IEEE SIGNAL PROCESSING LETTERS, VOL. 21, NO. 7, JULY 2014 853

A Lossless Tagged Visual Cryptography SchemeXiang Wang, Member, IEEE, Qingqi Pei, Member, IEEE, and Hui Li

Abstract—As one of the most efficient multi-secret visualcryptography (MVC) schemes, the tagged visual cryptography(TVC) [1] is capable of hiding tag images into randomly selectedshares. However, the encoding processes of TVC and other MVCschemes bring distortion to shares, which definitely lowers thevisual quality of the decoded secret image. This letter proposes anextended TVC scheme, named as lossless TVC (LTVC). Specifi-cally, “lossless” means that the proposed LTVC scheme encodesthe tag image without affecting the rebuilt secret image, i.e., thedecoded secret image of LTVC has the same visual quality withthat of the conventional VC scheme [2]. Moreover, we proposethe probabilistic LTVC (P-LTVC) to solve the potential securityproblem of LTVC. Finally, the superiority of the proposed schemeis experimentally verified.

Index Terms—Multi-secret sharing, visual cryptography, visualsecret sharing.

I. INTRODUCTION

T HE security of data is currently one of the most urgentissues to which many researchers have paid a lot of at-

tention. The visual cryptography (VC) proposed by Naor andShamir [2] is a technique that safely shares a secret image tomany participants. A ( ) VC scheme encodes a secret imageinto noise-like shares (called transparencies or shadows). Anyor more shares visually reveal the secret image when they are

superimposed together. Whereas any less than shares discloseno information of the secret image. The charm of VC is thatthe decoding process requires neither computational device norcryptographic knowledge, and the secret image is reconstructedeasily via the human visual system. Hence, for the applicationsin which the computing devices for decryption are not avail-able or too costly, VC becomes a reliable and handy techniqueto accomplish the sharing of digital images. However, the VCtechnique would be much attractive if more information can behidden within the encoding process. Therefore, multi-secret vi-sual cryptography (MVC) scheme deserves further study fromboth theoretical and practical perspectives [3]–[5].

Manuscript received May 13, 2013; revised January 07, 2014; accepted April04, 2014. Date of publication April 16, 2014; date of current version April 28,2014. This work was supported by the National Natural Science Foundationof China under Grants 61202391, 60803150, and 61373170, the 111 Projectunder Grant B08038, the Postdoctoral Science Foundation of China under Grant2012M521748, and by the Program for New Century Excellent Talents in Uni-versity under Grant NCET-11-0691. The associate editor coordinating the re-view of this manuscript and approving it for publication was Prof. Shantanu D.Rane.The authors are with the State Key Laboratory of Integrated Service

Networks, Xidian University, Xi’an, Shaanxi 710071, China (e-mail: wangx-iang@xidian.edu.cn; qqpei@mail.xidian.edu; lihui@mail.xidian.edu.cn).Digital Object Identifier 10.1109/LSP.2014.2317706

Wang and Hsu [1] proposed a tagged VC (TVC) scheme inwhich more secret images can be revealed by the folding up op-eration. Specifically, when we fold up a share along its midline,an additional secret image is visually presented. Obviously, thefolding up operation is easier for participants.However, both MVC and TVC scheme have a problem that

they inevitably bring distortion to the shares of conventionalVC. Consequently, the secret image disclosed by stacking theshares in MVC or TVC has lower quality than that of Naor andShamir’s conventional VC. To deal with this problem, this letterproposes a lossless TVC (LTVC) scheme which hides multiplesecret images without affecting the quality of the original secretimage. As a result, the decoder can rebuild exactly the identicalsecret image as that of conventional VC. In other words, theshares are losslessly modified to hide the tag images.

II. PROPOSED METHOD

For simplicity of description, several notations are first in-troduced. For an integer , denotes its complement. For aninteger array , we define to rep-resent the its complementary array, and use the functionto return its length. For an integer matrix

, we define the following notations.• is the element which stacks together with

when we fold up along the mid-line. Obvi-ously, . We denote andas a folded-up pair.

• and are used to represent the elements ofthe y-th column and the x-th row of , respectively.

• ,where ; and

, where.

A. Backgrounds

The proposed LTVC scheme first uses Naor and Shamir’sconventional VC technique [2] to encode the secret image toseveral shares, and then hides the tag images into these sharesby visual-losslessly adjusting the pixels. Before introducing theproposed LTVC method, Naor and Shamir’s VC constructionmethod is reviewed.A ground set is first defined in the

conventional ( )-VC. Clearly, has different subsets. Letdenotes the collection of all sub-

sets of even elements, i.e., is the subset of with even ele-ments, and is the collection of allsubsets of odd elements, i.e., has odd number of elements.Then, the white and black pixel basis matrices and withsize are generated as follows:

1070-9908 © 2014 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

854 IEEE SIGNAL PROCESSING LETTERS, VOL. 21, NO. 7, JULY 2014

(1)

When share a white (resp. black) pixel, the dealer randomlypermutes the columns of (resp. ), and each row of thepermuted (resp. ) corresponds the sub-pixels in one ofshares. Ref. [2] has proved that this construction satisfies the

security and contrast conditions.Further restricting a basis matrix to amatrix by deleting a row in all possible way, we get a

collection , where . Here,we give three lemmas of .Lemma 1: For a matrix in , , each column ofcan find one and only one complementary column in every

matrix of .Proof: According to the property of maximum linearly in-

dependent group, we can easily prove that each column of thematrix in can find a complementary column in the same ma-trix. In addition, the Security condition of VC indicates that anymatrices in and are indistinguishable in the sense thatthey contain the same columns (but with different positions). So,we can reasonably extend this prove as follows: each column ofthematrices in has one and only one complementary columnin any matrix in , for .Lemma 2: For two columns and , if

, then andhave the following relationship:

• if is even and , ;• if is odd and , ;• if is even and , ;• if is odd and , .Proof: If , we should ensure that the subset

corresponding to column and have thesame parity. In addition, the complementary relationship be-tween and indicates that

. When is even,and do not have the same parity.

Therefore, if is even, and ,and if is odd, the set while .As a result, we get that . On thecontrary, if is odd, and have thesame parity. Similarly, the set and should both have theelement (if is odd) or both not (ifis even), which proves that . Notethat, the above derivation can easily extend to .Lemma 3: Every matrix in or has one column which

only has white pixels, and one column whose pixels are allblack.

Proof: Note that has one column (corresponding to the) which is all white pixels. Suppose the column is

. So, the j-th column of eachmatrix of only has whitepixels as well. According to Lemma 1, we can obtain that eachmatrix of should has a column which only has black pixels.Then, based on the Security condition of VC, we can prove that

there is one column of every matrix of that only has blackpixels, and one column that only has white pixels.

B. ( )-LTVC Scheme

The same encoding process as VC, a ( )-LTVCscheme first encode the secret image into shares

. If or more shares are avail-able, we can stack them together to reveal the secret image(the Contrast requirement). While any less than shares

should disclose no information of (the Security requirement).Besides revealing the secret image, the ( )-LTVC has theability to disclose several tag images by the folding operation.In this section, we first describe the ( )-LTVC scheme.The input of the proposed ( )-LTVC scheme includes a se-

cret image and tag images . The outputare shares: . Stacking shares together, wecan visually present the secret image , and the particularof shares can disclose tag images by using the foldingoperation.Considering a folded-up pair and , the

conventional VC encodes these two pixels independently.Contrastly, the LTVC first shares using conven-tional VC. Then, is encoded according to shares of

. Define the sub-pixels of in shares are:. For each

pixel of the secret image generates sub-pixels inone share, we can obtain that and

.Suppose the first shares are selected to embed the

tag images. Collecting these shares together generates amatrix , and each row of corre-

sponds to one share of . Reviewing the construction ofand , we know that belongs to (if ),

or (if ). We then sequentially collect the pixelslocating at in the tag images, which produces avector . Noticethat the columns of are all possible combinationsof the binary values. Therefore, there is a column inwhich is exactly identical with . We denote this columnas . According to Lemma 1, has a com-plementary column of , and this column is de-noted as . In addition, there are a black columnand a white column in (Lemma 3), and define these twocolumns as and . Finally, weconstruct a matrix as follows:

(2)

where is constructed to represent the first shares of, and the function returns the

column position of which stacks together with the y-thcolumn of after the folding operation, i.e.,and constitute a fold-up pair, where

.

WANG et al.: A LOSSLESS TAGGED VISUAL CRYPTOGRAPHY SCHEME 855

We then analyze the light transmission of the tag images.When we fold up the share images, and( ) are stacked together, and denote the stackedvector as . According to Eq. (2), the value of iscomputed as:

(3)

If , have two white pixels. While, if, only consists of black pixels. Therefore,

the contrast of the tag image is .The first shares of are constructed according

to . Specifically, each share corresponds one row of:

(4)

where .Finally, we construct the last share of . Lemma 1

indicates that each column of has a complementarycolumn in . Suppose the column ofis the complementary column of . Then, the pixel

of the last share of is determined as:

(5)

where and .Notice that the last share is constructed without hiding thepixels of the tag image. Furthermore, we design Eq. (5) basedon Lemma 2, which ensures that the constructed shares areidentical with the ones of conventional VC.Lemma 1-3 indicates that the sub-pixels of con-

structed by LTVC are the shares of conventional VC aswell. Collecting shares of (resp. ) together,we get a matrix (resp. ). When

, each column of can find a com-plementary column in (Eq. (2) and (4)). ReviewingLemma 1, we can easily get that and have thesame columns, but the columns are distributed in differentlocations. Therefore, the rows of are also the sharesconstructed by conventional VC. When ,according to Lemma 2 and Eq. (4), we know that isidentical with the shares of conventional VC as well. Obvi-ously, the shares constructed by the proposed method satisfythe Security and the Contrast condition.The proposed ( )-LTVC can be easily extended to Droste’s

( )-VC [6] scheme. Specifically, we uses Droste’s method toconstruct the ( ) basis matrices and , and the embed-ding process of tag images are the same as that of ( )-LTVC.

C. Further Discussion of Security and P-LTVC

We consider a sub-pixel , where. Notice that stacking

the pixels and generates

. Notice that, is the complementarycolumn of , i.e.,

Therefore, we obtain that:

Clearly, reveals the XOR relationship ofand . Theoretically, we cannot get any information of

or based on , which also satisfies thesecurity condition. However, for the images that have largesmooth area, may disclose some secret information.To deal with this issue, we propose an improved LTVC,

named as probabilistic LTVC (P-LTVC). In P-LTVC, thematrix is constructed as follows:

(6)

where is a randomly selected column from, and should not repeat with any other

columns of . Notice that, in Eq. (2), we define. However, of Eq. (2) is

defined as follows:

Here, is obtained by randomly selecting 1 of el-ements of and applying the complement operation to thiselement with 50% probability. is constructed to ensurethat folding up the last share does not reveal the informationof the tag images. Then, the last share is constructed by usingEq. (4), which is the same as LTVC.We then compute the light transmission of P-LTVC. The

construction of indicates that if the tag pixel is white, wehave and with the prob-ability , and .However, we cannot determine the pixel value for othersub-pixels of , because the corresponding columns of

are constructed randomly. Here, we calculate thelight transmission of from a probabilistic perspective.Clearly, each pixel of and is assigned to 0 witha probability 50% and to 1 with a probability 50%. Since onlyboth of pixels are white, their stacking result is white. So,the light transmission of other sub-pixels of is 0.25.Similarly, if is carrying a black tag pixel, we have

and with the probability, and . And the

probabilistic light transmissions of other sub-pixels inare also 0.25. As a result, the contrast of the tag images is

, which is a little worse than that of LTVC.

III. EXPERIMENTAL RESULTS AND DISCUSSION

The proposed LTVC and P-LTVC schemes are comparedwith Wang et al.’s TVC scheme [1] to evaluate the perfor-

856 IEEE SIGNAL PROCESSING LETTERS, VOL. 21, NO. 7, JULY 2014

Fig. 1. Performance comparison between Wang et al.’s (4, 4)-TVC, (4, 4)-LTVC and (4, 4)-P-LTVC. (a)-(d) are tag images, and (e) is secret image. (f)-(i), (k)-(n)and (p)-(s) are decoded tag images of TVC, LTVC and P-LTVC, respectively. (j), (o) and (t) are decoded secret images of TVC, LTVC and P-LTVC, respectively.

mance. Naor et al.’s ( )-VC and Droste et al.’s ( )-VC areintroduced to share the secret image. In the experiment, fourbinary images are used as tag images (Fig. 1(a), 1(b), 1(c) and1(d)), and one binary carton image is used as the secret image(Fig. 1(e)). Fig. 1 presents the results of the (4,4) TVC, LTVCand P-LTVC schemes, respectively. The results consist of thedecoded tag and secret images.The experiment results indicate that the LTVC produces the

best performance in contrast on both tag and secret images.Specifically, in ( )-LTVC, the contrasts of the tag and thesecret image are and , respectively. In compar-ison, the corresponding contrasts of ( )-TVC are 9/64 and

, and of ( )-P-LTVC are and ,where indicates the pixel extension. Therefore, the decodedsecret image of LTVC always has higher quality than that ofTVC. In addition, when , LTVC produces better tag imagethan TVC. Whereas, only when , TVC performs betteron tag images than LTVC. However, we denote that P-LTVCfinds the best trade-off between contrast and security: it does nothave the security problem of LTVC and still has higher contrastthan TVC. More importantly, the contrast of the secret image ofP-LTVC is also the same as that of conventional VC.However, one drawback of the proposed LTVC and P-LTVC

is that we encrypt less information than TVC. For the( )-LTVC and ( )-P-LTVC, only tag imagescan be encrypted. While the ( )-TVC is able to encrypttag images. This problem becomes more obvious in the ( )scheme: the TVC can encrypt tag images, and unfortunately,LTVC and P-LTVC still only encrypts tag images.

IV. CONCLUSIONS

This letter proposed a lossless multi-secret visual cryptog-raphy method based on conventional VC scheme. The proposed( ) and ( ) LTVC and P-LTVC schemes can embed addi-tional tag images as well as the secret image. Stackingshares together reveals the secret image, and folding up one

of specific shares discloses the tag image. Comparedwith other multi-secret scheme, the most important advantageof LTVC and P-LTVC is that the embedding of tag images doesnot lower the quality of the original secret image. The experi-mental results illustrate that the stacking results of LTVC andP-LTVC has a higher contrast than that of previous tagged vi-sual cryptography method.

REFERENCES[1] R.-Z. Wang and S.-F. Hsu, “Tagged visual cryptography,” IEEE Signal

Process. Lett., vol. 18, no. 11, pp. 627–630, 2011.[2] M. Naor and A. Shamir, “Visual cryptography,” in Advances in Cryp-

tology–EUROCRYPT 1994, ser. Lecture Notes in Computer Science,A. De Santis, Ed. Berlin/Heidelberg, Germany: Springer, 1995, vol.950, pp. 1–12.

[3] C. Wu and L. Chen, “A study on visual cryptography,” Master Thesis,Inst. Comput. Inf. Sci., National Chiao Tung Univ., Hsinchu, Taiwan,1998, R.O.C..

[4] J.-B. Feng, H.-C. Wu, C.-S. Tsai, Y.-F. Chang, and Y.-P. Chu, “Visualsecret sharing for multiple secrets,” Patt. Recognit., vol. 41, no. 12, pp.3572–3581, 2008.

[5] S.-J. Shyu and K. Chen, “Visual multiple secret sharing based uponturning and flipping,” Inf. Sci., vol. 181, no. 15, pp. 3246–3266, Aug.2011.

[6] S. Droste, “New results on visual cryptography,” in Advances in Cryp-tology–CRYPTO 1996, ser. Lecture Notes in Computer Science, N.Koblitz, Ed. Berlin/Hedielberg, Germany: Springer, 1996, vol. 1109,pp. 401–415.