Sm.luth.se

This paper can be found in the proceedings of the International Conference on Information Technology: Coding and Computing, ITCC 2000, March 27-29, 2000, Las Vegas, Nevada. 2000 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. Watermarking applications and their properties
Ingemar J. Cox, Matt L. Miller and Jeffrey A. Bloom Abstract
Broadcast monitoring
We describe a number of applications of digital water- In 1997, a scandal broke out in Japan regarding televi- marking and the examine the common properties of robust- sion advertising. At least two stations had been routinely ness, tamper resistance, fidelity, computational cost and overbooking air time. Advertisers were paying for thou- false positive rate. We observe that these properties vary sands of commercials that were never aired [16]. The prac- greatly depending on the application. Consequently, we tice had remained largely undetected for over twenty years, conclude that evaluation of a watermarking algorithm is in part because there were no systems in place to monitor difficult without first indicating the context in which it is to the actual broadcast of advertisements.
There are several types of organizations and individuals interested in broadcast monitoring. Advertisers, of course,want to ensure that they receive the air time purchased frombroadcasting firms. Musicians and actors want to ensure 1. Introduction
that they receive accurate royalty payments for broadcastsof their performances.1 And copyright owners want to en-sure that their property is not illegally rebroadcast by pirate Watermarking methods are often evaluated based on the common properties of robustness, tamper resistance, and fi- We can use watermarks for broadcast monitoring by delity. However, examination of these properties without putting a unique watermark in each video or sound clip prior careful consideration of the application can often be mis- to broadcast. Automated monitoring stations can then re- leading. A watermark designed to serve security needs of ceive broadcasts and look for these watermarks, identifying the CIA must meet different requirements than one intended when and where each clip appears. Commercial systems for annotating home video. Thus, it is inappropriate to eval- have been deployed for a number of years and the basic uate these two watermarks according to the same standards.
concepts have a long history [15, 3, 19, 11, 4]. 2 In this paper, we examine how the requirements for wa- Owner identification
termarking can vary with application. Section 2 briefly de-scribes eight existing and proposed applications of water- Although a copyright notice is no longer necessary to marks. This is followed, in Section 3, with a discussion of guarantee copy rights, it is still recommended. The form of several properties of watermarking systems, and how their the copyright notice is usually “ c date, owner”. On books definition and importance depend on the application.
and photographs, the copyright is placed in plane sight. Inmovies, it is appended to the end of the credits. And onprerecorded music, it is placed on the packaging.
Applications
One disadvantage of such text copyright notices is that they can often be removed from the protected material.
This section describes seven applications of watermark- 1A recent spot-check by the Screen Actor’s Guild found an average of ing: broadcast monitoring, owner identification, proof of $1000 in underpaid royalties per hour of US television programming [2].
2The earliest reference we have found [15] is assigned to the Muzak ownership, authentication, transactional watermarks, copy Corporation, famous for providing “elevator music”, and may be the source of the many rumors that Muzak contained subliminal messages.
Packaging can be lost, movies can have the credits cut off, one pixel of the image is modified, it will no longer match and images can be spatially cropped. A digital watermark the signature, so any tampering can be detected. However, can be used to provide complementary copyright marking this signature is metadata that must be transmitted along functionality because it becomes an integral part of the con- with the photograph, perhaps in a header field of a partic- tent, i.e. the copyright information is embedded in the mu- ular image format. If the image is subsequently copied to sic to supplement the text notice printed on the packaging.
another file format that does not contain this header field, The Digimarc corporation has marketed a watermark- the signature will be lost, and the image can no longer be ing system designed for this application. Their watermark embedder and detector are bundled with Adobe’s popular A preferable solution is to embed the signature directly image processing program, Photoshop. When the detector into the image using watermarking. This eliminates the finds a watermark, it contacts a central database to identify problem of ensuring that the signature stays with the im- the watermark’s owner (who must pay a fee to keep the in- age. It also opens up the possibility that we can learn more about what tampering has occurred, since any changes madeto the image will also be made to the watermark. Thus, Proof of ownership
there are several systems that can indicate the rough loca-tion of changes that have been made to the image. There Multimedia owners may want to use watermarks not just are also systems designed to allow certain changes, such as to identify copyright ownership, but to actually prove own- JPEG compression [17, 18], and only disallow more sub- ership. To illustrate the problem, let’s quickly introduce stantial changes, such as removing an individual from a some characters who are well known in the watermarking literature. Suppose Alice creates an image and puts it onher website, with a copyright notice “ c Alice 2000”. Bob then steals the image, uses an image processing program to Transactional watermarks (Fingerprinting)
replace the copyright notice with “ c Bob 2000”, and then claims to own the copyright himself. How can the disputeresolved? Monitoring and owner identification applications place Traditionally, Alice could register the image with the Of- the same watermark in all copies of the same content. How- fice of Copyrights and Patents by sending a copy to them.
ever, electronic distribution of content allows each copy dis- The OCP archives the image, together with information tributed to be customized for each recipient. This capability about the rightful owner. When the dispute between Al- allows a unique watermark to be embedded in each indi- ice and Bob comes up, Alice contacts the OCP to obtain vidual copy. Transactional watermarks, also called finger- proof that she is the rightful owner. If Alice did not regis- prints, allow a content owner or content distributor to iden- ter the image, then she should at least be able to show the tify the source of an illegal copy. This is potentially valuable film negative. However, with the rapid acceptance of digital both as a deterrent to illegal use and as a technological aid photography, there might never have been a negative.
In theory, it is possible for Alice to use a watermark em- One possible application of transactional watermarks is bedded in the image to prove that she owns it. However, in the distribution of movie dailies. During the course of this is not a trivial problem, as Craver et al [10] have noted.
making a movie, the result of each day’s photography is of-ten distributed to a number of people involved in its produc- Authentication
tion. These dailies are highly confidential, yet occasionally,a daily is leaked to the press. When this happens, studios As both still and video cameras increasingly embrace quickly try to identify the source of the leak. Clearly, if digital technology, the ability for undetectable tampering each copy of the daily contains a unique transactional wa- also increases. The content of digital photographs can eas- termark that identifies the recipient, then identification of ily be altered in such a way that it is very difficult to detect the source of the leak is much easier.
what has been changed. In this case there is not even an Another application of transactional watermarks was de- original negative to examine. There are many applications ployed by the DiVX corporation. DiVX marketed a modi- where the veracity of an image is crucial, especially in legal fied version of DVD. One of the security measures imple- mented in DiVX hardware was a transactional watermark Authentication is a well studied problem in cryptography that could be used to identify a player used for piracy. If [22]. Friedman [12, 13] first discussed its application to cre- illegal copies of a DiVX movie turned up on the black mar- ate a “trustworthy camera” by computing a cryptographic ket, DiVX could use the watermark to track them to the signature that is associated with an image. If even one bit of Copy Control
digital conversions and lossy compression. More recently,there has been an increased concern that video and still im- Transactional watermarks as well as watermarks for age watermarks also be robust to geometric transformations.
monitoring, identification, and proof of ownership do not Robustness is often thought of as a single-dimensional prevent illegal copying. Rather, they serve as powerful de- value, but this is incorrect. A watermark that is robust terrents and investigative tools. However, it is also possi- against one process may be very fragile against another. In ble for recording and playback devices to react to embed- many applications, robustness to all possible processing is ded signals. In this way, a recording device might inhibit recording of a signal if it detects a watermark that indicates Usually, a watermark must survive common signal pro- recording is prohibited. Of course, for such a system to cessing only between the time of embedding and the time work, all manufactured recorders must include watermark of detection. For example, in television and radio broadcast detection circuitry. Such systems are currently being devel- monitoring, the watermark need only survive the transmis- oped for DVD video [6] and for digital music distribution sion process. For television, this means lossy compression, [5]. Interestingly, the use of watermarks in video to control analog transmission, and some small amount of horizontal equipment dates back to at least 1989 [7] and in audio to and vertical translation. It need not survive rotation, scaling, high-pass filtering, or any of a wide variety of distortionsthat do not occur during broadcast.
Covert communication
In some cases, robustness may be completely irrelevant, or even undesirable. Watermarks used for covert commu- One of the earliest applications of watermarking, or more nication need not be robust at all, if the cover media will precisely, data hiding, is as a method of sending secret mes- be transmitted digitally without compression. A watermark sages. The application has been formulated by Simmons for simple authentication, which just indicates whether the [21] as “the prisoner’s problem”, in which we imagine two media has been altered, should be fragile.
prisoners in separate cells trying to pass messages back and On the other hand, when the signal processing between forth. Their problem is that they cannot pass these messages embedding and detection is unpredictable, the watermark directly, but rather, must rely on the prison warden to act as may need to be robust to every conceivable distortion. This a messenger. The warden is willing to carry innocuous mes- is the case for owner identification, proof of ownership, fin- sages between them, but will punish them if he finds that, gerprinting, and copy control. It is also true for any applica- for example, their messages relate to a plan for escape. The tion in which hackers might want to remove the watermark.
solution is to disguise the escape-plan messages by hidingthem in innocuous messages. There are several commer- Tamper resistance
cially available programs designed for this application, in-cluding StegoTools [1].
Tamper resistance refers to a watermarking system’s re- sistance to hostile attacks. There are several types of tam- Properties
per resistance. Depending on the application, certain typesof attacks are more important than others. In fact, there are There are a number of papers that have discussed the several applications in which the watermark has no hostile characteristics of watermarks [8, 20, 14, 24]. Some of the enemies, and tamper resistance is irrelevant. Some basic properties discussed are robustness, tamper resistance, fi- delity, computational cost, and false positive rate. In prac- Active attacks. Here the hacker tries to remove the wa- tice, it is probably impossible to design a watermarking sys- termark or make it undetectable. This type of attack is tem that excels at all of these. Thus, it is necessary to make critical for many applications, including owner identi- tradeoffs between them, and those tradeoffs must be cho- fication, proof of ownership, fingerprinting, and copy sen with careful analysis of the application. In addition, the control, in which the purpose of the mark is defeated application can affect the very definition of a property.
when it cannot be detected [9]. However, it is not a In the following subsections, we look at each of the five serious problem for authentication or covert commu- properties listed above, and discuss how its importance and Passive attacks. In this case, the hacker is not trying Robustness
to remove the watermark, but is simply trying to deter-mine whether a mark is present. In most applications, A watermark is said to be robust if it survives common we are not concerned with this type of attack. In fact, signal processing operations such as digital-to-analog-to- we might even advertise the presence of the mark so that it can serve as a deterrent. But in the case of covert A small visible distortion caused by a watermark will not communication, our primary interest is in preventing Computational cost
Collusion attacks. These are a special case of active attacks, in which the hacker uses several copies of one Different applications require the embedders and detec- piece of media, each with a different watermark, to tors to work at different speeds. In broadcast monitoring, construct a copy with no watermark. Resistance to col- both embedders and detectors must work in (at least) real lusion attacks can be critical in a fingerprinting appli- time. The embedders must not slow down the media pro- cation, which entails putting a different mark in each duction schedule, and the detectors must keep up with real- copy of a piece of media. However, the number of time broadcasts. On the other hand, a detector for proof of copies that we can expect the hacker to obtain varies ownership will be valuable even if it takes days to find a wa- greatly from application to application. For example, termark. Such a detector will only be used during ownership in the DiVX application, a hacker can buy any number disputes, which are rare, and its conclusion about whether of DiVX players, and play one movie on all of them to the watermark is present is important enough that the user obtain any number of differently-watermarked copies.
On the other hand, in the film-studio dailies applica- Furthermore, different applications require different tion, each employee can only obtain one copy of the numbers of embedders and detectors. Broadcast monitor- watermarked material. A collusion attack would re- ing typically requires a few embedders and perhaps several quire that several employees conspire to steal the ma- hundred detectors at different geographic locations. Copy terial, which is an unlikely prospect.
control applications may need only a handful of embeddersbut millions of detectors. Conversely, in the fingerprinting Forgery attacks. Here, the hacker tries to embed a application implemented by DiVX, in which each player valid watermark, rather than remove one. These are embeds a distinct watermark, there would be millions of our main security concern in authentication applica- embedders and only a handful of detectors. In general, the tions, since, if hackers can embed valid authentication more numerous a device needs to be for a given application, marks, they can cause the watermark detector to ac- cept bogus or modified media. In addition, as pointed The wide variation in dollar cost and in speed require- out by Craver et al [10], this type of attack is a serious ments means that there is a wide variation in the required computational efficiency of watermark embedders and de-tectors.
Fidelity
False positive rate
A watermark is said to have high fidelity if the degreda- tion it causes is very difficult for a viewer to perceive. How- A false positive is a detection of a watermark in a piece of ever, it only needs to be imperceptible at the time that the media that does not actually contain that watermark. When media is viewed. If we can be certain that the media will be we talk of the false positive rate, we refer to the number of seriously degraded before it is viewed, we can rely on that false positives we expect to occur in a given number of runs degradation to help mask the watermark. Such a case oc- of the detector. Equivalently, we can discuss the probabil- curs when we watermark video that will be transmitted over ity that a false positive will occur in any given detector run.
NTSC, or audio that will be transmitted over AM radio. The There are two subtly different ways to define this probabil- quality of these broadcast technologies is so low that our ity, that are often confused in the literature. They differ in initial fidelity need not be very good. Conversely, in HDTV whether the watermark or the media is considered to be the and DVD video and audio, the signals are very high qual- ity, and require much higher fidelity watermarks (though, of In the first definition, the probability of a false positive course, the quality of the content remains the same - a bad is the probability that, given a fixed piece of media and a movie is a bad movie whether on VHS or DVD).
randomly-selected watermark, the detector will report that In some applications, we can accept mildly perceptible the watermark is in the media. The watermarks are drawn watermarks in exchange for higher robustness or lower cost.
from a distribution that is defined by the design of a water- For example, Hollywood dailies are not finished products.
mark generation system. Typically, watermarks are gener- They are usually the results of poor transfers from film to ated by either a bit-encoding algorithm or by a Gaussian, in- video. Their only purpose is to show those involved in a dependent random number generator. In many cases, prob- film production the raw material that has been shot so far.
ability of false positives, according to this first definition, is actually independent of the piece of media, and depends [4] D. E. H. amd C. M. Solar. Automatic monitor for programs only on the method of watermark generation.
broadcast. United States Patent, (4,025,851), 1977.
In the second definition, the probability of a false pos- itive is the probability that, given a fixed watermark and [6] J. A. Bloom, I. J. Cox, T. Kalker, J.-P. Linnartz, M. L. Miller, a randomly-selected piece of media, the detector will de- and B. Traw. Copy protection for DVD video. Proceedings tect the watermark in the media. The media is chosen from of the IEEE, 87(7):1267–1276, 1999.
the distribution of natural media, which is defined by either [7] R. S. Broughton and W. C. Laumeister. Interactive video nature or Hollywood, depending on the application. This method and apparatus. United States Patent, (4,807,031), distribution is very different from that defined by the wa- termark generation system, and thus probabilities based on [8] I. Cox and M. L. Miller. A review of watermarking and the importance of perceptual modeling. In Proceedings of SPIE, this definition can be quite different from those based on the Human Vision & Electronic Imaging II, volume 3016, pages In most applications, we are more interested in the sec- [9] I. J. Cox and J.-P. Linnartz. Some general methods for tam- ond definition of false positive probability than in the first.
pering with watermarks. IEEE Trans. on Selected Areas of However, in a few cases, the first definition is also impor- Communications, 16(4):587–593, 1998.
tant, such as in the case of fingerprinting, where the detec- [10] S. Craver, N. Memon, B.-L. Yeo, and M. Yeung. Resolving tion of a random watermark in a given image might lead to rightful ownerships with invisible watermarking techniques:Limitations, attacks and implications. IEEE Trans. on Se- lected Areas of Communications, 16(4):573–586, 1998.
The probability of false positives that is required depends [11] M. G. Crosby. Communication including submerged identi- on the application. In the case of proof of ownership, the de- fication signal. United States Patent, (3,845,391), 1974.
tector is used so rarely that a probability of [12] G. L. Friedman. The trustworthy camera: restoring credi- fice to make false positives unheard of. On the other hand, bility to the photographic image. IEEE Trans. On Consumer in the copy control application, millions of watermark de- Electronics, 39(4):905–910, 1993.
[13] G. L. Friedman. Digital camera with apparatus for authen- tectors are constantly being run on millions of pieces of me- tication of images produced from an image file. U.S. Patent, dia all over the world. If one piece of unwatermarked media consistently generates false positives, it could cause serious [14] F. Hartung and M. Kutter. Multimedia watermarking tech- trouble. For this reason, the false positive rate should be in- niques. Proceedings of the IEEE, 87(7):1079–1107, 1999.
finitesimal. For example, the general consensus is that wa- [15] E. F. Hembrooke. Identification of sound and like signals.
termark detectors for DVD video should have a false posi- United States Patent, (3,004,104), 1961.
[16] D. Kilburn. Dirty linen, dark secrets. Adweek, 1997.
[17] C.-Y. Lin and S.-F. Chang. A robust image authentication algorithm surviving jpeg compression. In SPIE Storage and Summary and conclusion
Retireval of Image/Video Databases, 1998.
[18] C.-Y. Lin and S.-F. Chang. Issues and solutions for authen- ticating mpeg video. In Proc. IS&T/SPIE Syposium on Elec- Watermarking is a technology that can serve a wide va- tronic Imaging: Science and Technology (EI’99) - SPIE Se- riety of applications, each of which may have very different curity amd Watermarking of Multimedia Contents, 1999.
requirements. Each application dictates a different tradeoff between the properties of robustness, tamper resistance, fi- dio broadcasting monitoring system. United States Patent, delity, and false positive rate. Moreover, for many of these [20] F. A. P. Petitcolas, R. Anderson, and M. G. Kuhn. Informa- properties, their very definitions can be dependent on appli- tion hiding - a survey. Proceedings of the IEEE, 87(7):1062– We conclude that a single set of standards should not be [21] G. J. Simmons. The prisoners’ problem and the subliminal applied to all proposed watermarking systems. Instead, a channel. In Proc. CRYPTO’83, pages 51–67. Plenum Press, separate set of standards should be applied to each system according to the application for which it is intended. One [22] D. R. Stinson. Cryptography: Theory and Practice. CRC [23] W. M. Tomberlin, L. G. MacKenzie, and P. K. Bennett. Sys- tem for transmitting and receiving coded entertainment pro- References
grams. United States Patent, (2,630,525), 1953.
[24] R. B. Wolfgang, C. I. Podilchuk, and E. J. Delp. Perceptual watermarks for digital images and video. Proc. of the IEEE, [1] http://www.informatik.tu-muenchen.de/ stowasse/security.html.
[2] http://www.sag.org/pressreleases/prla990826 spotchecks.html, [3] C. R. Abbey and H. H. Pursel. Data channel monitor. United States Patent, (3,415,947), 1968.

Source: http://www.sm.luth.se/csee/courses/smd/102/itcc00-cox.pdf