0.1 The image division-shuffling process

Without loss of generality, we assume that the size of the color plain-image I is M × N, where M and N are the width and height of the image, respectively. Converting the image I into its red, green and blue components, one can get three color matrices I_R, I_G, I_B with size M × N. Then combine the red, green and blue matrices horizontally by the following formula (1) and obtain a matrix I₁ with M rows and 3N columns: (1) The image I₁ is decomposed equally into four blocks and each block can be labeled in the form of Blk.k, k = 1, 2, 3, 4, as shown in Fig. 2. The size of each block are given as follows: size(Blk. 1) = ⎿M/2⏌×⎿3N/2⏌, size(Blk.2) = ⎿M/2⏌×(3N−⎿3N/2⏌), size(Blk.3) = (M−⎿M/2⏌)×⎿3N/2⏌ and size(Blk.4) = (M−⎿M/2⏌)×(3N−⎿3N/2⏌). If M is an odd number, append the first row of Blk.4 to the end of Blk.2 and delete the first row of Blk.4. Then the sizes of blocks Blk.2 and Blk.4 are obtained as follows: size(Blk.2) = (M−⎿M/2⏌)×(3N−⎿3N/2⏌) and size(Blk.4) = ⎿M/2⏌×(3N−⎿3N/2⏌). And the sizes of the other two blocks keep unchanged. In the following, we will further shuffle the plain-image, which makes the encryption operation more confusing and complex as it adds one extra step to the encryption process.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Division of the plain-image.

https://doi.org/10.1371/journal.pone.0119660.g002

We firstly create three empty matrices, i.e., P₁ with size ⎿M/2⏌×3N, P₂ with size (M−⎿M/2⏌)×3N and I₂ with size M ×3N. Then insert each column of Blk.4 in turn into the odd columns of matrix P₁ and insert each column of Blk.1 sequentially into the even columns of matrix P₁ as illustrated in Fig. 3. Similarly, insert each column of Blk.2 in turn into the odd columns of matrix P₂ and insert each column of Blk.3 sequentially into the even columns of matrix P₂. Finally, insert each row of P₂ in turn into the odd rows of matrix I₂ and insert each row of P₁ sequentially into the even rows of matrix I₂. Thus a disordered image matrix I₂ with size M ×3N is obtained.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Shuffling of the image blocks Blk. 1 and Blk. 4.

https://doi.org/10.1371/journal.pone.0119660.g003

Implementing the above procedure, we apply the first complexity to our encryption approach, which significantly enhance the resistance against known/chosen-plaintext attacks.

0.2 CML and the fractional-order Chen chaotic system

The cryptosystems based on widely used one-dimensional discrete chaotic maps suffer from fundamental drawbacks such as small key space, slow performance speed and weak security function [39]. To overcome these limitations in the proposed encryption scheme, a 2D coupled map lattice (CML) and the fractional-order Chen chaotic system are utilized to generate the key streams.

A 2D CML was introduced by Kaneko and Tsuda [40] as a simple model capturing essential features of spatiotemporal dynamics of extended nonlinear systems and later was employed for modeling complex spatial phenomena in diverse areas of science and engineering. Recently, CML was introduced for cryptography of a self-synchronizing stream cipher. The 2D CML is defined as follows: (2) where f(x) is the mapping function, n is the discrete time index, n = 0, 1, 2.…,L−1, with L being the system size, k = 1, 2, …,S is the lattice site index, and ε∈(0, 1) is the coupling constant. In general, periodic boundary conditions x_n(k+L) = x_n(k) are assumed, and f(x) = 1– μx² is chosen where μ is a constant parameter and μ∈(0, 2). The chaotic behavior of 2D CML (2) is demonstrated in Fig. 4(a).

Another chaotic system in our scheme is the fractional-order Chen chaotic system, which is described by (3) where a, b, c and d are positive system parameters. When a = 35, b = 7, c = 28, d = 3, and α_j ∈[0.8,1] (j = 1, 2, 3), the fractional-order Chen system behave chaotically [41], as displayed in Fig. 4(b).

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. The chaotic behaviors of systems (2) and (3).

(a) The spatiotemporal attractor of the 2D CML (2) with μ = 1.8 and ε = 0.1, (b) the chaotic attractor of the fractional-order Chen system (3) with α₁ = α₂ = α₃ = 0.9.

https://doi.org/10.1371/journal.pone.0119660.g004

0.3 Generation of the initial conditions and parameters

In the proposed scheme, let L = M × N and S = 3 for the CML, i.e., n = 0, 1, 2,…, M × N − 1, k = 1, 2, 3. In view of the basic need of cryptology, the cipher-text should have a close correlation with the key. There are two ways to accomplish this requirement: one is to mix the key thoroughly into the plain-text through the encryption process, another is to use a good key generation mechanism. Here we use a 280-bit long external secret key (K), which is divided into blocks (K_i) of 8-bit, to derive the parameters ε, μ, a_j (j = 1, 2, 3) and the initial conditions x₀ (1), x₀ (2), x₀ (3), y₁ (0), y₂ (0) and y₃ (0) in systems (2) and (3). The 280-bit long secret key (K) is given by: (4) The initial conditions and parameters are obtained as follows: (5) (6) (7) (8) (9) (10) (11) (12) (13) (14) (15) where the | operator is the bitwise OR; the & operator is the bitwise AND; ⨁ is the bitwise XOR operator.

Clearly, from Equations (5)–(15), one can see that the initial conditions and parameters of the CML and the fractional-order Chen system are greatly sensitive to changes in even a single bit of the 280-bit secret key. Therefore, the proposed cryptosystem with a key space of 2²⁸⁰ can resist any brute-force attack.

0.4 Image permutation based on CML

Image data have strong correlations among adjacent pixels in horizontal, vertical, and also diagonal directions for both natural and computer-graphical images. In order to weaken the strong relationship among adjacent pixels, a CML is used to scramble the pixel positions of the image I₂.

To permute the positions of image pixels, we perform the following 11 steps:

Step 1. Use the initial conditions x₀(1), x₀(2), x₀(3) and the parameters ε, μ obtained in Section 0.3 to iterate Equation (2) for l₁ + MN times, and discard the former l₁ state values to get rid of harmful effects. One can get three chaotic sequences, i.e., , and .

Step 2. Preprocess the above three chaotic sequences by the following formula (16): (16) where , , i = 1, 2, …, MN, j = 1, 2, 3, and Round(x) represents the integer function which rounds the real number x to the nearest integer. Thus we get three chaotic analogue sequences , and with very well expressed random-like properties. Further, transform the vectors into the matrices MD_j with size M × N, where the value in row (mod(i −1, M) + 1) and column ⎾i/M⏋ of MD, denotes the i-th value of , i.e., , i = 1, 2, …,MN, j = 1, 2, 3.

Step 3. Divide the image matrix I₂ equally into three matrices from left to right, i.e., I₂₁ = I₂(1: M, 1: N), I₂₂ = I₂(1: M, (N+1): 2N) and I₂₃ = I₂(1: M, (2N+1): 3N). Transform the matrices I_21, I_22, and I₂₃ into three one-dimensional vectors VP₁, VP₂ and VP₃ with length MN, respectively. For example, VP₁ = {g_1,1, g_{1, 2}, …, g_1,MN}^T where g_1,i denotes the value of the image pixel in row (mod(i - 1, M) + 1) column ⎾i/M ⏋of I₂₁, i.e., g_1,i = I₂₁((mod(i - 1, M) + 1), ⎾i/M ⏋), i = 1, 2, …,MN. Sort MN values in VP_i and attain the sorted vectors . Find the positions of values in {g_i,1, g_i,2,…, g_i,MN}^T and mark the transformation positions TP_j = {p_i,1, p_i,2,…, p_i,MN}^T where is exactly the value of g_j,pii.

Step 4. Shuffle the values in SP_j by TP_j (j = 1, 2, 3), getting where . Then transform the three one-dimensional vectors , and into the three image matrices I₃₁, I₃₂ and I₃₃ with size M × N, respectively, where the pixel value of I_3,j in row (mod(i - 1, M) + 1) and column ⎾i/M ⏋ is equal to the i-th value of , i.e., , i = 1, 2, …, MN.

Step 5. Repeat Steps 6 to 11 n rounds (n ≤ min(M, N)).

Step 6. Let i ← 1;

Step 7. Sort N values of the i-th row of MD_j and obtain the transform positions TM_j,i = {pm_j,i(1), pm_j,i(2),… pm_j,i(N),} (j = 1, 2, 3). Scramble the pixel positions of the i-th row of image I_3,j according to TM_j,i, i.e., move the pm_j,i(1) column of the i-th row to the first column, the pm_j,i(2) column of the i-th row to the second column etc., until all columns have been moved; thus a new column transformation of the i-th row is generated.

Step 8. Let i ← i + 1, return to Step 7 until i reaches M. Thus we get three row-permuted matrices I₄₁, I₄₂ and I₄₃.

Step 9. Let i ← 1;

Step 10. Sort M values of the i-th column of MD_j and obtain the transform positions TD_j,i = {pd_j,i(1), pd_j,i(2),…, pd_j,i(N)}^T (j = 1, 2, 3). Shuffle the pixel positions of the i-th column of image I_4j according to TD_j,i, i.e., move the pd_j,i(1) row of the i-th column to the first row, the pd_j,i(2) row of the i-th column to the second row etc., until all rows have been moved; thus a new row transformation of the i-th column is obtained.

Step 11. Let i ← i + 1, return to Step 10 until i reaches N. Thus we obtain three new total shuffled matrices I_51, I₅₂ and I₅₃, which are respectively the R, G and B color matrices of a new permutation image denoted by I₅.

Obviously, the above permutation-only process just rearranges the pixel positions without changing the pixel’s value. Different from conventional block encryption methods such as DES and AES, the proposed algorithm shuffles the positions of image pixels totally by using the transform positions. Compared with the permutations based on one-dimensional or two-dimensional chaotic maps, the permutation scheme proposed overcomes the drawback of short periodicity, since the relationship between the original and shuffled position of one pixel is not directly related to the chaotic map. However, there are still some potential weak points in these permutation-only algorithms [42], which are weak against statistical attack and known-text attack. To deal with the weakness of pure position permutation method, in the following, a diffusion process is further employed to modify the pixel’s gray value to enhance the security of the encryption algorithm.

0.5 Image diffusion based on the fractional-order Chen chaotic system

The encryption algorithm proposed in this paper is based on a permutation-diffusion architecture. In the diffusion stage, the fractional-order Chen chaotic system is employed to generate the key stream for diffusion, and the pixel values are modified sequentially to confuse the relationship between the cipher-image and the plain-image. In some existing chaos-based image ciphers, the key stream used in the diffusion process is solely determined by the key. The same key stream is applied to encrypt different plain-images if the key remains unchanged. An opponent may derive the key stream by the plain-text attack, i.e., by ciphering some special plain-text sequences and then comparing them with the corresponding cipher-text sequences. In order to make the cryptosystem secure against a differential attack, the modification made to a particular pixel depends not only on the corresponding key stream element, but also on the accumulated effect of all previous pixel values. The diffusion process is decomposed into the following 5 steps:

Step 1. Arrange the pixels of permuted color matrices I_51, I₅₂ and I₅₃ obtained in Section 0.3 from left to right and then from top to bottom, respectively, we get three one-dimensional vectors PR = {pr₁, pr₂,…, pr_MN,}, PG = {pg₁, pg₂,…, pg_MN,} and PB = {pb₁, pb₂,…, pb_MN,}.

Step 2. Use the initial conditions y₁(0), y₂(0), y₃(0), and the fractional orders α_j (j = 1, 2, 3) generated in Section 0.3 to iterate Equation (3) for l₂ + MN times, and discard the former l₂ state values to avoid transient effects. We then obtain three chaotic sequences, i.e., L₁ = {y₁(l₂+1), y₁(l₂+2),…, y₁(l₂+MN),}, L₂ = {y₂(l₂+1), y₂(l₂+2),…, y₂(l₂+MN),} and L₃ = {y₃(l₂+1), y₃(l₂+2),…, y₃(l₂+MN)}.

Step 3. To get the key streams, preprocess the above three chaotic sequences according to the following formula (17):

(17)

where y_j(l₂ + i) ∊ L_j, , i = 1, 2, …, MN, j = 1, 2, 3, and Round(x) represents the integer function which has the same meaning as that in Equation (16), the function Abs(x) returns the absolute value of x and the function Fix(x) returns the value of x to the nearest integer towards zero. Thus we obtain three key streams , and .

Step 4. Calculate the corresponding pixel data of the cipher-image by using the values of the currently operated pixel and the previously operated pixels, according to the following formula:

(18)

(19)

(20)

where i = 1, 2, …, MN, ⨁ is the bitwise XOR operator, PR(i), PG(i) and PB(i) are the current plain pixel values, C_R(i), C_G(i) and C_B(i) are the current cipher pixel values, , and are the current key stream elements, C_R(i − 1), C_G(i − 1) and C_B(i − 1) are the previous cipher pixel values, and , and are the previous key stream elements. The first cipher pixel values C_R(1), C_G(1) and C_B(1) are set as follows:

(21)

(22)

(23)

Step 5. Transform three encrypted vectors C_R, C_G and C_B with length MN into three matrices with size M × N, i.e., CR, CG and CB, respectively, which are the R, G, B components of the ciphered image C. Thus we finally obtain the encrypted image.

Since the CML and the fractional-order chaotic system have a nonlinear structure and more complex dynamics than low-dimensional ones, the proposed chaos-based cryptosystem is greatly sensitive to a change in even a single bit of the 280-bit long secret key. Moreover, using the division-shuffling process and the permutation-diffusion process, a slight change of plain-image pixel causes a significant change in the cipher-image, which makes a differential analysis inefficient and practically useless. These features will in turn strengthen the security and sensitivity of the cryptosystem. In addition, the generation of pseudo-random numbers by the CML and the fractional-order Chen chaotic system and the division-shuffling process on the plain-image can be carried out simultaneously, i.e., in a parallel manner, which promotes the speed performance of the proposed image encryption algorithm. Therefore, our proposed scheme has higher security and overcomes the limitations in the image cryptosystem based on one-dimensional or two-dimensional chaotic maps.

0.6 Design of image decryption algorithm

Because the presented color image encryption algorithm is a symmetric cryptosystem, the decryption procedure is similar to that of the encryption process but just in the reversed order. However, some remarks should be considered in the decryption process, which are summarized as follows:

Remark 1. We can rewrite Equations (18)–(23) to give the pixel values in the RGB components:

(24)

(25)

(26)

(27)

(28)

(29)

where i = MN,(MN − 1), (MN − 2),…,3,2.

Remark 2. Perform the reverse operations to remove the effect of permutation. All operations are the same as steps 3–11 in the image permutation process.

Remark 3. Use the same method in the image division-shuffling process but in the reversed order to recover the original color image.

Remark 4. Note that since the decryption process requires the same key streams for decrypting the cipher-image, the same 280-bit long external secret key K = K₁K₂K₃…K₃₅ should be applied for decryption. Hence, according to Section 0.2, it is possible to set the same initial conditions x₀(1), x₀(2), x₀(3), y₁(0), y₂(0), and y₃(0), and the parameters ε, μ, α_j (j = 1, 2, 3).

Figs. 5 and 6 show the encryption and decryption of two color images of Lena and Vegetables with size 256 × 256, respectively, where the secret key is chosen as “2eea2814e6087660406d59f82f740bfd9c2e5e463d96bdafe482c8054f457bab5cd180” (in hexadecimal). Throughout this paper, the original image of Lena is freely available at the USC-SIPI image database [43].

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Experimental results for Lena image.

(a) Original image of Lena, (b) encrypted image of Lena, (c) decrypted image of Lena.

https://doi.org/10.1371/journal.pone.0119660.g005

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 6. Experimental results for Vegetables image.

(a) Original image of Vegetables, (b) encrypted image of Vegetables, (c) decrypted image of Vegetables.

https://doi.org/10.1371/journal.pone.0119660.g006

1.1 Key space analysis

The size of the key space is the total number of different keys that can be applied in the encryption/decryption process. The key space should be large enough to make brute-force attacks infeasible. From the cryptographic point of view, the size of the key space should not be smaller than 2¹⁰⁰ to ensure a high level of security [44]. Since the secret key of the proposed scheme is 280-bit long, the key space is 2²⁸⁰, which is sufficiently large enough to resist a brute-force attack.

1.2 Statistical analysis

Shannon suggested that diffusion and confusion should be employed in a cryptosystem [8] for the purpose of frustrating a powerful statistical analysis. An ideal cipher should be robust against any statistical attack. In order to demonstrate the robustness of the proposed image encryption scheme, we have performed some statistical tests on the histograms of the ciphered images and on the correlations of adjacent pixels in the ciphered image.

A. Histogram analysis.

Image histogram is a significant feature in image analysis. Indeed, one can see the frequency of each gray level from the histograms, which can leak image information. For a good encryption algorithm, the distribution of cipher-text should hide the redundancy of plain-text and not leak any information about the plain-text or the relationship between the plain-text and the cipher-text.

Figs. 7 and 8 display the histograms of the color plain-image “Lena” (Fig. 5(a)) and the corresponding cipher-image (Fig. 5(b)), respectively. From these figures, one can clearly see that the histograms of the encrypted image are fairly uniform and significantly different from those of the plain-image. The statistical feature of the plain-image is enhanced in such a manner that the cipher-image has a uniform gray level distribution and good balance property. Hence it does not offer any clue to be used in a statistical analysis attack on the encrypted image.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 7. Histogram of the original image of Lena in the (a) red, (b) green, (c) blue, components.

https://doi.org/10.1371/journal.pone.0119660.g007

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 8. Histogram of the encrypted image of Lena in the (a) red, (b) green, (c) blue, components.

https://doi.org/10.1371/journal.pone.0119660.g008

B. Correlation analysis of two adjacent pixels.

It is well known that the adjacent pixels of the plain images are highly correlated either in horizontal, vertical or diagonal directions. An efficient image encryption algorithm should decrease the correlation of two adjacent pixels in the ciphered image as low as possible.

In the following, the correlation between all pairs of two horizontally adjacent pixels, all pairs of two vertically adjacent pixels, and 2000 pairs randomly selected of two diagonally adjacent pixels in the plain-image and cipher-image is tested. The correlation coefficients between two adjacent pixels in an image are calculated using the following equations: (30) (31) (32) (33) where x and y are gray level values of two adjacent pixels in the image, N is the total number of pixels selected from the image, E(x) and E(y) are the mean values of x_i and y_i, respectively.

Fig. 9 shows the vertical relevance of adjacent pixels in the plain-image of Lena (Fig. 5(a)) and the encrypted one (Fig. 5(b)). The detailed results of the correlation coefficients for two horizontally (vertically and diagonally) adjacent pixels in the red, green and blue components of the original plain-image and the encrypted one are given in Table 1. These results clearly show that the correlation coefficients of the plain-image are close to 1, while those of the cipher-image are nearly 0 and the distribution of adjacent pixels is fairly uniform. It indicates that the proposed algorithm has successfully reduced the correlation of adjacent pixels in the plain-image so that neighboring pixels in the cipher-image virtually have no correlation. So the proposed algorithm can resist statistical attacks. Furthermore, the comparison performed in Table 2 demonstrates that the proposed scheme in this paper is superior to other methods reported in the literature. The cipher-image using our proposed algorithm has the highest performance in the horizontal, vertical and diagonal directions.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 9. Vertical direction correlations of two adjacent pixels.

Frames (a), (c) and (e) show the distribution of two vertically adjacent pixels in the plain-image of Lena in the (a) red, (b) green and (c) blue components, respectively. Frames (b), (d) and (f) display the distribution of two vertically adjacent pixels in the encrypted image of Lena in the (b) red, (d) green and (f) blue components, respectively.

https://doi.org/10.1371/journal.pone.0119660.g009

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Correlation coefficients of two adjacent pixels in the plain-image and cipher-image.

https://doi.org/10.1371/journal.pone.0119660.t001

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Comparison of correlation coefficients of two adjacent pixels in different directions using the proposed algorithm with some other algorithms.

https://doi.org/10.1371/journal.pone.0119660.t002

1.3 Information entropy analysis

There are various kinds of entropy, such as K-S entropy, K2 entropy, Tsallis entropy and information entropy etc. Information entropy, also called Shannon entropy, which was introduced by Shannon in 1948, is described by (34) where s denotes the information source, N is the number of bits to represent a symbol s_i ∊ s, p(s_i) is the probability of symbol s_i. For a purely random source emitting 2^N symbols, i.e., s = 2^N, the information entropy is H(s) = N. In fact, a practical information source seldom generates random messages. Therefore, in general its entropy value is smaller than the maximum one. However, when the messages are encrypted, their entropy should ideally be N. If the output of such a cipher emits symbols with entropy less than N, there is a certain degree of predictability, which threatens its security. In order to design a good cryptosystem, the information entropy of the cipher-image should be as close to the ideal case as possible.

For the cipher-image (Fig. 5(b)) of the original Lena image (Fig. 5(a)) encrypted using the proposed scheme, we record the number of occurrence of each cipher-image pixel m_i and calculate the probability of occurrence for the red, green and blue components of the cipher-image, respectively. The entropy of the three color components of the cipher-image is: where R_i, G_i and B_i are the color components of the pixel m_i. The values obtained are very close to the theoretical maximum value N = 8 for the three color components, which indicates that information leakage in the encryption process is negligible and the cryptosystem is secure against an entropy attack. Further, Table 3 compares information entropy using the proposed algorithm with those using the existing algorithms mentioned in Refs. [29, 46]. Obviously, the entropy obtained using our proposed algorithm is indeed closer to the maximum.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Comparison of the information entropy using the proposed algorithm with some other algorithms.

https://doi.org/10.1371/journal.pone.0119660.t003

1.4 Differential attack

In general, an opponent may make a slight change (e.g., modify only one pixel) in the plain-image and compare the ciphered images to find out some meaningful relationship between the plain-image and the cipher-image, which can facilitate in determining the secret key. If one minor change in the plain-image can cause a significant change in the cipher-image, with respect to diffusion and confusion, then this differential attack would become very inefficient and practically useless.

As a general requirement for all the image encryption schemes, the encrypted image should be clearly different from its original form. Such a difference can be measured by means of two criteria, namely, the number of pixel change rate (NPCR) and the unified average changing intensity (UACI) [4, 28]. The more NPCR approaches 100%, the more effective for the cryptosystem to resist a plain-text attack. The larger UACI is, the more effective for the cryptosystem to resist a differential attack.

The formulas for calculating NPCR and UACI are described, respectively, as follows: (35) (36) where M and N are the width and height of the image, C_R,G,B and are the two encrypted images before and after only one pixel of the plain-image is changed, respectively, C_R,G,B(i, j) and are the values of the corresponding red, green or blue component in the two cipher-images, respectively. The matrix D_R,G,B is defined as follows: if , then D_R,G,B(i, j) = 0; otherwise, D_R,G,B(i, j) = 1. For instance, for two random images with 256 × 256 pixels and 24-bit true color, the expected values of NPCR_R,G,B and UACI_R,G,B are, respectively, computed as follows: NPCR_R = NPCR_G = NPCR_B = 99.6094% and UACI_R = UACI_G = UACI_B = 33.4635%.

To test the NPCR and UACI of the proposed cryptosystem, two plain images with only one bit difference are employed, i.e., the original color image of Lena, and the other one which is obtained by randomly modifying the value ‘213’ of the pixel located at (2,129) of the red component in the original image as ‘214’. Their corresponding ciphered images are obtained by encrypting the two plain images with the same key after n rounds of the proposed permutation process. The NPCR_R,G,B and UACI_R,G,B versus permutation rounds n are plotted in Fig. 10(a) and (b), respectively. One can find that different NPCR_R,G,B and UACI_R,G,B are obtained after different permutation rounds; after n = 14 permutation rounds, we get the largest value of NPCR_R,G,B, while the value of UACI_R,G,B is small; after n = 10 permutation rounds, we obtain the largest values of UACI_R,G,B, and the values of NPCR_R,G,B are more than 99.7%. From Fig. 10, we also find that the performance of NPCR_R,G,B and UACI_R,G,B are better after n = 10 permutation rounds than that obtained after other permutation rounds. The detailed results of NPCR_R,G,B and UACI_R,G,B with permutation rounds n = 10 are given in Table 4. One can easily see that the NPCR_R,G,B is over 99.79% and the UACI_R,G,B is over 49.19%, which implies that the proposed image cryptosystem is very sensitive to tiny changes in the plain-image. A slight change in the original image will result in a significant change in the ciphered image, so the proposed scheme can well resist a known/chosen plaintext attack.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 10. NPCR and UACI performance analysis of the proposed scheme.

(a) NPCR versus permutation rounds, (b) UACI versus permutation rounds.

https://doi.org/10.1371/journal.pone.0119660.g010

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. NPCR and UACI of the color image of Lena when changing one pixel and permutation rounds n = 10.

https://doi.org/10.1371/journal.pone.0119660.t004

Table 5 compares the NPCR_R,G,B and UACI_R,G,B for the proposed method and the schemes in Refs. [11, 26, 28, 30, 37, 45, 46] on the color image of Lena. As it is clear from the simulation results, our proposed cryptosystem achieves a higher performance by having NPCR_R,G,B ⩾ 99.79% and UACI_R,G,B ⩾ 49.19%.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 5. Comparison of the average NPCR and UACI values on the color image of Lena.

https://doi.org/10.1371/journal.pone.0119660.t005

1.5 Key sensitivity analysis

An efficient encryption scheme has also to be sensitive to the secret key, i.e., a very small change in the key will cause a significant change in the output. Suppose that two 280-bit secret keys are chosen randomly as: K1 =“ 2eea2814e6087660406d59f82f740bfd9c2e5e463d96bdafe482c8054f457bab5cd180” and K2 =“ 2eea2814e6087660406d59f82f740bfd9c2e5e463d96bdafe482c8054f457bab5cd181”. Obviously, two keys are different in only one bit. The key sensitivity test is carried out as follows.

The original color image of Lena is firstly encrypted by using the secret key K1 and then encrypted by using the secret key K2. We get two ciphered images by two slightly different keys. Fig. 11 displays the test results. The test shows that there is a difference up to 99.64% in terms of pixel gray-scale values between the encrypted image with K1 (Fig. 11(b)) and the encrypted one with K2 (Fig. 11(c)). Moreover, in Fig. 12, we have shown the results of some attempts to decrypt an encrypted image with slightly different secret keys. We use the color image of Lena as the plain-image. Fig. 12(a) shows the encrypted image by using the secret key K1. Fig. 12(b) displays the decrypted image by using another trivially modified key K2. Fig. 12(c) plots the decrypted image by using the correct key K1. The encrypted image by using the secret key K2 is displayed in Fig. 12(d). The decrypted image by using the slightly different key K1 is shown in Fig. 12(e). The decrypted image by using the correct key K2 is depicted in Fig. 12(f). Obviously, the decryption with a slightly different key fails completely and hence the proposed image encryption scheme is highly key sensitive.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 11. Key sensitivity test I.

(a) Original image of Lena, (b) encrypted image of Lena with the secret key K1, (c) encrypted image of Lena with the secret key K2, (d) difference image.

https://doi.org/10.1371/journal.pone.0119660.g011

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 12. Key sensitivity test II.

(a) Encrypted image of Lena with the secret key K1, (b) decrypted image with the secret key K2, (c) decrypted image with the secret key K1, (d) encrypted image of Lena with the secret key K2, (e) decrypted image with the secret key K1, (f) decrypted image with the secret K2.

https://doi.org/10.1371/journal.pone.0119660.g012

Furthermore, as discussed in Section 0.3, the transformations used in Equations (5)–(15) are constructed such that the initial conditions and parameters of the CML and the fractional-order Chen chaotic system are highly sensitive to a slight change even in one bit of the secret key, which will lead to undesired decryption images. The average pixel differences of some color images (Figs. 5(a), 6(a) and 13) using the random keys K1 and K2 are given in Table 6. From the results in Table 6, one can easily see that the values obtained by the proposed method are very close to the expected value of pixel difference on two randomly generated images (NPCR = 99.6094% and UACI = 33.4635%).

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 13. Some original plain-images used in Table 6.

(a) City gate tower, (b) Elephantine mountain, (c) Pandas, (d) Peony.

https://doi.org/10.1371/journal.pone.0119660.g013

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 6. Comparison of pixel difference between images encrypted by keys with one-bit difference.

https://doi.org/10.1371/journal.pone.0119660.t006

1.6 Speed performance

Besides the security consideration, the running speed of the algorithm is also an important issue for a well applicable cryptosystem, especially for real-time Internet applications. We implement the proposed algorithm by using Matlab 7.1. The speed performance is tested in a computer with an Intel Core 2 Duo CPU 2GHZ, 1.99GB Memory and 600GB hard-disk capacity, and the operating system is Microsoft Windows XP. From Refs. [47, 48, 49], we know that the encryption time of Refs. [5, 50, 51] are 3.704s, >10s and 2.901s, respectively. Table 7 shows the comparison of the experimental results between the proposed encryption method and other image cryptosystems in [5, 50, 51, 52]. Compared to the encryption schemes in [5, 50, 51, 52], we can see that the operation speed of our method is clearly faster for the image of Lena.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 7. Comparison of encryption time between our proposed method and some other cryptosystems.

https://doi.org/10.1371/journal.pone.0119660.t007

2.1 Noise addition

Generally, addition of noise is responsible for the degradation and distortion of the image. The cipher-image is also degraded by noise addition, resulting in difficulties in image decryption. We tested the proposed scheme’s robustness against two types of noise: Pepper & Salt noise and Gaussian noise, which are added to the cipher-image. Fig. 14(a) and (b) show the plain-image of Lena and the corresponding cipher-image without noise addition, respectively. We add Pepper & Salt noise with different noise densities, i.e., 0.005, 0.05 and 0.5, to the cipher-image, as displayed in Fig. 14(c), (e) and (g), respectively. The proposed scheme is utilized to decrypt the noise-contaminated ciphered images. The decrypted images are shown in Fig. 14(d), (f) and (h), respectively. The corresponding PSNR values of the decrypted images are 47.57dB, 31.87dB and 19.11dB, respectively. In addition, Gaussian white noise with mean value 0 and variance value 0.05 is added to the cipher-image, as shown in Fig. 14(i). Fig. 14(j) plots the decrypted image of the cipher-image in Fig. 14(i). Here the PSNR value of the decrypted image is 19.25dB. The results demonstrate that the noise-added encrypted image can still be decrypted appropriately, i.e., most information can be recovered.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 14. Test of noise addition.

(a) Original image of Lena, (b) encrypted image of Lena without noise addition, (c) encrypted image of Lena under adding Pepper & Salt noise with noise density 0.005, (d) decrypted image under Pepper & Salt noise addition (noise density 0.005), (e) encrypted image of Lena under adding Pepper & Salt noise with noise density 0.05, (f) decrypted image under Pepper & Salt noise addition (noise density 0.05), (g) encrypted image of Lena under adding Pepper & Salt noise with noise density 0.5, (h) decrypted image under Pepper & Salt noise addition (noise density 0.5), (i) encrypted image of Lena under Gaussian white noise addition, (j) decrypted image under Gaussian white noise addition.

https://doi.org/10.1371/journal.pone.0119660.g014

2.2 Cropping

Image cropping is very common in real applications. Cropping removes the outer parts of an image to enhance framing, accentuate subject matter or modify aspect ratio, which is a lossy manipulation. Fig. 15(a) shows that 25% of the cipher-image is removed where 255 is inserted to the cropped pixels, and then the decrypted image is well obtained using the proposed scheme (Fig. 15(b)). The corresponding PSNR value is 29.15. Even there were only a half of the encrypted image remained (Fig. 15(c)), the deciphered image is still recognizable, as shown in Fig. 15(d). Here the PSNR value is 23.88. In fact, we can always decrypt the cropped cipher-image with most recover information when the cropped part has a size of less than 256×256 pixels.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 15. Test of image under cropping.

(a) Cropped cipher-mage by removing 25% of the encrypted image of Lena (Fig. 14(b)), (b) decrypted image of the cropped cipher-image (a), (c) cropped cipher-mage by removing 50% of the encrypted image of Lena (Fig. 14(b)), (d) decrypted image of the cropped cipher-image (c).

https://doi.org/10.1371/journal.pone.0119660.g015

2.3 JPEG compression

Image compression is another very prevalent operation in digital images. In testing the tolerance of JPEG compression, the results show that the encrypted image, if being JPEG compressed, can be decrypted by the designed image encryption scheme, and the decrypted image after JPEG compression is still recognizable. A test is shown in Fig. 16. Fig. 16(a) displays the cipher-image after JPEG compression, where the quality factor used by the JPEG compression is 50. Here, the quality factor is a kind of measure for JPEG compression, commonly within a range between 1 to 100: the bigger the factor, the better the quality of the image after JPEG compression and, correspondingly, the smaller the compression rate. The PSNR value of the decrypted image (Fig. 16(b)) is 18.65dB. Further simulation results show that the deciphered image can still be decrypted with most recover information while any quality factor in [1,100].

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 16. Test of image encryption with JPEG compression.

(a) JPEG compressed cipher-mage of Lena, (b) decrypted image under JPEG compression.

https://doi.org/10.1371/journal.pone.0119660.g016

2.4 Rotation

Image rotation makes the coordinate axes changed. Without synchronization of the orthogonal axes, one cannot decrypt the cipher-image correctly. Here, we do not consider the question of how to recover the axes, which have been geometrically distorted. We assume that the distorted axes have been recovered before the cipher-image is decrypted. Simulations have shown that in this case we can still decipher the encrypted image (Fig. 17(b)) when the ciphered image is rotated by 45°, as shown in Fig. 17(a). Here the value of PSNR is 18.65dB.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 17. Test of image under rotation.

(a) Rotated cipher-image of Lena, (b) decrypted image under rotation.

https://doi.org/10.1371/journal.pone.0119660.g017

2.5 Brightening and darkening

We also test the proposed scheme’s robustness against image brightening and darkening attacks, which increases or decreases the color intensities in a colormap. Simulation results are given in Fig. 18. Fig. 18(a) and (c) display the cipher-image after brightened and darkened, respectively. Fig. 18(b) and (d) show the deciphered images decrypted from the brightened and darkened encrypted images, respectively, where the PSNR values of the decrypted images separately are 18.68dB and 18.66dB. These test results show that the ciphered image after brightened or darkened can still be decrypted with most recovered information.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 18. Test of image under brightening and darkening.

(a) Brightened cipher-image of Lena, (b) decrypted image under brightening, (c) darkened cipher-image of Lena, (d) decrypted image under darkening.

https://doi.org/10.1371/journal.pone.0119660.g018

Remark 5. From the above results, one can easily conclude that the proposed image encryption technique is highly robust against some common image processing operations and geometric attacks, e.g. noise addition, cropping, JPEG compression, rotation, brightening and darkening.