Intellectual Property Protection of Multimedia Contents Josep Domingo i Ferrer Francesc Sebé CRISES Group September.

Intellectual Property Protection of Multimedia Contents

Josep Domingo i FerrerFrancesc SebéCRISES Group

http://www.etse.urv.es/recerca/crises

September 2001

UNIVERSITAT ROVIRA I VIRGILI 2

Introduction

Implementing e-commerce of multimedia contents requiressolving the following security issues: Protection of Intellectual Property Rights (IPR). Secure e-payments.

This talk will address the IPR protection issue. The main open problem in IPR protection is to come up with robust systems to protect video (still and moving) and audio

IPR protection is explicitly addressed by EU 5FP ISTProgramme under action line II.4 “Information and network security and other confidence building technologies”.


Structure of this talk

Copy prevention vs copy detection State of the art in copy detection

Watermarks and fingerprints Mark embedding and reconstruction Requirements of marking systems Taxonomy of watermarking systems Taxonomy of fingerprinting systems

Case study 1: Sebé-Domingo-Herrera watermarking systems for still images (crop-proof, scale-proof).

Case study 2: Sebé-Domingo watermarking system for moving video (oblivious, scale-proof, survives geometric distortion)

Audio protection Collision-secure fingerprinting


IPR protection

Intellectual Property Rights protection (also known as electronic copyright protection) seeks to protect owners of multimedia content against unauthorized copy.

IPR protection is explicity covered by EU 5FP IST Programme under action subline II.4.3 “Digital object transfer”


Copy prevention vs copy detection

IPR protection based on copy prevention has proven ineffective in the last years (e.g., CD protection, encrypted TV, and currently DVD protection2). Prevention ultimately depends on players and recorders being compliant with open standards, which is risky in multi-vendor scenarios.

Copy detection is more promising. The merchant selling multimedia contents embeds a mark in them: To encode a mark bit, a piece of the contents is needed of

which two slightly different versions exist. When selling a copy of the contents, the merchant selects

a value for each mark bit to obtain a marked object. Upon detecting a redistributed item, the mark is

reconstructed to prove ownership or trace redistributors.2Bell(1999) “The dynamic digital disk”, IEEE Spectrum 36(10) 28-35 and http://www.wired.com/news/print/0,1294,32263,00.html


Watermarking vs fingerprinting

There are two types of mark:Watermark: Embedded copyright message (something

analogous to the © symbol on paper).Fingerprint: Sort of serial number (something identifying

the buyer of the copy). In watermarking, the mark is the same for all buyers,

whereas in fingerprinting it depends on the buyer’s identity.

Watermarking only allows to prove ownership, whereas fingerprinting allows redistribution tracing.

Unlike watermarks, fingerprints can be damaged by colluding buyers.


Mark embedding

Inputs to mark embedding are the mark E the cover object I (the contents to be marked) and a secret key K used for spreading E.

The output of mark embedding is the marked object .

_

I

Mark embeddingprocess

Key K

Marked object_

IMark E

Cover objectI


Mark reconstruction

Inputs to mark reconstruction are the redistributed object , the secret key K and possibly some additional information dependent on the properties of the scheme.

The output is the reconstructed mark E’ or a Boolean, depending on the scheme used.

_

'I

reconstructionprocess

E’boolean

Key K

Redistributed object

Other information

_

'I


Requirements of copyright marking schemes

Inperceptibility: The mark should be imperceptible for the buyer.

Robustness (merchant security): Single-user attacks and, for fingerprinting, collusion attacks should be survived by the mark. Multiple marking desirable.

Capacity: How much information can be embedded?Kerckhoff’s principle: Hiding method public (only the key is

secret).Buyer security: The buyer cannot be framed.Anonymity: Marking should not jeopardize buyer anonymity.


A taxonomy of watermarking schemes

SEMI-PRIVATE

OBLIVIOUS

EKI

EKII 1,0 EKI

1,0 EKII

Input: object I

PRIVATE

Input: mark E


Fingerprinting concepts

It is assumed that two or more dishonest buyers can only locate and delete mark bits by comparing their copies (Marking Assumption, [Boneh95]).

To make the marking assumption happen, fingerprinting needs an underlying sound watermarking scheme (specifically, one which does not need E for reconstruction).


A taxonomy of fingerprinting schemes

Classical fingerprinting schemes [Blakley86] [Boneh95] are symmetric in that both the merchant M and the buyer B know the fingerprinted copy. even if M identifies a dishonest B from a redistributed

copy, M’s previous knowledge of fingerprinted copies prevents M to use them as a proof of redistribution.

In asymmetric fingerprinting [Pfitzmann96], only B knows the fingerprinted copy. The problem is that M knows B’s identity even if B is honest.


A taxonomy of fingerprinting schemes (II)

In anonymous fingerprinting [Pfitmann97], M does not know the fingerprinted copy nor B’s identity. Upon finding a redistributed copy, M needs the help of a registration authority R to identify the redistributor.

Collusion-secure fingerprinting schemes [Boneh95] guarantee that the mark cannot be destroyed even if up to c buyers collude, where c is a security parameter.


Robustness benchmarks for watermarking

Image watermarking: StirMark is a benchmark for images that performs a number of manipulations on marked images: Low-pass filtering Compression Cropping, rotation and scaling Geometric distortions Others

A StirMark version for audio exists:


Case study 1: Sebé-Domingo-Herrera watermarking systems for still images

We present two semi-private watermarking systems [Sebé00]3 with different robustness properties: A crop-proof system A scale-proof system

Both systems survive several other signal processing manipulations

Being non-oblivious, both systems require the original image to be input for mark reconstruction. This makes them more suitable to protect still images than motion pictures (handling the original version of a motion picture is quite cumbersome).

3Sebé, Domingo, Herrera (2000) in Information Security ISW’2000, LNCS 1975, Springer-Verlag.


Case study 1: crop-proof watermarking

A watermarking algorithm for images with the following features is presented:

The JPEG algorithm is used to decide where and how to encode mark bits.

p and q are input parameters, where p is the desired Peak Signal-to-Noise Ratio (PSNR) between the original image X and the marked image X’’, and q is a JPEG quality level.

The key of the marking algorithm is a random bit sequence generated by a sound stream cipher. This sequence multiplies the differences between X and X’ (the JPEG q-compressed version of X ) to get X’’.

To resist croppings and other attacks, mark embedding is region-based.

Mark reconstruction uses ECC and needs knowledge of X but not of E (semi-private watermarking).

1iS i


Crop-proof: robustness assessment

The base test of the StirMark 3.1 benchmark was used on the images Lena, Bear, Baboon and Peppers to evaluate robustness.

Values p = 38dB, q=60% and a 70-bit mark were taken. The following StirMark attacks were survived by the embedded

mark: Color quantization. All low pass filtering manipulations (Gaussian, median 2x2, 3x3 and

4x4, frequency mode Laplacian removal, simple sharpening). JPEG compression 90% down to 30% Rotations with and without scaling of -0.25 up to 0.25 degrees. Shearing up to 1% in the X and Y directions. All StirMark cropping attacks. Row and column removal from X’’.


Crop-proof: robustness assessment (II)

Additional rotation, scaling and shearing can be detected and undone by the merchant M prior to mark reconstruction using computer vision.

Multiple marking is supported. M1 can mark an image and sell the marked image to M2, who remarks the image and so on.

In 10 successive markings on Lena with p=38dB the PSNRs decrease as 38, 35.1, 33.4, 32.28, 31.37, 30.62, 30.04, 29.5, 29.06 and 28.7.


Crop-proof: experimental results

Original Lena imageWatermarked Lena imagewith PSNR=38dB, q = 60% and 70-bit mark embedded



Different cropping attacks performed on the watermarked image by StirMark.The mark is still reconstructed thanks to the region based watermarking technique used in the embedding algorithm.



Original Lena image 5 times watermarked Lena image


Case study 2: scale-proof watermarking

A watermark algorithm for images with the following features is presented:

Based on the crop-proof idea, it survives scaling attacks The image is divided into square tiles, where parameter p determines

tile size and parameter r determines separation between neighbouring tiles.

The key of the marking algorithm is a random bit sequence The key is bitwise added to the mark before embedding. Each mark bit

is embedded in a different tile Visual components are used to decide the magnitude of marks

embedded within a tile. Each mark bit is embedded in all pixels in the tile. This allows scaling to be survived: even if the tile is reduced or magnified, there are still many pixels which carry the correct value of the embedded mark bit

Prior to key addition, the mark is encoded using an ECC to increase robustness.

1iS i


Scale-proof: robustness assessment

The base test of the Stirmark 3.1 benchmark was used on the images Lena, Bear, Baboon and Peppers to evaluate robustness.

Values p=5 and r=3 and a 70-bit mark were taken. The following Stirmark attacks were survived by the embedded

mark: Color quantisation Mos low pass filtering manipulations (Gaussian, median 2x2 and 3x3,

frequency mode Laplacian removal, simple sharpening) JPEG compression from 90% to 20% Rotations with and without scaling of -0.25 up to 0.25 degrees Shearing up to 1% in the X and Y directions Cropping up to 1% Row and column removal All stirmark scaling attacks (scale factors from 0.5 to 2).


Scale-proof: experimental results

Original Lena image 0.5 scaled Lena


Case study 2: Sebé-Domingo oblivious watermarking system

As noted in [Katzenbeisser00], oblivious watermarking is more convenient for movies, as it allows mark reconstruction without handling huge amounts of original image sequence.

We have developed an oblivious watermarking scheme: The mark is encoded using an ECC to increase robustness. The image is randomly tiled using a key k. Each mark bit is

embedded in one of the chosen tiles (the same bit in all pixels).

The value of a pixel [0,255] is divided into small intervals, which are alternatively labelled as 0 or 1.

To embed a bit in a pixel, the latter is modified to fit the appropriate label.

Visual components are used to decide maximum variation we can apply to a pixel.


Oblivious: Robustness assessment

The base test of the StirMark 3.1 benchmark was used on the images Lena, Bear, Baboon and Peppers to evaluate robustness.

The pixel range was divided into intervals of length between 10 and 13. A 30-bit mark was embedded. The following StirMark attacks were survived by the embedded mark:

Color quantization. All low pass filtering manipulations except sharpening (Gaussian, median

2x2, 3x3 and 4x4, frequency mode Laplacian removal). JPEG compressions (90% down to 30%). Rotations with and without scaling of -2 up to 2 degrees. All shearing manipulations. All scaling manipulations. Small cropping attacks up to 2% surface. Row and column removal from X”. StirMark random bend


Oblivious: experimental results

Original Peppers image Watermarked Peppers image



Original Peppers image

Visual components of Peppers image



Original Peppers image

Different scaling attacks performed on the watermarked image by StirMark.The mark is still reconstructed.


Audio watermarking


Our developments in fingerprinting

We present recent work in

Anonymous fingerprinting. Collusion-secure fingerprinting.


Anonymous fingerprinting

In [Domingo98a]6, a scheme for anonymous fingerprinting is presented that allows M to identify redistributors without help from R.

In [Domingo98b]7, anonymous fingerprinting without secure multi-party computation is presented. Rabin’s 1-2 OT is used but a generic ZKP is needed whereby B (buyer) shows to M (merchant) that a hash value was correctly computed by B.

Constructions [Pfitzmann97], [Domingo98a] for anonymous fingerprinting are too complex to be implementable on standard computers, let alone smart cards.

Construction [Domingo98b] relies on an unspecified general zero-knowledge proof.

6Domingo (1998), Electronics Letters, 34(13)

7Domingo (1998), in Proc. of CARDIS’98, Springer LNCS (to appear)


Anonymous fingerprinting (II)

In [Domingo99a]8, a new construction for anonymous fingerprinting is described which is efficiently and completely specified from a computational point of view.

The basic primitive used is committed oblivious transfer (COT), which in turn can be implemented using bit commitment (BC).

Complexity: Multimedia contents initialization: 1 digital signature and 2n

BC (n is the contents bitlength). Buyer registration: five exponentiations and a zero-

knowledge proof for showing possession of discrete logs [Chaum88].

Fingerprinting: n COT and n signatures. Mark reconstruction (identification): open O(n) BC.

8Domingo (1999), in Public Key Cryptography’99, Springer LNCS 1560, 43-52.


Anonymous fingerprinting (security)

Proposition 1. [Registration security] Registration provides buyer authentification without compromising the private key xB of the buyer.

Proposition 2. [Buyer anonymity] Let l2 be the minimal number of mark bits to be opened by a suspect buyer in the identification protocol. Then the probability that the merchant identifies an honest buyer who correctly followed the fingerprinting protocol is upper-bounded by 2-l

2.Proposition 3. [Merchant security] In order to remain undiscovered

after the identification protocol, a non-colluding redistributor must modify on average n/l2 randomly chosen bits of the fingerprinted copy. This number can be made large by choosing l2 << n.

Proposition 4. Without tamper-proof buyer devices, the expected percent of marks that can be deleted by a collusion of c buyers is 100(1-1/2c-1). With tamper-proof devices, any collusion is resisted.


Collusion-secure fingerprinting

Collusion: Two or more different buyers can detect mark bits by comparison of their copies of the same image (because the secret key is the same for all buyers).

Attack: A detected mark bit can be deleted or tweaked.

In [Domingo00a]9 dual binary Hamming codes are used to obtain a2-collusion secure fingerprinting scheme much simpler than thegeneral proposal [Boneh95].

9Domingo and Herrera (2000), Proc. of ITCC’2000, IEEE Computer Society Press (to appear)


Collusion-secure fingerprinting (security)

Theorem 1. The watermarking scheme described in [Domingo00a] can be transformed into a fingerprinting scheme secure against collusion of two buyers by taking as ECC in the mark generation algorithm a dual binary Hamming code H of length N = 2n-1. An innocent buyer will never be declared guilty and the probability that a participant in a two-buyer collusion can be identified can be made arbitrarily close to 1.

Future research should be directed to increasing the size of collusions

that can be successfully resisted.

Intellectual Property Protection of Multimedia Contents Josep Domingo i Ferrer Francesc Sebé CRISES Group September.

Documents

cd protection

audioipr protection

types of mark

mark embeddinginputs

ipr protection issue

output of mark embedding

copy detectionwatermarks

herrera watermarking