High-Capacity Reversible Data Hiding in Encrypted Images Based on 2D-HS Chaotic System and Full Bit-Plane Searching

Abstract

Using the local correlation of carrier images to embed secret data in MSBs is a popular scheme for reversible data hiding in encrypted images (RDHEI). However, most existing methods based on this scheme face challenges in achieving complete compression while ensuring security. In this study, an RDHEI method that uses a two-dimensional chaotic system and full bit-plane search (FBPS) is proposed. Specifically, the content owner provides cover images and employs a chaotic system to generate chaotic sequences for inter-block non-symmetrical permutation and intra-block diffusion. The special encryption method, combined with chaos, not only preserves the correlation of pixels within a block but also ensures an extremely high level of security. The FBPS technique is applied to detect all smooth bit planes, not limited to continuous MSBs. For data embedding, ‘0’ and ‘1’ are used to record all smooth and rough bit planes to achieve thorough compression. The results of the experiment show that our proposed method provides a high level of security and achieves 2.142 bit/pixel and 2.339 bit/pixel on the typical datasets BOSSbase (Break Our Steganographic System) and BOWS-2 (Break Our Watermarking System 2nd). Compared with the state-of-the-art methods, the embedding capacity has also been significantly improved.

1. Introduction

With the rapid development of symmetry cloud computing and cloud storage, more users are opting to store their data files in the cloud. Although this trend offers convenience, it also causes many privacy and security issues [1], especially in smart industry and smart healthcare, etc. [2], which are now covered in the 6G environment. Data hiding is a potential solution to address these issues by embedding private information into various types of carrier files (e.g., images). Nonetheless, embedding secret data can significantly distort the content of the carrier images, which is unacceptable for carrier images containing important information. In practical applications, such as medical, legal, and military applications [3,4,5], the carrier images contain important information or private data and cannot be destroyed. Therefore, reversible data hiding (RDH) has gained attention as a promising method for hiding data without compromising the content information of the carrier image [6].

As a hot topic in RDH, many RDH methods have been proposed to ensure the reversibility of cover images in data-hiding schemes [7,8,9,10,11,12,13,14,15,16]. At present, the techniques of these methods are primarily based on lossless compression [7,8,9], difference expansion [10,11], histogram shifting [12,13,14], and prediction-error expansion (PEE) [15,16]. Most of these algorithms rely on exploration of the spatial–symmetric correlation among local pixels in plain-text images to embed secret data, rendering them unsuitable for encrypted images because the pixels in encrypted images are diffused and lack a symmetric correlation with each other. Furthermore, the algorithms designed for plain-text images often fail to adequately protect the privacy of the carrier images. In many applications, carrier images must be encrypted in advance. Hence, RDH in encrypted images attracts significant attention as a potential approach for embedding secret data into encrypted images.

In general, there are three roles in RDHEI: content owner, data hider, and receiver. The content owner intends to encrypt image content to preserve privacy before uploading the image to the cloud. The data hider embeds secret data in encrypted images. For images with additional data, the receiver is able to extract error-free embedded data and recover encrypted images without any loss. With the constant exploration, many RDHEI schemes have been proposed [17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32]. For instance, Yu et al. [32] highlighted the importance of privacy protection for carrier images in RDHEI. They enhance security through no additional information transmission and embed data with a standard symmetric replacement operation.

RDHEI can be categorized into two frameworks: reserving room before encryption (RRBE) [17,18,19,20] and vacating room after encryption (VRAE) [21,22,23,24,25,26,27,28,29,30,31,32]. Figure 1 illustrates the general flow diagram of the RRBE and VRAE. RRBE-based methods preprocess the original image to reserve room before uploading it to the data hider, and then she/he can embed secret data into the processed image directly. In contrast, for VRAE methods, the content owner encrypts the original image, and the embedding operation is then performed on the data hider’s end. Compared to the VRAE methods, the RRBE methods perform the corresponding operation on the original plain-text image and thus have an advantage in terms of embedding rate (ER). However, the VRAE methods process the image after it has been encrypted and do not retain information about the image features before encryption. The result is that these methods causes a lower ER but can achieve a higher security level, which is essential for RDHEI.

A good RDHEI method is expected to trade-off among three performances, i.e., symmetric visual quality, ER, and safety, yet, as mentioned above, achieving a high-volume embedding rate in a more secure VRAE framework is challenging, and numerous attempts have been made by scholars to address this issue. Despite their proposed algorithms achieving good performance, there are still limitations to be addressed. For example, in terms of security, only ordinary sequences have been used to encrypt carrier images and secret data. Additionally, many researchers have focused solely on the compression of continuous most significant bits (MSBs) or least significant bits (LSBs) bit planes of carrier images while ignoring the smooth intermediate bit planes, leading to a significant waste of embedding space. Further research is needed to enhance the security and efficiency of RDHEI methods.

To address the aforementioned issues, this paper proposes a new RDHEI method based on a chaotic system and full bit-plane search. The main contributions of our work are summarized as follows:

(1)

A novel technique with all bit-plane exploration in RDHEI is proposed. In this way, all eight bit planes of the grayscale image will be explored, and all smooth planes will be recorded and compressed for data embedding so that we can achieve a higher embedding rate.

(2)

The proposed method uses a 2D-HS chaotic map to generate pseudo-random sequences with non-periodicity, unpredictability, and high sensitivity during the encryption phase, enhancing the security of both carrier images and secret data.

(3)

The performance of the proposed method has been validated through numerous experiments on two standard datasets. The results demonstrate that the proposed method provides a further step forward in embedding capacity and also achieves a higher level of security while guaranteeing full reversibility.

The rest of this paper is organized as follows. Section 2 reviews the related work of current popular RDHEI methods. Section 3 describes our proposed method in detail. Section 4 presents the experimental results and performance comparisons. Finally, the conclusions are drawn, and future work is proposed in Section 5.

2. Related Work

In recent years, to achieve a hider ER performance, many algorithms have begun to explore the characteristics of carrier images, expecting to be able to use the redundancy within the image to carry more private data. Two major methods exist for redundantly compressing and embedding information in carrier images: embedding in LSBs and embedding in MSBs.

2.1. Embedding in LSBs

One such method, first introduced by Zhang [21], encrypted the original image with a stream cipher and embedded secret data by substituting the LSBs of the encrypted pixels. A stream cipher is a symmetric encryption and does not require complex hardware to implement it; however, when the same starting state (seed) is used twice, the key stream must have a large period to ensure a certain level of security. Hong [22] employed a similar strategy but then divided the encrypted cover image into blocks. The three least significant bits of a half pixel in each block are inverted to embed secret data. The receiver can extract secret data and recover the image by using a fluctuation function. These methods may fail to extract secret data or recover carrier images correctly when the size of the image block is relatively small. To solve the above issues, many algorithms have been proposed in succession.

In [23], a distributed source coding technique is proposed to compress the last three bit planes, and then the last three bit planes are freed up and can be used to embed data. This method achieves a higher embedding rate in VRAE methods, but it is also limited when the embedding operation is only performed in the lower plane. Hussain et al. [24] used a combination of rightmost digit substitution and adaptive least significant bit to achieve an effective increase in the embedding capacity and, also, to obtain good visual symmetry. By using the binary-block embedding method, Yin [25] embedded the bits of the lower bit plane into the higher bit plane and then reserved space for secret data embedding.

The above-mentioned methods reflect an important issue in VRAE methods, which is that the embedding rate has more difficulty breaking through to higher levels because of the low redundancy in LSBs.

2.2. Embedding in MSBs

Puteaux and Puech [26] first proposed two symmetric RDHEI methods based on MSB prediction, namely CPE-HCRDH and EPE-HCRDH. In CPE-HCRDH, the original plain-text has been slightly modified to avoid prediction errors. The payload can reach 1 bit/pixel by replacing the MSB bit plane in the cipher-text image after encryption with the stream cipher of the ordinary sequence. In EPE-HCRDH, an error location binary map is created by analyzing the content of the original plain-text image and highlighting the prediction error in blocks of eight pixels. The prediction error location information is first stored in the encrypted image based on the error location binary map, and, thus, the payload can approach 1 bit/pixel by replacing most of the MSB bits in the encrypted image. To improve security, Li et al. [27] proposed an encryption method that combined block disruption and stream cipher. The combination of stream cipher and block disruption is an effective way to improve security over a single stream cipher encryption, but the pseudo-random series generated by the normal random function does not achieve satisfactory randomness. In terms of data embedding, by means of bit substitution, they embedded data in the prediction error image to increase the embedding capacity.

To explore more embeddable spaces, RDHEI with a high embedding rate based on pixel prediction and intra-block pixel difference has been proposed by Wu et al. [28]. They used the MED predictor to generate the predicted image and then subtracted the original image from the predicted image to obtain the difference image to obtain extra space. In this way, it is possible to extend the similarity of the MSB of pixels within the block, and, therefore, a higher embedding rate can be achieved. Liu et al. [29] proposed an RDHEI method based on a block-based adaptive MSB encoding technique. They first used a block-based image encryption method, including block permutation and pixel diffusion. Eight types of block codes are then formed depending on how many smooth surfaces there are in the successive MSBs. This method allowed for full compression of MSBs. In [30], the original image is divided into a block sized s×s and used a normal sequence to encrypt the cover image. Then, the RMR method is utilized to vacate room for secret data. In [31], the MED predictor is used to calculate the predicted value and then uses one bit to record the sign bit and the other bits to record the difference value.

Based on the strong correlation between local pixels, these algorithms are able to achieve complete compression of the continuous MSB of the pixels within the block. However, if only continuous MSBs or LSBs are concerned and other bit planes with the same redundancy properties after continuous interruptions are ignored, it is hard to achieve bit-level full compression. This paper presents an algorithm based on 2D chaotic encryption and proposes a full bit-plane exploration RDHEI method to improve the embedding capacity.

3. Proposed Method

In this paper, we design a data-hiding technique with a chaotic system and full bit-plane search. In the encryption phase, in order to ensure the security of carrier images and embedded data, nonlinear dynamics are utilized to construct a two-dimensional HS chaotic map to generate pseudo-random sequences. In the cover image preprocessing stage, the FBPS method is used to search smooth planes from MSB to LSB, which can detect all redundant space to fully compress the pixels within the block.

3.1. The 2D-HS Chaotic Map

Chaotic phenomena are deterministic random-like processes that occur in non-linear non-symmetric dynamic systems, characterized by non-periodic and irreversible behavior. These phenomena exhibit features such as initial value sensitivity, randomness, recurrence, and unpredictability, which significantly enhance the confidentiality of messages and make them particularly suitable for use in cryptography.

In this study, we introduce a two-dimensional chaotic map named 2D-HS, which is derived from Henon and Sine maps. While Henon and Sine maps exhibit simple behaviors and fragile chaotic intervals [33], the coupling of these two maps results in a new and quite improved chaotic map, defined as follows:

$$\left\{\begin{array}{c}{x}_{i+1}=sin\left(\pi a{y}_i\right)+sin\left(\pi \left(4(1-a)\left(1-x_i\right)\right)\right)+a\hfill \\ y_{i+1}=sin\left(\pi \left(x_i+y_i\right)\right)+sin\left(\pi \left(4(1-a)\left(1-y_i\right)\right)\right),\hfill \end{array}\right.$$

(1)

where a is a control parameter and $a ϵ [0,4]$.

Model of the 2D-HS Chaotic Map

The proposed 2D-HS is able to effectively generate pseudo-random sequences with improved chaotic properties. To demonstrate its excellent performance, we evaluate it with a bifurcation diagram, Lyapunov exponent, and phase diagram [34,35].

A. Bifurcation diagram

Bifurcation diagrams serve as a visual tool for the analysis of the performance of chaotic maps. Figure 2 presents the bifurcation diagram of the 2D-HS chaotic system with the parameter a. The diagram reveals that the system can attain a fully mapped state across a broad range of parameters within the interval [0, 2] so that the map can produce chaotic attractors throughout the entire range [0, 2]. This suggests that the 2D-HS chaotic system displays robust chaotic behavior.

B. Lyapunov exponent

The Lyapunov exponent (LE) is one of the indicators of superior chaotic properties of a dynamical system and provides a quantitative description of the initial sensitivity of a chaotic system. For a differentiable one-dimensional dynamical system, the LE can be defined as:

$$\lambda =\underset{n\to \infty }{lim}\frac{1}{n}\sum _{i=0}^{n-1}In\left|f^{\prime }\left(x_i\right)\right|.$$

(2)

In high-dimensional dynamical structures, there exists more than one Lyapunov exponent. The maximum LE value determines whether a high-dimensional map has chaotic properties. If a dynamical system has a positive maximum LE, it is chaotic. If multiple positive LEs are available for a dynamical map, the system behaves chaotically. High-dimensional chaotic maps typically display more complex and extensive dynamical properties than low-dimensional chaotic maps.

The Lyapunov diagram for the 2D-HS chaotic system is shown in Figure 3. Using Equation (2), by inputting the initial values $x_i$, $y_i$ (i = 1) of the two-dimensional chaotic mapping, two different LE values can be obtained after iteration. Then, as shown in Figure 3, two LE values for the 2D-HS can be clearly observed over a wide range. Only when a belongs to [0.84, 1.16], the system has one positive and one negative Lyapunov exponent. All Lyapunov exponents are greater than 0 when $a ϵ [0,0.84]$ and $a ϵ [1.16,4]$, indicating that the map is capable of generating chaotic factors.

C. Attractor phase diagram

Complex attractors that occupy a significant part of the phase diagram are usually contained by chaotic maps with excellent chaotic properties, and the attractor phase diagram of a high-quality chaotic system should be full of randomness and dispersion. In Figure 4, the initial conditions of the 2D-HS are $x=0.1$ and $y=0.2$, and the phase diagrams of the corresponding attractors are shown in Figure 4. When the parameters $a=1.4$ and $a=2$, the chaotic system produces attractors as depicted in Figure 4c,d. When $a=0.5$, the phase diagram is shown in Figure 4a. When $a=0.9$, the phase diagram also shows a random state, as shown in Figure 4b.

3.2. Full Bit-Plane Search

In this section, we propose a new pervasive RDHEI method, named FBPS, to exploit a high payload. To preserve the relevance within a block, apply a special block-level encryption method and then detect each of the eight-bit planes of the pixels within the block, recording all smooth bit planes whose value is 0 or 1, rather than simply a few consecutive front MSBs or a few consecutive LSBs. The framework of the FBPS is presented in Figure 5. Firstly, the content owner uses the cryptographic key ${\mathit{K}}_{\mathit{e}}$ to generate a chaotic sequence through the chaotic map. Block-based non-symmetrical permutation and diffusion operations are adopted to encrypt the original image by using the sequence. Then, upon receipt of the encrypted image by the data hider in the cloud, the image is divided into blocks, and the eight bit planes of each encrypted block are separated and detected one by one from the MSB to the LSB. The positions and initial values of all smooth planes are recorded so it can accomplish a more complete compression and embed more secret data after encryption with ${\mathit{K}}_{\mathit{d}}$. Finally, the receiver can recover the original image with ${\mathit{K}}_{\mathit{e}}$ and extract the secret data with ${\mathit{K}}_{\mathit{d}}$.

The following sections present the processes of image encryption, data embedding, data extraction, and image recovery in detail.

3.2.1. Image Encryption

In the image encryption phase, the content owner generates a chaotic sequence via the chaotic map described in Section 3.1. This sequence is then used to perform inter-block permutation and intra-block diffusion operations on the original plain-text image. Specifically, for the $M\times N$ sized original image, the content owner first divided it into n non-overlapped sized blocks $B_t(t=1,2,\dots ,n;n=(M\times N)/s^2)$ with raster-scanning order. Then, the original image blocks are permuted to generate the scrambled cipher image according to permutation key ${\mathit{K}}_{\mathit{e}\mathit{1}}$, which is composed of a pseudo-random chaotic sequence between 1 and $\mathit{n}$. Next, diffusion operations based on the pixels within a block are applied to change the pixel values. For each individual image block $\mathit{t}$, all pixel values within the block are to be converted to binary form by Equation (2).

$$P_{i,j,\lambda }^t=\lfloor \frac{P_{i,j}^t}{2^{8-\lambda }}\rfloor mod16,\lambda =1,2,\dots ,8,$$

(3)

where $\lambda$ represents the $\lambda$-th bit of the binary pixel, and (i, j) denotes the pixel’s coordinate in the block $\mathit{t}$. Then, a pseudo-random chaotic sequence ${\mathit{K}}_{\mathit{e}\mathit{2}}$ with a controlled range between [0, 255] is converted to the same binary form and performs a bitwise exclusive-or operation to change the pixels using Equation (3).

$$e_{i,j,\lambda }^t=K_{e2}^{\lambda ,t}\oplus P_{i,j,\lambda }^t.$$

(4)

With the completion of the pixel diffusion operation within the block, the encryption step of the carrier images is achieved. The inter-block scrambling and intra-block diffusion operations based on chaotic systems not only achieve high confidentiality but also preserve the pixel redundancy between blocks to facilitate an increased embedding capacity. The security tests on carrier images are given in Section 4.1.

3.2.2. Data Hiding

Upon receipt of the encrypted image E, the data hider should first use a data-hiding key ${\mathit{K}}_{\mathit{d}}$ to encrypt the secret data Ad to prevent the illegal detection. The data-hiding key ${\mathit{K}}_{\mathit{d}}$ consists of random binary bits with the same length as the secret data, and a bitwise exclusive-or operation is applied to encrypt each bit of secret data by ${\mathit{K}}_{\mathit{d}}$. Then, the data hider can divide E into an encrypted block sized $s\times s$. Subsequently, each block is traversed in order from top to bottom and left to right, and converts the current pixel in the block into a binary system. Within a block, the binary representation of all the pixels can generate eight bit planes $E_t^{\lambda }$, corresponding to the MSB ($E_8^{\lambda }$) and to the LSB ($E_1^{\lambda }$).

In general, pixels in local areas of the original image tend to have a strong symmetry correlation. After encryption, inter-block correlation is preserved, which results in the existence of continuous smooth features in the higher bit planes within the block. Additionally, smooth bit planes can also exist in the lower bit planes despite interruptions. Hence, all bit planes within a block will likely be the objects of exploration and compression.

In the proposed approach, all bit planes need to be taken into account for data embedding, and the MSB is used to record the index values of smooth and rough planes (‘1’ denotes smooth; ‘0’ denotes rough). Based on this premise, all blocks are classified into three types, as listed in

Table 1. Three block types and corresponding descriptions.

Block Types	Descriptions
T1	MSB is smooth
T2	MSB is not smooth, but another plane is smooth
T3	No plane is smooth

in our proposed scheme, and the block type is defined as T.

According to the classification rules in Table 1, all blocks of cipher-text images are scanned, which is different from the previous algorithms that used adaptive coding to record consecutive smooth planes.

In this paper, for pinpointing all smooth planes, ‘1’, ‘0’ are used as indices for the smooth and rough planes on a fixed number of bits. For T1, the MSB separated from the pixels in the block is the smooth plane. One bit of the MSB is kept unchanged as a reference bit, and the other bits are utilized as index bits to record the location of the smooth plane while reserving a reference bit in the other smooth plane. The remaining position is the compressible space for embedding data. Different from T1, if the block belongs to T2, the MSB is not a smooth bit plane, but there are smooth available bit planes in the remaining seven bit planes. In this case, AU1 is used for recording the bits in the MSB that will be replaced by the index bit. For T3, none of the eight bit planes are smooth. As a non-embeddable block, it is still necessary to mark the index with all ‘0’ in the MSB, and the bit values reserved in advance are recorded as AU2. AU1 and AU2 can be inserted into an encrypted block before secret data to enable the possibility of full reversibility. In order to have enough bits in the MSB to record the smoothness of the eight bit plane, there is a requirement for the block size. In this paper, the block size $s=4$ is the best choice. Figure 6 shows three types of blocks in Lena with the block size $s=4$. As can be observed in the block of T3, with all eight bit planes in grey, the bit planes are all rough and non-embeddable. Thus, ‘00000000’ is set in $E_t^8$ as a label. For T1 and T2, there are some smooth embeddable bit planes in the eight bit planes. Therefore, ‘0’ and ‘1’ are also used to record the location of the smooth bit planes. After retaining a reference value in each smooth bit plane, the remaining green positions are compressible space.

Specifically, to describe the compression and embedding process more vividly, an example in Figure 7 is given to demonstrate the details. This block has been divided into eight bit planes and can be classified into T1 because the MSBs are all ‘0’. The subsequent $E_7^{\lambda }$, $E_6^{\lambda }$, $E_5^{\lambda }$, and $E_3^{\lambda }$ bit planes are also smooth. Thus, the corresponding index of the eight planes is generated and puts them in the first eight positions in $E_8^{\lambda }$, where the yellow part represents the smooth plane, and the gray represents the rough plane. Then, the first bit value of the smooth bit plane is to be reserved as a reference value, and the remaining bits (white area) are vacating room for the secret data Ad, which are encrypted by the hiding key ${\mathit{K}}_{\mathit{d}}$. In Algorithm 1, the embedding details are described.

Algorithm 1 Data embedding in an encrypted block.

$\mathbf{Input}$: Encrypted image E, secret data Ad.

$\mathbf{Output}$: Embedded encrypted image E*.

1: Divide E into block $B_t$ which sized $4\times 4$;

2: Transform $B_t$ into the eight bit plane $E_t^i$ (i = 1, 2, 3, …, 8);

3: Determine which category the current $B_t$ belongs to (T1, T2, or T3);

4: $\mathbf{If}$ $B_t$ belongs to T1 $\mathbf{do}$;

5:    The marked bits $E_t^{i^{\prime }}$←$E_t^i$;

6: $\mathbf{Else}\mathbf{if}$ $B_t$ belongs to T2 $\mathbf{do}$;

7:    AU1←bits in the MSB;

8:    Marked bits $E_t^{i^{\prime }}$←$E_t^i$;

9: $\mathbf{Else}$ $\mathbf{do}$;

10:    AU2←bits in the MSB. Marked bits $E_t^{8^{\prime }}$←$E_t^8$;

11: end for if;

12:The marked E* is generated by reconstructing the bit planes $E_t^{i^{\prime }}$ = [$E_t^{8^{\prime }}$, $E_t^{7^{\prime }}$, …, $E_t^{1^{\prime }}$];

13: return E*.

Then, we can calculate the total number of bits occupied by AU1 and AU2 and the pure embedding rate as follows:

$${Total}_{-}AU=\mathrm{AU}1+\mathrm{AU}2=8\times \left(T_2+T_3\right),$$

(5)

$$E{R}_{rate}=\frac{{\sum }_{t=1}^{n}8\times s^2-{\mathit{Total}}_{-}\mathit{A}\mathit{U}}{M\times N},$$

(6)

where $T_2$, $T_3$ represent the number of blocks of type T2 and T3.

3.2.3. Data Extraction and Image Recovery

After receiving the embedded encrypted image E*, the receiver first divides E* into blocks of size $\mathit{s}$, traverses the blocks in turn, and converts them into eight bit planes. Then, the receiver can: (1) extract secret data with the data-hiding key ${\mathit{K}}_{\mathit{d}}$; (2) recover the cipher-text image to the original image using the decryption key ${\mathit{K}}_{\mathit{e}}$; or (3) execute (1) and (2) simultaneously if the receiver has both ${\mathit{K}}_{\mathit{d}}$ and ${\mathit{K}}_{\mathit{e}}$.

A. Data extraction

To extract secret data, the receiver must first divide E* into blocks and convert each image block into eight bit planes. Then, to obtain the location where the secret data starts to be embedded, all blocks are traversed to count the number of blocks in the three categories, and, from this, the value of $T_2$ and $T_3$ are calculated. Finally, according to the different block types, the following steps are performed to extract the secret data:

(1)

If the block belongs to T1 or T2, the index value is extracted in the MSB and then in the smooth bit plane, except for the reference bit; the rest is the secret information which needs to be extracted.

(2)

If the block belongs to T3, there are no bits necessary to extract in the current block.

After extracting all of the secret data, the data-hiding key ${\mathit{K}}_{\mathit{d}}$ is used to decrypt the data so that the receiver can obtain the original additional data.

B. Image decryption

If the receiver only holds the image encryption key ${\mathit{K}}_{\mathit{e}}$, which includes ${\mathit{K}}_{\mathit{e}\mathit{1}}$ and ${\mathit{K}}_{\mathit{e}\mathit{2}}$, the original image can be obtained by him or her. Firstly, T2 and T3 are obtained by converting the traversed block into a binary bit plane and then by extracting AU1 and AU2 and embedding them into index positions in the MSB by bit substitution. If there is a smooth bit plane in the current block, the reference pixel of the smooth bit plane is filled to the bit plane where it is located.

After processing all the blocks in this way, the encrypted image is obtained. Then, the block-based exclusive-or key ${\mathit{K}}_{\mathit{e}\mathit{2}}$ is used to recover the pixel value within the block, and block-based scrambling secret ${\mathit{K}}_{\mathit{e}\mathit{1}}$ is used to restore the order between blocks. Note that the final decrypted image will be identical to the original image due to full reversibility.

C. Image recovery

If the receiver has obtained both authoritizations to decrypt the image and to extract the secret data with ${\mathit{K}}_{\mathit{e}}$ and ${\mathit{K}}_{\mathit{d}}$, he/she can extract the embedded data without error by means of the data extraction operation in Step $\left(\mathbf{1}\right)$ and then recover the encrypted image without loss by following the image decryption operation in Step $\left(\mathbf{2}\right)$.

4. Experimental Results and Discussion

In this section, we conduct some experiments to prove the superior performance of our proposed method. Firstly, we analyze the security with different metrics in detail. Then, as shown in Figure 8, we use five common grayscale images to present the embedding rate of the proposed method. In addition, to further illustrate the universality of the proposed scheme, two typical datasets, BOSSbase [36] and BOWS-2 [37] (each of them containing 10,000 images) are used to show the excellent embedding performance of the proposed method. Based on the premise of high security, the embedding rate, which is expected to be as large as possible, is the key indicator. Additionally, SSIM (structural similarity) and MSE (mean square error) are also used to verify reversibility.

4.1. Security Analysis

The security of the RDHEI methods has attracted increasing attention from researchers in recent years [38]. In the previous subsection, we have experimentally demonstrated the effectiveness of chaotic formulas for generating pseudo-random sequences. Next, to further prove the high security of our proposed method, we analyze it from two aspects: (1) key sensitivity analysis; (2) corresponding histogram, information entropy, and PSNR (Peak signal-to-noise ratio).

The sensitivity of the secret key is an important evaluation indicator of the security of a cipher-text image. A small change in the key in encryption can result in a completely different cipher-text image. Moreover, in decryption, a small change in the decryption key can also produce a completely different decrypted image.

The results of the key sensitivity test are displayed in Figure 9. We have made a slight change in the initial parameter $x_0$ during the encryption process, As shown in Figure 9a–d, there is a huge difference between the two cipher-text images obtained. During the decryption process, a slight change in the initial parameters will also cause the decryption to fail, and the correct decrypted image cannot be obtained.

A histogram analysis of cipher-text images is the process of statistically and visually analyzing the distribution of pixel values in a cipher-text image. The histogram can provide important information about the distribution of pixel values in a cipher-text image. With a good encryption algorithm, the histogram of a cipher-text image should show a relatively uniform distribution. This means that the pixel values have a similar frequency or number throughout the range with no significant concentration or skewing.

Next, we utilize Lena as an example to show the distribution of pixels in the cover image at each phase of data hiding by means of a histogram.

Shown in Figure 10a1–d1 are the original image, the encrypted image, the embedded encrypted image, and the recovered image of Lena. Obviously, the encrypted images are all noise-like and completely non-identifiable so the contents of the original image are difficult to view directly. The images of a2–d2 and a3–d3 are the histogram and pixel distribution of a1–d1, respectively. It can be seen that the histogram and pixel value distribution of the original image have distinctive features, yet the corresponding histogram and pixel value distribution of the encrypted image have been homogenized. Therefore, it is difficult to steal the image information by analyzing the pixel value distribution of the encrypted image.

Furthermore, we use PSNR to measure the distortion of the encrypted image, and, as shown in

Table 2. PSNR (dB) and information entropy for different test images.

Images	PSNR between Original and Encrypted Image	Information Entropy
		Original Image	Encrypted Image	Embedded Image
Man	9.1782	7.1926	7.9984	7.9973
Airplane	8.1296	6.7025	7.9981	7.9915
Peppers	8.4239	7.5715	7.9987	7.9939
Lena	9.2569	7.4451	7.9983	7.9973
Baboon	9.5313	7.3579	7.9991	7.9775

, all PSNRs of the encrypted images do not exceed 10 dB, which means that the encrypted images are quite different from the original images. Information entropy is also used in Table 2 to estimate the randomness of the images in a different phase, and the value of the information entropy is calculated by Equation (6).

$$H\left(I\right)=\frac{1}{N}\sum _{i=1}^{N}p\left(m_i\right)log\frac{1}{p\left(m_i\right)}$$

(7)

In the case of low peak signal-to-noise ratios and high global information entropy, a highly random local entropy map can further indicate that the encryption algorithm introduces sufficient confusion and diffusion. The local entropy maps of the five test images and the cipher-text images, shown in Figure 11a1–e1, are natural carrier images, and the contours of their corresponding local entropy maps, Figure 11a2–e2, are clearly visible. Figure 11a3–e3, on the other hand, have no obvious repetitive patterns or regularities visible and do not show an obvious structure or recognizable patterns. This represents a uniform distribution of entropy values in the local entropy map across the entire image, further demonstrating the superior performance of the algorithm proposed in this paper.

4.2. Embedding Performance

After ensuring a robust level of security, the evaluation of the embedding rate becomes a crucial factor in determining the merit of the method.

Table 3. ER comparison with six different schemes.

Images Methods	Xu [14]	Li [27]	Yu [18]	Pun [29]	Yu [32]	Fu [7]	Ours
Lena	0.581	1.411	0.353	1.382	0.25	1.113	1.577
Baboon	0.225	0.513	0.113	0.493	0.24	0.37	0.518
Peppers	0.512	1.312	0.291	1.347	0.25	1.004	1.497
Airplane	0.594	1.294	0.634	1.584	0.25	1.286	1.979
Man	1.195	1.275	0.316	0.962	0.25	1.254	1.369

shows the ERs on the test images and compares them with six state-of-the-art methods.

In order to have a more visual perception, the dates in Table 3 are shown more directly in Figure 12 through a line graph. It can be seen that the proposed method can achieve a higher ER than all of the compared related methods.

In order to reduce the impact caused by the accidental selection of images, we use two classical datasets (BOSSbase and BOWS-2), which contain sufficient samples to test the performance of the proposed method. In

Table 4. The results of embedding rate on two datasets.

Datasets	max	min	Average
BOWS-2	6.142	0.141	2.179
BOSSbase	6.205	0.122	2.339

, we can see that the highest embedding rate reaches 6.205 bpp, and the average embedding rate is also at a very respectable level.

Furthermore, to clearly observe the advantages of our proposed method, we calculate the remaining smooth planes by removing the consecutive smooth planes. The results are shown in

Table 5. Ablation study of the FBRS on the five test images.

Test Images	The Benefits of FBPS
	Increased Smooth Bit-Plane	Only Successive Plane/b	Increased Number of Bits
Lena	+22	13,068	330
Baboon	+54	6346	960
Peppers	+82	13,730	1740
Airplane	+221	13,494	5295
Man	+24	11,864	360

. For different carrier images, continuous smooth bit planes account for most of the embeddable blocks, but there are still discontinuous smooth bit planes. For example, compared to the method of compressing only the front MSBs, there are an additional 82 blocks with excess embeddable space in the Peppers image, which adds a total of 1740 bits. This number is calculated without adding bits after the smooth interruptions added in T1. For different cover images, the added compressible space is even larger. So, after fully exploiting these discontinuous block bit planes, the number of embedding bits can be effectively increased.

The theoretical analysis and running-time measurements of the three stages of image encryption, data embedding, data extraction, and image recovery enable an objective verification of the practical advantages of the algorithms proposed in this paper. The comparison with the three existing classical algorithms is presented in

Table 6. Comparison of algorithm time complexity.

Algorithms	Running Time/s
	Image Encryption	Data Embedding	Data Extraction and Image Recovery
Qin et al. [1]	1.2352	8.7951	10.0573
Chen et al. [20]	0.9114	6.2647	7.4725
Liu et al. [29]	1.3149	8.4583	9.7549
proposed method	0.9011	4.3635	7.0287

.

As the running time in the image encryption process is only related to the number of blocks of the carrier images, the time complexity of this part is O(n). The message embedding phase contains chunking of the cipher-text image, bit-plane separation, and various message embedding operations. The complexity increases, reaching 4.3635 s in the average case. However, compared to the literature [1,20,29], there is still a significant advantage in terms of the time complexity. Finally, in the data extraction and image recovery phases, the running time is lower than the three typical algorithms, which means that the proposed algorithm also has a significant advantage in time performance.

5. Conclusions

This paper proposed a novel reversible data-hiding scheme in encrypted images that used a chaotic system and full bit-plane search technique. Through the combination of block-based encryption and chaotic sequences, a high level of security is achieved, and the correlation of pixels within the block is preserved. Moreover, by exploring the full bit plane, all smooth bit planes within the upper block are effectively utilized without being limited to consecutive MSBs, which results in a higher embedding capacity.

Currently, the FBPS method is able to achieve a large increase in the embedding capacity, but it is still limited by the distribution characteristics of the original pixels. For instance, adjacent pixels, such as 127:01111111 and 128:10000000, have a high redundancy yet cannot be utilized effectively. Therefore, in our future work, we plan to focus on transform correlation enhancement of the local intervals of carrier images so that neighboring pixels within a certain interval of difference values have more space for exploitation.