Rad a u d u S i S o i n o Dat a a t b a a b s a e e W at a e t r e m r ar a k r in i g n 2!"!

Transcription

1 !" /16/ All Rights Reserved. DASFAA 2006

2 2

3 scenario payment Alice (financial advisor) market analysis Mallory (malicious licensed client) STOP Jane (innocent victim) 3

4 alternate scenario: traitor tracing top-secret documents military base Cody Banks agent 007 agent tie n suit Lex Luthor 4

5 overview Exponentially increasing amounts of valuable information we want to share. Connected environments. Digital : zero-cost verbatim copies. Significant potential for misuse and illicit profit. It becomes essential to have the integrated ability to assert digital rights. rights protection 5

6 rights protection What? identity (e.g. rights holder) Work How? legal means (e.g. severe penalties) + technology (e.g. Watermarking) 6

7 but why not publish newspaper digest? payment Alice (financial advisor) Idea: is there a digest that would allow this? market analysis crypto digest Mallory (malicious licensed client) Problem: what if modified Work has (illicit) resale value? 7

8 watermarking: rights protection tool Watermarking induces a convincing and relevant (wrt. court-time proofs) property ( rights signature ) in a Work, through minor alterations. convincing very rare (false positives) relevant by radu Original Work Watermarked Work Key Watermark Key Watermark Watermarking Watermark Detection Original Work Watermarked Work Yes/No (confidence level) watermark embedding watermark detection 8

9 attacks: Mallory (evil entity) Mallory wants to sell our data illicitly. Detect and Remove ( subtractive ) Perturb Add new Watermark ( additive ) Collude different watermarked copies Watermarking is a game against Mallory! 9

10 10

11 media The encoding bandwidth stems from knowing the main digital Works consumer (human) and the associated limitations of perception. metric of distortion allowable bounds resilience 11

12 12

13 watermarking beyond media In a general data domain (non-media) most existing (multimedia) techniques do not apply because distortion metrics, tolerable bounds, and resilience often bear multiple semantics. Q: How to preserve data value when there is always a semantic dimension that gets impacted even by minor changes thus maybe we should instead focus on preserving application specific quality properties. 13

14 model: consumer driven watermarking Data consumer requirements define distortion metrics and associated bounds. Encoding only guarantees them. In other words: quality metrics should not be hard-coded but rather separated from the watermarking method. Data Rights Holder data constraints "satisfies" A1 A2 A3 A4 A5 A6 A1 A2 A3 A4 A5 A6 Original Data Outsourced Data customer fingerprint or rights holder watermark WM Data Customer 14

15 essential desiderata Rights protection method should not interfere with intended data use. 15

16 16

17 relational data: scenario outsourcing Licensed Party STOP Data Rights Holder Third Party 17

18 relational data: problem relational database B, set of quality constraints C determine B (a watermarked B) B satisfies C and features enough mark resilience. what is resilience? what type of constraints? minimal context detection ( blind )? 18

19 numeric data: initial ideas First thoughts: randomly change bits in the data according to a certain criteria. 19

20 numeric data: Agrawal and Kiernan, watermark insertion [1] Rakesh Agrawal, Peter J. Haas, and Jerry Kiernan. Watermarking relational data: framework, algorithms and analysis. The VLDB Journal, 12(2): ,

21 numeric data: Agrawal and Kiernan, watermark insertion [1] Rakesh Agrawal, Peter J. Haas, and Jerry Kiernan. Watermarking relational data: framework, algorithms and analysis. The VLDB Journal, 12(2): ,

22 numeric data: Agrawal and Kiernan, watermark detection 22

23 numeric data: virtual primary key If primary key does not exist or could be changed in attacks, then for each tuple partition each attribute Ai into MSBs Mi and LSBs (least g significant bits) Li virtual primary key = concatenation of two (or more) hash values in set {H(K,Mi): i=0, r-1} that are closest to zero Dynamic: for different tuples, different attributes may be selected (based on secret key) to form virtual primary key Content-based: it depends on hash values of MSBs rather than order of attributes [4] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. Constructing a virtual primary key for fingerprinting relational data. In DRM '03: Proceedings of the 2003 ACM workshop on Digital rights manage ment, pages , New York, NY, USA, ACM Press. 23

24 numeric data: challenges Challenges: sensitive data (destroys ulterior data uses) natural numeric transformations It is necessary: to handle a set of desired quality metrics + survive attacks (e.g. segmentation, alterations) 24

25 numeric data: key insight Encode information in global numeric properties of secret subsets of the data while continuously evaluating data quality C (backtrack if necessary). Which properties? How do we use them? 25

26 numeric data: weak mark distribution(s i ) c x stdev(s i ) avg(s i ) S i V c (S i ) handles: data loss linear changes random alterations 26

27 numeric data: amplification distribution(s i ) c x stdev(s i ) avg(s i ) S i V c (S i ) collection subset weak mark amplification collection collection subset By applying a (weak) mark on secret subsets of the original data set, it is effectively amplified. 27

28 numeric data: error correction 28

29 numeric data: detection process reconstruct subsets detect invalid subset encoding(s) detect valid bits construct error correction map apply error correction chain reconstruct watermark 29

30 allowable semantic constraints Idea: data consumer requirements define the data quality metrics and associated allowed bounds; encoding process guarantees those bounds. In other words: data quality metrics are not to be hard-coded; data use semantics are to be separated from the watermarking method. 30

31 wmdb.*: system architecture usability metric plugin A usability metric plugin B usability metric plugin C usability metrics plugin handler evaluate WM mark user key attributes backtrack log JDBC A1 A2 A3 A4 A5 A6 multi-threaded Java, tested with pgres/file-io/oracle 9 different JDBC drivers for different connections multiple databases at the same time, parallel watermarking 31

32 wmdb.*: runtime snapshot 32

33 wmdb.*: experiments overview resilience data loss (subset selection) absolute data changes epsilon attacks semantics and data quality classification preservation arbitrary query result performance running times notes: PC, MB RAM, Java, remote JDBC (SQL-92, e.g. Oracle, Postgres, even files), simultaneous multiple database marking, Sales Data from Wal-Mart etc. 33

34 experiments: data loss resilience 34

35 experiments: absolute change 35

36 experiments: arbitrary data change note: average zero epsilon-attack 36

37 experiments: arbitrary data change (2) note: average non-zero epsilon-attack, nice resilience, no knowledge of nature of transform. 37

38 experiments: classification preservation note: as guaranteed classification sensitivity decreases, available bandwidth increases 38

39 experiments: classification preservation (2) note: bandwidth increases as guaranteed classification goodness relaxes 39

40 experiments: performance note: includes local network costs, DBMS costs 40

41 41

42 categorical data: challenges Because there are no epsilon-changes, earlier approaches (numeric) do not work. What is our embedding channel? statistical bias in inter-attribute association Any alteration is discrete, possibly significant we would like to minimize the number (+maximize impact) of required alterations 42

43 embedding channel & # $ $! % # " # $ % # &(e.g. { Chicago, Bucharest Amsterdam }) Because there are no epsilon-changes, earlier approaches (numeric) do not work. we need a different embedding channel! inter-attribute association Any alteration is discrete, possibly significant.! we would like to minimize the number (+maximize impact) of required alterations 43

44 single-key bias # $ % # '()! '()*+, # Question: is the data watermarked? problem: is & this $ relevant (i.e. solution: wrt. by key radu ) k is!? by radu (not viable) solution: multi-bit watermark stating by radu select fit tuples How: slightly alter A, modulating some of its ( fit ) values according to a keyed one-way hash of K 44

45 single-key, single-bit bias & # $ $! % # '()! '() -*+, # Question: is the data watermarked? if yes then what is the one bit watermark? detection time: counting bias '*+, # (().. // '*+, # (().'*. '* // -0' 1 '* How: slightly alter A, modulating some of its ( fit ) values according to a oneway keyed hash of K and the value of the watermark bit w. 45

46 single-key, multi-bit bias problem: some watermark bits solution: might not use be separate considered keys due to +'().(),correlation! & $ and # to de-correlate. # $! % # '()! +, +, '* +, '() -2+3*+ '() -2+3 *+,, # # Question: is the data watermarked? if yes then what is the watermark string? +#, +$, +-, +(), +()*+ +() # *+,, +, +, How: slightly alter A, modulating some of its ("fit") values according to a one-way hash of K and a spread of the values of the watermark w. 46

47 multi-key, multi-bit bias drawback: multi-mark inference, multi-pass solution: required build in (?) interference +, +#, +$, awareness (hash-map)! & # # $ - $ $! % # /! Question: is the data watermarked? if yes then what is the watermark string? +-, +, +, global key 0(. #.. ) one-bit watermarking algorithm How: embed m one-bit watermarks into data using separate dedicated keys. 47

48 vertical partitioning: multi-attribute encoding Question: How to survive vertical partitioning? problem: multi-mark interference & $ solution: interference dependency graph problem: non-primary key first argument! solution: # multi-layer % low impact watermarks! multi-bit watermarking # 1 1 & # $! % # % $ $ #! % % $! -! - How: Embed a watermark in all expected partitions (closure). 48

49 mark interference 1 2 Question: How to deal with multiple marks encoding interference? How: Maintain a mark interference dependency graph so as to propagate awareness of changes. 49

50 attack: bucket counting 1 # $! '() Question: How to survive a correlation attack aimed at detecting statistical bias in case of non-primary key first argument? problem: values in A (non-key) can repeat Mallory can count buckets for 2 ' 3 pairs and identify hot spots #! solution: increase size of possible assigned target values for B when encoding. '() *+, # ' $) 4*+, # 54 $, %&& How: Larger target value sets for fit tuples. 50

51 attack: bucket counting revisited Question: How to survive a correlation attack aimed at detecting statistical bias in case of non-key first argument? 1 # # $! $ - # '()! global key 0(. #.. ) low-impact encoding How: Spread correlation among multiple layers of weak(er) low-impact encodings. 51

52 attack: extreme partitioning Question: How to survive extreme, single-attribute partitioning? $! %! 3-6' * one *17 answer: frequency domain of value occurrences & # $! % 1 # % $ 1 # % $ solution: alter this frequency domain value occurrence histogram to encode an additional watermark.! - - How: Frequency domain embedding. 52

53 attack: value re-mapping # $ % # & Question: How to deal with bijective value re-mappings? 4 & $ & 4 $ #! % (8 # 4! 4 %! 4! #8 $8 %8 # & freq '98 1 How: Discover inverse mapping by using frequency histograms. 53

54 attack: informed inverts Question: How to survive informed mark removal attacks? 5 # solution: if Mallory inverts embedding 2 it effectively enforces 1 (collision set bias). How: Multiple self-reinforcing layers. 54

55 architecture quality metric A quality metric B quality metric C K A B... data quality metrics plugin handler evaluate WM r/w mark user key attributes: K,A backtrack log DBMS JDBC schema metadata 55

56 selected results watermark recovery in the presence of random alterations (error corrected) watermark recovery in the presence of data loss (error corrected) 56

57 resilience analysis -66*'* + * 6 ': 7 a P( r, a) = P'( r, ) = e a / e a / e i= r i p i (1 p) ( a / e) i ;6** ** +-6<= (( <= (>(1 ;6<Σ=?* 1<'Σ=?' f ( X ) = i X i mean = stdev a X i p e a p (1 p) e 'Σ= 64 *> ** - -'-- <'Σ=?'**0 <@,>>(ABC 57

58 categorical data: analysis D 6-'E***,>C '6,>>-6 >C '6'*6*66 +@' AC D'- * + (@C * E*** *' '6(@ 60 r e wm ( tecc) = 1% N wm _ data ;6F D 6-'E**- * +*-6AC**6 6 '*,>C '6G + 6**66* '6G 58

59 categorical data: analysis * 9+ + * * * 7 #0E** ''6,>C '6 - * *6 >C D 6-6-6* *,C ' 6*+ '>C 59

60 60

61 sensor streams: scenario sensor sensor sensor sensor farm wm Licensed Data Consumer STOP sensor sensor Third Party sensing environment 61

62 sensor streams: challenges Transforms Segmentation (no timestamps!) Summarization Sampling Attacks Random Alterations Linear Changes Streaming model Fast encoding (almost real time) Single-pass (no second look at data) Memory bounds 62

63 sample temperature stream A +6.0 C +7.7 E +6.7 F G I +8.7 H K +6.0 B D +2.0 J -5.5 time 63

64 trivial embedding (no timeline) idea: use resilient stream features to encode watermark bits (e.g., extremes) major extremes: η t 1 η t 2 η t 3 η t 4 η t 5 η t 6 time pick some extremes ( fit, major ) H ( msb( η, α ), k1)modφ = i i b( wm) = m wm[i 1 ] wm[i 2 ] +, +#, +$, +-, +, +, 64

65 trivial characteristic subset encoding time e η d δ Encoding: characteristic subset x Θ( η), msb( x, α ) = msb( η, α ) x Θ( η), x[ bit] bit = H ( msb( η, α ), = wm[ i], k 1 )mod β deals with: sampling, summarization 65

66 vulnerability: correlation detection major extremes: η t 1 η t 2 η t 3 η t 4 η t 5 η t 6 H ( msb( η, α ), k1)modφ = i time i b( wm) = m wm[i 1 ] wm[i 2 ] +, +#, +$, +-, +, +, problem: bit-location-msb correlation values in MSB can repeat Mallory can count buckets per * 9 MSB values and identify hot spots need: alternate source of (pseudo-) randomness 66

67 if we would have a reference timeline discrete stream: labels: x t x 1 t x 2 t x 3 t x 4 t x 5 t 6 t 1 t 2 t 3 t 4 t 5 t 6 time tuple then we could maybe apply existing relational data methods (e.g. numeric watermarking by Kiernan and Agrawal, VLDB 2002) would survive random alterations (but not summarization and other transforms). 67

68 timeline requirements survives: transforms (summarization, sampling) attacks (segmentation, random alterations) can be constructed: fast from little more than a window of data 68

69 constructing timeline : stream behaviour idea: timeline = differential interpretation of stream behavior A +6.0 C +7.7 E +6.7 F G I +8.7 H K +6.0 B -7.3 AC: CE: 0 D +2.0 EG: 1 GI: 0 J -5.5 IK: 0 time label(k): deals with: segmentation, sampling, summarization 69

70 bit embedding (with timeline) bit = H t 3, k ) mod β ( 1 bit = H t 5, k ) mod β ( 1 time e time d e d characteristic subset characteristic subset major extremes: η t 1 η t 2 η t 3 η t 4 η t 5 η t 6 labels: t 1 t 2 t 3 t 4 t 5 t 6 time H ( msb( η, α ), k1)modφ = i i b( wm) = m wm[i 1 ] wm[i 2 ] +, +#, +$, +-, +, +, partial problem remains: Mallory can count buckets per * 9 MSB values (+previous labels!) and sometimes identify hot spots smarter: labeling, encoding convention 70

71 smarter characteristic subset encoding partial hash sums Θ( η, δ ) = { x i 1,..., x j [1, a], m ij a = } x u u [ i, j] j i + 1 encoding convention: true lsb( H ( lsb( m, β ), label( η)), ζ ) = 2 ζ 1 false ij lsb( H ( lsb( m, β ), label( η)), ζ ) = 0 ij pros: cons: survives summarization provides randomness de-correlates encoding location finding conforming data point is computationally very expensive 71

72 generate data with conforming partial sums computation required is exponential, but we are ok because we can likely get away with computing just a few of them 72

73 sensor streams: implementation in mark key wm undo log window quality eval. agg. data out constraint A constraint B constraint C 73

74 sensor streams: summarization 74

75 sensor streams: sampling 75

76 sensor streams: sampling+summarization 76

77 sensor streams: segmentation 77

78 sensor streams: random alteration 78

79 sensor streams: impact on quality 79

80 80

81 limits Are there any bounds one can assess for watermarking as a tool for rights protection? 81

82 limits: usability spaces u1 U max U wm f(ε) O' x U wm2 f( max ) x O wm U wm1 u2 A point uniquely identifies a Work in D in this 2 dimensional view of an usability space. Watermarking is a translation that results in O, a watermarked version of O. 82

83 limits: Mallory attacks u1 U max U a2 U attack U wm O' x U a1 U wm2 wm U wm1 x O U successful attack u2 A successful attack is one that yields results in the area of intersection between U max and (U a -U wm ). 83

84 84 limits: inherent vulnerability No matter what the watermarking method, there exists a random attack with a significant non-zero success probability. A more convincing mark yields an even more vulnerable bound on attack success probability max ) 2 ( cos ) 2 (1 cos a w a a a a a a w a sa R d R d R d R R d R d R u U P π π ε π π ε + = =

85 limits: what if scenarios high dimensionality sparse vicinities concavity smart Mallory 85

86 limits: sparse vicinities u1 U data O x U wm1 U wm3 U wm4 U max1 U max3 U max4 wm uninformed attack U wm2 U max2 x O' U max5 U wm5 U wm6 U wm7 U max6 U max7 u2 86

87 limits: concave shapes u1 U data U attack1 x O' 1 wm 1 x O wm 2 U attack2 x O' 2 u2 87

88 watermarking principles Convince-ability Trade-off. There exists a direct relationship between the probability of success of a random attack and the ability to convince in court. The more convincing in court, the higher the probability of success of a random attack. are there classes for which this is not true? Optimality Principle. The vulnerability of a watermarking scheme is minimized when it yields watermarked result Works on the boundary of the maximum allowable distortion vicinity of the originals. recommendation for algorithm design 88

89 89

90 future knowledge centric model of security attacks integrate constraint handling in encoding multi-source data integration extend limit proofs, understand broader class optimizer: find sweet spot in encoding space wmdb.*: backtrack pruning speed up protect categorical data streams intersection: categorical - numerical data alteration distance (categorical data) 90

91 selected references [1] Rakesh Agrawal, Peter J. Haas, and Jerry Kiernan. Watermarking relational data: framework, algorithms and analysis. The VLDB Journal, 12(2): , [2] David Gross-Amblard. Query-preserving watermarking of relational databases and xml documents. In Proceedings of the Nineteenth ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, pages , New York, NY, USA, ACM Press. [3] J. Kiernan and R. Agrawal. Watermarking relational databases. In Proceedings of the 28th International Conference on Very Large Databases VLDB, [4] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. Constructing a virtual primary key for fingerprinting relational data. In DRM '03: Proceedings of the 2003 ACM workshop on Digital rights manage ment, pages , New York, NY, USA, ACM Press. [5]. Proving ownership over categorical data. In Proceedings of the IEEE International Conference on Data Engineering ICDE, [6]. wmdb.*: A suite for database watermarking (demo). In Proceedings of the IEEE International Conference on Data Engineering ICDE, [7], Mikhail Atallah, and Sunil Prabhakar. Rights protection for relational data. In Proceedings of the ACM Special Interest Group on Management of Data Conference SIGMOD, [8], Mikhail Atallah, and Sunil Prabhakar. Relational data rights protection through watermarking. IEEE Transactions on Knowledge and Data Engineering TKDE, 16(6), June [9], Mikhail Atallah, and Sunil Prabhakar. Resilient rights protection for sensor streams. In Proceedings of the Very Large Databases Conference VLDB, [10], Mikhail Atallah, and Sunil Prabhakar. Ownership proofs for categorical data. IEEE Transactions on Knowledge and Data Engineering TKDE,

92 eof # $ % 92

93 more references [1] Rakesh Agrawal, Peter J. Haas, and Jerry Kiernan. Watermarking relational data: framework, algorithms and analysis. The VLDB Journal, 12(2): , [2] David Gross-Amblard. Query-preserving watermarking of relational databases and xml documents. In Proceedings of the Nineteenth ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, pages , New York, NY, USA, ACM Press. [3] J. Kiernan and R. Agrawal. Watermarking relational databases. In Proceedings of the 28th International Conference on Very Large Databases VLDB, [4] Yingjiu Li, Huiping Guo, and Sushil Jajodia. Tamper detection and localization for categorical data using fragile watermarks. In DRM '04: Proceedings of the 4th ACM workshop on Digital rights management, pages 73-82, New York, NY, USA, ACM Press. [5] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. Constructing a virtual primary key for fingerprinting relational data. In DRM '03: Proceedings of the 2003 ACM workshop on Digital rights manage ment, pages , New York, NY, USA, ACM Press. [6] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. A robust watermarking scheme for relational data. In Proceedings of the Workshop on Information Technology and Systems (WITS), pages , [7] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. Defending against additive attacks with maximal errors in watermarking relational databases. In Proceedings of the IFIP WG 11.3 Working Conference on Data and Application Security, pages 81-94, [8] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. Fingerprinting relational databases: Schemes and specialties. IEEE Transactions on Dependable and Secure Computing, 2(1):34-45, [9]. Proving ownership over categorical data. In Proceedings of the IEEE International Conference on Data Engineering ICDE, [10]. Rights Assessment for Discrete Digital Data, Ph.D. dissertation. Computer Sciences, Purdue University, [11]. wmdb.*: A suite for database watermarking (demo). In Proceedings of the IEEE International Conference on Data Engineering ICDE, [12] and Mikhail Atallah. Attacking digital watermarks. In Proceedings of the Symposium on Electronic Imaging SPIE, [13], Mikhail Atallah, and Sunil Prabhakar. On watermarking numeric sets. Online at [14], Mikhail Atallah, and Sunil Prabhakar. On watermarking numeric sets. In Proceedings of IWDW 2002, Lecture Notes in Computer Science. Springer-Verlag, [15], Mikhail Atallah, and Sunil Prabhakar. Power: Metrics for evaluating watermarking algorithms. In Proceedings of IEEE ITCC IEEE Computer Society Press, [16], Mikhail Atallah, and Sunil Prabhakar. Watermarking databases. Online at [17], Mikhail Atallah, and Sunil Prabhakar. Rights protection for relational data. In Proceedings of the ACM Special Interest Group on Management of Data Conference SIGMOD, [18], Mikhail Atallah, and Sunil Prabhakar. Relational data rights protection through watermarking. IEEE Transactions on Knowledge and Data Engineering TKDE, 16(6), June [19], Mikhail Atallah, and Sunil Prabhakar. Resilient rights protection for sensor streams. In Proceedings of the Very Large Databases Conference VLDB, [20], Mikhail Atallah, and Sunil Prabhakar. Ownership proofs for categorical data. IEEE Transactions on Knowledge and Data Engineering TKDE,

94 94

95 David-Gross Amblard, PODS 2003 The main difficulty preserving query results is linked to the informational complexity of sets defined by queries, rather than their computational complexity". Roughly, if the family of sets defined by the queries is not learnable [36], no query-preserving data alteration scheme can be designed. Under certain assumptions (i.e., query sets defined by firstorder logic and monadic second order logic on restricted classes of structures with a bounded degree for the Gaifman graph or the tree-width of the structure) a querypreserving data alteration scheme indeed exists. 95

96 relational data: scenario Given a numeric relational database B(a 1,, a n ), a set of local and global semantic constraints C, and a set of secrets K, determine a watermarked version B (a 1,, a n ) of B, such that all elements in C are satisfied (over B ) and B features enough watermark resilience. example challenges: what is resilience? recover mark with minimal context (i.e. no original data available)? 96