1 Introduction

Recent years, people have paid more attention on the privacy with the development of cloud and internet. Reversible data hiding in encrypted images (RDHEI) is proposed, this technology is useful for protecting the privacy. Now, RDHEI is widely used in many regions, such as military and medical images. For example, when you upload your photos to your cloud space, you can first encrypt the photos to ensure the image security and embed the information of the corresponding photo into the encrypted image for finding it later conveniently.

Data hiding is a useful technology in the field of information protection, so that the adversary can not detect the embedded information [1,2,3,4]. Now, digital image has become an important manner of communication, however, sometimes the images may disclose important information in military or medical fields. Based on these respects, people need to protect the security of images and effective manage images [5,6,7,8]. An improved dual-image RDH method using the selection strategy of shiftable pixels’ coordinates with minimum distortion was proposed in [9]. A color-image-dedicated reversible data hiding (RDH) algorithm [10] was proposed to improve embedding performance by applying a guided filtering predictor and an adaptive prediction-error expansion (PEE) scheme. Based on prediction-error expansion (PEE), a new reversible data hiding (RDH) technique for multiple histograms was proposed in [11]. However, the proposed scheme in [12] improved PEE by exploiting the correlations among prediction-errors. In [13], the authors revisited histogram shifting (HS) technique and proposed a framework of HS-based RDH. In [14], a novel prediction-based reversible data hiding scheme was proposed, which was based on image inpainting. By exploiting modification direction (EMD), a new scheme for reversible data hiding was proposed in [15]. Nevertheless, sometimes people do not want others to know the original image content, hence, reversible data hiding or compression in encrypted images was proposed. A novel lossy compression for encrypted images was proposed in [16]. The original image was encrypted by a modulo-256 addition and block permutation, and then the spatial correlation and quantization were used in compression phase. In [17], the content owner encrypted the image by a stream cipher, and the secret data were embedded by flipping the three LSB layers. The receiver can directly decrypt the marked image, extract the secret data and recover the original image. The method in [18] improved the scheme in [17] by the side-match technique, and the authors defined a new fluctuation function for each block. To further improve the performances of [17, 18], Liao et al. proposed a new, more precise function to calculate the complexity of the image blocks by considering the absolute mean difference of multiple neighboring pixels [19]. A resolution progressive compression scheme was proposed in [20], which was used in encrypted image. A new scheme for separable reversible data hiding in encrypted images was proposed in [21], the data hider embedded the secret data into spare room where compressed by matrix operation. In [21], if the receiver only had the encryption key, he can decrypt the marked image directly. If the receiver only had the data hiding key, he can extract the embedded data directly. If the receiver had both the encryption key and data hiding key, he can extract the embedded data and recover the original image perfectly. Base on [21], the method in [22] changed data embedding phase, the data hider divided the encrypted image into three sets, and pseudo-randomly permuted the encrypted pixels in each set. Then, the data hider divided the pixels in each set into segments and used the matrix operation to embed additional data. When the marked image was received, the receiver divided the image recovery procedure into three rounds to recover the image. The discrete Fourier transform (DFT) in the encrypted domain which based on the homomorphic properties of the underlying cryptosystem was proposed in [23]. In [24], the method of data hiding in encrypted image used MSB prediction to achieve high capacity, however, this method needed the pre-processing. The scheme in [25] used LDPC code to compress a part of encrypted image, and the rest were kept unchanged as the side information for image recovery. Based on the distributed source coding, a novel scheme of reversible data hiding in encrypted images was proposed in [26]. In data embedding phase, LDPC code was also used to embed the additional data into the encrypted image. In [27], the original image was encrypted by specific encryption, and then one secret bit was embedded into each block of the encrypted image. The receiver can decrypt the marked image by the encryption key. Based on decrypted image, the secret data can be extracted and the original image can further be recovered by the data hiding key and the smoothness function.

In this paper, we propose a new scheme of separable reversible data hiding in encrypted images and make full use of the relationship of adjacent pixels. The content owner divides the original image into non-overlapping blocks and encrypts them by stream cipher and permutation. The data hider classifies the blocks into smooth region and complex region and embeds the secret data into the encrypted image by two steps: (1) replace the MSB layer of a part of encrypted pixels in smooth region with the secret data, (2) compress the LSB layers of a part of the rest encrypted pixels. If the receiver only has the encryption key, he can decrypt the marked image directly to obtain an approximate image which has a good image quality. If the receiver only has the data hiding key, he can extract the secret data from the marked image. If the receiver has both the encryption key and data hiding key, he can extract the embedded data successfully and recover the image without any error according to the spatial correlation in natural image.

The rest of this paper is organized as follows. Section 2 describes the proposed RDHEI scheme detailedly. Experimental results and comparisons are given in Sect. 3. Section 4 concludes the paper.

2 Proposed scheme

In the proposed scheme, there are four phases: (1) image encryption; (2) data embedding; (3) data extraction; (4) image recovery. Figure 1 shows the framework of the proposed scheme. The content owner divides the original image into a number of non-overlapping blocks with a size of 2 × 2 and encrypts the blocks by stream cipher and permutation. Then, the data hider classifies the blocks into smooth region and complex region according to a pre-determined threshold T and embeds the data into the encrypted image using two methods; one is that the data hider compresses the least significant bits (LSB) of a part of pixels in the encrypted image using a data hiding key to create a sparse room for the additional data, the other is that the most significant bit (MSB) of a part of pixels in smooth region are replaced by the additional data. The marked image is generated after the image encryption and data embedding phases. When the receiver received the marked image, he can decrypt the marked image only with encryption key to obtain an approximate image which has a good image quality. He can also extract the additional data in the marked image only according to the data hiding key. If the receiver has both the encryption key and data hiding key, he can extract the embedded data successfully and recover the image without any error according to the spatial correlation in natural image. The detail of the proposed method is described as follows.

Fig. 1
figure 1

Framework of the proposed scheme

Full size image

2.1 Image encryption

Assume the original image I with a size of M × N is an uncompressed grayscale image and each pixel can be represented by 8 bits. The content owner divides the original image I into a number of non-overlapping 2 × 2-sized blocks, and M × N/4 blocks are generated. The blocks are denoted by Bi,j (1 ≤ i ≤ M/2 and 1 ≤ j ≤ N/2), and the four pixels in Bi,j are Bi,j(0,0), Bi,j(0,1), Bi,j(1,0) and Bi,j(1,1). As shown in Fig. 2, the pixels Bi,j(0,0) and Bi,j(1,1) are represented by “○”, Bi,j(0,1) and Bi,j(1,0) by “□”, respectively.

Fig. 2
figure 2

Four pixels in block Bi,j

Full size image

The content owner decomposes the four pixel values in each block into 8 bits by:

$$b_{{i,j}}^{{(x,y,u)}}=\left\lfloor {\frac{{B_{{i,j}}^{{(x,y)}}}}{{{2^u}}}} \right\rfloor \;\bmod \;2,\quad u=0,1, \ldots ,7,$$
(1)

where the (i, j) is the block index, and (x, y) ∈ {(0, 0), (0, 1), (1, 0), (1, 1)}. In each block, the content owner first encrypts 8 bits of the square pixels and p least significant bits of the circle pixels by pseudo-random bits according to the encryption key:

$$b_{{i,j}}^{{\prime (x,y,u)}}=b{\kern 1pt} _{{i,j}}^{{(x,y,u)}} \oplus f_{{i,j}}^{{(x,y,u)}},\quad (x,y,u) \in {\varvec{\Psi}_1} \cup {\varvec{\Psi}_2},$$
(2)
$${\varvec{\Psi}_1}=\{ (x,y,u)|(x,y) \in \{ (1,0),\,({\text{0,1)}}\} \;{\text{and }}u=0,{\text{1, 2, }} \ldots {\text{, 7}}\} ,$$
(3)
$${\varvec{\Psi}_2}=\{ (x,y,u)|(x,y) \in \{ (0,0),\,(1{\text{,1)}}\} \;{\text{and }}u=0,{\text{1, 2, }} \ldots {\text{, }}p - 1\} ,$$
(4)

where p denotes the number of LSB layers and will be used in data embedding phase. Here, p is a small positive integer and smaller than 4. Then, the content owner needs to encrypt the rest of (8 − p) most significant bits of the circle pixels in each block. Another different pseudo-random binary sequence Ai,j is generated by the content owner according to the encryption key, if the (8 − p) most significant bits of the circle pixels belong to Ψ3:

$$\left\{ {\begin{array}{*{20}{c}} {b_{{i,j}}^{{\prime (x,y,u)}}=\overline {{b_{{i,j}}^{{(x,y,u)}}}} ,\quad \text{if}\;{A_{i,j}}=1,} \\ {b_{{i,j}}^{{\prime (x,y,u)}}=b_{{i,j}}^{{(x,y,u)}},\quad \text{if}\;{A_{i,j}}=0,} \end{array}} \right.\quad (x,y,u) \in {\varvec{\Psi}_3},$$
(5)
$${\varvec{\Psi}_3}=\{ (x,y,u)|(x,y) \in \{ (0,0),\,({\text{1,1)}}\} \;{\text{and }}u=p,p+1{\text{, }}p+{\text{2, }} \ldots {\text{, 7}}\} .$$
(6)

Then, the encrypted pixels are calculated by:

$$B_{{i,j}}^{{(x,y)}}=\sum\limits_{{u=0}}^{7} {[{2^u} \times b_{{i,j}}^{{\prime (x,y,u)}}]} .$$
(7)

When the pixels in the image are all encrypted, the content owner permutes the blocks pseudo-randomly according to the encryption key. Thus, the final encrypted image Ie is generated.

2.2 Data embedding

During this stage, the data hider embeds the secret data into the encrypted image by two steps.

The first step: the encrypted image Ie is divided into a series of non-overlapping 2 × 2-sized blocks Ei,j (1 ≤ i ≤ M/2 and 1 ≤ j ≤ N/2), which is the same with method in encryption phase. In each block Ei,j, four pixels are denoted by \(E_{{i,j}}^{{\left( {0,0} \right)}}\), \(E_{{i,j}}^{{\left( {0,1} \right)}}\), \(E_{{i,j}}^{{\left( {1,0} \right)}}\), \(E_{{i,j}}^{{\left( {1,1} \right)}}\) from left to right, then from top to bottom. Then, the data hider calculates the absolute difference of the two circle pixels in each block, as illustrated in Fig. 2. For each block, the function is used to measure its smoothness:

$${d_{i,j}}=\left| {{2^p} \cdot \left\lfloor {{{E_{{i,j}}^{{(0,0)}}} \mathord{\left/ {\vphantom {{E_{{i,j}}^{{(0,0)}}} {{2^p}}}} \right. \kern-0pt} {{2^p}}}} \right\rfloor - {2^p} \cdot \left\lfloor {{{E_{{i,j}}^{{(1,1)}}} \mathord{\left/ {\vphantom {{E_{{i,j}}^{{(1,1)}}} {{2^p}}}} \right. \kern-0pt} {{2^p}}}} \right\rfloor } \right|,$$
(8)

where di,j represents the value of smoothness of corresponding block Ei,j. Higher di,j denotes the corresponding block is more complex. For classifying the smooth and complex regions, a threshold T is obtained. According to the threshold T, the data hider divides the blocks into smooth region and complex region:

$$\left\{ {\begin{array}{*{20}{c}} {{\mathbf{E}_{i,j}} \in {\mathbf{R}_1},\quad {\kern 1pt} \text{if}\; {d_{i, j}} \leq T,} \\ {{\mathbf{E}_{i,j}} \in {\mathbf{R}_2},\quad \text{if} \;{d_{i, j}}>T,} \end{array}} \right.$$
(9)

where R1 and R2 represent smooth region and complex region, respectively. In each encrypted block of smooth region R1, the data hider collect the square pixels \(E_{{i,j}}^{{\left( {0,1} \right)}}\) and \(E_{{i,j}}^{{\left( {1,0} \right)}}\) to generate a group Ge. Then, the most significant bit (MSB) of each pixel in Ge is replaced by secret data be:

$$E'{\kern 1pt} _{{i,j}}^{{(x,y)}}=\left( {E_{{i,j}}^{{(x,y)}}\,\bmod 128} \right)+{b_e} \times 128,\quad (x,y) \in {\varvec{\Psi}_4},$$
(10)
$${\varvec{\Psi}_4}=\{ (x,y)|(x,y) \in \{ (0,1),\,({\text{1,0)}}\} \} .$$
(11)

When the pixels in group Ge are all embedded, the data hider puts them into their original position. We embed the secret data into the smooth region due to the full exploitation of spatial correlation in natural image. Thus, the first step is completed. Since the blocks belonging to smooth region are used to hide the additional data by MSB replacement in this step, thus, if the threshold T is higher, more blocks would belong to smooth region and more additional bits can be embedded into the encrypted image.

The second step: the data hider collects the p least significant bits of two circle pixels (\(E_{{i,j}}^{{\left( {0,0} \right)}}\), \(E_{{i,j}}^{{\left( {1,1} \right)}}\)) in each block Ei,j and divides them into a number of groups, each of which has q pixels. The number of pixels which are used for embedding in second step is M × N/2. In each group, denote them as v(k, 1), v(k, 2), …, v(k, p·q). Here, k denotes the group index. A matrix M sized (p·q − s) × p·q is obtained by the data hider according to the data hiding key, which consist of two parts:

$$\mathbf{M}=[{\mathbf{I}_{p \cdot q - s}},\,\mathbf{Q}],$$
(12)

where the matrix I is an (p·q − s) × (p·q − s) identity matrix, and the matrix Q sized (p·q − s) × s is a pseudo-random binary matrix. In each group, the data hider compresses the bits by Eq. (13):

$$\left[ {\begin{array}{*{20}{c}} {{v^\prime }{\text{(}}k,\;1{\text{)}}} \\ {{v^\prime }{\text{(}}k,\;2{\text{)}}} \\ \vdots \\ {{v^\prime }{\text{(}}k,\;pq - s{\text{)}}} \end{array}} \right]=\mathbf{M} \cdot \left[ {\begin{array}{*{20}{c}} {v{\text{(}}k,\;1{\text{)}}} \\ {v{\text{(}}k,\;2{\text{)}}} \\ \vdots \\ {v{\text{(}}k,\;pq{\text{)}}} \end{array}} \right].$$
(13)

The arithmetic in Eq. (13) is modulo-2. After calculated by function (13), [v(k, 1), v(k, 2), …, v(k, p·q)] becomes [v′(k, 1), v′(k, 2), …, v′(k, p·q − s)], that is, p·q bits are compressed into (p·q − s) bits. Thus, the data hider embeds the data into [v′(k, p·q − s + 1), v′(k, p·q − s + 2), …, v′(k, p·q)] in each group. Combine [v′(k, 1), v′(k, 2), …, v′(k, p·q − s)] and [v′(k, p·q − s + 1), v′(k, p·q − s + 2), …, v′(k, p·q)] to generate a new [v′(k, 1), v′(k, 2), …, v′(k, p·q)]. Substitute the [v(k, 1), v(k, 2), …, v(k, p·q)] with [v′(k, 1), v′(k, 2), …, v′(k, p·q)] and put them into their original position. After the two steps, an encrypted image with embedded data Im is generated. However, the order of the two steps can be changed and known by the receiver.

2.3 Data extraction and image recovery

During this phase, three cases may happened: (1) receiver only has the encryption key, (2) receiver only has the data hiding key, (3) receiver has both encryption key and data hiding key. In our proposed scheme, the threshold T is a fixed number and known by the content owner, data hider and receiver.

If the receiver only has the encryption key, he/she can decrypt the marked image to obtain an image with high image quality which is similar to original image. First, the receiver divides the marked image Im into M × N/4 non-overlapping blocks sized 2 × 2 and classifies them into smooth region R1 and complex region R2 by the threshold T. Then, the pixels in each block are decomposed into 8 bits. Decrypting the four pixels in each block using exclusive OR operation according to the corresponding encryption key, as described in Sect. 2.1. After that, all the M × N/4 blocks are inversely permuted back to their original locations in the image by the encryption key. Thus, a basic image I’m is obtained. To improve the directly decrypted image’s quality, the receiver needs to further recover the MSB of square pixels of each block in smooth region R1. Because (8 − p) MSB layers of the circle pixels in \({\mathbf{I}}_{m}^{\prime }\) are all unchanged, the receiver can generate a function to obtain estimated gray value:

$${\hat {p}_{m,n}}=\frac{{\left\lfloor {{p_{m - 1,n}}/{2^p}} \right\rfloor +\left\lfloor {{p_{m+1,n}}/{2^p}} \right\rfloor +\left\lfloor {{p_{m,n - 1}}/{2^p}} \right\rfloor +\left\lfloor {{p_{m,n+1}}/{2^p}} \right\rfloor }}{4} \cdot {2^p}+{2^{p - 1}},$$
(14)

where the estimated gray value is generated from the neighbors in the basic image \({\mathbf{I}}_{m}^{\prime }\), and (m, n) denotes the position of the pixels (1 ≤ m ≤ M and 1 ≤ n ≤ N). For the square pixels in smooth region R1, the receiver calculates:

$$p_{{m,n}}^{\prime }=\left\{ {\begin{array}{*{20}{l}} {128+\bmod ({p_{m,n}},128),}&\quad{\text{if}\;\left| {128+\bmod ({p_{m,n}},128) - \hat {p}{}_{{m,n}}} \right|<\left| {\bmod ({p_{m,n}},128) - \hat {p}{}_{{m,n}}} \right|,} \\ {\bmod ({p_{m,n}},128),}&\quad {\text{otherwise}.} \end{array}} \right.$$
(15)

According to the function (15), the receiver further recovers the MSB of the square pixels in smooth region. Because the data hider embeds a part of data into MSB layer in the smooth region, the result of further recovery is good. Thus, final decrypted image Id is generated.

If the receiver only has the data hiding key, he can extract the embedded data from the marked image directly. First, the receiver divides the marked image into M × N/4 non-overlapping blocks sized 2 × 2 and classifies them into smooth region R1 and complex region R2 by the threshold T. After that the embedded data in MSB of the square pixels of the smooth region R1 can be extracted by the data hiding key. Then, the receiver collects p bits of circle pixels in each block and divides them into k groups. In each group, s embedded bits can be extracted according to the data hiding key. Thus, the receiver extracts all the embedded data without known the original image.

If the receiver has both the encryption key and data hiding key, he can extract the embedded data and recover the original image. In the beginning, the receiver divides the marked image into M × N/4 non-overlapping blocks, and the values of parameters p, q and s are obtained according to the data hiding key. M × N/4 non-overlapping blocks are classified into smooth region and complex region by the threshold T. Thus, the embedded data can be extracted from the marked image. Then the receiver decrypts the marked image to generate decrypted image Id according to the encryption key. In decrypted image Id, p LSB layers of the circle pixels in each block need to recover. In each pixel group, the receiver can get the vector [v′(k, 1), v′(k, 2), …, v′(k, p·q − s)] in (13). The original bits vector of each group [v(k, 1), v(k, 2), …, v(k, p·q)] must be one in function (16):

$$\varvec{\Theta}=\left[ {{v^\prime }{\text{(}}k,\;1{\text{), }}{v^\prime }{\text{(}}k,\;2{\text{),}} \ldots {\text{,}}{v^\prime }(k,\;pq - s),\,0,\,0, \ldots ,0} \right]+\varvec{\Gamma} \cdot \mathbf{H},$$
(16)
$$\mathbf{H}=[{\mathbf{Q}^\prime },\,{\mathbf{I}_s}],$$
(17)

where Γ is an arbitrary binary vector sized 1 × s, and H is a matrix sized s × pq and consisted of the transpose of Q and an s × s identity matrix. Thus, for recovering the vector [v(k, 1), v(k, 2), …, v(k, p·q)], there are 2s possibilities. The receiver puts the elements in each vector Θ into their original position and decrypts the pixel group to generate decrypted pixel group Ok according to the encryption key, and then calculates the total difference of the decrypted and estimated pixels in each group. Here, \({\tilde {p}_{m,n}}\) is generated from the neighbors in the directly decrypted image Id, and rm,n denotes the pixel values in decrypted pixel group Ok:

$${\tilde {p}_{m,n}}=\frac{{{p_{m - 1,n}}+{p_{m+1,n}}+{p_{m,n - 1}}+{p_{m,n+1}}}}{4},$$
(18)
$$D=\sum\limits_{{(m,\;n) \in {O_k}}} {\left| {{r_{m,n}} - {{\tilde {p}}_{m,n}}} \right|} .$$
(19)

Thus, 2s possible D corresponding to 2s decrypted pixel group Ok. 2s decrypted pixel groups must contain the original segment which has the smallest D, because of the spatial correlation in natural image. That is if the receiver find the smallest D, he can regard the corresponding pixel group as the original segment. When the pixel groups are all recovered, the original image is recovered.

In our scheme, the adjacent pixels are helped each other to recover the image. We first use (8 − p) MSB layers of circle pixels to recover the MSB layer of square pixels in decryption phase. Then, the recovered square pixels are used to further recover the p LSB layers of circle pixels. Finally, the original image is recovered without any error. This way can improve the embedding rate and the visual quality of decrypted image significantly. The parameters of p, q and s can be transmitted as the additional data.

3 Experimental analysis and results

3.1 Security analysis

For the schemes of reversible data hiding in encrypted image, the security of encryption is important. Our encryption method consists of stream encryption and permutation. After the stream encryption, we randomly permute the M × N/4 non-overlapping blocks. In the permutation phase, there are at most (M × N/4)! possibilities of the permuted patterns. However, the value of (M × N/4)! is too large to rearrange the permuted blocks as original. To illustrate, we test the image lake in this phase. Figure 3a–d shows the original image, encrypted image only with stream encryption, final encrypted image and decrypted image, respectively. In Fig. 4a, b, we show the histograms of original image and final encrypted image; however, the two histograms are quite different. In Fig. 4c, d, the x-axis and y-axis denote the position of corresponding pixel of the image, and the z-axis represents the pixel values. In addition, distributions of the pixel values of the original image and final encrypted image are shown in Fig. 4c, d. Clearly, the distribution of pixel values in the final encrypted image is uniform. Generally, the security of our encryption method is guaranteed.

Fig. 3
figure 3

a Original image, b encrypted result with stream encryption, c final encrypted result with block permutation after stream encryption, d decrypted image

Full size image
Fig. 4
figure 4

Histograms and distributions of original image Lake and its final encrypted version. a Histogram of original image, b histogram of encrypted image, c distribution of the pixel values of the original image, d distribution of the pixel values of the final encrypted image

Full size image

3.2 Comparisons with state-of-the-art schemes

In this phase, the sizes of test images are 512 × 512, and the threshold T is 1. In Fig. 5, we use image Airplane to show the results, here, the parameters of q, p and s are 1600, 1 and 1, respectively. Figure 5a shows the original image Airplane. The encrypted image and marked image with embedding rate 0.1171 bpp are shown in Fig. 5b, c. Figure 5d illustrates the directly decrypted image with PSNR of 57.4 dB.

Fig. 5
figure 5

a Original image, b encrypted image, c marked image (embedding rate 0.1171 bpp), d directly decrypted image with PSNR of 57.4 dB

Full size image

The results of four images Airplane, Lake, Lena and Crowd with different embedding rates are shown in Fig. 6. They all have good image quality with big embedding capacity. Our proposed scheme is more suitable for the smooth image because the smooth region and complex region in the image are used.

Fig. 6
figure 6

PSNR of directly decrypted image with different embedding rates

Full size image

Table 1 illustrates the results of the four images with different parameters q, p and s in detail. From Table 1, we can see that when the parameter p is high, the corresponding embedding rate is also improved. However, due to more LSB layers are changed, the corresponding PSNR in directly decrypted images are declined a little. In addition, as illustrated in Table 1, the image quality of final recovered image is good, and mostly can be recovered without any error.

Table 1 Embedding rate (R), PSNR of directly decrypted images and PSNR of recovered images under different in parameters q, p and s
Full size table

Figures 7 and 8 show the comparisons between the propose scheme and [17, 19, 21]. Here, the parameter p of method in [19] is 1. Figure 7 illustrates the PSNR of directly decrypted image with different embedding rate comparisons. Both in PSNR and embedding rate, our propose scheme is well beyond other three methods. Figure 8 illustrates the SSIM of directly decrypted image with different embedding rate comparisons [28]. The results of SSIM and embedding rate of our proposed scheme are also very good. In our experiments, we set the threshold T is 1. If higher embedding capacity is required, the user can set higher value of the threshold T.

Fig. 7
figure 7

Rate-PSNR comparisons between the proposed scheme and [17, 19, 21]. aAirplane, bLake, cLena, dCrowd

Full size image
Fig. 8
figure 8

Rate-SSIM comparisons between the proposed scheme and [17, 19, 21]. aAirplane, bLake, cLena, dCrowd

Full size image

3.3 Analysis of computation complexity

The computation complexity of our proposed scheme mainly depends on the embedding phase including two embedding ways and the iteration algorithm in image recovery phase. As a result, the real-time performance will be affected, if more bits are embedded into the encrypted image or more groups are obtained. In the proposed scheme, the encryption method, embedding method and decryption method are all have low computation complexity. Here, we set parameters of q, p and s are 1600, 1 and 1, respectively. The image Lena sized 512 by 512 was used as an example. The execution time of image encryption, data embedding, direct decryption and image recovery are 0.819, 2.570, 0.824 and 1.863 s, respectively, which demonstrates the real-time performance of our scheme and the feasibility in real applications.

4 Conclusions

In this work, a real-time reversible data hiding scheme in encrypted image is presented, which uses mutual aid of the adjacent pixels to improve the embedding capacity and image quality of decrypted image. In the encryption phase, the content owner divides the original image into blocks and uses the stream cipher and permutation to encrypt the blocks. When the data hider obtains the encrypted image, he can embed the secret data into the encrypted image without known the image content. In detail, the data hider first classifies the encrypted blocks into smooth region and complex region and embeds the secret data into the MSB layer of square pixels in blocks of smooth region. Then, he collects the LSB layers of the circle pixels in all blocks and compresses them to make a room for embedding the secret data again. Finally, the marked image with secret data is generated. If he receiver only has the encryption key, he can divides the marked image into blocks and decrypts them directly by the encryption key. If the receiver only has the data hiding key, he can classifies encrypted blocks into smooth region and complex region according to the threshold T, and then the embedded data can be extracted by the data hiding key. If the receiver has both encryption key and data hiding key, he can extract the embedded data directly and recover the original image perfectly. Our scheme has good quality of decrypted image and high embedding rate due to the MSB replacement in smooth region. Experimental results show the better rate-distortion performance of our scheme than some of state-of-the-art schemes and also the high computational efficiency for the requirements of real-time applications.