Complex Domain Approach for Reversible Data Hiding and Homomorphic Encryption: General Framework and Application to Dispersed Data
Extracted source text · arXiv 2510.03770
%\documentclass[10pt,journal,compsoc]{IEEEtran}
\documentclass[lettersize,journal]{IEEEtran}
\usepackage{lmodern}
\usepackage[T1]{fontenc}
%\usepackage[latin9]{inputenc}
\usepackage{amsmath}
\usepackage{amsthm}
\usepackage{amssymb}
\usepackage{upgreek}
\usepackage{graphicx}
\usepackage[caption=false]{subfig}
\usepackage{color}
\usepackage{resizegather}
\usepackage{enumerate}
\usepackage{hhline}
\usepackage[shortlabels]{enumitem}
\usepackage{bm}
\usepackage{array}
\usepackage[ruled,vlined]{algorithm2e}
\usepackage{soul}
\usepackage{algorithmic}
\usepackage{hyperref}
%\usepackage[hyphens]{url}
\hyphenation{op-tical net-works semi-conduc-tor IEEE-Xplore}
\def\BibTeX{{\rm B\kern-.05em{\sc i\kern-.025em b}\kern-.08em
T\kern-.1667em\lower.7ex\hbox{E}\kern-.125emX}}
\usepackage{balance}
\makeatletter
\theoremstyle{definition}
\newtheorem{defn}{Definition}
\newtheorem{remark}{Remark}
\newcommand{\remarkend}{\hfill$\triangle$}
\newcommand{\abs}[1]{\left|#1\right|}
\newcommand{\hidden}{H$[i]$dden\xspace}
\theoremstyle{plain}
\newtheorem{thm}{Theorem}
\newcommand{\agg}{^\mathrm{Agg}}
\newcommand{\tps}{^\mathrm{T}}
\renewcommand{\Re}{\operatorname{Re}}
\renewcommand{\Im}{\operatorname{Im}}
\DeclareMathOperator{\Mod}{\mathrm{mod}}
\renewcommand{\pmod}[1]{\,(\Mod #1)}
\newcommand{\enc}{\mathrm{Enc}}
\newcommand{\dec}{\mathrm{Dec}}
\begin{document}
\title{Complex Domain Approach for Reversible Data Hiding and Homomorphic Encryption: General Framework and Application to Dispersed Data}
\author{David Megías, \textit{Member, IEEE}
\thanks{D. Megías is with the Ethical Technologies and Connectivity for Humanity Research Centre (UOC-TECH), Universitat Oberta de Catalunya, Rambla del Poblenou 154, 08018 Barcelona, Spain (e-mail: dmegias@uoc.edu).}}
\markboth{Journal of \LaTeX\ Class Files,~Vol.~14, No.~8, August~2021}%
{Shell \MakeLowercase{\textit{et al.}}: A Sample Article Using IEEEtran.cls for IEEE Journals}
%\IEEEpubid{0000--0000/00\$00.00~\copyright~2021 IEEE}
\maketitle
\begin{abstract}
Ensuring the trustworthiness of data from distributed and resource-constrained environments, such as Wireless Sensor Networks or IoT devices, is critical. Existing Reversible Data Hiding (RDH) methods for scalar data suffer from low embedding capacity and poor intrinsic mixing between host data and watermark. This paper introduces Hiding in the Imaginary Domain with Data Encryption (\hidden), a novel framework based on complex number arithmetic for simultaneous information embedding and encryption. The \hidden framework offers perfect reversibility, in-principle unlimited watermark size, and intrinsic data-watermark mixing. The paper further introduces two protocols: \hidden-EG, for joint reversible data hiding and encryption, and \hidden-AggP, for privacy-preserving aggregation of watermarked data, based on partially homomorphic encryption. These protocols provide efficient and resilient solutions for data integrity, provenance and confidentiality, serving as a foundation for new schemes based on the algebraic properties of the complex domain.
\end{abstract}
\begin{IEEEkeywords}
Reversible Data Hiding, Complex Domain, Gaussian Integers, Homomorphic Encryption, Data Aggregation, Dispersed Data, Paillier, ElGamal, Data Integrity.
\end{IEEEkeywords}
\section{Introduction}
\label{sec:introduction}
The ubiquitous generation and pervasive use of digital data stand as defining characteristics of the modern era. From vast networks of Internet of Things (IoT) devices and industrial sensors to intricate smart city infrastructures and critical healthcare systems, data fuels decision-making, automates processes, and enables unprecedented levels of connectivity. This reliance on data, often collected from distributed and potentially vulnerable environments, is critically linked to its trustworthiness \cite{yan2014survey}. Ensuring the confidentiality, integrity, authenticity, and privacy of information has become a priority, as compromised data can lead to erroneous conclusions, system failures, and severe breaches of privacy or security \cite{liang2016review}.
Within this complex digital landscape, the concept of \textbf{Reversible Data Hiding (RDH)} \cite{shi:2016,kumar2022reversible} emerges as a specialized and increasingly popular approach to data security. RDH involves embedding secret information (a ``watermark'') directly into a host data item in such a way that, after extraction of the watermark, the original host data can be perfectly and exactly restored to its original state. This unique property, combining data embedding with guaranteed reversibility, makes RDH appropriate in sensitive applications such as medical imaging, legal documentation, and military intelligence, where any permanent alteration of the original data is unacceptable. Unlike traditional data encryption, which primarily ensures confidentiality, RDH focuses on providing intrinsic integrity, authenticity, and provenance, within the data itself.
In the context of individual, scalar, or time-series numerical data, such as those originating from Wireless Sensor Networks (WSNs) \cite{shi:2013}, IoT devices \cite{rahman:2021}, or critical financial and medical monitoring systems \cite{bahlearao:2019}, RDH offers unique advantages. Foremost among these is its ability to ensure robust data integrity and authenticity at the granular level of single readings or sequential observations. By embedding a watermark that can be extracted and verified, receivers (\textit{e.g.,} a Data Collector in a WSN) can confirm that the data originated from a legitimate source and has not been tampered with in transit. This inherent capability to facilitate data provenance and traceability is particularly valuable, allowing for forensic analysis of data origin and processing paths in distributed and often resource-constrained environments.
Beyond these general benefits, RDH offers distinct advantages compared to other commonly employed security primitives in certain contexts. Unlike cryptographic hashing or digital signatures, which typically append a separate authentication tag or signature to the data, RDH embeds the integrity verification mechanism directly \textit{within} the data itself. This can simplify data handling and ensure the integrity proof travels jointly with the content. While conventional encryption ensures confidentiality, it does not directly provide data integrity; and Physical Unclonable Functions (PUFs) \cite{gao2020physical} focus on device authentication rather than data integrity. RDH uniquely combines content-dependent integrity (through watermark verification) with the guarantee of perfect original data restoration, a feature not offered by one-way hash functions or irreversible authentication tags. This intrinsic embedding can be particularly beneficial in constrained environments or specialized data formats where appending additional metadata is undesirable or challenging.
From an implementation perspective, basic RDH techniques can often be quite lightweight, requiring minimal computational resources. This aspect is particularly useful for deployment on resource-constrained devices like low-power sensors. However, it is worth pointing out that this ``lightweight'' advantage primarily applies to simple, non-encrypted RDH schemes. When RDH is combined with advanced cryptographic primitives, such as the homomorphic encryption schemes explored in this paper, the computational overhead significantly increases, with cryptographic operations becoming the dominant factor. Nevertheless, the enhanced security and privacy offered by such combination often justify this increased complexity, addressing critical requirements for secure and trustworthy data ecosystems.
Despite these advantages, a significant limitation of existing RDH techniques for individual or dispersed data, particularly in high-security contexts, is their low embedding capacity. Typically, these methods allow for the embedding of only 1 bit per data sample or even less (as is often the case with difference expansion methods). This low capacity severely limits the granularity of tampering detection and the strength of integrity guarantees for independent, single data items. For instance, if only 1 bit is embedded in a single measurement, the probability of an attacker randomly guessing the correct bit is 1/2, offering very weak protection. While the security scales with the number of samples, making the probability of deceiving detection negligible for a sufficient number of measurements $M$ (\textit{e.g.,} $2^{-M}$), this aggregate protection is not robust in situations where the frequency of measurements or the total number of independent data points is small. This highlights a gap in current RDH capabilities for truly strong, individual data item integrity in such sparse or low-frequency scenarios.
In a parallel development within cryptography, \textbf{Homomorphic Encryption (HE)} \cite{acar2018survey} has emerged as a transformative technology for data privacy \cite{iezzi2020practical}. HE schemes allow computations to be performed directly on encrypted data without ever needing to decrypt it \cite{zhang2020lvpda}. The output of such a computation is an encrypted result that, when decrypted, is identical to the result of the same computation performed on the unencrypted data. This property enables the processing of sensitive information by untrusted third parties (such as cloud servers) while ensuring that the data's confidentiality remains fully protected throughout its lifecycle.
While HE is broadly applied to solve privacy challenges in cloud computing, its principles can be integrated with other security primitives to achieve more complex security goals. For instance, combining data integrity mechanisms like RDH with HE's ability to operate on encrypted data allows for the creation of protocols that simultaneously guarantee confidentiality, authenticity, and data integrity. This powerful synergy is especially relevant in systems that require both privacy during data processing and proof of data origin and integrity, setting the stage for more robust and trustworthy data ecosystems.
\subsection{Plan and Contributions of the Paper}
\label{sec:contributions}
This paper introduces a novel framework for RDH and encryption, taking advantage of the algebraic properties of the complex domain (Gaussian integers). Termed \textbf{Hiding in the Imaginary Domain with Data Encryption (\hidden)}, the proposed approach fundamentally addresses key limitations of existing RDH techniques when applied to individual, scalar, or dispersed data. Unlike methods that merely append or isolate hidden bits in low-significance positions (\textit{e.g.,} modulo-based schemes), \hidden uses complex number arithmetic to mix the original data and the watermark, providing a richer embedding space and assuring a larger tampering detection capacity.
The main contributions of the paper are summarized below:
\begin{itemize}
\item A novel core complex-domain reversible information hiding scheme for individual data, offering intrinsic data-watermark mixing, perfect reversibility and, in principle, unlimited watermark size.
\item A distinct application of the core \hidden embedding scheme to aggregated data, which prepares individual data items for privacy-preserving and efficient summation of \textit{watermarked data} while retaining extractability.
\item A detailed \textbf{novel extension of ElGamal encryption to the Gaussian integers}, serving as a foundational cryptographic primitive for the complex domain.
\item The \textbf{\hidden-EG} protocol, providing joint reversible information hiding and encryption specifically for individual data points, making use of the extended Gaussian ElGamal scheme.
\item A novel component-wise application of Paillier encryption to complex-valued data, establishing a privacy-preserving additive homomorphism for secure aggregation.
\item The \textbf{\hidden-AggP} protocol, enabling joint reversible information hiding, encryption, and privacy-preserving data aggregation from multiple sources, built upon the component-wise Paillier application.
\end{itemize}
Through these contributions, the paper demonstrates a new paradigm for reversibly embedding authenticating information directly into sensitive data, providing strong cryptographic protection while maintaining the relevant property of perfect host data reversibility.
The rest of the paper is organized as follows. Section \ref{sec:background} provides the necessary background on RDH and HE. Section \ref{sec:reversible} details the proposed complex-domain reversible watermarking scheme for both individual and aggregated data. Section \ref{sec:homomorphic} presents the extension of ElGamal and Paillier encryption to the complex domain. Section \ref{sec:protocols} details the \hidden-EG and \hidden-AggP protocols for joint watermarking and encryption/aggregation, respectively. A comprehensive security analysis is provided in Section \ref{sec:security}. Finally, Section \ref{sec:cocnlusion} concludes the paper and outlines future research directions.
\section{Background}
\label{sec:background}
This section provides the foundational concepts and related work that are essential for understanding the proposed framework. The core of this work lies at the intersection of two distinct but complementary fields of research: RDH and HE. While RDH offers powerful mechanisms for embedding information within data for integrity and provenance, HE provides thea unique capability to perform computations on encrypted data, thereby ensuring confidentiality. The following sections detail the relevant background on these two key areas.
\subsection{Reversible Data Hiding}
\label{sec:reversible_data_hiding} % Label for future reference
Reversible Data Hiding \cite{shi:2016,kumar2022reversible} is a specialized field within information hiding that focuses on embedding secret information into host data in such a way that the original host data can be perfectly and exactly recovered after the hidden data (watermark) has been extracted. This property is essential in applications that do not allow the permanent alteration of the original content.
Historically, RDH techniques have been extensively developed and applied primarily to multimedia content, including digital images, audio, and video \cite{shi:2016}. Methods like Least Significant Bit (LSB) modification (when combined with original LSB storage) \cite{celik:2002}, Difference Expansion (DE) \cite{tian:2003}, Histogram Shifting (HS) \cite{ni:2006}, and Prediction-Error Expansion (PEE) \cite{ou:2013} use the inherent statistical redundancy and the human perceptual system's tolerance for slight alterations in these rich data formats. These approaches can embed information in a perceptually imperceptible manner while ensuring perfect reversibility, meaning the host data is faithfully restored to its original state after hidden data extraction.
In contrast, the application of RDH to individual, scalar, or time-series numerical data (\textit{e.g.,} sensor readings, financial figures, or simple numerical sequences) presents distinct and more challenging problems. Unlike multimedia, such data typically exhibits very low inherent redundancy, is highly sensitive to even minor numerical changes (as there is no ``perceptual'' domain to hide in), and has a very limited host capacity. This scarcity of ``hiding space'' and the demand for exact numerical preservation make traditional RDH techniques, often designed for media, largely unsuitable.
For this class of individual or dispersed data, existing reversible embedding methods tend to fall into a few categories. One common approach is \textbf{Modulo/Remainder-based embedding}, where the secret information $w$ (an integer in range $0, \ldots, q-1$) is embedded into a host integer $d$ using an operation like $d' = q \cdot d + w$ \cite{kabir2025rewap}. A common special case involves embedding a single bit ($w \in \{0,1\}$) by setting $q=2$, resulting in $d' = 2d + w$ \cite{kabir2024privacy}. Upon extraction, $w$ is simply $d' \pmod q$ and $d$ is $\lfloor d' / q\rfloor$. When $q$ is a power of 2 ($q=2^B$), these extraction operations can be efficiently performed using bitwise logic (\textit{e.g.,} $w = d' \text{ \& } (q-1)$ and $d = d' \gg B$). While perfectly reversible and simple, a significant characteristic of this method is that the host data's magnitude is directly scaled or inflated by a factor of $q$, making the numerical modification immediately obvious and leading to a poor mixing between the original data and the watermark.
While modulo-based embedding places the watermark in a very distinct (\textit{e.g.,} least significant) position within the embedded data, one might consider more intricate bit-level operations to ``mix'' the bits of the original data and the watermark more thoroughly within the resulting embedded value. Such approaches would likely involve complex sequences of bitwise operations, permutations, or scrambling algorithms. However, these methods, even if designed to be perfectly reversible, tend to lack mathematical elegance and direct interpretability. The resulting embedded data would exhibit a less intuitive relationship to its original host and watermark, making such bit-mixing techniques generally less desirable compared to approaches that achieve blending through inherent algebraic properties.
Another relevant approach for sequential data is \textbf{Difference Expansion (DE)}, or its more general form, \textbf{Prediction-Error Expansion} \cite{shi:2013}. These methods exploit relationships between consecutive data samples by computing prediction errors (\textit{e.g.,} $e_k = d_k - d_{k-1}$) and then embedding information by expanding these errors. %While effective for time-series data, they still result in alterations to the numerical values of the host data points.
These existing methods for individual/scalar data often suffer from relatively low embedding capacity. This highlights the need for novel approaches that can integrate data hiding more subtly or within a more complex framework, especially when combined with other security operations like encryption.
%and lead to numerically visible alterations of the host data, challenging the concept of "imperceptibility" when applied beyond perceptual media.
\subsection{Homomorphic Encryption}
Homomorphic Encryption \cite{acar2018survey} is a unique and powerful class of cryptographic schemes that allows a user to perform computations on encrypted data without first having to decrypt it. The result of these operations is an encrypted output which, when decrypted, is the same as if the operations had been performed on the original, unencrypted data. This remarkable capability is useful for maintaining data privacy and confidentiality when computations are outsourced to untrusted third parties, such as cloud services or remote data aggregators.
HE schemes are typically classified based on the types and number of operations they support. Partially Homomorphic Encryption (PHE) schemes, such as \cite{cominetti2020fast}, support an unlimited number of a single type of operation, either addition or multiplication. Somewhat Homomorphic Encryption (SHE) schemes, which include the pioneering work by Boneh-Goh-Nissim (BGN) in \cite{boneh2005evaluating}, can perform a limited number of both additions and multiplications. Finally, Fully Homomorphic Encryption (FHE) schemes, such as Ring Learning with Errors (RLWE) \cite{brakerski2011fully}, support an unlimited number of both operations, allowing for arbitrary computations on encrypted data. In this paper, two classical PHE schemes, \textbf{ElGamal} and \textbf{Paillier}, are applied for their distinct homomorphic properties that enable the proposed protocols for both individual data encryption and privacy-preserving data aggregation.
\subsubsection{ElGamal Encryption}
ElGamal encryption \cite{elgamal1985public} is an asymmetric key encryption algorithm based on the Diffie-Hellman key exchange. Its security relies on the difficulty of the discrete logarithm problem (DLP) in the multiplicative group of integers modulo a prime number. %It was described by Taher ElGamal in 1985 \cite{elgamal1985public}.
The cryptosystem works as follows. Let $p$ be a prime number and $g$ be a generator of the cyclic multiplicative group $\mathbb{Z}_p^*$, often also denoted as $\left({\mathbb Z/p\mathbb Z}\right)^{\times}$. The ElGamal encryption scheme consists of three algorithms:
\begin{itemize}
\item Key generation: The key generation process involves selecting a random integer $a$ such that $1 \leq a \leq p-1$ as the private key. Then, $K = g^a \pmod{p}$ is computed. The public key is formed as the triple $\mathbf{K}=(p, g, K)$.
\item Encryption: To encrypt a message $m \in \mathbb{Z}_p^*$, a random integer $b$, such that $1 \leq b \leq p-1$, is selected as the ephemeral key. The ciphertext is then computed as $y_1 = g^b \pmod{p}$ and $y_2 = m \cdot K^k \pmod{p}$, resulting in the pair $(y_1, y_2)$. The encryption function can be denoted as follows:
\[(y_1,y_2)=\enc_{\mathbf K}(m, b) = \left(g^b \pmod{p}, m \cdot K^b \pmod{p}\right).\]
\item Decryption: The decryption of the ciphertext $(y_1, y_2)$ using the private key $a$ involves computing the shared secret $s = y_1^a \pmod{p}$ and then decrypting the message as $m = y_2 \cdot s^{-1} \pmod{p}$. This decryption function can be formally denoted as follows: \[\dec_{a}(y_1, y_2) = y_2 \cdot (y_1^a)^{-1} \pmod{p}.\]
\end{itemize}
The security of ElGamal encryption relies on the difficulty of the DLP in $\mathbb{Z}_p^*$. If an attacker can efficiently solve the DLP, they can compute the private key $a$ from the public key $K$ and then decrypt any ciphertext. However, for sufficiently large prime numbers $p$, the DLP is believed to be computationally infeasible.
ElGamal encryption exhibits a homomorphic property under component-wise multiplication of ciphertexts. This means that given two ciphertexts $\enc_{\mathbf K}(m_1, b_1) = (y_1, y_2)$ and $\enc_{\mathbf K}(m_2, b_2) = (y'_1, y'_2)$, multiplying them component-wise as $(y_1 \cdot y'_1, y_2 \cdot y'_2)$ results in a ciphertext that decrypts to the product of the original plaintexts:
\[\dec_a\left(\enc_{\mathbf K}(m_1, b_1) \cdot \enc_{\mathbf K}(m_2, b_2)\right) = m_1 \cdot m_2 \pmod{p}.\]
This property has applications in various cryptographic protocols and it is exploited to combine reversible watermarking and encryption in this paper.
\subsubsection{Paillier Encryption}
\label{sec:paillier}
Paillier encryption is a probabilistic asymmetric encryption algorithm \cite{paillier1999public}. Unlike ElGamal, which is homomorphic with respect to multiplication, Paillier encryption is additively homomorphic, meaning that sums of plaintexts can be computed from their ciphertexts.
%proposed by Pascal Paillier in 1999
The cryptosystem works as follows. It operates in the group $\mathbb{Z}_{n^2}^*$, where $n$ is a product of two large prime numbers. The Paillier encryption scheme consists of three algorithms:
\begin{itemize}
\item Key generation:
\begin{enumerate}
\item Select two large random prime numbers $p$ and $q$ such that $p \neq q$ and $\mathrm{gcd}(pq, (p-1)(q-1)) = 1$.
\item Compute $n = pq$ and $L_P = \mathrm{lcm}(p-1, q-1)$, where ``$\mathrm{lcm}(\cdot)$'' stands for the least common multiple.
\item Select a random integer $g \in \mathbb{Z}_{n^2}^*$ such that $g$ has order a multiple of $n$ modulo $n^2$. A common choice is $g = n+1$.
\item Compute $M_P = (L(g^{L_P} \pmod{n^2}))^{-1} \pmod n$, where the function $L(x)$ is defined as $L(x) = \frac{x-1}{n}$.
\end{enumerate}
The public key is formed as the pair $\mathsf{K_{pub}}=(n, g)$, and the private key is $\mathsf{K_{priv}}=(L_P, M_P)$.
\item Encryption: To encrypt a message $m$, where $0 \leq m < n$, a random integer $r$ is selected such that $0 < r < n$ and $\mathrm{gcd}(r, n) = 1$. The ciphertext $c$ is then computed as:
\[c = g^m \cdot r^n \pmod{n^2}.\]
The encryption function can be denoted as $\enc_{\mathsf{K_{pub}}}(m, r) = g^m \cdot r^n \pmod{n^2}$.
\item Decryption: The decryption of a ciphertext $c$ using the private key $(L_P, M_P)$ involves computing:
\[m = L(c^{L_P} \pmod{n^2}) \cdot M_P \pmod n.\]
This decryption function can be formally denoted as $\dec_{\mathsf{K_{priv}}}(c) = L(c^{L_P} \pmod{n^2}) \cdot M_P \pmod n$.
\end{itemize}
The security of Paillier encryption relies on the computational difficulty of the composite residuosity problem. This problem is considered hard for sufficiently large $n$, making it computationally infeasible for an attacker to recover the plaintext $m$ from a ciphertext $c$ without knowing the private key $(L_P, M_P)$.
A core feature of Paillier encryption is its additive homomorphic property. This means that operations can be performed on ciphertexts such that the decryption of the result corresponds to the addition of the original plaintexts.
\begin{enumerate}
\item Addition of encrypted numbers: Given two ciphertexts $c_1 = \enc_{\mathsf{K_{pub}}}(m_1, r_1)$ and $c_2 = \enc_{\mathsf{K_{pub}}}(m_2, r_2)$, their product modulo $n^2$ decrypts to the sum of their plaintexts:
\[\dec_{\mathsf{K_{priv}}}(c_1 \cdot c_2 \pmod{n^2}) = m_1 + m_2 \pmod n.\]
\item Multiplication by a plaintext constant: Given a ciphertext $c_1 = \enc_{\mathsf{K_{pub}}}(m_1, r_1)$ and a plaintext constant $k$, the ciphertext raised to the power of $k$ modulo $n^2$ decrypts to the product of the plaintext and the constant:
\[\dec_{\mathsf{K_{priv}}}(c_1^k \pmod{n^2}) = k \cdot m_1 \pmod n.\]
\end{enumerate}
This additive homomorphism is particularly useful for applications requiring privacy-preserving aggregation, where sums of data points need to be computed without revealing individual values. In the context of this paper, it will be exploited for secure data aggregation in a new protocol.
\section{Reversible Watermarking Approach on the Complex Domain}
\label{sec:reversible}
This section presents a reversible watermarking scheme that can be used for isolated data measurements (\textit{e.g.}, readings of a smart meter or sensor data).
\subsection{Basic Definitions}
First, let us define the different elements of the reversible watermarking scheme.
\begin{defn}\label{def:data}
Fine-grained original data: $d_{j,k}$ is the scalar data produced by the $j$-th device (\textit{e.g.}, a sensor) in the \mbox{$k$-th} time sample (time $t_k$).
Without loss of generality, we assume that the original data is an integer: $d_{j,k}\in \mathbb{Z}$, since it is represented on a digital device and can always be mapped to an integer (even if it is a floating-point number).
\end{defn}
\begin{defn}\label{def:wm}
Watermark: $w_k$ is the watermark to be embedded at time $k$ in the fine-grained data $d_{j,k}$. Similarly, we assume $w_k\in \mathbb{Z}$.
\end{defn}
\begin{remark}
The only assumption we are making with respect to the watermark $w_k$ is to be an integer. Hence, any limitations in a practical deployment (\textit{e.g.}, a given number of bits) would be caused by the implementation details, such as the number of bits used for representing integers in a particular programming language. \remarkend
\end{remark}
\begin{defn}
\label{def:embext}
Reversible embedding and blind extraction functions: The embedding process is carried out using an embedding function $E_w$ in the following way:
\[
d'_{j,k}=E_w(d_{j,k},w_k,K_w),
\]
where $K_w$ is a watermarking key required for both the embedding and extraction processes. The reversible extraction or recovery function $R_w$ allows recovery of \textbf{both} the original data and the watermark, as follows:
\[
\left[d_{j,k}, w_k\right]\tps=R_w(d'_{j,k},K_w),
\]
for the watermarked data $d'_{j,k}$, where the superscript ``$\mathrm{T}$'' denotes the transposition operator.
Note that the extraction is blind, since the original data is not used in the function.
\end{defn}
\begin{defn}\label{def:aggregated}
Aggregated data and watermarked aggregated data: The aggregated data $S_k$, for the devices $j=1,2,\dots,N$ in the $k$-th time sample is defined as follows:
\[
S_k = \sum_{j=1}^{N}d_{j,k}.
\]
Similarly, the aggregated watermarked data $S'_k$ can be defined as detailed below:
\[
S'_k = \sum_{j=1}^{N}d'_{j,k} = \sum_{j=1}^{N}E_w(d_{j,k},w_k,K_w).
\]
Note that the watermark embedded in the different devices is the same ($w_k$), although it can vary at every $t_k$.
\end{defn}
\begin{defn} Reversible blind aggregated data and watermark extraction: An aggregated data and watermark extraction function $R\agg_w$ allows extracting both $S_k$ and $w_k$ from $S'_k$ as follows:
\[
\left[S_k, w_k\right]\tps=R\agg_w(S'_k,K_w,[N]),
\]
where ``$[N]$'' indicates that the extraction function may require, as an additional parameter, the number of data samples involved in the aggregation.
\end{defn}
\subsection{Proposed Reversible Watermarking Scheme}
This section details the embedding, extraction, and aggregated extraction functions for the proposed watermarking scheme.
First, let the watemarking key $K_w$ be a Gaussian integer $\lambda_k=a_k+i b_k$, where $i=\sqrt{-1}$ is the positive imaginary unit, $a_k,b_k\in\mathbb{Z}$, and $a_k, b_k\neq0$. The last condition guarantees that $\lambda_k$ is not either just real or imaginary, and also that $\lambda_k\neq0$. Thus, there exists a complex number $\lambda_k^{-1}$ such that $\lambda_k\lambda_k^{-1}=1$, with:
\[
\lambda_k^{-1} = \frac{1}{\lambda_k}=\frac{\overline{\lambda_k}}{\lambda_k\overline{\lambda_k}}=\frac{a_k-ib_k}{a_k^2+b_k^2}.
\]
where complex conjugate of a Gaussian integer $x+iy$ is denoted as $\overline{x+iy} = x-iy$.
Hence, $\lambda_k$ is simply a complex number with integer real $\Re(\cdot)$ an imaginary $\Im(\cdot)$ parts (\textit{i.e.,} a Gaussian integer, by definition): $\lambda_k\in\mathbb{Z}[i]$. In general, $\lambda_k^{-1}$ is not a Gaussian integer, but a Gaussian rational: $\lambda_k^{-1}\in\mathbb{Q}[i]$, which means that both real and imaginary parts of $\lambda_k^{-1}$ are rational numbers, or $\Re(\lambda_k^{-1}),\Im(\lambda_k^{-1})\in\mathbb{Q}$:
\[
\Re(\lambda_k^{-1})=\frac{a_k}{a_k^2+b_k^2},\:
\Im(\lambda_k^{-1})=\frac{-b_k}{a_k^2+b_k^2}.
\]
The secret watermarking key $\lambda_k$, termed as challenge factor, could be fixed or change at each time interval, hence the subscript ``$k$'' used in its definition. The changes on $\lambda_k$ can be scheduled according to the desired security level.
The embedding function, based on complex number arithmetic operations, is defined as follows. Let $\delta_{j,k}$ be the Gaussian integer $\delta_{j,k} = d_{j,k} + i w_k$.
\begin{remark}
Note that $\delta_{j,k}$ is simply a complex number (Gaussian integer), whose real part is the original data and the imaginary part is the embedded watermark:
$\Re(\delta_{j,k})=d_{j,k}$ and $\Im(\delta_{j,k})=w_k$.
As detailed in Definitions \ref{def:data} and \ref{def:wm}, both the data and the watermark are assumed to be integers and, hence, the complex number $\delta_{i,j}$ is indeed a Gaussian integer. \remarkend
\end{remark}
Now, the watermarked data\footnote{We use the notation $\delta'_{j,k}$ instead of $d'_{j,k}$ to remark that the value is complex (Gaussian integer) and not a regular integer.} $\delta'_{j,k}$ can be obtained applying the following embedding function:
\begin{equation}\label{eq:embedding}
\begin{split}
E_w(d_{j,k},w_k,\lambda_k)&=\lambda_k \cdot \delta_{j,k}\\& = (a_k+i b_k)(d_{j,k} + i w_k) \\ & = (a_k d_{j,k}-b_k w_k)+i (a_k w_k+b_k d_{j,k}).
\end{split}
\end{equation}
\begin{remark}
$\delta'_{j,k}$ is, again, a Gaussian integer, since it is the product of two Gaussian integers ($\lambda_k$ and $\delta_{i,j}$). Hence, the real and the imaginary parts of the watermarked data are integers.
This is particularly interesting if we want to carry out further operations on this data, such as public-key encryption. \remarkend
\end{remark}
\begin{remark}
From a purely mathematical point of view, there is no need to constrain the data, the watermark and the watermarking key to be integers or Gaussian integers. Consequently, a formulation of the scheme based on real and complex numbers (without constraints) is perfectly possible. However, in practical implementations, using floating point numbers would produce round-off errors in simple computations (such as multiplications or divisions). In addition, floating point numbers are not handled directly in some operations, such as public-key encryption. For these reasons, the proposed method is defined using integers in this paper. \mbox{\hspace{1cm}}
\remarkend
\end{remark}
\begin{remark}\label{rem:vector}
It may be argued that the proposed approach is just a linear transformation of the vector $[d_{j,k}, w_k]{^\mathrm{T}}$ to a new vector $v$, obtained multiplying by a particular $2\times 2$ matrix, as follows:
\[\left[\begin{array}{c}
v_1 \\
v_2
\end{array}\right] =
\left[\begin{array}{cc}
a_k & -b_k \\
b_k & a_k
\end{array}\right] =
\left[\begin{array}{c}
d_{j,k} \\
w_k
\end{array}\right],
\]
where $v_1$ corresponds to $\Re(\delta'_{j,k})$ and $v_2$ to $\Im(\delta'_{j,k})$.
While this is true, the idea behind the proposed scheme is to exploit the algebraic operations that are already available for complex numbers. There are libraries for complex number operations in most programming languages and, hence, they can be directly applied in any practical implementation of the method. This prevents the explicit use of matrices and matrix inverses, which may be cumbersome.
Obviously, the method can be further generalized in its vector form, as discussed in the Appendices (supplemental material). \remarkend
\end{remark}
The extraction of the original data and the watermark from the watermarked data is straightforward, since the reversible extraction function $R_w$ can be defined as follows:
\begin{equation}\label{eq:extraction}
\left[\begin{array}{c}
d_{j,k} \\
w_k
\end{array}
\right] =
\left[\begin{array}{c}
\Re(\lambda_k^{-1}\delta'_{j,k})\\
\Im(\lambda_k^{-1}\delta'_{j,k})
\end{array}
\right].
\end{equation}
Consequently, we only need to multiply $\delta'_{j,k}$ by $\lambda_k^{-1}$ (the complex inverse of $\lambda_k$) and, then, take the real and the imaginary parts to recover both the original data and the watermark.
\begin{remark}
Expression \ref{eq:extraction} perfectly matches the formulation given for $R_w$ in Definition \ref{def:embext}, since it takes, as input parameters, $\delta'_{j,k}$ (analogous to $d'_{j,k}$) and $K_w=\lambda_k$. \remarkend
\end{remark}
\begin{remark}\label{rem:factor}
The proposed method is vulnerable against Gaussian integer factorization. Even with just one eavesdropped value, a malicious observer may try to compute the Guassian integer factors of the watermarked data and obtain knowledge about the original data, the watermark or the watermarking key. Consequently, \textbf{for practical applications, it is not recommended to rely solely on the challenge $\lambda_k$ as a security measure.} The scheme can be combined with random numbers and/or cryptographic functions for increased security and privacy, as shown in the protocols proposed in Section \ref{sec:protocols}. \remarkend
\end{remark}
\begin{remark}
Although the data and the watermark are clearly separated in $\delta_{j,k}$ (the real part contains the data and the imaginary part is the watermark), this is no longer true after multiplying by $\lambda_k$. In the watermarked data $\delta'_{j,k}=\lambda_k \cdot \delta_{j,k}$, the data $d_{j,k}$ and the watermark $w_k$ contribute to both the real and the imaginary parts. To recover the data and the watermark, knowledge about the secret key $\lambda_k$ is necessary (to compute $\lambda_k^{-1}$).
Hence, an eavesdropper who accessed $\delta'_{j,k}$ would not be able to determine the data or the watermark directly, but may try to infer information from Guassian integer factorization, as discussed in Remark \ref{rem:factor}. In addition, if the eavesdropper had access to the watermarked values corresponding to different time samples ($k$) or different devices ($j$), they could try to obtain even more information about $\lambda_k$, especially if it is not changed frequently. \remarkend
\end{remark}
% \subsection{Data Aggregation}
% When we have a collection of devices $j=1,2,\dots,N$, for privacy reasons, it may be convenient to work on the aggregated data $\sigma_k$ (which is completely analogous to $S_k$ defined above, but this notation reflects the complex domain of the data). The aggregated watermarked data, using the embedding function of Expression (\ref{eq:embedding}), can be easily defined as follows:
% \
% \[
% \sigma'_k=\sum_{j=1}^N \delta'_{j,k} = \sum_{j=1}^N \lambda_k \delta_{j,k} = \lambda_k \sum_{j=1}^N\delta_{j,k}=\lambda_k \sum_{j=1}^N(d_{j,k}+iw_k).
% \]
% Now, we can rearrange this expression as:
% \[
% \sigma'_k=\lambda_k\sum_{j=1}^N d_{j,k}+i\lambda_k \sum_{j=1}^N w_k = \lambda_k S_k + i \lambda_k N w_k.
% \]
% Since the watermark $w_k$ is the same for all devices, the sum $\sum_j w_k$ can be computed as a simple integer multiplication ($N w_k$). This expression can be further simplified as follows:
% \begin{equation}\label{eq:agg}
% \sigma'_k=\lambda_k(S_k+iNw_k),
% \end{equation}
% just by taking $\lambda_k$ as the common factor.
% Similarly as the non-aggregated case, the result is a complex number $\sigma'_k$, where the aggregated data $S_k$ and the watermark $w_k$ affect both the real and imaginary parts of the result. It is not possible to separate these values without the secret key $\lambda_k$.
% The extraction function $R\agg_w$ can now be easily defined from Expression (\ref{eq:agg}), as follows:
% \begin{equation}
% \left[
% \begin{array}{c}
% S_k \\ w_k
% \end{array}
% \right]= \left[\begin{array}{c}
% \Re(\lambda_k^{-1}\sigma'_k) \\
% \displaystyle \frac{1}{N} \Im(\lambda_k^{-1}\sigma'_k)
% \end{array}\right].
% \end{equation}
% Hence, both the aggregated data and the watermark can be easily extracted from aggregated-watermarked data. First, we need to multiply by the inverse of $\lambda_k$ and, after that, the real part directly produces the aggregated original data ($S_k$) and the imaginary part, divided by the number of devices ($N$), gives the watermark ($w_k$).
\subsection{Data Aggregation}
\label{sec:aggregation}
When a collection of devices $j=1,2,\dots,N$ transmit data, it is often desirable, for privacy reasons, to work on the aggregated data rather than individual readings. Let $d_{j,k}$ be the sensor data (an integer) from device $j$ at time $t_k$, and $S_k$ (Definition \ref{def:aggregated}) be the total aggregated data.
For a data aggregation protocol, each device $j$ at time $t_k$ first combines
the watermark $w_k$ with its data to form a complex number $\delta_{j,k} = d_{j,k} + i w_k$. This individual watermarked data is then scaled by the challenge factor $\lambda_k$ (which is provided by the Data Collector for the specific $k$-th round) to produce $\delta'_{j,k} = \lambda_k \delta_{j,k}$.
The total aggregated watermarked data, denoted as $\sigma'_k$, is the sum of these individual scaled and watermarked complex numbers across all devices:
\[
\sigma'_k=\sum_{j=1}^N \delta'_{j,k} = \sum_{j=1}^N \lambda_k \delta_{j,k}.
\]
Since $\lambda_k$ is a common factor for all devices in a given round, we can factor it out of the summation:
\[
\sigma'_k = \lambda_k \sum_{j=1}^N\delta_{j,k}=\lambda_k \sum_{j=1}^N(d_{j,k}+iw_k).
\]
By separating the real and imaginary components of the sum, and noting that the watermark $w_k$ is the same for all devices in a given round, the expression for $\sigma'_k$ can be rearranged as:
\begin{equation}\label{eq:agg}
\sigma'_k = \lambda_k \left( \sum_{j=1}^N d_{j,k} + i \sum_{j=1}^N w_k \right) = \lambda_k ( S_k + i N w_k ).
\end{equation}
where $S_k$ is the aggregated real data and $N w_k$ is obtained as the aggregated imaginary part.
Similarly to the non-aggregated case, the result $\sigma'_k$ is a complex number where both the aggregated data $S_k$ and the watermark $w_k$ (scaled by $N$) affect its real and imaginary parts. It is not possible to separate these values without the secret challenge factor $\lambda_k$.
The extraction of both the aggregated data $S_k$ and the watermark $w_k$ from $\sigma'_k$ is straightforward. We can first multiply $\sigma'_k$ by the inverse of $\lambda_k$ in the complex domain, $\lambda_k^{-1}$. Then, the real part of the result directly yields the aggregated original data ($S_k$), and the imaginary part, divided by the number of devices ($N$), gives the watermark ($w_k$). This extraction process can be formally expressed as:
\begin{equation}
\left[
\begin{array}{c}
S_k \\ w_k
\end{array}
\right]= \left[\begin{array}{c}
\Re(\lambda_k^{-1}\sigma'_k) \\
\displaystyle \frac{1}{N} \Im(\lambda_k^{-1}\sigma'_k)
\end{array}\right].
\end{equation}
Hence, both the aggregated data and the watermark can be easily recovered from the aggregated-watermarked data.
A numerical example with small numbers is provided in the Appendices (supplemental material) to illustrate how the embedding and recovery methods work, both for single data and for data aggregration.
\begin{remark}
This particular version of the extraction function $R\agg_w$ does require $N$ as an input: $R\agg_w(\sigma'_k,\lambda_k,N)$. However, if further constraints in the definition of the watermark and the number of devices are introduced, an alternative aggregated extraction function that would not require $N$ as an input may be obtained.
For example, if the number of devices $N$ was limited to a maximum of $100$: $N\leq 100$ (which may be enough in many applications), it would suffice to choose the watermark $w_k$ as any integer with no prime factors lower than 100. A partial factorization of $\Im(\lambda_k^{-1}\sigma'_k)=Nw_k$, for primes below 100, would clearly reveal both $N$ and $w_k$. All prime factors of $\Im(\lambda_k^{-1}\sigma'_k)$ lower than 100, with their respective exponents, would yield $N$. Once $N$ is known (by multiplying all those powers of small prime factors), then $w_k$ could be finally obtained by dividing $\Im(\lambda_k^{-1}\sigma'_k)=Nw_k$ by $N$.
In any case, knowledge about the number of participants is, in general, acceptable in many real-life situations.\remarkend
\end{remark}
% \subsection{Generalized Vector-based Approach} \label{sec:generalized}
% As discussed in Remark \ref{rem:vector}, a similar scheme could be obtained using vectors and matrices instead of complex numbers. In this case, the complex number would be a particular example of the vector case (but with some advantages as already discussed).
% In the generalized case, the watermarked data $d'_{j,k}$ can be defined in vector form, as follows:
% \[\resizebox{\columnwidth}{!}{$
% d'_{j,k}=
% \left[\begin{array}{cc}
% m_{11,k} & m_{12,k} \\
% m_{21,k} & m_{22,k}
% \end{array}\right]
% \left[\begin{array}{c}
% d_{j,k} \\
% w_k
% \end{array}\right]= \left[\begin{array}{c}
% m_{11,k}d_{j,k} + m_{12,k} w_k \\
% m_{21,k}d_{j,k} + m_{22,k} w_k
% \end{array}\right],$}
% \]
% where a $2\times2$ matrix makes the appropriate transformation.
% For reversibility, it is enough that the matrix be invertible, \textit{i.e.}, that its determinant is different from zero: $m_{11,k}m_{22,k}-m_{12,k}m_{21,k} \neq 0$. If this condition is satisfied, the original data and the watermark can be extracted from $d'_{j.k}$ as follows:
% \[
% \left[\begin{array}{c}
% d_{j,k} \\
% w_k
% \end{array}\right]=\left[\begin{array}{cc}
% m_{11,k} & m_{12,k} \\
% m_{21,k} & m_{22,k}
% \end{array}\right]^{-1}d'_{j,k}.
% \]
% Since this is a linear transformation, it would also work for aggregated data, similarly as in the complex numbers case.
% The property of ``distributing'' the watermark and the data in the two components of the resulting vector ($d'_{j,k}$) will be satisfied as far as none of the elements of the matrix is zero. Again, if all the values $m_{11,k}, \dots, m_{22,k}$ are integers, the obtained vector will also have integer components ($d'_{j,k}\in\mathbb{Z}^2$), which may be convenient for different applications, especially those that require public-key encryption.
% \begin{remark}
% This vector form of the reversible watermarking system, however, requires four parameters ($m_{11,k}, \dots, m_{22,k}$) instead of two: the real ($a_k$) and imaginary ($b_k$) parts of a Gaussiann integer $\lambda_k$. While using four parameters offers no clear advantage over the two-parameter (complex number) case, it does require a larger secret watermarking key at both the embedding and extraction ends. This increased key size, without any compensating benefits, can be considered a disadvantage of the generalized approach, leading to the preference for the complex number-based formulation in this paper. The only advantage of such a scheme would rely on the longer apparent key size, but this can be easily replicated with two values instead of four just by selecting a larger range for each of them. \remarkend
% \end{remark}
% Obviously, the method could be further extended by introducing larger vectors and matrices. However, no clear advantages would be obtained with that additional complexity.
% \subsection{Numerical Example}
% This section presents an example of how the method would work with simple data. In this example, three devices produce the following data: $d_{1,1}=5$, $d_{2,1}=8$, and $d_{3,1}=17$ at time $t_1$. All of them must embed the watermark $w_1=4$, and the secret embedding key is $\lambda_1=3+2i$. With this setting, the inverse $\lambda_1^{-1}$ can be obtained as follows:
% \[
% \lambda_1^{-1}=\frac{3-2i}{3^2+2^2}=\frac{3}{13}-\frac{2}{13}i.
% \]
% The corresponding embedded data are the following:
% \[
% \begin{split}
% \delta'_{1,1}&=(3+2i)(5+4i)=7+22i,\\
% \delta'_{2,1}&=(3+2i)(8+4i)=16+28i,\\
% \delta'_{3,1}&=(3+2i)(17+4i)=43+46i.
% \end{split}
% \]
% \begin{remark}
% As discussed in Remark \ref{rem:factor}, a simple Gaussian integer factorization of eavesdropped data could reveal much information. For example, a factorization calculator for $7+22i$ yields $7+22i=(3+2i)(5+4i)$, which leaks $\lambda_k=3+2i$, in one factor, and the original data and watermark, in the other factor. While an individual eavesdropped data would not be enough to identify $\lambda_k$ and $d_{j,k}+iw_k$ from the computed factors, it is obvious that a small number of leaked data would suffice for an attacker. Additional security measures are required for the transmission of watermarked data. In addition, it is recommended to modify $\lambda_k$ frequently (\textit{e.g.}, at each time sample). \remarkend
% \end{remark}
% \begin{remark}
% As in the regular integer case (without complex numbers), the use of large prime factors for $\lambda_k$ would make the factorization problem harder for an attacker and, consequently, would increase security. \remarkend
% \end{remark}
% At the receiver end, the following computation would be performed:
% \[
% \begin{split}
% \lambda_1^{-1}\delta'_{1,1}&=\left(\frac{3}{13}-\frac{2}{13}i\right)(7+22i)=5+4i,\\
% \lambda_1^{-1}\delta'_{2,1}&=\left(\frac{3}{13}-\frac{2}{13}i\right)(16+28i)=8+4i,\\
% \lambda_1^{-1}\delta'_{3,1}&=\left(\frac{3}{13}-\frac{2}{13}i\right)(43+46i)=17+4i.
% \end{split}
% \]
% Thus, taking the real and the imaginary parts after the multiplication recovers both the original data and the watermark, respectively.
% Reversible extraction is also possible from aggregated data. The aggregated data for these three devices at time $t_1$ can be computed as:
% \[
% S_1=\sum_{j=1}^3d_{j,1}=d_{1,1}+d_{1,2}+d_{1,3}=5+8+17 =30.
% \]
% Similarly, the aggregated watermarked data can be obtained as follows:
% \[
% \begin{split}
% \sigma'_1&=\sum_{j=1}^3\delta'_{j,1}=\delta'_{1,1}+\delta'_{1,2}+\delta'_{1,3}\\&=(7+22i)+(16+28i)+(43+46i)\\&=66+96i.
% \end{split}
% \]
% The receiver end would compute the following:
% \[
% \lambda_1^{-1}\sigma'_1=\left(\frac{3}{13}-\frac{2}{13}i\right)(66+96i)=30+12i,
% \]
% whose real part provides the aggregated data: $S_1=\Re(30+12i)=30$, whereas the imaginary part is $\Im(30+12i)=12=3\cdot 4=Nw_1$. If the imaginary part is divided by the number of devices ($N=3$), the embedded watermark ($w_1=4$) is finally extracted.
% % \begin{figure*}[ht]
% % \centering
% % \subfloat[Initial set of values] {\label{fig:mod5a} \includegraphics[width=.8\columnwidth]{mod5a.eps}} \qquad
% % \subfloat[Set reduced to 45 values]{\label{fig:mod5b} \includegraphics[width=.8\columnwidth]{mod5b.eps}} \\
% % \subfloat[Set reduced to 45 values] {\label{fig:mod5c} \includegraphics[width=.8\columnwidth]{mod5c.eps}} \qquad
% % \subfloat[Final set of 25 values]{\label{fig:mod5d} \includegraphics[width=.8\columnwidth]{mod5d.eps}} \\
% % \caption{Gaussian integers $\pmod{5}$.}
% % \end{figure*}
\section{Homomorphic Encryption on the Complex Domain}
\label{sec:homomorphic}
This section presents the extension of ElGamal and Paillier cryptosystem to use complex-valued data.
The extension of ElGamal encryption to Gaussian integers requires a careful examination of the mathematical basis of the cryptosystem. The first building block of the standard ElGamal cryptosystem is the multiplicative cyclic group $\mathbb Z^*_p$, for a prime number $p$, and a generator $g$ for such a group. In the Gaussian integer case, we must have a prime number $\pi$ in $\mathbb Z[i]$ and a consistent definition of the modular arithmetic $\pmod{\pi}$.
For a better understanding of the adaptation of this cryptosystem to the complex domain, a brief introduction to modular arithmetic over Gaussian integers is provided in the Appendices (supplemental material). A more detailed reference on Gaussian integers can be found in \cite{conrad2016gaussian}.
% \subsection{Modular Arithmetic over Gaussian Integers}
% \label{sec:modular}
% The extension of ElGamal encryption to Gaussian Integers requires a careful examination of the mathematical basis of the cryptosystem.
% The first building block of the standard ElGamal cryptosystem is the multiplicative cyclic group $\mathbb Z^*_p$, for a prime number $p$, and a generator $g$ for such a group. In the Gaussian integer case, we must have a prime number $\pi$ in $\mathbb Z[i]$ and a consistent definition of the modular arithmetic $\pmod{\pi}$.
% It is worth pointing out that Gaussian prime numbers have some differences compared to the regular integer case. The obvious one is that Gaussian primes can have both real and imaginary parts. The second main difference is that not all integer primes are also Gaussian primes. For example, prime factorizations exists for both 2 and 5 in $\mathbb Z[i]$: $2=(1+i)(1-i)$ and $5=(2+i)(2-i)$. The integer primes $p$ that are also Gaussian primes satisfy the following condition $p\equiv 3 \pmod{4}$ as proven, for example, in \cite{conrad2016gaussian}.
% \begin{figure}[ht]
% \centering{
% \includegraphics[width=.6\columnwidth]{mod7.eps}}
% \caption{Representatives of Gaussian integers $\pmod{7}$, or $\mathbb Z[i]_7$.}
% \label{fig:mod7}
% \end{figure}
% Regarding modular arithmetic, we need to extend the definition of integer division to the complex domain. For general Gaussian integers $
% \alpha,\beta\in \mathbb Z[i]$, the Gaussian integer division is defined as $\alpha=\kappa \beta+\rho$, for some residual $\rho$ with $\mathrm{N}(\rho)<\mathrm{N}(\beta)$, where $\mathrm{N}(\cdot)$ stands for the norm of a complex number, which is defined as follows:
% \[
% \mathrm{N}(a+ib)=\abs{a+ib}^2=a^2+b^2.
% \]
% This definition preserves the intuition of integer division for Gaussian integers since, for each number $\alpha$ and each divider $\beta$ in Gaussian integers, a quotient $\kappa$ and a remainder $\rho$ can be found such that $\alpha=\kappa \beta+\rho$, and $\rho$ is, in some sense, smaller than the divider $\beta$. Here, the norm of complex number is the criterion for determining whether a complex number is smaller than another.
% With this definition of the integer division, we can apply the same rules of modular arithmetic as for standard integers, \textit{i.e.}, for $\alpha,\beta,\kappa,\rho\in \mathbb Z[i]$, if $\alpha=\kappa\beta+\rho$, we have $\alpha \equiv \rho \pmod{\beta}$, since $\beta | (\alpha-\rho)$.
% It is well known that, in regular integers, for a prime number $p\in\mathbb Z$, the elements of the cyclic group $\mathbb Z_p$ (or $\mathbb Z/p\mathbb Z$) are $0,1,\dots,p-1$, while the multiplicative cyclic group $\mathbb Z^*_p$ has the same elements, excluding 0. The order of the corresponding cyclic groups $\mathbb{Z}[i]_{\pi}$ and ${\mathbb{Z}[i]}^*_{\pi}$ is not so straightforward when $\pi$ is a Gaussian prime. For Gaussian integers, given a prime number $\pi\in\mathbb Z[i]$, the norm $\mathrm N(\pi)$ determines the order of the additive cyclic group $\mathbb{Z}[i]_{\pi}$, whereas $\mathrm N(\pi)-1$ is the order of the multiplicative cyclic group ${\mathbb{Z}[i]}^*_{\pi}$ (because of the exclusion of 0). Proofs for these facts can also be found in \cite{conrad2016gaussian}.
% As a practical example, the selection of representatives for the cyclic group ${\mathbb{Z}[i]}^*_{\pi}$ for $\pi=7$, which is both an integer and a Gaussian prime, is discussed below. First, we need to take into account that many possible selections of representatives exists, similar to the integer case. For example, 13 and 6 refer to the same equivalence class in both ${\mathbb Z}^{*}_7$ and ${\mathbb Z[i]}^*_7$, since 13 and 6 differ in a multiple of 7 (in fact, exactly 7). The only relevant consideration for the selection is not to include more than one representative for the same class. A method for such a selection is described in \cite{conrad2016gaussian} both when the divider has real and imaginary parts different from zero, and when the imaginary part is zero (the case of the Gaussian prime $\pi=7$).
% The procedure is illustrated in Fig. \ref{fig:mod7}: We take $7$ (the divider) and $7i$ (by multiplying by $i$) and draw a square which has 7 and $7i$ as the left and lower edges (shown in green color in the picture). The square is completed with the purple edges that connect 7 and $7i$ with the vertex $7+7i$. The representatives of $\mathbb Z[i]_7$ are the Gaussian integers that lie within the square and the ones which are on the green edges, but excluding the ones on the purple edges, since they represent the same equivalence class as the elements on the green ones.
% \begin{figure}[ht]
% \centering{
% \includegraphics[width=.6\columnwidth]{mod7can.eps}}
% \caption{``Canonical'' epresentatives of Gaussian integers $\pmod{7}$, or $\mathbb Z[i]_7$.}
% \label{fig:mod7can}
% \end{figure}
% %Although it is not a Gaussian prime, the modular arithmetic works analogously to the standard integers and, for this illustration, $p$ does not need to be a a prime. The set of Gaussian integers whose norm is smaller than $\mathrm{N}(5)=5^2=25$ is shown in Fig. \ref{fig:mod5a}. A circle of radius 5 encloses all Gaussian integers with norm less than 25, resulting in 69 different numbers. However, not all those numbers are different $\pmod{5}$. For example, $-1+i \pmod{5}$ is equivalent to $-1+i+5 \pmod{5}=4+i$. Hence, at least two members of the equivalence class of $4+i\pmod{5}$ are shown in the figure, using a black square for $-1+i$ and a red circle for $4+i$. If we add 5 to all the numbers shown with a black square in Fig. \ref{fig:mod5a}, the number of elements reduces to 45 as shown in Fig. \ref{fig:mod5b}.
% % \begin{remark}
% % There are some numbers whose norm is greater than or equal to 25 in Fig. \ref{fig:mod5b}, shown with a black square. For example, $4+4i$ has norm equal to 32. However, this value is equivalent to $-1+4i \pmod{5}$, whose norm is actually lower than 25. To compute the order of ${\mathbb{Z}[i]}_5$ we just need to make sure that none of the elements we consider are equivalent $\pmod{5}$, even if we choose a representative of a class with a norm greater than 25. \remarkend
% % \end{remark}
% %However, in Fig.\ref{fig:mod5b} there are still some values hat are ``repeated'' $\pmod{5}$. For example, $1-i$ is equivalent to $1-i+5i \pmod{5}=1+4i$. The elements with a negative imaginary part, shown with a diamond symbol in Fig.\ref{fig:mod5c}, can be mapped to values with a positive imaginary part (shown with a red circle or a black square) by adding $5i$, which is a multiple of 5. Hence, the number of elements is further reduced from 45 to 25 once all the equivalent values are removed, as shown in Fig.\ref{fig:mod5d}.
% %Although three values of Fig.\ref{fig:mod5d} have norm greater than or equal to 25 ($3+4i$, $4+3i$, and $4+4i$), all of them coudl be replaced by equivalent values with norm lower than 25 (for example, $3-i$, $4-2i$, and $4-i$, respectively). However, the form given in Fig.\ref{fig:mod5d} is particularly convenient, since
% With this particular selection, the set of values of the cyclic multiplicative group ${\mathbb{Z}[i]}^*_7$ can be easily represented as
% \[ {\mathbb{Z}[i]}^*_7=\left\{ x + iy \mid x, y \in \{0, 1, \dots, 6\right\} \text{ and } (x,y) \neq (0,0) \}, \]
% with no equivalent elements. This leads to the following observations:
% \begin{itemize}
% \item The order of the additive cyclic group ${\mathbb Z[i]}_p$, for $p\in\mathbb Z$ (\textit{i.e.,} $p$ is a regular integer) is $p^2$.
% \item If $p\in \mathbb Z$ is both a regular prime and a Gaussian prime, \textit{i.e.,} when $p\equiv 3\pmod{4}$, then ${\mathbb Z[i]}^*_p$ is a multiplicative cyclic group of order $p^2-1$.
% \end{itemize}
% This set of representatives is particularly convenient to carry out modular arithmetic operations, since $(a+ib) \pmod{7}$ is simply $a \pmod{7}+ib\pmod{7}$. This means that we can just apply the modular operator to the real and the imaginary parts separately, which is easy to handle with most of the existing programming languages.
% This selection of representatives is not ``canonical'', in the sense that it includes some elements whose norms are greater than $\mathrm{N}(7)=7^2=49$. For example $\mathrm{N}(5+5i)=5^2+5^2=50$.
% A more ``canonical'' set of representatives for ${\mathbb{Z}[i]}^*_7$ would be the following (Fig. \ref{fig:mod7can}):
% \[ {\mathbb{Z}[i]}^*_7=\left\{ x + iy \mid x, y \in \{-3, -2, \dots, 3\} \text{ and } (x,y) \neq (0,0) \right\}, \]
% which is obtained by shifting the values of Fig. \ref{fig:mod7} by $-3$ units in each axis. This new selection of representatives is intuitively closer to that usually made for the cyclic groups defined using standard integers, but the one shown in Fig. \ref{fig:mod7} is more convenient for computational operations. In any case, both are completely equivalent. For example, $5+5i \equiv -2-2i \pmod{7}$, where the former is one of the points represented in Fig. \ref{fig:mod7} and latter only appears in Fig. \ref{fig:mod7can}. Note that the norm of $-2-2i$ is $2^2+2^2=8$, which, of course, is lower than $N(7)=49$. Hence, although $5+5i$ has a norm greater than $\mathrm{N}(7)$, an equivalent value can easily be found with a norm below that of the modulus. The norms of all values represented in Fig. \ref{fig:mod7can} are lower than 49.
\subsection{ElGamal Encryption over Gaussian Integers}
The principles of ElGamal encryption can be extended to other finite cyclic groups, including the multiplicative group of Gaussian integers modulo a Gaussian prime. This adaptation exploits the rich algebraic structure of Gaussian integers while maintaining the security reliance on the DLP.
We define the ``Gaussian'' version of ElGamal encryption as follows. Let $p$ be a Gaussian prime (preferably a regular prime integer of the form $4n-1$, as discussed in Appendix A). Let $\gamma$ be a generator of the cyclic multiplicative group of Gaussian integers modulo $p$, denoted as ${\mathbb{Z}[i]}^*_p$. The ElGamal encryption scheme over Gaussian integers consists of the same three fundamental algorithms:
\begin{itemize}
\item Key generation: The key generation process involves selecting a random integer $a$ such that $1 \leq a \leq \mathcal{N}-1$ as the private key, where $\mathcal{N}$ is the order of the group ${\mathbb{Z}[i]}^*_p$. For a prime integer $p$ (of the form $4n-1$), $\mathcal{N} = p^2-1$. Then, the public key $\mathcal{K} = \gamma^a \pmod{p}$ is computed. The public key is formed as the triple $\mathbf{K}=(p, \gamma, \mathcal{K})$.
\item Encryption: To encrypt a message $\mu \in {\mathbb{Z}[i]}^*_p$, a random integer $b$, such that $1 \leq b \leq \mathcal{N}-1$, is selected as the ephemeral key. The ciphertext is then computed as $\psi_1 = \gamma^b \pmod{p}$ and $\psi_2 = \mu \cdot \mathcal{K}^b \pmod{p}$, resulting in the pair $(\psi_1, \psi_2)$. The encryption function can be denoted as follows:
\[(\psi_1, \psi_2)=\enc_{\mathbf K}(\mu, b) = \left(\gamma^b \pmod{p}, \mu \cdot \mathcal{K}^b \pmod{p}\right).\]
\item Decryption: The decryption of the ciphertext $(\psi_1, \psi_2)$ using the private key $a$ involves computing the shared secret $\tau_k = \psi_1^a \pmod{p}$. Then, the message is decrypted as $\mu = \psi_2 \cdot \tau_k^{-1} \pmod{p}$. This decryption function can be formally denoted as follows:
\[\dec_{a}(\psi_1, \psi_2) = \psi_2 \cdot (\psi_1^a)^{-1} \pmod{p}.\]
\end{itemize}
%The security of this Gaussian integer ElGamal variant relies on the difficulty of the DLP in ${\mathbb{Z}[i]}^*_p$. If an attacker can efficiently solve the DLP in this group, they can compute the private key $a$ from the public key $\mathcal{K}$ and then decrypt any ciphertext. For sufficiently large Gaussian primes $p$, the DLP is believed to be computationally infeasible. The order of this group, $N = p^2-1$, is significantly larger than $p-1$ for the same numerical prime $p$, which contributes to its security. The security is highly dependent on the largest prime factor of $N$.
The selection of a suitable generator $\gamma$ for the group ${\mathbb{Z}[i]}^*_p$ is a practical consideration, similar to the regular integer case. This can be efficiently achieved through probabilistic methods involving testing candidate elements.
%The order of this group, $p^2-1$, is significantly larger than $p-1$ for the same numerical prime $p$. However, to ensure robust security against algorithms like Pohlig-Hellman \cite{pohlig:1978}, it is essential that the largest prime factor of $p^2-1$ is sufficiently large. This requirement guides the selection of the Gaussian prime $p$, making the issue solvable through appropriate parameter choices.
%Obviously, the security of this Gaussian integer ElGamal variant relies on the difficulty of the DLP in ${\mathbb{Z}[i]}^*_p$. If an attacker can efficiently solve the DLP in this group, they can compute the private key $a$ from the public key $\mathcal{K}$ and then decrypt any ciphertext. For sufficiently large Gaussian primes $p$, the DLP is believed to be computationally infeasible. The order of this group, $\mathcal{N} = p^2-1$, is significantly larger than $p-1$ for the same numerical prime $p$ in the standard integer case. This relationship, $\mathcal{N} = (p-1)(p+1)$, implies that if $(p-1)$ possesses a large prime factor, this factor will also be a prime factor of $\mathcal{N}$. Consequently, a prime $p$ chosen for robust security in standard integer ElGamal (due to its group order's large prime factor) will inherently contribute to the strength of its Gaussian counterpart. To ensure maximum resistance against algorithms like Pohlig-Hellman \cite{pohlig:1978}, it is essential that the largest prime factor of $\mathcal{N}$ is sufficiently large. This requirement guides the selection of the Gaussian prime $p$, making the issue solvable through appropriate parameter choices.
The security of this Gaussian integer ElGamal variant fundamentally relies on the difficulty of the DLP in the group ${\mathbb{Z}[i]}^*_p$. If an attacker can efficiently solve the DLP in this group, they could compute the private key $a$ from the public key $\mathcal{K}$ and subsequently decrypt any ciphertext. For sufficiently large Gaussian primes $p$, the DLP is believed to be computationally infeasible.
As a key property, the order of this group, $\mathcal{N} = p^2-1$, is significantly larger than $p-1$ for the same numerical prime $p$ used in the regular integer ElGamal. This relationship, $\mathcal{N} = (p-1)(p+1)$, is particularly advantageous for security. If a prime $p$ is chosen such that $p-1$ possesses a large prime factor (a standard requirement for robust security in integer-based ElGamal against algorithms like Pohlig-Hellman \cite{pohlig:1978}), then this same large prime factor will inherently be a factor of $\mathcal{N}$. Therefore, the Gaussian integer ElGamal variant naturally inherits at least the same level of security (in terms of resistance to Pohlig-Hellman attacks) as its regular integer counterpart for a given $p$. Furthermore, the existence of the additional factor $(p+1)$ in $\mathcal{N}$ can potentially introduce even larger prime factors, further enhancing the security of the scheme. Thus, careful selection of the Gaussian prime $p$ to ensure that the largest prime factor of $\mathcal{N}$ is sufficiently large guides robust parameter choices.
Similar to its regular integer counterpart, this Gaussian integer ElGamal encryption exhibits a homomorphic property under component-wise multiplication of ciphertexts. This means that given two ciphertexts $\enc_{\mathbf K}(\mu_1, b_1) = (\psi_1, \psi_2)$ and $\enc_{\mathbf K}(\mu_2, b_2) = (\psi'_1, \psi'_2)$, multiplying them component-wise as $(\psi_1 \cdot \psi'_1, \psi_2 \cdot \psi'_2)$ results in a ciphertext that decrypts to the product of the original plaintexts:
\[\dec_a\left(\enc_{\mathbf K}(\mu_1, b_1) \cdot \enc_{\mathbf K}(\mu_2, b_2)\right) = \mu_1 \cdot \mu_2 \pmod{p}.\]
This property enables its use in various cryptographic protocols and specifically finds application in the proposed method for combining reversible watermarking and encryption in this paper.
\subsubsection{Numerical example}
This example demonstrates the ElGamal encryption process and its homomorphic property using Gaussian integers. The multiplicative group of Gaussian integers modulo $p=23$, denoted as ${\mathbb{Z}[i]}^*_p$, is selected. The order of this group is $\mathcal{N} = 23^2-1 = 528$.
For the parameters, the prime modulus $p = 23$ and the generator $\gamma = 1+2i$ are taken, and the private key is chosen as $a = 7$. Now, $\mathcal{K}$ is computed as $\mathcal{K} = \gamma^a \pmod{p} = (1+2i)^7 \pmod{23} = 6+2i$, and the public key is thus formed as the triple $\mathbf{K}=(p, \gamma, \mathcal{K}) = (23, 1+2i, 6+2i)$.
To encrypt a first message $\mu_1 = 5+4i$, an ephemeral key $b_1 = 5$ is chosen. The ciphertext components are computed as $\psi_1 = \gamma^{b_1} \pmod{p} = (1+2i)^5 \pmod{23} = 18+8i$, and $\psi_2 = \mu_1 \cdot \mathcal{K}^{b_1} \pmod{p} = (5+4i) \cdot (6+2i)^5 \pmod{23} = 21+11i$. The resulting ciphertext is $(\psi_1, \psi_2) = (18+8i, 21+11i)$. Decryption of this ciphertext using the private key $a=7$ successfully yields $\mu_1 = 5+4i \pmod{23}$.
For a second message $\mu_2 = 3+2i$, an ephemeral key $b_2 = 7$ is chosen. The ciphertext components are computed as $\psi'_1 = \gamma^{b_2} \pmod{p} = (1+2i)^7 \pmod{23} = 6+2i$, and $\psi'_2 = \mu_2 \cdot \mathcal{K}^{b_2} \pmod{p} = (3+2i) \cdot (6+2i)^7 \pmod{23} = 21+16i$. The resulting ciphertext is $(\psi'_1, \psi'_2) = (6+2i, 21+16i)$. Decryption of this ciphertext using the private key $a=7$ successfully yields $\mu_2 = 3+2i \pmod{23}$.
The homomorphic property is demonstrated by multiplying the two ciphertexts component-wise:
$(\psi_1, \psi_2) = (18+8i, 21+11i)$ and $(\psi'_1, \psi'_2) = (6+2i, 21+16i)$.
The resulting ciphertext components, obtained by component-wise multiplication, are:
\begin{align*}
\psi''_1 &= \psi_1 \cdot \psi'_1
= (18+8i) \cdot (6+2i) = 0+15i \pmod{23}, \\
\psi''_2 &= \psi_2 \cdot \psi'_2
= (21+11i) \cdot (21+16i) = 12+15i \pmod{23}.
\end{align*}
The combined ciphertext for the product is then expressed as $(\psi''_1, \psi''_2) = (0+15i, 12+15i)$.
Decryption of this combined ciphertext $(\psi''_1, \psi''_2) = (0+15i, 12+15i)$ using the private key $a=7$ yields $\mu'' = 7+22i \pmod{23}$. This precisely matches the direct multiplication of the original plaintexts: $\mu_1 \cdot \mu_2 = (5+4i) \cdot (3+2i) \pmod{23} = (15-8) + (10+12)i \pmod{23} = 7+22i \pmod{23}$. This confirms the correct operation and homomorphic property of ElGamal encryption over Gaussian integers.
\subsection{Component-wise Paillier Encryption of Gaussian Integers}
While the previously discussed ElGamal scheme was extended to operate natively over Gaussian integers, the additive homomorphic property of Paillier encryption allows for a straightforward application to complex numbers (specifically, Gaussian integers) without requiring a specialized ``complex'' version of the cryptosystem. This is achieved by encrypting the real and imaginary parts of a Gaussian integer independently.
Let a Gaussian integer plaintext message be represented as $\mu = m_R + i m_I$, where $m_R$ and $m_I$ are integers. To encrypt $\mu$ using the standard Paillier scheme with public key $\mathsf{K_{pub}}=(n, g)$, the process is as follows:
\begin{itemize}
\item Each component is encrypted separately:
\begin{align*}
c_R &= \enc_{\mathsf{K_{pub}}}(m_R, r_R) = g^{m_R} \cdot r_R^n \pmod{n^2}, \\
c_I &= \enc_{\mathsf{K_{pub}}}(m_I, r_I) = g^{m_I} \cdot r_I^n \pmod{n^2},
\end{align*}
where $r_R$ and $r_I$ are randomly chosen integers for each encryption, satisfying $0 < r_R, r_I < n$ and $\mathrm{gcd}(r_R, n) = \mathrm{gcd}(r_I, n) = 1$.
\item The ciphertext for the Gaussian integer $\mu$ is then represented as a pair of Paillier ciphertexts: $(c_R, c_I)$.
\end{itemize}
Decryption of a Gaussian integer ciphertext $(c_R, c_I)$ is performed component-wise using the Paillier private key $\mathsf{K_{priv}}=(L_P, M_P)$: $m_R = \dec_{\mathsf{K_{priv}}}(c_R)$ and $m_I = \dec_{\mathsf{K_{priv}}}(c_I)$.
The decrypted Gaussian integer is then reconstructed as $\mu = m_R + i m_I$.
The primary advantage of this component-wise approach is that it directly inherits the additive homomorphic property of the standard Paillier scheme. If we have two encrypted Gaussian integer messages, $\enc(\mu_1) = (c_{1R}, c_{1I})$ for $\mu_1 = m_{1R} + i m_{1I}$ and $\enc(\mu_2) = (c_{2R}, c_{2I})$ for $\mu_2 = m_{2R} + i m_{2I}$, their sum can be computed in the encrypted domain as follows:
\begin{itemize}
\item For the real part: $c_{\mathrm{sum},R} = c_{1R} \cdot c_{2R} \pmod{n^2}$.
\item For the imaginary part: $c_{\mathrm{sum},I} = c_{1I} \cdot c_{2I} \pmod{n^2}$.
\end{itemize}
When the resulting ciphertext $(c_{\mathrm{sum},R}, c_{\mathrm{sum},I})$ is decrypted, the real and imaginary components sum independently:
\begin{align*}
\dec_{\mathsf{K_{priv}}}(c_{\mathrm{sum},R}) &= m_{1R} + m_{2R} \pmod n, \\
\dec_{\mathsf{K_{priv}}}(c_{\mathrm{sum},I}) &= m_{1I} + m_{2I} \pmod n.
\end{align*}
Thus, the decryption yields the sum of the original Gaussian integers: $\mu_1 + \mu_2 = (m_{1R} + m_{2R}) + i(m_{1I} + m_{2I}) \pmod n$.
This component-wise additive homomorphism is useful for applications such as privacy-preserving aggregation of complex-valued data, where sums of watermarked sensor readings can be computed without revealing individual values. The security of this approach remains equivalent to that of the underlying regular Paillier encryption scheme.
\section{Protocols for Joint Watermarking and Encryption on the Complex Domain}
\label{sec:protocols}
This section presents the Hiding in the Imaginary Domain with Data Encryption (\hidden) framework, a novel approach designed to simultaneously embed information (watermarks) into data and encrypt it. Within this general framework, we detail two distinct protocols tailored for different application scenarios and taking advantage of different homomorphic properties.
The first protocol, termed the \textbf{\hidden-EG} protocol, uses Gaussian ElGamal encryption to provide joint watermarking and encryption for individual data points. The second one, denoted as the \textbf{\hidden-AggP} protocol, uses Paillier encryption's additive homomorphism to enable joint watermarking, encryption, and privacy-preserving aggregation of data from multiple sources. Each protocol is presented with its initialization and data exchange phases, and also their respective complexities.
%\subsection{Joint Reversible Data Hiding and Encrypted Data Exchange}
\subsection{\hidden-EG: Joint Watermarking and Encryption for Individual Data}
\label{sec:elgamal_protocol_description}
This section describes a protocol for secure and reversible information hiding between a sensor (S) and a data collector (DC). It applies the proposed complex domain framework and Gaussian ElGamal encryption to ensure sensor data ($d_k$) is transmitted confidentially while simultaneously embedding a time-dependent watermark ($w_k$) for verification and integrity.
The protocol proceeds in two distinct phases: Initialization and watermarking and data exchange.
The initialization phase establishes the necessary cryptographic keys and shared secrets between the DC and S:
\begin{enumerate}
\item Public Key Distribution: DC generates a Gaussian ElGamal key pair. It computes and publicly distributes its public key $\mathbf{K}=(p, \gamma, \mathcal{K})$.,% where $p$ is a sufficiently large and secure Gaussian prime (\textit{e.g.,} a regular prime integer of the form $4n-1$), $\gamma$ is a generator of ${\mathbb{Z}[i]}^*_p$, and $\mathcal{K} = \gamma^a \pmod{p}$ for DC's randomly chosen private key $a$.
\item Watermark Agreement: DC and S agree on a set of shared watermarking keys or a mechanism to generate sequential, time-dependent watermarks: $w_1, w_2, \ldots, w_M$ corresponding to times $t_1, t_2, \ldots, t_M$. Each $w_j$ is a non-negative integer represented with $B$ bits, taking values in the range $0, \ldots, 2^B-1$.
\end{enumerate}
Then, for the watermarking and data exchange phase, at each designated time $t_k$, sensor data is generated, watermarked, encrypted, and transmitted for verification.
\begin{enumerate}
\item DC's Challenge Factor: DC chooses a Gaussian integer factor $\lambda_k$ with $\Re(\lambda_k)\cdot\Im(\lambda_k)\neq 0$ (from ${\mathbb{Z}[i]}^*_p$). DC then encrypts $\lambda_k$ using its own public key $\mathbf{K}$, yielding the ciphertext $(\psi_{k,1}, \psi_{k,2}) = \enc_{\mathbf K}(\lambda_k, b_{\lambda_k})$, where $b_{\lambda_k}$ is a randomly chosen ephemeral key. DC sends this ciphertext to S.
\item Sensor's Data and Watermark Embedding: S generates its data reading $d_k$ (an integer, typically representing a real-world measurement). S then assigns the pre-agreed watermark $w_k$ to the imaginary part of the data, forming a complex-valued plaintext $\delta_k = d_k + i w_k$. Next, S encrypts this combined plaintext $\delta_k$ using DC's public key $\mathbf{K}$, resulting in the ciphertext $(\psi'_{k,1}, \psi'_{k,2}) = \enc_{\mathbf K}(\delta_k, b_{\delta_k})$, where $b_{\delta_k}$ is another randomly chosen ephemeral key. Making use of the homomorphic property of Gaussian ElGamal, S component-wise multiplies the received challenge ciphertext with its own generated ciphertext:
\begin{align*}
\psi''_{k,1} &= \psi_{k,1} \cdot \psi'_{k,1} \pmod{p}, \\
\psi''_{k,2} &= \psi_{k,2} \cdot \psi'_{k,2} \pmod{p}.
\end{align*}
S then sends the resulting combined ciphertext $(\psi''_{k,1}, \psi''_{k,2})$ to DC. This step simultaneously performs both embedding and encryption, with the additional benefit of homomorphic multiplication.
\item DC's Decryption and Verification: Upon receiving the combined ciphertext $(\psi''_{k,1}, \psi''_{k,2})$, DC decrypts it using its private key $a$. Due to the homomorphic property, the decrypted value $\mu_k = \dec_a(\psi''_{k,1}, \psi''_{k,2})$ will correspond to the product of the two original plaintexts: $\mu_k = \lambda_k \cdot \delta_k \pmod{p}$. Given the careful selection of $p$ to be sufficiently large, this modular result $\mu_k$ is guaranteed to be equivalent to the exact, non-modular product $\lambda_k \cdot \delta_k$ as Gaussian integers. To isolate the watermarked data, DC then computes $\delta_k = \mu_k / \lambda_k$ using standard complex number division. Finally, DC extracts the original sensor data $d_k$ from the real part of $\delta_k$ and the embedded watermark $w_k$ from its imaginary part. The data $d_k$ is accepted only if the extracted watermark $w_k$ correctly matches the expected time-dependent watermark; otherwise, the data is discarded, indicating potential tampering or an unauthorized source.
\end{enumerate}
\subsubsection{Complexity analysis}
Regarding computational complexity, the number of complex modular exponentiations and integer modular exponentiations, required at each party during the data exchange phase, is analyzed below.
For a Gaussian integer $\chi = x+iy \in {\mathbb{Z}[i]}^*_p$, its modular inverse $\chi^{-1} \pmod{p}$ is typically computed as $\overline{\chi} \cdot (\mathrm{N}(\chi))^{-1} \pmod{p}$. This involves obtaining the modular inverse of the integer norm $\mathrm{N}(\chi) = x^2+y^2$ modulo $p$ (an integer modular exponentiation), followed by a complex multiplication.
\textbf{At the Sensor:}
In step 2 of the data exchange phase, S computes $\psi'_{k,1} = \gamma^{b_{\delta_k}} \pmod{p}$ and $\mathcal{K}^{b_{\delta_k}} \pmod{p}$ (for $\psi'_{k,2}$). Both of these are complex modular exponentiations. Therefore, the Sensor performs \textbf{2 complex modular exponentiations} per data exchange.
\textbf{At the Data Collector:}
In step 1, DC computes $\gamma^{b_{\lambda_k}} \pmod{p}$ and $\mathcal{K}^{b_{\lambda_k}} \pmod{p}$ for the challenge factor's encryption. This amounts to \textbf{2 complex modular exponentiations}.
In step 3, DC performs the decryption and subsequent isolation of $\delta_k$:
\begin{itemize}
\item Decryption: This involves computing $(\psi''_{k,1})^a \pmod{p}$, which is \textbf{1 complex modular exponentiation}.
\item Computation of $\tau_k^{-1}$: To compute the inverse of the shared secret $\tau_k = (\psi''_{k,1})^a$, it is calculated as $\overline{\tau_k} \cdot (\mathrm{N}(\tau_k))^{-1} \pmod{p}$. This involves \textbf{1 integer modular exponentiation} (for $(\mathrm{N}(\tau_k))^{-1} \pmod{p}$).
\item Computation of $\mu_k$: This is $\psi''_{k,2} \cdot \tau_k^{-1} \pmod{p}$, involving complex multiplication.
\item Computation of $\delta_k$: As $\mu_k$ is now the exact product $\lambda_k \cdot \delta_k$, DC computes $\delta_k = \mu_k / \lambda_k$ using standard complex number division.
\end{itemize}
In summary, per data exchange, the Data Collector performs a total of \textbf{3 complex modular exponentiations} (2 for encrypting $\lambda_k$ and 1 for computing $(\psi''_{k,1})^a$) and \textbf{1 integer modular exponentiation} (for the inverse of $\mathrm{N}(\tau_k)$).
\begin{remark}\label{rem:cost_factor_remark}
Regarding the relative computational cost, a complex modular exponentiation is approximately four times as expensive as an integer modular exponentiation of a similar exponent length. This is primarily because each complex modular multiplication, which forms the building block of exponentiation, involves four integer modular multiplications. \remarkend
\end{remark}
% \begin{table}[htbp]
% \centering
% \caption{Computational Complexity Summary. Values represent the number of equivalent integer modular exponentiations per data exchange round, assuming a complex modular exponentiation is approximately four times as expensive as an integer one.}
% \label{tab:complexity_summary}
% \begin{tabular}{|l|c|}
% \hline
% \textbf{Party} & \textbf{Cost (Integer Exp.)} \\
% \hline
% Sensor (S) & 8 \\
% Data Collector (DC) & 13 \\
% \hline
% \end{tabular}
% \end{table}
% The computational overhead for each party during a single data exchange round is summarized in Table~\ref{tab:complexity_summary}. As evident, the majority of the computational burden lies with the Data Collector. This is primarily due to the operations involved in encrypting the challenge factor ($\lambda_k$) sent to the Sensor, decrypting the combined ciphertext received from the Sensor, and then isolating the original watermarked data. The Sensor's computational load is comparatively lighter, consisting solely of encrypting its watermarked data. This distribution of workload aligns well with typical sensor network architectures where sensors are often resource-constrained devices, while the data collector usually possesses greater computational power.
The computational overhead for each party during a single data exchange round is analyzed in terms of equivalent integer modular exponentiations (as defined in Remark~\ref{rem:cost_factor_remark}). The Sensor performs approximately \textbf{8 equivalent integer modular exponentiations} for encrypting its watermarked data. In contrast, the Data Collector incurs a higher computational burden, totaling approximately \textbf{13 equivalent integer modular exponentiations} per round (and sensor). The majority of this computational load at the DC is primarily due to the operations involved in encrypting the challenge factor ($\lambda_k$) sent to the Sensor, decrypting the combined ciphertext received from the Sensor, and then isolating the original watermarked data. This distribution of workload, where the Sensor's load is comparatively lighter, aligns well with typical sensor network architectures where sensors are often resource-constrained devices, while the data collector usually possesses greater computational power.
% \subsection{Security Analysis}
% This section informally analyzes the security of the proposed protocol against common cyber attacks that may lead to extensive interruptions or information leakage in sensor data exchange. We denote the attacker by $\mathcal{A}$, who may attempt various active and passive attacks. Passive attacks involve analyzing transmitted data without altering it, while active attacks manipulate or inject false data into the communication.
% \textbf{Attack Model:}
% The attacker $\mathcal{A}$ is assumed to have full control over the communication channel between the Sensor (S) and the Data Collector (DC). $\mathcal{A}$ can read, modify, delete, insert, and replay messages. However, $\mathcal{A}$ does not possess the DC's private key $a$, nor does $\mathcal{A}$ know the shared, time-dependent watermarks $w_k$.
% \begin{itemize}
% \item \textbf{Eavesdropping:} $\mathcal{A}$ can eavesdrop on the transmission channel to gain information about the sensor data $d_k$ or the challenge factor $\lambda_k$.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} All sensitive information, including the DC's challenge factor $\lambda_k$ and the sensor's watermarked data $\delta_k$, is transmitted in ciphertext format using Gaussian ElGamal encryption. The security of this encryption relies on the computational infeasibility of the DLP in ${\mathbb{Z}[i]}^*_p$. Therefore, $\mathcal{A}$ cannot recover the plaintext values from the intercepted ciphertexts, effectively preventing information leakage due to eavesdropping.
% \end{itemize}
% \item \textbf{Man-in-the-Middle (MitM) Attack:} $\mathcal{A}$ can intercept messages and attempt to retrieve, discard, or modify the usage data or the challenge factor.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} The confidentiality of all transmitted data (challenge factors and watermarked sensor data) is guaranteed by the semantic security of Gaussian ElGamal encryption, preventing $\mathcal{A}$ from retrieving plaintext information. Any unauthorized tampering with the ciphertexts by $\mathcal{A}$ (without possessing the DC's private key) will, with overwhelming probability, result in a ciphertext that either fails to decrypt or decrypts to a corrupted value. Even if $\mathcal{A}$ were to somehow produce a cryptographically valid ciphertext after modification, the decrypted complex number would almost certainly not contain the correct expected time-dependent watermark $w_k$. This immediate failure in watermark verification ensures that any tampered data is detected and discarded by the Data Collector, thereby preventing successful data modification. While cryptographic protocols do not inherently prevent denial-of-service attacks (\textit{e.g.,} discarding or delaying messages), the time-dependent nature of the watermarks can help detect significant delays or omissions.
% \end{itemize}
% \item \textbf{Replay Attack:} $\mathcal{A}$ can resend, replay, or delay previously transmitted combined ciphertexts $(\psi''_{k,1}, \psi''_{k,2})$ maliciously.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} The time-dependent nature of the watermark $w_k$ is the primary defense. Each $w_k$ is specific to a time $t_k$. If $\mathcal{A}$ replays an old ciphertext from time $t_j$ at a current time $t_k$ (where $j \neq k$), the decrypted $\delta_k$ will contain $w_j$. When DC checks this extracted watermark against the \textbf{expected} $w_k$ for the current time $t_k$, it will detect a mismatch, causing the data to be discarded. Additionally, the challenge factor $\lambda_k$ (chosen by DC for each round) further complicates replay attempts, as $\mathcal{A}$ cannot predict or correctly substitute the required $\lambda_k$.
% \end{itemize}
% \item \textbf{Masquerading Attack:} An external attacker $\mathcal{A}$ can pretend to be an internal entity (\textit{e.g.,} impersonating the Sensor S) to gain unauthorized access or inject false data into the system.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} DC's public key encryption ensures that only the legitimate DC can decrypt messages encrypted with $\mathbf{K}$. $\mathcal{A}$ cannot impersonate S without knowing the correct, time-dependent watermark $w_k$. To successfully inject fabricated data $d'_k$, $\mathcal{A}$ would have to embed the correct $w_k$ (unknown to $\mathcal{A}$) into $\delta'_k = d'_k + i w_k$, and then encrypt it correctly. Without the shared watermarking mechanism, $\mathcal{A}$ cannot generate the expected $w_k$, leading to the failure of DC's watermark verification and rejection of the fabricated data.
% \end{itemize}
% \item \textbf{False Data Injection (FDI):} This involves $\mathcal{A}$ attempting to introduce malicious or fabricated data into the system (\textit{e.g.,} by compromising the sensor node).
% \begin{itemize}
% \item \textbf{Protocol's Defense:} This attack is directly and robustly mitigated by the watermark verification mechanism. The integrity and authenticity of the data fundamentally rely on the attacker $\mathcal{A}$ being unable to provide the correct, secretly agreed-upon watermark $w_k$ for the specific time $t_k$. Any injected false data $d'_k$ (or a corrupted $\delta'_k$) that does not carry the correct $w_k$ will result in the DC extracting a $w'_k$ that does not match the expected $w_k$, leading to the immediate discarding of the malicious data. Thus, the security against FDI is primarily contingent on the secrecy and unpredictability of the shared watermarking key agreement.
% \end{itemize}
% \end{itemize}
\subsection{\hidden-AggP: Joint Watermarking, Encryption, and Aggregation}
\label{sec:paillier_protocol_description}
This section describes a protocol enabling privacy-preserving data aggregation from multiple sensors ($\mathrm{S}_j$, $j=1,\dots,N$) by a Data Collector (DC), incorporating reversible information hiding and applying Paillier encryption for additive homomorphism. The protocol ensures that aggregated sensor data is obtained securely, while a time-dependent watermark allows for verification and integrity checking.
The initialization phase establishes the cryptographic keys and shared secrets required for secure communication and data aggregation.
1) \textbf{Paillier Public Key Distribution:} DC generates a Paillier key pair. It computes and publicly distributes its public key $\mathsf{K_{pub}}=(n, g)$, where $n=pq$ for large primes $p,q$, and $g$ is a generator as defined in Section \ref{sec:paillier}. DC keeps its corresponding private key $\mathsf{K_{priv}}=(L_P, M_P)$ secret.
2) \textbf{Symmetric Key Exchange (for DC to Sensor):} For each sensor $\mathrm{S}_j$ ($j=1, \ldots, N$), $\mathrm{S}_j$ generates a unique, random symmetric key $K_{\mathrm{sym},j}$ (\textit{e.g.,} an AES key). $\mathrm{S}_j$ then encrypts $K_{\mathrm{sym},j}$ using DC's public Paillier key $\mathsf{K_{pub}}$, resulting in ciphertext $c_j = \enc_{\mathsf{K_{pub}}}(K_{\mathrm{sym},j}, r_j)$, where $r_j$ is a random integer. $\mathrm{S}_j$ transmits $c_j$ to DC. Upon reception, DC decrypts $c_j$ using its private key $\mathsf{K_{priv}}$ to obtain $K_{\mathrm{sym},j}$. This process establishes a unique symmetric key $K_{\mathrm{sym},j}$ shared securely between DC and each individual sensor $\mathrm{S}_j$. These symmetric keys will subsequently be used for secure communication from DC to $\mathrm{S}_j$.
3) \textbf{Watermark Agreement:} DC and all sensors $\mathrm{S}_j$ collectively agree on a set of shared, sequential, time-dependent watermarks: $w_1, w_2, \ldots, w_M$ corresponding to times $t_1, t_2, \ldots, t_M$. Each $w_k$ (for the $k$-th round) is a non-negative integer represented with $B$ bits, taking values in the range $0, \ldots, 2^B-1$.
At each designated time $t_k$, sensor data is generated, watermarked, encrypted, and aggregated for privacy-preserving transmission and verification:
1) \textbf{DC's Challenge Factor Distribution:} DC chooses a Gaussian integer factor $\lambda_k$ with $\Re(\lambda_k)\cdot\Im(\lambda_k)\neq 0$. The real and imaginary parts of $\lambda_k$ must be chosen such that the resulting components of $\delta'_{j,k}$ can be represented within Paillier's plaintext modulus $n$. For each sensor $\mathrm{S}_j$ ($j=1, \ldots, N$), DC encrypts $\lambda_k$ using the pre-established unique symmetric key $K_{\mathrm{sym},j}$ shared with that specific sensor. Let this symmetric encryption be $E_{K_{\mathrm{sym},j}}(\lambda_k)$ (implying $\lambda_k$ is suitably serialized for symmetric encryption). DC then sends $E_{K_{\mathrm{sym},j}}(\lambda_k)$ to each $\mathrm{S}_j$. Each sensor $\mathrm{S}_j$ decrypts the received message using its $K_{\mathrm{sym},j}$ to obtain the plaintext $\lambda_k$.
2) \textbf{Sensor Data Embedding and Initial Paillier Encryption:} Each sensor $\mathrm{S}_j$ generates its data reading $d_{j,k}$ (an integer). $\mathrm{S}_j$ then combines the pre-agreed watermark $w_k$ with its data, forming a complex number $\delta_{j,k} = d_{j,k} + i w_k$. Using the received $\lambda_k$, $\mathrm{S}_j$ then computes the scaled and watermarked complex number $\delta'_{j,k} = \lambda_k \delta_{j,k}$. This $\delta'_{j,k}$ is the value that will be aggregated. $\mathrm{S}_j$ encrypts $\delta'_{j,k}$ component-wise using DC's public Paillier key $\mathsf{K_{pub}}$. Let $\delta'_{j,k} = m_{j,k,R} + i m_{j,k,I}$ (where $m_{j,k,R}$ and $m_{j,k,I}$ are integers). The ciphertext is $(c_{j,k,R}, c_{j,k,I}) = (\enc_{\mathsf{K_{pub}}}(m_{j,k,R}, r_{j,k,R}), \enc_{\mathsf{K_{pub}}}(m_{j,k,I}, r_{j,k,I}))$, where $r_{j,k,R}$ and $r_{j,k,I}$ are fresh random numbers for each encryption.
3) \textbf{Cascading Encrypted Summation (Tree Aggregation):} The individual encrypted watermarked data points are then aggregated in a cascading manner, typically following a binary tree structure involving $\lceil \log_2(N) \rceil$ steps.
\begin{itemize}
\item \textbf{Initial Layer:} Each $\mathrm{S}_j$ that is a leaf node in the aggregation tree generates its ciphertext $(c_{j,k,R}, c_{j,k,I})$ as described in step 2.
\item \textbf{Aggregation Steps:} For each internal node in the aggregation tree, a designated sensor (or an intermediate aggregator) receives two ciphertexts, say $(C_{1R}, C_{1I})$ and $(C_{2R}, C_{2I})$, from its children (or from other sensors). Taking advantage of the additive homomorphic property of Paillier encryption, this aggregator computes the sum of the encrypted real parts ($C_{\mathrm{sum},R} = C_{1R} \cdot C_{2R} \pmod{n^2}$) and the sum of the encrypted imaginary parts ($C_{\mathrm{sum},I} = C_{1I} \cdot C_{2I} \pmod{n^2}$). The resulting ciphertext $(C_{\mathrm{sum},R}, C_{\mathrm{sum},I})$ is then passed up the tree. This process continues until a single final encrypted sum is obtained.
\item \textbf{Handling $N \neq 2^X$:} If the number of sensors $N$ is not a power of 2, some ``blank'' or identity ciphertexts (\textit{e.g.,} encryption of $0+i0$) may be included in the aggregation process to complete the tree structure, or the tree may be handled as an unbalanced structure.
\end{itemize}
The final encrypted sum, $\sigma'_{\mathrm{sum},k} = (C_{\mathrm{final},R}, C_{\mathrm{final},I})$, is obtained by the root sensor in the aggregation tree (\textit{e.g.,} $\mathrm{S}_N$ if sensors are ordered by aggregation path) and is then sent to DC.
4) \textbf{DC's Decryption and Verification:} Upon receiving the final aggregated ciphertext $\sigma'_{\mathrm{sum},k} = (C_{\mathrm{final},R}, C_{\mathrm{final},I})$, DC decrypts both components using its private Paillier key $\mathsf{K_{priv}}$. This yields the real and imaginary parts of the aggregated watermarked data:
\begin{align*}
\sigma'_{k,R} &= \dec_{\mathsf{K_{priv}}}(C_{\mathrm{final},R}) = \sum_{j=1}^N m_{j,k,R} \pmod n, \\
\sigma'_{k,I} &= \dec_{\mathsf{K_{priv}}}(C_{\mathrm{final},I}) = \sum_{j=1}^N m_{j,k,I} \pmod n.
\end{align*}
The decrypted value is the aggregated watermarked data $\sigma'_k = \sigma'_{k,R} + i \sigma'_{k,I}$. As derived in Section \ref{sec:aggregation}, $\sigma'_k = \lambda_k(S_k+iNw_k)$, where $S_k = \sum_{j=1}^N d_{j,k}$. DC then isolates the true aggregated data $S_k$ and the watermark $w_k$ by computing $(S_k+iNw_k) = \sigma'_k / \lambda_k$ using standard complex number division. Finally, DC extracts $S_k$ from the real part and obtains $w_k$ by dividing the imaginary part by $N$. If the extracted watermark $w_k$ correctly matches the expected time-dependent watermark, the aggregated data $S_k$ is accepted; otherwise, it is discarded, indicating potential tampering or an unauthorized source.
\subsubsection{Complexity Analysis}
\label{sec:agg_complexity}
This section analyzes the computational and communication complexity of the proposed data aggregation protocol. We focus on the operations within a single data exchange round ($t_k$), as initialization costs are typically one-time or amortized over many rounds.
%We assume that symmetric encryption/decryption, as well as individual complex modular multiplications and standard complex divisions, are computationally negligible compared to Paillier modular exponentiations (which are the dominant operations).
For computational complexity. the dominant costs arise from Paillier encryption and decryption operations, which primarily involve modular exponentiations modulo $n^2$. Other operations, such as symmetric encryption/decryption, complex modular multiplications (including those from homomorphic ciphertext additions), and standard complex divisions, are considered computationally negligible in this high-level analysis.
\textbf{At the Sensor ($\mathrm{S}_j$):}
Each sensor $\mathrm{S}_j$ performs one initial encryption of its watermarked data $\delta'_{j,k}$. Since this involves encrypting both the real and imaginary components separately using Paillier encryption, each sensor performs \textbf{2 Paillier encryptions} per round. Each Paillier encryption typically involves two modular exponentiations (one for $g^m$ and one for $r^n$), totaling \textbf{4 modular exponentiations modulo $n^2$} per sensor for initial encryption.
If a sensor also acts as an intermediate aggregator in the tree, it performs additional Paillier ciphertext multiplications (homomorphic additions). While these are critical for the protocol's functionality, their computational cost is significantly lower than modular exponentiations and is thus neglected in this dominant cost analysis.
\textbf{At the Data Collector:}
DC's primary computational burden occurs in the final decryption and extraction step. DC receives the final aggregated ciphertext, $\sigma'_{\mathrm{sum},k}$, which consists of two Paillier ciphertexts $(C_{\mathrm{final},R}, C_{\mathrm{final},I})$.
DC performs \textbf{2 Paillier decryptions} (one for the real part and one for the imaginary part). Each Paillier decryption primarily involves one modular exponentiation modulo $n^2$. Therefore, the DC performs approximately \textbf{2 modular exponentiations modulo $n^2$} per round.
\textbf{Network-Wide Aggregation (Aggregator Nodes):}
The aggregation tree involves $N-1$ aggregation steps in total (for $N$ sensors in a binary tree). Each aggregation step involves two modular multiplications modulo $n^2$ (one for the real component sum and one for the imaginary component sum). These operations, while numerous, are computationally less intensive than modular exponentiations and are therefore not included in this dominant cost count.
The computational overhead for each party during a single data exchange round is analyzed based on the number of dominant modular exponentiations. The Sensor ($\mathrm{S}_j$) performs \textbf{4 integer modular exponentiations modulo $n^2$} for encrypting its watermarked data (two for the real part and two for the imaginary part). In contrast, the Data Collector (DC) incurs a comparatively lighter computational burden, totaling approximately \textbf{2 integer modular exponentiations modulo $n^2$} per round for decrypting the aggregated ciphertext. The network-wide aggregation process, while involving numerous modular multiplications, is not included in this dominant cost count as these operations are less intensive than exponentiations. This distribution of workload, where the Sensor bears a higher computational burden in terms of dominant Paillier exponentiations, is an important consideration for resource-constrained sensor deployments, implying the need for adequate computational capabilities at the sensor level.
On the other hand, the communication complexity is measured by the number of messages exchanged in a single data exchange round ($t_k$).
\begin{itemize}
\item \textbf{DC to Sensors ($\lambda_k$ distribution):} The DC sends the symmetrically encrypted challenge factor $E_{K_{\mathrm{sym},j}}(\lambda_k)$ to each of the $N$ sensors. This accounts for \textbf{$N$ messages} from DC to sensors.
\item \textbf{Sensor-to-Sensor and Sensor-to-DC (Aggregation):} The cascading summation process in a binary tree structure involves messages being passed up the tree. For instance, if $N$ is a power of 2, the first level of aggregation generates $N/2$ messages, the second level $N/4$, and so on, until the last level generates 1 message. This sums up to $N/2 + N/4 + \ldots + 1 = N-1$ messages for the intermediate aggregation steps. A final message is then sent from the root aggregator sensor ($\mathrm{S}_N$) to the DC. Thus, the total number of messages for the aggregation phase (from sensors to DC) is $(N-1) + 1 = N$ messages, regardless of whether $N$ is a power of 2.
\end{itemize}
Combining the DC-to-sensor and the aggregation messages, the overall number of messages exchanged in the network per round is $N + N = 2N$ messages. This indicates an efficient communication pattern, as the total message count scales linearly with the number of sensors.
% \subsection{Security Analysis}
% This section informally analyzes the security of the proposed data aggregation protocol against common cyber attacks. The attacker model remains consistent with that defined previously (see Section \ref{sec:previous_security_analysis_label} for details on attacker capabilities). Many of the fundamental security properties are preserved or enhanced compared to the single-device ElGamal-based protocol, primarily due to the robust cryptographic primitives employed and the integral time-dependent watermarking mechanism. Here, we highlight how this protocol specifically mitigates common cyber attacks, focusing on its unique features.
% \textbf{Attack Model:}
% The attacker $\mathcal{A}$ is assumed to have full control over the communication channel between the Data Collector (DC) and the sensors ($\mathrm{S}_j$) and among the sensors themselves. $\mathcal{A}$ can read, modify, delete, insert, and replay messages. However, $\mathcal{A}$ does not possess the DC's Paillier private key $\mathsf{K_{priv}}$, nor does $\mathcal{A}$ know the unique symmetric keys $K_{\mathrm{sym},j}$ shared between DC and each $\mathrm{S}_j$. Crucially, $\mathcal{A}$ does not know the shared, time-dependent watermarking keys $w_k$.
% \begin{itemize}
% \item \textbf{Eavesdropping:} $\mathcal{A}$ can eavesdrop on the transmission channel to gain information about individual sensor data $d_{j,k}$, watermarks $w_k$, or the challenge factor $\lambda_k$.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} Confidentiality is assured by the strong cryptographic primitives used. The individual watermarked data $\delta'_{j,k}$ is protected by Paillier encryption, which is semantically secure. The challenge factor $\lambda_k$ is protected by a unique symmetric key $K_{\mathrm{sym},j}$ for each sensor. Both schemes ensure $\mathcal{A}$ cannot recover plaintext values, operating on principles similar to the ElGamal-based protocol's defense but with distinct underlying cryptographic hard problems.
% \end{itemize}
% \item \textbf{Man-in-the-Middle (MitM) Attack:} $\mathcal{A}$ can intercept messages (\textit{e.g.,} encrypted $\lambda_k$, individual encrypted $\delta'_{j,k}$, or intermediate aggregated ciphertexts) and attempt to retrieve, discard, or modify them.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} Confidentiality prevents retrieval. Against modification, any unauthorized tampering with ciphertexts (Paillier or symmetrically encrypted $\lambda_k$) by $\mathcal{A}$ will, with overwhelming probability, result in a corrupted value. This leads to an immediate failure in watermark verification, preventing successful data modification. The tree aggregation structure means $\mathcal{A}$ could potentially tamper with intermediate sums, but such tampering would still be caught by the final watermark verification at the DC, as the homomorphic property only works for valid operations.
% \end{itemize}
% \item \textbf{Replay Attack:} $\mathcal{A}$ can resend, replay, or delay previously transmitted encrypted messages.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} The primary defense remains the time-dependent nature of the watermark $w_k$. Any replayed message from time $t_j$ at a current time $t_k$ will result in a $w_j$ that mismatches the expected $w_k$, leading to rejection. This mechanism is effective regardless of which underlying cryptographic scheme is used for encryption.
% \end{itemize}
% \item \textbf{Masquerading Attack:} An external attacker $\mathcal{A}$ can pretend to be an internal entity.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} $\mathcal{A}$ cannot successfully impersonate a sensor $\mathrm{S}_j$ without knowing the correct, time-dependent watermark $w_k$ (secretly agreed upon for each $t_k$). This is the primary defense, as any fabricated data without the correct $w_k$ will be rejected by DC's verification. Additionally, $\mathcal{A}$ cannot correctly decrypt the symmetrically encrypted $\lambda_k$ from DC without knowing $K_{\mathrm{sym},j}$, which prevents it from correctly participating in the protocol's data transformation and aggregation. The Paillier public key does not provide origin authentication for individual sensor messages, but the watermark provides authentication for the data content itself.
% \end{itemize}
% \item \textbf{False Data Injection (FDI):} This involves $\mathcal{A}$ attempting to introduce malicious or fabricated data into the system.
% \begin{itemize}
% \item \textbf{Protocol's Defense:} This attack is robustly mitigated by the watermark verification mechanism. The integrity and authenticity of the aggregated data fundamentally rely on $\mathcal{A}$ being unable to provide the correct, secretly agreed-upon watermark $w_k$ for the specific time $t_k$. Any injected false data (whether at the individual sensor level or by manipulating intermediate aggregated ciphertexts in the tree) that does not correspond to the correct $w_k$ will result in the DC extracting an incorrect watermark, leading to the immediate discarding of the malicious data.
% \end{itemize}
% \end{itemize}
\section{Security Analysis}
\label{sec:security}
This section provides a security analysis for both proposed protocols. The \hidden-EG protocol, described in Section \ref{sec:elgamal_protocol_description}, and the \hidden-AggP protocol, detailed in Section \ref{sec:paillier_protocol_description}), are informally analyzed against common attacks.
\textbf{Attack Model:}
The attacker, denoted by $\mathcal{A}$, is assumed to have full control over the communication channel between the Data Collector (DC) and the sensors ($\mathrm{S}_j$) and among the sensors themselves. $\mathcal{A}$ can read, modify, delete, insert, and replay messages. However, $\mathcal{A}$ does not possess any private keys (DC's ElGamal private key $a$, DC's Paillier private key $\mathsf{K_{priv}}$), nor does $\mathcal{A}$ know the unique symmetric keys $K_{\mathrm{sym},j}$ shared between DC and each $\mathrm{S}_j$. Furthermore, $\mathcal{A}$ does not know the shared, time-dependent watermarking keys $w_k$.
%\textbf{Common Defenses Across Protocols:}
Both protocols inherently share several key security properties:
\textbf{Eavesdropping:} Confidentiality of transmitted sensitive information (sensor data $d_{j,k}$, watermarks $w_k$, challenge factors $\lambda_k$) is assured by the use of strong cryptographic primitives. All data is transmitted in ciphertext form. The security relies on the respective underlying hard problems (DLP for ElGamal, Composite Residuosity for Paillier) and the strength of symmetric encryption. $\mathcal{A}$ cannot recover plaintext values from intercepted ciphertexts.
\textbf{Replay Attack:} The primary defense against replay attacks in both protocols is the time-dependent nature of the watermark $w_k$. Since each $w_k$ is unique to a specific time $t_k$, any replayed message from time $t_j$ at a current time $t_k$ (where $j \neq k$) will result in the decryption yielding $w_j$. When the DC checks this extracted watermark against the \textit{expected} $w_k$ for the current time $t_k$, it will detect a mismatch, causing the data to be discarded. This mechanism is effective regardless of the specific public-key encryption scheme used.
\textbf{False Data Injection (FDI):} Both protocols mitigate FDI through the watermark verification mechanism. The integrity and authenticity of the data (whether individual or aggregated) fundamentally rely on $\mathcal{A}$ being unable to provide the correct, secretly agreed-upon watermark $w_k$ for the specific time $t_k$. Any injected false data that does not correspond to the correct $w_k$ will result in DC extracting an incorrect watermark, leading to the immediate discarding of the malicious data. Thus, the security against FDI is primarily based on the secrecy and unpredictability of the shared watermark agreement.
%\textbf{Protocol-Specific Security Considerations:}
While the above defenses are common, each protocol presents specific cryptographic mechanisms and architectural implications that affect its security against certain attacks:
%\begin{itemize}
\textbf{Man-in-the-Middle (MitM) Attack}: For both protocols, confidentiality prevents retrieval. Against modification, any unauthorized tampering with ciphertexts by $\mathcal{A}$ (without possessing the necessary private/symmetric keys) will, with overwhelming probability, result in a corrupted value. This leads to an immediate failure in watermark verification. In addition, for each particular protocol:
\begin{itemize}
\item \hidden-EG: $\mathcal{A}$'s ability to tamper with a single ElGamal ciphertext is directly thwarted by the semantic security of the scheme and the ultimate watermark verification.
\item \hidden-AggP: The tree aggregation structure introduces intermediate aggregated ciphertexts. $\mathcal{A}$ could potentially tamper with these. However, any such tampering, even if it does not immediately corrupt the ciphertext's validity, will ultimately be detected by the final watermark verification at the DC, as the homomorphic property only works for valid operations on valid plaintexts. Discarding or delaying messages remains a denial-of-service issue not directly prevented by encryption, though time-dependent watermarks can aid detection.
\end{itemize}
\textbf{Masquerading Attack:} $\mathcal{A}$ cannot successfully impersonate a sensor $\mathrm{S}_j$ without knowing the correct, time-dependent watermark $w_k$. This is the primary defense. Then, for each protocol:
\begin{itemize}
\item \hidden-EG: DC's public key encryption ensures that only the legitimate DC can decrypt messages. Impersonation by $\mathcal{A}$ requires forging a message that encrypts to the correct watermarked data.
\item \hidden-AggP: $\mathcal{A}$ also cannot correctly decrypt the symmetrically encrypted $\lambda_k$ received from DC without knowing $K_{\mathrm{sym},j}$, which prevents it from correctly participating in the data transformation required for valid messages. The Paillier public key does not provide origin authentication for individual sensor messages, but the watermark provides authentication for the data content itself.
\end{itemize}
\textbf{Role of $\lambda_k$ (Challenge Factor):} In both protocols, the confidentiality of $\lambda_k$ (from $\mathcal{A}$) prevents $\mathcal{A}$ from directly influencing or predicting the exact multiplicative factor used in the plaintext domain (in \hidden-AggP) or encrypted domain (in \hidden-EG), which, combined with the watermark, makes forgery harder. Its varying nature each round also contributes to freshness.
% Now, more specifically:
% \begin{itemize}
% \item \hidden-EG Protocol: $\lambda_k$ is chosen by DC and encrypted using DC's public ElGamal key (known to S, but not invertible by $\mathcal{A}$). S multiplies its $\delta_k$ by this encrypted $\lambda_k$. The unencrypted $\lambda_k$ is known to DC.
% \item \hidden-AggP Protocol: $\lambda_k$ is chosen by DC and distributed to each sensor using unique symmetric keys $K_{\mathrm{sym},j}$. Sensors use the plaintext $\lambda_k$ to scale their data $\delta_{j,k}$ \textit{before} Paillier encryption. The unencrypted $\lambda_k$ is also known to DC.
% \end{itemize}
%\end{itemize}
\section{Conclusion}
\label{sec:cocnlusion}
This paper introduces Hiding in the Imaginary Domain with Data Encryption (\hidden), a novel framework for RDH that operates uniquely within the complex domain. By intrinsically mixing data and watermark through complex number arithmetic, the \hidden approach offers perfect reversibility and allows for embedding a watermark of in principle unlimited size, directly addressing key limitations of existing RDH techniques for individual and dispersed data. Two distinct protocols embodying this framework are proposed: the \hidden-EG protocol, providing joint RDH and encryption for individual data points by extending ElGamal encryption to Gaussian integers, and the \hidden-AggP protocol, which enables privacy-preserving data aggregation by taking advantage of a novel component-wise application of Paillier encryption to complex-valued data.
The proposed \hidden framework and its instantiations offer novel solutions for ensuring data integrity and authenticity in scenarios involving sensitive, distributed, and potentially resource-constrained environments like Wireless Sensor Networks and IoT ecosystems. By integrating advanced cryptographic primitives with innovative complex-domain embedding, the proposed methods provide strong security guarantees beyond simple data hiding, including confidentiality and privacy-preserving aggregation. This work demonstrates a significant step towards building more trustworthy data pipelines from diverse sources, where the provenance and integrity of information are strong requirements.
As directions for future work, one key area involves exploring the inclusion of other homomorphic encryption schemes, such as BGN or FHE schemes, to operate efficiently within the complex domain or over Gaussian integers. Such extensions could unlock new homomorphic capabilities (\textit{e.g.,} multiple multiplications on ciphertexts) or improved efficiency for complex-valued computations. In addition, this could provide post-quantum security, an aspect that is not covered by ElGamal or Paillier.
%Another possible direction is to investigate the application of the \hidden approach to multimedia domains. This would involve adapting integer-based media formats (such as pixel values or audio samples) to the complex domain, where the \hidden scheme could embed watermarks. The resulting complex numbers could then be efficiently mapped back to standard integers for storage or transmission using bijective functions like Cantor's pairing. This approach holds promise for offering novel embedding strategies for traditional image, audio, or video watermarking challenges, taking advantage of the inherent mixing properties and high capacity of the \hidden scheme in these contexts.
Another future research direction is the potential application of the \hidden approach to multimedia domains. By adapting integer-based media formats to the complex domain for embedding, this method could offer a novel approach to traditional image, audio, or video watermarking challenges, taking advantage of the inherent mixing properties and high capacity of the \hidden scheme.
%\bibliographystyle{IEEEtranS}
%\bibliography{ref}
% \begin{IEEEbiographynophoto}{Jane Doe}
% Biography text here without a photo.
% \end{IEEEbiographynophoto}
% \begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{fig1.png}}]{IEEE Publications Technology Team}
% In this paragraph you can place your educational, professional background and research and other interests.\end{IEEEbiography}
% Generated by IEEEtranS.bst, version: 1.14 (2015/08/26)
\begin{thebibliography}{10}
\providecommand{\url}[1]{#1}
\csname url@samestyle\endcsname
\providecommand{\newblock}{\relax}
\providecommand{\bibinfo}[2]{#2}
\providecommand{\BIBentrySTDinterwordspacing}{\spaceskip=0pt\relax}
\providecommand{\BIBentryALTinterwordstretchfactor}{4}
\providecommand{\BIBentryALTinterwordspacing}{\spaceskip=\fontdimen2\font plus
\BIBentryALTinterwordstretchfactor\fontdimen3\font minus \fontdimen4\font\relax}
\providecommand{\BIBforeignlanguage}[2]{{%
\expandafter\ifx\csname l@#1\endcsname\relax
\typeout{** WARNING: IEEEtranS.bst: No hyphenation pattern has been}%
\typeout{** loaded for the language `#1'. Using the pattern for}%
\typeout{** the default language instead.}%
\else
\language=\csname l@#1\endcsname
\fi
#2}}
\providecommand{\BIBdecl}{\relax}
\BIBdecl
\bibitem{acar2018survey}
A.~Acar, H.~Aksu, A.~S. Uluagac, and M.~Conti, ``A survey on homomorphic encryption schemes: Theory and implementation,'' \emph{ACM Computing Surveys (Csur)}, vol.~51, no.~4, pp. 1--35, 2018.
\bibitem{bahlearao:2019}
S.~Bhalerao, I.~A. Ansari, A.~Kumar, and D.~K. Jain, ``A reversible and multipurpose {ECG} data hiding technique for telemedicine applications,'' \emph{Pattern Recognition Letters}, vol. 125, pp. 463--473, 2019.
\bibitem{boneh2005evaluating}
D.~Boneh, E.-J. Goh, and K.~Nissim, ``Evaluating {2-DNF} formulas on ciphertexts,'' in \emph{Theory of cryptography conference}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2005, pp. 325--341.
\bibitem{brakerski2011fully}
Z.~Brakerski and V.~Vaikuntanathan, ``Fully homomorphic encryption from {ring-LWE} and security for key dependent messages,'' in \emph{Annual cryptology conference}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2011, pp. 505--524.
\bibitem{celik:2002}
M.~U. Celik, G.~Sharma, A.~M. Tekalp, and E.~Saber, ``Reversible data hiding,'' in \emph{Proceedings. International conference on image processing}, vol.~2.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2002, pp. {II--157}--{II--160}.
\bibitem{cominetti2020fast}
E.~L. Cominetti and M.~A. Simplicio, ``Fast additive partially homomorphic encryption from the approximate common divisor problem,'' \emph{IEEE Transactions on Information Forensics and Security}, vol.~15, pp. 2988--2998, 2020.
\bibitem{conrad2016gaussian}
K.~Conrad, ``The gaussian integers,'' 2016, available at: \url{https://kconrad.math.uconn.edu/blurbs/ugradnumthy/Zinotes.pdf}. Accessed on \today.
\bibitem{elgamal1985public}
T.~ElGamal, ``A public key cryptosystem and a signature scheme based on discrete logarithms,'' \emph{IEEE Transactions on Information Theory}, vol.~31, no.~4, pp. 469--472, 1985.
\bibitem{gao2020physical}
Y.~Gao, S.~F. Al-Sarawi, and D.~Abbott, ``Physical unclonable functions,'' \emph{Nature Electronics}, vol.~3, no.~2, pp. 81--91, 2020.
\bibitem{iezzi2020practical}
M.~Iezzi, ``Practical privacy-preserving data science with homomorphic encryption: an overview,'' in \emph{2020 IEEE international conference on big data (big data)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2020, pp. 3979--3988.
\bibitem{kabir2025rewap}
F.~Kabir, K.~Cabaj, T.~Koohpayeh~Araghi, and D.~Meg{\'\i}as, ``{ReWaP:} {Reversible} watermarking and {Paillier} encryption approach for privacy-preserving smart meter,'' in \emph{International Conference on Availability, Reliability and Security}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2025, pp. 346--363.
\bibitem{kabir2024privacy}
F.~Kabir, T.~Koohpayeh~Araghi, and D.~Meg{\'\i}as, ``Privacy-preserving protocol for high-frequency smart meters using reversible watermarking and {P}aillier encryption,'' \emph{Computers and Electrical Engineering}, vol. 119, 2024, {A}rt. no. 109497.
\bibitem{kumar2022reversible}
S.~Kumar, A.~Gupta, and G.~S. Walia, ``Reversible data hiding: A contemporary survey of state-of-the-art, opportunities and challenges,'' \emph{Applied Intelligence}, pp. 1--34, 2022.
\bibitem{liang2016review}
G.~Liang, J.~Zhao, F.~Luo, S.~R. Weller, and Z.~Y. Dong, ``A review of false data injection attacks against modern power systems,'' \emph{IEEE Transactions on Smart Grid}, vol.~8, no.~4, pp. 1630--1638, 2016.
\bibitem{ni:2006}
Z.~Ni, Y.-Q. Shi, N.~Ansari, and W.~Su, ``Reversible data hiding,'' \emph{IEEE Transactions on Circuits and Systems for Video Technology}, vol.~16, no.~3, pp. 354--362, 2006.
\bibitem{ou:2013}
B.~Ou, X.~Li, Y.~Zhao, R.~Ni, and Y.-Q. Shi, ``Pairwise prediction-error expansion for efficient reversible data hiding,'' \emph{IEEE Transactions on image processing}, vol.~22, no.~12, pp. 5010--5021, 2013.
\bibitem{paillier1999public}
P.~Paillier, ``Public-key cryptosystems based on composite degree residuosity classes,'' in \emph{Advances in Cryptology --- EUROCRYPT '99}, J.~Stern, Ed.\hskip 1em plus 0.5em minus 0.4em\relax Berlin, Heidelberg: Springer, 1999, pp. 223--238.
\bibitem{pohlig:1978}
S.~Pohlig and M.~Hellman, ``An improved algorithm for computing logarithms over {$GF(p)$} and its cryptographic significance (corresp.),'' \emph{IEEE Transactions on Information Theory}, vol.~24, no.~1, pp. 106--110, 1978.
\bibitem{rahman:2021}
M.~S. Rahman, I.~Khalil, X.~Yi, M.~Atiquzzaman, and E.~Bertino, ``A lossless data-hiding based iot data authenticity model in edge-ai for connected living,'' \emph{ACM Trans. Internet Technol.}, vol.~22, no.~3, Dec. 2021, {A}rt. No. 25.
\bibitem{shi:2013}
X.~Shi and D.~Xiao, ``A reversible watermarking authentication scheme for wireless sensor networks,'' \emph{Information Sciences}, vol. 240, pp. 173--183, 2013.
\bibitem{shi:2016}
Y.-Q. Shi, X.~Li, X.~Zhang, H.-T. Wu, and B.~Ma, ``Reversible data hiding: Advances in the past two decades,'' \emph{IEEE Access}, vol.~4, pp. 3210--3237, 2016.
\bibitem{tian:2003}
J.~Tian, ``Reversible data embedding using a difference expansion,'' \emph{IEEE Transactions on Circuits and Systems for Video Technology}, vol.~13, no.~8, pp. 890--896, 2003.
\bibitem{yan2014survey}
Z.~Yan, P.~Zhang, and A.~V. Vasilakos, ``A survey on trust management for {Internet} of {Things},'' \emph{Journal of network and computer applications}, vol.~42, pp. 120--134, 2014.
\bibitem{zhang2020lvpda}
J.~Zhang, Y.~Zhao, J.~Wu, and B.~Chen, ``Lvpda: A lightweight and verifiable privacy-preserving data aggregation scheme for edge-enabled iot,'' \emph{IEEE Internet of Things Journal}, vol.~7, no.~5, pp. 4016--4027, 2020.
\end{thebibliography}
\appendices
\section{Generalized Vector-based Approach for RDH} \label{sec:generalized}
As discussed in Remark \ref{rem:vector}, a similar RDH scheme could be obtained using vectors and matrices instead of complex numbers. In this case, the complex number would be a particular example of the vector case (but with some advantages as already discussed).
In the generalized case, the watermarked data $d'_{j,k}$ can be defined in vector form, as follows:
\[\resizebox{\columnwidth}{!}{$
d'_{j,k}=
\left[\begin{array}{cc}
m_{11,k} & m_{12,k} \\
m_{21,k} & m_{22,k}
\end{array}\right]
\left[\begin{array}{c}
d_{j,k} \\
w_k
\end{array}\right]= \left[\begin{array}{c}
m_{11,k}d_{j,k} + m_{12,k} w_k \\
m_{21,k}d_{j,k} + m_{22,k} w_k
\end{array}\right],$}
\]
where a $2\times2$ matrix makes the appropriate transformation.
For reversibility, it is enough that the matrix be invertible, \textit{i.e.}, that its determinant is different from zero: $m_{11,k}m_{22,k}-m_{12,k}m_{21,k} \neq 0$. If this condition is satisfied, the original data and the watermark can be extracted from $d'_{j.k}$ as follows:
\[
\left[\begin{array}{c}
d_{j,k} \\
w_k
\end{array}\right]=\left[\begin{array}{cc}
m_{11,k} & m_{12,k} \\
m_{21,k} & m_{22,k}
\end{array}\right]^{-1}d'_{j,k}.
\]
Since this is a linear transformation, it would also work for aggregated data, similarly as in the complex numbers case.
The property of ``distributing'' the watermark and the data in the two components of the resulting vector ($d'_{j,k}$) will be satisfied as far as none of the elements of the matrix is zero. Again, if all the values $m_{11,k}, \dots, m_{22,k}$ are integers, the obtained vector will also have integer components ($d'_{j,k}\in\mathbb{Z}^2$), which may be convenient for different applications, especially those that require public-key encryption.
\begin{remark}
This vector form of the reversible watermarking system, however, requires four parameters ($m_{11,k}, \dots, m_{22,k}$) instead of two: the real ($a_k$) and imaginary ($b_k$) parts of a Gaussiann integer $\lambda_k$. While using four parameters offers no clear advantage over the two-parameter (complex number) case, it does require a larger secret watermarking key at both the embedding and extraction ends. This increased key size, without any compensating benefits, can be considered a disadvantage of the generalized approach, leading to the preference for the complex number-based formulation in this paper. The only advantage of such a scheme would rely on the longer apparent key size, but this can be easily replicated with two values instead of four just by selecting a larger range for each of them. \remarkend
\end{remark}
Obviously, the method could be further extended by introducing larger vectors and matrices. However, no clear advantages would be obtained with that additional complexity.
\section{Modular Arithmetic over Gaussian Integers}
\label{sec:modular}
% The extension of ElGamal encryption to Gaussian Integers requires a careful examination of the mathematical basis of the cryptosystem.
% The first building block of the standard ElGamal cryptosystem is the multiplicative cyclic group $\mathbb Z^*_p$, for a prime number $p$, and a generator $g$ for such a group. In the Gaussian integer case, we must have a prime number $\pi$ in $\mathbb Z[i]$ and a consistent definition of the modular arithmetic $\pmod{\pi}$.
It is worth pointing out that Gaussian prime numbers have some differences compared to the regular integer case. The obvious one is that Gaussian primes can have both real and imaginary parts. The second main difference is that not all integer primes are also Gaussian primes. For example, prime factorizations exists for both 2 and 5 in $\mathbb Z[i]$: $2=(1+i)(1-i)$ and $5=(2+i)(2-i)$. The integer primes $p$ that are also Gaussian primes satisfy the following condition $p\equiv 3 \pmod{4}$ as proven, for example, in \cite{conrad2016gaussian}.
\begin{figure}[ht]
\centering{
\includegraphics[width=.6\columnwidth]{mod7.eps}}
\caption{Representatives of Gaussian integers $\pmod{7}$, or $\mathbb Z[i]_7$.}
\label{fig:mod7}
\end{figure}
Regarding modular arithmetic, we need to extend the definition of integer division to the complex domain. For general Gaussian integers $
\alpha,\beta\in \mathbb Z[i]$, the Gaussian integer division is defined as $\alpha=\kappa \beta+\rho$, for some residual $\rho$ with $\mathrm{N}(\rho)<\mathrm{N}(\beta)$, where $\mathrm{N}(\cdot)$ stands for the norm of a complex number, which is defined as follows:
\[
\mathrm{N}(a+ib)=\abs{a+ib}^2=a^2+b^2.
\]
This definition preserves the intuition of integer division for Gaussian integers since, for each number $\alpha$ and each divider $\beta$ in Gaussian integers, a quotient $\kappa$ and a remainder $\rho$ can be found such that $\alpha=\kappa \beta+\rho$, and $\rho$ is, in some sense, smaller than the divider $\beta$. Here, the norm of complex number is the criterion for determining whether a complex number is smaller than another.
With this definition of the integer division, we can apply the same rules of modular arithmetic as for standard integers, \textit{i.e.}, for $\alpha,\beta,\kappa,\rho\in \mathbb Z[i]$, if $\alpha=\kappa\beta+\rho$, we have $\alpha \equiv \rho \pmod{\beta}$, since $\beta | (\alpha-\rho)$.
It is well known that, in regular integers, for a prime number $p\in\mathbb Z$, the elements of the cyclic group $\mathbb Z_p$ (or $\mathbb Z/p\mathbb Z$) are $0,1,\dots,p-1$, while the multiplicative cyclic group $\mathbb Z^*_p$ has the same elements, excluding 0. The order of the corresponding cyclic groups $\mathbb{Z}[i]_{\pi}$ and ${\mathbb{Z}[i]}^*_{\pi}$ is not so straightforward when $\pi$ is a Gaussian prime. For Gaussian integers, given a prime number $\pi\in\mathbb Z[i]$, the norm $\mathrm N(\pi)$ determines the order of the additive cyclic group $\mathbb{Z}[i]_{\pi}$, whereas $\mathrm N(\pi)-1$ is the order of the multiplicative cyclic group ${\mathbb{Z}[i]}^*_{\pi}$ (because of the exclusion of 0). Proofs for these facts can also be found in \cite{conrad2016gaussian}.
As a practical example, the selection of representatives for the cyclic group ${\mathbb{Z}[i]}^*_{\pi}$ for $\pi=7$, which is both an integer and a Gaussian prime, is discussed below. First, we need to take into account that many possible selections of representatives exists, similar to the integer case. For example, 13 and 6 refer to the same equivalence class in both ${\mathbb Z}^{*}_7$ and ${\mathbb Z[i]}^*_7$, since 13 and 6 differ in a multiple of 7 (in fact, exactly 7). The only relevant consideration for the selection is not to include more than one representative for the same class. A method for such a selection is described in \cite{conrad2016gaussian} both when the divider has real and imaginary parts different from zero, and when the imaginary part is zero (the case of the Gaussian prime $\pi=7$).
The procedure is illustrated in Fig. \ref{fig:mod7}: We take $7$ (the divider) and $7i$ (by multiplying by $i$) and draw a square which has 7 and $7i$ as the left and lower edges (shown in green color in the picture). The square is completed with the purple edges that connect 7 and $7i$ with the vertex $7+7i$. The representatives of $\mathbb Z[i]_7$ are the Gaussian integers that lie within the square and the ones which are on the green edges, but excluding the ones on the purple edges, since they represent the same equivalence class as the elements on the green ones.
\begin{figure}[ht]
\centering{
\includegraphics[width=.6\columnwidth]{mod7can.eps}}
\caption{``Canonical'' epresentatives of Gaussian integers $\pmod{7}$, or $\mathbb Z[i]_7$.}
\label{fig:mod7can}
\end{figure}
%Although it is not a Gaussian prime, the modular arithmetic works analogously to the standard integers and, for this illustration, $p$ does not need to be a a prime. The set of Gaussian integers whose norm is smaller than $\mathrm{N}(5)=5^2=25$ is shown in Fig. \ref{fig:mod5a}. A circle of radius 5 encloses all Gaussian integers with norm less than 25, resulting in 69 different numbers. However, not all those numbers are different $\pmod{5}$. For example, $-1+i \pmod{5}$ is equivalent to $-1+i+5 \pmod{5}=4+i$. Hence, at least two members of the equivalence class of $4+i\pmod{5}$ are shown in the figure, using a black square for $-1+i$ and a red circle for $4+i$. If we add 5 to all the numbers shown with a black square in Fig. \ref{fig:mod5a}, the number of elements reduces to 45 as shown in Fig. \ref{fig:mod5b}.
% \begin{remark}
% There are some numbers whose norm is greater than or equal to 25 in Fig. \ref{fig:mod5b}, shown with a black square. For example, $4+4i$ has norm equal to 32. However, this value is equivalent to $-1+4i \pmod{5}$, whose norm is actually lower than 25. To compute the order of ${\mathbb{Z}[i]}_5$ we just need to make sure that none of the elements we consider are equivalent $\pmod{5}$, even if we choose a representative of a class with a norm greater than 25. \remarkend
% \end{remark}
%However, in Fig.\ref{fig:mod5b} there are still some values hat are ``repeated'' $\pmod{5}$. For example, $1-i$ is equivalent to $1-i+5i \pmod{5}=1+4i$. The elements with a negative imaginary part, shown with a diamond symbol in Fig.\ref{fig:mod5c}, can be mapped to values with a positive imaginary part (shown with a red circle or a black square) by adding $5i$, which is a multiple of 5. Hence, the number of elements is further reduced from 45 to 25 once all the equivalent values are removed, as shown in Fig.\ref{fig:mod5d}.
%Although three values of Fig.\ref{fig:mod5d} have norm greater than or equal to 25 ($3+4i$, $4+3i$, and $4+4i$), all of them coudl be replaced by equivalent values with norm lower than 25 (for example, $3-i$, $4-2i$, and $4-i$, respectively). However, the form given in Fig.\ref{fig:mod5d} is particularly convenient, since
With this particular selection, the set of values of the cyclic multiplicative group ${\mathbb{Z}[i]}^*_7$ can be easily represented as
\[ {\mathbb{Z}[i]}^*_7=\left\{ x + iy \mid x, y \in \{0, 1, \dots, 6\right\} \text{ and } (x,y) \neq (0,0) \}, \]
with no equivalent elements. This leads to the following observations:
\begin{itemize}
\item The order of the additive cyclic group ${\mathbb Z[i]}_p$, for $p\in\mathbb Z$ (i.e., $p$ is a regular integer) is $p^2$.
\item If $p\in \mathbb Z$ is both a regular prime and a Gaussian prime, i.e., when $p\equiv 3\pmod{4}$, then ${\mathbb Z[i]}^*_p$ is a multiplicative cyclic group of order $p^2-1$.
\end{itemize}
This set of representatives is particularly convenient to carry out modular arithmetic operations, since $(a+ib) \pmod{7}$ is simply $a \pmod{7}+ib\pmod{7}$. This means that we can just apply the modular operator to the real and the imaginary parts separately, which is easy to handle with most of the existing programming languages.
This selection of representatives is not ``canonical'', in the sense that it includes some elements whose norms are greater than $\mathrm{N}(7)=7^2=49$. For example $\mathrm{N}(5+5i)=5^2+5^2=50$.
A more ``canonical'' set of representatives for ${\mathbb{Z}[i]}^*_7$ would be the following (Fig. \ref{fig:mod7can}):
\[ {\mathbb{Z}[i]}^*_7=\left\{ x + iy \mid x, y \in \{-3, -2, \dots, 3\} \text{ and } (x,y) \neq (0,0) \right\}, \]
which is obtained by shifting the values of Fig. \ref{fig:mod7} by $-3$ units in each axis. This new selection of representatives is intuitively closer to that usually made for the cyclic groups defined using standard integers, but the one shown in Fig. \ref{fig:mod7} is more convenient for computational operations. In any case, both are completely equivalent. For example, $5+5i \equiv -2-2i \pmod{7}$, where the former is one of the points represented in Fig. \ref{fig:mod7} and latter only appears in Fig. \ref{fig:mod7can}. Note that the norm of $-2-2i$ is $2^2+2^2=8$, which, of course, is lower than $N(7)=49$. Hence, although $5+5i$ has a norm greater than $\mathrm{N}(7)$, an equivalent value can easily be found with a norm below that of the modulus. The norms of all values represented in Fig. \ref{fig:mod7can} are lower than 49.
\section{Numerical Example for Watermark Embedding, Extraction and Data Recovery}
This section presents an example of how the method would work with simple data. In this example, three devices produce the following data: $d_{1,1}=5$, $d_{2,1}=8$, and $d_{3,1}=17$ at time $t_1$. All of them must embed the watermark $w_1=4$, and the secret embedding key is $\lambda_1=3+2i$. With this setting, the inverse $\lambda_1^{-1}$ can be obtained as follows:
\[
\lambda_1^{-1}=\frac{3-2i}{3^2+2^2}=\frac{3}{13}-\frac{2}{13}i.
\]
The corresponding embedded data are the following:
\[
\begin{split}
\delta'_{1,1}&=(3+2i)(5+4i)=7+22i,\\
\delta'_{2,1}&=(3+2i)(8+4i)=16+28i,\\
\delta'_{3,1}&=(3+2i)(17+4i)=43+46i.
\end{split}
\]
\begin{remark}
As discussed in Remark \ref{rem:factor}, a simple Gaussian integer factorization of eavesdropped data could reveal much information. For example, a factorization calculator for $7+22i$ yields $7+22i=(3+2i)(5+4i)$, which leaks $\lambda_k=3+2i$, in one factor, and the original data and watermark, in the other factor. While an individual eavesdropped data would not be enough to identify $\lambda_k$ and $d_{j,k}+iw_k$ from the computed factors, it is obvious that a small number of leaked data would suffice for an attacker. Additional security measures are required for the transmission of watermarked data. In addition, it is recommended to modify $\lambda_k$ frequently (\textit{e.g.}, at each time sample). \remarkend
\end{remark}
\begin{remark}
As in the regular integer case (without complex numbers), the use of large prime factors for $\lambda_k$ would make the factorization problem harder for an attacker and, consequently, would increase security. \remarkend
\end{remark}
At the receiver end, the following computation would be performed:
\[
\begin{split}
\lambda_1^{-1}\delta'_{1,1}&=\left(\frac{3}{13}-\frac{2}{13}i\right)(7+22i)=5+4i,\\
\lambda_1^{-1}\delta'_{2,1}&=\left(\frac{3}{13}-\frac{2}{13}i\right)(16+28i)=8+4i,\\
\lambda_1^{-1}\delta'_{3,1}&=\left(\frac{3}{13}-\frac{2}{13}i\right)(43+46i)=17+4i.
\end{split}
\]
Thus, taking the real and the imaginary parts after the multiplication recovers both the original data and the watermark, respectively.
Reversible extraction is also possible from aggregated data. The aggregated data for these three devices at time $t_1$ can be computed as:
\[
S_1=\sum_{j=1}^3d_{j,1}=d_{1,1}+d_{1,2}+d_{1,3}=5+8+17 =30.
\]
Similarly, the aggregated watermarked data can be obtained as follows:
\[
\begin{split}
\sigma'_1&=\sum_{j=1}^3\delta'_{j,1}=\delta'_{1,1}+\delta'_{1,2}+\delta'_{1,3}\\&=(7+22i)+(16+28i)+(43+46i)\\&=66+96i.
\end{split}
\]
The receiver end would compute the following:
\[
\lambda_1^{-1}\sigma'_1=\left(\frac{3}{13}-\frac{2}{13}i\right)(66+96i)=30+12i,
\]
whose real part provides the aggregated data: $S_1=\Re(30+12i)=30$, whereas the imaginary part is $\Im(30+12i)=12=3\cdot 4=Nw_1$. If the imaginary part is divided by the number of devices ($N=3$), the embedded watermark ($w_1=4$) is finally extracted.
\end{document}