U ) descrambling keys for U clients
(a) Flow diagram of (1) partitioning a descrambling key into subkeys, embedding watermarks (βi) into each subkeys, and multicasting the original and JFD subkeys to clients.
(b) Detailed processing of decryption, descrambling and embedding of fingerprints at client side.
Figure 5.1: Overview of partitioning and multicasting a descrambling key from a content server to clients, and embedding a fingerprint to the descrambled video.
This section presents a method of generating and multicasting v sets of descrambling keys, referred to as subkeys, to U clients, where v is in the order of O(√
U ). Figure 5.1 (a) shows an overall diagram of the proposed method. As described in Section 5.4.1, a randomly generated scrambling key is first decomposed into v subkeys. These subkeys
are then embedded with Gaussian watermarks to generate v JFD subkeys. These v JFD subkeys along with v original subkeys are then organized into v sets and multicasted to U clients. By using the method described in Section 5.4.2, descrambling keys for U clients can be combined from v sets of subkeys.
5.4.1 Balanced incomplete block designs (BIBD)
The basic concept of multicasting v sets of descrambling subkeys to U clients is mainly motivated from the balanced incomplete block design (BIBD) methods [35, 36]. A (v, k, λ) balanced incomplete block design (BIBD) is a pair (X , A), where A is a collection of k-element blocks (subsets) of a v-element set X , such that each pair of elements of X occur together in exactly λ blocks.
According to the design rule of BIBD, for a (v, k, 1)-BIBD, any two subsets in A can only have at most one common element from X , and the number of k-element subsets in A can be enumerated by (v2− v)/(k2 − k). In this chapter, we will use (v, k, 1)-BIBD to design decomposing strategies for the descrambling subkeys. In the following, a (9, 3, 1)-BIBD is used as an example to illustrate some major design concepts. A (9, 3, 1)-BIBD is a pair of (X , A), where A is a collection of 3-element subsets of a 9-element set X . Thus, for a given set X = {a1, a2, a3, a4, a5, a6, a7, a8, a9}, the collection of subset A = {{a1, a2, a3}, {a4, a5, a6}, {a7, a8, a9}, {a1, a4, a7}, {a2, a5, a8}, {a3, a6, a9}, {a1, a5, a9}, {a2, a6, a7}, {a3, a4, a8}, {a1, a6, a8}, {a2, a4, a9}, {a3, a5, a7}}.
In most application of BIBD, the collection of subsets in A can be represented in a matrix form, called incident matrix. The following is the incident matrix B for the
collection A of an example (9, 3, 1)-BIBD,
In matrix B, each column corresponds to a subset in A. Each ”1” in a column of B corresponds to an element of a subset in A. For instance, the first column in B has 3
”1s”, at the first 3 rows, which represents {a1, a2, a3}, and the three 1’s in the 2nd column corresponds to {a4, a5, a6}.
5.4.2 Multicasting descrambling subkeys with BIBD
This section presents the method of using a (v, k, 1)-BIBD to decompose a descrambling key for U clients. For U clients, the values of U , v and k needs to satisfy the following relation:
U ≤ (v2− v)/(k2− k). (5.9)
Given a (9, 3, 1)-BIBD, the collection A contains 12 different 3-element subsets, and any two subsets in A can have at most one common element. Based on this simple concept in BIBD strategy, nine different (finger) patterns can be combined to generate enough different fingerprints for 12 users. In the following, a (v, k, 1)-BIBD is used to guide the design of the proposed JFD method. First, we assume that a fingerprint can be composed from a set of watermarks. According to the number of users, a proper (v, k, 1)-BIBD is selected first, and v watermarks are generated and correspond to one and only one element in X . Then, each subset in A corresponds to a designated fingerprint for each client. Hence, for U clients, only v (v < U ) watermarks are need to be sent in a multicast manner. Similarly at a client side, a fingerprint can be combined from k (k < v)
watermarks. It is easy to see that between any two fingerprints (i.e., a subset in A), there exist at most one common watermarks (i.e., one elements in X ). Thus, multicasting v watermarks for the generation of U fingerprints is an efficient approach.
As shown in Figure 5.1 (a), a scrambling key Ks is decomposed into v subkeys K1, K2, . . . , Kv. The core idea in the proposed method is embedding an independent Gaussian watermark βi into each scrambling subkey Ki, to form a JFD subkey ϑi:
ϑi = Ki× (1 + αβi), 1 ≤ i ≤ v. (5.10) Both Ki and ϑi are then encrypted with two encrypting keys ei and εi into Ki′ and ϑ′i respectively. Finally, a total v sets of descrambling subkey pairs {(Ki′, ϑ′i)|1 ≤ i ≤ v}
are multicasted from the server to all clients. A complete description of subkey pair decrypting, video descrambling, and fingerprint embedding at clients are presented in Figure 5.1(b). First, a combination of v decrypting keys selected from {ei|1 ≤ i ≤ v} and {εi|1 ≤ i ≤ v} is sent to a designated client u via a secure channel. This combination of v decryption keys consists of two sets of keys ¯εu and ¯eu. ¯εu contains k decryption keys selected from {εi|1 ≤ i ≤ v} and ¯eu contains v − k keys from {ei|1 ≤ i ≤ v}. According to the (v, k, 1)-BIBD adopted, if the element (i, u) of the incident matrix is equal to 1, εi is sent to client u; otherwise, ei is sent. Precisely speaking, ¯εu = {εi|B(i, u) = 1}, and ¯eu = {ei|B(i, u) = 0}, where B is the incident matrix of the (v, k, 1)-BIBD. Next, these v decryption keys are used to decrypt v descrambling subkeys from subkey pairs {(Ki′, ϑ′i)|1 ≤ i ≤ v}. Since the method based on (v, k, 1)-BIBD is used to distribute decryption keys to each client, client u can only decrypt one descrambling subkey from each encrypted subkey pair (Ki′, ϑ′i), 1 ≤ i ≤ v. Finally, these decrypted subkeys are combined to form a descrambling key Ku and can be used to descramble the multicasted video clip. Because some of the decrypted descrambling subkeys were embedded with independent Gaussian watermarks (i.e., JFD subkeys), thus the descrambled video clip will contain fingerprints composed of these watermarks.
In the following, an example of (9, 3, 1)-BIBD is used to illustrate the details of de-scrambling subkey decrypting and fingerprint embedding process. Suppose a combination
of decryption keys composed of { ¯e2, ¯ε2} is unicasted to client 2, according to column 2 of the incident matrix B in Section 5.4.1, the elements in ¯e2 and ¯ε2 are ¯e2 = {e1, e2, e3, e7, e8, e9} and ¯ε2 = {ε4, ε5, ε6}, respectively. After decrypting process, a descrambling key K(2) designated to client 2 can be obtained:
K(2) = K1× K2× K3× ϑ4× ϑ5× ϑ6× K7× K8× K9 (5.11)
= Ks× (1 + αβ4)(1 + αβ5)(1 + αβ6). (5.12) By submitting Eq. (5.12) into Eq. (5.1), a fingerprinted frame Fc2 designated to client 2 can be expressed as:
Fc2 = FcKs × K2 = Fc× (1 + αβ4)(1 + αβ5)(1 + αβ6) (5.13) Let W2 = (1/α)(1 + αβ4)(1 + αβ5)(1 + αβ6) − 1, then
Fc2 = Fc× (1 + αW2) (5.14)
As shown in Eq. (5.12), K(2) contains three independent Gaussian watermarks, i.e., β4, β5 and β6, which can be combined to generate a fingerprint (see Eq. (5.14)) for client 2.
As described in Section 5.3.1, the descrambling subkeys are obtained by decomposing the scrambling key randomly, so only the random seeds are required to be transmitted for the purpose of saving network bandwidth. Thus, the scrambled video clip and JFD subkeys are the only data needs to be multicasted from server to clients. By comparing with the required bandwidth of JFD subkeys, the bandwidth required to transmit encryption keys { ¯ei, ¯εi|1 ≤ i ≤ v} and the random seeds of subkeys is very small and can be ignored.
Thus, the needed transmission bandwidth comes from the v JFD subkeys. According to the relation U ≤ (v2 − v)/(k2− k), of a (v, k, 1)-BIBD, the needed bandwidth can be estimated in the order of O(v) = O(k√
U ).