PERFORMANCE STUDY OF ECC-BASED COLLUSION-RESISTANT MULTIMEDIA FINGERPRINTING

Transcription

1 PERFORMANCE STUDY OF ECC-BASED COLLUSION-RESISTANT MULTIMEDIA FINGERPRINTING Shan He and Min Wu ECE Department, University of Maryland, College Park ABSTRACT * Digital fingerprinting is a tool to protect multimedia content from illegal redistribution by uniquely marking copies of the content distributed to each user. Fingerprinting based on error correction coding (ECC) handle the important issue of how to embed the fingerprint into host data in an abstract way known as the marking assumptions, which often do not fully account for multimedia specific issues. In this paper, we examine the performance of ECC based fingerprinting by considering both coding and embedding issues. We provide performance comparison of ECC-based scheme and a major alternative of orthogonal fingerprinting. As averaging is a feasible and cost-effective collusion attack against multimedia fingerprints yet is generally not considered in the ECC-based system, we also investigate the resistance against averaging collusion and identify avenues for improving collusion resistance. 1. INTRODUCTION Digital fingerprinting is an emerging technology to protect multimedia content from unauthorized dissemination, whereby each user s copy is identified by a unique ID embedded in his/her copy and the ID can be extracted to help identify culprits when a suspicious copy is found. A powerful, cost-effective attack from a group of users is collusion, where the users combine their copies of the same content to generate a new version. If designed improperly, the fingerprints can be weakened or removed by the collusion attacks. A growing number of techniques have been proposed in the literature to provide collusion resistance in multimedia fingerprinting systems [1]-[8]. Many of them fall in one of the two categories, namely, the orthogonal fingerprinting and coded fingerprinting. The orthogonal fingerprinting assigns each user a spread spectrum sequence as fingerprint and the sequence is mutually orthogonal to those for other users [3][4]. An early work on coded fingerprinting focused on generic data and introduced a two-level construction in code domain to resist up to c colluders with high probability [1]. This binary code was later used to modulate a direct spread spectrum sequence to embed the fingerprints in multimedia signals [2]. A q-ary ECC code resisting c The authors can be reached at {shanhe, minwu}@umd.edu. colluders, known as the c-traceability code or c-ta in short, was proposed and later extended to deal with symbol erasures contributed by noise or cropping in multimedia signal domain [6][9]. A recent code based on combinatorial design was embedded in multimedia through spread spectrum code modulation and can identify colluders through the code bits shared by them [7]. Many existing fingerprinting systems based on random code or ECC handle the embedding issues in a rather abstract level through models known as the marking assumption [1][6]. For example, it typically assumes that colluders can only change fingerprint codebits in which they have different values [1], and the colluders assemble pieces of their codes to generate a colluded version [6]. Many of these assumptions work well with generic data, but do not fully account for the unique issues when fingerprints are embedded in multimedia[8]. Colluders can manipulate fingerprinted multimedia in the signal domain, bringing changes in the code domain beyond the marking assumption. For example, the colluders may average the corresponding signal components or features from multiple copies [7][8]. Thus it is important to examine the fingerprinting performance from signal domain, taking into account coding, embedding, attack, and detection issues. We evaluate the performance of ECC-based fingerprinting in this paper with a focus on two issues. First, there is little comparison in the literature on the performance between the ECC-based coded fingerprinting and the orthogonal fingerprinting (denoted as ORTH ), where the ORTH scheme is conceptually simple and easy to implement. By incorporating embedding issues, we provide a common ground for the two types of fingerprinting and compare their performance in identifying traitors and resisting collusion. Second, we have discussed that multiuser averaging is a feasible and representative way to signal-domain collusion. While it is important for a fingerprinting system to resist averaging collusion, the current design of ECC based fingerprinting typically considers only interleaving collusion. Investigating their resistance against averaging collusion is a key step toward understanding and improving the collusion resistance of fingerprinting systems for multimedia. The paper is organized as follows. Section 2 presents the system setup of ECC-based embedded fingerprinting for multimedia. Section 3 discusses the selection of important parameters and unique issues incurred by embedding. We

2 examine in Section 4 the system performance under different scenarios and compare with the performance of the ORTH scheme. Finally conclusion is drawn in Section ECC-BASED FINGERPRINTING SYSTEM 2.1 System Framework Fingerprint encoding and embedding are two important issues for fingerprinting multimedia. We illustrate a fingerprinting system that employ an ECC based fingerprint code and spread spectrum embedding in Fig.1. The system has two layers: the outer code layer is an ECC-based traceability code of N u codewords resisting c colluders and having alphabet size q; and the inner embedding layer is for embedding each code symbol in multimedia. Fingerprinting ECC encoding (c-ta code) with alphabet size q Orthogonal modulation with q colors Fingerprinted Multimedia Channel Attacks ECC decoding (c-ta code) with alphabet size q Orthogonal demodulation with q colors Suspicious Multimedia Fig.1 Framework of ECC based fingerprinting scheme Fingerprinting We first choose an ECC code with an alphabet size of q and a large minimum distance, and assign to each user a codeword. We call each symbol from the above alphabet a color as in [2]. The design of this ECC fingerprint code will be discussed in Section 2.2. We partition the host signal into non-overlapped segments (such as frames of video or audio), where each segment is to carry one color of the fingerprint code. Within each segment, we use q mutually orthogonal spread spectrum sequences to represent the possible color values, and add one of these sequences into the segment (with perceptual scaling) according to the color value in the fingerprint code. This spread spectrum embedding technique from [10] has been shown highly robust against a variety of processings and attacks. It is also a common signal processing technique for embedding orthogonal, coded, and other correlated fingerprints [8][10]. The ORTH scheme can be regarded as a special case of ECC-based fingerprinting, which has code length 1, alphabet size N u, and uses the entire multimedia signal as one segment. Each fingerprinted segment can be modeled as yij = uij + x j (1) where u ij is the spread spectrum sequence for embedding the j-th color of the i-th user s codeword, x j is the j-th segment of host signal, and y ij is the fingerprinted segment. Then the concatenation of all fingerprinted segments forms the ultimate fingerprinted signal. Detection Collusion Attacks Interleaving collusion is considered by most ECC-based fingerprinting works. Each colluder contributes a non-overlapped set of segments and these segments are assembled together to form a colluded copy. Additional noise may be added to the multimedia signal during the collusion. As few colluders would be willing to take higher risk than others, they generally would make contributions of approximately equal amount in the collusion. We have discussed in the introduction that colluders can contribute one segment in a partial way and can perform signal domain combining that is not captured by the interleaving attack. A simple yet effective way is by averaging differently fingerprinted copies, i.e. 1 z = s + x+ d (2) i c i Sc where s i represent the fingerprint sequence for user i, S c the colluder set, c the total number of colluders, x the host signal, and d the noise term. For simplicity in analysis, we assume that the noise in interleaving and averaging collusion follows i.i.d. Gaussian distribution. Detection To identify colluders who have contributed to a suspicious copy of multimedia content, we first determine which color is present in each multimedia segment using a correlation detector commonly used for spread spectrum embedding [4][10]. If the host signal is available to detectors in fingerprinting applications, we register the suspicious copy with the host signal and subtract the host from the suspicious copy to obtain a test signal; otherwise, we use the signal itself as a test signal. We then correlate this test signal with each of the q spreading sequences, identify the sequence giving the maximum correlation, and record the corresponding color. From the sequence of colors extracted from all media segments using this maximum detector [4], we proceed to the ECC code layer and apply a decoding algorithm to identify colluders whose codewords have the most matches with the extracted color sequence. 2.2 ECC Code Layer A common practice in fingerprint code design treats the colors contributed from other colluders as errors, and makes the minimum distance between codewords large enough to tolerate the errors. The minimum distance requirement ensures that the best match with a colluded codeword (referred to as the descendant) comes from one of the true colluders. The c-ta code [11] is such an example and is defined as follows: Definition: Let Г Σ L be a code over an alphabet Σ with length L. Without loss of generality, we represent the set of c colluders as C = {u 1,..,u c } Г, where a codeword u i Г represents the i-th colluder and consists of a sequence of L colors u i = {w (i) 1, w (i) 2,..,w (i) L }. A codeword set that can descend from this colluder set is denoted as desc(c) =

3 {(x 1,..,x L ): x j {w (i) j : 1 i c}, 1 j L}. If for any descendant (x 1,..,x L ) desc(c), there is a u i C such that {j: x j = w (i) j } > {j: x j = s j } for any innocent user s codeword (s 1,..,s L ) Г \C, then Г is called c-traceability (c-ta) code. The minimum distance requirement for constructing a c- TA code under typical marking assumptions was discussed in [11], and extensions made to tolerate L e erasures [6]. We will derive conditions in Section 3 to address the unique issues incurred by embedding. 2.3 System Design Procedures We summarize the design procedure for an ECC-based multimedia fingerprinting system that aims at surviving interleaving attack. Step1: Given a multimedia signal, obtain the signal length N and determine the segment size N s. Select the alphabet size q. The value of L can be computed by L= N / Ns. Step2: For each segment, under the use of spread spectrum embedding and the maximum detector, compute the probability of correctly detecting a guilty color that is contributed from at least one colluder (denoted as P d ) and the probability of false detection of a color (denoted as P fa =1 P d ). For simplicity, we assume that such probability is identical from segment to segment. Step3: Denote the total number of extracted colors that are contributed from colluder set as N correct. Given n, we examine the probability of an event A that N correct n: L L k L k Pr ( A) = Pr ( Ncorrect n) = Pd ( 1 Pd ) k= n k (3) Step 4: The probability of correctly identifying at least one colluder, denoted as P d_all, is bounded by: Pd_ all Pr ( catch at least one colluder A) Pr ( A) (4) With n = L-L e and a c-ta code from [6] that can handle L e erasures, we ensure Pr(catch at least one colluder A)=1. To meet the minimum probability of positive detection P d_all_req that the system is designed to satisfy, it is sufficient to keep Pr(A) equal to or greater than P d_all_req. Thus with the properties of c-ta code derived in [6], we can establish a relationship between L e, P d_all_req, and the c-ta code capacity (namely, C max the maximum colluder resistance, and N u the number of codewords for representing different users). Using this relationship and for a fixed N u, we can obtain C max and the corresponding c-ta code to meet a given detection requirement P d_all_req. Alternatively, we can examine the detection probability P d_all for a c-ta code with a specific C max. 3. UNIQUE ISSUES INCURRED BY EMBEDDING Minimum Distance Requirement The distortions and attacks mounted by adversaries on fingerprinted multimedia can lead to errors in detecting fingerprint code symbols/colors. The existing work on c-ta code has extended to tolerate erasures only [6]. We note that there is nontrivial probability for false alarms in color detection, which contributes to the non-erased erroneous colors that are not contributed by any colluders. Thus we need to consider both erasure and non-erasure errors when designing fingerprint code. In the following, we extend the definition of c-ta code to account for both types of errors and develop a minimum distance requirement with a similar strategy used in [6]. As before, we consider a code Γ of length L over an alphabet Σ of size q. This code is called a c-traceability code tolerating L e erasures and L FA errors and denoted as c-ta q (L, N u ; L FA, L e ) if for any (x 1,..,x L ) X(C), there is a colluder s codeword u i C such that {j: x j = w (i) j } > {j: x j = s j } for any innocent user s codeword (s 1,..,s L ) Г \C. Here X(C) denotes the set of the codeword with no more than L e erasures and no more than L FA erroneous colors over an extended alphabet Σ {?}, where {?} is the erasure symbol. We derive the following minimum distance conditions for c-ta(l, N u ; L FA, L e ). Theorem 1 Let Γ be an (L,N u,d) q -ECC, and c an 1 c integer. If D > 1 L L FA + L 2 e (5) c c c then Γ is c-ta q (L,N u ; L e, L FA ). We can construct c-ta code using a Reed-Solomon code that satisfies the above condition. The design can be simplified by treating erasures as errors, which reflects the case of color extraction by such schemes as the maximum correlation detector described in Section 2.2. This simplification leads to the following theorem. Theorem 2 Among Reed-Solomon code with alphabet size q, there exists a c-ta q (L,N u ; L FA ) code with minimum 1 c + 1 distance D > 1 L L FA, (6) c c where the codeword number N u = q t L c+ 1 and t= L 2 2 FA c c. With these conditions, we modify the Step 4 in Section 2.3 as follows. We follow the same procedure up to choosing Pr(A) equal to or greater than P d_all_req. We then use L FA = L n in place of former L e = L n, and employ Theorem 2 to establish the relation between L FA, P d_all_req, and the c-ta code capacity (C max and N u ). We set t=2 in this paper for tolerating as many as possible colluders while accommodating a moderate number of users. We plot the relation between C max and L FA under various levels of the detection requirement P d_all_req and refer it as the System Design Figure. A point (P d_all_req, C max, L FA ) in this figure corresponds to a system that can resist up to C max colluders with a probability of at least P d_all_req if the number of falsely detected colors is no greater than L FA.

4 Choosing Alphabet Size As we use the orthogonal embedding to put a desired color in a segment of multimedia, the color detection algorithm in Section 2.1 implies that the alphabet size q of the outer code determines the computational complexity in identifying suspicious color(s) from each segment [8][10]. Furthermore, the study in [4] has suggested that fingerprinting through orthogonal modulation has a fundamental limit in the number of colluders that it can resist under averaging collusion. Thus there is a limit on the number of guilty colors that we can tolerate when the system encounters averaging collusion. The overall collusion resistance is determined by the limits from both the embedding layer and the outer code layer. In view of these limits, we select the alphabet size q on the order of several dozens for the studies in this paper. 4. PERFORMANCE EVALUATION We first compare the performance of the ECC-based fingerprinting for multimedia with that of the ORTH fingerprinting under interleaving collusion. We then examine the impact of averaging collusion, as well as the resilience toward a large group of colluders. 4.1 Comparison with ORTH Fingerprinting For a fair comparison between the ECC-based fingerprinting and the ORTH fingerprinting, we choose the same values for the targeted collusion resistance C max and the total number of users N u, and apply the two fingerprinting schemes to the same host signal. To facilitate the analysis, we use i.i.d. Gaussian sequence with length N to emulate the host signal in this paper. We design the ECC-based fingerprinting system using a Reed-Solomon code with q=2 5, L=30, N s = 1000, and N u = q 2 =1024. Fig. 2 is the System Design Figures obtained from the steps in Section 2. For watermark-to-noise ratio (WNR) of -17dB (corresponding to blind detection or severe attacks) shown in Fig. 2(a), we see that the system can resist up to 5 colluders to meet the required detection probability P d_all_req in the range of , and this is achieved with codes constructed without the need of explicitly tolerating any color detection errors (i.e. L FA =0). Further, when the system is designed to achieve P d_all_req in the range of , it can resist up to 4 colluders with codes that are constructed to explicitly tolerate one color error (L FA =1). For the case of WNR = 0dB (corresponding to non-blind detection and moderate distortions) shown in Fig. 2(b), the system can resist up to 5 colluders over a wide range of required detection probability, and the codes used do not need to explicitly tolerating color detection errors (L FA =0). For the ORTH fingerprinting, we can obtain the relationship between the required detection probability P d_orth_req and C max according to the study in [4]. Fig. 3 shows the System Design Figures for the ORTH system with the same host signal length N and the total number of users N u. These are in terms of the maximum number of colluders that the system can tolerate while meeting the required colluder detection probability P all-req. Note that owing to the employment of maximum correlation detector, the false accusation probability is 1 - P all-req. The above figures indicate that for a medium-scale host signal of tens of thousands elements and a moderate user group size of about a thousand, ORTH fingerprinting can catch much more colluders than the ECC based system at the same level of colluder detection requirement. The difference in colluder resistance is one order of magnitude in the high WNR case. Several factors contribute to this performance gap. First, the two-layer design in ECC-based fingerprinting imposes structural constraints on the signal space of fingerprints. For example, the number of colors represented by orthogonal sequences is substantially smaller than in the ORTH scheme. Second, the current decoding of ECC-based fingerprinting makes a hard decision on the color values, while the ORTH detection aggregates the contribution from each part of the multimedia signal through a correlation detector and does not make hard decision until the whole signal is processed. Our preliminary test shows that soft decoding can potentially improve the detection performance of ECC fingerprinting. Furthermore, the design conditions of (4)(5)(6) for ECC fingerprinting are stronger than necessary, leading to a conservative C max. On the other hand, we note that q orthogonal sequences of length N/L is used in ECC based system, while the ORTH system requires q t mutually orthogonal sequences of length N. This suggested that the ECC based system has the advantage of providing a more compact way of representing users and consuming less resource in terms of the orthogonal sequences. Overall, the ECC-based fingerprinting is attractive for applications that have a large number of users but a very small number of colluders at a time; and the ORTH system provides better protection for applications having a larger group of potential colluders. 4.2 Resistance Against Averaging Collusion Our second performance study is on the resistance against averaging collusion by the ECC-based fingerprinting systems that primarily target at surviving interleaving collusion. We take an ECC-based fingerprinting system designed following the aforementioned procedures with the same parameters as Section 4.1, and examine its colluder detection probability P A d_all under averaging attack. The analysis for P A d_all is similar to that for the interleaving case in the Step 3 and 4 of Section 2, except that the color detection probability P d now should be derived from averaging attack and n=l-l FA. Noticing from Section 4.1 that the original system survives 5-user interleaving collusion, we examine the performance of averaging collusion with 2 to 5 colluders. The code parameter L FA is set to 2 from the results in Section 4.1. The lower bound of P A d_all from analysis is

5 (a) (a) (a) (b) (b) (b) Fig. 2 System design figures of ECC fingerprinting at WNR = -17dB(a) and WNR = 0dB (b). Fig. 3 System design figures of ORTH scheme at WNR = -17dB (a) and WNR = 0dB (b). Fig. 4 Performance of ECC fingerprinting under averaging collusion at WNR = -17dB (a) and WNR = 0dB (b). plotted numerically in Fig.4. We can see that for very low WNR in Fig.4(a), the unexpected averaging collusion has a significant negative impact on the detection performance. The system can no longer be guaranteed to meet the colluder identification requirement P d_all_req after averaging collusion. On the other hand, for moderately high WNR as in Fig.4(b), the system can resist averaging collusion and identify colluders with probability higher than the requirement. We now use simulations of 500 runs to evaluate the actual detection performance for WNR of -17dB and 0dB, respectively. For WNR = -17dB, we choose the point of (P d_all,c max, L FA ) = (0.91,5,0) from the system design figure. This indicates that the system can achieve detection probability of at least 0.91 and tolerate up to 5 colluders under interleaving attacks. The results of interleaving and averaging collusion on this system are shown in Fig. 5, along with the results by the ORTH scheme. As we can see, the system survives interleaving attacks as it is designed for, but cannot track down colluder with desired probability under averaging collusion. The actual probability of correct detection is higher than the lower bound from our analysis shown in Fig.4, but is still below the required level. On the contrary, the result confirms that the averaging and interleaving collusions have almost identical effect on the ORTH system [8]. For WNR = 0dB, we choose a working point of (P d_all, C max, L FA ) = (0.99,5,0) from the System Design Figure. Simulation results Fig. 6 show that the system can resist both interleaving collusion and averaging collusion. The different impacts by averaging collusion on the two types of fingerprinting can be explained as follows. For every media segment in ECC fingerprinting, interleaving collusion preserves a color in its entirety, while averaging collusion reduces the power of the color from each colluder. This makes colors less likely to be correctly detected under low WNR after averaging collusion. The increased color errors will be propagated to the code level and lead to performance degradation in tracing colluders. On the other hand, ORTH scheme aggregates the correlation over the entire signal. In terms of the overall fingerprint energy for each user, averaging and interleaving collusions have approximately the same effect [8]. 4.3 Performance for Colluder Number Beyond C max We note that the system design based on Theorem 1 concerns the worst-case scenario, which may not happen often in a particular realization. To explore the ECC fingerprinting s potential in collusion resistance, we examine through simulation the performance when the colluder number becomes greater than C max and compare it with ORTH under the same collusion scenario. The result of 1000 runs, shown in Fig.7, indicates that the ORTH scheme still substantially outperform the ECC-based fingerprinting. One interesting observation is that as c increases, the resistance of ECC fingerprinting against interleaving collusion decreases quickly, but it survives averaging collusion. Our study shows that this survival is contributed in part by the inherent correlation between the codewords through shared colors at some symbol positions. After

6 (a) (a) (a) (b) (b) (b) Fig. 5 Simulation results of different schemes at WNR = -17dB under interleaving(a) and averaging collusion(b). Fig. 6 Simulation results of different schemes at WNR = 0dB under interleaving(a) and averaging collusion(b). Fig. 7 Performance with increased colluder number at WNR=0dB under interleaving(a) and averaging collusion (b). averaging collusion, the colors shared among colluders are likely to be extracted by the maximum correlation detector, and these shared colors rarely appear in the innocent user s codeword. This suggests that strategically introducing correlation between fingerprints can be equally important as introducing separations. The benefit of correlation has been demonstrated by several recent non-ecc based fingerprinting schemes [7][8]. 5. CONCLUSIONS In this paper, we have examined the performance of the ECC-based multimedia fingerprinting by taking into account both coding and embedding issues. Our studies have shown that the orthogonal fingerprinting has superb collusion resistance and can catch colluders one order of magnitude more than the ECC based system, while the ECC-based fingerprinting consumes less orthogonal spreading sequences. Regarding different types of collusions, the ECC fingerprinting systems that are intended for resisting interleaving collusion is unable to resist averaging collusion under low WNR, while it can resist both averaging and interleaving collusion under high WNR. Our studies also suggest the benefit of correlation between fingerprints constructed via ECC in combating collusions. Acknowledgement This work was supported by the Air Force Research Laboratory Grant#F and the National Science Foundation Award#CCR The authors thank Dr. Z. Jane Wang of UMD for the enlightening discussions. REFERENCES [1] D. Boneh and J. Shaw, Collusion-Secure Fingerprinting for Digital Data, IEEE Tran. on Info. Theory, 44(5), [2] Y. Yacobi, Improved Boneh-Shaw Content Fingerprinting, CT-RSA 2001, LNCS 2020, pp , [3] F.Ergun, J.Kilian and R.Kumar, A Note on the limits of Collusion-Resistant Watermarks, Eurocrypt 99, [4] Z.J. Wang, M. Wu, H. Zhao, W. Trappe, and K.J.R. Liu, Collusion Resistance of Multimedia Fingerprinting using Orthogonal Modulation, submitted to Trans. on Image Proc. [5] F. Zane, Efficient Watermark Detection and Collusion Security, FC 2000, LNCS 1962, pp , 2001 [6] R. Safavi-Naini and Y. Wang, Collusion Secure q-ary Finger-printing for Perceptual Content, Security and Privacy in Digital Rights Management (SPDRM'01), pp , [7] W. Trappe, M. Wu, Z.J. Wang and K.J.R. Liu, Anti-collusion Fingerprinting for Multimedia, IEEE Transactions on Signal Processing, vol. 51, no. 4, April [8] M. Wu, W. Trappe, Z. Wang, and K.J.R. Liu, "Collusion Resistant Fingerprinting for Multimedia", to appear in IEEE Signal Processing Magazine, [9] R. Safavi-Naini and Y. Wang, Traitor Tracing for Shortened and Corrupted Fingerprints, Digital Right Management (DRM'02), pp , [10] I. Cox, J. Kilian, F. Leighton, and T. Shamoon, Secure Spread Spectrum Watermarking for Multimedia, IEEE Trans. on Image Processing, 6(12), pp , [11] J.N. Staddon, D. R. Stinson, and R. Wei, Combinatorial Properties of Frameproof and Traceability Codes, IEEE Trans. on Information Theory, vol. 47, no. 3, March 2001.