Efficient image encryption algorithm based on dynamic high-performance S-box and hyperchaotic system

Yuyue Su; Xiaojun Tong; Miao Zhang; Zhu Wang

doi:10.1088/1402-4896/acd1c3

1. Introduction

With the popularity of the network and the development of science and technology, how to ensure the confidentiality and security of data in the transmission process is always a matter of commitment. The increasing performance of computers has led to the development not only of cryptography but also of cryptanalysis. Traditional block cipher algorithms, such as Data Encryption Standard(DES) [1], Advanced Encryption Standard(AES) [2] and International Data Encryption Algorithm(IDEA) [3], can encrypt and decrypt text data, but they cannot solve the problems of strong correlation between adjacent pixels, data redundancy and energy distribution in image data. Since chaos has the characteristics of improving the security of cipher algorithms, including initial value sensitivity, randomness and uniqueness, more and more cryptographic algorithms use chaotic systems to improve their security. As the only nonlinear component in many cryptographic algorithms, S-box plays a key role in avoiding ciphertext from linear approximation attacks and algebraic attacks.

Common chaotic systems can be roughly divided into low-dimensional chaotic systems and hyperchaotic systems. Compared with low-dimensional chaotic systems, hyperchaotic systems have more complex dynamic characteristics and more control parameters. The hyperchaotic system need to satisfy the condition of having no less than two nonlinear functions, which is equivalent to having at least two positive Lyapunov exponents. Based on Lorenz system [4], Chen system [5], Lü system [6] and Rossler system, many new hyperchaotic systems have been proposed in recent years. Zhou et al [7] construct a new four-dimensional smooth quadratic autonomous hyperchaotic system by adding state variables to the Lorenz system. Zhang et al [8] construct a four-dimensional non-equilibrium hyperchaotic system by adding two new non-linear functions to the modified Sprott B system. He et al [9] design the fractional symbolic network entropy measure algorithm to analyze the complexity of fractional order chaotic system. In addition, there are 3D hyperchaotic map [10], 5D hyperchaotic systems [11], 6D hyperchaotic systems [12] and 7D hyperchaotic systems [13].

The S-box is essentially a substitution table of non-repeating integers of [0,2ⁿ). When the value of n is 8, there are a total of 10⁵⁰⁶ possible S-boxes and these S-boxes have different security strengths, so high-performance S-boxes need to be obtained in finite time by algebraic methods [14, 15], random construction methods [16–19] or hybrid construction methods [20–22]. In general, the performance of the S-boxes obtained by random construction is not as high as that of the S-boxes generated by algebraic methods. The most typical S-box generation by algebraic methods is the AES S-box, where the inverse element and affine transformation are solved under GF(2⁸) to generate the S-box with nonlinearity 112. Although the maximum algebraic degree of AES S-box can reach 255, the algebraic expression has only nine terms, which makes it vulnerable to algebraic attacks. Liu et al [23] increased the number of algebraic expression terms to 255 by improving the generation method of AES S-boxes. Massey et al [24] implemented the substitution operation in the SAFER cryptographic algorithm by means of a logarithmic function and an exponential function. In the case of GF(2⁸), the linear fractional transform (LFT) is also applied to generate the S-box [25, 26] and a S-box with differential uniformity of 4 and nonlinearity of 112 can be got. Al-Obeidi et al [13] constructed S-boxes by using the cubic fractional transform (CFT), which can generate S-boxes with differential uniformity of 10 and nonlinearity of 107. S-boxes can be classified as dynamic S-boxes and static S-boxes based on whether they change in cryptographic algorithm. Well-known algorithms that use static S-boxes including AES, Present, Camellia, and SMS4, among which S-boxes all have outstanding performance. Su et al [27] obtained S-boxes with average nonlinearity of 113 and difference uniformity of 8 by a three-layer S-box optimization method. In general, the performance of dynamic S-boxes is not as good as that of static S-boxes in order to save overhead. RC4 implements a dynamic S-box by swapping the values of two positions in the S-box at each encryption, but it can not guarantee that a high-performance S-box is obtained every time. Algorithms such as Khufu and Twofish use dynamic S-boxes associated with keys. Ibrahim et al [28] generated dynamic S-boxes with average nonlinearity of 107.5by key alignment on a finite elliptic curve. Obviously, if the performance of static and dynamic S-boxes is approximately the same, the security strength of the algorithm using dynamic S-boxes is higher. How to dynamically construct high-performance S-box based on algebraic methods becomes a problem.

Many image cipher algorithms are able to improve greatly in terms of security performance over previous cipher algorithms, but are costly, time-consuming, and not efficient to use for application in daily life, such as DNA-based image encryption algorithms [29, 30]. There are also image cipher algorithms that have specific requirements for the size of the image and require additional delivering of hash values. Wang et al [31] obtain a visually meaningful ciphertext by using quantum 16*16 S-box to displace the images, using the probability matrix to diffuse the images, but this algorithm requires delivering two phase masks of the same size as the ciphertext during the decryption process. Lin et al [32] proposed an image encryption algorithm based on Latin squares and cellular neural networks. This encryption algorithm is only applicable to square grayscale images and does not take the relationship between the RGB three layers into account. Teng et al [33] and Liu et al [34] improve image resistance to differential attacks as well as key sensitivity by computing 512-bit hashes of plaintext image, but additional hashes need to be passed in each encryption and decryption process. Xu et al [35] use RSA to encrypt and decrypt keys, and embed the key cipher image and cipher image into the carrier image, but asymmetric cryptography take longer time. So how to design a secure and efficient image cipher algorithm that can encrypt image of any size and consider RGB triple correlation is a problem.

In this paper, we first propose a new hyperchaotic system with more complex dynamical properties than the conventional chaotic system. Then a new algorithm for dynamically generating high-performance S-boxes is designed based on the multiplication and addition on GF(2⁸). Finally, an efficient image cipher algorithm suitable for image of any size is designed. The main contributions of this paper are as follows:

A new four-dimensional hyperchaotic system is proposed. By adding nonlinear feedback terms and dimensions to the Lű chaotic system, a hyperchaotic system with more complex dynamic properties is constructed.
A new algorithm for generating dynamic high-performance S-boxes is proposed. By improving the method for generating S-boxes in AES, selecting the relatively optimal irreducible polynomial as well as affine matrix, calculating affine multiplication as well as multiplication inverse matrices in advance, the proposed algorithm is constructed. The algebraic expression of the S-box generated by the algorithm reaches 255 terms, with an algebraic degree of up to 254.
A new secure and efficient image cipher algorithm is proposed. Based on the new hyperchaotic system and dynamic S-box, the proposed image cipher algorithm is designed by using cyclic shift permutation with fixed point, dynamic S-box substitution and interleaved permutation, which can encrypt images of any size and take the correlation of RGB triplet pixels into account. Dynamic S-box substitution does not require the calculation of inverse S-box, saving the storage space for inverse affine multiplication matrix. The setting of cyclic shift permutation with fixed point and dynamic S-box substitution also ensures that the plaintext image transformation can be transferred to the entire image.

The remainder of this paper is organized as follows: section 2 describes the construction of a new four-dimensional hyperchaotic system. Section 3 introduces a new method for dynamically generating high-performance S-box. In the section 4, a new secure and efficient cipher algorithm is designed. Finally, a brief summary about the work in this paper and future work direction are given in the section 5.

2. A new four-dimensional hyperchaotic system

2.1. Construction of new hyperchaotic system

2.1.1. Lű chaotic system

Lű chaotic system is a three-dimensional chaotic system proposed based on Lorenz system and Chen system, as shown in equation (1). When (m, n, h) = (36,3,20), the system is in chaotic state.

$\begin{eqnarray}&&\left\{\begin{array}{c}\mathop{x}\limits^{\bullet }=m\left(y-x\right)\\ \mathop{y}\limits^{\bullet }=hy-xz\\ \mathop{z}\limits^{\bullet }=-nz+xy\end{array}\right.\end{eqnarray} \tag{ 1 }$

2.1.2. The new hyperchaotic system

A new hyperchaotic system is constructed by adding dimensions and nonlinear feedback terms to the Lű chaotic system, as shown in equation (2).

$\begin{eqnarray}&&\left\{\begin{array}{c}\mathop{x}\limits^{\cdot }=m\left(y-x\right)+pzy+w\\ \mathop{y}\limits^{\cdot }=hy-xz+w\\ \mathop{z}\limits^{\cdot }=-nz+xy-w\\ \mathop{w}\limits^{\cdot }=yz+qxy-kw\end{array}\right.\end{eqnarray} \tag{ 2 }$

where m, n, h, p, q, k are the control parameters and x, y, z, w are the system variables. When (m, n, h, p, q, k) = (36, 3, 20, 0.6, 2, 2), the system is a hyperchaotic system and has chaotic properties.

2.2. Performance analysis of hyperchaotic systems

2.2.1. Lyapunov exponent

The Lyapunov exponent (LE) is a value that theoretically quantifies how fast the orbits diverge or contract in phase space. To ensure the unpredictability of the system, the more divergent the orbits are, the better, which means that the larger value of the Lyapunov exponent the more chaotic the system is. As shown in figure 1, the LE values of the Lű system with (m, n, h)=(36,3,20) and the new four-dimensional hyperchaotic system with (m, n, h, p, q, k)=(36,3,20,0.6,2,2) are plotted against time.

Figure 1. Refer to the following caption and surrounding text. — **Figure 1.** Lyapunov exponent.
Download figure:
Standard image High-resolution image

The three LE values of the Lű system are LE1 = 1.336, LE2 = 0, and LE3=−20.338. The four LE values of the new four-dimensional hyperchaotic system are LE1 = 5.468, LE2 = 0.008, LE3 = 0, and LE4=−26.189. The maximum LE value of the Lű system is smaller than that of the new four-dimensional hyperchaotic system, which means that the dynamical property of the new four-dimensional hyperchaotic system are more complicated.

2.2.2. Poincaré section

Poincaré section is a two-dimensional graph obtained by intercepting the continuous trajectory using section. The morphology of the trajectory motion can be determined from the trajectories on the Poincaré section. If there are a large number of dense points that aggregate into fractal structure on the Poincaré section, the system is chaotic. The Poincaré section of the new four-dimensional chaotic system is shown in figure 2.

Figure 2. Refer to the following caption and surrounding text. — **Figure 2.** Poincare surface of section.
Download figure:
Standard image High-resolution image

From figure 2, it can be observed that the four-dimensional hyperchaotic system has a large number of dense points that aggregate into fractal structure on the section. So the new system proposed in this paper is chaotic.

2.2.3. Dissipativity

Chaotic systems include dissipative systems and conservative systems, where unique attractors exist in dissipative systems and do not exist in conservative systems. The total energy of the dissipative system changes as time changes. Equations (3) and (4) is used to judge whether the system is dissipative. When the volume element ${\rm{\nabla }}\cdot f\lt 0,$ the system is a dissipative chaotic system. When the volume element ${\rm{\nabla }}\cdot f=0,$ the system is a conservative chaotic system.

$\begin{eqnarray}&&F=\left[\begin{array}{c}{f}_{1}\left(x,y,z,w\right)\\ {f}_{2}\left(x,y,z,w\right)\\ {f}_{3}\left(x,y,z,w\right)\\ {f}_{4}\left(x,y,z,w\right)\end{array}\right]=\left[\begin{array}{c}m\left(y-x\right)+pzy+w\\ hy-xz+w\\ -nz+xy-w\\ yz+qxy-kw\end{array}\right]\end{eqnarray} \tag{ 3 }$

$\begin{eqnarray}&&\left\{\begin{array}{c}{\rm{\nabla }}\cdot f=\displaystyle \frac{\partial {f}_{1}}{\partial x}+\displaystyle \frac{\partial {f}_{2}}{\partial y}+\displaystyle \frac{\partial {f}_{3}}{\partial z}+\displaystyle \frac{\partial {f}_{4}}{\partial w}\\ V\left(t\right)={e}^{{\rm{\nabla }}\cdot ft}\end{array}\right.\end{eqnarray} \tag{ 4 }$

The volume element of the new hyperchaotic system is calculated to be ${\rm{\nabla }}\cdot f=-m-n-k$ = $-36+20-3-2$ = $-21\lt 0,$ which means that there are unique attractors in the new hyperchaotic system and the phase space volume tends to 0 at the rate of ${e}^{-21t}.$ This new hyperchaotic system is a dissipative system with unique attractors.

2.2.4. Fractal dimension

The fractal dimension is the infinite multilayer self-similar shape of the unique attractor in the chaotic system. According to the Kaplan York conjecture, the calculation method for fractal dimension is shown in equation (5).

$\begin{eqnarray}&&FD=j+\displaystyle \frac{\displaystyle {\sum }_{i=1}^{j}L{E}_{i}}{| L{E}_{j+1}| }\end{eqnarray} \tag{ 5 }$

where j is the maximum value that satisfies $\displaystyle {\sum }_{i=1}^{j}L{E}_{i}\gt 0.$

The fractional dimension of the new hyperchaotic system is calculated to be a fraction of $FD=3+\displaystyle \frac{5.468+0.008+0}{| -26.189| }=3.209$ and $3\lt FD\lt 4.$ Therefore, the new system is a four-dimensional hyperchaotic system with unique attractors.

2.2.5. Unique attractor

Since this hyperchaotic system is a dissipative system, there will be infinite self-similar structures in the phase space and the volume of the phase space will keep decreasing and eventually converge to a set, which is the unique attractor. For four-dimensional hyperchaotic system, the phenomenon can be macroscopically observed in three dimensions as well as in two-dimensional phase space.

The projection of the attractor of the new four-dimensional hyperchaotic system on the plane is shown in figure 3.

Figure 3. Refer to the following caption and surrounding text. — **Figure 3.** Projection of the attractor of the chaotic system on the plane.
Download figure:
Standard image High-resolution image

2.2.6. Equilibrium point

When the equilibrium point has a positive eigenvalue, it is called an unstable equilibrium point. The new hyperchaotic system equations were solved according to equation (6), and four sets of solutions were obtained: (−7.6483, −6.0, 15.9436, −1.9411), (0, 0, 0, 0), (−20, −45.0, 0, 900), and (0.4483, −6.0, −35.5800, 104.0502). By using Jacobi matrix, the eigenvalues of the fourth set of solutions are (26.2549, 2.1732, −4.7459, −44.6822). There are positive and negative real numbers in the eigenvalues, so this hyperchaotic system has unstable saddle point.

$\begin{eqnarray}&&\left\{\begin{array}{c}36\left(y-x\right)+0.6zy+w=0\\ 20y-xz+w=0\\ -3z+xy-w=0\\ yz+2xy-2w=0\end{array}\right.\end{eqnarray} \tag{ 6 }$

2.2.7. Initial value sensitivity

Initial value sensitivity refers to the fact that even if the initial value changes very slightly, the results obtained over time can be completely different.

As shown in figure 4, the four variables x, y, z, w all appear to have different chaotic trajectories at t<10 after adding 10¹⁴. This new hyperchaotic system possesses initial value sensitivity.

Figure 4. Refer to the following caption and surrounding text. — **Figure 4.** Initial value sensitivity.
Download figure:
Standard image High-resolution image

2.2.8. Pseudo-randomness

In order to apply the pseudo-random sequence generated by the chaotic system to the encryption process, it is necessary to discretize pseudo-random sequence. We use SP800-22 to test whether discretized sequence is a random sequence. The discretization equation is shown in equation (7).

$\begin{eqnarray}&&\left\{\begin{array}{c}{x}_{i}=floor\left({x}_{i}\times {10}^{12}\right)\mathrm{mod}\,256\\ {y}_{i}=floor\left({y}_{i}\times {10}^{12}\right)\mathrm{mod}\,256\\ {z}_{i}=floor\left({z}_{i}\times {10}^{12}\right)\mathrm{mod}\,256\\ {w}_{i}=floor\left({w}_{i}\times {10}^{12}\right)\mathrm{mod}\,256\end{array}\right.\end{eqnarray} \tag{ 7 }$

Take 100 sets of 1,000,000 bits of the discretized pseudo-random sequences generated by the new hyperchaotic system for testing. From table 1, we can see that the 15 tests are successfully passed.

Table 1. SP800 test result.

	Statistical test	P-Value	Pass rate	Results
1	The Frequency Test	0.383827	0.9900	Pass
2	Frequency Test within a Block	0.719747	0.9800	Pass
3	The Runs Test	0.102526	1.0000	Pass
4	Tests for the Longest-Run-of-Ones in a Block	0.851383	1.0000	Pass
5	The Binary Matrix Rank Test	0.401199	1.0000	Pass
6	The Discrete Fourier Transform (Spectral) Test	0.637119	0.9900	Pass
7	The Non-overlapping Template Matching Test	0.991468	1.0000	Pass
8	The Overlapping Template Matching Test	0.955835	0.9900	Pass
9	Maurer's 'universal Statistical' Test	0.911413	1.0000	Pass
10	The Linear Complexity Test	0.115387	1.0000	Pass
11	The Serial Test	0.026948	1.0000	Pass
12	The Approximate Entropy Test	0.867692	0.9900	Pass
13	The Cumulative Sums Test	0.494392	0.9900	Pass
14	The Random Excursions Test	0.619772	1.0000	Pass
15	The Random Excursions Variant Test	0.654467	0.9855	Pass

In summary, the newly proposed four-dimensional system is a hyperchaotic system with complex dynamics, unique attractors, unstable equilibrium points, initial value sensitivity and the ability to generate pseudo-random sequences, which is suitable for application in image encryption and decryption.

3. Dynamic high-Performance S-Box

3.1. Construction of dynamic high-performance S-box

3.1.1. Design of high-performance S-box

Let S(x) denote the value in the S-box and x denote the position. As shown in figure 5, a new general structure is designed to generate a high-performance S-box. The expression that generates the high-performance S-box is shown in equation (8), where $b\ne c,$ $b\in {{\mathbb{Z}}}_{256},$ $c\in {{\mathbb{Z}}}_{256}.$

$\begin{eqnarray}&&S\left(x\right)=\left\{\begin{array}{c}{\left(Ax+b\right)}^{-1}\left(Ax+c\right),\,{\rm{others}}\\ 1\,,\,Ax+b=0\end{array}\right.\end{eqnarray} \tag{ 8 }$

Figure 5. Refer to the following caption and surrounding text. — **Figure 5.** S-box structure.
Download figure:
Standard image High-resolution image

3.1.2. Selection of irreducible polynomial and affine matrix in general structure

The expression of an eighth irreducible binary polynomial is { ${d}_{8}{x}^{8}+{d}_{7}{x}^{7}+{d}_{6}{x}^{6}$ + ${d}_{5}{x}^{5}+{d}_{4}{x}^{4}+{d}_{3}{x}^{3}$ + ${d}_{2}{x}^{2}+{d}_{1}{x}^{1}+1$ }, where ${d}_{i}\in \{0,1\}.$ There are 30 eighth irreducible binary polynomials. The maximum nonlinearity of the 30 irreducible binary polynomials is 112 [35], and the corresponding irreducible binary polynomials are 'x⁸+x⁴+x³+x+1', 'x⁸+x⁶+x⁵+x+1', and 'x⁸+x⁷+x⁶+x⁵+x⁴+x+1', as shown in table 2.

Table 2. Irreducible polynomial.

Irreducible polynomial	d₈ d₇ d₆ d₅ d₄ d₃ d₂ d₁	Decimal value	Nonlinearity
x⁸+x⁴+x³+x+1	100011011	283	112
x⁸+x⁶+x⁵+x+1	101100011	355	112
x⁸+x⁷+x⁶+x⁵+x⁴+x+1	111110011	499	112

The expression of the affine transformation defined on GF(2) is y = Ax+b, where A is the 8 $\times$ 8 invertible matrix and b is a constant of 8 bits. A₁, A₂ and A₃ are relatively good affine matrices [36, 37], and their corresponding affine transformations are equations (9)–(11), respectively. Assuming that A is taken as A₁ and b is taken as 45, the corresponding affine transformations are equation (12).

$\begin{eqnarray*}&&{{\rm{A}}}_{1}=\left[\begin{array}{c}{\rm{11000001}}\\ {\rm{11100000}}\\ {\rm{01110000}}\\ {\rm{00111000}}\\ {\rm{00011100}}\\ {\rm{00001110}}\\ {\rm{00000111}}\\ {\rm{10000011}}\end{array}\right]{{\rm{A}}}_{2}=\left[\begin{array}{c}{\rm{11001011}}\\ {\rm{11100101}}\\ {\rm{11110010}}\\ {\rm{01111001}}\\ {\rm{10111100}}\\ {\rm{01011110}}\\ {\rm{00101111}}\\ 1{\rm{0010111}}\end{array}\right]{{\rm{A}}}_{3}=\left[\begin{array}{c}{\rm{00101111}}\\ {\rm{10010111}}\\ {\rm{11001011}}\\ {\rm{11100101}}\\ 1{\rm{1110010}}\\ 01{\rm{111001}}\\ 101{\rm{11100}}\\ {\rm{0}}101{\rm{1110}}\end{array}\right]\end{eqnarray*}$

$\begin{eqnarray}&&{y}_{i}={x}_{i}\oplus {x}_{\left(i+1\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+7\right)\mathrm{mod}\,8}\oplus {c}_{i}\end{eqnarray} \tag{ 9 }$

$\begin{eqnarray}&&{y}_{i}={x}_{i}\oplus {x}_{\left(i+1\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+2\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+4\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+7\right)\mathrm{mod}\,8}\oplus {c}_{i}\end{eqnarray} \tag{ 10 }$

$\begin{eqnarray}&&{y}_{i}={x}_{\left(i+1\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+2\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+3\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+4\right)\mathrm{mod}\,8}\oplus {x}_{\left(i+6\right)\mathrm{mod}\,8}\oplus {c}_{i}\end{eqnarray} \tag{ 11 }$

$\begin{eqnarray}&&y=\left[\begin{array}{c}{y}_{7}\\ {y}_{6}\\ {y}_{5}\\ {y}_{4}\\ {y}_{3}\\ {y}_{2}\\ {y}_{1}\\ {y}_{0}\end{array}\right]=\left[\begin{array}{c}{\rm{11000001}}\\ {\rm{11100000}}\\ {\rm{01110000}}\\ {\rm{00111000}}\\ {\rm{00011100}}\\ {\rm{00001110}}\\ {\rm{00000111}}\\ {\rm{10000011}}\end{array}\right]\left[\begin{array}{c}{x}_{7}\\ {x}_{6}\\ {x}_{5}\\ {x}_{4}\\ {x}_{3}\\ {x}_{2}\\ {x}_{1}\\ {x}_{0}\end{array}\right]+\left[\begin{array}{c}0\\ 0\\ 1\\ 0\\ 1\\ 1\\ 0\\ 1\end{array}\right]\end{eqnarray} \tag{ 12 }$

To generate S-boxes with better performance, the irreducible binary polynomials (283, 355, 499) and affine matrices (A₁, A₂, A₃) are combined and applied to equation (8), respectively. Under different combinations of irreducible polynomials and affine matrices, 1000 S-boxes are generated by taking $b\in {{\mathbb{Z}}}_{100},$ $c\in \{c| 101\leqslant c\leqslant 110,c\in {\mathbb{Z}}\}$ and the average value of S-box performance is calculated. As shown in table 3, there are nine combinations.

Table 3. The performance comparison of S-box with different Irreducible polynomial and affine matrix.

		NL					SAC		BIC_SAC
Irreducible polynomial	A_i	Min.	Avg.	Max.	LP	DU	_Offset	BIC_NL	_Offset
x⁸+x⁴+x³+x+1(283)	A₁	112	112	112	0.0625	4	0.027	112	0.0093
x⁸+x⁶+x⁵+x+1(355)	A₁	112	112	112	0.0625	4	0.0269	112	0.0088
x⁸+x⁷+x⁶+x⁵+x⁴+x+1(499)	A₁	112	112	112	0.0625	4	0.0268	112	0.0086
x⁸+x⁴+x³+x+1(283)	A₂	112	112	112	0.0625	4	0.0268	112	0.009
x⁸+x⁶+x⁵+x+1(355)	A₂	112	112	112	0.0625	4	0.0271	112	0.0091
x⁸+x⁷+x⁶+x⁵+x⁴+x+1(499)	A₂	112	112	112	0.0625	4	0.027	112	0.0094
x⁸+x⁴+x³+x+1(283)	A₃	99	100.9	102	0.1209	256	0.0431	101	0.0152
x⁸+x⁶+x⁵+x+1(355)	A₃	99	100.8	103	0.1209	256	0.0438	101	0.0156
x⁸+x⁷+x⁶+x⁵+x⁴+x+1(499)	A₃	99	101	103	0.1209	256	0.0432	101	0.0154

According to the comparison results in table 3, the irreducible binary polynomial is chosen as x⁸+x⁷+x⁶+x⁵+x⁴+x+1 (499), and the affine matrix is chosen as A₁.

3.1.3. Design of dynamic S-box

By changing the values of the constants $b,c\in {{\mathbb{Z}}}_{256},$ different high-performance S-boxes can be generated. Generating S-boxes mainly consists of three operations on GF(2⁸): affine multiplication Ax, multiplication inverse, and multiplication operations. Because A is fixed A₁ and $x\in {{\mathbb{Z}}}_{256},$ affine multiplication has 256 items of data. The multiplication inverse on GF(2⁸) also has 256 items of data. The multiplication operation can be simplified as a combination of time operations, then the results of multiplying $x\in {{\mathbb{Z}}}_{256}$ and $x\in \{1,2,4,8,16,32,64,128\}$ contains 2048 items of data. As shown in table 4, the average time taken for the 256 times direct calculation and for the 256 times calculations with the help of the precomputing data is obtained by repeating 100 times.

Table 4. The time comparison of calculating directly and calculating by data.

	Affine multiplication	Multiplication inverse	Multiplication
The time of calculating directly(ms)	27.7884	1454.9166	1.6083
The time of calculating by data(ms)	0.0021	0.0058	0.2760

It can be observed from table 4 that multiplication inverse saves the most time, followed by affine multiplication and finally multiplication operation. Considering the balance between speed and memory, the data of affine multiplication and the data of multiplication inverse are selected to save, corresponding to tables 5 and 6, so that S-boxes can be generated dynamically.

Table 5. Affine multiplication T1.

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	0	131	7	132	14	141	9	138	28	159	27	152	18	145	21	150
1	56	187	63	188	54	181	49	178	36	167	35	160	42	169	45	174
2	112	243	119	244	126	253	121	250	108	239	107	232	98	225	101	230
3	72	203	79	204	70	197	65	194	84	215	83	208	90	217	93	222
4	224	99	231	100	238	109	233	106	252	127	251	120	242	113	245	118
5	216	91	223	92	214	85	209	82	196	71	195	64	202	73	205	78
6	144	19	151	20	158	29	153	26	140	15	139	8	130	1	133	6
7	168	43	175	44	166	37	161	34	180	55	179	48	186	57	189	62
8	193	66	198	69	207	76	200	75	221	94	218	89	211	80	212	87
9	249	122	254	125	247	116	240	115	229	102	226	97	235	104	236	111
A	177	50	182	53	191	60	184	59	173	46	170	41	163	32	164	39
B	137	10	142	13	135	4	128	3	149	22	146	17	155	24	156	31
C	33	162	38	165	47	172	40	171	61	190	58	185	51	176	52	183
D	25	154	30	157	23	148	16	147	5	134	2	129	11	136	12	143
E	81	210	86	213	95	220	88	219	77	206	74	201	67	192	68	199
F	105	234	110	237	103	228	96	227	117	246	114	241	123	248	124	255

Table 6. Multiplication inverse T2.

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	0	1	249	174	133	203	87	220	187	229	156	136	210	239	110	232
1	164	88	139	130	78	190	68	244	105	219	142	242	55	120	116	161
2	82	206	44	254	188	200	65	40	39	64	95	73	34	255	122	144
3	205	162	148	153	71	126	121	28	226	253	60	93	58	92	169	106
4	41	38	103	180	22	245	127	52	94	43	100	250	217	154	20	191
5	234	98	32	207	214	119	221	6	17	165	134	115	61	59	72	42
6	159	167	81	235	74	251	181	66	218	24	63	168	197	208	14	233
7	113	112	135	91	30	160	215	85	29	54	46	145	173	150	53	70
8	237	147	19	138	202	4	90	114	11	157	131	18	198	222	26	243
9	47	123	236	129	50	152	125	172	149	51	77	216	10	137	166	96
A	117	31	49	204	16	89	158	97	107	62	194	178	151	124	3	248
B	241	246	171	195	67	102	192	225	231	213	228	8	36	201	21	79
C	182	224	170	179	209	108	140	223	37	189	132	5	163	48	33	83
D	109	196	12	238	230	185	84	118	155	76	104	25	7	86	141	199
E	193	183	56	252	186	9	212	184	15	111	80	99	146	128	211	13
F	247	176	27	143	23	69	177	240	175	2	75	101	227	57	35	45

3.1.4. Dynamic high-performance S-box overall algorithm

A flow chart for dynamically generating high-performance S-box is shown in figure 6. The specific steps are shown as follows.

Figure 6. Refer to the following caption and surrounding text. — **Figure 6.** S-box generation flow chart.
Download figure:
Standard image High-resolution image

Step 1: Parameter input. Enter the values of parameters b, c, where $b\ne c,$ $b,c\in {{\mathbb{Z}}}_{256}.$

Step 2: Initialize the S-box. Initialize the S-box in the order of {0,1,2,...,255}.

Step 3: Affine multiplication. The result of multiplying the element x with the affine matrix A₁ is found in table 5, then the number B at position x of table 5 is the result of affine multiplication.

Step 4: XOR. M is the result of B xor parameter b. E is the result of B xor parameter c.

Step 5: Multiplication inverse. Calculate multiplication inverse D of M according to table 6.

Step 6: Multiply. The final result S(x) is obtained by multiplying E with D under GF(2⁸), and the irreducible polynomial is selected to be x⁸+x⁷+x⁶+x⁵+x⁴+x+1.

Step 7: Determine if all x have been processed. if not, turn to Step 3. Otherwise, Sbox is obtained.

When b = 5 and c = 22, the resulting S-box Sbox1 is shown in table 7.

Table 7. S-box Sbox1.

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	97	150	241	208	190	172	41	79	162	44	17	173	54	145	31	53
1	252	157	99	80	110	105	146	170	62	164	248	163	229	156	13	182
2	83	131	95	144	246	178	148	179	90	40	243	38	205	46	4	174
3	91	103	210	87	220	250	168	238	184	213	200	27	202	120	209	73
4	138	207	47	42	171	177	195	50	39	134	65	143	122	48	3	133
5	66	115	6	12	75	7	211	107	185	231	242	37	29	132	43	196
6	125	167	109	176	151	21	191	64	34	49	124	88	123	121	126	161
7	137	227	234	235	24	14	194	236	16	169	204	175	10	9	192	239
8	28	251	165	255	106	217	183	142	72	104	181	112	100	36	128	116
9	140	129	193	5	111	93	180	118	223	20	8	85	58	15	127	86
A	222	22	249	11	245	189	71	216	51	96	226	82	23	84	35	160
B	166	33	228	61	247	18	77	81	149	0	135	25	57	197	130	212
C	68	141	136	2	201	69	155	52	159	153	32	56	214	244	117	254
D	206	158	92	186	139	240	98	154	1	152	219	114	108	253	230	19
E	101	55	45	89	76	63	26	225	218	94	113	102	188	74	30	237
F	147	198	203	224	59	233	215	67	78	199	119	187	232	60	221	70

3.2. Performance analysis of S-box

We analyze the performance of S-boxes by nine metrics, including bijectivity, fixed point , iteration period, algebraic expression, nonlinearity, etc.

3.2.1. Bijectivity

Bijectivity means that the S(x) obtained for any x is unique, and similarly for any one S(x) the obtained x is unique. We can know from table 7 that the 256 values in Sbox1 are non-repeating integer arrangements in the range [0,255], and the S-boxes all satisfy the bijection property.

3.2.2. Fixed point

If S(x)=x, then position x is a fixed point of the S-box. Fixed points can cause threat to the security of the algorithm, so the existence of fixed points should be reduced. From table 7, we can get that there is no fixed point in Sbox1.

3.2.3. Iteration period

For all elements in S(x), if satisfied ${S}^{n}(x)=x,$ n is the iteration period of x. The maximum value of n is 256, the minimum value of n is 1. The smallest positive integer n is taken as the iteration period of the S(x). The formula for calculating the iteration period of S(x) is shown in equation (13).

$\begin{eqnarray}&&Period=\mathop{\min }\limits_{x\in {{\mathbb{Z}}}_{2}^{m}}\left(\left\{n| {S}^{n}\left(x\right)=x,n\in {\mathbb{Z}}\right\}\right)\end{eqnarray} \tag{ 13 }$

After calculation, the iteration period of all elements in Sbox1 is 256. Therefore, S-box have long iteration periods.

3.2.4. Algebraic expression

The insertion attack is effective against block ciphers with few algebraic expression terms and low algebraic degree. In order to prevent insertion attacks, the algebraic expression of the S-box should be made to have the highest algebraic degree as well as the highest number of terms. We use the algebraic representation of the elemental components [38] to calculate the algebraic expression of the S-box.

When irreducible polynomial is x⁸+x⁷+x⁶+x⁵+x⁴+x+1:

$\begin{eqnarray*}&&\begin{array}{c}\left[\begin{array}{c}{x}_{0}\\ {x}_{1}\\ {x}_{2}\\ {x}_{3}\\ {x}_{4}\\ {x}_{5}\\ {x}_{6}\\ {x}_{7}\end{array}\right]\,=\left[\begin{array}{llllllll}49 & 216 & 174 & 203 & 88 & 27 & 182 & 120\\ 208 & 238 & 99 & 135 & 160 & 159 & 19 & 246\\ 104 & 194 & 25 & 178 & 104 & 194 & 25 & 178\\ 52 & 201 & 92 & 11 & 69 & 185 & 45 & 123\\ 43 & 111 & 215 & 251 & 129 & 180 & 124 & 33\\ 221 & 191 & 57 & 152 & 6 & 20 & 227 & 50\\ 166 & 139 & 240 & 196 & 13 & 81 & 90 & 31\\ 98 & 134 & 161 & 158 & 18 & 247 & 209 & 239\end{array}\right]\left[\begin{array}{c}x\\ {x}^{2}\\ {x}^{4}\\ {x}^{8}\\ {x}^{16}\\ {x}^{32}\\ {x}^{64}\\ {x}^{128}\end{array}\right]\end{array}\end{eqnarray*}$

$\begin{eqnarray*}Ax=\left[\begin{array}{llllllll}131 & 176 & 108 & 210 & 234 & 115 & 116 & 97\\ 137 & 244 & 212 & 254 & 144 & 70 & 188 & 60\\ 140 & 229 & 38 & 62 & 141 & 228 & 39 & 63\\ 119 & 100 & 146 & 66 & 172 & 207 & 72 & 232\\ 194 & 25 & 178 & 104 & 194 & 25 & 178 & 104\\ 80 & 91 & 30 & 167 & 138 & 241 & 197 & 12\\ 25 & 178 & 104 & 194 & 25 & 178 & 104 & 194\\ 245 & 213 & 255 & 145 & 71 & 189 & 61 & 136\end{array}\right]\left[\begin{array}{c}x\\ {x}^{2}\\ {x}^{4}\\ {x}^{8}\\ {x}^{16}\\ {x}^{32}\\ {x}^{64}\\ {x}^{128}\end{array}\right]\end{eqnarray*}$

After calculation, we can get $Ax=6x+36{x}^{2}+238{x}^{4}+23{x}^{8}+94{x}^{16}+229{x}^{32}+82{x}^{64}+177{x}^{128}$

So when b = 5, c = 22,

$\begin{eqnarray*}&&\begin{array}{c}S\left(x\right)={\left(Ax+b\right)}^{-1}\left(Ax+c\right)={\left(Ax+b\right)}^{254}\left(Ax+c\right)\,=\\ 96+43x+231{x}^{2}+\mathrm{..}.+167{x}^{253}+41{x}^{254}\end{array}\end{eqnarray*}$

The algebraic expression of Sbox1 has 255 terms and the maximum degree of this is 254, reaching the maximum number of terms and the maximum degree. Sbox1 algebraic expression coefficient matrix is shown in table 8.

Table 8. The algebraic expression coefficient of Sbox1.

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	96	43	231	118	54	66	225	195	110	71	237	70	103	96	14	47
1	159	174	100	188	20	12	56	129	13	127	160	79	67	232	21	6
2	155	53	149	73	237	24	185	133	55	157	62	48	253	187	216	225
3	180	23	58	218	144	1	187	156	242	160	201	109	186	15	104	137
4	53	182	201	88	127	154	126	132	84	78	39	106	42	80	6	247
5	121	149	233	142	183	123	251	66	81	54	106	37	32	72	40	122
6	67	175	56	70	149	111	12	54	140	252	3	64	210	80	149	203
7	65	170	144	169	153	228	235	49	106	158	35	112	235	4	173	166
8	130	105	241	43	197	175	69	4	168	30	179	49	140	116	39	33
9	84	243	24	49	223	95	248	23	45	199	155	26	223	70	161	60
A	72	201	252	185	50	104	23	121	195	50	195	16	102	179	240	19
B	8	230	24	78	127	50	111	180	254	106	232	100	2	223	119	60
C	106	203	7	250	87	78	62	200	92	1	142	185	152	124	44	247
D	59	239	212	158	43	80	229	237	21	185	146	15	11	130	72	55
E	15	137	106	29	213	229	163	140	235	11	84	69	39	11	183	159
F	190	14	163	163	6	41	109	162	9	173	128	249	156	167	41	0

3.2.5. Linear attacks

Linear attacks are one of the common attacks. This paper measures the ability of S-box to resist linear attacks by nonlinearity(NL) and Linear approximation probability(LP).

After calculation, the eight nonlinearities of both Sbox1 and the average of 1000 dynamic S-boxes are 112,112,112,112,112,112,112,112. The LP of both Sbox1 and the average of 1000 dynamic S-boxes is 0.0625, which means that the dynamic S-boxes generated in this paper has strong resistance to linear attacks.

3.2.6. Differential uniformity(DU)

Differential attack is used to break the cipher algorithm by analyzing the effect of the difference of the plaintext pair on the difference of the ciphertext pair. The differential uniformity is calculated as in equation (14).

$\begin{eqnarray}&&DU=\mathop{\max }\limits_{{\rm{\Delta }}x\ne 0,{\rm{\Delta }}y}\left(\#\left\{x\in S\left(x\right)| S\left(x\right)\oplus S\left(x\oplus \bigtriangleup x\right)=\bigtriangleup y\right\}\right)\end{eqnarray} \tag{ 14 }$

where ${\rm{\Delta }}x$ and ${\rm{\Delta }}y$ represent the input differential value and the output differential value, respectively. The smaller the differential uniformity, the better the S-box performance.

After calculation, the differential uniformity of both Sbox1 and the average of 1000 dynamic S-boxes is 4, which means that the dynamic S-boxes has strong resistance to differential attacks.

3.2.7. Strict avalanche criterion (SAC)

The strict avalanche criterion means that any input bit changes with a change probability of 0.5 for each output bit. The SAC correlation matrix is calculated as in equation (15).

$\begin{eqnarray}&&{P}_{t,i}\left(f\right)={2}^{-n}\displaystyle \displaystyle \sum _{x\in {{\mathbb{Z}}}_{2}^{n}}{f}_{i}\left(x\right)\oplus {f}_{i}\left(x\oplus {e}_{t}\right)\end{eqnarray} \tag{ 15 }$

where ${e}_{t}=1\lt \,\lt t,\,t\in {{\mathbb{Z}}}_{m}.$ Let offset denote the average distances between all values in the SAC correlation matrix and 0.5. The smaller the offset is, the better of S-box performance is.

The SAC correlation matrix for Sbox1 is shown in table 9. The offset of Sbox1 is 0.0291. The offset average of 1000 dynamic S-boxes is 0.0268. Therefore, the S-boxes generated by the dynamic high-performance S-box generation algorithm satisfy the strict avalanche criterion.

Table 9. SAC correlation matrix of Sbox1.

	0	1	2	3	4	5	6	7
0	0.5156	0.5469	0.4531	0.4531	0.5156	0.4375	0.4844	0.5313
1	0.4531	0.4688	0.4375	0.4844	0.4531	0.4688	0.5000	0.4531
2	0.5313	0.4375	0.4844	0.4844	0.5000	0.5625	0.4688	0.4531
3	0.5469	0.4844	0.4844	0.5000	0.5000	0.4375	0.4688	0.5313
4	0.4844	0.4844	0.5000	0.4844	0.5156	0.5156	0.4375	0.5469
5	0.5313	0.5000	0.4844	0.5156	0.5313	0.4844	0.4844	0.4844
6	0.4531	0.4844	0.5156	0.5000	0.5625	0.5313	0.4844	0.5313
7	0.5469	0.4688	0.5313	0.4688	0.5156	0.5625	0.5313	0.4688

3.2.8. Bits independence criterion (BIC)

The bits independence criterion of S-box is measured by the nonlinearity BIC_NL and strict avalanche criterion BIC_SAC of ${f}_{i}\left(x\right)\oplus {f}_{j}\left(x\right)$ $\left(0\leqslant i,j\lt m\right),$ where ${f}_{i}\left(x\right)$ and ${f}_{j}\left(x\right)$ belong to two different output bits of S(x). BIC_NL and BIC_SAC are calculated in a similar way as NL and SAC.

After calculation, the BIC_NL of both Sbox1 and the average of 1000 dynamic S-boxes is 112. The BIC_SAC of both Sbox1 and the average of 1000 dynamic S-boxes is 0.0105 and 0.0086. It means that the S-boxes generated by the dynamic high-performance S-box generation algorithm has good bits independence criterion.

3.2.9. Comparison of S-box performance

From table 10, it can be observed that the performance of Sbox1 and 1000 S-boxes generated by the dynamic S-box generation algorithm proposed in this paper is superior to that of other literature S-boxes.

Table 10. S-box performance comparison.

		Nonlinearity			SAC
S-box		Min.	Avg.	Max.	Min.	Max.	offset	LP	DU	BIC_ NL	BIC_ SAC_offset
Static S-box	Ref. [39]	106	107.00	108	0.4219	0.5781	0.0354	0.1563	10	103.50	0.0114
	Ref. [21]	110	110.25	112	0.4219	0.5781	0.0232	0.1250	10	104.07	0.0114
	Ref. [22]	112	112.00	112	0.4375	0.5781	0.0276	0.1094	10	104.79	0.0127
	Ref. [40]	104	106.25	110	0.4219	0.5938	0.0381	0.1406	10	103.36	0.0140
	Ref. [41]	104	107.00	110	0.4219	0.5938	0.0310	0.1328	10	103.29	0.0130
Dynamic S-box	Ref. [42]	98	103.75	106	0.3906	0.5938	0.0352	0.1250	12	103.86	0.0112
	Ref. [43]	99	103.88	108	0.3984	0.6172	0.0332	0.1211	10	103.89	0.0126
	Ref. [44]	102	104.00	108	0.3906	0.5625	0.0300	0.1328	10	103.00	0.0112
	Ref. [17]	104	105.50	108	0.3750	0.6250	0.0364	0.1250	10	103.79	0.0141
	Ref. [45]	100	104.00	106	0.3906	0.5781	0.0325	0.1250	12	103.21	0.0113
	Sbox 1	112	112.00	112	0.4375	0.5625	0.0291	0.0625	4	112.00	0.0105
	S-box Average	112	112.00	112	0.4803	0.5234	0.0268	0.0625	4	112.00	0.0086

4. Image cipher algorithm based on dynamic S-box and hyperchaotic system

We design an efficient and secure image cipher algorithm by hyperchaotic system and dynamic high-performance S-boxes. m represents the length of image and n represents the width of image. per represents the number of iterations, layer represents the selected layer number, mnum represents the selected row number, and nnum represents the selected column number. The above variables are initialized to 1. These definitions apply to all content in section 4.

4.1. Key generation

The initial values x₀, y₀, z₀, w₀ of chaotic equation are generated according to 192bit initial key Key inputted by user, including CKey₁, CKey₂, CKey₃, CKey₄.

4.1.1. Generation of initial values for the hyperchaotic equation

CKey₁, CKey₂, CKey₃ and CKey₄ are all 48bit. The four initial values x₀, y₀, z₀, w₀ of the hyperchaotic system are obtained by processing CKey_i according to equation (16).

$\begin{eqnarray}&&\left\{\begin{array}{c}{x}_{0}=\displaystyle \frac{CKe{y}_{1}}{{10}^{14}}-\unicode{x0230A}\displaystyle \frac{CKe{y}_{1}}{{10}^{14}}\unicode{x0230B}\\ {y}_{0}=\displaystyle \frac{CKe{y}_{2}}{{10}^{14}}-\unicode{x0230A}\displaystyle \frac{CKe{y}_{2}}{{10}^{14}}\unicode{x0230B}\\ {z}_{0}=\displaystyle \frac{CKe{y}_{3}}{{10}^{14}}-\unicode{x0230A}\displaystyle \frac{CKe{y}_{3}}{{10}^{14}}\unicode{x0230B}\\ {w}_{0}=\displaystyle \frac{CKe{y}_{4}}{{10}^{14}}-\unicode{x0230A}\displaystyle \frac{CKe{y}_{4}}{{10}^{14}}\unicode{x0230B}\end{array}\right.\end{eqnarray} \tag{ 16 }$

4.1.2. Dynamic S-box generation

First, input the initial values x₀, y₀, z₀, w₀ to the hyperchaotic system and eliminate the first 5000 pseudo-random sequences, then generate b_i, c_i, $i\in \left\{1,2,3\right\}$ according to equation (7). Judge whether b_i is equal to c_i. If so, xor c_i with 1. Then loop input b_i, c_i to generate high-performance S-box. The pseudo code is shown in Algorithm 1.

Algorithm 1. Generate S-box algorithm.

Input:	b_i, c_i, $i\in \left\{1,2,3\right\}$
Output:	S-boxes S₁, S₂, S₃
1:	for i = 1:3 do
2:	if b_i = c_i then
3:	${c}_{i}\leftarrow {c}_{i}\oplus 1$
4:	end if
5:	for x= 0:255 do
6:	if Ax + b = 0 then
7:	${S}_{i}\left(x\right)\leftarrow 1$
8:	else
9:	${S}_{i}\left(x\right)\leftarrow {\left(Ax+b\right)}^{-1}\left(Ax+c\right)$
10:	end if
11:	end for
12:	end for

4.2. Interleaved permutation

In order to improve the rate of permutation and the security of cipher algorithm, interleaved permutation is proposed. According to the sequence zkey_layer, zmsort_layer, znsort_layer, layer = {1,2,3} generated by the hyperchaotic system, the whole rows and columns in one layer are randomly permuted into the other two layers. The specific steps are as follows.

Step 1: Initialization. By using hyperchaotic system, generate the discretization sequence zkey of length 3*(m+n); obtain the index sequence zmsort, znsort of length 3m, 3n.

Step 2: Layers calculation. Get the value of temp according to mod(zkey_layer, 2). Then, according to table 11, get the value of zlayer.

Table 11. Correspondence between layers.

layer	temp	zlayer
1	0	2
1	1	3
2	0	1
2	1	3
3	0	1
3	1	2

Step 3: Row and column permutation selection. The value of tnum is calculated according to mod(per−1,2). If tnum = 0 and mnum $\leqslant$ m, or nnum > n, then go to Step 4; Otherwise go to Step 5.

Step 4: Row interleaving permutation. Swap the row that layer number is layer, row number is mnum with the row that layer number is zlayer, row number is zmsort_layer(mnum). Turn to Step 6.

Step 5: Column interleaving permutation. Swap the column that layer number is layer, column number is nnum with the column that layer number is zlayer and column number is znsort_layer(nnum).

Step 6: If each row and column in the image has undergone interleaving permutation, it ends. Otherwise, go to Step 2 and continue performing interleaving permutation on the next row or column.

When zkey=[[1,2,3,4,5,6,7,8],[10,11,12,13,14,15,16,17],[20,21,22,23,24,25,26,27]], zmsort=[[4,3,2,1],[3,2,1,4],[2,1,4,3]], znsort=[[1,4,3,2],[3,4,2,1],[4,2,1,3], an example of interleaved permutation for a color image of size 4 × 4 is shown in figure 7. After calculation, the row that layer number is 1 and row number is 1 is swapped with the row that layer number is 3 and row number is 4; The column that layer number is 1 and column number is 1 is swapped with the column that layer number is 2 and column number is 1; After dealing with all the rows and columns in this way, the final interleaved permutation result is obtained.

Figure 7. Refer to the following caption and surrounding text. — **Figure 7.** An example of interleaved permutation.
Download figure:
Standard image High-resolution image

If the image is a grayscale image, both the value of layer and zlayer are 1, which means that interleaved permutation is performed only in one layer.

4.3. Dynamic S-box substitution

Three dynamic S-boxes generated in section 4.1.2 are used to improve the security of the cipher algorithm. The sequence generated by the hyperchaotic system and three dynamic S-box are used to realize the substitution operation. The specific steps are as follows.

Step 1: Initialization. According to the hyperchaotic system, the discretization sequences dmkey, dnkey of length 3m, 3n are generated and three S-boxes S₁, S₂, S₃ are generated by Algorithm 1. first is the user input.

Step 2: The replacement of R layer. First calculate ca₁ by equation (17), then perform S-box substitution for R layer of image according to equation (18), where $i\in \{1,2,3,\mathrm{..}.,m\},$ $j\in \{1,2,3,\mathrm{..}.,n\},$ sImage represents the input image, and mImage represents the output image.

$\begin{eqnarray}&&c{a}_{1}=\,\mathrm{mod}\left(dmkey\left(i\right)+dnkey\left(j\right),256\right)\end{eqnarray} \tag{ 17 }$

$\begin{eqnarray}&&\begin{array}{c}mImage\left(i,j,1\right)\,=\\ \,\left\{\begin{array}{c}\mathrm{mod}\left(S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+first,256\right)\right)+sImage\left(i,j,1\right),256\right),i=1,j=1\\ \mathrm{mod}\left(S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i-1,n,3\right),256\right)\right)+sImage\left(i,j,1\right),256\right),i\ne 1,j=1\\ \mathrm{mod}\left(S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i,j-1,3\right),256\right)\right)+sImage\left(i,j,1\right),256\right),others\end{array}\right.\end{array}\end{eqnarray} \tag{ 18 }$

Step 3: The replacement of G layer. Perform S-box substitution for G layer of image according to equations (19) and (20).

$\begin{eqnarray}&&c{a}_{2}=\,\mathrm{mod}\left(dmkey\left(i+m\right)+dnkey\left(j+n\right),256\right)\end{eqnarray} \tag{ 19 }$

$\begin{eqnarray}&&mImage\left(i,j,2\right)=\,\mathrm{mod}\left(S{U}_{2}\left(\mathrm{mod}\left(c{a}_{2}+mImage\left(i,j,1\right),256\right)\right)+sImage\left(i,j,2\right),256\right)\end{eqnarray} \tag{ 20 }$

Step 4: The replacement of B layer. Perform S-box substitution for B layer of image according to equations (21) and (22).

$\begin{eqnarray}&&c{a}_{3}=\,\mathrm{mod}\left(dmkey\left(i+2m\right)+dnkey\left(j+2n\right),256\right)\end{eqnarray} \tag{ 21 }$

$\begin{eqnarray}&&mImage\left(i,j,3\right)=\,\mathrm{mod}\left(S{U}_{3}\left(\mathrm{mod}\left(c{a}_{3}+mImage\left(i,j,2\right),256\right)\right)+sImage\left(i,j,3\right),256\right)\end{eqnarray} \tag{ 22 }$

Step 5: Judge whether all values in the image have been substituted. If not, turn to Step 2; Otherwise, the dynamic S-box substitution ends.

When b₁=b₂=b₃ = 5, c₁=c₂=c₃ = 22, dmkey=[10,20,30,40,50,60,70,80,90,100,110,120], dnkey=[130,140,150,160,170,180,190,200,210,220,230,240], first = 0, SU₁, SU₂, SU₃ correspond to S₁, S₂, S₃ respectively, an example of dynamic S-box substitution for a color image of size 4 × 4 is shown in figure 8. Starting from the pixel value of 85 in the upper left corner of the first layer, the value becomes 185, calculated according to equation (18). Then the upper left corner value of the second layer change from 154 to 247 according to equation (20) and the value 185. Then, according to equation (22) and the value 247, the value of the upper left corner of the third layer change from 174 to 62. In this way, the result after dynamic S-box substitution is obtained.

Figure 8. Refer to the following caption and surrounding text. — **Figure 8.** An example of dynamic S-box substitution.
Download figure:
Standard image High-resolution image

The three-layer dynamic S-box inverse substitution for color image decryption is shown in equations (23)–(25), and the inverse S-box is not required.

$\begin{eqnarray}&&sImage\left(i,j,1\right)=\left\{\begin{array}{c}\mathrm{mod}\left(mImage\left(i,j,1\right)-S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+first,256\right)\right),256\right),i=1,j=1\\ \mathrm{mod}\left(mImage\left(i,j,1\right)-S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i-1,n,3\right),256\right)\right),256\right),i\ne 1,j=1\\ \mathrm{mod}\left(mImage\left(i,j,1\right)-S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i,j-1,3\right),256\right)\right),256\right),others\end{array}\right.\end{eqnarray} \tag{ 23 }$

$\begin{eqnarray}&&sImage\left(i,j,2\right)=\,\mathrm{mod}\left(mImage\left(i,j,2\right)-S{U}_{2}\left(\mathrm{mod}\left(c{a}_{2}+mImage\left(i,j,1\right),256\right)\right),256\right)\end{eqnarray} \tag{ 24 }$

$\begin{eqnarray}&&sImage\left(i,j,3\right)=\,\mathrm{mod}\left(mImage\left(i,j,3\right)-S{U}_{3}\left(\mathrm{mod}\left(c{a}_{3}+mImage\left(i,j,2\right),256\right)\right),256\right)\end{eqnarray} \tag{ 25 }$

When the image is grayscale, the corresponding dynamic S-box substitution and the dynamic S-box inverse substitution are shown in equations (17), (26), (27).

$\begin{eqnarray}&&mImage\left(i,j\right)=\left\{\begin{array}{c}\mathrm{mod}\left(sImage\left(i,j\right)+S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+first,256\right)\right),256\right),i=1,j=1\\ \mathrm{mod}\left(sImage\left(i,j\right)+S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i-1,n\right),256\right)\right),256\right),i\ne 1,j=1\\ \mathrm{mod}\left(sImage\left(i,j\right)+S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i,j-1\right),256\right)\right),256\right),others\end{array}\right.\end{eqnarray} \tag{ 26 }$

$\begin{eqnarray}&&sImage\left(i,j\right)=\left\{\begin{array}{c}\mathrm{mod}\left(mImage\left(i,j\right)-S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+first,256\right)\right),256\right),i=1,j=1\\ \mathrm{mod}\left(mImage\left(i,j\right)-S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i-1,n\right),256\right)\right),256\right),i\ne 1,j=1\\ \mathrm{mod}\left(mImage\left(i,j\right)-S{U}_{1}\left(\mathrm{mod}\left(c{a}_{1}+mImage\left(i,j-1\right),256\right)\right),256\right),others\end{array}\right.\end{eqnarray} \tag{ 27 }$

4.4. Cyclic shift permutation with fixed point

For the color image, the R, G, and B layers are connected by row or column to form a cylindrical side. The sequences generated by the hyperchaotic system are used to perform the row and column cyclic shift permutation. pkey is used to specify how many positions need to cyclic shift, msort is used to specify the row number to cyclic shift, and nsort is used to specify the column number to cyclic shift. Fixed point means that the last one position pixel of the image is not changed, so that if there is a change in the plaintext image, the change can be passed to each pixel of the image by the second round of dynamic S-box substitution. The specific encryption steps are as follows.

Step 1: Initialization. According to the hyperchaotic system, generate the discretization sequence pkey with length of m+n; obtain the sorted pseudo-random sequences msort and nsort with the length of m and n.

Step 2: The selection of row and column cyclic shift permutation. The tnum is obtained according to equation (28). When $tnum\in \{0,1\},$ turn to Step 3; When $tnum\in \{2,3\},$ turn to Step 4.

$\begin{eqnarray}&&tnum=\left\{\begin{array}{c}\mathrm{mod}\left(per-1,2\right)+2,nnum\gt n\\ \mathrm{mod}\left(per-1,2\right),mnum\gt m\\ \mathrm{mod}\left(per-1,4\right),{\rm{others}}\end{array}\right.\end{eqnarray} \tag{ 28 }$

Step 3: Connect the three RGB layers by columns to form a cylindrical side, which is of size $3m\times n.$ When tnum = 0, upward cyclic shift; when tnum = 1, downward cyclic shift. wper(i) is calculated according to equation (29) and represents the number of row after the pixel cyclic shift with row number i. Column cyclic shift permutation is performed at the column number nsort(nnum) according to wper. Turn to Step 5.

$\begin{eqnarray}&&wper\left(i\right)=\left\{\begin{array}{c}\mathrm{mod}\left(i-1-pkey\left(per\right),3m\right)+1,tnum=0\\ \mathrm{mod}\left(i-1+pkey\left(per\right),3m\right)+1,tnum=1\end{array}\right.,i\in \left\{1,2,3,\mathrm{..}.,3m\right\}\end{eqnarray} \tag{ 29 }$

Step 4: Connect the three RGB layers by rows to form a cylindrical side, which is of size $m\times 3n.$ When tnum = 2, left cyclic shift; When tnum = 3, right cyclic shift. wper(j) is calculated according to equation (30) and represents the number of column after the pixel cyclic shift with column number j. Row cyclic shift permutation is performed at the row number msort(mnum) according to wper. Turn to Step 5.

$\begin{eqnarray}&&wper\left(j\right)=\left\{\begin{array}{c}\mathrm{mod}\left(j-1-pkey\left(per\right),3n\right)+1,tnum=2\\ \mathrm{mod}\left(j-1+pkey\left(per\right),3n\right)+1,tnum=3\end{array}\right.,j\in \left\{1,2,3,\mathrm{..}.,3n\right\}\end{eqnarray} \tag{ 30 }$

Step 5: Judge whether nsort(nnum)=n or msort(mnum)=m. If it is, replace the last pixel of the image back.

Step 6: Judge whether all columns and rows of the image have been cyclic shift. If so, end and output the image; Otherwise, turn to Step 2.

Suppose the color image size is 4 × 4, pkey=[17,5,3,4,11,20,10,90], nsort=[3,4,1,2], msort=[1,2,3,4], the corresponding example of cyclic shift permutation is shown in figure 9. First, RGB three layers combined by column, the third column cyclic shift up by 17 positions. and the 4th column cyclic shift down by 5 positions. Since nsort(2)=m = 4, 43 is swapped with 48, and 48 is fixed as the last pixel. Then the RGB three layers are combined by row, the first row cyclic shift to the left by 3 positions and the second row cyclic shift to the right by 4 positions. After executing all the rows and columns in this way, the result image is obtained.

Figure 9. Refer to the following caption and surrounding text. — **Figure 9.** An example of cyclic shift permutation with fixed point.
Download figure:
Standard image High-resolution image

Since m may not equal to n and the row cyclic shift and the column cyclic shift are performed twice alternately, it is necessary to calculate np and mp first when decrypting. np, mp represents how many column or row cyclic shifts need to be performed first, respectively. When m>n, mp=m-floor(n/2)*2, np = 0. When n>m, np=n-(floor(m/2)*2<m? floor(m/2)*2+2: floor(m/2)*2), mp = 0.

If it is a gray image, only one layer is cyclic shifted by row and column. Other situations are similar with RGB images.

4.5. The proposed image encryption algorithm

The structure of the image encryption algorithm is shown in figure 10, where the initial values x₀, y₀, z₀, w₀ and are calculated from the user input key.

Figure 10. Refer to the following caption and surrounding text. — **Figure 10.** Image encryption structure.
Download figure:
Standard image High-resolution image

The specific steps for color image encryption are as follows.

Step 1: Initialization. Read in the plaintext image sImage. Based on the key input by user, the initial values x₀, y₀, z₀, w₀ of the hyperchaotic system and three S-boxes S₁, S₂, S₃ are generated.

Step 2: Interleaved permutation. The mImage is obtained by interleaved permutation. Set sImage=mImage.

Step 3: Dynamic S-box substitution. Let first = 0, SU₁, SU₂, SU₃ correspond to S₁, S₂, S₃ respectively, and get mImage by dynamic S-box substitution. Set sImage=mImage.

Step 4: Cyclic shift permutation with fixed point. The mImage is obtained by cyclic shift permutation with fixed point. Set sImage=mImage.

Step 5: Dynamic S-box substitution. Let first=sImage(m,n,3), SU₁, SU₂, SU₃ correspond to S₂, S₃, S₁ respectively, and get mImage by dynamic S-box substitution. Set sImage=mImage.

Step 6: Interleaved permutation. The mImage is obtained by interleaved permutation.

Step 7: Output cipher image mImage.

The overall process of grayscale image encryption and decryption algorithm is similar with color image, but the grayscale image algorithm only needs to generate one dynamic S-box.

4.6. Experimental results and performance evaluation

The following tests were performed in environments Intel(R) Core(TM) [email protected], 8GBRAM, Windows 10. The test images are from the USC-SIPI database, which is linked to https://sipi.usc.edu/database/.

4.6.1. Encryption and decryption results

Figure 11 shows that the encryption and decryption results of the color images: House, Baboon, San Diego and grayscale image: Airplane. The corresponding sizes of the images are $256\times 256,$ $512\times 512,$ $1024\times 1024,$ $256\times 256$ respectively. Visually, all ciphertext images appear snowflake-shaped, and plaintext pictures are the same with decrypted pictures.

Figure 11. Refer to the following caption and surrounding text. — **Figure 11.** Image encryption and decryption results.
Download figure:
Standard image High-resolution image

MSE and MSSIM are used to quantitatively measure the similarity between two images. The larger the MSE and the smaller the MSSIM, the greater difference between the two images. It can be observed from table 12 that plaintext images and ciphertext images are not similar, and plaintext images are the same with decrypted images.

Table 12. The results of MSE and MSSIM.

	PlainText Image & CipherText Image		PlainText Image & Decrypted Image
Image	MSE	MSSIM	MSE	MSSIM
House(4.1.05)	8395.1995	0.0258	0	1
Baboon(4.2.03)	8622.4728	0.0242	0	1
San Diego(2.2.01)	9211.0913	0.0230	0	1
Airplane(5.1.11)	10889.2502	0.0256	0	1

4.6.2. Histogram

Histogram is used to visualize the frequency distribution of each pixel value. The histograms of the four plaintext images and the corresponding ciphertext images are shown in figure 12. As can be observed from figure 12, the frequency of pixel values in plaintext images is not uniformly distributed, with peaks and valleys, while the frequency distribution of each pixel value in the ciphertext image connects into a line without large fluctuations. The ciphertext image generated by the proposed cipher algorithm has a uniform frequency distribution of pixel values and is resistant to statistical attacks.

Figure 12. Refer to the following caption and surrounding text. — **Figure 12.** Image histogram.
Download figure:
Standard image High-resolution image

4.6.3. Information entropy

The information entropy can be used to quantitatively describe the randomness of the ciphertext. The closer the ciphertext information entropy is to 8, the less information is revealed by the ciphertext. The information entropy is calculated for the four plaintext images and the corresponding ciphertext images, and the results are shown in table 13. From table 13, we can see that the information entropy of the plaintext images is low, and the information entropy of the ciphertext images is high and close to the theoretical value.

Table 13. Image information entropy results.

	PlainText Image				CipherText Image
Image	R	G	B	Avg.	R	G	B	Avg.
House	6.4311	6.5389	6.2320	6.4007	7.9977	7.9973	7.9973	7.9974
Baboon	7.7067	7.4744	7.7522	7.6444	7.9994	7.9993	7.9993	7.9993
San Diego	7.7575	7.3387	6.9561	7.3508	7.9998	7.9998	7.9998	7.9998
Airplane	—	—	—	7.1914	—	—	—	7.9967

As can be observed from table 14, the information entropy of the 512 × 512 color ciphertext image generated by the proposed algorithm is no less than that of algorithms [33, 46–48, 50]. The ciphertext image generated by proposed cipher algorithm is secure and randomized.

Table 14. Comparison of image information entropy.

	PlainText Image
Cipher Algorithm	R	G	B	Avg.
Ours	7.9994	7.9993	7.9993	7.99933
Ref. [46]	7.9993	7.9994	7.9993	7.99933
Ref. [47]	7.9917	7.9912	7.9918	7.99157
Ref. [48]	7.9992	7.9993	7.9992	7.99923
Ref. [33]	7.9912	7.9913	7.9914	7.99130
Ref. [49]	7.9994	7.9993	7.9994	7.99937
Ref. [50]	7.9994	7.9993	7.9993	7.99933

4.6.4. Adjacent pixel correlation

Adjacent pixel correlation is the elements correlation of horizontal, vertical, and diagonal. Adjacent pixel correlation can be used to check whether the ciphertext image will reveal information and contain laws. From figure 13, it can be observed that the adjacent pixels of the plaintext image are unevenly distributed with high correlation, and the pixels of the ciphertext image are evenly distributed over the whole plane with low correlation. Therefore, the proposed cipher algorithm can make adjacent pixel correlation of image lower.

Figure 13. Refer to the following caption and surrounding text. — Download figure:
Standard image High-resolution image

4.6.5. Differential attack

The ability of cipher algorithms to resist differential attacks is measured by NPCR and UACI. NPCR is the data change rate of two pairs data at the same position, and UACI is the overall change rate of two pairs data.

From [51], the theoretical values of NPCR and UACI for images with maximum pixel value of 255 are μ_N = 99.6094% and μ_u = 33.4635%. The NPCR and UACI tests were most stringent when $\alpha =0.05.$ The NPCR and UACI thresholds corresponding to different image sizes at $\alpha =0.05$ are shown in table 15. When NPCR ≥ ${N}_{0.05}^{* },$ UACI $\in$ ( ${u}_{0.05}^{* -},$ ${u}_{0.05}^{* +}$ ), image passes NPCR and UACI tests.

Table 15. Thresholds about NPCR and UACI for different image sizes.

	NPCR(%)		UACI(%)
Image Size	${N}_{0.05}^{* }$	${\mu }_{N}$	${u}_{0.05}^{* -}$	${u}_{0.05}^{* +}$	${\mu }_{u}$
64 × 64	99.4491	99.6094	32.7389	34.1882	33.4635
128 × 128	99.5292	99.6094	33.1012	33.8259	33.4635
256 × 256	99.5693	99.6094	33.2824	33.6447	33.4635
512 × 512	99.5893	99.6094	33.3730	33.5541	33.4635
1024 × 1024	99.5994	99.6094	33.4183	33.5088	33.4635

The average of the corresponding NPCR and UACI obtained by repeating 100 times are shown in table 16 and all ciphertext images pass the NPCR and UACI tests.

Table 16. Test results about NPCR and UACI.

	NPCR(%)				UACI(%)
Image	R	G	B	Avg.	R	G	B	Avg.	Test Result
House	99.6086	99.6062	99.6092	99.6080	33.5075	33.4515	33.4353	33.4648	PASS
Baboon	99.6139	99.6125	99.6108	99.6124	33.4655	33.4566	33.4352	33.4524	PASS
San Diego	99.6125	99.6130	99.6120	99.6125	33.4716	33.4514	33.4622	33.4617	PASS
Airplane	—	—	—	99.6056	—	—	—	33.4638	PASS

As shown in table 17, the results of NPCR and UACI tests on 512*512 color images are compared with other literature. The NPCR of the proposed algorithm is closer to the theoretical value than that of other algorithms. The UACI is closer to the theoretical value than UACI of the literature [33, 46, 49, 50, 52]. Therefore, the proposed cryptographic algorithm is resistant to differential attacks.

Table 17. Comparison of NPCR and UACI.

	NPCR(%)				UACI(%)
	R	G	B	Avg.	R	G	B	Avg.
Our	99.6058	99.6095	99.6092	99.6082	33.4606	33.4698	33.4443	33.4582
Ref. [46]	99.6200	99.6100	99.6200	99.6167	33.4600	33.5600	33.5100	33.5100
Ref. [47]	99.6243	99.6185	99.6281	99.6236	33.4224	33.4362	33.4604	33.4397
Ref. [33]	99.6243	99.6433	99.6029	99.6235	33.4686	33.5020	33.4155	33.4620
Ref. [49]	99.6479	99.6597	99.6288	99.6455	33.4390	33.4799	33.4833	33.4674
Ref. [50]	99.6296	99.6174	99.6473	99.6314	33.6027	33.4997	33.5516	33.5513
Ref. [52]	99.6052	99.6120	99.6303	99.6158	33.4025	33.4428	33.5029	33.4494

4.6.6. Select plaintext attack

Selective plaintext attack means that the attacker can know the ciphertext corresponding to any of the plaintexts, so the ciphertext with a regular pattern can be obtained by carefully constructing the contents of plaintext and be used to crack the cipher algorithm. The cipher images obtained by encrypting 512*512 all-black and all-white color images are analyzed to judge whether the proposed cipher algorithm can resist the selective plaintext attack. As shown in figure 14, the proposed algorithm is visually resistant to the selective plaintext attack.

Figure 14. Refer to the following caption and surrounding text. — **Figure 14.** Select plaintext attack test results.
Download figure:
Standard image High-resolution image

As shown in table 18, the white and black cipher images still have high security, which means that the cryptographic algorithm proposed in this paper can resist selective plaintext attack.

Table 18. Security test results of all black and white pictures.

			Differential attack		Correlation coefficients
Image	Channel	Information Entropy	NPCR(%)	UACI(%)	Horizontal	Vertical	Diagonal
White	R	7.9992	99.6078	33.4578	0.0015	0.0020	0.0021
	G	7.9993	99.6086	33.4640	0.0016	0.0017	0.0033
	B	7.9993	99.6082	33.4712	0.0015	0.0014	0.0016
Black	R	7.9994	99.6097	33.4600	0.0016	0.0023	0.0024
	G	7.9993	99.6113	33.4517	0.0016	0.0019	0.0055
	B	7.9993	99.6107	33.4589	0.0017	0.0016	0.0028

4.6.7. Key space size

The key size for the proposed cipher algorithm is 192bit which is exceeds 128, so the proposed cipher algorithm can resist brute-force attack.

4.6.8. Key sensitivity

Key sensitivity refers to two aspects: one is decryption sensitivity: a small change in the key will make the decrypted image of the ciphertext image different from the plaintext image; The second is encryption sensitivity: small changes in the key will cause the ciphertext image to be different. The proposed algorithm sets up three 192-bit keys K₁, K₂ and K₃, of which K₁ is only 1 bit different from K₂ and K₃.

K₁= 210CD20802249A787989BCD0774428912873145693293AB3

K₂= 310CD20802249A787989BCD0774428912873145693293AB3

K₃= 210CD20802249A787989BCD0774428912873145693293AB2

As shown in figure 15, visually, the ciphertext image obtained by using key K₁ encryption can only be decrypted by the original key K₁ and cannot be decrypted by using keys K₂ and K₃. The key of the proposed cipher algorithm has decryption sensitivity.

Figure 15. Refer to the following caption and surrounding text. — **Figure 15.** Encryption and decryption diagram of different keys.
Download figure:
Standard image High-resolution image

PSNR is used to measure whether two pairs data are similar or not. The encryption sensitivity is measured by NPCR, UACI, PSNR and MSSIM. The closer the NPCR is to 99.6094%, the closer the UACI is to 33.4635%, and the smaller the PSNR and MSSIM are, the more sensitive the key is.

Suppose that the encrypted images obtained by keys K₁, K₂ and K₃ are E₁, E₂ and E₃, respectively. As shown in table 19, the values indicate that a mere 1bit change in the key can also cause the ciphertext image to be very different, so the key of the proposed image cipher algorithm has encryption sensitive.

Table 19. Key encryption sensitivity results.

		E₁&E_i
Image	Key	NPCR	UACI	PSNR	MSSIM
House	K2	99.6109	33.4652	7.7397	0.0143
	K3	99.6277	33.5422	7.7547	0.0173
Baboon	K2	99.6014	33.4305	7.7544	0.0154
	K3	99.6201	33.4105	7.7613	0.0171
San Diego	K2	99.6035	33.4661	7.7503	0.0153
	K3	99.6134	33.4554	7.7496	0.0155
Airplane	K2	99.6185	33.4627	7.7673	0.0179
	K3	99.6140	33.4191	7.7496	0.0110

4.6.9. Efficiency

In order to verify the efficiency of the proposed image cipher algorithm, the average time to encrypt the same color image and same grayscale image of size 256 × 256, 512 × 512, 1024 × 1024 repeated 100 times is compared and the results are shown in table 20. From table 20, it can be observed that the proposed image cipher algorithm has high efficiency in processing both grayscale and color images at different scales.

Table 20. Comparison of time consumption.

	Gray image		Color image
Cipher Algorithm	256*256	512*512	1024*1024	256*256	512*512	1024*1024
Ours	0.1056	0.1512	0.3304	0.1956	0.3620	1.2604
Ref.[53]	0.1745	0.9178	2.7710	1.2866	4.8242	20.3141
Ref.[49]	—	—	—	0.1385	0.5693	2.8148
Ref.[54]	0.1059	0.5135	3.0835	0.4550	2.3439	14.5444
Ref.[55]	2.0064	2.0825	2.0854	2.7715	2.9095	2.9884
Ref.[56]	0.4091	1.6470	6.8327	1.2085	4.8322	24.9778
Ref.[57]	—	—	—	7.9765	39.1302	—

5. Conclusion

The four-dimensional hyperchaotic system is proposed on the basis of the three-dimensional Lű chaotic system. Then, the method of generating S-box by AES is improved, and the relative suitable irreducible polynomial and affine matrix are selected by combining different irreducible polynomials and affine matrices on the basis of GF(2⁸). Dynamic high-performance 8 × 8 S-box generation is achieved by calculating affine multiplication and multiplication inverse matrices in advance. Based on the new four-dimensional hyperchaotic system and the method of generating S-box in real time, a image cipher algorithm that can securely and efficiently encrypt images of any size is designed. In order to improve the ability of the image to resist differential attacks, cyclic shift permutation with fixed point is set to ensure that the plaintext transformation can be transferred to entire image through the second round of dynamic S-box substitution. The proposed image cipher algorithm can be used only for encrypting and decrypting images. Further research can be done to design an efficient and secure cipher algorithm that can encrypt and decrypt both text and images.

Acknowledgments

This work was supported by the following projects and foundations: the National Natural Science Foundation of China (No.61902091); Shandong Provincial Natural Science Foundation(No.ZR2019MF054).

Data availability statement

All data that support the findings of this study are included within the article (and any supplementary files).

Conflict of interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	0	131	7	132	14	141	9	138	28	159	27	152	18	145	21	150
1	56	187	63	188	54	181	49	178	36	167	35	160	42	169	45	174
2	112	243	119	244	126	253	121	250	108	239	107	232	98	225	101	230
3	72	203	79	204	70	197	65	194	84	215	83	208	90	217	93	222
4	224	99	231	100	238	109	233	106	252	127	251	120	242	113	245	118
5	216	91	223	92	214	85	209	82	196	71	195	64	202	73	205	78
6	144	19	151	20	158	29	153	26	140	15	139	8	130	1	133	6
7	168	43	175	44	166	37	161	34	180	55	179	48	186	57	189	62
8	193	66	198	69	207	76	200	75	221	94	218	89	211	80	212	87
9	249	122	254	125	247	116	240	115	229	102	226	97	235	104	236	111
A	177	50	182	53	191	60	184	59	173	46	170	41	163	32	164	39
B	137	10	142	13	135	4	128	3	149	22	146	17	155	24	156	31
C	33	162	38	165	47	172	40	171	61	190	58	185	51	176	52	183
D	25	154	30	157	23	148	16	147	5	134	2	129	11	136	12	143
E	81	210	86	213	95	220	88	219	77	206	74	201	67	192	68	199
F	105	234	110	237	103	228	96	227	117	246	114	241	123	248	124	255

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	0	1	249	174	133	203	87	220	187	229	156	136	210	239	110	232
1	164	88	139	130	78	190	68	244	105	219	142	242	55	120	116	161
2	82	206	44	254	188	200	65	40	39	64	95	73	34	255	122	144
3	205	162	148	153	71	126	121	28	226	253	60	93	58	92	169	106
4	41	38	103	180	22	245	127	52	94	43	100	250	217	154	20	191
5	234	98	32	207	214	119	221	6	17	165	134	115	61	59	72	42
6	159	167	81	235	74	251	181	66	218	24	63	168	197	208	14	233
7	113	112	135	91	30	160	215	85	29	54	46	145	173	150	53	70
8	237	147	19	138	202	4	90	114	11	157	131	18	198	222	26	243
9	47	123	236	129	50	152	125	172	149	51	77	216	10	137	166	96
A	117	31	49	204	16	89	158	97	107	62	194	178	151	124	3	248
B	241	246	171	195	67	102	192	225	231	213	228	8	36	201	21	79
C	182	224	170	179	209	108	140	223	37	189	132	5	163	48	33	83
D	109	196	12	238	230	185	84	118	155	76	104	25	7	86	141	199
E	193	183	56	252	186	9	212	184	15	111	80	99	146	128	211	13
F	247	176	27	143	23	69	177	240	175	2	75	101	227	57	35	45

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	97	150	241	208	190	172	41	79	162	44	17	173	54	145	31	53
1	252	157	99	80	110	105	146	170	62	164	248	163	229	156	13	182
2	83	131	95	144	246	178	148	179	90	40	243	38	205	46	4	174
3	91	103	210	87	220	250	168	238	184	213	200	27	202	120	209	73
4	138	207	47	42	171	177	195	50	39	134	65	143	122	48	3	133
5	66	115	6	12	75	7	211	107	185	231	242	37	29	132	43	196
6	125	167	109	176	151	21	191	64	34	49	124	88	123	121	126	161
7	137	227	234	235	24	14	194	236	16	169	204	175	10	9	192	239
8	28	251	165	255	106	217	183	142	72	104	181	112	100	36	128	116
9	140	129	193	5	111	93	180	118	223	20	8	85	58	15	127	86
A	222	22	249	11	245	189	71	216	51	96	226	82	23	84	35	160
B	166	33	228	61	247	18	77	81	149	0	135	25	57	197	130	212
C	68	141	136	2	201	69	155	52	159	153	32	56	214	244	117	254
D	206	158	92	186	139	240	98	154	1	152	219	114	108	253	230	19
E	101	55	45	89	76	63	26	225	218	94	113	102	188	74	30	237
F	147	198	203	224	59	233	215	67	78	199	119	187	232	60	221	70

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	96	43	231	118	54	66	225	195	110	71	237	70	103	96	14	47
1	159	174	100	188	20	12	56	129	13	127	160	79	67	232	21	6
2	155	53	149	73	237	24	185	133	55	157	62	48	253	187	216	225
3	180	23	58	218	144	1	187	156	242	160	201	109	186	15	104	137
4	53	182	201	88	127	154	126	132	84	78	39	106	42	80	6	247
5	121	149	233	142	183	123	251	66	81	54	106	37	32	72	40	122
6	67	175	56	70	149	111	12	54	140	252	3	64	210	80	149	203
7	65	170	144	169	153	228	235	49	106	158	35	112	235	4	173	166
8	130	105	241	43	197	175	69	4	168	30	179	49	140	116	39	33
9	84	243	24	49	223	95	248	23	45	199	155	26	223	70	161	60
A	72	201	252	185	50	104	23	121	195	50	195	16	102	179	240	19
B	8	230	24	78	127	50	111	180	254	106	232	100	2	223	119	60
C	106	203	7	250	87	78	62	200	92	1	142	185	152	124	44	247
D	59	239	212	158	43	80	229	237	21	185	146	15	11	130	72	55
E	15	137	106	29	213	229	163	140	235	11	84	69	39	11	183	159
F	190	14	163	163	6	41	109	162	9	173	128	249	156	167	41	0

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	0	131	7	132	14	141	9	138	28	159	27	152	18	145	21	150
1	56	187	63	188	54	181	49	178	36	167	35	160	42	169	45	174
2	112	243	119	244	126	253	121	250	108	239	107	232	98	225	101	230
3	72	203	79	204	70	197	65	194	84	215	83	208	90	217	93	222
4	224	99	231	100	238	109	233	106	252	127	251	120	242	113	245	118
5	216	91	223	92	214	85	209	82	196	71	195	64	202	73	205	78
6	144	19	151	20	158	29	153	26	140	15	139	8	130	1	133	6
7	168	43	175	44	166	37	161	34	180	55	179	48	186	57	189	62
8	193	66	198	69	207	76	200	75	221	94	218	89	211	80	212	87
9	249	122	254	125	247	116	240	115	229	102	226	97	235	104	236	111
A	177	50	182	53	191	60	184	59	173	46	170	41	163	32	164	39
B	137	10	142	13	135	4	128	3	149	22	146	17	155	24	156	31
C	33	162	38	165	47	172	40	171	61	190	58	185	51	176	52	183
D	25	154	30	157	23	148	16	147	5	134	2	129	11	136	12	143
E	81	210	86	213	95	220	88	219	77	206	74	201	67	192	68	199
F	105	234	110	237	103	228	96	227	117	246	114	241	123	248	124	255

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	0	1	249	174	133	203	87	220	187	229	156	136	210	239	110	232
1	164	88	139	130	78	190	68	244	105	219	142	242	55	120	116	161
2	82	206	44	254	188	200	65	40	39	64	95	73	34	255	122	144
3	205	162	148	153	71	126	121	28	226	253	60	93	58	92	169	106
4	41	38	103	180	22	245	127	52	94	43	100	250	217	154	20	191
5	234	98	32	207	214	119	221	6	17	165	134	115	61	59	72	42
6	159	167	81	235	74	251	181	66	218	24	63	168	197	208	14	233
7	113	112	135	91	30	160	215	85	29	54	46	145	173	150	53	70
8	237	147	19	138	202	4	90	114	11	157	131	18	198	222	26	243
9	47	123	236	129	50	152	125	172	149	51	77	216	10	137	166	96
A	117	31	49	204	16	89	158	97	107	62	194	178	151	124	3	248
B	241	246	171	195	67	102	192	225	231	213	228	8	36	201	21	79
C	182	224	170	179	209	108	140	223	37	189	132	5	163	48	33	83
D	109	196	12	238	230	185	84	118	155	76	104	25	7	86	141	199
E	193	183	56	252	186	9	212	184	15	111	80	99	146	128	211	13
F	247	176	27	143	23	69	177	240	175	2	75	101	227	57	35	45

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	97	150	241	208	190	172	41	79	162	44	17	173	54	145	31	53
1	252	157	99	80	110	105	146	170	62	164	248	163	229	156	13	182
2	83	131	95	144	246	178	148	179	90	40	243	38	205	46	4	174
3	91	103	210	87	220	250	168	238	184	213	200	27	202	120	209	73
4	138	207	47	42	171	177	195	50	39	134	65	143	122	48	3	133
5	66	115	6	12	75	7	211	107	185	231	242	37	29	132	43	196
6	125	167	109	176	151	21	191	64	34	49	124	88	123	121	126	161
7	137	227	234	235	24	14	194	236	16	169	204	175	10	9	192	239
8	28	251	165	255	106	217	183	142	72	104	181	112	100	36	128	116
9	140	129	193	5	111	93	180	118	223	20	8	85	58	15	127	86
A	222	22	249	11	245	189	71	216	51	96	226	82	23	84	35	160
B	166	33	228	61	247	18	77	81	149	0	135	25	57	197	130	212
C	68	141	136	2	201	69	155	52	159	153	32	56	214	244	117	254
D	206	158	92	186	139	240	98	154	1	152	219	114	108	253	230	19
E	101	55	45	89	76	63	26	225	218	94	113	102	188	74	30	237
F	147	198	203	224	59	233	215	67	78	199	119	187	232	60	221	70

	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
0	96	43	231	118	54	66	225	195	110	71	237	70	103	96	14	47
1	159	174	100	188	20	12	56	129	13	127	160	79	67	232	21	6
2	155	53	149	73	237	24	185	133	55	157	62	48	253	187	216	225
3	180	23	58	218	144	1	187	156	242	160	201	109	186	15	104	137
4	53	182	201	88	127	154	126	132	84	78	39	106	42	80	6	247
5	121	149	233	142	183	123	251	66	81	54	106	37	32	72	40	122
6	67	175	56	70	149	111	12	54	140	252	3	64	210	80	149	203
7	65	170	144	169	153	228	235	49	106	158	35	112	235	4	173	166
8	130	105	241	43	197	175	69	4	168	30	179	49	140	116	39	33
9	84	243	24	49	223	95	248	23	45	199	155	26	223	70	161	60
A	72	201	252	185	50	104	23	121	195	50	195	16	102	179	240	19
B	8	230	24	78	127	50	111	180	254	106	232	100	2	223	119	60
C	106	203	7	250	87	78	62	200	92	1	142	185	152	124	44	247
D	59	239	212	158	43	80	229	237	21	185	146	15	11	130	72	55
E	15	137	106	29	213	229	163	140	235	11	84	69	39	11	183	159
F	190	14	163	163	6	41	109	162	9	173	128	249	156	167	41	0