sryptography

3830 IEEE TRANSACTIONS ON IMAGE PROCESSING, VOL. 22, NO. 10, OCTOBER 2013

Image Size Invariant Visual Cryptography forGeneral Access Structures Subject to Display

Quality ConstraintsKai-Hui Lee and Pei-Ling Chiu

Abstract— Conventional visual cryptography (VC) suffers froma pixel-expansion problem, or an uncontrollable display qualityproblem for recovered images, and lacks a general approachto construct visual secret sharing schemes for general accessstructures. We propose a general and systematic approach toaddress these issues without sophisticated codebook design. Thisapproach can be used for binary secret images in non-computer-aided decryption environments. To avoid pixel expansion, wedesign a set of column vectors to encrypt secret pixels ratherthan using the conventional VC-based approach. We begin byformulating a mathematic model for the VC construction prob-lem to find the column vectors for the optimal VC construction,after which we develop a simulated-annealing-based algorithmto solve the problem. The experimental results show that thedisplay quality of the recovered image is superior to that ofprevious papers.

Index Terms— Visual secret sharing scheme, pixel expan-sion, general access structures, optimization, controllable displayquality.

I. INTRODUCTION

V ISUAL cryptography (VC), which was proposedby Naor and Shamir, allows the encryption of

secret information in image form [1]. Following theirwork, much research was done on visual secret shar-ing schemes (VSSs) [2]. From the point of view ofaccess structures, the existing VC schemes (VCSs) canbe divided into two categories: threshold access structure(also known as k-out-of-n VCSs or (k, n)-VCSs) [3]–[5]and general access structure (GAS) [6]–[12]. Naor and Shamirfocused on how to generate n shares such that the secret imageis revealed by at least k shares (2 ≤ k ≤ n).

Ateniese et al. (hereinafter Ateniese) [6] proposed the GASconcept and also developed a VC-based solution for someGASs. Using the GAS enables dealers to define reasonablecombinations of shares as decryption conditions rather thanto specify the number of shares. For example, if there arefour participants (one president, one vice president, and two

Manuscript received July 26, 2012; revised March 2, 2013; acceptedApril 29, 2013. Date of publication May 13, 2013; date of current versionAugust 28, 2013. This work was supported in part by the National ScienceCouncil of Taiwan under Contracts NSC 101-2221-E-130-018 and NSC101-2410-H-130-001. The associate editor coordinating the review of thismanuscript and approving it for publication was Prof. Jana Dittmann.

K.-H. Lee is with the Department of Computer Science and Informa-tion Engineering, Ming Chuan University, Taoyuan 33348, Taiwan (e-mail:[email protected]).

P.-L. Chiu is with the Department of Risk Management and Insurance, MingChuan University, Taipei 111, Taiwan (e-mail: [email protected]).

Digital Object Identifier 10.1109/TIP.2013.2262290

managers) sharing a secret, the president may expect to decryptthe secret with any single colleague who holds one of theother shares, whereas the vice president is allowed to obtainthe secret only with two managers. The two managers arerestricted from accessing the secret. Given these flexibilities,we also can set the number of shares as the decryptingcondition. Clearly, (n, n)- and (k, n)-VCSs are special casesof the GAS.

The pixel-expansion problem is a major drawback withmost VCSs that use the VC-based approach. The pixel-expansion problem affects the practicability of a VCscheme because it increases the storage and/or transmis-sion costs. Moreover, the pixel-expansion problem usuallyintroduces the side effect that the recovered secret imageshave less contrast. The contrast of the recovered imagesdecreases in proportion to 1/m, whereas the shares areexpanded by a factor of m times. As a result, the decreasein contrast limits the application of these VC schemes.To address the pixel expansion problem, Adhikari et al.also proposed construction methods for VCSs for GASs;their approach aims to reduce the pixel expansion factor for(k, n)-VCSs [10]. Hsu et al. (hereinafter Hsu) used the proba-bility concept to construct a VCS for GAS [7], [8]. However,Hsu’s method does not guarantee enough blackness in someaccess structures, such that recovered images cannot be recog-nized by the naked eyes. Liu et al. proposed a deterministicconstruction method for GASs to balance the drawbacks ofdisplay quality and pixel expansion [9].

The display quality of a recovered image is affected not onlyby its contrast value but also by its blackness [5], [13]. Thedegree of blackness represents the probability that black secretpixels will be accurately recovered. An image that has highercontrast should have better display quality when the blacknessis fixed [5]. However, a greater blackness value (e.g., 100%)may decrease the contrast value of the recovered image. Inthis paper, we take blackness as one of the design factors toimprove the display quality of recovered images.

In the past decade, a number of researchers have devel-oped optimization models to address various VC construc-tion problems [7], [8], [12], [13]. They have formulated thethreshold VCS for maximizing contrast or minimizing pixelexpansion as a linear programming problem. Koga proposeda general formula to find the basis matrices for (k, n)-VCSsby the exhaustive search method; its objectives were to bothmaximize the contrast and minimize the pixel expansion [13].

1057-7149 © 2013 IEEE

LEE AND CHIU: IMAGE SIZE INVARIANT VC FOR GASs 3831

Recently, Lee and Chiu (hereinafter Lee) proposed a genericVC construction method for general access structures [12].Their approach can perfectly recover black secret pixels, butit results in decreasing contrast of recovered images in someaccess structures. From our review, we note that the existingVCS construction algorithms for GASs cannot simultaneouslyavoid the pixel-expansion problem and guarantee an acceptableblackness. These issues motivated us to develop a systematicapproach to the construction of size invariant VCSs (SIVCSsor VCSs in short) for GASs subject to the adjustable displayquality of recovered images.

The proposed approach for SIVCSs is applicable to binarysecret images and no computational devices are needed duringthe decryption phase. First, we formulate a mathematicaloptimization model for the problem of the SIVCS for GASswhere the objectives are to maximize the worst and averagecontrast of recovered images simultaneously under a blacknessconstraint. Using this model, dealers can adjust the blacknessdepending on the characteristics of the secret images to obtainthe best display quality for the recovered images. Then, wedevelop a simulated-annealing-based algorithm to solve thecombinatorial optimization problem. Finally, we compare ourresults with other approaches and present implementationresults to evaluate the effectiveness of the proposed algorithm.

The remainder of this paper is organized as follows:Section II presents a review of background and related work.In Section III, we introduce our model. The proposed opti-mization model and the solution algorithm are introducedin Section IV. In Section V, we show the results of anexperiment that was performed to evaluate the performanceof the proposed method. Finally, we summarize and concludeour work in Section VI.

II. BACKGROUND AND RELATED WORK

A. Background of General Access Structures

Suppose P = {1, . . . ,n} is a set of n participants, and 2Pdenotes the power set of P . The quantity �Qual denotes the setof subsets of P from which we wish to share the secret; thus,�Qual ∈ 2P . Each set in �Qual is said to be a qualified set,and each set not in �Qual is called a forbidden set (denotedas �Forb). Obviously, �Qual ∪�Forb = 2P and �Qual ∩�Forb =∅. Based on these definitions, a VCS for an access structure(�Qual, �Forb) on P can yield n shares. When we stack togetherthe shares associated with the participants in any set X ∈�Qual, we can recover the secret image, but any X ∈ �Forbhas no information on the stacked image.

The quantity �0 consists of all the minimal qualified sets:

�0 = {A ∈ �Qual : A′ /∈ �Qual ∀A′ ⊂ A}.In traditional secret sharing schemes, �Qual increases monoton-ically and �Forb decreases monotonically, the access structure(�Qual, �Forb) is said to be strong, and �0 is called a basis. Ina strong access structure,

�Qual = {C ⊆ P : B ⊆ C for some B ∈ �0},and we say that �Qual is the closure of �0. If �Qual = �0,then the access structure (�Qual, �Forb) is said to be weak.

For example, if three participants share a secret image (i.e.,P = {1, 2, 3}) and �0 = {{1, 2} , {1, 3}}, in the strong accessstructure (�Qual, �Forb)-VCS, stacking any set of subsets {1, 2},{1, 3}, or {1, 2, 3} can reveal the secret image; otherwise, noinformation can be displayed. However, in the weak accessstructure (�0, �Forb)-VCS, only stacking sets {1, 2} and {1, 3}can reveal the secret image; the image is not guaranteed to berevealed with set {1, 2, 3}.

B. Review of VCSs for GASs

1) Ateniese’s Approach: In 1996, Ateniese first proposeda VC-based approach for VCSs for GASs. They mapped aVCS access structure to a graph and found both the lower andupper bounds on the size of the shares (i.e., the pixel-expansionfactor) from the graph. They gave minimum pixel-expansionfactors as well as basis matrices for VCSs for strong accessstructures for a maximum of four participants [6].

MacPherson extended Ateniese’s model to include grey-scale images and derive new results on the minimum possiblepixel expansion for all possible GASs on at most four par-ticipants. However, a method for constructing the grey-scaleVCSs for GASs remains an open problem [11].

As with other conventional VC-based approaches, theabove-mentioned VCS approach for GASs also suffers fromthe pixel-expansion problem. There also are other drawbackswith Ateniese’s approach. For example, black secret pixelscannot be completely recovered, the aspect ratio of the recov-ered image cannot be maintained, and this approach needs asophisticated codebook design.

2) Hsu’s Approach: In 2006, Hsu, for the first time, reportedthe formulation of an unexpanded VCS for a GAS problemas an optimization model [7], [8]. Their method adopts a setof n × 1 column vectors to share a secret pixel to encrypt nparticipants, thus eliminating the drawbacks of pixel expan-sion. Based on the model, a probability matrix can be foundand used to encrypt a secret for a specific access structure.Hsu’s objective is to maximize contrast values for all qualifiedrecovered images subject to the security constraint. They usethe goal-programming technique and also develop a genetic-based algorithm to solve the optimization problem [7], [8].

Hsu’s approaches have better maximum and average con-trast values for recovered images than Ateniese’s results insome cases. However, Hsu’s method still has problems. First,the approach is probabilistic, which leads to poor visual qualityfor the recovered secret images when the blackness of theimages is low. Second, Hsu’s objective cannot guarantee anacceptable contrast level for recovered images in the worstcase [8].

3) Lee’s Approach: Lee proposed the formulation of aSIVCS for strong general access structures, (�Qual, �Forb),based on the probabilistic (n, n)–VCSs [12]. Lee’s approachis to find the quantity of basis shares and a construction set fora given access structure. The basis shares that were yielded bythe probabilistic (n, n)–VCSs are used to synthesize the sharesof (�Qual, �Forb)-VCS according to the construction set.

For example, suppose there are four participants, P ={1, 2, 3, 4}, who share a secret image and the qualified set


is �Qual = {{1, 2} , {1, 2, 3} , {1, 2, 4} , {1, 3, 4} , {1, 2, 3, 4}}.The VCS for (�Qual, �Forb) can be constructed by 3 basisshares and construction set C = {{s1} , {s2, s3} , {s2} , {s3}}.Hence, the encryption procedure generates 3 basis sharess1, s2, and s3 by utilizing the construction of an existing(3, 3)-VCS. Then, by construction set C, the procedure con-structs 4 shares, S1, S2, S3, and S4, for the (�Qual, �Forb)-VCS.That is, assign basis shares s1, s2, and s3 to shares S1, S3,and S4, respectively; Stack shares s2 and s3 together and thenassign the stacked share to S2. Obviously, upon stacking allshares in any qualified set in �Qual, the secret image can berestored as same as the (3, 3)-VCS can do.

Lee’s approach utilizes pixel-expansion-free (n, n)-VCSto synthesize the strong (�Qual, �Forb)-VCS, therefore, theapproach also can avoid the pixel expansion problem. Lee’sapproach has the following drawbacks. First, it relies onexisting (n, n)-VCS, so the visual quality of recovered imagesdepends on the (n, n)-VCS. Second, the encryption processneeds two phases to generate shares.

III. THE PROPOSED MODEL

The main idea behind the proposed SIVCS is the probabilis-tic visual cryptography (ProbVC) which was first proposed byIto et al. in 1999 [4]. Ito et al. constructed the (k, n)-VCSby using two collections of column vectors, C0 and C1, whichare transformed from basis matrices of the conventional (k, n)-VCS. Suppose the basis matrix contains n×m entries, C1 (C0)will contain m n×1 column vectors. To share a black (white)pixel, one of the column vectors in C1 (C0) is randomly chosenand then distributes i -th entry in the column vector to i -thshare. For example, the (2, 3)-ProbVC scheme is constructedby the following collections of column vectors

C0 =⎧⎨

⎩

⎡

⎣111

⎤

⎦ ,

⎡

⎣000

⎤

⎦ ,

⎡

⎣000

⎤

⎦

⎫⎬

⎭and

C1 =⎧⎨

⎩

⎡

⎣100

⎤

⎦ ,

⎡

⎣010

⎤

⎦ ,

⎡

⎣001

⎤

⎦

⎫⎬

⎭

C1 and C0 are transformed from two 3×3 basis matrices of theconventional (2, 3)-VCS. For encrypting a black secret pixeland suppose the chosen column vector is

[0 1 0

]T, the pixels0, 1, and 0 are distributed to shares 1, 2, and 3, respectively.In this fashion, each secret pixel within a secret image isencrypted in only one pixel in each constituent share. Thus,image size of shared and stacked images is same as the secretimage.

The approach of Ito et al. has to rely on existing basismatrices of the conventional VCSs. To relax the limitation,Yang proposed general construction rules for (k, n)-ProbVCSin 2004 [3]. Both of Ito et al. and Yang have proved theProbVC is as secure as the conventional VCSs.

In the present study, we develop a general constructionmethodology for SIVCSs for GASs. To state our conceptformally, we first present our definitions as follows.

Definition 1: The n-tuple Boolean column vector S = [s j ]Twith 1 ≤ j ≤ n, is defined as an encoding pattern for

each original pixel, where s j= 0(1) denotes that the pixel isencoded as a white (black) sharing pixel in share j .

Definition 2: Suppose P = {1, . . . ,n} is a set of n partic-ipants and 2P denotes the power set of P . When a set ofparticipants X with X ∈ 2P\∅, stack their shares (which wereencrypted by vector S) together, the visual effect (i.e., black orwhite) of a stacked pixel can be obtained by L (vX ) = sp1 +sp2+. . .+spk , where k = |X | and p1,…, pk ∈ X . The quantityvX is a k-tuple column vector, vT

X= [sp1 sp2 . . .spk ], and theoperator “+” represents the OR operation. If L(vX ) = 1 (0),the corresponding pixel will be decoded as black (white) onthe stacked image.

Example 1: Suppose P = {1, 2, 3} and two participantsstack their shares together. At a coordinate, pixel values ontheir shares are black, white, and white, respectively. Thecolumn vector of participants 1 and 2 is vT{1,2} =

[s1 s2

] =[

1 0]

and their stacked pixel is black, which can be calculatedby L

(v{1,2}

) = s1+ s2 = 1. The column vector of participants2 and 3 is vT{2,3} =

[s2 s3

] = [ 0 0]

and their stacked pixel iswhite, which can be calculated by L

(v{2,3}

) = s2 + s3 = 0.Blackness is an important factor for recovered images.

The blackness of a binary image denotes the appearance fre-quency of black pixels in the image. In VC-based approaches,the blackness of a recovered image is proportional to theHamming weight H(V) of the “OR”-ed m-vector V, whichis stacked by m shared subpixels of participants [1]. In aconventional (2, 2)-VCS, the basis matrices for white and

black secret pixels are

[0 10 1

]

and

[0 11 0

]

; hence, the blackness

of white and black secret pixels are H([

0 1]) = 1 and

H([

1 1]) = 2, respectively. Similarly, in this study, the

blackness of recovered image can be determined by the “OR”-ed operation of all column vectors [3].

Definition 3: Suppose P = {1, . . . ,n} is a set of n par-ticipants that share an image encoded by an encoding setC = {Si , 1 ≤ i ≤ m}, where Si= [si, j ] is an n-tuple Booleancolumn vector. For any subset set X ,

{i1, i2, . . . , iq

}is all

members of X with{i1, i2, . . . , iq

} ⊂ {1, 2, . . . , n}. Let VC,Xdenotes the collections of q-tuple vectors that are obtained byrestricting each n-tuple vector in C to rows i1, i2, . . . , iq . Theset λC,X =

{L(vi,X

),∀vi,X ∈ VC,X, X ∈ 2P\∅} represents

the stacked result of all shares in X . The blackness ofthis recovered image is H

(λC,X

)/m, where H

(λC,X

)is the

Hamming weight of λC,X.The contrast for the recovered image is one of the major

metrics for evaluating the performance of VCSs. For a recov-ered (binary) image of VCSs, the contrast of the image is thedifference in the blackness of recovered pixels for black andwhite secret pixels. Contrast can be defined as below.

Definition 4: Suppose an image is stacked from shares heldby a set of participants X . These shares hold a portion of asecret image via a VC scheme and two collections C0 and C1of sets, where Ct = {Si , 1 ≤ i ≤ m}, t ∈ {0, 1}. The contrast(denoted as αX ) and blackness (denoted as βX ) for the imagecan be defined as

αX = H(λC1,X

)− H(λC0,X

)

mand βX = H

(λC1,X

)

m.


Definition 5: Suppose P = {1, . . . ,n} is a set of n par-ticipants. A solution with non-expandable shares to the VCSfor an access structure (�Qual, �Forb) on P consists of twocollections of sets, C0 and C1 of sets, where Ct = {Si , 1 ≤i ≤ m}, t ∈ {0, 1}. Collection C0 (C1) is used to encryptwhite (black) pixels of secret images. Suppose αTH (αTH>0)is the threshold for detecting a difference in an image by thehuman’s visual system. The solution is considered feasible ifthe following conditions are satisfied:

1) For any Y ∈ �Forb, VC1,Y = VC0,Y.2) For any X ∈ �Qual, H

(λC1,X

)− H(λC0,X

)>αTH.

Condition 1 is the security condition on restricting secretaccessibility of any forbidden set. For any forbidden setY, assume

{i1, i2, . . . , iq

}is all members of Y and VC0,Y

(VC1,Y) denotes the collection of column vectors that areobtained by restricting each n-tuple vectors in C0 (C1) torows i1, i2, . . . , iq . Then VC0,Y and VC1,Y have to containthe same collections of q-tuple vectors with the same chosenprobabilities (i.e., H

(λC1,Y

)/m = H

(λC0,Y

)/m). The black

and white secret pixels are therefore indistinguishable byhuman’s visual system. The property is equivalent to the secu-rity condition presented by Naor and Shamir for conventionalVCSs [1]. Hence, condition 1 is valid as a security conditionof ProbVCSs.

Condition 2 ensures that the blackness of recovered blacksecret pixels is higher than that of recovered white secret pixelsin a qualified recovered image. If H

(λC1,Y

)−H(λC0,Y

)>αTH,

a human’s visual system can recognize a difference betweenthe recovered secret pixels. If αTH is large enough, a human’svisual system can distinguish between the recovered black andwhite secret pixels to obtain the secret images.

Using these definitions, a SIVC scheme for access structure(�Qual, �Forb) can be constructed as follows: let two collectionsof sets C0 and C1 be adopted for the SIVCS. In the encryptionphase, the dealer randomly chooses one column vector fromC0 (C1) to encrypt white (black) secret pixels.

The above-mentioned method, which is also called thesingle pixel encoding method encrypts a secret image pixel bypixel. This method is easy and low in complexity, but it cannotguarantee that the pixel can be uniformly distributed in a smallarea in the reconstructed image. It may decrease the qualityof reconstructed images [17]–[18]. Chow et al. proposed amulti-pixel block size invariant VCS that maintains the relativepixel density in a small area in the reconstructed image toimprove the quality of the image [17]. The proposed schemeis built from existing basis matrices of the conventional VCS.However, in Chow et al.’s scheme, the encryption process isperformed by taking a multi-pixel block as a unit of encryp-tion. They suggest that to use the pixel expansion factor, m,in the conventional VCS as the block size of encryption.Zhang et al. also worked on the multi-pixel encoding methodto improve the quality of the reconstructed image [18]. Theirmethod is similar to Chow et al.’s; however, it collected thepixel block in the secret image by a zigzag scan method ineach encoding run. We focus on how to find code collectionsets, C0 and C1, for SIVCSs upon a given access structure.

Hence, we use the single pixel encoding method to generateshares in the following experiments.

Example 2: Suppose there are four participants P ={1, 2, 3, 4}, that share a secret image; the minimal qualifiedset is �0 = {{1, 2, 3} , {1, 4} , {3, 4}} and the forbidden setis �Forb = 2P\�Qual. Then, the (�Qual, �Forb)-VCS can beconstructed using the following two sets of collections

C0 = {2 :E0, 1 : E6, 1 : E11, 1 : E13}

=

⎧⎪⎪⎨

⎪⎪⎩

⎡

⎢⎢⎣

0000

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

0000

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

0110

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

1011

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

1101

⎤

⎥⎥⎦

⎫⎪⎪⎬

⎪⎪⎭

and

C1 = {1 : E1, 1 : E2, 1 : E5, 1 : E8, 1 : E14}

=

⎧⎪⎪⎨

⎪⎪⎩

⎡

⎢⎢⎣

0001

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

0010

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

0101

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

1000

⎤

⎥⎥⎦ ,

⎡

⎢⎢⎣

1110

⎤

⎥⎥⎦

⎫⎪⎪⎬

⎪⎪⎭

.

We first examine the security condition for forbidden sets.Let Y = {1, 2} ∈ �Forb, then by Definition 3, we have

λC0,Y ={L(v1,Y

), L(v2,Y

), L(v3,Y

), L(v4,Y

), L(v5,Y

)}

={

L

([00

])

, L

([00

])

, L

([01

])

,

L

([10

])

, L

([11

])}

= {0, 0, 1, 1, 1} ,λC1,Y =

{

L

([00

])

, L

([00

])

, L

([01

])

,

L

([10

])

, L

([11

])}

= {0, 0, 1, 1, 1} ,and

VC1,Y = VC0,Y ={[

00

]

,

[00

]

,

[01

]

,

[10

]

,

[11

]}

.

Hence, the forbidden set Y = {1, 2} is secure. It is easy toverify that all forbidden sets meet the security condition.

Next, we calculate the contrast condition for qualified setX = {1, 2, 3}. We have λC0,X = {0, 0, 1, 1, 1} and λC1,X ={0, 1, 1, 1, 1}. Thus, the contrast of the recovered image, whichis stacked from shares 1, 2, and 3, is

αX = H(λC1,X

)− H(λC0,X

)

m= 4− 3

5= 1

5.

In the same way, we have contrasts α{1,4} = 2/5 and α{3,4} =1/5. The contrast of the recovered image that is stacked fromthe other qualified sets also can have αX ≥ 1/5, X ∈ �Qual.This shows that collections C0 and C1 are valid solutionsfor the (�Qual, �Forb)-VCS because it meets the security andcontrast conditions.

In Example 2, notation ETj =

[e j ,1, . . . ,e j,n

], 0 ≤ j < 2n ,

denotes a n-tuple Boolean column vectors for encrypting nshares, where

∑ni=1 2n−i×e j,i = j . Notation q : ET

j , q ≥ 1,q ∈ Z, denotes q column vectors ET

j . In the rest of this paper,


TABLE I

THE USED CODE COLLECTIONS IN EXAMPLE 4

Code Collections

C0 C1

Set p {2 :E0, 1 : E7, 1 : E9, 1 : E14} {1 : E1, 1 : E2, 1 : E4, 1 : E8, 1 : E15}Set q {1 : E0, 2 : E7, 1 : E9, 1 : E14} {1 : E3, 1 : E5, 1 : E6, 1 : E8, 1 : E15}Set r {1 : E0, 2 : E7, 1 : E9, 2 : E14} {1 : E3, 1 : E5, 1 : E6, 1 : E10, 1 : E12, 1 : E15}

Fig. 1. Relationship between �0, �Qual, and �Forb.

we use the notation for denoting the collection of columnvector. By Example 2, we make the following observation.

Observation 1: In a (�Qual, �Forb)-VCS, the contrast ofeach recovered image can vary, and depends on the accessstructure of each qualified set.

In the previous studies on visual cryptography, researcherstried to construct a (�Qual, �Forb)-VCS such that the secretscan be revealed while all shares in qualified set X , X ∈ �Qual,were stacked. The relationship between �0, �Qual, and �Forbis as shown in Fig. 1. Qualified set �Qual is the closure of �0,that is, any qualified set X, X ∈ �Qual and X /∈ �0, shouldbe a subset of Y, Y ∈ �0. That means the secret also can berevealed by stacking all shares in minimal set Y. On the otherhand, the quantity of �Qual is no less than the quantity of �0.Hence, to find the encodings that satisfy the contrast conditionfor all sets in �0 could be easier than that for all sets in �Qual.

Definition 6: Suppose P = {1, . . . ,n} is a set of n partici-pants. A solution of a (�0, �Forb)-VCS on P consists of twocollections of sets C0 and C1 of sets. Collection C0 (C1) isused to encrypt white (black) pixels of secret images. Thesolution is considered feasible if the security condition can besatisfied for any set Y ∈ �Forb and the secret can be revealedfor any set X1 ∈ �0. The contrast condition can be ignoredfor the qualified set X2, X2 ∈ �Qual and X2 /∈ �0. The (�0,�Forb)-VCS also is called a weak VCS for GASs.

Example 3: Suppose P = {1, 2, 3, 4} and the minimalqualified set is �0 = {{1, 2, 3} , {1, 4} , {3, 4}}. Qualified set�Forb is the closure of �0 and the forbidden set is �Forb =2P\�Qual. Then, the (�0, �Forb)-VCS can be constructed usingtwo sets of collections:C0 = {1 : E0, 1 : E6, 1 : E11, 1 : E13}and C1 = {1 : E2, 1 : E5, 1 : E9, 1 : E14}.

By Definition 6, it is easy to determine if the code collec-tions can meet the security condition; that is, VC1,Y = VC0,Y,∀Y ∈ �Forb. The contrast of the recovered image that is stackedfrom qualified set X , X ∈ �0, is αX = 1/4.

The (�0, �Forb)-VCS ignores the contrast condition forqualified set X , X ∈ �Qual and X /∈ �0; therefore, stackingall shares in X cannot reveal the secret. For example, in

TABLE II

THE CONTRAST AND BLACKNESS OF RECOVERED IMAGES IN EXAMPLE 4

QualifiedSets X

Contrast (αX ) Blackness (βX )

Set p Set q Set r Set p Set q Set r

{1, 2, 4} 1/5 1/5 1/6 4/5 1 1

{1, 3, 4} 1/5 1/5 1/6 4/5 1 1

{2, 3} 1/5 1/5 1/6 3/5 4/5 1

Example 3, the recovered image by stacking shares 1, 2, and4 cannot reveal the secret because the image cannot meetthe contrast condition (i.e., α{1,2,4}= 0, {1, 2, 4} ∈ �Qual and{1, 2, 4} /∈ �0). However, it has an alternative way to revealthe secret by stacking shares 1 and 4 (i.e., α{1,4} = 1/4,{1, 4} ∈ �0).

From Example 3, we have the following second observation.Observation 2: Instead of applying the (�Qual, �Forb)-VCS,

the (�0, �Forb)-VCS can have a higher opportunity to constructrecovered images with better contrast.

Example 4: Suppose there are four participants P ={1, 2, 3, 4}, that share a secret image; the minimal qualifiedset is �0 = {{1, 2, 4} , {1, 3, 4} , {2, 3}} and the forbidden setis �Forb = 2P\�Qual. Dealers use three code collections, aslisted in Table I, to construct the (�0, �Forb)-VCS. The contrastand blackness values of the recovered image of each minimalqualified set are listed in Table II.

In this example, code sets p and q have same contrastvalues for all minimal qualified sets; however, all blacknessof code set q are better than those of code set p. Thatmeans that the recovered images constructed by code set qhave a better display quality than those constructed by codeset p. Although dealers would like to further improve theblackness value of the recovered images, doing so may havethe undesirable side effect of decreasing the contrast valueof the image. For example, dealers would like to constructthe (�0, �Forb)-VCS subject to the 100% blackness for allrecovered images by using code set r ; however, this resultsin the contrast decreasing from 1/5 to 1/6 for all images, bycomparison with code set q .

Observation 3: Blackness of a recovered image will affect(i.e., increase or decrease) the display quality of the image.

The above-mentioned observations indicate two majorissues in VCS construction for GASs. First, the contrast ofthe images in a qualified set may vary across a wide range,which, in the worst case, will lead to poor display quality.Second, the display quality of the recovered images can be


improved by adjusting the blackness of the recovered images.We address these problems in the following section.

IV. PROPOSED ALGORITHM

A. Formulation

The problem for constructing a (�0, �Forb)-VCS is to findthe two collections of sets C0 and C1 subject to the security,contrast, and blackness constraints. From the perspective of thequality of the recovered image, the objectives of the proposedformulation are to maximize the worst and the average contrastfor recovered secret images among all minimal qualified sets.

The proposed problem can be formulated as a multi-objective optimization model given below.Given parameters:P Set of participants, P = {1,. . ., n}.n Number of participants, n ≥ 2.δ Control parameter for blackness of recovered images,

δ ∈ Z.�0 Set of minimal qualified sets, �0 ∈ 2P\∅.�Qual Qualified set, �Qual ∈ closure(�0).�Forb Set of forbidden sets,�Forb = 2P\�Qual.

Decision variables:m Number of column vectors in code collection C0 (or C1),

m ≥ 2.Si n-tuple Boolean column vector, Si= [si, j ], 1 ≤ i ≤ m,

1 ≤ j ≤ n; si, j= 0 (1) indicates that the pixel is encodedas a white (black) sharing pixel in share j .

C0 C0 = {Si , 1 ≤ i ≤ m}, consists of a set of columnvectors used to share a white pixel.

C1 C1 = {Si , 1 ≤ i ≤ m}, consists of a set of columnvectors used to share a black pixel.

αX Contrast for a recovered image that is reconstructedby shares held on a set of participants X , X ∈ 2P\∅;contrast αX can be defined as αX = H

(λC1,X

)−H(λC0,X

)

m .Objective function:

maximize min∀X∈�0αX

maximize1

|�0|∑

∀X∈�0

αX (IP1)

subject to:

VC1,Y = VC0,Y, ∀Y ∈ �Forb (1)

H(λC1,Y

)> 0, ∀Y ∈ �Forb, |Y| = 1 (2)

H(λC1,X

)− H(λC0,X

)> 0, ∀X ∈ �0 (3)

m − H(λC1,X

) ≤ δ, ∀X ∈ �0 (4)

si, j ∈ {0, 1},∀1 ≤ i ≤ m, 1 ≤ j ≤ n (5)

m ≥ 2, m ∈ Z . (6)

The first objective of the formulation is to maximize thecontrast of the worst recovered image in the minimal qualifiedset. The second objective is to promote the average contrast ofall recovered images in the minimal qualified set. Constraint(1) ensures that the solution for (�0, �Forb)-VCS obeys thesecurity condition. Constraint (2) specifies that each sharemust contain some black pixels. Constraint (3) guarantees that

each qualified recovered image can have a nonzero contrastsuch that the image can be recognized. Constraint (4) ensuresthat the minimal blackness for all black secret pixels can bereconstructed. In other words, the blackness of all recoveredimages must be at least equal to (m − δ)/m at least. Byadjusting constant δ, dealers can achieve better display qualityfor recovered images. Constraints (5) and (6) limit the rangesof the decision variables.

The complexity of the solution space for the optimizationproblem is extremely high. The column vector Si has 2m

possible combinations to construct a white or black secretpixel for n shares. Therefore, the complexity to solve theoptimization problem is O(22mn).

B. Solution Approach

In this section, we proposed an algorithm to solvethe proposed multi-objective optimization problem for the(�0, �Forb)-VCS. To simplify solution procedures and improvethe efficiency of the proposed algorithm, some constraints ofthe original optimization model are relaxed before the solutionprocedures start. Then, the proposed simulated-annealing-based (SA-based) algorithm is developed to solve the opti-mization problem.

1) Model Transformation: First, we relax Constraints (1),(3), and (4) of the proposed model by penalizing the objectivefunction. The penalty function P for code collections C0 andC1, can be defined as follows:

P (C0, C1) = 1+ η ×∑

∀Y∈�Forb

S (Y)

+⎛

⎝|�0| −∑

∀X∈�0

(C (X)− D (X))

⎞

⎠

where

S (Y) ={

1+SF (Y) , VC1,Y �= VC0,Y0, otherwise

C (X) ={

1, H(λC1,X

)− H(λC0,X

)>0

0, otherwise

and

D (X) ={ (

m − δ − H(λC1,X

))/m, m − H

(λC1,X

)>δ

0, otherwise.

Function S (Y) determines the number of forbidden setsthat violates the security constraint. Parameter η, η =0.5 × |�0|/|�Forb|, which is the weight of function S(Y),is used to balance the penalty between the qualified setsand the forbidden sets. The fraction part of S(Y), SF (Y) =(H(λC1,Y

)− H(λC0,Y

))/m, which is an external penalty

function, is used to indicate the degree of the security con-straint violation for a code collection. Functions C (X) andD (X) calculate the number of minimal qualified sets thatmeets the contrast condition (i.e., Constraint (3)) and theblackness constraint (i.e., Constraint (4)). Function D(X) isused to measure the difference between the blackness of aqualified recovered image and its target value. If the imagecannot meet the blackness constraint, the difference will be apenalty for the image. When Constraints (1), (3), and (4) were


satisfied, the function values of S(Y), C(X), and D(X) shouldbe 0, |�0|, and 0, respectively. Hence, function P for a feasiblesolution must be equal to1.

Next, the multiple objective functions can be combined tosimplify the complexity of the solution procedure. In thisstudy, we take the first objective in IP1 as the primary goal.The combined objective function F for code collection sets C0and C1 is defined as follows:

F (C0, C1) ={

P (C0, C1) , P (C0, C1) > 1α′/K, P (C0, C1) = 1

where α′ = K − ( ⌊K ×min∀X∈�0 αX

⌋ + (1/|�0|)∑∀X∈�0

αX)

and K is a big constant (e.g., 10 000). The firstequation of α

′, min∀X∈�0 αX , which is equivalent to the first

objective in IP1 represents the worst contrast of recoveredimage. The value of

⌊K ×min∀X∈�0 αX

⌋is greater than 1 if

the code collection is feasible and constant K is large enough.The second equation of α

′, 1|�0|∑∀X∈�0

αX , which equals tothe second objective in IP1 is less than 1. Hence, the firstobjective becomes the integer part of function F and the secondobjective is the fraction part of function F. Obviously, functionF will be less than 1 if the code collection is feasible.

Eventually, the original multi-objective optimization modelcan be transformed as IP2:

Objective function:

minimize F (C0, C1) (IP2)

subject to:

H(λC1,Y

)>0, ∀Y ∈ �Forb, |Y| = 1 (7)

si, j ∈ {0, 1}, ∀1 ≤ i ≤ m, 1 ≤ j ≤ n (8)

m ≥ 2, m ∈ Z . (9)

Original model IP1 can be replaced by the penalized model(IP2). In this way, Constraints (1), (3), and (4) can be omittedduring the solution process. Constraints (7), (8), and (9) arethe same as Constraints (2), (5), and (6), respectively.

2) The Proposed Algorithm: The SA approach is a genericand probabilistic meta-heuristic method for solving difficultoptimization problems. It can solve combinatorial optimizationproblems in a large search space; that is, it can find goodapproximated solutions to the global optimums by randomizedheuristic methods. In this section, we develop a SA-basedalgorithm to solve the proposed mathematical optimizationformulation (IP2) for the GAS problem.

The relationship between the pixel expansion and the con-trast in the conventional VC-based VCSs is sophisticated andremains an open question. Yang proved that the requiredcolumn vectors in the probabilistic VCSs are equivalent tothe pixel expansion factor in conventional VCSs [3]. Hence,to determine the required number of column vectors m in theproposed model IP2 is a difficult problem. Koga exhaustivelysearched for solutions for threshold VCSs within a given rangeof m and found the best one for the VCSs [3]; this approachis inefficient. An efficient method for finding a minimal mwithin a given range is proposed in the following.

Lemma 1: Suppose code collection C = {C0, C1} is theoptimal solution of a VCS and no redundant column-vectors

TABLE III

PSEUDO CODE OF PROPOSED REDUCE_CV ALGORITHM

Algorithm Reduce_CV()Input: C, mOutput: C, m1. ∀1 ≤ i ≤ m, r0,i ← 0, r1,i ← 02. ∀1 ≤ i ≤ m, if S0

i = S1j and r1, j �= 1 (S0

i ∈ C0, S1j ∈ C1, 1 ≤ j ≤ m)

then r0,i ← 1, r1, j ← 13. C← C, m ← m

4. ∀1 ≤ i ≤ m, if r0,i = 1 then delete S0i from C0

i

5. ∀1 ≤ i ≤ m, if r1,i = 1 then delete S1i from C

1i , m ← m − 1

6. Output C, m

exist in C. Column vectors S ∈ C0 and S ∈ C1 are calledredundant vectors in C.

Proof: Suppose C1 and C0 consisting m column vectors,is an optimal solution of the VCS, column vector s ∈ C0and S ∈ C1. Obviously, vector s cannot alter the security andvalue of HX to the VCS where HX = HC1,X − HC0,X and Xis a qualified set. Therefore, vector s can be deleted from C0and C1 simultaneously. The contrast value of set X will bealtered from HX/m to HX/(m − 1). In other words, the newcode collection in which redundant vector s was deleted hasa higher contrast value for set X than the original one. Thatis contradictory.

Theorem 1: A feasible code collection C′

can be reduced toan optimal code collection C by deleting all redundant columnvectors from C

′.

Proof: Based on Lemma 1, the theorem holds obviously.

Theorem 1 indicates that an optimal solution of a VCS canbe found when the given range of m is larger than its minimalvalue.

Example 5: Suppose there are four participants P ={1, 2, 3, 4}, �0 = {{1, 2, 3} , {1, 4}}, the optimal values of the(�0, �Forb)-VCS are m = 4, the optimal contrasts α{1,2,3} =1/4, and α{1,4} = 1/2. A feasible code collection C

′ ={C′0, C

′1

}, C

′0 = {1 : E0, 1 : E6, 1 : E11, 1 : E13, 1 : E3, 1 :

E10} and C′1 = {1 : E3, 1 : E5, 1 : E8, 1 : E14, 1 : E3, 1 : E10},

can be obtained when we find the solution in the case of m= 6.Hence, we have the contrasts α{1,2,3} = 1/6 and α{1,4} =

1/3. By Theorem 1, the right-most two column vectors can bedeleted. Therefore, we can obtain the optimal contrast values1/4 and 1/2 for sets {1, 2, 3} and {1, 4}, respectively.

Based on Theorem 1, the value of m is no longer asensitive parameter in the VCS construction. As illustrated inExample 5, given a moderate value of m, a feasible solutionfor a specific VC scheme can be found, and then the bestconstruction for the VCS can be obtained by reducing thecolumn vectors of the feasible solution.

The pseudo code for deleting redundant column vectors in afeasible solution is listed in Table III. Step 1 resets all markersr0,i (r1,i ), 1 ≤ i ≤ m, that are used to indicate whether or not acolumn vector i is redundant in C0 (C1). Step 2 marks a pair ofredundant column vectors in C0 and C1 as redundant vectorsby setting corresponding markers. Steps 4 and 5 delete allredundant vectors in C according to the markers. Finally, the


TABLE IV

PSEUDO CODE OF PROPOSED SA-BASED ALGORITHM

Algorithm GAS_SA()Input: n, m, �0, �ForbOutput: Cbest , f1. ∀1 ≤ i ≤ n, randomly generate an initial guess for code collection

C = {C0, C1} such that H(λC0,{i}

) = H(λC1,{i}

) = �m/2�2. Calculate energy E for the above initial guess3. Eold ← E , Ebest ← Eold, Cbest ← C4. t ← t0, r ← r05. While t ≥ t f do6. Repeat r times7. Randomly select a share i and a column j , let s0

i, j ← 1 − s0i, j ,

s0i, j ∈ C0

8. Randomly select a column j ′, where s1i, j ′ = 1 − s0

i, j and

s1i, j ′ ∈ C1, let s1

i, j ′ ← s0i, j

9. Calculate E for the new configuration10. If E < 1 then11. Call Reduce_CV (C, m, C, m)

12. ∀Y ∈ �Forb, |Y| = 1, if H(λC1,Y

)= 0 then goto Step 7

13. Calculate E based on m14. EndIf15. Enew ← E16. �E ← Enew − Eold17. Generate a random number ρ uniformly distributed in [0, 1).18. If �E < 0 or ρ < e(−�E/t) then19. Zold ← Znew20. If Eold < Ebest then Ebest ← Eold, Cbest ← C21. else recover the action in Steps 7 and 822. End Repeat23. t ← αT × t , r ← βT × r24. End While25. If Ebest ≥ 1 then f ← 0, goto Step 2926. f ← 127. Call Reduce_CV (Cbest , m, C, m)28. Cbest ← C29. Output Cbest , f

output is a reduced code collection C and number of columnvectors in C0 (i.e., m).

The SA-based algorithm, as listed in Table IV, is developedfor solving model IP2. The proposed approach treats decisionvariable m as a given variable and tries to find the bestsolution with a given access structure (�0, �Forb) based onm. Step 1 randomly guesses an initial value for C0 andC1 subject to the security constraint on each share. Step 2calculates energy value E for the first solution. Given that theoptimization problem in IP2 is a minimization problem, theenergy function in the SA-based algorithm is directly definedas E = F (C0, C1). Steps 3 and 4 initialize related parametersfor the SA procedure.

Steps 5–24 are the main SA loop, which will be terminatedwhen the frozen temperature, t f , is reached. Steps 6–22 areexecuted r times to refine solutions in a state of equilibrium.Steps 7 and 8 randomly explore a next solution by alteringthe current solution state of its neighborhood. The step sizein Step 7 is very small, the algorithm selects column vector jin C0, and then alters the encoding of share i . The alteredencoding is denoted by s0

i, j . Step 7 indicates that share iviolates the security condition, which is corrected in Step 8.Step 8 selects a column vector in C1 in which the encodingof share i , s1

i, j ′ , differs from s0i, j and then alter s1

i, j ′ . In sucha way, the encoding of share i can be altered and the securitycondition of share i can be preserved. Steps 10–14 deal with

Constraint (7) in model IP2 only while the current solutionreceives no penalty (i.e., E < 1). Step 11 reduces the currentcode collection and then Step 12 checks whether or not thecode collection meets Constraint (7). If the constraint can besatisfied, the energy of the feasible solution is reevaluatedbased on the actual quantity of vectors in the solution (i.e., m)in Step 13; if the constraint cannot be satisfied, then it abortsthe solution. Steps 15–21 evaluate the value of the energyfunction for the new state and decide whether or not the currentstate will be replaced by the new state. The objective valuewith the minimum energy value should be saved as the bestsolution in Step 20. After r solution iterations, parameters tand r are modified in Step 23.

The solution procedure is terminated when t < t f . When thealgorithm stops, if Ebest < 1, the best-found solution, Cbest, isa feasible solution to this problem. Steps 26–28 reduce Cbestand set a feasibility indicator of Cbest as feasible (i.e., f = 1).In contrast, if Ebest ≥ 1, it will reset indicator f in Step 25.Finally, the algorithm outputs indicator f and the best-foundsolution Cbest as the solution to the problem.

The running time of the proposed SA-based algorithmcontains two parts: outer and inner loops. The outer loopcontains steps from Step 5 to Step 24. The running of theouter loop depends on the parameter setting for the coolingscheduler of SA process. The inner loop contains steps fromStep 7 to Step 21. Step 9 dominates the time complexity ofthe loop. The calculation of energy function E involves alldecryption possibilities of n participants. The time complexityto check the security condition for a forbidden set is O(m).Hence, the time complexity of the inner loop is O (m2n).

V. EXPERIMENTAL RESULTS

A. Scenario

In the following subsections, we assess the performanceof the proposed algorithm from the quantitative and thequalitative viewpoints. From the quantitative viewpoint, weexamine the performance of the proposed scheme and solutionapproach. In this study, we use the worst and the averagecontrasts of recovered images as quantitative performancemetrics. The worst contrast (αmin) and the average contrast(αavg) of a minimal qualified set �0 are defined as:

αmin = min∀X∈�0 αX and αavg = 1

|�0|∑

∀X∈�0αX .

From the qualitative viewpoint, we evaluate our results byvisual effects. In both evaluations, we test access structuresas listed in Table V. The parameters for the algorithm aret0= 0.05, tf = t0/15, αT= 0.75, and βT= 1.1. The otherparameters for the algorithm also are listed in Table V. Wealso compare our results with other approaches.

B. (�0, �Forb)-VCS vs. (�Qual, �Forb)-VCS

First, we assess the performance of (�0, �Forb)-VCSs and (�Qual, �Forb)-VCSs in terms of the worstcontrast αmin, the average contrast αavg, and theminimal required number of column vectors m. Asshown in Table VI, the αmin of (�0, �Forb)-VCSs


TABLE V

SOME MINIMAL QUALIFIED SETS AND ITS RELATED PARAMETERS USED

IN THIS EXPERIMENT

No n �0Parameters for SA

r0 m

1 4 2-out-of-4 2, 000 20

2 4 123,14 100 20

3 4 123,14,34 100 20

4 4 134,12,23,24 100 20

5 4 123,124 200 20

6 4 124,134,23 200 20

7 4 123,124,134 200 20

8 4 3-out-of-4 200 20

9 5 1234,1235,1245,345 20, 000 40

10 5 1234,1345,235 20, 000 40

11 5 1235,1245,234,345 105 40

12 5 4-out-of-5 105 40

13 6 1235,126,1345,1356,2345 3∗105 40

14 6 1245,1246,1346,12356,3456 5∗105 40

15 7 146,12357,34 1.2∗106 40

16 7 1234,1457,2567,3467 1.5∗106 40

17 7 1234,147,2567,3467 106 40

18 7 1234,34567 2∗106 40

19 8 13478,23,256 106 40

20 8 12,1357,178,236,2468 106 40

is better than that of (�Qual, �Forb)-VCSs in some minimalqualified sets, which are denoted by bold font. This indicatesthat a (�0, �Forb)-VCS can produce recovered images witha higher contrast value than a (�Qual, �Forb)-VCS. Theαavg of

(�Qual, �Forb

)-VCSs is slightly larger than that of

(�0, �Forb)-VCSs in access structure 3. However, the minimalrequired m for a (�0, �Forb)-VCS can be smaller than a(�Qual, �Forb)-VCS needs. That implies a (�0, �Forb)-VCS hasa smaller solution space than a (�Qual, �Forb)-VCS. Hence,we evaluate the performance of the proposed algorithm onlyfor (�0, �Forb)-VCSs in the following experiments.

C. Performances of (�0, �Forb)-VCSs

In this subsection, we investigate how the blacknessconstraint (i.e., Constraint (4)) affects performances of a(�0, �Forb)-VCS. The evaluation is performed under threeoptimization models:

• Model A: (�0, �Forb)-VCS without blackness constraint;that is, Constraint (4) is omitted.

• Model B: (�0, �Forb)-VCSs under the blackness con-straint with blackness control parameter δ = 1.

• Model C: (�0, �Forb)-VCSs under the blackness con-straint with parameter δ = 0.

The worst-case contrasts of these models are listed inTable VII. From Table VII, we make the following observa-tions:

1. In optimization Model A, recovered images can reach100% blackness for all minimal qualified sets in someaccess structures; for example, access structures 4 and 5.

TABLE VI

A COMPARISON BETWEEN (�0, �Forb)- AND (�Qual, �Forb)-VCSS

No(�0, �Forb)-VCS (�Qual, �Forb)-VCS

m αmin αavg m αmin αavg

1 6 1/3 33.3% 6 1/3 33.3%

2 4 1/4 37.5% 4 1/4 37.5%

3 4 1/4 25.0% 5 1/5 26.7%

4 4 1/4 25.0% 4 1/4 25.0%

5 4 1/4 25.0% 4 1/4 25.0%

6 5 1/5 20.0% 5 1/5 20.0%

7 6 1/6 16.7% 6 1/6 16.7%

8 6 1/6 16.7% 6 1/6 16.7%

9 12 1/12 10.4% 12 1/12 10.4%

10 10 1/10 10.0% 10 1/10 10.0%

11 10 1/10 10.0% 10 1/10 10.0%

12 15 1/15 6.7% 15 1/15 6.7%

13 14 1/14 7.1% 15 1/15 6.7%

14 18 1/18 5.6% 18 1/18 5.6%

15 18 1/18 18.5% 19 1/19 12.3%

16 18 1/18 5.6% 25 1/25 6.0%

17 16 1/16 6.3% 21 1/21 6.0%

18 20 1/20 5.0% 24 1/24 4.2%

19 19 1/19 19.3% 19 1/19 5.3%

20 14 1/14 17.2% 15 1/15 12.0%

m: number of column vectors in code collection C0 (or C1)

In the general cases, recovered images cannot be guaran-teed to reach 100% blackness for all minimal qualifiedsets in most of the access structures. In access structures3, 6, 10, 11, 15, 17, and 19, the blackness of theworst-case recovered images was no more than 80%.The “worst-case recovered images” means the imagehas the worst contrast among an access structure. Thelow blackness value affects the display quality of arecovered image; in fact, the recovered image may notbe recognizable when the contrast of the image is toolow.

2. In optimization Models B and C, the blackness of theworst-case recovered image can be improved in someaccess structures without decreasing the contrast valueof the image. For example, in access structures 2, 7,and 15—20, the blackness value of all images can bepromoted to 100% (i.e., δ = 0) without losing thecontrast values of the images. Except in the case ofaccess structure 9, the blackness value of all imagescan be promoted to (m − 1)/m (i.e., δ = 1) withoutdecreasing the contrast values of the images. In accessstructure 19, the blackness can be increased up to 36%by Model B.

3. In the majority of the cases (access structures 1, 3, 6,and 8—14 in Table VII), the contrast values (αmin)will decrease under optimization Model C to construct(�0, �Forb)-VCSs. The decrease cannot lead to a seriousproblem in recognizing the contents of the recoveredimages, but the increased m value will enlarge the searchspace of the optimization problem.


TABLE VII

THE WORST-CASE CONTRAST (αmin) OF (�0, �Forb)-VCSS IN VARIOUS

BLACKNESS CONSTRAINTS

No

Optimization Models

A B (δ = 1) C (δ = 0)

m αmin β m αmin m αmin

1 6 1/3 5/6 6 1/3 8 1/4

2 4 1/4 1 4 1/4 4 1/4

3 4 1/4 3/4 4 1/4 9 2/9

4 4 1/4 1 4 1/4 4 1/4

5 4 1/4 1 4 1/4 4 1/4

6 5 1/5 3/5 5 1/5 6 1/6

7 6 1/6 5/6 6 1/6 6 1/6

8 6 1/6 5/6 6 1/6 9 1/9

9 12 1/12 5/6 15 1/15 18 1/18

10 10 1/10 4/5 10 1/10 12 1/12

11 10 1/10 4/5 10 1/10 14 1/14

12 15 1/15 13/15 15 1/15 25 1/25

13 14 1/14 6/7 14 1/14 18 1/18

14 18 1/18 8/9 18 1/18 25 1/25

15 18 1/18 7/9 18 1/18 18 1/18

16 18 1/18 5/6 18 1/18 18 1/18

17 16 1/16 3/4 16 1/16 16 1/16

18 20 1/20 17/20 20 1/20 20 1/20

19 19 1/19 11/19 19 1/19 19 1/19

20 14 1/14 6/7 14 1/14 14 1/14

β: the blackness of the recovered image which has the worst contrastvalue αmin

Table VIII lists the average contrast (αavg) of the(�0, �Forb)-VCSs in Table VI. As listed in Table VIII, exceptfor access structure 9, Models A and B have the same averagecontrast for all access structures, which indicates that theblackness constraint (δ = 1) cannot affect the average contrastof recovered images. When the model tries to achieve thehighest blackness (i.e., Model C, δ = 0) for all recoveredimages, the average contrast decreases slightly in some accessstructures (e.g., access structures 1, 3, 8, 9, and 11–14).However, in the case of access structure 6, Model C has thehighest average contrast and blackness among all models atthe same time. This case shows that the blackness constraint(especially, in the case of δ = 0) can affect (increase ordecrease) the average contrast of the images only slightly.

In summary, the blackness constraint can increase the dis-play quality of the recovered images, but it also can decreasethe display quality and increase the number of required columnvectors, which rapidly increases the solution space. The effectof the constraint is complicated and highly depends on theaccess structure of a VCS. Hence, combining the blacknessconstraint into the VCS optimization model can help the dealerin finding a code collection for producing recovered imagesthat have better display quality by adjusting the blacknesscontrol parameter δ.

D. Comparison With Other Approaches

Next, we compare our results (Model A) with the results ofAteniese [6], Hsu [7], and Lee [12]. Hsu reported his results

TABLE VIII

THE AVERAGE CONTRAST (αavg) OF (�0, �Forb)-VCSS IN VARIOUS

BLACKNESS CONSTRAINTS

No

WithoutBlacknessConstraint

WithBlackness Constraint

δ = 1 δ = 0

m αavg m αavg m αavg

1 6 33.3% 6 33.3% 8 25.0%

2 4 37.5% 4 37.5% 4 37.5%

3 4 25.0% 4 25.0% 9 22.2%

4 4 25.0% 4 25.0% 4 25.0%

5 4 25.0% 4 25.0% 4 25.0%

6 5 20.0% 5 20.0% 6 22.2%

7 6 16.7% 6 16.7% 6 16.7%

8 6 16.7% 6 16.7% 9 11.1%

9 12 10.4% 15 10.0% 18 8.3%

10 10 10.0% 10 10.0% 12 10.0%

11 10 10.0% 10 10.0% 14 7.1%

12 15 6.7% 15 6.7% 25 4.0%

13 14 7.1% 14 7.1% 18 6.7%

14 18 5.6% 18 5.6% 25 4.0%

15 18 18.5% 18 18.5% 18 18.5%

16 18 5.6% 18 5.6% 18 5.6%

17 16 6.3% 16 6.3% 16 6.3%

18 20 5.0% 20 5.0% 20 5.0%

19 19 19.3% 19 19.3% 19 19.3%

20 14 17.2% 14 17.2% 14 17.2%

only for the access structures 2—7; hence, our comparisonfocuses on these access structures.

Fig. 2 shows that the proposed approach can achieve bettercontrast values in the worst case of recovered images thanHsu’s probabilistic constructions (i.e., access structures 3,4, 6, and 7), Ateniese’s VC-based constructions (i.e., accessstructure 3), and Lee’s approach (i.e., access structures 3, 4, 6,and 7). These results prove the effectiveness of the proposedoptimization model in improving the contrast for the image inthe worst case.

From Fig. 2 and 3, the proposed approach has the samevalues of αmin and αavg with Ateniese’s results except thosefor access structure 3. It indicates that both approaches havefound the best results for access structures 2 and 4–7. Fromthe results of Hsu’s and this study in access structures 3 and 4,these access structures have conflicting objectives betweenmaximizing the worst and average contrasts. Hsu’s aimedto maximize the average contrast, therefore his approachdecreases the contrast value in the worst case in accessstructures 3 and 4. Except for the above-mentioned cases,the results of this study have better performances than otherapproaches in terms of αmin and αavg.

In access structure 3 (access structure is �0 ={{1, 2, 3}, {1, 4}, {3, 4}}), qualified set {1, 2, 3} has the worstrecovered image than other sets. Hence, we use the recov-ered image of set {1, 2, 3} as an example in the followingexperiment. Fig. 4 shows a comparison between the proposedstudy and other approaches by visual effects. The recoveredimages in Fig. 4(c) and (e) are difficult to recognize due to the


Fig. 2. Comparison by αmin.

Fig. 3. Comparison by αavg.

(a) (b) (c) (d)

(e)

Fig. 4. Comparison between other approaches and the proposed study on theworst case result (i.e., set {1, 2, 3}) of access structure {{1, 2, 3}, {1, 4}, {3, 4}},(a) Secret image with 96 × 64 pixels (192 DPI), (b) the recovered images ofthis study (contrast αmin = 2/9, blackness β = 1), (c) the recovered imageof Hsu’s study (αmin = 0.15, β = 0.75), (d) the recovered image of Lee’sstudy (αmin = 1/8, β = 1), (e) the recovered image of Ateniese’s study (pixelexpansion factor = 5, αmin = 1/5, β = 0.8).

low contrast as well as blackness. As shown in Fig. 4(b), theproposed approach can produce the clearest recovered imagefor set {1, 2, 3} than other approaches. The code collection forproducing Fig. 4(b) is listed in Table IX (access structure 3,δ= 0).

There are two major differences between Hsu’s modeland the proposed models. First, the proposed model aims tomaximize contrast for recovered images in the worst case.In contrast, Hsu’s model focuses on promoting the averagecontrast for recovered images. Second, the proposed modelguarantees the minimal blackness for recovered images, butHsu’s model does not. These differences indicate that the pro-posed model can produce better display quality for recoveredimages in the worst case.

A part of the solutions for the four participants producedby the proposed algorithm are listed in Table IX. Thesesolutions can help readers to verify the correctness of thefollowing comparison results. More results are available onhttp://www.csie.mcu.edu.tw/∼khlee/vc/gas.htm.

TABLE IX

A PART OF VCS SOLUTIONS FOR ACCESS STRUCTURES LISTED IN

TABLE V

No m δ Code Collects

2 4 0C0 = {1 : E0, 1 : E6, 1 : E11, 1 : E13}

C1 = {1 : E3, 1 : E5, 1 : E8, 1 : E14}

3 9 0C0 ={1 : E0, 1 : E1, 1 : E6, 1 : E7, 3 : E11, 1 : E12, 1 : E13}

C1 = {2 :E3, 2 : E5, 2 : E9, 1 : E10, 2 : E14}3 4 1 C0 = {1 : E0, 1 : E6, 1 : E11, 1 : E13}

C1 = {1 : E2, 1 : E5, 1 : E9, 1 : E14}4 4 0 C0 = {1 : E0, 1 : E7, 1 : E13, 1 : E14}

C1 = {1 : E5, 1 : E6, 1 : E11, 1 : E12}5 4 0

C0 = {1 : E0, 1 : E7, 1 : E11, 1 : E12}C1 = {1 : E3, 1 : E4, 1 : E8, 1 : E15}

6 5 1C0 = {1 : E0, 2 :E7, 1 : E9, 1 : E14}

C1 = {1 : E3, 1 : E5, 1 : E6, 1 : E8, 1 : E15}7 6 0 C0 = {1 : E0, 2 : E7, 1 : E11, 1 : E13, 1 : E14}

C1 = {1 : E3, 1 : E5, 1 : E6, 1 : E8, 2 : E15}δ: Control parameter for blackness of recovered images.

E. Demonstrations and Discussions

In this subsection, we show the implementation resultsof access structure 10, which has five participantsand shares a secret image based on access structure{{1, 2, 3, 4}, {1, 3, 4, 5}, {2, 3, 5}}. The cipher-text in thesecret image used in this experiment, as shown in Fig. 5(a),was written in various font sizes (i.e., 220, 160, 84, 72,60, 48, 36, and 24 pts). Fig. 5(b), (c), and (d) demonstratethe worst-case recovered images of Models A, B, and C,respectively.

Fig. 5(b) shows that the worst-case recovered image ofModel A can achieve only an 80% blackness; thus, the cipher-texts in smaller font sizes (e.g., the upper part of Fig. 5(b))look very dim and are very difficult for the human eye torecognize. The situation indicates that a VC scheme withoutthe blackness constraint may fail to decrypt secrets from therecovered image if the cipher-texts are not in a large/bold fontand that the recovered black secret pixels cannot remain at ahigh blackness. This case demonstrates that a VCS may failto decrypt secret images for some access structures due to thepoor visual quality of the worst-case recovered images, evenif the contrast of the image is maximized.

Fig. 5(c) and (d) illustrate that the cipher-texts become clearwhen the blackness is increased. In Fig. 5(c), four ‘S” in alarger font can be recognized. In Fig. 5(d), all “S” are clearenough for decrypting except for the smallest one. Althoughthe contrast value of Fig. 5(d) is lower than that of the others,the display quality of Fig. 5(d) is superior to that of Fig. 5(b)and (c) because all of the black secret pixels can be recovered.Because a cipher-text can be made in smaller (or thin) fontsthe secret image can have higher capacity in a given area or adealer can write the cipher-text in a smaller area. The aboveexample proves the effectiveness of the blackness constraint inthe proposed optimization model. These results also indicatethat the blackness can be more important than contrast in thevisual quality of a VC scheme.

VI. CONCLUSION

In this study, we propose a weak visual cryptogra-phy scheme for GASs using the optimization technique.


(a) (b)

(c) (d)

Fig. 5. A part of implementation results for access structure 10, (a) the secretimage (320 × 320 pixels, 192DPI), (b) the recovered image for set {2, 3, 5}(Model A, contrast α = 1/10, blackness β = 4/5), (c) the recovered imagefor set {2, 3, 5} (Model B, α = 1/10, β = 9/10), (d) the recovered image forset {1, 3, 4, 5} (Model C, α = 1/12, β = 1).

The proposed model for SIVCSs eliminates the disadvantagesof the pixel-expansion problem from which conventional VCscenarios suffer. Our method guarantees the blackness of blacksecret pixels for VCSs and improves the display quality ofthe worst-case image. The experimental results show that ourapproach performs better than those previously proposed interms of the display quality of the recovered image, whichincludes the controllable blackness for black secret pixels andmaintenance of the same aspect ratio as that of the originalsecret image.

The major contributions of this work include the followingthree: First, this is the first solution for weak SIVCS forGASs subject to controllable blackness of black secret pixels.Second, we formulate the construction problem of the SIVCSfor GASs as a mathematical optimization problem such thatthe problem can be solved by using optimization techniques.Third, the proposed method is a general and systematicapproach that can be applied to any VC schemes withoutindividually redesigning codebooks or basis matrices.

ACKNOWLEDGMENT

Hereby, the authors appreciate the anonymous reviewers fortheir valuable comments.

REFERENCES

[1] M. Naor and A. Shamir, “Visual cryptography,” in Advances in Cryp-tology, vol. 950. New York, NY, USA: Springer-Verlag, 1995, pp. 1–12.

[2] J. Weir and W. Yan, “A comprehensive study of visual cryptography,”in Transactions on Data Hiding and Multimedia Security V (LNCS),vol. 6010. New York, NY, USA: Springer-Verlag, 2010, pp. 70–105.

[3] C. N. Yang, “New visual secret sharing schemes using probabilisticmethod,” Pattern Recognit. Lett., vol. 25, no. 4, pp. 481–494, 2004.

[4] R. Ito, H. Kuwakado, and H. Tanaka, “Image size invariantvisual cryptography,” IEICE Trans. Fundam., vol. E82-A, no. 10,pp. 2172–2177, 1999.

[5] P. L. Chiu and K. H. Lee, “A simulated annealing algorithm for generalthreshold visual cryptography schemes,” IEEE Trans. Inf. ForensicsSecurity, vol. 6, no. 3, pp. 992–1001, Sep. 2011.

[6] G. Ateniese, C. Blundo, A. D. Santis, and D. R. Stinson, “Visualcryptography for general access structures,” Inf. Comput., vol. 129, no. 2,pp. 86–106, 1996.

[7] C. S. Hsu and Y. C. Hou, “Goal-programming-assisted visual cryp-tography method with unexpanded shadow images for general accessstructures,” Opt. Eng., vol. 45, no. 9, pp. 097001-1–097001-10, 2006.

[8] C. S. Hsu, S. F. Tu, and Y. C. Hou, “An optimization model forvisual cryptography schemes with unexpanded shares,” in Foundationsof Intelligent Systems (LNAI), vol. 4203. New York, NY, USA: Springer-Verlag, 2006, pp. 58–67.

[9] F. Liu, C. Wu, and X. Lin, “Step construction of visual cryptographyschemes,” IEEE Trans. Inf. Forensics Security, vol. 5, no. 1, pp. 27–38,Mar. 2010.

[10] A. Adhikari, T. K. Dutta, and B. Roy, “A new black and white visualcryptographic scheme for general access structures,” in Progress inCryptology (LNCS), vol. 3348. New York, NY, USA: Springer-Verlag,2004, pp. 399–413.

[11] L. A. MacPherson, “Grey level visual cryptography for general accessstructures,” M.S. thesis, School of Comput. Sci., Univ. Waterloo, Water-loo, ON, Canada, 2002.

[12] K. H. Lee and P. L. Chiu, “An extended visual cryptography algorithmfor general access structures,” IEEE Trans. Inf. Forensics Security, vol. 7,no. 1, pp. 219–229, Feb. 2012.

[13] F. Liu, C. K. Wu, and X. J. Lin, “A new definition of the contrastof visual cryptography scheme,” Inf. Process. Lett., vol. 110, no. 7,pp. 241–246, 2010.

[14] C. Blundo and A. De Santis, “Visual cryptography schemes withperfect reconstruction of black pixels,” Comput. Graph., vol. 22, no. 4,pp. 449–455, 1998.

[15] T. Hofmeister, M. Krause, and H. U. Simon, “Contrast-optimal k out ofn secret sharing schemes in visual cryptography,” Theoretical Comput.Sci., vol. 240, no. 2, pp. 471–485, 2000.

[16] H. Koga, “A general formula of the (t, n)-threshold visual secret sharingscheme,” in Advances in Cryptology, Asiacrypt. New York, NY, USA:Springer-Verlag, 2002, pp. 328–345.

[17] Y. W. Chow, W. Susilo, and D. S. Wong, “Enhancing the perceived visualquality of a size invariant visual cryptography scheme,” in Informationand Communications Security (LNCS), vol. 7618. New York, NY, USA:Springer-Verlag, 2012, pp. 10–21.

[18] H. B. Zhang, X. F. Wang, W. H. Cao, and Y. P. Huang, “Visual cryp-tography for general access structure using pixel-block aware encoding,”J. Comput., vol. 3, no. 12, pp. 68–75, 2008.

Kai-Hui Lee received the Ph.D. degree in electronicengineering from the National Taiwan University ofScience and Technology, Taipei, Taiwan, in 2002.He is a Professor with the Department of ComputerScience and Information Engineering, Ming ChuanUniversity, Taipei.

His current research interests include visual cryp-tography, wireless networks, and network resourcemanagements.

Pei-Ling Chiu received the Ph.D. degree in informa-tion management from the National Taiwan Univer-sity, Taipei, Taiwan, in 2007. She is a Professor withthe Department of Risk Management and Insurance,Ming Chuan University, Taipei.

Her current research interests include visual cryp-tography, wireless sensor networks, and optimizingtechnologies.

sryptography

Documents

decryptthe secret

obtainthe secret

secret imageis

n shares

binary secret images

index terms visual secret

secret pixels ratherthan

vcbased solution