A $\left(k,n\right)$-Threshold Secret Image Sharing Scheme Based on a Non-Full Rank Linear Model

Abstract

Secret image sharing is a hot issue in the research field of data hiding schemes for digital images. This paper proposes a general $\left(k,n\right)$ threshold secret image sharing scheme, which distributes secret data into $n$ meaningful image shadows based on a non-full rank linear model. The image shadows are indistinguishable from their corresponding distinct cover images. Any $k$ combination of the $n$ shares can perfectly restore the secret data. In the proposed scheme, the integer parameters $\left(k,n\right)$, with $k\le n$, can be set arbitrarily to meet the application requirement. The experimental results demonstrate the applicability of the proposed general scheme. The embedding capacity, the visual quality of image shadows, and the security level are satisfactory.

1. Introduction

With the rapid development of portable devices and wireless communication, a huge amount of information is transmitted via the Internet in daily life. To protect the security of private information, encryption techniques are applied [1,2], which transform the private data into a meaningless ciphertext with a secret key. However, the meaningless ciphertext may arouse the eavesdropper’s suspicion. Researchers turn to develop some techniques which hide private data into meaningful media such as digital images or videos. The technique of embedding secret data in a digital cover image to produce a stego image is called image steganography. Conventional methods for image steganography include the least significant bits (LSB) substitution [3], the exploiting modifying direction (EMD) method [4], the difference expansion (DE) [5], the histogram shifting (HS) [6], and some other approaches [7,8]. The secret data are transmitted under the cover of a meaningful digital image, without attracting the eavesdropper’s suspicion.

The current image steganography techniques suffer from a problem that the stego images are vulnerable to tampering attack. Slight changes to a stego image may completely disrupt the decryption result. To improve the flexibility of decryption, in 1995, Naro and Shamir [9] proposed the visual secret sharing (VSS), also called visual cryptography, in which they encrypted a secret image into n shares and recovered the secret image through stacking not less than t shares. Later, many improved versions of visual secret sharing were proposed [10,11,12,13]. The main weakness of such schemes is the low quality of the restored secret image.

As a result, a series of secret image sharing schemes was proposed [14,15,16,17,18,19] that used mathematical computation to recover the secret image instead of stacking. A common approach is to apply the polynomial-based secret sharing scheme. In a (k, n) polynomial-based secret image sharing scheme, the dealer divides a pixel or a pixel block of the secret image into n shadows via a polynomial function. In such schemes, we can consider that the secret image is encrypted with polynomial-based secret sharing into n noise-like images. Due to the continuous feature of a polynomial, the reconstructed secret image is distorted by numerical errors.

Another series of secret image sharing schemes focusing on sharing secret into multiple image shadows were proposed [20,21,22]. The image shadows are indistinguishable from the cover images and the secret can be perfectly recovered. In 2007, Chang et al. [20] introduced the first version of such schemes. The secret message is transmitted through two meaningful image shadows, and it can be recovered only when both image shadows are obtained. Although these schemes distribute the secret data into multiple image shadows, all shadows are required in the secret extraction phase.

Some works on $\left(k,n\right)$-threshold secret image sharing have been proposed [23,24,25,26], in which the secret data can be completely recovered by no less than $k$ shares. However, shadow images are vulnerable to the steganalysis because they are generated based on the same cover image. Recently, some secret image sharing schemes using different meaningful cover images have been proposed [27,28]. In these methods, $\left(k,n\right)$ is a fixed pair of predefined constants.

The motivation of this research is to find a general secret image sharing scheme, in which parameters $\left(k,n\right)$ with $k<n$ can be arbitrarily chosen according to different application requirements, and the $n$ distinct cover images can be arbitrarily assigned too. We first present a $\left(k,n\right)$-threshold secret sharing scheme based on a non-full rank linear model. A secret segment of $k$ entries is used to generate a solution vector of $n$ entries. By using any combination of $k$ entries from the solution vector, the complete solution vector can be recovered and the secret segment can be restored.

Then, this scheme is applied to a digital image transmission system. In the first step, the secret data is divided into secret vectors too. Then, the solution vectors are generated in the same way as the proposed secret sharing scheme. To implement it on the image transmission system, each solution vector is further applied to modulate a vector constituted by pixel values collected from different cover images. In the final step, the resulting modulated vector is recorded to the image shadows. In the recovery phase, only a predefined number of shadows are required to restore the complete secret.

The remainder of this paper is organized as follows. In Section 2, we introduce the $\left(k,n\right)$ secret sharing scheme based on a non-full rank linear model. The proposed $\left(k,n\right)$-threshold secret image sharing scheme is described in Section 3. The experimental results and theoretic analysis are given in Section 4. Finally, we conclude this paper in Section 5.

2. $\left(k,n\right)$-Threshold Secret Sharing Scheme Based on Non-Full Rank Linear Model

In this section, we first discuss the solution of a non-full rank linear model over a finite integer field. Then, an application of recovering a solution vector with missing entries is introduced. Based on this mathematical model, we propose a generalized $\left(k,n\right)$-threshold secret sharing scheme based on a non-full rank linear model.

2.1. Non-Full Rank Linear Model over a Finite Integer Field

Assume $p$ is a prime number, $z_p$ is a field of integers modulo $p$; $n$ and $k$ are two positive integers with $n\ge k$. The equations ${\pi }_1,{\pi }_2,\cdots ,{\pi }_{n-k}$ are $\left(n-k\right)$ linearly independent equations of n variables over the field $z_p$, which are formulated as

$${\pi }_i: a_{i,1}{x}_1+a_{i,2}{x}_2+\cdots +\cdots a_{i,n}{x}_n=b_i \mathrm{mod} p, i=1,2,\cdots ,n-k.$$

(1)

Let

$$A=\left(\begin{array}{cc}\begin{array}{cc}\begin{array}{c}{a}_{1,1}\\ a_{2,1}\end{array}& \begin{array}{c}{a}_{1,2}\\ a_{2,2}\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\cdots \\ \cdots \end{array}& \begin{array}{c}{a}_{i,n }\\ a_{2,n }\end{array}\end{array}\\ \begin{array}{cc}\begin{array}{c} ⋮\\ a_{n-k,1}\end{array}& \begin{array}{c}⋮ \\ a_{n-k,2}\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\ddots \\ \cdots \end{array}& \begin{array}{c}⋮\\ a_{n-k,n}\end{array}\end{array}\end{array}\right),b=\left(\begin{array}{c}\begin{array}{c}{b}_1\\ b_2\end{array}\\ \begin{array}{c}⋮\\ b_{n-k}\end{array}\end{array}\right).$$

(2)

Then, the solution space of the $\left(n-k\right)$ linear equations Equation (1) is given by

$$H=\left\{x|x={\left(x_1,x_2,\cdots ,x_n\right)}^T,Ax=b \mathrm{mod} p\right\}.$$

(3)

This system of linear equations can also be written in matrix form as

$$\left(\begin{array}{cc}\begin{array}{cc}\begin{array}{c}{a}_{1,1}\\ a_{2,1}\end{array}& \begin{array}{c}{a}_{1,2}\\ a_{2,2}\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\cdots \\ \cdots \end{array}& \begin{array}{c}{a}_{i,n }\\ a_{2,n }\end{array}\end{array}\\ \begin{array}{cc}\begin{array}{c} ⋮\\ a_{n-k,1}\end{array}& \begin{array}{c}⋮ \\ a_{n-k,2}\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\ddots \\ \cdots \end{array}& \begin{array}{c}⋮\\ a_{n-k,n}\end{array}\end{array}\end{array}\right)\left(\begin{array}{c}\begin{array}{c}{x}_1\\ x_2\end{array}\\ \begin{array}{c}⋮\\ x_n\end{array}\end{array}\right)=\left(\begin{array}{c}\begin{array}{c}{b}_1\\ b_2\end{array}\\ \begin{array}{c}⋮\\ b_{n-k}\end{array}\end{array}\right)modp.$$

(4)

According to linear algebra, a system of $n$ linearly independent equations with$n$ variables $x={\left(x_1,x_2,\cdots ,x_n\right)}^T$, a unique solution vector $x$ can be determined. The current non-full rank $\left(n-k<n\right)$ system of linearly independent equations leads to a solution space of rank $n-\left(n-k\right)=k$.

We can manipulate the augmented matrix $\left(A|b\right)$ by using elementary row operations over field $z_p$ to obtain the simplest row form as

$$\left(\begin{array}{cc}\begin{array}{ccc}1& 0& \cdots \\ 0& 1& \cdots \\ \begin{array}{c}⋮\\ 0\end{array}& \begin{array}{c}⋮\\ 0\end{array}& \begin{array}{c}\ddots \\ \cdots \end{array}\end{array}& \begin{array}{cc}\begin{array}{c}0\\ 0\\ \begin{array}{c}⋮\\ 1\end{array}\end{array}& \begin{array}{ccc}{c}_{1,n-k+1}& \cdots & c_{1,n+1}\\ c_{2,n-k+1}& \cdots & c_{2,n+1}\\ \begin{array}{c}⋮\\ c_{n-k,n-k+1}\end{array}& \begin{array}{c}\ddots \\ \cdots \end{array}& \begin{array}{c}⋮\\ c_{n-k,n+1}\end{array}\end{array}\end{array}\end{array}\right).$$

(5)

Then, we obtain an equivalent system of linearly independent equations

$$\left\{\begin{array}{c}{x}_1=-c_{1,n-k+1}{x}_{n-k+1}-c_{1,n-k+2}{x}_{n-k+2}-\cdots -c_{1,n}{x}_n+c_{1,n+1} \mathrm{mod} p\\ \begin{array}{c}{x}_2=-c_{2,n-k+1}{x}_{n-k+1}-c_{2,n-k+2}{x}_{n-k+2}-\cdots -c_{2,n}{x}_n+c_{2,n+1} \mathrm{mod} p\\ ⋮\end{array}\\ x_{n-k}=-c_{n-k,n-k+1}{x}_{n-k+1}-c_{n-k,n-k+2}{x}_{n-k+2}-\cdots -c_{n-k,n}{x}_n+c_{n-k,n+1} \mathrm{mod} p\end{array}\right..$$

(6)

Let $\beta ={\left({\beta }_1,{\beta }_2,\dots ,{\beta }_{n-k},0,0,\cdots ,0\right)}^T$ be a particular solution for Equation (6). To solve the unknown entries, we substitute $\beta$ into Equation (6) and obtain

$$\left\{\begin{array}{c}{\beta }_1=c_{1,n+1} \\ \begin{array}{c}{\beta }_2=c_{2,n+1} \\ ⋮\end{array}\\ {\beta }_{n-k}=c_{n-k,n+1} \end{array}\right..$$

(7)

To solve a set of linearly independent homogeneous solutions of Equation (6), let the $k$ homogeneous solutions be

$$\left({\alpha }_1,{\alpha }_2,\cdots ,{\alpha }_k\right)=\left(\begin{array}{cc}\begin{array}{cc}\begin{array}{c}{\alpha }_{1,1}\\ {\alpha }_{1,2}\end{array}& \begin{array}{c}{\alpha }_{2,1}\\ {\alpha }_{2,1}\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\cdots \\ \cdots \end{array}& \begin{array}{c}{\alpha }_{k,1 }\\ {\alpha }_{\mathrm{k},2 }\end{array}\end{array}\\ \begin{array}{cc}\begin{array}{c} ⋮\\ {\alpha }_{1,n-k}\end{array}& \begin{array}{c}⋮ \\ {\alpha }_{2,n-k}\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\ddots \\ \cdots \end{array}& \begin{array}{c}⋮\\ {\alpha }_{k,n-k}\end{array}\end{array}\\ \begin{array}{cc}\begin{array}{c}1\\ 0\end{array}& \begin{array}{c}0\\ 1\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}\cdots \\ \cdots \end{array}& \begin{array}{c}0\\ 0\end{array}\end{array}\\ \begin{array}{cc}\begin{array}{c}⋮\\ 0\end{array}& \begin{array}{c}\ddots \\ 0\end{array}\end{array}& \begin{array}{cc}\begin{array}{c}⋮\\ \cdots \end{array}& \begin{array}{c}0\\ 1\end{array}\end{array}\end{array}\right).$$

(8)

To solve the unknown entries of each solution ${\alpha }_i$, we can substitute them into the homogeneous equation that corresponds to Equation (6) and obtain

$$\left\{\begin{array}{c}{\alpha }_{i,1}=-c_{1,n-k+j} \mathrm{mod} p\\ \begin{array}{c}{\alpha }_{i,2}=-c_{2,n-k+j} \mathrm{mod} p\\ ⋮\end{array}\\ {\alpha }_{i,n-k}=-c_{n-k,n-k+j} \mathrm{mod} p\end{array}\right.,i=1,2,\dots ,k.$$

(9)

The solution space $H$ can be defined by using the homogeneous and particular solutions as

$$H=\left\{x|x={{\displaystyle \sum }}_{i=1}^k{m}_i{\alpha }_i+\beta \mathrm{mod} p\right\}, \mathrm{where} m_i\in z_p.$$

(10)

Suppose a particular solution vector with missing entries $x^{\prime }={\left(x_1^{\prime },x_2^{\prime },\cdots ,x_k^{\prime }\right)}^T$ is given, where $\left(n-k\right)$ entries of a solution $x={\left(x_1,x_2,\cdots ,x_n\right)}^T\in H$ are missing. We can recover the missing entries by the following procedures.

Without the loss of generality, let us assume the available entries are the first $k$ entries. We first manipulate the original augmented matrix $\left(A|b\right)$ with elementary row operations into the following form

$$\left(\begin{array}{c}{h}_{1,1}\\ h_{2,1}\\ \begin{array}{c}⋮\\ h_{n-k,1}\end{array}\end{array} \begin{array}{c}\cdots \\ \cdots \\ \begin{array}{c}\ddots \\ \cdots \end{array}\end{array} \begin{array}{c}{h}_{1,k}\\ h_{2,k}\\ \begin{array}{c}⋮\\ h_{n-k,k}\end{array}\end{array} \begin{array}{c}1\\ 0\\ \begin{array}{c}⋮\\ 0\end{array}\end{array} \begin{array}{c}0\\ 1\\ \begin{array}{c}⋮\\ 0\end{array}\end{array} \begin{array}{c}\cdots \\ \cdots \\ \begin{array}{c}\ddots \\ \cdots \end{array}\end{array} \begin{array}{c}0\\ 0\\ \begin{array}{c}⋮\\ 1\end{array}\end{array} \begin{array}{c}{h}_{1,n+1}\\ h_{2,n+1}\\ \begin{array}{c}⋮\\ h_{n-k,n+1}\end{array}\end{array}\right).$$

(11)

Then, the missing entries can be obtained by

$$\left\{\begin{array}{c}{x}_{k+1}=-h_{1,1}{x}_1-h_{1,2}{x}_2-\cdots -h_{1,k}{x}_k+h_{1,n+1} \mathrm{mod} p\\ \begin{array}{c}{x}_{k+2}=-h_{2,1}{x}_1-h_{2,2}{x}_2-\cdots -h_{2,k}{x}_k+h_{2,n+1} \mathrm{mod} p\\ ⋮\end{array}\\ x_n=-h_{n,1}{x}_1-h_{n,2}{x}_2-\cdots -h_{n,k}{x}_k+h_{n,n+1} \mathrm{mod} p\end{array}\right..$$

(12)

Each solution vector can be represented as

$$x=m_1{\alpha }_1+m_2{\alpha }_2+\cdots +m_k{\alpha }_k+\beta \mathrm{mod} p.$$

(13)

By substituting the obtained particular and homogeneous solutions into Equation (13), we can get

$$\left(\begin{array}{c}\begin{array}{c}{x}_1\\ x_2\end{array}\\ \begin{array}{c}⋮\\ x_{n-k}\end{array}\\ \begin{array}{c}⋮\\ ⋮\end{array}\\ \begin{array}{c}⋮\\ x_n\end{array}\end{array}\right)=m_1\left(\begin{array}{c}\begin{array}{c}{\alpha }_{1,1}\\ {\alpha }_{1,2}\end{array}\\ \begin{array}{c}⋮\\ {\alpha }_{1,n-k}\end{array}\\ \begin{array}{c}1\\ 0\end{array}\\ \begin{array}{c}⋮\\ 0\end{array}\end{array}\right)+m_2\left(\begin{array}{c}\begin{array}{c}{\alpha }_{2,1}\\ {\alpha }_{2,2}\end{array}\\ \begin{array}{c}⋮\\ {\alpha }_{2,n-k}\end{array}\\ \begin{array}{c}0\\ 1\end{array}\\ \begin{array}{c}⋮\\ 0\end{array}\end{array}\right)+\cdots +m_k\left(\begin{array}{c}\begin{array}{c}{\alpha }_{k,1}\\ {\alpha }_{k,2}\end{array}\\ \begin{array}{c}⋮\\ {\alpha }_{k,n-k}\end{array}\\ \begin{array}{c}0\\ 0\end{array}\\ \begin{array}{c}⋮\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}\begin{array}{c}{\beta }_1\\ {\beta }_2\end{array}\\ \begin{array}{c}⋮\\ {\beta }_{n-k}\end{array}\\ \begin{array}{c}0\\ 0\end{array}\\ \begin{array}{c}⋮\\ 0\end{array}\end{array}\right)modp.$$

(14)

By expanding the last $k$ rows, we can also get the coefficients of the given vector $x^{\prime }$.

$$\left\{\begin{array}{c}{m}_1=x_{n-k+1}\\ \begin{array}{c}{m}_2=x_{n-k+2}\\ ⋮\end{array}\\ m_k=x_n\end{array}.\right.$$

(15)

From the above analysis, Equations (5)–(7) give the solution steps to obtain a particular solution, and Equations (8) and (9) give the solution steps to obtain a set of linearly independent homogeneous solutions. Thus, any solution vector of the given $\left(n-k\right)$ linearly independent equations of n variables can be represented with a linear combination of homogeneous and particular solutions as Equation (10). In addition, Equations (11) and (12) give the solution steps to recover the missing $\left(n-k\right)$ entries of a solution vector from $k$ available entries; Equations (13)–(15) give a one-to-one mapping between a solution vector and the coefficients of the linear combination. Based on this model, suppose coefficients $\left(m_1,m_2,\cdots ,m_k\right)$ are the secret, we can produce a vector ${\left(x_1,x_2,\cdots ,x_n\right)}^T$, which includes $n$ secret shares, using Equation (13). When $k$ shares among $n$ are available, we can restore the remaining shares and calculate the secret from the restored complete set of shares.

2.2. $\left(k,n\right)$. -Threshold Secret Sharing Scheme Based on the Non-Full Rank Linear Model

A general scheme for $\left(k,n\right)$ threshold secret sharing based on a non-full rank linear model is proposed in this section. It is divided into three phases: the setup, the share generation, and the secret extraction with authentication.

2.2.1. Setup

The scenario is that a dealer embeds secret data S into n shares $X_1,X_2,\cdots ,X_n$ and distributes them to n participants. To recover secret data, at least k participants should cooperate by providing their shares. The dealer first selects $\left(n-k\right)$ linearly independent equations with $n$ variables over the field $z_p$ as

$${\pi }_i: a_{i,1}{x}_1+a_{i,2}{x}_2+\cdots +\cdots a_{i,n}{x}_n=b_i \mathrm{mod} p, i=1,2,\cdots ,n-k.$$

(16)

Then, a set of linearly independent homogeneous solutions $\left\{{\alpha }_1,{\alpha }_2,\cdots ,{\alpha }_k\right\}$ and a particular solution $\beta$ can be obtained by applying Equations (5)–(9).

2.2.2. Share Generation

The secret data S to be shared is divided into $l$ secret segments of k entries denoted by $m_j=\left(m_{j,1},m_{j,2},\cdots ,m_{j,k}\right)$, where $m_{j,r}\left(1\le r\le k\right)\in z_p, 1\le j\le l$. For each secret message segment $m_j$, a solution vector $x_j$ can be generated by

$$x_j=F\left(m_j\right)=(m_{j,1}+{\gamma }_{j,1}){\alpha }_1+(m_{j,2}+{\gamma }_{j,2}){\alpha }_2+\cdots +\left(m_{j,k}+{\gamma }_{j,k}\right){\alpha }_k+\beta \mathrm{mod} p,$$

(17)

where ${\gamma }_{j,r}\left(1\le r\le k\right)$ is a series of integers over $z_p$ generated by a pre-shared data hiding key. This integer series encrypt each secret entry by adding a random offset. By rearranging the collection of synthesized vectors $x_j$ ($1\le j\le l$), the dealer generates $n$ secret shares as

$$X_i={\left(x_1\left(i\right), x_2\left(i\right),\cdots ,x_l\left(i\right)\right)}^T,1\le i\le n,$$

(18)

where $x_j\left(i\right)$ denotes the $i$-th entry of the $j$-th synthesized vector $x_j$. Finally, these shares are distributed to the $n$ participants.

2.2.3. Secret Extraction with Authentication

Suppose k faithful participants provide their shares as $X_1,X_2,\cdots ,X_k$. The combiner first rearranges the k shares into $l$ vectors as

$$x_j^{\prime }={(x_j^{\prime }\left(1\right), x_j^{\prime }\left(2\right),\cdots ,x_j^{\prime }\left(k\right))}^T,1\le j\le l,$$

(19)

where $x_j^{\prime }\left(i\right)$ denotes the $j$-th entry of the $i$-th share. Then, the vector $x_j^{\prime }$ with missing entries can be restored into the complete solution $x_j$ by using Equations (11) and (12).

To extract secret data, the combiner first reproduces the random sequence ${\gamma }_{j,r}\left(1\le r\le k\right)$ by the shared data hiding key. Then, the secret segments $m_j\left(1\le j\le l\right)$ can be extracted by substituting the complete solution vectors $x_j\left(1\le j\le l\right)$ back into Equation (17), as

$$\left(\begin{array}{c}\begin{array}{c}{x}_j\left(1\right)\\ x_j\left(2\right)\end{array}\\ \begin{array}{c}⋮\\ x_j(n-k)\end{array}\\ \begin{array}{c}⋮\\ ⋮\end{array}\\ \begin{array}{c}⋮\\ x_j\left(n\right)\end{array}\end{array}\right)+(m_{j,1}+{\gamma }_{j,1})\left(\begin{array}{c}\begin{array}{c}{\alpha }_{1,1}\\ {\alpha }_{1,2}\end{array}\\ \begin{array}{c}⋮\\ {\alpha }_{1,n-k}\end{array}\\ \begin{array}{c}1\\ 0\end{array}\\ \begin{array}{c}⋮\\ 0\end{array}\end{array}\right)+\cdots +(m_{j,k}+{\gamma }_{j,k})\left(\begin{array}{c}\begin{array}{c}{\alpha }_{k,1}\\ {\alpha }_{k,2}\end{array}\\ \begin{array}{c}⋮\\ {\alpha }_{k,n-k}\end{array}\\ \begin{array}{c}0\\ 0\end{array}\\ \begin{array}{c}⋮\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}\begin{array}{c}{\beta }_1\\ {\beta }_2\end{array}\\ \begin{array}{c}⋮\\ {\beta }_{n-k}\end{array}\\ \begin{array}{c}0\\ 0\end{array}\\ \begin{array}{c}⋮\\ 0\end{array}\end{array}\right)modp.$$

(20)

By expanding the last $k$ rows, we can get the secret segments

$$\left\{\begin{array}{c}{m}_{j,1}=x_j\left(n-k+1\right)-{\gamma }_{j,1}\\ \begin{array}{c}{m}_{j,2}=x_j\left(n-k+2\right)-{\gamma }_{j,2}\\ ⋮\end{array}\\ m_{j,k}=x_j\left(n\right)-{\gamma }_{j,k}\end{array}\right..$$

(21)

When additional doubtful shares are available, they can be authenticated by using the restored missing entries based on the trustworthy shares.

2.3. Demonstration

Let us assume $k=2$, $n=4$, and $p=5$. That is, we are going to demonstrate a (2,4)-threshold secret sharing scheme. The dealer selects two linearly independent equations with four variables, as

$$\begin{gathered} {\pi }_1:1x_1+3x_2+1x_3+2x_4=1 \mathrm{mod} 5, \\ {\pi }_2:2x_1+4x_2+0x_3+1x_4=3 \mathrm{mod} 5. \end{gathered}$$

(22)

That is, $A=\left(\begin{array}{ccc}1& 3& \begin{array}{cc}1& 2\end{array}\\ 2& 4& \begin{array}{cc}0& 1\end{array}\end{array}\right)$ and $b=\left(\begin{array}{c}1\\ 3\end{array}\right)$.

2.3.1. Particular and Homogeneous Solutions

Manipulate the augmented matrix with elementary row operations (see Appendix A) over the field Z_p to obtain a row simplest augmented matrix as

$$\begin{gathered} \left(A|b\right)=\left(\begin{array}{ccc}1& 3& \begin{array}{cc}1& 2 \end{array}\\ 2& 4& \begin{array}{cc}0& 1 \end{array}\end{array}|\begin{array}{c}1\\ 3\end{array}\right)\stackrel{R_2=R_2+3R_1}{\to }\left(\begin{array}{ccc}1& 3& \begin{array}{cc}1& 2 \end{array}\\ 0& 3& \begin{array}{cc}3& 2 \end{array}\end{array}|\begin{array}{c}1\\ 1\end{array}\right) \\ \stackrel{R_2=2R_2}{\to }\left(\begin{array}{ccc}1& 3& \begin{array}{cc}1& 2 \end{array}\\ 0& 1& \begin{array}{cc}1& 4 \end{array}\end{array}|\begin{array}{c}1\\ 2\end{array}\right)\stackrel{R_1=R_1+2R_2}{\to }\left(\begin{array}{ccc}1& 0& \begin{array}{cc}3& 0 \end{array}\\ 0& 1& \begin{array}{cc}1& 4 \end{array}\end{array}|\begin{array}{c}0\\ 2\end{array}\right). \end{gathered}$$

(23)

Then, by applying Equation (7), we can get a particular solution $\beta ={\left(0,2,0,0\right)}^T$. By applying Equations (8) and (9), we can get a set of linearly independent homogeneous solutions

$${\alpha }_1=\left(-3 \mathrm{mod} 5,-1 \mathrm{mod} 5,1,0\right)=\left(2,4,1,0\right),$$

(24)

$${\alpha }_2=\left(-0 \mathrm{mod} 5,-4 \mathrm{mod} 5,0,1\right)=\left(0,1,0,1\right).$$

(25)

2.3.2. Share Generation

For each secret segment $m_j=\left(m_{j,1},m_{j,2}\right)$_, the solution vector $x_j$ can be generated by

$$x_j=(m_{j,1}+{\gamma }_{j,1}){\alpha }_1+(m_{j,2}+{\gamma }_{j,2}){\alpha }_2+\beta \mathrm{mod} 5.$$

(26)

Let the secret data be $m_1=\left(4,0\right), m_2=\left(1,1\right),m_3=\left(4,2\right)$, and the random integer series generated by the data hiding key be $\left({\gamma }_{1,1},{\gamma }_{1,2}\right)=\left(3, 2\right)$, $\left({\gamma }_{2,1},{\gamma }_{2,2}\right)=\left(4, 2\right),\left({\gamma }_{3,1},{\gamma }_{3,2}\right)=\left(2,3\right)$, then the generated vectors are

$$x_1=\left(\begin{array}{c}{x}_1\left(1\right)\\ x_1\left(2\right)\\ \begin{array}{c}{x}_1\left(3\right)\\ x_1\left(4\right)\end{array}\end{array}\right)=\left(4+3\right)\left(\begin{array}{c}2\\ 4\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right)+\left(0+2\right)\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}0\\ 2\\ \begin{array}{c}0\\ 0\end{array}\end{array}\right)=\left(\begin{array}{c}4\\ 2\\ \begin{array}{c}2\\ 2\end{array}\end{array}\right),$$

(27)

$$x_2=\left(\begin{array}{c}{x}_2\left(1\right)\\ x_2\left(2\right)\\ \begin{array}{c}{x}_2\left(3\right)\\ x_2\left(4\right)\end{array}\end{array}\right)=\left(1+4\right)\left(\begin{array}{c}2\\ 4\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right)+\left(1+2\right)\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}0\\ 2\\ \begin{array}{c}0\\ 0\end{array}\end{array}\right)=\left(\begin{array}{c}0\\ 0\\ \begin{array}{c}0\\ 3\end{array}\end{array}\right),$$

(28)

$$x_3=\left(\begin{array}{c}{x}_3\left(1\right)\\ x_3\left(2\right)\\ \begin{array}{c}{x}_3\left(3\right)\\ x_3\left(4\right)\end{array}\end{array}\right)=\left(4+2\right)\left(\begin{array}{c}2\\ 4\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right)+\left(2+3\right)\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}0\\ 2\\ \begin{array}{c}0\\ 0\end{array}\end{array}\right)=\left(\begin{array}{c}2\\ 1\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right).$$

(29)

The dealer rearranges the vector entries into secret shares and distributes them to the participants.

$$X_1={\left(4, 0, 2\right)}^T,X_2={\left(2, 0, 1\right)}^T,X_3={\left(2, 0, 1\right)}^T,X_4={\left(2, 3, 0\right)}^T.$$

(30)

2.3.3. Authentication

At the combiner side, suppose that only shares $X_1={\left(4, 0, 2\right)}^T$ and $X_2={\left(2, 0, 1\right)}^T$ are trustworthy, while $X_3$ and $X_4$ are doubtful. The combiner can reproduce the remaining shares and restore the secret data by using the faithful ones. He/she first manipulates $\left(A|b\right)$ by using elementary row operations, so that the submatrix constituted by column 3 and 4 becomes an identity matrix as

$$\left(A|b\right)=\left(\begin{array}{ccc}1& 3& \begin{array}{cc}1& 2 \end{array}\\ 2& 4& \begin{array}{cc}0& 1 \end{array}\end{array}|\begin{array}{c}1\\ 3\end{array}\right)\stackrel{R_1=R_1+3R_2}{\to }\left(\begin{array}{ccc}2& 0& \begin{array}{cc}1& 0 \end{array}\\ 2& 4& \begin{array}{cc}0& 1 \end{array}\end{array}|\begin{array}{c}0\\ 3\end{array}\right).$$

(31)

Then, the combiner rearranges the available entries into $x_1^{\prime }={\left(4,2\right)}^T$, $x_2^{\prime }={\left(0,0\right)}^T$, and $x_3^{\prime }={\left(2,1\right)}^T$. Finally, these vectors with missing entries are substituted into Equation (31) as

$$\left\{\begin{array}{c}{x}_1\left(3\right)=-2\times 4-0\times 2+0 \mathrm{mod} 5=2\\ x_1\left(4\right)=-2\times 4-4\times 2+3 \mathrm{mod} 5=2\end{array}\right..$$

(32)

$$\left\{\begin{array}{c}{x}_2\left(3\right)=-2\times 0-0\times 0+0 \mathrm{mod} 5=0\\ x_2\left(4\right)=-2\times 0-4\times 0+3 \mathrm{mod} 5=3\end{array}\right..$$

(33)

$$\left\{\begin{array}{c}{x}_3\left(3\right)=-2\times 2-0\times 1+0 \mathrm{mod} 5=1\\ x_3\left(4\right)=-2\times 2-4\times 1+3 \mathrm{mod} 5=0\end{array}\right..$$

(34)

Therefore, the complete solution vectors are $x_1={\left(4,2,2,2\right)}^T$, $x_2={\left(0,0,0,3\right)}^T$, $x_3={\left(2,1,1,0\right)}^T$, and the remaining shares should be $X_3={\left(2, 0, 1\right)}^T$, $X_4={\left(2, 3, 0\right)}^T$. If a share provided by a suspicious participant does not match the result, then he/she is a cheater.

2.3.4. Secret Recovery

To restore secret data, the combiner first manipulates the given linear equations to obtain the particular and homogeneous solutions as the share generation phase. Thus, the solution vectors should be

$$x_j=\left(m_{j,1}+{\gamma }_{j,1}\right)\left(\begin{array}{c}2\\ 4\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right)+(m_{j,2}+{\gamma }_{j,2})\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}0\\ 2\\ \begin{array}{c}0\\ 0\end{array}\end{array}\right) \mathrm{mod} 5.$$

(35)

Therefore, the secret segments can be obtained by substituting the restored shares $X_3,X_4$ and the integer series ${\gamma }_{j,r},1\le j\le 2, 1\le r\le 2,$ generated by the shared data hiding key into the last two rows of Equation (35), as

$$\left\{\begin{array}{c}{m}_{1,1}+{\gamma }_{1,1}=x_1\left(3\right) \\ m_{1,2}+{\gamma }_{1,2}=x_1\left(4\right)\end{array}\right.\to \left\{\begin{array}{c}{m}_{1,1}=x_1\left(3\right)-{\gamma }_{1,1} \mathrm{mod} 5=2-3 \mathrm{mod} 5=4\\ m_{1,2}=x_1\left(4\right)-{\gamma }_{1,2} \mathrm{mod} 5=2-2 \mathrm{mod} 5=0\end{array}\right..$$

(36)

$$\left\{\begin{array}{c}{m}_{2,1}=x_2\left(3\right)-{\gamma }_{2,1} \mathrm{mod} 5=0-4 \mathrm{mod} 5=1\\ m_{2,2}=x_2\left(4\right)-{\gamma }_{2,2} \mathrm{mod} 5=3-2 \mathrm{mod} 5=1\end{array}\right..$$

(37)

$$\left\{\begin{array}{c}{m}_{3,1}=x_3\left(3\right)-{\gamma }_{3,1} \mathrm{mod} 5=1-2 \mathrm{mod} 5=4\\ m_{3,2}=x_3\left(4\right)-{\gamma }_{3,2} \mathrm{mod} 5=0-3 \mathrm{mod} 5=2\end{array}\right.$$

(38)

The recovered secret segments are $m_1=\left(4,0\right), m_2=\left(1,1\right),m_3=\left(4,2\right)$, which are the same as embedded.

3. $\left(k,n\right)$-Threshold Secret Image Sharing Scheme Based on Linear Model

In this section, the $\left(k,n\right)$-threshold secret sharing scheme discussed above is applied to the platform of digital image transmission. By using the proposed secret sharing scheme, we can hide secret data in three distinct meaningful images and produce three shadows with imperceptible changes. While the shadow images are transmitted to $n$ different participants, the secret data can be recovered only if more than $k$ participants share their shadows. We present our scheme with the following subsections: system overview, setup, shadow image generation, secret data extraction with authentication, and a demonstration.

3.1. System Overview

The flowchart of the proposed scheme is shown in Figure 1. In the proposed scheme, secret data $S$ are converted into a sequence of $p$-ary digits first. Then, this sequence is divided into segments denoted by $S=\left\{m_j|m_j={\left(m_{j,1}, m_{j,2},\cdots ,m_{j,k}\right)}^T\in {\mathrm{z}}_p^k,j=1,2,\cdots ,l\right\}$, where $l$ is the total number of secret segments. We randomly choose $n$ distinct meaningful cover images $I_1,I_2,\dots ,I_n$ with size $w\times h>l$. A vector sequence is produced from the cover images and denoted by $I_{vec}=\left\{y_j|y_j={\left(y_j\left(1\right),y_j\left(2\right),\dots ,y_j\left(n\right)\right)}^T,j=1,2,\cdots ,w\times h\right\}$, where each vector $y_j$ is a collection of $n$ pixel values retrieved from corresponding positions of the $n$ images. To embed secret data, we apply the proposed $\left(k,n\right)$-threshold secret sharing scheme to generate a vector $x_j={\left(x_j\left(1\right),x_j\left(2\right),\dots x_j\left(n\right)\right)}^T$ of $n$ digits using a secret segment $m_j$ of $k$ digits. After all secret segments are converted, the resulting vector sequence $X=\left\{x_j|j=1,2,\cdots ,l\right\},$ is applied to modulate $I_{vec}=\left\{y_j|j=1,2,\cdots ,w\times h\right\}$ and obtain the sequence ${\widehat{I}}_{vec}=\left\{{\widehat{y}}_j|j=1,2,\cdots ,w\times h\right\}$, correspondingly. Finally, the secret image shadows are generated by distributing the modulated sequence back into $n$ meaningful images ${\widehat{I}}_1,{\widehat{I}}_2,\dots ,{\widehat{I}}_n$ sized $w\times h$. In the secret data recovery phase, at least $k$ trustworthy shadows should be available. These $k$ shadows are rearranged into a vector sequence with missing entries ${\widehat{I}}_{vec}^{\prime }=\left\{{\widehat{y}}_j^{\prime }|{\widehat{y}}_j^{\prime }={\left({\widehat{y}}_j^{\prime }\left(1\right),{\widehat{y}}_j^{\prime }\left(2\right),\dots ,{\widehat{y}}_j^{\prime }\left(k\right)\right)}^T,j=1,2,\cdots ,w\times h\right\}$. Then, a sequence of vectors with missing entries ${\widehat{X}}^{\prime }=\left\{{\widehat{x}}_j^{\prime }|{\widehat{x}}_j^{\prime }={\left({\widehat{x}}_j^{\prime }\left(1\right),{\widehat{x}}_j^{\prime }\left(2\right),\dots ,{\widehat{x}}_j^{\prime }\left(k\right)\right)}^T,j=1,2,\cdots ,l\right\}$ are demodulated. The missing entries can be recovered by using Equations (11) and (12). If there are suspicious participants, the one who provides a share that mismatches the reproduced shadow is a cheater. Finally, the secret data can be recovered using Equations (20) and (21).

3.2. Setup

The dealer decides the number of the participants $n$, the threshold$k$, and the prime number $p$. He/she selects $\left(n-k\right)$ linearly independent equations of $n$ variables over the field $z_p$

$${\pi }_i:a_{i,1}{x}_1+a_{i,2}{x}_2+\cdots +a_{i,n}{x}_n=0 \mathrm{mod} p, \mathrm{where} i=1,2,\cdots ,\left(n-k\right).$$

(39)

We can rewrite them in matrix form as

$$Ax=b \mathrm{mod} p.$$

(40)

Find a set of linearly independent homogeneous solutions $\left\{{\alpha }_1,{\alpha }_2,\cdots ,{\alpha }_k\right\}$ and a particular solution $\beta$ by applying Equations (5)–(9).

3.3. Shadow Image Generation

Let us assume that the secret data to be embedded are denoted as $S$ and the $n$ distinct meaningful cover images with size $w\times h$ are denoted as $I_1$,$I_2$,$\cdots$,$I_n$. The shadow images can be generated by the following steps.

Step 1. Rearrange the cover images $I_1$,$I_2$,$\cdots$,$I_n$ into vector sequence as

$$I_{vec}=\left\{y_j|y_j={\left(y_j\left(1\right),y_j\left(2\right),\dots y_j\left(n\right)\right)}^T,j=1,2,\cdots ,w\times h\right\}.$$

(41)

Step 2. Convert the secret data stream $S$ into a sequence of $p$-ary digits and divide them into segments denoted by $S=\left\{m_j|m_j={\left(m_{j,1}, m_{j,2},\cdots ,m_{j,k}\right)}^T\in {\mathrm{z}}_p^k,j=1,2,\cdots ,l\right\}$, where $l\le w\times h$ is the total number of secret segments.

Step 3. Apply $m_j={(m_{j,1}, m_{j,2},\cdots ,m_{j,k})}^T,j=1,2,\cdots ,l$ to generate vectors $x_j={\left(x_j\left(1\right),x_j\left(2\right),\dots x_j\left(n\right)\right)}^T,$ $j=1,2,\cdots ,l$ using Equation (17). Compute the residual vectors of $I_{vec}$ by

$${\overline{x}}_j={\left({\overline{x}}_j\left(1\right),{\overline{x}}_j\left(2\right),\dots {\overline{x}}_j\left(n\right)\right)}^T{\left(y_j\left(1\right),y_j\left(2\right),\dots y_j\left(n\right)\right)}^T \mathrm{mod} p,\mathrm{where} j=1,2,\cdots ,l.$$

(42)

Compute the stego vector sequence ${\widehat{I}}_{vec}=\left\{{\widehat{y}}_j|{\widehat{y}}_j={\left({\widehat{y}}_j\left(1\right),{\widehat{y}}_j\left(2\right),\dots ,{\widehat{y}}_j\left(n\right)\right)}^T,j=1,2,\cdots ,l\right\}$ by

$${\widehat{y}}_j\left(i\right)=\left\{\begin{array}{l}{y}_j\left(i\right)+[(x_j\left(i\right)-{\overline{x}}_j\left(i\right)) \mathrm{mod} p], \mathrm{if} (x_j\left(i\right)-{\overline{x}}_j\left(i\right)) \mathrm{mod} p<p/2 ,\\ y_j\left(i\right)-\left[\left({\overline{x}}_j\left(i\right)-x_j\left(i\right)\right) \mathrm{mod} p\right], \mathrm{otherwise}.\end{array}\right.$$

(43)

When overflow/underflow is encountered, do

$${\widehat{y}}_j\left(i\right)=\left\{\begin{array}{l}{\widehat{y}}_j\left(i\right)+p, if {\widehat{y}}_j\left(i\right)<0,\\ {\widehat{y}}_j\left(i\right)-p, if {\widehat{y}}_j\left(i\right)>255.\end{array}\right.$$

(44)

Append the rest of the unmodulated vectors $y_j,j=l+1,l+2,\cdots ,w\times h$ to constitute ${\widehat{I}}_{vec}=\left\{{\widehat{y}}_j|j=1,2,\cdots ,w\times h\right\}.$

Step 4. Distribute the modulated sequence ${\widehat{I}}_{vec}=\left\{{\widehat{y}}_j|j=1,2,\cdots ,w\times h\right\}$ back into $n$ meaningful shadow images ${\widehat{I}}_1,{\widehat{I}}_2,\dots ,{\widehat{I}}_n$ sized $w\times h$.

3.4. Secret Data Extraction with Authentication

Suppose the $n$ meaningful shadow images ${\widehat{I}}_1,{\widehat{I}}_2,\dots ,{\widehat{I}}_n$ sized $w\times h$ are transmitted to $n$ participants and now $k$ faithful participants provide their shadow images to a combiner. The combiner can recover secret data and authenticate the rest shadows by the following steps. Without loss of generality, let us suppose that the $k$ trustworthy shadows are ${\widehat{I}}_1,{\widehat{I}}_2,\dots ,{\widehat{I}}_k$.

Step 1. Convert $k$ shadow images ${\widehat{I}}_1,{\widehat{I}}_2,\dots ,{\widehat{I}}_k$ into vectors of $k$-tuples as

$${\widehat{I}}_{vec}^{\prime }=\left\{{\widehat{y}}_j^{\prime }|{\widehat{y}}_j^{\prime }={\left({\widehat{y}}_j^{\prime }\left(1\right),{\widehat{y}}_j^{\prime }\left(2\right),\dots ,{\widehat{y}}_j^{\prime }\left(k\right)\right)}^T,j=1,2,\cdots ,w\times h\right\}.$$

(45)

Step 2. Compute the residual vectors

$${\widehat{x}}_j^{\prime }={\left({\widehat{y}}_j^{\prime }\left(1\right),{\widehat{y}}_j^{\prime }\left(2\right),\dots ,{\widehat{y}}_j^{\prime }\left(k\right)\right)}^T\mathrm{mod} p,\mathrm{where} j=1,2,\cdots ,l.$$

(46)

Step 3. Substitute each vector ${\widehat{x}}_j^{\prime }={\left({\widehat{x}}_j^{\prime }\left(1\right),{\widehat{x}}_j^{\prime }\left(2\right),\dots ,{\widehat{x}}_j^{\prime }\left(k\right)\right)}^T$ into Equations (11) and (12), the missing entries can be recovered to obtain its corresponding complete solution vector ${\widehat{x}}_j={\left({\widehat{x}}_j\left(1\right),{\widehat{x}}_j\left(2\right),\dots ,{\widehat{x}}_j\left(n\right)\right)}^T$.

Step 4. Convert a doubtful shadow ${\widehat{I}}_r$ into sequence ${\widehat{y}}_j^{*}\left(r\right),j=1,2,\dots ,w\times h.$ Then, compute its residual sequence ${\widehat{x}}_j^{*}\left(r\right),j=1,2,\dots ,l.$ If ${\widehat{x}}_j^{*}\left(r\right)={\widehat{x}}_j\left(r\right), j=1,2,\dots ,l,$ the authentication is passed; else, it is a tampered shadow.

Step 5. Extract the secret data by applying ${\widehat{x}}_j={\left({\widehat{x}}_j\left(n-k+1\right),\dots ,{\widehat{x}}_j\left(n\right)\right)}^T,j=1,2,\dots ,$l to Equation (21).

3.5. Demonstration

We use the example model given in Section 2.3 to demonstrate how the proposed secret sharing scheme can be applied to image transmission applications. That is, $k=2$, $n=4$, $p=5$, and the two linearly independent equations with four variables are

$${\pi }_1:x_1+3x_2+x_3+2x_4=1 \mathrm{mod} 5 \mathrm{and} {\pi }_2:2x_1+4x_2+0x_3+x_4=3 \mathrm{mod} 5.$$

(47)

As analyzed in Section 2.3.1, ${\alpha }_1={\left(2, 4,1,0\right)}^T$ and ${\alpha }_2={\left(0, 1,0,1\right)}^T$ are two linearly independent homogeneous solutions, and $\beta ={\left(0,2,0,0\right)}^T$ is a particular solution.

Assume that $m_1=\left(2,1\right)$ and $m_2=\left(3,0\right)$ are two 5-ary secret segments, and the four cover images are $I_1=\left(135,136\right)$, $I_2=\left(161,162\right)$, $I_3=\left(201,200\right)$, and $I_4=\left(55,58\right)$. Two random segments ${\gamma }_1=\left(4,0\right)$ and ${\gamma }_2=\left(1,2\right)$ are generated by the data hiding key.

For the secret segments $m_1$ and $m_2$, we generate their corresponding solution vectors by using Equation (17) and obtain

$$x_1=F\left(m_1\right)=\left(2+4\right)\left(\begin{array}{c}2\\ 4\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right)+\left(1+0\right)\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}0\\ 2\\ \begin{array}{c}0\\ 0\end{array}\end{array}\right)=\left(\begin{array}{c}2\\ 2\\ \begin{array}{c}1\\ 1\end{array}\end{array}\right),$$

(48)

$$x_2=F\left(m_2\right)=\left(3+1\right)\left(\begin{array}{c}2\\ 4\\ \begin{array}{c}1\\ 0\end{array}\end{array}\right)+\left(0+2\right)\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 1\end{array}\end{array}\right)+\left(\begin{array}{c}0\\ 2\\ \begin{array}{c}0\\ 0\end{array}\end{array}\right)=\left(\begin{array}{c}3\\ 0\\ \begin{array}{c}4\\ 2\end{array}\end{array}\right).$$

(49)

The residual vectors are

$${\overline{x}}_1={\left(135,161,201,55\right)}^T \mathrm{mod} 5={\left(0,1,1,0\right)}^T,$$

(50)

$${\overline{x}}_2={\left(136,162,200,58\right)}^T \mathrm{mod} 5={\left(1,2,0,3\right)}^T.$$

(51)

Then, the stego vectors are

$${\widehat{y}}_1=\left(\begin{array}{c}135+\left(2-0\right)\mathrm{mod}5\\ 161+\left(2-1\right)\mathrm{mod}5\\ \begin{array}{c}201+\left(1-1\right)\mathrm{mod}5\\ 55+\left(1-0\right)\mathrm{mod}5\end{array}\end{array}\right)=\left(\begin{array}{c}137\\ 162\\ \begin{array}{c}201\\ 56\end{array}\end{array}\right),{\widehat{y}}_2=\left(\begin{array}{c}136+\left(3-1\right)\mathrm{mod}5\\ 162-\left(2-0\right)\mathrm{mod}5\\ \begin{array}{c}200-\left(0-4\right)\mathrm{mod}5\\ 58-\left(3-2\right)\mathrm{mod}5\end{array}\end{array}\right)=\left(\begin{array}{c}138\\ 160\\ \begin{array}{c}199\\ 57\end{array}\end{array}\right).$$

(52)

Finally, the four shadow images are

$${\widehat{I}}_1=\left(137,138\right), {\widehat{I}}_2=\left(162,160\right),{\widehat{I}}_3=\left(201,199\right),{\widehat{I}}_4=\left(56,57\right).$$

(53)

The shares ${\widehat{I}}_1, {\widehat{I}}_2, {\widehat{I}}_3, {\widehat{I}}_4$ are distributed to the four participants, respectively.

If a combiner obtains trustworthy shadow images ${\widehat{I}}_1=\left(137,138\right)$ and ${\widehat{I}}_2=\left(162,160\right)$, he/she first calculates the residual vectors as

$${\widehat{x}}_1^{\prime }={\left(137,162\right)}^T\mathrm{mod} 5={\left(2,2\right)}^T,{\widehat{x}}_2^{\prime }={\left(138,160\right)}^T\mathrm{mod} 5={\left(3,0\right)}^T.$$

(54)

Then, the missing entries can be recovered using Equations (11,12). For the current case, manipulations are demonstrated in Equation (31) as

$$\left\{\begin{array}{c}{x}_1\left(3\right)=-2\times 2-0\times 2+0 \mathrm{mod} 5=1\\ x_1\left(4\right)=-2\times 2-4\times 2+3 \mathrm{mod} 5=1\end{array}\right..$$

(55)

$$\left\{\begin{array}{c}{x}_2\left(3\right)=-2\times 3-0\times 0+0 \mathrm{mod} 5=4\\ x_2\left(4\right)=-2\times 3-4\times 0+3 \mathrm{mod} 5=2\end{array}\right..$$

(56)

To extract secret data, the random segments ${\gamma }_1=\left(4,0\right)$ and ${\gamma }_2=\left(1,2\right)$ are generated by the shared data hiding key first. The secret data can be extracted using Equation (21) as

$$m_1=\left(1-4,1-0\right)=\left(2,1\right),m_2=\left(4-1,2-2\right)=\left(3,0\right).$$

(57)

4. Experimental Results and Discussions

In this section, we use two secret image sharing schemes with different combinations of $\left(k,n\right)$ values to demonstrate the applicability of the proposed approach. Performance evaluation based on the embedding capacity and the visual quality of image shadows are given. The security level of the proposed scheme is also analyzed.

4.1. Demonstration of Applicability

In this subsection, we implement a (2,4)-threshold and a (3,5)-threshold secret image sharing schemes to verify the applicability and the generalizability of the proposed approach.

4.1.1. (2,4)-Threshold Secret Image Sharing Scheme

In our first implementation, the parameter settings are $k=2$, $n=4$, $p=5$, and the two linearly independent equations given in Equation (47) are applied. The secret data are assumed to be a secret image, as shown in Figure 2a, which is a grayscale image sized $384\times 384$. The four distinct cover images are shown in Figure 2b–e, which are all grayscale images sized $512\times 512$. All pixel values in our experiments are recorded in eight bits.

To fit the parameter settings, the pixels of the secret image are divided into groups of four pixels each. Thirty-two bits of each pixel group are converted into fourteen 5-ary digits and then grouped into seven secret segments of two digits. Each secret segment is applied to generate a solution vector of four entries and used to modulate four cover pixels. Therefore, four pixel-values of the secret image are distributed in fourteen pixels for each cover image. The generated image shadows are shown in Figure 2f–i. The changes with respect to their corresponding cover images are imperceptible. The peak-signal-to-noise-ratio (PSNR) given below the figures is defined by

$$\mathrm{PSNR}=10 {\log }_{10}(\frac{{255}^2}{e_{mse}}) \left(\mathrm{dB}\right),$$

(58)

where $e_{mse}$ denotes the mean-square-error between the cover image $I_j$ and the shadow image ${\widehat{I}}_j$ defined by

$$e_{mse}=\frac{1}{w\times h}{{\displaystyle \sum }}_{j=1}^{w\times h}{\left({\widehat{I}}_j-I_j\right)}^2.$$

(59)

The recovered secret images by using different combinations of image shadow pairs are given in Figure 2j–m. In all cases, the secret image can be perfectly recovered.

4.1.2. (3,5)-Threshold Secret Image Sharing Scheme

In our second implementation, the parameter settings are $k=3$, $n=5$, and $p=5$, and the two linearly independent equations are given by

$$\begin{gathered} {\pi }_1:2x_1+2x_2+x_3+3x_4+x_5=1 \mathrm{mod} 5. \\ {\pi }_2:3x_1+4x_2+3x_3+4x_4+x_5=3 \mathrm{mod} 5. \end{gathered}$$

(60)

The solution space $H$ of ${\pi }_1$ and ${\pi }_2$ over $z_5$ is formulated as

$$H=c_1\left(\begin{array}{c}1\\ 0\\ \begin{array}{c}0\\ 4\\ 1\end{array}\end{array}\right)+c_2\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 3\\ 4\end{array}\end{array}\right)+c_3\left(\begin{array}{c}0\\ 0\\ \begin{array}{c}1\\ 3\\ 0\end{array}\end{array}\right)+\left(\begin{array}{c}1\\ 1\\ \begin{array}{c}1\\ 2\\ 0\end{array}\end{array}\right)\mathrm{mod} 5,$$

(61)

where $c_1$, $c_2$, $c_3\in z_5$. Then, solution vector generation function is given by

$$x_j=F\left(m_j\right)=(m_{j,1}+{\gamma }_{j,1})\left(\begin{array}{c}1\\ 0\\ \begin{array}{c}0\\ 4\\ 1\end{array}\end{array}\right)+(m_{j,2}+{\gamma }_{j,2})\left(\begin{array}{c}0\\ 1\\ \begin{array}{c}0\\ 3\\ 4\end{array}\end{array}\right)+\left(m_{j,3}+{\gamma }_{j,3}\right)\left(\begin{array}{c}0\\ 0\\ \begin{array}{c}1\\ 3\\ 0\end{array}\end{array}\right)+\left(\begin{array}{c}1\\ 1\\ \begin{array}{c}1\\ 2\\ 0\end{array}\end{array}\right) \mathrm{mod} p.$$

(62)

The secret image sized $512\times 438$ is given in Figure 3a; the five distinct cover images sized $512\times 512$ are given in Figure 3b–f. To fit the parameter settings, pixels of the secret image are divided into groups of six pixels each. Forty-eight bits of each pixel group are converted into twenty-one 5-ary digits, and then grouped into seven secret segments of three digits. Each secret segment is applied to generate a solution vector of five entries and is used to modulate five cover pixels. Therefore, six pixel-values of the secret image are distributed in thirty-five pixels for each cover image. The generated image shadows are shown in Figure 3g–k. The changes with respect to their corresponding cover images are again imperceptible. The recovered secret images using different combinations of image shadows are given in Figure 3l–p. In all cases, the secret image can be perfectly recovered.

4.2. Performance Evaluation

In our $\left(k,n\right)$ threshold secret image sharing scheme, $k$ digits of $p$-ary numbers are embedded in $n$ pixels of each image shadow. The embedding capacity (EC) can therefore be measured in bits per pixel (bpp) of an image shadow by

$$\mathrm{EC}={\log }_2{p}^k \left(\mathrm{bpp}\right).$$

(63)

When the total number of shares $n$ increases, the total amount of image shadows to be transmitted also increases. However, an increase in the number of shares can improve the flexibility of secret recovery. Recall that any $k$ shares among the $n$ shadows can perfectly recover the secret.

For each cover pixel, Equation (43) always modulates the pixel value with an integer deviation within the range of $\left[-\left(p-1\right)/2:\left(p-1\right)/2\right]$. Suppose the deviation value is randomly distributed, the mean-square-error $e_{mse}$ of modulation distortion can be estimated by

$$e_{mse}=\frac{1}{p}{{\displaystyle \sum }}_{d=-\left(p-1\right)/2}^{\left(p-1\right)/2}{d}^2=\frac{\left(p-1\right)\left(p+1\right)}{12}.$$

(64)

When the pixels of a cover image are not fully exploited to embed secret data, we define the payload ratio as

$$r=\frac{N_e}{N_t},$$

(65)

where $N_e$ and $N_t$ denote the number of pixels exploited and the number of total pixels, respectively. For the two schemes implemented in Section 4.1, the payload ratios can be calculated by

$$r_{\left(2,4\right)}=\left[\left(384\times 384\right)/4\left(\mathrm{groups}\right)\times \left(7\times 4\right)\left(\mathrm{pixels}/\mathrm{group}\right)\right]/\left(512\times 512\times 4\right)=0.9844,$$

(66)

$$r_{\left(3,5\right)}=\left[\left(512\times 438\right)/6\left(\mathrm{groups}\right)\times \left(7\times 5\right)\left(\mathrm{pixels}/\mathrm{group}\right)\right]/\left(512\times 512\times 5\right)=0.9980.$$

(67)

Under the payload ratio $r$, the mean-square-error $e_{mse}$ is proportionally corrected to $r\times e_{mse}$. Thus, the expected PNSR value of an image shadow with a payload ratio $r$ is given by

$$\mathrm{PSNR}\left(r\right)=10{\log }_{10}\left( \frac{{255}^2}{r\times e_{mse}}\right)=10{\log }_{10}\left( \frac{12\times {255}^2}{r\left(p-1\right)\left(p+1\right)}\right)\left(\mathrm{dB}\right).$$

(68)

The expected PSNR values with respect to different payload ratios and prime numbers are listed in

Table 1. The expected PSNR value (dB) with specific ratio, $r$

	r
p	0.1	0.2	0.3	0.4	0.5	0.6	0.7	0.8	0.9	1.0
3	59.89	56.88	55.12	53.87	52.90	52.11	51.44	50.86	50.35	49.89
5	55.12	52.11	50.35	49.10	48.13	47.348	46.67	46.09	45.58	45.12
7	52.11	49.10	47.34	46.09	45.12	44.33	43.66	43.08	42.57	42.11
11	48.13	45.12	43.36	42.11	41.14	40.35	39.68	39.10	38.59	38.13

. The corresponding evolution curves are plotted in Figure 4, where the curves for four different prime numbers are given. According to the theoretic analysis, the expected PSNR values of the two implemented cases are 45.1889 dB and 45.1290 dB, respectively, which sharply coincide with our experimental values.

4.3. Security Analysis

Various steganalysis techniques [29,30,31,32] have been proposed to detect the existence of secret information in a digital image. The general idea of steganalysis is to detect the abnormal statistical feature of a doubtful image. However, there are various types of data hiding methods for images. To successfully detect the embedding of secret, special steganalysis techniques are devised to deal with each target steganography. For example, the RS steganalysis [29] is applied to detect the LSB substitution. For data hiding in encrypted images, people usually use pixel value entropy or gray level histogram to analyze the existence of a secret message.

The data hiding method of the proposed secret sharing scheme is essentially based on the modulus function. Two steganalysis tools, relative entropy [30] and pixel-value differencing [31,32], are suitable for testing the security level of our scheme. The first tool is the relative entropy proposed by Cachin [30]. To measure the difference between cover image $I_c$ and image shadow $I_s$, we accumulate their probability distributions $P_c\left(x\right)$ and $P_s\left(x\right)$, respectively. Then, their relative entropy $D\left(I_c,I_s\right)$ is calculated by

$$D\left(I_c,I_s\right)={{\displaystyle \sum }}_{x=0}^{255}{P}_c\left(x\right){\log }_2\left[\frac{P_c\left(x\right)}{P_s\left(x\right)}\right].$$

(69)

If $D\left(I_c,I_s\right)\le \epsilon$, by definition, the data hiding scheme is $\epsilon$-secure against passive attacking. A smaller value of $\epsilon$ means a better security level. We apply the relative entropy measure to our (3,5)-threshold secret image sharing scheme with $p=5$. The experimental results are listed in

Table 2. Relative entropy values under half embedded and fully embedded cases.

	Half Embedded			Fully Embedded
Cover Images	$\mathit{E}\left({\mathit{I}}_{\mathit{c}}\right)$	$\mathit{E}\left({\mathit{I}}_{\mathit{s}}\right)$	$\mathit{D}\left({\mathit{I}}_{\mathit{c}},{\mathit{I}}_{\mathit{s}}\right)$	$\mathit{E}\left({\mathit{I}}_{\mathit{c}}\right)$	$\mathit{E}\left({\mathit{I}}_{\mathit{s}}\right)$	$\mathit{D}\left({\mathit{I}}_{\mathit{c}},{\mathit{I}}_{\mathit{s}}\right)$
Baboon	7.3579	7.3543	0.0049	7.3579	7.3415	0.0185
Boat	7.1914	7.2050	0.0052	7.1914	7.2129	0.0184
Lena	7.4455	7.4482	0.0007	7.4455	7.4510	0.0014
Peppers	7.5944	7.5978	0.0006	7.5944	7.5998	0.0021
Goldhill	7.4778	7.4839	0.0036	7.4778	7.4829	0.0058

, where the relative entropy values for half embedded and fully embedded cases are given. All values listed in the table are very close to zero, which implies the image shadows of the proposed scheme are robust under a passive attack.

The second steganalysis applied is the pixel-value differencing analysis [31,32]. The neighboring pixel-values of a natural image are highly continuous. The continuity is disrupted by most data hiding schemes. If the pixel-value differencing histogram (PDH) of an image is unusually flat, it is highly doubtful. To investigate the security level of the proposed scheme, we apply the PDH analysis to a set of five image shadows produced by our (3,5)-threshold secret image sharing scheme with $p=5$. The secret image given in Figure 5a is embedded into five distinct cover images. The PDHs of the five pairs of cover images and their corresponding image shadows are plotted in Figure 5b–f. The PDH curves of image shadows are very close to their corresponding cover images, which indicates the proposed scheme is secure under PDH steganalysis.

5. Conclusions

In this paper, we propose a general $\left(k,n\right)$-threshold secret image sharing scheme with meaningful image shadows. We first present a $\left(k,n\right)$-theshold secret sharing scheme based on a non-full rank linear model. It is then applied to the platform of image transmission system. Using $n$ secret shares to modulate $n$ distinct cover images, we can produce $n$ image shadows. A combiner can completely recover the secret message by collecting at least $k$ image shadows.

To demonstrate the applicability to any combination of $\left(k,n\right)$ parameter values, we use two example models (2,4) and (3,5) to demonstrate our scheme. Experimental results confirm the applicability of the proposed scheme. Moreover, the embedding capacity and visual quality of image shadows are satisfactory. Embedding capacity and theoretic image quality under different parameter settings are also analyzed. Finally, we use two steganalysis tools to show the security level of our scheme.

The proposed scheme is based on the pixel-value modification in the spatial domain, which is suitable for digital images of a bitmap format. Our future work will focus on the implementation of the general secret sharing scheme to different cover media, such as JPEG images, encrypted images, and QR code images, which are more commonly applied in Internet applications.