1. An Efficient and Anonymous Buyer- Seller Watermarking Protocol C. L. Lei, P. L. Yu, P. L. Tsai and M. H. Chan, IEEE Transactions on Image Processing, VOL. 13, NO. 12, December 2004 Multimedia Security

2. Outline Customer’s Right Problem Buyer-Seller Watermarking Protocol Unbinding Problem The Proposed Watermarking Protocol Discussion

3. Customer’s Right Problem In traditional watermarking scenarios, the seller is entitled to the responsibility of generating and inserting digital watermarks. As a result, the seller is granted access to each watermarked copy. A malicious seller can easily frame the buyer by releasing corresponding watermarked copy afterwards.

4. Memon and Wong’s Protocol B & ID B Sign WCA (E B (W)) W E B (W’)=P(E B (W)) E B (X’)=E B (X+W’)= E B (X)+E B (W’) X’=D B -1 (E B (X’)) Privacy Homomorphism

5. Memon and Wong’s Protocol

8. Unbinding Problem Failure to bind a watermark to a certain piece of content –U’=U+P 1 (W 1 ), V’=V+P 2 (W 2 ) –If Seller gets V’, P 2 (W 2 ) is available to seller. –E B (U+P 2 (W 2 )) now can be generated

9. Roles S: seller B: buyer CA: A trusted certification authority, issuing anonymous certificate WCA: a trusted watermark certificate authority ARB: arbiter

10. Notations (pk I, sk I ) : a public-private key pair for owner I (pk*, sk*): a one-time key pair Sign I (M): digital signature of message M signed by I D skI /E pkI : Decryption and encryption function X+W: watermarked version of X, + standards for watermark insertion ARG: common agreement between buyer and seller, negotiated in advance

11. Registration Protocol B first sends a randomly selected pk B to CA. When CA receives pk B,, it generates an anonymous certificate Cert CA (pk B ) and sends it back to B. The registration process can be skipped if anonymity is not a concern

12. The Proposed Protocol

13. X’=X+V E pk* (X’’)=E pk* (X’+W)=E pk* (X’)+E pk* (W) Store sales records

14. The Proposed Protocol

20. Identification and Arbitration Seller Arbiter Y, X’, Cert CA (pk B ), Cert pkB (pk*), ARG, Sign pk* (ARG), E pk* (W), E pkwca (W), Sign WCA (E pk* (W), pk*, Sign pk* (ARG)) WCA W CA Buyer using pk*

21. Solving Unbinding Problem Sign WCA (E pk* (W), pk*, Sign pk* (ARG)) explicitly binds W to ARG By introducing the one-time key pairs, it is impossible for S to fool B.

22. Accomplishment of Other Goals Buyer’s privacy is well protected by using anonymous certificate. Only one communication with seller is required for the buyer now Trusted third parties are capable of making appropriate adjudications, no cooperation from buyer is required. The WCA gets information about the digital content, thus a more robust watermark may be tailored.