1. Electronic Watermarking Jean-Paul M.G. Linnartz Nat.Lab., Philips Research

2. Outline of Today’s Talk A quick update on security in Copy Protection More about Watermarks Watermark embedding and detection A few attacks on watermarks

3. Copyrighted content in the digital world of the future will only flow over compliant devices Compliant World All content is encrypted on all interfaces Controlled by CSS, 5C, 4C, Millennium,... Non-Compliant World All analog devices, some digital authentication encryption watermark? By licensing contract:- no unprotected output Analog Digital To avoid analog circumvention DVD ROM VHS Rush

4. Record Control; How to enforce? All licensing contracts are based on permission to PLAY BACK protected content

5. Playback only Play Ticket Playback original Copy Ticket Record Playback copy Watermarked content Electronic Authorization Ticket or Play Control : Watermark matches with valid ticket : Free-Copy: No Watermark + Copy Ticket Record / playback ONLY if or

6. Anti-Cloning: use a physical mark for discs Wobble Wobble amplitude of 30 nm (peak to peak) Encrypted content can be cloned. Store the keys as a physical id which is hard to duplicate, even in a disc press environment Catch illegal copies using play-back control

7. Generation Control Copying “in the family circle” is “fair use” German customers pay tape levies, thus buy the right to copy “Copies of copies” lead to exponential growth of copy population Without generation control With generation control

8. Re-marking: Adding a secondary watermark Primary watermark: Copy-Once STBRecorder Detect Watermark + Add Secondary watermark: Copy-No-More Player Primary + Secondary watermark: Copy-Once

9. Drive Recorder Drive TT’ is implemented as Ticket Handling Check whether TW n

10. encoder information to embed original data retrieved information marked data decoder channel (processing) received data Digital watermarking The imperceptible, robust, secure communication of information by embedding it in and retrieving it from other digital data. processed data

11. Image: p(n) + Perceptive model X Watermark: w(n) Marked Image: q(n) A simple example Pseudo- noise Seed

12. Correlation detector: matched filter Suspect Video X Reference watermark AccumulatorComparator Detection Threshold Decision Variable  Optimal detection method (under certain AWGN conditions) Detection can be executed in MPEG compressed domain.

13. Provide an additional communication channel Additional data travels with the content Imperceptibly embed information directly into original data (“host data”, “cover data”) to produce “watermarked data” Motivation for Digital Watermarking

14. Types of Watermarks Imperceptible or perceptible but unobtrusive Robust or Fragile Blind detection or detection with original Public of private detection Clear Video Marked Video Watermark Embedding Data Decision: present/absent Watermark Detection Data

15. Some Applications of Watermarking Copyright control –playback, copy-generation control (DVD, SDMI) Meta data and referral service Broadcast monitoring –check on royalty payments –commercial verification Distribution tracing –fingerprinting Proof of ownership (with zero knowledge?) Proof of authenticity

16. Watermarked data and original data should be perceptually indistinguishable Use low-amplitude modifications and/or perceptual modeling Desired Properties: Imperceptibility Original image 115 154 180 … 158 183 174 … 177 168 144 … After embedding 114 150 180 … 156 186 172 … 177 170 144 …

17. Desired Properties: Robustness Processing of the watermarked data cannot damage or destroy the embedded information without rendering the processed data useless JPEG compressionAdditive noise & clipping

18. Watermark parameters Robustness Perceptibility, transparancy Security –vulnerability to intentional attacks –Kerckhoffs’ principle Complexity Granularity Capacity, payload False Positive Rate Layering & remarking

19. Watermarking: A Multidisciplinary Field Communications Information theory Cryptography Human perception Detection theory Hypothesis testing Signal processing Data compression Multimedia processing Intellectual property Law Consumer electronics Music & film industry

20. The matched filter is optimum for AWGN channels Example of research topics 1: Prefiltering H -1 AWGN Image Watermark +HX H MF

21. Example of research topics 2: Exploiting non-stationarity Images contain areas A 0, A 0,.., A I-1, with different statistical properties –mean and variance   of luminance –spectrum of luminance –masking properties  Correlateweigh Correlateweigh Correlateweigh + f0f0 f1f1 A0A0 A1A1 Decision variable d. SNR: g d 0 = d 0,w + d 0,p d 0 f 0

22. Example of research topics 3: Correlation After FFT Detection when synchronization is unknown: d k = k ranges over [128 by 128], Computationally infeasible [d k ] = I-FFT(FFT(Q) * conj(FFT(W)) FFT(CyclicShift(W,k)) = z k FFT(W) FFTMultiplyI-FFT FFT Q W d 0 = d k =

23. Example of research topics 4: Zero-Knowledge proof of ownership Assume that Peggy wants to prove that has watermarked content, without revealing the secrets of her watermarking method. 1) she must prove that she had committed to a watermarking method in advance 2) she may just prove the presence of a watermark in a scrambled (permuted) version of the suspect image, where she reveals either the permuatation or the permuted watermark.

24. Exercise Given –watermarking scheme: q(n) = p(n) + w(n) –Watermark detection: correlation method Summarize various attacks and discuss whether the watermarking scheme is robust, or how it can be made more robust. The application of copy protection requires a very low false positive rate. How would you choose the decision threshold setting?

25. Examples of Attacks Attacks on the content – (noise addition, filtering scaling) Attacks exploiting the presence of an embedder Attack exploiting the presence of a detector Attacks on the system

26. Scrambling Descrambling Recorder Watermark detector Watermark detector Player Copyrighted Video IN Copied Video OUT Copy Protected video recorder and player Circumvention by encryption Encryption device has a legitimate purpose (privacy) Hacker can use very simple scrambling Avoid that CSS is misused to hide watermarks. It does not help to outlaw all other file formats than MPEG

27. Copyprotected content Data hiding Fake carrier Free-copy Watermark detector Recorder Watermark detector Player Extract hidden data Copy of Copyprotected content Circumvention by data hiding

28. Decision: present/absent Secret Watermark Detection Data Watermark Detector Attacks exploiting the presence of a detector: Exploiting Side Information Computation time; Frame accumulation time Reliability parameter Power consumption; CPU load

29. Attacks exploiting the presence of a detector Scenario 1: Consumer recorder / player or PC image processing application has an embedded “tamperproof” detector Scenario 2: Access to on-line watermark detector, e.g. internet service

30. Correlator detector Suspect Video X Reference watermark AccumulatorComparator Detection Threshold Decision Variable  Note the step-wise transition if the watermark is just strong enough

31. Sensitivity Attack How to...remove a watermark in N steps Take a watermarked image Take an unmarked image Combine these images, until the detector is just below threshold of making decision “present”. Now experiment pixel by pixel to see how the detector responds. This fully reveals the detector’s sensitivity to particular pixels. Subtract the pattern of pixel sensitivities Iterate if you suspect that the detector is non-linear. Key assumption: Attacker has a black-box device that detects whether a watermark is present.

32. Sensitivity Attack Abstract Mathematical Interpretation original p watermarked q 0 q 0 : test image at detection threshold w: watermark Watermark not present Watermark present Set of images that look simiar top Space of all possible images random nonmarked image

33. Countermeasure against Sensitivity Attack Suspect Video Reference watermark AccumulatorComparator Decision Variable  X y=R(q) y thr Probability Decision=“ Present ” yy thr 1 0 y 1 y 2 q w D

35. Probability Decision=“ Present ” y y 0 =R(q 0 ) 1 0 y 1 y 2 p0p0 Statistical Analysis

36. Probability Decision=“ Present ” y y i,j =R(q 0 +t j +  j ) 1 0 y 1 y 2 p0p0 y 0,j =R(q 0 +  j ) pjpj Sophisticating the Attack yy p j = p 0 +  y p’(y)

37. p j = p 0 +  y p’(y) if R(t j ) = +1 Probability of response D = 1 can be measured by repeated experiments How much information leaks? Initially, the entropy of a watermark pixel H(w(n 0 )) = 1 Mutual information I(D K ;w(n 0 )) = H(D K ) - H(D K |w(n 0 )) I(D 1 ;w(n 0 )) = h(p 0 ) - 1/2[h(p 0 +  y p’ ( y ) )+ h(p 0 -  y p’ ( y ) ) ]

38. Here, we use with We arrive at the differential equation

39. Require the leakage I to be constant over [y 1, y 2 ] yy p(y) y1y1

40. original p watermarked q Transformed copies of the watermarked image (red area) must trigger the detector (with P < P md ) Transformed version of the unmarked original (blue area) may not trigger the detector (with P < P fa ) Why are most “robust” systems vulnerable?

41. Conclusions Concept protection is critical in an economy that more and more relies on knowledge Watermarks have interesting applications Security features are different from cryptography