Combining digital Watermarks and collusion secure Fingerprints for digital Images

Transcription

1 header for SPIE use Combining digital Watermarks and collusion secure Fingerprints for digital Images Jana Dittmann a, Alexander Behr a, Mark Stabenau a, Peter Schmitt b, Jörg Schwenk c, Johannes Ueberberg d a GMD - German National Research Center for Information Techology, Darmstadt, Germany b Justus Liebig University, Giessen, Germany c Deutsche Telekom, Technologiezentrum, Darmstadt, Germany d debis, IT Security Services, Germany ABSTRACT Digital watermarking is the enabling technology to prove ownership on copyrighted material, detect originators of illegally made copies, monitor the usage of the copyrighted multimedia data and analyze the spread spectrum of the data over networks and servers. Embedding of unique customer identification as a watermark into data is called fingerprinting to identify illegal copies of documents. Basically, watermarks embedded into multimedia data for enforcing copyrights must uniquely identify the data and must be difficult to remove, even after various media transformation processes. Digital fingerprinting raises the additional problem that we produce different copies for each customer. Attackers can compare several fingerprinted copies to find and destroy the embedded identification string by altering the data in those places where a difference was detected. In our paper we present a technology for combining a collusion-secure fingerprinting scheme based on finite geometries and a watermarking mechanism with special marking points for digital images. The only marking positions the pirates can not detect are those positions which contain the same letter in all the compared documents, called intersection of different fingerprints. The proposed technology for a maximal number d of pirates, puts enough information in the intersection of up to d fingerprints to uniquely identify all the pirates. Keywords: Collusion secure fingerprinting, watermarking, copyright protection, customer copy identification 1. MOTIVATION The expansion of digital networks all over the world allows extensive access on, and reuse of, visual material. Problems include unauthorised taping, reading, manipulating or removing of data, which might lead to financial loss or legal problems of the producers and creators. Thus, designers, producers and publishers of digital data like images, video or multimedia material are seeking technical solutions to the problems associated with copyright protection of multimedia data. Thus, systems are required which provide environments where digital data can be signed by authors or producers as their intellectual property, i.e. by embedding private or public information into the video data, to ensure and proof ownership rights on the produced video material during its distribution. Digital watermarking is the enabling technology to prove of ownership on copyrighted material, detect the originator of illegally made copies, monitor the usage of the copyrighted multimedia data and analyze the spread spectrum of the data over networks and servers. Embedding of unique customer identification as a watermark into data is called fingerprinting to identify illegal copies of documents. Basically, watermarks, labels or codes embedded into multimedia data for enforcing a copyright must uniquely identify the data as property of the copyright holder, and must be difficult to be removed, even after various media transformation processes. Thus the goal of a label is to always remain present in the data. Digital fingerprinting which embeds customer information into the data to enable detection of license infringement raises the additional problem that we produce different copies for each customer. Attackers can compare several fingerprinted copies to find and destroy the embedded identification string by altering the data in those places where a difference was detected. In our paper we present a technology for combining a collusion-secure fingerprinting scheme based on finite geometries and a watermarking mechanism with special marking points for digital images. The only marking positions the pirates can not detect are those positions which contain the same letter in all the compared images, called intersection of different fingerprints. The proposed technology for a maximal number d of pirates, puts enough information in the intersection of up to d fingerprints to uniquely identify all the pirates. The next chapter explains the fingerprinting algorithm. Based on the fingerprinting algorithm we present then the watermarking algorithm and the test results.

2 2. COLLUSION SECURE FINGERPRINTING ALGORITHM A digital fingerprinting scheme consists of a number of marking positions in the document, a watermarking algorithm to embed letters from a certain alphabet at the marking positions, a fingerprinting algorithm which selects the letters to be embedded for each marking position depending on the number i of the copy and a pirate tracing algorithm which, on input of a modified document, outputs at least one number i of a copy that was used in constructing the modified document. Different copies of a document containing digital fingerprints differ at most at these marking positions. A powerful attack to remove a fingerprint therefore consists of comparing two or more fingerprinted documents and to alter these documents randomly in those places where a difference was detected. If three or more documents are compared, a majority decision can be applied to improve this kind of attack: For the area where the documents differ, choose the value that is present in most of the documents. The only marking positions the pirates can not detect are those positions which contain the same letter in all the compared documents. We call the set of these marking positions the intersection of the different fingerprints. In this section we propose a fingerprinting algorithm that, for a maximal number d of pirates, puts enough information in the intersection of up to d fingerprints to uniquely identify all the pirates. A fingerprinting scheme with this property is called d- detecting. Another important parameter is the number n of copies that can be generated with such a scheme. We use techniques from finite projective geometry [1, 6] to construct d-detecting fingerprinting schemes with q+1 possible copies. These schemes need n=q d +q d q+1 marking positions in the document. We use a binary alphabet in our scheme: Therefore marking positions with a 1 embedded will be called marked, those with a 0 will be called unmarked. Unmarked positions are not altered compared to the original document. The problem of collusion-secure fingerprinting has originally been described and solved by D. Boneh and J. Shaw [2]. Our approach, is different from [2], since we put the information to trace the pirates into the intersection of up to d fingerprints. In the best case (e.g. automated attacks like computing the average of fingerprinted images) this allows us to detect all pirates, in the worst case (removal of individually selected marks) we can detect the pirates with a negligibly small one-sided error probability, i.e. we will never accuse innocent customers Two simple examples The smallest possible example of a fingerprinting scheme (and the smallest projective space) is shown in Picture 1. The projective space PG(2,2) of dimension 2 (i.e. it is a plane) and order 2 (i.e. there are 2+1=3 points on each line) has 7 points and 7 lines (the circle through the points 2, 4 and 6 counting as a line). 1 Points Lines Fingerprint 1 Fingerprint 2 Fingerprint Figure 1: A 2-detecting fingerprinting scheme with 3 possible copies in the finite projective space PG(2,2). To implement this scheme, we need 7 marking positions in the document, each associated with one point of PG(2,2). This association must be secret and highly nonlinear to destroy all purely geometric information in the document. (In the following, if no confusion is possible, we will not distinguish between the terms point and marking position.) Each fingerprint consists of 3 marked and 4 unmarked points. E.g. to embed fingerprint 2 in a document, the marking positions corresponding to the points 1, 2 and 3 will be marked, the rest remains unmarked. This scheme is 2-detecting because any two of the lines {1,2,3}, {3,4,5} and {1,5,6} intersect in a unique point. A possible attack could be the following: Customer 1 buys a copy of the document with fingerprint 1, and customer 2 gets a copy with fingerprint 2. They compare their documents to generate a pirate copy. The two documents differ at the marking positions 2, 3, 5 and 6, 3

3 In the worst case, they can unmark all those points. However, they can not detect marking position 1 if a good watermarking scheme has been used. If they sell the pirated copy, it will eventually fall into the hands of the copyright owner. The copyright owner will then start the pirate tracing algorithm and detect point 1 and from this point the two pirate customers 1 and 2. Remark: Following a different strategy, it is possible for the pirates to generate with probability ¼ a document where detection of pirates is not possible. This can be done by guessing, in each document, the marking point that belongs to point 5 or 3, resp. By leaving these marks unchanged, the pirates make it impossible to decide whether customer 1 and 2, or 2 and 3, or 1 and 3, have generated this document. This problem has already been described in [2]. However, when d and q increase, this probability becomes negligible. How can this scheme be generalized? Figure 2 gives an idea that will be formalized in the next sections. Figure 2: A tetrahedron as an example of a 3-detecing fingerprinting scheme. Consider a tetrahedron in a 3-dimensional space. A tetrahedron has the property that any two of its planes intersect in a unique line, and that any three of its planes intersect in a unique point. A fingerprinting scheme will therefore mark all points of a plane of a generalized tetrahedron. Such structures exist in finite projective spaces Finite Projective Spaces The finite projective spaces PG(d,q) can be constructed from vector spaces over finite fields by the following construction: Let GF(q) be a finite field (finite fields exist and are unique for all prime powers q), and let V=GF(q) d+1 be the (d+1)- dimensional vector space over GF(q). Then PG(d,q) is the following structure: The points of PG(d,q) are the 1-dimensional subspaces of V. The lines of PG(d,q) are the 2-dimensional subspaces of V. Generally: The i-dimensional subspaces of PG(d,q) are the (i+1)-dimensional subspaces of V. By defining a normal form, we can re-use the coordinates of V for PG(d,q): A point of PG(d,q) which corresponds to the 1- dimensional subspace { (ta 0,ta 1,...,ta d ) t GF(q), (a 0,a 1,...,a d ) V } has homogeneous coordinates (0,...,0,1,a i+1 /a i,...,a d /a i ) if a 0 =a 1 =...=a i-1 =0, a i 0. A hyperplane of PG(d,q) is a (d-1)-dimensional subspace. PG(d,q) contains q d +q d q+1 points and the same number of hyperplanes. Hyperplanes can be described as those sets of points whose homogeneous coordinates satisfy a linear equation b 0 x 0 +b 1 x b d x d =0. This equation can be abbreviated as a kind of coordinate [b 0 :b 1 :...:b d ]. The normal form of a hyperplane coordinate is defined in the same way as for the homogeneous coordinates of points. For our fingerprinting scheme we need dual rational normal curves [6]. Without going into the theory behind these structures, they can simply be defined by their coordinates. A dual rational normal curve in PG(d,q) is the following set of hyperplanes: 5 = { [1:t:t 2 :...:t d ] t GF(q)} {[0:0:0:...:0:1]}. (1) These sets of hyperplanes generalize the property of a tetrahedron: Any i d hyperplanes from 5 intersect in a unique subspace of dimension d-i.

4 2.3. The RNC Scheme We can now use 5 to construct a d-detecting fingerprinting scheme with q+1 copies: Each fingerprint consists of the points of one of the hyperplanes from 5 which will be marked in the corresponding copy of the document. This rational normal curve scheme (RNC scheme) has the following properties: The RNC scheme is d-detecting: Given i d fingerprints, that is hyperplanes H 1,..., H i from 5, these hyperplanes intersect in a unique subspace U = H 1... H i. (For i=d this is a point.) From this unique subspace U all hyperplanes H 1,..., H i (and therefore all pirate customers) can be reconstructed due to the geometric properties of dual rational curves. The RNC scheme can generate q+1 copies: 5 contains exactly q+1 hyperplanes. If we omit the special hyperplane [0:0:...:0:1], we have the following algorithms for the generation and detection of pirates: Algorithm 1: Generation of fingerprints For customer I, choose i GF(q) and H i :=[1:i:i 2 :...:i d ]. Mark all marking points associated with points whose homogeneous coordinates have the form (a 0,a 1,...,a d-1,(-a 0 -a 1 i-...-a d-1 i d-1 )/i d ). (2) Algorithm 2: Detection of pirates Detect the marked points in a pirated copy of a document. Determine the largest projective subspace contained in this point set (this may be a single point). Let f be the dimension of this subspace. For one point (1,a 1,...,a d ) of this subspace, solve the equation 1 + a 1 t + a 2 t a d t d = 0 (3) for t in GF(q). Check if there are exactly d-f different solutions for t. If not, return an error message. The different solutions for t correspond to the indices of the pirate customer s hyperplanes. Algorithm 2 : Detection of pirates Detect the marked points in a pirated copy of a document. For a random sample of points (1,a 1,...,a d ), solve the equation 1 + a 1 t + a 2 t a d t d = 0 (4) for t in GF(q). For each sample point, a list of hyperplane indices will be issued. The indices of the pirate customer s hyperplanes are contained in these lists. To get the pirates indices, different algorithms must be used depending on the pirates cheating strategy: If the pirates follow a delete all known marks strategy, the pirates indices lie in the intersection of these lists. If the pirates follow a delete some known marks strategy, a majority vote has to be applied Open problems The main disadvantage of the RNC scheme is the limited number of copies that can be produced. This situation can be improved by combining two (or more) randomly chosen hyperplanes into a fingerprint. If we use each hyperplane only once, then this scheme is still d-detecting, but allows for ½(q d +q d q+1) copies. This scheme poses some problems concerning the traitor tracing algorithm and will be studied in the next phase of our project. 3. DIGITAL WATERMARKING FOR COLLUSION SECURE FINGERPRINTING FOR IMAGES Usually the known watermarking techniques spread the watermarking information all over the image data [3,4,5]. The embedding of the fingerprinting information with watermarking techniques requires an optimized watermarking scheme in the context of digital fingerprints since we have different requirements for the watermarking scheme here. Our watermarking scheme needs special marking points to integrate the fingerprinting information and to build the intersection of remaining fingerprinting elements after an attack in the intersection region. In the first section we present the watermarking algorithm in general for a maximal number d of pirates and for number q of copies that can be generated with the proposed fingerprinting scheme. In the following sections we describe the detailed embedding and retrieval algorithm. The watermarking algorithm is designed to use the original image in the retrieval process to get better results and avoid failures of customer detection.

5 3.1. Watermarking Algorithm Digital Watermarking is used to embed customer information generated by the fingerprinting algorithm to trace illegal image copies. Current digital watermarking techniques usually would embed the generated fingerprinting information FP randomly all over the image with the disadvantage, that the intersection of the proposed fingerprints can not be used to find attackers after comparing attacks of different customer copies. To use the excellent properties of the fingerprint to conclude to the customers which attacked the watermark we build a watermarking scheme with a fixed number of marking positions in each copy of the image. The fingerprinting algorithm selects the letters, the FP vector over the binary alphabet {0,1}. The watermarking algorithm embeds this binary FP vector at the chosen marking positions. The fingerprinting algorithm generates binary FP vectors of length q d +q d q+1 for each image. With this fingerprinting scheme a d-detecting binary FP vector can be generated to build q customer copies of the image. Each customer gets his specific binary FP vector which elements will be embedded at the same marking positions of the image. With these construction the only marking positions the pirates can detect are the differences in the binary FP vectors and they do not detect those positions which contain the same letter in all the compared images, the intersection of the fingerprints FP. Based on the remaining information it is possible to conclude to the customers. To give the watermarking scheme more robustness we embed each binary FP vector r 1 times, r 1 redundant, into the image. With these construction we need r 1 * (q d +q d q+1) marking positions. The marking positions will be generated randomly with a image specific secret user key of the copyright holder and image size as parameter. The embedding of the binary FP vector into the image at the defined marking positions is performed in the frequency domain to be more robust against compression. The image is divided into blocks, transformed into the frequency domain using a discrete cosinus transformation and quantized. The blocks correspond to the marking positions. If the block was selected randomly as marking position the DCT coefficients are modified with a watermarking sequence depending on the FP vector element. The retrieval uses the original and check image to evaluate the embedded watermarking sequence at the marking positions and retrieve the binary FP vector. The fingerprinting algorithm gets the vector as input parameter and produces the customer list Fingerprint Embedding The detailed embedding of the fingerprinting vector for each customer copy is performed in three steps. Figure 3: Embedding Scheme In the first step the fingerprinting vector FP for the customer is generated. The number of customer which can be delivered with a d-detecting fingerprint depends on the maximal number of available marking positions of the image. In step 2 the position sequences, the marking positions, are generated from the user key as a seed with a secure random number generator. In the order of the generated position sequence every marking position block is now discrete cosine transformed and the fingerprinting vector is embedded in the following way: 1. Parameter: Image I with height h and width w Binary FP vector v with length n = q d +q d q+1, v = (x 0, x 1, x 2, x 3...x n ) for example n=13, d=2, q=3 (3 customer): v 1 =( ), v 1 =( ), v 3 =( ), Redundancy for vector embedding: e.g. r 1 = 3 Redundancy for watermarking intensity of the single marking points r 2 : e.g. r 2 = 10 Embedding sequence for each vector element at the marking positions R: [-k,k], -4<=k<=4, parameter value k influences robustness and visibility Secret user key: k Watermarking strength: WMStrength 2. Calculation of the 8x8 blocks of the image: m

6 3. Calculation of the redundancy factor r 1, maximal n*r 1 =m 4. Pseudo random generation of r 1 *n block marking positions x i,j with the user key UK Number of FP vector bits (x 0,x 1, x 2, x 3,...x n ) Redund 1 ancy r r 1 0 x 0,1 x 0,2 x 0,3... x 0,r1 1 x 1,1 x 1,2 x 1,3... x 1,r1 2 x 2,1 x 2,2 x 2,3... x 2,r n x n,1 x n,2 x n,3... x n,r1 Table 1: n*r 1 Marking positions with redundancy r 1 Figure 4: Image marking blocks with redundancy 5. Before we embed the binary bits into the DCT coefficients of the marking blocks directly, we increase the signal difference by a generation of the n random sequences R i [-k,k], k=4, for embedding the single n fingerprinting information bits. Each FP vector element will be then embedded r 1 (e.g. 3) times and modifies r 2 (e.g. 10) DCT coefficients, by using the random sequence R ij for each FP vector bit with r 1 *r 2 (30) redundancy: FP vector bits x i = (x 0,x 1, x 2, x 3,...x n ) Random x i,1 sequences x i,2 for the marking x i,3 Positions n * r 1.. x i,r1 0 R 0,1 R 0,2 R 0,3... R 0,r1 1 R 1,1 R 1,2 R 1,3... R 1,r1 2 R 2,1 R 2,2 R 2,3... R 2,r n R n,1 R n,2 R n,3... R n,r1 Table 2: Random marking sequences R i,j for the marking positions, each R i,j has length r 2 For example, r 1 = 3, r 2 = 10 R 0 = (R 01, R 02, R 03) = (3,0,3,-1,1,1,0,3,-4,1 4,2,2...0,1 3,1,-1,-4,1,0,0,0,3,1)... R n-1(12) = (R 12,1, R 12,2, R 12,3) = (4,0,-4,-1,1,1,0,2,-4,1 2,3,2...0,1-4,1,-1,-2,1,0,3,4,3,1) 6. Embedding of the random sequences R i,j into the marking position blocks: 1. Extraction of the image RGB values 2. Extraction of the luminance values 3. DCT transformation of the luminance values 5. Quantization of the DCT-luminance values with the following weighted quantization matrix: low High Table 3: Quantization matrix

7 The matrix is weighted with the parameter watermarking strength, WMStrength [0,2], and influences the visiblity and robustness of the watermarking information (the fingerprint). 5. Embedding of the FP vector v = (x 0, x 1, x 2, x 3...x n ) with redundancy r 1, e.g. v r1=3 =(x 01, x 01, x 03, x 11, x 12, x 13,...,x n1, x n2, x n3 ) using the random sequence R ij. For each vector bit we use R i = (R i1, R i2, R i3) to embed v i =(x i1, x i1, x i3 ) with redundancy r 2 by adding the R i, 1(...3) to the DCT coefficients when x i is 1 otherwise we embed nothing 7. Retransform the luminance values, inverse quantization, inverse DCT and replacing original luminance of the block with the modified one. Figure 5: Embedding into the marking blocks DCT coefficients, e.g. x 01 The image has now modified luminance blocks if the FP vector bit is one else the original image block remains. The attacker can now work together, find differences, but the intersections of the fingerprinting information remains present for evaluation during retrieval Fingerprint Retrieval The retrieval of the fingerprinting information is performed with the check image and the original image to find the embedded watermarking sequence in the marking positions. The general retrieval steps can be seen in the next figure: Figure 6: Retrieval Scheme We have three main steps to retrieve the customer fingerprints back, the position generation, the retrieval of the watermarking information, which is the fingerprinting vector, and the evaluation of the extracted fingerprint to find the customer Ids. The input parameter of the position generation and retrieval are the user key, the original image and check image. First we calculate the differences between the original and the check image. All following steps use this difference image for retrieval. It is decoded into RGB values and the position generation of the marking points is performed. Then the marking blocks luminance values are DCT tranformed and quantized. The random sequences R i are generated and will be searched in the next steps over all marking position points. If we find a conformity we interpret the marking position with a 1 otherwise 0. The detailed retrieval steps are as follows: 1. Parameter: d and q for the fingerprinting system redundancy factor r 1, e.g. r 1 = 3 Redundancy for watermarking intensity of the single marking points r 2 : e.g. r 2 = 10

8 Search sequence for each vector element at the marking positions R: [-k,k], -4<=k<=4, parameter k influences robustness and visibility, [-4,4] Secret user key: UK Tolerance level 2. Calculation of difference image between original and check image 3. Pseudo random generation of r 1 *n block positions with the user key UK Number of FP vector bits (x 0,x 1, x 2, x 3,...x n ) Redund 1 ancy r r 1 0 x 0,1 x 0,2 x 0,3... x 0,r1 1 x 1,1 x 1,2 x 1,3... x 1,r1 2 x 2,1 x 2,2 x 2,3... x 2,r n x n,1 x n,2 x n,3... x n,r1 Table 4: n*r 1 Marking positions with redundancy r 1 4. Generation of the n random sequences R i [-k,k], k=4: FP vector bits x i = (x 0,x 1, x 2, x 3,...x n ) Random x i,1 sequences x i,2 for the marking x i,3 Positions n * r 1.. x i,r1 0 R 0,1 R 0,2 R 0,3... R 0,r1 1 R 1,1 R 1,2 R 1,3... R 1,r1 2 R 2,1 R 2,2 R 2,3... R 2,r n R n,1 R n,2 R n,3... R n,r1 Table 5: Random marking sequences R i,j for the marking positions, each R i,j has length r 2 In our example: R 0 = (R 01, R 02, R 03) = (3,0,3,-1,1,1,0,3,-4,1 4,2,2...0,1 3,1,-1,-4,1,0,0,0,3,1)... R n-1(12) = (R 12,1, R 12,2, R 12,3) = (4,0,-4,-1,1,1,0,2,-4,1 2,3,2...0,1-4,1,-1,-2,1,0,3,4,3,1) 5. Comparing the generated R ij with appropriate DCT coefficients at the marking positions. If there is a conformity we retrieve a 1 else a 0 Figure 7: Retrieval from the DCT coefficients During the embedding we have used the parameter watermarking strength. To get better retrieval results we should use the same watermarking strength for quantization. We try to estimate the original used watermarking strength in the following two steps: 1. first we quantize the blocks with 1 percent of the original quantization matrix. So we get high values of the watermarking sequence. We sum the absolute values of the generated R ij into SumOrgSequence and sum all the retrieved values into SumWMSequence. 2. Second we quantize the blocks now with quantization factor: 100/(SumWMSequence/SumOrgSequence). With these new factor we estimate the watermarking strength of the embedding process.

9 Extended Retrieval Usually the direct compare of the originally generated random sequences R ij with the retrieved sequences of the difference image will not be successful because of image transformations and modifications. Therefore our extended retrieval uses the whole R ij sequence of one FP vector bit for a comparison. We calculate the absolute sum, SUM1 = SumWMSequence, of each retrieved R ij again. Additionally we calculate SUM2, it is the sum over all absolute differences of the retrieved R ij and original R ij value. If we have embedded a 1 SUM2 should be 0. Then we calculate the number of marking positions for one bit of the FP vector, it is the product p = r 1 * r 2 and weight this product with the ToleranceValue t; t*p. That means we allow variation in the DCT coefficients. For example t = 1 means that every coefficient can vary up to 1. SUM1 is for the 0-decision, because if the fingerprinting bit was 0 we have not embedded any information into the blocks. If now SUM1*2 is less then the weighted product tp we retrieve a 0, if SUM2 is less then tp we retrieve a 1. If both checks fail the block was attacked and we set a 0 into the resulting fingerprinting vector. 4. TESTRESULTS We have tested our implementation with different images and performed first a robustness test of the watermarking algorithm and second the recognition test of attackers, the evaluation of the fingerprinting information. Ten examples should demonstrate the capabilities and the shortcomings of the algorithm. The following table shows the test results of the watermarking robustness tests after compression and after the watermark removing program StirMark [7]. StirMark combines various attacks. It simulates distortions caused by a printing and rescanning process. Furthermore it introduces some minor geometric distortions like stretching, shearing, rotations and shifting. It is reported that StirMark is very effective against most even commercial watermarking techniques. However, the distortions introduced by StirMark are unrecognisable. In the table the original image is displayed and the table entries give the watermarking parameter to withstand the attack. If there is no entry then there was no successful retrieval possible with an acceptable quality (minimum of 4). The quality parameter Q ranges from excellent (1), good (2), satisfying (3), basic (4), unexceptable (5). Parameter: WMStrength W Tolerance level T Visual quality: Q {1,...5} The tests show excellent visual quality factors in images where we have non-homogenous regions. Images with smooth blocks are more visually influenced by high watermarking strengths to withstand high compression. About 30% of the images could withstand very high compression of 90%, and 90% of the images could withstand 50% compression with the appropriate watermarking parameters. The StirMark attack was very successful if we used the original image and the stirmarked watermarked image. No fingerprint was retrieved correctly. We could improve the retrieval by performing also the Stirmark attack with the same parameter on the original image. In this extended retrieval we used the stirmarked original image and the stirmarked watermarked image. 70% of the images could be checked successful and the fingerprinting information was retrieved correctly. The remaining 30% error rate are caused by the scratching and shifting operations of StirMark where our watermarking positions could not be found correctly.

10 Images JPEG Stirmark 25% 50% 75% 85% 90% With Original W=0,1 W=0,4 W=0,7 W=2,0 With stirmarked Original - - W=0,8 T=1,0/1,5 W=0,1 W=0,4 W=0,5 W=0,4-3 W=0,8 T=1, W=0,8 T=1,0/1, T=1,0/1,5 W=1,0 W=1,2 T=2-3 - W=1,0 T=1,0 T=1,0 W=0,1 W=0,4 T=1,0,5 W=0,4 W=0,4-3 W=0,3 T=1,0 W=1,0-2 W=0,5 T=2, T=1,0 W=1,0-2 W=1,5 - W=1, W=0,5 T=2,5 W=1,0 T=2,5 W=1,6 T=2,5 Q=4 - T=1,0/1, T=1,0/1, Table 6: Test results of basic watermarking attacks W=0,5 The next table contains the error rates after comparing attack of different copies to remove the fingerprinting information. Out of a great variety of attacks, we have chosen the most significant one: Comparison of copies from 2 customer and selecting the average of the difference values Comparison of copies from 2 customer and replacing differences with surrounding colours Comparison of n copies and selecting the most frequently used position differences for all n image copies Comparison of n copies and selecting the less frequently used position differences for all n image copies

11 Two customer attack Average calculation Replacing by surroundings (no differences) Two and more customers (maximal d) Average calculation Correct customer recognition 70% 100% 55% 100% Table 7: Fingerprint attacks test results Customer 1 Customer 2 Difference Image Blocks Replacing by surroundings (no differences) Figure 8: Calculation of difference blocks by attackers Figure 8 shows the images of two customer and their difference image. The attack where the difference blocks are replaced by the average value of the images produces partly additional occurrences of 1 instead of 0 in the watermarking retrieval process. The current implementation of the fingerprinting evaluation tool supports only the strategy of maximal removal of the fingerprinting information. Therefore the creation of additional ones are not supported yet and the tool can not detect the concerned customers correctly. The attack of replacing surrounding image part with the difference blocks can be detected correctly with the fingerprinting tool. The original image is nearly reconstructed and produces 0 instead of 1 simulating maximal removal of the fingerprinting information. 5. OPEN PROBLEMS The watermarking algorithm has still problems with robustness against attacks like scaling, rotation, shifting or cutting and cropping the image. The first step is to extend the retrieval process to restore the check image before the difference image is generated. For example the retrieval is successful after scaling if we first scale the original image to the size of the check image, then we re-scale both to the original size and perform the check. We could reach 95% successful results by this proceeding. Secondly the watermarking algorithm is also improved to handle cropped image parts. The missing image regions will be detected and only the cropped image parts are used for the retrieval. Because we have used the redundancy r 1 the fingerprinting information is spread over the image more than once so that we have still marking positions in the remaining cropped image parts and can retrieve this information. The retrieval after the StirMark attack can be increased by using the detected difference blocks in the difference image between the stirmarked original and stirmarked watermarked image instead of using only the pseudo random sequence as correct marking positions. If we have an additional orientation for our watermarking blocks we could find the shifted watermarked blocks easier and improve the error rates of 70% easily. Our prototype implementation of the fingerprinting algorithm can only identify the customers if the strategy of maximal removal of the detected marking point differences has been used. All other kind of attacks, like partly modifications of differences are not supported today in our implementation but will be addressed in further work. 6. CONCLUSION In our paper we described a fingerprinting mechanisms and an appropriate watermarking scheme to embed customer information into images to trace illegal copies. Current digital fingerprinting has the disadvantage, that customers could work together as attackers to destroy the watermarking information by comparing their image data and remove the differences. With our proposed technique attackers could still work together, but our mechanisms provide the possibility to conclude to the customers which attacked the watermark.

12 Our robustness tests of the watermarking scheme based on DCT coefficients are mainly based on compression, format conversions and geometrical transformations. Format conversions are handled with very low error rates. Especially StirMark attacks could be handled more efficiently by performing the StirMark on the original image too to find the correct marking points back. The fingerprinting tests, comparing different image copies, are successful and the remaining intersection gives the possibility to trace the attackers. Altogether our tests show that the watermarking technology with special marking points are satisfying. In our future work we will address first the problems with visual distortions by high WMStrength parameter to withstand high compression and extreme scaling operations. Because each pseudo randomly selected image marking block is modified, artefacts are common especially in smooth blocks or in sharp edges. In our further research our experimental systems will adapt the strength of the embedded watermark to the HVS-properties using two parameters instead of uniformly modulate the luminance values: smoothness and edge character of the block. The edge characteristics could be based on the analysis of DCT values so that we can mostly detect vertical and horizontal edges. Smoothness and edge character will be the two main parameters. These are concerned in the algorithm and the expected visibility of the watermark can be calculated, resulting in a value which can be interpreted as the capability of the block to incorporate the watermark without visual distortions. Altogether digital watermarking to embed fingerprinting information is a pragmatic approach to de-motivate the illegal use of the copied data. Beside the development of watermarking algorithms our future goal is to design interactive tools which strengthen the producers acceptance to use digital watermarking techniques to offer their data in a more secure way in the digital marketplace. ACKNOWLEDGMENTS The research work described in this paper was performed jointly with Eva Saar from Telekom and we would like to thank her for many stimulating discussions and support. REFERENCES [1] A. Beutelspacher and U. Rosenbaum, Projective Geometry. Cambridge University Press [2] D. Boneh and J. Shaw, Collusion-Secure Fingerprinting for Digital Data. Proc. CRYPTO 95, Springer LNCS 963, pp , [3] I.J. Cox and M.L. Miller, A review of watermarking and the importance of perceptual modeling, Proc. of Electronic Imaging 97, February 1997 [4] J. Dittmann and M. Stabenau,, Digitale Wasserzeichen für MPEG Video, GMD Report 34, 1998 [5] J. Dittmann, M. Stabenau, R. Steinmetz, Ralf, Robust MEG Video Watermarking Technologies, Proceedings of ACM Multimedia 98, The 6 th ACM International Multimedia Conference, Bristol, England, pp , 1998 [6] J.W.P. Hirschfeld, Projective Geometries over Finite Fields. Oxford University Press, 2 nd Edition [7] F. Petitcolas and R. J. Anderson, Multimedia and Security, Workshop at ACM Multimedia 98, Bristol, U.K., September 12 13, GMD Report 41, pp , 1998