Privacy-preserved data hiding using compressive sensing and fuzzy C-means clustering

Nowadays, digital images are confronted with notable privacy and security issues, and many research works have been accomplished to countermeasure these risks. In this article, a novel scheme for data hiding in encrypted domain is proposed using fuzzy C-means clustering and compressive sensing technologies to protect privacy of the host image. The original image is preprocessed first to generate multiple highly correlated classes with fuzzy C-means clustering algorithm. Then, all classes are further divided into two parts according to proper threshold. One is encrypted by stream cipher, and the other is encrypted and compressed simultaneously with compressive sensing technology for easy data embedding by information hider. The receiver can extract additional data and recover the original image with data-hiding key and encryption key. Experiments and analysis demonstrate that the proposed scheme can achieve higher embedding rate about additional data and better visual quality of recovered image than other state-of-the-art schemes.


Introduction
With the continuous development of computer network technology, more and more data, especially the multimedia data (images, audios, and videos) captured by the sensors, are uploaded to cloud platforms by users to alleviate storing and computing burdens. 1 However, some unexpected results may happen under this circumstance, such as some illegal individuals or groups infringe copyright, disclose privacy, steal commercial confidential information, and so on. Therefore, how to manage users' data in the complex network environment with a privacy-preserved way has become an urgent problem for the enterprises. 2 Digital image is one of the most typical multimedia. An important feature of digital images is data redundancy, which means that strong correlations always exist in the spatial domain of natural images. This is also the reason why images can be compressed effectively. In addition, because the information entropy of the image is generally far from the maximum value, data hiding in the host image is possible. Data hiding has been considered as an effective way to manage the host media in terms of data authentication, protection, classification, retrieval, and so on. 3-5 1 Generally, there are two criterions to evaluate the performance of data hiding. One is data embedding capacity, which can be measured by bit per pixel (bpp). The other is the quality of stego-image, which can be measured by peak signal-to-noise ratio (PSNR). 2,6 With the aim of preserving privacy, a growing number of original data is encrypted before uploading it onto the cloud. [7][8][9][10] Therefore, data hider needs to embed additional information into encrypted images directly without knowing any information about the original data, which is called data hiding in encrypted image. 2,6,[11][12][13][14][15][16] Compared with traditional data hiding in plaintext image, few redundancy spaces can be used to embed additional data, since the information entropy of the host media is close to the maximum value after encryption. In other words, encryption brings new challenge to data hiding. 17 To perform data hiding in encrypted images effectively, additional space should be vacated in the host image. According to the sequence of creating additional space and encryption, existing embedding mechanisms in encrypted image can be classified into reserving room before encryption (RRBE) 11,15,18 and vacating room after encryption (VRAE). [12][13][14]19,20 However, both of the two schemes have disadvantages. RRBE-based embedding mechanism demands extra preprocessing operation for the content owner before image encryption, and VRAE-based embedding mechanism has greater computational complexity due to the maximized entropy after encryption. In contrast, the proposed scheme aims to encrypt image and reserve room simultaneously for effective data hiding.
Image encryption techniques have been greatly advanced recently. 21 One of the most attractive signalprocessing techniques today is compressive sensing (CS), which is used for efficient signal acquiring and reconstructing. The principle of CS is that a sparse signal can be recovered by optimization from far fewer samples than the required according to the Nyquist-Shannon sampling theorem. 22 CS can also be designed with cryptosystem property to achieve signal compression and encryption simultaneously, 23,24 and it is especially suitable for the resource restricted wireless sensors network (WSN). 25 However, data hiding in CS domain is difficult because the information entropy of the signal obtained by CS has increased greatly. Many solutions combining CS with data hiding have been proposed. [26][27][28][29][30][31] Some of them are based on the segmentation or pre-treatment of the host signal, [27][28][29][30] while others processed the measurements directly. 26,31 As stated before, reversible data hiding can only be achieved under the condition that the information entropy of host media has not reached the maximum value. In other words, additional space must be vacated in the encrypted domain before data hiding, and it is better to achieve CS-based encryption and vacating room simultaneously.
Motivated by the requirements of the privacy and fidelity of the host image and high embedding capacity of the additional data, this work proposes a novel privacy-preserved data-hiding scheme. The original image is pre-processed and divided into multiple classes through fuzzy C-means (FCM) clustering algorithm by image owner, and then all classes are classified into two major categories according to the given threshold. The category where the absolute differences of each class are greater than the threshold is encrypted via exclusive-or operation. The other category is encrypted and compressed synchronously by CS technology, where the measurement matrix is served as encryption key. The whole encrypted and compressed image generated will be transmitted to data hider to embed additional information with data-hiding key. After obtaining the marked, encrypted image, the receiver can extract additional information exactly and recover original image with satisfactory visual quality. The proposed scheme can achieve secure transmission of secret data, protection and management of host images by applying data hiding in the CS domain.
The contributions of our scheme are summarized as follows: (1) The original image is divided into multiple classes, but only partial classes whose the absolute difference less than the threshold are compressed to vacate room for additional data. Thus, the visual quality of recovered image can be well guaranteed. (2) The combination of FCM clustering algorithm and CS technology makes full use of the sparsity of original image to achieve higher embedding capacity. (3) By combining CS with cryptosystem, data privacy can be protected effectively while making room for embedding additional information. (4) The result of classification is determined by class number and threshold, and the size of vacated capacity is controlled by CS sampling rate; therefore, the visual quality of the recovered image and the embedding rate of the host image can be adjusted according to specific requirements.
The remaining article is arranged as following. Relevant knowledge is shown in section ''Relevant knowledge.'' The details of our scheme are introduced elaborately in section ''Proposed scheme.'' Experimental results and performance comparisons with other related works are given in section ''Experimental results and performance analysis.'' Finally, section ''Conclusion'' concludes our work.

Relevant knowledge
Tent-logistic chaotic system Chaos system is extremely sensitive to initial state and regulatory parameters, so any slight change of initial state can be exponentially amplified. 32 Tent-logistic chaotic system (TLCS) is a combination of two common one-dimensional (1D) chaotic systems, that is, tent map and logistic map, which are defined by equations (1) and (2) respectively where parameters a 2 ½3:57, 4 and b 2 (1, 2. The TLCS is formulated by equation (3) z(n + 1) = abz(n)½1 À z(n), 0\z(n)\0:5 ab½1 À z(n)f1 À b½1 À z(n)g, 0:5 ł z(n)\1 The chaos range of TLCS is much larger than single logistic or tent system, and it can realize more unpredictability chaotic performance.

CS technology
CS is a novel signal sampling technology described in detail by Donoho. 33 The signal can be sampled randomly by applying the sparse character of nature signal in certain transform domain under the condition that the sampling rate is much lower than Nyquist. Inversely, the original signal can be recovered through the nonlinear reconstruction algorithm accurately or with high probability.
Assume that the original signal x is the N-dimension vector, fc i g N i = 1 represents N-dimension orthogonal vector in space R N , and C = ½c 1 , c 2 , . . . , c N signifies an orthogonal basis. Thus, the signal x can be represented as where u is the projection coefficient vector of signal x on orthogonal basis C. The central problem after sparse representation is to find a proper random measurement matrix F to meet the restricted isometry property (RIP), and the non-adaptive linear sampling process can be expressed as The process can also be shown in Figure 1.
Due to the number of measurements M(N, the random measurement process of a signal is regarded as compression process. We can get the approximate valuẽ x of the original signal by solving the convex optimization problem by equations (6) and (7) min u k k 1 s:t: y = FCu ð6Þ whereũ is the solution of the convex optimization problem andx means the recovered signal.

FCM clustering algorithm
FCM is a fuzzy clustering algorithm based on objective function for data clustering analysis, the core idea of which is the objects divided into the same cluster having the largest similarity but different clusters possessing the smallest similarity. In addition, FCM as an improvement of the ordinary C-means algorithm is a flexible fuzzy division. 34 The explicit process about implementation of FCM is described as follows. Suppose the sample set X = fx 1 , x 2 , :::, x n g, where c and n represent the number of clusters and the number of samples in set, respectively. Here, n samples would be divided into c classes, and the membership matrix of n samples corresponding to c classes is expressed as  which also can be written as U c, n = fu i, j ji 2 ½1, c, j 2 ½1, ng, where each item u i, j of U c, n is the probability of jth sample x j belonging to the ith cluster. Meanwhile, each element u i, j should conform to two restricted conditions represented by equations (9) and (10) Equation (9) means the value of u i, j changing between interval [0, 1], and equation (10) denotes that each x j of X should belong to a definite class. That is, ith cluster (i 2 ½1, c) is with certain probability u i, j , and the sum is equal to 1. The generalized form of objective function about FCM clustering algorithm is shown in equation (11) where parameter V = fV 1 , V 2 , . . . , V c g denotes the cluster centers of each cluster, and the exponent m refers to predefined weighting divisor and impacts the clustering effect indirectly. In reference Bezdek et al., 35 Pal and Bezdek consider that the effect is better when the value of m is in interval [1.5, 2.5]. Thus, the complex problem of fuzzy clustering is transformed to the single issue of minimization of equation (12). d i, j signifies the Euclidean distance between ith cluster center V i and jth sample x j , which can be obtained by equation (12) The implementation of the whole FCM clustering process is illustrated in Figure 2, which is also described step by step as follows.
Step 1. Set cluster number c (2 ł c ł n), weighting exponent m, threshold e used for terminating iteration, random initialization U 0 , and iteration counter b = 0.
Step 2. Update the cluster center matrix V (b) by equation (13) Step 3. Update the fuzzy membership matrix U (b + 1) according to equation (14) Step 4.
\e, output the clustering information including clustering center matrix V and membership matrix U, and stop the process. Otherwise, set b = b + 1 and go to Step 2 to continue next iteration. Note that, Á k k means appropriate distance norm.

Proposed scheme
The proposed scheme mainly consists of image encryption, data hiding, data extraction, and image recovery. The overall framework of our scheme is illustrated in Figure 3. In the phase of image encryption, the original image is encrypted and compressed synchronously via traditional stream cipher and CS technology. As for data hiding, after receiving the whole processed image, data hider can embed additional information directly with data-hiding key to facilitate management and operation of the host data. In the end, the receiver can extract additional information exactly and recovery original image with satisfactory visual quality from the marked, encrypted image.

Image encryption
During this stage, the original image I with size of M 3 N is split into c classes expressed as C = fC 1 , C 2 , . . . , C i , . . . , C c g by FCM clustering algorithm described in section ''Relevant knowledge.'' Then, according to the given threshold T, all classes are divided into two categories C1 and C2 by equations (15) and (16) The classification results of Lena with c = 13, T = 10 and c = 13, T = 15 are shown in Figure 4, in which the white and black regions represent C1 and C2, respectively. Each class in C1 is encrypted by traditional stream encryption, and the gray value of each pixel ranging from 0 to 255 in C1 can be expressed as eight binary bits using equation (17).
In the process of image encryption, all pixels in the same class belonging to categories C1 are encrypted with the same way through equation (18) by encryption key k i generated via TLCS where k i (k) is the random bit corresponding to encryption key k i to encrypt the kth bit plane of the class C1 i , and c1 0 i (x, y, k) represents the encrypted result by key k i (k) and c1 i (x, y, k) with exclusive-or operation. Then, collect all the encrypted binary bits c1 0 i (x, y, k) to generate the cipher class C1 0 i as shown in equation (19), and the final encrypted category C1 0 is produced by making up all cipher classes Meanwhile, each class C2 i in categories C2 is encrypted and compressed simultaneously through CS technology. The measurement matrix is created by TLCS, and initial parameter serving as encryption key. The implementation of encryption and compression is represented by following equations. Each class C2 i where C t 3 t is a transformation matrix sized t 3 t, and u t 3 1 represents homologous sparse transformation coefficient of v t 3 1 , which implies that the signal v t 3 1 could be sparsely represented in certain transform domain. We believe that the signal v t 3 1 is exactly ksparse when C domain has at most k non-zero coefficients. Then, each class C2 i would be encrypted and compressed by projecting v i t onto measurement matrix F with sampling rate r Here, we set H a 3 t = F a 3 t C t 3 t . Equation (21) can be written as follows where a = r 3 t. Thus, there would be (t À a) spaces vacated in each class. Finally, all measurements of classes in categories C2 are quantified to interval [0, 255] to create cipher C2 0 and combine with encrypted result C1 0 to obtain the integrated cipher C 0 . However, to strengthen the security of original content further, C 0 is encrypted again through exclusive-or operation with encryption key k e to generate final encrypted image C e , as shown in equation (23). The entire process of encryption is illustrated in Figure 5 C

Data embedding in encrypted domain
After receiving the cipher image C e , data hider can embed encrypted additional information to it directly with data-hiding key k w , because the size of the original image is decreased through CS technology. In Figure 6, D represents the vacated spaces used for embedding additional data. To realize data extraction and image recovery, some auxiliary information as a part of payload should be embedded into the cipher image, which includes: (1) classes c in interval 1,32 with six bits by letter p for representation, (2) cluster tag of each pixel in original image is marked L, (3) 6-bit delimiter ''0 0 0 1 1 1'' used to differentiate two cipher categories C1 0 , C2 0 and each encrypted class in C2 0 , (4) q bits of classes belonging to categories C1. Thus, the embedding rate r could be calculated by equation (24) r = (1 À r) 3 n 3 8 À L À p À q À 6 3 count m 3 n where n represents the number of pixels compressed by CS technology in categories C2, and count is the number of classes in C2.

Data extraction and image recovery
In this section, there are three cases to handle data extraction and image recovery by receiver. (1) The decrypted operation can be accomplished only when encryption key is available.
(2) Additional data can be extracted precisely only when data-hiding key is available.
(3) Not only additional data can be obtained accurately, but also the decryption can be implemented when both encryption key and data-hiding key are available. The flowchart of this section is illustrated in Figure 7. Only encryption key is available. In this stage, five steps should be executed to accomplish image decryption.
Step 1. Final cipher image C e is decrypted with encryption key k e through exclusive-or operation by equation (25) to obtain cipher C 0 Step 2. According to the auxiliary information, C 0 is classified into two encrypted parts C1 0 and C2 0 .
Step 3. As for C1 0 , the identical operation with encryption process is executed to acquire decrypted category C1 accurately by equation (26) Step 4. And for C2 0 , we reconstruct each class signal with overwhelming probability through solving the following convex optimization problem by equations (27) and (28)   whereũ means the solution of optimization problem andṽ denotes reconstructed signal. We obtain the recovered category C2 until all class is reconstructed.
Step 5. Combine the recovered category C1 and C2 to generate the final decrypted image I o . Note that, we cannot extract any additional information without data-hiding key.
Only data-hiding key is available. In this situation, we can just extract all additional data perfectly with datahiding key without knowing any information about original content. For example, in Figure 6, we can directly extract all information in domain D with datehiding key but we need not know anything about C1 and C2.
Both encryption key and data-hiding key are available. The receiver can not only decrypt cipher image and but also extract additional data with both encryption key and data-hiding key. The order of two operations is exchangeable and independent. That is, the receiver can decrypt cipher image with encryption key first by applying the procedure which is the same as section ''Only encryption key is available,'' and then extract additional data with data-hiding key as stated in section ''Only data-hiding key is available,'' and vice versa.

Experimental results and performance analysis
In this section, to show the effectiveness and superiority of our scheme, sufficient experimental results and comparisons are presented with a mass of standard images. Our experiment is conducted in a personal computer with a 3.20 GHz Inter i5 processor, 4.00 GB memory and MATLAB R2014a in windows 10 operating system. There are mainly two aspects of the experiment, that is, security analysis of cipher image, and performance analysis in terms of recovered image quality and embedding capacity.

Security of cipher image
Histogram analysis. Image histogram is an intuitive means to reflect the distribution status of pixels value in a gray image. In general, an effective encryption scheme should mask the pixel value distribution of original image and generate an absolutely uniform distribution. Histograms of multiple plain images and their corresponding cipher images are given in Figure 8 to show the security performance of our encryption scheme. Information entropy analysis. In 1949, Shannon proposed the concept of information entropy to solve information quantification and measurement problem. In general, information entropy is used for measuring the uncertainty by calculating the probability of a randomness variable appearing. The information entropy H(x) of source x can be calculated by equation (29) H(x) = À where p(x i ) represents the probability of pixel x i , and K means the number of pixels in an image. Ideally, the value of information entropy closer to eight indicates more disordered state and greater uncertainty for a gray-scale image.
where N is the amount of samples, x i and y i represent gray values of selected adjacent pixels in ith pair. In Table 2, it can be found that the pixel correlations in three directions are decreased significantly after encryption, and the cipher images obtained by the proposed encryption scheme has relatively lower correlation coefficients than in previous studies. [41][42][43] An example with Lena image is given in Figure 9 to show distribution of pixel correlation. We can observe that the distribution of adjacent pixel pairs is fairly centralized in plain image but scattered in encrypted image.

Recovered image and embedding rate
In this section, two typical criterions are applied to evaluate quality of recovered images, which are PSNR and structural similarity index measurement (SSIM). We can calculate PSNR and SSIM by equations (33)- (38) PSNR(I, I 0 ) = 10 3 log 10 255 2 MSE ð33Þ where I(x, y) and I 0 (x, y) represent the pixels used for evaluation of original image I and recovered image I 0 at the coordinate (x, y), respectively, and M 3 N denotes the size of images I and I 0 . In general, the value of PSNR closer to positive infinity means that the recovered image I 0 is more similar to original image I SSIM(I, I 0 ) = ½l(I, I 0 ) a ½c(I, I 0 ) b ½s(I, I 0 ) g ð35Þ s(I, where l(I, I 0 ), c(I, I 0 ) and s(I, I 0 ) are three contrast modules constituting the SSIM measurement system, that is, brightness, contrast, and structure. m I , m I 0 , and s I , s I 0 denote the mean values and the standard deviations of images I and I 0 . s II 0 represents the covariance of images I and I 0 . c 1 , c 2 , and c 3 are the constants. And a.0, b.0, g.0, in actual engineering calculation, we set a = b = g = 1 and c 3 = c 2 =2. SSIM can also be calculated by equation (39) SSIM(I, The SSIM value of two images I and I 0 falls in the interval ranging from 0 to 1. The larger the SSIM value, the smaller difference between original image I and recovered image I 0 . Quality of recovered image. Figure 10 shows the experimental results of original images and recovered images with some standard test images sized 512 3 512 under parameters c = 10, T = 5, r = 0.7. PSNR and SSIM of the recovered image are provided to show the performance of the proposed scheme. Figure  10(a1)-(f1) represent original test images with Baboon, bridge, couple, plane, man, and Lena, Figure  10 Figures 11-13 give the quality changes of recovered images with Barbara, peppers, and lake under the condition that two parameters keep invariable, but the other is changing. It can be     Table 7. And it can be found that our scheme has higher embedding rate than the literatures [36][37][38][39][40] and in previous studies. 12,15,44 Conclusion In this article, we proposed a privacy-preserved datahiding scheme in encrypted domain by FCM clustering and CS technologies. Low-correlated classes of the     works. However, an obvious deficiency is the indistinctive improvement of recovered image quality caused by CS reconstruction even when the embedding capacity is lower. Thus, we expect especially that a more precise and appropriate CS reconstruction algorithm can be explored to optimize the visual quality of reconstructed image.

Declaration of conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.