www.elsevier.com/locate/patrec

Pattern Recognition Letters 27 (2006) 551–555

Secret image sharing with smaller shadow images

Ran-Zan Wang *, Chin-Hui Su

Department of Computer and Communication Engineering, Ming Chuan University, 5 Der-Ming Rd., Kwei-Shan, Tau-yuan, 333 Taiwan, ROC

Received 9 August 2004; received in revised form 30 July 2005Available online 26 October 2005

Communicated by Prof. G. Sanniti di Baja

Abstract

Secret image sharing is a technique for protecting images that involves the dispersion of the secret image into many shadow images.This endows the method with a higher tolerance against data corruption or loss than other image-protection mechanisms, such as encryp-tion or steganography. In the method proposed in this study, the difference image of the secret image is encoded using Huffman codingscheme, and the arithmetic calculations of the sharing functions are evaluated in a power-of-two Galois Field GF(2t). Experiment resultsshow that each generated shadow image in the proposed method is about 40% smaller than that of the method in [Thien, C.C., Lin, J.C.,2002. Secret image sharing. Comput. Graphics 26 (1), 765–770], which improves its efficiency in storage, transmission, and data hiding.� 2005 Elsevier B.V. All rights reserved.

Keywords: Secret sharing; Image sharing; Shadow image; Data hiding

1. Introduction

The continuing improvements in computer technologiesand the rapid increase in Internet usage are responsible forthe increasing popularity of network-based data transmis-sion. In many applications, such as the communication ofcommercial affairs or military documents, important imagesmust be kept secret. Many image-protection techniques,such as data encryption (Cheng and Xiaobo, 2000; Bourba-kis and Dollas, 2003) and steganography (Marvel et al.,1999; Petitcolas et al., 1999), have been proposed to increasethe security of secret images. However, one common defectof these techniques is their policy of centralized storage, inthat an entire protected image is usually maintained in a sin-gle information carrier. If a cracker detects an abnormalityin the information carrier in which the protected imageresides, he or she may intercept it, attempt to decipher thesecret inside, or simply ruin the entire information carrier(and once the information carrier is destroyed, the secret

0167-8655/$ - see front matter � 2005 Elsevier B.V. All rights reserved.

doi:10.1016/j.patrec.2005.09.021

* Corresponding author. Tel.: +886 3 3507001x3406; fax: +886 34340700.

E-mail address: rzwang@mcu.edu.tw (R.-Z. Wang).

image is also lost forever). Secret image sharing is an imageprotection mechanism that does not suffer from these prob-lems. It works by splitting the secret image into n incuriousshadow images that are transmitted and stored separately.One can reconstruct the original image if at least a presetnumber r (1 6 r 6 n) of these n shadow images are obtained;knowledge of less than r shadow images is insufficient forrevealing the secret image.

The concept of secret sharing was introduced indepen-dently by Shamir (1979) and Blakley (1979). They pro-posed the so-called (r,n)-threshold scheme. The methodinvolves dividing important data D into n pieces of shadowdata. The important data D can be reconstructed if r of then pieces of shadow data are obtained, but even completeknowledge of r � 1 pieces of shadow data reveals no infor-mation about D. Many studies (Karnin et al., 1983; Stin-son, 1994; Verheul and van Tiborg, 1997; Blundo andSantis, 1997) have investigated implementations of the(r,n)-threshold scheme, mainly concentrating on the com-munication of keys in cipher systems. Benaloh and Leichter(1989) proposed a more generalized sharing method byspecifying several subgroups that had to be resolved toreveal the hidden secrets. Noar and Shamir (1995)

552 R.-Z. Wang, C.-H. Su / Pattern Recognition Letters 27 (2006) 551–555

proposed a new cryptographic technique called visual cryp-tography for sharing image-based secrets that was basedon the human visual system. In visual cryptography, thesecret message is distributed in many transparency shadowsthat consist of many noisy black dots. Superimposing theshadows that contain the secret message makes the messagerecognizable by human eyes. Recently, Thien and Lin (2002)proposed a secret image sharing method based on the (r,n)-threshold scheme that involved performing modular arith-metic operations in the prime Galois Field GF(P). Eachgenerated shadow image is 1/r the size of the secret imagein their lossy scheme, and is approximately 1/r in the loss-less version.

This paper proposes a secret image sharing method thatutilizes smaller shadow images. In the proposed method, nshadow images are derived from the secret image, and any rshadow images among the n shadow images can reveal thesecret image, but less than r shadow images will not. Asindicated by Thien and Lin (2002), the small size of eachshadow image is advantageous in their subsequent use.The proposed method is introduced in Section 2, Section3 presents the experimental results, and conclusions aredrawn in Section 4.

2. Proposed method

Secret image sharing works by deriving n shadow imagesfrom the secret image using a sharing function, where eachshadow image can be transmitted and stored separately.This method splits the secret image in several shadowimages, which decreases the risks of data corruption andloss. However, the total size of the n shadow images is con-siderable, and hence the size of the generated shadowimage should be carefully considered when designing animage sharing system.

The remainder of this section is divided as follows: thesharing method used to derive the n shadow images fromthe secret image is introduced in Section 2.1, the revealmethod used to reconstruct the secret image from any r

shadow images is presented in Section 2.2, and a modifiedsharing version that decreases the error propagationproblem is stated in Section 2.3. Finally, the security prop-erties of the proposed method are discussed in Section2.4.

2.1. Sharing phase

Consider a t-bit secret image SE = {seij}, where1 6 i 6 m and 1 6 j 6 n. We want to derive n shadowimages SH1,SH2, . . . ,SHn from SE, whereby the secretimage can be reconstructed from any r of the n shadowimages. First, a difference image DIFF = {diffij} of SE iscomputed using

diff ij ¼seij if i ¼ 0 and j ¼ 0;

seij � seði�1Þj if i 6¼ 0 and j ¼ 0;

seij � seiðj�1Þ otherwise.

8><>:

ð1Þ

Note that diffij has values from �2t + 1 to 2t � 1. To reducethe amount of data fed to the subsequently sharing process,the difference image is encoded using a Huffman codingscheme (Storer, 1988). Every t bits arriving from the Huff-man coding output stream are grouped sequentially intoa sharing coefficient, and every r generated sharing coeffi-cients form a sharing section. Without loss of generality,for the jth sharing section, the polynomial sharing functionof degree r � 1 is defined as

qjðxÞ ¼ ða0 þ a1xþ � � � þ ar�1xr�1Þmod2t; ð2Þ

where a0,a1, . . . ,ar�1 are the r sharing coefficients in thesharing section. We take the shadow numbers x = 1,2, . . . ,n into the sharing function and evaluate the n outputpixels w1,w2, . . . ,wn, respectively:

w1 ¼ qjð1Þ; . . . ;wi ¼ qjðiÞ; . . . ;wn ¼ qjðnÞ. ð3Þ

Note that in the proposed method, all arithmetic opera-tions in the sharing functions are evaluated in GF(2t).The n output pixels (w1,w2, . . . ,wn) of this sharing sectionare then assigned to the jth pixel individually to n shadowimages (SH1,SH2, . . . ,SHn). We summarize the proposedsecret image sharing method in the following steps:

1. Apply the differencing function in Eq. (1) to the secretimage SI and obtain the difference image DIFF.

2. Apply a Huffman coding scheme to encode the differ-ence image, and obtain the output Huffman codes.

3. Sharing section generation:3.1. Sequentially take t bits from the output Huffman

codes generated in Step 2 to form a sharingcoefficient.

3.2. Repeat Step 3.1 until r sharing coefficients aregenerated, which form a sharing section.

4. Use the r sharing coefficients of the sharing section gen-erated in Step 3 to serve as the coefficients of Eq. (2). Wegenerate the sharing function q(x). For each shadowimage with shadow numbers i = 1,2, . . . ,n, evaluateq(i) in GF(2t) to generate n pixels for the n shadowimages.

5. Repeat Steps 3 and 4 until all bits in the Huffman codesstream are processed.

6. Record the shadow number, the Huffman code table,and all of the generated pixels in the shadow image SHi.

Note that Thien and Lin (2002) use a key to permute thepixels before performing any sharing process, the mainpurpose of which is to hide the correlation between neigh-boring pixels. In their scheme, if the method uses the shar-ing process directly, the shadow images will adumbrate theshapes of the original image. Fig. 1 shows this phenomenonwhen applying the Thien and Lin scheme to share the secretimage ‘‘Jet’’ with no permutation. In the method proposedin the present study, the original secret image is processedusing the image differencing procedure and encoded usingHuffman codes before sharing. This procedure hides the

Fig. 1. The four shadow images generated using the scheme of Thien andLin (2002) if their permutation process is by-passed. The shadow numbersused to generate panels (a)–(d) are 1–4, respectively.

R.-Z. Wang, C.-H. Su / Pattern Recognition Letters 27 (2006) 551–555 553

correlation between neighboring pixels, and hence removesthe need to perform a permutation process.

2.2. Reveal phase

Given any r shadow images among the n shadowimages, the following steps are performed to reveal thesecret image:

1. For each shadow image, locate and retrieve the shadownumber, the Huffman code table, and the pixel data.

2. Sequentially take one not-processed-yet pixel from eachof the r shadow images.

3. Use these r pixels and Lagrange�s interpolation methodto solve for the coefficients a0,a1, . . . ,ar�1 in Eq. (2).Note that all of the numeric operations are evaluatedin GF(2t).

4. Repeat Steps 2 and 3 until all pixels of the r shadowimages are processed. The entire stream of Huffmancodes is then reconstructed.

5. Decode the Huffman codes to reveal the differenceimage.

6. Use the inverse-differencing process to reveal the secretimage from the difference image.

2.3. An error-propagation-limited version

The use of differences between pixels reduces the sizes ofshadow images. However, if one error occurs in the shadowimage, it will be impossible to reveal any of the pixelsappearing after the error position in the secret image. Toovercome this problem, we present a modified version ofthe proposed method here to decrease the probability ofthe error propagation. Furthermore, if there is an erroroccurs, the error propagation is limited within a singleblock. Instead of calculating the difference image in thesharing process directly using Eq. (1), the secret image isdivided into nonoverlapping blocks in moderate size. Wedefine the base of a block to be the smallest gray value of

that block. In the image difference step, the base is sub-tracted from each pixel of a block to obtain the differenceimage. After generated the difference image, the bases ofthe blocks and the difference image are encoded using theHuffman coding scheme as mentioned in Step 2 of the shar-ing process in Section 2.1, and the sharing Steps 3–6 areconducted in the same way to generate the shadow images.

In this modified version, the errors can be classified intotwo cases: (a) if the error occurs in the base of a block,there is an error propagation effect. However, due to thedifference operation is conducted locally in a block, theerror propagation effect is limited within the block wherethe error occurs; (b) if the error occurs in the differencecoefficient of a block, there is no error propagation prob-lem. Owing to the error propagation occurs only if theerror locates in the base of the block, if we set the size ofa block to m · n, the probability that an error causes thepropagation effect is 1/(m · n).

2.4. Security analysis

The security of the proposed method is based on thecomplexity of the sharing polynomials, as discussed byThien and Lin (2002). Without loss of generality, let usinspect how q1(x) can be revealed. Revealing coefficientsa0 � ar�1 of the polynomial presented in Eq. (2) requiresr equations. If only r � 1 shadow images are available(without loss of generality, suppose we only have q1(1),q1(2), . . . ,q1(r � 1)), then we can construct only r � 1equations

q1ð1Þ¼ ða0þa1þa2þ�� �þar�1Þmod2t

q1ð2Þ¼ ða0þ2a1þ2a2þ���þ2ar�1Þmod2t

..

.

q1ðr�1Þ¼ ða0þðr�1Þa1þðr�1Þa2þ�� �þðr�1Þar�1Þmod2t

8>>>><>>>>:

ð4ÞThere are 2t possible solutions to solving for r unknownsusing only the above r � 1 equations, and hence the possi-bility of guessing the correct solution is 1/2t. There are s

polynomials for an image with s sharing sections, andhence the possibility of obtaining the correct image is(1/2t)s. For example, for an image with size 512 · 512, ift = 8 and r = 2, there are about 100,000 sharing sections.The possibility of obtaining the correct image is only(1/28)100,000, indicating the infeasibility of cracking theoriginal secret image.

3. Experimental results

The six test images used in this experiment are shownin Fig. 2, all of which are 8-bit gray-level images with a sizeof 512 · 512 pixels. An image-sharing result is shown inFig. 3. In this test, the irreducible polynomial x8 + x5 +x3 + x2 + 1 is selected as the prime polynomial in GF(28).Fig. 3(a) is the secret image ‘‘Jet’’. The four shadow imagesgenerated using the proposed method with r = 2 and n = 4,

Fig. 2. The six test images used in this experiment: (a) Jet, (b) Lena,(c) Milk, (d) Scene, (e) Sunset, (f) Tiff.

Fig. 3. An illustrated experimental result: (a) Secret image ‘‘Jet’’, (b)–(e)the four generated shadow images and (f) the reconstructed image.

554 R.-Z. Wang, C.-H. Su / Pattern Recognition Letters 27 (2006) 551–555

and shadow numbers 1–4, are shown in Fig. 3(b)–(e),respectively; they are shown in 512 · 256 boxes in orderto allow comparison with the shadow size generated inthe Thien and Lin scheme. The image revealed by anytwo of the four shadow images is shown in Fig. 3(f), whichis identical to the secret image shown in Fig. 3(a). Table 1summarizes the sizes of the shadow images generated usingthe proposed method and the method proposed by Thien

Table 1The sizes (in bytes) of the shadow images generated using (a) the methodproposed in this study and (b) the method of Thien and Lin (2002)

Method a b a/b

Jet 74,571 131,072 0.57Lena 81,827 131,072 0.62Milk 69,271 131,072 0.53Scene 92,606 131,072 0.72Sunset 59,164 131,072 0.45Tiff 77,340 131,072 0.59Mean 75,797 131,072 0.58

and Lin (2002). It can be seen that the shadow imagesgenerated using our method are about 40% smaller thanthat of the method in (Thien and Lin, 2002). Table 2 sum-marizes the sizes of the shadow images generated using themodified error-propagation-limited method under variantblock sizes, the obtained size of each of the shadow imagegenerated in this method is about 10% bigger than that ofthe proposed basic scheme, but is still about 30% smaller

Table 2The sizes (in bytes) of the shadow images generated using the error-propagation-limited version proposed in this study with variant block sizes

Block size 3 · 3 4 · 4 5 · 5

Jet 94,437 94,920 102,586Lena 96,694 94,665 101,687Milk 87,734 85,261 93,581Scene 108,705 106,981 114,943Sunset 86,930 85,617 95,303Tiff 92,976 92,360 99,523Mean 94,579 93,301 101,271

R.-Z. Wang, C.-H. Su / Pattern Recognition Letters 27 (2006) 551–555 555

than that of the method in Thien_Lin scheme. The genera-tion of smaller shadow images is advantageous to theirfurther processing, and demonstrates the utility of theproposed method.

4. Conclusion

We have proposed a secret image sharing methods withsmaller shadow images in this letter. Our method has the fol-lowing characteristics: (1) the secret image is used to gener-ate n shadow images, (2) any r (or more) shadow images canbe used to reconstruct the secret image in a lossless manner,(3) using less than r shadow images will provide insufficientinformation to reveal the secret image, and (4) the generatedshadow images are less than 1/r the size of the secret image.The proposed method owns the following advantages:(1) the application of Huffman coding and the use of imagedifferencing process successfully reduce the size of eachshadow image. This improvement saves storage space andtransmission time required for subsequent processing ofthe shadow images such as when they are hidden or storedon distributed web-based servers, (2) the calculation of thesharing function uses GF(2t) instead of GF(P) as adoptedby Thien_Lin scheme (2002), which avoids the quality deg-radation of the secret image in the sharing process, (3) theuse of image differencing together with Huffman codinghides the correlation between the neighboring pixels; hencethe permutation process in the Thien_Lin scheme can beby-passed and still owns the same effect of noisy shadowimages, (4) we also proposed an error-propagation-limitedversion of sharing method; it decreases the probability ofthe error propagation problem, and limits the propagationeffect within the block where the error occurs.

Acknowledgements

The authors would like to thank the reviewers for theirvaluable comments. This work is supported by NationalScience Council, ROC under grant NCS91-2213-E-130-013.

References

Benaloh, J., Leichter, J., 1989. Generalized secret sharing and monotonefunctions. Advances in Cryptology—CRYPTO�88 403, 27–35.

Blakley, G.R., 1979. Safeguarding cryptography keys. In: Proc. of theAFIPS 1979 National Computer Conference, vol. 48, pp. 313–317.

Blundo, C., Santis, A.D., 1997. Lower bounds for robust secret sharingschemes. Inf. Process. Lett. 63 (6), 317–321.

Bourbakis, N., Dollas, A., 2003. Scan-based compression-encryption-hiding for video on demand. IEEE Multimedia Mag. 10, 79–87.

Cheng, H., Xiaobo, L., 2000. Partial encryption of compressed images andvideos. IEEE Trans. Signal Process. 48 (8), 2439–2451.

Karnin, E.D., Greene, J.W., Hellman, M.E., 1983. On secret sharingsystems. IEEE Trans. Inf. Theory 29, 35–41.

Marvel, L.M., Boncelet, G.G., Retter, C.T., 1999. Spread spectrum imagesteganography. IEEE Trans. Image Process. 8 (8), 1075–1083.

Noar, N., Shamir, A., 1995. Visual cryptography. Advances in Crypto-graphy: Eurocrypt�94. Springer-Verlag, Berlin, pp. 1–12.

Petitcolas, F.A.P., Anderson, R.J., Kuhn, M.G., 1999. Informationhiding—a survey. Proc. IEEE 87 (7), 1062–1078.

Shamir, A., 1979. How to share a secret? Comm. ACM 22 (11), 612–613.

Stinson, D.R., 1994. Decomposition constructions for secret-sharingschemes. IEEE Trans. Inf. Theory 40 (1), 118–124.

Storer, J.A., 1988. Data Compression: Methods and Theory. ComputerScience Press, Rockville, MD.

Thien, C.C., Lin, J.C., 2002. Secret image sharing. Comput. Graphics 26(1), 765–770.

Verheul, E.R., van Tiborg, C.A., 1997. Constructions and properties of kout of n visual secret sharing schemes. Des., Codes, Cryptogr. 11 (2),179–196.