Public-key image steganography using discrete cosine transform and quadtree partition vector quantization coding

Transcription

1 Public-key image steganography using discrete cosine transform and quadtree partition vector quantization coding Wen-Yuan Chen Chin-Hsing Chen National Cheng Kung University Department of Electrical Engineering 1 University Road Tainan 70101, Taiwan wenyuanc@ms77.hinet.net Abstract. A public-key image hiding scheme is proposed to offer safe exchange of a stego image on the Internet. In the proposed scheme, the secret image is first compressed by quadtree partition vector quantization (QPVQ) coding into the indices bit stream, which is then embedded into the discrete cosine transform (DCT) of the cover image. In the embedding process, adaptive quantization and appropriate DCT coefficients are used to enhance the imperceptibility of the stago image. On the other hand, the Rivest, Shamir, and Adleman (RSA) algorithm is hired to provide the mechanism of a public-key system for secure communication on the Internet. Our proposed method has two advantages compared with other data hiding techniques. One is the high safety and convenience offered by the RSA system to exchange data on the Internet. The other is that the stego image can pass through high-quality Joint Photograph Experts Group (JPEG) compression without noticeable degradation Society of Photo-Optical Instrumentation Engineers. [DOI: / ] Subject terms: public key; cover image; stego image; Joint Photograph Experts Group (JPEG); Rivest, Shamir, and Adleman algorithm; hamming code. Paper received Feb. 17, 2003; revised manuscript received Mar. 24, 2003; accepted for publication Mar. 25, Introduction The Internet provides a convenient and efficient tool for human life. A person can exchange data with other people in the world through the Internet. While people benefit greatly from the Internet, they also encounter many serious problems within it. One biggest concern is the security of data transmission. The secrecy of documents, products, and multimedia including audio, image, video, or text can be lost if attacked or tampered by illegal users. To remedy the drawback of data communication on the Internet, many data security techniques have been proposed. In general, there are two types of data security schemes: steganography and watermarking. Steganography techniques 1 5 conceal secret data, so that no one can find it. Watermarking techniques 6 9 usually conceal a logo and publish it. We propose a data hiding scheme for image camouflage, in which a secret image is concealed into a cover image of the same size. A direct secret data hiding method usually conceals the secret bits into bits of each pixel of the cover image. Leastsignificant-bit LSB substitution is a popular method for this purpose. Although embedding data in LSB is hard to be perceived in the cover image, it is easily lost under truncation space processing. Lie and Chang 10 proposed a method based on the human visual system to embed a series of secret data into a cover image. The embedding process is achieved via the adaptive number of least significant bits. In their approach, a higher hiding efficiency is obtained by using the concept of a selfcontained number of LSB under the constraint of human visual perception. In the extracting process, the secret data can be extracted without the knowledge of the original cover image. Wang, Lin, and Lin 11 published a method of hiding data in images by optimal moderately significant bit MSB replacement. They presented a scheme consisting of ciphering, optimal substitution, and pixel adjustment to implement the hiding process. However, embedding secret data in the MSB is accompanied by paying the price of degradation of the cover image quality. An approach using image binary tree encoding and image smoothing to obtain data hiding was proposed by Hou and Chiao. 12 They created a binary tree code for a smooth secret image and embedded them into the cover image by bit replacement. In their approach, concealing a bigger image in a smaller image becomes possible, and data with different types image, audio, video, and text can be used as the secret data. Wu and Tsai 13 published an image data hiding method employing multiple-based number conversion and lossy data compression. A stego image is obtained by embedding secret data into selected pixels with a capacity determined by the difference of the cover image and the lossily processed cover image. In the extracting process, the original cover image is required to extract the secret data. Chen, Chang, and Hwang, 14 presented a vector quantization method with a data encryption standard DES cryptosystem to hide the secret image. In this method the secret image and the cover image are first reorganized by vector quantization, then the indice bit stream is generated. For 2886 Opt. Eng. 42(10) (October 2003) /2003/$ Society of Photo-Optical Instrumentation Engineers

2 security purposes, the DES cryptosystem is adopted to encrypt the indice bit stream. Although many methods have been proposed for hiding secret data that include audio, video, and text with the hiding capacity unceasingly enlarged, none of these methods is particularly suitable for Internet application. We present a novel data hiding scheme aimed at camouflaging images exchanged on the Internet by employing the Rivest, Shamir, and Adleman RSA public-key algorithm. The scheme promotes the security of the Internet significantly. In addition to the RSA public-key system, discrete cosine transform DCT and quadtree partition vector quantization QPVQ 15 coding are employed to construct a secure and efficient data hiding scheme that can pass through highquality Joint Photograph Experts Group JPEG compression for the Internet. The remainder of this work is organized as follows. In Sec. 2, the RSA public-key steganography system is presented. The proposed data-embedding algorithm is presented in Sec. 3. The data extracting process from the stego image is illustrated in Sec. 4. Empirical tests and security analysis are presented in Sec. 5. Finally, Sec. 6 concludes this work. 2 RSA Public-Key Steganography System Pioneer research by Diffie and Hellman 16 introduced a new approach to cryptograph that met the requirements for public-key systems. 17 One of the first responses to the challenge was the work by Rivest, Shamir, and Adleman RSA, 18 published in The RSA scheme is a block cipher where plain text and cipher text are integers between 0tono 1 for some no. In practice, the block size is 2 h bits and 2 h no 2 h 1. In encryption, the plain text message psw is translated into ciphertext rndsed by rndsed psw e mod no. 1 In description, the cipher text rndsed is translated back to the plain text psw using psw rndsed d mod no, psw e d mod no, psw ed mod no. 2 In Eqs. 1 and 2, the numbers e and no constitute the public key, and the numbers d and no constitute the private key, respectively. The RSA key pair (e,d) can be found as follows. First we choose two bigger strong prime numbers p, q, and no pq. Then we find e such that gcd (no),e 1 where 1 e (no) and d e 1 mod (no). However, to find the key pair is unfeasible. In our steganography system, the sender uses the password psw to generate the three PN sequences used in the embedding process. On the other hand, the receiver uses rndsed to recover the password psw used to generate the same three PN sequences in the extracting process. The proposed steganography system is outlined in Fig. 1. In the sending end, the secret image S, the cover image X, the password psw, and the public key e are processed by the Fig. 1 The proposed steganography system: (a) the embedding process and (b) the extracting process. system to generate the stego-image R and the random seed rndsed. After the stego-image R is formed, it is compressed by JPEG into R c, which is sent along with rndsed to the receiver, as shown in Fig. 1 a. At the receiving end, the received stego-image R c is decompressed into R. The R, the rndsed, and the private key d are processed by the system to generate the recovered secret image S, as shown in Fig. 1 b. 3 Data Embedding Algorithm A steganography scheme must be extremely secure to all kinds of attacks, and at the same time not reduce the visual quality of the cover image when the secret image is concealed. The overall concealing process of our proposed scheme is shown in Fig. 2. The secret image S was encoded by QPVQ into the bit stream m. A chaotic mechanism CM in Ref. 8 was used to hash m into m c to enhance security. The bit stream m c is transformed into its corresponding hamming code m h with error correction power. On the other hand, the cover image X is JPEG preprocessed to generate X. The X is then forward discrete cosine transform FDCT transformed to Xˆ, of which blocks are one-by-one randomly selected for the following parity check embedding PCE process. In PCE, 16 coefficients of a selected block B are used for embedding the same number of secret bits from m h. The resultant image Xˆ after embedding is then inversely transformed to obtain the stego-image Rˆ by inverse discrete cosine transform IDCT. The details of the blocks of Fig. 2 are described in the following. 3.1 Quadtree Partition Vector Quantization Encoding To conceal a big secret image into a cover image of the same size, compressing the secret image is necessary. Vector quantization VQ coding is a good choice for this purpose due to its large compression ratio and high reconstructed image quality. 15 Before VQ coding, an image partition is usually performed to improve the rate-distortion performance. We adopt the quadtree partition method 15 to divide an image into blocks of difference sizes according to the activity in the blocks. Consider an image block of size b b expressed as X x 1,x 2,...x j ; j b 2. Let X, X H, and X L represent the block mean, the upper mean, and the lower mean, respectively, defined as Optical Engineering, Vol. 42 No. 10, October

3 Fig. 2 The flow chart of the embedding process. X H 1 q x i, for x i X X L 1 j q x i, for x i X S X H X L, where q is the number of pixels whose intensity is equal to or greater than the block mean, and S is the quadtree partition decision threshold. In the top-down quadtree partition scheme, the original input image is first divided into blocks of size The value of S of each block is then calculated. If it is greater than the threshold value S th, the block is further subdivided into four blocks of size 8 8. By the rule, high-activity blocks will be finally divided into blocks of size 4 4. Smaller threshold values result in higher reconstructed image quality but lower compression ratio, while large threshold values do the opposite. According to our experience, 15 threshold value S th 20 is used in this work. An example of the quadtree partition is given in Fig. 3. In quadtree partition VQ coding, four separate codebooks are designed. One for blocks, one for 8 8 blocks, one for low-activity 4 4 blocks, and one for highactivity 4 4 blocks. For a secret image, four set indices ind 16, ind 8, ind 4, and ind 4n are generated from the four codebooks. Additionally, another set of indices ind q is generated for encoding the quadtree information. Thus the output bit sequence m of the QPVQ block in Fig. 2 is given by ind q, ind 16, ind 8, ind 4, and ind 4n. The flow chart of the quadtree partition VQ scheme is shown in Fig Chaotic Mechanism In data hiding, we hope the data is chaotic. Because chaotic data is more protected from being stolen or attacked. The VQ indices obtained from the secret image by quadtree partition VQ are already in the encrypted form, and a Fig. 3 An example of the quadtree partition: (a) the original image, (b) after the first partition, and (c) after the second partition. Fig. 4 The flow chart of the QPVQ encoding Optical Engineering, Vol. 42 No. 10, October 2003

4 Table 1 The adaptive quantization table used in our scheme. Q Q 1 Q 2 Q 3 Q 4 Q 5 Q 6 Q 7 Q 1 Q 2 Q 3 Q 4 Q 5 Q 6 Q 7 Q 8 Q 2 Q 3 Q 4 Q 5 Q 6 Q 7 Q 8 Q 9 Q 3 Q 4 Q 5 Q 6 Q 7 Q 8 Q 9 Q 10 Q 4 Q 5 Q 6 Q 7 Q 8 Q 9 Q 10 Q 11 Q 5 Q 6 Q 7 Q 8 Q 9 Q 10 Q 11 Q 12 Q 6 Q 7 Q 8 Q 9 Q 10 Q 11 Q 12 Q 13 Q 7 Q 8 Q 9 Q 10 Q 11 Q 12 Q 13 Q 14 Table 2 The 16 embedded coefficients of a DCT block with P 6. P 1 P 9 P 10 P 2 P 8 P 11 P 3 P 7 P 12 P 4 P 6 P 13 P 5 P 14 P 15 P 16 hacker may still attack it. Therefore, a chaotic mechanism is hired to hash the VQ indices. Once the VQ indices are chaotic, it is difficult for a hacker to attack, and security is promoted. In this work, a fast pseudorandom number traversing method is used as the chaotic mechanism to permute the VQ indices. The bit sequence after permutation is related to the bit sequence before permutation by m p i m i, 1 i,i F, i permutation i, where F is the length of the bit sequence. The permutation operation in Eq. 7 is accomplished by the PN1 sequence. 3.3 Hamming Error Correction Code We hide the secret data bits in the DCT coefficients of the cover image. In the extracting process, bit errors occur due to the truncation error between FDCT and IDCT if the stego image is compressed. The errors reduce the quality of the reconstructed secret image, therefore decreasing the bit error is necessary. The Hamming error correction code of a message consists of the message bits and the parity check bits, which are the products of the message and the generator matrix. The error correcting ability of a hamming code is achieved by inspecting the syndrome calculated by multiplying the received vector with the parity check matrix. The efficiency of a hamming code is given by 6 7 2r 1 r 2 r 1 1 r n, 8 where r and n denote the length of the message and the hamming code, respectively. In this paper, we use r 4 and n 11 with efficiency 7/11 to convert the secret bits sequence m c into its corresponding hamming code sequence m h. 3.4 Parity Check Embedding In the embedding process, the cover image X is first passed through the JPEG preprocessor to generate X. X is then divided into nonoverlapping 8 8 blocks, each of which is transformed into a block of DCT coefficients of the same size. The DCT coefficients are quantized using the adaptive quantization table shown in Table 1, in which an appropriate value of Q is chosen for a cover image. The PN2 sequence is used to hash the DCT blocks into random order for the following PCE processing. The PN2 sequence is generated by using the same random seed used in the PN1 sequence with an offset. An illegal user without the private key to generate the PN2 sequence could not extract the block order correctly even though he knows the embedded position exactly. The PCE process of each block embeds 16 secret bits in the 16 DCT coefficients selected by the zigzag-order pattern indicated in Table 2, in which a proper value of parameter P is selected for a cover image. Since the selected 16 Fig. 5 The flowchart of the extracting process. Optical Engineering, Vol. 42 No. 10, October

5 Fig. 6 The flowchart of IQPVQ. coefficients are located in the lower and middle bands, the embedding scheme will pass the JPEG high-quality compression test. In the PCE process, the parity check bit is located at the least significant bit denoted as b1 of the 8-bit DCT coefficient. If the odd parity is adopted, the embedding process is as follows. If the secret bit m h is 1, then bits 4 to 7 are configured as odd parity, and are otherwise configured as even parity. That is, when m h 1, then b1 1 if b7 b6 b5 b4 0, and 0 if b7 b6 b5 b4 1. Similarly, when m h 0, then b1 0 ifb7 b6 b5 b4 0, and 1 if b7 b6 b5 b4 1. The parity of the previous embedding procedure is fixed. As a result, it is easy for a hacker to extract. To avoid this drawback, a sequence PN3 is used to generate a random number for each secret bit to be embedded. The secret bit is then embedded according to the parity of its associated random number. 4 Data Extracting Algorithm A process that inverses the concealing process is used to recover the original secret image. The flow chart of the recovering process is shown in Fig. 5. The stego-image R is transformed to Rˆ by FDCT. The PN sequence PN2 used in the concealing process is used to select the embedded block B from Rˆ for secret bit extracting SBE. All the secret bits extracted from the block sequence B in SBE are concatenated from the bit sequence m h. m h is then contracted by an inverse hamming code IHC into m c, followed by an inverse chaotic mechanism ICM into Fig. 8 (a) The stego-image Baboon and (b) the recovered secret image Lena. m. By passing m through the inverse quadtree partition vector quantization IQPVQ process, shown in Fig. 6, the secret image S is recovered. 5 Empirical Test and Security Analysis 5.1 Empirical Test According to the human visual system, some amount of distortion between the cover image and the stego image are allowed. We employ the PSNR to indicate the degree of transparency. The PSNR is given by PSNR 10 log N N i 0 N 1 N 1 j 0 X i, j R i, j 2, where X i, j and R i, j, are the grayscale values of the cover image and the stego image of size N N, respectively. Figures 7 a and 7 b show the stego-image Lena and the extracted secret image F16, respectively. Figures 8 a and 8 b show the stego-image Baboon and the recovered secret image Lena, respectively. The PSNRs of the stego image and the recovered secret image for both cases are shown in Table 3. Table 4 shows the detail information of the secret images of the proposed scheme for both cases. Photoshop 6.0 was used in the JPEG preprocess for both cases. According to Table 4, we found that the number of error bits of the extracted secret image F16 within the stego-image Lena under a JPEG level-9-quality attack is four without the hamming code but only one with. Similarly, the number of error bits of the extracted secret image Lena within the stego-image Baboon under a JPEG level- 9 Table 3 The PSNR of the stego image and the recovered secret image. Cover image Secret image PSNR of the secret image before embedding PSNR of the secret image after extraction PSNR of the stego image Fig. 7 (a) The stego-image Lena and (b) the recovered secret image F16. Lena F Baboon Lena Optical Engineering, Vol. 42 No. 10, October 2003

6 Table 4 Comparison of the number of error bits of the recovered secret image with and without the hamming code. Secretimage Parameter Q Parameter P Number of error bits without error correction Number of error bits with error correction PSNR degradation F db Lena db 9-quality attack is 17 without the hamming code but only three with. The degradation in PSNR of the extracted secret images F16 and Lena are only 0.05 and 0.04 db, respectively. Figure 9 shows the PSNRs of the secret images F16 and Lena extracted from the stego-image Baboon under JPEG attacks. Figure 10 shows the number of error bits of the secret images F16 and Lena extracted from the stegoimage Baboon under JPEG attacks. 5.2 Security Analysis In our scheme, a cover image is used to camouflage a secret image to form a stego image. Since the distortion between the cover image and the stego image is insignificant, an illicit user cannot sense any hint in the stego image, even if he possesses it. Besides, our system employs several security techniques to protect images from attacks. The security issue of our system is analyzed as follows. 1. The quadtree partition VQ coding technique is employed to compress the secret image into indices and scramble them into chaotic data. This chaotic processing, like encryption of cryptology, promotes the security of the secret image. However, any illicit user wanting to break it would need to make 6500 runs of trial and error for a VQ of 6500 indices from a image. 2. In the embedding process, the cover image was divided into 4096 nonoverlapping 8 8 DCT blocks. The proper block into which a secret bit is embedded is decided by the PN2 sequence. However, the PN2 sequence is generated by the random number seed of the secret key, and an illegal user would need 4096 tries to break the key. 3. In this work, the hamming code was used to correct one bit error. Parity check and message bits used to construct the hamming code is like another kind of cryptology system. As far as secrecy is concerned, an illegal user without knowing the rule is unlikely to decode the hamming code correctly. 4. The RSA algorithm is based on the factorization problem, which is very hard to solve even now. Therefore, the RSA algorithm sustains all kinds of attacks very well The encryption decryption systems, digital signatures, and public systems usually hire the RSA algorithm as a core skill. The RSA public-key algorithm, used in our method, enhances the convenience and security for the internet. This above analysis shows that the proposal method is strong in security, because if an illicit user wants to get the secret image, he must break through all of items listed. An illicit user without private keys needs a number of computer runs equal to the multiplication of all the individual numbers of the previous items to break the system. How hard it woule be! 6 Conclusion We propose a data hiding scheme that is imperceptible when a big image is concealed in a cover image. As in other systems, imperceptibility and security are essentially compromised in ours. However, there are two advantages Fig. 9 The PSNR of the secret images F16 and Lena extracted from the stego-image Baboon under JPEG attacks. Fig. 10 The number of error bits of the secret images F16 and Lena extracted from the stego-image Baboon under JPEG attacks. Optical Engineering, Vol. 42 No. 10, October

7 of our system over others. One is that the stego image generated by our method can pass through high-quality JPEG compression before being sent to customers. The other is that the RSA public key of our system provides a safe and convenient environment for the Internet. How to increase the stego-image compression ratio by JPEG without degradation and increase the number of secret bits concealed in the cover image imperceptibly are our next investigations. Acknowledgment The authors would like to take this opportunity to thank the anonymous reviewers for their valuable suggestions. References 1. L. M. Marvel, C. G. Boncelet, Jr., and C. T. Retter, Spread spectrum image steganography, IEEE Trans. Image Process. 8 8, R. J. Anderson and F. A. P. Petitcolas, On the limits of steganography, IEEE J. Sel. Areas Commun. 16 4, J. Fridrich, M. Goljan, and R. Du, Deteting LSB steganography in color and gray-scale images, IEEE Trans. Multimedia 8 4, R. Chandramouli and N. Memon, Analysis of LSB based image steganography techniques, Proc. Image Process. 3, G. Mastronardi, M. Castellano, and F. Marino, Steganography effects in various formats of images, Int. Workshop Intell. Data Acquisition Adv. Computing System: Technol. Appl., pp I. J. Cox, J. Kilian, F. T. Leighton, and T. Shamoon, Secure spread spectrum watermarking for multimedia, IEEE Trans. Image Process. 6 12, C. D. Vleeschouwer, J. F. Delaigle, and B. Macq, Invisibility and application functionalities in perceptual watermarking An overview, Proc. IEEE 90 1, C. T. Hsu and J. L. Wu, Hidden digital watermarks in images, IEEE Trans. Image Process. 8 1, H. M. Chao and Y. S. Tsai, A bi-polar multiple-base data hiding technique on information security and authentication, IPPR Conf. Comput. Vison, Graphics Image Process., pp W. N. Lie and L. C. Chang, Data hiding in image with adaptive numbers of least significant bits based on the human visual system, IEEE Intl. Conf. Image Process., 28, Oct R. Z. Wang, C. F. Lin, and J. C. Lin, Hiding data in images by optimal moderately-significant-bit replacement, Electron. Lett , Y. C. Hou and Y. F. Chiao, Steganography: an efficient data hiding method, J. Technol. 15 3, D. C. Wu and W. H. Tsai, Data hiding in images via multiple-based number conversion and lossy compression, IEEE Trans. Consum. Electron. 44 4, T. S. Chen, C. C. Chang, and M. S. Hwang, A virtual image cryptosystem based upon vector quantization, IEEE Trans. Image Process. 7 10, C. C. Wang and C. C. Chen, Low-complexity fractal-based image compression using two-stage search strategy, Opt. Eng. 38 6, June W. Diffie and M. E. Hellman, New directions in cryptograph, IEEE Trans. Inf. Theory IT-22, Nov F. Hartung and B. Girod, Fast public-key watermarking of compressed video, IEEE Intl. Conf. Image Process. 1, Oct W. Stallings, The RSA algorithm in Cryptograph and Network Security Principle and Practice, 2nd ed., Prentice Hall International Edition, pp , Prentice Hall, New York H. Kuwakado and K. Koyama, Security of RSA-type cryptoystem over elliptic curves against Hastad attack, Electron. Lett , L. Shuguo, Z. Runde, and G. Yuanqing, A 1024-bit RSA cryptocoprocessor for smart cards, ASIC Proc. 4th Intl. Conf., pp M. J. B. Robshaw, Security estimates for 512-bit RSA, WESCON 95 Conf. Record, pp Wen-Yuan Chen received BS and MS degrees in electronic engineering from National Taiwan University of Science and Technology in 1982 and 1984, respectively. He is currently working towards the PhD degree in electrical engineering at National Cheng Kung University, Tainan, Taiwan. Since 1985, he has been an instructor with the Department of Electronic Engineering at National Chin-Yi Institute of Technology. His research interests include digital signal processing, image compression, and watermarking. Chin-Hsing Chen received the BS degree in electrical engineering from National Taiwan University in 1980, and the MS and PhD degrees in electrical and computer engineering from the University of California at Santa Barbara, in 1983 and 1987, respectively. Since 1988, he has been with the Department of Electrical Engineering at National Cheng Kung University in Taiwan, where he is now a professor. His current research interests include pattern recognition, image processing, and very large scale integration (VLSI) array design. He has published more than 160 papers and given more than 80 technical presentations in more than 15 countries Optical Engineering, Vol. 42 No. 10, October 2003