Reversible Data Hiding for Encrypted 3D Model Based on Prediction Error Expansion

,


Introduction
With the rapid advancement of multimedia processing technologies on the internet, data hiding methods have been developed for the security of three-dimensional (3D) models [1][2][3]. Data hiding methods achieve integrity authentication and copyright protection by embedded secret data into the content of the original carrier [4,5]. However, for the occasions with high data security requirement, such as medical images and judicial certification, no modification is allowed on the original carrier. Therefore, reversible data hiding (RDH) has attracted more researchers for potential applications [6][7][8].
Traditional RDH methods can be divided into three categories: difference expansion (DE), histogram shifting (HS), and lossless compression (LC). DE-based RDH methods embed secret data into carrier image by expanding the difference among adjacent pixels [9,10]. Prediction error expansion (PEE), which belongs to difference expansion, embeds secret data by expanding the difference between the actual value and the prediction value of pixels [11][12][13][14]. HS-based RDH methods generate the feature histogram of original image and embed secret data into the smallest point of the histogram [15,16]. LS-based RDH methods compress the specified area of the carrier image and embed secret data into the compressed area [17].
With the development of outsourced storage in the cloud, reversible data hiding in encrypted domain (RDH-ED) has been studied for security of multimedia files in the cloud.
The existing RDH-ED methods are mainly classified into reserving room before encryption (RRBE) and vacating room after encryption (VRAE). The RRBE method reserves embedding room before encrypting the original image. For example, Ma et al. proposed a reversible data hiding method, in which the room is reversed by self-embedding before encryption. Zhang [19] constructed the histogram of prediction error and reserved room by HS, which is the most popular method for reversible data hiding. Cao et al. improved the method of [18,19] by generating prediction error with a small entropy so that the reserved room can be increased, and the data hiding capacity can be improved [20].
The VRAE method directly implements data embedding by modifying the encrypted image [21,22]. For example, Zhang embedded secret data by flipping the three least significant bits of a pixel [19]. With the help of the spatial correlation of natural images, the receiver extracted the secret data through the evaluation function of texture complexity. Based on the method of [19], Hong et al. increased data hiding capacity by improving the evaluation function [23]. Zhang [19] emptied out space for data embedding by using the typical manner of cipher-text compression.
However, the above RDH methods are for images and cannot be directly used to 3D models because the data structure of the 3D model is different from that of the image. Therefore, Wu and Cheung proposed a RDH method for 3D models based on DE, which embeds secret data by modifying the difference among adjacent vertices [24]. Jhou et al. constructed the histogram of the distance between all vertices and the center of 3D model and embedded secret data by histogram shifting. However, these methods cannot be implemented in the encrypted domain [25]. Jiang et al. proposed a RDH-ED method for 3D models based on stream cipher encryption [26]. By flipping several least significant bits of vertex coordinates, one bit was embedded. The receiver extracted secret data by using the spatial correlation of the original 3D model. Shah and Zhang proposed a watermarking method based on the Paillier cryptosystem, which used VRAE framework to vacate space before encryption [27]. Wang et al. embedded secret data in the encrypted domain by constructing direction histogram and histogram shifting [28].
Combining homomorphic encryption and prediction error expansion, a RDH method for encrypted 3D model is proposed in this paper. In this method, the original 3D model is preprocessed, and the vertex of 3D model is encrypted by using Paillier cryptosystem. In the cloud, in order to improve the accuracy of data extraction, the dyeing method is designed to classify all vertices into the embedded set and the referenced set. After that, the secret data is embedded by expanding direction of prediction error with direction vector. The prediction error of the vertex is computed by using the referenced set, and the direction vector is obtained according to the mapping table. Moreover, the mapping table is constructed to map several bits to a direction vector. Secret data can be extracted by comparing the angle between the direction of prediction error and direction vector, and the original model can be restored using the referenced set. The contributions of the paper are organized as follows.
(1) By designing the dyeing method to classify all vertices into the embedded set and the referenced set, the error rate of data extraction can be reduced (2) The mapping table is constructed to map several bits to a direction vector, so that several bits can be embedded into a vertex, which improves data hiding capacity (3) Compared the existing RDH-ED methods, the proposed method has higher capacity, lower bit error rate, and the directly decrypted 3D model has less distortion The rest of this paper is organized as follows. The Paillier cryptosystem is briefly introduced in Section 2. The related reversible data hiding method is proposed in Section 3. The experimental results are shown in Section 4. The conclusions are discussed in Section 5.

Related Algorithm
The Paillier cryptosystem [29], which has been widely used in encrypted signal processing, has homomorphism and probability. Homomorphism means that the product of two ciphertexts is consistent with the sum of two corresponding plaintexts. Probability means that different ciphertexts, which are obtained by encrypting the same plaintext with different parameters, can be decrypted to the same plaintext. The following describes the process of key generation, encryption, decryption, two characteristics, and subtraction homomorphism expansion.
2.1. Key Generation. Randomly pick up two large prime numbers p and q. Calculate N = pq and λ = lcm ðp − 1, q − 1Þ, where lcm ð⋅Þ stands for the lowest common multiple. Afterwards, select g ∈ Z * N 2 randomly, which satisfies where LðuÞ = ðu − 1Þ/N, and gcd ð⋅Þ means the greatest common divisor of two inputs. Z N 2 = f0, 1, 2, ⋯, N 2 − 1g and Z * N 2 are the numbers in Z N 2 which prime with N 2 . Finally, we get the public key ðN, gÞ and corresponding private key λ.
2.2. Encryption. Select a parameter r ∈ Z * N 2 randomly. The plaintext m ∈ Z N can be encrypted to the corresponding ciphertext c by where E½⋅ denotes the encryption function.

Decryption.
The original plaintext m can be obtained by Moreover, two important characteristics are described as follows (which has been applied in the proposed method).

Homomorphic Multiplication.
For ∀r 1 , r 2 ∈ Z * N , two plaintexts m 1 , m 2 ∈ Z N and corresponding ciphertexts E½m 1 , The original Paillier encryption system only has addition homomorphism and multiplication homomorphism. The subtraction homomorphism of the Paillier encryption system can be realized as follows.

The Proposed Reversible Data Hiding Method
In order to protect 3D model in the cloud, a reversible data hiding (RDH) method for encrypted 3D model is proposed. Figure 1 shows the flowchart of the proposed method. An original 3D model is preprocessed, and the vertex of 3D model is encrypted by using the Paillier cryptosystem. In the cloud, all vertices are classified into the embedded set and the referenced set. Then, the secret data is embedded by expanding direction of prediction error with direction vector. The prediction error of the vertex is computed by using the referenced set, and the direction vector is obtained according to the mapping table. Receiver can extract secret data by comparing the angle between prediction error and the direction vector, and the original model can be restored using the referenced set.

Preprocessing.
Because the input of the Paillier cryptosystem should be a positive integer, the vertex coordinates firstly are converted from decimal to positive integer.
3D models are consisted of vertex data and connectivity data. The vertex data includes the coordinates of each vertex in the spatial domain. The connectivity data reflects the connection relationship between vertices. A 3D model Fairy and its local region are illustrated in Figure 2, and the corresponding format file is shown in Table 1. Each vertex and each face of the 3D model have a corresponding index, respectively. For a 3D model M, let fv i g and N V is the number of vertices. Note that each coordinate |v i,j | <1, j ∈ fx, y, zg, and the significant digit of each coordinate is 6.
Normally, uncompressed vertices are 32-bit floating point numbers with a precision of 6 digits. Therefore, the vertex coordinates are converted into an integer with k significant digits by using.
Moreover, all vertex coordinates should be converted to positive integers for encryption by using.
If k is greater than 6, the model can be restored losslessly; however, the time cost of encryption and decryption is large. If k is less than 6, the time cost is small, while the model cannot be restored losslessly. In order to balance the time cost and distortion of 3D model, the best k will be selected through the experiment. (2), an integer r can be randomly selected to encrypt the vertex coordinates

Encryption. Referring to Equation
where c i,j is the ciphertext from the plaintext v i,j ′ .

Data Embedding.
Firstly, the dyeing method is designed to classify all vertices into the embedded set and the referenced set. Secondly, the prediction error of the vertex in the embedded set is computed using the referenced set. Thirdly, a one-to-one mapping is constructed to map several bits to a direction vector. Finally, for embedding secret data, the direction vector and the embedded key are used to expand the direction of the prediction error. In addition, the embedded key is calculated to reduce the accuracy of data extraction.

Classifying the Vertices.
For the vertex of 3D model, 1ring neighborhood of the vertex refers to these vertices that are directly adjacent to the vertex. As shown in Figure 3, If a vertex is modified to embed secret data, its 1-ring neighborhood cannot be modified, and it is mainly because the 1-ring neighborhood is required to calculate the prediction value of the vertex. Therefore, the dyeing algorithm is designed to classify all vertices into the embedded set and the referenced set because the color of adjacent vertices cannot be same. The vertices in the referenced set can be used to calculate the prediction value of the vertices in the embedded set because the referenced set consists of 1-ring neighborhood of all vertices in the embedded set, while the vertices in embedded set are modified to embed secret data. Suppose that S e denotes the embedded set, and S r denotes the referenced set. In order to obtain large data hiding 3 Journal of Sensors capacity, the number of the vertices in the embedded set should be increased. The embedded set is the nonadjacent vertex set. According to graph theory, the existing polynomial algorithms can find the largest nonadjacent vertex set if the graph is a bipartite graph. However, the connectivity data of a 3D model cannot be represented by a bipartite graph since all loops of 3D model are 3. Hence, finding the largest embedded set in a 3D model is NP-hard problem. In order to increase data hiding capacity, the dyeing algorithm is designed to increase the number of the vertices in the embedded set.
Referring to the four-color theorem, different colors are required for any two adjacent vertices. For 3D models, at least seven colors are needed to dye the vertices to ensure that the colors of the adjacent vertices are different. After completing the process of dyeing, the color with most vertices is selected, and all vertices of this color are regarded as the embedded set, and the remaining vertices are regarded as the referenced set. Suppose that C denotes the color set of dyeing all vertices, Z i denotes the color set of 1-ring neighborhood of the vertex, and c i denotes the color of the ith vertex. The steps for the vertex classification using the dyeing algorithm are listed as follows.
Step 1. Suppose that the color of all vertices is black, and traverse all vertices in order of the vertex index.
Step 2. For an unclassified vertex v i , statistic the color set of its 1-ring neighborhood.
Step 3. Dye the vertex v i using the first color in C but not in Z i .
Step 4. Determine whether the next vertex v i+1 is black. If v i+1 is black, the classification ends. If v i+1 is not black, loop from Step 2 until no vertex is black.  Figure 1: Flowchart of the proposed RDH-ED method.    Journal of Sensors Step 5. Select the most frequently used color, add all vertices of this color to the embedded set, and the remaining vertices are added to the referenced set.
Since all vertices are traversed only once, the time complexity of the dyeing algorithm is OðnÞ. For example, as illustrated in Figure 4, let C = fred, green, yellow, blueg. Traverse the vertex v 1 , and let c 1 = red since Z 1 = fblackg. Traverse the vertex v 2 , and let c 2 = green since Z 1 = fblack, redg. Traverse the vertex v 2 , and let c 2 = yellow since Z 1 = fblack, red, greeng. After traversing all vertices, the most frequently used color green is selected. The vertex set {2,6,7,11} of color green is regarded as the embedded set, while the remaining vertices as the referenced set.

Computing of Prediction
Error. The accuracy of prediction error directly affects the performance of data hiding. As shown in Figure 3, the vertex v j ′ is adjacent to the vertex v i ′ , and the vertex v i is the prediction value of vertex v i ′ . According to the correlation of adjacent vertices, prediction value v i can be calculated by using where N i denotes the number of the adjacent vertices of the vertex v i ′ .  Embed one bit into a vertex, which means n = 1, and s w ∈ 0, 1 ½ . On this condition, let b k,j ∈ −1, 1 f g.
Embed two bits into a vertex, which means n = 2, and s w ∈ 0, 3 ½ . On this condition, let b k,j ∈ −1, 1 f g.
Embed three bits into a vertex, which means n = 3, and s w ∈ 0, 7 ½ . On this condition, let b k,j ∈ −1, 1 f g.
Embed four bits into a vertex, which means n = 3, and s w ∈ 0, 15 ½ . On this condition, letb k,j ∈ −1, 0, 1 f g . The prediction error of the vertex v i ′ can be calculated by using where Δv i denotes the prediction error of the vertex v i ′. Δv i is a three-dimensional vector with random direction. Due to the spatial correlation, the modulus length jΔv i j is usually small, and experiment results show that the modulus length jΔv i j has the maximum D. Hence, the range of jΔv i j is as follows.
3.3.3. Constructing the Mapping Table. In order to embed several bits into a vertex in the embedded set, several bits should be mapped to a direction vector. Data embedder converts secret data into several groups with n bits, and n is a shared parameter. Let a group with n bits denote as wðw 0 , w 1 , ⋯, w n−1 Þ. Suppose that s w denotes weighted sum of w, and s w is calculated as In order to embed s w into a vertex, the corresponding direction vector of s w should be constructed. Suppose that b ! s w denotes the direction vector of s w , and s w is embedded by expanding the direction of prediction error with direction vector b ! s w . The one-to-one mapping between weighted sum and direction vector is constructed as shown in Table 2. Let b k,j ∈ f−1, 1g, k ∈ ½0, 7, and if n ≤ 3, eight direction vectors can be constructed. The mapping between direction vector and weighted sum is shown at the top three rows in Table 2. Let b k,j ∈ f−1, 0, 1g, k ∈ ½0, 26Þ, and if n = 4, twentysix direction vectors are constructed as shown at the fifth row in Table 2. Let b k,j ∈ f−2,−1, 0, 1, 2g, k ∈ ½0, 110Þ, and if n = 5 or n = 6, 110 direction vectors are constructed. Let W b k denote the direction weight of direction vector. As shown in Table 2, the direction vector b ! k is sorted according to the value W b k , and the direction weight W b k of the direction vector is calculated as follows.
Hence, if the shared parameter n is obtained, the mapping table between weighted sum and direction vector can be constructed. For different s w , the corresponding direction vector b ! s w can be found through the mapping table. For example, if n = 2, four direction vectors b ! s w should be constructed to represent four weighted sum s w , respectively. Let b k,j ∈ f−1, 1g, eight direction vectors can be constructed, and the first four direction vectors are selected according to the direction weight W b k . As a result, the four direction vectors (-1,-1,-1), (-1,-1,1), (-1,1,-1), and (-1,1,1) are constructed to represent s w ∈ ½0, 3, respectively.

Data Embedding.
In order to embed secret data into the vertex, the vertex coordinates are required to be modified by using the direction vector and the embedding key. The weighted sum s w of wðw 0 , w 1 , ⋯, w n−1 Þ is embedded in the vertex v i ′ by using Equation (13).
where v i ″ is the modified vertex coordinate of v i ′ , parameter φ is the embedding key, and b ! s w = ðb s w ,x , b s w ,y , b s w ,z Þ is the corresponding direction vector of s w .
Referring to Equation (13), data embedding in the encrypted domain is performed as Journal of Sensors where c i,j ′ is the ciphertext of v i,j ″ , and c s w is the ciphertext of φ ⋅ b s w ,j . Moreover, if φ ⋅ b s w ,j > 0, addition homomorphism of Paillier cryptosystem is utilized to embed secret data. If φ ⋅ b s w ,j < 0, subtraction homomorphism expansion of Paillier cryptosystem is utilized to embed secret data.
After data embedding, the corresponding change of the prediction error in the plaintext is as follows.
After Δv i being changed, the angle between the direction of prediction error and direction vector will be small.
In order to improve accuracy of data extraction, two inferences about vector are provided to calculate the embedded key.
where θðm where × denotes cross product. Since n ! 1 and n ! 2 are unit vector, Equation (18) can be obtained according to Equation (17).

Embedding Key Calculation.
The embedding key influences the accuracy of data extraction. If the embedding key satisfies a certain condition, secret data can be extracted correctly. Figure 5 shows the angle between prediction error and three direction vectors. Suppose that θ s w denotes the angle between prediction error Δv i and direction vector b ! s w corresponding to the secret data s w , and θ k denotes the angle between prediction error Δv i and other direction vector Since the secret data is extracted by using the smallest angle between the prediction error and the direction vector, in order to improve the accuracy of data extraction, θ s w should be smaller than θ k ðk ∈ ½0, 2 n − 1, k ≠ s w Þ. After data embedding, Equation (20) should be satisfied.
The following equation can be derived by using Cosine Theorem.
It can be derived to the following equation.
Suppose that the vector M   Journal of Sensors According to Inference 2, the angle between b ! s w and M Since the modulus length jΔvj ∈ ½0, DÞ, Equation (25) can be derived according to Inference 1.
It can be derived to the following equation by using Cosine Theorem.
Suppose that θð b If φ satisfies Equation (27), secret data can be extracted correctly. According to Inference 2 and Equation (27), φ has the maximum if the angle between b ! s w and b ! k is smallest. Since direction vector is related to the shared parameters n, the shared parameters influence the value of φ. According to Equation (27), the relationship between φ and n is obtained as follows.
In order to explain the whole processes, the data embedding example is given as follows. For convenience, suppose that n = 2, the ith vertex v i ′= ð1410, 2120, 790Þ, the prediction value v i = ð1430, 2280, 750Þ, and the secrete data w′ = ð1, 0Þ. Since n = 2, the weighted sum s w ∈ ½0, 3 according to Equation will be smallest after data hiding, and the secret data can be extracted by finding the smallest angle. Figure 6 shows the changes of angles θ s w between prediction error Δv i ′ of 100 vertices and direction vector b ! s w corresponding to secret data s w before and after data embedding when the shared parameter is 3. The result shows that the angle will become smaller after data embedding.
In addition, a large embedding key will make 3D model disturbed obviously. Hence, the embedding key will be discussed specifically in Section 4 to balance the distortion of the directly decrypted model and the accuracy of data extraction.

Data Extraction and Model Recovery.
After receiving the encrypted model with secret data, receiver can decrypt 3D model with private key λ and obtain the directly decrypted 3D model. The decryption of 3D model is as follows.
The directly decrypted 3D model is similar to the original model because only the coordinates of some vertices are modified slightly during data embedding.
After decrypting 3D model, all vertices are first classified into the embedded set and the referenced set using the dyeing algorithm. Secondly, prediction error of the vertex in embedded set is computed and the mapping table is constructed with the shared parameter n. Then, the angles between prediction error and all direction vector are computed, and the smallest angle θ s w is selected, which is the angle between s w is converted into n bit wðw 0 , w 1 , ⋯w n−1 Þ by using After data extraction, the embedding key and direction vector can be used to recovery the original 3D model by using

Experiment Results and Discussion
The proposed method was implemented in Matlab 2016b under Window 7. We implemented the following experiment on 100 3D models and calculated the average of 100 3D models. Figure 7 shows a group of experiment results of five 3D models in different parses. The phases from left to right are original 3D model, encrypted 3D model, data-embedded 3D model, directly decrypted 3D model, and recovered 3D model. Directly decrypted 3D models have low distortion, and recovered 3D models have high similarity compared to original 3D model. The similarity of disturbed 3D models is evaluated by the signal-to-noise ratio (SNR). The higher the SNR, the better the imperceptibility after embedding watermark. SNR is computed as

Journal of Sensors
where v x , v y , v z are the mean of vertex coordinates, v i ðv i,x , v i,y , v i,z Þ are the original vertex coordinates, and g i ðg i,x , g i,y , g i,z Þ are the coordinates of disturbed 3D model. SNR D is used to evaluate the similarity of directly decrypted models, and SNR R is used to evaluate the similarity of recovered models. In addition, the bit error rate (BER) is used to measure the error rate of data extraction. The lower the BER, the higher the accuracy of data extraction.

Decimal Reservation Digits k.
In order to observe the effect of decimal reservation digits k on the quality of the decrypted model and time cost, we changed the value of k from 1 to 8 and perform encrypting and decrypting on 3D models. As shown in Figure 8(a), k = 6 is a threshold, which enables 3D models recovery losslessly or limits recovery losslessly. Since the significant digits of vertex coordinates is 6, it is easy to cause permanent distortion if k < 6. The distortion of directly decrypted model (SNR D ) is calculated, which is shown in Figure 8(b). The time cost of encryption and decryption is related to the value k, which is shown in Figure 8(c). In order to obtain high quality of decrypted models and reduce the time cost, k is set to 4 in the next experiment.

The
Maximum of the Modulus Length D. D is the maximum of the modulus length of the prediction error. Due to the spatial correlation of natural 3D model, the actual value and its prediction value of the vertex coordinates are relatively close. Hence, the modulus length of the prediction error always is small. In order to calculate the range of the prediction error, the experiment is performed on 40 3D models. Figure 9 shows the maximum modulus length of 40 3D models. For all 3D models, it can be observed that all maximum modulus lengths are less than 250. Hence, D is set to 250 in the next experiment.

The Choice of the Embedding Key and the Shared
Parameter. According to Equation (13), the embedding key φ directly affects the distortion of decrypted model. If φ is large and satisfies Equation (27), secret data will be extracted correctly, but the quality of 3D models will be decreased obviously. If φ is small, the change of prediction error also will be small, and the accuracy of data extraction will reduce. However, there are several existing methods that can improve the accuracy of data extraction, such as ECC code and BCD code. Hence, in order to balance the accuracy of data extraction and the decrypted model, the experiment is carried out by select φ from 50 to 350 with the interval of 20.  The larger the shared parameter, the greater the embedding capacity. However, the larger the shared parameter leads to that, more direction vectors are constructed, which affects the accuracy of data extraction. The experiment is carried out by selecting n from 1 to 6. Table 3 shows the effect of the embedding key and shared parameter on BER of data extraction. Figure 10(a) shows the effect of the embedding key and shared parameter on SNR R of decrypted model. Figure 10 It is observed that the proposed method has high accuracy, high embedding capacity, and low distortion when n = 3 and φ = 110. Figure 11 shows decrypted models when n = 3, and φ changes from 90 to 150. Figure 12 shows decrypted model when n changes from 1 to 4.  Table 4 shows the relationship between the number of the vertices and SNR R . If a 3D model has a large number of vertices, then the distance between the adjacent vertices will become small, which makes 3D model has a small D. In addition, D directly influence SNR R because of the relationship between D and ϕ. Hence, if a 3D model has more vertices, then the value of SNR R will be small, which means that the decrypted model has low distortion.

Performance Comparison.
In order to show the performance of the proposed method, we compare the proposed method with the existing method in [26] and in [28], as shown in Table 5. Compared with method in [26], the proposed method has three times the capacity and lower distortion than method in [26]. Moreover, the proposed has a lower BER, which can be reduced to zero by making the embedding key satisfy Equation (27).
Compared to method in [28], the embedding capacity of the proposed method is smaller. However, since several bits can be mapped to a direction vector using the mapping table, the capacity can be improved by embedding several bits into a vertex. Hence, the proposed method has a higher embedding capacity.
In the proposed method, the distortion and the accuracy can be adjusted by using the embedding key. When the embedding key is 110, 3D models after data hiding has lower distortion. When the embedding key is 250, the BER of data extraction can be reduced to zero. In addition, the distortion will increase as the embedding key increases, the BER will decrease as the embedding key decreases.

Conclusion
The method is proposed to preserve privacy and protect copyright of 3D models. Moreover, the proposed method has very good potential for practical applications since the directly decrypted models have lower distortion than the original models. Original 3D model is preprocessed, and the vertex of 3D model is encrypted by using Paillier cryptosystem. In the cloud, the dyeing method is designed to classify all vertices into the embedded set and the referenced set. After that, secret data is embedded by expanding direction of prediction error with direction vector. The prediction error of the vertex in the embedded set is computed by using the referenced set, and the direction vector is obtained according to the mapping table. Secret data can be extracted by comparing the angle between the direction of prediction error and direction vector, and the original model can be restored using the referenced set. The proposed method is efficient to protect copyright of 3D models in the cloud when the cloud administrator does not know the content of the 3D models. Moreover, the proposed has higher capacity and lower distortion than the existing methods.
For the future work of RDH-ED method, we will investigate the following two possible research directions. (1) Extracting information from plaintext is expanded to extracting from plaintext and ciphertext. (2) Further improve the similarity between the directly decrypted model and the original model.

Data Availability
The data used to support the findings of this study are available from the corresponding author upon request.

Conflicts of Interest
The authors declare no conflict of interest.