Secure Arithmetic Coding with Error Detection Capability
© M. Sinaie and V. T. Vakili. 2010
Received: 9 February 2010
Accepted: 7 September 2010
Published: 19 September 2010
Recently, arithmetic coding has attracted the attention of many scholars because of its high compression capability. Accordingly, this paper proposed a Joint Source-Cryptographic-Channel Coding (JSCC) based on Arithmetic Coding (AC). For this purpose, embedded error detection arithmetic coding, which is known as continuous error detection (CED), is used. In our proposed method, a random length of forbidden symbol which is produced with a key is used in each recursion. The dummy symbol is divided into two dummy symbols with a key and then is placed in random positions in order to provide security. Finally, in addition to producing secure codes, the suggested method reduced the added redundancy to half of the total redundancy added by CED. It has less complexity than cascades source, channel coding, and encryption while its key space in comparison to other joint methods has enlarged. Moreover, the coder provides a flexible switch between a standard compression model and a joint model.
The increasing demand for the use of computer networks, the wide availability of digital multimedia contents, and the accelerated growth of wired and wireless communications have resulted in new research areas in joint coders.
The design of modern multimedia communication systems is very challenging as the system must satisfy several contrasting requirements . Data compression is needed because it provides a mechanism to increase the effective bandwidth in a network and serves the highest possible number of users. Data compression optimizes the required storage space and reduces transmission time in the network. In one hand, compression typically makes the transmission very sensitive to error or packet losses, thus it can decrease the quality of received data by the final users so channel coding is required for error detection and correction . On the other hand, source coding decreases redundancy in the plaintext which makes the data more resistant to statistical methods of cryptanalysis , and additionally, the accessibility of data makes it possible for the unauthorized users to reach the data easily. Therefore, to be reliably and confidentially transmitted, the data must be encrypted .
Many data compression techniques are available for efficient source coding [5, 6]. Strong error control codes have been developed for channel coding. In addition, some encryption algorithms have been developed for secure data transmission. Recent source coding, channel coding, and encryption algorithms require computational power for encoding and decoding. This is particularly unfavorable in certain applications such as mobile communications, embedded systems and real-time communication, where devices (e.g., portable equipments) are resource constrained due to the size limitation and power consumption considerations .
In real-time or satellite communication, delay and complexity are not desirable. Therefore, low complexity JSCC is preferable for such situations. Techniques for joint source-channel coding, which have been proposed in this research, use the duality of source encoding and channel decoding and are aimed at decoding noisy compressed data as reliably as possible. The development of these joint algorithms has closely followed the development of source and channel coding algorithms.
Most of the early works on joint source-channel coding used different forms of Huffman codes. But nowadays, by increasing interest in arithmetic coding in the multimedia applications , for example, JPEG2000 and H.264, many researchers were attracted to it. In 1997 Boyd et al.  introduced a forbidden symbol in the source alphabet and used it at the decoder side as an error detection device. Sayir  considered the arithmetic coder as a channel coder and added redundancy in the transmitted bit stream by introducing gaps in the coding space and shrinking the probability of symbols by a factor . In these joint coders, we have embedded error detection compressed data without providing essentially any security in the face of a chosen plaintext attack, in which an attacker has the ability to specify a sequence of input symbols, to observe the corresponding output, and to repeat this process for an arbitrary number of times.
Some schemes of joint AC and encryption have been also proposed up to now. Wen et al.  modified the traditional AC by removing the constraint that intervals corresponding to each symbol are continuous and the intervals associated with each symbol can be split according to a key which is known for the both encoder and decoder. Grangetto et al.  proposed a method in which the system modified the traditional arithmetic coder by randomly permuting the intervals in accordance with a key.
Magli et al.  developed a JSCC. It used arithmetic coding which was proposed by Sayir and for providing security; it randomly permuted the intervals in accordance with a key generating shuffling sequence which was introduced by Grangetto. Although this system is a JSCC but the attacker can break the system by comparing pairs of the output with the corresponding input which differ from each other in exactly one symbol. Teekaput and Chokchaitam  have introduced a scheme for JSCC. Security was provided by changing the location of the forbidden symbol. This system looks like the system which was introduced by Magli et al., so it suffered from the same limitations.
In this paper, we present a method for joint source-cryptographic-channel coding based on arithmetic coding. This is very important in light of simplifying the design of the system. We use binary arithmetic coding with the forbidden symbols which was introduced in  for error detection. Security is provided by using random length of the forbidden symbols and randomly placing these dummy symbols in the probability table. Compression ratio is improved in comparison with the systems in [1, 13]. Also, the actual key space has enlarged. This method can be used for arithmetic coding with multiple symbols. However, to simplify the method, we use binary AC.
The rest of this paper is organized as follows: in Section 2, we discuss more on arithmetic coding and arithmetic coding with forbidden symbol. In Section 3, our proposed method for JSCC is described. In Section 4, the results obtained from the simulation and the performance of the system are explained. In Section 5, we draw some conclusions.
2. Arithmetic Coding and CED
This section provides a brief introduction to arithmetic coding and AC with forbidden symbol which is named in  as CED. Until AC was developed in the 1970s, Huffman coding was considered to be almost optimal. Huffman coding uses a tree for encoding a sequence. AC uses a one-dimensional table of probabilities instead of a tree. It always encodes the whole massage at once and allows the allocation of fractional number of bits to each source symbol. It generates a code sequence which is uniquely decodable, such that the probability of distribution of code sequence approaches the uniform distribution over the code alphabet .
This forbidden symbol can be placed anywhere in the probability table, and we can also have more than one forbidden symbol and place them in more than one location in the probability table. In conventional CED, the probability of the forbidden symbol is fixed, and also the forbidden symbol is fixed at the same location for the whole encoding process. Before transmission, the encoder and decoder should negotiate the location and size of the forbidden symbol . If its probability is fixed for the whole encoding process, then the bit rate of the code is fixed, and the amount of the added redundancy is fixed to bit per symbol.
If we take the maximum bit rate needed into account and also consider that the bit rate in each recursion is not allowed to exceed the maximum bit rate, we can change the bit rate while encoding. This causes less redundancy to be added to the bit stream and higher security. We describe this in more details in Section 3.
3. Scheme of the Proposed Model
3.1. Inserting Forbidden Symbols
Adding the forbidden symbol leads to the addition of redundancy to the output extension which can be used as a means of error detection. This method does not have enough security against attacks; therefore, we use a random-length forbidden symbol in each recursion in our scheme instead of a fixed-length one. In each recursion with a random generator, we generate a forbidden symbol in the range , in which is determined by maximum bit rate, , by using (1). The generated probability of the forbidden symbol in each recursion is named . By using this random forbidden symbol in every recursion, we shrink the probability of symbols by the factor ( ). This causes adding random redundancy while encoding each input symbol. In addition, we can claim that we have a semiadaptive arithmetic coder because in each recursion, a different length of the forbidden symbol is produced. It leads to a different shrinking factor in each recursion. Therefore, the probability of the source symbols with various factors would be shrunk.
In the previous section we said that we can have more than one forbidden symbol, therefore we use two forbidden symbols in this method. Since the sum of the probabilities of two forbidden symbols must be equal to , we can divide the generated forbidden symbol, , in each recursion equally, or generate another forbidden symbol in the range and then uniformly divide the forbidden symbol to two forbidden symbols with probabilities of and .
The and represent the encryption key which is also referred to as K in the following sections and adjusted with a proper precision in an acceptable range depending on the requirements of different applications. At the decoder side, if a synchronized decoder is applied, that is, adding the and at each coding step, data will be reconstructed accurately. Otherwise, whether using a standard AC decoder or a decoder of proposed scheme with a different and , the encoded code stream cannot be correctly decoded.
3.2. Establishing and Selecting the Probability Table
In Section 2 we demonstrated that the forbidden symbol can be placed anywhere in the probability table. In binary AC, it can be placed at the beginning, in the middle and at the end of the probability table. We use Pseudorandom Number Generator (PRNG) to control the place of the forbidden symbols. A seed value, S, which also represents another encryption key, is used to initialize the PRNG. The bits of the generated random sequence are used as an encryption key in each recursion. In practice, the random sequence is taken on the values 0 and 1 with probability of .5 which is also the controlling bits sequence.
Mapping function of binary arithmetic codes with two different lengths of forbidden symbols (look up table).
Mapping function of binary arithmetic codes with two equal lengths of forbidden symbol (look up table).
To conclude, we do not encrypt the code string which causes a totally different value but only secretly add subintervals and secretly place them. The proposed encoder works with a keyK= ( ), which represents the final encryption key. Given the same K, both the encoder and the decoder generate the same pseudorandom number sequence for decision bits and exactly add the same to the corresponding code string in order to synchronize them with each other. On the other hand, no matter which parameter ofK is unknown or incorrectly given, the decoder cannot decode the compressed data properly, and the decompressed data is almost meaningless. Furthermore, as long as and are set to 0, our scheme achieves a simple switch from the joint compression, error detection, and encryption model to a standard compression model. Also by setting the sum of and equal to , this JSCC is transformed to joint compression and error detection. Thus, this scheme can be used for selective encryption and apply to portions of data which needs more security. Nevertheless, an efficient and secure key distribution protocol is one of the challenging issues and is beyond the scope of this paper.
4. Simulation Results
Our proposed scheme has been implemented with Matlab software and a personal computer with 2 G of RAM and Intel Centrino Core 2 Duo 2.2 G as its CPU. Due to unstable possesses in computer systems, we take 20 trials and select the most frequently occurred results as the final values. Input symbols, upper and lower bounds, and also produced forbidden symbols in each recursion are set with precisions of being equal to 16-bit implementation. It is worth noting that this precision is not fixed and can be flexibly adjusted depending on the requirement of the target applications.
4.1. Compression Ratio
Comparison of code lengths as a function of sequence length .
AC with fixed length
Proposed method with maximum
P(a) = 1/3 H =
Based on the extensive performed simulations, it is concluded that in the CED method, if bits are needed for detecting an error after it has occurred, bits are needed for error detection in our proposed method. Hence, to solve this problem, we can compensate for this shortcoming by assuming greater lengths for the input blocks in the proposed encoder. However, we know that adding security and error detection capability to a compression encoder often leads to a compromise between the amounts of compression achieved and the amount of security and the robustness against channel errors incorporated.
The encoded stream can be reconstructed perfectly by providing the sameK and by reversing the encoding operations. By having the sameK, both encoder and decoder generate the same pseudorandom number sequence for decision bits and exactly add the same and to the corresponding code string in order to synchronize with each other. As soon as the forbidden symbol is decoded, the occurrence of error in the received sequence is detected. However, this method of decoding is not capable of correcting the errors. But, the redundancy of the encoder's output can be used for correcting errors.
Arithmetic codes can be viewed as tree codes. Sequential decoding is a general decoding algorithm for tree codes. It was introduced by Wozencraft and Reiffen to decode convolutional codes in . Fano  presented an improved sequential algorithm in 1963, which is now known as the Fano algorithm. Pettijohn et al. [17, 18] proposed two sequential decoding algorithms, depth first and breadth first, for decoding arithmetic codes in the presence of channel errors. We can use these decoding algorithms with the same key for decoding the output of our proposed scheme.
Sayir  showed that an arithmetic coder can be an entropy source encoder when the model is matched with the source and can be a channel encoder when the probability space is properly reserved for error protection and can act as a convolutional code. After inserting the forbidden symbol to a source with M alphabet, we will have an arithmetic coding with M + 1 alphabet in which one of the symbols never appears. Therefore, adding parity is performed while compression without adding more additional operations to the conventional arithmetic coding. If the source has M alphabet, so this method just adds M multiplication and 1 additional operation to the complexity of conventional arithmetic encoder. But if we want to place a convolutional encoder after arithmetic encoder, according to the amount of redundancy, it needs some shift and XOR operations and increasing memory usage. For example, if the bit rate is 1/2 and the code generator polynomial is , it would need at least three shift register and XOR operations for each input symbol.
Placing the forbidden symbol in different locations and assigning random lengths of the forbidden symbols increase computational complexity. This extracomputational complexity of joint AC and channel coding in comparison with the complexity of three disjoint coders is very small.
Our proposed technique can be implemented utilizing techniques similar to those used in traditional arithmetic coding and can benefit from the same optimizations for speed, finite precision, and so forth. Inserting the forbidden symbol to the probability table adds no complexity to arithmetic coder; only establishing the probability table and searching the look up table increase the amount of memory needed to store the look up table and the probability of forbidden symbols. In addition, division of the forbidden symbol and updating the probability of symbols by factor ( ) in each recursion introduce an additional multiplication though, as with traditional arithmetic coding, faster algorithms that replace the multiplications with simpler operations can be introduced .
4.3. Security Analysis
A good encryption procedure should be robust against all kinds of cryptanalytic, statistical, and brute-force attacks. In this section, we discuss the security analyses of the proposed encryption scheme. This includes statistical analysis, key space analysis, and sensitivity analysis of the proposed encryption scheme with respect to the key and plaintext, and so forth. to prove that the proposed cryptosystem is secure against the most common attacks.
4.3.1. Key Space
For a secure encryption algorithm, the key space should be large enough to make the brute force attack infeasible. The main private information in our proposed scheme is the key used in the PRNGs; each of them is as long as 128 bits. These PRNGs generate random sequences which are used by the proposed technique as a secret key in each recursion.
The proposed cipher has different combinations of the secret key, and key space of our proposed method is larger than that of the methods introduced in [1, 12]. A cipher with such a long key space is sufficient for reliable practical use in multimedia communications.
As mentioned above, the proposed encoder uses generated random sequences as its secret key in each recursion. In  there are only two possible choices in one recursion: at the beginning of the probability table or at the end. Even though the swapping probability is also used as a key parameter in this method, but there are other keys, and , and attacker must decode received sequence using all possible seeds, , or and for accessing correct data.
If precision of is set to 16 bits, one should try trails for estimating each forbidden symbol in one recursion and trails for finding the situation of the probability table in each recursion; therefore, the actual key space in each recursion can be times larger than the key space in . In this proposed method, if we suppose that the key is known by the attacker, he cannot find out what random value at which positions is added, and as long as the attacker is not aware of the value of the forbidden symbols he cannot access the status of the probability table in each recursion.
4.3.2. NIST SP 800-22 Test for Cipher
Sp 800-22 tests results of cipher.
Block frequency ( )
Nonoverlapping templates ( , )
Overlapping templates ( , , )
Random excursions (state )
Random excursions variant (state )
4.3.3. Sensitivity Analysis
Sensitivity Analysis of the Cipher to Key
changing one bit of S1 which determined the forbidden symbol length in each recursion,
changing one bit of S2 which divided the forbidden symbol into two different forbidden symbols in each recursion,
changing one bit of S3 which determined the probability table in each recursion,
changing just one bit of the three main keys.
where, and are the values of corresponding bits in the two encrypted outputs to be compared and is the total number of output bits.
We performed the above mentioned steps for several different keys. Then, we calculated the correlation coefficient for the encoded sequences by using (4). In all the cases, very small correlation coefficients of the corresponding outputs were obtained. For instance, Table 5 shows the correlation coefficients between encoded sequences with S1, S2, and S3 keys for the outputs from the steps (a) to (d) based on changing the first bits of the keys.
As the Table 5 shows, no correlation exists among the three encrypted outputs even though these have been produced by using only slightly different secret keys. Also, based on the comparison of outputs of the proposed scheme for a large number of inputs, it was found that changing one symbol in the plaintext will result in a completely different output by more than 99%. This shows that different inputs even in one symbol will result in different outputs.
Correlation coefficients of different outputs.
Changing first bit of S1
Changing first bit of S2
Changing first bit of S3
Changing first bit of S1, S2, S3
Sensitivity Analysis of Cipher to Plaintext
Generally, attacker may make a slight change in the plaintext. In order to test the influence of changing a single bit in the original data, the correlation coefficients between the corresponding output sequences were calculated for the changes in the input sequence. As expected, the correlation coefficients were very small.
Since the proposed coder is simulated for binary inputs and the output is also binary, we can calculate the changing bit rates of the cipher instead of correlation coefficients. Change of one bit in the plaintext should make theoretically a 50% difference  in the bits of the cipher. We also developed a test for the changing rate of the cipher bits. The changing rate was 49.41%. For all these reasons, the proposed scheme of this study proves to be sensitive to the changes in the input, hence, an ideal coder.
4.3.4. Different Attacks
The model dynamically reorders the frequency of the input symbols according to the length of random forbidden symbols in each recursion.
The output from the engine is in the form of words with variable sizes so the individual bits of the output corresponding to the inserted symbols could not be determined.
where represents the probability of symbol . The entropy is expressed in bits. If the source emits 2 symbols with equal probability, that is, , then the entropy is = 1, corresponding to a true random sequence. The system test real entropy value is 0.9974. So the system can resist the entropy attacks.
Another large class of attacks is based on the analysis of statistical properties of the output bit stream B= , where is the output length. It is thus important to investigate the statistics of B. Various simulations showed that the output of the proposed coder had ( ) = ( = 1) = 1/ 2, for any i. Therefore, from the first-order statistics, the attacker cannot find any information regarding the secret key.
Alternatively, the attacker may wish to recover the key stream which is used in the proposed method. Suppose that the input symbol sequence length is N. The length of the key stream used in the method is then . Assume that the generated bit stream is of length . Then, the total complexity of breaking the key stream is . In the case that the input symbol sequence length is sufficiently large which makes , the attacker would rather use the brute-force attack to break the secret key utilized in the PRNGs.
A pseudorandom sequence is vulnerable to the known plaintext attacks; since there is a given known input sequence, the attacker can compare the joint source-channel coder and the proposed coded sequences and attempt to find the added subintervals and their locations. To increase the security, an efficient key distribution protocol could be also explored in our algorithm to provide a sufficient encryption.
In this paper, a scheme has been presented which combines compression, error detection, and data encryption. The proposed technique by adding a little complexity to CED provides security. It adds two random subinterval and to the probability interval in each iterative coding step and controls the locations of the forbidden symbol by a PRNG with a seed, , while the key is in each recursion. Moreover, it easily switches to standard arithmetic coding by setting and equal to zero when the data do not need to be protected. This coder causes the added redundancy to be almost halved without any special effect on error detection capability. The proposed technique is less complicated and faster than cascaded systems; therefore, they are more suitable for real-time applications. The technique can be also extended to selectively encrypting data and images. This proposed method can be used in ARQ systems for error detection and error correction.
The authors would like to thank ITRC (Iran Telecommunication Research Center) for the invaluable assistance and funding for this paper.
- Magli E, Grangetto M, Olmo G: Joint source, channel coding, and secrecy. EURASIP Journal on Information Security 2007, 2007:-7.Google Scholar
- Kaneko H, Fujiwara E: Joint source-cryptographic-channel coding based on linear block codes. Applicable Algebra in Engineering, Communication and Computing, 2007, Lecture Notes in Computer Science 4851: 158-167.MathSciNetMATHGoogle Scholar
- Bose R, Pathak S: A novel compression and encryption scheme using variable model arithmetic coding and coupled chaotic system. IEEE Transactions on Circuits and Systems 2006, 53(4):848-857. 10.1109/TCSI.2005.859617MathSciNetView ArticleGoogle Scholar
- Xie D, Kuo C-CJ: Multimedia encryption with joint randomized entropy coding and rotation in partitioned bitstream. EURASIP Journal on Information Security 2007, 2007:-12.Google Scholar
- Moffat A, Neal RM, Witten IH: Arithmetic coding revisited. ACM Transactions on Information Systems 1998, 16(3):256-294. 10.1145/290159.290162View ArticleGoogle Scholar
- Cover T, Thomas J: Elements of Information Theory. John Wiley & Sons, New York, NY, USA; 1991.View ArticleMATHGoogle Scholar
- Kim H, Wen J, Villasenor JD: Secure arithmetic coding. IEEE Transactions on Signal Processing 2007, 55(5):2263-2272. 10.1109/TSP.2007.892710MathSciNetView ArticleGoogle Scholar
- Boyd C, Cleary JG, Irvine SA, Rinsma-Melchert I, Witten IH: Integrating error detection into arithmetic coding. IEEE Transactions on Communications 1997, 45(1):1-3. 10.1109/26.554275View ArticleGoogle Scholar
- Sayir J: On Coding By Probability Transformation. Hartung-Gorre, Konstanz, Germany; 1999.Google Scholar
- Sayir J: Arithmetic coding for noisy channels. In Proceedings of the Information Theory and Communication Workshop, 1999. IEEE; 69-71.Google Scholar
- Wen JG, Kim H, Villasenor JD: Binary arithmetic coding with key-based interval splitting. IEEE Signal Processing Letters 2006, 13(2):69-72. 10.1109/LSP.2005.861589View ArticleGoogle Scholar
- Grangetto M, Magli E, Olmo G: Multimedia selective encryption by means of randomized arithmetic coding. IEEE Transactions on Multimedia 2006, 8(5):905-917. 10.1109/TMM.2006.879919View ArticleGoogle Scholar
- Teekaput P, Chokchaitam S: Secure embedded error detection arithmetic coding. In Proceedings of the 3rd International Conference on Information Technology and Applications (ICITA '05), July 2005. IEEE; 568-571.View ArticleGoogle Scholar
- Anand R, Ramchandran K, Kozintsev IV: Continuous error detection (CED) for reliable communication. IEEE Transactions on Communications 2001, 49(9):1540-1549. 10.1109/26.950341View ArticleMATHGoogle Scholar
- Wozencraft, JM, Reiffen B: Sequential Decoding. MIT Press, Cambridge, Mass, USA; 1961.MATHGoogle Scholar
- Fano RM: A heuristic discussion of probabilistic decoding. IEEE Transactions Information Theory 1963, 64-74. 10.1109/TIT.1963.1057827Google Scholar
- Pettijohn BD, Sayood K, Hoffman MW: Joint source/channel coding using arithmetic codes. Proceedings of the Data Compression Conference (DDC '00), March 2000, Snowbird, Utah, USA 73-82.View ArticleGoogle Scholar
- Pettijohn BD, Hoffman MW, Sayood K: Joint source/channel coding using arithmetic codes. IEEE Transactions on Communications 2001, 49(5):826-835. 10.1109/26.923806View ArticleMATHGoogle Scholar
- Hodjat A, Verbauwhede I: Area-throughput trade-offs for fully pipelined 30 to 70 Gbits/s AES processors. IEEE Transactions on Computers 2006, 55(4):366-372. 10.1109/TC.2006.49View ArticleGoogle Scholar
- Grangetto M, Magli E, Olmo G: Multimedia selective encryption by means of randomized arithmetic coding. IEEE Transactions on Multimedia 2006, 8(5):905-917. 10.1109/TMM.2006.879919View ArticleGoogle Scholar
- Rukhin A, Soto J, Nechvatal J, et al.: A statistical test suite for random and pseudorandom number generators for cryptographic applications. NIST Special Publication 800-22, May 2001
- Tong X, Cui M, Wang Z: A new feedback image encryption scheme based on perturbation with dynamical compound chaotic sequence cipher generator. Optics Communications 2009, 282(14):2722-2728. 10.1016/j.optcom.2009.03.075View ArticleGoogle Scholar
This article is published under license to BioMed Central Ltd. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.