed method is superior to the existing method in relation to the embedding capacity. The main contributions of the paper are listed as follows.

• A greedy algorithm is employed to classify the vertex into the embedded set and the reference set to increase the embedding capacity.
• The module length of the prediction error is expanded to embed data in the encryption domain.
• The embedding capacity of the proposed method is superior to that of the existing RDH-ED methods.

The rest of this article is organized as follows. The Paillier cryptosystem is briefly introduced in Section 2. The proposed method is described in detail in Section 3. Section 4 presents the experimental results. Section 5 provides the conclusions.

2. Related Work

In this section, we introduce the encryption technique and review related RDH-ED methods. Commonly used encryption algorithms include stream bit encryption and Paillier encryption. Stream bit encryption uses a stream ciphertext to encrypt the image, which has low complexity and no pixel overflow [26]. Since homomorphic encryption can directly process data in the encryption domain and there is no need to decrypt the cipher-texts before operating them, the Paillier cryptosystem is more practical [27,28]. For example, Chen et al. encrypted an image through the Paillier cryptosystem and used the additive homomorphism of the Paillier encryption system to embed the secret data [29].

The RDH-ED method can be divided into two categories. The first category is reserving room before encryption (RRBE), in which the room for data embedding is created before encrypting the original image [30,31,32]. Zhang et al. embedded one bit into each encrypted image block by flipping three least significant bits (LSB), and the data were extracted through the texture evaluation [33]. On the basis of Zhang’s study, Hong et al. increased the embedding capacity by using a public key modulation mechanism [34]. However, in these two methods, the image needs to be decrypted before data extraction. Zhang compressed the LSBs of the encrypted image to provide embedding room, and they separated data extraction and image recovery [35]. Xiang et al. designed an RDH-ED method using the properties of the Paillier cryptosystem [36], where data can be extracted from the decrypted domain and the encrypted domain, respectively. In summary, the RRBE method requires a great deal of work before encryption, and reliable interaction with the cloud administrator must be established.

Compared with RRBE, vacating room after encryption (VRAE) as the second category is more practical [37,38]. Xiang et al. selected two pixels as a group for encryption, and data were embedded by shifting the histogram of the absolute difference between pairs of pixels [39]. However, the embedding capacity was insufficient. Xiong et al. embedded two bits into groups of three pixels to increase the embedding capacity [40]. However, these RDH-ED methods are designed for images; to date, only a few RDH-ED methods have been studied for 3D models. Jiang et al. proposed an RDH-ED based on stream bit encryption, and they embedded data by flipping several LSBs of vertex coordinates [41]. With the help of spatial correlation of the 3D model, the receiver extracted data by using the smooth function. Li et al. divided the 3D model into non-overlapping patches, and the vertex in each patch was encrypted using the Paillier cryptosystem [42]. In this method, three directions of each patch are computed to build the corresponding histogram for embedding data. However, each patch only can hold one bit, and the embedding capacity cannot be increased further. Moreover, the cipher mapping table should be transmitted to the receiver for data decryption. In order to increase the embedding capacity, Li et al. encrypted the 3D model using the Paillier cryptosystem and used the dyeing algorithm to classify vertices into the embedded set and the reference set for data embedding [43]. To embed more than one bit into the embedded vertex, each bit is mapped to the direction of the vertex, which should be recorded in a mapping table. However, after the dyeing algorithm, the number of embedded vertices is low, which affects the embedding capacity. Furthermore, the mapping table as the additional information should be transmitted for data extraction.

Finally, to better distinguish the proposed method from some related methods, some differences are listed in

Table 1. Differences among related RDH-ED methods.

	Jiang [41]	Li [42]	Li [43]	Proposed
Vertex Classification	Yes	No	Yes (Dyeing algorithm)	Yes (Greedy algorithm)
PEE	No	No	Yes (Angle)	Yes (Module length)
Embedded bits in one vertex	One	Less than one	More than one	More than one
Side information	Small	Huge	Huge	Small
Encryption	Stream bit encryption	Paillier	Paillier	Paillier

. Similar to Jiang’s [41] and Li’s [43] methods, the vertex is classified, but the proposed method uses a greedy algorithm to improve the embedding capacity. Similarly to Li’s [43] method, the proposed method uses PEE but expands the module length of the prediction error to embed data. Compared with Jiang’s [41] and Li’s [42] methods, the proposed method embeds more than one bit for one vertex. Moreover, the proposed method only transmits secret keys as the additional information for data extraction and uses the Paillier cryptosystem to encrypt the 3D model.

3. Background

The Paillier cryptosystem is an additive homomorphic encryption method [27] that is often used to process ciphertext in the encrypted domain. Its homomorphism shows that the ciphertext can be arithmetically operated after encryption and the operation result is consistent with the corresponding operation result in the plaintext field. The Paillier cryptosystem mainly includes key generation, encryption, and decryption, which are depicted here in detail.

Key generation is used to select two large primes, a₁ and a₂, randomly at first. Then, N = a₁ × a₂ and γ = f₁(a₁, a₂), where f₁(•) returns the smallest common multiple. Afterwards, we select an integer $g\in {\mathrm{Z}}_{N^2}^{*}$, where ${\mathrm{Z}}_{N^2}=\left\{0,1,2,\dots ,N^2-1\right\}$ and ${\mathrm{Z}}_{N^2}^{*}$ are the numbers in ${\mathrm{Z}}_{N^2}$, which are prime with N². Moreover, g satisfies:

$$f_2\left(f_3\left(\mathrm{mod}\left(g^{\gamma },N^2\right)\right)\right)=1,$$

(1)

where f₂(•) returns the greatest common divisor, mod(•) returns the remainder after division, and f₃(x) = (x − 1)/N. Finally, we obtain the public key (N,g) and the private key γ.

In the process of encryption, we select an integer $t\in {\mathrm{Z}}_{N^2}^{*}$ randomly, and the plaintext $s\in {\mathrm{Z}}_{N^2}$ is encrypted with the public key (N, g) using Equation (2):

$$c=\mathrm{En}\left(s,t\right)=\mathrm{mod}\left(g^s\times t^N,N^2\right),$$

(2)

where En(•) denotes the encryption function, and c is the ciphertext. Owing to the nature of the Paillier cryptosystem, it ensures the security of the ciphertext. Specifically, different ciphertexts are computed with different t for the same s, and, after decryption, different ciphertexts can be restored to the same s with the secret key γ:

$$s=\mathrm{De}\left(c\right)=\mathrm{mod}\left(\frac{f_3\left(\mathrm{mod}\left(c^{\gamma },N^2\right)\right)}{f_3\left(\mathrm{mod}\left(g^{\gamma },N^2\right)\right)},N\right),$$

(3)

where De(•) denotes the decryption function. In the following, homomorphism and homomorphic extension of subtraction are described for the Paillier cryptosystem. For the homomorphism, let two plaintexts be s₁ and s₂, respectively, and $\forall t_1,t_2\in {\mathrm{Z}}_{N^2}^{*}$. The two ciphertexts are computed as:

$$\begin{array}{c}{c}_1=\mathrm{En}\left(s_1,t_1\right),\\ c_2=\mathrm{En}\left(s_2,t_2\right).\end{array}$$

(4)

The original Paillier cryptosystem has addition homomorphism and multiplication homomorphism:

$$c_1\times c_2=\mathrm{En}\left(s_1,t_1\right)\times \mathrm{En}\left(s_2,t_2\right)=\mathrm{mod}\left(g^{s_1+s_2}\times {\left(t_1\times t_2\right)}^N,N^2\right),$$

(5)

$$\mathrm{De}\left(c_1\times c_2\right)=\mathrm{De}\left(\mathrm{mod}\left(\mathrm{En}\left(s_1,t_1\right)\times \mathrm{En}\left(s_2,t_2\right),N^2\right)\right)=\mathrm{mod}\left(m_1+m_2,N\right).$$

(6)

The subtraction homomorphism can be obtained through modular multiplication inverse (MMI). In order to compute s₁ − s₂ in the Paillier cryptosystem, first, the negative number –s₂ is represented by N–s₂. Then, the Euclidean technique is used to compute the ciphertext of N–s₂. Suppose that En(s₂)⁻¹ is the cipertext of N–m₂; thus, in the Paillier cryptosystem, s₁+(−s₂) is computed using $\mathrm{mod}(\mathrm{En}\left(s_1,t_1\right)\times \mathrm{En}{\left(s_2,t_2\right)}^{-1},N^2)$.

4. The Proposed Method

Using the Paillier cryptosystem, the 3D model is encrypted and then uploaded to the cloud service. In the cloud service, the corresponding administrator embeds data into the encrypted domain, as illustrated in Figure 1. First, the vertices are preprocessed for the Paillier cryptosystem, and then the greedy algorithm is used to classify the vertices into reference vertices and embedded vertices in order to increase the embedding capacity. Then, the prediction error is computed for each embedded vertex, and data are embedded using PEE. On the receiver side, the data can be extracted and the original 3D model can be restored by comparing the module length range of the prediction error, which is symmetric to the data embedding. In the following, the preprocessing, encryption, data embedding, and data extraction are depicted in detail.

4.1. Preprocessing and Encryption

Generally, uncompressed vertices of the 3D model are 32-bit floating point numbers. However, the Paillier cryptosystem requires positive integers for the input; thus, the vertex coordinates are required to be converted from the decimal to the positive integer.

The 3D model mainly consists of vertex data and face data. The vertex data include coordinates of each vertex, and the face data supply the topological information that reflects the connection between vertices. Let ${\left\{v_i\right\}}_{i=0}^{N_v}$ represent the sequence of vertices after scanning a 3D model, where N_v is the number of vertices and v_i = {v_i,x, v_i,y, v_i,z} as shown in

Table 2. File format of the 3D model.

Vertex List				Face Information
Index of Vertex	X-Axis	Y-Axis	Z-Axis	Index of Face	Elements in Each Face
1	v1,x	v1,y	v1,z	1	(2, 3, 1)
2	v2,x	v2,y	v2,z	2	(5, 1, 4)
3	v3,x	v3,y	v3,z	3	(3, 6, 7)
4	v4,x	v4,y	v4,z	4	(5, 2, 1)
5	v5,x	v5,y	v5,z	5	(3, 10, 7)
...	...	...	...	...	...

. Note that each coordinate of the vertex $\left|v_{i,j}\right|<1, j\in \left\{x,y,z\right\}$ and its significant digit is 6.

Since the 3D model can be accurately represented by the first four significant digits of the vertex coordinates, the vertex coordinates are converted into an integer with four significant digits by using the following formula:

$$v_{i,j}^{\prime }=\lfloor v_{i,j}\times {10}^4\rfloor .$$

(7)

Then, all coordinates of the vertices are changed to the positive integer:

$$v_{i,j}^{\prime }=v_{i,j}^{\prime }+{10}^4.$$

(8)

After preprocessing, v′_i,j is encrypted as

$$c_{i,j}=En\left(v_{i,j}^{\prime },t_{i,j}\right)=\mathrm{mod}\left(g^{v_{i,j}^{\prime }}\times t_{i,j}{}^N,N^2\right),$$

(9)

where t_i,j is a small random integer for v′_i,j, and it is less than N.

4.2. Processes of Data Hiding

After encryption, data are embedded to manage the encrypted 3D model. Firstly, the vertex is classified into the embedded vertex set and reference vertex set using the greedy algorithm. Then, the prediction error of the embedded vertex is calculated by using the reference vertex. Finally, the module length of the prediction error is expanded to embed the secret data in the encrypted domain.

When the 3D model is encrypted and uploaded to the cloud, the cloud administrator still can embed the secret data without knowing the original content. Some vertices are chosen to embed data and their adjacent vertices are unmodified as references for prediction. In the following, vertex classification, prediction error computation, data embedding, and the parameter d are described in detail.

4.2.1. Vertex Classification

First, the 1-ring neighborhood and 2-ring neighborhood of a vertex are defined. For two vertices v_i and v_p, where i,p ∈ {1,2,…,N_v}, if they are connected by an edge, v_i is an adjacent neighbor of v_p. All adjacent neighbors of v_i constitute the 1-ring neighborhood, and the neighbors of all 1-ring neighborhoods constitute its 2-ring neighborhood. Vertices are classified into the embedded set and the reference set, which are used for embedding data and predicting data, respectively. Specifically, one vertex in the embedded set is utilized to embed data, and its 1-ring neighborhood is not changed for prediction. Let the embedded set and the referenced set be Se and Sr, respectively. In order to increase the embedding capacity, the maximum of Se must be reached.

Vertices of Se are not connected each other, and if the graph is bipartite, the polynomial algorithm can identify the largest set of nonadjacent vertices. However, there are three loops in the 3D model and the patch structure of the 3D model cannot be represented by the bipartite graph. Thus, NP represents a significant challenge in obtaining the maximum value of Se in the 3D model, and the greedy algorithm is employed to obtain embedded vertices.

When a vertex is added to Se, the 1-ring neighborhood of this vertex is added to Sr. According to the local optimal solution of the greedy algorithm, the values of Sr and Se should be small and large, respectively, by selecting the vertex with the smallest number of the 1-ring neighborhood to be added to Se. The specific steps of vertex classification are listed as follows.

Step a-1. Compute the vertex number of the 1-ring neighborhood for all vertices in the 3D model; we define it as the degree of each vertex.

Step a-2. Suppose that k is the minimum of all degrees and choose vertices with the degree of k to form a set, denoted as V_k. For example, V₃ consists of vertices with the degree of 3.

Step a-3. One vertex of V_k is added to Se, and the 1-ring neighborhood of this vertex is added to Sr.

Step a-4. Remove this vertex and its 1-ring neighborhood from the 3D model, and the degrees of vertices in the 2-ring neighborhood are updated.

Step a-5. If all vertices of the 3D model are assigned to Se or Sr, the vertex classification is finished. Otherwise, return to Step a-2 until all vertices are assigned.

In order to describe the processes clearly, an example is illustrated in Figure 2. First, we scan v₁, v₂, …, v₁₀ and v₁₁ and compute their degrees. We obtain V₂ = {v₄, v₆, v₁₁}, Se = {v₄}, and Sr = {v₁,v₅}. We remove these vertices from the 3D model and update the degrees of corresponding vertices. At this time, the minimum degree is 1, V₁ = {v₂}, Se = {v₄} ∪ {v₂} = {v_4, v₂} and Sr = {v₁,v₅} ∪ {v₃} = {v₁,v₅,v₃}. We update the degrees of corresponding vertices after removing assigned vertices and then continue to classify the remaining vertices. Lastly, Se = {v_4, v_2, v_6, v_10, v₁₁} and Sr = {v_1, v_5, v_3, v_7, v_9, v₈}.

4.2.2. Prediction Error Computation

The 1-ring neighborhood is used to predict the current vertex in Se, and the prediction value of v′_i is computed as

$$\overline{v_i}=\frac{1}{N_i}{\sum }_{l=1}^{N_i}{v}_l^{\prime },$$

(10)

where v′_l is the 1-ring neighborhood vertex of v′_i from Sr, and N_i is the number of vertices in the 1-ring neighborhood. In the spatial domain, $\overline{v_i}$ is close to v′_i and the prediction error is computed as:

$$\Delta v_i=v_i^{\prime }-\overline{v_i}.$$

(11)

$\Delta v_i$ includes three directional values, and its module length is often small. Suppose that D is the maximum module length for all prediction errors, and $\left|\Delta v_i\right|$ satisfies:

$$\left|\Delta v_i\right|\in \left[0,D\right).$$

(12)

4.2.3. Data Embedding

Before data embedding, the secret data are divided evenly into several groups; suppose that w₀, w₁, …, w_n-1 are bits in each group, where n is the number of bits. The weight of each bit is computed as:

$${\mathrm{s}}_w={\sum }_{i=0}^{n-1}{w}_i\times 2^i,{\mathrm{s}}_w\in \left[0,2^n-1\right].$$

(13)

v′_i is modified to embed data:

$$v_i^{\prime \prime }=v_i^{\prime }+{\mathrm{s}}_w\times d\times \overrightarrow{b}=\left(v_{i,x}^{\prime }+{\mathrm{s}}_w\times d,v_{i,y}^{\prime }+{\mathrm{s}}_w\times d,v_{i,z}^{\prime }+{\mathrm{s}}_w\times d\right),$$

(14)

where d is the secret key for data embedding, $\overrightarrow{b}=\left(1,1,1\right)$, and the corresponding module length of $\Delta v_i$ is changed. In the encryption domain, data are embedded as:

$$c_{i,j}^{\prime }=c_{i,j}\times c_{s_w}=\mathrm{mod}\left(\mathrm{En}\left(v_{i,j}^{\prime },r_{i,j}\right)·\mathrm{En}\left(s_w\times d,r_{s_w}\right),N^2\right),$$

(15)

where $r_{s_w}$ is the random integer, and $c_{s_w}$ is the encrypted ciphertext of $s_w·d$.

After embedding data, the prediction error is modified as:

$$\Delta v_i^{\prime }=\Delta v_i+{\mathrm{s}}_w\times d\times \overrightarrow{b}.$$

(16)

When the directions of $\Delta v_i$ and $\overrightarrow{b}$ are the same, the module length $\left|\Delta v_i^{\prime }\right|$ is the maximum. If the directions of $\Delta v_i$ and $\overrightarrow{b}$ are opposite, $\left|\Delta v_i^{\prime }\right|$ is the minimum, which is

$$\{\begin{array}{c}{\left|\Delta v_i^{\prime }\right|}_{max}=s_w\times \sqrt{3}d+\left|\Delta v_i\right|,if \Delta v_i=\frac{\left|\Delta v_i\right|}{\sqrt{3}}\times \overrightarrow{b}\\ {\left|\Delta v_i^{\prime }\right|}_{min}=s_w\times \sqrt{3}d-\left|\Delta v_i\right|,if \Delta v_i=-\frac{\left|\Delta v_i\right|}{\sqrt{3}}\times \overrightarrow{b}\end{array}.$$

(17)

From Equation (17), it can be concluded that the value of $\left|\Delta v_i^{\prime }\right|$ is the range of $s_w\times \sqrt{3}d-\left|\Delta v_i^{\prime }\right|$ to $s_w\times \sqrt{3}d+\left|\Delta v_i^{\prime }\right|$.

4.2.4. Parameter d

In order to increase the correctness of data extraction, their ranges of module lengths should not be overlapped after embedding the secret data. After embedding s_w + 1, its minimum module length should be greater than the maximum module length after embedding s_w; that is,

$$\left(s_w+1\right)\times \sqrt{3}d-\left|\Delta v_i\right|\ge s_w\times \sqrt{3}d+\left|\Delta v_i\right|.$$

(18)

From Equation (18), we can obtain $d\ge 2\times \left|\Delta v_i\right|/\sqrt{3}$. If $d=2\times D/\sqrt{3}$. The ranges of module lengths are not overlapped for different s_w, and $\left|\Delta v_i^{\prime }\right|\in \left[0,\sqrt{3}d/2\right)$. After data embedding, the range of $\left|\Delta v_i^{\prime }\right|$ is defined as:

$$\begin{array}{c}\left|\Delta v_i^{\prime }\right|\in \left[\left(s_w-0.5\right)\times \sqrt{3}d,\left(s_w+0.5\right)\times \sqrt{3}d\right),if s_w\in \left[1,2^n-1\right]\\ \left|\Delta v_i^{\prime }\right|\in \left[0,\frac{\sqrt{3}}{2}d\right], if s_w=0\end{array}$$

(19)

Figure 3 shows the value of $\left|\Delta v_i^{\prime }\right|$ after ‘0’ or ‘1’ is embedded, and, obviously, the module length of embedding ‘1’ is greater than that of embedding ‘0’.

4.3. Data Extraction and Model Recovery

In the receiving side, when the Stego and encrypted 3D model is received, it can be decrypted via the private key γ. The decrypted vertex is computed as:

$$v_{i,j}^{″}=\mathrm{De}\left(c_{i,j}^{\prime }\right)=\mathrm{mod}\left(\frac{f_3\left(\mathrm{mod}\left(c_{i,j}^{\prime }{}^{\gamma },N^2\right)\right)}{f_3\left(\mathrm{mod}\left(g^{\gamma },N^2\right)\right)},N\right).$$

(20)

Since the coordinates of a few vertices are modified, the decrypted 3D model is similar to the original 3D model. After decryption, the data extraction and 3D model recovery are processed:

-

Step b-1. All vertices are classified into the embedded set and the reference set according to the greedy algorithm.

-

Step b-2. The prediction error $\Delta v_i^{\prime }$ of v_i″ is computed.

-

Step b-3. Equation (21) is used to obtain the range of s_w:

$$\frac{\left|\Delta v_i^{\prime }\right|}{\sqrt{3}d}-0.5<s_w<\frac{\left|\Delta v_i^{\prime }\right|}{\sqrt{3}d}+0.5.$$

(21)

From Equation (21), only one integer is in the range, and s_w can be extracted correctly. s_w is converted to the binary bits as:

$$w_i=\mathrm{mod}(\lfloor \frac{s_w}{2^i},2\rfloor ).$$

(22)

-

Step b-4. Via d and s_w, the original 3D model is recovered as:

$$v_i^{\prime }=v_i^{″}-{\mathrm{s}}_w\times d\times \overrightarrow{b}.$$

(23)

5. Experimental Results and Discussion

The experiments were implemented in MATLAB R2016b under Windows 7 Pro. To demonstrate the effectiveness of the proposed method, one hundred 3D models were used for testing, and six 3D models are illustrated in Figure 4.

The SNR was used to evaluate the quality of the Stego 3D model.

$$SNR=10\lg \frac{{\sum }_{i=1}^{N_v}\left({\left(v_{i,x}-\overline{v_x}\right)}^2+{\left(v_{i,y}-\overline{v_y}\right)}^2+{\left(v_{i,z}-\overline{v_z}\right)}^2\right)}{{\sum }_{i=1}^{N_v}\left({\left(g_{i,x}-v_{i,x}\right)}^2+{\left(g_{i,y}-v_{i,y}\right)}^2+{\left(g_{i,z}-v_{i,z}\right)}^2\right)},$$

(24)

where N_v is the number of vertices, v_i,x, v_i,y, and v_i,z are the vertex coordinates of the original 3D model, g_i,x, g_i,y, and g_i,z are the vertex coordinates of the Stego 3D model, and $\overline{v_x}$, $\overline{v_x}$, and $\overline{v_x}$ are the mean of v_i,x, v_i,y, and v_i,z, respectively.

Suppose that SNR_D is the SNR of the decrypted 3D model, and SNR_R is the SNR of the recovered 3D model. BER is used to evaluate the correctness of the data extraction. For the parameter D, we compute the maximum module lengths for the 3D models, and it is concluded that D < 250 [43].

5.1. Discussion of Parameters d and n

In order to show the feasibility of the proposed data hiding method, 1024 bits were embedded in the 3D models, and the data could be extracted completely. Taking ‘Solider’ as an example, the ‘solider’ encrypted using the Paillier cryptosystem cannot be recognized, as illustrated in Figure 5b. Without data extraction, the 3D model can be decrypted as illustrated in Figure 5d, and the decrypted 3D model is similar to the original 3D model. The 3D model can be recovered completely and data can be extracted without any error, as illustrated in Figure 5e,f, respectively.

The parameters d and n are related to the 3D model’s quality and the correctness of the data extraction. When d is low, BER is increased and the 3D model distortion is small, as illustrated in Figure 6a. If d is high, BER is decreased and the distortion of the 3D model is increased.

If n is large, s_w is large, and the embedding capacity and the corresponding model distortion are increased, as illustrated in Figure 6. For instance, when n = 1 and d = 110, the corresponding BER = 2.89%, SNR_D = 15.34 dB, and SNR_R = 33.89 dB. From the experiments, we can conclude that when d = 150 and n = 3, the model distortion is small and BER is small as well. Figure 7 shows the visual quality of the 3D models for different values of d when n = 3, and Figure 8 shows the visual quality of the decrypted 3D models for different values of n when d = 150. It was also found that the decrypted 3D model was similar to the original 3D model.

5.2. Vertex Classification Comparison

In order to show the effectiveness of the proposed method for classifying the vertex into the embedded set and the reference set using the greedy algorithm, Jiang’s [41] and Li’s methods were used for comparison, as shown in

Table 3. Comparisons of the vertex number in S_e.

3D Model	Nv	Proposed		Jiang [41]		Li [43]
		Se	Connected Vertex	Se	Connected Vertex	Se	Connected Vertex
Fairy	4252	1389	0	1356	312	1086	0
Boss	10,663	3412	0	3515	948	2498	0
Devil	27,872	8640	0	8357	2146	6944	0
Thing	110,812	34,905	0	35,820	9420	23,368	0
Lord	250,343	80,109	0	81,521	21,321	53,548	0

. In Jiang’s [41] method, the number of vertices in S_e is large, but some vertices are connected, which will lead to high BER of data extraction. The proposed method classifies the vertices more efficiently by using the greedy algorithm compared with Jiang’s [41] method since the number of connected vertices is 0. The number of vertices in S_e is greater than in Li’s [43] method, which indicates that the proposed method can embed more bits.

5.3. Performance Comparison

In order to show the effectiveness of the proposed method, Li’s [43] method was first used for comparison. We embedded one bit in each vertex, and, as shown in

Table 4. Performance comparison with Li’s [43] method.

	SNRD	SNRR	Embedding Capacity (.bpp)
Proposed	16.65	∞	0.324
Li’s [43]	15.24	∞	0.242

, the proposed method performed better than Li’s [43] in relation to the embedding capacity and the 3D model quality. This is mainly because the greedy algorithm for vertex classification is superior to the dyeing algorithm. This also shows that the proposed method successfully achieves low embedding capacity.

In

Table 5. Performance comparison with Jiang’s [41] and Li’s [42] methods.

	BER	SNRR	Embedding Capacity (.bpp)
Proposed (d = 150)	3.34%	34.14	0.972
Proposed (d = 289)	0	∞	0.972
Jiang [41]	4.22%	31.97	0.369
Li [42]	0	∞	0.396

, Jiang’s [41] and Li’s [42] methods are used for comparison. Compared with Jiang’s [41] method, the embedding capacity of the proposed method is nearly three times higher, at 0.972 bpp, as shown in Table 5. The corresponding BER is also lower than that of Jiang’s method and the quality is also higher. Compared with Li’s [42] method, although the image quality is slightly lower, the embedding capacity is still much higher. Moreover, when d is adjusted to 289, the image quality of the proposed method can be increased significantly. Thus, in summary, the proposed method is superior to the other two methods, with proven effectiveness.

6. Conclusions

In this paper, a reversible data hiding in encrypted domain (RDH-ED) based on prediction error expansion (PEE) has been presented. Before being sent to the cloud for storage, the 3D model is encrypted using the homomorphic Paillier cryptosystem so that the content cannot be accessed by the cloud administrator. In the cloud service, data are embedded into the encrypted domain for management of the 3D model. Specifically, the vertices of the 3D models are divided into embedded and reference sets using the greedy algorithm, and the maximum vertex number is obtained for the embedded set in order to increase the embedding capacity. The reference vertex is used to compute the prediction value of the embedded vertex, and the corresponding prediction error is calculated and expanded to embed data. On the receiving side, the secret data are extracted by comparing the module length of the prediction error, and the original 3D model can be reconstructed. The experimental results show that the proposed method is superior to the existing RDH-ED methods. However, when the embedding capacity is high, the visual quality is reduced significantly; we will attempt to resolve this in future studies.