Secret keys mainly consist of two parts. One is the chaotic systems which include the piecewise linear chaotic map (PWLCM) (Alawida et al., 2019; Zhou et al., 2021) and logistic map (Sui et al., 2015; 2014), while the other is the modulation key.

The dynamic equation of PWLCM can be described by the following function: X n + 1 = X n / p , 0 ≤ X n < p X n − p / 0.5 − p , p ≤ X n < 0.5 1 − X n − p / 0.5 − p , 0.5 ≤ X n < 1 − p 1 − X n / p , 1 − p ≤ X n ≤ 1 (1) where the parameter p should be in the range of (0, 0.5), and the status value X(n) is in the range of (0,1).

The logistic map is defined as follows: X n + 1 = λ X n 1 − X n (2) where the parameter λ should be in the range of (0, 4), and the status value X(n) is in the range of (0,1).

We use the abovementioned chaotic systems to generate three random sequences, two of which are generated by the PWLCM with the initial status values X _r (0) and X _c (0) and one by a logistic map with the initial status value X _d (0). To relate the initial values with the plain image, we use Keccak (Bertoni et al., 2013) to hash the plain image to generate a fixed-length K (512 bit), which can be divided into 32 blocks, each of 16-bit. We denote it as K = {k ₁, k ₂, … , k ₃₂}. The initial status values are derived as follows: X r 0 = 1 16 ∑ i = k 1 k 11 32 4 k i + 1 + 1 4 k i + 3 + 128 10 ∗ k i + 5 + 64 10 k i + 7 + 4 10 k i + 9 + 1 10 k i + 3 X c 0 = 1 16 ∑ i = k 12 k 22 32 4 k i + 1 + 1 4 k i + 3 + 128 10 ∗ k i + 5 + 64 10 k i + 7 + 4 10 k i + 9 + 1 10 k i + 3 X d 0 = 1 16 ∑ i = k 23 k 32 32 4 k i + 1 + 1 4 k i + 3 + 128 10 ∗ k i + 5 + 64 10 k i + 7 + 4 10 k i + 9 + 1 10 k i + 3 (3)

After retrieving the initial value [i.e., X _r (0)] and the corresponding chaotic map, we iterate through the chaotic map n times [(i.e., X _r (n)] to remove transient processes and then continue to iterate it to obtain the random sequence of the specified length.

Modulation key M is a binary sequence of equal length to the encoded DNA sequence. In M, ‘0’ represents A/T and ‘1’ represents C/G (Zan et al., 2022). The 01 composition of the key directly reflects the base composition of the encoded DNA sequence. Since the DNA sequences with extreme guanine–cytosine (GC) content or long homopolymers (i.e., longer repeats of the same base, i.e., AAAAAA…) are difficult to synthesize and prone to sequencing errors, most of the DNA storage works comply with some encoding constraints on the DNA sequences, such as the GC content of 45%–55% and homopolymer runs of ≤ 3 nt (Erlich and Zielinski, 2017). In our encryption scheme, the percentage of 1 s (or 0 s) in the modulation key (equivalent to the GC content) and the consecutive length of 1 s (or 0 s) (equivalent to the homopolymer runs) also adhere to these constraints. From a key space perspective, this makes key cracking more difficult.

Given an image P with size W × H and the iteration number n ∈ 100 , ∞ . Let N = W × H, the detailed encryption process can be depicted as follows.

As an asymmetric cryptosystem is more secure than a symmetric cryptosystem (Dong, 2015), the decryption keys are not identical to the encryption ones in our method. The decryption scheme uses the keys λ, p, X _r (n), X _c (n), X _d (n), and M to execute the reverse operation on the encryption algorithm. First, according to the modulation decoding method (Zan et al., 2022), M is used to correct noises in the sequenced data C′ and decode them to obtain the two-dimensional pixel matrix P ₃. Second, Eqs. 4, 2, λ, and X _d (n) are used to perform reverse diffusion operations on P ₃ to get P ₂. Finally, Eq. 1, p, X _r (n), and X _c (n) are used to perform reverse scrambling operations on P ₂ to derive plain image P.

The key space of the proposed method is sufficiently large to withstand any brute force attack. In the traditional decryption process, the receiver has to know the five parameters λ, p, X _r (n), X _c (n), and X _d (n). As their valid precision is 10^–16, the key space of the five parameters will be S key = 1 0 80 ≈ 2 266 (5) Given that the sequence length is 200, and the percentage of 1s in the carrier strand is about 0.5, the modulation key space is S M = 200 100 ≈ 2 196 (6) The total key space of our method is S = S key × S M = 1 0 80 × 200 100 ≈ 2 462 ≫ 2 128 (7) It is much larger than the theoretical secure key value 2¹²⁸ (Dong et al., 2022). As the modulation key space alone is larger than 2¹²⁸, we can conclude that the storage channel can serve as another layer for data security.

Attackers have two possible ways to decipher the encrypted image in the noisy DNA storage channel. One is to infer a possible modulation key M′ by MSA and then decipher the sequenced reads by it, and the other is to directly decipher sequenced reads by the MSA algorithm. This is because there are only two methods of correcting base errors in DNA storage: constraint coding and multiple sequence alignment (MSA) without prior knowledge. As MSA fundamentally relies on pairwise sequence alignment algorithms, such as the Needleman–Wunsch algorithm (Needleman, 1970) and seeks to find a globally optimal alignment between multiple copies, there is limited variability in alignment accuracy across MSA software tools (Pervez et al., 2014). Assuming all keys are known except for M, we apply one of the famous MSA tools named MAFFT (Katoh et al., 2002) to conduct a series of experiments.

It is impossible to infer a potential modulation key when the error rate is higher than 20%. The attacker can decipher the encrypted image if the inferred key M′ is very similar to M. Here, we assume that the attackers could have sufficient sequence copies to infer M. Figure 3A shows that the average Hamming distance between M and M′ increases as the error rate increases. When the error rate is larger than 20%, the average Hamming distance is about 80, and increasing sequence copies may even result in a larger Hamming distance (see the top left corner). Figure 3B further shows the Hamming distance distribution at 10,000 sequence copies. The least Hamming distance may reach 32 at an error rate of 20%. That is, there are at least 32 errors in the inferred modulation keys with 200 bits. As the error rate increases, this lower limit could further increase. Therefore, inferring the true modulation key becomes almost impossible in a high error channel.

Without knowing the modulation key M, it is almost impossible to decipher the real image when the error rate is larger than 20%. To evaluate the difference between the decrypted and original images, the number of pixels change rate (NPCR) and unified average changing intensity (UACI) are calculated as D i , j = 1 , c 1 i , j ≠ c 2 i , j 0 , o t h e r w i s e (8) N P C R = ∑ i j D i , j W × H × 100 (9) U A C I = 1 W × H ∑ i j | c 1 i , j − c 2 i , j | 255 × 100 % (10) where W and H are the width and height of two images (c ₁ and c ₂), respectively. Figures 3C, D show the decrypted images using different sequence copies by the inferred modulation key and MSA, respectively. Compared with the original image, the decrypted images are all seriously distorted with NPCR ≈ 1 and UACI ≈ 0.5, even at sequence copies 1,000. The utilization of the traditional cryptographic techniques further increases crack difficulties.

The proposed method is sensitive to secrete keys and plaintext. A slight change in the key (i.e., a single bit change) or plaintext could cause a completely different encrypted result. First, the sensitivity of the PWLCM and logistic map has been confirmed in many image-encryption works (Sui et al., 2015; Sui et al., 2014; Alawida et al., 2019; Zhou et al., 2021). At the same time, 1 bit insertion/deletion in the modulation signal will affect the encoding of a large number of pixels. Second, plaintext sensitivity is accomplished by the pixel diffusion process and initial status values of the chaotic systems which are strongly related to the plain image.

The proposed method can resist statistical attacks. Figure 4 shows the histogram of the pixels in the original image (A) and the encoded eight-base pixel DNA strands (B). The distribution of the encoded DNA sequences is more flat than that of the original. Considering the IDS noises in the sequenced reads, the distribution in (B) tends to be more uniform. Table 1 shows the correlation coefficients of the ciphered image after dislocation and diffusion. All values in the three directions are close to the ideal value of 0 (Ghadirli et al., 2019). That is, the encrypted pixels are distributed randomly. The information entropy of the cyphered image is 7.950121813, which is very close to the ideal value of 8 (Ghadirli et al., 2019). Therefore, the encrypted image shows favorable randomness.

The proposed method is robust to the two most commonly seen errors in DNA storage: base errors and sequence loss. Sequence loss refers to the loss of some DNA molecules during DNA storage processes (e.g., DNA decay, PCR, and sequencing) due to the complexity of the biochemical reactions. Figure 5A shows the decrypted images at an error rate of 20 ∼ 40 % and sequence copies 50∼1,000. The original images could be completely deciphered, given sufficient sequence copies. Figure 5B shows the decrypted images which could retain the portrait even at a loss rate of 50%. It should be added that the proposed method can easily be combined with an erasure code, such as a fountain code (Mackay, 2005), to further improve its resistance to sequence loss attacks. The combined method is quite simple. All that is required is to encode P ₃ with a fountain code prior to dynamic modulation encryption. To the best of our knowledge, such robustness can only be achieved by modulation-based DNA storage architecture (Yazdi et al., 2017; Antkowiak et al., 2020; Press et al., 2020; Srinivasavaradhan et al., 2021; Song et al., 2022; Zan et al., 2022).

The proposed method is resistant to classical attacks, such as known plaintext attacks, chosen plaintext attacks, and chosen ciphertext attacks. As mentioned earlier, the secret keys depend not only on the given initial values, such as modulation keys and system parameters, but also on the plain image. For every plain image, the keys are changed both in the encryption process and decryption process. As such, attackers cannot extract any useful information, either by encrypting a pre-designed special image or by decrypting a certain ciphertext. This concludes that chosen plaintext, chosen ciphertext, and known plaintext attacks do not work against the proposed method.

Table 2 shows the detailed comparisons of existing studies. When compared with other methods, our method has the following advantages in terms of encryption using DNA molecules: first, the modulation key and chaotic systems feature our encryption scheme with dynamic encoding and encryption, which can withstand any kind of brute force attack. More importantly, modulation encoding provides a natural way to comply with biochemical constraints for long-term storage. Second, encrypting data by noise storage channels avoids the complexity and uncertainty in biochemical reactions, such as DNA strand displacement, DNA hiding, and DNA self-assembly. Finally, it is the only method with both high logical information density and strong robustness, which can tolerate extreme environments with high base noise and sequence loss. We believe that all these features endow our method with the potential to achieve reliable, secure, robust, and scalable encryption for DNA storage.