Secure Encryption and Hiding of Data and Messages in Images

The invention relates to methods of encryption and, more particularly, to methods for hiding messages in digital images.

This invention belongs to the field of steganography, the science of information hiding. Sending an encrypted message over a public channel gives a clear idea to anybody who intercepts the message that secret communication is occurring. There are cases when it is desirable to hide the very presence of communication while keeping a certain degree of security.

Historically, many steganographic techniques have been designed. Invisible ink, use of clear chemicals that change color when exposed to heat or other chemicals, microdots, and many other techniques have been used in the past. Today, various forms of digitized information, such as digital images, videos, or soundtracks provide a natural environment for hiding secret messages. Specifically, the noise component of such digital information is especially attractive for the aforementioned purpose.

One of the most common steganographic techniques for secret hiding of messages in digital images is called the Least Significant Bit (LSB) encoding. In this technique, a secret message is encoded into the least significant bit of some image. This naive scheme, however, has some obvious drawbacks. Anybody can look at the least significant bit of the image to determine whether a message exists. Second, if one byte is used for representing the color of one pixel (for example, this is true in grayscale images), the secret message can form at most 12.5% of the image size.

In the present invention, a method is provided which uses three-dimensional chaotic maps to encrypt a secret message, which is then embedded into the least two significant bits of the pixel values of some carrier image. The use of three-dimensional chaotic maps is described in copending, U.S. patent application, Ser. No. 08/763,572, filed Dec. 10, 1996, for "METHOD FOR ENCRYPTING AND DECRYPTING DATA USING CHAOTIC MAPS", hereby incorporated by reference. During the embedding process, the carrier image is slightly modified so that the modifications resemble a Gaussian noise invisible to the human eye even under close inspection. The encryption has two functions: it provides security (anybody without the key will be unable to recover the secret message); and, also, the encrypted message is randomized by the encryption. After embedding, it does not create any patterns in the least two significant bits of the carrier image.

This invention uses and extends to the field of steganography the discovery of the class of parametized permutations of a rectangular array of elements (symbols) based on discretized chaotic maps, described in the aforementioned, copending patent application, Ser. No. 08/763,572. A simple software implementation of the new cipher using a desktop computer achieves encryption speeds greater than software implementations of DES that are executed on general purpose computers. Therefore, the invention is a viable and secure alternative to other bulk encryption techniques. It can be used for secure transfer and archival of large quantities of data, such as digital imagery or other large electronic data files.

This invention uses the new class of encryption techniques based on two- and three-dimensional chaotic maps. Chaotic mapping provides excellent security and has many desired cryptographic qualities. It is simple to implement, which results in high encryption rates. A typical software implementation using a 66 MHz Pentium desktop computer achieved a 1 Mb/sec encryption rate. This rate is several orders of magnitude faster than the current software implementation of the public key and bulk encryption methods that utilize higher speed general purpose computers.

Secure transmission and archival of data is of paramount importance to the military, police, and banking industry, and virtually the entire industrial sector in general. Information protection is commonly achieved via encrypting the information using some encryption technique. A large number of powerful encryption schemes, such as DES, RSA, El Gamal, LUCIFER, IDEA, Blowfish (Schneier, B., APPLIED CRYPTOGRAPHY, John Wiley, New York, 1996), etc., have been designed. The security of virtually any encryption technique can be significantly increased if the encrypted information were to look like some other ordinary message (a carrier). The security of the encryption method significantly increases if some useful information can be encrypted and hidden inside some other, innocent-looking message. It is important that an eavesdropper not recognize that some other, secret message is being sent by visually inspecting the carrier message containing the hidden message.

An ideal candidate for hiding secret information is provided by a digitized image. Raw digital images typically contain uncorrelated, thermal Gaussian noise. If a secret message can be masked inside some other image as a random noise, the carrier image with hidden message will not raise a suspicion that some secret information is being sent.

One of the methods for hiding information inside of an ordinary message is to insert "garbage symbols" between the symbols of the secret message. The method requires a mask which can be applied to the text, and which extracts the hidden secret message. However, this method is applicable to text rather than some binary message, such as an image. Also, it is somewhat elaborate and time-consuming to devise an appropriate carrier. Another disadvantage is that the size of the carrier with hidden message significantly exceeds the size of the hidden message, drastically decreasing the efficiency of the whole scheme.

Other methods for hiding information utilize invisible ink, chemical properties of the paper, slight modification of letters, marking letters with pencils, etc. (Schneier, B., APPLIED CRYPTOGRAPHY. John Wiley, New York, 1996). However, since these techniques do not combine encryption with hiding, any person familiar with the principles of the secret embedding can access the secret information.

The scheme described hereinbelow is applicable to both text and binary data files. The expansion factor of the proposed scheme can be made close to 1, if the secret information is a digital image.

To embed a small message of the order of 8 bits or so, an image is scanned until a certain password-dependent message digest hash function returns the required 8-tuple of bits. This has the advantage of absolute secrecy tantamount to one-time pad used in cryptography. The same error distribution and undetectability is guaranteed. Although the scheme satisfies the rigorous requirements of steganographic standards, it is time consuming, has very limited capacity, and is not applicable to image carriers for which only one copy is available.

In "Invisible Communication", by T. Aura, (Proc. of the HUT Seminar on Network Security '95, ESPOO, Finland, November 1995. Telecommunications Software and Multimedia Laboratory, Helsinki University of Technology.), the author suggests changing only a small fraction of the carrier bits (e.g., modifying each hundredth pixel in the carrier by one gray level). Depending on the image noise, these changes are usually compatible with the uncertainties involved with any statistical model of the image.

Before any secret message hiding technique can be considered secure, the carrier image and its statistical properties must be investigated carefully. The noise component may not be uniform within the image, but may depend on the pixel position in the image. For example, pixels corresponding to a bright white color will probably always be saturated at 255, even though the overall model of the noise can be Gaussian with a non-zero variance.

In a black and white image with black pixels corresponding to even gray levels and white pixels corresponding to odd values of gray levels, a large patch of odd pixels, for example, can correspond to pixels saturated at 255 in the original image. Even if only a small fraction of pixels in the image is modified, certain suspicious noise may be introduced into the overflowed patch. This problem with overflow/underflow can of course be avoided by a more careful choice of the carrier image, by preprocessing the carrier, or by instructing the steganographic scheme to avoid the overflowed/underflowed areas.

It is probably impossible to obtain a complete model of the carrier noise, and the search for the perfect steganographic method will probably never be complete. But all good secret hiding schemes must be based on some model of the noise. If it is known that scanned images exhibit larger noise correlations in the horizontal direction and smaller correlations in the vertical direction, while the probability distribution for each pixel (which is neither overflowed nor underflowed) is Gaussian with certain standard deviation, then this evidence is taken into account. The present secret message hiding scheme is adjusted so that the carrier modifications are consistent with the statistical evidence.

An example follows of how to incorporate statistical evidence into the construction of a secret message hiding scheme. Assume that the noise component of pixels with gray levels within the range [L, H] can be modeled with a uniformly valid probability density, f, symmetric around zero. If the secret plain-text message {p.sub.i }.sup.N.sub.i=1 is encrypted, the cipher-text {c.sub.i }.sup.N.sub.i=1 should be a random sequence of ones and zeros. By averaging several scanned versions of the carrier image, a "zero noise" image, Z, is obtained. Using a pseudo-random number generator, we can choose, at random, N pixels in Z with their gray levels in [L, H]. Then, the LSB of those pixels can be modified by the amount of (2b.sub.i -1).vertline..eta..sub.i .vertline., where .eta..sub.i is a random variable with probability distribution f. The remainder of the pixels will be modified by .eta..sub.i. The modifications should be consistent with the statistical model.

In accordance with the present invention, there is provided a method of embedding a secret digital square image with 256 gray levels within an image carrier. The invention is also implemented using color images. The secret image is first encrypted using a chaotic baker map. The resulting image is a random collection of pixels with randomly distributed gray levels without any spatial correlations. Each gray level of the encrypted secret image is coded using four pixels in the carrier. By modifying the gray level of each pixel by 1, 0, -1, -2, four values of information can be hidden. The four pixels hide 4.times.4.times.4.times.4=256 values of gray levels.

The method hides one N.times.M digitized image with 256 gray levels inside of a carrier 2N.times.2M pixels with 256 gray levels, although, in other embodiments, this method is also applicable to color images. The method for hiding a secret image inside of a carrier image comprises the steps of:

a) encrypting the secret image N.times.M pixels with 256 gray levels using a chaotic map;

b) choosing a carrier image 2N.times.2M pixels with 256 gray levels;

c) modifying the carrier image according to the following pseudo-code:

i) for each pixel P=(i,j) of the secret image, converting the gray level g.sub.ij to its base 4 representation t1, t2, t3, t4 (i.e., g.sub.ij =t1+4*t2+16*t3+64*t4, where 0.ltoreq.t1, t2, t3, t4.ltoreq.3);

ii) modifying the gray levels of pixels (2i, 2j), (2i+1, 2j), (2i, 2j+1), (2i+1, 2j+1) by 2-t1, 2-t2, 2-t3, and 2-t4, respectively; and

iii) sending the modified image to the recipient.

Care must be taken so that a pixel with a gray level close to zero or close to 255 is not changed to a value outside of the interval [0, 255]. This is arranged by applying special rules for pixels whose gray levels are close to 255 or to zero.

Extracting the secret image from the modified carrier comprises the following steps:

a) subtracting the original (unmodified) carrier from the image received (modified carrier image);

b) extracting the encrypted secret image from the difference image using the pseudocode:

i) for each (i, j), 0.ltoreq.i.ltoreq.N-1, 0.ltoreq.j.ltoreq.M-1 taking the four values at positions (2i, 2j), (2i+1, 2j), (2i, 2j+1), (2i+1, 2j+1) of the subtracted image (to be t1, t2, t3, t4, respectively); and

ii) recovering the gray level g.sub.ij of the encrypted image by applying the formula g.sub.ij =t1+4*t2+16*t3+64*t4, where 0.ltoreq.t1, t2, t3, t4.ltoreq.3;

c) decrypting the encrypted image and recovering the original secret image.

Both the sender and the recipient need the original unmodified carrier image and the secret key for encrypting the secret image. Even if an eavesdropper obtains the original image, the secret image is still protected by the chaotic cipher. Thus, the scheme for hiding images provides a high degree of security and does not raise a suspicion that any secret information is being sent.

The encryption, using chaos, has two purposes: first, it increases the security of the scheme; and second, it converts the secret image into an uncorrelated, random-looking image which, when encoded into the carrier, resembles a thermal Gaussian noise commonly present in digital images. This is extremely important because the encoded information is well masked. An eavesdropper will not even suspect that secret information is being sent.

In the above scheme, a carrier 2N.times.2M image is used to send one secret N.times.M image. In other words, in order to hide .times. bytes of information, 4.times. bytes of data must be sent. The efficiency of the scheme is .times./4.times.=1/4. The efficiency can be increased to 1 in either of two ways. First, only two or three pixels in the carrier can be used for coding the information about one pixel of the secret image. This would require modifications of pixels in the carrier image by more than one or two gray or color levels. If two pixels are used instead of four, the efficiency increases from 1/4 to 1/2. Second, if slight modifications of the secret image are acceptable, the color depth of the secret image can be decreased by a factor of two or four, and the efficiency can increase to almost 1. For example, using two pixels in the carrier image per one pixel in the secret image with 121=11.times.11 gray levels, would result in an efficiency factor equal to 1. This would require modification of the gray levels in the carrier by .+-.5 gray levels.

In the hiding scheme of this invention, both the sender and the receiver share a secret key for enciphering/deciphering the secret image. They also must know the original carrier image. Since it would not be safe to reuse one carrier image several times, the communicating parties should agree on some database of images from which the carrier images are drawn. The need for sharing a database of images could be overcome by a scheme or agreement in which both parties can fix the least two significant bits of any carrier image. The least two significant bits of the unmodified carrier could be forced to be 0 and 1, for example. This simple agreement, however, would be too transparent for an eavesdropper. A better solution is to use the chaos cipher again. Both parties can request that the least two significant bits of the unmodified carrier be the same as the least two significant bits of some simple seed image (for example, a black square) encrypted ten times using the secret key already shared by both parties. Since the pattern of the least two significant bits is random by all statistical tests, a complex hard-to-detect structure is obtained. Fridrich, Jiri, "Secure Image Ciphering Based on Chaos", Final Report, Rome Laboratory, New York, 1997.

It is an object of this invention to provide a technique for secure encryption and hiding of messages in digital images.

It is another object of this invention to combine the cryptographic technique described in the aforementioned copending patent application, Ser. No. 08/763,572, with a steganographic technique for hiding images in digital images by slightly modifying groups of pixels of the digital image (carrier).

It is yet another object of this invention to provide means for covert communication based on embedding messages in carrier images so that the detection of messages in the carrier is extremely difficult without the knowledge of a secret password.

A complete understanding of the present invention may be obtained by reference to the accompanying drawings, when considered in conjunction with the subsequent detailed description, in which:

FIG. 1 illustrates a scanned image;

FIG. 2 illustrates the scanned image after applying a 3-D chaotic map;

FIG. 3 illustrates a schematic diagram of the encryption and hiding of data within an image, in accordance with the invention;

FIG. 4 depicts an illustrative view of one example of practicing the inventive embedding or hiding method.

FIG. 5 depicts a block diagram of a method for hiding images in accordance with the invention; and

FIG. 6 shows a block diagram of a method of deciphering and recovering the hidden image of FIG. 4.

The methods of the present invention for hiding secret messages in images are based on a novel approach to cryptography which utilizes the properties of chaotic maps. Chaotic maps offer better advantages for several reasons:

1) chaotic maps provide excellent security and have many desired cryptographic qualities, such as sensitivity to parameters, keys, and initial conditions;

2) they are simple to implement, which results in high encryption rates. A typical software implementation achieves 1 Mb/sec encryption rate on a 66 MHz Pentium machine, which is several orders of magnitude faster than current software implementation of public key cryptographic techniques; and

3) they provide a new paradigm in private key cryptography.

Referring now to FIG. 1, consider a secret message to be a digital square image with 256 gray levels. It is clear that any message written in some alphabet can be transformed easily to a square or rectangular array of 8-bit symbols, thus forming "an image."

Referring now to FIG. 2, the secret image is first encrypted using a chaotic baker map. The resulting image is a random collection of pixels with randomly distributed gray levels without any spatial correlations. The histogram is evenly distributed. Each gray level of the encrypted secret image will be coded using four pixels in the carrier. By modifying the gray level of each pixel by 1, 0, -1, -2, four values of information can be hidden. Therefore, four pixels can hide 4.times.4.times.4.times.4=256 values of gray levels.

Referring to FIG. 3, the process of coding an image inside of a carrier image is shown. The method of this invention combines the secure chaos-based encryption techniques as described in the aforementioned, copending patent application, Ser. No. 08/763,572, and a steganographic method similar to the LSB method. As aforementioned, the appearance of the carrier with the hidden secret message is such that an eavesdropper does not even suspect that secret information is being sent. The security of the scheme further increases if the secret message is encrypted before it is hidden in the carrier. It is important that a potential eavesdropper should not be able to recognize that a secret message is being transmitted even under close scrutiny of the carrier message. A message is hidden inside a digital image by slightly modifying the gray levels of the carrier image. The modifications will have the properties of thermal, Gaussian noise commonly present in digitized images taken with CCD elements or with an ordinary scanner.

Referring now to FIG. 4, there is shown the method for hiding one N.times.M digitized image with 256 gray levels inside a carrier 2N.times.2M pixels with 256 gray levels. A typical secret 236.times.236 image, a typical 472.times.472 carrier image, and the typical carrier image containing the embedded encrypted secret image is shown.

Referring to FIG. 5, a general scheme for hiding images is illustrated. The scheme comprises the steps of:

a) encrypting the secret image N.times.M pixels with 256 gray levels using a chaotic map, as previously described;

b) choosing some carrier image 2N.times.2M pixels with 256 gray levels;

c) modifying the carrier image according to the following pseudocode:

i) For each pixel P=(i, j) of the secret image, convert the gray level g.sub.ij to base 4 (i.e., g.sub.ij=t1+ 4*t2+16*t3+64*t4, where 0.ltoreq.t1, t2, t3, t4.ltoreq.3);

ii) modify the gray levels of pixels (2i, 2j), (2i+1, 2j), (2i, 2j+1), (2i+1, 2j+1) by 2-t1, 2-t2, 2-t3, and 2-t4, respectively; and

iii) send the modified image to the recipient.

In part (ii), care must be taken so that a pixel with a gray level close to zero or close to 255 is not changed to a value outside of the interval [0, 255]. This can be arranged easily by applying special rules for pixels whose gray levels are close to 255 or to zero.

Referring to FIG. 6, a general scheme is shown for extracting a secret image from a modified carrier. Extraction comprises the following steps:

a) subtract the original (unmodified) carrier from the image received (modified carrier) using the pseudocode:

i) for each (i, j), 0.ltoreq.i.ltoreq.N-1 and 0.ltoreq.j.ltoreq.M-1, take the four values at positions (2i, 2j), (2i+1, 2j), (2i, 2j+1), (2i+1, 2j+1)) of the subtracted image; and

ii) recover the gray level g.sub.ij of the encrypted image by applying the formula g.sub.ij =t1+4 t2+16 t3+64 t4, where 0.ltoreq.t1, t2, t3, t4.ltoreq.3; and

b) decrypt the encrypted image and recover the original secret image.

Both the sender and the recipient need the original unmodified carrier image and a secret key for encrypting the secret image. Even if an eavesdropper obtains the original image, the secret image is still protected by the chaotic cipher. Thus, the scheme for hiding images provides a high degree of security and does not raise a suspicion that any secret information is being sent.

It is possible to modify the hiding scheme so that knowledge of the exact form of the carrier image is not necessary, as explained hereinafter.

Encryption using chaos has two purposes. First, it increases the security of the scheme. Second, it converts the secret image into an uncorrelated, random-looking image which, when encoded into the carrier, resembles thermal Gaussian noise commonly present in digital images. This is extremely important because the encoded information is well masked. An eavesdropper will not even suspect that a secret information is being sent.

In the above scheme, a carrier 2N.times.2M image is used to send one secret N.times.M image. In other words, in order to hide .times. bytes of information, 4.times. bytes of data must be sent. The efficiency of the scheme is .times./4.times.=1/4. Ideally, the efficiency should be as close to 1 as possible. It is possible to increase the efficiency (bandwidth) of the scheme by:

1) using only two or three pixels in the carrier for coding the information about one pixel of the secret image. This requires modifications of pixels in the carrier image by more than one or two gray levels. If two pixels are used instead of four, the efficiency increases from 1/4 to 1/2; and

2) if slight modifications of the secret image are acceptable, the color depth of the secret image can be decreased by a factor of two or four, and the efficiency increased to almost 1. For example, using two pixels in the carrier image per one pixel in the secret image and using 121 (11.times.11) gray levels would result in an efficiency factor equal to 1. This would require modification of the gray levels in the carrier by .+-.5 gray levels.

In the hiding scheme described above, both the sender and the receiver share a secret key for enciphering/deciphering the secret image. They also know the original carrier image. Since sharing a carrier image requires processing of a great amount of information, it would be desirable to eliminate the need for exact knowledge of the unmodified carrier. It is possible to modify the scheme to achieve that goal.

One possible approach to this problem is to design a scheme (an agreement) wherein both parties can fix the least two significant bits of any carrier image. Of course, the least two significant bits of the unmodified carrier could be restricted to 0 and 1, for example. However, this simple agreement would be too transparent for an eavesdropper. A better solution is to use the chaos cipher again. For example, the least two significant bits of the unmodified carrier could be forced to be the same as the least two significant bits of some simple seed image (for example, a black square) encrypted ten times using the secret key already shared by both parties. Since the pattern of the least two significant bits is random by all statistical tests, a complex, hard-to-detect structure is obtained.

Since other modifications and changes varied to fit particular operating requirements and environments will be apparent to those skilled in the art, the invention is not considered limited to the example chosen for purposes of disclosure, and covers all changes and modifications which do not constitute departures from the true spirit and scope of this invention.

Having thus described the invention, what is desired to be protected by Letters Patent is presented in the subsequently appended claims. ##SPC1##