Mobile Application Security for Video Streaming Authentication and Data Integrity Combining Digital Signature and Watermarking Techniques

Transcription

1 Moble Applcaton Securty for Vdeo Streamng Authentcaton and Data Integrty Combnng Dgtal Sgnature and Watermarkng Technques Stefano Chessa, Roberto D Petro, Erna Ferro, Gaetano Gunta, Gabrele Olger ISTI-CNR, Area della Rcerca d Psa, Va G.Moruzz 1, Psa, Italy Dpartmento d Informatca, Unverstà d Psa, Largo. Pontecorvo 3, Psa, Italy Dpartmento d Matematca, Unverstà d Roma Tre, L.go S. Muraldo 1, 046 Rome, Italy. Dpartmento d Elettronca Applcata, Unverstà d Roma Tre, Va della Vasca Navale 84, 046 Rome, Italy. Abstract Satellte lnk presents pecular characterstcs lke no packet reorderng and low bt error rate. In ths paper we leverage these characterstcs combned wth watermarkng technques to propose a novel authentcaton algorthm for multcast vdeo streamng. Ths algorthm combnes a sngle dgtal ature wth a hash chan pre-computed on the transmtter sde; the hash chan s embedded n the vdeo stream by means of a watermarkng technque. Our proposal shows several nterestng features: Authentcaton s enforced, as well as ntegrty of the receved multcast stream; receved blocks can be authentcated on the fly; no storage s requred on the recever sde, except for the amount of memory needed to store a sngle hash; overhead computatons requred on the recever sum up to sngle hash per block, whle a dgtal ature verfcaton s amortzed over the whole receved stream. Fnally, note that the bandwdth overhead ntroduced s neglgble, snce the appled watermarkng technque ntroduces vrtually no modfcatons (at least, not recognzable by humans) on the orgnal vdeo stream pctures. I. INTRODUCTION In a secure vdeo-streamng system, sender authentcaton must be performed to prevent unauthorsed use of the shared meda [1]. Conventonal methods for securely dentfyng mages use hash functons. Dgtal ature standard, used n cryptosystem to dspute authentcaton documents, also nvolve the use of hash functons. A dgtal ature s a bt stream dependent on a prvate key and the content of the document to be ed. For each document, the dgtal ature algorthm provdes a unque output bt stream [2]. Authentcaton schemes assert that an adversary cannot compute the same ature wth two dfferent messages. In cryptosystems, ths type of process s largely used to ensure data ntegrty, data orgn authentcaton and non repudaton. The dgtal ature s based on a hash functon (or a oneway hash functon -OWH-) and an encrypton algorthm [3]. Ths work has been supported by the CNR/MIUR program Legge 449/97 (project IS-Manet) and by the European Commsson wthn the 6th Research Framework Programme n the framework of the European Satellte Communcatons Network of Excellence (SatNEx II, IST-27393) for the FT4 Vdeo Streamng Authentcaton n satellte communcatons (VStA) of the JA 2240 Securty. One-way functons and cryptographc hash functons are computed by cryptographc prmtves wthout key. For example, MD5 [4] and SHA-1 [5] are customzed hash functons n cryptographc process. Another method for securely dentfyng mages s watermarkng. In order to be effcent n mages [1], the dgtal ature should be dfferent f and only f the mage contents are dfferent. Dgtal watermarkng [6] s a multdscplnary feld that combnes meda and al processng wth cryptography, communcaton theory, codng theory, al compresson, theory of human percepton, and qualty of servce requrements [7]. Technques based on watermarkng are largely used for copyrght protecton and fast search of mages n databases [6]. In authentcaton or copyrght watermark, the embedded ature watermarks the data wth the owner s or producer s dentfcaton. Ths s the enablng technology to prove ownershp on copyrghted materal, ether to montor the use of the copyrghted multmeda data, or to analyse where the data s n use over networks and servers. Ths technology bulds on the dea of hdng meta-nformaton, lke an owner s ature, n physcal materal n whch content s represented, such as the pxels of an mage. From the dgtal form, authorsed recpents can extract the embedded nformaton when necessary to show proof of ownershp. In general, we have a watermarkng embeddng functon that nserts a watermark h nto meda data and generates the watermarked data w. A detector can check for the exstence of the watermark and extracts t (h) from data w. The embeddng and detector functons are usually publc but they are ntalsed by keys to acheve securty. Referrng to the exstng lterature, to the best of our knowledge, no publshed papers deal wth proposals of a combned procedure nvolvng dgtal watermarkng together wth publc/prvate key securty mechansm. Dgtal watermarkng technques should be robust and fragle at once [6]. Copyrght, fngerprnt, and copy-control watermarks should have a hgh robustness, consstng of resstance to blnd, non-targeted modfcatons, or common meda operaton. For manpulaton recognton, the ntegrty watermark /$ IEEE 634

2 0 1 RSA(H( 1)) H( ) 1 2 H( ) Fg. 2. Hash chan constructed on three blocks. Fg. 1. Multcast satellte scenaro. must be fragle (t dsappears f someone has altered the fle) to detect altered meda. Secure watermarkng mples that embedded nformaton cannot be removed by targeted attacks wthout these modfcatons beng detected. Moreover, watermark must be transparent accordng to the propertes of the human sensory system, n order that a transparent watermark causes no artfacts or qualty loss. Furthermore, ether a prvate verfcaton (by a prvate-key functon) or a publc verfcaton (by a publc-key algorthm) of the embedded watermark has to be mplemented, dependng on the partcular applcaton. All these characterstcs should operate at a reasonable level of complexty: The ntroduced overhead requred to embed and retreve a watermark should be low, especally for real-tme applcatons such as vdeo-streamng. II. SYSTEM MODEL Multcast satellte networks present pecular characterstcs lke hgh round trp tme, no packet reorderng and low bt error rate (ER). For nstance, geostatonary satelltes placed n equatoral orbt at 36,000 km alttude, ntroduce a transmsson delay between transmtter and recever of about 250 ms, whle satellte lnk presents a low ER of about 10 8 n the majorty of cases [8]. Ths low ER s due to de requrements and structural constrants. Leveragng the low ER and the no packet reorderng feature, we propose a novel schema for authentcatng multcast vdeo streamng that does not affect avalable bandwdth. Our scenaro s n Fgure 1: The center has to dstrbute an uncompressed vdeo stream through a multcast satellte network. oth transmtter and recever can perform preprocessng elaboratons, lke MPEG2 codng/decodng, before the transmsson and after recepton respectvely. The use of MPEG2 [9] algorthm s justfed f we assume our satellte network usng DV-S [10]. The sender preprocesses the uncompressed vdeo stream nsertng n t the authentcaton nformaton. Ths s acheved wth watermarkng technque. The next step for the sender s frst to perform MPEG2 compresson and then to transmt the al to the varous recever statons through the satellte net- work. It s worth notcng that usng watermarkng technque to embed authentcaton nformaton wthn the vdeo stream avods to ncur n any bandwdth overhead. Indeed, the authentcaton nformaton ntroduce just transparent modfcatons to the vdeo pctures (that s, modfcatons that wll not affect the perceved qualty of the vdeo). Each recever staton decompresses the vdeo stream and then authentcates t. Ths goal s obtaned combnng a a dgtal ature lke RSA [11] wth a hash chan. Fgure 2 syntheszes the authentcaton schema, where x s the compressed verson of the block x (GOP). Ths approach amortses also the computatonal overhead due to the sngle asymmetrc ature over the whole vdeo stream, tradng off the overhead related to dgtal ature, wth the overhead requred by one way hash functons, lke SHA-1 [12], charactersed by a low computatonal overhead. III. THE AUTHENTICATION PROCEDURE In ths secton we present a novel authentcaton procedure for multcast vdeo streamng. We propose a new authentcaton schema based on sngle dgtal ature lke RSA [11], authentcatng a one-tme ature chan. The hash chan, (that could be bult over SHA-1 [12]) s hdden n the vdeo stream pctures, by means of the watermarkng technque descrbed n Secton IV. An MPEG2 vdeo stream can be consdered as a GOP (Group Of Pctures) sequence, lke n Fgure 3. A GOP s composed of three dfferent types of pctures: I-pcture (Intra), P-pcture (Predctve), and -pcture (drectonally predctve). Insde a GOP there s only one I-pcture and one or more and P-pctures. Compresson s computed over two dfferent levels: The spatal and the temporal ones [9]. Spatal compresson s performed only over the I-pcture, whle temporal compresson s carred out over the and the P-pctures. These pctures are obtaned va dfference from the I-pcture. A GOP, hereafter G, represents n the MPEG2 doman a well known pcture sequence (block) n the uncompressed doman. Let H( ) and Sgnature( ) be the functons that mplement a SHA-1 hash and an RSA ature respectvely. The functon Mpeg2( ) computes the GOP assocated wth the specfc nput block usng the MPEG2 algorthm. Fnally, W (x, y) nserts the data y nto a block of x pctures accordng to the watermarkng algorthm descrbed n Secton IV. Table I descrbes n detals how the sender bulds up the hash chan. Transmtter s provded wth an uncompressed vdeo stream S and nterprets t as sequence of blocks of pctures 635

3 S G 1 G2 G3 G4 G n 1 Gn Fg. 3. IP... Vdeo stream as a pcture sequence. [ 1,..., n ], so that each block wll be codfed afterwards as a GOP by the MPEG2 algorthm. The last block of the vdeo sequence s compressed: G c = Mpeg2( n ). The constructon of the hash chan starts from the block of ndex n 1. The hash value h s calculated over the GOP G c through the functon h = H(G c ). Ths value (h ) s nserted nto the block by means of the watermarkng functon W (,h ).The watermarked block s now encoded wth G c = Mpeg2( w), obtanng the GOP G c that wll be the argument for the next hash calculaton. The procedure s terated over all the blocks up to the frst one ( 1 ). Fnally, the frst GOP (G c ) s authentcated through a dgtal ature wth Sgnature(H(G c )). Note that ths s the only asymmetrc operaton performed by the sender. The marked block sequence s now codfed wth MPEG2 by the functon Mpeg2([1 w,...,n w ]). Note that each block belongng to S s codfed nto a GOP n S c. Hence, each block n the uncompressed doman corresponds to a GOP n the compressed doman. TALE I Constructon of the sngle hash chan let S =[ 1,..., n] be the uncompressed vdeo stream block sequence; G c = Mpeg2( n) ; for = n 1 to 1 h = H(G c); w = W (,h ); G c = Mpeg2( w ) ; Sg = Sgnature(H(G c)); S c = Mpeg2([1 w,...,n w ]) ; Transmt (Sg,S c); On the recever sde, the authentcaton procedure work as follows: Once the recever has stored (Sg,S c ), t decodes the MPEG2 stream and extracts a GOP sequence from the compressed vdeo stream S c va ExtGOP( ), that s: [G 1,...,G n ]=ExtGOP(S c ). Now, the recever has to authentcate the anchor of the authentcaton chan. Note that ths operaton s the only operaton based on asymmetrc key cryptography on the recever sde. Hence, once the hash over the frst GOP s computed: h = H(G 1 ), ths value s employed to verfy the dgtal ature (Sg) wth V ersgnature(sg,h). If the test succeeds, the recever can subsequently authentcate the vdeo stream checkng for the authentcty of each block of the hash chan. The hash value h nserted by the sender s extracted from the block u through the watermark retreval functon E( u ). u s obtaned repeatedly from each GOP belongng to the vdeo stream through u = UnMpeg2(G ). The value h s then compared wth the hash calculated by the recever over the GOP G +1, that s H(G +1 ). The executon proceeds teratvely only f the test s successful for all of the blocks. If a pcture s corrupted (for nstance, forged or changed durng the channel transmsson) ts hash changes, and the authentcaton test fals. Note that once a falure s trggered, all the subsequent pctures cannot be authentcated. Table II shows n detals the algorthm run by the recever. TALE II Verfcaton of the authentcty of sequence Sg,S c Receve (Sg,S c); [G 1,...,G n]=extgop (S c) ; h = H(G 1); f not ( V ersgnature(sg,h) ) authentcaton faled; ext; for =1to n u = UnMpeg2(G ) ; h = E( u); f h =H(G +1); authentcaton faled; ext; Wthout losng of generalty, we assumed that the sequence (Sg,S c ) s receved correctly. Whle ths assumpton s acceptable due to the low ER of satellte lnk, t should be noted that f message corrupton should become an ssue, t could be tackled consderng redundant hash chan or usng FEC [13]. For nstance, robustness could be obtaned embeddng nto the same block more than one hash calculated over several GOP. IV. THE EMEDDING PROCEDURE A. Embeddng nformaton as watermark In ths secton we descrbe the technque used to embed the hash chan nto the vdeo stream. In partcular, we descrbe the functons W ( ) and E( ) used n the prevous secton. Note that our use of watermarkng technques s not standard; classcal watermarkng s used to embed a logo (generally a pcture) wthn a vdeo stream. Ths embeddng s hdden n the vdeo and t can be extracted to wtness the ownershp of the vdeo. It s acceptable that the extracton 636

4 could be lossy, that s, the logo can be extracted wth errors, provded t remans recognsable. Instead, n our case, we use watermarkng to embed the result of a hash computaton. The extracton of the hash must not be affected by errors, otherwse the hash chan would break and the recever could not authentcate the remanng of the vdeo stream. For ths reason, n ths secton we propose an embeddng technque that provdes error-free hash extracton. An uncompressed vdeo stream can be consdered as a three dmensonal al, where ts components are a bdmensonal matrx (the pcture) and the tme. Each pcture s formed by a w h matrx of pxels; each pxel expresses a colour that can be represented by three values: R (red), G (green), (blue) or, equvalently, by Y(lumnance) and U, V (chromnance) components. In our algorthm, we consder the Y-U-V representaton, and we embed a mark (hash) on each pcture of the vdeo stream on ts lumnance component (Y). We use a Fourer doman method based on the DCT (dscrete cosne transform). Ths method assures robustness wth regard to varous types of compresson methods lke MPEG2 or MPEG4 [14], [15]. Ths procedure works modfyng the mage frequency doman coeffcents; t thus has a mnmal mpact n the spatal doman of the pcture. Let us consder as a block of pctures and h the hash value that should be embedded n each pcture belongng to the block. Note that, due to specfc features of the mark extracton (dscussed n Secton IV-), the mark must be represented as a sequence of 1, 1. For ths reason h (whch s a sequence of 0, 1) s frst smply converted nto a sequence of 1, 1. Then, for each pcture p (wth 1 m) n, themarkh s embedded n p usng the followng equaton: P = DCTp (Y) (1) TALE III Functon W ( ) embeddng a hash value nto vdeo stream pctures let be a vdeo block belongng to the stream S; let h be the hash value to be embedded n ; let p 1,...,p m be the pctures belongng to ; let α be an amplfcaton factor; let PRSG( ) be a pseudo random sequence generator algorthm; H Rep =[h,h,...,h] // concatenaton of the // h replcatons h Rep M ( = Reshape to a ) square matrx h Rep 0 0 // Place data nto hgh h W = 0 h Rep M // frequency DCT doman for =1to k n = PRSG() P = DCTp (Y) = P HF + P HF P h p (Y )=DCT 1 P h (Y) α n h W TALE IV Functon E( ) retrevng the hash value from a block of vdeo pctures let be a vdeo block belongng to the stream S; let p 1,...,p m be the pctures belongng to ; let PRSG( ) a pseudo random sequence generator algorthm; let SIGN s the mathematcal um functon x =0 for =1to m n = PRSG() P = DCTp (Y) n P HF = Extract hgh frequency from P P HFV = Reshape P HF to a vector // Consder P HFV h = h j as [h,...,h j,...,h] x = x + h h = SIGNx P H = P HF + P HF α n h W (2) Equaton 1 computes the DCT transformaton over the lumnance (Y) component p (Y ), obtanng P. Equaton 2 embeds h W, a repeated and reshaped verson of vector h, n the hgh frequency of P, denoted P HF. To ths goal, we defne the parameters α, an amplfcaton factor, and n,a pseudo-nose sequence whch s changed for each pcture. In partcular, n s a matrx of bnary ( 1, 1) pseudo nose sequences. The spread sequence n h s multpled by an amplfcaton factor (α), replcated accordng to a replcaton factor, and fnally reshaped to a matrx of the same dmensons of the pcture. The mark s scaled by the lumnance frequency coeffcents, so that t s spread proportonally to the DCT coeffcents. Fnally, the resultng sequence s summed up to the hghest of the DCT transformed pcture P. The pseudo code of the embeddng algorthm s shown n Table III. frequences coeffcents P HF. Retreval of nformaton Snce the mark has been embedded n each pcture of the block, the recever extracts the mark from each pcture. Ths s necessary because the extracton from a sngle pcture s, n general, affected by errors. Thus, the mark s obtaned combnng the nformaton extracted from all the pctures n the block. Gven a pcture p n an ncomng block, the recever performs a DCT transform over the lumnance component (Y) of the pcture denoted P. Then, t extracts the mark from the hgh frequences of P (whch are the frequences where the mark was embedded). Ths s acheved usng the followng equatons: P HF n = P HF = P HF n + P HF α n h W n n + P HF α h W 637

5 Let h (j) be the j th replca of the hash nsde pcture and Red be the number of hash replcatons n each pcture. The recever combnes the marks extracted from each pcture usng the followng equaton: =k j=red =1 P (j) n (j)+ P (j) α h (j) (3) where the nner sum accumulates mark replcated wthn a gven pcture, and the outer sum accumulates all the marks extracted from all the pctures n the block. The choce of the number of pctures to be embedded n a block s essental: If the number of pctures s too small, the ntroduced mark redundancy could be nsuffcent and the extracton fal. lock dmensonng s an essental operaton that must be done by the sender n the preprocessng phase of the vdeo streamng. Snce the frst term n Equaton 3 (P (j) n (j)) expresses uncorrelated als, ther sum tends to 0 thus, f the number of pctures n a block s suffcently hgh, Equaton 3 becomes: =k j=red =1 P (j) α h (j). (4) Thus, mark extracton s performed over Equaton 4 usng the um functon as: but =k j=red =1 =k j=red =1 =k j=red =1 P (j) α h (j) P (j) α h P (j) α 1. The pseudo code of the extracton algorthm s shown n Table IV. V. CONCLUSIONS We have presented a novel scheme for authentcatng vdeo streamng n a multcast satellte network. The proposed scheme leverages pecular features of satellte lnk, lke low ER and no packet reorderng. In partcular, ths work shows how t t possble to use watermarkng to embed securty related nformaton. The securty propertes enforced are authentcaton and ntegrty of the multcast stream. These features are acheved usng just one dgtal ature, combned wth a pre-computed hash chan. In partcular, we embed the hash chan nsde the vdeo by means of a watermarkng technque. Ths soluton provdes several benefts; on the sender sde: The computaton overhead sums up to a dgtal ature for the whole stream and a hash per block; as for bandwdth, securty related nformaton does not consume ths resource, snce these data are nserted n the vdeo stream pctures through neglgble modfcatons (at least, not recognzable by humans). On the recever sde: Authentcaton s performed on a per block bass; no extra storage s requred on the recever, except for the storng of a hash value; the computatonal overhead on the recever sde s lmted to one dgtal ature verfcaton, that s amortzed over the whole multcast stream, and one extra hash computaton per block. Future work strves to extend the proposed scheme provdng reslence to ncreasngly lossy channel. REFERENCES [1] F. Lefèbvre, J. Czyz, and. M. Macq, A robust soft hash algorthm for dgtal mage ature. n ICIP (2), 2003, pp [2] O. Goldrech, Two remarks concernng the goldwasser-mcal-rvest ature scheme, n CRYPTO, 1986, pp [3] Dgtal ature standard (DSS). Washngton: Natonal Insttute of Standards and Technology, 2000, federal Informaton Processng Standard [4] R. Rvest, The MD5 message-dgest algorthm, RFC 1321, [5] N.. of Standards, Dgtal ature standard, Natonal ureau of Standards, Tech. Rep. FIPS Publcaton 186, [6] J. Dttmann and F. Nack, Copyrght-copywrong, IEEE MultMeda, vol. 07, no. 4, pp , [7] F. enedetto, G. Gunta, and A. Ner, End-to-end qualty of servce assessment n moble applcatons for user-centrc multmeda networks by tracng watermarkng, n IEEE 12 th Symp. on Communcaton and Vehcular Tecnology, Twente, Netherland, [8] A. Annese, P. arsocch, N. Celandron, and E. Ferro, Performance evaluaton of udp multmeda traffc flows n satellte-wlan ntegrated paths, n Proceedngs of the 11th Ka and roadband Communcatons Conference, Sept. 2005, pp [9] D. L. Gall, Mpeg: a vdeo compresson standard for multmeda applcatons, Commun. ACM, vol. 34, no. 4, pp , [10] R. de run and J. Smts, Dgtal vdeo broadcastng: technology, standards, and regulatons. Norwood, MA, USA: Artech House, Inc., [11] R. L. Rvest, A. Shamr, and L. M. Adelman, A method for obtanng dgtal atures and publc-key cryptosystems, Tech. Rep. MIT/LCS/TM-82, [12] D. Eastlake 3rd and P. Jones, US Secure Hash Algorthm 1 (SHA1), RFC 3174, Sept. 20. [13] M. Luby, L. Vcsano, J. Gemmell, L. Rzzo, M. Handley, and J. Crowcroft, Forward error correcton (fec) buldng block,, Unted States, [14] M. arn, F. artoln, and N. Checcacc, Watermarkng of mpeg-4 vdeo objects. IEEE Transactons on Multmeda, vol. 7, no. 1, pp , [15] S. swas, S. R. Das, and E. M.Petru, An adaptve compressed mpeg- 2 vdeo watermarkng scheme, IEEE Transactons on Instrumentaton and Measuremnent, vol. 54, no. 5, pp ,