An Improved Reversible Data Hiding in Encrypted Image Method Based on Block Selection

For reversible data hiding in encrypted image (RDHEI), the most important problem is the conflict between reversibility and embedding capacity. Reversibility has been realized by existing methods, however, the embedding capacity is still too low for practical RDHEI applications. To settle this problem, an improved RDHEI method is proposed in this article by presenting a block selection mechanism. Since extraction error occurs on blocks from which the fluctuation function fails to identifies the flipped part, we propose to distinguish these exceptional blocks from extraction-correct-block (ECB) (i.e., pixel block from which the hidden data can be exactly extracted) and embed additional data into only ECBs. In this way the minimum block size can be adopted to pursue high capacity. To guarantee reversibility, a new self-embedding method is proposed to embed the auxiliary information into the cover image. Finally, a new fluctuation function is also proposed to provide more ECBs and thus further improve the embedding capacity. Experimental results show that the proposed method not only achieves significant improvement in capacity but also guarantees lossless data extraction and perfect image recovery.


I. INTRODUCTION
Reversible data hiding (RDH) is a technique that aims to reversibly embed additional data into distortion-unacceptable medium so that the cover medium can be restored after data extraction [1]- [3]. Due to the reversibility, RDH has been applied to many sensitive fields such as medical, military and law imagery [4], [5]. So far, a large number of RDH methods have been proposed [1]- [4], [6]- [15] and they are mainly classified into three categories [16], i.e., difference expansion based methods [7]- [9] embed additional data by expanding the difference between adjacent pixels, histogram shifting based methods [10]- [13] modify the gray value of pixels using the histogram shift mechanism, lossless compression based methods [6], [14], [15] create the embedding space through compressing a feature set of the cover image.
More and more images are stored on a cloud storage server nowadays with the rapid development of cloud computation [17]. For privacy protection, the image owner usually encrypts the images before transmission. At the cloud storage The associate editor coordinating the review of this manuscript and approving it for publication was Pedro R. M. Inácio . server, additional message such as the information of the image owner or other notation information may be embedded for the needs of management, even though the original content is unknown [18]. As the entropy of the image is greatly improved after encryption, traditional RDH methods cannot be applied [19], [20] and reversible data hiding in encrypted images (RDHEI) becomes desirable. Existing RDHEI methods can be classified into joint RDHEI [21]- [26] and separable RDHEI [2]- [5], [27]- [33]. For the former, the recipient who wants to extract the hidden data must have both the decryption key and the data-hiding key. In other words, the cover image is recovered with the hidden data extracted. For the latter, the hidden data can be extracted with only the data-hiding key and a directly-decrypted image which is highly similar to the cover image can also be obtained with only the decryption key. That is to say, data extraction and image decryption are separable.
RDHEI was firstly proposed by Zhang [21] with the idea of exploiting the spatial correlation of pixels to realize data embedding and extraction. After encrypted image partition, additional bit is embedded by flipping the three leastsignificant-bits (LSBs) of half of pixels within block. In this way, image recovery and data extraction can be realized with a fluctuation function which identifies the flipped part. Following Zhang's work, a new fluctuation function and side match technique which considers neighboring blocks were proposed to reduce the error rate of data extraction [22]. In [23] block smoothness is calculated by applying specific approaches for various pixels including vertex pixel, edge pixel and internal pixel. Moreover, data embedding ratio is also considered so as to further reduce the error rate. [24] similarly presents a new fluctuation function for the reduction of the error rate. To improve the embedding capacity, Bhardwaj and Aggarwal [25] proposed a new RDHEI method by segmenting each non-overlapping pixel block into n sub-blocks such that n (n = 2, 3, 4, . . .) bits can be embedded.
For the aforementioned methods [21]- [25], the block size must be large enough to guarantee reversibility for the reason that all blocks are used to carry additional data. In this way the embedding capacity benefits little from the improvement of fluctuation function. In this article, to achieve high capacity we propose to embed data into only extraction-correct-block (ECB), i.e., pixel block from which the hidden data can be exactly extracted. Specifically, extraction error occurs on blocks from which the fluctuation function fails to identifies the flipped part. Before image encryption, these exceptional blocks will be distinguished from ECBs with a block selection mechanism and the corresponding location information will be recorded and transmitted by a self-embedding mechanism. The contributions of this article can be summarized as follows: • A new block selection mechanism. Since the ECBs can be exactly distinguished at encoder or decoder, real reversibility is guaranteed by embedding data into only ECBs and the minimum block size (i.e., 2 × 2) can be adopted to pursue high capacity.
• A new fluctuation function. With the proposed fluctuation function, the fluctuation value of pixel block can be better evaluated such that more ECBs are obtained. In this way the embedding capacity is further improved.
• A new self-embedding mechanism. The three LSBs are flipped for additional data embedding while the five most-significant-bits (MSBs) are used to carry the position file which is required for distinguishing ECBs at decoder. With the proposed self-embedding mechanism, the position file can be exactly extracted and the MSBs can be perfectly recovered. The remainder of this article is organized as follows. Section II briefly reviews the related works. Section III describes the detailed procedures of the proposed method. The experimental results and the comparison with the prior arts are shown in Section IV. Finally, Section V concludes this article. Fig. 1 provides the general sketch of the previous methods [21]- [25]. As it is shown there are three participants. First, the cover image is encrypted by the content owner with the encryption key. Then, the data hider embeds additional data into the encrypted image with the data-hiding key even knowing nothing about the original content. Finally, the authorized recipient who has both the decryption key and the data-hiding key decrypts the image and then extracts the hidden data and restores the cover image.

II. RELATED WORKS
The previous methods [21]- [25] share the same encryption and embedding procedures. A stream cipher encryption method is used to encrypt the cover image. Then, the encrypted image is segmented into a lot of nonoverlapping blocks. For each s × s sized block, pixels are pseudo-randomly divided into two equal sets denoted by S 0 and S 1 according to the data-hiding key. If the tobe-embedded bit is 0, flip the three LSBs of pixels in S 0 . Otherwise, flip those in S 1 . During data extraction and image recovery, two new blocks denoted by H 0 and H 1 are firstly obtained by flipping the three LSBs of pixels in S 0 or those in S 1 . Then, to determine either H 0 or H 1 is the original block and the hidden bit is 0 or 1, a fluctuation function is designed in [21] as where u, v indicate the pixel position. Taking into account that one of H 0 and H 1 must be the original block while the other one is more seriously interfered, the fluctuation values of H 0 and H 1 , f 0 and f 1 , are compared. If f 0 < f 1 , H 0 is taken as the original block and the extracted bit is 0. Otherwise, H 1 is taken as the original block and the extracted bit is 1. Zhang's fluctuation function considers only non-boundary pixels. As shown in Fig. 2, for a 4×4 sized block only four pixels are employed while the other twelve ones are ignored. This may lead to precision loss of the fluctuation function. The employed pixels (marked by red) of [21]. VOLUME 8, 2020 By summing the absolute differences between two consecutive pixels, an improved fluctuation function is proposed in [22] as With the idea of multiple neighboring pixels, another fluctuation function is proposed in [23] by dividing pixels into vertex pixel, edge pixel and internal pixel. For these three types of pixels, the sum of absolute mean differences is respectively calculated as Overall, the whole summation is calculated as According to Eq. (3,4,5), the fluctuation is measured by the absolute difference between target pixel and the average of neighboring pixels. Fig. 3 shows some special cases, from which we can see that although multiple neighboring pixels are considered the fluctuation value is always zero. Such risks also exist in [21]. Later, one more improved fluctuation function is proposed in [24] by summing the absolute differences between target pixel and four neighbouring pixels as This fluctuation function considers only non-boundary pixels just like Zhang's, which is also adopted in [25]. On this basis, Bhardwaj et al. proposed to segment pixel block into n (n = 2, 3, 4, . . .) sub-blocks each of which carries one additional bit. Table 1 presents the embedding capacity comparison of methods [21]- [25], where ten 512 × 512 sized standard test images from [34] are selected. One can see that the embedding capacity of [21] is generally quite limited, especially on the images Baboon, House, Stream and F16. Although slight improvement has been achieved by improved methods [22]- [25], it is still far from sufficient for practical applications.

III. PRELIMINARY
In this section, the principle of the proposed RDHEI method is first presented, followed by the details of ECB selection. Next, the self-embedding method and the new fluctuation function are sequentially presented.

A. THE PRINCIPLE OF THE PROPOSED RDHEI METHOD
The proposed method is inspired by the association among embedding capacity, block size and fluctuation function. Firstly, the fluctuation function determines the extraction performance. With specific fluctuation function, the extraction error rate simply depends on block size. Fig. 4 shows the comparison of extraction error rate on the test image ''Man''. It is seen that when block size is set as 4×4 the extraction error rate is 16.1%, 8.7%, 9.1%, 13.1% and 29.3% for methods [21]- [25] respectively. As the block size increases, the extraction error rate generally decreases. Therefore, to achieve real reversibility with zero extraction error rate, there are always minimum block size and corresponding maximum embedding capacity for every image.
To better illustrate the extraction error rate, Fig. 5 shows the recovery result using the block size of 4×4, where blocks except ECBs are marked by white. It is seen that there is quite small white area, which corresponds to high percentage of ECBs in all blocks. Table 2 presents the numbers of ECBs derived from methods [21]- [24] using various block sizes. Since the number of ECBs is mainly determined by the fluctuation function, [25] is ignored here due to the same fluctuation function as [21]. One can see that the number of ECBs significantly increases with the decrease of block size. On the image ''Lena'', the minimum block size guaranteeing real reversibility is 16 × 16 for [21], [22] and [24], and 12 × 12 for [23]. Although all blocks are ECB when using the minimum block size, however, the derived ECBs are much fewer than that derived from smaller block size. For example, the number of ECBs reaches up to 13264 on the image ''Lena'' using the block size of 4 × 4 in [21]. Therefore, besides the improvement of fluctuation function, how to distinguish ECBs and embed additional data into them only is quite worthy of investigating.

B. ECB SELECTION AND IMAGE RECONSTRUCTION
After dividing the M × N sized cover image into a lot of non-overlapping blocks with the size of s 1 ×s 2 , the fluctuation value is first calculated for each pixel block. Then, all pixels are flipped to calculate another fluctuation value and the  difference between it and the original one. Let F i,j denote the difference, pixel blocks with F i,j < 0 will be selected as ECB.
To distinguish ECBs from others after data hiding, a M /s 1 × N /s 2 sized binary matrix is generated as a position file (PF) where a bit 1 represents that the block is ECB while a bit 0 represents that the block is not. After that, all pixel blocks are collected in raster-scan order to achieve rearrangement such that ECBs are always in front of others. As shown in Fig. 6, zone ECB denote the collection of ECBs while zone NECB denote the collection of other pixel blocks.

C. SELF-EMBEDDING
The generated PF should be embedded into the reconstructed image. As shown in Fig. 7, by decomposing each pixel into the so-called spare bits (i.e., five MSBs) and loading bits (i.e., three LSBs), the reconstructed image is decomposed into two sub-images denoted by I M and I L , i.e., I M collects the spare bits while I L collects the loading bits. In this way, pixel value falls in [0,31] in I M while pixel value falls in [0,7] in I L .

1) POSITION FILE EMBEDDING
In this article, the block median preservation method [35] is adopted to embed PF into I M . For each pixel block, all pixels are sorted in ascending order to obtain p 1 (i, j) ≤ p 2 (i, j) ≤ . . . ≤ p s 1 ×s 2 (i, j). Then, the median p m (i, j) is obtained as Next, the differences between p m (i, j) and the other s 1 ×s 2 −1 pixels are calculated as where 1 ≤ k ≤ s 1 ×s 2 and k = m. By collecting s 1 ×s 2 −1 differences of each pixel block, the difference histogram is thus constructed and PF will be embedded by histogram shifting. Specifically, the bins in the range of [−2EL − 1, −EL − 1] and [EL + 1, 2EL + 1] are first emptied as After that, PF is embedded into bins in the range of [−EL, EL]. For example, bins in the range of [−EL, 0) and (0, EL] are shifted as where W is a to-be-embedded bit. Accordingly, the pixel is modified as 2) OVERFLOW/UNDERFOLW PREVENTION Overflow/underfolw would occur if p k (i, j) out of the range of [0,31]. Therefore, a M /s 1 × N /s 2 sized location map is needed to exclude exceptional blocks. Next, the generated location map is losslessly compressed using arithmetic coding and embedded into the first two rows by LSB replacement. Finally, the original LSBs of selected pixels in the first two rows and PF are embedded into I M except the first two rows. During data extraction, the same pixels are selected from the first two rows using the encryption key to retrieve the compressed location map. After lossless decompression, the original location map can be obtained to guide the extraction of the original LSBs and PF. Table 3 presents the comparison of embedding capacity with various ELs when the block size is set as 4 × 4. As the length of PF is 65536 bits at most for 512 × 512 sized image, Table 3 shows that PF can be generally embedded due to sufficient embedding capacity.

D. A NEW FLUCTUATION FUNCTION
To better evaluate the fluctuation of a block, a new fluctuation function is proposed in this article with the idea of summing the absolute mean differences between each pixel and its neighbors. As shown in Fig. 8, pixels within block are classified into pixels at four vertexes, pixels on the down and up borders except vertexes, pixels on the right and left borders except vertexes, and pixels inside block. In the proposed method, the minimum block size is 2 × 2. The distribution of pixels within 2 × 2 sized block is shown in Fig. 9. As it is shown, all pixels are at vertexes and all of them are the neighbors of the other pixels. Notice that the grid marked by red denote the target pixel, the grid marked by other colors denote its neighbor. Specific function is designed for each kind of pixel to calculate its fluctuation.  For pixels at four vertexes, the fluctuation is calculated as For pixels on the down and up borders except vertexes, the fluctuation is calculated as For pixels on the right and left borders except vertexes, the fluctuation is calculated as For pixels inside block, the fluctuation is calculated as

IV. METHODOLOGY
The sketch of the proposed method is given in Fig.10. As we can see, there are three participants including content owner, data hider and receiver. With the encryption key, ECB selection and image reconstruction are first conducted by the content owner to obtain PF and the reconstructed image. Next, PF is embedded into the reconstructed image through selfembedding. Finally, the reconstructed image containing PF is encrypted using the encryption key and a classical symmetric encryption method such as RC4 or SEAL. After transmission, some additional data is embedded into ECBs by the data hider using the data-hiding key. Then, the authorized receiver who has both the decryption key and the data-hiding key can losslessly extract the hidden data and perfectly recover the cover image. The details of the proposed method are given in the following aspects: 1) image encryption; 2) data hiding; 3) data extraction and image recovery.

A. IMAGE ENCRYPTION
For simplicity, the cover image is assumed to be uncompressed gray-scale image and pixel value falls into [0, 255]. Each pixel is first discomposed into 8 bits using Eq.18, where p i,j is the pixel value located at (i, j) and . is the flooring function.
After that, standard stream encryption method such as RC4 or SEAL is used to generate pseudo-random bits using the encryption key. Then, each pixel is encrypted by Eq.19, where e i,j,h represents the cipher-text, r i,j,k is the key stream and ⊕ stands for exclusive-or. e i,j,k = b i,j,k ⊕ r i,j,k k = 0, 1, 2, . . . , 7 The encrypted pixel is calculated by Eq.20. After that, the encrypted image and the encrypted PF are transmitted.

B. DATA HIDING
After receiving the encrypted image containing PF, some additional data is embedded into the encrypted image by the data hider. The details of embedding are given as follows.
To prevent additional data from being read illegally, the additional data is first encrypted using the data-hiding key.
Step 2: Image segmentation. The encrypted image is segmented into a lot of non-overlapping pixel blocks with the size of s 1 × s 2 .
Step 3: Data hiding. Pixels of ECB are pseudo-randomly divided into two equal-size sets N 0 and N 1 using the data-hiding key. If the to-be-embedded bit is ''0'', flip the three LSBs of each pixel in N 0 as . Otherwise, flip the three LSBs of each pixel in N 1 as By repeating step 3, the additional data is embedded into the encrypted image. After that, an end mark is also embedded.

C. DATA EXTRACTION AND IMAGE RECOVERY
Data extraction and image recovery can be completed by an authorized recipient. The details of data extraction and image recovery are given as follows.
Step 1: Image decryption. An pseudo-random matrix that has the same size as the received image is first generated using the decryption key. Then, the received image is decrypted by calculating the exclusive-or value of the received images and the pseudo-random matrix.
Step 2: PF extraction. PF is extracted from the decrypted image such that pixel blocks can be rearranged into the original state.
Step 3: Data extraction and image recovery. Pixels of ECB are pseudo-randomly divided into two equal-size sets N 0 and N 1 using the data-hiding key. Then, the three LSBs of pixels in N 0 (N 1 ) are flipped to obtain N 0 (N 1 ). Next, the fluctuation values of N 0 and N 1 , denoted by F 0 and F 1 , are calculated using the proposed fluctuation function. if F 0 >F 1 , the hidden bit is ''1'' and N 1 is the original pixel block. Otherwise, the hidden bit is ''0'' and N 0 is the original pixel block.

V. EXPERIMENTAL RESULT
In this section, we conduct several experiments to evaluate the proposed method, including recovery result comparison and analysis, embedding capacity analysis using different block sizes, fluctuation function comparison and analysis, comparison with existing methods. The experiment PC configuration is: Intel E6-1620 v3, CPU 3.50GHz, 16GB RAM. All program is encoded by MATLAB. All test images are sized 512 × 512 and can be obtained from [34].

A. RECOVERY RESULT COMPARISON AND ANALYSIS
To verify the advantages of the proposed method, standard test images ''Lena'' and ''Baboon'' are used to test the recovery result of the proposed method and related methods. When 4096 bits are embedded, Fig. 11 and Fig. 12 show the changes   on the test image in several key stages of the proposed method, including original image, encrypted image containing additional data, directly decrypted image containing additional data and recovered image. Fig.11(b) and Fig.12(b) show the encrypted images containing additional data. As we can see, these two images are very similar to noise images such that a recipient without the decryption key and the data-hiding key cannot read the cover image content and extract the hidden data. Therefore, the privacy of the image owner and the security of additional data can be well protected. The directly decrypted images are shown in Fig. 11(c) and Fig. 12(c). It is seen that both of them have high visual quality, which indicates that the cover image content can be read by the receiver who has only the decryption key. Fig. 11(d) and Fig. 12(d) show the recovered images. As it is shown, these two test images have been perfectly recovered. Therefore, we conclude that the receiver has both the decryption key and the data-hiding key can perfectly recover the cover image and losslessly extract the hidden data.
When 4096 bits are embedded, the recovery results of related methods are shown in Fig. 13 and Fig. 14, where incorrectly recovered blocks are marked by white. As we can see, there are far more incorrectly recovered blocks on the rough image ''Baboon''. This indicates that embedding capacity is highly close to image complexity for related methods. Moreover, all related methods fail to embed 4096 bits into the images ''Lena'' and ''Baboon''. By contrast, the proposed method has much higher embedding capacity.  [21], (b) [22], (c) [23], (d) [24], (e) [25].

B. EMBEDDING CAPACITY ANALYSIS USING DIFFERENT BLOCK SIZES
To further verify the performance of the proposed method, we compute the embedding capacity on all test images under different block sizes. As shown in Table 4, the embedding capacity generally increases with the decrease of block size. With the block size of 2 × 2, the proposed method achieves the highest capacity of 42857 bits on the image ''Tank'', and the lowest capacity of 29409 bits on the image ''Stream''. Therefore, it can be concluded that the proposed method can always vacate enough room for data embedding such that it is a practical RDHEI method. VOLUME 8, 2020

C. FLUCTUATION FUNCTION COMPARISON AND ANALYSIS
For further improvement, a new fluctuation function is introduced in the proposed method. Compared with those of [21] and [24], the new fluctuation function additionally considers pixels on the edge of the pixel block. Moreover, more neighboring pixels are considered when compared with [22]. Compared with those of [21] and [23], the new fluctuation function evaluates the real fluctuation of pixels, especially for pixels shown in Fig. 3.  Table 5 presents the comparison of the number of ECBs when various fluctuation functions are adopted with the block size of 4 × 4. As it is shown, the proposed fluctuation function generally provides the most ECBs. This confirms the significance of new fluctuation function to capacity improvement.

D. COMPARISON WITH EXISTING METHODS
To better demonstrate the advantages of the proposed method, the extraction error rate and PSNR of the proposed method are compared with those of previous methods under the payload size of 256, 625, 1024, 1764, 2601,4096, 7225 and 16384 bits. As shown in Fig.15, the proposed method always has an extraction error rate of zero. This implies that real reversibility is guaranteed by the proposed method for given payloads. For previous methods, by contrast, the extraction error rate of zero can only be achieved when the payload is fairly low. For example, Fig.15(c) shows that with a payload of 256 bits the extraction error rate is not zero for all previous methods except [25]. Moreover, all previous methods achieve a extraction error rate larger than zero on the extremely complex image ''Stream'', as shown in Fig.15 (e). That is to say, reversibility cannot by guaranteed by previous methods if cover image with high complexity is given.
The PSNR comparison of the proposed method and previous methods is shown in Fig.16. As we can see, for the given payloads and test images, the PSNR of the proposed method is always +∞. This means that the cover images can be perfectly recovered. On the contrary, the PSNR of previous methods can reach +∞ only with very low payload and low-complexity image. As shown in Fig.16 (e), on the image ''Stream'' the PSNR of previous methods cannot reach +∞ even though the payload size is 256 bits. However, it is seen from Fig.16 (e) that the PSNR of the proposed method is always +∞. This indicates that reversibility is guaranteed by the proposed method despite the high complexity of cover image. Table 1 presents the maximum capacity of previous methods. By comparing Table 1 and Table 4, one can see that the embedding capacity is significantly improved by the proposed method.
Based on the above analysis, we can conclude that the performance of the proposed method is much better than previous methods. For practical RDHEI applications, the proposed method is undoubtedly more suitable.

VI. CONCLUSION
For traditional RDHEI methods which fulfill data embedding by flipping the three LSBs of half of pixels within block, it is not guaranteed that the fluctuation function always identifies the flipped part whatever the block size is. To ensure real reversibility, an efficient block selection mechanism based on precise extraction-correct-block (ECB) distinguishment is proposed in this article. By embedding additional data into only ECBs, the dependence of reversibility on block size can be completely removed and one can seek sufficient embedding capacity with flexible block size.
In a word, on the issue of real reversibility and embedding capacity, the advantage of the proposed ECB based solution is incomparable to existing improvements in fluctuation function. Moreover, a better fluctuation function is also proposed to provide more ECBs and thus higher embedding capacity. One deficiency of the proposed method is that the embedding room is vacated before image encryption. This increases the computational burden of the owner. In the future we plan to study embedding room vacating at the cloud sever.