Commutative reversible data hiding and encryption

Transcription

1 SECURITY AND COMMUNICATION NETWORKS Security Comm. Networks 3; 6: Published online March 3 in Wiley Online Library (wileyonlinelibrary.com)..74 RESEARCH ARTICLE Xinpeng Zhang* School of Communication and Information Engineering, Shanghai University, 49 Yanchang Road, Shanghai 7, China ABSTRACT This work proposes a novel scheme of commutative reversible data hiding and encryption. In encryption part, the gray values of two neighboring pixels are masked by same pseudo-random bits. In data-hiding part, the additional data are embedded into various bit planes with a reversible manner, and a parameter optimization method based on a capacity distortion criterion is used to ensure a good performance. Because the data space used for accommodating the additional data is not affected by the encryption operation, the data embedded in plain/encrypted domain can be extracted from encrypted/plain domain, and the way of insertion/extraction of additional data in plain domain is same as that in encrypted domain. Furthermore, the original image can be recovered without any error from an image containing additional data. Copyright 3 John Wiley & Sons, Ltd. KEYWORDS reversible data hiding; image encryption; image recovery *Correspondence Xinpeng Zhang, School of Communication and Information Engineering, Shanghai University, 49 Yanchang Road, Shanghai 7, China. xzhang@shu.edu.cn. INTRODUCTION As well known, encryption technique aims to convert plaintexts into unintelligible data, whereas the purpose of data-hiding technique is to embed additional data into cover signal for copyright protection or covert communication. In recent years, the joint data hiding and encryption has attracted considerable research interests. A number of particular data-hiding methods with the aid of encryption mechanism have been developed. In a buyer seller watermarking protocol [], the seller of digital multimedia product encrypts the original data by using a public key and then permutes and embeds an encrypted fingerprint provided by the buyer in the encrypted domain on the basis of the homomorphic properties of cryptosystem. After decryption with a private key, the buyer can obtain a watermarked product. This protocol ensures that the seller cannot know the buyer s watermarked version, whereas the buyer cannot know the original version. An anonymous fingerprinting scheme presented in [] improves the enciphering rate by exploiting Okamoto Uchiyama encryption method. By introducing the composite signal representation mechanism, both the computation complexity and the communication bandwidth due to the homomorphic public key encryption are significantly reduced [3]. In [4], the content owner encrypts the signs of host discrete cosine transform (DCT) coefficients, and each content user uses a different key to decrypt only a subset of the coefficients, so that a series of versions containing different fingerprints are generated for the users. In another type of joint data-hiding and encryption schemes, a part of cover data is used to carry the additional data, and the rest of the data are encrypted, so that both the copyright and the privacy can be protected. For example [5], the intraprediction mode, motion vector difference, and signs of DCT coefficients are encrypted, whereas a watermark is embedded into the amplitudes of DCT coefficients. In [6], the image data in higher and lower bit planes of transform domain are, respectively, encrypted and watermarked. In [7], after wavelet transform, the coefficients in the lowest level and the signs of coefficients in other levels are encrypted, whereas the amplitudes of coefficients in middle level are used to carry the watermark data. With these schemes, the data-hiding and encryption operations are commutative because watermarking an encrypted signal is equivalent to encrypting a watermarked signal. In most cases, data-hiding operations introduce slight distortion to the original covers. For some special media such as medical or military images, the distortion due to data hiding, no matter how small it is, cannot be tolerated. On the other hand, in some application scenarios, when a content owner encrypts a secret image to conceal its content, for conveniently managing the plain/encrypted image, an ability to embed and extract additional message, such as the origin information, image annotation, or authentication data, in both the plain and encrypted domains is required. 396 Copyright 3 John Wiley & Sons, Ltd.

2 X. Zhang For example, when some additional message is embedded into a secret image and the image containing additional message is encrypted, a receiver without the knowledge of cryptographic key may hope to obtain the embedded message from the encrypted image when keeping its content unrevealed, and another receiver with the knowledge of cryptographic key may hope to perfectly recover the original secret image. In short, a commutative reversible data-hiding and encryption scheme is desired. Most works on reversible data hiding focus on the data insertion and extraction in plain spatial domain, in which the additional data are embedded with a reversible manner so that the original contents can be restored without any error after the extraction of hidden data. The reversible data-hiding techniques can be roughly classified into three types: lossless compression-based methods, difference expansion methods, and histogram shift methods. The lossless compression-based methods make use of statistical redundancy of the host media by performing lossless compression to create a spare space for data embedding [8]. In the difference expansion method [9], differences between two adjacent pixels are doubled so that a new bit plane is generated to accommodate the additional data. A typical histogram shift method presented in [] utilizes the zero and peak points of the histogram of an image and slightly modifies the pixel grayscale values to embed data into the image. Furthermore, various mechanisms have been introduced into the reversible data-hiding schemes for performance improvement, including generalized integer transform [], smarter value prediction [], simplification of location map [3], and binary codes [4]. A reversible data-hiding scheme for encrypted image is proposed in [5]. With this scheme, while a content owner encrypts the original image using an encryption key, a data hider can embed additional data into the encrypted image by using a data-hiding key, although he does not know the original content. When having an encrypted image containing additional data, a receiver may first decrypt it according to the encryption key and then extract the embedded data and recover the original image according to the data-hiding key. Whereas the data insertion can be implemented in encrypted domain, the data extraction must be implemented on a decrypted image. That means the reversible data-hiding and encryption operations in [5] are not commutative. This paper proposes a novel scheme of commutative reversible data hiding and encryption on digital images. In encryption part, the gray values of two neighboring pixels are masked by same pseudo-random bits. In datahiding part, the additional data are embedded into various bit planes with a reversible manner, and a parameter optimization method is used to ensure a good payload distortion performance. Because the data space used for accommodating the additional data is not affected by the encryption operation, the data insertion/extraction can be performed in both the plain and encrypted domains, and the ways of data insertion/extraction in the two domains are same. That implies the data embedded in the plain/encrypted domain can be extracted from the encrypted/plain domain. Furthermore, the original plain/ encrypted image can be recovered without any error from a plain/encrypted image containing additional data.. PROPOSED SCHEME Denote the original plain image, the additional data to be embedded, the encryption operation, the data-embedding operation, the encrypted image, and the image containing the additional data as I, M, E, W, I E and I W. That means and EðÞ¼I I E () WðI; MÞ ¼ I W () We also denote the decryption operation as D and the operation integrating data extraction and image recovery as R. As the decryption is an inverse operation of encryption, DðI E Þ ¼ I (3) When the additional data are embedded with a reversible manner, the original image and the additional data can be perfectly recovered and extracted from I W, RðI W Þ ¼ ði; MÞ (4) This paper proposes a commutative reversible data-hiding and encryption scheme that also meets the following properties. () The embedding encryption and encryption embedding operations produce a same result, EW ½ ði; MÞŠ ¼ WEI ½ ðþ; MŠ ¼ I WE (5) () Decrypting an encrypted image containing additional data results in a plain image containing additional data, DðI WE Þ ¼ I W (6) (3) From an encrypted image containing additional data, the additional data can be extracted, and an encrypted image without additional data can be obtained, RðI WE Þ ¼ ði E ; MÞ (7) In other words, the data-hiding and encryption operations do not affect mutually, meaning that the data embedding, data extraction, and image recovery can be implemented in both the plain and the encrypted domains. The detailed Security Comm. Networks 3; 6: John Wiley & Sons, Ltd. 397

3 X. Zhang procedures of encryption/decryption, data embedding, data extraction, and image recovery are presented as follows... Image encryption and decryption Assume the original image I is in uncompressed format and the gray values of pixels fall into [, 55]. Before encryption, the image is segmented into a series of nonoverlapping blocks, each of which including two neighboring pixels. The way of segmentation is public, such as scanning all pixels in a row-by-row or column-by-column manner and dividing them into two-pixel blocks. Denoting the number of blocks as N and the pixels in the N blocks as {p,, p, }, {p,, p, },...,{p N,, p N, }, decompose each pixel into 8bits, t b ðþ n;i ¼ p n;i = t mod ; t ¼ ; ;...; 7; n ¼ ; ;...; N; i ¼ ; ð8þ where t is the index of bit planes. Equation (8) implies that p n;i ¼ X7 t¼ b ðþ t n;i t ð9þ According to an encryption key, generate a bit sequence with alengthof8n by using a pseudo-random number generator and divide the pseudo-random bit sequence into N pieces, each of which containing 8 bits. It is well known that there is no probability polynomial time algorithm to distinguish pseudo-random number sequence and random number sequence until now. We denote the nth piece as {r () n, r () n,..., r (7) n } and calculate the exclusive-or between the bits of two pixels in the nth block and the pseudo-random bits, B ðþ t n;i ¼ b ðþ t ðþ t n;i r n ðþ Note that the two pixels in a block are encrypted by the same pseudo-random bits. Then, B n,i are concatenated orderly as the encrypted data I E. Although the correlation between two bits in a same plane and a same block still exists, it is unpractical for an attacker without the encryption key to reveal the content of plain image. Figure gives an original image Lena and its encrypted version. Here, the 8 encrypted bits of each pixel are converted into a gray value for showing the disorder of I E. Clearly, the procedure of decryption is same as that of encryption. With the same key and exclusive-or calculation, the original image I can be retrieved from the encrypted data I E... Data embedding With an original image I or an encrypted image I E, a data space unaffected by encryption will be exploited to carry the additional data. In the data-embedding procedure, a capacity distortion criterion is also employed to calculate the optimal values of parameters, and according to the optimal parameters, the additional data are embedded into various bit planes of the invariant data with a reversible manner. The detailed data-embedding procedure is as follows. The data hider first segments the original or encrypted image into N blocks with two neighboring pixels and calculates the exclusive-or of two bits in a same plane and a same block. For an original image, the exclusive-or is calculated as x ðþ t n ¼ b ðþ t ðþ t n; b n; ðþ For an encrypted image, the exclusive-or is calculated as Because B ðþ t n; B ðþ t n; ¼ x ðþ t n ¼ B ðþ t ðþ t n; B n; b ðþ t ðþ t n; r n ¼ b ðþ t ðþ t n; b n; t b n; ðþ ðþ t r n ðþ ð3þ the original image and its encrypted version have same x n. Actually, x n will be used to carry the additional data to be embedded. (a) (b) Figure. (a) Original image Lena and (b) its encrypted version. 398 Security Comm. Networks 3; 6: John Wiley & Sons, Ltd.

4 X. Zhang The data hider collects x n in various planes to form 8 binary sequences, and pseudo-randomly permutes the elements in each sequence according to a data-hiding key. The purpose of pseudo-randomly permutation is to ensure that an attacker without knowledge of the datahiding key cannot extract the embedded data and to remove the correlation between x n. Denote the permuted sequences of the tth plane as x and the rate of zero in x as r. Generally, because of the spatial correlation in natural image, r are more than /, and a larger t corresponds to a larger r. Table I gives the values of r of the original/encrypted image Lena. The upper bound of performance on reversible data hiding in a binary sequence has been discussed in [6]. Considering the binary sequence x as cover data, if the rate of bit alteration caused by reversible data hiding, that is, the rate of flipping cover bit from to and from to, is Δ, the capacity of reversible data hiding is given in [6], h i ðþ ¼ N H max r ðþ t Δ ðþ t ; = H r ðþ t C t where H() is a binary entropy function ð4þ HðrÞ ¼ r log r ð rþlog ð rþ ð5þ Clearly, when Δ r /, h i ðþ ¼ N H r ðþ t Δ ðþ t H r ðþ t C t ð6þ and, when Δ > r /, the capacity does not increase with an increasing Δ. It is also concluded in [6] that, if Δ [, r /], for achieving the embedding capacity, all the alteration on cover data should be from to. When the data hider performs the reversible data hiding in the 8 sequences, the total capacity is C ¼ X7 t¼ C ðþ t ð7þ Because a bit alteration in the tth sequence x implies a flip in the tth bit plane of cover image and the bit alterations caused by data hiding in different sequences are independent mutually, the total energy of distortion is Δ ¼ N X7 t¼ Δ ðþ t t So, the value of peak signal-to-noise ratio (PSNR) is Table I. Values of r of original/encrypted Lena. ð8þ r () r () r () r (3) r (4) r (5) r (6) r (7) PSNR ¼ log N55 Δ ð9þ The data hider always hopes to maximize the payload with a certain distortion level or to minimize the distortion with a certain payload. Define a Lagrange function, L ¼ C lδ When meeting the optimal case, there ¼ ðþ t If Δ [, r /], Equation (8) implies that In other words, r ðþ Δ ðþ log r ðþ þ Δ ðþ r ðþ t Δ ðþ t ¼ l ðþ ðþ t ð Þ¼ 4 log ¼ 4 log r ðþ Δ ðþ r ðþ þ Δ ð Þ Δ ðþ 7 r 7 ðþ¼ r ð7þ þ Δ ðþ 7 ð3þ So, we may employ the following steps to find the optimal values of Δ. () With the given r,define the functions f f ðþ t Δ ðþ t ¼ t log r ðþ t Δ ðþ t r ðþ t þ Δ ðþ t ð4þ for Δ [, r /]. Clearly, f are monotonic decreasing functions of Δ. () For a given positive value l, if l > f (), the sequence x is not used to carry the additional data. Otherwise, find Δ to satisfy f ðþ t Δ ðþ t ¼ l ð5þ Then, the found Δ is the optimal values that should be used for the reversible data embedding. (3) Calculate the capacity and PSNR by using Equations (7) and (9). Here, if x is not used, C = and Δ =. Then, the calculated capacity PSNR is an upper bound of performance on reversible data hiding. In the previously described steps, the smaller the value of l, the higher the capacity and the lower the PSNR. The data hider may select a suitable l to obtain a desired capacity or distortion. Figure gives the curves of f (Δ ) with the original/encrypted Lena. Because both Security Comm. Networks 3; 6: John Wiley & Sons, Ltd. 399

5 X. Zhang f.5 x -3.5 t= t=3 t=4 f x t=5 t=6 t= Figure. Curves of f (Δ ) with different t for original/encrypted Lena. r () and r () are approximately /, the curves of f () (Δ () ) and f () (Δ () ) are very close to the point (,) and therefore ignored in Figure. Table II lists the optimal values of Δ, PSNR, and capacity with respect to different l. Define h t ¼ ; if ΔðÞ t ¼ ; if Δ ðþ t t ¼ ; ;...; 7 ð6þ > and denote the number of h t being as g and a vector made up of h t as tag vector h. For most images, r () /, leading to Δ () =. The data hider takes g subsequences from the beginning of x (). For each subsequence, let it correspond to a positive Δ and name the subsequence c. The length of the subsequences will be given later. Then, the data hider performs the reversible data embedding in binary sequences x with Δ >. Divide x into a number of subsequences with a same size, and denote the number of subsequences as M, their length as L and the subsequences as x, x,..., x M (M L = N). That means x = x x x M. Note that, for successful data-embedding in x, c will be also exploited and the length of c is also L. For each subsequence x m (m =,,..., M), collect the elements with zero values in it and denote the number of the collected elements as L m, L ðþ t m Lr ðþ t ð7þ Suppose the probabilities of and in the data to be embedded are /. By employing arithmetic coding technique, the data hider may take a number of bits to be embedded and convert them into a binary sequence with a length L m, where the probabilities of and in the binary sequence are (r Δ )/r and Δ /r, respectively. This way, the number of taken bits is approximately b E Lr ðþ t H Δ ðþ t =r ðþ t ð8þ Then, replace the L m zero elements in subsequence x m with the elements in the binary sequence to obtain a new x m. In the new x m, the elements with zero values must be also zero in old x m, whereas the elements with one values include two types: the elements whose old values are also one and the elements that are zero in old x m and changed to one by the replacement. Denoting the number of elements in the two parts as a and a, a L r ðþ t ð9þ a LΔ ðþ t ð3þ Then, label the elements in the first and the second types as and, respectively. Using arithmetic coding technique, the labels can be compressed as a binary sequence with a uniform distribution of {, }, and the length of the compressed data is approximately b A L r ðþ t þ Δ ðþ t Δ ðþ t H ð3þ r ðþ t þ Δ ðþ t Actually, the compressed data will be used to recover the original subsequence x m at receiver side, and we name them as auxiliary information (AI). From Equations (8) and (3), Table II. Optimal values of Δ, peak signal-to-noise ratio (PSNR), and capacity with respect to l. l Δ () Δ () Δ () Δ (3) Δ (4) Δ (5) Δ (6) Δ (7) PSNR (db) C (bits) Security Comm. Networks 3; 6: John Wiley & Sons, Ltd.

6 X. Zhang h i b E b A L H r ðþ t Δ ðþ t H r ðþ t Because r > r Δ /, b E b A > ð3þ ð33þ That means the amount of data carried by a subsequence is larger than that of data used for recovering it. Figure 3 sketches the relationship between the subsequences and the payload hidden in them. The payload on the tth plane, P, is made up of the original data of c and the additional data. The auxiliary information generated from x m is denoted as AI m. Whereas the data embedded into the first subsequence are purely the payload, the data embedded into subsequences x, x 3,..., x M consist of the auxiliary information generated from the previous subsequences and the payload. Furthermore, c is used to accommodate the values of r and Δ,AI M, and a part of payload by simple bit replacement. Note that there are g subsequences c at the beginning of x (). For the first c, the data accommodated in it also include the tag vector h. For few images with strong spatial correlation, r () is significantly more than /. Then, the optimization steps may result in a positive Δ (), meaning that x () should be also used for data hiding. In this case, the reversible data embedding is also implemented in x () except c with a similar way. At last, the data hider makes an inverse permutation on x and, for each x n having been changed, flips b n, or B n, from to or from to. After converting the 8 bits of each pixel into a gray value, a new image containing the additional data is finally produced. This way, the data hider can embed the additional data into a plain image I to produce I W or into an encrypted image I E to produce I WE. Because the sequences x are not affected by encryption, the embedding encryption and encryption embedding operations produce a same result, that is, W(I E, M)=E(I W )=I WE..3. Data extraction and image recovery When having a plain image containing additional data I W or an encrypted image containing additional data I WE, the receiver first segments the image into blocks and calculates the exclusive-or of two bits in a same plane and a same block to generate x n. According to the data-hiding key, pseudo-randomly permute x n in each plane to yield the sequences x. From the first c at the beginning of x (), the receiver can retrieve the tag vector h and know the g sequences x and g corresponding subsequences c that are used for carrying the additional data. Then, the receiver may recover the original x and c and extract the additional data hidden in them. After obtaining the values of r and Δ,AI M, and a part of payload from c, the receiver decompresses AI M to retrieve the labels that are used to distinguish the two types of elements being one in x M. Then, flip the second type of elements from to to recover the original x M. With the original x M, the receiver can retrieve the payload hidden in x M by arithmetic decoding. Then, the auxiliary information extracted from a subsequence is always used to recover the original elements of the previous subsequence, and the embedded data in the previous subsequence are always extracted by using the recovered original elements. So, the original subsequences x are recovered, and the data hidden in them are extracted with an inverse order. Collect the extracted data and divide them into two parts: the original data of c and the pure payload. This way, all the sequences x are recovered, and the pure payload in the sequences are extracted. At last, by retrieving the original b n,i or B n,i on the basis of the recovered x, the original plain image I or the original encrypted image I E is reconstructed, and by concatenating the extracted pure payload, the entire additional data are restored. Note that the data extraction and image recovery may be not successful when the plain/encrypted image containing additional data has been compressed or processed. 3. EXPERIMENTAL RESULTS The test image Lena sized 5 5 shown in Figure (a) was used as the original image in the experiment. Its encrypted version is also given in Figure (b). We let l =. and embedded the additional data into the original Lena and its encrypted version to produce a plain image containing additional data and an encrypted image containing additional data, which are shown in Figure 4. Original data of c Additional data (pure payload) Payload P P AI P AI M P M, AI M P M+ Subsequence x Subsequence x Subsequence x M c Figure 3. Components of the hidden data and the relationship between the subsequences and the hidden data. Security Comm. Networks 3; 6: John Wiley & Sons, Ltd. 4

7 X. Zhang (a) (b) Figure 4. (a) A plain Lena containing additional data and (b) an encrypted image containing additional data. The additional data embedded into the original Lena and its encrypted version were same, and their amount was bits. Also, both the values of PSNR in Figure 4 (a) when regarding Figure (a) as a reference and in Figure 4(b) when regarding Figure (b) as a reference are 4. db. The amount and PSNR are close to the upper performance bound, bits and 4.3 db, which are listed in Table II. When we encrypted Figure 4(a) with an encryption key that was used to encrypt Figure (a) to produce Figure (b), Figure 4(b) was also produced. That means the data-embedding and the encryption operations are commutative. When we implemented the data extraction and image recovery procedure on Figure 4(a) or (b), the entire additional data were retrieved, and Figure (a) or (b) was recovered without any error. That means the additional data embedded in plain/encrypted domain can be extracted from encrypted/plain domain and completely separated from the cover image. Figures 5 8 show the amount of embedded additional data and PSNR caused by data embedding on the four 5 5 gray images Lena, Man, Baboon, and Couple. By employing different values of l, the various amounts of additional data were embedded into the individual image, and a number of versions with various qualities were produced. Whereas the ordinate represents the amount of embedded data, the abscissa is the values of PSNR. The more the embedded additional data, a lower the PSNR. Also, a smoother plain image implies larger values of r, leading to a better payload distortion Amount of additional data (bits) 5 x Upper bound Actual performance PSNR (db) Figure 6. Actual performance and upper bound on Man. Amount of additional data (bits) 5 x Upper bound Actual performance PSNR (db) Figure 5. Actual performance and upper bound on Lena. Amount of additional data (bits) Upper bound Actual performance PSNR (db) Figure 7. Actual performance and upper bound on Baboon. 4 Security Comm. Networks 3; 6: John Wiley & Sons, Ltd.

8 X. Zhang Amount of additional data (bits) x PSNR (db) performance. The upper bounds of performance are also given in these figures. It can be seen that the actual performance is very close to the upper bound. 4. CONCLUSION In this work, a novel commutative reversible data-hiding and encryption scheme is proposed, which consists of image encryption, data embedding, and data-extraction/imagerecovery parts. In the encryption part, the gray values of two neighboring pixels belonging to a same block are masked by same pseudo-random bits. With an original image or an encrypted version, a data hider can generate a data space that is not affected by encryption and embed additional data into various bit planes of the invariant space with a reversible manner. Also, a capacity distortion criterion is employed to find the optimal values of parameters to ensure a good performance. Using this scheme, the data embedded in plain/encrypted domain can be extracted from encrypted/plain domain, and the way of insertion/extraction of additional data in plain domain is same as that in encrypted domain. Furthermore, the original image can be perfectly recovered from an image containing additional data. ACKNOWLEDGEMENTS This work was supported by the National Natural Science Foundation of China under Grants 6739 and 6787, by the Research Fund for the Doctoral Program of Higher Education of China under Grant 38, and by the Program for Professor of Special Appointment (Eastern Scholar) at Shanghai Institutions of Higher Learning. REFERENCES Upper bound Actual performance Figure 8. Actual performance and upper bound on Couple.. Memo N, Wong PW. A buyer seller watermarking protocol. IEEE Trans. on Image Processing ; (4): Kuribayashi M, Tanaka H. Fingerprinting protocol for images based on additive homomorphic property. IEEE Trans. on Image Processing 5; 4(): Deng M, Bianchi T, Piva A, Preneel B. An efficient buyer seller watermarking protocol based on composite signal representation, in Proceedings of the th ACM Workshop on Multimedia and Security, 9; Kundur D, Karthik K. Video fingerprinting and encryption principles for digital rights management. Proceedings of the IEEE 4; 9(6): Lian S, Liu Z, Ren Z, Wang H. Commutative encryption and watermarking in video compression. IEEE Trans. on Circuits and Systems for Video Technology 7; 7(6): Cancellaro M, Battisti F, Carli M, Boato G, Natale FGB, Neri A. A commutative digital image watermarking and encryption method in the tree structured Haar transform domain. Signal Processing: Image Communication ; 6():. 7. Lian S, Liu Z, Zhen R, Wang H. Commutative watermarking and encryption for media data. Optical Engineering 6; 45(8). 8. Celik MU, Sharma G, Tekalp AM, Saber E. Lossless generalized-lsb data embedding. IEEE Trans. on Image Processing 5; 4(): Tian J. Reversible data embedding using a difference expansion. IEEE Trans. on Circuits and Systems for Video Technology 3; 3(8): Ni Z, Shi Y-Q, Ansari N, Su W. Reversible data hiding. IEEE Trans. on Circuits and Systems for Video Technology 6; 6(3): Wang X, Li X, Yang B, Guo Z. Efficient generalized integer transform for reversible watermarking. IEEE Signal Processing Letters ; 7(6): Luo L, Chen Z, Chen M, Zeng X, Xiong Z. Reversible image watermarking using interpolation technique. IEEE Trans. on Information Forensics and Security ; 5(): Kim HJ, Sachnev V, Shi YQ, Nam J, Choo H-G. A novel difference expansion transform for reversible data embedding. IEEE Trans. on Information Forensics and Security 8; 3(3): Zhang W, Chen B, Yu N. Capacity-approaching codes for reversible data hiding. in Proceedings of the 3th Information Hiding Conference, Lecture Notes in Computer Science,, 6958, Zhang X. Reversible data hiding in encrypted image. IEEE Signal Processing Letters ; 8(4): Kalker T, Willems FM. Capacity bounds and constructions for reversible data-hiding. in Proceedings of 4th International Conference on Digital Signal Processing, ; Security Comm. Networks 3; 6: John Wiley & Sons, Ltd. 43