Embed Size (px)
Citation preview
ANONYMOUS BUYER-SELLER WATERMARKING PROTOCOLWITH ADDITIVE HOMOMORPHISM
Mina Deng, Li WengIBBT-COSIC, K.U.Leuven, ESAT/SCD, Kasteelpark Arenberg 10, bus 2446, B-3001 Leuven-Heverlee, Belgium
[email protected], [email protected]
Bart PreneelIBBT-COSIC, K.U.Leuven, ESAT/SCD, Kasteelpark Arenberg 10, bus 2446, B-3001 Leuven-Heverlee, Belgium
Keywords: Security, Watermarking protocol, E-Commerce, Cryptography
Abstract: Buyer-seller watermarking protocols integrate multimedia watermarking and fingerprinting with cryptogra-phy, for copyright protection, piracy tracing, and privacy protection. We propose an efficient buyer-sellerwatermarking protocol based on dynamic group signatures and additive homomorphism, to provide all therequired security properties, namely traceability, anonymity, unlinkability, dispute resolution, non-framing,and non-repudiation. Another distinct feature is the improvement of the protocol’s utility, such that the doublewatermark insertion mechanism is avoided; the final quality of the distributed content is improved; the com-munication expansion ratio and computation complexity are reduced, comparing with conventional schemes.
1 INTRODUCTION
Today’s fast growing information technology permitsperfect duplication and cheap distribution for digi-tal works. The problems associated with intellectualproperty protection have become important issues. Inthe realm of security, encryption and digital water-marking are recognized as promising techniques forcopyright protection. Encryption is to prevent unau-thorized access to a digital content. The limitationis that once the content is decrypted, it doesn’t pre-vent illegal replications by an authorized user. Dig-ital watermarking, complementing encryption tech-niques, provides provable copyright ownership by im-perceptibly embedding the seller’s information in thedistributed content. Similarly, digital fingerprintingis to trace and identify copyright violators by embed-ding the buyer’s information in the distributed con-tent.
The literature of fingerprinting research can becategorized as fingerprinting for generic data, e.g. c-secure fingerprinting code by Boneh et al. (Bonehand Shaw, 1995), fingerprinting for multimedia data(Wang et al., 2005; Trappe et al., 2003; Liu et al.,2005), and fingerprinting protocols, e.g. the onesbased on secure two-party computations (Pittzmannand Schunter, 1996; Pfitzmann and Waidner, 1997)
or based on coin-based constructions (Pfitzmann andSadeghi, 1999; Pfitzmann and Sadeghi, 2000; Ca-menisch, 2000). The shortcoming of these finger-printing schemes lies in the inefficiency of the im-plementations (Ju et al., 2002). On the other hand,the literature can also be categorized as as symmet-ric schemes, asymmetric schemes, and anonymousschemes. In symmetric schemes (Blakley et al., 1985;Boneh and Shaw, 1995; Cox et al., 1997), both theseller and the buyer know the watermark and the wa-termarked content. As a consequence, it is possi-ble for a malicious seller to frame an innocent buyer,or for an accused buyer to repudiate the guilt. Thiscustomer’s rights problem in symmetric schemes wasfirst pointed out by Qiao and Nahrstedt (Qiao andNahrstedt, 1998), and the problem can be solved byasymmetric schemes (Pittzmann and Schunter, 1996;Pfitzmann and Waidner, 1997; Biehl and Meyer,1997), where only the buyer can obtain the exact wa-termarked or fingerprinted copy, and hence the buyercannot claim that an pirated copy was originated fromthe seller. When a pirated copy is found, the seller isable to obtain a means to identify and prove the copy-right violation to a trusted third party. Moreover, inorder to provide the buyer’s anonymity, anonymousschemes (Pfitzmann and Sadeghi, 1999; Pfitzmannand Sadeghi, 2000) further make use of a registration
service to eliminate the need of exposing the buyer’sidentity to the seller.
A buyer-seller watermarking protocol combinesencryption, digital watermarking, and fingerprinting,in order to ensure copyrights protection, privacy, andsecurity for both the buyer and the seller simultane-ously in e-commerce. A buyer-seller watermarkingprotocol should provide the following security prop-erties (Jae-Gwi Choi, 2003; Goi et al., 2004), as thestrategic design principle:Traceability: A copyright violator should be able tobe traced and identified.Non-framing: Nobody can accuse an honest buyer.Non-repudiation: A guilty buyer cannot deny his re-sponsibility for a copyright violation caused by him.Dispute resolution: The copyright violator should beidentified and adjudicated without him revealing hisprivate information, e.g. private keys or watermark.Anonymity: A buyer’s identity is undisclosed untilhe is judged to be guilty.Unlinkability: Nobody can determine whether thedifferent watermarked contents are purchased by thesame buyer or not.
In the literature of buyer-seller watermarking pro-tocols, the first known asymmetric buyer-seller wa-termarking protocol was introduced by Memon andWong (Memon and Wong, 2001) by applying pri-vacy homomorphic cryptosystems, and it was ex-tended by Ju et al. (Ju et al., 2002). Since theintroduction of the concept, several alternative de-signs have been proposed (Jae-Gwi Choi, 2003; Goiet al., 2004; Lei et al., 2004; Zhang et al., 2006;Ibrahim et al., 2007). Choi et al. (Jae-Gwi Choi,2003) pointed out the conspiracy problem in (Memonand Wong, 2001; Ju et al., 2002), where a maliciousseller can collude with an untrustworthy third party tofabricate piracy to frame an innocent buyer. Goi etal. (Goi et al., 2004) found the conspiracy problemcouldn’t be solved through commutative cryptosys-tems in (Jae-Gwi Choi, 2003). Lei et al. (Lei et al.,2004) addressed the unbinding problem in (Memonand Wong, 2001; Ju et al., 2002; Jae-Gwi Choi, 2003;Goi et al., 2004) and provided a mechanism to binda specific transaction of a digital content to a spe-cific buyer, such that a malicious seller cannot trans-plant the watermark embedded in a digital content toanother higher-priced content. Zhang et al. (Zhanget al., 2006) presented a scheme, derived from (Leiet al., 2004), where no trusted third party (TTP) isrequired in the watermark generation phase and theconspiracy problem is solved. Unfortunately, we findthe existence of dispute resolution problem: in (Zhanget al., 2006), in order to resolve disputes the buyeris required to cooperate and reveal his secret key or
his secret watermark to the judge or to the CA, whichis unrealistic in real-life applications. Ibrahim et al.(Ibrahim et al., 2007) recently proposed a schemeclaiming that all the above problems has been solved.
1.1 Our Contributions
We propose a new anonymous buyer-seller water-marking protocol to fulfill the design requirements.Different from the predecessors, our approach makesimprovements on the following aspects:With group signatures and anonymous commu-nication channel. The essential mechanism fortraceability, anonymity and unlinkability is to de-ploy a group signature in the protocol’s applicationlayer. Besides, an anonymous communication chan-nel enables both anonymous outgoing connectionsand anonymous hidden services. We assume that apublic key infrastructure PKI is available, such thateach party has a public and private key pair certifiedby the CA. The CA is trustworthy and maintains thelink between the buyer’s private key and identity.Support multi-transactions and dispute resolution.The buyer is only required to interact with the CAprior to transactions, and with the seller during mul-tiple transactions, hence no third party is involved. Ajudge can recover the identity of an adjudicated guiltybuyer without the buyer actively participating in thedispute resolution process.Avoid double watermark insertion. Existingschemes all require double watermark insertions, andit has the drawback to cause a degradation of the fi-nal quality of the distributed contents, thus end upreducing their commercial value. When applied in-dependently, the second watermark could confuse ordiscredit the authority of the first watermark, thus act-ing as an actual ”ambiguity attack” (Frattolillo, 2007).We avoid it by designing a composite watermark,which is composed of the buyer’s secret watermark,the seller’s secret watermark, and a transaction index.Not limited to linear watermark. The proposed pro-tocol is not limited to linear or permutation tolerantwatermarks. As long as privacy homomorphism ispreserved, any types of watermarking schemes can beadopted.
The rest of the paper is organized as follows.Some cryptographic primitives are reviewed in Sect.2. A generalized model of anonymous buyer-sellerwatermarking protocol is defined in Sect. 3. The pro-posed protocol is explained in in Sect. 4. An exampleof the proposed scheme is illustrated in Sect. 5. Thesecurity analysis is provided in Sect. 6. Sect. 7 pro-vides a conclusion.
2 CRYPTOGRAPHICPRIMITIVES
2.1 Privacy Homomorphism
A privacy homomorphism refers to a cryptosystemE which is homomorphic with respect to some bi-nary operators ¯M in the plaintext space M and¯C in the ciphertext space C , such that ∀m1,m2 ∈M : E(m1 ¯M m2) = E(m1)¯C E(m2). Homomor-phic cryptosystems can be classified as two groups,namely the ones whose security relies on the ”de-cisional composite residuosity assumption” (DCRA),and the ones of the ElGamal class based on ”de-cisional Diffie-Hellman assumption” (DDH). Thestrongest security level a privacy homomorphism canreach is IND-CPA, instead of IND-CCA2. For in-stance, the deterministic RSA cryptosystem (Rivestet al., 1978) and the ElGamal cryptosystem (ElGa-mal, 1985) are multiplicative privacy homomorphism.In contrast to deterministic RSA, ElGamal is IND-CPA. The Goldwasser-Micali cryptosystem (Gold-wasser and Micali, 1982), the Paillier cryptosys-tem (Paillier, 1999), and Paillier’s generalization theDamgard-Jurik cryptosystem (Jurik, 2001) are addi-tive privacy homomorphism.
2.2 Group Signature
Group signatures (Chaum and van Heyst, 1991; Ca-menisch and Stadler, 1997), enable group members,each with its own private signature key to producesignatures on behalf of the group. Group signatureschemes can be either static or dynamic. Dynamicschemes allows to update group members with time,with the advantage that instead of assigning a highlevel of trust to a single group manager, the groupmanager is separated as an issuer and an opener. Thisprovides more security with a lower level of trust. Thesecurity properties of group signatures are formallyproved in (Bellare et al., 2003; Bellare et al., 2005):Anonymity allows group members to create signa-tures anonymously, such that it is hard for an adver-sary, not in possession of the group manager’s open-ing key to recover the identity of the signer.Traceability permits the signer’s anonymity to be re-voked by the group manager in case of misuse, andensures that no colluded group members can createunverifiable signatures, or signatures that can’t betraced back to some member of the coalition.Non-frameability requires that no adversary can pro-duce a signature in the name of a user unless the latterindeed produced it.
2.3 Verifiable Encryption
Verifiable encryptions (Camenisch and Shoup, 2003)can prove that a plaintext satisfies certain propertieswithout compromising the secrecy. The applicationsinclude escrow schemes (Young and Yung, 1998;Poupard and Stern, 2000), group signature and iden-tity escrow (Ateniese et al., 2000; Kilian and Petrank,1998), and digital payment with revocable anonymity(Frankel et al., 1996; Camenisch et al., 1996). In theproposed protocol, a verifiable encryption is appliedfor key escrow of the buyer’s private key.
3 MODEL OF ANONYMOUSBUYER-SELLERWATERMARKINGPROTOCOLS
Let X0 ∈ {0,1}∗ be the cover data, X be the set ofall watermarked copies of X0, and k be a security pa-rameter as a common input for all algorithms. Ananonymous buyer-seller watermarking protocol in-volves four parties: a seller Alice A that is the copy-right holder, a buyer Bob B , a certificate authority CAthat functions as a group manager, and a judge J thatadjudicates lawsuits against the infringement of copy-rights. The protocol consists of the following threesubprotocols.Reg-BRC: The registration protocol consists of analgorithm Set-RC and a protocol Reg . Set-RC is aprobabilistic key setup algorithm to generate groupmanager’s public key gpk and private keys (ok, ik)of the CA. Reg is a probabilistic two-party protocol(Reg-RC, Reg-B) between the CA and B . Theircommon input are B’s identity B and gpk. The CA’ssecret input is (ok, ik). B’s output is his private groupsignature key gskB. The CA stores B’s group certifi-cate certB and the buyer’s identity B in a registrationtable as reg[B].WK-BS: A two-party protocol (WK-S,WK-B) betweenA and B . Their common input is gpk. A’s secretinput are the cover data X0 and a transaction numberφ, and A’s output is a transaction record in TableA.B’s secret input is B’s group signature key gskB, andB’s output is a watermarked copy X
′ ∈ X.Arb-SJRC: A three-party protocol (Arb-S, Arb-J,Arb-RC ) among A , J , and the CA. A and J ’s input area pirated copy Y ∈ X, the cover data X0, and a recordin TableA. The CA’s input are (gpk,ok, ik) and thelist of certB’s in reg. The CA’s output is the identityid of a guilty buyer with a proof τ. J verifies τ andprovides A the output as id or an empty string ε in
case of failure.Note that the registration protocol Reg-BRC is re-
quired to be performed once in the setup-phase by theCA for each new buyer. The watermarking protocolWK-BS should be executed multiple times for multi-ple transactions between the buyer and the seller. Thearbitration protocol Arb-SJRC is executed for disputeresolution.
4 PROPOSED SCHEME
In this section, we elaborate on the three subproto-cols. We assume the CA is trustworthy and consistsof a group key generator, an issuer for group memberjoining, and an opener for group signature opening.Note that the security of the protocol depends on thesecurity of the underlying watermarking and crypto-graphic building blocks. Therefore, the watermarkingscheme employed is required to be collusion resis-tant. In particular, no colluded parties can remove ortamper the watermarking scheme, and nobody is ableto detect and delete the embedded watermark from acontent without knowing the watermark. As an ex-ample, we choose to employ Bellare et al.’s dynamicgroup signature (Bellare et al., 2005), and Camenischet al.s verifiable encryption scheme (Camenisch andDamgard, 1998) for the key escrow of the buyers pri-vate key at the CA. For consistency, we assume thedigital content is a still image, although the protocolcan be applied to other data format such as audio orvideo. An example of the proposed protocol with anadditive homomorphism and a watermarking schemewill be provided in Sec. 5. Notations are depicted inTable 1.
4.1 Registration Protocol
The registration protocol performed between thebuyer B and the CA is depicted in Fig.1.
The CA executes the group-key generation algo-rithm GKg to produce the group public key gpk, theissuer key ik, and the opener key ok. Then B beginswith the user-key generation algorithm UKg to obtaina public and private key pair (upkB,uskB).
To join the group, B generates a key pair(skB, pkB), signs pkB with uskB resulting sigB, andsends (pkB,sigB) to the issuer of the CA. If sigB isverified, the CA issues B a certificate certB of pkBand B’s identity B. Then (pkB,sigB) are stored ina registration table as reg[B], and sigB can be usedlater by the opener to prove group opening claims.Otherwise, the issuer returns an empty string ε andthe protocol halts. Upon receiving certB, B generates
Table 1: Notations and abbreviations.
B Buyer’s identification informationX0 Original contentX The set of watermarked content of X0
X′
A watermarked content of X0, X′ ∈ X
Det (X0,Y ) Non-blind watermark extractionARG An agreement between the buyer and
the seller that uniquely binds the par-ticular transaction to X
Epki(·) Encryption with the public key of iDski(·) Decryption with the private key of i(pkB,skB) B’s verification key and signing key
used in the group joining phasesigB B’s signature to pkB signed with upkBcertB The certificate for B from the issuer
signed to B and pkB with the issuer keygskB B’s group signature key assigned by the
issuerreg[i] The registration table reg populated by
the issuer and read-accessed by theopener to store the registration infor-mation of group member i
(pk∗B,sk∗B) B’s one-time anonymous public privatekey pair for each transaction
GSig The group signing algorithmGVf The group signature verification algo-
rithmOpen The opening algorithmJudge The judge algorithm1k For k ∈ N, the string of k ones.µ B’s signature to pk∗B using his private
group signature key gskBλ B’s signature of message m, m ←
(pk∗B,µ,ARG,ewB, p fsk∗B ,Eesc)Eesc, p fsk∗B B’s key escrow cipher EpkGA(sk∗B) and
its proofWA The one-time watermark generated by
the seller in each transactionWB The one-time fingerprint generated by
the buyer in each transactionφ The transaction index of A’s record in
TableAε Empty string
his private group signature key gskB from the tuple(B, pkB,skB,certB).
Certificate authority (CA) Buyer (B)
1. group key generation SecureChannel¾ - 2. user key generation
(gpk,ok, ik)← GKg (1k) (upkB,uskB)← UKg (1k)
3. group joining Vf (upkB, pkB,sigB) = 1 pkB,sigB¾ (pkB,skB)← Ks(1k), sigB ← Sig uskB (pkB)
certB ← Sig ik(B, pkB), reg[B]← (pkB,sigB)
else certB ← ε certB - gskB ← (B, pkB,skB,certB)
Figure 1: The registration protocol Reg-BRC performed between the buyer B and the certificate authority CA.
4.2 Watermark Generation AndEmbedding Protocol
The protocol can be executed multiple times formulti-transactions between the seller A and the buyerB , as depicted in Fig.2. A and B first need to nego-tiate a purchase agreement ARG on rights and obliga-tions as well as the specification of the digital contentX0.
B first generates a one-time anonymous key pair(pk∗B,sk∗B). Then B applies the group signing algo-rithm GSig to create a signature µ to pk∗B with hisgroup signature key gskB and the group public keygpk, as µ = GSig (gpk,gskB, pk∗B). Next, B computesan escrow cipher Eesc = EpkRC(sk∗B) to recover sk∗Bfrom the CA in case of disputes. The verifiable proofp fsk∗B assures A that the cipher Eesc is valid with-out compromising the secret key sk∗B. B then gener-ates the buyer’s secret watermark WB, in compliancewith the features of X0 for robustness, and encryptsWB with pk∗B as ewB = Epk∗B(WB). Finally, B sends(pk∗B,µ,ARG,ewB, p fsk∗B ,Eesc) with his signature λ toA .
After A executes the group signature verificationalgorithm GVf to check the validity of B’s group sig-nature µ using gpk, she generates the seller’s uniquewatermark WA, and an index φ to locate this trans-action record in TableA. Let WAB = WA +WB, W =WAB + φ2n. W consists of the n-bit WAB and the `-bitφ. W can be decomposed into `+ n binary numbers,with Wi,WABi,φi ∈ {0,1}, satisfying:
W =n+`−1
∑i=0
Wi2i =n−1
∑i=0
WABi2i +n+`−1
∑j=n
φ j2 j (1)
WAB =n−1
∑i=0
WABi2i (2)
φ =`−1
∑j=0
φ j2 j (3)
A performs the watermark embedding in the en-crypted domain by applying additive homomorphism.Let E(·) denote Epk∗B(·), we have:
E(W ) = E(WA +WB +φ2n)= E(WA) ·E(WB) ·E(φ2n) (4)
E(X′) = E(X0)⊗E(W ) = E(X0⊕W ) (5)
Thereafter, A stores (φ,m,λ,WA) in TableA, and de-livers Epk∗B(X
′) to B . As a result, B obtains the water-
marked content X′
by decryption Dsk∗B(Epk∗B(X′)).
4.3 Identification And ArbitrationProtocol
The identification and arbitration protocol, executedamong the seller A , the judge J , and the CA, is de-picted in Fig. 3.
Once a pirated copy Y of X0 is found, A extractsthe watermark U from Y and retrieves the most sig-nificant ` bits of U as the index φ′ in order to searchthe TableA. It is accomplished by choosing the valueφ from TableA that is most correlated with φ′ . Afterthat, A provides the collected information to J .
If λ is verified with the provided key pk∗B, J sendsthe escrow cipher Eesc to the CA. Otherwise, the pro-tocol halts. Next, the CA decrypts Eesc to recoverthe suspected buyer’s private key sk∗B = DskRC(Eesc),and sends EpkJ (sk∗B) back to J . J recovers sk∗B =DskJ (EpkJ (sk∗B)), WB = Dsk∗B(ewB), and calculates WABfrom WA and WB provided by A . On the other hand,J extracts the watermark U
′from the pirated copy Y
and retrieve the n least significant bits of U′as W
′AB. If
W′AB and WAB match with a high correlation, the sus-
pected buyer is proven to be guilty. Otherwise, thebuyer is innocent. Note that until now, the buyer hasstayed anonymous.
To recover the buyer’s identity, J orders theopener of the CA to execute the group signature openalgorithm Open , using its opener key ok and the reg-istration table reg, to retrieve the identity B with aclaim proof τ. J verifies B and τ with the group sig-nature judging algorithm Judge . If verified, J closesthe case and adjudicate that the buyer B with identityB is guilty. Otherwise, the protocol halts.
Seller (A) Buyer (B)
ARG¾ - 1. (pk∗B,sk∗B)← KB(1k), µ = GSig (gpk,gskB, pk∗B)
Eesc = EpkRC (sk∗B), Vf (p fsk∗B,Eesc)
2. GVf (gpk,(pk∗B,µ)), Vf (λ, pk∗B),Vf (p fsk∗B,Eesc) m,λ¾ generate WB,ewB = Epk∗B
(WB), m← (pk∗B,µ,ARG,ewB, p fsk∗B,Eesc), λ = Sig sk∗B
(m)
generate WA,φ, WAB ← (WA,WB),W ← (WAB,φ)
ew = Epk∗B(X′) = Epk∗B
(X0⊕W ), TableA ← [φ,m,λ,WA]Epk∗B
(X′)- 3. get X
′with sk∗B
Figure 2: The watermark generation and embedding protocol WK-BS performed between the seller A and the buyer B .
Seller (A) Judge (J ) Certificate authority (CA)
1. U ← Det (X0,Y ), φ′ ←U [TableA]Y¾ - 2. Vf (λ, pk∗B) Eesc - 3. sk∗B = DskRC (Eesc)
4. WB = Dsk∗B(ewB), WAB ← (WA,WB)
EpkJ (sk∗B)¾W′AB ← Det (X0 ,Y ), W
′AB
?= WABµ, pk∗B- 5. open group signature
B¾ 6. Judge (gpk,B,upk[B], pk∗B,µ,τ) B,τ¾ (B,τ)← Open (gpk,ok,reg, pk∗B,µ)
Note: µ = GSig (gpk,gskB, pk∗B)
Figure 3: The copyright violator identification and arbitration protocol Arb-SJRC performed among A , J , and the CA.
5 SCHEME EXAMPLE
In this section, we provide an example of the pro-posed protocol and employ the additive homomor-phism of Damgard-Jurik cryptosystem (Jurik, 2001)and the watermarking scheme by Kuribayashi andTanaka. (Kuribayashi and Tanaka, 2005). Note thatanti-collusion fingerprintings by Wu et al. (Wanget al., 2005; Trappe et al., 2003; Liu et al., 2005) canbe applied for the coding of watermark values, in or-der to prevent complete removal or tampering of thewatermarking by colluded parties. In this section, wefocus on the watermarking embedding and detectionscheme, but we will not explain anti-collusion finger-prints further.
The probabilistic encryption function ofDamgard-Jurik cryptosystem (Jurik, 2001) isE :G→ Z∗ns+1 , with Z∗ns+1
∼=G×H, G a cyclic groupof order ns, and H ∼= Z∗n. Choose an RSA modulusn = pq and s ∈ N. Choose λ = lcm(p− 1,q− 1);g ∈ Z∗ns+1 such that g = (1 + n) jx mod ns+1 forgcd( j,n) = 1 and x ∈ H; d mod n ∈ Z∗n and d ≡ 0mod λ (using the Chinese Remainder Theorem). Thepublic key is (n,g), the private key is d. Given aplaintext m ∈ Zns , choose a random r ←R Z∗ns+1 ,and the ciphertext is c = gmrns
mod ns+1. Indecryption, given a ciphertext c, first computecd mod ns+1 = (1+n) jmd mod ns
. Let L(b) = (b−1)/n,and jmd is obtained by applying a recursive versionof Paillier’s decryption scheme (Paillier, 1999). Sincejd is known, m = ( jmd).( jd)−1 mod ns.
The watermark W = WB +WA + φ2n is a binaryvector W = {w1,w2, ...,wm}, with wi = wBi + wAi +φi2n ∈ {0,1}. Note that in order to be collusion re-
sistant, W is embedded into m low frequency DCTcoefficients {x1,x2, ...,xm} of the host image by thefollowing basic steps:1. Divide the image into 16× 16 non-overlapping
blocks;2. Transform each block by two-dimensional DCT;3. Quantize each block;4. Embed the watermark by adjusting least signif-
icant bits of chosen DCT coefficients in eachblock;
5. Inverse transform each block.The 16× 16 quantization matrix Q is expanded fromthe 8×8 JPEG quantization matrix:
q =
16 11 10 16 24 40 51 6112 12 14 19 26 58 60 5514 13 16 24 40 57 69 5614 17 22 29 51 87 80 6218 22 37 56 68 109 103 7724 35 55 64 81 104 113 9249 64 78 87 103 121 120 10172 92 95 98 112 100 103 99
.
q is first expanded to an 8×16 matrix b in horizontaldirection by:
bx,y =
qx,y/2 (y = 0,2,4, . . . ,14)qx,y/2+qx,y/2+1
2 (y = 1,3,5, . . . ,13)qx,7 (y = 15)
.
Then b is expanded in vertical direction to form the16×16 quantization matrix Q by:
Qx,y =
bx/2,y (x = 0,2,4, . . . ,14)qx/2,y+qx/2+1,y
2 (x = 1,3,5, . . . ,13)b7,y (x = 15)
.
Figure 4: Frequency band for watermark embedding.
In order to adjust the embedding strength, a parame-ter qw is defined. The final quantization matrix Q′ isderived from Q according to:
Q′x,y =
100−qw
50Qx,y .
To increase security, a few DCT coefficients in eachblock are chosen secretly for watermark embedding.Their indices are generated by a secure pseudo-random number generator according to a secret key.For each block, the candidate DCT coefficients arechosen from a limited low frequency band, as shownin Figure 4. In the simulation, the low frequency bandis from f1 = 0.2 to f2 = 0.6 (normalized frequency).The embedding method is modifying the least signif-icant bit (LSB) of a DCT coefficient after quantiza-tion. Conventional LSB-based watermarking meth-ods modify the LSB in such a way that if watermarkbit is 1, then the LSB is made odd, otherwise even.This approach cannot be directly used here becausethe watermark is encrypted and thus unknown to theembedder. Instead, some modification is made, asproposed by (Kuribayashi and Tanaka, 2005). A DCTcoefficient is always quantized to the nearest even in-teger if it is chosen to embed one bit. To insert thewatermark in the encrypted domain, we apply the ad-ditive homomorphism of (Jurik, 2001) over m ∈ Zns ,
E(m1) ·E(m2) = gm1+m2(r1r2)nsmod ns+1
= E(m1 +m2) (6)
In order to preserve the image quality, if the re-quantized DCT coefficient is larger than the originalone, the watermark bit is subtracted from the quan-tized coefficient in the encrypted domain, otherwiseit is added to the quantized coefficient. In order to
50 55 60 65 70 75 80 85 9034
35
36
37
38
39
40
qw
PS
NR
(dB
)
Figure 5: PSNR for different embedding strengths, α = 75.
increase robustness, the same watermark message isembedded repetitively for α times in the same image.After watermark detection, a majority voting is usedto decide the watermark bit. Watermark detection isstraightforward: each image block is transformed byDCT and then quantized; if the specified coefficient iseven after quantization, the embedded bit is 0, other-wise it is 1.
Simulation is carried out to show the performanceof this watermarking scheme. A 512×512 gray scaleLena image is used in the simulation, as shown inFigure 6. Assuming that the watermark contains 200random bits and α = 75, the peak signal to noise ra-tio (PSNR) is shown in Figure 5 for various embed-ding strength qw. The watermark embedded versionfor qw = 75 (PSNR=36.9 dB) is shown in Figure 7.Each image block contains on average 15 watermarkbits.
In order to examine the robustness of the water-mark, JPEG compression and Gaussian noise additionare applied to the embedded image. For the embed-ding strengths of qw = 55,65,75, the bit error ratesof the watermark after JPEG compression are plot-ted in Figure 8; the bit error rates for Gaussian noiseare plotted in Figure 9; Figure 10 – 12 present biterror rates after average filtering, gaussian filtering,and median filtering respectively. As the figures illus-trated, this scheme is robust against JPEG compres-sion and Gaussian filtering; besides, it can resist weakGaussian noise and slight filtering by average or me-dian method.
Figure 6: Lena.
Figure 7: Lena embedded (qw = 75,α = 75,PSNR =36.9 dB).
25 30 35 40 45 50 55 60 65 70 750
0.1
0.2
0.3
0.4
0.5
JPEG quality [%]
Bit
erro
r ra
te
qw
=55q
w=65
qw
=75
Figure 8: Robustness to JPEG compression.
5 6 7 8 9 10 11 12 13 14 150
0.1
0.2
0.3
0.4
0.5
0.6
Standard deviation of Gaussian noise
Bit
erro
r ra
te
qw
=55q
w=65
qw
=75
Figure 9: Robustness to Gaussian noise.
3 4 5 6 7 8 9 10 11 12 130
0.1
0.2
0.3
0.4
0.5
Filter size
Bit
erro
r ra
te
qw
=55q
w=65
qw
=75
Figure 10: Robustness to average filtering.
3 4 5 6 7 8 9 10 11 12 13−1
−0.8
−0.6
−0.4
−0.2
0
0.2
0.4
0.6
0.8
1
Filter size
Bit
erro
r ra
te
qw
=55q
w=65
qw
=75
Figure 11: Robustness to Gaussian filtering.
3 4 5 6 7 8 9 10 11 12 130
0.1
0.2
0.3
0.4
0.5
Filter size
Bit
erro
r ra
te
qw
=55q
w=65
qw
=75
Figure 12: Robustness to median filtering.
6 SECURITY ANALYSIS
In this section, we analyze the security of the pro-posed protocol and explain how it fulfills the designrequirements. The soundness and completeness relyon the security and robustness of the underlying cryp-tographic and watermarking primitives.Traceability. Once a pirated copy is found, the proto-col provide mechanisms for A to identity the relatedtransaction record, and for J to arbitrate and trace theprivacy violator.Non-framing (buyer’s security). Since A onlyknows the encrypted content EpkB
∗(X′), and without
the knowledge of B’s watermark WB and B’s anony-mous private key skB, A can’t know the watermarkedcontent X
′ B received. Therefore, A cannot frameB by distributing replicas of X
′herself. That is, the
customer’s rights problem is solved. The unbindingproblem is solved as follows. If A manages to ob-tain a copy sold to B as Y = X0⊕ (WA +WB + φ2n),A can obtain WB anyhow since she knows WA and φ.Then A can insert the extracted WB to another contentto fabricate a copy. Even if this fabricated piracy ispossible, A can’t forge B’s signature λ that explicitlybinds Epk∗B(WB), pk∗B to ARG, which in turn binds toa particular transaction with specifications of X . Fur-thermore, since B’s anonymous key (pk∗B,sk∗B) is one-time, A cannot trick B by sending outdated informa-tion from previous transactions. Therefore, framing isnot possible because A cannot forge any evidence.Non-repudiation (seller’s security). B only knowsWB but not A’s watermark WA nor the original contentX0. Therefore, B cannot remove WB from X
′. Neither
can he claim that a piracy was created by A or a se-curity breach of A’s system, because no one else canforge B’s copy.
Conspiracy resistance. B generates his own WB andthere is no third party involved in the watermark gen-eration and insertion protocol. It enables the schemeto be resistant against conspiracy attacks.
Dispute resolution. When a dispute occurs, J canrecover sk∗B from the CA, without B exposing sk∗B andWB. After sk∗B is recovered, J can obtain WB and hecan further arbitrate the dispute.
Anonymity. B’s anonymity is essentially preservedbecause of the underlying group signature and theone-time anonymous key pair. It is computationallyinfeasible for an adversary, not in possession of theCA’s opening key ok, to recover the identity of B .Note that the CA is trustworthy, otherwise the groupsignature scheme would not be secure. In disputes, Acan only know some buyer with an anonymous keypk∗B has bought the product X0 but not the identity ofB . Besides the proposed protocol, the communica-tion between A and B is over an anonymous channel,such as Tor (Dingledine et al., 2004). B’s privacy isprotected against various traffic analysis attacks, de-pending on the security of the underlying technique.Therefore, B is able to stay anonymous until he is ad-judicated to be guilty.
Unlinkability. Because of the unlinkability propertyintroduced by the one-time key pair, the underlyinggroup signature and the anonymous communicationtechnique, given the purchase information, no one canrelate two transactions to the same buyer.
Quality and complexity improvement. In the pro-posed scheme, only one composite watermark is re-quired to be inserted, which reduces the computationcomplexity. Another obvious advantage over doublewatermark embedding schemes is to prevent contentquality degradation and to improve robustness.
Moderate expansion ratio. Early anonymousfingerprinting protocols (Pfitzmann and Waidner,1997; Pfitzmann and Sadeghi, 1999; Pfitzmann andSadeghi, 2000) employ a bit-commitment, whichleads to an expansion ratio of at least 103 to achievesecurity, and are inefficient. (Kuribayashi and Tanaka,2005) Therefore, a cryptosystem with a smaller ex-pansion ratio, i.e., the ratio between the length of theciphertext and the corresponding plaintext, is desir-able to be applied in the protocol. Various DCRA-based homomorphic cryptosystems are evaluated ac-cording to the expansion ratio in Table 2. TheDamgard-Jurik cryptosystem has the smallest expan-sion ratio of (s + 1)/s, which can be close to 1 if s issufficiently large. Note that the Paillier cryptosystemis the special case with s = 1.
Table 2: Comparison of the plaintext space, the ciphertext space, and the expansion ratio of various probabilistic DCRA-basedhomomorphic cryptosystems.
E :G→ G G G Expansion ratio
Goldwasser-Micali (Goldwasser and Micali, 1982) {0,1} Z∗n lg(n)Benaloh (Benaloh, 1994) Z/rZ (Z/nZ)∗ lg(n)/lg(r)Naccache-Stern (Naccache and Stern, 1998) Z/rZ (Z/nZ)∗ lg(n)/lg(r)Okamoto-Uchiyama (Okamoto and Uchiyama, 1998) Z/pZ Z/p2qZ lg(p2q)/lg(p) > 2Paillier (Paillier, 1999) Zn Z∗n2 lg(n2)/lg(n) = 2Damgard-Jurik (Jurik, 2001) Zns Z∗ns+1 (s+1)/s≤ 2 (s ∈N)
7 CONCLUSIONS
We have proposed a new anonymous buyer-seller wa-termarking protocol based on group signatures andadditive homomorphism. One achievement of theproposed protocol is to fulfill all the required se-curity properties. The protocol provides revokableanonymity such that a buyer can purchase digital con-tents anonymously but the buyer’s anonymity can berevoked as soon as he is adjudicated guilty. On theother hand, transaction unlinkability is preserved, yetthe seller can trace copyright violators with the help ofa trusted authority. The buyer is only required to inter-act with the CA prior to transactions; with the sellerduring multiple transactions; and is not required toparticipate in the dispute resolution process. There-fore, the protocol design is relevant to real-life ap-plications. Another improvement of our scheme ison utility. The double watermark insertion mecha-nism from conventional schemes is avoided, in or-der to improve the final quality of the product, to re-duce the computation complexity, and to enhance therobustness of the underlying watermark. The proto-col gives the flexibility to adopt all kinds of water-marking schemes, as long as privacy homomorphismis preserved. We showed how to apply additive ho-momorphism, such that an encrypted watermark canbe embedded in an encrypted content by adapting thequantized frequency coefficients. Furthermore, wereduce the expansion ratio from 103 of the conven-tional schemes which apply secure two-party compu-tation and bit-commitment, to 2 as the theoretical up-per bound of the Damgard-Jurik cryptosystem, whichis reasonable for cipher communication.
ACKNOWLEDGEMENTS
This work was supported in part by the ConcertedResearch Action (GOA) AMBioRICS 2005/11 of theFlemish Government and by the IAP ProgrammeP6/26 BCRYPT of the Belgian State (Belgian SciencePolicy). The first two authors were supported by theInterdisciplinary institute for BroadBand Technology(IBBT), Belgium.
REFERENCES
Ateniese, G., Camenisch, J., Joye, M., and Tsudik, G.(2000). A practical and provably secure coalition-resistant group signature scheme. LNCS 1880, pages255–270.
Bellare, M., Micciancio, D., and Warinschi, B. (2003).Foundations of group signatures: Formal definitions,simplified requirements, and a construction based ongeneral assumptions. In Topics in Cryptology - Eu-rocrypt 2003, LNCS 2656, pages 614–629. Springer-Verlag.
Bellare, M., Shi, H., and Zhang, C. (2005). Foundations ofgroup signatures: the case of dynamic groups. In Top-ics in Cryptology - CT-RSA 2005, LNCS 3376, pages136–153. Springer-Verlag.
Benaloh, J. (1994). Dense probabilistic encryption. In Proc.Selected Areas of Cryptography (SAC’94), pages 120–128.
Biehl, I. and Meyer, B. (1997). Protocols for collusion-secure asymmetric fingerprinting. In Proc. 14thSTACS, LNCS 1200, pages 213–222. Springer-Verlag.
Blakley, G. R., Meadows, C., and Prudy, G. B. (1985). Fin-gerprinting long forgiving messages. In Advances inCryptology - CRYPTO 85, LNCS 218, pages 180–189.Springer-Verlag.
Boneh, D. and Shaw, J. (1995). Collusion-secure finger-printing for digital data. LNCS 963, pages 452–465.
Camenisch, J. (2000). Efficient anonymous fingerprintingwith group signatures. In ASIACRYPT, LNCS 1976,pages 415–428. Springer-Verlag.
Camenisch, J. and Damgard, I. (1998). Verifiable encryp-tion and applications to group signatures and signaturesharing. In Technical Report RS-98-32, BRICS, De-partment of Computer Science, University of Aarhus.
Camenisch, J., Maurer, U. M., and Stadler, M. (1996). Digi-tal payment systems with passive anonymity-revokingtrustees. In ESORICS, pages 33–43.
Camenisch, J. and Shoup, V. (2003). Practical verifiableencryption and decryption of discrete logarithms. InAdv. in Cryptology - Crypto 2003, LNCS 2729, pages126–144. Springer-Verlag.
Camenisch, J. L. and Stadler, M. A. (1997). Efficient groupsignature schemes for large groups. In Adv. in Cryp-tology - CRYPTO 97, LNCS 1294, pages 410–424.
Chaum, D. and van Heyst, E. (1991). Group signatures. InAdvances in Cryptology - EUROCRYPT ’91, LNCS547, pages 257–265.
Cox, I., Kilian, J., Leighton, T., and Shamoon, T. (1997).Secure spread spectrum watermarking for multimedia.IEEE Transactions on Image Processing, 6(12):1673–1687.
Dingledine, R., Mathewson, N., and Syverson, P. (2004).Tor: The second-generation onion router. In In Pro-ceedings of the 13th USENIX Security Symposium,pages 303–320.
ElGamal, T. (1985). A public key cryptosystem and a sig-nature scheme based on discrete logarithms. In Adv.in Cryptology - CRYPTO 84, LNCS 196, pages 10 –18.
Frankel, Y., Tsiounis, Y., and Yung, M. (1996). Indirectdisclosure proof: Achieving. efficient fair off-line e-cash. In Advances in Cryptology - Asiacrypt ’96,LNCS 1163, pages 286–300.
Frattolillo, F. (2007). Watermarking protocol for web con-text. IEEE Transactions on Information Forensics andSecurity, 2(3):350–363.
Goi, B.-M., Phan, R. C.-W., Yang, Y., Bao, F., Deng, R. H.,and Siddiqi, M. U. (2004). Cryptanalysis of twoanonymous buyer-seller watermarking protocols andan improvement for true anonymity. In Applied Cryp-tography and Network Security, LNCS 2587, pages369–382.
Goldwasser, S. and Micali, S. (1982). Probabilistic encryp-tion and how to play mental poker hiding all partialinformation. In Proceedings of the 14th Annual ACMSymposium on the Theory of Computing, pages 365–377.
Ibrahim, I. M., El-Din, S. H. N., and Hegazy, A. F. A.(2007). An effective and secure buyer-seller wa-termarking protocol. In Third International Sympo-sium onInformation Assurance and Security, 2007.IAS 2007, pages 21–28.
Jae-Gwi Choi, Kouichi Sakurai, J.-H. P. (2003). Does itneed trusted third party? design of buyer-seller wa-termarking protocol without trusted third party. InApplied Cryptography and Network Security, LNCS2846, pages 265–279.
Ju, H.-S., Kim, H.-J., Lee, D.-H., and Lim, J.-I. (2002). Ananonymous buyer-seller watermarking protocol withanonymity control. Information Security and Cryptol-ogy - ICISC, pages 421–432.
Jurik, I. D. M. (2001). A generalisation, a simplification andsome applications of paillier’s probabilistic public-keysystem. In 4th International Workshop on Practiceand Theory in Public-Key Cryptography, LNCS 1992,pages 119–136. Springer-Verlag.
Kilian, J. and Petrank, E. (1998). Identity escrow. In Adv.in Cryptology - CRYPTO 98, LNCS 1462, pages 169–185.
Kuribayashi, M. and Tanaka, H. (2005). Fingerprintingprotocol for images based on additive homomorphicproperty. IEEE Transactions on Image Processing,14(12):2129–2139.
Lei, C.-L., Yu, P.-L., Tsai, P.-L., and Chan, M.-H. (2004).An efficient and anonymous buyer-seller watermark-ing protocol. IEEE Transactions on Image Process-ing, 13(12):1618–1626.
Liu, K., Trappe, W., Wang, Z., Wu, M., and Zhao, H.(2005). Multimedia Fingerprinting Forensics forTraitor Tracing. EURASIP Book Series on SignalProcessing and Communications. Hindawi PublishingCo.
Memon, N. D. and Wong, P. W. (2001). A buyer-sellerwatermarking protocol. IEEE Transactions on ImageProcessing, 10(4):643–649.
Naccache, D. and Stern, J. (1998). A new public-key cryp-tosystem based on higher residues. In 5th ACM Con-ference on Computer and Communications Security,pages 59–66. ACM.
Okamoto, T. and Uchiyama, S. (1998). A new public-key cryptosystem as secure as factoring. In Advancesin Cryptology - EUROCRYPT’98, LNCS 1403, pages308–318. Springer-Verlag.
Paillier, P. (1999). Public-key cryptosystems based oncomposite degree residuosity classes. In Advancesin Cryptology - EUROCRYPT’99, LNCS 1592, pages223–238. Springer-Verlag.
Pfitzmann, B. and Sadeghi, A.-R. (1999). Coin-basedanonymous fingerprinting. In Advances in Cryptol-ogy - EUROCRYPT’99, LNCS 1592, pages 150–164.Springer-Verlag.
Pfitzmann, B. and Sadeghi, A.-R. (2000). Anonymous fin-gerprinting with direct non-repudiation. In Advancesin Cryptology - ASIACRYPT ’00, LNCS 1976, pages401–414. Springer-Verlag.
Pfitzmann, B. and Waidner, M. (1997). Anonymous fin-gerprinting. In Advances in Cryptology - EURO-CRYPT’97, pages 88–102.
Pittzmann, B. and Schunter, M. (1996). Asymmetricfngerprinting. In Advances in Cryptology - EU-ROCRYPT’96, LNCS 1070, pages 84–95. Springer-Verlag.
Poupard, G. and Stern, J. (2000). Fair encryption of RSAkeys. In Adv. in Cryptology - EUROCRYPT’00, LNCS1807, pages 172–190.
Qiao, L. and Nahrstedt, K. (1998). Watermarking schemesand protocols for protecting rightful ownership andcustomer’s rights. Journal of Visual Communicationand Image Representation, 9(3):194 – 210.
Rivest, R. L., Shamir, A., and Adelman, L. M. (1978). Amethod for obtaining digital signatures and public-keycryptosystems. Commun. of the ACM, 21(2):120–126.
Trappe, W., Wu, M., Wang, Z. J., and Liu, K. J. R. (2003).Anti-collusion forensics of multimedia fingerprintingusing orthogonal modulation. IEEE Transactions onImage Processing, 51(4):1069 – 1087.
Wang, Z. J., Wu, M., Zhao, H. V., Trappe, W., and Liu,K. J. R. (2005). Anti-collusion forensics of multime-dia fingerprinting using orthogonal modulation. IEEETransactions on Image Processing, 14(6):804 – 821.
Young, A. and Yung, M. (1998). Auto-recoverable auto-certifiable cryptosystems. In EUROCRYPT, pages 17–31.
Zhang, J., Kou, W., and Fan, K. (2006). Secure buyer-sellerwatermarking protocol. In IEE Proceedings Informa-tion Security, volume 153, pages 15–18.
