Weighted Polynomial-Based Secret Image Sharing Scheme with Lossless Recovery

In some particular scenes, the shadows need to be given different weights to represent the participants’ status or importance. And during the reconstruction, participants with different weights obtain various quality reconstructed images. However, the existing schemes based on visual secret sharing (VSS) and the Chinese remainder theorem (CRT) have some disadvantages. In this paper, we propose a weighted polynomial-based SIS scheme in the field of GF (257). We use (k, k) threshold polynomial-based secret image sharing (SIS) to generate k shares and assign them corresponding weights. +en, the remaining n − k shares are randomly filled with invalid value 0 or 255. When the threshold is satisfied, the number and weight of share can affect the reconstructed image’s quality. Our proposed scheme has the property of lossless recovery. And the average light transmission of shares in our scheme is identical. Experiments and theoretical analysis show that the proposed scheme is practical and feasible. Besides, the quality of the reconstructed image is consistent with the theoretical derivation.


Introduction
With the development of Internet technology and digital multimedia technology, digital images are more and more widely used. Meanwhile, security is also threatened. In particular, personal privacy images, confidential commercial images, medical images, and military drawings are easy to be intercepted, tampered, and destroyed in the process of storage and transmission. Cryptography [1,2] and steganography [3,4] are commonly used to protect images. A normal image is converted into a noise-like image through encryption technology. We cannot understand the secret image, but we can tamper with or destroy it, because it is clear that the image has been encrypted. Steganography improves the security of images, making it difficult for attackers to detect the existence of secret information. But steganography is the single-channel transmission, and if part of the area of data hiding is lost in transmission, the secret message could not be recovered.
Secret sharing (SS) is another technology to protect data with the features of multichannel transmission and loss tolerance. In 1979, Shamir [5] and Blakley [6] independently proposed the (k, n)-threshold SS scheme. e extension of SS to images is called secret image sharing (SIS). e secret image can be distributed among n participants by dividing it into n shadow images (also called shares or shadows). e secret can be reconstructed from any k or more authorized shadow images, while any k − 1 or fewer shadow images could not recover the secret. At present, in the SIS research field, visual cryptography schemes (VCS), also called visual secret sharing (VSS), schemes based on the CRT, and polynomial-based SIS schemes are the primary branches.
In 1995, Noar and Shamir [7] first proposed the (k, n)-threshold VCS. In general VCS, a binary image is encrypted to n shadow images on transparencies. e secret image can be obtained by superposing any k or more shadow images.
e recovery process relies on the human visual system (HVS) and does not require cryptographic computation or device [8,9]. According to the implementation principle, the VCS can be divided into schemes based on the basis matrix [7] and the random grid [10]. In the VCS field, current researches focus on these areas, including improving the visual quality of reconstructed images [11,12], implementing general access structures [13,14], share authentication [15], and meaningful shadow images [16][17][18].
Mignotte [19] first proposed the (k, n)-threshold SS scheme based on the CRT in 1982. en, Asmuth and Bloom [20] proposed a threshold SS scheme based on the CRT with random factors A. In their scheme, a set of integers p, m 1 < m 2 < · · · < m n is chosen subject to certain conditions. en, A ∈ [ N/p , (M/p) − 1 , where p is a prime Yan et al. [21] first applied the CRT to SIS. But the scheme has slight information leakage, and the recovery is lossy. Yan et al. [22] proposed a (k, n)-threshold SIS based on CRT for grayscale images. e scheme is lossless recovery and without auxiliary encryption. After that, most of the SIS schemes [23,24] based on the CRT were studied based on Asmuth and Mignotte's scheme.
ien and Lin [25] applied SS proposed by Shamir to SIS and first proposed a (k, n)-threshold SIS scheme. For the polynomial-based SIS, the sharing and recovery processes are simple, efficient, and easy to implement and have fewer public parameters. erefore, polynomial-based SIS schemes are widely used [26][27][28]. However, most polynomial-based SIS schemes are slightly lossy. To achieve lossless recovery, many polynomial-based SIS schemes have been studied. We can segment pixel values greater than 250, operate in the field of GF(2 8 ), or choose a prime number greater than 255. In this paper, we choose the prime number 257 and use the screening operation to achieve lossless recovery.
In the above SIS schemes, the participants have the same weight and importance. However, in some scenarios, to indicate the status or importance of the participants, the shadow images need to be given different weights. Hou et al. [29] proposed a privilege-based VSS model. e model implemented a (2, n)-threshold VSS without pixel expansion. e participants of their scheme have the same size and different privileges. In the recovery phase, the greater the shadows' weight, the better the quality of the reconstructed image. But the average light transmissions of shares are not equal. Yang et al. [30] extended Hou et al.'s scheme with a correct privilege level, achieving the consistency of the average light transmission and the sum of privilege levels. Both Hou and Yang's schemes require a codebook and are lossy in recovery. Liu et al. [31] proposed a weighted (k, n)-threshold random grid VSS(RG-VSS) with lossless recovery. Each share has a weight in their scheme, and the secret image can be recovered by OR and XOR operations. Especially, the recovered image is lossless when using XOR operations. e secret image format of the weighted VSS schemes is only binary image. Tan et al. [23] proposed a weighted (k, n)-threshold SIS scheme based on the CRT for sharing grayscale images. Tan et al.'s scheme requires a weight generation modulus. And the average light transmissions of shares of their scheme are also unequal. To sum up, the weighted schemes based on VSS are lossy and can only share the binary images, not grayscale images. For the weighted schemes based on the CRT, we need to set parameters according to requirements in advance, and the number of participants is limited. Compared with VSS and CRT, polynomial-based SIS has some advantages. erefore, we consider combining polynomialbased SIS with different weights to overcome the above disadvantages.
In this paper, we propose a weighted polynomial-based SIS scheme with lossless recovery. Each share is assigned to a weight. We improve ien and Lin's scheme, choosing the prime number 257 and using the screening operation to achieve lossless recovery. A polynomial generates the n share pixel values, and then k of them are selected according to their weights. e remaining n − k shadows are randomly filled with invalid value 0 or 255. In the recovery phase, when the threshold is satisfied, the greater the weight of one of the shadows or the number of shadows, the better the quality of the recovery secret image. e contributions of our work are summarized as follows: (1) We propose a weighted polynomial-based SIS scheme in the field of GF(257). e rest of this paper is organized as follows. In Section 2, we review Shamir's scheme and ien and Lin's scheme and then introduce the definition of the correct recovery probability (CRP). e proposed scheme and the theoretical analyses are described in Section 3. Section 4 gives experimental results and comparisons. Finally, conclusions are drawn in Section 5.

Preliminaries
In this section, we review the polynomial-based SIS schemes proposed by Shamir and ien and Lin. en, the evaluation parameter CRP of the reconstructed secret images of our scheme is given.

Review of Shamir's Scheme.
In 1997, Shamir [5] proposed the (k, n)-threshold SS scheme based on polynomial properties. If a plane has k points, there exists a unique k − 1 degree polynomial. Shamir shared a secret S into n different shares S 1 , S 2 , . . . , S n based on this property. en, n shares were distributed to n participants P 1 , P 2 , . . . , P n . e secret S was chosen from the field of GF(p), where p is a prime greater than S and n. e polynomial of Shamir's scheme was defined as shown in f(x) � a 0 + a 1 x + a 2 x 2 + · · · + a k−1 x k− 1 (mod p), (1) where the coefficient a 0 was the secret S, and the other k − 1 coefficients are chosen from the field of GF(p). In the sharing phase, we set x � x i and then obtain f(x i ), where i � 1, 2, . . . , n. e n pair of points (x i , f(x i )) were generated according to the above polynomial.
After obtaining n pair of points, any k or more of which can recover the secret S, while any k − 1 or fewer pairs cannot recover the secret. e secret S can be reconstructed by using Lagrange's interpolation as shown in equation (2). When x � 0, the secret was reconstructed by calculating ψ(x), i. e., S � ψ(0).

Review of ien and Lin's Scheme.
ien and Lin [25] first applied the SS scheme to share a secret grayscale image in 2002. In their scheme, a secret image S was shared to n shadow images SC 1 , SC 2 , . . . , SC n , and any k or more of which can recover the secret image. In ien and Lin's scheme, all the coefficients were used to share the secret image's pixels. en, the successive k pixels of the secret image were shared through a polynomial presents two problems. e first is that each shadow image size is (1/k) of the original secret image. Second, there may be information leakage because of the correlation among pixels. erefore, the secret image pixels should be encoded before the sharing phase to increase security. In ien and Lin's scheme, the value of prime p was taken as 251. However, the range of the 8-bit grayscale image pixel value was [0, 255]. e pixels between 251 and 255 were truncated to 250, resulting in the fact that all the pixels were within [0, 250]. erefore, the reconstructed secret images were lossy. At the same time, the method of lossless recovery was provided in their scheme. e secret pixel values of more than 250 required additional operations, and that led to the expansion of shadow images.
ere are 256 pixels of the 8-bit grayscale image between 0 and 255. To achieve lossless recovery, all need to be included in the sharing phase. A prime number greater than 256 is 257, [0, 255] ⊂ GF(257). But 256 also belongs to GF(257), and the sharing process needs to be redone if a pixel value is shared to 256. Random numbers are generated to update the other k − 1 coefficients in the polynomial except a 0 until all the share pixel values are within [0, 255].
us, the probability P of an invalid value occurring when sharing a pixel is P � (257 − 256/257) × 100% ≈ 0.389%. At the same time, in the weighted SIS scheme, we filled in 0 and 255 as invalid values.
at is to say, there may be three invalid values, i.e., 0, 255, and 256, during the sharing of a pixel value. e probability P w of an invalid value occurring per share operation is P w � (3/257) × 100% ≈ 1.167%. is can achieve lossless recovery, and the efficiency of sharing is not greatly affected, which is within the acceptable range. erefore, in our scheme, we choose the prime number 257 and use the screening operation.

Correct Recovery Probability (CRP).
For the quality evaluation of the reconstructed image in the general SIS schemes, the most commonly used is mean squared error (MSE) and peak sign-to-noise value relation (PSNR). MSE is used to assess the distinction between the recovered image and the secret image. e lower MSE value indicates that the reconstructed image is close to the original image. PSNR represents the reconstructed image's quality. e higher the PSNR value is, the closer the reconstructed image is to the original image.
In our weighted SIS scheme, we adopt the correct recovery probability (CRP) [32] to evaluate the reconstructed image's quality. CRP is the ratio of the number of identical pixels in the same locations between the reconstructed image and the secret image to the image's total pixels. e higher the CRP value is, the more the number of pixel values is recovered correctly, that is, the closer the reconstructed image is to the secret image. e reconstructed image is lossless when CRP � 1.
For a secret image S with the size of A × B, the CRP of its reconstructed image S′ is calculated by where T is the number of identical pixels in the same locations in both two images.

The Proposed Scheme
In this section, we propose a weighted polynomial-based SIS scheme based on Shamir's scheme. To achieve lossless recovery, we choose the prime number 257 and use the screening operation. Each participating shadow image is assigned a weight, and the sum of these weights is equal to 1. Each pixel of the secret image generates k share pixel values by a polynomial, and we assign them weights. e remaining n − k shares are randomly filled with invalid value 0 or 255. When recovering the secret image, we adopt Lagrangian interpolation to obtain the secret pixel values. e secret image cannot be recovered from less than k shares. When more than k shares are collected, the higher the weights of the shares are, the better the recovered secret image's quality is. At the same time, our scheme can achieve lossless recovery when all the shadow images are used to participate in the recovery. e design idea of the sharing phase of our scheme is shown in Figure 1.

e Sharing Phase.
In the sharing phase of our scheme, for each pixel of the original secret image, k share pixels are generated by the polynomial-based SIS scheme with a (k, k)-threshold (PSIS(k, k)). en, k shares are distributed to k participants through a certain probability determined by the weights of the participants, and the shares of the other n − k participants are filled with invalid values. e detailed steps are described in Algorithm 1.
In the sharing phase, each shadow image is assigned a certain weight. Suppose that the weights of shares are w 1 , w 2 , . . . , w n , where w 1 + w 2 + · · · + w n � 1. en, we set corresponding weight interval for each shadow image in the interval of [0, 1] as shown in Figure 2. e proportion of the t − th interval in the whole interval is w t . We randomly generate any real numbers x in the interval of [0, 1]. If If P[t] has been set to 1, a random number will be generated again until the number of "1" in the share allocation list P is k.  Security and Communication Networks participant P t is selected, i.e., P[t] � 1. If the interval has been selected before that, i.e., P[t] has been set to 1, then random real number will be generated to perform the above operation. is process is repeated until k different participants are selected. By performing this operation, k shares have been distributed to k of the n participants according to a certain probability, while the remaining n − k participants have been distributed to invalid values.

3.2.
e Recovery Phase. Our scheme is based on the polynomial-based SIS scheme and can be recovered by Lagrangian interpolation. e secret image cannot be recovered from less than k shares. When more than k shares are collected, the higher the weights of the shares are, the better the recovered secret image's quality is. If all the shares participate in the restoration of the secret image, the reconstructed image is lossless. e specific recovery steps are shown in Algorithm 2.

eoretical Analyses.
In this subsection, some theoretical analyses of our scheme are presented. First, our weighted polynomial-based SIS scheme is based on Shamir's scheme. e constant coefficient of the polynomial is replaced with the pixel value of the secret image. And all the operations are performed in the field of GF(257). ere are 256 pixels of grayscale image, and [0, 255] ⊂ GF(257). erefore, our scheme can be applied to grayscale images. According to the principle of polynomial and Lagrange interpolation algorithm, any less than k equations cannot obtain the polynomial coefficients. us, k − 1 or fewer shares could not recover the pixel value of the secret image. Because we fill in invalid values to represent different weights of shares, when k shares are involved in reconstruction, some pixel values cannot be correctly recovered. When all shares are involved in reconstruction, we can exclude all invalid values and then use the remaining k valid values to recover the secret image's corresponding pixel value. erefore, our scheme can achieve lossless recovery. en, we theoretically analyze the quality and the effect factors of the reconstructed secret image. Each share is assigned a weight w i in the proposed scheme, and n i�1 w i � 1. e reconstructed secret image's quality is related to the weights of the shares involved in the reconstruction. To evaluate the quality of the reconstructed secret image, we compared the pixels in the corresponding positions of the two images, counted the number of identical pixels in the same positions, and combined them with the weights. en, we calculated the CRP of the reconstructed secret image in our scheme with (k, n)-threshold theoretically as CRP t (S) according to where k, n are threshold parameters, and t denotes the number of shares involved in the reconstruction. i j is the j th share in the i th combination, w i j denotes the weight of share i j , and t j�1 w i j � 1. e number of combinations of arbitrary k of t shares is denoted by C k t (k ≤ t ≤ n). C k t i�1 k j�1 w i j denotes the probability sum that arbitrary k of t shares are selected. e probability sum that arbitrary k of t shares are selected is denoted by C k n i�1 k j�1 w i j . Intuitively, we can guess that the number and weight of shadows can affect the reconstructed secret image's quality.
eoretically, if the threshold is satisfied, and the number of shadows is increased, the recovery quality of the secret image will be better. When all shadows participate in reconstruction, the secret image can be recovered in a lossless way.
at is to say, our scheme is progressive in reconstruction. Second, if the threshold is satisfied, and the weight of one of the shadows in the set increases, the recovery quality of the secret image will be better.
Assuming that there are t shadows in the set, the secret image could be recovered when these shadows participate in the recovery. e CRP of the reconstructed image is shown in equation (4). If another shadow l is added in the set to participate in the recovery, and the weight of shadow l is w l , then the CRP of the reconstructed image of t + 1 shadows recovery as CRP t (S) is calculated by When comparing the two reconstructed images' quality, it can be determined by subtracting CRP t (S) and CRP t ′ (S). e result is shown in According to the properties of combinatorial numbers, equation (7) holds.
where i j ′ ≠ l. erefore, equation (6) can be rewritten as where i j ′ ≠ l.

Security and Communication
Step 2. Judge whether the share pixel value is invalid value 0 or 255. Only if it is valid, it will participate in the recovery. (5) Step 3. Calculate Lagrange interpolation f(x) in the field of GF(257) by the formula ψ(x) � k j�1 f(i j ) k l � 1 l≠j . en, set x � 0 to obtain f(0). (6) Step 4. S(a, b) � f(0). (7) Step 5. Output the recovered image S. ALGORITHM 2: e recover procedure of the weighted polynomial-based SIS scheme. In equation (8), CRP t ′ (S) is greater than CRP t (S). at is to say, the quality of the reconstructed secret image from t + 1 shadows is better than that of t shadows. erefore, if the threshold is satisfied, the reconstructed image's quality will improve with the increase in the number of shadows involved in the recovery.
Assuming that there are t shadows in the set, the secret image could be recovered when these shadows participate in the recovery. e shadow v is replaced by the more heavily weighted shadow u, where w v > w u . According to equations (8) and (7), we can get equations (9) and (10).
where i j ′ ≠ v; where i j ′ ≠ u.
As shown in equation (11), CRP u t (S) is greater than CRP v t (S). erefore, if the threshold is satisfied, the reconstructed image's quality will improve with increasing the weight of one of the shadows.

Experiment and Evaluation
In this section, we give two examples to verify the feasibility of the scheme in the Subsection 4.1 and evaluate the reconstructed image's quality in the Subsection 4.2. en, we compare other weighted SIS schemes in the Subsection 4.3.

Image Illustration.
To verify the feasibility of our scheme, two examples with (2, 4) and (2, 3) thresholds are given using Python in a PC with Windows 10. Figure 3 (

Quality of the Reconstructed Images.
In our scheme, each share is assigned a weight in the sharing phase, and the recovery phase is progressive. Both the weight and the number of shadows affect the quality of the reconstructed image.
e CRP is used to evaluate the quality of the reconstructed images. e greater the CRP value, the better the quality of the reconstructed image, and the more effective our scheme. Equations (4) and (5) are used to compute CRP(S) and CRP t (S). CRP Our (S) represents the actual value of the experiment for our proposed scheme. CRP t (S) denotes the theoretical value. e results of our (2, 4) and (2, 3) threshold weighted schemes are shown in Tables 1 and 2.
From Figure 3 and Table 1, we can draw the following conclusions: (1) Our weighted polynomial-based SIS scheme is effective, and the shadows have weights that can affect the quality of the recovered secret image. (2) e quality of the reconstructed image is consistent with theoretical estimates. (3) When the numbers of shares involved in reconstruction are the same, the greater the sum of the weights is, the better the reconstructed image's quality is. When the sums of the weights of the shares are the same, the more shares involved in the reconstruction are, the better the quality of the  is is because the same method is used to give weight to each share in our scheme and Tan's scheme. e obvious difference between the two schemes is the average light transmission of shares as shown in Figure 6. ere is no obvious difference for the average light transmission of four shares in our scheme. For the remaining n − k shares, we fill with invalid value 0 or 255 randomly. However, the average light transmissions of four shares in Tan's scheme are different. In their scheme, the remaining n − k shares are filled with the corresponding privacy modulus. As the weight increases, the shadow image gets darker. Obviously, this phenomenon will leak out the importance of shadow images and reduce the security of the weighted scheme to some extent.
In general, SIS schemes have many features. Table 3 shows the main characteristics and comparisons of our scheme with related weighted schemes. All schemes listed are weighted schemes. Liu et al.'s, Tan et al.'s, and our schemes with (k, n)-threshold are more flexible than (2, n)-threshold of Hou et al. and Yang et al. Image format, lossless recovery, and additional information are related to the sharing method. Compared to the methods based on VSS and the CRT, our polynomial-based scheme has many advantages, such as less computation, less additional information, and lossless recovery. Meanwhile, compared with Tan's scheme, we overcome the problem that the average light transmissions of shares are not identical.

Conclusion
In this paper, a weighted SIS scheme with lossless recovery is proposed. Each share has a weight. e larger the weight is, the greater the influence on the reconstructed image's quality is, when it participates in the recovery. When the threshold of secret image recovery is satisfied, the number and weight of share can affect the reconstructed image's quality. When all shares are involved in the reconstruction, the reconstructed image can be lossless. And we overcome the problem that the average light transmissions of shares are not identical. eoretical analysis and experimental results show the effectiveness of the scheme. In future work, we will extend our weighted SIS scheme for color images and study the polynomial-based SIS scheme in the field of GF (2 8 ).

Data Availability
Some or all data, models, or code generated or used during the study are available from the corresponding (chen-jia9624@nudt.edu.cn) author upon request.

Conflicts of Interest
e authors declare that they have no conflicts of interest.