Matrix embedding in multicast steganography: analysis in privacy, security and immediacy

Transcription

1 SECURITY AND COMMUNICATION NETWORKS Security Comm. Networks 2016; 9: Published online 14 November 2014 in Wiley Online Library (wileyonlinelibrary.com) SPECIAL ISSUE PAPER Matrix embedding in multicast steganography: analysis in privacy, security and immediacy Weiwei Liu*, Guangjie Liu and Yuewei Dai School of Automation, Nanjing University of Science and Technology, Nanjing, China ABSTRACT With rapid development of multicast communication, multimedia share services have become one of the most important channels for steganography. In this paper, we extend traditional unicast steganography to multicast steganography, which is the covert communication of a single sender attempting to deliver different secret messages simultaneously to several receivers within the same cover object. The general model of multicast steganography is first presented, and the newly spawned problems are discussed including the intergroup privacy, extended embedding efficiency and information retrieval immediacy. Then with the widely used matrix embedding strategy, synchronous and asynchronous multicast matrix embedding frameworks are proposed respectively; the former is based on Slepian Wolf coding, and the latter employs overlapped multi-embedding. The state-of-the-art syndrome-trellis codes are taken as examples to illustrate the performance of the proposed two schemes in experiments, which shows that the former scheme can achieve higher embedding performance, while the latter one can guarantee better intergroup privacy and information retrieval immediacy. Copyright 2014 John Wiley & Sons, Ltd. KEYWORDS multicast steganography; matrix embedding; intergroup privacy; extended embedding efficiency; information retrieval immediacy *Correspondence Weiwei Liu, School of Automation, Nanjing University of Science and Technology, Nanjing, China. lwwnjust5817@gmail.com 1. INTRODUCTION Steganography is a popular covert communication technique carried out by conveying the secret messages in some digital multimedia, for example, digital images, audios, texts, etc., which is known as cover object. A good steganographic scheme should have high embedding capacity and good imperceptibility [1]; it means that the number of embedding changes in the cover object should be as small as possible and the modification of the cover data should only occur in inconspicuous parts. Matrix embedding [2], the embedding method arising from errorcorrecting codes, is generally used for reducing embedding distortion, which has become the mainstream steganographic coding framework; many matrix embedding schemes have been proposed using different types of codes. The first one based on coding theory was constructed by using the family of binary Hamming codes [2], and on the basis of this, the famous steganographic software F5 [3] was developed. Then, many schemes based on the same model have been proposed; they were based on different types of codes: random linear codes [4,5], BCH codes [6,7], Reed-Solomon codes [8], Low-Density Generator-Matrix codes [9] and convolutional codes [10,11]. The application of these codes has made the embedding performance of unicast steganography approximate to the theoretical bounds. With the rapid development of network communication technology, as a common operation in a network to resolve many issues, multicast communication of information from one source to several receivers are now more frequent. For example, the image share services via social networks, the voice or video chatroom application via Internet, the group voice call via radio, the battlefields information sharing via tactical data link and so on. These multicast communications have become one of the main data traffics in Internet; traditional unicast steganography cannot make the best use of their multicast property on many conditions. In this paper, we consider the problem of steganography in these situations, which is called multicast steganography. To the best of our knowledge, the problem of multicast steganography has not been addressed in depth Copyright 2014 John Wiley & Sons, Ltd. 791

2 SCN-SI-066 W. Liu, G. Liu and Y. Dai for steganography before. In fact, if only in the perspective of communication results, the function of multicast steganography can also be supplanted by multiple unicast steganography. However, taken together, the former has three obvious superiorities: Firstly, multicast steganography can be implemented on multicast communication, which means less time budget than multiple unicast steganography. And the less communication can reduce the abnormality in behavioral sense on the sending side. Secondly, there is only the same one stego object for all receivers in multicast steganography, which avoids the joint steganalysis with higher probability of success by collecting multiple stego objects for multiple unicast steganography [12,13]. Finally, for many covert communication tasks, there always exist correlations among the secret messages sent to different receivers. These redundancy information can be reduced by some encoding technique in multicast steganography, while multiple unicast steganography cannot fulfill that. With the preceding three points, it can be found that the multicast steganography can achieve better performance in many situations than multiple unicast steganography. In this paper, we model the problem of multicast steganography and consider the newly spawned aspects including privacy, security and immediacy. The privacy in this problem refers to the information privacy among group members, which is called intergroup privacy; good intergroup privacy always means that each authorized receiver can only obtain the secret information delivered to her/him or obtain the secret information which is not delivered to her/him as little as possible. As the security of steganographic scheme is always enhanced by reducing the embedding distortion, two definitions of embedding efficiency are given together to evaluate the embedding performance: practical embedding efficiency and entropic embedding efficiency. And it is also necessary to consider the information retrieval immediacy due to the rapid rise of burn-after-reading multimedia share applications, for example, Snapchat [14], which provides near-optimal channel for steganography; the steganalysis and forensics are difficult to carry out because the stego objects will be destroyed within several seconds after receiving. Then, on the basis of matrix embedding framework, two practical multicast steganographic schemes are proposed; they are distinguished as synchronous and asynchronous according to information embedding strategy. The former is implemented by the concatenation of Slepian Wolf (SW) coding [15] and syndrome coding, which aims to minimize the embedding distortion for correlated secret messages, while the latter employs joint coding based on overlapped multi-embedding; it places emphasis on the enhancement of privacy and immediacy at the expense of some embedding performance. This paper is organized as follows: in the next section, related works are introduced including the concept of additive distortion function, the framework of matrix embedding and the brief description of syndrome-trellis codes (STCs). In Section 3, the problem of multicast steganography is described; some newly spawned aspects in privacy, security and immediacy are discussed in detail. Then, on the basis of matrix embedding, synchronous and asynchronous multicast matrix embedding frameworks are proposed in Section 4. Section 5 contains experimental results of the proposed schemes for different correlated secret messages and distortion profile, and we give a comprehensive comparison of them with the analysis of intergroup privacy, embedding efficiency and information retrieval complexity. Finally, in Section 6, we give a conclusion for this paper. 2. RELATED WORKS 2.1. Binary embedding with additive distortion function Without loss of generality, we suppose that the cover and stego object are represented by the binary vectors X, Y {0, 1} n, which can be produced via some bitassignment function such as mod 2 from the cover or stego media data. Furthermore, the embedding operation is also assumed binary; the cost of changing cover element x i to y i is defined as d i = f(x, y i ), where d i [0, ] is the singleletter distortion and may be different for the different cover element despite x i y i {0, 1}. In [10], the single-letter distortion is defined with a relatively simple form as d i = ρ i (x i y i ), where ρ i is commonly viewed as the single-letter distortion weight. The set of single-letter distortion weight ρ ={ρ 1,, ρ n } is called the distortion profile. Thus, the total distortion can be approximatively represented as the following additive form. DðX; YÞ ¼ n ρ i ðx i y i Þ (1) i¼1 Obviously, the distortions profile should be designed to reflect the steganography risk, that is, the lower D(X, Y) is, the less the detection probability is. Under elaborately designed distortion profiles, the embedder will strive to minimize the distortion in Equation (1) when he or she has to embed the binary message M {0, 1} q with q < n Matrix embedding in unicast steganography A family of binary structured Hamming codes are first employed to design the matrix embedding scheme in [2], which can provide an outstanding answer to the problem of minimizing embedding distortion. The secret message bits are conveyed with the syndrome of the Hamming codes. The embedding and extraction functions are depicted as follows: 792 Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd.

3 W. Liu, G. Liu and Y. Dai SCN-SI-066 Embedding : Extraction : Y ¼ X LrðHX MÞ M ¼ HY (2) the optimum stego object, the Viterbi algorithm [16] is implemented, and weights are assigned to all trellis edges on the basis of the distortion profile. where H {0, 1} q n denotes the parity-check matrix of the Hamming code, Lr(S) stands for a coset leader of the syndrome S, and the embedding strategy achieves minimal cover change rate. With the development of syndrome coding, in order to limit the modification of the cover data only occurring in inconspicuous parts, Filler et al. [11] gave a single-letter distortion to each cover element; the embedding and extraction are realized using a binary linear code C of length n and dimension n q, which can minimize additive distortion in Equation (1) by selecting the optimal stego object from the coset set corresponding to the message M. Embedding : Y ¼ arg min Hω¼M DðX; ωþ Extraction : M ¼ HY where H {0, 1} q n denotes the parity-check matrix of the linear code C Syndrome-trellis codes With convolutional codes employed in the embedding and extraction framework as Equation (3), a detailed description of STCs is given in [11]. The parity-check matrix H {0, 1} q n of the convolutional code C(N, N 1) is first constructed by placing a small submatrix ^H of size h N along the main diagonal as Figure 1; the submatrices ^H are placed next to each other and shifted down by one row, and h and N denote the memory degree length and the block length of the convolutional code, respectively. Then the syndrome trellis is parameterized by the message M {0, 1} q and can represent members of arbitrary coset δ(m)={ε {0, 1} n H ε = M}. An example of the syndrome trellis is shown in Figure 1; the syndrome trellis is a graph consisting of q trellis blocks, and each trellis block contains 2 h (N + 1) nodes organized in a grid of N + 1 columns and 2 h rows. The nodes in every column are called states. Each ε {0, 1} n satisfying H ε = M represents a path through the syndrome trellis that starts in the leftmost allzero state in the trellis and extends to the right. To find (3) 3. THE PROBLEM OF MULTICAST STEGANOGRAPHY 3.1. The model of multicast steganography Multicast steganography is the extension of traditional unicast steganography for the case of single sender and multiple receivers. Without loss of generality, similar to the model of broadcast channel in [17], the number of receivers is assumed 2 hereinafter; other conditions are then generalized. The model of multicast steganographic system can be depicted by Figure 2. Let ψ be a finite alphabet, for example, Galois field GF(2), on the sending side; the secret messages M 1 ψ q 1 and M2 ψ q 2 are embedded into the cover object X ψ n, and a composite stego object Y ψ n is then produced that is suitably close to the cover object. It is delivered to the receivers through public channels A and B, respectively, the output of which are Y A, Y B ψ n ;at each receiving side, the corresponding secret message can be retrieved. The secret key K 1 is shared by the sender and Receiver A, and the secret key K 2 is shared by the sender and Receiver B. The embedding and extraction mapping of a multicast steganographic scheme can be defined as follows. Embedding : ψ n ψ q 1 ψ q 2 ψ n Extraction : ψ n ψ q i i ¼ 1; 2 If the public channels A and B are both noise-free channels, then Y A = Y B = Y; we know that the joint entropy of messages will not be more than the conditional entropy of stego and cover objects, that is, HðM 1 ; M 2 (4) Þ Hð YXÞ j (5) where H(,) and H( ) denote joint entropy and conditional entropy, respectively. And if the public channels A and B are both noisy channels with capacity c a and c b (c a c b ), Equation (6) should be satisfied to guarantee the integrity of the embedding messages. Figure 1. Example of a parity-check matrix and its corresponding syndrome trellis. Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd. 793

4 SCN-SI-066 W. Liu, G. Liu and Y. Dai Figure 2. The model of multicast steganographic system. Hð M 1 jm 2 Þ=c a þ HðM 2 Þ=c b HðYXÞ j (6) In this paper, the public channels are assumed to be noise-free, which is a general assumption in steganography, and that means the stego objects obtained by receivers are just the same. In fact, the multicast steganographic schemes with noisy public channel can be designed by improving the schemes with noise-free public channels with error-correcting codes. Moreover, in practice, there may exist correlations between secret messages in many multicast steganography tasks; for example, each secret message may contain public information and private information, and the former is shared by all receivers and the latter is only known to a single receiver. These correlations always can be partly reserved even if they are encrypted to independent, identically distributed bitstream. Here, we concentrate on the conditions that the messages are correlated, and the uncorrelated conditions can be viewed as a simpler particular form of that The analysis of privacy, security and immediacy for multicast steganography As multicast steganography is implemented on multicast communication, which is quite different from that based on unicast communication, some newly spawned problems should be discussed in detail. In this section, we analyze the privacy, security and immediacy with three core aspects: intergroup privacy, extended embedding efficiency and information retrieval complexity. Pvy A B means worse privacy of Receiver A to Receiver B and vice verse. As we know, in synchronous multicast steganographic schemes, the secret messages are first jointly coded with a SW encoder [15] to minimize the embedding distortion, while the asynchronous one is sub-optimal, which trades embedding performance for privacy and immediacy. Thus, we employ the admissible rate region of SW coding shown in Figure 3 to analyze the bound of the intergroup privacy, where R 1 and R 2 denote the information rates of messages M 1 and M 2, which is the ratio between the number of produced bits and that of the input message. The shadow area in Figure 3 represents the admissible rate region, and the triangular region ABE is called symmetrical coding area; the arbitrary point in this area can achieve information rate lower than entropy of each message. For inflection point A, the information rate R 1 of message M 1 achieves the lower bound H(M 1 M 2 ); the amount of information that the extraction of M 1 needs retrieving from M 2 is I(M 1 ; M 2 ), Pvy B A = I(M 1 ; M 2 )/H (M 2 ) and Pvy A B = 0, which means the privacy of Receiver A to Receiver B performs the best and that of Receiver B to Receiver A performs the worst at inflection point A, and the inflection point B is just the reverse. Thus, the theoretical bound of intergroup privacy for arbitrary point F(f 1, f 2 ) in symmetrical coding area ABE can be obtained by Equations (7) and (8). Privacy Privacy is an important issue of multiuser information theory; as a covert multicast communication, it is necessary to discuss the intergroup privacy of multicast steganography. In our problem, intergroup privacy Pvy A B is defined as the privacy of Receiver A to Receiver B, which is measured by the ratio between the information content of message M 1 that can be accessed by Receiver B and the gross information content of M 1 ; the higher value of Figure 3. Admissible rate region of SW coding. 794 Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd.

5 W. Liu, G. Liu and Y. Dai SCN-SI-066 Pvy A B ¼ ðhðm 2 Þ f 2 Þ=HðM 1 Þ (7) Pvy B A ¼ ðhðm 1 Þ f 1 Þ=HðM 2 Þ (8) to meet the demands of burn-after-reading applications. Suppose that t a and t b are the information retrieval times of two receivers, respectively, then the immediacy can be measured by the combination of average retrieval complexity (t a + t b )/2 and maximum retrieval complexity max(t a, t b ). Security With the development of syndrome coding, minimizing the additive distortion function designed to capture statistical detectability has become a very important target to enhance the steganalysis-resistance capability of the steganographic scheme [18 21]. Thus, similar to the unicast steganography, embedding efficiency is employed to measure the security of multicast steganography including practical embedding efficiency E p and entropic embedding efficiency E t, which are defined as follows. E p ¼ ðq 1 þ q 2 Þ=DðX; YÞ (9) E t ¼ HðM 1 ; M 2 Þ=DðX; YÞ (10) As shown in Equations (9) and (10), the practical embedding efficiency measures the carried message bits per distortion; while the entropic embedding efficiency measures the carried information entropy per distortion, the latter places emphasis on the handling ability of message correlation. It is necessary to put them together to measure the multicast steganographic schemes. Immediacy As burn-after-reading multimedia share applications have become a very important branch of social networks, for example, Snapchat [14], the information retrieval immediacy is required for the low life cycle of receiving multimedia files. As we know, the complexity of the steganographic scheme is composed of information embedding complexity and information retrieval complexity; the former is concerned with the sender, while the latter is concerned with the receiver. In multicast steganography, we only consider the information retrieval complexity 4. MULTICAST MATRIX EMBEDDING FRAMEWORK Inthissection,weextendthewidelyusedmatrixembedding strategy in unicast steganography to multicast steganography. Two multicast matrix embedding frameworks are proposed, and they are classified into synchronous and asynchronous by message embedding strategy. The synchronous one is implemented by combining SW coding and syndrome coding, the secret messages of which are embedded into the cover object synchronously, while in asynchronous multicast matrix embedding framework based on overlapped multi-embedding, the quantization of secret messages is asynchronous. Here, we concentrate on correlated secret messages; the uncorrelated conditions can be viewed as a simpler particular form of that. Without loss of generality, the secret messages M 1 and M 2 are generally assumed binary symmetrical channel correlated sequences with the same length, M 2 is considered as the output signal ofm 1 transmittedthroughabinarysymmetricalchannelwith errorprobabilityp[22],thatis,p(m 1 M 2 )=p,andthefinite alphabet ψ is assumed as GF(2) hereinafter, M 1, M 2 {0, 1} q. Thus, the entropic embedding efficiency can be obtained as Equation (11). E t ¼ q½1 þ Hp ð ÞŠ=DðX; YÞ (11) As weknow,whenp = 0.5,thetwomessagesareuncorrelated, and the conditions of p (0, 0.5] are symmetric with that of p [0, 5, 1) (i.e., P(M 1 M 2 )=p equals P M 1 M 2 ¼ 1 p,wherem2 denotesthebit-flippingsequence of M 2 ); thus, only the conditions of p (0, 0.5] are considered in thispaper. Figure 4. The general framework of synchronous multicast matrix embedding. Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd. 795

6 SCN-SI-066 W. Liu, G. Liu and Y. Dai 4.1. Synchronous multicast matrix embedding based on Slepian Wolf coding A synchronous multicast matrix embedding system is shown in Figure 4. As shown in Figure 4, three parts are divided by dotted lines including the process flow of the sender and two receivers. On the sending side, the secret messages M 1 {0, 1} q and M 2 {0, 1} q are first encoded into a composited signal ^M f0; 1g l (l > q) via SW encoder [23 25], which is then embedded into the cover object X {0, 1} n with secret key K s by the syndrome embedder; the produced stego object Y {0, 1} n is delivered to two receivers through a noise-free channel. On each receiving side, the composited signal ^M is extracted with secret key K s by the syndrome extractor, which is decoded to corresponding message by SW decoder. The syndrome embedder and extractor can be realized as the embedding and extraction mapping of arbitrary matrix embedding scheme as Equation (3). And symmetric SW coding [23] is employed for SW encoding and decoding; here, for simplicity, it is assumed that the information rates of the two messages in SW encoder is the same, that is, R 1 = R 2. The process of SW encoder and decoder can be depicted as Figure 5. Suppose that G qr ¼ I qq U qðr qþ is the generator matrix of systematic linear block code C(r, q), where I q q denotes a sized q q identity matrix and U q (r q) denotes a sized q (r q) binary matrix. Two codewords ^M 1 ¼ ½M 1 P 1 Š and ^M 2 ¼ ½M 2 P 2 Š are generated by the encoder with secret messages as input signals, P i denotes the parity-check bits of ^M i. Then the composite signal ^M can be obtained as the output of SW encoder (the element order may be permuted by a secret key in practice). ^M¼ M 1 k 1 P 1 M kþ1 q 2 P 2 (12) where M a b i denotes the subvector of M i that is composed of elements from the ath to the bth, and here, the parameter k = bq/2c. On the receiving side, for example, Receiver A, as the composite signal ^M has been retrieved from the stego object, the parity-check matrix H ðr qþr ¼ U T I ðr qþðr qþ is used to construct SW decoder A with ^M 1 ¼ M 1 k 1 M kþ1 q 2 P 1 as the input signal; then the codeword ^M 1 of secret message M 1 can be obtained by maximum likelihood decoding with the bits in M 1 k 1 and P 1 being unmodifiable, that is, ^M 1 ¼ argmin Hυ¼0 D Ham ^M 1 ; υ (13) Subject to : υ 1 k ¼ M 1 k 1 and υ qþ1 r ¼ P 1 where D Ham (A, B) represents the Hamming distance between the vectors A and B, and the secret message M 1 is just composed of the former q bits in ^M 1. Similarly, for SW decoder B, we have ^M 2 ¼ argmin Hυ¼0 D Ham ^M 2 ; υ (14) Subject to : υ kþ1 q ¼ M kþ1 q 2 and υ qþ1 r ¼ P 2 In fact, as the two correlated messages M 1, M 2 {0, 1} q Figure 5. The process of SW encoding and SW decoding. 796 Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd.

7 W. Liu, G. Liu and Y. Dai SCN-SI-066 q 2=R 1 are encoded into a composite signal ^M f0; 1g ð Þ,where R = q/r denotes the code rate of the code C(r, q), Equation (15) shouldbesatisfied to ensure the correct retrieval of secret messages according to coding theory. 2=R 1 1 þ Hp ðþ (15) As a particular linear block code, for systematic convolutional code C(N, K), arbitrary codeword can be divided with block length N; in each block, the former K bits denote information bits, and the latter N K bits denote parity-check bits. Thus, the former bk/2c bits and all parity-check bits in each block of ^M 1 are retained to compose the composite signal ^M, while the latter K/2 bits and all parity-check bits in each block of ^M 2 are retained (if K/2 is not an integer, small adjustment should be implemented to guarantee that the numbers of retained bits in ^M 1 and ^M 2 are the same ) Asynchronous multicast matrix embedding based on overlapped multi-embedding As introduced in the preceding section, the main target of synchronous multicast matrix embedding framework is the minimization of embedding distortion with the successful retrieval of secret messages. In this section, to place emphasis on privacy and immediacy at the expense of some embedding performance, we propose an asynchronous multicast matrix embedding framework based on overlapped multi-embedding, which is shown in Figure 6. As shown in Figure 6, message M 1 {0, 1} q is first embedded into cover object X {0, 1} n with secret key K 1 by syndrome encoder A, the produced temporary stego object Y* {0, 1} n of which is used as the cover signal of syndrome encoder B to convey secret message M 2 {0, 1} q with secret key K 2. The stego object Y {0, 1} n is then delivered to receivers through a noise-free channel. On each receiving side, a secret message can be retrieved with the corresponding syndrome extractor. Assume that X a, X b {0, 1} λn (0.5 λ < 1) are the cover subsets with overlapped part X p {0, 1} (2λ 1) n, X 1, X 2 {0, 1} λn conveying secret messages M 1 and M 2,which are determined by secret key K 1 and K 2, respectively, X 1 X 2 = X, X p = X 1 X 2. Y 1, Y 2 and Y p denote the subsets in stego object Y corresponding to X 1, X 2 and X p. Then the embedding and extraction mapping can be described as follows. Syndrome encoder A : Syndrome encoder B : Syndrome encoder A : M 1 ¼ H 1 Y 1 Y 1 ¼ arg min H1α¼M 1 DðX 1 ; αþ Y 2 ¼ arg min H2β¼M 2 D X 2 ; β Subject to : Y p is unmodifiable Syndrome encoder A : M 2 ¼ H 2 Y 2 (16) where H 1, H 2 {0, 1} q (λn) are the parity-check matrices corresponding to syndrome coding A and B respectively, and X 2 is the modification of X 2 with the overlapped part X p changed to Y p. Take STCs in Figure 1 for example, suppose that the cover object X = {1, 0, 0, 1, 0, 1, 0, 0, 1} T, the secret messages M 1 = {0, 1, 1} T and M 2 = {0, 1, 0} T, and the distortion profile is constant (ρ i 1). Two cover subsets X a = {x 1, x 2,, x 6 } T and X b ={x 4, x 5,, x 9 } T are obtained with λ = 2/3. Then two pseudorandom order sequences A 1 = {2, 1, 3, 4, 5, 6} and B 1 = {2, 5, 3, 4, 1, 6} are generated by secret keys to produce two permuted cover subsets X 1 ¼ n o T n o T 0; 1; 0; 1 ; 0 ; and X 2 ¼ 1 ; 0; 0 ; 0; 1 ; 1, the 1 underlined bits denote the bits in overlapped part. The overlapped multi-embedding process can be depicted as Figure 7. As shown in Figure 7, the italic numbers around the states denote accumulated distortions of the states; the survived path is marked with red thick line, and in each path, the horizontal edge represents label 0 and the oblique one represents label 1. The cover object is orderly processed with syndrome encoders A and B. The modifications of the cover object produced by syndrome encoder A will not be changed again by syndrome encoder B; that is, the single distortion weights of all elements in Y 1 will be set to ρ i = for implementing the second syndrome coding. The resulting stego object just can be obtained with Y = Y 1 Y 2. Figure 6. The general framework of asynchronous multicast matrix embedding. Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd. 797

8 SCN-SI-066 W. Liu, G. Liu and Y. Dai Figure 7. Example of overlapped multi-embedding based on STCs. 5. EXPERIMENTAL RESULTS AND ANALYSIS In order to benchmark the proposed two multicast matrix embedding schemes (synchronous and asynchronous multicast matrix embedding schemes, called S-MME and A-MME, respectively), we compare them on three aspects: embedding efficiency, intergroup privacy and information retrieval complexity. To ensure practicability, the syndrome codings in two schemes are both implemented with the state-of-the-art matrix embedding scheme, STCs [11], the C++ and Matlab source code, which can be downloaded from syndrome/. And the SW coding in synchronous multicast matrix embedding is based on systematic convolutional codes. The memory degree lengths of the convolutional codes employed in syndrome coding and SW coding are all fixed to h = 10. The practical and entropic embedding efficiency of the two proposed schemes are computed with three typical distortion profiles, including the constant distortion profile (ρ i = 1), the linear distortion profile (ρ i =2i/n) and the square distortion profile (ρ i =3(i/n) 2 ). According to Equations (9) and (10), practical embedding efficiency E p and entropic embedding efficiency E t measure carried message bits per distortion and carried information entropy per distortion, respectively, E p = n α p /D(X, Y) and E t = n α t /D (X, Y), where n denotes the cover length, practical relative payload α p denotes the ratio between the number of all message bits and that of the cover object, and the entropic relative payload α t =(1+H(p)) α p /2 denotes the ratio between the joint entropy of the messages and that of the cover object; here we set message correlated parameter p = P(M 1 M 2 ) = To determine the parameter λ in A-MME, the practical embedding efficiency for constant distortion profile with different practical relative payload α p = {0.1, 0.2, 0.3} and parameter λ = {0.3, 0.4, 0.5, 0.6, 0.7, 0.8} are shown in Figure 8, in which the horizontal axis denotes the parameter λ and the vertical axis denotes the practical embedding efficiency. As we can find in Figure 8, A-MME scheme can achieve the better performance for the parameter λ = 0.6; thus, the parameter λ in A-MME is fixed to λ = 0.6 in the following experiments. Then, we compare the embedding efficiency of the two proposed schemes, for S-MME, the code rate of convolutional codes employed in SW coding R SW = {3/ 4, 4/5, 5/6, 6/7}. The cover length n = 6000, the secret message length q = {600, 900, 1200, 1500, 1800, 2100}, and thus the practical relative payload α p = Figure 8. Practical embedding efficiency with different practical relative payload and parameter λ. 798 Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd.

9 W. Liu, G. Liu and Y. Dai SCN-SI-066 Figure 9. Embedding efficiency of the proposed schemes for constant distortion profile: (a) practical embedding efficiency and (b) entropic embedding efficiency. {0.2, 0.3, 0.4, 0.5, 0.6, 0.7}. The experimental results of practical embedding efficiency E p and entropic embedding efficiency E t with message correlated parameter p = P (M 1 M 2 ) = 0.05 are shown in Figures In Figures 9 (a), 10(a) and 11(a), each point is plotted by reciprocal practical relative payload on the horizontal axis and practical embedding efficiency on the vertical axis, while in Figures 9(b), 10(b) and 11(b), each point is plotted by reciprocal entropic relative payload on the horizontal axis and entropic embedding efficiency on the vertical axis. Each point is obtained as an average over 100 samples. As shown in Figures 9 11, S-MME schemes can always achieve higher practical and entropic embedding efficiency than A-MME with different distortion profile. In Figures 9(a), 10(a) and 11(a), we can find a remarkable superiority of A-MME in that it can achieve practical embedding efficiency moreover than practical bound in [11] (the ratio between the carried message bits and the expected minimum distortion); that is, if the secret messages are correlated, A-MME can reduce the embedding distortion greatly when compared with the condition that the same message bits are embedded by unicast matrix embedding schemes. The practical embedding efficiency of A-MME will increase by the code rate of SW encoder increasing, which is limited to the bit error rate of extracted messages; the related results have been shown in Figure 12. When the message correlated parameter p 0.06, the secret messages both can be extracted correctly by SW decoding with code rate R SW = {3/4, 4/5, 5/6, 6/7}; however, only the SW coding scheme with R SW = 3/4 can ensure the correct retrieval of secret messages for p 0.2, and bit error rate will increase by message correlated parameter p increasing Figure 10. Embedding efficiency of the proposed schemes for linear distortion profile: (a) practical embedding efficiency and (b) entropic embedding efficiency. Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd. 799

10 SCN-SI-066 W. Liu, G. Liu and Y. Dai Figure 11. Embedding efficiency of the proposed schemes for square distortion profile: (a) practical embedding efficiency and (b) entropic embedding efficiency. for other SW coding schemes, which is consistent with Equation (15). Moreover, as shown in Figures 9(b), 10(b) and 11(b), both S-MME and A-MME can approach the entropic bound (the ratio between the carried information entropy and the expected minimum distortion), and the gap between the entropic bound and the entropic embedding efficiency of S-MME will decrease by increasing the code rate of SW coding. Then, for intergroup privacy, in S-MME framework described in Sections 4.1 and 3.2, we have Pvy A B + Pvy B A = 1 for arbitrary SW coding as the secret messages are decoded correctly on the basis of part of information bits in the other one. Particularly, for symmetrical SW coding scheme employed in this paper, we have Pvy A B = Pvy B A = 0.5. However, in A-MME framework, each secret message is extracted only by the corresponding secret key; the extraction mappings of the two messages are irrelevant; that is, Pvy A B = Pvy B A =0. Therefore, A-MME can maintain much better intergroup privacy than S-MME. Last, we compare the average information retrieval complexity of the two schemes (as the average information retrieval complexity is the same with the maximum information retrieval complexity when the two messages are of the same length); the information retrieval complexity Comp S MME of S-MME is composed of two parts: the complexity of syndrome decoder Comp syndrome and the complexity of SW decoder Comp SW, while the information retrieval complexity Comp A MME of A-MME only contains the complexity of syndrome decoder Comp syndrome. Experimental results of the information retrieval complexity for two schemes have been given in Figure 13. The cover length n = 6000, the secret message length q = {600, 900, 1200, 1500, 1800, 2100} and the code rate of convolutional codes employed in SW coding R SW = {3/ 4, 4/5, 5/6, 6/7}. The results are obtained with Visual C using an Intel Core2 T GHz CPU machine utilizing a single CPU core. As shown in Figure 13, the information retrieval complexity of S-MME is much larger than that of A-MME; it Figure 12. Bit error rate of messages for different SW coding scheme and message correlated parameter p. Figure 13. Information retrieval complexity (ms) of the two proposed schemes. 800 Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd.

11 W. Liu, G. Liu and Y. Dai SCN-SI-066 means A-MME is more suitable for immediacy demand conditions of some burn-after-reading multimedia applications that require the low information retrieval complexity as the retrieval time and computing resources are always limited. Above all, S-MME aims to minimizing the embedding distortion by making use of the correlation between secret messages, while A-MME can perform nearoptimal intergroup privacy and information retrieval immediacy at the expense of some embedding efficiency. They should be chosen to utilize for different application demands. 6. CONCLUSION Multicast steganography is the problem of a single sender attempting to deliver different secret messages simultaneously to several receivers with the same cover object, which is an important extension of steganography in multicast communication. In this paper, we model this problem and discuss some newly spawned aspects including intergroup privacy, extended embedding efficiency and information retrieval immediacy. Combining with matrix embedding, two multicast matrix embedding frameworks are proposed; the synchronous one is based on SW coding, and the asynchronous one is based on overlapped multiembedding. As STCs taken for example, the two schemes are compared in three aspects with experiments and analysis, which shows that the synchronous multicast matrix embedding scheme has superiority in embedding performance, while the asynchronous one places emphasis on privacy and immediacy. In fact, in multicast steganography, the stego object is always transmitted in noisy public channel; in this paper, we limit our discussion to the condition of noise-free public channel. A more general multicast matrix embedding framework that can prevent the secret messages from channel disturbance is worth studying in our future works. ACKNOWLEDGEMENTS This study was supported by NSF of Jiangsu province (Grant no. BK ), and NSF of China (Grant no , , ). REFERENCES 1. Cheddad A, Condell J, Curran K, et al. Digital image steganography: survey and analysis of current methods. Signal Processing 2010; 90(3): Crandall R. Some notes on steganography. Posted on Steganography Mailing List, Westfeld A. F5 a steganographic algorithm. In Information hiding. Springer: Berlin Heidelberg, 2001; Fridrich J, Soukal D. Matrix embedding for large payloads. Electronic Imaging International Society for Optics and Photonics, 2006; 60721W W Mao Q. A fast algorithm for matrix embedding steganography. Digital Signal Processing 2014; 25: Schönfeld D, Winkler A. Embedding with syndrome coding based on BCH codes: the corrected version of this paper is now available as full text. Proceedings of the 8th Workshop on Multimedia and Security, ACM, 2006; Zhang R, Sachnev V, Kim HJ. Fast BCH syndrome coding for steganography. In Information hiding. Springer: Berlin Heidelberg, 2009; Fontaine C, Galand F. How Reed Solomon codes can improve steganographic schemes. EURASIP Journal on Information Security 2009; 2009:1. 9. Fridrich J, Filler T. Practical methods for minimizing embedding impact in steganography. Electronic Imaging International Society for Optics and Photonics, 2007; Filler T, Judas J, Fridrich J. Minimizing embedding impact in steganography using trellis-coded quantization. IS&T/SPIE Electronic Imaging. International Society for Optics and Photonics, 2010; Filler T, Judas J, Fridrich J. Minimizing additive distortion in steganography using syndrome-trellis codes. IEEE Transactions on Information Forensics and Security 2011; 6(3): Ker AD. The square root law in stegosystems with imperfect information. In Information hiding. Springer: Berlin Heidelberg, 2010; Ker AD, Bas P, Böhme R, et al. Moving steganography and steganalysis from the laboratory into the real world. Proceedings of the first ACM workshop on Information hiding and multimedia security, ACM, 2013; Snapchat. [April 15, 2014]. 15. Slepian D, Wolf J. Noiseless coding of correlated information sources. IEEE Transactions on Information Theory 1973; 19(4): Viterbi A. Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. IEEE Transactions on Information Theory 1967; 13(2): Cover T. Broadcast channels. IEEE Transactions on Information Theory 1972; 18(1):2 14. Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd. 801

12 SCN-SI-066 W. Liu, G. Liu and Y. Dai 18. Holub V, Fridrich JJ. Designing steganographic distortion using directional filters. WIFS, 2012; Holub V, Fridrich J. Digital image steganography using universal distortion. Proceedings of the first ACM workshop on Information hiding and multimedia security, ACM, 2013; Huang F, Luo W, Huang J, et al. Distortion function designing for JPEG steganography with uncompressed side-image. Proceedings of the first ACM workshop on Information hiding and multimedia security, ACM, 2013; Holub V, Fridrich J, Denemark T. Universal distortion function for steganography in an arbitrary domain. EURASIP Journal on Information Security 2014; 2014(1): Tu Z, Li J, Blum RS. An efficient SF-ISF approach for the Slepian Wolf source coding problem. Eurasip Journal on Applied Signal Processing 2005; 2005: Aaron A, Girod B. Compression with side information using turbo codes. Proceedings of Data Compression Conference, DCC 2002, IEEE, 2002; Bajcsy J, Mitran P. Coding for the Slepian Wolf problem with turbo codes. Global Telecommunications Conference, GLOBECOM 01, IEEE, Vol. 2, 2001; Garcia-Frias J. Compression of correlated binary sources using turbo codes. IEEE Communications Letters 2001; 5(10): Security Comm. Networks 2016; 9: John Wiley & Sons, Ltd.