An extended visual cryptography algorithm for general access structures.bak


Published on

1 Comment
  • we are doing project under this ... will ou clarify our doubts
    Are you sure you want to  Yes  No
    Your message goes here
  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

An extended visual cryptography algorithm for general access structures.bak

  1. 1. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 1, FEBRUARY 2012 219 An Extended Visual Cryptography Algorithm for General Access Structures Kai-Hui Lee and Pei-Ling Chiu Abstract—Conventional visual secret sharing schemes generate scheme or -VSS scheme) have been proposed [2]–[9].noise-like random pixels on shares to hide secret images. It suf- Ateniese et al. (denoted as Ateniese in short) [10] proposedfers a management problem, because of which dealers cannot visu- the concept of general access structure (GAS) and also devel-ally identify each share. This problem is solved by the extended vi-sual cryptography scheme (EVCS), which adds a meaningful cover oped a VC-based solution for some GASs. Afterward, Hsu etimage in each share. However, the previous approaches involving al. reported the formulation of an unexpanded VCS for a GASthe EVCS for general access structures suffer from a pixel expan- problem as an optimization model [11], [12]. Liu et al. (de-sion problem. In addition, the visual cryptography (VC)-based ap- noted as Liu in short) proposed a recursive approach to con-proach needs a sophisticated codebook design for various schemes. struct VCS for GASs [13]. By using the GAS, dealers can de-In this paper, we propose a general approach to solve the above- fine reasonable combinations of shares as decryption conditionsmentioned problems; the approach can be used for binary secretimages in noncomputer-aided decryption environments. The pro- rather than specifying the number of shares. For example, ifposed approach consists of two phases. In the first phase, based there are four participants—one CEO, one manager, and twoon a given access structure, we construct meaningless shares using employees—sharing a secret, the CEO may expect to decryptan optimization technique and the construction for conventional the secret with any one colleague who holds one of the otherVC schemes. In the second phase, cover images are added in each shares. The manager is allowed to obtain the secret with onlyshare directly by a stamping algorithm. The experimental results two employees. The two employees are restricted access to theindicate that a solution to the pixel expansion problem of the EVCSfor GASs is achieved. Moreover, the display quality of the recov- secret. Due to these flexibilities, dealers can also set the numberered image is very close to that obtained using conventional VC of shares as the decrypting condition. Hence, the -VSSschemes. scheme can be treated as a special case of the GAS. Index Terms—Extended visual cryptography (EVC), general ac- Conventional VSS schemes generate noise-like randomcess structures, optimization, pixel expansion, visual secret sharing pixels on shares to hide secret images. In this manner, the secretscheme. can be perfectly concealed on the share images. However, these schemes suffer from a management problem—dealers cannot identify each share visually. Hence, researchers have I. INTRODUCTION developed the extended visual cryptography scheme (EVCSV ISUAL cryptography (VC), which was proposed by Naor [14], also known as the friendly VC scheme [15], [16]), which and Shamir, allows the encryption of secret information adds a meaningful cover image on each share to address thein the image form [1]. By applying the concept of secret sharing, management problem. Ateniese presented a general techniquea secret image can be encrypted as different share images to implement -threshold EVCS as well as various in-printed on transparencies, which are then distributed to par- teresting classes of access structures for binary secret imagesticipants. By stacking transparencies (shares) directly, the se- [14]. Fang [15] and Chen et al. [16] proposed VC-based andcret images can be revealed and visually recognized by humans random-grid-based techniques, respectively, for -EVCSwithout any computational devices and cryptographic knowl- with a progressive decryption effect. Wang et al. developed aedge. On the other hand, any one share or a portion of shares can matrix extension algorithm for -EVCS by modifying anyleak nothing related to the secret image. VC is a very good so- existing VCS with random-looking shares, which were thenlution for sharing secrets when computers cannot be employed utilized as meaningful shares [17].for the decryption process. The pixel expansion problem is a common disadvantage with In the past decade, many research results on the threshold most of the VSS schemes. When the VC-based approach is em-visual secret sharing scheme (also known as -out-of- VSS ployed, each secret pixel within a secret image is encrypted in a block consisting of subpixels in each constituent share image. Thus, the area of a share is times that of the original secret image. The contrast of the recovered images will be decreased Manuscript received May 07, 2011; revised August 21, 2011; accepted Au-gust 26, 2011. Date of publication September 12, 2011; date of current ver- to simultaneously. The pixel expansion problem not onlysion January 13, 2012. This work was supported in part by the National Sci- affects the practicability of storage/transmission requirementsence Council of Taiwan under Contract NSC100-2410-H-130-009 and Contract for shares but also decreases the contrast of the recovered se-NSC100-2221-E-130-011. The associate editor coordinating the review of thismanuscript and approving it for publication was Dr. Carlo Blundo. cret images. To the best of our knowledge, the existing EVCS K.-H. Lee is with the Department of Computer Science and Information En- algorithms for GASs cannot avoid the pixel expansion problem.gineering, Ming Chuan University, Taipei, Taiwan (e-mail: khlee@mail.mcu. Therefore, we are motivated to find a solution to this P.-L. Chiu is with the Department of Risk Management and Insurance, Ming In this paper, we propose a novel encryption algorithm ofChuan University, Taipei, Taiwan (e-mail: EVCS for general access structures to cope with the pixel expan- Digital Object Identifier 10.1109/TIFS.2011.2167611 sion problem. The proposed algorithm is applicable to binary 1556-6013/$26.00 © 2011 IEEE
  2. 2. 220 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 1, FEBRUARY 2012secret/cover images, and no computational devices are needed B. Reviews VCS/EVCS for GASsduring the decryption phase. In order to avoid pixel expansion, 1) Ateniese’s VCS/EVCS for GASs: In 1996, Ateniese firstwe do not adopt the traditional VC-based approach to encrypt proposed a VC-based approach of VCS for GASs. They mappedsecret images. The encryption process can be divided into two an access structure of VCS to a graph and then found both thephases. The first phase of the algorithm, which uses optimiza- lower and the upper bounds on the size of the shares (i.e., thetion techniques for a given access structure, constructs a set pixel expansion factor) by the graph. They gave minimum pixelof noise-like shares that are pixel-expansion-free. We identified expansion factors as well as basis matrices for VCS for strongand formulated the problem in this phase as a combinatorial op- access structures for at the most four participants [10].timization problem and then developed a simulated-annealing- Then, in 2001, they developed a general method that can ex-based algorithm to solve it. The second phase of the algorithm tend conventional -VCSs to -EVCSs based upon thedirectly adds a cover image on each share via a stamping al- basis matrices of VCSs [14]. They proved that their VC-basedgorithm. In this manner, the pixel expansion can be removed encoding approach had an optimal pixel expansion factor. Theirentirely. Recently, Weir and Yan also used the similar technique method consisted of two steps: first, they found out a set of basisto solve the alignment problem of VC schemes [18]. Finally, we matrices to satisfy the VCS for a given access structure. Second,present implementation results to evaluate the effectiveness of they adopted the theory of hypergraph coloring to obtain the re-the proposed algorithm. Moreover, we compare our results with sultant matrices for the EVCS according to the basis matrices.other approaches. They also discussed some applications of their technique on var- The remainder of this paper is organized as follows. Section II ious interesting classes of access structures. Example 1, whichpresents a review of background and related work. Section III is adopted from Example 5.1 of [14], shows Ateniese’s solutionintroduces the proposed encryption algorithm. In Section IV, we the results of an experiment that was performed in order Example 1: Let and let be clo-to evaluate the performance of the proposed method. Lastly, we sure of , where . Assume thatsummarize and conclude our work in Section V. . A VCS for can be ob- tained using basis matrices and which are illustrated in II. BACKGROUND AND RELATED WORK the left part (without gray background) of matrices and , respectively. Then, by the theory of hypergraphA. Background of the General Access Structure coloring and Ateniese’s algorithm, a set of basis matrices can be obtained for -EVCS. A part of basis matrices, In this section, we briefly review some of Ateniese’s basic are as follows: and ,definitions and notations on GAS that will be used throughoutthe paper [10]. 0 1 Suppose is a set of participants, and 1 1denotes the power set of . denotes the set of subsets 1 0of from which we desire to be able to reconstruct the secret; 1 0thus, . Each set in is said to be a qualified set, 1 0while each set not in is called a forbidden set (denoted as 0 1 ). Obviously, and . 1 1Based on the definitions, a VCS/EVCS for an access structure 1 0 on is defined as a technique that can yield 1 0shares. When we stack together the shares associated with the 1 0participants in any set , we can recover the secretimage, but any has no information related to the As with other conventional VC-based approaches, Ateniese’ssecret image on the stacked image. VCS approach for GASs also suffers from the pixel expansion consists of all the minimal qualified sets problem. It will expand the size of shares 2–8 times for strong access structures on at the most four participants [10]. More- over, their extended method for -EVCS will in- troduce extra pixel expansion that will enlarge the size of theIn traditional secret sharing schemes, is monotonously shares and decrease the contrast of the recovered images. Asincreasing and is monotonously decreasing, the access shown in Example 1, two extra columns (marked as gray back-structure is said to be strong, and is termed a ground) have to be added to the basis matrices of VCS forbasis. In a strong access structure EVCS; the pixel expansion factor is, therefore, increased from 8 to 10. The contrast value is decreased from 1/8 to 1/10. The contrast of meaningful shares is fixed and is only 10% in this access structure.and we say that is the closure of . For example, if Besides this, there are other drawbacks of Ateniese’s ap-there are four participants sharing a secret image (i.e., proach: black secret pixels cannot be completely recovered ) and , stacking (e.g., access structures 12, 15, and 17 in [10, Table 1]); theany set of subsets , , or can aspect ratio of the recovered image cannot be maintained; thereveal the secret image; otherwise, no information can be dis- hypergraph coloring problem, which is NP-hard, needs to beplayed. solved; this approach needs a sophisticated codebook design;
  3. 3. LEE AND CHIU: EXTENDED VC ALGORITHM FOR GENERAL ACCESS STRUCTURES 221Fig. 1. Construction trees of Example 2: (a) Construction of -VCS. (b) Con-struction of -VCS.and the solution approach has to rely on the basis matrices ofthe existing VCSs cannot be generalized. 2) Liu’s VCS for GASs: In 2010, Liu [13] proposed a stepconstruction to construct VCS for GASs by applying (2,2)-VCSrecursively. Their constructions are applicable to binary secretimages and consider the VCS both under XOR and OR opera-tions. The main idea behind Liu’s approach is that the partic-ipants can take multiple share images for sharing one secret Fig. 2. Solution procedures for EVCS.image. Based on their idea, an access structure can be parti-tioned into several independent access structures to reduce the the help of other devices. For example, for the , theaverage pixel expansion (APE). Liu defined the APE as the av- participants need to first enlarge the smaller share to the othererage value of the total pixel expansions of the share images larger shares. This will lead to an alignment problem whileholding by each participant [13]. Moreover, a VCS for an ac- shares were printed on transparencies. Finally, recovered im-cess structure can be constructed by downsizing the size of the ages cannot maintain the same aspect ratio as the original secretaccess structure and applying (2,2)-VCS recursively. image. Example 2, which is modified from [13, Example 4], showsLiu’s construction. Example 2: Let and let be closure III. PROPOSED ENCRYPTION ALGORITHMof , where . First, In this section, we present a two-phased encryption algo- can be partitioned into rithm of -EVCS for GASs. The solution proce-and . Then, the two schemes -VCS and dures are shown in Fig. 2. In the first phase, it generates interme- -VCS will be constructed individually. For the step con- diate shares (i.e., in Fig. 2) of -VCS.struction of Construction 3, the construction trees are shown These intermediate shares (I-shares) have a meaningless appear-in Fig. 1. For the , apply Construction 2 for ance and no pixel expansion. In the second phase, cover images , i.e., apply the (2,2)-VCS, and denote will be added in these I-shares to yield the resultant shares ofthe first share distributed to a virtual participant as . -EVCS (i.e., in Fig. 2). Each moduleThe second share is duplicated and then distributed to partic- in Fig. 2 will be described in the following section.ipants and simultaneously because they are equivalentparticipants in the access structure. Then, take as the secret A. Phase I: Generating I-Sharesimage, and construct a step construction of -VCS. 1) Problem Statement: This phase aims to construct a pixel-Finally, we apply a (2,2)-VCS and distribute the two shares expansion-free VCS for a given access structure .to participants and , respectively. The construction pro- The main idea behind the solution approach is as follows. Acedures of is similar to that of .Eventually, participants , , and take two shares, one security system employs different keys to protect a secretresults in a pixel expansion of 2 times and the other results in and distributes these keys to participants. Each key may bepixel expansion of 4 times. Participant only take one share duplicated and will be distributed to at least one participant.which has 4 times pixel expansion. Each participant is allowed to hold at least one key. Consid- For the , the . For ering this scenario, if someone wants to access the secret, he/shethe , the . Hence, has to collect different keys from a set of participants. Ifthe APE of is 11/2. The pixel expansion for both he/she misses any one type of key, the secret will remain pro-the schemes -VCS and -VCS is 4, and the contrast is 1/4. tected. To construct such a security system for an access struc- Liu claimed that his approach could improve the average ture , the dealer has to carefully distribute dif-pixel expansion and contrast properties as compared with Ate- ferent keys to any set of participants , and hasniese’s approach. However, a comparison with the conventional to guarantee that any set of participants , willVCS showed that Liu’s approach had some additional draw- not hold all types of keys. Hence, the method of distributionbacks: first, the participants may take multiple share images of different keys to participants will provide a solution forwith different pixel expansions for one secret image. This dif- a given access structure. Before applying the above-mentionedfers from conventional VC schemes and will increase admin- scenario to -VCS, there are three key points toistrative inconvenience and difficulty. Second, the decryption be overcome: first, what constructions can be used to encryptprocess is more complicated than conventional VCSs and needs secret images without pixel expansion? Next, how many keys
  4. 4. 222 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 1, FEBRUARY 2012(shares) can satisfy the requirement of the given access struc- works. In this subprocedure, the last two questions that wereture? Finally, how should the keys be distributed? proposed in the beginning of this subsection will be solved. For example, there are 4 participants, , Second, basis shares that were yielded by construc-sharing a secret image upon the qualified set tions of -VCS and the construction set will be utilized and the forbidden set to obtain uncovered I-shares . This work will be car-(We keep this relation in the rest of the paper.) Intuitionally, we ried out by the encryptor and the share synthesizer, as shown incan utilize the construction of a (4,4)-VCS to yield 4 shares, Fig. 2. Obviously, the first question will be solved in this sub- , , , and (called basis shares), and then distribute one procedure.basis share to each participant. For example, participant 2) GAS Solver:holds the share , holds the share , and so on. Finally, we a) Problem statement and formulation: In this subsection,have 4 I-shares for the we give a formal definition for the GAS solver and then formu- -VCS. Obviously, upon stacking I-shares , , late it as a mathematical optimization problem. , and (according to ), the secret The problem of the GAS solver can be defined as follows:image which is the same as the result of the (4,4)-VCS, can be Definition 2: Given a set of participantsrevealed. and an access structure , finding a construction In this paper, construction of -VCSs is adopted to be set with a minimal , such that ,the encryptor in Fig. 2. The I-shares of a -VCS where and . Moreover, for any set ,are synthesized from the basis shares that are the products of the satisfying ; for any setencryptor. The construction set C holds the relation between the , .basis shares and the I-shares. Definition 2 not only describes a principle to construct a Definition 1: Assume that the -VCS, where -VCS via a -threshold VCS, but alsois to be used to construct a -VCS with par- shows the following properties.ticipants, , . Construction Property 1: For any -VCS, if a constructionset denotes the constitution member of shares of the set satisfying the requirements of exists, then -VCS, represents the constitution member of the -VCS can be constructed via the resultantparticipant , . Basis share , shares of a -threshold VCS. , is the resultant share of the -VCS. Shares Property 2: Suppose a -VCS can be con-of participant can be defined as . structed via the resultant shares of a -threshold VCS with By Definition 1, the construction set of the above example can a minimal , the recovered image of the -VCSbe expressed as . As black and has the highest contrast value .white pixels are presented by logical “1” and “0,” respectively, Proof: By Definition 2, a -VCS can get thethe stacking shares will be limited in pixel-wise “OR”-ed opera- same stacking result as a -VCS. Naor and Shamir havetion. Hence, the recovered image for shown that the upper bound on contrast for a -VCSshould be the stacking result of , , , and which is the scheme is [1]. That is, the upper bound on contrast issame as that of the (4,4)-VCS. proportional to the value of . Hence, the -VCS Example 3: Suppose there are 4 participants, will have the highest contrast while is minimal. , who share a secret image and the qualified The GAS Solver problem can be formulated as the followingset is . mathematical optimization model.Then the -VCS can be constructed by uti-lizing the construction of the (3,3)-VCS to yield 3 basis Given parameters:shares , , and . The construction set can be set as . By Definition 1, we can ob- A set of participants, .tain 4 shares for the -VCS, that is , , , and . Stacking any one subset Number of participants, .in can get all the basis shares, otherwise it will leak at Participant , , .least one. Minimal qualified set, . Assume that the qualified set ofExample 3 is altered to Qualified set, . . Forbidden set, .We can also employ the construction of the (3,3)-VCS toconstruct the -VCS. Now, the construction setcan be modified as . The Decision variables:I-shares for the -VCS become , , , and . Number of basis shares, . In summary, phase I of the proposed algorithm contains two S Set of basis share ,subprocedures: first, finding the number of basis shares and presents the th share which is encrypted bya corresponding construction set for a -VCS. the construction of -VCS.We develop a GAS solver, as shown in Fig. 2, to deal with these
  5. 5. LEE AND CHIU: EXTENDED VC ALGORITHM FOR GENERAL ACCESS STRUCTURES 223 Indication variables, if presents secured, should be equal to 0. This implies that the solution , otherwise , , satisfies Constraint (4). The penalized energy function can , . be used not only to measure whether a solution violates Con- straints (3) and (4) but also to represent how close the solution Construction set, , is to its feasible status. In the proposed SA-based algorithm, we where . will use the penalized energy function to replace the original energy function; Constraints (3) and (4) can, therefore, be omitted during the solution process. It should be noted that for a feasible solution must be less than 1. The proposed iterative improvement framework is as listed in Algorithm 1. Initially, the algorithm starts to find a solution for the given GAS by the procedure with an initial (1) guess in Steps 1 and 2. In each iteration (i.e., from (2) Steps 2 to 10), the algorithm proceeds to find a minimum by decreasing or increasing the value of by 1. If a solution (3) is found (i.e., , denotes the best-found energy function in the last iteration), the algorithm stops while (4) or in the case of , it decreases the value of by 1 and (5) proceeds to the next iteration with the lower . On the contrary, if a solution is not found, the algorithm stops while or it (6) increases the value of by 1 and proceeds to the next iteration Constraint (1) ensures that each share of the while . At the end of the procedure, the algorithm outputs -VCS consists of at least one basis a minimum and a construction set as the optimal solutionshare. Constraint (2) limits each basis share to be assigned of the problem. If no solution can be found for a given accessto at least one participant. Constraints (3) and (4) examine structure, the solution procedure will be terminated whilewhether the construction set obeys the access structure , where is a given parameter that prevents Algorithm . Constraints (5) and (6) limit the ranges of the 1 from falling into an infinite loop.decision variables. Suppose there are participants sharing a secret. If is Algorithm 1: SA-based algorithm for GAS solverknown, there are possible combinations to construct theshare of a participant. The complexity to solve the optimization Procedureproblem is . When and increase, the solution space 1. .of the optimization problem will grow very fast. 2. Call . 3) Algorithm for GAS Solver: In this section, we develop an 3. If then //No solution in last turnalgorithm based on the simulated annealing (SA) [19] approach 4. .to solve the proposed mathematic optimization formulation for 5. IF then Stop and Output “No solutionthe GAS problem. found” We transform and relax the original mathematical model for 6. If then goto Step 11.the GAS solver to simplify solution procedures. Our solution Elseapproach adopts an iterative improvement framework. First, we 7. . //Found a solution in last turntreat the decision variable as a given variable and the original 8. If then goto Step 11.optimization problem is, therefore, transformed into a decision 9. . //Improvementproblem. In each iteration, we try to find a solution with a given 10. End If and refine according to the possibility of a solution being 11. Goto Step 2.found or not. 12. Output , . We continue to relax Constraints (3) and (4) of the proposedmodel by penalizing the energy function. The penalized energy Algorithm 2 presents the pseudocode of the proposedfunction can be defined as follows: SA-based algorithm, . In Step 1, the initial guess can be generated as follows:where and . Here, denotes the amount of The initial guess can satisfy Constraints (1) and (2) at the samea set (which belongs to the qualified set) that can recover the time. Steps 2 and 3, evaluate the value of for the initial guesssecret image. If a solution satisfies Constraint (3), will be and store the results of the initial guess as the current best-found ; otherwise, . Notation represents solution (i.e., and ). Step 4 sets the initial value forthe amount of an insecure forbidden set in . If a solution is annealing parameters and . From Steps 5 to 20, the main loop
  6. 6. 224 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 1, FEBRUARY 2012of the SA heuristic is executed repeatedly. At each state, the so- The second step (i.e., the share synthesizer in Fig. 2) produceslution procedure selects a share , , and alters the I-shares by stacking the basis shares upon construction set .current state of to a neighbor of the current state randomly,except for an empty set. Steps 9 to 17 evaluate the value of the Algorithm 3: Proposed algorithm of share constructorenergy function for the new state and decide whether to acceptthe new state or not. The objective value with the minimum en- Procedure // SI: Secretergy value should be saved as the best-found solution in Step Image15. After solution iterations, the annealing parameters and 1. Encrypting SI by Yang’s -ProbVSS to yield aare modified in Step 19. The solution procedure will be termi- set of basis shares .nated while or a solution without penalty (i.e., ) 2. , ,is found. When the algorithm has stopped, the best-found solu- 3. Output I-shares .tion corresponding to is a solution to this problem,if receives no penalty. Example 4: Suppose there are 4 participants, , sharing a secret image and the qualified set Algorithm 2: Pseudocode of proposed SA-based algorithm . Solving the problem by utilizing the procedure, it can obtain Procedure and construction set . By 1. , , . Yang’s construction rule, the codebook for (3,3)-VCS are 2. Calculate for the above initial guess. 3. , , . 4. , . 5. While and do 6. Repeat times 7. Randomly select a share . 8. Alter the solution configuration of randomly. 9. Calculate for the new configuration. The chosen probability for each 3 1 column vector is 1/4. 10. . Then, and are employed to produce 3 basis shares, , 11. . , and . Finally, distributing basis shares and to partic- 12. Generate a random number uniformly ipants and , respectively, a composite share is generated by distributed in [0, 1). stacking and (respectively, and ) together for partic- 13. If or then ipant (respectively, ). 14. . The shared and recovered images that are constructed in this 15. If then , phase have the following properties. . Property 3: The recovered image has no pixel expansion. 16. If then goto Step 21 Proof: The recovered image is produced by stacking all 17. else recover the action in Step 8. shares constructed by Yang’s -ProbVSS scheme directly. 18. End Repeat Yang has shown that this construction is free of pixel expansion. 19. , . That proves this property. 20. End While Property 4: The black secret pixels can be perfectly recon- 21. Output . structed in the recovered images. Proof: By observing the code distributing patterns, 4) Share Constructors: The share constructor consists of two , it can be found that each columnmodules in Fig. 2: the encryptor and the share synthesizer. The matrix contains at least one “1” (black pixel). Hence, the stackedencryptor adopts Yang’s construction for the -ProbVSS image can reconstruct all the black secret pixels completely.scheme directly (i.e., [6, Construction 3]). Yang’s construction Property 5: The I-shares are secure.rule is summarized as follows: Proof: Because each I-share is composed of the basis shares, this property can be evaluated by the following two Let and be the two white and black sets consisting facts: first, the basis shares are secure. Second, each I-share is of matrices for a -VCS. Then, and only composed of a part of the basis shares. Hence, any single are constructed as I-share cannot reveal anything related to the secret image. That and . Let (respec- proves the security property. tively, ) be the code distributing patterns for white (re- spectively, black) secret pixels. Chosen probability for B. Phase II: Stamping Cover Images and is . In this section, we have proposed a stamping algorithm to The procedure of the share constructor is shown as Algo- stamp cover images on I-shares , that were producedrithm 3. The first step (i.e., the encryptor in Fig. 2) generates in the first phase. There are two major differences between ourthe basis shares by employing Yang’s -ProbVSS scheme. approach and the existing research for the EVCS. First, we put
  7. 7. LEE AND CHIU: EXTENDED VC ALGORITHM FOR GENERAL ACCESS STRUCTURES 225 TABLE Icover images on shares directly rather than redesign a code- NOTATIONS OF ALGORITHM 4book for a specific VC scheme; hence, our approach does notintroduce any pixel expansion in this phase. Second, the blackpixel density of the cover images can be adjusted on demand ina fine-grained fashion. Suppose denotes a collection of pixel colors for I-share , cover image , and secret image in coordinate . Nota-tion expresses there are a white, black, andblack pixels on I-share , cover image , and secret imagein . The stamping algorithm sticks extra black pixels onI-shares where collection of pixel colors isor . That means the stuck black pixels only ap-pear in the region where shared pixels are white and cover pixelsare black. Hence, having more black pixels appear in the region,the cover images can be revealed. Besides, there are two majorissues have to be considered in the algorithm. First, it preservesthe security property for I-shares. Second, it keeps the contrastof reconstructed images as high as possible. To preserve the security condition, on the resultant shares Algorithm 4: Proposed stamping algorithm(called stamped shares), the algorithm has to maintain an equaldensity for cover-pixels between two regions where collection Procedure Stampingof pixel colors are and , re- 1. , calculate for each coordinate .spectively. Otherwise, a portion of the secret image will be dis- 2. , calculate andclosed on stamped shares. To meet this condition, we first cal- .culate the amount of extra cover-pixels for each share. Suppose 3. Calculate for each coordinate . presents the desired density for cover pixels on I-share . 4. ,The amount of extra cover-pixels and will be scattered 5. For downto 1in the regions where and , re- 6. Begin http://ieeexploreprojects.blogspot.comspectively. The amount of cover-pixels are 6.1 Repeat Steps 6.2 to 6.8 times 6.2 Randomly select a coordinate where and 6.3 6.4 If then goto Step 6.1respectively, where and denote the amount of pixels 6.5 For toin the regions where and , 6.6 Beginrespectively. In the stamping phase, we randomly add and 6.6.1 If and then cover pixels on their corresponding regions of I-share , Add a black pixel in of , .the cover image can be displayed, and the security condition 6.6.2 If and thenof resultant shares can be satisfied. Add a black pixel in of , . Because the cover and secret images are binary images, 6.7 EndForadding extra black pixels on I-shares may increase the black 6.8 If and then gotopixels in the white region of the recovered image. Thus it may Step 9.decrease the contrast of the image. Hence, the stamping algo- 7. EndForrithm tries to add black cover-pixels on the same coordinate of 8. If or then gotoeach I-share to reduce the overall number of extra cover-pixels Step the recovered image. Notation denotes overlapped 9. , Output as stamped shares .frequency of black cover-pixels at coordinate . Notation means there are cover images which have a blackpixel at . Before scatter cover pixels on I-shares, we first Steps 1–3 calculate all required parameters. Step 4 initializescalculate for each coordinate. According to the value of indicators for all coordinates. Steps 5–7 stamp cover pixels , randomly select candidate coordinates from the region on in iterations. In Step 6.2, each coordinate will be ran-where to add extra cover pixels to I-shares. In domly selected once at most based on its priority . In Stepthis manner, coordinates with larger have higher priority 6.4, the use of constant and function can avoid theto be added cover pixels. This method ensures that cover pixels clustering of cover-pixels in coordinates with higher priority.have a high probability of being allocated to the same coordi- Constant ranges between 0.7 and 1.0. Steps 6.5–6.7 add covernate such that the contrast value of the recovered image is high. pixels on selected coordinates of on demand.A detailed description of the stamping algorithm is provided in Please note that black cover-pixels will only be added on can-Algorithm 4. Table I lists the notations included in Algorithm 4. didate coordinate of that has a white pixel on it (i.e.,
  8. 8. 226 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 1, FEBRUARY 2012 (6,5) and (8,5) in . Parameters were updated as , , , and . In Step 8, because the stopping condition is not satisfied, the algorithm continues to perform the second round stamping process. In the first iteration of the second round, coordinates (3,4), (8,8), (6,6), and (5,8) were chosen and cover pixels were added on . Parameters were updated as and . In the second iteration, the coverFig. 3. Example of Algorithm 4. (a) Parameter , (b) secret image, (c) cover pixel was added to coordinate (6,4) in . Finally, the resultantimage 1, (d) cover image 2, (e) I-share , (f) I-share , (g) stamped share , shares and were produced and then the algorithm stopsand (h) stamped share . In (g) and (h), grids filled with gray (black) color because of the stopping condition is reached.represent shared (cover) pixels. An example of resultant shares and are shown in Fig. 3(g) and (h). Obviously, the contrast of cover image on ). Step 6.6.1 (Step 6.6.2) adds an extra cover shares and are high enough to reveal the cover images.pixel to if the desired density for cover image in the regionof black (white) secret pixels does not reach (i.e., parameter IV. EXPERIMENTAL RESULTS is greater than zero). In Step 8, if the required densitiesof cover-pixels is not reached in corresponding share, the algo- In this section, we first evaluate the performance of the pro-rithm performs Steps 4–7 again until all required cover-pixels posed optimization model by comparing with the previous VCare stamped on shares . Step 9 outputs all the resultant results for GASs. Then, we assess the performance of the pro-stamped shares . posed encryption algorithm for EVCS in terms of the contrast of The main loop (i.e., Steps 4–7) comprises the majority of the the recovered secret images. Finally, we demonstrate the resultsalgorithm’s time complexity. The execution time of the loop de- of our implementation of EVCS by examples.pends on the selection of a random number generator and con- A. Performance of GAS Solverstant . In the best case, the main loop will be only executed onetime, the time complexity of the algorithm is where The proposed algorithm for GAS solver is coded in lan-and are the height and width of a secret image, respectively. guage. The parameters of the cooling schedule for AlgorithmSuppose the loop will be executed times in the worst case; the 1 are and . The initial values includetime complexity of the stamping algorithm is . Be- and . The frozen temperature is .sides, in order to uniformly distribute cover pixels over shares, In the following subsections, we examine the performancesall images are divided into smaller blocks (e.g., 8 8 pixels) at of the GAS solver in two different VC scenarios and comparethe beginning of the algorithm. them with Ateniese’s and Liu’s results. In both comparisons, we Example 5: Suppose there are 2 participants, , test all strong access structures with up to four participants assharing a secret image and the qualified set . listed on [10, Table 1].The example images are shown in Fig. 3. The incremental pixel 1) Comparison With Conventional VCS for GASs: First, wedensities of the cover image for the 2 participants are test the conventional VCS scenario restricting each participant and . to hold a single share image for sharing one secret image. The From Fig. 3, we have , , , and solution results of the proposed GAS solver are listed in Table II. . By using Step 2, we can calculate In Table II, all strong access structures have a corresponding , , construction set , which means that a pixel-expansion-free , and . Parameter for each VCS for one of these access structures can be constructed viacoordinate can be expressed as Fig. 3(a). a -VCS. In the first iteration, coordinates where have Fig. 4 illustrates the implementation results for minimalthe highest priority to be candidates for adding cover pixels. qualified set 5. The secret image can be revealed by stackingSuppose coordinate (1,5) is chosen and the collections of pixel qualified participants, as shown in Fig. 4(f). However, itcolors are [note: I-shares and are cannot be accessed by any forbidden participants, as shown inshown in Fig. 3(e) and (f)], when the algorithm starts. Hence, a Fig. 4(g) and (h). It proves the effectiveness of the proposedcover pixel is added to the coordinate in I-shares and at the GAS solver algorithm.same time. The values of and are also updated to 7 and 7, Although Ateniese has proved that their VC-based approachrespectively. Afterward, in the rest of the iteration, coordinates has optimal pixel expansion, his approach still results in pixel(3,6), (2,8), (1,6), (3,7), (7,8), (6,7), and (4,5) were chosen; expansion of 2–8 times, as listed on Table II. Our proposed al-according to the collections of pixel colors, there are 7 and 5 gorithm can totally remove the pixel expansion; hence, our ap-cover pixels added to and , respectively. Coordinates (6,7) proach is superior to Ateniese’s method in terms of the pixeland (7,8) in share cannot be added black pixels, because of expansion.there are black shared pixels on it. Parameters were updated 2) Comparison With Liu’s Scenario: In the second compar-as , , , and . Next, in the second ison, we adopt Liu’s scenario that allows each participant toiteration (i.e., ), coordinates (2,2), (3,3), (6,5), and (8,5) carry multiple share images for sharing one secret image. Forwere chosen; two cover pixels were added to coordinates (2,2) fairness, before the start of the encryption process, the minimaland (3,3) in and two cover pixels were added to coordinates qualified sets listed on Table II are also partitioned into several
  9. 9. LEE AND CHIU: EXTENDED VC ALGORITHM FOR GENERAL ACCESS STRUCTURES 227 TABLE II TABLE IIISOLUTION RESULTS AND COMPARISONS FOR CONVENTIONAL VCS FOR GASs OUR OUTCOMES BY COMBINING LIU’S PARTITION RESULTS : Pixel expansion factor. and denote Ateniese’s and our results, respectively. Note: The qualified sets with prepartitioning are the same as those listed on Table II TABLE IV COMPARISON BY PIXEL EXPANSION OF RECOVERED IMAGE http://ieeexploreprojects.blogspot.comFig. 4. A parts of Implementation results for minimal qualified set 5. (a) Secretimage; (b) share 1; (c) share 2; (d) share 3; (e) share 4; (f) shares 1 2; (g) shares1 3; (h) shares 1 4.subsets, which are the same as Liu’s partitioning results. The dif-ferent parts of the qualified sets are separated by a semicolon,as shown in Table II. Table III lists our solution outcomes by combining Liu’sprepartitioning results. Due to the prepartitioning, a qualifiedset is divided into several smaller subsets; hence, each subsetcan be solved by employing the previous solution results. Forexample, in Table III, the minimal quality set 5 can be dividedinto and . Hence, the construction performance in terms of pixel expansion for recovered imagesresult for minimal quality sets 1 and 2 can be adopted for and APE for shares. and , respectively. The results listedin Table III indicate that our solution approaches can also be B. Contrast of Images Recovered by EVCSapplicable to Liu’s encryption scenario. In this subsection, we evaluate the performance of the EVCS Table IV shows that Ateniese’s and Liu’s approaches have the algorithm by the contrast of recovered images. Cover imagessame pixel expansion for the recovered image. By combining and the secret image for this experiment are shown in Figs. 6 andLiu’s partition results, Ateniese’s approach can have a smaller 7. All figures are in 512 384 pixels and have been reduced topixel expansion factor than his own previous results in some ac- 25% of the original size due to space limitation. The incrementalcess structures. Our approach is still pixel-expansion-free which pixel density for the cover image is set at the same valuemeans that by applying our method, the dealers do not need to in this experiment.resize their shares before decryption. Table IV also indicates that Table V lists a part of the contrast value of the recovered im-all the approaches have the same contrast values for the recov- ages. The resultant contrast values are compared with the the-ered images. Fig. 5 shows that our approach has minimal av- oretical upper bound of the recovered image. Obviously, theseerage pixel expansion for shares. The above comparison results contrast values obtained by the proposed EVCS algorithm aredemonstrate that the proposed encryption approach has a great very close to its upper bound. Actually, the use of the stamping
  10. 10. 228 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 1, FEBRUARY 2012 TABLE V CONTRAST (%) OF RECOVERED IMAGES Fig. 5. Comparison of average pixel expansion (APE).Fig. 6. Cover images used for experiments. (a) Cover image 1; (b) cover image2; (c) cover image 3; (d) cover image 4. Fig. 7. Secret image used for experiments.algorithm reduces only slightly the contrast of the recovered im-ages. This degradation is proportional to the parameter re-gardless of the VCS’s access structure. This verifies the effec-tiveness of the proposed stamping algorithm.C. Demonstration of Our Results for EVCS In this subsection, we demonstrate the implementation re-sults of the proposed construction algorithm for the conven-tional EVCS. To evaluate whether the stamping algorithm canbe applied to various types of cover images, cover images 1 isreplaced with the inversed version of Fig. 6(a). Cover images 2 Fig. 8. Implementation results for minimal qualified set 4 in Table II. (a) Coverand 3 are as presented in Figs. 8(a) and 6(c), respectively. image 2; (b) share 1; (c) share 2; (d) share 3; (e) shares 1 2; (f) shares 1 3; (g) shares 2 3; (h) shares . The implementation results of access structure 4 in Table IIare shown in Fig. 8. The parameters for cover images1, 2, and 3 are set to 15%, 20%, and 20%, respectively. the feasibility of our hybrid approach. This indicates that anFig. 8(b), (c), and (d) show that the cover images can be excellent display quality of the recovered images is possible bystamped and can be clearly revealed on meaningless shares. employing the proposed stamping algorithm.Fig. 8(e), (f), and (g) cannot display any information related to The proposed stamping algorithm may result in some dimthe secret image due to the forbidden combinations of decryp- traces of cover images on the recovered images. There are threetion. On contrary, the qualified set can recover the ways to remove or conceal the traces to promote the displaysecret image, as shown in Fig. 8(h). This example demonstrates quality for recovered images. First, use graphs drawn by lines
  11. 11. LEE AND CHIU: EXTENDED VC ALGORITHM FOR GENERAL ACCESS STRUCTURES 229be the cover images, for example, the cover images in Fig. 6. [5] C. Blundo, P. D’Arco, A. D. Santis, and D. R. Stinson, “Contrast op-Second, adjust the density of cover images as low as possible. timal threshold visual cryptography schemes,” SIAM J Discrete Math., vol. 16, pp. 224–261, 2003.Finally, adopt a pair of complementary images to be the cover [6] C. N. Yang, “New visual secret sharing schemes using probabilisticimages in each qualified set. This method was also used in [20]. method,” Pattern Recognit. Lett., vol. 25, pp. 481–494, 2004. [7] C. Blundo, S. Cimato, and A. D. Santis, “Visual cryptography schemes with optimal pixel expansion,” Theor. Comput. Sci., vol. 369, pp. V. CONCLUSION 169–182, 2006. In this paper, we have proposed a two-phased encryption al- [8] D. Wang, L. Zhang, N. Ma, and X. Li, “Two secret sharing schemes based on boolean operations,” Pattern Recognit., vol. 40, pp.gorithm for the EVCS for general access structures. From the 2776–2785, 2007.point of view of pixel expansion, our approach successfully [9] P. L. Chiu and K. H. Lee, “A simulated annealing algorithm for generalsolves the open questions. The experimental results also show threshold visual cryptography schemes,” IEEE Trans. Inf. Forenics Se- curity, vol. 6, no. 3, pp. 992–1001, Sep. 2011.that in most of the cases, our approach has better performances [10] G. Ateniese, C. Blundo, A. D. Santis, and D. R. Stinson, “Visual cryp-than those proposed in previous research in terms of the display tography for general access structures,” Inform. Comput., vol. 129, pp.quality of the recovered image, which includes contrast, perfect 86–106, 1996. [11] C. S. Hsu and Y. C. Hou, “Goal-programming-assisted visual cryp-reconstruction of black secret pixels, and maintenance of the tography method with unexpanded shadow images for general accesssame aspect ratio as that of the original secret image. structures,” Opt. Eng., vol. 45, no. 9, p. 097001-1, 2006, (10 pages). The proposed algorithm has four advantages. First, the algo- [12] C. S. Hsu, S. F. Tu, and Y. C. Hou, “An optimization model for vi- sual cryptography schemes with unexpanded shares,” Found. Intelli-rithm is a generic approach. It can construct the EVCS for gen- gent Syst., LNAI, vol. 4203, pp. 58–67, 2006.eral access structures without the need to design a sophisticated [13] F. Liu, C. Wu, and X. Lin, “Step construction of visual cryptographycodebook. The second advantage is the modularity. Each phase schemes,” IEEE Trans. Inf. Forensics Security, vol. 5, no. 1, pp. 27–38, Mar. the encryption procedure is less coherent, so it can be indi- [14] G. Ateniese, C. Blundo, A. D. Santis, and D. R. Stinson, “Extendedvidually designed and also can be replaced separately. The third capabilities for visual cryptography,” Theor. Comput. Sci., vol. 250,advantage is the first phase of the proposed algorithm: this phase pp. 143–161, 2001. [15] W. P. Fang, “Friendly progressive visual secret sharing,” Patternis applicable not only to the extended VC schemes but also to Recognit., vol. 41, pp. 1410–1414, Apr. 2008.the conventional VC schemes. The fourth advantage is that be- [16] T. H. Chen and Y. S. Lee, “Yet another friendly progressive visualcause the density of the cover images is adjustable, it is very secret sharing scheme,” in Proc. 5th Int. Conf. Intelligent Information Hiding and Multimedia Signal Processing, 2009, pp. 353–356.helpful for modifying the display quality of the cover images. [17] D. Wang, F. Yi, and X. Li, “On general construction for extended visual The major contributions of our work are as follows: First, cryptography schemes,” Pattern Recognit., vol. 42, pp. 3071–3082,this is the first solution that addresses the pixel problem of the Nov. 2009. “Plane transform visual cryptography,” in Proc. [18] J. Weir and W. Yan,EVCS for general access structures. Second, we formulate the 9th Int. Workshop Digital Watermarking (IWDW2010), Seoul, Korea,construction problem of VCS for general access structures as a Oct. 2010, pp. 60–74.mathematical optimization problem such that the problem can [19] S. Kirkpatrick, C. D. Gelatt, and M. P. Vecchi, “Optimization by sim- ulated snnealing,” Science, vol. 220, pp. 671–680, solved by optimization techniques. Third, we have developed [20] Z. Zhou, G. R. Arce, and G. D. Crescenzo, “Halftone visual cryptog-a hybrid method for EVCS constructions. By adopting the pro- raphy,” IEEE Trans. Image Process., vol. 15, no. 8, pp. 2441–2453,posed stamping algorithm, all existing VC schemes can be mod- Aug. 2006.ified to form their extended VC schemes without redesigning Kai-Hui Lee received the Ph.D. degree in electroniccodebooks. engineering from the National Taiwan University of Science and Technology, Taipei, Taiwan, in 2002. ACKNOWLEDGMENT He joined the Department of Computer Science and Information Engineering, Ming Chuan Uni- The authors gratefully acknowledge the helpful comments versity, Taipei, Taiwan, as an associate professor in 2003. His current research interests includeand suggestions of the reviewers, which have improved the pre- visual cryptography, wireless networks, and networksentation. And they are especially grateful to Prof. Carlo Blundo resource managements.for his kind help during the review process of this paper. REFERENCES [1] M. Naor and A. Shamir, “Visual cryptography,” in Proc. Advances in Cryptology (Eurprocrypt’94), 1994, pp. 1–12. Pei-Ling Chiu received the Ph.D. degree in informa- [2] E. R. Verheul and H. C. A. v. Tilborg, “Constructions and properties tion management from the National Taiwan Univer- of k-out-of-n visual secret sharing schemes,” Designs Codes Crypto., sity, Taipei, Taiwan, in 2007. vol. 11, pp. 179–196, 1997. She joined the Department of Risk Management [3] H. Koga, “A general formula of the (t,n)-threshold visual secret and Insurance, Ming Chuan University, Taipei, sharing scheme,” in Proc. Advances in Cryptology (Asiacrypt), 2002, Taiwan, as an associate professor in 2008. Her pp. 328–345. research focuses on visual cryptography, wireless [4] A. Adhikari and S. Sikdar, “A new (2, n)-visual threshold scheme for sensor networks, and optimizing technologies. color images,” in Proc. INDOCRYPT 2003, Berlin, Germany, 2003, pp. 148–161.