Digital Watermarking PDF

Digital Watermarking Agenda Background Terminology Applications Techniques Research topics References HISTORY OF WATERMARKING Papermaking was invented in China over one thousand years earlier, paper watermarks did not appear until about 1282, in Italy. The marks were made by ad...

Digital Watermarking Agenda Background Terminology Applications Techniques Research topics References HISTORY OF WATERMARKING Papermaking was invented in China over one thousand years earlier, paper watermarks did not appear until about 1282, in Italy. The marks were made by adding thin wire patterns to the paper molds. The paper would be slightly thinner where the wire was and hence more transparent. The meaning and purpose of the earliest watermarks are uncertain. They may have been used for practical functions such as identifying the molds on which sheets of papers were made, or as trademarks to identify the paper Maker By the eighteenth century, watermarks on paper made in Europe and America had become more clearly utilitarian. They were used as trademarks, to record the date the paper was manufactured, and to indicate the sizes of original sheets HISTORY OF WATERMARKING The term watermark seems to have been coined near the end of the eighteenth century and may have been derived from the German term wassermarke (though it could also be that the German word is derived from the English ). The term is actually a misnomer, in that water is not especially important in the creation of the mark. It was probably given because the marks resemble the effects of water on paper. Counterfeiting prompted advances in watermarking technology. William Congreve, an Englishman, invented a technique for making color watermarks by inserting dyed material into the middle of the paper during papermaking. In 1954, Emil Hembrooke of the Muzak Corporation filed a patent for “watermarking” musical Works. An identification code centered at 1 kHz. Komatsu and Tominaga , in 1988, first used the term digital watermark. 1990s the term digital watermarking came into vogue About 1995, interest in digital watermarking began to mushroom. The first Information Hiding Workshop (IHW), which included digital watermarking as one of its primary topics, was held in 1996. SPIE began devoting a conference specifically to Security and Watermarking of Multimedia Contents [450, 451], beginning in 1999  Organizations began considering watermarking technology for inclusion in various standards. The Copy Protection Technical Working Group (CPTWG) tested watermarking systems for protection of video on DVDs. The Secure Digital Music Initiative (SDMI) made watermarking a central system component for protecting music. Two projects sponsored by the European Union, VIVA and Talisman, tested watermarking for broadcast monitoring. The International Organization for Standardization (ISO) took an interest in the technology in the context of designing advanced MPEG standards. In the late 1990s several companies were established to market watermarking products. Technology from the Verance Corporation was adopted into the first phase of SDMI and was used by Internet music distributors such as Liquid Audio.  IMPORTANCE OF DIGITAL WATERMARKING The sudden increase in watermarking interest is due to the increase in concern over copyright protection of content This risk of piracy is exacerbated by the proliferation of high-capacity digital recording devices. The first technology content owners turn to is cryptography. Cryptography is probably the most common method of protecting digital content. It is certainly one of the best developed as a science. The content is encrypted before delivery, and a decryption key is provided only to those who have purchased legitimate copies of the content. The encrypted file can then be made available via the Internet but would be useless to a pirate without an appropriate key. Unfortunately, encryption cannot help the seller monitor how a legitimate customer handles the content after decryption. A pirate can actually purchase the product, and use the decryption key to obtain an unprotected copy Comparison Watermarking Vs Cryptography Watermark D  Hide information in D Encrypt D  Change form of D Applications Copyright Protecton:To prove the ownership of digital media Eg. Cut paste of images Hidden Watermarks represent the copyright information  Applications and Properties Watermarking is distinguished from other techniques in three important ways: 1- Watermarks are imperceptible. 2- Watermarks are inseparable from the Works in which they are embedded. 3- Watermarks undergo the same transformations as the Works. The performance of a given watermarking system can be evaluated on the basis of a small set of properties. For example, robustness describes how well watermarks survive common signal processing operations fidelity: describes how imperceptible the watermarks Steganography is distinguished from other techniques in that it is covert While watermarking is also a form of data hiding, in many applications, the presence of watermarking is well known. And while encryption provides for privacy, encryption does not hide the fact that Alice and Bob are communicating  Applications and Properties There is a strong need for an alternative or complement to cryptography: A technology that can protect content even after it is decrypted. Watermarking has the potential to fulfill this need because it places information within the content where it is never removed during normal usage. Decryption, encryption, compression, digital-to-analog conversion, and file format changes—a watermark can be designed to survive all of these processes. Watermarking has been considered for many copy prevention and copyright copy-prevention Broadcast Monitoring In 1997, a scandal broke out in Japan regarding television advertising. At least two stations had been routinely overbooking air time. Advertisers were paying for thousands of commercials that were never aired. The practice had remained largely undetected for more than 20 years- there were no systems in place to monitor the actual broadcast of advertisements. There are several types of organizations and individuals interested in broadcast monitoring. Advertisers, of course, want to ensure that they receive all of the air time they purchase from broadcasters, such as the Japanese television stations caught in the 1997 scandal. A 1999 spot check by the Screen Actor’s Guild (SAG) found an average of $1,000 in underpaid royalties per hour of U.S. television programming. In addition, owners of copyrighted Works want to ensure that their property is not illegally rebroadcast by pirate stations Applications Tamper proofing: To find out if data was tampered. Eg. Change meaning of images Hidden Watermarks track change in meaning Issues: Accuracy of detection  A passive system consists of a computer that monitors broadcasts and compares the received signals with a database of known Works. When the comparison locates a match, the song, film, TV program, or commercial being aired can be identified Problems with implementing passive monitoring systems. First, comparing the received signals against a database is not trivial. In principle, we would like to divide the signals into recognizable units, such as individual frames of video, and search for them in the database. Each frame of video consists of several million bits of information, and it would be impractical to use a large bit sequence as an index for a database search. Active Monitoring System Computer-recognizable identification information is transmitted along with the content. Active monitoring is technically simpler to implement than passive monitoring. The identification information is straightforward to decode reliably, and no database is required to interpret its meaning. One way to implement an active system is to place the identification information in a separate area of the broadcast signal. For example, analog television broadcasts permit digital information to be encoded in the vertical blanking interval (VBI) of a video signal. This part of the signal, sent between frames, has no effect on the picture. Closed captioning information is distributed in this manner, as is Teletext in Europe.  Active Monitoring System Nielsen Media Research uses the VBI for its SIGMA advertisement monitoring service. Embedding signals in the VBI can be problematic. It is not always clear who legally controls the content of the VBI. Both cable and satellite operators stake a claim to it  Active Monitoring System Watermarking is an alternative method of coding identification information for active monitoring. It has the advantage of existing within the content itself, rather than exploiting a particular segment of the broadcast signal The primary disadvantage is that the embedding process is more complicated than placing data in the VBI or in file headers. There is also a concern that the watermark may degrade the visual or audio quality of the Work.  Owner Identification Under U.S. law, the creator of a story, painting, song, or any other original Work automatically holds copyright to it the instant the Work is recorded in some physical form. Through 1988, if copyright holders wanted to distribute their Works without losing any rights, they had to include a copyright notice in every distributed copy. After 1988, this was changed so that the copyright notice is now no longer required. Textual copyright notices have several limitations as a technology for identifying the owner of a Work. For one, they are easy to remove from a document when it is copied, even without any intention of wrongdoing. Example, a professor copying pages out of a book (within the strictures of fair use) might neglect to photocopy the copyright notice on the title page.  Owner Identification Watermarks can be made both imperceptible and inseparable from the Work that contains them Users of Works are supplied with watermark detectors, they should be able to identify the owner of a watermarked Work  Transaction Tracking Transaction tracking is more often called fingerprinting, as each copy of a Work can be uniquely identified by the watermark.. An example of watermarking for transaction tracking was implemented by the now-defunct DiVX Corporation. DiVX sold an enhanced DVD player that implemented a pay-per-view business model. Each DiVX-enabled player would place a unique watermark into every video it played Content Authentication It is becoming easier and easier to tamper with digital Works in ways that are difficult to detect. Modification made to images using Adobe Photoshop. The same problem exists with audio and video. Source 4 Copy Control In the copy control application, we aim to prevent people from making illegal copies of copyrighted content. The first and strongest line of defense against illegal copying is encryption. The key would then be provided to legitimate users in a manner that is difficult for them to copy or redistribute. Many satellite television broadcasts are encrypted. The decryption keys are provided to each paying customer on a “smart card,” Embedded in the content itself might provide a better method of implementing copy control. If every recording device were fitted with a watermark detector, the devices could be made to prohibit recording whenever a never-copy watermark is detected at its input. This functionality is sometimes referred to specifically as record control. Such a system has been envisioned for use on video DVDs by the Copy Protection Technical Working Group (CPTWG), and for use in audio. Device Control Digimarc’s Mobile system embeds a unique identifier into printed and distributed images such as magazine advertisements. After the image is recaptured by a mobile phone’s camera, the watermark is read by the software on the phone and the identifier is used to direct a web browser to an associated website PROPERTIES OF WATERMARKING SYSTEMS Embedding Effectiveness The effectiveness of a watermarking system is the probability that the output of the embedder will be watermarked. In other words, the effectiveness is the probability of detection immediately after embedding. The watermarking system might have an effectiveness of less than 100%. Depending on the application, sacrifice some effectiveness for better performance Fidelity In general, the fidelity of a watermarking system refers to the perceptual similarity between the original and watermarked versions of the cover Work. We may define the fidelity of the watermarking system as the perceptual similarity between the unwatermarked and watermarked Works at the point at which they are presented to a consumer. In some applications, we can accept mildly perceptible watermarks in exchange for higher robustness or lower cost  Data Payload Data payload refers to the number of bits a watermark encodes within a unit of time or a Work. For a photograph, the data payload would refer to the number of bits encoded within the image. For audio, data payload refers to the number of embedded bits per second that are transmitted. For video, the data payload may refer to either the number of bits per field (or frame) or the number of bits per second. A watermark that encodes N bits is referred to as an N-bit watermark. Such a system can be used to embed any one of 2^N different messages. Copy control applications may require just 4–8 bits of information to be received over a period of, say, every 10 seconds for music and perhaps 5 minutes for video. The data rate is approximately 0.5 bits per second for music and 0.02 bits per second for video. Television broadcast monitoring might require at least 24 bits of information to identify all commercials  Blind or Informed Detection Detectors that do not require any information related to the original are referred to as blind detectors. Whether a watermarking system employs blind or informed detection can be critical in determining whether it can be used for a given application. Informed detection can only be used in those applications where the original Work is available. Systems that use informed detection are often called private watermarking systems Those that use blind detection are called public watermarking systems. False Positive Rate A false positive is the detection of a watermark in a Work that does not actually contain one. The false positive rate, refer to the number of false positives we expect to occur in a given number of runs of the detector In the first definition, the false positive probability is the probability that given a fixed Work and randomly selected watermarks, the detector will report that a watermark is in that Work  Robustness Robustness refers to the ability to detect the watermark after common signal processing operations. Examples: Images spatial filtering, lossy compression, printing and scanning, and geometric distortions (rotation, translation, scaling, and so on). Video: Robust to many of the same transformations, as well as to recording on video tape and changes in frame rate. Audio: Robust to such processes as temporal filtering, recording on audio tape, and variations in playback speed.  Robustness An important branch of watermarking research focuses on fragile watermarks. A fragile watermark is one designed so that it is not robust. A watermark designed for authentication purposes should be fragile. Any signal processing application applied to the image should cause the watermark to be lost. There are applications in which the watermark must be robust to every conceivable distortion that does not destroy the value of the cover Work. Signal processing between embedding and detection is unpredictable  Security The security of a watermark refers to its ability to resist hostile attacks. A hostile attack is any process specifically intended to thwart the watermark’s purpose. The types of attacks we might be concerned about fall into three categories: Unauthorized removal Unauthorized embedding Unauthorized detection  Security Elimination Attack of a watermark means that an attacked Work cannot be considered to contain a watermark at all. That is, if a watermark is eliminated, it is not possible to detect it even with a more sophisticated detector. Masking of a watermark means that the attacked Work can still be considered to contain the watermark, but the mark is undetectable by existing detectors. More sophisticated detectors detect it. For example, image watermark detectors cannot detect watermarks that have been rotated slightly. Collusion attack. Here, the attacker obtains several copies of a given Work, each with a different watermark, and combines them to produce a copy with no watermark. This is primarily a concern in transaction tracking. With existing watermarking systems, a small number of copies suffices to make a collusion attack successful  Cipher and Watermark Keys In cryptography, security is usually provided by the use of secret keys. The method by which messages are embedded in watermarks depends on a key, and a matching key must be used to detect those marks. The security of most cryptographic algorithms relied on keeping those algorithms secret. This led to two problems. First, if the security of an algorithm was compromised, a completely new algorithm had to be developed. Second, because of the need for secrecy, it was not possible to disclose an algorithm to outside researchers for study. Cipher and Watermark Keys A well-designed cipher should meet the following standards: Knowledge of the encryption and decryption algorithms should not compromise the security of the system. Security should be based on the use of keys. Keys should be chosen from a large keyspace so that searching over the space of all possible keys is impractical.  Cipher and Watermark Keys Watermark algorithms can be designed to use secret keys in a manner similar to that in spread spectrum. For example, one simple form of watermarking algorithm, that adds a pseudo- random noise pattern (or PN pattern) to an image. For the system to work, the embedder and detector must use the same PN pattern. Thus, the PN pattern, or a seed used to generate the PN pattern, can be considered a secret key.  Modification and Multiple Watermarks The American copyright law grants television viewers the right to make a single copy of broadcasted programs for time-shifting purposes (i.e., you are permitted to make a copy of a broadcast for the noncommercial purpose of watching that broadcast at a later time). However, you are not permitted to make a copy of this copy. The content may be labeled copy-once and, after recording, should be labeled copy-no-more. This modification of the recorded video can be accomplished in a variety of ways. The most obvious manner is to simply alter the embedded watermark denoting copy- once so that it now denotes copy-no-more. However, if a watermark is designed to permit easy modification, there is the risk that a device or program that modifies the video from copy-once to copy-freely.  Cost The economics of deploying watermark embedders and detectors can be extremely complicated and depends on the business models involved In broadcast monitoring, both embedders and detectors must work in (at least) real-time. The embedders must not slow down the production schedule, and the detectors must keep up with real-time broadcasts. A detector for proof of ownership will be valuable even if it takes days to find a watermark. Such a detector will only be used during rare ownership disputes, and its conclusion about whether the watermark is present is important enough that the user will be willing to wait.depend EVALUATING WATERMARKING SYSTEMS The Notion of “Best” If we are evaluating a video watermark for use in copy control, we test its robustness to small rotations, in that these could be used as an attack Robustness might be irrelevant for broadcast monitoring, because rotations are unlikely to occur during normal broadcasting, and we might not be concerned with security against active attacks. Many watermark detectors employ a detection threshold parameter, which we can lower to translate our improved false positive probability into improved robustness. Many embedders employ an embedding strength parameter, which trades robustness for fidelity. Benchmarking Unfortunately, this benchmark can only be performed on certain watermarking systems and is only relevant to certain watermarking applications. Many watermarking systems are designed to carry very small data payloads (on the order of 8 bits or fewer), with very high robustness, very low false positive probability, and/or very low cost. Such systems typically employ codes that cannot be expanded to 80 bits Furthermore, the tests performed by Stirmark are not critical to many applications that do not have stringent security requirements. They also do not represent a comprehensive test of the security required in applications No benchmark can ever be relevant to all watermarking systems and applications  Scope of Testing In general, watermarking systems should be tested on a large number of Works drawn from a distribution similar to that expected in the application. For example, we would not necessarily expect an algorithm that was tuned to “Lena”13 to be ideally suited for X-ray images, satellite photos, or animation frames. If a system is being tested without a specific application in mind, the Works it is tested on should be representative of a typical range of applications. These two issues—size and typicality of the test set—are especially important in testing false positive rates. Imagine a watermark detector that will be examining a large number of Works, looking for one particular watermark pattern. If this system is required to have a false positive rate of 10 ^−6, expect to see, on average, no more than one false positive in every one million Works examined. To truly verify this performance, we would need to present the detector with many millions of Works. Applications Quality Assessment: Degradation of Visual Quality Loss of Visual Quality Hidden Watermarks track change in visual quality Watermarking Process Data (D), Watermark (W), Stego Key (K), Watermarked Data (Dw) Embed (D, W, K) = Dw Extract (Dw) = W’ and compare with W (e.g. find the linear correlation and compare it to a threshold) Q. How do we make this system secure ? A. K is secret (Use cryptography to make information hidden more secure) Watermarking Process Example – Embedding (Dw = D + W) Matrix representation (12 blocks – 3 x 4 matrix) (Algorithm Used: Random number generator RNG), Seed for RNG = K, D = Matrix representation, W = Author’s name 1 2 3 4 5 6 7 8 9 10 11 12 Watermarking Process Example – Extraction The Watermark can be identified by generating the random numbers using the seed K 1 6 8 10 Data Domain Categorization Spatial Watermarking Direct usage of data to embed and extract Watermark e.g. voltage values for audio data Transform Based Watermarking Conversion of data to another format to embed and extract. e.g. Conversion to polar co-ordinate systems of 3D models, makes it robust against scaling Extraction Categorization Informed (Private) Extract using {D, K, W} Semi - Blind (Semi-Private) Extract using {K, W} Blind (Public) Extract using {K} - Blind (requires less information storage) - Informed techniques are more robust to tampering Robustness Categorization Fragile (for tamper proofing e.g. losing watermark implies tampering) Semi-Fragile (robust against user level operations, e.g. image compression) Robust (against adversary based attack, e.g. noise addition to images) This categorization is application dependent Categorization of Watermark Eg1. Robust Private Spatial Watermarks Eg2. Blind Fragile DCT based Watermarks Eg3. Blind Semi-fragile Spatial Watermarks Watermarking Example Application: Copyright Protection Design Requirements: - Imperceptibility - Capacity - Robustness - Security Imperceptibility Watermarking Stanford Bunny 3D Model Visible Watermarks in Bunny Model  Distortion Watermarking Stanford Bunny 3D Model Invisible Watermarks in Bunny Model  Minimal Distortion Robustness Adversaries can attack the data set and remove the watermark. Attacks are generally data dependent e.g. Compression that adds noise can be used as an attack to remove the watermark. Different data types can have different compression schemes. Robustness Value Change Attacks - Noise addition e.g. lossy compression - Uniform Affine Transformation e.g. 3D model being rotated in 3D space OR image being scaled If encoding of watermarks are data value dependent  Watermark is lost  Extraction process fails Robustness Sample loss Attacks - Cropping e.g. Cropping in images - Smoothing e.g. smoothing of audio signals e.g. Change in Sample rates in audio data change in sampling rat results in loss of samples If watermarks are encoded in parts of data set which are lost  Watermark is lost  Extraction process fails Robustness Reorder Attack - Reversal of sequence of data values e.g. reverse filter in audio signal reverses the order of data values in time 0 1 1 1 1 0 Attack 1 2 3 3 2 1 Samples in time Samples in time If encoding is dependent on an order and the order is changed  Watermark is lost Extraction process fails Capacity Multiple Watermarks can be supported. More capacity implies more robustness since watermarks can be replicated. Spatial Methods are have higher capacity than transform techniques ? Security In case the key used during watermark is lost anyone can read the watermark and remove it. In case the watermark is public, it can be encoded and copyright information is lost. Watermarking Algorithm Design Requirements  As much information (watermarks) as possible  Capacity  Only be accessible by authorized parties  Security  Resistance against hostile/user dependent changes  Robustness  Invisibility  Imperceptibility Tamper proofing Robustness against user related operations – compression, format conversion Accuracy of Detection – Only changes in meaning should be detected References http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Digital_watermark http://www.cypak.com/pictures/med/Cypak%20microchip.jpg THANK YOU !