1. Symmetric Tardos fingerprintingfor arbitrary alphabet sizes WISSec 2007 Boris Škorić, Stefan Katzenbeisser, Mehmet Celik Philips Research, Information and System Security group

2. Outline • Trends in content protection • Collusion-resistant watermarking • The Tardos fingerprinting system • Our improvements

3. Trends in content protection CGMS 1980 1990 2000 • Consumers increasingly dislike DRM • Vista content protection spec "longest suicide note in history" (Gutmann 2006) • "Disembodied" distribution  Hard to DRM-protect; Easy to watermark • April 2007: EMI announces DRM-free music • Gradual shift from copy prevention to distribution tracking

4. originalcontent originalcontent content withhidden payload payload WM secrets WM secrets payload Detector Embedder Watermarking (a.k.a. Fingerprinting) • Forensic tracking • Payload = unique identifier of recipient • Redistribution traced back to source • Examples • Jan.2004: Man arrested for distributing oscar screeners. • Digital cinema

5. "Coalition of pirates"  = "detectable positions" pirate #1 1 1 1 0 1 0 1 0 0 0 0 1 1 0 1 0 1 0 1 0 1 0 1 1 #2 1 0 1 0 1 0 1 0 0 0 1 1 #3 1 1 1 0 0 0 1 1 0 0 0 1 #4 AttackedContent 1 0/1 1 0 0/1 0 1 0/1 0/1 0 0/1 1 Collusion attacks • Users pool their content • Differences point to watermark • Attackers remove watermark

6. equivalent for binary symbols Collusion-resistant watermarking • Requirements • Resistance against cc0 attackers • Low False Positive error rate • Low False Negative error rate • ... and all that with small watermark payload! (7bits/min. video) • Attack model • "Marking assumption": Modification only at detectable positions • Several options • Restricted digit model: Choice from available symbols only • Unreadable digit model: Erasure allowed • Arbitrary digit model: Arbitrary symbol (but not erasure) • General digit model

7. Staddon et al 2001: Tardos 2003: Boneh and Shaw 1998: Tardos 2003: Chor et al 2000: Boneh and Shaw 1998: History of collusion resistance: Code length Construction [ Hollmann et al 1998: IPP codes, c0=2 ] n = #usersm = code length in symbols q = alphabet size 1 = Prob[accuse specific innocent]  = Prob[not all accused are guilty] 2 = False Negative prob. Provenlower bound

8. Step 1: Generate iid p1,..., pm (0,1); Prob. density Step 2: Generate columns of X; Prob[Xji=1] = pi. pi p1 p2 pm 1 1 1 0 0 1 1 The Tardos scheme (2003) X n users j m symbols i

9. Proven properties: • Resistance against c0 colluders withindependent of coalition strategy • If c>c0, then • no false accusations! • high prob. that nobody gets accused The Tardos scheme (continued) • Embed X into the content for users 1...n.Store p and X. • Coalition publishes content with payload y = {y1,..., ym}. • Content owner computes accusation values:User #j gets accused if Sj > threshold

10. Our contributions Škorić, Katzenbeisser, Celik; 2007Škorić, Vladimirova, Celik, Talstra; 2006 • New construction of X and new accusation • Arbitrary alphabet size q. • Dirichlet distribution • Symbol-symmetric accusation, even for q=2. pi0pi1pi2 pi3 2 0 X 2 2 3 2 2

11. New analysis method based on statistics • Compute FN and FP error rate from E[Sj] and E[Sj2] • Central Limit Theorem:For large c0, accusations have Gaussian distribution Our contributions (continued) • Decouple 2 from 1. • Desired FP and FN properties are independent • Usually 1<< 2 instead of vice versa • Assumptions: • Column-symmetric coalition strategy • Restricted digit model when q>2.

12. Results Symmetric scheme& statistical analysis for large coalitions Tardos 2003 1, 2 independent (usually 1<< 2) Binary alphabet, Binary alphabet: q-ary alphabet: further reduction of m q= 3: 35% q=10: 80%

13. Open questions / future work • How much can be gained from tweaking the f function? • How Gaussian are the accusations for small c0? Summary • Tardos scheme is asymptotically optimal • Two improvements • Symbol-symmetric binary scheme • Statistical analysis method • Together: code length reduced by factor 20 for large c0 • Scheme for arbitrary alphabet size.In restricted digit model  further reduction of code length.

14. Literature D. Boneh and J. Shaw. Collusion-secure fingerprinting for digital data. IEEE Transactions on Information Theory, 44(5):1897-1905, 1998. B. Chor, A. Fiat, M. Naor, and B. Pinkas. Tracing traitors. IEEE Transactions on Information Theory, 46(3):893-910, 2000. I.J. Cox, M.L. Miller, and J.A. Bloom. Digital Watermarking. Morgan Kaufmann Publishers, San Francisco, CA, USA, 2002. H.D.L. Hollmann, J.H. van Lint, J-P. Linnartz, and L.M.G.M. Tolhuizen. On codes with the identifiable parent property. Journal of Combinatorial Theory, 82:472-479, 1998. G.C. Langelaar, I. Setyawan, and R.L. Lagendijk. Watermarking digital image and video data. IEEE SPMAG, SEP 2000. C. Peikert, A. Shelat, and A. Smith. Lower bounds for collusion-secure fingerprinting. In Proceedings of the 14th Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), p 472-478, 2003. B. Skoric, S. Katzenbeisser, and M.U. Celik, Symmetric Tardos fingerprinting for arbitrary alphabet sizes. To be published in Designs, Codes and Cryptography. Preprint at http://eprint.iacr.org/2007/041 B. Skoric, T.U. Vladimirova, M. Celik, and J.C. Talstra. Tardos Fingerprinting is better than we thought.Technical report, Submitted to IEEE Transactions on Information Theory.Preprint at arXiv repository, http://www.arxiv.org/abs/cs.CR/0607131, 2006. J.N. Staddon, D.R. Stinson, and R. Wei. Combinatorial properties of frameproof and traceability codes. IEEE Transactions on Information Theory, 47(3):1042-1049, 2001. G. Tardos. Optimal probabilistic fingerprint codes. In Proceedings of the 35th Annual ACM Symposium on Theory of Computing (STOC), pages 116-125, 2003.