Collusion Secure Fingerprinting. CMLab

Transcription

1 Collusion Secure Fingerprinting CMLab

2 2 Outline Introduction Collusion attack Collusion-resilient fingerprinting Combinatorial designed code Error correction code Orthogonal signals Research issues

3 3 Introduction Two types of fingerprinting Type I: Embed fingerprints to contents Embed Type II: Extract fingerprints from contents Extract Extract

4 4 Introduction - Type I Fingerprinting What The process of assigning a unique key for each user' s content Why To identify the person who acquired a particular copy To prevent users from destroying the identification information To trace the traitors How Watermarking the contents with the unique keys

5 5 Introduction - Type II Fingerprinting What Extract unique and robust image descriptors from contents Why For the detection of replicas For content-based image retrieval How Select the features that best describe a given content

6 6 Introduction Talk focus Type I fingerprinting Some related terms Collusion attack Traitor tracing

7 Introduction- The Future of Multimedia Security What will be the major security problem at the dawn of the 22nd century? Ans: Trust (E. J. Delp, Multimedia security: the 22nd century approach, 2005) Who and what I do trust? Is the sensor valid? Is the data valid? Has the data been modified?

8 Introduction-Fingerprinting Successful application Hollywood film industry 2004 Oscars Successfully captured a few pirates (in the voting group) leaking the movie to the market The Last Samurai Carmine Caridi Russell Internet Challenging problem Collusion attack

9 9 Introduction Collusion attack A coalition of traitors collude to destroy the identification information and leak the content (keys) Collusion attack Extraction Pirate code

10 10 Introduction Traitor tracing Find at least one of the colluders {,,,, } Can not frame innocent users {,..} Related researches: From Broadcast Encryption to Fingerprinting

11 11 Collusion attack Broadcast encryption e.g. u 1 : {k 1,k 3,k 7 } u 2 :{k 3,k 5,k 7 } pirate decoder box: {k 1,k 5,k 7 } Digital fingerprinting Linear & non-linear collusion attacks Copy-and-paste attack

12 12 Collusion attack P d of the T N statistics under different attacks Z. J. Wang, M. Wu, H. Zhao, W. Trappe, & K. J. R. Liu, 2003 #of users: 100 code length : P fp : 1% y s d x+n T N y T 2 s / d s 2

13 13 Collusion attack Analyze the statistical features to improve the detection performance H. V. Zhao, M. Wu, Z. J. Wang, & K. J. R. Liu, 2004 e.g. Observe the histograms of sample means of extracted fingerprints under the average, minimum and randomized negative attacks, respectively 2 W 1 9, M 10000, K 45

14 14 Collusion-resilient fingerprinting Boneh-Shaw scheme D. Boneh & J. Shaw, Collusion-secure fingerprinting for digital data, CRYPTO 95 Watermarking the digital data (e.g. software, documents, music, and videos) with fingerprints Based on the Marking Assumption Too long (too many keys) B. Chor et al. claimed: It is much less efficient than our schemes

15 15 Collusion-resilient fingerprinting Marking Assumption Any coalition of c users is only capable of creating an object whose fingerprint lies in the feasible set of the coalition Feasible set F( C; ) F( C; ) { w( {?}} s.t. w, u C} ( is the code, C is the collusion coalition, R is the set of undetectable positions, and w is the pirate code) e.g. A: B: F= l R w ( u) R

16 16 Collusion-resilient fingerprinting <Definition>Totally c-secure code A code is totally c -secure if thereexists a tracingalgorithm A satisfying thefollowing condition:if a coalition C users generatesa word x then A( x) C. of at most c C U x c x A UC

17 17 Collusion-resilient fingerprinting Lemma Boneh & Shaw: There are no totally c-secure codes Clearly, it is enough to show that there are no totally 2 - secure codes. let be an arbitrary ( l,n) - code let w define themajority word M (1) (1) (2) (1) (3) wi, if wi wi or wi wi (2) (2) (3) Mi wi, if wi wi?, otherwise. One can readily verify that themajority word M { u,u 1 (1) 2,w }{, u (2) 1 If is a totally c - secure code then C for all colatiitons C,w 3 (3),u }{, u }. However, theintersection of thecoalitionsis empty. by thelast lemma, thecode be threedistinct codewords assigned to users u,u,u 2,u 3 1,... C r of MAJ ( w at most (1),w (2) 1 c... C users each.,w (3) ) by Γ is not toally2 - secure. r F( C 1, respectively is feasible for all threecoalitions 1 2 )... F( C 3 r )

18 18 Collusion-resilient fingerprinting n-secure code with -error 0 (n,d): l=d(n-1)=o(n 3 log(n/ )) too long! e.g. 0 (4,3) A: Random B: permutation C: D: Given 1)if weight ( x 2) if weight( x 3)for all s l x {01},, find a subset of B 1 B ) n-1 ) d 0 then output then output 2 ton-1do :let k thecoalition that produced "user 1is guilty" "user n is guilty" weight ( x B s ). x. if weight ( x B s-1 ) k 2 k 2 log 2n then output "user s is guilty"

19 19 Collusion-resilient fingerprinting c-secure code with -error of log length (L,N,n,d) Compose 0 (n,d) with an (L,N)-code C x=((1) (2) (L)) (i) 0 0 =alphabet size of C l=o(c 4 log(n/ )log(1/ )) l Given x {01},, find a member of thecoalition that produced 1) Apply algorithm1 toeach of for each component i outputsof that y 2) Find the word of i algorithm1.set position (tiesare broken arbitrarity). 3) Let u be theuser whose codeword is derived from wc output "user u is guilty" thel componentsof x. 1,...,Larbitrarily chooseoneof y i tobe the thischosen output.note is a number between 1and n. Next,form the word y wc which matches y in themost number x. y 1...y L.

20 Collusion-resilient fingerprinting Three main trends of collusion-resilient fingerprint codes Combinatorial designed code Error correction code Orthogonal signals

21 21 Collusion-resilient fingerprinting Combinatorial designs D. R. Stinson & R. Wei, Combinatorial properties and constructions of traceability schemes and frameproof codes, 1997 Give combinational descriptions of the following two objects in terms of set systems Traceability schemes for broadcast encryption Frameproof codes for digital fingerprinting <Definition> t-(v, k,λ) design A t-( v,k,λ)design is a set system( X, B), where B k for every BB, and every t - subset of exactly blocks in B. X X v, occurs in

22 22 Collusion-resilient fingerprinting t-design (t-(v,k,)) 2-design : BIBD (Balanced incomplete block design) (9,3,1)-BIBD {0,1,6},{0,2,5},{0,3,4},{1,2,4},{3,5,6},{1,5,7}, {5,4,8},{4,6,7},{6,2,8},{2,3,7},{3,1,8},{0,7,8} e.g. J. Dittmann, P. Schmitt, E. Saar and J. Ueberberg, Combining Digital Watermarks and Collusion Secure Fingerprints for Digital Images, detecting code

23 23 Collusion-resilient fingerprinting <Definition> c-traceability Scheme (c-ts(k,n,l)) Suppose any exposed user U is produced by C and denotedby c-ts( k,n,l). C is a member of thecoalition C whenever a piratedecoder c. Then thescheme is called a c - traceability scheme and it is C U c F F <Definition> c-frame Proof Codes (c-fpc(l,n)) A ( l,n) - code Γ is called a c - frameproof code if, for every C Γ such that C c, we have F( C) Γ C. Wesay that Γ is a c-fpc( l,n). C x c

24 Collusion-resilient fingerprinting 24 <Theorem> a c-fpc(v,b) a set system( X,Β) such that B theredoes not exist a block d i1 b and for any subset of B i B d i1 B i d c B B\{B blocks 1,B 2 B,B 1,...,B 2 d X,...,B d v, B, } such that

25 Collusion-resilient fingerprinting 25 <Theorem> a c-ts( k, b,v) a set system( X,Β) such that B b and B k-subset B B\{B F,B k for every choice of 1 2 d j1,...,b for every BB, with theproperty hat t d d B j c blocks, theredoes } such that B,B 1 F B j 2,...,B d not exist a block F B X for 1 v, B and for any j d

26 Collusion-resilient fingerprinting <Theorem>If there exists a c-ts(k,b,v), then there exists a c-fpc(v,b). <proof> Let ( X, Β) be We provethat ( Suppose and a Then block theset system corresponding toa c-ts( k,b,v). no; then there exist B B B Β\{B j X, Β) is a c-fpc( v,b). 1 B B, B 2 d,..., B for 1 26 d j c blocks, d. B, B 1 } such that B 2,..., B d i1 d B i B,.

27 27 Collusion-resilient fingerprinting Theorem t where c where c ( k <Theorem> v ( k Theorem t ( v, k,1)design 1) /( t 1) /( t 1) ( v, k,1)design 1) c-fpc( v,( c-ts ( k,( 1,3mod6 2 FPC( v, v( v 1) / 6) ) /( v 1,4 mod12 3 FPC( v, v( v 1) /12) v 1,5 mod20 4 FPC( v, v( v 1) / 20) v t v t ) /( k t k t )), ), v), <Theorem> primepower q 2 2 q TS ( q 1, q q 1, q q 1) It needs tricks to construct a suitable code

28 Collusion-resilient fingerprinting Error correcting code (ECC) Field A field F is a set that has two operations defined on it: addition and multiplication, such that the following axioms are satisfied. The set is an abelian group under addition The field is closed under multiplication, and the set of nonzero elements is an abelian group under multiplication The distribution law (a+b)c=ac+bc holds for all a, b, c in the field (An abelian group, also called a commutative group, is a group satisfying the requirement that the product of elements does not depend on their order)

29 Collusion-resilient fingerprinting Galois field A field with q elements Denoted by GF(q) The smallest field Must have zero and one GF(2)

30 Collusion-resilient fingerprinting A linear code is a subspace of GF(q) n The theory of vector spaces can be used to study these codes Any set of basis vectors for the subspace can be used as rows to form a k n matrix G called the generator matrix of the code The row space of G is the linear code C, any codeword is a linear combination of the rows of G The set of q k codewords is called an (n,k) linear code The dimension of the whole space GF(q) n is n There are q k codewords

31 Collusion-resilient fingerprinting Encoding Any one-to-one paring of k-tuples and codewords can be used as an encoding procedure c=ig c: codeword i: information word G: generator matrix

32 Collusion-resilient fingerprinting Example G i c ig

33 Collusion-resilient fingerprinting parity-check matrix H A generator matrix of C s dual code H T C=0 e.g. H specifies that for each codeword, digits 1 and 2 should sum to zero and digits 3 and 4 should sum to zero

34 Collusion-resilient fingerprinting G I P k T H [ P I ] nk G H Hx = 0 xc the syndrome of the received z = x + e is defined to be: Hz = H(x + e) = Hx + He = 0 + He = He

35 Collusion-resilient fingerprinting Syndrome decoding Syndrome Coset Leader 0: e 1 : e 6 : e e e e e e e 1 +e 4, e 2 +e 5, e 3 +e 6

36 36 Collusion-resilient fingerprinting Error correcting code (ECC) Has systematic encoding and decoding algorithms Distance-based decoding criterion Resilient to attacks for multimedia data Robust than the t-design codes

37 37 Collusion-resilient fingerprinting <Definition> c-ta codes (c-traceability codes) A code C if w desc( C for all z C C <Theorem> is a c - TA code if i ) then there exists i C i x for all coalitionsc c x C w i such that i of size at most c, I( x,w) z I( z,w) Suppose that C is an ( l,n) - code having minimum Hamming distance d l(1-1/c 2 ).Then C is c - TA code. Larger minimum distances imply higher tracing ability Unfortunately, it s not easy to find practical ECCs with so large minimum distances!!

38 38 Collusion-resilient fingerprinting e.g. 2-TA: (15,3,11) 4 -BCH (120,2,96) 4 -code It s not easy to find practical ECCs with so large minimum distances Reed-Solomon code (l,k,d)-rs over GF(q m ) : d=l-k+1=q m -1-k+1=q m -k A code for sequential traitor tracing R. Safavi-Naini & Y. Wang, 2003 ( Tr( x s 1 ), Tr( x s 2 ),..., Tr( x s q k )) k * GF( q ), { 1, 2,..., q} k / 21 k 2 t, s q,and r such that ( Tr( x) r t, q r x x q x q (mod s) x q k )

39 39 Collusion-resilient fingerprinting Assign one of the q versions for each movie segment (q-ary code) H. Jin, J. Lotspiech, & S. Nusser (IBM Almaden research), 2004

40 40 Collusion-resilient fingerprinting Orthogonal signals W. Trappe, M. Wu, Z. J. Wang, and K. J. R. Liu, Anti-collusion fingerprinting for multimedia, 2003 Orthogonal fingerprint Orthogonal modulation w j =u j # of fingerprints=# of ortho. bases Modulate the code based on BIBD by noiselike signals w j B i1 b ij u i # of fingerprints>># of orthogonal bases

41 41 Collusion-resilient fingerprinting <Theorem> Let (X,A) be a (v,k,1)-bibd and M the corresponding incidence matrix. If the codevectors are assigned as the bit complement of the columns of M, then the resulting scheme is a (k-1)-resilient AND-ACC. (7,3,1)-BIBD {{0,1,3},{0,2,5},{0,4,6},{1,2,4},{1,5,6},{2,3,6},{3,4,5}}

42 42 Collusion-resilient fingerprinting The bit-complement of the incidence matrix for a (7,3,1)- BIBD Modulate the codewords by 7 orthogonal bases

43 43 Collusion-resilient fingerprinting If user 1 and user 2 are colluders Average attack: the pirate code is (w 1 +w 2 )/2 The coefficient vector is (-1,0,0,0,1,0,1) 1 occurs in the fifth and seventh location uniquely identifies users 1 and 2 as colluders Experiments (16,4,1)-BIBD 20 users c=3

44 44 Collusion-resilient fingerprinting Tree-structured detection T N y T s U i 2 / d su i 2

45 45 Collusion-resilient fingerprinting Orthogonal signals Z. J. Wang, M. Wu, H. Zhao, W. Trappe, and K. J. Liu, 2003~ Gaussian signals (suitable for multimedia content) Performance is limited if the number of Gaussian signals is larger

46 46 Collusion-resilient fingerprinting Joint fingerprint embedding and decryption based on coefficient set scrambling D. Kundur & K. Karthik, 2004

47 47 Collusion-resilient fingerprinting PSNR=22dB Original, encrypted, and fingerprinted images PSNR=34dB

48 48 Collusion-resilient fingerprinting Make the colluded copy useless U. Celik, G. Sharma, & A. M. Tekalp, Collusion-resilient fingerprinting by random pre-warping, 2004 The host signal is warped randomly prior to watermarking

49 Collusion-resilient fingerprinting 49

50 50 Collusion-resilient fingerprinting Fingerprint multicast in secure video streaming H. V. Zhao & K. J. R. Liu, 2006 Tree-structure-based fingerprint scheme

51 51 Collusion-resilient fingerprinting MPEG-2-based joint fingerprint design and distribution scheme for video on demand applications The fingerprint embedding and distribution process at the server s side

52 Collusion-resilient fingerprinting 52 Hierarchical traceability code Y. T. Lin & J. L. Wu, w 0 w 1 w b- w 0 w... 1 w b Fingerprint-segment 1 (fs 1 ) Fingerprint-segment 2 (fs 2 )... Fingerprint-segment h (fs h ) b 1 u x b The fingerprint of u x is w 0 w i1 w i2 w i3 w i4 w 1

53 Collusion-resilient fingerprinting 53 Discriminate different groups Pseudorandomly modulate each group by a different sequence w i w i w... i group group group 2 j s j j, b level 1 level 2... level j level h ( ) w 1 w 2 b j Group b j w b w b w 1 w 2. Group 4. w 1 w 2 Group 3 s j,4 ( ) w b w 1 w 2 Group 1 w 1 w 2 Group 2 w b s j,1 ( ) s j,2 ( ) w b s j,3 ( )

54 54 Collusion-resilient fingerprinting Traitor-within-traitor behavior forensics H. V. Zhao & K. J. R. Liu, 2006 Investigate the precollusion processing strategies for selfish colluders to minimize their risk

55 55 Collusion-resilient fingerprinting Traitor-within-traitor behavior forensics

56 56 Collusion-resilient fingerprinting Traitor-within-traitor behavior forensics

57 57 Collusion-resilient fingerprinting Concatenated collusion-secure code Y. T. Lin & J. L. Wu, 2007 Outer code: resisting collusion attacks Inner code: satisfying the Strict Marking Assumption codeword 1 codeword 2 codeword i The outer code... codeword 1 codeword 2 codeword q The inner code... codeword n o... The ith outer codeword... A q-ary symbol... Each q-ary symbol is encoded by the inner code One example of the nested codewords

58 58 Collusion-resilient fingerprinting Outer code: encoding group numbers Inner code: encoding member numbers and symbols Group # Codeword g The octal outer code q Member # m The binary inner code e.g. g=1 m=2 outer code

59 59 Collusion-resilient fingerprinting Video fingerprinting for large user group S. He & M. Wu, 2007 A small (the correlation between fingerprint sequences), i.e. a large minimum distance, leads to higher detection accuracy

60 60 Collusion-resilient fingerprinting Two schemes ECCFP with building-block Video Group of frames Directly apply ECCFP q-ary symbol Embedding Permuted subsequences embedding (PSE) Binary symbol

61 61 Collusion-resilient fingerprinting Collusion resistance under interleaving collusion (copy-and-paste attack) Outer code: RS (62,2,61) 64 for 64 2 users Inner code: RS (6,2,5) 8 for 64 symbols

62 Collusion-resilient fingerprinting Collusion-resistant video fingerprinting based on temporal oscillation Y. T. Lin, C. H. Hwang, & J. L. Wu, 2008 Protect the traceable code Make the colluded version of the video useless

63 Collusion-resilient fingerprinting Original video Shot change detection Curve fingerprints producing Motion analysis Spatial warping Temporal fingerprint embedding Traceability code embedding Traceability fingerprint Fingerprinted video

64 Collusion-resilient fingerprinting Oscillation User1: User2: User3: User4: Number of colluders f ( i) f ( i 1) Average attack (PSNR) i 2 Oscillation= f() i, where f(i) is the i embedding curve function Copy-and-paste attack (Oscillation) db db db

65 Collusion-resilient fingerprinting Fingerprinting while demodulating S. Lian & Z. Wang, 2008 The multimedia content is modulated by pseudorandom sequences at the server side The encrypted content is then demodulated under the control of the fingerprint code at the customer side

66 Collusion-resilient fingerprinting Fingerprinting while demodulating

67 67 Research issues Collusion-resilient fingerprint scheme Robust against collusion attacks Fingerprint - Hard to be removed by collusion attacks Content - Useless after being attacked Traceability code Short l Large n Large c Tracing algorithm & detection strategy High hit ratio Low false alarm rate Fast Low computational overhead Applications Broadcast environment Streaming data

68 68 Collusion-resilient fingerprinting Dan Boneh Associate Professor, Computer Science and Electrical Engineering, Stanford University.

69 69 Collusion attack K. J. Ray Liu Min Wu Z. J. Wang H. V. Zhou