IEEE SIGNAL PROCESSING LETTERS, VOL. 18, NO.

4, APRIL 2011 255

Reversible Data Hiding in Encrypted Image

Xinpeng Zhang

Abstract—This work proposes a novel reversible data hiding does not know the original image content. For example, when
scheme for encrypted image. After encrypting the entire data of medical images have been encrypted for protecting the patient
an uncompressed image by a stream cipher, the additional data privacy, a database administrator may aim to embed the personal
can be embedded into the image by modifying a small proportion
of encrypted data. With an encrypted image containing additional information into the corresponding encrypted images. It may be
data, one may firstly decrypt it using the encryption key, and the also hopeful that the original content can be recovered without
decrypted version is similar to the original image. According to any error after decryption and retrieve of additional message at
the data-hiding key, with the aid of spatial correlation in natural receiver side. That means a reversible data hiding scheme for
image, the embedded data can be successfully extracted and the encrypted image is desirable.
original image can be perfectly recovered.
In some existing joint data-hiding and encryption schemes,
Index Terms—Image encryption, image recovery, reversible data a part of cover data is used to carry the additional message and
hiding.
the rest data are encrypted. For example [7], the intra-prediction
mode, motion vector difference and signs of DCT coefficients
I. INTRODUCTION are encrypted, while a watermark is embedded into the ampli-
tudes of DCT coefficients. In [8], the cover data in higher and

R EVERSIBLE data hiding is a technique to embed addi-

tional message into some distortion-unacceptable cover
media, such as military or medical images, with a reversible
lower bit-planes of transform domain are respectively encrypted
and watermarked. In [9], the content owner encrypts the signs
of host DCT coefficients and each content-user uses a different
manner so that the original cover content can be perfectly key to decrypt only a subset of the coefficients, so that a se-
restored after extraction of the hidden message. A number of ries of versions containing different fingerprints are generated
reversible data hiding methods have been proposed in recent for the users. In these joint schemes, however, only a partial en-
years. In difference expansion method [1], differences between cryption is involved, leading to a leakage of partial information
two adjacent pixels are doubled to generate a new least signifi- of the cover. Furthermore, the separation of original cover and
cant bit (LSB) plane for accommodating additional data. A data embedded data from a watermarked version is not considered.
hider can also perform reversible data hiding using a histogram In [10] and [11], each sample of a cover signal is encrypted by
shift mechanism, which utilizes the zero and peak points of a public-key mechanism and a homomorphic property of en-
the histogram of an image and slightly modifies the pixel cryption is exploited to embed some additional data into the en-
gray values to embed data into the image [2]. Another kind crypted signal. But the data amount of encrypted signal is signif-
of method makes use of redundancy in a cover by performing icantly expanded and the computation complexity is high. Also,
lossless compression to create a spare space for data embed- the data embedding is not reversible.
ding [3]. Furthermore, various skills have been introduced into This work proposes a novel reversible data hiding scheme for
the typical reversible data hiding approaches to improve the encrypted image, which is made up of image encryption, data
performance [4]–[6]. embedding and data-extraction/image-recovery phases. The
As is well known, encryption is an effective and popular data of original cover are entirely encrypted, and the additional
means of privacy protection. In order to securely share a secret message is embedded by modifying a part of encrypted data.
image with other person, a content owner may encrypt the image At receiver side, with the aid of spatial correlation in natural
before transmission. In some application scenarios, an inferior image, the embedded data are successfully extracted while the
assistant or a channel administrator hopes to append some addi- original image is perfectly recovered.
tional message, such as the origin information, image notation
or authentication data, within the encrypted image though he
II. PROPOSED SCHEME

Manuscript received December 13, 2010; revised January 26, 2011; accepted A sketch of the proposed scheme is given in Fig. 1. A content
February 06, 2011. Date of publication February 14, 2011; date of current owner encrypts the original uncompressed image using an en-
version February 28, 2011. This work was supported by the Natural Science
cryption key to produce an encrypted image, and then a data-
Foundation of China (61073190, 60872116, and 60832010), the Shanghai
Rising-Star Program (10QH14011), and the Key Scientific Research Project of hider embeds additional data into the encrypted image using
Shanghai Education Committee (10ZZ59). The associate editor coordinating a data-hiding key though he does not know the original con-
the review of this manuscript and approving it for publication was Prof. H.
tent. With an encrypted image containing additional data, a re-
Vicky Zhao.
The author is with the School of Communication and Information ceiver may firstly decrypt it using the encryption key, and the
Engineering, Shanghai University, Shanghai 200072, China (e-mail: decrypted version is similar to the original image. According to
[email protected]).
the data-hiding key, he can further extract the embedded data
Color versions of one or more of the figures in this paper are available online
at http://ieeexplore.ieee.org. and recover the original image from the decrypted version. The
Digital Object Identifier 10.1109/LSP.2011.2114651 detailed procedures are as follows.

1070-9908/$26.00 © 2011 IEEE

256 IEEE SIGNAL PROCESSING LETTERS, VOL. 18, NO. 4, APRIL 2011

If the additional bit is 1, flip the 3 encrypted LSB of pixels in

,

and (5)

The other encrypted data are not changed.

C. Data Extraction and Image Recovery

When having an encrypted image containing embedded data,
Fig. 1. Sketch of proposed scheme. a receiver firstly generates according to the encryption
key, and calculates the exclusive-or of the received data and
A. Image Encryption to decrypt the image. We denote the decrypted bits as
. Clearly, the original five most significant bits (MSB) are
Assume the original image is in uncompressed format and retrieved correctly. For a certain pixel, if the embedded bit in
each pixel with gray value falling into [0, 255] is represented the block including the pixel is zero and the pixel belongs to
by 8 bits. Denote the bits of a pixel as , or the embedded bit is 1 and the pixel belongs to , the
where indicates the pixel position, and the gray value as data-hiding does not affect any encrypted bits of the pixel. So,
. Thus the three decrypted LSB must be same as the original LSB, im-
plying that the decrypted gray value of the pixel is correct. On
(1) the other hand, if the embedded bit in the pixel’s block is 0 and
the pixel belongs to , or the embedded bit is 1 and the pixel
and belongs to , the decrypted LSB

(2)

In encryption phase, the exclusive-or results of the original bits

and pseudo-random bits are calculated (6)

(3) That means the three decrypted LSB must be different from the
original LSB. In this case:
where are determined by an encryption key using a stan-
dard stream cipher. Then, are concatenated orderly as the (7)
encrypted data. A number of secure stream cipher methods can
be used here to ensure that anyone without the encryption key, So, the sum of decimal values of three decrypted LSB and three
such as a potential attacker or the data hider, cannot obtain any original LSB must be seven. The average energy of errors be-
information about original content from the encrypted data. tween the decrypted and original gray values is

B. Data Embedding (8)

With the encrypted data, although a data-hider does not know

the original image content, he can embed additional message As the probability of incorrect LSB-decryption is 1/2, when re-
into the image by modifying a small proportion of encrypted constructing an image using the decrypted data, the value of
data. Firstly, the data-hider segments the encrypted image into a PSNR in the decrypted image is approximately
number of nonoverlapping blocks sized by . In other words,
the encrypted bits satisfying , (9)
and ( and are positive
integers) are within a same block. Then, each block will be used
to carry one additional bit. Then, the receiver will extract the embedded bits and recover
For each block, pseudo-randomly divide the pixels into the original content from the encrypted image. According to
two sets and according to a data-hiding key. Here, the the data-hiding key, he may segment the decrypted image into
probability that a pixel belongs to or is 1/2. If the addi- blocks and divide the pixels in each block into two sets in a
tional bit to be embedded is 0, flip the 3 least significant bits same way. For each decrypted block, the receiver flips all the
(LSB) of each encrypted pixel in , three LSB of pixels in to form a new block, and flips all the
three LSB of pixels in to form another new block. We denote
the two new blocks as and . There must be that either
(4) or is the original block, and another one is more seriously
ZHANG: REVERSIBLE DATA HIDING IN ENCRYPTED IMAGE 257

Fig. 2. (a) Original Lena, (b) its encrypted version, and (c) a decrypted version
Fig. 3. Blocks of incorrect bit-extraction with the cover Lena and .
containing embedded data.

interfered due to the LSB flip operation. For the two blocks sized
by , define a function to measure the fluctuation in them

(10)

and denote the values of fluctuation function of and as

and , respectively. Because of spatial correlation in natural
image, the fluctuation function of original block is generally
lower than that of a seriously interfered version. So, the receiver
can perform data extraction and image recovery by comparing
and . If , regard as the original content of the
block and let the extracted bit be 0. Otherwise, regard as
the original content of this block and extract a bit 1. Finally,
concatenate the extracted bits to retrieve the additional message Fig. 4. Extracted-bit error rate with respect to block sizes.
and collect the recovered blocks to form the original image.

III. EXPERIMENTAL RESULTS of bit extraction and image recovery rises. Fig. 3 indicates the
The test image Lena sized 512 512 shown in Fig. 2(a) was blocks of incorrect bit-extraction when the original cover Lena
used as the original cover in the experiment. After image en- and were used, and most of the blocks are in texture
cryption, the 8 encrypted bits of each pixel are converted into a area due to the weak spatial correlation. Fig. 4 shows the ex-
gray value to generate an encrypted image shown in Fig. 2(b). tracted-bit error rate with respect to block sizes when four test
Then, we embedded 256 bits into the encrypted image by using images Lena, Man, Lake and Baboon sized 512 512 were used
the side length of each block . The decrypted image is as the original covers. These covers are standard test images
given as Fig. 2(c), and the values of PSNR caused by data em- and freely available in many image databases. Here, the ex-
bedding is 37.9 dB, which is imperceptible and verifies the the- tracted-bit error rate is equivalent to the rate of unsuccessful
oretical analysis in (9). At last, the embedded data were success- block recovery. It can be seen that the smoother the cover image,
fully extracted and the original image was perfectly recovered the better is the performance of data extraction and image re-
from the decrypted image. covery. When the side length of block is not less than 32, for
In the proposed scheme, the smaller the block size, the more most cover images, all the embedded bits can be correctly ex-
additional data can be embedded. However, the risk of defeat tracted and the original image can be successfully recovered.
258 IEEE SIGNAL PROCESSING LETTERS, VOL. 18, NO. 4, APRIL 2011

IV. CONCLUSION AND DISCUSSION REFERENCES

[1] J. Tian, “Reversible data embedding using a difference expansion,”
In this work, a novel reversible data hiding scheme for en- IEEE Trans. Circuits Syst. Video Technol., vol. 13, no. 8, pp. 890–896,
Aug. 2003.
crypted image with a low computation complexity is proposed, [2] Z. Ni, Y.-Q. Shi, N. Ansari, and W. Su, “Reversible data hiding,” IEEE
which consists of image encryption, data embedding and data- Trans. Circuits Syst. Video Technol., vol. 16, no. 3, pp. 354–362, 2006.
extraction/image-recovery phases. The data of original image [3] M. U. Celik, G. Sharma, A. M. Tekalp, and E. Saber, “Lossless gen-
eralized-LSB data embedding,” IEEE Trans. Image Process., vol. 14,
are entirely encrypted by a stream cipher. Although a data-hider no. 2, pp. 253–266, Feb. 2005.
does not know the original content, he can embed additional [4] L. Luo, Z. Chen, M. Chen, X. Zeng, and Z. Xiong, “Reversible image
watermarking using interpolation technique,” IEEE Trans. Inf. Foren-
data into the encrypted image by modifying a part of encrypted sics Secur., vol. 5, no. 1, pp. 187–193, 2010.
data. With an encrypted image containing embedded data, a re- [5] W. Hong, T.-S. Chen, Y.-P. Chang, and C.-W. Shiu, “A high capacity
reversible data hiding scheme using orthogonal projection and predic-
ceiver may firstly decrypt it using the encryption key, and the tion error modification,” Signal Process., vol. 90, pp. 2911–2922, 2010.
decrypted version is similar to the original image. According to [6] C.-C. Chang, C.-C. Lin, and Y.-H. Chen, “Reversible data-embedding
the data-hiding key, with the aid of spatial correlation in natural scheme using differences between original and predicted pixel values,”
Inform. Secur., vol. 2, no. 2, pp. 35–46, 2008.
image, the embedded data can be correctly extracted while the [7] S. Lian, Z. Liu, Z. Ren, and H. Wang, “Commutative encryption and
original image can be perfectly recovered. Although someone watermarking in video compression,” IEEE Trans. Circuits Syst. Video
Technol., vol. 17, no. 6, pp. 774–778, 2007.
with the knowledge of encryption key can obtain a decrypted [8] M. Cancellaro, F. Battisti, M. Carli, G. Boato, F. G. B. Natale, and
image and detect the presence of hidden data using LSB-ste- A. Neri, “A commutative digital image watermarking and encryption
ganalytic methods, if he does not know the data-hiding key, it method in the tree structured haar transform domain,” Signal Process.:
Image Commun., DOI 10.1016/j.image.2010.11.001, to be published.
is still impossible to extract the additional data and recover the [9] D. Kundur and K. Karthik, “Video fingerprinting and encryption princi-
original image. For ensuring the correct data-extraction and the ples for digital rights management,” Proc. IEEE, vol. 92, pp. 918–932,
2004.
perfect image recovery, we may let the block side length be a [10] N. Memon and P. W. Wong, “A buyer-seller watermarking protocol,”
big value, such as 32, or introduce error correction mechanism IEEE Trans. Image Process., vol. 10, no. 4, pp. 643–649, Apr. 2001.
[11] M. Kuribayashi and H. Tanaka, “Fingerprinting protocol for im-
before data hiding to protect the additional data with a cost of ages based on additive homomorphic property,” IEEE Trans. Image
payload reduction. Process., vol. 14, pp. 2129–2139, 2005.