Published in Proc. IEEE Int. Conf. on Image Processing (1997) - available only on cdrom. Copyright IEEE.
Public watermarks and resistance to tampering
Ingemar J. Cox Jean-Paul M.G. Linnartz
NEC Research Institute Natuurkundig Laboratorium
4 Independence Way WY8, Philips Research
Princeton, NJ 08540 5656 AA Eindhoven, The Netherlands
Public watermarks allow embedded signals to be extracted from audio and video content for a variety of purposes. One application is for copyright control, where it is envisaged that digital video recorders will not permit the recording of content that is watermarked as "never copy". In such a scenario, it is important that the watermark survive both normal signal transformations and attempts to remove the watermark so that an illegal copy can be made. In this paper, we discuss to what extent a public watermark can be resistant to tampering and describe a variety of possible attacks.
The digital distribution of copyrighted content is attractive to content owners. However, the possibility of making an unlimited number of perfect digital copies is a serious concern. While it is acknowledged that professional piracy is unlikely to be prevented by technological means alone, it is hoped that the illegal casual copying that occurs in the home can be prevented by a combination of encryption and watermarking. For example, for the digital versatile disk (DVD), copyrighted video content will be scrambled before being placed on a disk, much like premium channels for cable TV. However, after descrambling, the content is unprotected which is why a watermark or embedded signal will also be placed in the content. Digital video players will look for watermarks in copyrighted material and prevent playback if a ever copy" watermark is detected in material whose source is known to be a recordable disk. Similarly, digital video recorders will not record material if a ever copy" watermark is detected.
The above example is an over simplification of the copyright protection system being designed for DVD. Nevertheless, it serves to illustrate an application in which millions of digital video players must be capable of reading signals embedded in the
video content. In such a scenario, it is imperative that the watermark survive common video signal transformations, especially MPEG-2 compression and re-compression and analog-to-digital and digitalto-analog conversions, since copies of content originally stored in compressed form on a DVD disc might subsequently be copied onto an analog VHS tape before being re-digitized and re-compressed by a writable DVD recorder. Just as importantly, it should not be trivial for an average user to circumvent the copy protection system, by for example, removing the watermark.
The requirements for watermarking can differ between applications. In many cases, it is desirable to embed information in audio, image or video content such that this information is readable by many receivers. For instance in an application such as transferring copyright ownership information by watermarking news photographs, any and all receiving users should be capable of reading the embedded information. We describe such systems as public" watermarking procedures. The embedding algorithm is private. i.e., only known to copyright owners, whereas the detection algorithm is public knowledge. There may be a fundamental asymmetry in the embedding and detection function, such that it may be computationally infeasible to derive one from the other. While a similar asymmetric concept exists in cryptography , it is not sure whether secure public watermarking can theoretically exist.
This paper discusses the susceptibility of public watermarking algorithms to tampering. We assume that the reader is aware typical watermark methods (e.g. [2, 3, 4, 5, 6, 7]) and of the most basic attempts to remove the watermark, such as noise addition, filtering, shifting stretching and rotating the image, etc., as we do not cover these. In Section 2 we introduce some notation. In Section 3 we then describe a series of attacks that may be used to remove a watermark.