File Hiding Web Application (FHWA) Using Image Steganography

Only limited file type that can be hidden

Most of current systems provide only one type of file that can be hidden. Some systems can only hide text messages and other systems can only hide image files. This can be a tedious task for users because they need to find different hiding tools or software to hide any file type that they want. User may give up to hide their confidential information since it cost time to search for a tool that can hide any specific file type (Semilof & Clark, 2018).

Unauthorized user can easily finds and view the hidden file

Some of the current systems did not provide encryption or password to lock the hidden file. Kessler (2015) mentioned that when the hidden file does not have any password or encryption to open it, the process of hiding data is simply pointless. It is still not secure even the user already hides the data because an intruder may detect the secret information easily and find a solution to conceal or reveal it since the hidden file is not encrypted. Without encrypting this hidden file, it will make it easier for intruders to obtain secret data.

Revealing process is not provided and only certain file types can be revealed

Most of the current systems do not provide the revealing process of the hidden files. Although some current systems provide the revealing process, the system can only reveal certain types of files. This can be difficult for users because they cannot reveal the hidden file easily since some current systems did not provide the revealing process (Stone, 2017). Other than that, since some of the current systems only can hide certain file types, then the system also only could reveal certain types of hidden files. Thus, they need to find different revealing tools or software to reveal the hidden files inside the image file.

To enable a user to hide any type of file inside an image

This paper discusses how a user can hide any type of files or information into another file which is an image file. To make this happen, image steganography technique is used in FHWA. With this technique, the user will be able to hide and unhide the secret file. Other than that, users can hide any type of file including text message, image, audio, video, and any document type together with the image data.

To ensure that hidden files are read or viewed only by authorized users

The paper also highlighted how FHWA enables the users to set a password and encrypt their hidden files. Only the user who has the encryption key or password can decrypt the hidden file. This will ensure that unauthorized users are unable to read or view the hidden file.

To allow an authorized user to reveal any hidden file types

With FHWA, only authorized users can reveal the hidden files (any types). To develop this process, the reverse image steganography technique known as steganalysis is implemented. Both steganography and steganalysis are discussed below in this paper.

Steganography

Steganography refers to a method intended to hide interactions between the two communicators. The words steganography is composed specifically of Greek terms στεγανός, covered and γραφία, writing (Telsy, 2020). According to Taha et al. (2019), steganography defines as how a secret message is kept hidden in a cover message in such a manner that its existence is completely hidden. It is also can be referred to as the art or activity of hiding a file, image, audio, or message within another file which is image, audio, or video. The secret message could be in the form of a text file, an image, a ciphertext, or something that can be interpreted as a bit. Thus, the main objective of steganography is to communicate privately with secret information through the cover file.

Steganography can also be used in command and control protocols for malware, including reading content from image files accessible by sharing and social media platforms (Murphy, 2019). Therefore, the use of steganography is actually to hide confidential or secret data from unauthorized users. For example, information that is not supposed to be revealed to others can be protected using steganography. Sensitive information, such as financial records, can also be concealed in a cover object and stored on a private computer. It needs appropriate conditions to make steganography techniques effective (Lake, 2019).

See Full Size >

Figure 1 shows the process of steganography and steganalysis where it involves interaction between two individuals which are sender and receiver. The steganography process is executed when the sender hides the secret message by using a stego-key or password in a cover media such as an image. On the receiver site, the steganalysis process will be executed if the receiver has the stego-key and the secret message sent by the sender will be revealed.

Steganalysis is the process of identifying or discovering the secret messages or we can say it is the reverse process of steganography. Since FHWA includes this process to reveal the hidden message, steganalysis is one of the important processes in this development. This process aims to evaluate if the file or any other medium contains a secret message and if the result is positive, the hidden message contained in the medium can be revealed (Telsy, 2020).

In this application we used an image as a cover to hide the secret data. According to Ives (2017), there are several steganography techniques for hiding the data, however, with the intention of hiding files within images, only two methods were feasible which are hiding file data within the image data and adding file data together with the image data.

The first method replaces irrelevant image data with information to be concealed. Normally this approach works by hiding the data in the Least Significant Bits (LSB) of the image color component. Therefore, the size of the file shall remain the same as the data or secret message is just replaced, not added (Olomo Rachael, 2019). This will ensure that the steganography is tough to locate. However, only a very small amount of secret information can be covered in each image.

For the second method, it can retain full image quality thus increase the overall file size. By adding secret data to an unnoticed part of the file, such as after the logical end of the image, any amount of data can be concealed (Douglas et al., 2017). Therefore, the user may add secret data in the cover image without regarding the file size of the secret data which is different from hiding the data in the Least Significant Bits (LSB) where it can hide an only a small amount of secret information. However, this approach is easier to detect as the file size increases and the file can be analyzed to reveal secret information.

FHWA uses the second approach as it enables users to hide any number of files in the image, regardless of the image resolution. Besides that, FHWA uses end of file (EOF) markers to incorporate data that will not normally be found in an image format. The EOF markers for images file types include PNG: AE426082, JPEG: FFD9, and GIF: 3B. Hence, there should be no information after the EOF marker, so any data that is stored after the marker will be ignored by software when scanning the file. Other than that, we also implement the cryptography element in this development to secure the confidentiality of the hidden data.

Agile Development

FHWA make used of Agile Development methodology as shown in Figure 2. This approach prioritizes individual responsibility, short time frames for deliverables, consistent communication, feedback, and sustainable growth (Thattamparambil, 2020). This iterative agile approach is more versatile and its short-term iterations aim to develop the project on a small timeframe, with little preparation rather than a long-term strategy. It allows teams to adapt to randomness through systematic iterative work cycles, known as sprints (Azmee, 2017). Therefore, this method is very suitable and has been chosen for FHWA because it requires a short time to complete.

See Full Size >

The planning and analysis phase mainly focuses on developing a plan according to the requirements which includes an analysis, design and testing plans to provide a clear path for the development process. This includes the construction of question to be asked in the questionnaire, which then have been distributed to 100 users (for user requirement). For analysis, we analyzed and identified the user requirements, system requirements and algorithms that will be implemented which are steganography and cryptography.

In second phase, we designed the flow of this application in the form of use case and flowchart diagram. We also designed the user interfaces which are simple, efficient, informative and user friendly.

After the best design has been selected, implementation started immediately by using several programming languages. We used Javascript like Node.js for backend while for frontend, Javascript library and framework such as ReactJS, Next.js were implemented. Specifically for User Interface (UI), we used Tailwind CSS, Semantic UI for designing the UI and we used MongoDB in setting up a database.

For testing phase, we implemented few testing which include unit, integration, system (both functional and non-functional) and user acceptance. In this paper, we will present the user acceptance testing results (from 60 respondents) as they can prove that FHWA can be used successfully in order to meet above objectives.

Design and Implementation

Figure 3 shows FHWA flowchart where it starts with entering the username and password to login to the system. The actors in this system are Administrator and Users. Administrator can manage users that have been registered in this system where they can view user details, add new users, update user details, and delete a user. Administrator also can perform the ‘hide files’ and ‘reveal files’ functions.

See Full Size >

For normal users, if they did not have a username and password to log in, they can proceed to the registration page. Once successfully registered, they can log in and proceed to hide files or reveal files. If the users choose to hide a file, then they must add any file that they want to keep confidential, add a cover image, choose the compression level, and set a password to encrypt the confidential file. After that, the process of hiding and encrypting the files should be successful. Then, users can proceed to download and store the file in their device or local storage.

If the users choose to reveal files, then they must add an image file that contains a secret file and enter the same password used to encrypt the secret files. After that, the process of revealing and decrypting the files should be successful. Users can also proceed to download and store the file in their device or local storage. Lastly, if administrators and users want to end the application sessions, they can log out from the system.

FHWA involves two main processes which are hiding files and revealing secret files. These processes use few algorithms and the steps of the processes are discussed below:

• Hiding the files
• Revealing the files

This process is similar to the hiding process but in the reverse step.

• First, the file will be converted to a Uint8Array and read using the FileReader API.
• After the EOF marker has been discovered by iterating through the array, the files are immediately retrieved and followed the EOF marker. If no content follows the EOF marker, the image does not include any hidden files.
• The decryption technique to hide the ZIP file is the same as the technique used in the encryption process. However, to derive decryption, the derivation key is used with the AES-CTR algorithm to decrypt the data.
• After the ZIP file has been decrypted, JSZip is used to extract the files.
• Finally, the extracted ZIP files that contain hidden messages or files can be downloaded and stored on user devices or local storage.

Interface Design

See Full Size >

Figure 4 (a) shows sign-up page and Figure 4 (b) shows the login page of FHWA system. The sign-up page provides three information that needs to be filled in by the users which are the name, email, and password. If all the information that has been filled in is valid, a user should successfully be registered into the system after they click the ‘Signup’ button. Then, users can login to the system by filling the registered email and password.

See Full Size >

Figure 5 (a) shows hiding files page and Figure 5 (b) shows the revealing files page of FHWA system. To hide files inside the image, users must click a radio button that is provided in question one which is the ‘hide files inside an image’. After click it, users must click the ‘Add files’ button to add the files that they want to hide and choose the compression level to compress the files. The system also provides the user to set the password to encrypt the files. Then, click ‘Hide files inside image’ button and download button will be available. Users need to click the button to download and store the image files that contain hidden files into the user's devices or local storage.

To run the revealing files process, users must click a radio button that is provided in question one which is the ‘Reveal files from an image’. Then, user can click ‘Add image’ button to add the image that they want to reveal the files from within and enter the same password that has been set. Click the ‘Reveal files inside image’ button and download button will be available. User must click the download button to download and store the hidden or revealed files into the user's devices or local storage.

User Acceptance Testing Result

Out of 100 questionnaires distributed to users, 60 were completed and used for this analysis.

Based on Table 1, we found that 100% of respondents can login and register into FHWA. Table 1 has shown an evidence which all of the respondents were able to set a password to encrypt their hidden files inside an image. FHWA shows that 95% of its respondents can hide their confidential files and can reveal the hidden files afterwards using image steganography technique. The remaining 5% were just not so sure what they have accomplished. This may be due to knowledge gap in information technology or it can be due to unfriendly user interface itself.

Since security is very important in this application, we asked the users to enter the correct and the incorrect passwords when revealing the hidden files. From Table 1, we can see that 95% of the respondents cannot reveal the hidden files inside the image without entering the correct password. Thus, it proves that the security feature was successfully implemented in FHWA

Table 1 also shows that all of the respondents agreed with this application where it runs smoothly. On average, we can say 98% of the respondents strongly agree that FHWA met its objectives.