Separable Reversible Data Hiding for Encrypted 3D Meshes Based on Self-Organized Blocking and Most Significant Bit Prediction

Abstract

As a booming technique that allows secret data extraction and information carrier recovery without any loss, reversible data hiding in different carriers has attracted more and more concerns in the field of information security. In this paper, a separable reversible data hiding technique for encrypted 3D meshes is proposed based on self-organized blocking and most significant bit (MSB) prediction. The content-owner traverses all faces of the mesh in the ascending index order. Through self-organized blocking, adjacent vertices are concentrated in different small sets. The central vertex is considered as the reference and the others as embedded vertices in each set. Then, multiple most significant bits between the central vertex and others are adaptively predicted and reserved as embeddable bits for secret data embedding. Because vertex coordinates in each set have a high space correlation and most vertices participate in the prediction process, a huge number of most significant bits can be marked as embeddable bits to embed secret data. Experimental results demonstrate that the proposed method can obtain the highest embedding rate compared with representative methods. To our best knowledge, the average embedding rate of the proposed method is about 28 bits per vertex (bpv) higher than the recently proposed method. Most importantly, instead of recovering meshes with higher quality, original meshes with high visual symmetry/quality can be recovered.

1. Introduction

With the improvement of cloud computing capabilities and cloud infrastructure service facilities, more and more information, including pictures, videos, and other data, tends to be stored in third-party cloud storage management platforms for easy viewing and access at any time, which brings serious privacy and security issues. Information transmitted through public channels is susceptible to malicious attacks. The data hiding technique [1,2,3,4,5,6], as a secure means of information protection, can imperceptibly record secret data, such as image and text, into different carriers. Thus, it can efficiently reduce the attention of eavesdroppers and avoid their damages. Consequently, this technique is increasingly favored by researchers and has been widely used in fields such as image integrity authentication [7], health care [8], privacy protection [9,10], data security [11], and 3D models [12,13]. Furthermore, because reversible data hiding in encrypted images (RDHEI) can approximately or accurately restore the original carrier under the premise of extracting secret information without errors, various related methods have been proposed in recent years [14,15]. Using an image as the carrier, based on their embedding strategies, the RDHEI methods can be classified into several categories, namely lossless compression [16,17], difference expansion [18,19], histogram shifting [20,21], and prediction error expansion [22,23]. According to the order in which the image encryption and spare room reservation processes are executed, the frameworks of RDHEI are mainly summarized into two categories, i.e., vacating room after encryption (VRAE) [24,25] and reserving room before encryption (RRBE) [26,27,28,29,30]. In VRAE methods, the secret information is directly embedded into the ciphertext with the help of spatial features of the encrypted image. Puech et al. [24] first proposed the VRAE concept. Through analyzing the local standard deviation of the marked encrypted image, the secret information is extracted during the image decryption process. Since the correlation between adjacent pixels of the original image is destroyed to varying degrees during the encryption process, the corresponding embedding capacity is usually limited. In contrast, the RRBE methods can achieve a higher payload. Because the space reservation is obtained before encryption, the correlation relationship of the original image can provide more redundant bits as embeddable rooms. Ma et al. [26] first embedded secret information into the least significant bits of the image before encryption, and the original least significant bits are considered as auxiliary data. As is pointed out in [31], the embedding capacity and visual symmetry/quality are complementary, which indicates that the quality of the recovered image is usually poor.

Nowadays, 3D models have become ubiquitous in our daily lives and are also widely used in the field of information security [32,33,34,35,36]. Jiang et al. [37] first proposed an encrypted domain-reversible data hiding algorithm for 3D models. In this method, floating-point coordinates are converted to their corresponding binary forms and encrypted by the aid of bit-stream. Secret information is embedded by flipping the least significant bit (LSB) of vertex coordinates. Experimental results indicated that the embedding rate of this method is low and the secret information cannot accurately be extracted. Shah et al. [38] proposed a two-layer reversible data hiding framework for end-to-end identity authentication and cloud data management, in which two properties of homomorphic cryptosystem are utilized. Although a higher embedding rate is obtained, this method is relatively complex and brings challenges to practical application. Tsai [39] designed a separable method based on spatial subdivision and spatial coding. Although the complexity of this method is not high, it suffers from a relatively low embedding rate and cannot achieve lossless recovery of the original model. Based on prediction error expansion, Li et al. [40] designed a coloring method to mark vertices as the embedded and reference set, and then embed the secret data by extending the direction vectors of prediction errors. A mapping table is used to obtain the direction vectors, which can map several bits to a direction vector. Using the homomorphic properties of Paillier cryptosystems, Van Rensburg et al. [41] proposed a two-tier method, where the secret data can be extracted in both encrypted and plaintext domains. Also, based on prediction error expansion, Luo et al. [42] used a greedy algorithm to divide vertices of 3D models into reference and embedded sets to improve the model’s embedding capacity. Utilizing the multi-MSB prediction, Yin et al. [43] first embedded the secret information into the most significant bits of vertex coordinates in the embedded set. Although the embedding rate is significantly improved and the original model can be recovered without any loss, the utilization rate of vertices in the model is somewhat low. To solve this problem, Lyu et al. [44] modified the vertex set classification by dividing the vertices into odd and even sets. Experimental results demonstrated a further improvement in the embedding rate using this method. Similar to Yin et al.’s method, Xu et al. [45] proposed an approach based on integer mapping and MSB prediction. Combined with the multi-MSB prediction, Hou et al. [46] divided the 3D model into non-overlapping sub-blocks using Octree subdivision, and the vertices of each sub-block were classified into the embedded and reference set. Gao et al. [47] suggested an adaptive vertex grouping strategy and improved the model’s embedding capacity through proper vertex grouping and data compression. Zhang et al. [48] introduced a multi-layer mesh synchronous method in the spatial domain, and used minimum distortion analysis to address the mesh asynchrony issue. Qu et al. [49] divided the original 3D mesh into non-overlapping rings where no vertex is possessed by two rings, where different rings do not share vertices, and the ring central vertex is considered as the reference vertex for multi-MSB prediction. Although a higher embedding capacity is obtained by compressing labels using canonical Huffman coding, due to an incomplete precision selection range, this method may fail to achieve lossless recovery for some models.

Although the methods based on most significant bit prediction have higher embedding capacities compared with the previous methods, there are still a larger number of vertices used as references, and their coordinates are wasted. For example, in Lyu et al.’s method [44], half of the vertices of the 3D mesh are divided into the embedded set based on the odd-even property of vertex indices, and the other half serve as the reference. In this way, only half of the vertex coordinates are explored to generate free rooms. In order to improve the embedding rate, it is necessary to consider reducing the number of reference vertices. Taking into account this principle, a separable reversible data hiding method for encrypted 3D meshes is proposed in this paper based on self-organized blocking and most significant bit prediction. Meanwhile, to enhance the security level, the vertex coordinates and secret data are encrypted using a stream cipher function. The main contributions are listed as follows:

• All vertices of a 3D mesh are classified into different small sets using self-organized blocking. In each set, only one vertex is used as the reference, and others are used to reserve free rooms. Thus, from a holistic perspective, this method can effectively reduce the number of reference vertices in the 3D mesh and obtain more free rooms from other vertices;
• All vertices in each set are adjacent to the central vertex. Between these vertices, high spatial correlation can be usually obtained. When the most significant bit prediction is applied, more high-order bits of x, y, and z coordinates in each set can be considered as embeddable bits;
• Only a small amount of auxiliary information is generated during the calculation process of obtaining free rooms. In each set, several high-order bits of x, y, and z coordinates of the second vertex are used to record this auxiliary information, while high-order bits of other vertices can be used as embeddable bits. Thus, the embedding rate can be improved further.

The rest of this paper is organized as follows. In Section 2, along with the self-organized blocking of 3D meshes, the proposed method based on most significant bit prediction is introduced in detail. In Section 3, a series of experiments are performed on meshes and the experimental results are analyzed. Finally, a brief conclusion is presented in Section 4.

2. Method Description

In this section, a new method for reversible data hiding in encrypted 3D mesh based on self-organization blocking and embedding in multiple most significant bits of each vertex is described in detail. As shown in Figure 1, there are five parts in the proposed framework, i.e., pre-processing, blocking and auxiliary information generation, 3D mesh model encryption, secret data embedding, and secret data extraction/mesh reconstruction. The content-owner converts the floating-point coordinates of each vertex to the corresponding integer format for a mesh model, and divides the vertices into different blocks in the way of self-organization. Based on the distribution of multiple most significant bits in each block, the redundant rooms of vertex coordinates are reserved while a small amount of auxiliary information is generated. The data-hider embeds the secret data in the reserved rooms of the encrypted mesh model. The receiver extracts the secret data and recovers the original content according to the connectivity between the various faces of the 3D mesh model. In Figure 1, $K_m$ is the mesh encryption key and $K_d$ is the secret data encryption key.

2.1. Preprocessing of Vertex Coordinates

For different application scenarios, a 3D mesh model can be recorded with various file formats (OFF, PLY, OBJ, VRML, etc.), and the index-based data structure is used to describe its content. As listed in

Table 1. 3D mesh model data structure.

Vertex Information					Face Information
Index of Vertex	x-Axis Coordinate	y-Axis Coordinate	z-Axis Coordinate	Coordinates Value	Index of Faces	Elements in Each Face
0	$v_{1,x}$	$v_{1,y}$	$v_{1,z}$	(0.262933, 0.102269, 0.138247)	0	(4, 14, 17)
1	$v_{2,x}$	$v_{2,y}$	$v_{2,z}$	(0.0843142, 0.0418575, −0.0419302)	1	(0, 15, 2)
2	$v_{3,x}$	$v_{3,y}$	$v_{3,z}$	(0.0676609, −0.0308717, 0.133371)	2	(5, 1, 16)
3	$v_{3,x}$	$v_{3,y}$	$v_{3,z}$	(0.0469116, −0.050008, 0.252355)	3	(3, 4, 5)
4	$v_{4,x}$	$v_{4,y}$	$v_{4,z}$	(0.0184431, 0.103867, −0.0063665)	4	(7, 1, 16)
5	$v_{5,x}$	$v_{5,y}$	$v_{5,z}$	(0.0998372, −0.193745, −0.16268)	…
…	…	…	…	…	10	(2, 4, 45)
14	$v_{14,x}$	$v_{14,y}$	$v_{14,z}$	(0.0111131, −0.104825, −0.14166)	…	…
15	$v_{15,x}$	$v_{15,y}$	$v_{15,z}$	(0.0178132, 0.0791963, −0.0112798)	32	(2, 3, 4)
16	$v_{16,x}$	$v_{16,y}$	$v_{16,y}$	(−0.061459, −0.0977343, −0.133353)	…	…
17	$v_{17,x}$	$v_{17,y}$	$v_{17,z}$	(0.0247783, −0.131539, 0.0722694)
…	…	…	…	…
45	$v_{45,x}$	$v_{45,y}$	$v_{45,z}$	(0.0847778, −0.432659, −0.0978527)
…	…	…	…	…

, a mesh model recorded in the OFF format consists of two types of information, i.e., geometric and topological data, where the mesh model is surrounded by triangular faces. The geometric data include the positions of vertices, and the topological data represent the connectivity between the various faces of the mesh model. Let ${\left\{v_i\right\}}_{i=0}^N$ denote the set of vertices, where $v_i=\left(v_{i,x},v_{i,y},v_{i,z}\right)$ represents a vertex and $N$ is the maximum index of the vertex, and ${\left\{f_n\right\}}_{n=0}^M$ denote the set of faces, where $f_j=\left(v_{i_1},v_{i_2},v_{i_3}\right)$ indicates that each face is constructed with three individual vertices and $M$ is the maximum index of the face.

In general, the x, y, and z coordinates of each vertex are typically represented as 32-bit floating-point numbers, and the number of significant digits is 6. Because operation on this level of precision is not necessary in most applications of 3D models, Deering [50] proposed a lossy vertex data compression method to avoid processing all bits of floating-point coordinates. In this method, the positions of vertex coordinates are normalized with an axis-aligned bounding box, and then uniformly quantized to the required precision. Specifically, as follows, if the truncation precision is set to $k$ bits, each coordinate $v_{i,j}\left(j\in \left\{x,y,z\right\}\right)$ is normalized to:

$$v_{i,j}^{\prime }=⌊v_{i,j}\times {10}^k⌋$$

(1)

where $k\in \left[1,33\right]$ and $⌊\cdot ⌋$ are the floor function. Thus, each coordinate is empirically expressed as an integer between 0 and $2^k-1$. Reversibly, the integer $v_{i,j}^{\prime }$ can be transformed to the original decimal coordinate as:

$$v_{i,j}=v_{i,j}^{\prime }/{10}^k$$

(2)

The coefficient $k$, representing the truncation precision, is an important factor to determine both the embedding capacity and model recovery performance. Also, it affects the bit length of vertex coordinates. The correspondence between the truncation precision and the bit-length can be summarized by:

$$l=\left\{\begin{array}{ll}8,& 1\le k\le 2\\ 16,& 3\le k\le 4\\ 32,& 5\le k\le 9\\ 64,& 10\le k\le 33\end{array}\right.$$

(3)

where $l$ denotes the bit-length of vertex coordinates. Further, the binary form of each vertex coordinate can be obtained as:

$$b_{i,j,u}=⌊v_{i,j}^{\prime }/2^u⌋\mathrm{mod}2,u=0,1\dots ,l-1$$

(4)

where $b_{i,j,u}$ represents the $u^{th}$ bit of the binary coordinate.

2.2. Blocking and Embeddable Room Generation

Basically, secret data are embedded into a 3D model by slightly changing vertex coordinates under the premise of retaining the topological structure of this mesh. In most previous methods, all of the vertices are divided into two sets in advance. One set is used to hide secret data where corresponding vertex coordinates are destroyed. The other is treated as the reference where vertex coordinates are retained. It can be intuitively concluded that a large number of vertices cannot afford redundant room to record secret data, which will inevitably reduce the embedding capacity of these methods. To solve this problem, in the proposed method, adjacent vertices in a mesh model are self-organized and partitioned into many small sets, and then redundant room can be obtained from almost all vertices in each set. Here, a small set also is called a block. As shown in Figure 2, a local region of the elephant model is depicted to illustrate the process of self-organized blocking, and the related data structure is listed in Table 1 in detail. The content-owner traverses all faces in the ascending index order. Two temporary sets represented as $S_b$ and $S_p$ are applied to record the allocated vertices of a block and all processed vertices of this mesh model, respectively. In the beginning, the first triangular face $f_0$ is traversed, and corresponding vertices are added into two temporary sets, namely $S_b=\left\{4,14,17\right\}$ and $S_p=\left\{4,14,17\right\}$. Thus, a block is initially constructed with three vertices, 4, 14, and 17, and these vertices are marked as processed. Meanwhile, vertex 4 is considered as the central vertex of this block. When the subsequent faces $f_1$ and $f_2$ are traversed, because vertex 4 is not included in the vertices of two triangles, no vertices are added into the two temporary sets. When $f_3$ is traversed, vertices 3 and 5 are added, that is, $S_b=\left\{4,14,17,3,5\right\}$ and $S_p=\left\{4,14,17,3,5\right\}$. Notably, in order to avoid adding a vertex into $S_b$ repeatedly, $S_p$ is checked to judge whether this vertex is already processed. For example, when $f_{32}$ is traversed, vertex 3 is already in $S_p$ and it will be ignored. Until all triangular faces are traversed, the block constructed with vertices 4, 14, 17, 3, 5, 2, and 45 is completely recognized. Next, $S_b$ is cleared and $S_p$ remains unchanged, and the above process is repeated to divide the remaining vertices. In this way, all vertices of the mesh model are partitioned into different blocks. Naturally, the number of vertices in a block differs between blocks.

The neighboring vertices in a block often belong to a local region, which are very close in space. The similarity of the x, y, and z coordinate of these vertices is relatively high. Therefore, the distribution of multiple most significant bits of vertex coordinates in each block can be efficiently explored to vacate redundant room for embedding the secret data. Take the recognized block constructed with vertices 4, 14, 17, 3, 5, 2, and 45 as an example. As shown in Figure 3, when the precision $k$ is set to 6, the x coordinates of all vertices are converted into 32-bit binary information using Equation (4). Each bit of x coordinates from the most significant bit to the least significant bit are compared to see if all corresponding bits are the same. Once bits in the same position are not equal, the comparison stops and a tag $\varphi$ is given to record the length of bits that are the same. In Figure 3, $\varphi$ is recorded as 15 since the 15 most significant bits of all x coordinates are the same. It is obvious that if the former $\varphi$ most significant bits of the first vertex remain unchanged, i.e., bits marked with a brown background as shown in Figure 3, corresponding bits of other vertices can be obtained by directly copying these bits. Of course, the tag $\varphi$, considered as auxiliary information, should be recorded and sent to the receiver for implementing data extraction and model recovery. In the proposed method, several most significant bits of the second vertex are required to record this tag value. The number of most significant bits required is related to the bit-length of the coordinates, which can be determined as:

$$l_m=\left\{\begin{array}{ll}3,& l=8\\ 4,& l=16\\ 5,& l=32\\ 6,& l=64\end{array}\right.$$

(5)

where $l_m$ is the number of bits required to record the tag value. The max tag value $2^{l_m}-1$ can be recorded in these bits. In Figure 3, the 5 most significant bits marked with a green background are used to record the tag value 15. Subsequently, whether x coordinates in a block are embeddable is determined. If $l_m$ is not larger than the tag value, x coordinates in this block are considered as embeddable, where redundant bits can be offered to embed secret data. As shown in Figure 3, the former 5 most significant bits of the second vertex are substituted with the tag value 15, i.e., “01111”, and 85 bits marked with a blue background can be vacated to embed secret data. Otherwise, x coordinates in this block are not embeddable, and all bits will remain unchanged.

When a positive floating-points coordinate is transformed using Equation (1), the former consecutive most significant bits of the integer coordinate are usually all 0. On the contrary, when a negative coordinate is processed, the former consecutive most significant bits are all 1. During the processes of data extraction and model recovery, the tag value is extracted from the former $l_m$ bits of the second x coordinate in a block. When these bits are all 1, two different results can be deduced. One is that the max tag value is obtained, which means that the former $2^{l_m}-1$ bits of all vertices are the same in this block. Another is that the tag value equals 0, which means that the former most significant bits of all vertices are different and the second x coordinate is negative. In this case, all bits of x coordinates in this block remain unchanged in the embedding process and no secret data are recorded in them. In order to solve this contradiction between two kinds of results, only the former $l-2$ bits of all the x coordinates in a block are compared to obtain the tag value. Thus, the max tag value $l-2$ may be recorded in the former $l_m$ bits of the second x coordinate. For example, when $l$ is 32 and $l_m$ is 5, the max tag value will be 30 instead of 31. In this way, when x coordinates in a block are embeddable and negative, the former $l_m$ most significant bits of the second vertex are not all 1, and erroneous judgment can be efficiently avoided.

The number of redundant rooms vacated from the y and z coordinates in a block can be calculated in the same way. In Figure 4, the tag value $\varphi$ is 14, and $l_m$ is 5 according to Equation (5). The y coordinates in this block are embeddable, and 79 bits marked with blue background are vacated to embed the secret data. Also, the former 5 most significant bits of the second vertex are substituted with the tag value, i.e., “01110”. In Figure 5, the tag value $\varphi$ is 0 and lower than 5, which means that the z coordinates in this block are not embeddable and no redundant bits can be offered. In this situation, all bits of z coordinates remain unchanged and the former 5 most significant bits of the second vertex are all 1. In the process of data extraction and model recovery, it is easily known that these z coordinates are not embeddable. Adding all redundant bits obtained from the x, y, and z coordinates, a total of 164 bits can be vacated in this block constructed with vertices 4, 14, 17, 3, 5, 2, and 45. After all blocks of the mesh model are checked, a larger number of embeddable rooms can be obtained, which will be used to embed secret data by the data-hider.

2.3. Mesh Model Encryption and Data Embedding

To enhance the security, after the original 3D mesh is divided into blocks and embeddable bits are reserved from each block, the vertices are encrypted with an encryption key $K_m$ in the beginning. Using Equation (4), the coordinates of the integer vertices are translated to the corresponding binary coordinates by the sender. Meanwhile, a pseudo-random integer sequence is generated with the encryption key and also converted to binary bits using Equation (4). Then, the bitwise exclusive-OR (XOR) calculation is applied between the bits of the 3D mesh and the randomly generated bits, which is mathematically expressed as:

$$e_{i,j,u}=b_{i,j,u}\oplus c_{i,j,u}, j\in \left\{x,y,z\right\}$$

(6)

where $c_{i,j,u}$ is a randomly generated bit, $e_{i,j,u}$ is the encrypted bit, and $\oplus$ represents the XOR operator. The integer coordinates of the encrypted mesh model can be obtained as:

$$v_{i,j,e}^{\prime }={\displaystyle \sum _{u=0}^{l-1}{e}_{i,j,u}\times 2^u}$$

(7)

where $v_{i,j,e}^{\prime }$ represents the integer form of each encrypted vertex. Finally, the encrypted decimal coordinates $v_{i,j,e}$ can be obtained using Equation (2). Notably, the former $l_m$ most significant bits of the x, y, and z coordinates of the second vertex in each block are not encrypted, because tag values generated in the reservation process of embeddable bits are recorded in these bits.

After the encryption is implemented for all blocks, the encrypted mesh composed of vertices $v_{i,j,e}^{\prime }$ is sent to the data-hider to hide secret data. Since the topological structure of the vertices remains unchanged, the encrypted mesh can be divided into blocks that are the same as those obtained in the reservation process of embeddable rooms. In each block, the x, y, and z coordinates of the first vertex remain unchanged. Tag values are first calculated from the former $l_m$ most significant bits of the x, y, and z coordinates of the second vertex, respectively. Based on $l_m$ and these tag values, the data-hider can know which bits in the second vertex are embeddable. For example, the tag value 15 is calculated from the former 5 bits of the x coordinate of the second vertex as shown in Figure 3, from which it is known that the remaining 10 bits in this coordinate are embeddable. The data-hider can embed 10 bits of secret data in them. Except for the first and second vertices, the embeddable bits of other vertices can also be concluded using tag values. In Figure 3, the former 15 bits of the x coordinate of the other vertices are embeddable. The data-hider can embed 75 bits of secret data in them.

Similarly, for y coordinates, as shown in Figure 4, the corresponding tag value is calculated as 14 using “01110”, which is retrieved from the second vertex. The data-hider can embed 9 bits of secret data in the remaining bits. The former 14 bits of the first vertex remain unchanged, while the former 14 bits of the other vertices are vacated. Thus, the data-hider can embed 70 bits of secret data in these vacated rooms. In Figure 5, the sequence composed of “11111” is retrieved from the former 5 bits of the second vertex, with which the data-hider easily knows that the z coordinates of this block cannot accommodate embeddable rooms. Therefore, the data-hider cannot embed any secret data in these z coordinates.

Before embedding, similar to the encryption of the 3D model mesh described in Equation (6), the secret data are first converted to the bit-stream, and then encrypted by the XOR calculation between this bit-stream and a pseudo-random bit sequence, which is generated using a data hiding key $K_d$. For the embeddable rooms in the second vertex, the encrypted secret coordinates are embedded as:

$$v_{i,j,e}^{″}={\displaystyle \sum _{s=l-l_m}^{l-1}\left(e_{i,j,e}\times 2^s\right)}+{\displaystyle \sum _{s=l-\varphi }^{l-l_m-1}\left(b_s\times 2^s\right)}+v_{i,j,e}^{\prime }\mathrm{mod}{2}^{l-\varphi -1}$$

(8)

where $v_{i,j,e}^{″}$ is the marked coordinate carrying the secret data, and $b_s$ is a bit of encrypted secret data. Obviously, only $\varphi -l_m$ bits are recorded in the coordinates of the second vertex. For other vertices in the block, the embedding is expressed as:

$$v_{i,j,e}^{″}={\displaystyle \sum _{s=l-\varphi }^{l-1}\left(b_s\times 2^s\right)}+v_{i,j,e}^{\prime }\mathrm{mod}{2}^{l-\varphi -1}$$

(9)

In this case, $\varphi$ bits are recorded in the coordinates of each vertex. Finally, the 3D modal composed of vertices $v_{i,j,e}^{″}$ is obtained as the marked encrypted mesh.

2.4. Data Extraction and Mesh Recovery

Based on the unchanged topological structure of the vertices, the marked encrypted 3D mesh composed of vertices $v_{i,j,e}^{″}$ is first self-organized and partitioned into small blocks by the receiver. These blocks are consistent with those processed by the data-hider. Also, auxiliary data (i.e., tag values) of the x, y, and z coordinates can be retrieved from the second vertex. Subsequently, whether the secret data are extracted and the original 3D mesh is recovered mainly depends on the different keys held by the receiver.

If only the data-hiding key $K_d$ is available, the encrypted secret data can be directly extracted from each block. Namely, if the auxiliary bits or the tag value of a block are not all 1 or 0, this block is embeddable, where the middle $\varphi -l_m$ bits of the x, y, and z coordinates of the second vertex and the $\varphi$ most significant bits of the other vertices are directly extracted. Using the data hiding key, the pseudo-random bit sequence used in the embedding process of the secret data is generated again. After the XOR calculation between this sequence and the extracted bits is executed, the original secret bits can be perfectly decrypted. Notably, the information of the original 3D model mesh is not revealed due to the absence of the encryption key.

If only the encryption key $K_m$ is available, although vertices $v_{i,j,e}^{″}$ in each block contain the bits of secret data, the corresponding original block can be recovered. Firstly, the pseudo-random bit sequence composed of $c_{i,j,u}$ is generated with the encryption key, which is the same as that used in the process to encrypt the original 3D model mesh. Performing the XOR calculation between this sequence and bits of the marked encrypted mesh, except for embeddable bits, the original bits of the integer coordinates of each block are recovered. Secondly, $\varphi$ bits are extracted from the former most significant bits of coordinates of the first vertex (i.e., the central vertex). For other vertices from the second to the last vertex in the block, because the $\varphi$ former bits of coordinates are the same as those of the first vertex, the extracted $\varphi$ bits can be directly copied to the former most significant bits of other vertices. Take the x coordinate of the block shown in Figure 3 as an example. The bits “000000000000001” are extracted from the first vertex, and the 15 former most significant bits of other vertices are obtained by directly copying these bits. Thus, each block with integer coordinates is completely recovered. Finally, the decimal coordinates of each original block are calculated using Equation (2). After all blocks are processed in the same way, the entire 3D mesh is recovered to the same state as the original one.

If both the data-hiding key and the encryption key are available, not only can the secret data be extracted without error but the 3D model mesh can also be perfectly recovered. The relevant processes are the same as the above descriptions. It is worth noting that the extraction of secret data should be performed before the recovery of the 3D model mesh. Otherwise, the encrypted secret bits embedded into the mesh are thoroughly destroyed, which will yield that the original secret data cannot be accurately recovered.

3. Experimental Results

To demonstrate the performance of the proposed method, our experimental results are analyzed from different aspects such as the embedding rate, geometric and visual quality of 3D model mesh, signal-to-noise ratio between the original and recovered meshes, and the Hausdorff distance. Also, the comparison experiments are performed between the proposed method and the state-of-the-art methods. To guarantee fairness and comparability, six 3D meshes, as shown in Figure 6, are used to evaluate the validity of the proposed method in the following experiments, and these model meshes are also commonly used for evaluating the state-of-the-art methods.

3.1. Analysis of Embedding Capacity

As an important metric to evaluate the ability of data accommodation of a method, the embedding rate (ER) is the ratio of the number of embedded bits to the number of vertices within a 3D model mesh, and is calculated as the number of bits per vertex. As expressed with Equation (3), the bit-length $l$ is mainly determined by the truncation precision $k$ used in the process of obtaining the integer vertex coordinates, and $l$ affects the embedding rate of 3D meshes seriously. Therefore, the influence of $k$ and $l$ on the embedding rate is basically analyzed. Using the meshes shown in Figure 6, when different $k$ and $l$ values are applied, the embedding capacities are calculated and listed in

Table 2. The embedding capacity of the test meshes for different $k$ values.

Bit Length $\mathit{l}$	8 Bits	16 Bits		32 Bits			64 Bits
$\mathit{k}$	2	3	4	5	6	7	10	11	12	13
beetle	6.04	16.78	10.28	35.43	28.71	21.96	66.10	59.28	52.39	45.91
pig	4.87	14.33	7.14	31.38	25.31	18.89	60.93	54.12	47.95	41.58
mushroom	1.15	10.24	2.64	25.77	20.13	14.11	52.05	46.50	40.50	34.27
cow	4.99	18.14	11.48	36.71	29.94	23.11	68.54	60.73	53.98	47.10
elephant	7.03	18.57	11.31	38.32	31.11	23.85	70.98	63.91	56.60	49.45
fandisk	5.19	15.96	9.95	33.05	26.90	20.64	61.05	54.91	48.69	42.44

. It is obvious that, for a fixed bit-length, the embedding capacity of each mesh decreases with an increase in the precision coefficient. Take the beetle as an example, when $l$ is 16 bits, the maximum embedding rate is 16.78 bpv as $k$ is 3. When $l$ is 32 bits, the maximum embedding rate is 35.43 bpv as $k$ is 5. As $k$ increases by 1 from 6 to 9, the maximum embedding rate gradually decreases. Similarly, when $l$ is 64 bits, the maximum embedding rate is 66.10 bpv as $k$ is 10, and the maximum embedding rate decreases when $k$ changes from 11 to 33. In the same time, for a fixed bit-length, the maximum embedding rates of all meshes can be obtained with the same precision. For example, when $l$ is 32 bits and $k$ is 5, the embedding rates of the six meshes are calculated as 35.43 bpv, 31.38 bpv, 25.77 bpv, 36.71 bpv, 38.32 bpv, and 33.05 bpv, respectively, all of which are higher than when $k$ is 6 or 7.

To illustrate the relationship between $k$ and the embedding rates of the six meshes, the curves between them are plotted and shown in Figure 7. It can be intuitively seen that, with increases in the precision coefficient, the embedding rate shows a fluctuating upward trend rather than a steady increase. For each mesh, the local maxima are obtained when $k$ is 3, 5, and 10. Also, these local maxima get larger and larger. Therefore, the result calculated when $k$ is 10 and $l$ is 64 bits is considered as the maximum embedding rate of each mesh in the proposed method. For a fixed bit-length, the local maximum of the embedding rate is always calculated with the first precision coefficient. This is mainly because the maximum number of the same most significant bits of the x, y, and z coordinates in a block is obtained. Still take the beetle as an example; when $k$ is 5 and $l$ is 32 bits, a total of 35,008 embeddable bits can be reserved. When $k$ is 6, 7, 8, and 9, only 28,368, 21,700, 15,103, and 6618 bits are vacated from the x, y, and z coordinates of this model mesh. In a word, as the precision coefficient increases for a fixed bit-length, the correlation between the most significant bits in each block of a model mesh will become worse and worse, which leads to a lower and lower embedding rate.

3.2. Geometric and Visual Quality

In the embedding process of secret data, the decimal x, y, and z coordinates of vertices are normalized to their corresponding integer forms using Equation (1). Although the difference between an original model mesh and its recovered mesh cannot be observed with the naked eye, it is inevitable that some geometric errors will be added to the recovered result. To quantitatively analyze these distortions of model restoration, two metrics are introduced. One is the Hausdorff distance to evaluate the similarity between the two sets of vertices, and another is the signal-to-noise ratio (SNR) to measure the geometrical distortion between the original and recovered model meshes. Suppose that $A=\left\{a_1,a_2,\dots ,a_q\right\}$ and $B=\left\{b_1,b_2,\dots ,b_p\right\}$ are two sets of vertices, the Hausdorff distance between them is mathematically defined as:

$$H(A,B)=max(h(A,B),h(B,A))$$

(10)

$$h(A,B)=\underset{a\in A}{max}\left\{\underset{b\in B}{min}‖a-b‖\right\}$$

(11)

$$h(B,A)=\underset{b\in B}{max}\left\{\underset{a\in A}{min}‖b-a‖\right\}$$

(12)

where $‖\cdot ‖$ is used to calculate the distance between a vertex $a$ and $b$ that belong to two sets, respectively. The SNR between two meshes, where there are $N$ vertices in each mesh, is mathematically defined as:

$$\mathrm{SNR}=10\times \lg {\displaystyle \frac{{\displaystyle {\sum }_{i=1}^N\left[{\left(v_{i,x}-{\overline{v}}_x\right)}^2+{\left(v_{i,y}-{\overline{v}}_y\right)}^2+{\left(v_{i,z}-{\overline{v}}_z\right)}^2\right]}}{{\displaystyle {\sum }_{i=1}^N\left[{\left(g_{i,x}-{\overline{v}}_x\right)}^2+{\left(g_{i,y}-{\overline{v}}_y\right)}^2+{\left(g_{i,z}-{\overline{v}}_z\right)}^2\right]}}}$$

(13)

where $v_i=\left(v_{i,x},v_{i,y},v_{i,z}\right)$ and $g_i=\left(g_{i,x},g_{i,y},g_{i,z}\right)$ are the coordinates belonging to two meshes, respectively, and $\overline{v}=\left({\overline{v}}_x,{\overline{v}}_y,{\overline{v}}_z\right)$ is the average of the first mesh coordinates.

As shown in Figure 8, the curves between the truncation precision $k$ and the Hausdorff distance are displayed for the six meshes. As is pointed out in [43], when $k$ is set to 1, the quality of the recovered meshes is very poor and there is no significance for practical applications. Therefore, the truncation precision $k$ varies from 2 to 19 to calculate the Hausdorff distance between the original meshes and recovered results. Obviously, for each mesh, its corresponding curve shows a rapid downward trend, which means that the quality of the recovered mesh becomes higher with the increase in the truncation precision. Especially, when $k$ is equal to 4, the Hausdorff distance is very close to 0, and it is difficult to discern the difference between an original mesh and its recovered result with the naked eye. As shown in Figure 9, the curves between the $k$ and SNR are displayed for the six model meshes. When $k$ is lower than 9, the geometrical distortion between the original and recovered model meshes is obvious. For example, when $k$ is equal to 9, the maximum SNR values for the beetle and elephant meshes are 214.22 and 222.07, respectively. However, all SNR values will tend to infinity when the truncation precision reaches 10. In other words, the six meshes can be completely recovered as the same as the original meshes when $k$ is larger than 9.

As shown in Figure 10, the visual effects at different stages including the encrypted mesh, marked encrypted mesh, and recovered mesh are displayed for the six meshes. Here, the truncation precision is set to 10, which means that all recovered meshes are the same as the original meshes. Obviously, no difference between an original mesh and its recovery can be perceived. This is also consistent with the experimental data results plotted in Figure 9. In order to verify the applicability of the proposed method, three PLY format meshes are selected from The Stanford 3D Scanning Repository to embed the secret data. These meshes are dense models consisting of at least tens of millions of triangles, which is a huge challenge to the performance of the proposed method. The corresponding visual effects are displayed in Figure 11. Obviously, the proposed method is effective for the secret data embedding of dense mesh models.

3.3. Performance Comparison

In order to more intuitively demonstrate the high performance of this model, a comparison between the proposed method and five state-of-the-art methods is executed form different aspects, including the embedding capacity, Hausdorff distance, SNR, and others. Among these representative methods, Jiang et al. [37] first proposed the reversible data-hiding algorithm and applied in encrypted 3D meshes. During the mesh recovery, the least significant bits of embedded vertex coordinates are predicted using the spatial correlation, which inevitably yields large error rate. Shah et al. [38] implemented end-to-end authentication using a two-layer reversible data-hiding framework in the encrypted domain of 3D meshes. These two methods are inseparable, i.e., the 3D mesh recovery and secret data extraction are executed simultaneously. Furthermore, Tsai [39] suggested a separable reversible data-hiding method using the spatial subdivision and space encoding of encrypted 3D models. To improve the embedding capacity, Yin et al. [43] divided all vertices of a 3D mesh into two sets, where one is used to as the embedded set and another is considered as the reference set. Through the most significant bit prediction, several most significant bits of vertex coordinates in the embedded set can be vacated to record secret information. Similarly, Lyu et al. [44] utilized most significant bit prediction to further free up more rooms from 3D meshes. Differently, all vertices of a mesh are divided into two sets based on the odd-even property of indices. The compared results show that the proposed method can improve the embedding rate extremely, since the most significant bits of more and more vertices in the block can be predicted to offer embeddable bits.

As shown in Figure 12, the comparison results of the embedding rates between the proposed method and the other five representative methods are presented. In Jiang et al.’s method [37], only 1-bit data are embedded by flipping the least significant bit of encrypted vertex, and not all vertices are used to embed data. No matter which 3D mesh is analyzed, the embedding rate of this method is in the 0.3~0.5 bpv range and less than 1 bpv. In Shah et al.’s method [38], each layer can contribute an embedding rate of 3 bpv. Therefore, the total embedding rate reaches 6 bpv for any mesh. In Tsai’s method [39], although the embedding rate is greatly improved, it is also fixed for any mesh and reaches 7.68 bpv. In Yin et al.’s method [43], all vertices of a 3D mesh are divided into two categories, which can guarantee that as many vertices as possible are assigned to the embedded set. Using the most significant bit prediction, more free space is obtained from most significant bits of the vertex coordinates. Compared with Yin et al.’s method [43], half of the vertices of a 3D mesh are divided into the embedded set in Lyu et al.’s method [44]. At the same time, the auxiliary data generated in the embedding process, i.e., the label list, are compressed using arithmetic coding to reduce the consumption of embeddable bits. Thus, this method can effectively improve the embedding rate. Similar to the methods of Yin et al. and Lyu et al. [43,44], the most significant bit prediction technique is also applied in the proposed method. Namely, embeddable bits are retrieved from the most significant bits of the vertex coordinates. Most importantly, in the proposed method, adjacent vertices of a 3D mesh are divided into small blocks using self-organized partitioning. In a block, all vertices except the central vertex are predicted. Also, the vertex coordinates in a block are highly correlated, where more identical most significant bits can be produced. Therefore, a huge number of redundant bits can be retrieved from a 3D mesh in the proposed method. As shown in Figure 12, it can be intuitively seen that the embedding rate obtained using the proposed method is at least twice that of Lyu et al.’s method [44]. Especially, for the mannequin model, the resulting embedding rate is more than three times that of Lyu et al.’s method [44]. In order to fully reflect the superior performance of the proposed method, a comparison of the average embedding rate on the dataset (Princeton Shape Retrieval and Analysis Group) with that of the other state-of-the-art methods is performed and the results are displayed in Figure 13. The recently proposed method, i.e., Gao et al.’s method [47], has the highest average embedding rate compared to the previous methods, reaching 41.35 bpv. However, the embedding rate of the proposed method is about 28 bpv higher than this method.

Table 3. Comparison between the proposed method and the state-of-the-art methods.

Test Meshes	Method	Embedding Rate (bpv)	Hausdorff $\mathbf{Distance}{10}^{-3}$	SNR	Error-Free in Secret Data Extraction	Separable
beetle	Jiang et al. [37]	0.35	9.9000	43.00	YES	NO
	Shah et al. [38]	6	0.0820	90.8471	NO	NO
	Yin et al. [43]	16.51	0.0086	96.20	NO	YES
	Lyu et al. [44]	23.55	0	125.00	NO	YES
	proposed method	66.10	0	∞	NO	YES
mannequin	Jiang et al. [37]	0.34	9.3000	52.47	YES	NO
	Shah et al. [38]	6	0.0728	100.0923	NO	NO
	Yin et al. [43]	13.66	0.0040	130.92	NO	YES
	Lyu et al. [44]	18.95	0	125.00	NO	YES
	proposed method	57.02	0	∞	NO	YES
mushroom	Jiang et al. [37]	0.45	10.1000	47.91	YES	NO
	Shah et al. [38]	6	0.0640	100.0923	NO	NO
	Yin et al. [43]	16.72	0.0081	102.25	NO	YES
	Lyu et al. [44]	21.76	0	125.00	NO	YES
	proposed method	52.05	0	∞	NO	YES
elephant	Jiang et al. [37]	0.34	0.1100	41.50	YES	NO
	Shah et al. [38]	6	0.0848	90.8037	NO	NO
	Yin et al. [43]	18.12	0.0086	95.97	NO	YES
	Lyu et al. [44]	27.96	0	125.00	NO	YES
	proposed method	70.98	0	∞	NO	YES

lists the comparison results between the proposed method and four state-of-the-art methods in terms of different features including the embedding rate, Hausdorff distance, SNR, error-free in secret data extraction, and separability. Firstly, Jiang et al. and Shah et al.’s methods are inseparable [37,38]. Compared with them, using other separable methods, not only higher embedding rates are obtained but also lower Hausdorff distances and higher SNR values are calculated. In addition, during the secret data extraction and mesh recovery process of Jiang et al.’s method [37], the smoothness function is used to evaluate the surface variation, and some deviations will yield to errors. Therefore, this method fails to achieve error-free data extraction and mesh recovery. On the contrary, other methods can achieve the accurate extraction of secret data and obtain the recovered mesh with higher quality. Most importantly, compared with the methods of Yin et al. and Lyu et al. [43,44], the proposed method has a Hausdorff distance equal to 0 and an infinite SNR under the premise of obtaining the maximum embedding rate, which indicates that a mesh can be recovered without errors. In addition, except for Jiang et al.’s method [37], the other methods are error-free in their secret data extraction.

4. Conclusions

In summary, a separable reversible data-hiding method for encrypted 3D models is proposed based on the self-organized blocking of meshes and multiple most significant bits prediction. Through self-organized blocking, neighbor vertices are divided into small sets, and vertex coordinates in a set have high correlation. Using multiple most significant bits prediction, more high-order bits of binary vertex coordinates can be reserved to embed secret data. In a set, the central vertex is considered as the reference, and the coordinates of other vertices are used to vacate embedding bits. In this way, most of the vertices in a mesh can participate in the calculation of freeing up embeddable bits. Therefore, compared with the state-of-the-art methods, this method can obtain the highest embedding rate. Meanwhile, instead of recovering meshes with higher quality, this method can effectively accomplish the goal of recovering meshes without errors. In general, the experimental results of this work can not only enrich the functionality of reversible data-hiding but also can serve as a reference for future research.