Reversible data hiding for encrypted image based on adaptive prediction error coding

Reversible data hiding (RDH) is a useful technique of data security. Embedding capacity is one of the most important performance of RDH for encrypted image. Many existing RDH algorithms for encrypted image do not reach desirable embedding capacity yet. To address this problem, a new RDH algorithm is proposed for encrypted image based on adaptive prediction error coding. The proposed RDH algorithm uses a block-based encryption scheme to preserve spatial correlation of original image in the encrypted domain and exploits a novel technique called adaptive prediction error coding to vacate room for data embedding. A key contribution of the proposed RDH algorithm is the adaptive prediction error coding. It can efﬁciently vacate room from encrypted image block by adaptively coding prediction errors according to block content and thus contributes to a large embedding capacity. Many experiments on benchmark image databases are done to validate performance of the proposed RDH algorithm. The results show that the average embedding rates on the open databases of UCID, BOSSBase and BOWS-2 are 1.7081, 2.4437 and 2.3083 bpp, respectively. Comparison results illustrate that the proposed RDH algorithm outperforms some state-of-the-art RDH algorithms in embedding capacity.


INTRODUCTION
With the rapid development of information technology, communication via the Internet has become more convenient. Meanwhile, there are security risks during information transmission, such as information monitoring, information tampering and information forgery. Therefore, data security has attracted much attention in the past years. Reversible data hiding (RDH) [1][2][3][4] is a useful technique of data security. It can embed secret information into multimedia carrier, e.g. image, video and audio, and does not significantly change perceptual characteristic of the carrier. Moreover, it can exactly recover the carrier after data extraction. These advantages make RDH techniques suitable for many applications [5][6][7][8], such as judicial imaging, privacy protection, medical application and military communication. As digital images are widely used in our lives, researchers have designed many image-based RDH algorithms. According to the meanings of visual contents of digital images, these RDH algorithms can be divided into two kinds: RDH algorithms for plaintext image [9][10][11] and RDH algorithms for encrypted improved algorithm by dividing image into coarse blocks and smooth blocks. The results show that the improved algorithm is better than the algorithm [16] in embedding capacity. Zhang et al. [18] proposed to estimate some pixels before encryption and vacate room for embedding additional information by shifting the estimated error histogram. This RDH algorithm is errorfree in image recovery and data extraction. To make a high embedding capacity, Yi and Zhou [19] improved Zhang et al.'s RDH algorithm [18] by using half of image pixels for estimation. In another work, Cao et al. [20] introduced an RDH algorithm by using the patch-level sparse representation. This algorithm can reach high capacity. Wu et al. [21] used pixel redundancy of natural images to make room for embedding by vacating two lowest bits of pixels. Puteaux and Puech [22] proposed a new most significant bit (MSB) prediction method for RDH algorithm in encrypted image, in which MSB values are used to embed secret message instead of LSB values. Motivated by [22], Puyang et al. [23] designed a two-MSB prediction to explore correlation between local pixels for improving embedding capacity. The average payload of [23] is about 1.5 times as larger as the average payload of [22]. Recently, Wu et al. [24] used an edge detector to predict pixels, and exploited pixel differences between original pixels and their predicted pixels to make room for embedding before image encryption. Mohammadi et al. [25] proposed to divide original image into blocks and used a local difference predictor to reserve room. Both the schemes [24,25] make full use of spatial correlation among original pixels, which contributes to a high embedding capacity.
(2) RDH algorithms based on RRAE: A famous RRAE based algorithm was designed by Zhang in 2011 [26]. This algorithm divides the encrypted image into blocks and embeds one bit into a block by flipping three LSBs of half block pixels. It extracts secret data by using a fluctuation function and cannot avoid extraction errors theoretically. Inspired by [26], Hong et al. [27] designed a new effective fluctuation function to measure block smoothness. The results illustrate that the number of the extracted error bits of Hong et al.'s algorithm [27] is smaller than that of Zhang's algorithm [26]. Zhou et al. [28] presented a secure RDH algorithm by embedding secret data using a public key modulation mechanism. This algorithm can conceal more than one bit in an encrypted block. Yu et al. [29] exploited two-dimensional permutation and the exploiting modification direction (EMD) to design a new RDH scheme. In this scheme, a histogram of adjacent encrypted pixel errors is constructed, and secret data is embedded into the histogram via EMD. To preserve spatial correlation in the encrypted domain, Tang et al. [30] encrypted image by additive homomorphism and then embedded secret data by shifting block histogram of pixel differences. In another work, Tang et al. [31] used a block-based encryption scheme to conduct image encryption and proposed a novel technique called differential compression to vacate room from encrypted image for data embedding. Both the methods [30,31] reach high embedding rate. Zheng et al. [32] used logistic map to encrypt image and compressed LSBs of encrypted image for vacating room by lossless compression. Yin et al. [33] divided original image into blocks, encrypted image through a multi granularity encryption method, and exploited the histogram shifting to embed secret information. Recently, Yi and Zhou [34] proposed a novel technique called parametric binary tree labelling for reserving room in encrypted domain by classifying encrypted pixels. This scheme has a high embedding rate.
Most RDH algorithms for encrypted image have good performance in their applications, but they do not reach desirable embedding capacity yet. To address this problem, we propose a new RDH algorithm for encrypted image based on adaptive prediction error coding. A key contribution is the novel technique called adaptive prediction error coding. It can efficiently vacate room from encrypted image block by adaptively coding prediction errors according to block content and thus contributes to a desirable embedding capacity. Experiments on benchmark image databases are done to validate performance of the proposed RDH algorithm. The comparison results illustrate that the proposed RDH algorithm outperforms some state-ofthe-art RDH algorithms for encrypted image.
The rest of this paper is organized as follows. Section 2 explains the proposed RDH algorithm in detail. Section 3 presents experimental results and Section 4 makes conclusions of this paper.

PROPOSED REVERSIBLE DATA HIDING ALGORITHM
Framework of the proposed RDH algorithm consists of three parts, as shown in Figure 1. In the first part, content owner encrypts original image under the control of encryption key. Output of the first part is the encrypted image. In the second part, data hider applies the proposed adaptive prediction error coding to vacate room from the encrypted image and then embeds secret data into the reserved room with data-hiding key. Note that the secret data mentioned in this work is a bit sequence, which can be generated from any data file, such as an image, a text file or a PDF file. In the third part, receiver can conduct different operations on the marked encrypted image according to the available knowledge of keys. If the receiver only has the data-hiding key, he/she can exactly extract secret data from the marked encrypted image. If the receiver only has the encryption key, he/she can recover image from the marked encrypted image. If the both keys are available, he/she can conduct data extraction and image recovery from the marked encrypted image. Detailed steps of the proposed RDH algorithm are explained as follows.

Image encryption
To preserve spatial correlation of original image in the encrypted domain, a block-based scheme is used to conduct image encryption. To do so, an original image is firstly divided into non-overlapping blocks sized s × s. For simplicity, suppose that there are M image blocks in total and the blocks are numbered from left to right and top to bottom (i = 1, 2, …, M). Next, a well-known chaotic map called skew tent map is used to calculate a chaotic sequence with M random numbers, which are exploited to encrypt blocks by XOR operation. The definition of the used skew tent map [35] is as follows.
where μ ∈ (0, 1) represents the control parameter. In this work, the control parameter μ and the initial value y 0 ∈ [0, 1] are used as the keys for controlling the random sequence c by iteratively repeating the Equation (1). It is reported that the total combinations of μ and y 0 for the skew tent map is 2 104 [36], which is a large key space against the brute-force attacks [37,38]. Since the elements of the random sequence c are real numbers, they are converted to integers in the range of [0, 255] by the below equation.
where mod(⋅, ⋅) represents the modulus operation, and c i and d i represent the i-th elements of the sequences c and d (1 ≤ i ≤ M), respectively. After the random integer sequence d is obtained, the i-th image block is encrypted by bit-wise XOR operation as follows.
where b i,j is the j-th pixel of the i-th block, p i,j is the corresponding encrypted pixel, and the symbol '⊕' represents the bitwise XOR operation. After all image blocks are processed, the encrypted blocks are scrambled to make the final encrypted image E under the control of secret key. The key space of our block scrambling is M!. Therefore, the key space of our encryption scheme is 2 104 M!.

Data embedding with adaptive prediction error coding
Prediction errors of the encrypted image are firstly calculated. To do so, the encrypted image is divided into non-overlapping image blocks sized s × s. Let B i be the i-th block (1 ≤ i ≤ M) and p i,j be the j-th pixel of B i . Assume that p i,t is the smallest pixel of B i . Thus, the prediction error of p i,j can be calculated by the below equation.
Clearly, e i,j ≥ 0. As spatial correlation of original image is well preserved in the encrypted domain, pixels in encrypted block are still similar. This property makes small prediction errors, which is helpful to adaptive coding. After prediction error calculation, the processed encrypted block B ′ i is obtained as follows.
where b ′ i, j represents the j-th pixel of B ′ i . After all image blocks are processed, a predicted encrypted image for adaptive coding is available.
As prediction error is a non-negative small value, it can be coded with fixed-length bits for reserving room. Suppose that α i bits are used to represent the prediction errors of the block Thus, the reserved room of an encrypted pixel is f i = 8 − α i bits. Clearly, the smaller the α i value, the larger the reserved room and thus the higher the embedding capacity. Note that there are s 2 −1 prediction errors in each block, and α i bits can only represent 2 i integers ranging from 0 to 2 i − 1. If the selected α i is too small, some prediction errors cannot be coded by the fixed-length bits and thus they must be marked with sign. In this paper, a binary sequence with m '0's (1 ≤ m ≤ 7) is selected as the sign for marking those prediction errors which cannot be coded by α i bits. If the used α i is too big, the reserved room is limited. Therefore, a proper α i selection can make a good coding performance. Figure 2 presents structure of prediction error after adaptive coding. Figure 2(a) is the structure of prediction error coded with α i bits. Clearly, the first α i bits are the corresponding binary code of the prediction error, and the rest is the reserved room sized (8 − α i ) bits, which is used to conceal data. Figure 2(b) is the structure of prediction error marked sign, where the first m bits are all '0' (the sign) and the remained (8 − m) bits are the original data of the prediction error. Note that the original first m bits of the prediction error are picked out in advance before   Yes   TABLE 2 One-to-one mapping code book between the prediction error and its code when α i > m

No. Error value
Code with α i bits Usable inserting the sign and will be embedded into the block for image recovery.
Since the elements of the sign are all '0', those fixed-length binary codes with m '0's as the prefix cannot be used for adaptive coding. According to the relation of α i and m, two code books can be generated as shown in Tables 1 and 2. Table 1 presents the code book for α i ≤ m, where only one code with m '0's is discarded and other codes are all used. In this case, the binary code of the prediction error not bigger than 2 i − 2 can be found in the one-to-one mapping table. Table 2 presents the code book for α i > m, where 2 i −m codes are not used since their prefixes contain m '0's. In this case, the binary code of the prediction error not bigger than 2 i − 2 i −m − 1 can be found in the code book. Therefore, the prediction error to be coded should satisfy the below rule.
Suppose that there are n i pixels whose prediction errors satisfying the rule in Equation (6). Therefore, the practical capacity of the i-th block can be determined as below equation.
In the right part of the Equation (7), the first term is the size of reserved room and the second term is the cost of preserving the prefixes of those prediction errors marked with sign. Consequently, for a given m, the optimal α i can be determined by solving an optimization problem as below.
where i ∈ {1, 2, … , 7}. Note that α i denotes the number of the used bits of a pixel for prediction error coding. Therefore, α i = 8 cannot be selected because there is no bit to conceal data. Clearly, different blocks have different optimal α i values.
To ensure exact data extraction, the used optimal α i value is embedded into its block. Since its maximum value is 7, 3 bits are enough for storing the α i value. Except the optimal α i value, other auxiliary information should be also preserved. Note that the smallest pixel is used during prediction error calculation, which is also required for data extraction. However, the position of the smallest pixel in each block is unknown. To solve this problem, the position of the smallest pixel is first recorded and embedded into the block, and then the smallest pixel and the last pixel of the block are swapped. During data extraction, the smallest pixel can be easily picked out and restored under the guidance of the position information. As the block size is s × s, the required bits for storing position of the smallest pixel is ⌈log 2 s 2 ⌉ = ⌈2log 2 s⌉, where ⌈.⌉ is the upward rounding. Note that range of the pixel position is [0, s 2 −1]. Specifically, position of the first pixel is represented by 0, position of the second pixel is represented by 1, and so on. Therefore, the size of auxiliary information of each block is ⌈2log 2 s⌉ + 3 bits. Consequently, the usable room of the i-th block is determined by the below equation.
If r i ≥ 1, the i-th block is a usable block and can be exploited to conceal secret data. Otherwise, the block is unusable. Let v i be the embedding capacity of the i-th block. Thus, it can be Since there are M blocks in the encrypted image, a binary map S with M elements can be used to represent block signs. The element of the map S can be defined as follows.
Consequently, the pure capacity of an encrypted image can be calculated by the following equation.
To make easy operations of data embedding and extraction, the block sign (i.e. S(i)), the optimal α i value and the position of the smallest pixel are all embedded in the block. Specifically, the block sign is inserted into the eighth bit of the last pixel of the block. If the block sign S(i) = 1, the three bits of the α i value are hidden in the seventh to fifth bits of the last pixel and then the ⌈2log 2 s⌉ bits of pixel position are inserted into the first ⌈2log 2 s⌉ bits of the reserved room. Note that the eighth to fifth bits of the last pixel are also picked out in advance before data insertion and will be embedded into the encrypted block for image recovery.
During data embedding, the eighth to fifth bits of the last pixels of the usable blocks (suppose that the number of the usable blocks is q) are connected with the encrypted version of the secret data to construct the data to be embedded. The encrypted version of secret data is calculated by the bitwise XOR operation between the secret data and a pseudorandom bit sequence generated by the famous RC4 algorithm [39] under the control of the data-hiding key. Note that, for each usable block, the first ⌈2log 2 s⌉ bits have been used for storing pixel position, some vacated bits are used to store the preserved bits (i.e. those bits of the pixels replaced by m '0's), and only the remained room can be used for data embedding. Therefore, we embed data into the remained room block by block. To better illustrate our embedding, Figure 3 presents the structures of the room and the embedded data used in our algorithm. Figure 3(a) is the structure of the reserved room of a block, where the first ⌈2log 2 s⌉ bits represent the position of the smallest pixel of the block, the second part is the preserved bits and the remained room can be used to embed data. Figure 3(b) is the structure of the embedded data, where the first M bits are the 8th bits of the last pixels of all blocks, the 3q bits are the seventh to fifth bits of the last pixels of the usable blocks, and the rest data is the encrypted secret data. Figure 4 illustrates an example of our data embedding with prediction error coding. Suppose that the parameter selection is m = 2. Figure 4(a) is a 2 × 2 image block, (b) is the result of prediction errors and (c) is the binary codes of (b). By solving the Equation (8), it can be determined that the optimal value is α = 2. Thus, a code book can be generated as listed in Table 3. According to the code book, the prediction errors 1 and 2 are represented by '10' and '11' and the prediction error 17 cannot be coded. Therefore, the coding results of errors 1 and 2 are '10******' and '11******', where '*' is the reserved room. Moreover, the eighth to seventh bits of the prediction error 17 are replaced with the sign '00' (its original bits '00' are picked out in advance and will be preserved in the reserved room). Figure 4(d) is the results of error coding. Next, the positions of the smallest pixel 54 and the last pixel are swapped. As the position of the smallest pixel 54 is 2 (it is numbered from left to right and top to down), its binary code is '10'. Clearly, the block sign is 1. As α = 2, its binary code with 3 bits is '010'. Therefore, the eighth bit of the last pixel is replaced with '1' and its seventh to fifth bits are replaced with '010'. The position of the smallest pixel '10' is inserted into the reserved room of the first prediction error, and the first two bits of the prediction error 17 (i.e. '00') are preserved in the next two bits of the first prediction error. Figure 4(e) presents our coding with auxiliary information, where '*' is the reserved room for data embedding.

Data extraction and image recovery
When the marked encrypted image is obtained, the receiver can extract auxiliary information for data extraction and image recovery. The marked encrypted image is firstly divided into blocks and the eighth bits of the last pixels of all blocks are picked out. Once the block signs are available, the number of the usable blocks (i.e. q) can be calculated. According to the seventh to fifth bits of the last pixels of each block, the used α i of the block can be determined. Consequently, the code book of prediction error coding can be generated with the guide of the parameter m. Next, the receiver can extract data hidden in each block by jointly using the code book and the prefix with m '0's. As the structures of the room of block and the embedded data are known, the receiver can pick out different data according to the available knowledge of keys. There are three cases as follows.
1. Only the data-hiding key is available. In this case, the receiver only picks out the encrypted secret data from the extracted data. He/she can correctly decrypt the encrypted secret data by bitwise XOR operation with the pseudorandom bit sequence generated by the RC4 algorithm under the control of the data-hiding key. 2. Only the encryption keys are available. The receiver firstly picks out the M bits and 3q bits from the extracted data. The M bits are used to replace the eighth bits of the last pixels of all blocks, and the 3q bits are used to replace the seventh to fifth bits of the last pixels of the usable blocks. For each usable block, the receiver picks out the bits of pixel position and the preserved bits. With the position information, the original last pixel and the original smallest pixel can be correctly swapped. In addition, those prediction errors marked with signs can be reconstructed by using the preserved bits. Next, the encrypted pixels can be restored by adding the smallest pixel to their prediction errors. Encrypted blocks are then re-scrambled under the control of secret key. A random integer sequence generated by the skew tent map is calculated under the control of secret keys, as illustrated in Section 2.1. Finally, the original image can be reconstructed from the encrypted image by bitwise XOR operation between the random integer sequence and the image blocks. 3. Both the data-hiding key and the encryption keys are available. The receiver can exactly extract secret data by using the operations described in the first case. Moreover, he/she can also correctly decrypt the encrypted image by the operations described in the second case.

EXPERIMENTAL RESULTS
Extensive experiments on benchmark images are done to verify the performance of the proposed RDH algorithm. In the fol- lowing experiments, our parameter settings are as follows. The block size is 4 × 4, and the parameter m is 5. Section 3.1 introduces our data-hiding results, and Section 3.2 discusses security of our encrypted images. Section 3.3 presents parameter discussion. Section 3.4 compares the proposed RDH algorithm with some state-of-the-art RDH algorithms.

Data-hiding results
Six benchmark grey images of size 512 × 512 from the open image database [40] are used as test images. Figure 5 illustrates these benchmark images. To validate effectiveness of the proposed RDH algorithm, these benchmark images are taken as input images and then encrypted by encryption keys. Next, different secret data is generated and embedded into the encrypted images under the control of data-hiding key. Finally, data extraction and image recovery are done on the marked encrypted images. It is found that the secret data can be correctly extracted and the reconstructed images are exactly the same as their original images. For page limitation, a visual example of the standard Lena image is presented here.

Security analysis
Security performances of our encrypted images are evaluated by using some well-known metrics, including number of pixel change rate (NPCR), unified average changing intensity (UACI), entropy and histogram. NPCR and UACI are generally exploited to test the performance of key sensitivity. The definition of NPCR [31] is defined as follows.
where W and Y are the image row number and image column number, and F(i, j) is determined by the below equation.
where I(i, j) and I′(i, j) represent the pixels in the i-th row and jth column of two encrypted images, respectively. The definition of UACI [41] is as follows. (15) For digital images with 256 grey levels, the expected theoretical values of NPCR and UACI are 100% and 33.33% [31,41], respectively. If the calculated NPCRs/UACIs are close to their theoretical values, it can be concluded that the encrypted images are key-sensitive and secure.
In the experiments, six benchmark grey images are also selected as test images. For every image, different keys are used to conduct image encryption and the NPCRs/UACIs between every pairs of encrypted images are calculated. It is observed that the obtained NPCRs/UACIs are close to the theoretical values. For page limitation, typical results of the Baboon image are demonstrated here. Figure 7 presents four encrypted images of Baboon under the control of four slightly different encryp- tion keys T 0 , T 1 , T 2 , and T 3 . Table 4 lists the detailed NPCRs and UACIs. It can be seen that the calculated results of NPCR and UACI are all close to their theoretical values. This illustrates that our encrypted images are secure. Information entropy is an effective measure for evaluating security of encrypted images. The entropy of a grey image with 256 levels can be calculated by the below equation.
where I is the grey image with 256 levels and P(x i ) is the probability of the grey level x i (0 ≤ i ≤ 255). In general, a bigger entropy means a more secure encrypted image. The maximum theoretical entropy of a grey image with 256 levels is 8. Table 5 presents the calculated entropy values of six benchmark images. It can be seen that the entropy values of all encrypted images are very close to 8. This also validates security of our encrypted images.
Histogram is an important image feature. In general, an effective image encryption scheme is expected to produce the encrypted image with a uniform histogram. In this case, it is almost impossible to successfully predict the original image of a given encrypted image by searching images with histogram-based techniques. Figure 8 demonstrates histograms of the encrypted versions of six benchmark images. It is found that these histograms are nearly uniform distributions. So the encrypted images of our algorithm are also secure in terms of histogram.
In addition, visual security is also tested by using the metrics of mean square error (MSE), Pearson correlation coefficient (PCC), peak signal to noise ratio (PSNR) and structural similarity (SSIM) [30]. For MSE, a bigger value means higher visual security. For PCC, PSNR and SSIM, a smaller value implies higher visual security. Experiments on six benchmark images demonstrate that our algorithm has good results on these metrics. For space limitation, typical results of the Airplane are listed in Table 6. It can be seen that all MSE values are big and all PCC, PSNR and SSIM values are small. These results illustrate good visual security of our algorithm.

Parameter discussion
The main parameters of the proposed RDH algorithms are the block size s × s and the parameter m. To determine optimal parameter selection, different parameter settings are exploited to conduct data embedding. The used block sizes are 2 × 2, 3 × The embedding rate used for measuring data-hiding performance is the bit per pixel (bpp), which is defined as the ratio between the number of embedded bits and  the total pixel number. A bigger embedding rate means a better data-hiding performance. Tables 7-11 present the embedding rates of the six benchmark images under different m settings when the block size s varied from s = 2 to s = 6. In these tables, the numbers in bold are the maximum embedding rates (the best results). It can be seen that when m = 5, the embedding rates of all benchmark images reach the maximum values under different block sizes. Therefore, m = 5 is the optimal parameter selection. Figure 9 presents the trend curve of average embedding rate under different block sizes when m = 5. It can be found that when the block size is small, the average embedding rate is also small. As the block size increases, the average embedding rate also increases and reaches the maximum value when block size s = 4. After it reaches the maximum value, it decreases when the block  size increases. This can be understood as follows. When the block size is too small, the number of image blocks increases and thus there is much more auxiliary information needed for self-embedding, which limits the embedding rate. If the block size is too large, spatial correlation in the block will be weakened and thus some prediction errors will become large numbers, which also restrict the improvement of embedding rate.

Performance comparison
To verify advantages of the proposed RDH algorithms, performance comparisons with four state-of-the-art RDH algorithms  Three open image databases are exploited to test the performances of these algorithms. The used databases include UCID [42], BOSSBase [43] and BOWS-2 [44]. The UCID contains 1338 colour images, which are converted to grey images with 256 levels in the experiments. The BOSSBase and BOWS-2 both contain 10,000 standard grey images. All these evaluated RDH algorithms are applied to the grey images of these databases. The average embedding rate of grey images in these databases are calculated and the results are demonstrated in Figure 10, where the x-axis is the used database and the y-axis is the average embedding rate. It can be seen that the average embedding rates of the proposed RDH algorithm on UCID, BOSSBase and BOWS-2 are 1.7081, 2.4437 and 2.3083 bpp, which are all bigger than those of the compared RDH algorithms. Table 12 presents our improvements of average embedding rate on different databases, which are calculated by subtracting the average embedding rate of the compared algorithms from that of the proposed algorithm. It is observed that To view the detailed embedding capacities of the proposed algorithm and the compared algorithms on every test image of these databases, the results of embedding capacities are all plotted in the same figure. It is found that our embedding capacities of most images are bigger than those of the compared algorithms. For page limitation, only the comparisons between the proposed algorithm and Wu et al.'s algorithm are presented here. Figures 11-13 demonstrate the embedding capacity comparison on the databases of UCID, BossBase and BOWS-2, respectively, where the x-coordinate represents the image index, and the y-coordinate represents the embedding capacity. It is clear that the proposed algorithm outperforms Wu et al.'s algorithm in the embedding capacities of most test images. This also verifies advantage of the proposed algorithm in embedding performance.
Computational time of these RDH algorithms is also compared. The experimental environments are as follows. The coding perform is MATLAB R2016. The configurations of the used computer include the Intel Core i5-6500 CPU with 3.20 GHz and 8 GB RAM. The operating system is Windows 10 Education. All images in the BOWS-2 are used to conduct data embedding. The results are presented in Table 13. The first column is the evaluated algorithm, the second column is the average time of embedding data into an image, the third column is the average capacity of an image, and the final column is the average

CONCLUSIONS
In this paper, a novel RDH algorithm for encrypted image has been proposed. The proposed RDH algorithm uses a blockbased encryption scheme to preserve spatial correlation of original image in the encrypted domain. An important contribution is the adaptive prediction error coding. This technique can efficiently vacate room from encrypted image block by adaptively coding prediction errors according to block content, and thus contributes to a large embedding capacity. Many experiments on benchmark image databases have been done to validate performance of the proposed RDH algorithm. The comparison results have illustrated that the proposed RDH algorithm outperforms some state-of-the-art RDH algorithms in embedding capacity. Computational time results have also shown that the proposed RDH algorithm is better than most compared algorithms. In future work, we will investigate other RDH algorithms for encrypted image, such as RDH algorithms via steganography coding, colour image based RDH algorithms using channel correlation, and multi-image based RDH algorithms.