ARTICLE IN PRESS

0923-5965/$ - se

doi:10.1016/j.im

�Correspondfax: +886 3 434

E-mail addre

Signal Processing: Image Communication 22 (2007) 363–373

www.elsevier.com/locate/image

Scalable secret image sharing

Ran-Zan Wanga,�, Shyong-Jian Shyub

aDepartment of Computer and Communication Engineering, Ming Chuan University, 5 Der-Ming Rd., Kwei-Shan,

Tau-yuan 333, Taiwan, ROCbDepartment of Computer Science and Information Engineering, Ming Chuan University, 5 Der-Ming Rd., Kwei-Shan,

Tau-yuan 333, Taiwan, ROC

Received 7 April 2006; received in revised form 17 November 2006; accepted 29 December 2006

Abstract

In this paper, we propose an innovative scheme, namely the scalable secret image sharing scheme, for sharing an image O

among n participants such that the clarity of the reconstructed image (i.e., the amount of information therein) scales with

proportion with the number of the participants. The proposed scheme encodes O into n shadow images that exhibit the

following features: (a) each shadow image reveals no information about O, (b) each shadow image is only half the size of

O, (c) any k (2pkpn) shadow images can be used to reconstruct O in a scalable manner such that the amount of

information about O is proportional to k, and (d) O can be reconstructed perfectly when all of the n shadow images are

available. The clarity of O can be measured in terms of several metrics. We define three modes, namely the multisecret,

priority, and progressive modes, for sharing O in our scheme. The scalability and flexibility of the proposed schemes

indicate the wide range of potential applications for secret image sharing.

r 2007 Elsevier B.V. All rights reserved.

Keywords: Image sharing; Progressive sharing; Shadow image; Secret sharing

1. Introduction

The concept of secret sharing was introducedindependently in 1979 by Shamir [15] and Blakley[2]. Their (r, n) threshold scheme divides the inputdata D into n shares, which are then distributedamongst n recipients. In this scheme, D can bereconstructed by anyone who obtains a predefinednumber r, where 2prpn, of these shares, butanyone with complete knowledge of r�1 sharesreveals no information about D. To share image-based secrets, Noar and Shamir [14] proposed a new

e front matter r 2007 Elsevier B.V. All rights reserved

age.2006.12.012

ing author. Tel.: +886 3 3507001x3406;

0700.

ss: rzwang@mcu.edu.tw (R.-Z. Wang).

cryptographic technique called visual secret sharing(VSS) scheme. In (r, n) VSS scheme, the input imageis transformed into n shares with noise-like appear-ance. The noisy share conceals the information anddelimitates the correlations between neighboringpixels in the original image, hence ensures theunreadability of the secret behind. These shares canbe printed out on transparent slides and thendistributed over the participants. The original secretcan be obtained only when a subset of at least r

shares are available and are well stacked together.The decryption process is by our visual systemwithout the need for any computation, that is, wecan see the secret from the stacked shares.

The nice property that the secret can be decrypted byonly human eyes without any computer computation

.

ARTICLE IN PRESSR.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373364

attracts many studies on visual cryptography. Atenieseet al. [1] extended the (r, n) VSS scheme to generalaccess structures where the dealer can specify allqualified and forbidden subsets of n participants.Eisen and Stinson [4] evaluated the minimum pixelexpansion for a specified contrast of the reconstructedimage. Nakajima and Yamaguchi [13] extended thedot-clustered subpixel arrangements to enhance theregister tolerance in stacking the shares to makethe secret visible. Some VSS schemes were proposedfor sharing gray-level and color images. Lin and Tsai[7] applied the dithering technique to convert a gray-level image into an approximate binary image andapplied existing binary VSS schemes to accomplish thework of creating shares. Hou [5] exploited the color-decomposition and halftoning technology to generatevisual cryptograms for both gray-level and colorimages. The VSS schemes mentioned above recognizethe secret on superimposed shares by means of humaneyes, they cannot restore the original image perfectlywithout any loss. Jin et al. [6] applied the halftoningtechnique and developed a microblock encodingmethod to establish their VSS scheme. A computa-tion-based decryption scheme was proposed to per-fectly reconstruct the original image, and a progressivemechanism was established to share image at multipleresolutions.

With the widespread uses of images on theinternet, secret image sharing with perfectly recon-struction ability attracts much attention in recentyears. Chang and Huang [3] applied the vectorquantization technique to encode the secret image,where the generated codebook for reconstructingthe secret image is shared among the n participantsby applying the (r, n) threshold scheme. Tsai et al.[19] proposed a method to share multiple secretsamong the participants by incorporating the least-significant-bit substitution method in the VCscheme. Given some secrets and a set of coverimages, the method converts the secrets into multi-ple bit planes and modifies the cover imagesaccording to these bit planes. Lukac and Plataniotisdeliberately utilized the concept of bit-level decom-position in secret image sharing schemes [10–12].They decomposed an image directly into multiplebit planes and performed the sharing process oneach bit plane. The scheme proposed in [10–12]performed binary cryptographic operations oncolor vectors at the decomposed bit levels and theoriginal image can be reconstructed without anyloss through simple logical operations. Thien andLin [17] proposed a secret image sharing method

based on the (r, n) threshold scheme [15]. Eachgenerated shadow image is small (about 1/r of thatof the secret image) in their method, which isadvantageous in the transmission and hiding ofshadow images. They further developed a method[18] that makes the shadow images look likeportraits of the original secret image, and providesa user-friendly interface to facilitate the manage-ment of the shadow images. Lin and Tsai [9]transformed the secret image into frequency domainusing discrete cosine transform. They retained thefirst ten coefficients of each block, and disarrangedthe 2nd–10th coefficients in such a way that theycannot recovered without the first coefficient.Finally, only the first coefficient is coded into n

shares to reduce the size of the share data. They [8]also proposed another image sharing method withthe additional capabilities of steganography andauthentication.

Previous developed image sharing methods[3,8–12,17–19] in the literature allow an image tobe shared among n participants such that the imagecan be perfectly reconstructed if at least r shadowimages are available, while knowledge of any r�1 orless shadow images reveals no information. Thistype of sharing policy offers a secure and robustmethod for protecting an important image; how-ever, the all-or-nothing property that reveals eitherthe entire image or nothing limits its possibleapplications—in some circumstances we may re-quire the input image to be gradually revealeddepending upon the number or characteristics of theshares participating in the decryption process. Forinstance, the quality of the reconstructed imagemight be increased with the number of participants,or we may assign different priorities to differentparticipants such that those with higher prioritieswill obtain a more detailed image in the decryptionprocess.

This paper proposes a novel idea for secret imagesharing, referred to as the scalable secret image

sharing scheme. This sharing scheme provides thescalability and flexibility that different versions ofthe secret image can be reconstructed by differentcombinations of participants. Three sharing modes,namely the multisecret, priority, and progressivemodes, are designed for users to accommodate theirneeds to share the secret image. Our schemereconstructs the secret image with a scalableresolution (including the perfect reconstruction ofthe image) according to users’ needs. Our methodsutilize the property of bit-level decomposition

ARTICLE IN PRESSR.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373 365

[10–12] to assign weights to the generated shadowimages, and incoporate both the spatial and depthdecompositions for sharing the secret image in aprogressive strategy.

The remainder of the paper is organized asfollows. Section 2 takes a brief review of Thien–Linsecret image sharing scheme. The proposed schemesand their security properties are introduced inSection 3, we summarize the experimental resultsin Section 4, and the conclusions are stated inSection 5.

2. Review of Thien–Lin (r, n) secret image sharing

scheme

Consider image O, comprising m pixels, that isshared by n participants. In the Thien–Lin (r, n)secret image sharing scheme [17], the grayscalevalues of the pixels in O are first set to be in therange from 0 to 250 by truncating those from 251 to255. The resulting image O0 is transformed into anoisy-looking image Q by permuting all pixels in O

according to a secret key. Q is further divided intom/r nonoverlapping sections, where each sectioncontains r pixels. Let S(k) be the kth shadow imageand Sj

(k) be the jth pixel in S(k), where 1pkpn and1pjpm/r. The r pixels of section j in Q aredeliberately adopted to determine a single shadowpixel (i.e., Sj

(k)) for each of the n shadow images asfollows:

SðkÞj ¼ ðq0 þ q1k þ q2k

2þ � � � þ qr�1k

r�1Þmod p,

(1)

where 1pjpm/r, 1pkpn, p ¼ 251, and q0,q1,y,qr�1 are the grayscale values of the r pixelsof section j in Q. For a certain k, 1pkpn, thecollection of the shadow pixels Sj

(k) for 1pjpm/rconstitutes shadow image S(k), where the size ofeach generated shadow image is m/r (or 1/r of thatof the secret image). Only r shadow images arerequired to reconstruct Q.

The following steps are applied to reveal thesecret image using any r of the n shadow images.

Step 1: Take the first not-processed pixel fromeach of the r shadow images.

Step 2: Use these r pixels (a subset of{Sj

(1),Sj(2),y,Sj

(n)}) and the Lagrange’s interpola-tion to solve the coefficients q0, q1,y,qr�1 in Eq. (1).Without loss of generality, let the pixels participatein revealing the coefficients be Sj

(1),Sj(2),y,Sj

(r). We

first construct F(x) by the following formula:

F ðxÞ ¼ Sð1Þj

ðx� 2Þðx� 3Þ � � � ðx� rÞ

ð1� 2Þð1� 3Þ � � � ð1� rÞ

� �

þ Sð2Þj

ðx� 1Þðx� 3Þ � � � ðx� rÞ

ð2� 1Þð2� 3Þ � � � ð2� rÞ

� �þ � � �

þ SðrÞj

ðx� 1Þðx� 2Þ � � � ðx� ðr� 1ÞÞ

ðr� 1Þðr� 2Þ � � � ðr� ðr� 1ÞÞ

� �.

ð2Þ

Expand the right side of Eq. (2) and arrange theterms in the order of increasing exponents of x.Thus, F(x) can be expressed in the form F xð Þ ¼

ðd0 þ d1xþ d2x2 þ � � � þ dr�1x

r�1Þ: The coefficientsin the sharing polynomial in Eq. (1) can be obtainedby qi ¼ di, i ¼ 0,1,y,r�1. They are exactly the r

pixel values of section j in Q.Step 3: Repeat steps 1 and 2 until all pixels of the

r shadow images are processed.Step 4: Applying the inverse-permutation operation

to the permutated image Q to get the secret image O0.Note that in the approach of Thien and Lin [17],

the permutation process transforming O0 into Q

delimitates the correlation between neighboringpixels so as to increase the secrecy of the shadowimages. However, it should be realized that thearithmetic operations are performed in the primeGalois field GF(251), and hence a preprocessingstep to truncate all grayscale values larger than 250is necessary. In fact, the power-of-two Galois field(GF)(28) [16] that is widely used in encryptionalgorithms such as advanced encryption standard(AES) can solve this problem. GF(28) evaluatesarithmetic calculations with modular polynomialoperations under an irreducible polynomial, whichis a finite field with 256 elements. It works correctlywith all integers fit in an 8-bit memory in the range 0through 255. In the aforementioned sharing scheme,all of the arithmetic calculations can be performedcorrectly in the power-of-two GF(28), and hencethere is no need to transform O into O0. Conse-quently, the reconstructed image is O itself, insteadof O0. Therefore, the entire process is truly lossless.The arithmetic operations in our methods areevaluated in GF(28) so that all gray-scales in theoriginal image can be preserved.

3. The proposed method

This section introduces the details of the pro-posed method. In Section 3.1, the sharing phase that

ARTICLE IN PRESSR.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373366

derives shadow images from the input imageis presented. In Section 3.2, the reconstructionphase is applied to reveal the secret image froma set of shadow images. Finally, the securityproperties of the proposed method are discussed inSection 3.3.

3.1. The secret image sharing scheme

In our scheme, it is assumed that the secret imageO is to be shared among n participants, where eachparticipant possesses a single shadow image. Theproposed scheme is designed to ensure that (a) eachshadow image reveals no information about O, (b)each shadow image is only half the size of O, (c) anyk (2pkpn) shadow images can be used toreconstruct O in a scalable manner such that theamount of information about O is proportional tok, and (d) O can be perfectly reconstructed if all ofthe n shadow images are available.

To simplify the following explanations, we focuson the (2, n) scalable secret-sharing scheme; notethat it is easy to extend the concepts to the general(r, n) scheme. In our scheme, image O is first dividedinto n disjoint image partitions {P1, P2,y, Pn} suchthat ;.

[i

Pi ¼ O for 1pipn;

Pi \ Pj ¼ ; for 1piajpn;

sizeðPiÞ ¼1nsizeðOÞ for 1pipn;

8>><>>: (3)

where size(Y) is the number of bits in image Y. Eachimage partition Pj (1pjpn) is shared into twoshadow partitions Kj

(1) and Kj(2) by applying the

Thien–Lin (2, 2) image sharing scheme described inSection 2. According to the discussion of Thien–Linscheme [17], the shadow partition Kj

(1) ( or Kj(2))

singly reveals nothing about Pj, and the two shadowpartitions Kj

(1) and Kj(2) together can reconstruct Pj

without any loss. Note that the size of Kj(1) or Kj

(2) issize(O)/2n ( ¼ (1/2)� size(Pj) ¼ (1/2)� (size(O)/n).

The design principle of our scalable secret-sharingscheme with respect to Pj is to prevent both Kj

(1) andKj

(2) from being possessed by any group of less thank participants, and to assure that they appeartogether in a certain scalable manner for each groupof k or more participants (i.e., the scenario whereimage partition Pj can be reconstructed). When allimage partitions Pj, j ¼ 1,2,y,n are obtained in ascalable manner, O can be gradually reconstructedin proportion to the number of participants. Toachieve the design goal, we encode the n shadow

images, referred to as S(1), S(2),y, S(n), as follows:let S(i) (1pipn) be constructed using either Kj

(1) orKj

(2), which is the key shadow associated with Pj forall 1pjpn; that is,

SðiÞ ¼ [j

KðtÞj and t ¼

1 if iaj;

2 otherwise:

�(4)

The size of shadow S(i) is (size(O)/2n)� n; that is,size(O)/2. S(1), S(2),y,S(n) are the n shadow imagesthat achieve the goals mentioned above.

Since an image has many parameters, such as thespatial information (the size) and the depth in-formation (the number of bits per pixel), thedecomposition of O into P1, P2,y, Pn in ourscheme can be realized by choosing differentfeatures according to various interests. In thefollowing subsections, we present the three sharingmodes used in the implementation of our scheme:(1) multisecret mode, (2) priority mode, and (3)progressive mode.

3.1.1. Multisecret mode

In this sharing mode, secret image O is decom-posed into n partitions P1, P2,y, Pn such thatEq. (3) is satisfied, where Pi is a certain subimage (ora portion) of O. Fig. 1(b) and (c) shows twoexamples of 4-secret decompositions applied to thesecret image ‘‘Jet’’ shown in Fig. 1(a). It is easy tosee that Figs. 1(b) and (c) contain four subimages ofFig. 1(a). In order to reconstruct correctly the secretimage, an indexing strategy can be adopted and theindex of the decomposition applied should betransmitted to the participants. Regarding ourinstance in Fig. 1, there are two kinds of decom-positions and we may set the index of the decom-position in Fig. 1(a) to ‘‘0’’ while that in Fig. 1(b) to‘‘1’’. Note that there are plenty of choices tospatially decompose the secret image according tothe users’ requirements. For w decompositionchoices, we need log2w bits to record the decom-position index.

3.1.2. Priority mode

The concept of bit-level decomposition for shar-ing image was originally invented by Lakac et al.[10–12]. We follow their idea to develop our prioritysharing mode as follows. Let B(O) ¼ {bm–1,y, b2,b1, b0} be the set of bit-planes of a certain pixel in O,where m is the depth of a pixel, b0 is the leastsignificant bit, and bm�1 is the most significant bit.Based upon the characteristics of a pixel value, the

ARTICLE IN PRESS

Fig. 1. Examples of 4-secret decompositions: (a) Original image ‘‘Jet’’ (b) 4-secrets decomposition choice I, (c) 4-secret decomposition

choice II.

Fig. 2. One example of priority decomposition: (a)–(d) are partitions P1–P4, respectively.

R.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373 367

bits in B(O) follows a partial ordering bm�1 �

bm�2 � bm�3 � � � � � b0; where bi � bj means that bi

is more significant than bj, or simply i4j. Thepartial ordering of the bits in B(O) by theirsignificance implies the presence of priority amongthe bits.

The priority decomposition divides O into n

partitions P1, P2,y, Pn such that Eq. (4) is satisfiedand

[i

BðPiÞ ¼ BðOÞ for 1pipn;

BðPiÞ \ BðPjÞ ¼+ for 1piajpn:

((5)

Figs. 2 and 3 show two examples of the prioritydecomposition of image ‘‘Jet’’ in Fig. 1(a) whereFigs. 2 and 3 are of the same dimension withFig. 1(a); however, the depth of each pixel in Figs. 2and 3 is only two. In Fig. 2, B(P1) ¼ {b7, b6},B(P2) ¼ {b5, b4}, B(P3) ¼ {b3, b2}, B(P4) ¼ {b1, b0};while in Fig. 3, B(P1) ¼ {b7, b3}, B(P2) ¼ {b6, b2},B(P3) ¼ {b5, b1}, B(P1) ¼ {b4, b0}. For demonstra-tion purpose, all of these illustrations are shown as8-bit images in which the partitioned 2-bit planesare located in their corresponding positions of the8-bit planes, for instance, each pixel of P1 in Fig. 2 isdisplayed as b7b6000000 since B(P1) ¼ {b7, b6}

where b7 and b6 are the the 6th and 7th bit planesin the corresponding pixel in O. Note that both ofthe two decompositions satisfy BðP1Þ � BðP2Þ �

BðP3Þ � BðP4Þ; that is, B(P1) has the highest prioritywhile B(P4) has the lowest priority. Moreover,clarity differences are evident in Figs. 2 and 3. Thisenables the distributor of the images to specify theclarity of the reconstructed image to differentgroups of participants.

To successfully apply Thien–Lin scheme (whereeach pixel is 8 bits) for sharing each pixel inpartition Pj (in which each pixel contains only twobits), we condense every four neighboring pixels inPj into one for 1pjp4. Figs. 4(a)–(d) are theobtained images by condensing every four neigh-boring pixels into one for Figs. 2(a)–(d), respec-tively. In this illustraction, the number of pixels ineach partition is a quarter of that of O and thesize of the partitioned shadow generated is 1/8 ofthat of O.

3.1.3. Progressive mode

The progressive mode is a combination of themultisecret and priority modes; that is, the secretimage is decomposed using spatial and depthinformation simultaneously. Specifically, O is first

ARTICLE IN PRESS

Fig. 3. Another example of priority decomposition: (a)–(d) are partitions P1–P4, respectively.

Fig. 4. (a)–(d) are the obtained image by condensing every four neighboring pixels into one for Figs. 2(a)–(d), respectively.

Fig. 5. An example of progressive decomposition: (a) spatial decomposition, (b) bit-plane decomposition, (c) redistributing the

decomposed sections. Obtained partitions 1–4 are shown in (d)–(g), respectively.

R.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373368

spatially decomposed into n partitions P1, P2,y, Pn

as in the multisecret mode. Let B(Pi) denote the setof bit-planes of Pi. B(Pi) is decomposed into n

sections R1(Bi), R2(Bi),y, Rn(Bi) that are redis-tributed onto Pi, Pi+1,y, Pn, P1, P2,y, Pi�1

correspondingly. Formally, the set of bit-planes in

ARTICLE IN PRESSR.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373 369

Pi in the progressive mode, 1pipn, is composed by

BðPiÞ ¼ [j

BjðPiÞ and

BjðPiÞ ¼

BiðP1Þ if 1pi ¼ jpn;

BjðPnþ1�jÞ otherwise:

(ð6Þ

Fig. 5 illustrates the basic ideas of a (2, 4)progressive decomposition. Figs. 5(a) and (b) showthe spatially decomposition into four partitions andthe bit-plane decompositions into four sections foreach partition. Fig. 5(c) presents the result of theredistribution of those decomposed sections amongthe four partitions. Figs. 5(d)–(g) exhibit theimplementation results of P1�P4, respectively, forthe progressive decomposition of the image ‘‘Jet’’ inFig. 1(a).

Note that in Figs. 5(d)–(g), the (i, j)th pixel (pij(1))

of P1 consists of the 7th and 6th bits of o2i, 2j, the 5thand 4th bits of o2i, 2j+1, the 3rd and 2nd bits ofo2i+1, 2j, and the 1st and 0th bits of o2i+1, 2j+1; the(i, j)th pixel (pij

(2)) of P2 consists of the 7th and 6thbits of o2i, 2j+1, the 5th and 4th bits of o2i+1, 2j, the3rd and 2nd bits of o2i+1, 2j+1, and the 1st and 0thbits of o2i, 2j; the (i, j)th pixel (say pij

(3)) of P3 consistsof the 7th and 6th bits of o2i+1, 2j, the 5th and 4thbits of o2i+1, 2j+1, the 3rd and 2nd bits of o2i, 2j, andthe 1st and 0th bits of o2i, 2j+1; and the (i, j)th pixel(pij

(4)) of P4 consists of the 7th and 6th bits of o2i+1,

2j+1, the 5th and 4th bits of o2i, 2j, the 3rd and 2ndbits of o2i, 2j+1, and the 1st and 0th bits of o2i+1, 2j.Note that each pixel in the partitioned image has8 bits, and each partitioned image is a quarter thesize of the original image.

In order to reveal the secret image correctly underdifferent modes, the sharing mode applied for acertain instance should be attached in the imageshadows. In our scheme, a two bits string is set toindicate the four sharing modes: (1) multisecretsharing mode with decomposition choice I inFig. 1(b), (2) multisecret sharing mode with decom-position choice II in Fig. 1(b), (3) progressivesharing mode, and (4) priority sharing mode. Inaddition, the secret key applied to permute theoriginal image, and the height and width of thesecret image should also be stored in the shadowimages, too.

3.2. The reconstruction phase

Consider t participants 1,2,y,t with r associatedshadow images S(1), S(2),y, S(t) respectively, to-

gether with the related information including thesharing mode applied, permutation key, the heightand width of the secret image. The following stepsare performed to reconstruct the original image:

Step 1: For each participant j, fetch partitionedshadow Kj

(1) from shadow image S(j), and parti-tioned shadow Kj

(2) from any one of the othershadow images.

Step 2: Based on the pair of partitioned imageshadows Kj

(1) and Kj(2) obtained in Step 1, apply the

extraction procedure (steps 2.1–2.3) to reconstructpartition Pj.

Step 2.1: Take the first not-processed pixel fromboth Kj

(1) and Kj(2). Without loss of generality, let

the two pixels obtained be y1 and y2, respectively.Step 2.2: Evaluate a0 ¼ y1�y2 and a1 ¼ y2�y1

(Eq. (2) by using r ¼ 2), and assign a0 and a1sequentially in raster scanning order as the tworeconstructed pixels of Pj.

Step 2.3: Repeat steps 2.1 and 2.2 until all pixelsof partition shadows Kj

(1) and Kj(2) are processed.

Step 3: Repeat steps 1 and 2 until all of the t

partitions P1, P2,y, Pj are reconstructed.Step 4: Assemble the t partitioned images P1,

P2,y, Pj to obtain the original image according toone of the following sharing modes:

(a)

Multisecret mode: place each partitioned imagein the corresponding spatial position of theoriginal image.

(b)

Priority mode: reconfigure each partitionedimage into several 1-bit bitmaps that have thesame dimensions as the original image, andreplace each bitmap with the corresponding bit-plane of the original image.

(c)

Progressive mode: split each pixel of thepartitioned image into t parts, and place eachpart in the corresponding pixel of the originalimage.

3.3. Security analysis

The primary requirement of a secret imagesharing scheme is to satisfy the security demands.That is, the secret image must not be revealed unlessmore than a predefined number of shadow images(i.e., r) are available. Without lose of generality,consider a particular partitioned image Pj with itstwo key-shadow shares Kj

(1) and Kj(2) for 1pjpn.

Thien and Lin [17] have shown that a key-shadowshare Kj

(1) or Kj(2) alone cannot reveal any

ARTICLE IN PRESS

Fig. 8. Four shadow images generated in the priority sharing mode.

Fig. 7. Four shadow images generated in the progressive sharing mode.

Fig. 6. Four shadow images generated in the multisecret sharing mode.

Fig. 9. The images reconstructed in the multisecret sharing mode for different numbers of shadow images: (a)–(f) two shadow images,

(g)–(j) three shadow images, and (k) four shadow images.

R.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373370

ARTICLE IN PRESS

Fig. 10. The images reconstructed in the priority sharing mode for different numbers of shadow images: (a)–(f) two shadow images, (g)–(j)

three shadow images, and (k) four shadow images.

R.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373 371

information about Pj, whereas the two key-shadowshares Kj

(1) and Kj(2) together can reconstruct Pj

without loss. In our scheme, it is easily seen fromEq. (4) that Kj

(1) appears in S(j) only and that Kj(2)

appears in all S(i)’s, where i 6¼j. Therefore, theinformation in any single shadow image S(t) isinsufficient to reconstruct Pj, but the shadow imageS(j) can work together with another shadow imageS(i) (1pi6¼jpn) to reconstruct Pj without loss.

Consider two participants u and v with shares S(u)

and S(v). Since S(u) holds Ku(1) and S(v) holds Ku

(2),Pu can be reconstructed without loss. Likewise, S(v)

holds Kv(1) and S(u) holds Kv

(2), and so Pv can bereconstructed exactly. Thus, participants u and v

can work together to reconstruct both of thepartitioned images Pu and Pv. For another parti-tioned image Pw, where we{u,v}, since bothparticipants u and v hold Kw

(2), but neither u nor v

holds Kw(1), we have only a partitioned image

shadow Kw(2) associated with Pw, which cannot

reveal any information about Pw.In general, if s participants {S (k1), S(k2),y, S(ks)}

work together, the s partitioned imagesfPk1

;Pk2; . . . ;Pks

g of the original image can bereconstructed; however, the other n�s partitionedimages related to O are not accessible. In fact, whensXr, O can be reconstructed in a scalable manner,or the clarity of O is enhanced when moreparticipants work together; O is completely recon-structed when all of the n shadows are available.

4. Experimental results

This section presents some experimental resultsto demonstrate the feasibility of the proposedmethod. Following the secret image sharing scheme

ARTICLE IN PRESSR.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373372

described in Section 2, we used the 8-bit grayscaleimage ‘‘Jet’’ with a size of 512� 512 pixels as shownin Fig. 1(a) as the secret image. In this test, theirreducible polynomial x8+x5+x3+x2+1 was se-lected as the prime polynomial in GF(28) used in theproposed method. We show the effect of our schemefor the (2, 4) scalable secret image sharing. Theshadow images generated by the proposed schemeswith the multisecret, priority, and progressivemodes are shown in Figs. 6–8, respectively, wherethe size of each shadow image is 512� 256 pixels.The resulting shadow image has the noise appear-ance. It is satisfactory in terms of the protection ofthe secret image.

Fig. 9 shows the images produced by the multi-secret sharing mode. Figs. 9(a)–(f) are the six imagesreconstructed from any two of the four shadowimages in Fig. 6, and they clearly contain half of thesecret image. The four images reconstructed from any

Fig. 11. The images reconstructed in the progressive sharing mode for

(g)–(j) three shadow images, and (k) four shadow images.

three of the four shadow images of Fig. 6 are shownin Figs. 9(g)–(j), and they contain three-quarters ofthe secret image. Fig. 9(k) is the image reconstructedusing all of the four shadow images of Fig. 6, and is alossless version of the original secret image.

Fig. 10 shows the images produced by thepriority sharing mode. Figs. 10(a)–(f) are the siximages reconstructed from any two of the fourshadow images of Fig. 7, and the four imagesreconstructed from any three of the four shadowimages of Fig. 7 are shown in Figs. 10(g)–(j). We cansee that the quality of the images differs with thenumber of participants and their priority, with ahigher resolution image being obtained when thecombined participants together constitute a higherpriority. Fig. 10(k) is the image reconstructedfrom all of the four shadow images of Fig. 7 and,like Fig. 9(k), is a lossless version of the secretimage.

different numbers of shadow images: (a)–(f) two shadow images,

ARTICLE IN PRESSR.-Z. Wang, S.-J. Shyu / Signal Processing: Image Communication 22 (2007) 363–373 373

Fig. 11 shows the images produced by theprogressive sharing mode. Figs. 11(a)–(f) are thesix images reconstructed from any two of the fourshadow images shown in Fig. 8, and they representlow-resolution versions of the secret image. Thefour images reconstructed from any three ofthe four shadow images of Fig. 8 are shown inFigs. 11(g)–(j), and they represent high-resolutionversions of the secret image; however, some detailsof the secret image are still absent. Fig. 11(k) is theimage reconstructed from all of the four shadowimages of Fig. 8, and again is a lossless version ofthe original image.

5. Conclusions

Secret image sharing is an image protectionmechanism that exhibits a high degree of toleranceagainst data corruption or loss. The traditionalimage sharing scheme based on the (r, n) thresholdscheme splits the secret image into n noise-likeshadow images that are transmitted and storedseparately. The secret image can be perfectlyreconstructed if at least r (1prpn) of these n

shadow images are available, with knowledge of lessthan r shadow images revealing nothing about thesecret image. This method is restricted to partici-pants holding the same amount of information andthe use of a monochromatic secret image (which willbe either unknown or totally exposed).

In this paper, we have presented a novel scalablesecret image scheme with three sharing modes: (1)multisecret, (2) priority, and (3) progressive. Thisscheme enables the secret sharing to be applied in amore flexible manner. The participants sharing thesecret can be assigned different priorities, where thequality of the reconstructed secret image varies withthe priorities of the shadow images provided by theparticipants.

Acknowledgment

This work is supported by the National ScienceCouncil, Taiwan, ROC, under grant NCS93-2213-E-130-001.

References

[1] G. Ateniese, C. Blundo, A. De Santis, D.R. Stinson, Visual

cryptography for general access structures, Infor. Comput.

129 (2) (1996) 86–106.

[2] G.R. Blakley, Safeguarding cryptography keys, Proceedings

of AFIPS 1979 National Computing Conference 48 (1979)

313–317.

[3] C.C. Chang, R.J. Huang, Sharing secret images using

shadow codebooks, Infor. Sci. 111 (1–4) (1998) 335–345.

[4] P.A. Eisen, D.R. Stinson, Threshold visual cryptography

schemes with specified levels of reconstructed pixels, Design

Codes Cryptogr. 25 (1) (January 2002) 15–61.

[5] Y.C. Hou, Visual cryptography for color images, Pattern

Recognition 36 (7) (2003) 1619–1629.

[6] D. Jin, W.Q. Yan, M.S. Kankanhalli, Progressive color

visual cryptography, J. Electron. Imag. 14 (3) (2005) 033019.

[7] C.C. Lin, W.H. Tsai, Visual cryptography for gray-level

images by dithering techniques, Pattern Recognition Lett. 24

(1–3) (2003) 349–358.

[8] C.C. Lin, W.H. Tsai, Secret image sharing with stegano-

graphy and authentication, J. Syst. Software 73 (2004)

405–414.

[9] C.C. Lin, W.H. Tsai, Secret image sharing with capability of

share data reduction, Opt. Eng. 42 (August 2005)

2340–2345.

[10] R. Lukac, K.N. Plataniotis, A cost-effective encryption

scheme for color images, Real–Time Imag. 11 (5–6) (2005)

454–464.

[11] R. Lukac, K.N. Plataniotis, Image representation based

secret sharing (special issue on Visual Secret Sharing),

Commun. CCISA 11 (2) (April 2005) 103–114.

[12] R. Lukac, K.N. Plataniotis, Bit-level based secret sharing for

image encryption, Pattern Recognition 38 (5) (May 2005)

767–772.

[13] M. Nakajima, Y. Yamaguchi, Enhancing registration

tolerance of extended visual cryptography for natural

images, J. Electron. Imag. 13 (3) (2004) 654–662.

[14] N. Noar, A. Shamir, Visual Cryptography, Advances in

Cryptography: Eurocrypt’94, Springer, Berlin, 1995,

pp. 1–12.

[15] A. Shamir, How to share a secret, Commun. ACM 22 (1979)

612–613.

[16] W. Stalling, Cryptography and Network Security: Princi-

ples and Practices, Pearson Education Inc., 2003,

pp. 126–134.

[17] C.C. Thien, J.C. Lin, Secret image sharing, Comput.

Graphics 26 (2002) 765–770.

[18] C.C. Thien, J.C. Lin, An image-sharing method with user-

friendly shadow images, IEEE Trans. Circuits Syst. Video

Technol. 13 (2003) 1161–1169.

[19] C.S. Tsai, C.C. Chang, T.S. Chen, Sharing multiple

secrets in digital images, J. Syst. Software 64 (2002)

163–170.