AN ASYMMETRIC WATERMARKING METHOD FOR COPYRIGHT PROTECTION
UTILIZING DUAL BASES
†Jengnan Tzeng, ‡Wen-Liang Hwang, and †I-Liang Chern
†Department of Mathematics, National Taiwan University
‡Institute of Information Science, Academia Sinica, Taiwan
ABSTRACT
We present an asymmetric watermarking method for copy-right protection that uses different matrix operations to em-bed and extract a watermark. It allows for the public release of all information, except the secret key. We investigate the conditions for a high detection probability, a low false pos-itive probability, and the possibility of unauthorized users successfully hacking into our system. The robustness of our method is demonstrated by the simulation of various attacks.
1. INTRODUCTION
Digital security information embedded in content, called watermarking, has many applications, including authentica-tion, copyright protecauthentica-tion, copy protecauthentica-tion, fingerprinting, and broadcasting channel tracking [4, 10, 14].
Notable security problems of the symmetric watermark-ing approach(i.e., one secret key for encodwatermark-ing and decod-ing) stem from the need to make the secret key available to owners and recipients, as well as from the need to identify which secret key is associated with which image in a large image database. Another problem is that the watermark is present as evidence of ownership, so it provides an attacker with the knowledge to remove the watermark [2]. The solu-tion to the problem is a watermarking system that satisfies Kirckhoffs’principle [9], which states that a security system must assume that an adversary knows everything about the algorithm, except the secret keys.
Asymmetric watermarking is another approach that sat-isfies Kerckhoffs’ principle. This system uses two sets of keys: one for embedding, and one for detecting. The latter is made public, so anyone has access to it and is permit-ted to use it to verify whether an image is watermarked or not. Some interesting asymmetric schemes have been pro-posed for watermarking [8, 11, 12, 5, 6, 13, 7]. Hartung and Girod [8] proposed the firstasymmetric watermarking method. Furon and Duhamel [7] provided a useful survey of various methods, as well as an in-depth discussion of asym-metric watermarking.
In our previous study of symmetric watermarking, we proposed a robust subspace watermarking method. Based on that method, we have modified the detection approach so that the new method retains the robustness property and becomes an asymmetric watermarking method.
Section 2 provides a summary of our previous subspace symmetric watermarking method. Section 3 illustrates how we have extended it to develop our asymmetric method. In Section 4, we describe an attack scenario called projection attack and show how to avoid it by a specially designed de-tection matrix. The simulation results of various attacks are demonstrated in Section 5. Finally, in Section 6, we present our conclusions.
2. THE SYMMETRIC SUBSPACE WATERMARKING METHOD
In [15], we proposed a subspace symmetric watermarking method for copyright protection. The method, which mod-els watermarking as a communication with side information [4], makes the keys heavily dependent on the original image and on potential modifications of the watermarked image. The robustness of the approach lies in hiding a watermark in the subspace that is least susceptible to potential modifi-cations. The distribution of the features of forged images is derived by principal component analysis of the simulation of images attacks. One of the subspaces of the feature space is called the watermark space W, in which the watermark is hidden. The orthogonal complement of W is denoted as V, representing the subspace that is most susceptible to mod-ifications of the image. This approach allows a copyright owner to custom-select the watermark space that is most re-sistant to possible attacks.
Let φobe the feature of the original image. Watermark
wis embedded into W by:
φw= φo+ Gw,
where G is a secret matrix whose columns are a basis of W, and φw is the feature of the watermarked image.
Be-cause watermark w is in W, the watermark is robust against
possible attacks. A pirate can simulate attacks on our wa-termarked image and obtain a good approximation of space W, but he cannot detect the secret matrix G from the space. Our symmetric method uses the key G to embed, and its inverse GT to extract, watermark w. By choosing G such
that GTφ
o = 0, the method does not need a reference
im-age to detect a watermark. The key is content-dependent; therefore, when the number of watermarked images is large, there are problems that copyright owners need to manage so that the correct key of a watermarked image can be lo-cated. It is also necessary to secretly communicate the key to another party. In an asymmetric watermarking method, a verifierdoes not need exclusive permission to access a pub-lished key database, which reduces the key management ef-fort. Also, anyone can prove copyright of a watermarked image without secret key communication.
3. THE ASYMMETRIC WATERMARKING METHOD
Following the previous symmetric watermarking method, we divide our feature space into subspaces W and V. The difference from our symmetric method is that we further di-vide W into two orthogonal subspaces G and H. Let G and Hdenote the secret matrices whose columns form a basis of subspaces G and H respectively. We use matrix G to embed our watermark w into subspace G and detect w by using the published keys (D, w), where matrix D is a weighted mix-ture of the matrices H and G.
3.1. Encoding and Decoding
Embedding our watermark w into subspace G is achieved by the function
φw = φo+ Gw. (1)
We require the watermark strength ||w|| to be as large as possible, in order to obtain a high signal-to-noise ratio (SNR) of our watermark signal w to the original image feature φo. However, ||w|| should not be so large that the
perceptual quality of the watermarked image is degraded. Finally, a feature reconstruction function is applied to φwto
obtain a watermarked image Xw.
Our detection is a hard decision function δ with a thresh-old . The decision function applies the detection matrix D to the extracted feature φeand then uses the sim function
to measure the similarity between Dφeand w. Our detector
is: δ(φe) = 1 if |sim(w, Dφe)| ≥ , 0 otherwise, (2) where sim(w, Dφe) = wTDφ e ||w||||Dφe|| . (3)
We give the matrix D the form: D= GT + BHT
, (4)
where B is a matrix; H is a matrix, whose columns are a basis of H; and HTG= 0.
We have shown that a pirate who has (D, w) and the algorithm of our watermarking method does not have the knowledge to obtain Gw. In the next section, we propose that the design of B is important to the security issue.
4. PROJECTION ATTACK AND SPECIAL DESIGN OF THE DECTION MATRIX D
We evaluate the security threats of malicious attacks on our watermarking system. One type of efficientattack is called projection attack, which tries to findthe feature ˜φthat satis-fies
min
φ kφ − φwk 2
,
with the constraint wTDφ= 01. This means ˜φis the
fea-ture without a watermark that is closest to φw. As a
projec-tion attack is extremely effective in removing a watermark, we pay particular attention to it.
We claim that if the detection matrix is derived such that
Dφ= 0,
then our asymmetric watermarking method is totally threat-ened by the projection attack. Therefore, we need to design the detection matrix D in such a way that our asymmetric watermarking method can resist a projection attack.
The following theorem shows that we can construct a special matrix D so that the projection attack yields σo.
Because ψo is the perceptually robust feature of the
origi-nal image, there is a high probability that the image recon-structed from σo∈ V will be perceptually distorted.
Theorem Given G, H and φo = ψo+ σoi, where ψo is
a component of φo in W. We define mo = Dφo, ψw =
ψo+ Gw and the coefficientsof s, t, such that s, t satisfy
ψo= Gs + Ht,
(a) To avoid a projection attack, the detection matrix D (de-finedin Equation 4) must be chosen such that Dφo6= 0.
(b) If D is chosen such that
DTw= λψw, (5)
where λ 6= 0, then applying the projection attack to φw
(definedin Equation 1) obtains σo.
(c) If D and w satisfy Equation 5, then
w= λ
1 − λs, (6)
1The real constraint is |sim(W, Dφ)| < , where is the threshold.
where λ 6= 1. (d) If B is constructed as B =(1 − λ) ksk2 st T +X i,j ci,juivjt, (7)
where ui⊥ s, vj ⊥ t, ci,jis a real number, and w satisfies
Equation 6, then D satisfiesEquation 5.
(e) If w and D are chosen according to Equations 6 and 7 respectively, then w is parallel to mo.
(f) If B satisfies Equation 7, and λ = 1 + ksk2
ktk2, then
Dφo= 0.
Figure 1 shows that the projection attack on our water-marked image makes the image perceptually unacceptable. Thus, our watermarking method is secure under projection attack.
5. SIMULATION RESULTS AND ROC CURVE
We now demonstrate the resistance of our asymmetric wa-termarking method to the following attacks.
Spreading Noise into a Watermark Space. The
simula-tion results in [15] indicate that a pirate can simulate attacks on our watermarked image and obtain a good approximation of space W, but he cannot obtain the secret matrix G from the space. In this scenario, we evaluate the efficiency of an attack on our watermark space W by jamming it with ran-dom noise. We embed 64 ranran-dom noises that have various levels of energy into the watermark space of a watermarked Lena image. Performance results for this attack are shown in Figure 3. We plot the mean, obtained by averaging the detection values of the 64 random noise attacks on the W space, versus the SNR that is measured by 20 log10
||w|| ||n||,
where n is our random noise. One can observe from the fig-ure that even at a very low SNR, the detection value is still quite high compared to our threshold. This proves that our method is robust against this type of attack.
Blind Attacks Blind attacks are carried out with the
in-tention of removing a watermark when the attacker doesn’t know the watermarking method. For each of the 61 images in our database, we produce 32 watermarked images and performe an average of 100 attacks on each image. These attacks include: shifting, blurring, JPEG compression, sharp-ening, rotation, stirmarking, and combinations of these at-tacks. The means of the |sim| values are larger than 0.9 and most of the standard deviations of the |sim| values are smaller than 0.1.
ROC Curve As proposed in [3], we model the detection
probability and false positive probability as Gaussian distri-butions. We compute the mean and the standard deviation of the Gaussian distribution of the false positive probability from the detected values of the un-watermarked images. In the same way, we compute the parameters of the detection
Fig. 1. The image obtained from the feature extracted by
applying a projection attack to the watermarked image. The PSNR of the noise image, obtained by subtracting the bot-tom image from the top image, is 17 dB.
probability for the watermarked images. From the Gaussian distributions, we can draw the ROC curve of our empirical data. Figure 2 shows the ROC curves of different c val-ues obtained in this manner. We choose c = 0.1 and use 0.5 as our threshold. This corresponds to the false posi-tive probability below 10−5in our simulation. For
numer-ical precision, the figureshows only the parts of the curves whose false positive probability is above 10−15. The
inter-sections of the curves and the axis of false positive probabil-ity (x-axis) are 0.34, 0.50, and 0.56 for curves of c = 0.15, c= 0.1, and c = 0.05, respectively. From the distribution of the ROC curves, it is clear that our asymmetric water-marking method has the same robustness as our symmetric watermarking method.
6. CONCLUSION
To resolve the weaknesses of current symmetric ing methods, we have designed an asymmetrical watermark-ing method for copyright protection that satisfies the zero knowledge principle. All of our watermarking operations, except the secret matrices G and H, have been released and are publicly available. Our asymmetric design is robust be-cause it enhances the watermark space concept of our pre-vious symmetric watermarking method. As our watermark is heavily dependent on the original image, it cannot be re-moved without the watermarked image being perceptually distorted. Our method is secure, since we embed secret information Gw within a subspace of W, and provide the public with a key (D = GT + BHT) to detect Gw.
How-ever, because the secret basis of G is hidden from the public, estimating Gw is extremely difficult.
100−15 10−10 10−5 100 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
False positive probability
False negative probability
Fig. 2. ROC curves of our empirical data. The curves plot
the false positive probability in the logarithmic (base 10) scale against the false negative probability, which is defined as one minus the detection probability, as a function of the threshold and c value. The solid curve corresponds to c = 0.15, the dash-dot curve to c = 0.1, and the dotted curve to c= 0.05.
7. REFERENCES
[1] M. Barni, F. Bartolini, T. Furon, “A general framework for robust watermarking security,” Signal Processing, 83, pp. 2069-2084, 2003.
[2] S. Craver, “Zero knowledge watermark detection,”
Pro-ceedings of the Third International Workshop on Infor-mation Hiding, vol. 1768 of Lecture Notes in Computer
Science, pp. 101-116, Spring 2000.
[3] I. Cox, M. Miller, and J. Bloom, “Digital Watermark-ing,” Morgan Kaufmann Publishers, pp. 173-177, 2002. [4] I. Cox, M. Miller, and A. Mckellips, “Watermarking as communication with side information,” Proc. IEEE, vol. 87, pp. 1127-1141, July 1999.
[5] J. Eggers, J. Su, and B. Girod, “Public key watermark-ing by eigenvectors of linear transforms,” Proc. Eur.
Signal Process. Conf., Tampere, Finland, Sept. 2000.
[6] T. Furon, I. Venturini, and P. Duhamel, “An unified approach of asymmetric watermarking schemes,”
Pro-ceeding of SPIE: Security and Watermarking of Multi-media Contents III, P. W. Wong and E. Delp, Eds, San
Jose, U.S.A., Jan. 2000.
[7] T. Furon and P. Duhamel, “An asymmetric watermark-ing method,” IEEE Trans. on Signal Processwatermark-ing, vol. 51, no. 4, pp. 981-995, April 2003. −12 −10 −8 −6 −4 −2 0 2 4 6 8 0.9975 0.998 0.9985 0.999 0.9995 1 SNR c=0.1 sim value
Fig. 3. A white noise spreading attack on W.
[8] F. Hartung and B. Girod, “F ast public-key watermark-ing of compressed video,” Proc. IEEE Int. Conf.Image
Process., Oct. 1997.
[9] A. Kerckhoffs, “La cryptographie militaire,” J. Sci.
Militaires, vol. 9, pp. 5-38, Jan. 1883.
[10] P. Moulin and A. Ivanovic, “The zero-rate spread-spectrum watermarking game,” IEEE Trans. on Signal
Processing, vol.51, no. 4, pp. 1098-1117, April 2003.
[11] R. Van Schyndel, A. Tirkel, and I. Svalbe, “K ey inde-pendent watermark detection,” Proc. Int. Conf.
Multi-media Comput. Syst., vol. 1, Florence, Italy, June 1999.
[12] J. Smith and C. Dodge, “De velopments in steganog-raphy,” Proc. of Third Int. Workshop on Information
Hidding, A. Pfitzmann, Ed. Dresde, Germany, pp.
77-87, Sept. 1999.
[13] J. Stern and J. P. Tillich, “Automatic detection of a watermarked document using a private key,” Proc.
4th Int. Workshop Information hiding, vol. 2137, I. S.
Moskowitz, Ed., Pittsburg, PA, Apr. 2001.
[14] W. Trapper, M. Wu, Z. Wang, K. J. R. Liu, “Anti-Collusion fingerprintngfor multimedia,” IEEE Trans.
on Signal Processing, vol. 51, no.l 4 pp. 1069-1087,
April 2003. Special Issue on Signal Processing for Data Hiding in Digital Media & Secure Content Delivery. [15] J. Tzeng, W. L. Hwang, and I. Liang Chern,
“En-hancing image watermarking methods with/without ref-erence images by optimization on second order statis-tics,” IEEE Trans. on Image Processing, vol. 11, pp. 771–782, July 2002.
