Abstract
In some particular situations, participants need to recover different secrets both within a group (i.e., intragroup) and between two groups (i.e., intergroup). However, most of the existing multilevel secret sharing (MLSS) and multigroup secret sharing (MGSS) schemes mainly focus on how to protect a secret between one or more groups. In this paper, we propose a polynomial-based scheme to share multiple secret images both within a group and between groups. The random elements’ utilization model of integer linear programming is used to find polynomial coefficients that meet certain conditions so that each participant holds only one shadow image and some of them can recover secrets of both intergroup and intragroup. In addition, our scheme based on polynomials has the advantage of low computational complexity. Theoretical analysis and experiments show that the proposed scheme is feasible and effective.
1. Introduction
With the popularization of digital media technology, the transmission of information is more and more convenient and fast. At the same time, many malicious participants appear on the network to intercept or tamper with the information. So how to safely transmit secret information has become a problem of increasing concern. With the development of cloud technology, more and more attention has been paid to information security, especially image security. The secret image sharing (SIS) technique is an excellent way to keep secret images secure among specific participants.
The threshold SS scheme was firstly proposed by Adi [1] and Blakley [2], respectively. In Shamir’s scheme, the secret is shared into shadow images and distributed to participants. At least participants are needed to recover the secret, while less than participants cannot obtain any information of the secret. The Lagrange interpolation method is used to recover the secret. The SS scheme based on polynomial can be applied to SIS for grayscale images and color images.
The technology of visual cryptography (VC) has gradually developed as digital images are used more and more widely in daily life. This technique is also known as visual secret sharing (VSS). The visual cryptography scheme was first proposed by Noar and Shamir [3] in 1995. In their scheme, the secret can be revealed by a human visual system without any cryptographic computations, and the scheme is very useful when there is no lightweight computation device. The secret image can be recovered by stacking shares, and when the computation device is available, we can also choose the XOR operation to recover the secret image in a lossless manner [4, 5]. At present, the research on VC is mainly divided into basis matrix based [3, 6, 7] and random grid based [8–10]. However, the image quality recovered by this scheme is poor [11], so we choose a polynomial-based scheme as our scheme.
In 2002, Thien and Lin [12] firstly applied the polynomial-based SS technique to SIS. In their scheme, instead of setting the coefficients to be random, they embedded the secret image pixel values into all the coefficients. In order to avoid information leakage, the scheme permuted the secret image. Later, many people studied the polynomial-based SIS (PSIS) scheme from different perspectives. Li et al. [13] proposed an SIS scheme using derivative polynomial and Birkhoff interpolation. Kanso and Ghebleh [14] improved Thien and Lin’s [12] scheme by cyclically shifting the bits of the secret image; and there are some studies on essential SIS [15–17].
In some practical application scenarios, secret recovery requires a hierarchical limit of participants. Some multilevel secret sharing (MLSS) schemes were proposed [18–20]. The MLSS schemes are also called schemes with hierarchical threshold access structure. In MLSS, shares are divided into different levels. Shadow images of different levels will reach different thresholds to recover the secret image. Guo et al. [21] proposed an MLSS scheme based on Tassa’s [18] hierarchical SIS scheme. Pakniat et al. [22] improved the security of the scheme proposed by Guo et al.
For sharing secrets in groups, there are lots of multigroup secret sharing (MGSS) schemes. Li et al. [23] proposed a threshold MGSS scheme based on the Chinese Remainder Theorem (CRT). In their scheme, secrets of multiple groups are packed into a group of large secrets and shared with participants. Wu et al. [24] proposed a hierarchical SIS scheme with multigroup joint management. In their scheme, participants in different groups have to meet different threshold conditions to recover the secret, while all of the shadow images have the same weight. Meng et al. [25] proposed an MGSS scheme without hierarchy. A secret is shared between groups and all the participants are equal. A tightly coupled SS scheme proposed by Meng et al. can resist illegal participant attacks and share capture attacks.
However, all of the above schemes mainly focus on how to keep one secret image secure between one or more groups. Yang et al. [26] proposed a multiple secret images sharing (MSIS) scheme between multiple groups for the first time. They constructed a base matrix to embed the information of multiple secret images into the coefficients of polynomials. However, participants in their scheme are required to hold more than one shadow image.
In practical applications, a participant may need to participate in intragroup and intergroup SS. Holding multiple shadow images is not convenient for the distribution and transmission of the shadow images. Consider the following application scenario. In the professional field, often some experts’ research fields are crossed, and the number of experts in some fields is limited. Two groups of engineering designers have designed two kinds of products, respectively, and each of the two teams holds a draft of a product. At the same time, some members of the first group work with some members of the second group to design a third product. In this case, intragroup designers should be able to restore their own group’s draft; intergroup designers working on two products should be able to restore both drafts. The intragroup recovery and the intergroup recovery should be distinct. Designers working on only one product cannot restore the intergroup secret image.
In order to realize MSIS within one group and between groups and to transmit and save shadow images more conveniently in practical application, we propose an intragroup and intergroup MSIS scheme with each participant holding one shadow image. Our scheme is based on the polynomial; and we use the random elements utilization model to screen the coefficients of the sharing polynomial. The coefficients satisfying the condition can be solved by solving the matrix equation. The contributions of our work are as follows:(1)Multiple secret images can be shared within a group and between groups(2)Each participant holds only one shadow image(3)Our scheme has low computational complexity
The structure of this paper is as follows. In Section 2, we present the PSIS scheme and the concepts of intragroup and intergroup SIS. In Section 3, we describe the sharing and restoring processes of the proposed scheme in detail and take the value of a pixel as an example to illustrate the scheme. Related theoretical analyses are given in Section 4. In Section 5, we present the experimental results and comparison. Finally, conclusions are drawn in Section 6.
2. Preliminaries
In this section, we review the PSIS scheme and then introduce the concepts of intragroup and intergroup SIS.
2.1. Polynomial-Based SIS Scheme
Shamir proposed a threshold secret sharing scheme based on the polynomial and it can be applied to SIS. The PSIS scheme shares a secret image into shadow images and distributes them to participants. When or more participants participate in the recovery, the secret image can be recovered. The specific implementation principle is as follows. For secret , construct a polynomial in equation (1). are random numbers taken in the prime number field , and all operations are carried out in the field of . The value of is the value of the shadow pixel.
When recovering the secret, at least participants are needed, for there are unknown coefficients and we need equations. The Lagrange interpolation method shown in (2) is used to recover the secret . The secret can be recovered by calculating .
In the PSIS scheme, the influence of the coefficient value on the shadow image can be seen intuitively. In order to screen the coefficients more intuitively and find the appropriate combination of coefficients in the solution space, we adopted the PSIS scheme. We can list the conditions that need to be satisfied for the coefficients of the polynomial and solve the matrix equation to find the values of the coefficients. What is more, we choose to operate on the field of , for it has low computational complexity. However, the pixel value between 251 and 255 is changed to 250, and the scheme is lossy.
2.2. Intragroup and Intergroup SIS
As mentioned in the application scenario, the secret recovery involves recovering the secret across groups. Intragroup SIS means sharing and recovering a secret image within a group; intergroup SIS means sharing and recovering a secret image between two groups.
In our scheme, there is no hierarchy between the groups or the participants. There are two groups in our scheme. Every participant can participate in the intragroup secret recovery of his own group, and some predetermined participants can participate in the intergroup secret recovery.
Participants who are authorized to participate in the intergroup secret recovery can participate in the recovery of two different secret images with the one shadow image in their hands. Participants within one group cannot recover intergroup secrets, and participants without permissions cannot participate in the intergroup secret recovery. Secret recovery within one group and that between groups do not affect each other.
Take the intragroup (3, 4) and intergroup (4, 4) thresholds scheme as an example. in can participate in the recovery of ; in can participate in the recovery of ; can participate in the recovery of . The relationship between the participants and the groups is shown in Figure 1.
3. The Proposed Scheme
In this section, we propose an intragroup and intergroup SIS scheme with each participant holding one shadow image. Secret images are shared into multiple shadow images by the random elements utilization model. Participants who can participate in the recovery of the secret between groups are identified in advance.
A participant who is authorized to participate in intergroup secret recovery can recover the intergroup secret together with other participants according to the shadow image he holds; he could use the same shadow image to recover the group’s secret image with the intragroup participants. Intragroup and intergroup secrets are different and independent. Participants who do not have permission to participate in intergroup secret recovery have no access to get the intergroup secret image; they can only recover the intragroup secret together with intragroup participants. Those who participate in the secret image recovery within their own group are called local participants, while those who participate in the secret recovery between groups are called shared participants. The meanings of each symbol are shown in Table 1. The process of sharing and restoring is shown in Figure 2.
3.1. The Sharing Phase
The sharing process is based on the PSIS scheme proposed by Shamir. The random elements utilization model is used to screen the polynomial coefficients that satisfy specific conditions. All the following operations are performed in the field of . Assume that the size of the secret image is . The steps are shown in Algorithm 1.
|
For the shared participants, the shadow images obtained by this method satisfy both the intragroup sharing polynomials and the intergroup sharing polynomials. As a result, a shared participant can join in the intragroup and intergroup secret recovery with the same shadow image. It is worth noting that the shared participants are assigned in advance.
To find a suitable combination of the coefficients, the brute-force cracking method can be used, in which we traverse the solution space for all possible values until we find a solution that satisfies the condition. Obviously, this algorithm has high time complexity. We adopt the random elements utilization model of integer linear programming and find the solution by multiplying inverse matrix, and the calculation efficiency is greatly improved.
3.2. The Recovery Phase
In the recovery phase, we adopt Lagrangian interpolation to obtain the pixel values of the secret images. At least local participants in are required to recover ; at least shared participants between and are required to recover . The steps are shown in Algorithm 2.
|
When recovering the intergroup secret image, we require a dealer to collect shadow images from participants and recover the secret image. This is to prevent intergroup participants from gaining access to intragroup secret information of the other group. For example, intergroup participants in cannot obtain the shadow image of participants in .
3.3. An Example of a Pixel
In this section, we give an example of the sharing and recovery processes of a pixel. is the value of a pixel in , is the pixel value of the corresponding position in , and is the pixel value of the corresponding position in . The secret pixel values are . Intragroup (3, 4) and intergroup (4, 4) thresholds are assumed. are the local participants in and are the local participants in . We designate that can participate in the recovery of secret images between groups in advance. The order numbers of are , that is, . The sharing polynomials of the secret images are shown as follows:where represent the order numbers of the participants of the intergroup, which are the same as the order numbers of the selected participants from and .
The polynomial coefficients need to satisfy (4). The random elements utilization model of integer linear programming is shown in equation (5).
There are four equations and seven variables. We choose to assign values for variables: . The values assigned are randomly selected between 0 and 250 and the result is . After , and are determined as constants, we can obtain (6) by placing the constant terms in the equation on one side and obtain (7) by putting the values of the parameters into the equation and writing it in matrix form.
In equation (7), we can multiply both sides of the equation by the inverse of the coefficient matrix on the left-hand side, and we get that the values of are . So far, we have determined all the coefficients of the sharing polynomial. We can get the value of the shadow pixels by putting the values of the coefficients and the order numbers of the participants into equation (3). The results are as follows: the shadow pixel values of are and the shadow pixel values of are .
When recovering the secrets, we use the Lagrange interpolation method. We chose to recover , to recover , and to recover . The results are , which are equal to , respectively.
4. Theoretical Analysis
In this section, we give the feasibility and security analysis of the proposed scheme and give the conditions for each parameter to be satisfied.
4.1. Feasibility and Security Analysis
4.1.1. Feasibility Analysis
The following details are the sharing process of one pixel. are the secret pixels to be shared. The three pixels are shared into shadow image pixels as shown in (8)–(10):
In the basic sharing scheme, the polynomial coefficients are random. We use the randomness to make the coefficients meet certain conditions, so that the shadow images can carry more information. The shadow pixel value held by local participants in participating in intergroup secret sharing shall satisfy equations (8) and (10), while the shadow pixel value held by local participants in participating in intergroup secret sharing shall satisfy equations (9) and (10). So, the coefficients shall satisfy equation (11). The random elements utilization model of integer linear programming is shown in equation (12).
We write equation (11) as matrix multiplication, as shown in the following equation:
There are equations and variables in the system . Each coefficient has 251 possible values. The size of the solution space is . We pick coefficients at random and assign them to a random number between 0 and 250. Then the system has a unique solution, and we can use the matrix inverse method to solve for the coefficients. According to the coefficients we get, we can get the shadow image pixel value that satisfies our requirements. After the sharing of one pixel, the sharing of the whole image can be completed by traversing all the pixels of the secret image.
4.1.2. Security Analysis
When restoring the secret image within a group, less than participants could not recover ; when restoring the secret image between groups, less than participants could not recover .
Participants without permission cannot participate in the intergroup secret recovery, and even if they do, they cannot recover the secret information. The reason is that the coefficients are calculated according to the order numbers of the legal participants, and if an unauthorized participant participates in the recovery, the Lagrange interpolation method will not be able to recover the true secret.
There is no information leakage when the shared participants recover the intergroup secret image, for all the shadow images are sent to the dealer. A shared participant cannot get access to the shadow image of the other group.
4.2. Parametric Constraint
. For secret sharing between groups, the number of equations that the coefficients need to satisfy is . When sharing a pixel, the sharing polynomial of has variable coefficients; the sharing polynomial of has variable coefficients. The total number of variable coefficients is shown in the following equation:
In order for the solution space not to be empty, the number of variables should be greater than or equal to the number of equations (i.e., ).
should be greater than the number of participants in each group who are permitted to join in intergroup secret sharing. This requirement is put forward from a practical point of view. Local participants in each group are able to recover their group’s secret, and shared participants are able to recover the secret between groups. But participants in one group should not have permission to get the intergroup secret. is the minimum number of participants to recover the secret between the groups. As a result, should be greater than the number of participants in each group who are allowed to join in secret sharing between groups.
. The polynomial secret sharing scheme requires the threshold number to meet this requirement.
. The total number of participants should be greater than or equal to the number of participants in secret sharing between groups.
5. Experiment and Comparison
In this section, we give three examples. The first example realizes the secret sharing of the intragroup thresholds and intergroup thresholds, the second example realizes the secret sharing of the intragroup thresholds and intergroup thresholds, and the third example realizes the secret sharing of the intragroup thresholds and intergroup thresholds. In Section 5.1, the feasibility of the scheme is verified; in Section 5.2, the experimental analysis is given; and in Section 5.3, we compare our scheme with other secret sharing schemes within one group and between groups.
5.1. Introduction of the Experiment
5.1.1. Experiment One
In the first experiment, we realized the SIS of the intragroup thresholds and intergroup thresholds. The experimental process is as follows. There are two groups with six participants. There are three local participants in and three local participants in . The order numbers of are , respectively; and there are three shared participants in intergroup secret sharing. Each participant has only one shadow image.
All participants in their own group can participate in the SIS within the group, and specific participants can participate in the SIS between the groups. In this example, can participate in recovering the secret of , can participate in recovering the secret of , and can participate in recovering the intergroup secret. When recovering the secret image within the group, at least two local participants are required; when recovering the secret image between groups, all three shared participants are required. The size of the intragroup and intergroup secret images is 256 × 256. The membership is shown in Table 2.
The sharing process is as follows. The intragroup secret image of is shared into three shadow images by our proposed screening method, and they are distributed to participants , and . The secret image of is also shared into three shadow images, which are distributed to participants , and .
Figure 3 shows the intragroup secret images of , the intergroup secret image of and , and the shadow images. The secret image of is given in Figure 3(a), and Figures 3(d)～3(f) display the shadow images held by , and ; the secret image of is given in Figure 3(b), and Figures 3(g)～3(i) display the shadow images held by , and . The intergroup secret images of and are given in Figure 3(c).
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)
When recovering the secret image within a group, at least two participants are required. By using Shamir polynomial scheme, any two of can recover the secret of , and any two of can recover the secret of . When recovering intergroup secret, it takes three participants to join in. The secret image can be recovered if all are involved. The recovered secret image is shown in Figure 4.
(a)
(b)
(c)
5.1.2. Experiment Two
In the second experiment, we realized the SIS of the intragroup thresholds and intergroup thresholds. The membership of the experiment is shown in Table 3. Each of the two groups has four participants in , in . The order numbers of are , respectively; and we assigned to participate in the SIS between and .
Through our proposed screening method, the secret images of and are shared into four shadow images, respectively. The intragroup secret images, the intergroup secret image, and the shadow images are shown in Figure 5.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
(k)
When recovering the secret within a group, any two participants can recover the secret image; when recovering the secret between groups, three designated participants are all required to recover the secret image. Any two of can recover , and any two of can recover . are required to recover . The images recovered from the shadow images are shown in Figure 6.
(a)
(b)
(c)
5.1.3. Experiment Three
In the third experiment, we realized the SIS of intragroup thresholds and intergroup thresholds. are the local participants of ; and we assigned to participate in the SIS between and . The order numbers are the same as those in the second experiment. Three local participants are required to reconstruct the intragroup secret image. Four shared participants participate in intergroup secret sharing and they are all required to reconstruct the secret image.
As shown in Figure 7, the secret images of and are shared into four shadow images, respectively, by our proposed random elements utilization model.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
(k)
Any three of can recover , and any three of , can recover . are required to recover . The images recovered from the shadow images are shown in Figure 8.
(a)
(b)
(c)
5.2. Experimental Analysis
Compared with the first experiment, the intragroup threshold in the second experiment changed from to , and the intergroup threshold remained unchanged. The number of shared participants of the two experiments and the structure of the two equation systems are the same. The difference between the two experiments is the number of shadow images in a group, and it does not affect the solution of the system.
Compared with the first two experiments, the third experiment has a greater intragroup threshold, which means that there are more variable coefficients in the system. At the same time, the intergroup threshold in the third experiment is greater than those of the first two experiments, which means that there are more restrictions. The threshold parameters in the third experiment satisfy the constraints that need to be satisfied (i.e., ), so there exists a solution in the system.
We use the random elements utilization model to select polynomial coefficients satisfying certain conditions and realize the intragroup and intergroup SIS with each participant holding one shadow image. The experimental results show that the scheme is feasible.
5.3. Comparison
In this section, we compare the proposed scheme with other secret sharing schemes within one group and between groups. The comparisons of the main features are shown in Table 4.
The MLSS scheme proposed by Guo et al. [21] realized that each participant has different privileges to restore the secret image and can achieve lossless restoration. Pakniat et al. [22] improved the scheme and enhanced the security. Both two schemes need a dealer to divide the secret into parts with different widths and heights and give each participant a shadow of the corresponding hierarchy. Wu et al. [24] proposed a hierarchical secret sharing scheme between two groups, in which the secret image could not be restored unless participants from both groups joined in the recovery. The SIS with a hierarchical threshold access structure mentioned above all share one secret image within a group or between two groups.
The tightly coupled secret sharing scheme based on CRT proposed by Meng et al. [25] is the first time to propose secret sharing among multiple groups without any hierarchy. In this MGSS scheme, participants can go to another group to participate in the secret recovery. The secret image can be restored without loss and the computation is relatively small. However, the same secret is shared within one group and between groups in this scenario and there has to be a dealer to send an extra message to a participant who wants to participate in the secret recovery between groups. In our scheme, secrets within one group and between groups are completely different and independent, which has a different application scenery in real life.
For Yang et al.’s [26] scheme, sharing and recovering multiple secrets between multiple groups is proposed for the first time. In the scheme, secret images are shared among groups, and the recovery is lossless. However, in this scheme, multiple shadow images are held by a participant who participates in both intragroup and intergroup secret sharing. In our scheme, every participant holds only one shadow image, which is easier to manipulate and more secure in practical applications. Besides, Yang et al.’s scheme is proposed on the basis of domain and needs to calculate the basis matrix, so it requires a large amount of calculation, while our scheme requires a smaller amount of calculation.
To sum up, the advantages of our scheme are as follows: compared with the existing MLSS and MGSS schemes, we can share multiple secret images within one group and between groups; compared with Yang et al.’s [26] scheme, each participant only needs to hold one shadow image in the proposed scheme based on the random elements utilization model and there is no information leakage in the process of inter-roup SIS.
6. Conclusion
In this paper, we proposed an intragroup and intergroup secret sharing scheme, in which each participant holds one shadow image. There is no need for additional information to participate in secret recovery between groups. Participants who are able to join in the intergroup secret recovery are assigned in advance and when the number of legal participants reaches the threshold, they can recover the intergroup secret. Participants without permission can only participate in the secret recovery within the group but cannot participate in the secret recovery between groups. Even if they participate, they cannot recover the true secret. The secrets within one group and between groups are completely different and the scheme is simple to implement; thus it has a good application prospect in real life. In future work, we will further extend our scheme to SIS between more than two groups.
Data Availability
Some or all data, models, or codes generated or used during the study are available from the corresponding author upon request (publictiger@126.com).
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This work was funded by the Program of the National University of Defense Technology and the National Natural Science Foundation of China (no. 61602491).