Information Hiding: 5th International Workshop, IH 2002, Noordwijkerhout, The Netherlands, October 7-9, 2002, Revised Papers

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

2578

3

Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Tokyo

Fabien A.P. Petitcolas (Ed.)

Information Hiding 5th International Workshop, IH 2002 Noordwijkerhout, The Netherlands, October 7-9, 2002 Revised Papers

13

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editors Fabien A. P. Petitcolas Microsoft Research Ltd. 7 J. J. Thomson Avenue, Cambridge, CB3 0FB, UK E-mail: [email protected] Cataloging-in-Publication Data applied for A catalog record for this book is available from the Library of Congress. Bibliographic information published by Die Deutsche Bibliothek Die Deutsche Bibliothek lists this publication in the Deutsche Nationalbibliografie; detailed bibliographic data is available in the Internet at .

CR Subject Classification (1998): E.3, K.6.5, K.4.1, K.5.1, D.4.6, E.4, C.2, H.4.3 ISSN 0302-9743 ISBN 3-540-00421-1 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH http://www.springer.de © Springer-Verlag Berlin Heidelberg 2003 Printed in Germany Typesetting: Camera-ready by author, data conversion by DA-TeX Gerd Blumenstein Printed on acid-free paper SPIN: 10872352 06/3142 543210

Preface

These post-proceedings contain 27 papers that were accepted for presentation at the Fifth International Workshop on Information Hiding, held 7–9 October 2002, in Noordwijkerhout, The Netherlands. The papers were selected from 78 submissions on the basis of their scientific excellence and novelty by the program committee. We tried to have a balanced program covering several aspects of information hiding. The program committee was composed of Ross J. Anderson (University of Cambridge, UK), Jan Camenisch (IBM Zurich Research Laboratory, Switzerland), Ingemar J. Cox (NEC Research Institute, USA), John McHugh (SEI/CERT, USA), Ira S. Moskowitz (Naval Research Laboratory, USA), Job Oostveen (Philips Research, The Netherlands), Andreas Pfitzmann (Dresden University of Technology, Germany), Mike Reiter (Carnegie Mellon University, USA), and me. We all wish to thank all the authors of submissions for offering their papers for consideration. This year, contrary to the four previous workshops, the call for papers requested anonymous submissions. However, anonymity was not compulsory and we did accept some papers in which the identity of the authors was clear. Each submission was assigned to three members of the program committee. Papers submitted by program committee members were assigned to four reviewers. The program committee relied on the advice of outside colleagues. We also insisted that 12 of the 27 accepted papers should be revised according to the comments of the reviewers. The reviewers were Javier-Francisco Aprea (Philips Digital Systems Labs, The Netherlands), Rene Barto (Philips Research, The Netherlands), Oliver Benedens (Freelance Researcher, Germany), Oliver Berthold (Freie Universit¨at Berlin, Germany), Fons Bruekers (Philips Research, The Netherlands), LiWu Chang (Naval Research Laboratory, USA), Fred Cohen (Sandia National Laboratories, USA), Christian Collberg (University of Arizona, USA), Jana Dittmann (Leipzig University, Germany), Gwena¨el Do¨err (Institut Eur´ecom, France), JeanLuc Dugelay (Institut Eur´ecom, France), Elke Franz (Dresden University of Technology, Germany), Jessica Fridrich (SUNY Binghamton, USA), Emmanuel Garcia (Institut Eur´ecom, France), Dieter Gollmann (Microsoft Research, UK), Kelly Heffner, Neil Johnson (Booz Allen Hamilton, USA), Ton Kalker (Philips Research, The Netherlands), Darko Kirovski (Microsoft Research, USA), Herbert Klimant (Dresden University of Technology, Germany), Thomas Kriegelstein (Dresden University of Technology, Germany), Heinrich Langos (Freie Universit¨ at Berlin, Germany), Aweke Lemma (Philips Digital Systems Labs, The Netherlands), Kivan¸c Mih¸cak (Microsoft Research, USA), Pierre Moulin (University of Illinois at Urbana-Champaign, USA), Ginger Myles, Richard Newman (University of Florida, USA), Adrian Perrig (Berkeley University, USA), Jonathan Poritz (IBM Research, Zurich Research Laboratory, Switzerland),

VI

Preface

James Riordan (IBM Research, Zurich Research Laboratory, Switzerland), Keith Roberts (Philips Research, The Netherlands), Ahmad-Reza Sadeghi (Saarland University, Germany), Tomas Sander (HP Labs, USA), Dagmar Sch¨ onfeld (Dresden University of Technology, Germany), Marius Staring (Philips Research, The Netherlands), Sandra Steinbrecher (Dresden University of Technology, Germany), Martin Steinebach (Fraunhofer-IPSI Darmstadt, Germany), Joop Talstra (Philips Research, The Netherlands), Michiel van der Veen (Philips Research, The Netherlands), Arno van Leest (Philips Research, The Netherlands), Sviatoslav Voloshynovskiy (CUI, University of Geneva, Switzerland), Peter Wayner, Andreas Westfeld (Dresden University of Technology, Germany), and Francis Zane (Bell Labs, Lucent Technologies, USA). Thanks to all program committee members and reviewers who between them contributed over 230 reviews. Paper and review submissions, dispatching of the reviews, and notifications to authors was greatly simplified by the use of the Microsoft Conference Management Tool. Thanks to Tim Olson and Jonathan Simon from Microsoft for their support. Like last year we split the chairpersonship into the positions of ‘general’ chair and ‘program’ chair. Job Oostveen was the general chair. Together with his staff he did a terrific job with the local arrangements, printing the pre-proceedings and organizing the registration. He also organized a superb cruise dinner in Amsterdam. I thank Job very much for his efforts. We hope that you will enjoy reading these proceedings and that they will be helpful for your future research on information hiding.

November 2002

Fabien A.P. Petitcolas

Table of Contents

Session 1 – Information Hiding and Networking Session chair: Neil Johnson (Booz Allen Hamilton) Hiding Intrusions: From the Abnormal to the Normal and Beyond . . . . . . . . . . .1 Kymie Tan, John McHugh, and Kevin Killourhy Eliminating Steganography in Internet Traffic with Active Wardens . . . . . . . . 18 Gina Fisk, Mike Fisk, Christos Papadopoulos, and Joshua Neil

Session 2 – Anonymity Session chair: Andreas Pfitzmann (Dresden University of Technology) From a Trickle to a Flood: Active Attacks on Several Mix Types . . . . . . . . . . . 36 Andrei Serjantov, Roger Dingledine, and Paul Syverson Limits of Anonymity in Open Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Dogan Kedogan, Dakshi Agrawal, and Stefan Penz Chaffinch: Confidentiality in the Face of Legal Threats . . . . . . . . . . . . . . . . . . . . . 70 Richard Clayton and George Danezis

Session 3 – Watermarking Fundamentals Session chair: Job Oostveen (Philips Research) Nothing But a Kiss: A Novel and Accurate Approach to Assessing the Performance of Multidimensional Distortion-Compensated Dither Modulation . . . . . . . . . . . 87 Fernando P´erez-Gonz´ alez and F´elix Balado Robustness and Efficiency of Non-linear Side-Informed Watermarking . . . . . 106 Gu´enol´e C.M. Silvestre, Neil J. Hurley, and Teddy Furon Security of Public Watermarking Schemes for Binary Sequences . . . . . . . . . . . 119 Qiming Li and Ee-Chien Chang

Session 4 – Watermarking Algorithms I Session chair: Hyoung Joong Kim (Kangwon National University) Direct Embedding and Detection of RST Invariant Watermarks . . . . . . . . . . . 129 Peter A. Fletcher and Kieran G. Larkin

VIII

Table of Contents

Robust Image Watermark Using Radon Transform and Bispectrum Invariants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Hyung-Shin Kim, Yunju Baek, Heung-Kyu Lee, and Young-Ho Suh Audio Watermark Robustness to Desynchronization via Beat Detection . . . 160 Darko Kirovski and Hagai Attias

Session 5 – Watermarking Algorithms II Session chair: Ton Kalker (Philips Research) Robust Watermarking and Affine Registration of 3D Meshes . . . . . . . . . . . . . . 177 Oliver Benedens Natural Language Watermarking and Tamperproofing . . . . . . . . . . . . . . . . . . . . 196 Mikhail J. Atallah, Victor Raskin, Christian F. Hempelmann, Mercan Karahan, Radu Sion, Umut Topkara, and Katrina E. Triezenberg

Session 6 – Attacks on Watermarking Algorithms Session chair: Fabien A. P. Petitcolas (Microsoft Research) Cryptanalysis of UCLA Watermarking Schemes for Intellectual Property Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 Tri Van Le and Yvo Desmedt Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks . . . . . . . . . 226 M. Kıvan¸c Mıh¸cak, Ramarathnam Venkatesan, and Mustafa Kesal Detectors for Echo Hiding Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Scott Craver, Bede Liu, and Wayne Wolf

Session 7 – Steganography Algorithms Session chair: Jessica Fridrich (SUNY Binghamton) A Steganographic Embedding Undetectable by JPEG Compatibility Steganalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Richard E. Newman, Ira S. Moskowitz, LiWu Chang, and Murali M. Brahmadesam Steganography Preserving Statistical Properties . . . . . . . . . . . . . . . . . . . . . . . . . . .278 Elke Franz Bit-Plane Decomposition Steganography Combined with JPEG2000 Compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295 Hideki Noda, Jeremiah Spaulding, Mahdad N. Shirazi, Michiharu Niimi, and Eiji Kawaguchi

Table of Contents

IX

Session 8 – Steganalysis I Session chair: Richard Clayton (University of Cambridge) Steganalysis of JPEG Images: Breaking the F5 Algorithm . . . . . . . . . . . . . . . . .310 Jessica Fridrich, Miroslav Goljan, and Dorin Hogea Detecting Low Embedding Rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Andreas Westfeld

Session 9 – Steganalysis II Session chair: John McHugh (SEI/CERT) Detecting Hidden Messages Using Higher-Order Statistics and Support Vector Machines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340 Siwei Lyu and Hany Farid Detection of LSB Steganography via Sample Pair Analysis . . . . . . . . . . . . . . . . 355 Sorina Dumitrescu, Xiaolin Wu, and Zhe Wang

Session 10 – Hiding Information in Unusual Content I Session chair: Christian S. Collberg (University of Arizona) Hiding Data in DNA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373 Boris Shimanovsky, Jessica Feng, and Miodrag Potkonjak Tracing the Source of a Shredded Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Jack Brassil

Session 11 – Hiding Information in Unusual Content II Session chair: Caroline Fontaine (Universit´e des Sciences et Technologies de Lille) Oblivious Hashing: A Stealthy Software Integrity Verification Primitive . . . 400 Yuqun Chen, Ramarathnam Venkatesan, Matthew Cary, Ruoming Pang, Saurabh Sinha, and Mariusz H. Jakubowski Practical Oblivious Transfer Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415 Christian Tobias Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .427

Hiding Intrusions: From the Abnormal to the Normal and Beyond Kymie Tan1 , John McHugh2 , and Kevin Killourhy1 1

Carnegie Mellon University, Department of Computer Science Pittsburgh, PA 15213 USA {kmct,ksk}@cs.cmu.edu, 2 r CERT Coordination Center and Center for Computer and Communications Security Carnegie Mellon University, Pittsburgh, PA 15213 USA [email protected]

Abstract. Anomaly based intrusion detection has been held out as the best (perhaps only) hope for detecting previously unknown exploits. We examine two anomaly detectors based on the analysis of sequences of system calls and demonstrate that the general information hiding paradigm applies in this area also. Given even a fairly restrictive definition of normal behavior, we were able to devise versions of several exploits that escape detection. This is done in several ways: by modifying the exploit so that its manifestations match “normal,” by making a serious attack have the manifestations of a less serious but similar attack, and by making the attack look like an entirely different attack. We speculate that similar attacks are possible against other anomaly based IDS and that the results have implications for other areas of information hiding.

1

Introduction

For some time a primary dictum of the intrusion detection field has held that anomalous and intrusive activities are necessarily equivalent.1 Insofar as we have been able to determine, most previous activity in the anomaly based intrusion detection area has concentrated on demonstrating that anomalous manifestations, detectable by whatever detection scheme was being used, often occur at the same time an intrusion is being carried out. This has led many researchers in the intrusion detection field to assume that anomaly detection is the same as intrusion detection. As a consequence, many investigators have failed to examine the underlying causes and characteristics of the anomalous behaviors that 1

This view is clearly enunciated by Dorothy Denning [1] who said: The model is based on the hypothesis that exploitation of a system’s vulnerabilities involves abnormal use of the system; therefore, security violations could be detected from abnormal patterns of system usage. ... Similar, though often less clear, statements appear in many recent papers.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 1–17, 2003. c Springer-Verlag Berlin Heidelberg 2003


2

Kymie Tan et al.

they observe. In particular, they often fail to demonstrate that the anomalous manifestation is a necessary consequence of the intrusive activity. Recently, we discovered techniques whereby intrusive activities with anomalous manifestations could be modified in such a way as to be indistinguishable from arguably normal activities. We have also discovered techniques that can be used to modify other anomalous, intrusive activities so that, while still anomalous, they fall into the blind spot[2] of one commonly used anomaly detector (stide[3]) and become undetectable. We view both of these transformations as forms of information hiding and are beginning to suspect that the lessons that we are learning may be relevant to other areas of information hiding. As the paper continues, we will explain just enough about intrusion detection and anomaly based intrusion detection so that the reader has some context into which to place our results. Key to this effort is the notion that a sensor associated with the system being monitored abstracts system activity into a trace of data items on which analysis is performed. In this context, we will discuss the problems involved in establishing “normal” behavior in general, and the classes of sensors used for anomaly based intrusion detection in particular. Recent work [2] has characterized these sensors and has demonstrated that they may suffer from blind spots, that is regions in which they are unable to recognize anomalous data. With this background established, we will provide several examples of anomalous intrusions, concentrating on the characteristics that make them anomalous in the context of our observed “normal.” We then show how the intrusions can be transformed so that their traces either appear normal or fall into the blind spots of the anomaly detector. In passing, we also note that similar techniques could be used to produce traces that are anomalous but benign, overloading operators with false alarms that offer a further opportunity for hiding anomalous intrusive activity. At this point, we enter the realm of speculation. Much of information hiding depends on the unsuspecting observer remaining unsuspecting. Once the observer knows that hidden information is present and understands how the information was hidden, its extraction (or erasure) is relatively simple. Unlike cryptography, information hiding techniques depend on the hider doing a good enough job to operate below the suspicion / detection threshold of observer. In the case of the IDS, we know the detector characteristics and have been able to shape our activities so as to produce traces that avoid them. We speculate that, in general, knowledge of the detection algorithm enables the development of techniques that avoid detection. As a simple example, the Stegdetect package by Niels Provos [4, 5] assumes that the details of the steganographic algorithm are known, but appears not to detect that for which it has not been specifically provisioned. 1.1

Intrusions, Intrusive Activities, Penetrations, and Exploits

From the earliest days of computer security, the possibility that malicious users could defeat protection mechanisms was an area of serious concern. Due to the relatively limited networking of early systems and the prevalence of multiuser batch systems, coupled with the fact that publicly accessible services (such as

Hiding Intrusions: From the Abnormal to the Normal and Beyond Penetrator Not Authorized to use Data/Program Resource Case A:

Penetrator Not Authorized External Use Of Computer Penetration Penetrator Case B: Authorized Internal Use Of Computer Penetration

3

Penetrator Authorized to use Data/Program Resource

Case C: Misfeasance

Fig. 1. General cases of threats (after [6])

present day web servers) were almost unknown, most of the early efforts concentrated on mechanisms that untrusted insiders could use to access sensitive materials on multi-level secure systems2 . Under this model, the primary threat is from legitimate users of the system who try to gain access to material for which they do not have authorization. Although there are earlier discussions of the issues associated with malicious users, James P. Anderson’s 1980 report, “Computer Security Threat Monitoring and Surveillance”[6] sets up the first coherent framework for a of intrusions and intrusion detection. Anderson classifies threats as shown in Figure 1. The first task faced by an external penetrator is gaining access to the system in question. Note that the true external penetrator may be either an outsider with no connection to the organization that owns or controls the system being attacked or it may be someone associated with the organization who is not authorized to use the system. In todays world of networked systems, it could also be someone who has legitimate access to systems on the network, but not to the target of the attack. 1.2

Intrusions and Anomalous Behavior

Anderson (and later Denning [1]) assumed that the statistical behavior of users could be characterized with sufficient accuracy so that departures from normal behavior would be indicative of intrusions. After a number of attempts, it was realized that the problem is not that simple, but the notion that some characterization of normal can be found that allows intrusive activity to be recognized persists. In general, anomaly based intrusion detectors comprise a sensor that 2

A multi-level secure computing system is one that is capable of supporting a mandatory access control policy that bases access decisions on the classifications assigned to the information objects that it stores and clearances given to users on whose behalf processes seek access.

4

Kymie Tan et al.

monitors some aspects of system behavior and a decision process that decides if the sensed data is consistent with a predefined notion of normal. The latter is typically defined by observing the data under circumstances where it is certain that intrusive activity is not present. The sensed data may be complex, involving numerous variables and their temporal relationships or it may be fairly simple. The detectors that we examine for this study monitor the system call activity of privileged processes operating on Unix systems. After the system calls have been collected for a sufficiently long period of normal activity (the training data) and characterized as shown below, the system is monitored to look for departures from normal under the assumption that this will indicate an intrusion.

2

Description of the Anomaly Detectors

For our purposes, we choose two relatively simple detectors, stide [3] and t-stide [7]. Both use as input the system calls3 made by privileged UNIX programs such as lpr (the line printer server), sendmail (the mail delivery program), etc. These programs typically operate with special privileges because they must be able to read and write files belonging to many users. They are attractive targets for intruders because they can sometimes be abused in such a way that the abuser acquires their privileges. As they operate, these programs may spawn multiple processes. The data used for analysis consists of the lists (or traces) of system calls that each process associated with the program makes from its initial creation to its termination. The system calls may be thought of as unique symbols, each representing a particular system function invoked by the program, in effect, an alphabet consisting of several hundred characters. Stide makes a binary decision based on whether or not a fixed length subsequence of test data is in its “normal” database. T-stide takes into account the frequency with which such sequences occur in the training data, allowing sequences that occur infrequently in the normal data to be considered as possibly intrusive. 2.1

Description of Stide

Stide acquires a model of normal behavior by segmenting training data into fixed-size sequences [7]. This is done by sliding a detector window of fixed size DW over the training data, one symbol at a time, producing a series of overlapping samples, each a sequence containing DW symbols. Each unique size DW sequence obtained from the data stream is stored in a “normal database.” Sequences of size DW are also obtained from the test data using a sliding window and tested to see whether or not they are present in the normal database. If a test sequence is found in the normal database, it is assigned an anomaly score of 0. Sequences that do not exist in the normal database are assigned an anomaly score of 1. In this manner, a sequence of overlapping, fixed length, samples is converted to a sequence of 0s and 1s. 3

The calls are captured by instrumenting the system call interface to the Unix kernel.

Hiding Intrusions: From the Abnormal to the Normal and Beyond

5

The detector’s final response to the test data, the anomaly signal, is the sum of the anomaly scores for the most recent N test sequences. For example, if N , the size of the locality frame is set to 20, then for each sequence of test data the number of mismatches in the last 20 (overlapping) test sequences, including the current one, is calculated. The number of mismatches that occur within a locality frame is referred to as the locality frame count and is used to determine how anomalous the test data is in that region. The size of the locality frame is a user-defined parameter that is independent of the size of the detector-window. See [3, 7] for additional detail. 2.2

Description of T-stide

Warrender et al.[7] observed that some anomaly detection algorithms regarded rare sequences as suspicious events. T-stide (“stide with frequency threshold”) was designed to test this premise. T-stide involves a simple modification to the basic stide algorithm. As the normal database is built, counts are maintained of the total number of samples examined and the number of times each sample was seen. This allows the relative frequency of occurrence of each sample to be determined. Rare sequences were defined as those sequences with relative frequencies that fall at or below a user-defined threshold (0.001% in this case). Sequences in the database that are not rare are called “common.” In determining the anomaly scores for a sequence of test samples, t-stide treats samples found to be rare in the normal database as though they were not present and returns an anomaly score of 1. 2.3

A Description of an Anomaly-Based Evaluation Strategy

We define a foreign sequence (of any length) as a subsequence of a trace of test data that is not a subsequence of any trace of the normal data. We define a foreign test sequence as a sequence of length DW obtained from the test data that does not appear in the normal database. It is not difficult to see that stide will only detect foreign test sequences, and t-stide will detect both foreign and rare test sequences. Testing the detectors involves injecting foreign (or rare) sequences into normal data, a nontrivial process that is discussed in [8] which establishes a evaluation framework that focuses on the structure of anomalous sequences and provides a means to describe the interaction between the anomalous sequences and the sliding window of anomaly detection algorithms like stide. 2.4

Stide’s Performance

The most significant result provided by the evaluation of stide was that the detector is completely blind to a particular kind of foreign sequence, a minimal foreign sequence, that was found to exist (in abundance) in real-world intrusion data [2]. A minimal foreign sequence is foreign sequence whose proper subsequences all exist in the normal data, i.e. it contains no smaller foreign sequences.

Kymie Tan et al.

Size of detector window

6

12 Detection Region

11 10 9 8 7 6 5 4 3

Blind Region

2 1 1

2

3

4

5

6

7

8

9

10

Size of minimal−foreign−sequence anomaly

Fig. 2. The detector coverage (detection map) for stide; A comparison of the size of the detector window (rows) with the ability to detect different sizes of minimal foreign sequence (columns). A star indicates detection For stide to detect4 a minimal foreign sequence, its detector window size, DW must be larger than the size of the minimal foreign sequence. This phenomenon can be seen in Figure 2. The graph in the figure plots the size of the minimal foreign sequence on the x-axis and the size of the detector window on the yaxis. Each star marks the size of the detector window that successfully detected a minimal foreign sequence whose corresponding size is marked on the x-axis. The diagonal line shows the relationship between the detector window size and size of the minimal foreign sequence, a relationship that can be described by the function, y = x. Figure 2 also shows an area of blindness in the detection capabilities of stide with respect to the minimal foreign sequence. This means that it is possible for a foreign sequence to exist in the data in such a way as to be completely invisible to stide. This weakness will be shown to be exploitable by an attacker in the subsequent sections. 2.5

T-stide’s Performance Results from the Anomaly-Based Evaluation Strategy

The most significant result provided by the anomaly-based evaluation of t-stide was that there were conditions that caused the detector to be completely blind to 4

The term detect for stide means that the minimal foreign sequence must have caused as at least one sequence mismatch as it passed through the detector window.

Hiding Intrusions: From the Abnormal to the Normal and Beyond

7

both the minimal foreign and rare sequences. Like the minimal foreign sequence, a minimal rare sequence is rare sequence whose proper subsequences are all common sequences in the normal data. Although t-stide will be able to detect a minimal foreign sequence when the detector window is equal to or larger than the size of the minimal foreign sequence, it is possible for t-stide to detect a minimal foreign sequence when the detector window is smaller than the size of the minimal foreign sequence if the minimal foreign sequence contains at least one rare subsequence the size of the detector window. However, if the minimal foreign sequence is composed entirely of common subsequences, then t-stide exhibits the same behavior as stide, i.e. an area of detection blindness, identical to the one displayed in Figure 2, exists in the performance map. It is the t-stide’s blindness to minimal foreign or rare sequences composed entirely of common subsequences that can be exploited to hide the presence of attacks from the detector.

3

The Victim Programs, Normal Data, and Attacks

The attacks selected for this study are typical of those that stide is intended to detect, i.e., attacks that exploit privileged UNIX system programs. UNIX system programs typically run with elevated privileges in order perform tasks that require the authority of the system administrator, privileges that ordinary users are not usually afforded. Exploiting vulnerabilities in privileged system programs can result in the attacker acquiring its privileges[7]. We chose the three attacks examined in this study because they can be used to illustrate the types of information hiding with which we are concerned. The three attacks are called restore, tmpwatch, and kernel after the programs which are exploited during the attacks. Each of the attacks successfully allows an attacker with an unprivileged local account on a system to elevate his privileges to those of the system administrator, giving total control over the victimized host. For each of these programs, it is necessary to establish a baseline of normal behavior against which the attacks can be compared. Typically, this would be done by the administrator of the system being protected and would reflect the typical usage of that installation. An attacker wishing to hide an attack needs to know a reasonable approximation of the normal behavior as well. For anomaly detectors that monitor system programs, training data can easily be approximated because system programs typically have limited behaviors and it is possible to make reasonable assumptions about their typical usage. Program documentation and experience supplement these assumptions. It is important to note, however, that the success of this method for undermining stide and t-stide is reliant on the attacker being able to estimate the normal usage of the system program, however the attacker does not need to obtain every possible example of normal behavior for a given system program in order to undermine stide.

8

Kymie Tan et al.

When an exploit is performed, we need to determine whether the actions associated with the attack are actually manifested in the sensor data, and whether the manifestation is an anomalous event detectable by stide. The former is done by inspecting the system call trace captured and examining the source code of the attacked program to determine the execution path that produced it in response to the attack command. The later requires identifying the minimal foreign sequence(s) in the trace that associated with stide detection. In our evaluation, we used window sizes from 1 through 15 with both stide and t-stide. 3.1

The restore Attack

restore is a program used to restore corrupted or deleted files from a backup copy. In order to allow normal users to access tape devices used to perform backups and restores, the program must run with administrative privileges. In addition, the restore program allows the retrieval of backups from a remote, the backup server. In this case, the user of the restore program may be required to authenticate to the backup server. To support this authentication as well as the network connection required, restore executes a helper program, typically a “remote shell” on behalf of the user. A vulnerability exists in restore that passes its privileges to the helper program. The helper program can be specified by the user, allowing an attacker to create an arbitrary program and then use restore to execute it with root privileges. One example of such an attack program creates a “suid root” shell which the attacker can use to regain root access even if the vulnerability in restore is fixed. For the restore system program, normal data was obtained by monitoring a regular user executing the restore system program to retrieve backup data from a remote backup server. A second computer is set up to act as this backup server and maintain regular backups of the files on the target computer system which the user could access using ssh as detailed in [9]. The restore attack was simply downloaded from [10] and run. The successful execution of the exploit was confirmed by noting the elevated privileges given the command shell created and run during the attack. The manifestation of the restore attack was determined manually. An inspection of the source code for the restore program and its exploit script identified the system calls which are attributable to the attack. This sequence of system calls is dup2, close, close, dup2, getpid, setpgid, execve. In addition to the system calls of the child process, the sequence of system calls made by the restore process after it forks the child consists of failed attempts to interact with the attacker’s program. These system calls, fork, close, close, fstat, mmap, ioctl, write, getuid, setuid, write, read, write, munmap, exit,

Hiding Intrusions: From the Abnormal to the Normal and Beyond

9

are also considered part of the manifestation of the attack. The attack was detectable by stide and t-stide at all detector window sizes greater than one because the pair write, munmap is a minimal foreign sequence of size 2. 3.2

The tmpwatch Attack

tmpwatch is a program which is intended to periodically clean up the temporary files left in the tmp file system by both users and system programs. The tmpwatch program must be run by the administrator in order to remove files created by arbitrary users. Since removing a file which is currently open by another processes might put that process in an unstable state, tmpwatch uses another program, fuser, to determine whether the file is currently open by another process. If it is, the file is not removed. The manner by which tmpwatch invokes fuser is unsafe from a security standpoint. tmpwatch program assembles a shell command from the fuser program name and the name of the file to be tested.t tmpwatch does not check the filename for special characters that will be interpreted by the shell as something other than part of the file name. For example, an attacker can create a filename containing a semicolon. When the filename is passed to the shell, the semicolon will be interpreted as the end of one command and the beginning of another and the rest of the filename will be treated as a command and executed with the administrative privileges inherited from tmpwatch. In our example, the attacker forces tmpwatch to run a sequence of commands which creates a “setuid root” shell. For the tmpwatch[11] system program, normal data was obtained by populating the /tmp file system with a small directory hierarchy containing five directories and thirteen files, the access times of five of which are set to be more than five days old. Then the system calls of the tmpwatch program are logged while it is invoked by the system administrator to clean the /tmp directory of all files older than five days, using the fuser program to protect the files which are currently open by any other processes. The tmpwatch exploit was created based on the description [12]. The attack script creates a file in the tmp directory which will cause a root compromise the next time tmpwatch is run as root. The success of the attack is confirmed with the creation of a shell with administrative privileges by the tmpwatch. The sequence of system calls which constitutes the manifestation of the attack is: lstat, access, rt sigaction, rt sigaction, rt sigprocmask, vfork, wait4, rt sigaction, rt sigaction, rt sigprocmask, unlink. The vfork in this sequence is the creation of the child process which in turn executes the fuser program. Since it is in that execution which leads to the creation of the “root” shell, the sequence of system calls made by that process constitute the rest of the manifestation of the attack: rt sigaction, rt sigaction, rt sigprocmask, execve. The attack was detectable by both stide and t-stide at all detector window sizes greater than thirteen because the first part of the manifestation, listed

10

Kymie Tan et al.

above, formed a minimal foreign sequence of size thirteen when combined with the preceeding two (which are not part of the manifestation). 3.3

The kernel Attack

The Linux kernel enforces the security and access control policies of the system. One aspect of this is ensuring that the kernel support for debugger programs cannot be misused. Debuggers are programs which allow a developer to interactively control the execution of another program in order to analyze its behavior. The kernel mediates this interaction and must restrict these capabilities to authorized processes. For example, were an unprivileged process able to attach to and control a privileged program, the unprivileged program would be able subvert the privileged program and force it to take arbitrary actions. Unfortunately, a serialization error in the kernel creates an interval in which any process is able to attach to and control any other process before an authorization check is made. In our example, an attacker takes control of traceroute, a network diagnostic tool, and redirects it to create a “setuid root” shell. For the traceroute system program, normal data was obtained by executing it to acquire diagnostic information regarding the network connectivity between the local host and the Internet site nist.nsf.org5. The kernel exploit was downloaded from [14]. Since the exploitation of the vulnerability in the kernel requires the execution of a privileged system program, the exploit was configured to take advantage of the traceroute system program. The sequence of system calls that comprise the manifestation of the attack embodied by the kernel exploit is: setuid, setgid, execve. It was found that the attack was detectable at all detector window sizes by both stide and t-stide. More precisely, the attack was detectable by stide and t-stide because setgid and execve are foreign symbols (i.e. they do not appear in the normal data at all).

4

Hiding Attacks by Modifying Exploits

Thus far, we have established some limitations on the detection abilities of stide and t-stide but have shown that they easily detect our example exploits. Knowing that stide is running on the host system and will alarm if any of the exploits are used, we wonder if they can be modified to hide their manifestations. The detection map shown in figure 2 is the key to this process. Effectively, we have two choices: 1) ensure that the attack appears to be normal or 2) ensure that the attack falls into the detector’s blind region. This means ensuring that the attack either manifests no foreign sequences at all or manifests only minimal foreign sequences longer that the detector window, DW . If this is not possible, the consequences of detection may be reduced by making the attack appear to 5

Chosen because it is the simplest example in the documentation[13].

Hiding Intrusions: From the Abnormal to the Normal and Beyond

11

be either a less devastating attack; or another random attack altogether. We give examples for each of the approaches and each of the later alternatives. 4.1

Hiding in Normal

The restore attack can be hidden by making it appear normal. We do this by comparing the evidence left by the attack with what is left by a normal usage of the program and modifying the attack so that the evidence left is no different than what would have appeared normally. A comparison of the system call sequence made during the attack with that made during the normal restoration of files shows that the attack data can be distinguished from the normal data because the attack does not set up a communication channel to a remote host and the restore program fails. The system calls made when the restore program fails contain the foreign sequence that allows detection of the attack. In order to make the attack look normal, the helper program used must retrieve the backup file from the remote host, and at the same time perform its malicious activity. We modified the attack so that the program run by restore serves the dual purpose of giving the attacker elevated privileges and making the ssh connection to the backup server. Since the restore program receives the backup file and completes successfully, it never enters the error state and the evidence of the attack is hidden in what appears to be a normal run of restore. The sequence of system calls observed when the modified attack is made exactly match the sequence of system calls observed when the restore program is run normally as described above. Note that the helper program is specified by the user, so that there is no way to include its activities in the definition of normal for restore. 4.2

Hiding in the Blind Spot

In addition to the exploits described above, we have discovered another exploit against traceroute that can be modified to produce arbitrarily long minimal foreign sequences[15]. traceroute must have unrestricted access to the network interface, a resource only provided to privileged system programs. A logic error in traceroute allows an attacker to corrupt the process’ memory by specifying multiple network gateways on the command line[15]. The attack uses this memory corruption to redirect the process to instructions that execute a command shell with the elevated privileges of the traceroute system program. The attack can be confirmed from the system call trace of traceroute and observing that the attack has caused the process to launched a shell with administrative privileges. The result of this modification is illustrated graphically in Figure 3. The xaxis for Figure 3, represents the size of the minimal foreign sequence anomaly, and the y-axis represents the size of the detector window. Each star marks the size of the detector window that successfully detected a minimal foreign sequence whose corresponding size is marked on the x-axis.

12

Kymie Tan et al.

Fig. 3. Modifying traceroute exploit for an arbitrarily large Minimal Foreign Sequence

As expected the graph mirrors the detection map for stide, showing that the larger the minimal foreign sequence that is the manifestation of an exploit, the larger is the detector window required to detect that exploit. The circles and arrows illustrate the following scenario. If stide were deployed with a detector window of size 6, then it is possible to modify the traceroute exploit so that it manifests as a minimal foreign sequence of successively larger sizes until size 7 is reached where the exploit falls into the detector’s blind spot. This shows that it is very possible to exert control over a common exploit so that its manifestation is moved from an anomaly detector’s detection region, to its region of complete blindness. Such movement of an exploit’s manifestation effectively hides the exploit from the detector’s view. Achieving an attacker’s objectives is not affected by the modification to the exploit programs, and neither is the training data tampered with in order to render an anomaly detector blind to the attacks. While it would not be in the attacker’s interests to modify an attack to make it more easily visible, this may also be possible. These results have implications for both detector design and for detector evaluation. 4.3

Hiding in a Less Serious Attack

An example of an attack being made to look like a less devastating attack is the tmpwatch attack. We consider an alternative attack using tmpwatch which performs a denial of service on the host. This is arguably less damaging that al-

Hiding Intrusions: From the Abnormal to the Normal and Beyond

13

Manifestation of "Kernel"Attack Impersonating "Traceroute"Attack Kernel Affack Aodlfled Kernel Allack

0000000000C9OKO000KOKOOB~OOOOOOOMO~

Traceroule Allack

0000000000C9OKO000KOKOOB~OOOOOOOMO~

,"

,6

2"

26

3"

system C a l k used n Attack

Fig. 4. A comparison of the manifestations of the k e r n e l attack, the modified k e r n e l attack, and the attack it was modified to impersonate

lowing a root compromise. The evidence left by this lesser attack will be collected and analyzed and the original tmpwatch attack modified so that the evidence it leaves is made to look like the evidence left by the alternative attack. In order to recursively clean every subdirectory of the /tmp file system, the tmpwatch process forks a new process, copying itself. If an attacker can create a large number of subdirectories, the tmpwatch program will have to create a new process for each subdirectory. It is possible for the number of tmpwatch processes to grow until it reaches a system-wide limit on the number of running processes, typically crashing the system. An exploit based around this approach was created, also based on the d e scription of the vulnerability available at [12]. When the tmpwatch process is run, the success of the attack is confirmed when tmpwatch reports that the process table is full. The manifestation of this denial of service attack is thousands of sequences which look exactly like the manifestation of the root compromise attack. If both attacks are launched against a system, the elevation of privileges attack may go unnoticed by the intrusion detection system. Evaluating the evidence left by just the denial-of-service attack and then the evidence left by both the denial-of-service and the elevation of privilege attacks launched in parallel, it can be confirmed that the detection system reports the same number and type of anomalous sequences in both attacks. Hence, the more devastating attack has been hidden within the less devastating one.

4.4

Hiding as Another Attack

The k e r n e l attack can be made to look like avery different attack. The evidence from a n attack that exploits a vulnerability in the t r a c e r o u t e program is d e scribed. The k e r n e l attack is then modified so that the evidence it leaves exactly matches that left by the t r a c e r o u t e attack which is described in Section 4.2 above. As described above, the k e r n e l attack does not require any particular system program to be present on the system, most every system program which runs with administrative privileges works equally well. In this experiment, the k e r n e l attack uses the t r a c e r o u t e program.

14

Kymie Tan et al.

Figure 4 shows that the system calls issued by the impersonating (kernel) and impersonated (traceroute) attacks are identical. Each patterned block indicates a system call in the sequence of system calls that will be logged during the attack. This is possible because the traceroute attack contains the sequence of calls used in the kernal attack. It is possible to pad the kernal attack so that it takes on the appearance of the traceroute attack while preserving its own semantics. 4.5

Attack Hiding Results

The procedures described in the previous sections, designed to modify attacks to hide them, were all successful. For each of the attacks and for each of the two intrusion detection systems, stide and t-stide, the detection system is used to detect the attack at all window sizes from 1 through 15 and the number of alerts is recorded. The number of alerts produced by the attack is compared with the number of alerts produced by the target event which the attack is being modified to impersonate i.e. normal, a less devastating attack, or a totally different attack. A typical comparison is shown in Figure 5 in which it is shown that the kernel attack can be modified to successfully impersonate the traceroute attack to the t-stide anomaly-based intrusion detector. The top graph shows the alerts produced by the original kernel attack. The middle graph shows the alerts produced by the traceroute attack. And, the bottom graph shows the alerts produced by the kernel attack modified to look like the traceroute attack. Since the middle and bottom graphs match, T-stide is unable to distinguish between the two attacks, at window sizes from 1 through 15, with rarity threshold 0.005. The comparison between the restore attack modified to look like a normal run of restore and such a normal run, and the comparison between the tmpwatch attack modified to look like a denial-of-service attack and the denialof-service attack itself produce results similar to Figure 5.

5

Related Work

While this paper was under review, we became aware of similar work being performed by David Wagner [16] at Berkeley. Wagner’s approach is linguistically based, using a mechanical search to embed an attack, padded with system calls that have been effectively converted to “no-ops” if necessary, into strings that can be composed from the normal stide database for the program being attacked. This approach seems to be primarily applicable to attacks based on storage overflows where the attacker controls the execution sequence of the attacked program from the point of the overflow. Preliminary results showing that intrusions can be hidden in the blind spot of stide also appear in a paper by Tan, et. al. [17].

Number of Alarms

Hiding Intrusions: From the Abnormal to the Normal and Beyond

15

4

3

2

1

0

1

2

3

4

5

6

7

8

9

10

11

12

13 14 15 16 Detector Window Size

Number of Alarms

T-Stide Detector Response to Attack #1 (kernel attack) 25

20

15

10

5

0

1

2

3

4

5

6

7

8

9

10

11

12

13 14 15 16 Detector Window Size

Number of Alarms

T-Stide Detector Response to Attack #2 (traceroute attack) 25

20

15

10

5

0

1

2

3

4

5

6

7

8

9

10

11

12

13 14 15 16 Detector Window Size

T-Stide Detector Response to Attack #1 Made to Look Like Attack #2

Fig. 5. A comparison of the alerts produced by different attacks. The top graph shows the number of alerts that are produced when t-stide is used with window sizes 1 through 15 to detect attack #1, the kernel attack. The middle graph shows the number of alerts that are produced when t-stide is used to detect attack #2. The bottom graph shows the number of alerts that are produced when t-stide is used to detect attack #1 modified to look like attack #2. Since the graphs match, the modification is successful in getting attack #1 to look like attack #2 to t-stide

16

6

Kymie Tan et al.

Conclusions and Implications

At the very least, our work has demonstrated, through the application of a novel information hiding paradigm, that malicious acts and anomalous manifestations from intrusion detection sensors are not necessarily synonymous. We have demonstrated hiding serious attacks in such a way that they either appear completely normal or are likely to be confused with other attacks. We believe that we can apply the approach with other attacks and with other sensors. A skilled attacker who understands the detector and the environment in which it is deployed may be able to devise undetectable attacks. If this result holds for a wide variery of anomaly based intrusion detection systems, it may undermine the effectiveness of the anomaly detection approach to intrusion detection as a vehicle for detecting unknown attacks. At the same time, the “cat and mouse” game implied by this approach has an unsatisfying aspect to it. The anomaly detector evaluation that led to our work has a sound scientific basis, but the application of these detectors to intrusion detection is very much ad hoc as has been noted by Lee and Xiang [18]. In this respect, the work seems to have much in common with the rest of the information hiding field and with other areas involving “slights of hand” in general. This can be summed up as “It isn’t a trick once you understand it.” Much of the work in information hiding has this flavor, depending on obscurity for protection. We were hoping to gain insights that might move us toward a more theoretical basis for understanding intrusions. Instead, we seem to have discovered an interesting approach for serious intruders.

References [1] Denning, D. E.: An intrusion detection model. IEEE Transactions on Software Engineering SE-13 (1987) 222–232 1, 3 [2] Tan, K. M. C., Maxion, R. A.: “Why 6?” Defining the operational limits of stide, an anomaly-based intrusion detector. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, Oakland, CA (2002) 2, 5 [3] Forrest, S., Hofmeyr, S. A., Somayaji, A., Longstaff, T. A.: A sense of self for unix processes. In: Proceedings 1996 IEEE Symposium on Security and Privacy, Los Alamitos, CA, IEEE Computer Society Press (1996) 2, 4, 5 [4] Provos, N.: Steganography press information. On line report of work performed at the University of Michigan Center for Information Technology Integration (2002) Observed at http://www.citi.umich.edu/projects/steganography/ faq.html as of 4 february 2002 2 [5] Provos, N., Honeyman, P.: Detecting steganographic content on the internet. In: ISOC NDSS’02, San Diego, CA (2002) 2 [6] Anderson, J. P.: Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., Fort Washington, PA (1980) Available online at http://seclab.cs.ucdavis.edu/projects/history/CD/ande80.pdf 3 [7] Warrender, C., Forrest, S., Pearlmutter, B.: Detecting intrusions using system calls: Alternative data models. In: Proceedings of the 1999 IEEE Symposium on Security and Privacy, Oakland, CA (1999) 133–145 4, 5, 7

Hiding Intrusions: From the Abnormal to the Normal and Beyond

17

[8] Maxion, R. A., Tan, K. M. C.: Anomaly detection in embedded systems. IEEE Transactions on Computers 51 (2002) 108–120 5 [9] Pop, S., Card, R.: Restore(8) system manager’s manual. Included in dump version 0.4b13 software package (2000) 8 [10] fish stiqz: Redhat linux restore insecure environment variable vulnerability. Internet – http://www.securityfocus.com/bid/1914 (2000) bugtraq id 1914 8 [11] Troan, E., Brows, P.: Tmpwatch(8). Included in tmpwatch version 2.2 software package (2000) 9 [12] Yurchenko, A. Y.: Tmpwatch arbitrary command execution vulnerability. Internet – http://www.securityfocus.com/bid/1785 (2000) bugtraq id 1785 9, 13 [13] Jaconson, V.: Traceroute(8). Included in traceroute version 1.4a5 software package (1997) 10 [14] Anonymous: Linux ptrace/execve race condition vulnerability. Internet – http://www.securityfocus.com/bid/2529 (2001) bugtraq id 2529 10 [15] Kaempf, M.: Lbnl traceroute heap corruption vulnerability (2000) bugtraq id 1739 11 [16] Wagner, D., Soto, P.: Mimicry attacks on host-based intrusion detection systems. In: 9th ACM Conference on Computer and Communications Security. (2002) To Appear 14 [17] Tan, K. M., Killourhy, K. S., Maxion, R. A.: Undermining an anomaly-based intrusion detection system using common exploits. In Wespi, A., Vigna, G., Deri, L., eds.: 5th International Symposium, RAID 2002. Number 2516 in LNCS, Zurich, Switzerland, Springer (2002) 54–73 14 [18] Lee, W., Xiang, D.: Information-theoretic measures for anomaly detection’. In: Proceedings of the 2001 IEEE Symposium on Security and Privacy, Oakland, CA, IEEE Computer Society Press, Los Alamitos, CA (2001) 130–143 16

Eliminating Steganography in Internet Traffic with Active Wardens Gina Fisk1,2 , Mike Fisk1 , Christos Papadopoulos2, and Joshua Neil1,2 1 2

Los Alamos National Laboratory University of Southern California

Abstract. Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.

1

Introduction

Network security is one of the most pressing and difficult problems facing modern private organizations and governments. In addition to the daily barrage of unwanted traffic from network scans, viruses, worms, exploit tools, and other unauthorized attempts to gain access, sites must be concerned with malicious insiders using digital carriers to secretly disperse information through the very perimeter that is supposed to be protecting the network. The ubiquitous use of protocols and file structures laden with loose semantics and unused or marginallysignificant bits that can be freely used for covert communication channels only furthers those challenges. This paper focuses on the pragmatic challenges of implementing an active warden as a part of a network firewall. In particular, we concentrate on structured carriers such as the TCP/IP protocol suite rather than on the subjective, F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 18–35, 2003. c Springer-Verlag Berlin Heidelberg 2003


Eliminating Steganography in Internet Traffic with Active Wardens

19

or unstructured carriers, such as images, that dominate the information hiding literature. We call a carrier structured if there is a well-defined, objective semantics defining the overt information content of the carrier. Although wardens have been an area of research in the community since Simmons’s 1983 paper [31], after nearly two decades, active wardens still remain largely theoretical. The first contribution of this paper is the creation of an active warden system that operates on network traffic like a firewall. The context of a high-bandwidth, real-time, unattended firewall constrains the approaches available to warden design. For instance, passive detection systems such as intrusion detection systems are often viewed as a second-tier defense, with preventative firewall systems being the preferred primary defense. Further, the practical capabilities of an active warden differ significantly from those of a theoretical warden. The implementation of active wardens will improve understanding of what wardens can do, as well as enabling validation of watermark and steganographic algorithm robustness. Internet traffic also affects the relative importance of various carriers for covert or subliminal information. While the information hiding community is attentive to the detectability and robustness of information embedded in carriers such as images, audio, and natural language, there has been less effort placed on understanding the ability to use network protocols as carriers. A network warden must address all of the indispensable media types, and clearly protocols themselves cannot be avoided. Thus, our second contribution is the identification and exploration of a class of carriers that differ significantly from common, unstructured carriers exemplified by images, audio, and natural language. Network protocols and computer languages (such as XML, machine code, etc.) are examples of structured carriers that are interpreted by machines rather than humans. In contrast, unstructured carriers are subjectively interpreted by a human. While pseudo-random noise has often been suggested as a way to remove subliminal information from a carrier, random noise can also obliterate the overt function of structured carriers. It is for these same reasons that lossy compression is primarily used only on unstructured carriers. As shown later, a more delicate and directed approach is therefore required. Our third contribution is the concept of Minimal Requisite Fidelity (MRF), which we define as the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. MRF determines the limit of distortion we can introduce to a carrier channel in an attempt to foil any covert or subliminal channels. For the defender, MRF defines an upper-bound in the amount of modifications to the channel. This gives an advantage to the defender, because potentially this can greatly decrease or eliminate the capacity of the covert channel. For unstructured carriers that lack well-defined syntax or semantics, MRF is defined by human perception, but for structured carriers, well-defined semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels. Further, the MRF paradigm, as applied to network packets, includes an emerging area of research into exploit-

20

Gina Fisk et al.

ing and correcting ambiguities that create opportunities for intrusion detection evasion [24, 29]. Our fourth contribution is a specification-based analysis of TCP and IP in order to identify ambiguities that allow network traffic to be used as a carrier for steganographic content. We demonstrate these ambiguities with a software tool that sends covert information in several of these fields. In addition, we implement a network warden that removes these ambiguities without breaking overt communications. We show that TCP and IP are fertile ground for covert and subliminal information, but we also validate that many of these opportunities can be eliminated through the use of a fully-automated, real-time, network warden. Further, the modifications that a warden must make on packets are generally no more intrusive than those made by existing packet scrubbers [21, 10], firewalls, and NAT boxes. This paper is organized as follows: In §2, we discuss the threat model and potential consequences. In §3, we summarize the research to date and related work in the relevant areas of steganography and network intrusions. In §4, we explore the concept of Minimal Requisite Fidelity and in §5 we introduce examples of and embedding techniques for unstructured carriers and structured carriers. In §6, we develop algorithmic techniques for enforcing Minimal Requisite Fidelity in IP and TCP, and also examine applicability to other network security problems. We discuss our implementation and challenges that we discovered during its creation in §7, and lastly, we conclude the paper in §8.

2

Threat Model

Historically, the malicious insider has been one of the greatest threats to organizations [2], but techniques to stop these insiders are often time-consuming and inadequate. In the example of the admitted FBI spy Robert Hanssen, his espionage activities were not detected and stopped for over a decade [11, 27]. Meanwhile, he distributed some of the US government’s most classified information directly into the hands of the KGB. According to his own affidavit, Hanssen’s success was facilitated by various forms of steganography and other undercover techniques to communicate and transfer information. Secure organizations go to great lengths to secure their machines and networks from outside attackers. However, the vast number of insiders are largely trusted in order to maintain productivity. As a result, most insiders are able to gain complete control of several internal computer systems. Inevitably, there is some communication between these systems and external systems that may cooperate in the transfer of covert data. Since the insiders have access to both restricted data and machines which they can use to covertly distribute that data, the problem of detecting and stopping this unwanted behavior is extremely challenging. Even where personnel security is not of great concern, malicious software agents provide equivalent threats. There are many paths for viruses, worms, etc. to enter a network. Once active, these agents have all the electronic capabilities

Eliminating Steganography in Internet Traffic with Active Wardens

21

of a malicious individual. Further, network communications may be the only communications path these agents have. Our model is designed for high-security environments where the network is not a free channel, but is instead frequently monitored or restricted against unauthorized usage. Wardens are not a form of censorship themselves, but merely enforce that all communications are overt. We recognize that our framework may not be appropriate for the Internet as a whole, but only for restricted environments where there is a definite threat that a malicious insider could do permanent damage. In addition to using covert channels in Internet traffic, there are a plethora of other ways that a malicious insider could extract data from a given site, such as copying the data onto a floppy disk and carrying it home. However, our research is limited to network security and not physical security, and as such, we do not address this threat. 2.1

Potential Damage

Each steganographic algorithm has a data to carrier ratio that defines the bandwidth of the carrier. For images, this can be very high (over 50%). Using specific embedding algorithms such as BPCS [19], a 1 MB image could contain up to 500K of hidden data. Perhaps the highest-bandwidth carrier is network traffic itself. Each packet has the potential to carry over 8 bytes of data (See Figure 1). We analyzed traffic at one large site where over 500 million packets left the site each day. Assuming a malicious insider could control timing of packets to get 1 bit of data out per packet, the site could lose over 26 GB annually. If a malicious insider could manipulate 8 bytes in each packet, the site could loose over 4 GB daily. When combined with the potential that each e-mail attachment can have embedded data, the potential loss rates are staggering. Completely eliminating the leakage of information is very difficult. However, we are primarily concerned with relatively high-bandwidth leakage of information. While it is feasible that a malicious insider could transit a very small amount of information per day that would not be stopped by our warden, we feel that this is a problem that is best addressed once the high-bandwidth leakage is curbed. 2.2

Deficiencies of Detection Techniques

We argue that security mechanisms must adopt proactive as well as reactive defenses. As evidenced by the need for both firewalls and intrusion detection, prevention is an equally, if not more important problem than detection. While there are several techniques currently in use that reactively attempt to detect steganography in images, this is understandably an impossible task to complete, as there are many places to hide data, and many ways to hide the data in those places. In this section we discuss some of these detection techniques and their limitations.

22

Gina Fisk et al.

Protocol Covert Channel Bandwidth IP Hide data in padding bits 31 bits/packet IP Use IP id as covert chan- 16 bits/packet nel IP Set false source address 32 bits/packet to bounce messages IP Use of IP timestamp op- 1 bit/packet tion IP Use destination address 8 bits/packet as flag IP Use unnecessary fields varies (ToS, options, DF if a fragment, etc) TCP Hide data in padding bits 31 bits/packet TCP Use initial sequence num- 32 bits/conber as covert channel nection TCP Use urgent pointer field 16 bits/packet when URG bit not set TCP Use reserved bits 6 bits/packet TCP Use data field when varies RST=1 TCP Use source and destina- 32 bits/packet tion ports as data UDP Use checksum use as 1 bit/packet a flag ICMP Use code field when just 8 bits/packet sending a type ICMP Use unused bits as 32 bits/packet a covert channel

Rule State? Zero these bits No Reassemble and random- Yes ize IP id Egress filtering No Require or prohibit usage No Anomaly Detection

Yes

Zero these fields

No

Zero all padding bits Apply offset to sequence numbers Zero urgent pointer when URG bit is not set Zero reserved bits Zero data if RST=1

No No

Anomaly Detection

Yes

Anomaly Detection

Yes

No No No

Zero code field if just No sending a type Zero unused bits No

Fig. 1. Partial rule sets for IP, TCP, UDP, and ICMP

Johnson has done extensive work in identifying signatures for specific steganographic techniques [12, 15]. By closely monitoring the artifacts left from several commercial products, he noticed several distinguishing traits for many commercial products. Since all of the commercial techniques modify the carrier in some way, he was able to document many of these signatures. However, his published observations were limited to commercial steganographic packages, and the majority of malicious insiders would not opt to use such public techniques in their covert transfers. In [8], Fridrich et al. discuss a simple technique to detect hidden information in the least-significant bits of images by observing the number close colors in images. While their technique works relatively well to detect large hidden messages, small embedded messages produce an error rate of up to 40%.

Eliminating Steganography in Internet Traffic with Active Wardens

23

In [28], Provos attempted to find images containing steganography on the Internet. He downloaded 3 million JPEG images from Ebay and Usenet, and performed several tests to attempt to determine if they had embedded data from JP-Hide [16], J-Steg [17], or Outguess [23]. Provos’ detection tool Stegdetect [33] identified over 54,000 images with these detection signatures, but was unable to find the passwords for any of these images. As such, his results were inconclusive. While it is useful to gain intelligence about the activities of attackers, our primary goal is to provide system and information security rather than to collect attack information or spend time finding and defining steganographic signatures. This does not mean that we have abandoned the task of discovering the perpetrators. However, this potentially time-consuming task may be best done off-line after the necessary modifications have been made to prevent the covert channels, but before the original connection state is purged from our warden.

3

Related Work

The terms covert channel and subliminal channel are often used interchangeably, but in this paper we use the following definitions from the literature. Lampson defines a covert channel as a channel that is not intended for information transfer [20, 9]. In [31], Simmons describes a subliminal channel as one where hidden data piggybacks on an innocuous-looking legitimate communication. By definition, steganographic carriers are subliminal channels since the communication appears to be innocent, but really has ulterior information embedded below the threshold of perception. Active wardens have been an area of postulation since Simmons [31] introduced the Prisoners’ Problem in 1983. Simmons presents Alice and Bob as prisoners that collectively wish to plan their escape. However, since they are in separate areas of the prison, all of their communication must pass through the warden, Willy. If Willy sees any attempts at secret communication in their messages, he will stymie their efforts by not allowing them to communicate in the future. Thus, Alice and Bob must use a subliminal channel to communicate their escape plan without alerting Willy. Since Willy knows that Alice and Bob may wish to communicate secretly, he must carefully analyze all correspondence between Alice and Bob, but he must do so without perceptively altering their message or incurring a noticeable time delay. In this context, Simmons defined a subliminal channel as a communications channel whose very existence is undetectable to a warden. Active wardens have been discussed on several occasions [3, 1, 31, 4, 15] to actively block the creation of subliminal channels, but to date, there have been no published implementations of this type of warden. Meanwhile, firewalls are a routinely used form of active warden that is targeted at blocking unauthorized network access. In [3], Anderson discusses both passive wardens, which monitor traffic and report when some unauthorized traffic is detected, and active wardens, who try to remove any information that could possibly be embedded in traffic that

24

Gina Fisk et al.

passes by. In [3], Anderson shows that there are methods “more contrived than practical” where embedded data could survive a pass through an active warden. In [6], Ettinger develops the idea of critical distortion in an active warden scenario between two game players, a data hider and a data attacker. Equilibria for the game is achieved when the communication channel is distorted to a level where covert channels will not survive. Ettinger observed that due to the large number of bits that both the data hider and the data attacker could modify, this problem was extremely complex. While we don’t dispute this fact, our approach fundamentally differs from his in that Ettinger attempted to determine the critical distortion dynamically, without any prior knowledge of the steganographic carrier. Our technique implements static rule sets for a given carrier that are applied to the data as it traverses the network. By restricting the problem in this fashion, we are able to successfully eliminate steganography from certain carriers in Internet traffic. In 1997, Petitcolas published Stirmark [26, 25, 34], which has some of the functionality of a warden, but does not automatically change all network information as it traverses a network. Instead, Stirmark is an application program that will attempt to remove steganography in a given image. If modified, Stirmark could be used as a networked warden for certain types of unstructured carriers. In contrast, our contributions in this paper focus primarily on structured carriers such as TCP/IP. Also in the area of unstructured carriers, Johnson [12] tested several contemporary steganographic systems for robustness. His tests involved embedding information into an image, and then testing its survivability against a myriad of techniques including format translation, bit-density translation, blurring, smoothing, adding and removing noise, edge-sharpening, rotation, and dilation. Johnson noted that tools that rely of bit-wise embedding methods failed all of the tests. Digital watermarking [25, 13] uses many of the same techniques as steganography, but sometimes with an emphasis on robustness more than secrecy. Watermarks are designed to be tolerant of attempts to remove them by altering or transforming the carrier. An active warden would have a more difficult time removing a good watermark, but the detection of that watermark may also be proportionately easier. A network intrusion detection system is a form of passive warden that observes network traffic in search of malicious attacks. However, there have been several studies of ways to subvert intrusion detection systems using techniques known as packet evasion [29, 24] which exploit ambiguities in the semantics of network protocols and differences in perspective between intrusion detection systems and end hosts. Recently, it has been shown that this kind of attack can be defended against through the use of a protocol scrubber [21] or a traffic normalizer [10] which reduces ambiguous traffic to a canonical form that can be more reliably monitored. Similar techniques have been used to limit the amount of information leaked to a system fingerprinting mechanism such as nmap [32].

Eliminating Steganography in Internet Traffic with Active Wardens

25

While some of the mechanisms used to perform scrubbing and normalization are similar to that of an active warden, the problem domains differ.

4

Minimal Requisite Fidelity

Wardens have frequently been discussed as actors in a security system, but in our model, an active warden is a network service that is architecturally similar to a firewall, but functionally quite different. Like a firewall, a warden implements a site’s security policy. To prevent attacks from the outside, inside, or both, the warden modifies all traffic to remove many, if not all, of the carriers that can be used for covert channels, subliminal channels, intrusion detection evasion, and even some forms of attacks. Because this warden is a network service, it must be concerned not only with the application data that it handles, but also with the network protocols used to exchange data. One way to prevent the use of covert channels and subliminal channels across a network is to drastically alter all data that passes across that network and that may be used as a carrier. For example, if it is believed that data is embedded in color detail, all images can be converted to monochrome. However, this level of modification would disrupt users and is not generally acceptable. An alternate technique for preventing the successful use of covert channels is to distort potential carriers just enough that any covert and subliminal channels in those carriers become unusable. If done carefully, the overt users of the carriers remain unaware of these modifications. We describe this modification of traffic as imposing Minimal Requisite Fidelity. This term captures the essence of both the opportunity for data embedding and a warden’s defense. The basic premise is that for any communication there is some fidelity at which the data is interpreted by the recipient. For example, an image displayed in a web browser is intended for human consumption and need not possess any more information than is apparent to a human eye viewing a computer screen. However, the transmitted data may contain more detailed information than is perceptible to the viewer. As described in the following section, minute differences in color, textures, saturation, or other measures can be used to hide a wealth of information. The paradigm of Minimal Requisite Fidelity refers to determining the threshold of fidelity that is required for overt communications with the recipient and then limiting the fidelity of network transmissions so that no additional information is preserved. Since MRF preserves functionality while altering the exact values seen by the receiver, it makes the job of an attacker much more difficult, if not impossible. In this regard, an active warden enforcing MRF is very much like a network proxy. Such a warden acts as a semantic proxy by relaying the semantics of the protocol while insulating each end-point from the specific syntax created by that end-point. To date, there has been no theory behind proxies, but MRF could be used to define one. The ability to perform this fidelity modification varies with the type of carrier being used. In the next section, we break carriers into two broad classes of structured and unstructured carriers and provide examples of how the Min-

26

Gina Fisk et al.

imal Requisite Fidelity paradigm can be applied to them. We will show that the paradigm is equally applicable, but that additional constraints present with structured carriers allow for much stronger guarantees to be made.

5

Carrier Taxonomy

In this section, we will examine techniques for embedding data in some common examples of unstructured carriers and structured carriers. The definition of MRF for the two different types of carriers is quite different. 5.1

Unstructured Carriers

A subliminal channel is based on modifying a carrier in imperceptible ways. For what we call unstructured carriers, the limits to what can be changed are defined by fuzzy notions such as perception. Perception can be quantified and carriers can be subjected to statistical analysis, but there is no universal, objective bound to how much information can be altered for purposes of embedding. Below this level of perception, arbitrary changes can be made to the data in order to embed information. However, an active warden can make use of the exact same freedoms to destroy any embedded information. Examples of techniques to embed data in unstructured carriers are Null Ciphers - hiding data in plain text [18]; Least-Significant Bit Embedding - modifying the least-significant bit of specified pixels that result in color variations that are not distinguishable to the human eye [14]; Bit-Plane Embedding - identifying noisy regions of each bit-plane in an image and replacing those regions with embedded data [19]; and Discrete Cosine Transformation - modifying and converting pixel values into frequency values using the IDCT [13]. Quantifying MRF for Unstructured Carriers: In each of these examples of unstructured carriers, a Minimal Requisite Fidelity can be defined. This would be the minimum amount of purity in an unstructured carrier that is needed to convey the meaning of the carrier. In the example of an image, this MRF would be the set of minimal colors that displays the image as seen by the human eye. In a null cipher, the MRF could be achieved by slightly rewording phrases and adding spaces and tabs to the end of lines so the same meaning is conveyed, but in a slightly different format. However, finding the correct Minimal Requisite Fidelity for unstructured carriers is challenging. Because there are not objective bounds to the carrier, a threshold of requisite fidelity must be chosen subjectively. This threshold can be based upon knowledge of human perception, or the typical use of data. However, there remains the possibility that a determined adversary will risk making perceptible changes for the sake of getting a signal through. For instance, a warden may thwart BPCS by modifying all noisy regions in an image, but the threshold for defining a noisy region is arbitrary. An adversary could embed data in less noisy regions at the expense of making them appear grainy. While a warden might not be able to make all images grainy, grainy images might legitimately occur and be let through. Nonetheless, a warden may be able to

Eliminating Steganography in Internet Traffic with Active Wardens

27

assume that preserving graininess is not a requirement. In this case, smoothing or randomizing of grain could be employed. Clearly, there is a cycle of measure and counter-measure to this game. However, any time a warden can afford to reduce the fidelity of the carrier, the adversary’s job gets harder. While this cycle may be arduous, it at least makes forward progress towards security. 5.2

Structured Carriers

In contrast to unstructured carriers such as plain text, structured carriers are instantiations of some well-defined syntax and semantics. In this section we focus on a significant example of the structured carrier, network protocols. We first present an example of network traffic embedding and then examine how this technique exploits the syntax and semantics of the protocol. This examination leads to a formal expression of Minimal Requisite Fidelity. The ability to make such formal expressions is a unique characteristic of structured protocols and enables wardens to more thoroughly apply the concept of Minimal Requisite Fidelity. Network protocols such as the TCP/IP family of Internet protocols define both a syntax for network packets as well as the semantics used by systems exchanging packets. The syntax is the data format for packets that traverse the network. This syntax is not unlike the image encoding format of some unstructured carriers. What makes structured carriers different is the additional specification of semantics that describe how a packet is interpreted and what actions the end host will make based upon that packet. For example, the Covert TCP [30] program manipulates TCP/IP header information to encode ASCII values in header fields. Covert TCP makes use of the fact that IP uses arbitrarily assigned numbers to identify packets. Each packet has an ID field containing a 16-bit number. This ID has no notion of order and is used purely to let a packet be fragmented while allowing the receiver to identify related fragments and reassemble the larger packet. Every associated fragment will contain the same ID, while fragments of different packets will contain different IDs. Covert TCP chooses IDs that contain data to be sent. As a simplified example, the string “steg” can be embedded in a series of four packets where the first packet has an ID equal to the ASCII value of “s”, the second has an ID equal to “t” and so on. Because the semantics of the ID field are so clearly defined, Covert TCP is able to fully exploit the protocol without the risk that its choice of ID numbers will cause changes that are perceptible to the recipients of the packet. However, an active warden can use the same fact to renumber IDs to thwart such channels. In the following sections, we provide a concrete analysis of the semantics of this example and how MRF can be absolutely applied to this type of carrier. Quantifying MRF for Structured Carriers: Information theory provides a basis for analyzing the fidelity required to support the semantics of structured carriers. While the identifier field is not required to be a random variable, the

28

Gina Fisk et al.

difference between the amount of information contained in the field, 1 of 216 values, and the amount of information provided to the receiver is startling. The receiver need only match a fragment to 1/n packets where n is the number of packets that the receiver may be reassembling at any point in time. For TCP, which accounts for the vast majority of traffic,1 the value of n is bounded by the receiver’s advertised window size and is typically zero since most upperlayer protocols tend to avoid fragmentation for performance reasons. Thus, in the typical case, the amount of entropy present in the identifier is much greater than the amount required by the protocol semantics. This extra entropy can be used by programs such as Covert TCP or more sophisticated steganography in order to create a covert or subliminal channel. However, our definition of the amount of entropy required by the protocol semantics also leads us to search for a bijective transformation that randomizes this extra information while preserving semantics. With such a transformation, a warden can randomly permute the identifiers chosen by untrusted end systems. Assuming that a warden used some permutation function, f (x), an attacker could potentially learn the values of the renumbered packets and attempt to engineer an inverse function so that she may transmit packets with an inverted ID, f −1 (x), that, when transformed by the warden, becomes the intended value, f (f −1 (x)) = x. However, this kind of security feature is the very problem that encryption systems address. Therefore, we can employ an encryption algorithm to perform this permutation. Thus, we can recast the problem of randomizing excess entropy as a solved problem of encrypting the packet field. Covert TCP provides us with an example second problem with slightly different semantics. This example will exercise our reasoning and shows that our method for enforcing Minimal Requisite Fidelity has promise for additional carriers. Covert TCP can also embed data in the TCP initial sequence number, which is another arbitrarily chosen number. However, the semantics of this number are somewhat different in that subsequent packets from the initial sender will contain a sequence number computed by incrementing the initial sequence number. Further, the receiver will acknowledge the receipt of these sequence numbers back to the sender. Thus, the permutation must be applied only to the initial sequence number of a connection. If the warden saves the difference between the original and modified initial sequence number, it can re-apply this offset to all subsequent packets in that connection.

6

MRF Analysis of IP

Having seen that Minimal Requisite Fidelity can be precisely identified and manipulated in structured carriers, we now perform a more complete examination of the protocol headers and semantics in IP. We choose to look at IP because it has well-defined semantics and because without addressing IP, no Internet traffic can be considered completely protected. This case study will validate the 1

In our traces TCP accounts for 93% of the traffic. Figures vary, but this is not an unusual amount.

Eliminating Steganography in Internet Traffic with Active Wardens

29

applicability of the MRF model and demonstrate how a warden can provide some assurances about entire protocol layers. This analysis differs from previous work in [10] and [21] in that we are stopping the covert flow of data rather than attacks by a malicious outsider. The MRF analysis of all IP fields is presented below as a taxonomy of field semantics. For the sake of brevity, we do not discuss the individual IP option fields which are rarely used and in general are quite open to modification by both adversaries and wardens. Constant: (Version, Padding) These fields are effectively constants than cannot be changed without fundamentally changing the functions of the protocol. The version field specifies which version of the protocol is being used. Any value other than 4 (IP version 4) will cause the remainder of the packet to be interpreted with a completely different set of syntax and semantics. For instance, version 6 is the latest version, and while not widely supported, has similar, but slightly different definitions for syntax and semantics. An IPv4 packet cannot be turned into a valid IPv6 packet by simply changing the version number. For the sake of brevity, we assume IPv4 and term this field a constant. However, a more holistic analysis would examine all other versions of IP. Free: (Type of Service, Don’t Fragment Flag, Reserved Bits) These fields can hold arbitrary values while preserving the basic functionality of the protocol. Thus, wardens should modify these variables religiously. Due to nuances of these fields, we suggest that a warden not randomize them, but instead set them to safe defaults for the warden’s network environment. Note that this categorization of the type of service field may change if Differentiated Services [22] becomes widely deployed. However the Diff-Serv architecture assumes that this field will be administered according to local network policy and the warden may be a party to that policy. Decreasing: (Time To Live) The time to live is a counter value that is decremented at each hop. When the time to live reaches zero, the packet is discarded. This causes packets in routing loops to eventually be dropped. The TTL can be changed, but in order to preserve the routing loop behavior, the new TTL should always be lower than the existing TTL. Note that decreasing the TTL will prevent traceroute from working properly since it depends on TTL values being decremented only once per hop. Tokens: (Identification, Source Address) These fields, as described earlier, serve to correlate packets. The values themselves are arbitrarily chosen and can be mapped to different values, but this mapping must be stable across packets. Source address has some additional constraints in that it will be used to form reply and error messages. Thus, it must refer to the originator’s address or the

30

Gina Fisk et al.

address of system willing to proxy these messages to the originator. Network Address Translation is a widely-deployed technology that rewrites source addresses on traffic passing through a gateway [5]. Derivative: (Header Length, Header Checksum) These fields are determined by other aspects of the header. The length is determined by the number of options included in the header, while the header checksum is computed from all other fields in the IP header (excluding payload). If the checksum alone is changed, the packet will be dropped in transit. Fragmentation: (More Fragments Flag, Fragment Offset, Total Length) The maximum amount of data that can be sent is bounded by what the upperlayer protocol provides, but the IP layer has flexibility in how a payload is fragmented and sent. Fragments can be reassembled into a larger packet and then re-fragmented along different boundaries. Dependent: (Destination Address, Protocol, Payload) These fields are determined by upper-layer protocols. In general, every value is legal, but the legality of any specific value is determined by the upper-layer using the protocol. As a result, neither an adversary nor a warden can directly alter these values without altering the behavior of the protocol. However, a warden operating at a higher layer should cause these fields to be changed wherever possible. For instance, an adversary or a warden could segment the upper-layer packets differently in order to embed or remove information in packet sizes. The destination address cannot be changed by a warden. However, it does exhibit a property common to other fields in the dependent category. If an adversary is creating packets that do not contain legitimate data streams, arbitrary values can be chosen for these fields. For instance, a malicious party could generate traffic to incorrect or fictitious destinations knowing that the route to that address will cause the packets to traverse a link where a collaborating receiver can eavesdrop on traffic and observe the message. Additionally, an adversary could target specific machines on a subnet to sent covert messages. Although the IP header is compactly designed, it is worth noting that other protocols have additional fields that are predicated. These fields are always present, but are unused in some circumstances. In situations where the protocol does not use these fields, they are essentially reserved bits. As such, they are exceptional opportunities for embedding and should be modified by wardens. Of the six types of fields that we have defined, the application of Minimal Requisite Fidelity is most complicated for the token category, for which we have already described a solution. We have shown that, at least for the IP layer, MRF can be precisely defined and applied to each header field. Thus an active warden can give a level of assurance that IP headers are not being used for subliminal channels. In addition, this description of semantics sheds light on what kind of semantic detail is necessary to describe a structured carrier.

Eliminating Steganography in Internet Traffic with Active Wardens Protocol IP IP IP IP IP TCP TCP TCP TCP TCP TCP TCP TCP UDP

Field options present ToS reserved bits set ToS precedence bit set ToS delay bit set Don’t fragment no options reserved bits set urgent bit set urgent ptr set MaxSeg option Window option Bubba option Skeeter option all zero checksum

% Usage 0.0006091% 12.2% 0.5254% 11.76% 0.03692% 56.21% 0.007008% 0.0002275% 0.02417% 3.395% 0.6625% 1.666e-06% 1.911e-06% 24.2%

31

Number Packets 38358 768423616 33090880 33090880 2324986 3441988705 429164 13934 1479773 207894081 40570864 102 117 32235386

Fig. 2. Partial field usage statistics from a month-long trace (over six billion packets)

6.1

MRF Validation

The previous examination of IP was based on the protocol specification. However, the specification is not necessarily indicative of real use. For example, a protocol implementation may make use of reserved bits that have not been standardized. To validate our examination and determine which fields can be safely modified, we therefore performed several feasibility studies by analyzing network traffic from several sites. We present this information as a case study, and are not trying to make any observations about traffic composition as a whole on the Internet. The purpose of this study was to determine which fields in IP, TCP, UDP, and ICMP can be safely modified by our wardens without breaking any applications. Our final rule sets for IP, TCP, UDP, and ICMP will be dependent on our observations from these studies. In Figure 2, we list part of the results that we observed during our analysis. In some instances, the results were surprising and showed several discrepancies. Why, for example, is TCP’s urgent bit set in 13934 packets, but the urgent pointer is non-zero in 1479773 packets? Why were TCP’s reserved bits set in 429164 packets? Who could be using the Bubba and Skeeter options2 ? While it is possible that these inconsistencies are due to faulty implementations of TCP or network errors, we must rule out the possibility that legitimate communication channels are using these fields for justifiable purposes before we modify these bits with an active warden. 2

Communications on the Internet History mailing list from Frank Kastenholz explained the original assignment of TCP options 16 and 17 to Stev Knowles of ftp Software, Inc. for Diffie-Hellman Key Exchange.

32

Gina Fisk et al.

In addition to determining legitimate uses of each field, we must also ensure that the correctness of the IP and TCP protocols and associated applications don’t change. For example, changing the TTL without a proxy would break traceroute. Clearing the TCP reserved bits could interfere with Explicit Congestion Notification. For each rule that we define for each bit in the packet header, we will need to verify that a legitimate service will not be broken.

7

Proof-of-Concept Implementation

To demonstrate the techniques that we introduced in this paper, we have developed a proof-of-concept implementation of software that hides data in several TCP/IP fields and a warden that prevents those fields from being exploited. We implemented this warden as a module in the System for Modular Analysis and Continuous Queries [7], an extensible system for analyzing streaming data. To test the warden, we modified the Covert TCP application [30] to embed data using each of the following methods. To date, we enforce the following rules in IP and TCP: 1. If the TCP Reset flag is set, there should be no TCP payload. Recalculate the the IP packet length to make sure that the only payload is the TCP header. 2. The IP identification field can be used as a covert channel (as demonstrated by Covert TCP ). Assign a new IP ID to packets. 3. The TCP Initial Sequence Number (ISN) can be used as a covert channel (as demonstrated by Covert TCP ). Assign a new ISN at the beginning of a connection. Correct subsequent packets accordingly. 4. Reserved bits in TCP can be used as a covert channel. Zero these out. 5. If URG = 0, the urgent pointer is ignored and can be used to send covert data. Zero out the urgent pointer in this instance. 6. Bounds checking on the urgent pointer. The pointer is an offset of data in the payload. If the pointer is larger than the payload size, it is illegal and should be reset to 0 and the urgent flag removed. Though this implementation only exercises a few rules, our experimental results are encouraging, showing minimal delay of the network traffic and the complete elimination of embedded data in these fields. A complete warden implementation for IP, TCP, UDP, and ICMP is in progress, and our preliminary results are very promising. 7.1

Implementation Issues

A key performance limitation with any sort of automated active warden or firewall is the amount of state that must be saved for each packet or connection. The algorithms described in Figure 1 can be efficiently implemented since they require minimal state.

Eliminating Steganography in Internet Traffic with Active Wardens

33

To translate IP IDs, the warden can encrypt the original ID using some key. Because the mapping must be stable across multiple packets during a connection, we assume that a distinct pseudo-random key is used for each connection. Thus, the warden need only store one key for each connection. If the speed of the cipher itself is an issue, we assume that a cryptographic co-processor can be used. As described earlier, the semantics of sequence numbers require that the warden only encrypt the initial sequence number and save the offset between the original and new values. As described above, the handling of subsequent packets requires only basic mathematical operations. It is worth noting that this sort of mapping of sequence numbers is already supported by many Layer 7 switches that splice together separate TCP connections to the client and server.

8

Concluding Remarks

In this paper, we presented and discussed the paradigm of proactively preventing steganography, covert channels, and other forms of network attack. This paradigm uses a notion of Minimal Requisite Fidelity (MRF) to define the level of signal perturbation that is both acceptable to users and destructive to steganography. To develop the idea of MRF, we introduced the concepts of unstructured and structured carriers and gave several examples of how an attacker can exploit the use of anything more than the minimal fidelity that is required for overt communications. For structured carriers, we were able to take the analysis a step further and examine the feasibility of an active warden that rewrites all network packets to remove the opportunity for covert channels and steganography at the IP layer. These initial explorations show a paradigm and a model with great promise. However, much work remains to define Minimal Requisite Fidelities for other carriers, and to integrate this model in with traditional layered security models. Wardens won’t stop every form of attack, but if part of a more comprehensive security model for a site can greatly reduce the bandwidth of these attacks. In addition to the techniques that we presented, there are additional dimensions of fidelity, such as timing, that must also be examined. As we have demonstrated, defining an objective Minimal Requisite Fidelity for unstructured carriers is a difficult problem, but one not without hope. For structured carriers such as network protocols, we believe that much more precise definitions of fidelity can be made and enforced through detailed analysis of protocol semantics. Excitingly, we have found that this paradigm transcends specific categories such as steganography, network intrusions, and covert channels. The development of this paradigm has been a stimulating synthesis of experience in each of these areas, and, as such, we believe that the deployment of active wardens is a necessary addition to site security perimeters. Technologies such as active wardens are a new opportunity to create bi-directional security perimeters that protect against the malicious insider as well as the outside attacker.

34

Gina Fisk et al.

References [1] R. J. Anderson. Stretching the limits of steganography. Springer Lecture Notes in Computer Science, pages 39–48, 1996. Special Issue on Information Hiding. 23 [2] R. J. Anderson. Security Engineering: A Guide to Building Dependable Distributed Systems. John Wiley and Sons, New York, New York, USA, 2001. 20 [3] R. J. Anderson and F. A. P. Petitcolas. On the limits of steganography. IEEE Journal of Selected Areas in Communications, 16(4):474–481, May 1998. Special Issue on copyright and privacy protection. 23, 24 [4] S. Craver. On public-key steganography in the presence of an active warden. In Proceedings of the Second Information Hiding Workshop, April 1998. 23 [5] K. Egevang and P. Francis. RFC 1631: The IP network address translator (NAT), May 1994. 30 [6] M. Ettinger. Steganalysis and game equilibria. In Information Hiding, pages 319–328, 1998. 24 [7] M. Fisk and G. Varghese. Agile and scalable analysis of network events. In Proceedings of the SIGCOMM Internet Measurement Workshop. ACM, November 2002. 32 [8] J. Fridrich, R. Du, and M. Long. Steganalysis of LSB encoding in color images. In Proceedings of the IEEE International Conference on Multimedia and Expo, August 2000. 22 [9] V. D. Gilgor. A guide to understanding covert channel analysis of trusted systems. Technical report, National Computer Security Center, U. S. Department of Defense, 1993. 23 [10] M. Handley, C. Kreibich, and V. Paxson. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In Proceedings of USENIX Security Symposium, 2001. 20, 24, 29 [11] A. Havill. The Spy Who Stayed Out In The Cold: The Secret Life of Double Agent Robert Hanssen. St. Martin’s Press, 2001. 20 [12] N. F. Johnson. Steganalysis of images created using current steganographic software. In Proceedings of the Second Information Hiding Workshop, April 1998. 22, 24 [13] N. F. Johnson, Z. Duric, and S. Jajodia. Information Hiding: Steganography and Watermarking - Attacks and Countermeasures. Kluwer Academic Publishers, 2000. 24, 26 [14] N. F. Johnson and S. Jajodia. Exploring steganography: Seeing the unseen. IEEE Computer, pages 26–34, February 1998. 26 [15] N. F. Johnson and S. Jajodia. Steganalysis: The investigation of hidden information. In Proceedings of the IEEE Information Technology Conference, September 1998. 22, 23 [16] JP Hide and Seek. http://linux01.gwdg.de/~alatham/stego.html. 23 [17] JSteg Shell. http://www.tiac.net/users/korejwa/jsteg.htm. 23 [18] D. Kahn. The Codebreakers - The Story of Secret Writing. Scribner, New York, New York, USA, 1996. 26 [19] E. Kawaguchi and R. O. Eason. Principle and applications of BPCS steganography. In Proceedings of SPIE’s International Symposium on Voice, Video, and Data Communications, November 1998. 21, 26 [20] B. W. Lampson. A note on the confinement problem. Communications of the ACM, 16(10):613–615, 1973. 23

Eliminating Steganography in Internet Traffic with Active Wardens

35

[21] G. R. Malan, D. Watson, and F. Jahanian. Transport and application protocol scrubbing. In Proceedings of IEEE InfoCom, March 2000. 20, 24, 29 [22] K. Nichols, S. Blake, F. Baker, and D. Black. RFC 2474: Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 headers, December 1998. 29 [23] Outguess. http://www.outguess.org/. 23 [24] V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, 31(23-24):2435–2463, December 1999. 20, 24 [25] F. A. P. Petitcolas. Watermarking schemes evaluation. I. E. E. E. Signal Processing, 17:58–64, 2000. 24 [26] F. A. P. Petitcolas, R. J. Anderson, and M. G. Kuhn. Attacks on copyright marking systems. In Proceedings of Information Hiding, Second International Workshop, IH’98, 1998. 24 [27] S. Pluta. United States of America vs. Robert P. Hanssen. http://www.fas.org/irp/ops/ci/hanssen affidavit.html. 20 [28] N. Provos and P. Honeyman. Detecting steganographic content on the internet. In Proceedings of the Network and Distributed Systems Security Symposium (NDSS), 2002. 23 [29] T. H. Ptacek and T. N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection. Technical report, Secure Networks Inc., January 1998. 20, 24 [30] C. H. Rowland. Covert channels in the TCP/IP protocol suite. First Monday, 1996. 27, 32 [31] G. J. Simmons. The prisoners’ problem and the subliminal channel. In D. Chaum, editor, Advances in Cryptography: Proceedings of Crypto-83, pages 51–67. Plenum Press, New York and London, 1984, August 1983. 19, 23 [32] M. Smart, G. R. Malan, and F. Jahanian. Defeating TCP/IP stack fingerprinting. In Proceedings of the 9th USENIX Security Symposium, August 2000. 24 [33] Stegdetect. http://freshmeat.net/projects/stegdtetect/. 23 [34] Stirmark. http://www.cl.cam.ac.uk/~fapp2/software/. 24

From a Trickle to a Flood: Active Attacks on Several Mix Types Andrei Serjantov1, Roger Dingledine2 , and Paul Syverson3 1

University of Cambridge Computer Laboratory [email protected] 2 The Free Haven Project [email protected] 3 Naval Research Laboratory [email protected]

Abstract. The literature contains a variety of different mixes, some of which have been used in deployed anonymity systems. We explore their anonymity and message delay properties, and show how to mount active attacks against them by altering the traffic between the mixes. We show that if certain mixes are used, such attacks cannot destroy the anonymity of a particular message completely. We work out the cost of these attacks in terms of the number of messages the attacker must insert into the network and the time he must spend. We discuss advantages and disadvantages of these mixes and the settings in which their use is appropriate. Finally, we look at dummy traffic and SG mixes as other promising ways of protecting against the attacks, point out potential weaknesses in existing designs, and suggest improvements.

1

Introduction

Many modern anonymity systems are based on mixes. Chaum first introduced the concept in 1981 [2], and since then researchers and developers have described many mix variations, eg. [8, 9, 11]. These have different aims and approaches, yet we still fail to understand the performance and anonymity tradeoffs between them. In fact, some of the mixes used in well-known fielded systems such as Mixmaster [3, 12] are mentioned only briefly or not at all in the literature. We aim to start closing this gap by enumerating and exploring a variety of mix architectures. In particular, we consider the extent to which the mixes are vulnerable to active attacks such as the n − 1 attack. More specifically, an attacker targeting a specific message going into a mix can manipulate the batch of messages entering that mix so the only message unknown to him in the batch is the target message [3, 8]. This manipulation may involve delaying or dropping most or all other incoming messages (a trickle attack), or flooding the batch with attacker messages (a flooding attack). We call these attacks or combinations of them blending attacks.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 36–52, 2003. c Springer-Verlag Berlin Heidelberg 2003


From a Trickle to a Flood: Active Attacks on Several Mix Types

37

We provide a rigorous analysis and comparison of several properties of each mix variant, including anonymity, latency, and resistance to blending attacks. We also give intuition and guidelines about which environments and circumstances are most suitable for each mix variant.

2

Blending Attack Taxonomy

In the past, many anonymity systems have been concerned with protecting their users against passive adversaries, either global or local, usually citing the n−1 or the blending attack as a vulnerability, with (quoting [1]) “no general applicable method to prevent this attack”. In this paper we discuss ways of reducing this vulnerability. Here we consider a global active adversary who is not only able to see the traffic on all the links, but also to delay (remove) and insert arbitrarily many messages into the system in a short (constant) time. These are reasonable assumptions — methods of logging per-packet data on high bandwidth links exist, as does the possibility of building fast hardware to insert or delay messages. We further assume our attacker can send messages from many different source addresses; indeed, infrastructures to ensure sender authentication have proved difficult to build. More importantly, source authentication on links would trivially defeat the very anonymity free-route mix networks are intended to protect. The active attacker’s threat comes from his power to log and manipulate messages on the links. Note that the global active attacker can be viewed as a combination of two separate attackers: one who can only insert messages (global inserting attacker) and one who can only delay messages (global delaying attacker). It is well known that the ability to insert or delay messages may allow the attacker to determine, for instance, the recipient of a particular message originating from a sender. We illustrate this in the case of a single threshold n mix1 . The attack, commonly referred to as the n − 1 attack, proceeds as follows: The attacker observes the target message leaving the sender heading towards the mix and delays it. He now starts sending messages into the mix until it fires. As soon as the mix fires, he stops all other messages from entering the mix and sends in the target message along with n − 1 of his own messages. After the mix fires, he can recognize each of the n − 1 messages when they leave the mix and can therefore determine the destination of the target message. We now consider the properties of this attack before going on to examine how a similar arrangement could work on other mixes. First of all, we note that the attack is exact — that is, it provides the adversary with the ability to determine the receiver of a particular message with 1

The same attack can be used against a mix cascade by mounting it against the first mix, or against a mix network by repeating it
(the number of mixes in the path) times.

38

Andrei Serjantov et al.

certainty 1 (the anonymity of a message passing through the mix is 0)2 . We also note that this attack does not depend on the rest of the mix network; that is, the attacker has enough power to always isolate and trace a particular message. We call such an attack certain. We classify mixes into the following categories of vulnerability to blending attacks. – If no blending attack can reduce the anonymity of any message at all, the mix is strongly resistant to active attacks. – If no blending attack can reduce the anonymity of any message below a constant k, then the mix has blending attack anonymity k. – If the attacker can always reduce the anonymity of a message arbitrarily, but never to 0, the mix is vulnerable to non-exact, uncertain blending attacks. – If the attacker can always reduce the anonymity of a message to 0, but may need to spend an arbitrary amount of resources (time/messages) to do so, the mix is vulnerable to exact, uncertain attacks. – If the attacker is always able to reduce the anonymity of a message to 0 in a finite amount of resources, it is vulnerable to exact certain attacks. Although it may appear that the “vulnerability” of the mixes goes up as we go down the list, this is not necessarily the case – the cost of the attack is important to consider as well. For example, suppose the anonymity of a message going through Mix 1 under active attack is proportional to the inverse of the cube of the number of messages expended in the attack. This mix can be seen as “more vulnerable” than Mix 2 which is always compromised by 106 attacker messages. Note that Mix 1 is vulnerable only to non-exact blending attacks, while the Mix 2 is vulnerable to exact certain attacks. We now proceed to analyze and categorize several mixes. We suggest their blending attack cost functions (both of time and number of messages) where necessary.

3

Simple Mixes

In this section we describe various mixes divided according to their flushing algorithms. In particular we set out for each mix type: mix parameters, what the flushing algorithm is, the delay on messages in normal operations (i.e., when not under attack), the minimum and maximum anonymity provided against a purely passive adversary, analysis of the blending attacks on the mix, and finally a discussion of the adversaries capable of performing blending attacks. This section describes simple mixes, in which all of the messages in the mix are sent each time it fires. The more complex pool mixes are discussed in the next section. In describing the different mix flushing algorithms and working out their properties, we make several assumptions: 2

In this case, we can use either the information theoretic definition of [13] or the usual anonymity set definition.

From a Trickle to a Flood: Active Attacks on Several Mix Types

39

– The mixes take a constant time to fire (send messages out). – The mixes have limited physical memory and so can only contain a finite number of messages. Further, they have finite bandwidth, so can only receive a certain number of messages in a given amount of time. – Mixes prevent message replays.3 – Messages may or may not arrive at a uniform rate. – In calculating the minimum and maximum anonymity we assume the global passive adversary. The vulnerability to the active attacker is described separately. – When we talk about anonymity, we mean sender anonymity. Similar ideas can be applied to receiver anonymity as well. 3.1

Threshold Mix

Parameters: n, threshold. Flushing Algorithm: When the mix collects n messages, it fires (delivers all n). Message Delay: The minimum delay is  (the target message arrives when there are n − 1 messages already in the mix). The maximum delay can be infinite (the target arrives at a mix and no more ever arrive). Assuming a constant rate of arrival of messages r, we can calculate the mean delay: n−1 2r . Anonymity: The anonymity set against a passive adversary has n elements. We assume that all the messages in the batch are from different senders (and go to different receivers). Blending Attack Behaviour: The attack proceeds as outlined in Section 2 and is usually referred to as the n − 1 or the flooding attack. It takes  time as inserting the required messages and the (usually two) firings of the mix take a constant time. The attack takes a minimum of n − 1 (the attacker waits until the mix is empty, forwards the target message to the mix along with n−1 attacker messages to flush it out) and a maximum of 2n − 2 messages (the attacker does not wait for the mix to become empty). 3

Actually, flooding to overflow replay caches is a closely related problem — for example, Mixmaster 2.0 [12] expired old entries in the replay cache when it had too many, providing a window of attack for a flooding adversary. But since [4] shows the feasibility of a free-route network that securely protects against replays until a periodic key rotation event (after which the history can be forgotten), we think our assumption is reasonable; we will ignore replays and related issues for the rest of this paper.

40

Andrei Serjantov et al.

Adversaries: The above attack seemingly requires both the global delaying attacker capabilities and the global inserting attacker capabilities. However, this is not necessarily so. If the global inserting attacker is able to insert n − 1 of his own messages between each of the “good” messages going into a mix, he effectively mounts an n − 1 attack on each of them. Another possible attack scenario is when an attacker owns a mix in a free route mix network. He has the capability to delay all the messages going through this mix until the conditions are “just right”, i.e. the next mix contains n − 1 of the attacker’s messages and will fire as soon as the target message reaches it. Thus, he has the capability to attack the next mix in the route of each of the messages going through the mix he controls. (As a result, if the attacker owns all the mixes but one, he is able to compromise anonymity of any message.) 3.2

Timed Mix

Parameters: t, period. Flushing Algorithm: The mix fires (flushes all messages) every t seconds. Message Delay: The minimum delay is , which occurs if the message arrives just before the mix is due to fire. The maximum delay is t − , which is the case when the message arrives just after. The mean delay is 2t . Anonymity: The minimum anonymity set is 0 — no messages arrive during the entire time period. The maximum anonymity set is theoretically infinite, but in practice is limited by the capacity of the mix. The mean anonymity set (assuming a rate of arrival of r msgs/s) is rt. Note that the threshold and timed mixes are in some sense dual. If the goal of the anonymity system is to guarantee anonymity at the expense of fast message delivery, threshold mixes are good. (This is the scenario of a spy in a hostile country — if the anonymity is compromised, the spy is caught.) On the other hand, if timeliness of message delivery is crucial and anonymity is a bonus, the timed mix is ideal. Notice that if the messages are assumed to arrive at a constant rate, the properties of these mixes are exactly equivalent. Blending Attack Behaviour: The attack is exact and certain and proceeds as follows: The adversary delays the target message for a maximum of time t until the mix fires. He then delivers the target message and blocks all other incoming messages. After another t seconds the mix fires again producing the target message on its own. This takes a maximum of 2t −  and a minimum of  seconds (when the mix was empty and about to be fire), and 0 messages. The attack is usually referred to as the trickle attack. Adversaries: This attack does not require any insertion of messages, so the global delaying attacker is sufficient. We also note that this “attack” can happen naturally in low traffic conditions, so a dishonest mix may be able to attack the next hop of a message simply by holding it until the next hop is empty and about to fire.

From a Trickle to a Flood: Active Attacks on Several Mix Types

3.3

41

Threshold or Timed Mix

Parameters: n, threshold; t, period. Flushing Algorithm: The mix fires (flushes all messages) every t seconds or when n messages accumulate in the mix. Message Delay: The maximum message delay is t − , the minimum is . Anonymity: The minimum anonymity set is 0 – no messages arrive during the entire time period. The maximum anonymity is n. Blending Attack Behaviour: This design gives the worst case of threshold and timed mixes (and thus still exact and certain). The adversary can choose to perform a trickle attack, a flood attack, or a mixture of the two depending on whether he prefers to wait or send messages. It can be performed in a minimum of 0 messages in somewhere between 0 and 2t −  seconds or with a maximum of 2(n − 1) messages, in  seconds. Adversaries: This attack can be performed by either the global inserting or the global delaying attacker. 3.4

Threshold and Timed Mix

Parameters: n, threshold; t, period. Flushing Algorithm: A mix fires (flushes all messages) every t seconds but only when at least n messages have accumulated in the mix. Message Delay: The minimum delay is , and there is no maximum delay. Anonymity: The minimum anonymity of this mix is n. The maximum anonymity is in theory infinite, but is limited in practice by the number of messages the mix can hold. Blending Attack Behaviour: The n−1 attack is still exact and uses a combination of the attacks on the threshold and the timed mixes. It takes a maximum of 2t− and a minimum of  seconds; and a maximum of 2(n − 1) and a minimum of n − 1 messages. Adversaries: It is clear that to mount an attack on this mix, the attacker has to have the capability both to delay and to insert messages.

4

Pool Mixes

Not only are all the attacks described in the previous section exact and certain, but they are also low-cost. We now examine pool mixes, which give the adversary only an uncertain attack and substantially increase the cost.

42

4.1

Andrei Serjantov et al.

Threshold Pool Mix

Parameters: n, threshold; f , pool. Flushing Algorithm: The mix fires when n + f messages accumulate in the mix. A pool of f messages, chosen uniformly at random from all the messages, is retained in the mix. (Consider these messages as feedback into the mix.) The other n are forwarded on. Note that the threshold is the threshold of messages that must be received to fire again during ongoing operation. For pool mixes this is distinct from the ‘threshold’ of messages to fire when the mix is completely empty, e.g., n + f for the current mix type. Message Delay: The minimum delay is , the maximum delay is infinite — until n new messages arrive, the mix does not fire. Note, however, that even if there is a constant flow of messages and the mix is firing periodically, there is still a small but non-zero probability of the message remaining in the mix for an arbitrarily f rounds. If the messages arrive at a rate long time. The mean delay is 1 + n+f of r per second, then the average delay is (1 +

f n n+f ) r

seconds.

Anonymity: Here we have to resort to the information theoretic definition of anonymity described in [13] rather than the standard set-based definition, since the probabilities of the senders (receivers) sending (receiving) the message are unequal. Note also that the anonymity of the message going through a mix depends on the entire history of events that have happened in this mix. Thus, we achieve the maximum anonymity Amax when all of the messages that have ever passed through the mix come from different senders. Serjantov and Danezis carried out this analysis in [13].
 f f Amax = − 1 − log (n + f ) + log f n n The concept of minimum anonymity in pool mixes is slightly more elusive. In the threshold mix case we assumed that all the messages in the batch come from different senders. So, regardless of previous senders, the minimum anonymity of a threshold pool mix is at least n, and therefore no worse than that of a corresponding threshold mix. We could assume that all the other messages may have come from the same sender and thus provide no anonymity, but this would be overly pessimistic — the entire history of the mix is unlikely to consist of messages from just one sender. Thus the minimum anonymity of a threshold n pool mix is likely higher than that of a simple threshold n mix. Blending Attack Behaviour: In general, the blending attack has two phases: flushing the mix so that no good messages remain inside it, then forwarding in the target message and flushing it out onto the network. With simple mixes, one flush was sufficient for each phase. With pool mixes, this is no longer the case. Furthermore, there is now a small but non-zero probability that a given

From a Trickle to a Flood: Active Attacks on Several Mix Types

43

message (e.g. the target message) remains in the mix for an arbitrary length of time. Intuitively, the attack ceases to be certain. It proceeds as follows: The attacker delays the target message, fills up the pool mix and flushes it. If j of the attacker messages don’t come out, he knows that f − j good messages remain inside the pool mix. He now delays all the other incoming good messages and tries to flush the remaining good messages out of the mix (he can distinguish them as they come out). Of course, this takes more messages than to flush out a threshold mix (see below for details), but the attack is still exact (if/when the attacker succeeds in getting all the messages to leave the mix, he knows it). When all good messages have been flushed, he just sends in the target message, and flushes the mix as before until the target message comes out. Because the attacker is not guaranteed to flush out the mix completely or to flush out the target message, the attack is uncertain. Analysis: Flushing out the mix: after r rounds, the probability that a particular message that was in the mix at round 0 is still in the mix by round r is: r
f n+f If there were N good messages in the mix initially, the expected number left after r flushes is N times the above. Alternately, we might consider the chance that all N good messages have left the mix by round r: r N

f 1− n+f The number of good messages in the mix at the beginning of the attack can vary between f and n + f − 1. Example 1 Consider a pool mix with a threshold of 100 and a pool of 60 messages. The average delay of a message through this mix is 1.6 rounds. Assuming the attacker targets a mix with 60 messages, the expected number of good messages remaining in the mix falls below 1 after 5 rounds or 500 attacker messages. Similarly, the chance that all 60 messages have left the pool goes above 50% after 5 rounds, and reaches 99% after 9 rounds. Thus, the use of a pool mix in an anonymity system not only makes the n − 1 attack uncertain, but also more expensive in terms of attacker messages at the cost of increasing the average delay of a message passing through the mix. 4.2 Timed Pool Mix Parameters: t, period; f , pool; (0, threshold). Flushing Algorithm: The mix fires every t seconds. A pool of f messages chosen uniformly at random is retained in the mix. The others are forwarded on. If f or fewer messages are in the mix, it does not fire. (Thus, strictly speaking, this is a threshold and timed pool mix, for which the threshold is 0.)

44

Andrei Serjantov et al.

Message Delay: The minimum message delay is , and there is no maximum delay (if no messages arrive, the messages that are in the pool will never leave the mix). Like in the case of the threshold pool mix, there is again a small but non-zero probability that any given message could remain in the mix for an arbitrarily long time even if there are messages flowing through the mix. Anonymity: The timed nature of this mix allows an arbitrarily large number (only limited by the memory and bandwidth capacity of the mix) of messages to be mixed together. If we assume a constant rate r of message arrival, the anonymity provided by this mix can be calculated in just the same way as for the threshold case; but we leave this calculation for future work. Alternatively, the anonymity of a message going through this mix can be calculated from the history of the mix — a record of the operation of the mix ever since it was started. Like in the threshold case, a mix’s history includes the senders of each message and also the number of messages that got mixed together in each batch (and, potentially, a whole host of other features). Of course, in practice, a record of only the last few rounds gives a good approximation. The minimum anonymity of a timed pool f mix is clearly smaller than that of a threshold pool f mix (unless the threshold is 1). If the pool is small relative to the batch size, then the bulk of the anonymity comes from mixing the target message with the batch of incoming messages, not from mixing it with the messages in the pool. Because the timed mix does not always have this batch of messages for mixing the target message, its minimum anonymity should be considered to be very much worse than that of the threshold pool mix unless a large pool is maintained. Assuming reasonable parameters, [13] shows that the anonymity contribution of pool messages is quantifiably greater than that of messages in a new batch. That is, increasing the pool size has a larger effect on anonymity than increasing the batch size. Of course, increasing the pool size also increases the message delay — thus weakening one of the potential advantages of having a timed mix. Blending Attack Behaviour: Two flavours of blending attack are possible on this mix. The adversary has no control over when the mix fires, but he can choose to add many or just a few messages to each batch. (He prevents all other messages from reaching the mix). By adding as many messages as possible in one round, he maximizes the probability that after one flush only the attacker messages will be left in the pool. He knows that he has succeeded if f of his messages do not come out with the flush. This approach is very inefficient in terms of the number of messages added by the attacker (b) since the probability of flushing the mix by this method f2 (supposing there were f good messages in the mix initially).4 However, is b+f this aims to flush the good messages out of the mix in one round, and therefore 4

As previously mentioned, in practice there is an upper limit on b due to the finite memory capacity and/or bandwidth of the mix.

From a Trickle to a Flood: Active Attacks on Several Mix Types

45

a maximum of t seconds. Thus the entire attack can be executed in less than 2t seconds with an arbitrarily high probability of success. Alternatively, the attacker can add just one message to each round for many rounds. This is very efficient in the number of messages b (indeed, this attack is much more efficient than the one on the threshold pool mix in terms of messages, b  f , but clearly not in terms of time). The probability of flushing the mix is f f +1 but this approach delays all the messages to the mix by tb seconds, which is highly observable to the users of the anonymity system. The attacker can choose either or a combination of these approaches, based on whether he can send out many messages or delay messages to a mix for a long time. 4.3

Timed Dynamic-Pool Mix (Cottrell Mix)

Parameters: t, period; fmin minimum pool; frac, fraction of messages to be sent; (n, threshold) Flushing Algorithm: The mix fires every t seconds, provided there are n + fmin messages in the mix; however, instead of sending n messages (as in a timedand-threshold constant-pool mix), the mix sends the greater of 1 and m ∗ frac messages, and retains the rest in the pool, where m + fmin is the number of messages in the mix (m ≥ n). If n = 1, this is the mix that has been used in the Mixmaster remailer system for years. We use the term ‘Cottrell mix’ for n = 1 and ‘timed dynamic-pool mix’ for the more general case when n might be greater than one. We have called constant-pool mixes simply ‘pool mix’ up to now for consistency with the previous literature. Hereafter, ‘pool mix’ will refer to either constant or dynamic pool mixes. When messages arrive at a constant rate of 1 per period, Cottrell mixes are equivalent to both timed pool mixes and threshold-1 constant-pool mixes. Specifically, if the rate r of message arrival is 1/t, the mix will forward 1 message in every period and retain fmin in the pool. For a general Cottrell mix, if the messages arrive at a constant rate of n ∗ frac/t and n ∗ frac = n ∗ frac, then this is equivalent to a constant-pool mix with threshold of fmin + n(1 − frac). Message Delay: Like the other pool mixes, the minimum delay is , and there is no upper limit on the delay. The mean delay depends on the future rate of arrival of messages into the mix; it is at least as high as that of a timed constant-pool mix and typically higher. Anonymity: The dynamic-pool mix has identical minimum and maximum anonymity properties compared to a timed constant-pool mix. We could similarly use a log of the mix’s activity to calculate the anonymity of a message passing through it (although the calculation would be slightly different). Also, we note that the anonymity provided by the mix would be higher than that provided

46

Andrei Serjantov et al.

by either a timed or threshold constant-pool mix: As the number of messages in the mix goes up, frac keeps the chance of the message remaining in the mix constant, whereas it decreases in the case of the timed constant-pool mix. While the chance of a message remaining in a threshold constant-pool mix is also constant for each flush, increased message rate means more frequent flushing, thus reducing the chance of a message remaining in the constant-pool threshold mix per unit time. Blending Attack Behaviour: The introduction of the dynamic parameter frac has several new consequences compared to the timed constant-pool mix. Firstly, the maximum probability of flushing the mix of good messages in one flush is frac. Therefore there is no possibility of flushing the mix with high probability in one flush: the first of the two blending attacks on timed constantpool mixes is blocked. As already noted, it is similarly more resistant to flooding than a constant-pool threshold mix. Secondly, the attacker has to find out how many messages are in the mix. Of course, the number of good messages in the mix is easy to calculate from the number of messages that come out. Finally, the number of messages inside the pool mix may be arbitrarily high and cannot be reduced to below fmin in one round. Therefore, if we wish to send a message that is harder to track, we should send it at a time of higher traffic — thereby increasing the cost (in terms of messages or time) of attempted attacks on it.5 Thus timed dynamic-pool mixes require the attacker to delay all the traffic to the mix for a substantial number of rounds, and therefore for a substantial time. 6 Example 2 A Cottrell mix with a pool of 60 messages and fraction of 10 requires 5 rounds for the expected number of good messages remaining in the mix to fall below 1. If the period is 5 minutes, the overall flushing time is 25 mins. 500 messages will be used in the first part of the attack.

This example shows that the protection this mix provides against blending attacks is still weak. Indeed, the probability of a successful attack is proportional 1 to f rac k where k is the number of rounds. Ideally we would like a mix for which the anonymity does not go to 0 even as the cost of the attack goes up. We would also be happier with a mix where the probability of a successful 1 where P is a polynomial of a small degree. attack is proportional to P (k) We note that the minimum anonymity of the Cottrell mix is still very much worse than that of the threshold constant-pool mix (where the threshold size is much larger than the pool size). Therefore, we propose a larger threshold for the timed dynamic-pool mix, to improve its minimum anonymity properties. We believe this modification will not have adverse effects on the blending attack properties, although will slightly decrease the efficiency of this mix. 5

Unfortunately, an attacker capable of arbitrary message insertions, as we have been assuming, will make it hard to determine times of higher legitimate traffic.

From a Trickle to a Flood: Active Attacks on Several Mix Types

5 5.1

47

More on Resisting Blending Attacks Resisting Exact Attacks

All of the mixes presented above are vulnerable to exact attacks. In other words, the attacker is always able to find out if his attack is successful, and possibly expend more resources to try again if not. However, we could do better. If we make it hard to determine the number of good messages in the mix, it will be harder for the attacker to flush the mix as he will not know how many messages he needs to get rid of. This is easily possible by choosing the number of messages to flush from a binomial probability distribution (flipping a biased coin once for each message to decide whether it is to be flushed or not). The weight of the coin is chosen by an appropriate function of the number of messages in the mix. Thus, it would take the attacker several rounds to establish with any confidence the number of good messages in the mix initially, and he can never be exactly sure of that figure (unless he has the whole history). While introducing randomness appears to be a promising direction, note that it would not increase the cost of the attack significantly (if at all). Thus, we shall not pursue it further. 5.2

Resisting Blending vs. Verification

The tools that we give honest mixes to protect against these blending attacks are precisely the tools that dishonest mixes use to launch them. Uncertainty comes from not letting observers know when a given message might leave the mix; inexactness comes from not letting observers know how many messages are currently inside the mix. This flexibility allows a mix to prevent the adversary from learning the details of message flow, but at the same time it allows a compromised mix to manipulate message flow, for example by delaying a message until it’s ready to launch a trickle attack on the downstream hop. Many basic mix verification schemes, such as that proposed in [2] where senders observe the batches exiting a mix to confirm it processed their messages, require schemes where the messages come out with the next mix flush. More complex robustness schemes [9] enforce timely message processing if the adversary does not own a threshold of participating mixes. The receipt and witness scheme of [5] works because a mix loses reputation if it hasn’t obtained a receipt from the next hop within the allowed timeframe. All of these systems are designed to ensure that messages will leave each mix predictably. Yet more verification schemes that work in a system with pool mixes are described in [7, 10]. There the authors propose a commitment scheme which ensures that the mix commits to a decision before he receives the target message, and his actions are verifiable by the sender of the target message. In some topologies, such as free route mix networks, a widespread delaying attack is difficult to perform because the adversary must control all mixes that

48

Andrei Serjantov et al.

are sending messages to the target mix. In this case we may gain more by allowing mixes to protect against blending attacks than we lose by permitting compromised nodes to manipulate messages. At the other extreme, in a cascade topology, a single compromised mix has absolute control over the downstream message batch. In this case verification of correct processing is critical, to prevent wholescale (unobservable!) anonymity compromise. Methods to detect an attack afterwards, e.g. by checking for successful delivery of test messages at the end of the cascade [6], can help detect misbehaving mixes — but this technique only works for cascade topologies, and it assumes that the cascade head cannot distinguish test messages. As we design new protocols and batching approaches, we must consider this tradeoff between protection from blending attacks and verifiability. 5.3

Cover Traffic

Cover traffic is another promising protection against blending attacks. Consider a simple cover traffic policy, suggested originally by Lance Cottrell: at each flush one dummy is put out onto the network. The dummy message generated by the mix looks like a normal message. Assume that like the current Mixmaster dummy generation algorithm, it has by default a constant length of 4 hops, and it ends at a mix rather than at a receiver.6 This dummy policy still allows an attacker to flush the mix free of good messages and be certain about it. However, once the target message is inserted into the mix, at every round at least one message unknown to the attacker comes out. Naturally, when two messages come out, the attacker knows that the target message was one of those, but he does not know which one. If the attacker finishes here, he has reduced the anonymity of the message to 1 (that is, two possible receivers). However, he can do better. Assuming a free-route mix network, he can keep tracking both messages (and all the messages that result when these pass through more mixes) until he can detect that one message has gone to a recipient. That is the target message since all the dummy messages end in a mix. This attack is exact, but much more expensive than anything we have described previously. We can make the adversary’s job harder by making the mix choose its route length for the dummies from a uniform distribution rather than always choosing 4 by default. We can get further protection by allowing mixes to send cover traffic to the users. However, providing complete protection with this approach is very hard. Each mix must know all the users in the system: if a mix only delivers dummies to a subset of the users, an adversary can distinguish with better than even probability between a dummy and a legitimate message. Note that constant rate dummy policies do not affect the blending attack properties provided by the mixes themselves. Constant dummies simply magnify 6

The current Mixmaster dummy policy suffers also from the fact that there is no policy — a user or operator must manually decide to send each dummy. Some people have automated the process with periodic cron scripts, but we strongly recommend a coordinated network-wide policy that all users and mixes follow.

From a Trickle to a Flood: Active Attacks on Several Mix Types

49

the scale of the attack without changing the properties. For example, even with the above cover traffic policy (a dummy added at each flush), a threshold mix network can be attacked in  time (but a very large number of messages). We can provide stronger protection by adding a variable number of dummies to each batch — say, by choosing from a geometric distribution (flip a weighted coin: if it comes up heads, add a dummy and flip again). Some Mixmaster remailers have begun adopting a similar approach. We leave its analysis to future work. 5.4

Making Messages Unrecognizable

Link encryption offers some limited protection against traffic analysis. Encrypted links between honest nodes prevent an adversary from recognizing even his own messages, thus making it harder to flood mixes and watch where outgoing messages go. However, since the adversary performing the flooding attack can choose the next destination of each message, he may still be able to recognize his messages. At the extreme, he can direct all his chaff messages at the same next mix, so any other message will still stand out. A good link padding scheme may be able to further frustrate him, but much more research remains. Babel [8] introduces inter-mix detours, a scheme where mix nodes can choose to rewrap a message and send it through a few randomly chosen new hops — so even the sender cannot be sure of recognizing his message as it leaves the mix. This approach could help complicate blending attacks, but also introduces reliability risks; we leave its analysis for future work.

6

Limitations of Stop-and-Go Mixes

While active attacks have been widely cited in the literature and methods of protection against them have been suggested informally, most of these have not been rigorously analysed or evaluated [3, 8, 10, 11]. We now concentrate our attention on one particular proposal — Stop-and-Go Mixes [11]. The authors outline several techniques that could be used to protect mix systems against active attacks like the ones considered in this work. The first is a scheme for an anonymity system based on a mix cascade that requires authentication. This is based on a stronger assumption — that the attacker cannot mount a distributed n − 1 attack where the hostile messages come from different users. Unfortunately, it seems very hard to reuse this idea in free route networks, since there is no centralized input location at which we can do authentication; compromised mixes could claim to have done authentication on traffic they instead generate themselves. The second scheme, Stop-and-Go mixes (SG mixes), involves the sender estimating a time window during which the message is allowed to arrive at each of the mixes making up the route of the message. If the message arrives during that time period it will be forwarded on; otherwise it will be discarded. Therefore the attacker’s ability to delay messages is much more limited, so active attacks are harder.

50

Andrei Serjantov et al.

Average Delay Threshold Timed Simple

Constant Pool Dynamic Pool

n−1 2r t 2

Anonymity Min.

Max

n

n

0

mix capacity

Thresh. or Time

0

n

Thresh. & Time

n

mix capacity

Threshold

(1 +

f n+f



) nr ≥ n − 1 −

f n



log (n + f ) +

f n

≥1

< total # of senders

Cottrell

≥1

< total # of senders

Thresh. & Time

≥n

< total # of senders

Timed

log f

The attack is uncertain, and the authors argue that the probability of executing the attack successfully is very low. However, the scheme relies on the users being able to accurately calculate a security parameter that depends on their estimate of the rate of arrival of messages to the mixes that the target message will go through at the time it will travel through them. In other words, the users need to be able to predict the traffic levels in the system in the future to remain anonymous. This is likely to be exploited by the attacker (the exact details depend, of course, on how the security parameter is calculated). Furthermore, an active attacker is able to arbitrarily affect the levels of traffic in the mixes which the target message goes through. It is conceivable that combining SG mixes with reputation systems as in [5] or [6] might help. Thus, we defer the evaluation of SG mixes to future work as the precise details of parts of the protocol crucial to the security of the system have not yet been worked out.

7

Conclusion

We present a set of mixes and examine their anonymity, message delay and blending attack properties. In particular, we suggest that it is useful to partition the mixes into certain categories of vulnerability but emphasize that the cost and worst case attack scenario are important qualities to consider. Simple timed mixes seem best for anonymity infrastructures that require low latency. On the other hand, if we do not need guaranteed low latency, adding a pool to the mix can significantly improve anonymity. Allowing the pool to process a fraction of waiting messages (above a certain threshold) each round further improves robustness against flooding attacks designed to flush out a target message. Although we show the mixes to be rather vulnerable to active attacks, some avenues still have hope. The first of these is verification schemes. We also touch

From a Trickle to a Flood: Active Attacks on Several Mix Types

51

on cover traffic, a more widely used solution. We assess the cover traffic policy used in Mixmaster, point out weaknesses, and discuss some approaches to strengthening its dummy policy. The paper can also be treated as a tutorial on the different styles of mixes and as a recommendation to the Mixmaster implementors to alter the cover traffic policy and introduce thresholds into the mixes.

Acknowledgements We gratefully acknowledge support of ONR, DARPA, EPSRC grant GRN14872 Wide area Programming and EC grant PEPITO. We would also like to thank Andreas Pfitzmann for providing related work, and Adam Back, George Danezis, Nick Mathewson, Ira Moskowitz, Peter Palfrader, Len Sassaman, Adam Shostack, and the anonymous referees for comments on our paper.

References [1] Oliver Berthold, Andreas Pfitzmann, and Ronny Standtke. The disadvantages of free MIX routes and how to overcome them. In Designing Privacy Enhancing Technologies: Proceedings of the International Workshop on the Design Issues in Anonymity and Observability, pages 10–29, July 2000. 37 [2] David Chaum. Untraceable electronic mail, return addresses and digital pseudonyms. Communications of the ACM, 24(2):84–88, 1981. 36, 47 [3] L. Cottrell. Mixmaster and remailer attacks, 1994. http://www.obscura.com/~loki/remailer/remailer-essay.html. 36, 49 [4] George Danezis, Roger Dingledine, David Hopwood, and Nick Mathewson. Mixminion: Design of a Type III Anonymous Remailer Protocol. Manuscript, 2002. http://mixminion.net/. 39 [5] Roger Dingledine, Michael J. Freedman, David Hopwood, and David Molnar. A Reputation System to Increase MIX-net Reliability. In Ira Moskowitz, editor, Information Hiding, 4th International Workshop (IH 2001), pages 126–141. Springer-Verlag, LNCS 2137, 2001. http://www.freehaven.net/papers.html. 47, 50 [6] Roger Dingledine and Paul Syverson. Reliable MIX Cascade Networks through Reputation. In Matt Blaze, editor, Financial Cryptography (FC ’02). Springer Verlag, LNCS (forthcoming), 2002. http://www.freehaven.net/papers.html. 48, 50 [7] Elke Franz, Andreas Graubner, Anja Jerichow, and Andreas Pfitzmann. Comparison of Commitment Schemes Used in Mix-Mediated Anonymous Communication for Preventing Pool-Mode Attacks. In C. Boyd and E. Dawson, editors, 3rd Australasian Conference on Information Security and Privacy (ACISP’98, number 1438 in LNCS. Springer-Verlag, 1998. 47 [8] C. G¨ ulc¨ u and G. Tsudik. Mixing Email with Babel . In Internet Society Symposium on Network and Distributed Sytem Security (NDSS’96), pages 2–16, San Diego, CA, Feb 1996. 36, 49 [9] Markus Jakobsson. Flash Mixing. In Principles of Distributed Computing - PODC ’99. ACM, 1999. http://citeseer.nj.nec.com/jakobsson99flash.html. 36, 47

52

Andrei Serjantov et al.

[10] Anja Jerichow. Generalisation and Security Improvement of Mix-mediated Anonymous Communication. PhD thesis, Technischen Universitat Dresden, 2000. 47, 49 [11] D. Kesdogan, J. Egner, and R. Buschkes. Stop-and-go-MIXes providing probabilistic anonymity in an open system. In Proceedings of the International Information Hiding Workshop, April 1998. 36, 49 [12] Ulf M¨ oller and Lance Cottrell. Mixmaster Protocol — Version 2. Unfinished draft, January 2000. http://www.eskimo.com/~rowdenw/crypt/Mix/ draft-moeller-mixmaster2-protocol-00.txt. 36, 39 [13] Andrei Serjantov and George Danezis. Towards an information theoretic metric for anonymity. In Paul Syverson and Roger Dingledine, editors, Privacy Enhancing Technologies, LNCS, San Francisco, CA, April 2002. http://petworkshop.org/2002/program.html. 38, 42, 44

Limits of Anonymity in Open Environments Dogan Kedogan1 , Dakshi Agrawal2, and Stefan Penz1 1

Aachen University of Technology, Computer Science Department Informatik IV Ahornstr. 55, D-52074 Aachen, Germany {kesdogan,penz}@i4.informatik.rwth-aachen.de 2 IBM T. J. Watson Research Center 19 Skyline Drive, Hawthorne, NY 10532, USA [email protected]

Abstract. A user is only anonymous within a set of other users. Hence, the core functionality of an anonymity providing technique is to establish an anonymity set. In open environments, such as the Internet, the established anonymity sets in the whole are observable and change with every anonymous communication. We use this fact of changing anonymity sets and present a model where we can determine the protection limit of an anonymity technique, i.e. the number of observations required for an attacker to “break” uniquely a given anonymity technique. In this paper, we use the popular MIX method to demonstrate our attack. The MIX method forms the basis of most of the today’s deployments of anonymity services (e.g. Freedom, Onion Routing, Webmix). We note that our approach is general and can be applied equally well to other anonymity providing techniques.

1

Introduction

Anonymity and unobservability techniques to prevent network traffic analysis are not new. The basic techniques in this area date back to the 1970’s and 1980’s when David Chaum and others suggested several revolutionary techniques including broadcast and implicit addresses, MIXes and DC-Networks [1, 2, 3, 4, 5]. The goal of these techniques is to preserve the privacy of users by hiding the traffic information—who has communicated with whom, for how long and from which location. Pfitzmann and Waidner presented the basic techniques in their seminal paper [5]. Since then various enhancements and extensions in theory and practice have been proposed. It can be shown that their technique forms the basis of the most known works1 and that they can provide perfect2 protection if applied in closed environments, e.g. the number of users is known and is not too large (say less than 1000). 1

2

In more recent times, a new technique providing perfect protection was discovered independently by two different groups [6, 7]. This technique, known as Private Information Retrieval (PIR), has similarities to the DC-Networks. MIX technique uses public key encryption, thus the technique provides perfect anonymity, iff encryption is not considered as a limiting factor [2, 8].

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 53–69, 2003. c Springer-Verlag Berlin Heidelberg 2003


54

Dogan Kedogan et al.

Among these techniques, the MIX concept can be considered as the most popular and deployment friendly. As a result, it has been proposed for various networks like GSM, ISDN and the Internet [9, 10, 11, 12, 13, 14, etc.]. Since these networks cannot be considered as closed environments, a natural question arises: what happens to the protection level of anonymity providing techniques when the application environment changes from closed to open? In this paper, we address this question.

2

Basic Notions: Open Environments, Anonymity and Anonymity Set

The challenge for anonymity-providing techniques in an open environment is to accomplish their basic goal even if: a) The underlying communication network is global and is not subject to any topology restrictions. And as a consequence of this, we assume: • The set of users of an anonymity technique is an undetermined subset of all subjects worldwide. • There are no general time agreements between these subjects, thus the participants of the anonymity technique vary from time to time. b) The attacker3 E is able to tap all transmission lines of the communication network and controls all but one intermediary switching node. The attacker E is not able to break the cryptographic techniques chosen in the communication network. The question now is how to hide the existence of any communication relationship, i.e. that a message was sent (sender anonymity) or received (receiver anonymity) by a user. Although the content of a message can be effectively protected by cryptographic techniques, the use of cryptography alone cannot guarantee anonymity. The omnipresent attacker E can observe the sender of a message and follow the message up to the receiver, thereby detecting the communication relation without any need to read the content of the transmitted message. Hence, the decisive goal of an anonymity technique is to organize additional traffic in order to confuse the adversary and conceal communication relationships. To achieve this goal, the sender and/or receiver of a message must be embedded in a so-called anonymity set [15]. Definition 1 Given an attacker model E and a finite set of all users Ψ . Let R be a role for the user (sender or recipient) with respect to a message M . If, for an attacker according to model E, the a-posteriori probability p that a user u ∈ Ψ has the role R with respect to M is non-zero (p > 0), then u is an element of the anonymity set A ⊆ Ψ . A technique (method) provides an anonymity set of size n if the cardinality of A is n (n ∈ N). 3

Note that the same attacker model in open environments leads to a stronger attacker than in closed environments.

Limits of Anonymity in Open Environments

55

Thus, the sender or the receiver is anonymous only within the anonymity set. In the proposed open environment scenarios, the anonymity set of a particular user would change with time, and indeed, the changing anonymity sets of a particular user may be disjoint, be the same or may overlap. In our work we analyze these changing anonymity sets and show that it is possible to discover all peer communication partners of a chosen subject (e.g. of Alice) without requiring a large number of anonymity sets of the subject. In the next sections we will present the MIX technique and use it as the object of our investigation.

3

The MIX Concept

MIXes collect a number of packets from distinct users (anonymity set) and process them so that no participant, except the MIX itself and the sender of the packet, can link an input packet to an output packet [2]. Therefore, the appearance (i.e. the bit pattern) and the order of the incoming packets have to be changed within the MIX. The change of appearance is a cryptographic operation, which is combined with a management procedure and a universal agreement to achieve anonymity: User Protocol: All generated data packets including address information are padded to equal length (agreement), combined with a secret random number RN , and encrypted with the public key of the MIX node (see also [16]). A sequence of MIXes is used to increase the reliability of the system. MIX Protocol: A MIX collects b packets (called batch) from distinct users (identity verification), decrypts the packets with its private key, strips off the RN s, and outputs the packets in a different order (lexicographically sorted or randomly delayed). Furthermore, any incoming packet has to be compared with formerly received packets (management: store in a local database) in order to reject any duplicates. Every MIX (except the first) must include a functionality ensuring that each received packet is from a distinct user, e.g. apply an anonymous loop back4 , because only the first MIX can decide whether or not the packets are from distinct senders. E.g. assume that Alice wants to send a packet M to Bob (Fig. 1). A must encrypt the packet two times with the public keys ci of the respective MIXes and include the random numbers RNi : c1 (RN1 , c2 (RN2 , B, M )). Applying this protocol in closed environments where all subjects participate in all anonymity sets, the MIX method provides full security. The relation between the sender and the recipient is hidden from an omnipresent attacker as long as: 4

Loop back: Every MIX knows the sender anonymity set. It signs the received packets and broadcasts them to the respective users. Each user inspects whether his own packet is included or not and transmits a yes or no. The MIX goes on if it receives yes from all members of the anonymity set.

56

Dogan Kedogan et al.

Loop Back

S1 S2

aaaa aaa a a

...

Sb

aaa aaa aaa

Untraceability Providing Sytem 1

aa aa ...

aaa aaa aaa

Untraceability Providing Sytem 2

bb aa aa bb ...

aaa aaa aaa

R1 R2

Rn

Fig. 1. Cascade of two mixes

a) One honest MIX is in the line of the MIXes which the packet passes. b) The (b − 1) other senders do not all cooperate with the attacker. [8] states that the MIX method provides information-theoretic deterministic anonymity based on complexity-theoretic secure cryptography. 3.1

Related Works: Vulnerabilities of the MIXes

In the literature, several attacks have been proposed on anonymity techniques (see e.g. [17, 18, etc.]). Our work in this paper is most closely related to the intersection attack. The intersection attack gains information about a targeted user through repeated observations of the anonymity sets belonging to the targeted user. Since the intersection of two different anonymity sets is likely to be smaller than either of the anonymity sets (due to the assumed regularity in behavior), different intersections of anonymity sets could be used to gain information about the targeted user (see for such an analysis e.g. [18, 19]). A more powerful attack is the (n − 1)-Attack tackling directly the anonymity function of a MIX [8]. If a MIX cannot decide whether the packets are from different senders5 , the attacker can intercept the incoming packets, isolate each packet, and forward it together with (n − 1) of his own packets. This is also known as a trickle attack [10]. Note that also MIX variants like MIXmaster [20] are insecure against this attack [10, 21]. In [15] a MIX method (i.e. Stop-and-Go Mixes) an alternative approach is suggested with the goal of providing probabilistic security against the (n − 1)Attack with a security parameter µ. It was shown that a linear change of this parameter µ should have an exponential effect on the protection level of the method and on the achieved anonymity size n. However, recent research work [22, 23] limits the exponential effect on the size of the anonymity set by neglecting small probabilities, e.g. by neglecting all participants with a-posteriori probability less than p ≤ 0.0001 (see Definition 1). 5

Unfortunately, this is the case for all deployments in the Internet. Either the loop back functionality is not implemented or they assume a global Public Key Infrastructure (PKI), which is not existent yet.

Limits of Anonymity in Open Environments

57

In our work we abstract from a special MIX realization and assume that a MIX can build a secure anonymity set. Furthermore, we assume that all known or unknown problems (i.e. vulnerabilities) attacking the anonymity function of a MIX are solved. These assumptions allow us to compute the fundamental weakness of anonymity techniques regardless of a particular implementation. To crystallize these notions, in the next section we will present a formal model of a MIX.

4

Formal Model: The Random Communication Model

In the literature, several extensions and modifications (see e.g. [17]) have been proposed to the original MIX technique. Since the focus of this paper is on analyzing the fundamental protection bounds of MIXes, we will assume a formal MIX model which is secure except for the fact that not all users are synchronized. Our formal model is based on the following assumptions: – There are N users U1 , U2 , . . . , UN in the system. – The untraceability providing system, i.e. a MIX, provides perfect untraceability between incoming and outgoing packets. – The batch size of the system is b, where 1 < b  N , and a batch may contain a receiver more than once. Thus, the size n of the anonymity set fulfills the following condition n ≤ b (see also Definition 1). – The b packets in a batch are created by b different senders. – Alice is one of the senders Si , 1
i
N , and she uses the system to hide her m, 1 < m  N , communication partners. – Alice chooses her communication partner in each communication uniformly among her m partners. – Other senders choose their communication partners uniformly among all N users. – The attacker E takes notice of each untraceable communication act of Alice. This triggers the attacker to write down all recipients who are involved in this untraceable communication process, that is, the attacker simply records only those recipient sets which include a communication partner of Alice.

U1

U2 ... U(N-1)

UN

S1 S2 ... S(b-1) Sb

Untraceability Providing Sytem

Fig. 2. Formal Model

R1 R2 ... R(n-1) Rn

58

Dogan Kedogan et al.

For the sake of simplicity, we will enumerate the time t with increasing integer numbers whenever Alice sends a packet. Thus, when Alice communicates for the first time, t = 1, when she communicates for the second time, t = 2, and so on. We will denote the recipient set at time t by Rt = {Rt1 , . . . , Rtn }. We now make several comments about these assumptions: – Our formal model contains three essential parameters, namely user population N , batch size b, and the number of communication partners of the intended target m. These parameters can be easily identified in other anonymity providing techniques. – The random communication behavior of the users determines the size of anonymity set n. – Typically in open environments, the total number of users N is large. The anonymity size and the batch size (n ≤ b) is likely to be small in comparison to N . – Note that the number of communication partners of the intended target (Alice) m includes pseudo partners chosen by the target for sending dummy packets. We note that our formal model contains three critical assumptions: Alice has m communication partners, she chooses her communication partners at random, and the recipient sets of all users are uncorrelated6 . Later in this section, we will provide a justification for these assumptions. However, before we can justify these assumptions, we need to discuss our attack. First, we make the following claim for our model: Claim 1 The MIX method is insecure if m
N/n . Proof A potential attacker can proceed in two stages: the learning phase and the excluding phase. In the learning phase the attacker waits until he observes m mutually disjoint recipient sets (R1 , . . . , Rm ), i.e., for all i = j, Ri ∩ Rj = ∅. After the learning phase, the attacker can be sure that in each set Ri , there is only one peer communication partner of Alice. In the excluding phase of the attack, the recipient sets (R1 , . . . , Rm ) are refined using further observations. This can be done by using a new recipient set R which intersects with only one prior recipient set, that is, if R ∩ Ri = ∅ and R ∩ Rj = ∅ for all j = i. In that case, Ri can be refined to Ri ∩ R. The refinement process is continued until each of the sets R1 , . . . , Rm contains only one user. It is clear that the remaining m users in R1 , . . . , Rm are the communication partners of Alice. ✷ We call the above attack the disclosure attack. 6

This assumption leads to a uniform distribution for the (b − 1) other recipients in a batch.

Limits of Anonymity in Open Environments

4.1

59

Success of the Disclosure Attack

Since the senders are not coordinated, the probability that one of the phases does not find the needed batches (i.e. m disjoint batches or batches that overlap with only one of these) converges to zero as the number of observations grows. Hence, we can deduce that with probability one the attack succeeds after a finite number of observations. This number forms an upper bound on the protection limit of the MIXes. The number of observations that our attack needs to succeed clearly depends on the composition of the batches, which can be seen as a stochastic process as the senders are not coordinated. Thus the number of observations is a random variable X. Our task is to calculate the statistical characteristics such as the mean E(X) and the variance σ 2 of this number. 4.2

Explanation of the Critical Assumptions

Now we can justify the three critical assumptions made in our formal model. Clearly it is unrealistic to assume that Alice has a constant number of communication partners m for her whole life time. Thus, it is reasonable to restrict the time to a period of T , where Alice communicates frequently to m peer partners. Assuming this, following strategy can be applied to determine the number of communication partners of Alice: Assume, the real number of partners in a given time period is m. ¯ ¯ − k where k > 0 and If the attacker overestimates7 m such as m = m k ∈ N, then the first phase of the disclosure attack can not be applied. Thus, the attacker adjusts m to m := m − 1 and applies the first phase again until the first phase is successful. We note that the above strategy to find m could be computationally intensive. However, in this paper we are interested in the fundamental limits of the MIXes regardless of the computation power of the adversary. The second critical assumption of our formal model, that is, Alice chooses her communication partners randomly, is also unrealistic. However, here we are interested just in the upper bounds on the protection provided by a MIX. Since some partners occur more frequently than others, the attacker would need more observations to conclude the learning phase and the excluding phase of the attack. Thus, the number computed by assuming equally frequently partners would be a lower limit on the number of 7

Of course, the attacker can only be sure that he has a false estimation for m, if he has already “enough” observations to apply the disclosing attack. To decide the point “when it is enough”, depends on the stochastic structure of the random model. We will analyze this in the next sections.

60

Dogan Kedogan et al.

observation required by an adversary. In other words, it would provide an upper limit8 on the protection provided by the MIXes. Our third assumption can also be justified on the similar grounds. If the recipient sets for different users were correlated, then it would take an adversary more time to conclude the learning and excluding phase. For example, this would be the case, if another user had exactly the same set of recipients as Alice and contributed frequently to the MIX. In this case any batch in which this user and Alice send a packet would have two communication partner of Alice and the observation would be useless for the learning phase. Thus our assumption leads to a lower bound on the number of observations needed by an adversary, or in other words, an upper limit on the protection level of the MIXes.

5

Simulation Results

In order to determine the statistical characteristics of the number of observation required by an adversary, we wrote a simulator, which performs the attack described above. In the following subsections, we will describe the four main parts of this simulator. 5.1

Generating Observations

The simulator identifies each of the N possible recipients by a unique number out of {1, . . . , N }. Without any loss of generality, we assume that the numbers of the subset {1, . . . , m} represent the m communication partners of Alice. Hence, an observation is represented by a set of b numbers out of {1, . . . , N }, where at least one of these numbers is from the range {1, . . . , m}. To generate an observation, the simulator draws randomly a single number out of {1, . . . , m} and (b−1) more numbers out of {1, . . . , N }. Note that a recipient set may contain a number more than once. FUNCTION generateObservation(N,b,m) r := random(1,m); R := {r}; FOR i := 1 TO (b-1) r := random(1,N); R := R ∪ {r}; RETURN R; The function random(x,y) returns a random integer number out of the range [x, . . . , y]. For simplicity, we use a standard random number generator that provides uniformly distributed numbers. 8

In order to determine the protection bound of a security scheme two approaches are common. Either the strongest possible attack which cannot break the scheme has to be determined or the weakest attack which can break the scheme.

Limits of Anonymity in Open Environments

5.2

61

Learning Phase

The goal of the first phase is to find m mutually disjoint recipient sets. We are interested in the number of observations that an attack needs to reach this goal. The program iteratively generates new observations and checks if m recipient sets of these observations are mutually disjoint. When the check is successful, the number of observations and the found recipient sets are returned. FUNCTION learning_phase(N,b,m) t := 0; O := ∅; WHILE O = ∅ t := t + 1; Rt := generate_observation(N,b,m); O := find_disjoint_sets({R1,...,Rt},m); RETURN t,O; Clearly, the function find_disjoint_sets({R1,...,Rt},m) is the most interesting part. It searches for m mutually disjoint sets within {R1 , . . . , Rt }. Unfortunately, this problem turns out to be NP-complete. In fact, the function find_disjoint_sets() forms the major performance bottleneck of the simulation. Our approach to solve this problem is to use enhanced backtracking algorithms. Therefore we transform the problem into a binary Constraint Satisfaction Problem (binary CSP, see [24]) and use well-known backtracking methods on the transformed problem. A CSP consists of a set of m variables X = {x1 , . . . , xm }, a value domain Da for each variable xa and a set of constraints. Each value domain is a finite set of values, one of which must be assigned to the corresponding variable. A constraint is a subset of the Cartesian product of the domains of some variables. This subset contains all allowed combinations of values for the corresponding variables. In a binary CSP all constraints are defined over pairs of variables. The goal of a CSP is to assign a value to each variable, so that all constraints are satisfied. FUNCTION find_disjoint_sets({R1,...,Rt},m); csp := transform_to_csp({R1,...,Rt},m); solution := solve_csp(csp); O := retransform_solution(solution); RETURN O; A straightforward transformation is to take each observation Ri as a value i (i = 1, . . . , t). Hence, the CSP is to assign values out of 1, . . . , t to the m variables x1 , . . . , xm , so that these values correspond to observations that are mutually disjoint. Therefore, the binary constraints consist of all pairs of values, whose corresponding observations are disjoint, i.e. the pair (xa = i, xb = j) is allowed for all a, b ∈ {1, . . . , m}, if and only if Ri ∩ Rj = ∅.

62

Dogan Kedogan et al.

FUNCTION transform_to_csp({R1,...,Rt},m); constraints := ∅; FOR a~:= 1 TO m Da := 1,...,m; (domain of variable xa) FOR a~:= 1 TO m FOR b := 1 TO m FOR i := 1 TO t FOR j := 1 TO t IF Ri ∩ Rj = ∅ THEN constraints := constraints ∪ {(xa=i,xb=j)}; RETURN ({x1,...,xm},{D1,...,Dm},constraints); For common input sizes, this transformation results in a huge search space and the search is often computationally infeasible. For our simulation, we use supplementary knowledge about the observations to significantly reduce the search space. Firstly, we delete all observations that contain more than one of the peer partners. Since every observation in the solution contains exactly one of the peer partners, this deletion does not affect the completeness of the search. Secondly, we divide the observations into m classes C1 , . . . , Cm . Each class Ca consists of all observations that contain the peer partner a. Clearly, a solution consists of m observations, one out of each class. Hence, we can take the classes as domains for the CSP, i.e. the domain Da consists of all observations that also belong to the class Ca . FUNCTION transform_to_csp({R1,...,Rt},m); constraints := ∅; FOR i := 1 TO t IF contains_two_partners(Ri) THEN delete(Ri); FOR a~:= 1 TO m Da = {i | a~∈ Ri} (domain of variable xa) FOR a~:= 1 TO m FOR b := 1 TO m FOREACH i IN Da FOREACH j IN Db IF Ri ∩ Rj = ∅ THEN constraints := constraints ∪ {(xa=i,xb=j)}; RETURN ({x1,...,xm},{D1,...,Dm},constraints); Note that, in general, the attacker does not have the supplementary knowledge used by us. However, the attacker would find the same constraints as the ones found above even if he does not use the supplementary knowledge. Thus, using the supplementary knowledge significantly speeds up our simulations, but the results, i.e. the number of required observations for a successful attack, would be the same for both transformation procedures. The function solve_csp(csp) searches for a solution of the transformed problem and returns the first solution found, if any exists. This may be done

Limits of Anonymity in Open Environments

63

by traditional backtracking algorithms. Our simulator makes use of a C-library developed by van Beek [25] that provides more sophisticated procedures to solve CSPs. An overview of the implemented procedures can be found in [24] and [26]. We experienced significant performance improvements by using the procedures developed by van Beek. When solve_csp(csp) has found a valid variable assignment for the CSP, the function retransform_solution(solution) converts the returned solution to a solution O of the original problem. The observation Ri is an element of O, if and only if the solution of the CSP contains i. If solve_csp(csp) has not found a solution, the empty set ∅ is returned. 5.3

Excluding Phase

The goal of the second phase is to exclude elements from the recipient sets returned by the learning phase until each recipient set contains exactly one element, representing the peer partner. Again, we are interested in the number of observations the attacker needs to succeed. For simplicity, we denote the set of mutually disjoint recipient sets returned by the learning phase by O = {O1 , . . . , Om } and the recipient set of the new observation by Ri (i = 1, 2, . . .) . The simulation iteratively generates new recipient sets Ri and checks, if it is disjoint to all but one recipient set Oj ∈ O. If this is the case, Oj is replaced by the intersection Oj ∩ Ri . Even if the recipient set of a new observation overlaps with more than one Oi , it may be applicable later, when some elements are excluded from the affected recipient sets in O. Therefore, every time a new recipient set is found to be intersecting with only one recipient set in O, we have to check if any of the previously generated recipients sets is now applicable. Likewise, every time an old recipient set is found to be intersecting with only one recipient set in O, we have to check all old observations again for their applicability. FUNCTION excluding_phase(N,b,m,O={O1,...,Om}) t := 0 ; REPEAT t := t + 1; Rt := generate_observation(N,b,m); IF ∃i (Oi∩Rt= ∅˜ ∧ ∀j=i Oj∩Rt=∅) THEN Oi := Oi∩Rt; Rt := ∅; (Rt should not be checked again) REPEAT changed := FALSE; FOR k := 1 TO (t-1) IF ∃i (Oi∩Rk= ∅˜ ∧ ∀j=i Oj∩Rk=∅) THEN changed := TRUE; Oi := Oi∩Rk;

64

Dogan Kedogan et al.

Rk := ∅; (Rk should not be checked again) UNTIL changed = FALSE UNTIL ∀i∈{1,...,m} |Oi|= 1 RETURN t,O; When this function intersects an observation Ri with an observation out of O, Ri must not be checked again, because this would lead to an infinite loop. Hence, we set Ri = ∅, so that the IF-clauses return FALSE when Ri is checked. Note that some of the observations generated during the learning phase may be usable for the excluding phase. Hence, if we are interested in the total number of observations needed for both phases, we have to also check the observation generated during the learning phase for their intersection with O. Repeating the Simulation. It is clear that the number of observations depends on the randomly generated observations. Therefore we need to repeat a simulation several times with different streams of random numbers in order to compute a mean that satisfies some desired statistical requirements. After each simulation, we compute a 95% confidence interval for the mean, that is an interval which contains the real mean with a probability of 0.95. In general, the size of the confidence interval decreases with an increasing number of repetitions. We stop repeating the simulation when the confidence interval is sufficiently small, i.e. the size of the interval does not exceed 5% of the computed mean. 5.4

First Results

In our first simulations we were interested in in the effect of N , b and m on the number of observations an attacker needs to succeed. To see the effect of changing, N , b, and m, we first chose typical values for these parameters, viz, N = 20000, b = 50 and m = 20. Then we ran simulations with different values for one of the parameters while keeping the other two parameters unchanged. We note that our simulations in the excluding phase do not make use of observations generated during the learning phase. Therefore, the total number of observations needed to complete the whole attack may be less than the sum of the numbers needed for each phase as shown here. Number of Peer Partners (m). For a fixed number of total users N , and batch size b, as the number of peer partners m grows, it clearly becomes more difficult to find m mutually disjoint sets during the first phase. Similarly during the excluding phase, it gets harder to find sets that overlap with only one of the observations found in the learning phase since as m grows the number of elements in m mutually disjoint sets also grows. Figure 3 shows a graph of the number of required observation for both phases of the attack. For high values of m, the excluding phase turned out to be more critical than the learning phase. For low numbers the difference between the

Limits of Anonymity in Open Environments

65

Effect of m 800 700

#observations

600 500 400

learning phase

300

excluding phase

200 100 0 2

4

6

8

10

12

14

16

18

20

22

24

26

28

30

32

34

36

38

40

m

Fig. 3. Effect of m on the number of observations number of observation required for two stages is insignificant. Further analysis showed that for large values of m (m > 30), the number of observation needed during the excluding phase grows exponentially in m. Size of the Batch (b). One way for the anonymity provider to influence the security of the system is to take care of a suitably large batch size. Obviously, as b grows the attacks becomes very difficult, because if the total number of users N stays the same, it is much harder to find m large sets that are mutually disjoint than to find m small ones. Similarly, the probability that a set overlaps with only one of m sets becomes very small for large values of b. Hence the number of observations needed is expected to grow in b. The graph of the simulation results in Figure 4 supports this hypothesis. Again, the excluding phase turned out to be the more critical one for large values of b. For b < 50, the number of observations is nearly constant. We deduce that for small batches other parameters are more important. On the other hand, for 70 < b ≤ 85 the number of required observations made out a fast exponential growth in b, approximately doubling the number of observations needed for the excluding phase every time the batch size grows by five elements. Total Number of Users (N ). In contrast to m and b, the attack becomes harder as N decreases, because the probability to generate a set that is disjoint to (m − 1) mutually disjoint sets or to generate a set that overlaps with only one of these sets, is very small if you can choose the recipients only from a small domain. Figure 5 shows a graph of our results. Similar to the graph for the effect of b, we can see that for N > 20000, the observations needed remain nearly constant. On the other hand, for N < 10000 the graph for the excluding phase shows an exponential behavior. Again, when

66

Dogan Kedogan et al.

3000

2500

#observations

2000

1500

learning phase excluding phase

1000

500

0 5

10

15

20

25

30

35

40

45

50

55

60

65

70

75

80

85

b

Fig. 4. Effect of b on the number of observations 400 350

#observations

300 250 200

learning phase

150

excluding phase

100 50

50000

47500

45000

42500

40000

37500

35000

32500

30000

27500

25000

22500

20000

17500

15000

12500

10000

0

N

Fig. 5. Effect of N on the number of observations the total number of users becomes less, the number of observations needed for the excluding phase increase faster than for the learning phase. Summary. The first experiments showed that it is essential for the security of an anonymity system to choose the three critical parameters, b, m and N , carefully. To achieve a sufficient anonymity, b and m should be as big as possible, and the total number of users must not exceed a certain limit. One quite surprising result is that, when the problems get harder, that is for large b and m, and for small N , the excluding phase requires significantly more observations than the learning phase. On the other hand, the learning phase requires a lot more of computing power.

Limits of Anonymity in Open Environments

6

67

Conclusions

This paper presents a formal model of an anonymity service and identifies three critical parameters of such a service: the total number of users, batch size, and the number of peer communication partners. These parameters determine the fundamental protection provided by an anonymity service independent of the computing power of a potential adversary. The paper also provides a methodology to determine an upper limit on the fundamental protection provided by an anonymity service. Specifically, the paper applies this methodology to the MIXes, and shows that the protection limit of a MIX increases exponentially in the three critical parameters once these parameters cross a certain threshold. The paper provides these thresholds for typical values of the parameters for a MIX. In the hindsight provided by this paper, it is clear that the optimum values for these parameters are dependent on each other. Just choosing these values independently of each other does not necessarily result in a more secure system. In order to compute the optimum batch size it is essential to consider the total number of users in the system and the average number of communication partners of a user and compute the minimum threshold value for the size of the batch. In our future work, we would explore the stochastic nature of our formal model. It turns out that the learning phase and the excluding phase of the attack can be modelled as a Markov process. Our goal is to give analytical formulas to compute the threshold limits and verify them using the simulations. Furthermore, we would examine the effect of three critical assumptions made in this paper on the tightness of our limit on the protection level of an anonymity service.

References [1] D. Chaum: The dining cryptographers problem: Unconditional sender and recipient untraceability. Journal of Cryptology, 1:65-75, 1988. 53 [2] D. Chaum: Untraceable electronic mail, return addresses and digital pseudonyms. Communications of the A. C. M., 24(2):84-88, February 1981. 53, 55 [3] D. J. Farber, K. C. Larson: Network Security Via Dynamic Process Renaming. Fourth Data Communication Symposium, 7-9 October 1975, Quebec City, Canada. 53 [4] P. A. Karger: Non-Discretionary Access Control for Decentralized Computing Systems. Master Thesis, Massachusetts Institute of Technology. Laboratory for Computer Science, 545 Technology Square, Camebridge, Massachusetts 02139, Mai 1977, Report MIT/LCS/TR-179. 53 [5] A. Pfitzmann, M. Waidner, Networks without user observability, design options. In: Advances in Cryptology. Eurocrypt ’85, volume 219 of Lecture Notes in Computer Science. Spinger-Verlag, 1985. 53

68

Dogan Kedogan et al.

[6] B. Chor, O. Goldreich, E. Kushilevitz, M. Sudan: Private information retrieval. In: 36th IEEE Conference on the Foundations of Computer Science, pages 41-50. IEEE Computer Society Press, 1995. 53 [7] D. A. Cooper, K. P. Birman: Preserving privacy in a network of mobile computers. In: 1995 IEEE Symposium on Research in Security and Privacy, pages 26-38. IEEE Computer Society Press, 1995. 53 [8] A. Pfitzmann: Dienstintegrierende Kommunikationsnetze mit teilnehmer¨ uberpr¨ ufbarem Datenschutz. IFB 234, Springer-Verlag, Heidelberg 1990 (in German). 53, 56 [9] H. Federrath, A. Jerichow, A. Pfitzmann: MIXes in Mobile Communication Systems: Location Management with Privacy. Information Hiding, LNCS 1174. Springer-Verlag, Berlin 1996, 121-135. 54 [10] C. G¨ ulc¨ u, G. Tsudik: Mixing E-mail with BABEL. In: Symposium on Network and Distributed Systems Security (NDSS ’96), San Diego, California, February 1996. 54, 56 [11] A. Jerichow, J. M¨ uller, A. Pfitzmann, B. Pfitzmann, M. Waidner: Real-Time Mixes: A Bandwidth-Efficient Anonymity Protocol. IEEE Journal on Selected Areas in Communications, 1998. 54 [12] A. Pfitzmann, B. Pfitzmann, M. Waidner: ISDN-mixes: Untraceable communication with very small bandwidth overhead. In: GI/ITG Conference: Communication in Distributed Systems, pages 451-463. Springer-Verlag, Heidelberg, February 1991. 54 [13] M. G. Reed, P. F. Syverson, D. M. Goldschlag: Anonymous connections and onion routing. IEEE Journal on Special Areas in Communications, 16(4):482-494, May 1998. 54 [14] M. G. Reed, P. F. Syverson, D. M. Goldschlag: Protocols using Anonymous Connections: Mobile Applications, Security Protocols. 5th International Workshop Proceedings. B. Christianson, B. Crispo, M. Lomas, and M. Roe (eds.). SpringerVerlag LNCS 1361, 1998, pp. 13-23. 54 [15] D. Kesdogan, J. Egner, R. B¨ uschkes: Stop-and-go mixes providing probabilistic security in an open system. In: David Aucsmith (ed.): Information Hiding: Second International Workshop, volume 1525 of Lecture Notes in Computer Science, pages 83-98. Springer-Verlag, Berlin, Germany, 1998. 54, 56 [16] B. Pfitzmann, A. Pfitzmann: How to Break the Direct RSA-Implementation of MIXes. Eurocrypt ’89, LNCS 434. Springer-Verlag, Berlin 1990, pp. 373-381. 55 [17] J. F. Raymond: Traffic Analysis: Protocols, Attacks, Design Issues, and Open Problems. International Workshop on Design Issues in Anonymity and Unobservability, Berkley, LNCS 2009. Springer-Verlag, 2001. 56, 57 [18] O. Berthold, H. Langos: Dummy Traffic Against Long Term Intersection Attacks. Workshop on Privacy Enhancing Technologies, San Francisco, CA, USA, April 14-15, 2002. 56 [19] M. Wright, M. Adler, B. N. Levine, C. Shields: An Analysis of the Degradation of Anonymous Protocols. Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS 2002), February 2002. 56 [20] L. Cottrell: Mixmaster, http://www.obscura.com/ loki/. 56 [21] D. Kesdogan: Evaluation of Anonymity Providing Techniques using Queueing Theory. The 26th Annual IEEE Conference on Local Computer Networks (LCN 2001), November 15-16, 2001, Tampa, Florida. 56 [22] A. Serjantov, G. Danezis: Towards an Information Theoretic Metric for Anonymity. Workshop on Privacy Enhancing Technologies, San Francisco, CA, USA, April 14-15, 2002. 56

Limits of Anonymity in Open Environments

69

[23] C. Diaz, S. Seys, J. Claessens, B. Preneel: Towards Measuring Anonymity, Workshop on Privacy Enhancing Technologies, San Francisco, CA, USA, April 14-15, 2002. 56 [24] R. Dechter, D. Frost: Backtracking algorithms for constraint satisfaction problems. An ICS technical report, September 1999. 61, 63 [25] P. v. Beek: A C-library of routines for solving binary constraint satisfaction problems. http://ai.uwaterloo.ca/ vanbeek/software/software.html. 63 [26] V. Kumar: Algorithms for Constraint Satisfaction Problems, A Survey. AI magazine, 13(1):32-44, 1992. 63 [27] O. Berthold, H. Federrath, S. K¨ opsell: Web MIXes: A System for Anonymous and Unobservable Internet Access. International Workshop on Design Issues in Anonymity and Unobservability, Berkley, 2009 LNCS. Springer-Verlag, 2001. [28] I. Goldberg, A. Shostack: Freedom network whitepapers. [29] C. Rackoff, D. R. Simon: Cryptographic defence against traffic analysis. In: Proceedings of the Twenty-Fifth Annual ACM Symposium on the Theory of Computing, pages 672-681, San Diego, California, 16-18 May 1993.

Chaffinch: Confidentiality in the Face of Legal Threats Richard Clayton and George Danezis University of Cambridge, Computer Laboratory Gates Building, JJ Thompson Avenue, Cambridge CB3 0FD, United Kingdom {richard.clayton,george.danezis}@cl.cam.ac.uk

Abstract. We present the design and rationale of a practical system for passing confidential messages. The mechanism is an adaptation of Rivest’s “chaffing and winnowing”, which has the legal advantage of using authentication keys to provide privacy. We identify a weakness in Rivest’s particular choice of his “package transform” as an “all-or-nothing” element within his scheme. We extend the basic system to allow the passing of several messages concurrently. Only some of these messages need be divulged under legal duress, the other messages will be plausibly deniable. We show how this system may have some resilience to the type of legal attack inherent in the UK’s Regulation of Investigatory Powers (RIP) Act.

1

Introduction

We present a system called “Chaffinch” for passing confidential messages using shared secret keys. The basic mechanism is Ron Rivest’s “chaffing and winnowing” [10], which uses authentication primitives to provide confidentiality. The Chaffinch system allows several further messages to be steganographically concealed behind the main message. This allows cover traffic to be divulged to any authorities who wish to inspect the confidential information, without compromising the hidden material. The system is evaluated not only in terms of the traditional threat to confidentiality, eavesdroppers with significant computing power, but also in terms of its interaction with the UK’s Regulation of Investigatory Powers (RIP) Act 2000 [13], one of the first laws to attempt to engage with cryptography. Section 2 of this paper discusses the background to “chaffing and winnowing”. In particular, we identify a weakness in Rivest’s suggestion that his “package transform” should be used as an “all-or-nothing transform” on a message. This section also provides an overview of the relevant parts of the RIP Act. Section 3 provides a high-level description of the Chaffinch design. Section 4 covers a number of detailed design decisions that have been incorporated into the Chaffinch system. Finally, Section 5 covers the issues relating to secret keys and how best to manage the keys associated with Chaffinch communications.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 70–86, 2003. c Springer-Verlag Berlin Heidelberg 2003


Chaffinch: Confidentiality in the Face of Legal Threats

2 2.1

71

Background Chaffing and Winnowing

Chaffing and winnowing was proposed by Rivest [10] as a way of providing confidentiality using only authentication primitives. In the basic scheme, a message is split into many equal sized packets and a valid MAC is appended to each. Some other random packets are also generated, but further random values are associated with them instead of correctly calculated MACs. The two sets of packets are intermingled and transmitted to the receiver. Anyone who holds the authentication key for the MAC values can recognise the good packets and distinguish them from the random material. Anyone else eavesdropping upon the data stream will be unable to determine which of the possible selection of packets will reveal the message. Rivest called the random packets “chaff” and the process of separating the true message “winnowing”, by analogy with the harvesting task of separating the wheat from the chaff. There is an obvious attack on this simple scheme, whereby an eavesdropper could select packets from the data stream based on the likelihood that they fit well with the packets already selected. There is also an obvious difficulty in sending chunks of information in the clear since natural language text can be easily distinguished from random material. These attacks are not applicable where single bits are sent – but this is hugely inefficient if a very large MAC accompanies each bit. Rivest therefore proposed the use of his “package transform” [11] to produce a “packed message” with the two desirable properties that it was not practical to unpack it without having the whole message available and secondly that it would be statistically indistinguishable from random noise. Rivest also pointed out that the “chaffing” operation of adding the random noise does not require knowledge of the MAC key and can even be performed by a third party, thus reinforcing the case that this system is not an encryption system in the usual sense of the word. The basic idea was extended in two ways relevant to this work. Firstly, Rivest observed that the wheat of one participant might be used as the chaff for another. If two valid streams of packets are multiplexed together then the recipients will automatically discard the packets that they cannot authenticate and be left with the messages that were sent to them. The second observation is that more than one stream of packets can be mixed together by one participant in such a way that the presence of any or all messages can be denied. There have been only a handful of previous implementations of “chaffing and winnowing”, most written in Perl [2, 12]. These programs have just been proofof-concept systems or have omitted such stages as a package-transform – leaving them open to attack. 2.2

The Package Transform

As already observed, in order to hide patterns in the plaintext that could help an attacker reconstruct the message by accumulating sections that fit, an “all-or-

72

Richard Clayton and George Danezis

nothing transform” needs to be used. Rivest’s original “chaffing and winnowing” paper suggested that his “Package Transform” [11] would be suitable. This transform has some desirable properties. Although keys are used in the transform, it is not a cipher because the keys are not secret. Anyone with a copy of the transformed message can immediately convert it back into plaintext. However, it is infeasible to do this conversion or indeed to obtain any information at all about the original message, without having the entire transformed message available. This is exactly the property that “chaffing and winnowing” requires, since it means that an attacker has to guess exactly which sections of the data stream correspond to the message in order to get a decoding that generates anything other than random bits. The message transform described by Rivest works as follows: consider m1 , m2 , . . . , ms to be the plaintext blocks, E an encryption function and K  a randomly chosen key. Then the transformed blocks mi are calculated to be: mi = mi ⊕ E(K  , i) for i = 1, . . . , s The value of K  is transmitted to the receiver by sending the extra value M : M = K  ⊕ h1 ⊕ h2 ⊕ . . . ⊕ hs where:

hi = E(K0 , mi ⊕ i)

for i = 1, . . . , s

and K0 is a publicly known system wide key. The receiver will have all of the mi values along with M . They can retrieve K  by computing the values of hi and XORing them together. Once K  is known this can then be used to recover the values for mi . The security of Rivest’s “package transform” and other “all-or-nothing transforms” have been investigated by Anand Desai [7] and also commented upon by Mihir Bellare and Alexandra Boldyreva [5]. They concentrated on whether the transform is secure against exhaustive key search, and in particular in checking that such searches are slowed down by a factor that is equal to the number of blocks of ciphertext. However, this is not quite the way in which the all-or-nothing transform is being used within a “chaffing and winnowing” system. In particular, Rivest’s package transform does not create as much work as expected for an attacker who is trying a brute force attack to distinguish between message and chaff. The problem is that the values for hi can be calculated once and then reused for any trial arrangement that incorporates the same section of the message in the same position. In particular, if the attacker has just tried the selection S1 , S2 , . . . , Sn and now tries an alternative packet in position Si then all except one of the hi values can be reused in extracting the new trial value for K  . What is necessary is for the value of hi to differ, depending upon the exact choice of message sections that has been made. A simple variation of the Rivest scheme that achieves this would be to calculate: hi = E(K0 , mi ⊕ Z)

for i = 1, . . . , s

Chaffinch: Confidentiality in the Face of Legal Threats

73

where Z is the hash of the concatenated m values: Z = HASH(m1 , m2 , . . . , ms ) HASH can be any cryptographically sound hash function, such as SHA-1 or MD5, or indeed a block cipher used as a hash function. One can further note that since the encryption function E is only used “one-way” there is the possibility of replacing it by a hash – meaning that only one type of cryptographic primitive is being used. Using the value Z in this way pushes the cost of evaluating each trial arrangement up from as little as one encryption operation to at least s hash operations. It will be further noted that the package transform described by Rivest uses a block cipher in counter mode that operates independently on each section mi of the message. In order to avoid problems with repetition of plaintext, the block number is XOR’d into the message value. In a “chaffing and winnowing” scheme, these block numbers are all relatively small integers so that insufficient randomness may be injected to completely defeat an attacker who attempts to construct dictionaries of blocks at each position. Thus the security of this part of the transform is very heavily dependent upon selecting different random keys K  . Unless it is necessary to cater for parallel computation of this function, a defence-in-depth design philosophy makes it desirable to use a feedback mode for the encryption function. 2.3

The UK Regulation of Investigatory Powers Act 2000

The Regulation of Investigatory Powers Act 2000 [13] became part of United Kingdom law in July 2000. It covers a wide range of issues, from the rules for interception of communications through access to communications data (who talked to whom) to low-tech investigation techniques such as handling informers and following people down the street. Part III of the Act relates to “encryption” and is currently (late-2002) dormant, but is expected to become active sometime in 2003. The basic idea of this part of the Act is that there is “protected information”, which is either a message or some stored data. The authorities can, in suitable circumstances, serve a notice under s49 of the Act to require that the protected information be disclosed “in an intelligible form” (s50(1)(b)). It is an offence (s53), with a penalty of up to two years in prison for failing to comply. There are statutory defences (s53(2), s53(3), s53(4)) for such obvious issues as not having a suitable key to decrypt with, which means that you cannot be locked up for transporting random bits around. If you are required to decrypt material then it is sufficient to deliver the plaintext. You may hand over your key if you prefer (s50(2)), but you are not in general obliged to do so. In some special circumstances the notice served under s49 can require the delivery of keys, but the Act specifically forbids access to “signature keys” in s49(9).

74

3 3.1

Richard Clayton and George Danezis

Chaffinch Design High-Level Design

Chaffinch is a way of sending multiple messages within a single communication by means of a “chaffing and winnowing” style scheme. A “cover message” is always sent, which may be accompanied by further optional messages. The cover message is no shorter than the accompanying messages. In the face of legal challenge the cover message will always be the first to be revealed, and its contents should be chosen appropriately for this eventuality. It will be possible to “plausibly deny” that the optional messages exist, so they need not be revealed. The system works by taking the cover message, splitting it into short sections and randomly interspersing “chaff” between these sections. The valid sections of the resulting communication are “signed” with a secret key so that the receiver can identify them, whereas the chaff is given a random “signing” value so that the receiver will ignore it. Anyone unaware of the secret key will face an impracticable amount of work in identifying precisely which sections form the message and thereby recovering the text. The chaff can be composed either of completely random material, or it can be composed of further messages using different secret authentication keys. The treatment is the same as for the cover message; each further message is split into sections and then the appropriate secret key for that message authenticates each section by “signing” it. The resulting sections will act as chaff for the cover message and the cover message acts as chaff for them. Not all of the random chaff can be replaced by messages – for otherwise revealing the next to last message would also reveal the last message. However, by careful design parameter choice, as discussed below, the Chaffinch system permits between one and fifteen further messages to be sent, depending upon their length. Fig. 1 should make the general idea more clear. It shows a small part of a Chaffinch message, with the cover message (1) interleaved with two further messages (2) and (3). Note that the message sections are always in the correct order for each message, but that a random choice is made as to the way in which the interleaving occurs, so in the example the first section of message 3 occurs before the first section of message 1. In Rivest’s initial design he envisaged the use of a MAC to authenticate the message sections. He observed that by use of suitably long MAC values there would only be an infinitesimal chance of a random value attached to a piece of chaff being mistaken for a valid section of a message. He suggested a 64 bit MAC to ensure a false hit rate of less than one in 1019 . There is a problem with just using a MAC, pointed out by Bellare and Boldyreva [5]. If a message section recurs, then if the attached MAC values differ then this is an indication that one of the sections is message and the other is chaff. This can be used to reduce the time complexity of an attack. However, the main difficulty with using large MACs is that they increase bandwidth usage, so within Chaffinch we use an alternative scheme. The secret authentication key is used to prime a stream cipher (we could have used a block

Chaffinch: Confidentiality in the Face of Legal Threats

Session Message 3 Section 1 Message 1 Section 1 Random Message 1 Section 2 Message 2 Section 1 Random Message 1 Section 3

75

Message 3 Authenticator Message 1 Authenticator Random Message 1 Authenticator Message 2 Authenticator Random Message 1 Authenticator

Fig. 1. Conceptual view of a Chaffinch block

cipher operating in output feedback mode). The resulting data is used, a few bits at a time, as a marker to show which message sections are part of the message. The other sections receive random values so that someone who knows the authentication key will know that they can be ignored. Since the authentication is independent of the message section values the Bellare-Boldyreva attack is not relevant. To ensure that the authentication data will not be identical if the same key is used again with the same message, a random session value is incorporated into the cipher initialisation by hashing it with the authentication key. This session value is sent en claire to the receiver so that message reconstruction is possible and so it is not a secret and could be considered to be a key. In order to avoid revealing how many messages are present within a single communication, the same session value is used for all of the messages being sent at the same time. Although this authentication scheme uses less bandwidth (a few bits of cipher stream rather than 64 bits of MAC), it is now far more likely that a random value on a section of chaff will be mistaken for a valid authenticator. If only one message was being sent, it would be possible to choose another random value whenever a case of mistaken identity occurred. This would have to be done with care, so as to avoid any possibility that an attacker might detect non-random behaviour. However, we are trying to send multiple messages and if the next packet is from another message then you cannot change the authenticator on a single section. Clearly there are solutions to this, by choosing new session values and ordering the way in which misidentifications are checked for. However, this would be at the cost of some implementation complexity, with the consequent risk of errors that might allow an attacker to succeed in breaking the security of the system. To keep the implementation simple, Chaffinch takes a completely different approach. No attempt is made to prevent random chaff from being recognised as a valid section of the message. Instead, the recipient does a “brute-force” search of the possible combinations of valid message sections, and the correct arrangement is detected when the decoding generates a message prepended by a valid hash of its contents. The details of this can be found in Sect. 4.2, but the executive summary is that by using 10 bits of the cipher stream as an authenticator, then on average it is necessary to consider 41 possible arrangements of

76

Richard Clayton and George Danezis

message sections, and one time in ten thousand it will be necessary to consider 6,000 or more arrangements. This amount of effort is well within the capabilities of modern machines. It is wise to have an agreement between sender and receiver as to what length messages may be, because this simplifies the brute force search algorithm and allows it to “prune” large numbers of cases, with consequent performance benefits. Therefore messages are padded to one of a small number of known lengths. By padding to the smallest of these known lengths we can ensure that apart from the presence of the cover message, it is not possible to determine how many further messages are present, even if some of them are revealed. In order to deal with a cover message that is too long for the predefined lengths, we merely create a second Chaffinch block and append this to the first, with new random values and a new intermingling of message sections. The other messages are then distributed evenly across all available blocks. This algorithm, along with the insistence that the number of blocks is determined solely by the length of the cover message, prevents the leakage of information about the presence of any further messages. 3.2

The BEAR Pre-processing Stage

We need to apply an “all-or-nothing” pre-processing function to the message text before it is split into sections and authenticated. This pre-processing prevents the attacker from picking out a message by using a probabilistic approach of guessing whether the next part of the data stream fits as the next message section, or whether it is just random chaff. Furthermore, the pseudo-random nature of the result of the pre-processing ensures that the message sections will be indistinguishable from the random chaff – no statistical measurements will be able to tell them apart. In Chaffinch we use an “all or nothing” scheme based on BEAR [1] rather than Rivest’s package transform. Besides the weaknesses already discussed in Sect. 2.2, the package transform has the inconvenient property of adding an extra hash value to the length of each message – leading to a number of implementation complexities. It also uses a session key and although this is transmitted in a visible manner (if one knows exactly where to look) a court of law might consider it be an encryption key and start treating Chaffinch as an encryption system rather than a way of transmitting authenticated messages. One of our design aims was to avoid systems that are prima facie encryption since pure authentication systems have special legal privileges. We believe that lay jury members will be especially impressed by the fact that we use BEAR in a keyless manner and the transformed message is sent in plain sight, albeit in a hard to locate fashion. BEAR is usually described as a block cipher constructed from a keyed hash function and a stream cipher. These are combined in an unbalanced Feistel cipher structure where the left part (L) has the length of the output of the hash function and the right part (R) can be of arbitrary length.

Chaffinch: Confidentiality in the Face of Legal Threats

77

Encryption is performed using a keyed hash function H(k) for some key k and a stream cipher S: L = L ⊕ H(k1 , R) R = R ⊕ S(L) L = L ⊕ H(k2 , R) The decryption is done by exchanging k1 and k2 . Any standard hash function, such as SHA-1 can be converted into a suitable keyed hash function by prepending the key to the input stream. In Chaffinch, since we are not interested in secrecy but only in pre-processing into a sea of random bits, we don’t use a key at all: L = L ⊕ H(R) R = R ⊕ S(L) L = L ⊕ H(R) As we will see later in Sect. 4.2 the message text is preceded by some “red tape” which includes a randomly chosen nonce. This nonce contributes to the freshness whenever the same message is sent twice and also provides protection for messages with large amounts of padding – which might otherwise be vulnerable to brute force attack. There is a small risk that a court might view this nonce as some sort of key. However, it was not specially communicated between the sender and receiver, changes with every message and is always revealed when the message is put into an intelligible form, so requests for it to be provided independently of the message text make no logical sense. 3.3

Interaction with the RIP Act

With the high-level design of Chaffinch described, we can now look at how this interacts with the UK’s Regulation of Investigatory Powers Act. If a s49 notice is served on a sender or a receiver, then they will be obliged to put their communications into an “intelligible form”. A Chaffinch user could try and claim that their messages are not encrypted and hence are already intelligible, provided that one knows which sections to inspect. This might not impress a court, and previous papers already, in the limit, equate chaffing with encryption [9]. The court may also take the view that the use of keys to prime the stream cipher makes the system de facto encryption, even though the transforms made on the message itself are independent of these keys. A Chaffinch user will, however, be able to respond to the s49 notice by providing the plaintext of the cover message. To prevent any dispute as to whether the plaintext is correct then the nonce for its session should also be provided. This will allow the authorities to recreate the message sections and see that they are present in the message. They will be able to do this without having access to the key that was used to create the authenticators and hence they will not have access to any other traffic, past or future.

78

Richard Clayton and George Danezis

If there are further hidden messages then the s49 notice will, presumably, have been written in such terms as to require that they are also revealed. However, if the sender and receiver are prepared to unlawfully conceal these messages, the authorities will find it impossible to demonstrate their presence. In the usual phrase, Chaffinch users have “plausible deniability”. If the authorities wish to go further they may use s51 to require keys to be divulged. However, the keys will have been used solely for generating “electronic signatures” to authenticate message sections and s49(9) prohibits any demand for this type of key. Whilst the RIP Act was being debated in the UK Parliament, there was some controversy surrounding this clause and the exact definition of an encryption key [3] and this might provide the basis of an argument that would convince the court. If the legal argument fails and the Chaffinch keys must be revealed, then the same issues of “plausible deniability” arise as above. The user will need to divulge the key for cover messages (and any other messages they have revealed) because otherwise the authorities will know that they are being misled. However, undivulged messages whose keys stay secret will remain undetectable.

4

Detailed Design Issues

In this section we discuss some of the engineering decisions we took in implementing Chaffinch. To some extent, these choices are arbitrary, and alternative choices could be valid, though they would not inter-operate with our code. However, there are some good reasons for picking values from particular ranges of possibilities and we explain the considerations that apply. 4.1

Size and Number of Sections

The first decision was the size of each message section. If it is large then more information can be sent but the larger it is, the greater the risk that some sort of bias might be detectable between n bytes of output of a random number generator and n bytes of output from the BEAR pre-processing. Naturally we would expect to use a good random number generator and BEAR primitives will give a reasonably random output, but keeping n small will frustrate this type of analysis. We settled on using 4 byte sections so that only major flaws in randomness would leak information. Most email messages are short – less than 4 kbytes long. We chose the maximum number of sections a message can use to be 1024 so that a typical email could be sent as a single Chaffinch packet. Each packet will, as we will see, occupy 10.5 kbytes on the wire. Of course, it is relatively easy to arrange for messages to be compressed before they are encoded. Since text will typically shrink to about 20% of its initial size this means that by adding an automatic compression stage to the Chaffinch system a single packet could transport a 20K message. The sizes can now be chosen for the steganographically-concealed messages that can replace some of the chaff. These sizes need to be fixed in order to

Chaffinch: Confidentiality in the Face of Legal Threats

79

reduce the workload for the receiver who would otherwise have to try and detect messages at all possible sizes. We need to provide at least 47 bytes of chaff to protect the confidentiality of the smallest message we send (and that message must be at least 47 sections long). This is because this gives a brute force attacker 94!/(47! × 47!) arrangements to consider (about 290 ) which is similar to the recommended complexity for long term security in Blaze et al [6]. In practice, we specified 64 sections of chaff and allowed messages to have sizes of 64, 128, 256, 512 or 1024 sections (256, 512, 1K, 2K or 4K bytes). This choice of sizes gives an attacker a minimum of 2116 arrangements to tackle, even if all other messages have been revealed except for a 64 section message and the accompanying chaff. 4.2

Length of Authentication Data

It will be recalled that chaff can be incorrectly identified as a section of the message if its randomly chosen authentication matches an expected value. However, there are only a small number of chaff sections between message sections; even the smallest message size of 64 is spread over just 2048 sections (one message section for every 31 of chaff). With an authenticator of 8 bits, there’s only about a 12% chance of chaff being mistaken for part of the message. Of course, when the message is assembled and the BEAR pre-processing is undone, then the mistake will be detected. However, this will take effort, so reducing misidentification is desirable. Misidentification is dominated by the presence of two n + 1 values between a section marked n and the section marked n + 2. Clearly, other cases can occur (where an incorrect identification of n + 1 leads to the misidentification of which section is marked n+2 etc) but sections that are marked correctly occur so much more often than by random chance that combinations of mistaken identity don’t occur very often in practice. So, as a first approximation, the number of combinations of sections that could form a message can be determined by a binomial distribution:
 n px (1 − p)n−x x where n is the number of sections (64, 128, . . . , 1024), x the number of misidentifications (and hence 2x the number of attempts necessary to decode the message) 2048 and p the probability of a misidentification. p is approximately ( m−1 − 2)/2A where m is the number of sections and A the number of bits in the authentication data. Choosing A to be 10 leads to a manageable number of misidentifications: for 64 sections, 95% of the time one has a maximum of 128 attempts to decode the message. It is possible to refine this model to consider other combinations of misidentification such as the sequence: n, n + 1, n + 2, n + 1, n + 2, n + 3 . . . which leads to three possible message constructions, but occurs more rarely. This combines with the mechanism already identified to give a further, 128 times less common, binomial distribution of 3, 6, 12, 24 . . . possible arrangements.

80

Richard Clayton and George Danezis

6

Occurences

10

4

10

2

10

0

10 0 10

1

10

2

10 Number of Arrangements

3

4

10

10

Fig. 2. Messages of 1024 sections, 1 million trials, log scales

6

10

4

Occurences

10

2

10

0

10 0 10

1

10

2

3

10 10 Number of Arrangements

4

10

5

10

Fig. 3. Messages of 64 sections, 1 million trials, log scales

We verified this model by creating 1,000,000 Chaffinch messages with a 10 bit authenticator, 1024 message sections and plotted the resulting number of message arrangements in Fig. 2. The two overlapping binomial distributions can be clearly seen. When only 64 message sections were present, even more groups of binomial distributions occurred (because the extra chaff between message sections allowed more complicated interactions) as can be seen in Fig. 3. This analysis leads to a further refinement of the Chaffinch design. In order to ensure that a brute force attacker who is guessing keys will have the maximum amount of work to do, we process the authentication data with BEAR prior to splitting it up into 10-bit sections to mark the message. The attacker will therefore have to duplicate this processing before they can attempt to match their authentication stream with a message. If we did not do this then they would usually be able to conclude after a handful of matches that the authentication data was moving through the message sections too quickly to be valid.

Chaffinch: Confidentiality in the Face of Legal Threats

Nonce

Hash

Message Data

Count

81

Session Padding

Fig. 4. Message format before BEAR pre-processing

4.3

Message Format

Each message to be encoded by Chaffinch needs some further header data as shown in Fig. 4. nonce is the random value used to ensure that the pre-processing output is unique even where the same input message is present. hash is a hash of all the other fields in this block and all preceding blocks, except the nonce values (which are ignored, to avoid any remaining possibility that they might be seen as a key). count is a count of the message data bytes. One bit is also used to indicate that this is the last block in the whole Chaffinch communication. session is a copy of the value described in Sect. 3.1 above (and shown in Fig. 1) that is used to provide uniqueness to the authentication scheme. It is reproduced here to prevent some types of message splicing attacks. The message data is the text of the message to be sent and padding is any necessary zero valued bytes added to increase the total length of all the items shown to 256, 512, 1024, 2048 or 4096 bytes. The hash only needs to be calculated over the current block in order to allow the receiver to identify when the correct set of sections has been accumulated. However, it is calculated over the entire message thus far in order to detect an attacker replacing, removing or substituting entire blocks. 4.4

Message Section Recognition

The receiver needs to determine which sections form the message. This is relatively straightforward to do with a depth-first tree search with backtracking. The following pseudo-code shows the general technique: sub decode() for (n=0, i=0; ;i++) { if (i < maxSections && expectSig[n] == actualSig[i]) { // this section is signed correctly, so record it blocks[n++] = i; if (n == seekSections) { // once have the required number of sections check // if they form a~valid part of the message if (Validate(digest, last, blocks, chunks)) return TRUE;

82

Richard Clayton and George Danezis // if not then look for alternative match --n; } } if (i >= limit[n]) { // eventually no longer worthwhile looking for a~match if (n == 0) return FALSE; // so look for an alternative match i = blocks[--n]; } }

}

The limit array is filled in by searching backwards along the message to determine the last possible match for each signature. This then acts to prune the tree by indicating when it is not worthwhile searching for alternative matches because there is no possibility of filling in the rest of the blocks.

5 5.1

Operational Issues Key Distribution

The Chaffinch system relies upon using different keys for different messages hidden in the same stream. In the original chaffing and winnowing paper, Rivest states that a standard key exchange protocol, such as Diffie-Hellman, could be used by the two communicating parties to exchange authentication keys. In the threat model that our system is addressing, this is somewhat more problematic. Diffie-Hellman is pretty clearly an encryption system and is therefore subject to legal attack. If the authorities requested that a Diffie-Hellman exchange be put into an intelligible form then compliance would reveal whatever data had been transmitted over the link. However, if the Diffie-Hellman keys were discarded at the end of the conversation it would be possible to provide any plausible plaintext, rather than reveal some Chaffinch keying information. One might expect to be able to achieve this type of plausible deniability by using SSL to encrypt a Telnet session – except that some SSL configurations use long term secrets. All in all, it might be wiser to arrange an out-of-band physical meeting in order to agree the shared secret authentication key. It should be noted that Chaffinch requires a separate shared secret key for each message that is sent simultaneously, but the keys can be reused for subsequent messages. This leads to many interesting key sharing possibilities, including the idea of broadcast keys that allow for multi-way conversations. In particular keys can be agreed upon but never actually used. Chaffinch can be made more robust against coercion by agreeing extra keys per channel, one to be used to authenticate the traffic, and others to be revealed in extremis. If both parties to a conversation are being coerced at the same time then both revealing the same key may give plausibility to its veracity – despite it never

Chaffinch: Confidentiality in the Face of Legal Threats

83

having been used, although considerable further difficulties may arise if someone misremembers the intended order of revelation. A deniable encryption technique, such as the one presented by Beaver [4], could be used in order to exchange these two keys each time a message is sent. In order to make it even more plausible that the key revealed is actually the proper one it could also be used to authenticate some communications. This could be considered to be a special case of cover traffic within a Chaffinch channel. 5.2

Keeping Keys Secret

There are some practical threats to the security of secret keys. It is important that they are never stored on disk, since various powers allow the authorities to inspect computer storage. Even if encryption hides the keys, the RIP Act permits the authorities to request that stored material is “put into an intelligible form”. As usual with key systems, it is possible to generate different keys for every message by means of a generating phrase that is hashed a different, reducing, number of times on each occasion. If the phrase is kept secret but a key is revealed then past traffic will be compromised (because the authorities can perform the hashes needed to construct keys used in the past) but future traffic will be protected. Alternatively, both forward and reverse secrecy can be achieved by creating new keys that are a result of encrypting a key with itself. This will provide backward secrecy. It is a weakness of the Chaffinch system that the secrets that it uses are shared between sender and receiver. This means that either the sender or receiver of a message is in a position to reveal its contents and to compromise other messages sent with the same key. In an environment where both sender and receiver could be subject to simultaneous coercion to reveal these secrets it would be advisable to arrange for the secrets to be revealed in a pre-set order. This will minimise the rate of access to information achieved by the adversary for since half the effort spent on coercion will merely yield duplicate information – and will also avoid a situation where the adversary knows that both parties are continuing to hide information. Once the adversary believes that all of the keys have been revealed then perhaps the coercion will cease. 5.3

The Underlying Chaff

When all messages within a single communication have been revealed then all that remains will be the random chaff. In some cases a Chaffinch user, particularly if subject to extreme forms of coercion, may wish to be able to demonstrate that no further messages remain hidden. This might be achieved by generating the chaff in a pseudo-random manner using a key for this purpose. Of course, once this key has been revealed then any communication containing N messages will be compromised as soon as N − 1 message keys are known. In particular, if there is only a cover message then this will be immediately available. A better scheme would be to convert a suitable length array of zeros into a standard

84

Richard Clayton and George Danezis

Chaffinch message, with nonce, hash, length, etc. This can then be used to provide the chaff sections, with the authentication values being truly random. Once all messages have been revealed, the remaining sections will compromise this message – so there is no need to be able to regenerate the random data stream. Other users will be satisfied with the security that is given by making the random chaff irreproducible. They will be unable to prove that no further messages remain to be discovered. Such users will know that no matter how extreme the coercion, and no matter how well or badly they face up to their situation, they will continue to tie up the resources of their adversaries in a fruitless task. Finally, we note the possibility of providing further hidden channels within the chaff or within the (non-)authentication values that accompany the chaff. These channels could span many separate communications – all that is needed is an agreement between sender and receiver as to where to look for them. 5.4

Forensic Analysis

If a Chaffinch user comes under suspicion, their computer is likely to be seized and subjected to detailed forensic analysis. This may, of itself, yield copies of messages that have been communicated, either because they have been explicitly recorded or because details of the messages can be found in, or inferred from, system level files such as swap space. If more communications can be located than are accounted for by the information about messages or keys that have already been revealed, then the authorities will know that information is being withheld. Therefore Chaffinch can only be seen as one part of a communications security strategy in which systems such as steganographic filestores [8] may also play a part in providing system-wide plausible deniability.

6

Conclusions

We have shown how a practical confidential message passing system can be built that is based upon Rivest’s “chaffing and winnowing” idea. By using an allor-nothing system that utilises the variable block length cipher BEAR we have avoided the problems of pre-computation with Rivest’s “package transform”. The messages and also their authenticators are indistinguishable from random data, so further obfuscation can be achieved by disguising Chaffinch packets as other types of encryption. As well as the cover message we have made it possible to send further confidential messages whose presence is plausibly deniable. We have proposed alternative schemes for handling the situation when the last message has been revealed, which allow a choice between escaping further coercion or tying up an attacker’s resources indefinitely. We have simplified message construction, and significantly reduced bandwidth requirements, by a probabilistic scheme that requires extra work by the receiver – but a careful choice of design parameters keeps this work to a reasonable level. However, if the scheme was used for transmitting streaming media,

Chaffinch: Confidentiality in the Face of Legal Threats

85

then timing issues would require further study. We also assume that an attacker cannot observe the time taken to encode or decode any particular message. We have analysed the ability of the system to withstand attack not just by attackers in the cryptographic realm but also by authorities with legal powers granted to them under the UK’s Regulation of Investigatory Powers (RIP) Bill. The system provides confidentiality, so even if communications are intercepted, it will not be possible to understand the content of the message. However, there is nothing in the Chaffinch design to hide the identities of sender and receiver; and in many cases security is compromised by the mere act of communication rather than by what it actually said. People looking for systems that are secure against this type of traffic analysis will need to look for other mechanisms beyond mere confidentiality and plausible deniability.

Acknowledgements We would like to thank Dr Ross Anderson for his comments on drafts of this paper and for pointing out the simplification achieved by use of the BEAR cipher.

References [1] R. Anderson and E. Biham: Two practical and provably secure block ciphers: BEAR and LION. In Fast Software Encryption (proceedings Third International Workshop, 1996), Springer. 76 [2] W. Annis: Chaffe. http://www.biostat.wisc.edu/~annis/creations/Chaffe.html. 71 [3] Lord Bassam: Hansard, 13 July 2000, column 434. 78 [4] D. Beaver: Plausible deniability. In Advances in Cryptology – PraguoCrypt ’96 Proceedings, Prague, Czech Republic, 1996. pp. 272–288, GC UCMP, ISBN 8001-01502-5. 83 [5] M. Bellare and A. Boldyreva: The security of chaffing and winnowing. ASIACRYPT 2000, LNCS 1976, Springer-Verlag 2000, pp. 517–530. 72, 74 [6] M. Blaze, W. Diffie, R. L. Rivest, B. Schneier, T. Shimomura, E. Thompson and M. Wiener: Minimal key lengths for symmetric ciphers to provide adequate commercial security. A report by an ad hoc group of cryptographers and computer scientists. 1996 http://www.crypto.com/papers/keylength.txt. 79 [7] A. Desai: The security of all-or-nothing encryption: Protecting against exhaustive key search. CRYPTO 2000, LNCS 1880, Springer-Verlag 2000, pp. 359–375. 72 [8] A. McDonald and M. G. Kuhn: StegFS: A Steganographic File System for Linux. In A. Pfitzmann (Ed.) Information Hiding, Third International Workshop, IH’99, Dresden 1999, LNCS 1768, Springer Verlag 2000, pp. 463-477. 84 [9] J. McHugh: Chaffing at the Bit: Thoughts on a Note by Ronald Rivest. In A. Pfitzmann (Ed.) Information Hiding, Third International Workshop, IH’99, Dresden 1999, LNCS 1768, Springer Verlag 2000, pp. 395-404. 77 [10] R. L. Rivest: Chaffing and winnowing: Confidentiality without encryption. RSA Laboratories CryptoBytes 4(1) 1998. 70, 71

86

Richard Clayton and George Danezis

[11] R. L. Rivest: All-or-nothing encryption and the package transform. Fast Software Encryption 1997, LNCS 1267, E. Biham, Ed., Springer-Verlag, 1997, pp210–218. 71, 72 [12] B. Sussman and K. Fogel: Chaffwin. ftp://ftp.red-bean.com/pub/chaffwin/chaffwin.tar.gz. 71 [13] UK Stationery Office Ltd: Regulation of Investigatory Powers Act 2000. ISBN 0-10-542300-9. 70, 73

Nothing But a Kiss: A Novel and Accurate Approach to Assessing the Performance of Multidimensional Distortion-Compensated Dither Modulation
Fernando P´erez-Gonz´alez and F´elix Balado Dept. Tecnolog´ıas de las Comunicaciones, ETSI Telecom University of Vigo, E-36200 Vigo, Spain {fperez,fiz}@tsc.uvigo.es

Abstract. A considerable amount of attention has been lately paid to a number of data hiding methods based on quantization, seeking to achieve in practice the results predicted by Costa for a channel with side information at the encoder. In this paper we analyze a multidimensional extension of the implementation of Costa’s result known as DC-QIM. The presented analysis is based on measuring the probabilities of decoding error in the presence of two important kinds of additive channel distortions. DC-QIM is able to achieve a probability of decoding error of less than 1e-02 for 0 dB of watermark to noise ratio and only 20 samples per hidden bit. Empirical results supporting our analysis are given both for synthetic data and real images.

1

Introduction

Quantization methods have been used used for information hiding purposes since the early times of research in watermarking. However, it was only very recently when the idea was reviewed from a solid theoretical perspective in the form of a data hiding scheme known as Quantization Index Modulation (QIM) that was proposed by Chen and Wornell in [7]. QIM hides information by constructing a set of vector quantizers Qb (·), each representing a different codeword b. Then, given a host vector x and an information codeword b, the embedder constructs the watermarked vector y by simply quantizing x with Qb (·), i.e. y = Qb (x). Later, a crucial connection with an old paper by Costa [10] was made by some researchers [8, 11] realizing that it was possible to implement a particular capacity-achieving scheme by following Costa’s guidelines. The main improvement over QIM was made by adding back a fraction of the quantization error to the quantized signal. This compensation scheme gave rise to what Chen and Wornell called Distortion Compensated QIM (DC-QIM).


Work partially supported by the Xunta de Galicia under projects PGIDT01 PX132204PM and PGIDT02 PXIC32205PN, the European project Certimark (Certification of Watermarking Technologies), IST-1999-10987, and the CYCIT project AMULET, reference TIC2001-3697-C03-01.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 87–105, 2003. c Springer-Verlag Berlin Heidelberg 2003


88

Fernando P´erez-Gonz´ alez and F´elix Balado

The original proposal of DC-QIM in [8] provides a general framework that can be readily adapted in order to use many existing structured vector quantizers. In particular, close attention was paid to a special case of QIM called Dithered Modulation (DM), which has the advantage of a very simple implementation when uniform quantizers are used. It was soon realized that QIM and its improvement DC-QIM could benefit from multidimensional extensions. Previously, there had been some efforts in the use of multidimensional quantization lattices like those of Chae et al. [5, 6], who used D4 and other quantization lattices [9] to implement several image and video data hiding algorithms. Actually, this scheme was a sort of multidimensional QIM, but nevertheless no performance analysis was given. Later on, and departing from their Scalar Costa Scheme (SCS) method —formally equivalent to DC-QIM—, Eggers and Girod [11] extended the unidimensional approach to a bidimensional one by using the optimal sphere-packing hexagonal lattice and ternary information symbols. They empirically showed that there is an implicit performance gain in the use of a new dimension. Finally, Brunk [3] considered the problem of estimating the capacity of very high dimensional QIM and DCQIM schemes, trying to find the limiting capabilities when adding further dimensions. Only small attacking distortions were allowed for the used approximations to hold. Chen and Wornell only sketched very roughly the performance of QIM as measured by the probability of decoding error in front of additive Gaussian noise [8]. Unfortunately, as showed in [16], approaches to assessing performance based on the so-called union bound fail for high distortion levels. The number of “kissing spheres” in the quantizer increases exponentially with dimensionality, thus largely overestimating the actual probability of decoding error. Recently, we have been able to produce very tight approximations for the probability of decoding error in the case of Dither Modulation (DM) data hiding and theoretically support its good performance. To the authors’ knowledge there does not exist a formal analysis for Multidimensional Distortion-Compensated QIM methods in terms of their probability of decoding error. In this paper, we take an important step in this direction by producing very accurate bounds for this probability in the particular case of DC-DM method. We will show how the multidimensional problem can be transformed into a one-dimensional one by adapting a technique recently discovered in the digital communications area that will allow us to reduce the number of kissing spheres that need be considered, down to a single one.

2

Problem Formulation

Let x be a vector containing the samples of the host signal (henceforth an image) that will convey the hidden information. Before the encoding stage, a perceptual mask vector α is computed from x in the domain where the samples are defined (e.g., spatial, DCT, etc), taking into account the characteristics of the human visual system (HVS). At each sample k, the maximum variance of the

Nothing But a Kiss: A Novel and Accurate Approach

89

modification in the host signal sample that renders it perceptually unchanged is proportional to α2 [k]. In order to keep the discussion simple, we will assume that we want to hide only one binary digit of information that we consider to be mapped to an antipodal symbol, b ∈ {±1}. In order to hide this symbol, a set S = {k1 , . . . , kL } of L key-dependent pseudorandomly chosen indices for the samples of x is employed. This way of choosing the indices allows us to assume statistical independence between the host signal samples. Also note that in the subsequent statistical analysis, if L is large, it is enough to consider the embedding of one bit: thanks to the pseudorandom selection of the host signal samples, if additional bits were to be encoded they would face, in average, exactly the same channel. A host signal of size N would allow us to hide N/L bits in the same way. The watermark w is produced from the desired binary information symbol b by using a certain function, w = gK (x, α , b), that we will detail in Sect. 3. Without loss of generality we will write the watermarked signal as the addition y=x+w .

(1)

An important issue when performing a rigorous analysis lies in the election of a proper measure for the so-called embedding distortion. A quite often used possibility is the global Mean-Squared Error (MSE) distortion that in the singlebit case is defined as 1
Dw = Var{w[k]} (2) L k∈S

where w[k] is a random process representing the watermark 1 . The MSE, appropriate as it is for measuring the total power devoted to the watermark, should be handled with extreme care if one wants to relate it to visibility constraints. In fact, bounding just the MSE seems to be inadequate for the data hiding problem, since it is not well-matched to the characteristics of the HVS. It is widely recognized that the masking phenomena affecting the HVS and exploited for the invisible embedment of information respond to local effects. All existing approaches to modeling distortions which are unnoticeable to the HVS take into account this fact, be it the Just Noticeable Distortion function (JND) [19] in the spatial domain, the Noise Visibility Function (NVF) [17] applicable to different domains or equivalent models in other domains of interest like the DCT [12]. Then, the main drawback encountered when posing an MSE constraint is that unacceptably high local distortions (from the perceptual perspective) could be globally compensated with very small local distortions in order to meet the established restriction. An alternative consisting in a weighted MSE is discussed in [14], but it should be clear that it suffers from the same global compensation effect. 1

This randomness may be due to the way in which the watermark depends on the host image, as happens for instance in the DC-QIM method, or on a pseudorandom sequence, as occurs in spread spectrum based schemes.

90

Fernando P´erez-Gonz´ alez and F´elix Balado

In view of the previous discussion it seems reasonable to restrict the local variance of the watermark so that global compensations are not possible and at the same time perceptual weighting is taken into account. This is achieved by means of the following set of constraints: Var{w[k]} ≤ c2 · α2 [k], for all k ∈ S

(3)

where c is a visibility constant.2 If the samples w[k] are such that their variances take their extremal values in (3), it is immediate to write Dw =

c2
2 α [k] L

(4)

k∈S

Therefore, it is important to note that simultaneously meeting the constraints in (3) automatically leads to a bound in the MSE, but the converse is not true, unless an extremely large value of the visibility parameter c is considered. This cannot occur if some structure is imposed on the watermark, such as w[k] = c · α[k], for all k ∈ S. 2.1

Channel Characterization

Before arriving to the receiver we assume that the watermarked signal undergoes an additive probabilistic channel independent of x, yielding a received signal z = y + n. This channel distortion models certain attacking operations. By virtue of the pseudorandom choice of the indices in S we may assume for the multidimensional case that the samples in n are also mutually independent, with diagonal covariance matrix Γ = diag(σn2 [k1 ], . . . , σn2 [kL ]). The channel distortion Dc is defined in a similar fashion as the embedding distortion, i.e., 1
2 Dc = σn [k] (5) L k∈S

Then, it will be useful to introduce the square-root ratio  ξ
Dw /Dc

(6)

that relates the power of embedding and channel distortions. In addition, we define the watermark-to-noise ratio as WNR = 20 log10 ξ. As before, if perceptual shaping is to be introduced in the noise distribution3 , a simple constraint on Dc in (5) will not be enough and rather a set of inequalities like that in (3) will become necessary. For the purposes of this paper, we 2

3

Note that our definition of α[k] differs from others in the literature (e.g., that in [13]) in that the visibility constant has been taken away. Of course, this is just a matter of convenience and does not alter the final results. Note that an attacker can compute the perceptual mask himself and shape the noise accordingly by making σ n proportional to α , but this will unlikely occur for unintentional attacks, so the two cases are possible.

Nothing But a Kiss: A Novel and Accurate Approach

91

will assume that the channel distortion will be limited by that resulting during the embedding procedure, i.e. Dc ≤ Dw . This choice is justified whenever the attacker wants to produce an image with at least an equivalent quality as the watermarked image. In fact, this is the basis for attacking algorithms such as perceptual remodulation [18]. Needless to say, the previous argument cannot be repeatedly invoked over a sequence of attacks because, eventually, the invisibility conditions would be violated. A much less conservative approach is taken for instance in [15], where Dc ≥ Dw under the reasoning that restoration of the original signal must be included in the range of possible modifications caused by the attacking distortion. Last, in [11] both ranges are considered. In any case, it is worth saying that the novel methodology here presented can be adapted with little modification for any range of WNR. Finally, regarding the probability distribution function (pdf) of the distortion, we will consider here two simple but illustrative cases: Gaussian and uniform. Gaussian channels have been extensively used in the previous work on this topic, see [8, 11, 15]. On the one hand, the Gaussian channel gives upper bounds to capacity and the optimal attack under global MSE distortion constraints. On the other hand, Gaussian distributions often appear with regard to unintentional attacks. As for the uniform pdf, we have chosen it for its simplicity that leads to tractable analytical expressions of performance. Note that by no means we intend to consider here the whole gamut of possible attacks and that the question of which noise channel distribution is the most harmful remains open.

3

Multidimensional Distortion-Compensated Dither Modulation

In this section we discuss the structure of multidimensional QIM, in which each dimension is separately quantized. As mentioned in the Introduction, we solely consider the QIM implementation by means of uniform dithered quantizers, commonly called dithered modulation (DM). Also, we investigate the gain that the use of distortion compensation may produce, as proposed by [8]. For these reasons we call the presented scheme “multidimensional distortion-compensated dither modulation” (DC-DM). In order to simplify the subsequent discussion, we will assume that the samples of the perceptual mask are constant, i.e., α[k] = α, for all k ∈ S. Wherever it is appropriate, we will give indications on how to adapt the method and its analysis to the more realistic case in which the samples of perceptual mask are variant. In DC-DM each binary information symbol b is hidden by using a L-dimensional uniform quantizer Qb (·) on the host image, obtaining the watermark as w = ν e,

(7)

i.e. the L-dimensional quantization error e
Qb (x) − x weighted by an optimizable constant ν, 0 ≤ ν ≤ 1. Considering (1) this is equivalent to choosing y as (8) y = Qb (x) − (1 − ν)e

92

Fernando P´erez-Gonz´ alez and F´elix Balado

Observe that when ν = 1 we have multidimensional uncompensated DM as a particular case. The uniform quantizers Q−1 (·) and Q1 (·) are such that the corresponding centroids are the points in the lattices Λ−1 = 2∆ZL + d L

(9) T

Λ1 = 2∆Z + d + ∆(1, . . . , 1)

(10)

with d an arbitrary vector that may be key-dependent so as to introduce an additional degree of uncertainty. Since the presence of a known offset d in the above description of the lattices does not alter the final results, we will assume ∗ from now on that d = 0
(0, . . . , 0)T . Notice that Λ−1 ∪ Λ1 ∼ , i.e. the dual = DL of the checkered or face centered cubic root lattice [9]. As for the statistical modeling of the watermark, note that if the quantization step is small enough we can consider each dimension of the quantization error e to be uniformly distributed over an L-dimensional cube with edge size 2∆, centered at the corresponding quantization centroid. From (7) this in turn implies that the watermark is also uniformly distributed in a cube with edge size 2ν∆. Thus, it is immediate to write the embedding distortion in (2) as Dw = ν 2 ∆2 /3. 3.1

Decoding and Decision Regions

Now let z = y + n be the watermarked image that has been corrupted by a noise vector n. Given z, decoding is accomplished by using a minimum Euclidean distance decoder ˆb = arg min z − Q (z)2 b −1,1

(11)

The decision regions associated to ˆb = −1 and ˆb = 1 are denoted by respectively R−1 and R1 . In the sequel we will also find useful to identify the decision regions associatedto each of the centroids in the lattices Λ−1 and Λ1 . To that end, let c ∈ Λ−1 Λ1 be any centroid, then we will denote by Sc the Voronoi cell associated to c, i.e.,    (12) Sc
z ∈ RL | z − c2 ≤ z − c 2 , ∀c ∈ Λ−1 Λ1 It follows immediately from definition (12) that  Sc , b = {−1, 1} Rb = c∈Λb

(13)

The centroids and decision regions R−1 and R1 for the case L = 2 are depicted in Fig. 1. The L-dimensional Voronoi cells Sc are generalized truncated octahedra [9]. We will find useful to denote by T0 the generalized octahedron that contains the origin and is limited by all the hyperplanes having the form:   ∆ T (14) v z− v =0 2

Nothing But a Kiss: A Novel and Accurate Approach

93

Λ−1 Λ1 2∆

Fig. 1. Centroids and decision regions (L = 2). where v is any vector such that v[k] ∈ {±1}, k ∈ S and z ∈ RL . These hyperplanes simply bisect the segments that connect the origin 0 and its nearest neighbors in Λ1 . Obviously, S0 ⊆ T0 , with equality only when L = 1, 2. Both regions are depicted in Fig. 2 for L = 3. Several geometrical properties will later allow us to obtain upper bounds to the decoding error probability: Property 1. [9] Let S0 be the Voronoi cell associated to the centroid at 0. Then,  for any other codeword c ∈ Λ−1 Λ1 , its decision region is such that Sc = S0 + c

(15)

Property 2. By construction, it follows that the set T0 is symmetric with respect to the coordinate planes. Property 3. [16] T0 ⊂ R−1 . 3.2

Non-constant Perceptual Mask

In the case where the perceptual mask is not constant and the embedding distortions in (2) are taken to their extremal values it is easy to see that the quantization step in each dimension ∆[k] should be now proportional to α[k]. This has the effect of stretching the regions R±1 and consequently the octahedron T0 . If the noise variance at each sample is proportional to α2 [k] (perceptually shaped noise), then it is possible to rescale both the octahedron and the noise by dividing by α[k] so that the original problem with a constant perceptual mask and independent indentically distributed (i.i.d.) noise is recovered.

94

Fernando P´erez-Gonz´ alez and F´elix Balado

Fig. 2. Regions S0 and T0 (L = 3) If the noise variance is not perceptually shaped (for instance, constant variance noise), then it is still possible to divide both the octahedron and the noise by α[k], so that the regular octahedron is recovered; however, now the rescaled noise samples will have different variance. Fortunately, the procedure sketched in App. A for the computation of an upper bound to the probability of decoding error can be easily adapted by noting that scaling a random variable has a well-known effect on its characteristic function.

4

Performance Analysis

The discussion on the decision regions made in the previous section allows us to undertake the performance analysis of DC-DM. In order to obtain the decoding error probability we may assume without loss of generality (Property 1) that a symbol b = −1 is sent, and that x is such that Q−1 (x) = 0. Considering the detector (11) we have that Pe = P {z ∈ R1 }

(16)

For the determination of Pe , one might be tempted to resort to the wellknown union bound with the 2L nearest neighbors of 0 belonging to Λ1 ; unfortunately, for moderate values of Dc /Dw and L the results become impractical due to the overlap between the different decision regions that result when only two centroids (i.e., c = 0 and its nearest neighbors c ∈ Λ1 ) are taken into account. On the other hand, consideration of a single nearest neighbor, as done in [8], produces overly optimistic results, as we will confirm later. For obtaining a useful upper bound we will follow a different and novel strategy. Making use of properties P. 1 and P. 3 from the previous section, it is possible to conclude that

(17) Pe ≤ Ps = P z ∈ T0 where T denotes the complement of T in RL .

Nothing But a Kiss: A Novel and Accurate Approach

95

Let u
n−(1−ν)e, then from the assumption Q−1 (x) = 0 and making use of (8), we can write z = u. Recalling that e has i.i.d. components, e[k] ∼ U (−∆, ∆), it follows that u will also have i.i.d. components, each having a pdf  1 fn (n[k]) ∗ (1−ν) fe (e[k]/(1 − ν)), 0 L∆/2 (19) = P u  > u − ∆ · (1, . . . , 1)T 2 = P k∈S 

where O is the positive orthant and u is an auxiliary random vector with i.i.d. components such that u [k]
|u[k]| whose pdf is  2fu (u [k]), u [k] > 0  fu
(u [k])
, k ∈ S. (20) 0, otherwise Now, let r=




u [k]

(21)

k∈S

Then the pdf of the random variable r is the convolution of L independent random variables with pdf fu
(u ) and from (17) Ps is the integral of its tail from L∆/2 to infinity. This arrangement allows to transform the L-dimensional problem into a unidimensional one. In fact, we have transformed a problem with 2L kissing spheres into another with just one neighbor, which then becomes tractable as we will see next. By the central limit theorem (CLT), as L → ∞, fr (r) tends to a normal curve. Then, for L very large, fr (r) can be approximated by a Gaussian pdf whose mean and variance would suffice to compute the desired probability as4   L∆/2 − E{r}  Ps ≈ Q (22) Var{r} Moreover, since the components of u are i.i.d., we can write E{r} = L · E{u } 

Var{r} = L · Var{u }

(23) (24)

It is important to remark that the approximation (22) should be taken with a grain of salt because the process of building the one-sided distribution u [k] 4

Q(x)


√1 2π

∞ x

e−x

2

/2

dx.

96

Fernando P´erez-Gonz´ alez and F´elix Balado

may produce highly skewed pdf’s whose sum converges very slowly to a Gaussian distribution as L increases [4]. If this is the case, the Gaussian approximation to Ps may underestimate the importance of the tails of fr (r) and give results that are not even an upper bound to the true Pe . In App. A we show a novel technique that can be used to overcome this problem, which is extremely useful for the Gaussian noise case. 4.1

Approximation with Uniform Noise

With i.i.d. noise components we have n[k] ∼ U (−η, η), k ∈ S, and for η ≥ (1 − ν)∆, the pdf of u [k] becomes 1 0 < u [k] ≤ η − (1 − ν)∆   η,  η+(1−ν)∆−u
[k] fu
[k] (u [k]) = , η − (1 − ν)∆ < u [k] ≤ η + (1 − ν)∆(25) 2(1−ν)∆η   0, otherwise while for η < (1 − ν)∆ this pdf is  1   (1−ν)∆ ,
 [k] fu
[k] (u [k]) = η+(1−ν)∆−u , 2(1−ν)∆η   0,

0 < u [k] ≤ (1 − ν)∆ − η (1 − ν)∆ − η < u [k] ≤ η + (1 − ν)∆(26) otherwise

which is obviously the same expression as (25) after swapping η and (1 − ν)∆. Even though it is possible to derive an analytical expression for Pe in this case, the exact result becomes quite involved and has little interest. For this reason we will analyze it using the Gaussian approximation described above. We also remark that under the assumption η ≤ ν∆ (or, equivalently, Dc < Dw ) for accomplishing the perceptual restrictions, the upper bound (22) becomes in this case a good approximation of Pe . This is due to the fact that the one-sided distribution (25) is highly localized [4]. Considering (23-24), we can compute the mean and variance of r for the case (25) as 3 η 2 + (1 − ν)2 ∆2 6η 3 η 4 + 6 η 2 (1 − ν)2 ∆2 − (1 − ν)4 ∆4 Var{r} = L 36 η 2 E{r} = L

(27) (28)

The same statistics in the case (26) become straightforwardly 3(1 − ν)2 ∆2 + η 2 6 (1 − ν)∆ 3(1 − ν)4 ∆4 + 6 η 2 (1 − ν)2 ∆2 − η 4 Var{r} = L 36 (1 − ν)2 ∆2 E{r} = L

(29) (30)

Nothing But a Kiss: A Novel and Accurate Approach

Then Pe can be approximated by    √ 2  −(1−ν)2 ξ 2 Q , L √ 43νξ−3ν  3ν +6ν 2 (1−ν)2 ξ 2 −(1−ν)4 ξ 4   Pe ≈ √  3ν(1−ν)ξ 2 −ν 2  L√ , Q 4 4 2 2 2 4 3(1−ν) ξ +6ν (1−ν) ξ −ν

97

ξ < ν/(1 − ν) (31) ξ ≥ ν/(1 − ν)

where in this case, it is possible to show that ξ = ν∆/η. It is possible to improve on the approximation (31) by considering that, if ν ≥ 1/2 then Pe = 0 when ξ ≥ ν/(ν − 1/2) because the pdf (25-26) has finite length. Also, as ξ is constrained to be greater than zero, errorless decoding can never happen for ν < 1/2 regardless the value of ξ. Evidently, there is a performance variability associated to the parameter ν controlling the distortion compensation. It is interesting to see that for ξ = 1 the probability of error can take the worst possible value, i.e. Pe = 0.5, when either ν = 1 or ν = 0. √ Also, note that the appearance of a factor L governing the asymptotic performance means that usage of many dimensions can be assimilated to a form of repetition coding, where this factor would be the coding gain. 4.2

Approximation with Gaussian Noise

Assume that n is a random vector with L i.i.d. components with zero mean and variance σg2 , that is     1 2 −L/2 −1 T exp − nΓ n fn (n) = 2πσg (32) 2 where Γ is the noise covariance matrix that takes the form Γ = σg2 I, with I the L×L identity matrix. Hence, the pdf of the random variable u[k] in (18) becomes the convolution of a zero-mean Gaussian random variable with variance σg with a random variable uniformly distributed in the interval (−(1 − ν)∆, (1 − ν)∆). Then, the pdf of u [k], k ∈ S in (20) becomes  
 
 1 Q u [k]−(1−ν)∆ − Q u [k]+(1−ν)∆ , u [k] > 0  (1−ν)∆ σ σ g g (33) fu
[k] (u [k]) = 0, otherwise Since the one-sided Gaussian distribution is highly skewed, CLT approximation to the bound Ps is only valid for very large L, as we have already discussed. Even for high values of L, say L = 100, the CLT approximation holds only for values of ξ close to one. On the other hand, this approximation becomes very simple to compute; for this reason and for the purpose of comparison, in Section 5 we give the results, noting that its practical utility is limited by the actual values of L and ξ. In this case, for using (22) it would be necessary to compute numerically (23) and (24). We must mention that the bound obtained √ by following this procedure is asymptotically tight as ξ → ∞, with ξ = ν∆/( 3σg ). In the limit, the probability that n falls in R−1 but not in T0 , becomes negligible.

98

Fernando P´erez-Gonz´ alez and F´elix Balado

The procedure for computing a true upper bound to Ps in the Gaussian case for moderate values of L is given in App. A. This procedure has been adapted from a technique originally proposed in the digital communications area, by Beaulieu in [1] and [2], which is suitable for analyzing the performance of equal gain diversity communications receivers in fading channels. The main advantage of reduction in the kissing numbers that we have shown in this Section is that from this point on we are able to exploit Beaulieu’s technique and provide very accurate bounds.

5

Experimental Results

Next, the theoretical probabilities of error obtained in previous sections are compared and validated against empirical data. Plots are presented for values of WNR starting at WNR = 0 dB (ξ = 1). First we can see in Figs. 3 and 4 the comparison of empirical data generated through Monte Carlo simulations with the theoretical predictions for the two considered types of noise distortion and for the case of perceptually shaped noise. Apart from the theoretical predictions given in this paper, we also depict in these figures the single-neighbor approximation that would follow from adapting the results in [8] as well as the corresponding union bound using the 2L nearest neighbors. We can see in Figs. 3 and 4 that the single-neighbor approach clearly underestimates the true Pe because it does not take into account the actual number of neighbors at such distance, that grows exponentially with dimensionality. On the other hand, it becomes evident that the union bound, that considers all aforementioned neighbors but disregards any overlapping between their respective decision regions, is much too loose to be useful, especially for low values of WNR. Regarding the theoretical predictions given in Sect. 4 we can see that the approximation using the CLT is acceptable for the uniform distortion, due to the finite length of this pdf. As we see in the case for ν = 0.5, in the midrange values of ν this approximation slightly underestimates the real Pe . This discrepancy is explained due to the fact that the Gaussian approximation of (21) is above the true pdf at the error event values. Concerning the Gaussian channel distortion, it is clear that the CLT approximation is not good anymore, as it had been previously warned. even though, it improves to become progressively tight for decreasing ν as predicted. However the prediction using our novel approach succeeds to tightly upperbound the probability of decoding error for any WNR. It is important to highlight that Beaulieu’s approach could be also applied to the uniform case to get even more reliable bounds. Is is remarkable that the lower the value of ν, the less important the pdf of noise. If we compare the plots for ν = 0.5 we see that they are practically identical, while for the ν = 0.8 case there is a notable difference between uniform and Gaussian noise. Last, we have numerically computed what value of ν yields the optimum performance for ξ = 1, that is in both cases ν = 1/2.

Nothing But a Kiss: A Novel and Accurate Approach

99

0

10

Empirical Theoretical Union Bound Single neighbor

−2

10

−4

Pe

10

−6

10

−8

10

−10

10

−12

10

0

1

2

3

4

5

6

WNR (dB) (a) ν = 0.50 2

10

Empirical Theoretical Union Bound Single neighbor

0

10

−2

10

−4

10

−6

Pe

10

−8

10

−10

10

−12

10

−14

10

−16

10

0

1

2

3

4

5

6

WNR (dB) (b) ν = 0.80

Fig. 3. Monte Carlo simulation, uniform noise, L = 20

Next, in Fig. 5 we confirm the previous Monte Carlo results using a real implementation of DC-DM. The host signal x chosen is the well-known Lena image (256×256), and the embedding takes place in the spatial domain. The perceptual mask α is computed using the method proposed in [13] with a visibility factor c = 1, which happens to be very conservative. In Fig. 5 Gaussian noise is used as the channel distortion and two cases are considered for the noise variance:

100

Fernando P´erez-Gonz´ alez and F´elix Balado

(a) locally proportional to the perceptual mask energy; (b) equal to its average value. The theoretical bounds are depicted using the respective approximations derived in App. A. Some practical aspects are taken into account in the tests shown here. First, after embedding the watermark, y is quantized to integer values and limited between [0, 255] in order to produce a real image. Second, the decoder obtains

0

10

Theoretical (App. A) Theoretical (Gauss) Empirical Union Bound Single Neighbor

−2

10

−4

Pe

10

−6

10

−8

10

−10

10

−12

10

0

1

2

3

4

5

6

WNR (dB) (a) ν = 0.50 2

10

Theoretical (App. A) Theoretical (Gauss) Empirical Union Bound Single Neighbor

0

10

−2

10

−4

10

−6

Pe

10

−8

10

−10

10

−12

10

−14

10

−16

10

0

1

2

3

4

5

6

WNR (dB) (b) ν = 0.80

Fig. 4. Monte Carlo simulation, Gaussian noise, L = 20

Nothing But a Kiss: A Novel and Accurate Approach

101

−1

10

Theoretical Empirical

−2

10

−3

10

−4

Pe

10

−5

10

−6

10

−7

10

−8

10

0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

5

WNR (dB) (a) Perceptually shaped noise −1

10

Theoretical Empirical

−2

10

−3

10

−4

Pe

10

−5

10

−6

10

−7

10

−8

10

0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

5

WNR (dB) (b) Non-perceptually shaped noise

Fig. 5. Real DC-DM implementation using Lena image, Gaussian noise, ν = 0.70, L = 20

the perceptual mask from z without knowing x. This provokes that the α used by the decoder be just an approximation to the one used by the encoder. Finally, in Fig. 6 we consider the effect of applying Wiener filtering to the watermarked image. We can see that the result of this linear filter is more in-

102

Fernando P´erez-Gonz´ alez and F´elix Balado

0

10

Wiener Filtering, Empirical Gaussian Noise, Theoretical −2

10

−4

Pe

10

−6

10

−8

10

−10

10

−12

10

−2

0

2

4

6

8

10

WNR (dB)

Fig. 6. Real DC-DM implementation using Lena image, Wiener filtering, ν = 0.50, L = 20

jurious than just adding Gaussian noise with the same power. This leaves the door open to theoretically analyzing the performance of DC-QIM to other types of channel distortion which may be more harmful.

6

Conclusions

In this paper we have given a theoretical analysis together with empirical verifications on the attainable performance of multidimensional DC-DM using uniform quantizers. Gaussian and uniform random additive attacks were considered. Improvements could be expected if other lattices than the one employed were used. In general, these lattices would lead to a problem non-separable in each one of the dimensions, and therefore harder to solve. Anyway better options for multidimensional methods using quantization are actually known to be available. Specifically, further improvements are possible using quantized projections like Spread-Transform Dither Modulation (STDM) [8] or Quantized Projection (QP) [16]. These projections reduce the number of “kissing points” for the same embedding energy and thus make it possible to diminish the probability of error. For instance, preliminary tests show that QP would be able to overcome the performance of the optimum sphere-packing scheme for L = 2, i.e. the A2 hexagonal lattice, using host signal and attacking distortion with Gaussian statistics.

Nothing But a Kiss: A Novel and Accurate Approach

103

References [1] Norman C. Beaulieu. An infinite series for the computation of the complementary probability distribution function of a sum of independent random variables and its application to the sum of Rayleigh random variables. IEEE Trans. Commun., 38(9):1463–1474, September 1990. 98, 104, 105 [2] Norman C. Beaulieu and Adnan A. Abu-Dayya. Analysis of equal gain diversity on Nakagami fading channels. IEEE Trans. Commun., 39(2):225–234, February 1991. 98 [3] Hugh Brunk. Quantizer characteristics important for quantization index modulation. In Ping Wah Wong and Edward J. Delp, editors, Security and Watermarking of Multimedia Contents III, volume 4314 of Proc. of SPIE, pages 686–694, San Jos´e, USA, January 2001. 88 [4] K. V. Bury. Statistical Models in Applied Science. Robert E. Krieger Publishing Company, Malabar, Florida, 1975. 96 [5] J. J. Chae, D. Mukherjee, and B. S. Manjunath. A robust data hiding technique using multidimensional lattices. In Procs. of the IEEE Forum on Research and Technology Advances in Image Processing, pages 319–326, Santa B´ arbara, USA, April 1998. 88 [6] J. J. Chae, D. Mukherjee, and B. S. Manjunath. Color image embedding using multidimensional lattice structures. In Procs. of the IEEE Intnal. Conference on Image Processing (ICIP’98), volume 1, pages 460–464, Chicago, USA, October 1998. 88 [7] Brian Chen and Gregory W. Wornell. Provably robust digital watermarking. In Proc. of SPIE, volume 3845 of Multimedia Systems and Applications II, pages 43–54, San Jos´e, USA, 1999. 87 [8] Brian Chen and Gregory W. Wornell. Quantization index modulation: A class of provably good methods for digital watermarking and information embedding. IEEE Trans. on Information Theory, 47(4):1423–1443, May 2001. 87, 88, 91, 94, 98, 102 [9] J. H. Conway and N. J. A. Sloane. Sphere Packings, Lattices and Groups, volume 290 of Comprehensive Studies in Mathematics. Springer, 3rd edition, 1999. 88, 92, 93 [10] Max H. M. Costa. Writing on dirty paper. IEEE Trans. on Information Theory, 29(3):439–441, May 1983. 87 [11] Joachim J. Eggers, Jonathan K. Su, and Bernd Girod. A blind watermarking scheme based on structured codebooks. In Proc. of IEE Conf. on Secure Images and Image Authentication, London, UK, April 2000. 87, 88, 91 [12] Juan R. Hern´ andez, Mart´ın Amado, and Fernando P´erez-Gonz´ alez. DCT-domain watermarking techniques for still images: Detector performance analysis and a new structure. IEEE Trans. on Image´ aProcessing, 9(1):55–68, January 2000. Special Issue on Image and Video Processing for Digital Libraries. 89 [13] Juan R. Hern´ andez, Fernando P´erez-Gonz´ alez, and Jos´e M. Rodr´ıguez. Coding and synchronization: A boost and a bottleneck for the development of image watermarking. In Proc. of the COST #254 Int. Workshop on Intelligent Communications, pages 77–82, L’Aquila, Italy, June 1998. SSGRR. 90, 99 [14] Pierre Moulin and M. Kivan¸c Mıh¸cak. The data hiding capacity of image sources. June 2001. 89

104

Fernando P´erez-Gonz´ alez and F´elix Balado

[15] Pierre Moulin and Joseph A. O’Sullivan. Information-theoretic analysis of information hiding. January 2001. 91 [16] Fernando P´erez-Gonz´ alez, F´elix Balado, and Juan R. Hern´ andez. Performance analysis of existing and new methods for data hiding with known host information in additive channels. November 2001. Submitted to IEEE Transactions on Signal Processing. 88, 93, 102, 105 [17] Sviatoslav Voloshynovskiy, Alexander Herrigel, Nazanin Baumg¨ artner, and Thierry Pun. A stochastic approach to content adaptive digital image watermarking. In 3rd International Workshop on Information Hiding, Desden, Germany, October 1999. Springer-Verlag. 89 [18] Sviatoslav Voloshynovskiy, Shelby Pereira, Alexander Herrigel, Nazanin Baumg¨ artner, and Thierry Pun. Generalized watermark attack based on watermark estimation and perceptual remodulation. In Ping Wah Wong and Edward J. Delp, editors, Electronic Imaging 2000: Security and Watermarking of Multimedia Content II, volume 3971 of SPIE Proceedings, San Jos´e, USA, January 2000. 91 [19] Raymond B. Wolfgang, Christine I. Podilchuk, and Edward J. Delp. Perceptual watermarks for digital images and video. Proceedings of the IEEE, 87(7):1108– 1125, July 1999. 89

A

True Upper Bound with Gaussian Noise

We start by defining the normalized random variable m[k]
u [k]/σg , that allows us to rewrite (19) as √
Lξ 3 , (34) m[k] > Ps = P 2ν k∈S

where ξ takes the same form as in the previous section. Considering (33), the one-sided normalized random variable m[k] has the following pdf   1 Q (m[k] − µ) − Q (m[k] + µ) , m[k] > 0 fm[k] (m[k]) = µ (35) 0, otherwise where, for convenience, we have defined µ


(1 − ν)∆ σg

(36)

In order to compute Ps from its definition in (34) the characteristic function M (ω) of m[k] has to be first obtained. Let ωl = 2πl/T for any positive integer l and with T a sufficiently large real number. Then, following [1], Ps may be calculated as Ps ≈

∞ 2
|M (ωl )|L sin(Lθ(ωl )) 1 + 2 π l=1 l l odd

(37)

Nothing But a Kiss: A Novel and Accurate Approach

105

where θ(ω) is defined as √ ξ 3 θ(ω)
arg{M (ω)} − ω 2ν

(38)

and arg(x) denotes the four-quadrant phase of the complex number x. The series in (37) is pointwise convergent with an accuracy that depends on the value of T . A greater accuracy is obtained for larger values of T but this requires truncation to more terms in the series for a practical implementation. When the noise variance is not perceptually shaped, (19) remains valid after the rescaling procedure explained in Sect. 3.2. As already noted, in this case the variance of u [k] is different for each k; it is straightforward to see that the characteristic functions of these random variables can be written as Uk (ω) = M (ω σn [k]/α[k]). Now the calculation of Ps is made, following [1], as ∞ 2
1 Ps ≈ + 2 π l=1

 k∈S

 |Uk (ωl )| sin( k∈S φk (ωl )) l

(39)

l odd

where φk (ω) is defined as φk (ω)
arg{Uk (ω)} − ω ∆/2

(40)

It only remains the calculation of M (ω), which can be shown to be [16] M (ω) = e−ω

2

/2 sin(µω)

µω       1 −µ + jω µ −ω 2 /2 −jµω √ +j Re e Φ Φ √ +e µω 2 2

with Φ(·) the error function with complex argument.

(41)

Robustness and Efficiency of Non-linear Side-Informed Watermarking Gu´enol´e C.M. Silvestre1 , Neil J. Hurley1 , and Teddy Furon2 1

University College Dublin, Belfield, Dublin 4, Ireland {guenole.silvestre,neil.hurley}@ucd.ie 2 IRISA, INRIA, Rennes, France [email protected]

Abstract. A number of new non-linear watermark detectors have been proposed recently [1, 2, 3] in which the watermark detection statistic is an nth order polynomial function of the extracted vector. Coupled with a side-informed watermark embedding scheme that selects a watermark to maximise the detection output, it has been shown that hypothesis tests using such detectors are highly efficient. This paper presents further analysis of these non-linear schemes, focusing in particular on the robustness of the schemes in the presence of noise and the use of periodic filtering functions in order to reduce interference from the host signal.

1

Introduction

Watermark embedding in multimedia contents proceeds by extracting a vector of features r from the original content and mixing that vector with a watermark signal w, to produce a watermarked vector rw . The watermarked vector is embedded back into the contents by inverting the extraction process. The object of watermark detection is to reliably detect the presence of the watermark signal in watermarked contents. Most state-of-the-art watermarking schemes are blind and symmetric. In blind schemes, decoding is achieved without recourse to the original signal. In symmetric schemes, the embedding of watermark information depends on a private key which is also available at the detector. Spread-spectrum watermarking [4, 5] is the most common form of blind, symmetric watermarking. A pseudo-random signal, z, is modulated on the original contents and detection relies on an hypothesis test based on the correlation of the received signal with z. Hence, the signal z can be considered as a private key, which must be available to both the embedder and detector. It was widely believed that, with the assumption that the original vectors are Gaussian, the optimum scheme was spread spectrum (SS) with a correlation detector. However, in [1] it was shown that this is not the case and a new class of watermarking schemes was proposed that use side-information to maximise the power of the detector. Recent work has focused on the development of asymmetric watermarking schemes (e.g. [6, 7]) in which detection does not rely on the same private keys F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 106–119, 2003. c Springer-Verlag Berlin Heidelberg 2003


Robustness and Efficiency of Non-linear Side-Informed Watermarking

107

used to embed the mark. This work has lead to the investigation of detection schemes in which the detection statistic is a non-linear function of the extracted vector. In fact, Furon [8] showed that most asymmetric schemes proposed to date are second-order schemes, in that the detector determines the presence of the watermark by calculating a quadratic form on the extracted vector. With an aim towards increased efficiency and robustness, we have investigated even higher order detection schemes. By choosing the watermark signal to maximise the detection power, it is possible to achieve greater efficiency with our high-order schemes. These schemes out-perform spread-spectrum in the sense that, for a given watermark to signal power ratio and given embedded bit-rate, they result in detectors which have a greater probability of good detection (i.e. lower bit error rate). We examine two classes of side-informed detection schemes which we call JANIS [1] and POWER-n [3]. In particular, we focus on a robustness analysis of the high-order schemes. We present a first order theoretical analysis of the schemes in the presence of AWGN and validate this analysis with some experimental results. Furthermore, we investigate the use of filtering functions to boost the watermark to signal power ratio. The filtering functions are bounded, periodic mappings of the signal components. Filtering is applied by the detector and serves to reduce the variance of the input signal. The result is that the relative strength of the embedded watermark is increased. We show how filtering can be applied in conjunction with the side-informed watermark embedding to produce very powerful detection schemes.

2

Watermark Embedding and Detection

The first stage of watermark embedding is to extract an N -dimensional feature vector r from the original cover data, X, using an extraction function e, e(X, k) = r .

(1)

which typically extracts coefficients of some transform of the data. The secret key k is provided for security and is known to both the embedder and detector. The extraction process is invertible in the sense that there is an associated embedding process m(X, r) such that m(X, e(X, k)) = X .

(2)

Given an embedding strength, g, an N -dimensional watermark vector w is mixed with the feature vector r. Without loss of generality, we assume an additive mixing function, F (r, gw) = r + gw (3) where the watermark w is normalised to unit power. The watermarked content, Xw is then obtained via the embedding process: Xw = m(X, F (r, gw)).

(4)

108

Gu´enol´e C.M. Silvestre et al.

˜ proceeds by extracting Detection of the watermark from a received content X, ˜ the feature vector r = e(X). We consider detectors that calculate a real-valued detection function d(.) of the feature vector. The watermark is determined to be present if d(r) > thr , (5) for some threshold value thr. In Spread Spectrum (SS) watermarking, the detection function, d(r) = w.r is first order in the components of the feature vector. In this paper, we consider higher-order detection functions.

3

Detection Power and Efficiency

Given a significance level pf a, the threshold value thr is set to ensure that the probability of false alarm is greater than pf a. In the following, we consider r to be a set of N iid random variables. Let Q0 be the centred and normalised cdf of the detection function d under the null hypothesis H0 that the watermark is not present and let Q1 be the centred and normalised cdf of d under the alternative hypothesis H1 . Let µ0 , σ0 (resp. µ1 , σ1 ) be the mean and standard deviation of the detection function under H0 (resp. H1 ). Then, pf a = P (d > thr|H0 ) thr − µ0 ) = 1 − Q0 ( σ0 thr = σ0 Q−1 0 (1 − pf a) + µ0

(6) (7) (8)

The probability of good detection, or power of the test, is thr − µ1 ) σ1 σ0 (1 − pf a) − e) = 1 − Q1 ( Q−1 σ1 0

P (d > thr|H1 ) = 1 − Q1 (

(9) (10)

where the efficiency e is defined as e=

µ1 − µ0 . σ1

(11)

As Q1 is an increasing function, increasing the efficiency results in increasing the power.

4

Maximising the Power of Detection Using Side-Information and Filtering

Our goal is to build watermark embedding strategies and detection functions which maximise the power of detection. Let G = g 2 /σr2 be the watermark to

Robustness and Efficiency of Non-linear Side-Informed Watermarking

109

signal power ratio. In general, the value of the detection function is dependent on the embedding strength, G. The power function, p(G) = P (d(G) > thr|H1 )

(12)

gives the probability of correctly detecting the watermark given that the data is watermarked with embedding strength G and is in general an increasing function of G. 4.1

A Side-Informed Embedding Strategy

Given a detection function, in [1], it is shown that the watermark signal which maximises the power of the detector is w = k  ∇d(r) ,

(13)

where  denotes the component by component product and the vector k is chosen to normalise the power of w. Assuming that d is chosen such that the expected value E{d(h(r))} = 0, then, with the above choice of w, under hypothesis H1 that the watermark is present, the expected value of the output of the detector   
N ∂d is g i=0 E ( ∂ri (r))2 to the first order. 4.2

Filtering

Consider detection functions of the form d(r) = D(h(r))

(14)

where h is a non-linear mapping of the components of the received signal, h : ri → h(ri ) and h(r) is the vector which results in applying h(.) component-wise to r. We refer to h(.) as a filtering function. Its purpose is to reduce the variance of the input vector and hence increase the effective watermark to signal ratio. If we filter too much, then we run the risk of filtering out the watermark. However, our experiments have shown that filtering can significantly boost the power of detection. With filtering, Equation 13 becomes w = k  [ h (r)  ∇d(h(r)) ] .

(15)

Since, provided g is small, h(r + gw) ≈ h(r) + gh (r)w

(16)

the result of applying h(.) is that the effective watermark to signal power ratio is now approximately g 2 E{h2 }/σh2 . Various filtering functions can be used to define a tradeoff between robustness to external noise and capacity. Setting the watermarking signal to the gradient of a filtered signal ensures that only a limited amount of interference is

110

Gu´enol´e C.M. Silvestre et al.

introduced by the host signal. In fact, the use of periodic functions such as h(ri ) = sin(2πri /∆) is somewhat similar to watermarking methods based on quantisation [9, 10] and was also proposed in another context in [11]. The parameter pair (g, ∆) is then used in the same way as in the SCS method by Eggers et al. [9]. 4.3

Non-linear Detectors

From Section 4.1, we have a method for generating a watermarking signal to maximise the output of a given detection function. However, what is the best detection function? Consider the class of nth order polynomials of the input vector. A general nth order detector can be written as  iN dn (r) = ai1 ,...,iN r1i1 r2i2 . . . rN , (17)
N where the order n= k=1 ik . Initially, we consider the case where the highest power of any component of r is one and distinguish one particular subclass of such detectors, which we call JANIS. Next we investigate another subclass, called POWER-n, where one component of r is raised to the highest possible power.

5 5.1

Efficiency of Polynomial Detectors JANIS: nth Order Detection Using First Degree Polynomials

In the case where √ max (i1 , . . . , iN ) = 1, it has been shown [3] that the maximum efficiency is nN G to first order. One such class of first degree polynomial detectors is the JANIS class which has been presented in [1] and which use a detection function of the form d=

N/n n 

rij

(18)

i=1 j=1

where the N vector components have been partitioned into N/n groups of n indices labelled i1 · · · in . A complete expression for the mean and standard deviation of the JANIS detector can be found in [1]. Here, we give a first-order approximation. Under hypothesis H1 that the watermark is present, the mean of the detector is given by, √ (19) E{D|H1 } = N σrn G , and the variance of the detector is as follows: V {D|H1 } =

N 2n σr (1 + nG(M4n−1 + 2(n − 1)M4n−2 − n)) , n

(20)

Robustness and Efficiency of Non-linear Side-Informed Watermarking

111

where Mk is the k th moment of the normalised distribution of r. Hence, to first order, the efficiency is  nGN e= . (21) 1 + nG(M4n−1 + 2(n − 1)M4n−2 − n) 5.2

POWER-n: nth Order Detection Using Higher Degree Polynomials

Consider an nth order detector of the following form: 

N/2

d(r) =

rin−1 rj

(22)

i=1

where j is a randomly chosen index, which is matched with each index i. Assuming that r is drawn from a distribution which is symmetric about the origin, then E{d} is zero for even values of n. Here we examine the case of an nth order detector where the power of a component is raised as much as possible. Rather than simply raising a single component to the nth power, we pair two components together for two reasons. Firstly, we achieve security (the detector requires a private key which determines the random pairing of the components). Secondly, the pairing ensures that both the detector and the derived watermark have zero mean. Using the side-informed watermarking method, when the watermark is present, as a first approximation, the mean of the detector is given by

N n √  σr G M2n−2 + (n − 1) M2n−4 2 The variance of d can be written as E{d|H1 } =

V {d|H1 } =

(23)

 N 2n −2 σ M2n−2 1 + G M4n−4 M2n−2 + 2 r −1

−3

2 2 M2n−2 + 2(2n − 2)M4n−6 M2n−4

−1 −1 M2n−2 (n − 1)(2n − 3)M4n−8 M4 M2n−4 −1 −(n − 1)2 M2n−4 M2n−2 − 1

−1

2 2 2(n − 1)M2n−4 M2n−2 −1

 (24)

Hence, the dominant term of the efficiency of the POWER-n detector is given by:     GN M2n−4 e

1 + (n − 1) (25) 2 M2n−2 For some distributions, this leads to a higher efficiency than obtained for the JANIS detectors. For example, if r is uniformly distributed, then e ≈ n GN/6.

112

Gu´enol´e C.M. Silvestre et al.

However, this approximation only holds while G and n are small. We can expect the power of the detector to deteriorate for large values of n. A similar scheme can be devised for odd values of n, for example 

N/3

D(r) =

rin−2 rj rk .

(26)

i=1

6

Robustness to Additive Noise

Write the noise as γn where n is drawn from a Gaussian distribution with zero mean and unit variance and γ is the strength of the noise, so that K = [γ/σr ]2 is the noise to signal power ratio. With noise included and taking only terms to order K, the variance of the JANIS detector is increased by N σr2n K. The variance of the POWER-n detector is increased by N 2n σ K (M2n−2 + (n − 1)(2n − 3)M2n−4 ) . 2 r

(27)

Hence, in the case of the POWER-n detector, the contribution of additive noise to the variance of the detector is scaled by a factor proportional to n2 . We can expect the detector to become more sensitive to noise as n is increased.

7

Filtering Functions

The function h(r) processes the raw extracted vector to remove some of its variance. Hence, h(r) is typically a non-linear periodic function, which maps onto a closed interval around zero. We propose three different periodic functions of period ∆: hSAW (r) = r − ∆ round(

r ) ∆

 r r

hCTS (r) = r − ∆ round( ) sign(sin(π )) ∆ ∆

(28) (29)

r ∆ sin(π ) (30) 2 ∆ If the period ∆ is small, then h(r) is approximately uniformly distributed with variance σh(r) 2 = ∆2 /12. Note that in order for the first order approximation of Equation 15 to apply, the embedding strength g must be small relative to h(r) and hence we require ∆  g. If this is not the case, then errors occur whenever the watermark extends beyond the ∆-interval containing the component to which it is added. This error is most severe in the case of hSAW and hence this is expected to perform less well than the other filters. Moreover, for small values of ∆, the filtered vector is hSINE (r) =

Robustness and Efficiency of Non-linear Side-Informed Watermarking

113

orthogonal to the original vector and thus the filtering process greatly reduces host interference. Since filtering tends to produce a h(r) which is approximately uniformly distributed, we expect that the POWER-n detector is appropriate for filtered signals. On the other hand, high orders of n are only appropriate when G is sufficiently small. Since filtering boosts G, it may not be necessary to go to high orders of the detector for robustness. There is clearly a trade-off between the amount of filtering carried out and the order (and type) of detector to use.

8

Simulation Results

The nth order watermarking schemes described above have been tested for vectors r drawn from uniform and normal random distributions. The experimental efficiency is calculated on a large set of trials and used in Equation 9 to generate a power function and ROC plot. It is assumed that the detector is normally distributed, which is justified by the fact that it is a sum of independent identically distributed random variables. Fig. 1 and 2 show the power functions and ROC curves of the JANIS and POWER-n detectors when N =2500, Pf a =10−4 and the extracted vector is uniformly distributed. The performance of the POWERn detector increases with n up to n = 14 and works well down to G = −34 dB in this case. Performance of the JANIS detector improves up to n = 6, but is much less powerful than the POWER-n detector. As expected, for both schemes, a deterioration is observed for large values of n. When the distribution is normal (Fig. 3) JANIS out-performs POWER-n. However, in practise, when r is passed through the periodic filtering function, the output distribution tends to the uniform case. The BER is plotted against different levels of WNR in Fig. 4. Although the noise term in the efficiency is scaled by factors proportional to n for both JANIS and the POWER-n detectors, they are still quite robust to noise, with the POWER-n detector performing well to WNR=-10dB. The effect of filtering is clearly shown in Figure 5. With filtering applied, the detector performs well down to G = −40 dB at order n = 2. This is due to the fact that the effective watermark to signal ratio is boosted by filtering. The relative performance of the different filtering functions is demonstrated in Fig. 6. As expected, hSAW fails at the simulated value of ∆.

9

Conclusions

Two classes of watermarking schemes have been presented which employ an nth order detection process. The optimal value of n depends on the distribution of the received signal and the watermark embedding strength. Furthermore, we have introduced a filtering process which increases the effective watermark to signal ratio by a factor proportional to the inverse square of the filtering period ∆. Similarly to spread-spectrum schemes, the robustness of these schemes to noise is dependent on the length of the extracted vector and good robustness is

114

Gu´enol´e C.M. Silvestre et al. 1

0.8 n=2 Exp n=2 Th n=4 Exp n=4 Th n=6 Exp n=6 Th n=8 Exp

Pp

0.6

0.4

0.2

0 -40

-38

-36

-34

-32

-30 -28 G in dB

-26

-24

-22

-20

(a) 1

0.8 n=2 Exp n=2 Th n=4 Exp n=4 Th n=6 Exp n=6 Th n=10 Exp n=14 Exp

Pp

0.6

0.4

0.2

0 -40

-38

-36

-34

-32

-30 -28 G in dB

-26

-24

-22

-20

(b)

Fig. 1. Experimental (dotted lines) and theoretical (plain lines) power functions for (a) a JANIS detector and (b) a POWER-n detector with Pf a =10−4 and uniformly distributed signal

achieved down to a WNR of -10 dB at a vector length of 2500. Future work will investigate an optimal setting of the values of ∆, n and G for a given distribution.

Acknowledgements This project is supported by Enterprise Ireland Strategic Research Grant ST/2000/107/Y.

Robustness and Efficiency of Non-linear Side-Informed Watermarking

115

0

10

Pp

n=2 Exp n=2 Th n=4 Exp n=4 Th n=6 Exp n=6 Th n=10 Exp n=14 Exp

-1

10 -8 10

10

-7

10

-6

-5

10

-4

10 Pfa

-3

10

-2

10

-1

10

0

10

(a) 0

10

Pp

n=2 Exp n=2 Th n=4 Exp n=4 Th n=6 Exp n=6 Th n=8 Exp

-1

10 -8 10

10

-7

-6

10

-5

10

-4

10 Pfa

-3

10

-2

10

-1

10

0

10

(b)

Fig. 2. Experimental (dotted lines) and theoretical (plain lines) ROC curves of (a) a JANIS detector and (b) a POWER-n detector for G=-26 dB and uniformly distributed signal

116

Gu´enol´e C.M. Silvestre et al.

1

0.8 n=2 Exp n=2 Th n=4 Exp n=6 Exp n=8 Exp

Pp

0.6

0.4

0.2

0 -40

-38

-36

-34

-32

-30 -28 G in dB

-26

-24

-22

-20

(a) 1

0.8 n=2 Exp n=2 Th n=4 Exp n=6 Exp n=8 Exp

Pp

0.6

0.4

0.2

0 -40

-38

-36

-34

-32

-30 -28 G in dB

-26

-24

-22

-20

(b)

Fig. 3. Experimental (dotted lines) and theoretical (plain lines) power functions for (a) a JANIS detector and (b) a POWER-n detector with Pf a =10−4 and normally distributed signal

Robustness and Efficiency of Non-linear Side-Informed Watermarking

117

0

10

-1

10

-2

10

n=4 POWERn n=6 POWERn n=2 JANIS n=4 JANIS

-3

10

-4

10 -20

-15

-10

-5

0

5

Fig. 4. BER against WNR for G=-26 dB, N=2500 and Pf a =10−4

1

0.8

D=0.22 D=0.33 D=0.50 D=0.75 D=1.15 D=1.74 D=2.63 no filtering

Pp

0.6

0.4

0.2

0 -50

-47

-44

-41

-38

-35 -32 G in dB

-29

-26

-23

-20

Fig. 5. Power functions for different values of ∆ using hCTS and the POWER-n detector with n = 2 and Pf a = 10−4

118

Gu´enol´e C.M. Silvestre et al. 1 Sine D=1.74 Continuous D=1.74 Saw-Tooth D=1.74

0.8

Pp

0.6

0.4

0.2

0 -50

-47

-44

-41

-38

-35 -32 G in dB

-29

-26

-23

-20

Fig. 6. Power functions for fixed ∆ and different filtering functions

References [1] T.Furon, G.Silvestre, N.Hurley, “JANIS: Just Another N-Order Side-Informed Scheme” in Proceedings of ICIP 2002, Oct 2002. 106, 107, 109, 110 [2] N. J. Hurley, G. C. M. Silvestre, “Nth Order Audio Watermarking” in Proceedings of SPIE 2022, Jan 2002. 106 [3] N. J. Hurley, G. C. M. Silvestre and T. Furon, “Side-Informed Watermarking using Nth-Order Polynomial Detectors”, in Proceedings of EUSIPCO 2002, 2002. 106, 107, 110 [4] I. Cox, J. Kilian, T. Leighton, and T. Shannon, “Secure spread sprectrum watermarking for multimedia,” IEEE Transactions on Image Processing 6(12), pp. 1673–1687, 1997. 106 [5] F. Hartung and B. Girod, “Watermarking of uncompressed and compressed video,” Signal Processing 66(3), pp. 283–301, May 1998. 106 [6] J. Eggers, J. Su, and B.Girod, “A blind watermarking scheme based on structured codebooks,” in IEE Colloquium on Secure Images and Image Authentication, pp. 41–46, (Savoy Place London), April 10 2000. 106 [7] T. Furon and P. Duhamel, “An asymmetric public detection watermarking technique,” in Workshop on information hiding, (Dresden, Genmany), Oct. 2000. 106 [8] T. Furon, I. Venturini, and P. Duhamel, “Unified approach of asymmetric watermarking schemes,” in Security and Watermarking of Multimedia Contents III, Proc. SPIE 4313, 22-25 January 2001. 107 [9] J. Eggers, J. Su, and B.Girod, “Asymmetric watermarking schemes,” in Tagungsband des GI Workshops Sicherheit in Mediendaten, Springer Reihe: Informatik Aktuell, (Berlin, Germany), Sept. 2000. 110 [10] B. Chen and G. Wornell, “Dither modulation: a new approach to digital watermarking and information embedding,” in Security and Watermarking of Multimedia Contents, Proc. SPIE 3657, January 1999. 110

Robustness and Efficiency of Non-linear Side-Informed Watermarking

119

[11] M. Ramkumar and A. N. Akansu, “Self-noise suppression schemes for blind image steganography”, in SPIE Multimedia Systems and Applications (Image Security) 3845, Boston, MA, Sept. 1999. 110

Security of Public Watermarking Schemes for Binary Sequences Qiming Li and Ee-Chien Chang School of Computing National University of Singapore {liqm,changec}@comp.nus.edu.sg

Abstract. In this paper, we focus on the security aspect of public watermarking schemes. Specifically, given a watermarked sequence I
, we consider smart attackers whose task is to find a non-watermarked sequence I
using as few calls to the publicly available detection routine as possible. We restrict the media to binary sequences and use Hamming distance as the measure. We study a class of watermarking schemes and give an attacker who uses expected O(d(1 + log(n/k))) calls to find such I
, where d and k are determined by the false alarm and distortion of the scheme, and n is the length of the sequence. This attacker is optimal when k = o(n). By taking the number of calls required as a measure of the security, we can trade-off the requirements on security, false alarm and distortion.

1

Introduction

We consider the “public watermarking scheme” [7]. Under this setting, the detection routine is a black box accessible to the public, including the attackers. To access the detection routine, the public sends a sequence to a detector, which replies with 1 if the sequence is watermarked, and 0 otherwise. Given a wa
the task of an attacker is to find a non-watermarked termarked sequence I, sequence I
, which is as close to I as possible, using limited number of queries to the detector. Cox et al [7] give a heuristic for general watermarking schemes and an estimated number of queries required. The well-known Stir-mark [10] provides a list of practical attacks, many of which are based on image properties. In this paper, we view the attacks as games between the attacker and the watermarking scheme. We focus on a few schemes for binary sequences, and take the Hamming distance as the measure. Our problem is related to the Twenty Questions Game proposed by Ulam in 1976 [13]. In the original game, the target is a secretly chosen integer between 1 and 220 , and a player is to guess this integer by asking twenty yes-no questions. There are several variants of the Twenty Questions Game since then. For example, the Twenty Questions Game with Genes[11], and [1, 8]. We give a variant of the game that corresponds to the game between the watermarking scheme and the attacker. In this game, the player corresponds to the attacker of the watermarking scheme, and the player’s questions correspond to the queries sent to the F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 119–128, 2003. c Springer-Verlag Berlin Heidelberg 2003 

120

Qiming Li and Ee-Chien Chang

detector. We give a randomized player who uses expected O(d(1 + log(n/k))) questions, where d, k and n are parameters of the game. The number of calls required by the attacker can serve as a measure of the security. This can be traded-off with the requirements on false alarm and distortion. Our problem is different, however, from the collusion-secure fingerprint problem [2, 9, 12] in the way the watermarked sequences (queries) are generated. In the collusion-attack setting, each user is assigned a unique fingerprint, and an object watermarked with the unique fingerprint is distributed to each user. Some of the users may collude by comparing the different watermarked copies of the same object, and attempt to remove or modify the fingerprint. In our problem, there is only one attacker. The attacker is free to choose any sequence and the detector (available as a black box) has to disclose whether the chosen sequence is watermarked or not. Due to this flexibility, the attacker can intelligently choose a sequence, based on the outcomes of previously chosen sequences, that will lead to successful watermark removal. We first give the notations used in this paper (Section 2), and then describe a class of watermarking scheme (Section 3). In Section 4, we focus on the Twenty Questions Game. We first give a lower bound (Section 4.1), followed by the randomized player (Section 4.2), and how the game relates to the original watermarking problem (Section 4.3). In Section 5, we give a few variations of our problem.

2

Notations

A watermarking scheme consists of an encoder and a detector. The encoder of a watermarking scheme takes a binary sequence I =
a1 , a2 , . . . , an  as input and
Let K, the kernel, be the set of all possible encoded gives an encoded sequence I. sequences. The encoder satisfies the distortion constraint, which requires the Hamming distance of I
from I to be bounded by a predefined distortion . In the other end, the detector takes a sequence as input and outputs a 1 or 0 indicating whether the sequence is watermarked. Let W be the set of all watermarked sequences. The detector satisfies the constraint on the false alarm ratio F , that is, the probability of a randomly selected sequence being watermarked is bounded by F . If the underling distribution is the uniform distribution, then F = 2−n |W|. Besides the above constraint, the scheme should be resilient in the sense that under the influence of noise, the encoded sequence I
should remain watermarked. There are many different models and requirements for the noises. A scheme that can withstand random noise is usually known as a robust scheme. In this paper, we consider security. We say that a scheme meets the security requirement (S, d0 ) if, given a watermarked I
∈ K, any attacker requires at least expected S number of calls to the detector, so as to find a non-watermarked I
, where I
− I
 ≤ d0 . Note that security implies robustness, because an attacker may wish to act like the random noise.

Security of Public Watermarking Schemes for Binary Sequences

121

A lot of works have been done on the robustness of watermarking schemes, for example [6, 4, 5]. Relatively few theoretical works on smart attackers have been reported. This is the focus of this paper.

3

A Watermarking Scheme

This section describes a class of watermarking schemes for binary sequences of length n. This watermarking scheme is analogous to that in [3]. Each scheme is parameterized by the integers d, and k. The value of d, and k is made known to the public, including the potential attackers. What are kept secret by the encoder is a secret key K and a secret source coding code-book C. The codebook C is a collection of codewords, which are binary sequences of length k. The code-book satisfies the distortion requirement in the sense that every sequence is at most away from its nearest codeword. The secret key K = {h1 , h2 , . . . , hk } is a set of k indices, where 1 ≤ hi ≤ n for all 1 ≤ i ≤ k. For a sequence I, call the sequence
ah1 , ah2 , . . . , ahk  the watermarking coefficients of I. Encoder. Given a sequence I to be watermarked, the encoder quantizes the watermarking coefficients of I to the nearest codeword in C. For example, if
a1 , a2 , . . . , ak  is the watermarking coefficients, and
a
1 , a
2 , . . . , a
k  is the codeword in C that is nearest to
a1 , a2 , . . . , ak , then the watermarked sequence I
is the same as I except its watermarking coefficients are replaced by
a
1 , a
2 , . . . , a
k . Detector. In the other end, the detector declares a sequence I to be watermarked if and only if the watermarking coefficients are within a distance d from a codeword in C. Thus, the kernel K of this scheme contains sequences whose watermarking coefficients are in C, and the watermarked sequences W are all the sequences within a distance of d from the kernel. The false alarm and distortion of this scheme can be easily determined. Define VN,R to be the volume of a sphere in N -dimensional space with radius R, where the distance is measured as Hamming distance. That is,       N N N VN,R = + + ...+ + 1. R R−1 1 The false alarm F satisfies the following bound, F ≥

Vk,d . Vk,

(1)

The equality holds if and only if C is an perfect code. In this case, the distortion D is: D = .

(2)

For k d, the right-hand-side in (1) is approximately k d− . Note that the false alarm (1) and distortion (2) do not depend on the size n. The size n plays

122

Qiming Li and Ee-Chien Chang

an important role in security. To see how the security requirement affects the choice of d and k, let us assume that low false alarm and small distortion are the only desirable properties. Then, with fixed distortion, k should be as large as possible and d should be 0. Since d = 0, the watermarked sequences are isolated “points” in [0, 1]n . This amounts to finding a good source code for the binary sequence. By bringing in the security requirement, each sequence in the kernel should be surrounded by watermarked sequences. If not, an attacker can easily find a non-watermarked sequence by random perturbation. Intuitively, d should be as large as possible to enhance security. However, larger d will raise the false alarm (from (1)). Thus an important question is how to choose d and k for given requirements of false alarm, distortion and security. Next section gives an analysis on security that provides a trade-off for the watermarking requirements.

4

Twenty Questions Game with Watermark Attacker

Before we describe a watermark attacker, let us consider this guessing game involving a player and a target. The target K is a set containing k integers from U = {1, 2, . . . , n}. The player knows the size of K and U before the game starts. The goal of the player is to determine at least d + 1 elements in K, using as few queries as possible. A query is represented by a set Q ⊆ U . The outcome of a query Q, denoted by Q(Q), is Yes if and only if |Q ∩ K| > d. This game can be considered as a variant of the Ulam’s game [13], and is similar to the Twenty Questions Game with Genes in [11]. In the Twenty Questions Game with Genes, the query is of the form “does a given interval contain an integer from K”. The goal is to reconstruct K using as few queries as possible. The lower bound  for a deterministic player of the Twenty Questions n Game with Genes is log , which is approximately k log(n/k) for k  n. k Our game differs from the Twenty Questions Game with Genes in a few ways. Our player has an easier job because he only needs to determine d + 1 elements in K. On the other hand, our queries are more general, and thus might provide less information. 4.1

Lower Bound

A lower bound for any deterministic player in our game is     n k log / . d+1 d+1

(3)

In the guessing game, the player wins if he can identify d + 1 elements in  the  n target K. Before the game starts, from the player point of view, all the k

Security of Public Watermarking Schemes for Binary Sequences

123

sets of k elements are possible targets. This class of possible targets reduces as the player asks questions. When all the possible targets contain d + 1 common elements, the player can confidently outputs these d + 1 elements and wins the game. Let us look at the decision treewhere  each node is a class of possible targets. n Thus, the root is the class of size . In the best scenario for the player, each k   n − (d + 1) leaf is a class with largest possible number of targets, which is k − (d + 1) (this is the number of possible targets where d+ 1 elements are fixed). Therefore, the height of the tree is at least     n − (d + 1) n , / log k − (d + 1) k which is equal to (3). This gives the claimed lower bound. Note that the bound is in Ω(d log(n/k)), and for small k and d, the bound is approximately d log(n/k). By assigning each node with equal probability, and using the Yao’s principle [14], we can also show that any randomized player requires expected Ω(d log(n/k)) questions. 4.2

A Player (Deterministic and Probabilistic)

The job of a player is to identify at least d + 1 elements in K. Our strategy is to first find a small subset U0 ⊂ U that contains at least d + 1 elements in K. Next, the size of U0 is gradually reduced in a way similar to binary search, until its size becomes d + 1, which is what we want. To find the small U0 , the deterministic player uses step §1 in the algorithm below. However, this step requires (k − 1)/d − 1 queries in the worst case. The randomized player improves this step to expected constant number of queries by first shuffling the coefficients (§0). Deterministic Algorithm. guessing game.

Here we present a deterministic algorithm for the

§1. Divide U evenly into (k − 1)/d groups, U1 , U2 , . . . , U(k−1)/d . Find an i such that Q(Ui ) gives Yes. Let Q0 = Ui . §2. Divide Q0 evenly into 2d+ 2 groups, G1 , G2 , . . . , G2d+2 . Let L = φ and G0 = φ, where φ is the empty set. §3. Find the largest i ∈ {0, 1, 2, . . . , 2d + 2} such that Q((G0 ∪ G1 ∪ G2 ∪ . . . ∪ Gi ) ∪ L) gives No. Update L to be L ∪ Gi+1 . Repeat step §3 until no such i exist. §4. Update Q0 to be L. If Q0 contains only d + 1 elements, Q0 is the result. Otherwise repeat from step §2. By the pigeon-hole principle, there exists one group Ui in step §1 that contains at least d + 1 elements from K, and Q(Ui ) gives Yes. Therefore, the number of queries needed for this step is at most (k − 1)/d − 1.

124

Qiming Li and Ee-Chien Chang

Since each Gi+1 identified in step §3 contains at least one element from K, the repeat-loop in step §3 repeats for at most d + 1 rounds. Therefore, step §2 to §3 identify at most d + 1 groups among G1 , . . . , G2d+2 , which in total contain at least d + 1 elements from K. It follows that the size of L is at most |Q0 |/2. Note that step §3 can be completed using a single loop, which uses a total of 2d + 2 queries. Step §2 to §4 are repeated until |Q0 | is reduced to d + 1. Thus, the total number of rounds is at most max(1, log(n/k)) and the total number of queries required to complete the outer-loop is O (d(1 + log(n/k))). In the worst case, the number of queries needed by the player is O(k/d + d(1 + log(n/k))). Randomized Algorithm. When k is small, the above is dominated by the term d log(n/k). However, if k is large, the term k/d would dominate, which is undesirable. Now we introduce a probabilistic player, who uses expected O(d(1 + log(n/k))) queries. §0. Permutes the set U uniformly at random. This probabilistic player performs step §0, and then proceeds from step §1 of the deterministic player. Recall that the size of a group Ui in step §1 is dn/(k − 1). Since the input U is randomly shuffled in step §0, each element in Ui has the probability k/n to be from K. Let Z be the number of elements in Ui that are from K. Then the expected value of Z is E(Z) = dk/(k − 1). Since d < dk/(k − 1) < d + 1, the probability P r[Z ≥ (d + 1)] = P r[Z > E(Z)], which is greater than some constant that is approximately 1/2. Since we are doing selection without replacement in step §1, if the group we select contains less than d + 1 elements from K, the following groups would have greater probability to contain at least d + 1 elements from K. Thus, step §1 can be completed in expected O(1) queries. This gives expected O(d(1 + log(n/k))) for the randomized algorithm. When k = o(n), we have an optimal O(d log(n/k) algorithm. 4.3

A Watermark Attacker

For a set X of indices, let IX be the sequence whose i-th coefficient is 1 if and only if i ∈ X. Given a sequence I and a (n, k, d, ) scheme, the task of the attacker is to find a non-watermarked sequence I
such that I
− I ≤ d + 1. The attacker knows the values of n, k, d, and . What he does not know is the code-book and the secret key K. Here, we assume that the code-book is a perfect binary code. Without loss of generality, we can assume that the given sequence I consists of only 0’s, that is I =
0, 0, . . . , 0, and the code-book contains
0, 0, . . . , 0. Now, it suffices for the attacker to find a set of indices X such that |X| = d + 1 and X ⊆ K. Since |X ∩ K| = d + 1 and C is a perfect code, IX is non-watermarked.

Security of Public Watermarking Schemes for Binary Sequences

125

The watermark attacker corresponds to the player in the Twenty Questions Game in Section 4, the secret key K corresponds to the target, and the detector corresponds to the query. The sequence IX is watermarked if Q(X) gives No. Note, however, the two problems are not completely equivalent. Consider a X
where |X
∩ K| > d. It is possible that IX
is still watermarked, although Q(X
) gives Yes. However, the number of such X
is insignificant comparing to the ˜ where |X ˜ ∩ K| > d. number of X Trade-off with False Alarm and Distortion. For a given false alarm F and distortion D, we want to know how to choose d, k, and to achieve the highest security. By taking the approximate lower bound on the number of calls to the detector required as a measure of the security S,     n k S = log / , (4) d+1 d+1 combining with the equation for false alarm (1) and distortion (2), we can determine the right parameters. For simplicity, use the approximations S ≈ d log(n/k) and F ≈ k d− . Together with (2) and (4), it can be shown that S has the maximum value   Smax = ( D log n − log F −1 )2 (5) when d=D−

5

 D logn F −1 .

(6)

Variations of the Game

In this section we will examine some variations of the game and the corresponding watermarking schemes. These variations try to confuse the player by introducing a liar and multiple targets into the game. However, as we will see, although these mechanisms make the game more difficult, they degrade the performance on false alarm and distortion. In the overall tradeoff, they do not improve the security. 5.1

Twenty Questions Game between Watermark Attacker and Liar

The Twenty Questions Game with watermark attacker can be extended to a game with a liar. That is, with some constant probability p < 1/2, the answer to the query would be wrong. The error can be two-sided: a type-1 error with probability p1 , when |Q ∩ K| > d but the answer is No; and a type-2 error with probability p2 , when |Q ∩ K| ≤ d but the answer is Yes. If p2 = 0, our algorithm will still give a correct solution. However, because of the effect of p1 , the expected number of groups identified in step §2 and §3 will be increased to (d + 1)(1 + p1 ). So the factor by which U0 is reduced is not 1/2 but (1 + p1 )/2. Thus the expected cost of our randomized algorithm will be increased by a constant factor 1/(1 − log(1 + p1 )), but is still O(d log(n/k)). In order to take p2 into consideration, we need to slightly modify step §3 as the following.

126

Qiming Li and Ee-Chien Chang

§3. Find the largest i ∈ {0, 1, 2, . . . , 2d + 2} such that Q((G0 ∪ G1 ∪ G2 ∪ . . . ∪ Gi ) ∪ L) gives No. Update L to be L ∪ Gi+1 . Repeat step (3) until no such i exist. If L = Q0 , stop with no solution. Now our algorithm becomes a Monte Carlo algorithm, which gives a correct solution with certain probability. Obviously, if no errors occur in all the queries, the result would be correct. The probability of such cases is P = (1−p)c1d log(n/k) , where c1 is some positive constant. If we repeat the same query for T times and take the majority answer, the new probability of error p
< e−c2 T , for some positive constant c2 . Now the probability for our algorithm to give a correct solution is P = (1 − p
)c1 d log(n/k) , which is approximately 1 − p
c1 d log(n/k) for small p
. Let p
c1 d log(n/k) < e−c2 T c1 d log(n/k) < 1/2, then T > (1/c2 ) ln(2c1 d log(n/k)). Thus for P > 1/2, the expected number of queries required by our algorithm is O(d log(n/k) log(d log(n/k))). Therefore, by repeating the algorithm for an expected constant number of times, we will have a correct solution. The liar in the Twenty Questions Game corresponds to a detector that gives a wrong answer in the watermarking scheme. With probability p1 , the sequence is not watermarked but the detector says that it is; with probability p2 , the sequence is watermarked but the detector says that it is not. We can see that in practice p2 should be negligible, otherwise we could just randomly select a sequence near the watermarked one, and make the detector say that it is not watermarked by repeatedly sending the sequence to it. Because of p1 , the false alarm F will be increased to F
= F + p1 . In order for p1 to be significant enough to our algorithm, p1 has to be greater than c3 /d log(n/k), for some constant c3 . However, since the original false alarm F ≈ k d−  1/d log(n/k), it is very difficult, if not impossible, to compensate for the false alarm by adjusting the values of k and d. Even if we want to do so, the number of queries will increase because of the changes to d and k. 5.2

Modified Twenty Questions Game with Multiple Targets

We can also extend the Twenty Questions Game to have two secret sets K1 and K2 . The answer to the query would be Yes if |Q ∩ K1 | > d and |Q ∩ K2 | > d, and No otherwise. The player is still required to identify more than d elements from K1 . Interestingly, the algorithm and analysis in Section 5.1 are still applicable, with p2 = 0. Therefore it also can be solved in expected O(d log(n/k)) queries. This variation can be easily extended further to more than two secret sets, where different secret sets may have different values of d and k. However, those variations will not make the game more difficult. The corresponding watermarking scheme would have multiple code-books, and only use one of them to watermark a sequence. The choice of the codebook to be used can be random, or based on sequence specific information, such

Security of Public Watermarking Schemes for Binary Sequences

127

as the nearest distances from the codewords of each code-book. Similar to the watermarking scheme in Section 5.1, the false alarm F increases significantly due to p1 , and the number of calls to the detector increases if we want to compensate for F .

6

Remark and Future Works

We have also explored other watermarking schemes on binary sequences. It turns out that the simple watermarking scheme in Section 3 outperforms them. This leads to a general question: given the requirements on false alarm and distortion, what is the highest security (measured in term of number of calls to the detector) we can achieve. We do not know the solution to this general question. We suspect that the security of a watermarking scheme is closely related to the critical distance, that is, the radius of the smallest sphere centered at the kernel, whose surface contains roughly half watermarked sequences. Note that our randomized player given in Section 4.2 uses this distance to obtain the set U0 . We also do not know any non-trivial bound of this distance with a given false alarm and distortion. Many interesting problems remain open.

References [1] Andris Ambainis, Stephen A. Bloch, and David L. Schweizer. Playing twenty questions with a procrastinator. In Proceedings of the tenth annual ACM-SIAM symposium on Discrete algorithms, pages 844–845. ACM Press, 1999. 119 [2] D. Boneh and J. Shaw. Collusion-secure fingerprinting for digital data. IEEE Trans. on Information Theory, 44(5):1897–1905, 1998. 120 [3] E. C. Chang and M. Orchard. Geometric properties of watermarking schemes. In ICIP, volume 3, pages 714–717, 2000. 121 [4] B. Chen and G. W. Wornell. Achievable performance of digital watermarking systems. IEEE Int. Conf. on Multimedia Computing & Systems, 1:13–18, 1999. 121 [5] J. Chou, S. S. Pradhan, and K. Ramchandran. On the duality between distributed source coding and data hiding. 33rd Asilomar conference on Signals, System and Computers, pages 1503–1507, 1999. 121 [6] M. Costa. Writing on dirty paper. IEEE Trans. on Information Theory, 29(3):439– 441, 1983. 121 [7] I. J. Cox and J-.P. Linnartz. Public watermarks and resistance to tampering. IEEE Int. Conf. on Image Processing, 3(0 3–0 6), 1997. 119 [8] Aditi Dhagat, Peter G´ acs, and Peter Winkler. On playing ”twenty questions” with a liar. In Proceedings of the third annual ACM-SIAM symposium on Discrete algorithms, pages 16–22. ACM Press, 1992. 119 [9] J. Kilian, F. T. Leighton, L. R. Matheson, T. G. Shamoon, R. E. Tarjan, and F. Zane. Resistance of digital watermarks to collusive attacks. In IEEE International Symposium on Information Theory, page 271, 1998. 120 [10] Fabien A. P. Petitcolas, Ross J. Anderson, and Markus G. Kuhn. Attacks on copyright marking systems. In Information Hiding, Second International Workshop, number 1525 in LNCS, pages 219–239. Springer-Verlag, 1998. 119

128

Qiming Li and Ee-Chien Chang

[11] P. A. Pevzner. Computational Molecular Biology: An Algorithmic Approach. The MIT Press, 2000. 119, 122 [12] Harold S. Stone. Analysis of attacks on image watermarks with randomized coefficients. Technical report, NEC Research Instititute, 1996. 120 [13] S. Ulam. Adventures of a mathematician. Scribner and Sons, 1976. 119, 122 [14] A. C.-C. Yao. Probabilistic computations: Twoard a unified measure of complexity. 18th IEEE Symposium on Foundations of Computer Science, pages 222–227, 1977. 123

Direct Embedding and Detection of RST Invariant Watermarks Peter A. Fletcher and Kieran G. Larkin Advanced Technology Division Canon Information Systems Research Australia Pty, Ltd [CISRA] 1 Thomas Holt Drive, North Ryde, NSW 2113, Australia [email protected] [email protected]

Abstract. A common goal of many watermarking techniques is to produce a mark that remains detectable after the geometric transformations of Rotation, Scale and Translation; also known as RST invariance. We present a simple approach to achieving RST invariance using pixel-by-pixel addition of oscillating homogeneous patterns known as Logarithmic Radial Harmonic Functions [LRHFs]. LRHFs are the basis functions of the Fourier-Mellin transform and have perfect correlation, orthogonality, and spread-spectrum properties. Once the patterns have been embedded in an image they can be detected directly regardless of RST and with great sensitivity by correlation with the corresponding complex LRHFs. In contrast to conventional methods our approach is distinguished by the utilization of signal phase information and the absence of interpolation artifacts. Data encoding is based on the information in the relative centre positions of multiple spatially overlapping patterns.

1

Introduction

In this paper we are primarily concerned with practical watermarking schemes. A practical watermarking scheme must be resistant to the most common image editing operations if it is to be accepted by typical users. The common, non-malicious edits are rotation, scaling, shifting, cropping, blurring, filtering, contrast adjustment, colour shifting, printing, scanning, quantization and JPEG compression. The first four of these edits are known as geometric distortions or image deformations. Rather surprisingly many watermarking schemes proposed by researchers in the last half dozen years of frenetic publishing activity are vulnerable to one or more of these deformations. One of the first systematic approaches to watermarking with resilience to rotation, scale and translation (RST) was presented by O’Ruanaidh and Pun. [1] Their method is based upon the Fourier-Mellin transform (FMT) of the Fourier magnitude of an image. The Fourier magnitude is, perhaps, one of the best known translation invariants, whilst the 2-D FMT imparts rotation and scale invariance. Prior to this F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 129-144, 2003.  Springer-Verlag Berlin Heidelberg 2003

130

Peter A. Fletcher and Kieran G. Larkin

work Cox [2] had proposed a watermarking scheme based upon modifying the transform (Fourier or cosine) magnitude values of the Nth largest values for an image. The idea being that peak ordering is unaffected by simple image deformations such as RST. One of the earliest published methods to incorporate rotation immunity was the patent of Rhoads [3], which proposed a pattern of interlocking rings as the watermark. The underlying assumption here is that a ring is the only pattern with full rotational symmetry. Another approach to affine image deformations is to embed an alignment pattern, or template, in an image. Perhaps the most interesting approach is based on the embedding of a near-random pattern which is periodically repeated in x and y. Such a marked image will give a large autocorrelation (AC), if suitably high-passed filtered first. The autocorrelation resembles an array of delta functions with peaks values exceeding the background image AC, so it can easily be detected even if the template itself is imperceptible. Both Kodak [4] and Philips [5,6] have proposed AC methods. Finally we note a technique based on the scaling and rotation of self-similar patterns. Solachidis and Pitas [7] presented a method that only requires correlation over a small range of scale factors and a small range of angles. The method is expected to be computationally intensive because of the 2-D search space with a correlation at each point. RST invariant watermarking is a very active area of research and this introduction has omitted many of the recent publications. Our outline is not intended to be encyclopedic in it coverage, but rather to place our proposed RST method in context.

2

Fourier Mellin Basis Patterns and Invariant Functions

2.1

2-D Fourier Mellin Basis Function

In this section we introduce a remarkable family of functions by way of the FourierMellin transform. In the last three decades there has been considerable research in the area of RST pattern detection, especially for military target (viz tanks and aircraft) detection. Correlation is usually the chosen mode of detection because it can often be implemented in real time using optical correlators. In 1976 Casasent and Psaltis [8] introduced the idea of invariant correlation based upon a Mellin transform. Subsequently much research has been published in this area, most notably Mendlovic et al. [9], Rosen and Shamir [10], and Sheng and Shen [11]. There is also a considerable body of research in the image processing and pattern analysis literature which might be included in a full review article but has been omitted here for brevity. The conventional viewpoint is that an image can be transformed to an RST invariant domain and then detected by correlation. An equivalent interpretation is that an image can be uniquely represented by an orthonormal series of invariant functions; and these functions are the basis functions of the 2-D Fourier-Mellin transform; also known as Logarithmic Radial Harmonic Functions (LRHFs).1 1

Actually the Fourier-Mellin transform method of O’Ruanaidh discards the phase information of the embedded pattern, which means that it is more correct to state that the method is equivalent to the addition of a sequence of different basis functions, all centered at the spatial origin.

Direct Embedding and Detection of RST Invariant Watermarks

131

The 2-D Fourier-Mellin transform of a function f (r , θ ) is given by

M (s, m ) =

+π

∞

−

0

∫π ∫ f (r ,θ ).r e

s imθ

rdrdθ .

(1)

The variable s is assumed to be complex, and m is an integer representing the circular harmonic order. It can be shown that a complete [9] orthogonal [12]. sequence of functions results from setting ℜ(s ) = −1 . The orthogonal 2-D Fourier – Mellin basis functions gα ,k (r ,θ ) are given by gα ,k (r ,θ ) =

r iα exp(ikθ ) . r

(2)

It can be readily confirmed that this family of functions exhibits the required scale and rotation invariant properties we desire: gα ,k (ar ,θ + θ 0 ) = Agα ,k (r ,θ )

(3)

where A is a complex constant independent of the polar coordinates (r ,θ ) . The orthogonality conditions ensure that correlation based detection of such patterns is perfect (insofar as correlation results in a pure delta function peak). 2.2

Homogeneous Functions

The foregoing Fourier-Mellin approach to generating perfect RST patterns has the benefit of hindsight. Instead of proceeding by transforming an image to an RST invariant space and then embedding a pseudorandom noise pattern as described by O’Ruanaidh we initially considered the question:

Can there exist a two-dimensional pattern that has a sharp pattern when correlated with itself, and yet maintains correlation sharpness even when it is rescaled and rotated? The answer to this question remained apparently negative for some years during our research. To begin with, we knew that a function can only have a sharp autocorrelation if it has wide spectral coverage or support. We also knew that (using the Schwarz inequality) that the maximum possible (normalized) cross-correlation for two functions occurs when the functions are identical, within a multiplicative constant. From our past research on modulation and demodulation [13] we also knew that amplitude and frequency modulated patterns [AM-FM] possess particularly attractive spatial and spectral properties. The main idea being that a pattern can be defined by its local amplitude and its local phase (or frequency). The archetypal AMFM radial function in 2-D being f (x, y ) = b(r ) cos[ψ (r )]

(4)

where the amplitude b(r ) is real, but not necessarily positive, and the phase ψ (r ) can also be interpreted as an integral of the instantaneous frequency (IF). The idea that a modulated pattern might have an IF that is essentially unchanged by scaling may

132

Peter A. Fletcher and Kieran G. Larkin

seem at first counterintuitive, nevertheless it leads to a deep insight. Consider a function with spatially varying IF q (r ) determined by 2πq(r ) =

dψ (r ) . dr

(5)

A function with an IF that is simply the reciprocal of the coordinate r has the immediate property of scale invariance. This surprising result follows from the rescaling of Eqn. 4:

f (ar ) = b(ar ) cos[ψ (ar )]

(6)

dψ (r ) 1 ∝ ⇒ ψ (r ) = α ln(r ) dr r

(7)

f (ar ) = b(ar ) cos[α ln (r ) + α ln(a )] = 2b(ar ){exp[iα ln(r ) + iα ln(a )] + exp[− iα ln(r ) − iα ln(a )]}.

(8)

combined with

results in

Eqn. 8 defines a function that is the sum of two separately scale invariant functions (within a constant phase) if the amplitude is a homogeneous function with a real index: b(r ) = r . The analysis can be extended from purely radial functions by the inclusion of circular harmonics to give a result similar to Eqn. 2 except that only the real part of the function is considered: 1 ℜ gα ,k (r ,θ ) = cos(α ln(r ) + kθ ) . (9) r Eqn. 8 may also be expressed in complex form by the addition of the quadrature, or Hilbert conjugate, component fˆ (ar ) = b(ar ) sin[α ln(ar )] so that p

[

]

f (ar ) + ifˆ (ar ) = b(ar ) exp[iα ln (r )]exp[iα ln (a )] .

(10)

Recently it has been shown that the first order (α = 0, k = ±1) scale invariant transforms correspond to the Hilbert transform in 1-D and the Riesz (or spiral phase) transform in 2-D. [13] Interestingly it seems that homogeneous functions have not been considered previously for watermarking purposes. The reason may be that the well-known real index homogeneous functions, such as r p have very large cross-correlations with typical image functions, even though their autocorrelations have all the right properties. It transpires that complex index homogeneous functions, exemplified by Eqn. 2, have rather small cross-correlations with typical images. The full explanation of this effect is rather involved, but heuristically it is because of the rapid oscillation of the real and imaginary parts of g α , k tend to cause cancellation with image features in the same way as pseudo random noise (PRN).

Direct Embedding and Detection of RST Invariant Watermarks

133

Fig. 1. Section of scale invariant function. Note the unusual singularity as r → 0

real part

imaginary part

Fig. 2. Circular symmetric form of the LRHFs truncated at an inner and outer radius. Note that the central region has been set to zero to avoid aliasing of the high frequencies

real part

imaginary part

Fig. 3. The real and imaginary parts of a logarithmic radial harmonic phase function. Note how the tangential (angular) component generates an equiangular spiral. The central region has been set to zero to avoid aliasing of the high frequencies

134

Peter A. Fletcher and Kieran G. Larkin

Fig. 2 shows the real and imaginary parts of the function shown in Eqn. 2 with the harmonic coefficient k set to zero, resulting in exact circular symmetry. Fig. 3 shows a LRHF with a spiral component k ≠ 0 . We now have some complex basis functions with the desired RST properties. The next section considers an additional property which supports their use in real, finite, images.

3

Orthogonality of Truncated LRHFs

The first problem with using LRHFs is that they extend over all space and that they have infinitely high frequencies near the centre.2 In practice the patterns must be limited in extent to fit in an image. The finite sampling requirement means that the maximum, non-aliased, spatial frequency is one half the sampling frequency (the Nyquist criterion). If we are to utilize these patterns they must be truncated beyond a maximum radius and below a minimum radius corresponding to the Nyquist frequency. In principle the truncation boundary may be a shape other than a circle, however we ignore this possibility here to allow the derivation of an exact orthogonality condition. In practice rectangular and other boundary shapes give nearorthogonality which is quite useable. Firstly we consider a generalized form of the LRHF in Eqn. 2 g p ,α ,k (r , θ ) = r p r iα exp(ikθ ) .

(11)

The orthogonality properties of this LRHF (over an annular region) are easily calculated because of the radial and tangential separability:

I α , k , β ,l =

+π

R2

−π

R1

∫

∗ ∫ g p,α ,k (r,θ )g p, β ,l (r,θ )rdrdθ

+π

R2

−π

R1

= ∫ exp i (k − l )dθ

∫r

2 p i (α − β )

r

(12)

rdrdθ .

This equation can be further simplified because the tangential (angular harmonic) component integrates to a Kronecker delta function +π

1, k = l ∫−π exp i(k − l )dθ = δ k ,l = 0, k ≠ l .

(13)

The radial part of the overlap integral has the following form

2

Ironically, singular functions have often been used as examples of pathological functions that do not have well-defined Fourier transforms. However the functions and transforms do exist as generalized functions or tempered distributions, see for example Champeney, D. C., A handbook of Fourier transforms, Cambridge University Press, Cambridge, 1987.

Direct Embedding and Detection of RST Invariant Watermarks

R2

∫1 r

2 p i (α − β )

r

rdr =

R

(R

2 p + 2 + i (α − β ) 2

)

− R12 p + 2 + i (α − β ) . 2 p + 2 + i (α − β )

135

(14)

Now using the original orthogonality condition p = −1 , the magnitude squared of the overlap integral is

2

I α , k , β ,l

= δ k ,l

 [α − β ] ln[R 2 R1 ]  sin 2   2   . 2 (α − β )

(15)

Orthogonality is thus ensured for integer values of [k, l ] and [α , β ] such that

α −β =

(16)

2πn , n∈Z . ln[R 2 R1 ]

Further details about the correlation peaks function under orthogonality condition will be covered in the next few sections. For a typical digital image containing 5122 pixels there are of the order 103 independent useable patterns.

4

The Remarkable Spectral Properties of LRHFs

Not only do LRHFs have unusual spatial properties, but also their spectral properties are unique. Essentially LRHFs are self-Fourier functions, but because of their scale invariance the normal Fourier scaling theorem is subverted. The continuous 2-D Fourier transform can be defined +∞ +∞

∫ ∫ f (x, y ) exp(− 2πi[ux + vy])dxdy

F (u, v ) =

.

(17)

.

(18)

− ∞− ∞

The inverse transform similarly f ( x, y ) =

+∞ +∞

∫ ∫ F (u, v ) exp(+ 2πi[ux + vy ])dxdy

− ∞− ∞

It is more convenient here to work with continuous functions and FTs, but it is worth remembering that all the equations have corresponding discrete forms appropriate (although more complicated) for exact evaluation in sampled images. It can be shown that the pure radial LRHF has the following FT, where we use the symbol ↔ to indicate Fourier transformation between function pairs:

r −c ↔ λ .q c − 2 , 0 < ℜ{c} < 2

(19)

where the spectral polar coordinates are (q, φ ) , u = q cos φ , v = q sin φ , and λ is a complex constant determined by c. Note that there is a radial inversion relation between the transform function exponents ( −c → c − 2 ). The negation of the

136

Peter A. Fletcher and Kieran G. Larkin

imaginary part of c is simply phase negation or complex conjugation. By partial differentiation of the above it is possible to show (informally) that the spiral LRHFs are also self-Fourier functions. Again the radial parts invert but the spiral part does not. A formal proof of these relations, being rather lengthy, is not presented here (for example see Bracewell for an outline of Bessel function methods [15]). r − c e ikθ ↔ µ c q c − 2 e ikφ , 0 < ℜ{c} < 2 .

(20)

Another important frequency related property of the LRHF hinted at above is that the outer regions contain lower frequency components than the central regions. This can be formalized using the stationary phase approximation to the FT of a generalized 2-D fringe pattern. [16,17,] Treating the LRHF as an AM-FM pattern (essentially the complex form of Eqn. 4) then gives the IF (as defined by the local phase derivative) as a function of position q ( x, y ) =

1 2π

2

2

 ∂ψ   ∂ψ   .  +    ∂x   ∂y 

(21)

Using the LRHF defined in Eqn. 11 we find that the IF magnitude is indeed inversely related to the radial coordinate as originally conjectured q ( x, y ) =

α2 +k2 . 2πr

(22)

A direct consequence is that the annular limitations proposed for the support practical LRHF define a maximum and a minimum frequency: q max =

α2 +k2 α2 +k2 . , q min = 2πR min 2πR max

(23)

One fascinating consequence of this relation is that annular LRHF Fourier transform into annular LRHF in the stationary phase limit. Moreover, the inner parts of a LRHF transform into the outer parts of the FT, and vice versa. In other words the FT turns the LRHFs inside out! The significance of Eqn. 20 is that it is trivial to compute either the function or its FT directly from knowledge of the parameter c, allowing a shortcut in the discrete correlation computation.

5

Optimal Detection: Correlation and Translation Invariance

Correlation (or matched filtering) is known to be the optimal linear detection method under the assumption of certain noise models. Of course in watermarking the watermark is considered to be the signal and the image is the “noise”. Clearly the noise is nothing like zero-mean, stationary, Gaussian noise. Following convention we ignore this intrusion of reality and pretend we have an ideal noise source! Correlation has the important effect of introducing translation (the T in RST) invariance into the watermarking procedure. In the preceding section we have already

Direct Embedding and Detection of RST Invariant Watermarks

137

shown how the idealized LRHFs have perfect orthogonality even after scaling and rotation. Initially we wish to know the ideal correlation function for two untruncated LRHFs g p ,α , k and g p , β ,l . We use the 2-D Fourier correlation/convolution theorem (see Bracewell) [15,18] with ⊗ ⊗ representing the 2-D convolution operator: If f (x, y ) ↔ F (u , v ), g (x, y ) ↔ G (u , v )

(24) Then h( x, y ) = f ( x, y ) ⊗ ⊗ g ( x, y ) ↔ F (u, v )G ∗ (u , v ) . So correlation can be implemented by Fourier transforming both functions, complex conjugating one and then multiplying by the other before transforming back. For our chosen functions we find: g p ,α , k (r ,θ ) = r p +iα e ikθ ↔ G p ,α , k (q, φ ) = µ p ,α q − p −iα − 2 e ikφ g p , β ,l (r ,θ ) = r

p + iβ

e

ikθ

↔ G p , β ,l (q, φ ) = µ p , β q

− p −iβ − 2 ilφ

e

(25)

.

The complex constant in each case is represented by µ . The FT of the crosscorrelation is then H p ,α , k , β ,l (u, v ) = G p ,α , k (q, φ ).G ∗p , β ,l (q, φ ) = µ p ,α µ p , β q −2 p − 4 −i (α − β )e i (k −l )φ .

(26)

Now we can see that the phases partly cancel when the two chosen functions are similar. Only when the functions are identical do the phases entirely cancel out. Phase cancellation is the classic condition for maximum correlation (a linear phase component can exist and merely indicates a shift between the two original functions). At this point it is worth noting, for future reference, that several types of enhanced correlation may be used advantageously here. A phase-only correlation may be useful for detecting patterns (a phase correlation sets the magnitude of H to unity and can give a much sharper correlation peak in certain instances). Furthermore, high frequency enhanced correlation is capable of sharpening the peak. In the case where the correlated functions are identical (or scaled and rotated versions of each other) we obtain: H p ,α , k ,α , k (u, v ) = µ p2 ,α q −2 p − 4 .

(27)

The correlation peak is then a pure delta function, or a very sharp inverse cone function, depending on the real radial exponent

δ ( x, y ), p = −2  h p ,α , k ,α , k (x, y ) ∝ π − ln(r ), p = −1  2 p+2 , p ≠ −2, p ≠ −1. r

(28)

In the latter cases of Eqn. 28 the inverse cone can be sharpened to a delta function by the use of Laplacian image enhancement (corresponding to a parabolic multiplier, q 2 , in Fourier space). In the case of finite sized LRHFs we find empirically that the limit on the radial power range can be extended to −2 ≤ p < 0 at least.

138

Peter A. Fletcher and Kieran G. Larkin

Consider the quintessential scaled and rotated correlation and its FT: 2 1  g p ,α , k (r ,θ ) ⊗ ⊗ g p ,α ,k (ar ,θ + θ 0 ) ↔ µ p ,α   a

(

)

p + 2 − iα

q − 2 p − 4 e −i (k −l )θ 0

(29)

In other words it is the same as the undistorted correlation in Eqn. 27 and hence the final rotated and scaled correlation is just the same as Eqn. 26 apart from a complex constant. This is precisely the correlation property we require for RST watermark detection. It should be noted that the various integrals and FTs presented above have certain limitations related to L2 boundedness and the existence of singular integrals, which will not be dealt upon here (see Stein[19], Champeney [14], or Calderon & Zygmund [20] for more details). Taking the annular bounds of practical LRHFs into account modifies the result in Eq.28. The main difference being that the ideal delta spike becomes an Airy disc function, more familiar as the point spread function of a perfect annular optical imaging system. The actual energy spread is small; typically of the order of one pixel width. 5.1

Embedding Real Marks and Detecting with Complex Patterns

Having demonstrated that the LRHFs have all the required mathematical properties for RST detection we move on to an actual implementation. We are typically limited to real patterns when embedding in discrete images. We are further limited by typical greyscale images having just 8 bits (0-255) of data per pixel. Fortunately all the preceding analysis extends easily to the case where we have a real pattern embedded in an image and we detect with a complex pattern. The main difference is a halving of the detected signal compared to the full complex correlation, as can be seen from the Fourier representation:

{

}

g p ,α , k (r ,θ ) ⊗ ⊗ℜ g p ,α , k (ar ,θ + θ 0 )

.

b

(µ

)

2

p , +α

1   a

p+2

q − 2 p − 4 e − ikθ

1  1  1   +   2  a  a iα

0

− iα

 q − 2iα e −i 2 kθ  

(30)

There are two terms corresponding to the two conjugate terms in Eqn. 8. The first term in the Fourier transform is half the original (complex-complex) correlation signal. The second term is an auto-convolution term and contains frequency doubled terms which appear as a highly dispersed noise background (and in discrete systems some high frequencies will be aliased to low frequencies). The process is reminiscent of sum and difference frequency generation in AM modulators, except in 2-D. For typical image sizes (>2562) the frequency doubled components are several orders of magnitude below the main correlation peak level and can therefore be ignored. We can conclude that scale and rotation invariant correlation is achievable for real patterns in practice.

Direct Embedding and Detection of RST Invariant Watermarks

{

139

}

g p ,α , k (r ,θ ) ⊗ ⊗ℜ g p ,α ,k (ar ,θ + θ 0 ) ≅ g p ,α ,k (r ,θ ) ⊗ ⊗ g p ,α ,k (ar ,θ + θ 0 )

(31)

2

6

Proposed Embedding Algorithm

The basic idea is to add a number of LRHF patterns to an image at a near imperceptible level. Each LRHF is chosen with a different centre position but a fixed radial index α and spirality k . The relative positions of the centres can encode information in a variety of ways. In the simplest case the x and y position in a 2562 grid can encode almost 2 bytes per pattern. It is prudent to take advantage of certain features of the human visual system to allow embedding more signal in regions where it is less visible, and less signal in particularly sensitive regions. This so-called perceptual masking is universally used in watermarking schemes. We use a very simple perceptual mask based on the local mean of the gradient magnitude to demonstrate the essential characteristics of our method, bearing in mind that more sophisticated perceptual masking could be used to further improve results. The algorithm flowchart is shown in Fig. 4. The effectiveness of the embedding and detection of LRHFs in typical images depends on the cross-correlation of the image with the chosen LRHF being of low magnitude and widely dispersed. In general this is difficult to estimate, however initial tests have indicated that the cross-correlation is almost always small compared to the auto-correlation. The heuristic argument for this is that LRHFs do not resemble features in typical images. The LRHFs used have both wide spatial support and wide spectral support.

7

Detection Algorithm

The first step of the detection algorithm is to undo the perceptual masking. The reason for this is that optimal detection theory predicts that the best signal detection occurs for a matched detection function. There would appear to be two possibilities; one to perceptually mask the detection function before correlation, the second, shown in Fig. 5, is to unmask the image before correlation. The first option is not actually possible to implement because it would require a different mask for each overlap integral and for each embedded pattern. The second option has the advantage, unlike the first, that the simple correlation is close to perfectly spread-spectrum, and results in a very sharp detection peak. Of course the ultimate SNR depends upon the unmasked image cross-correlation too, and this is impossible to predict in general. In practice it is not necessary to exactly undo the masking of the embedding process – experiments indicate that the unmasking step (even with a rough estimate of the mask) significantly improves peak SNR.

140

Peter A. Fletcher and Kieran G. Larkin perceptual mask

image

message

+

X watermark patterns

watermarked image

Fig. 4. Watermark Embedding Algorithm

watermarked image

estimate perceptual mask

complex basis pattern (real & imaginary)

a a b

b correlation magnitude peak positions encode data

correlate

Fig. 5. Watermark detection algorithm

Direct Embedding and Detection of RST Invariant Watermarks

(a) Basis pattern

(b) Sum of 87 patterns

(c) Perceptually masked sum

(d) Correlation magnitude

(e) Distorted watermarked image

(f) Correlation magnitude from (e)

Fig. 6. Correlation detection results

141

142

Peter A. Fletcher and Kieran G. Larkin

(a) Correlation peak close-up

(b) Peaks after distortion

Fig. 7. Close up of correlation peaks before and after rotation-scaling distortion

8

Detection Results

To demonstrate the effect of RST operations on an embedded pattern we embedded 87 patterns with their centers placed in the form of the company logo CISRA. Fig. 6 shows the full sequence of results. Initially the patterns were embedded in a greyscale image of Lenna. The embedded signal has an rms of 3.6 greylevels. Applying the detection algorithm to the watermarked image recovered the logo against a background of low-level noise. The image was then rotated 17° and reduced to 80% of its original size. Applying the detection algorithm again recovered the logo against a slightly higher background noise level. Using phase-only correlation typically results in detection peaks that are localized within a few pixels with an SNR of more than 16 (peak signal/rms noise) and 2 (lowest signal peak/highest noise peak). Fig. 7 show details of the correlations peaks before and after image distortion; note that the peak energy distribution is not seriously degraded. In real applications the number of embedded patterns can be much smaller than the above example. Embedding patterns located on a 642 grid requires about 12 patterns to encode 8 bytes of information, including error correction.

9

Performance: Resistance to Watermark Attacks

In principle a watermarking scheme based upon embedded LRHFs is completely invariant to RST and cropping. However the finite size of the patterns introduces some limitations that may be optimized for particular applications. Assuming a minimum final image size of 2562 the method is resistant to: scaling in the range 50% to 200%, any rotation, and cropping to approx 50% of original. Simple changes to the detection search space can easily extend these ranges. Because of the spreadspectrum, wide-space nature of the patterns, they are intrinsically resistant to filtering and compression. Embedding the watermark in the luminance signal makes the mark

Direct Embedding and Detection of RST Invariant Watermarks

143

robust to colour modifications. Random row and column deletions do reduce the correlation peaks, but not drastically. Only two Stirmark [21,22] v3.1 attacks defeat the method. The first is the shear/aspect ratio change of more than 1%. The second is extremely low quality JPEG compression, where the image quality is unacceptable for many applications.

10

Conclusion

We have presented a family of spread-space/spread-spectrum functions that are invariant to rotation and scale essentially because of their equiangular spiral symmetry. The Logarithmic Radial Harmonic Functions have near ideal autocorrelation and orthogonality properties and can be derived from two different premises: Fourier Mellin invariance or AM-FM pattern invariance. Surprisingly the patterns have, like PRNs, very low cross-correlation with most natural images, which makes them eminently suitable for watermarking applications. The direct embedding and detection of LRHFs avoids awkward interpolation effects (related to the log-polar transforms required by alternative RST methods) and allows encoding based on the relative centering of individual basis patterns. Like many proposed watermarking schemes the method is vulnerable to certain attacks, however malicious removal of the marks in an image of N pixels would involve at least 103 NlogN operations. Only the rudimentary properties and applications have been presented in this short introduction to LRHFs; much more remains to be uncovered!

References 1. 2. 3. 4. 5. 6.

O'Ruanaidh, J. J. K., and Pun, T., “Rotation, Scale and Translation Invariant Spread Spectrum Digital Image Watermarking”, Sig. Proc. 66, (3), 303-317, (1998). Cox, I. J., Kilian, J., Leighton, F. T., and Shamoon, T., “Secure Spread Spectrum Watermarking For Multimedia”, IEEE Transactions of Image Processing 6, (12), 1673-1687, (1997). Rhoads, G, US patent 5,636,292, "Steganography methods employing embedded calibration data", 1995. Honsinger, C., and Rabbani, M., “Data Embedding Using Phase Dispersion”, Eastman Kodak, 2000. Linnartz, J.-P., Depovere, G., and Kalker, T., “On the Design of a Watermarking System: Considerations and Rationales,” Information Hiding, Third International Workshop, IH'99, Dresden, Germany, (1999), 253-269. Maes, M., Kalker, T., Haitsma, J., and Depovere, G., “Exploiting Shift Invariance to Obtain a High Payload in DigitalImage Watermarking,” IEEE International Conference on Multimedia Computing and Systems, ICMCS, Florence, Italy, (1999), 7-12.

144

7. 8. 9. 10. 11. 12. 13.

14. 15. 16. 17. 18. 19. 20. 21. 22.

Peter A. Fletcher and Kieran G. Larkin

V.Solachidis, and Pitas, I., “Self-similar ring shaped watermark embedding in 2D DFT domain,” European Signal Processing Conf.(EUSIPCO'00), Tampere, Finland, (2000), Casasent, D., and Psaltis, D., “Position, rotation, and scale invariant optical correlation”, Applied Optics 15, (7), 1795-1799, (1976). Mendlovic, D., Marom, E., and Konforti, N., “Shift and scale invariant pattern recognition using Mellin radial harmonics”, Opt. Comm. 67, (3), 172-176, (1988). Rosen, J., and Shamir, J., “Scale invariant pattern recognition with logarithmic radial harmonic filters”, App. Opt. 28, (2), 240-244, (1989). Sheng, Y., and Shen, L., “Orthogonal Fourier Mellin moments for invariant pattern recognition”, J. Opt. Soc. Am. A 11, (6), 17481757, (1994). Moses, H. E., and Prosser, R. T., “Phases of complex functions from the amplitudes of the functions and the amplitudes of the Fourier and Mellin transforms”, J. Opt. Soc. Am. A 73, (11), 1451-1454, (1983). Larkin, K. G., Bone, D., and Oldfield, M. A., “Natural demodulation of twodimensional fringe patterns: I. General background to the spiral phase quadrature transform.”, J. Opt. Soc. Am. A 18, (8), 1862-1870, (2001). http://www.physics.usyd.edu.au/~larkin/ Champeney, D. C., A handbook of Fourier transforms, Cambridge University Press, Cambridge, 1987. Bracewell, R. N., Two-Dimensional Imaging, Prentice Hall, Englewood Cliffs, New Jersey, 1995. Larkin, K. G., “Topics in Multi-dimensional Signal Demodulation”, PhD. University of Sydney, 2001. http://setis.library.usyd.edu.au/~thesis/ Larkin, K. G., “Natural demodulation of two-dimensional fringe patterns: II. Stationary phase analysis of the spiral phase quadrature transform.”, J. Opt. Soc. Am. A 18, (8), 1871-1881, (2001). Bracewell, R. N., The Fourier transform and its applications, McGraw Hill, New York, 1978. Stein, E. M., Singular integrals and differentiability properties of functions, Princeton University Press, Princeton, N.J., 1970. Calderon, A. P., and Zygmund, A., “On the existence of certain singular integrals”, Acta Mathematica 88, 85-139, (1952). Petitcolas, F. A. P., Anderson, R. J., and Kuhn, M. G., “Attacks on copyright marking systems,” Information Hiding, Second International Workshop, IH'98, Portland, Oregon, USA, (1998), 219-239. Petitcolas, F. A. P., “Watermarking scheme evaluation - Algorithms need common benchmarks”, IEEE Signal Processing Magazine 17, (5), 58-64, (2000).

Robust Image Watermark Using Radon Transform and Bispectrum Invariants Hyung-Shin Kim1 , Yunju Baek1 , Heung-Kyu Lee1 , and Young-Ho Suh2 1

Division of Computer Science Department of Electrical Engineering & Computer Science Korea Advanced Institute of Science and Technology 373-1 Kusung-Dong Yusong-Gu Taejon, 305-701, South Korea [email protected] 2 Contents Technology Department Electronics and Telecommunications Research Institute(ETRI) 161 Gajeong-Dong, Yuseong-Gu, Daejeon, 305-350, South Korea

Abstract. Image watermark that is resistant to geometric distortion is remained to be an unsolved problem. Difficulty of the probelm comes from the situation that the watermark should be extracted without any information of the original image. In this paper, we review this problem and propose a new watermarking scheme based on invariant pattern recognition theory. We propose an invariant watermark using the Radon transform and higher order spectra. A bispectrum feature vector of the image is used as the watermark. Our approach differs from the previous methods in that we embed watermark into the phase of the higher order spectra. Also, our Radon embedding grid outperforms the Fourier-Mellin based methods. We devised a new embedding method which allows detection of the watermark when there is no exact inverse function during embedding. As we use the Radon transform, our method can be used for medical images. We show the invariance of the designed watermark with mathematical proofs. Experimental results confirm that this scheme is resistant to geometric distortions.

1

Introduction

There has been a very intensive research in the digital watermarking area in the last few years [1]. A useful image watermarking method must be robust to the distortions occurred by any normal use of images. Those distortions include a wide range of image processing such as image enhancement, JPEG compression and geometrical modifications. However, conventional image watermarking algorithms are sensitive to geometric distortions [2]. Simple rotation, scale and translation may significantly reduce the detection level since it changes the alignment of the watermark. Random geometric distortion which is known as StirMark attack [2] greatly reduces the watermark strength at the detector. Some watermarking methods that are resilient to geometrical attacks were reported in recent papers. One approach is to embed a known template into F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 145–159, 2003. c Springer-Verlag Berlin Heidelberg 2003


146

Hyung-Shin Kim et al.

images along with the watermark [3][4]. The template contains the information of the geometric transform undergone by the image. During detection, the image is inverse transformed using the distortion information estimated from the template, then the watermark can be extracted. This method requires embedding a template in addition to the watermark so that this may reduce image fidelity and watermark capacity. Watermarks itself can be used as a template [5]. They embed a signal multiple times and use autocorrelation for the detection of the watermark pattern. The autocorrelation peaks have the structure for inverting geometric distortion. For this type of system to be robust, both the inverting and watermark detection procedure should be robust. Another approach is to insert a watermark in a domain that is invariant to geometrical distortions based on the Fourier-Mellin transform [6]. A rotation and scaling of an image results in the translation at the log-polar mapping of the Fourier magnitude spectrum of the image. After taking the Fourier magnitude spectrum of the modulus of it, we reach to the RST invariant domain. Watermark is inserted in the domain and inverted to have the watermarked image. One problem with this method is that they have implementation difficulty. The log-polar and inverse log-polar mapping process uses interpolation that causes a degradation of the watermark and fidelity loss of the watermarked image. The second problem is in that they need the original image for the watermark detection. Any geometric distortion can be inverted with the original image. Watermarks that are invariant to geometric distortions can be designed [7]. They use the Fourier-Mellin transform for the required invariance. They define an invariant vector from the central slices of the log-polar mapped Fourier magnitude spectrum. A watermark is embedded by modifying the vector. Algorithms using the Fourier-Mellin transform suffer serious implementation difficulties. The log-polar and inverse log-polar mapping introduces errors during insertion. As they use the Fourier magnitude spectrum, interpolation performance is poor because interpolation only performs well with the sample values with the same scale. There are many other implementation problems to consider [6][7]. Watermarking algorithms using a feature of an image were proposed as the second generation watermark [8][9]. As features of the image have high invariance to distortions, they can be used as a key to find the insertion location. We propose a feature based image watermarking method that is resistant to geometrical attacks. An invariant feature vector is defined with higher order spectra (HOS) of an image. The HOS were introduced as spectral representations of cumulants or moments of ergodic processes, and are useful in the identification of nonlinear and non-Gaussian random processes as well as deterministic signals [10][11]. The use of HOS for our feature-based watermark is motivated as HOS are translation invariant and they are zero for Gaussian noise. For the use of HOS, we adopt the bispectrum (the third-order spectra) feature which is known to have a wide range of invariance properties. Invariant bispectrum features have been used in pattern recognition for texture analysis and image classification [12][13]. We define a bispectrum vector from the projections of an image. The vector is modified and inverted to have the watermarked

Title Suppressed Due to Excessive Length

147

image. However, due to its lossy nature of the inverse process, we can not detect the modified vector after the inversion. As argued in [7], we believe that the strong invariance of the embedding function is not necessary. We can formulate this as follows. With an embedding function, Y (w, C), we generate the watermarked image Cw from the cover image C and the watermark w. Instead of detecting the inserted signal w from Cw , the detector X(Cw ) extracts the signal mixed with the watermarking system distortion ns as follows: X(Cw ) = w = w + ns

(1)

If the function Y can generate inverted image exactly during the embedding procedure, we have ns = 0 and we can extract the exact embedded watermark. However, as in [6] and [7], when we use an embedding function that has lossy inverse procedure, ns is not zero. These inversion losses occur when we apply the continuous functions to discrete images. In these situations, we still have to be able to detect w from the distorted w . This problem can be solved in several approaches. By defining a function that maps w from w , the embedded watermark can be extracted. Another way to avoid this problem is to design an inversion procedure that can minimize ns . These approaches generally introduce complexity to the system with high cost. We propose a low cost method using the detector information during the insertion procedure. We use a form of informed embedding of watermarking with side information [14]. First, we design a detector that extracts the feature vector from the projections of the test image. During the embedding procedure, the detector is called to estimate w . If w has a detection value significantly greater than values for previously defined watermarks, it is accepted as the watermark and it is expected to be extracted at the detector instead of w. We repeat this procedure with different watermarks until we are successful. Watermarks are generated through this iterative routine to guarantee their uniqueness at the detector. Our approach is similar to [7]. We define a vector from the projections. However, our method is different from them in that we use the bispectrum feature vector which has a wide range of invariance properties. We devised a new insertion method which does not require exact inversion process. Our method is more resilient to tampering as we embed a signal into the Fourier phase spectrum while the previous methods use the magnitude spectrum. This is because the phase components of the discrete Fourier transform (DFT) have more psychovisual impact than magnitude spectrum and as a consequence, malicious parties would need to cause unacceptable damage to the quality of the image in order to remove the watermark [15]. The proposed method is evaluated using the StirMark [2] benchmark software. The experimental results show that our algorithm performs well against the geometric distortions and other signal attacks. The rest of this paper is organized as follows: Section 2 describes the bispectrum feature of images; Section 3 presents the watermarking algorithm; Section 4

148

Hyung-Shin Kim et al.

4

x 10 5 4.5

150

4

s

g(s,θ)

100

y

3.5 −50

θ

3

s

0

x

2.5 2

50

1.5

100

1

i(x, y)

150 0.5 0

50

(a)

100

150

(b)

Fig. 1. Image decomposition with the Radon transform : (a) Projection process (b) 1-D Projection of Lena image

shows the experimental results of the proposed method; In section 5, we conclude with the contribution of our approach and directions for future development.

2

Bispectrum Feature Vector of Images

The bispectrum, B(f1 , f2 ), of a 1-D deterministic real-valued sequence is defined as B(f1 , f2 ) = X(f1 )X(f2 )X ∗ (f1 + f2 )

(2)

where X(f ) is the discrete-time Fourier transform of the sequence x(n) at the normalized frequency f . By virtue of its symmetry properties, the bispectra of a real signal is uniquely defined in the triangular region of computation, 0 ≤ f2 ≤ f1 ≤ f1 + f2 ≤ 1. A 2-D image is decomposed into N 1-D sequences g(s, θ) using the Radon transform. The Radon transform g(s, θ) of a 2-D image i(x, y) is defined as its line integral along a line inclined at an angle θ from the y-axis and at a distance s from the origin. This projection process and the Radon transform of Lena image is shown in Fig. 1. The projection slice theorem [16] states that the Fourier transform of the projection of an image on to a line is the 2-D Fourier transform of the image evaluated along a radial line. From the theorem, we can use 2-D Fourier transform instead of the Radon transform during implementation.

Title Suppressed Due to Excessive Length

149

A parameter p(θ) is defined as the phase of the integrated bispectra of a 1-D Radon projection g(s, θ) along the line of f1 = f2 and it can be expressed with the polar mapped 2-D DFT as follows using the projection slice theorem:




0.5

p(θ) =  f1 =0+ 0.5

B(f1 , f1 )df1


 =

2



∗



I (f, θ)I (2f, θ)df

(3)

f1 =0+

Though the parameter can be defined along a radial line of slope a, 0 < a ≤ 1 in the bifrequency space, we compute p(θ) at a = 1, where f1 = f2 . In this way, we can avoid interpolation during the computation of p(θ). A vector p of length N is defined as p = (p(θ1 ), p(θ2 ), . . . , p(θN )). From the properties of the Radon transform and bispectrum parameter p(θ), p is invariant to dc-level shift, amplification, translation, scaling, and Gaussian noise [12]. As a rotation of the 2-D image results in a cyclic shift in the set of projections, p will be cyclically shifted as well. In [12], p was used as a feature for object recognition. We show the invariance properties of p against rotation, scaling, and translation in the following. 2.1

Translation

A translated version of an image i(x, y) is represented as i (x, y) = i(x + x0 , y + y0 )

(4)

The Fourier transform of i (x, y) is I  (fx , fy ) and it is given by I  (fx , fy ) = I(fx , fy ) · ejx0 fx · ejy0 fy

(5)

If we now rewrite (4) using polar coordinates, fx = f cosθ fy = f sinθ

(6) (7)

I  (f, θ) = I(f, θ) · ejx0 f cosθ · ejy0 f sinθ

(8)

then (5) becomes,



From (3), the parameter p (θ) becomes, p (θ)




0.5

= 0+

I 2 (f, θ)I ∗ (2f, θ)ej(2x0 f cosθ+2y0 f sinθ−2x0 f cosθ−2y0 f sinθ) df



150

Hyung-Shin Kim et al.




0.5

=

I 2 (f, θ)I ∗ (2f, θ)df



0+

= p(θ)

(9)

As (9) shows that p(θ) is invariant to translation, p is invariant to translation. 2.2

Scaling

A scaled image i (x, y) can be expressed as i (x, y) = i(sx, sy)

(10)

where s is a scale factor. The polar mapped Fourier transform of i (x, y) is achieved using (6) and (7) and it is shown as follows,   f  ,θ (11) I (f, θ) = s · I s As p (θ) integrates B(f, θ) between 0 and a half of the Nyquist frequency, assuming fs < 0.5, (11) will show the same result with that of using I(f, θ). In practice, we found this assumption can be accepted up to 50% scaling down. This can be shown as follows,     f 2f , θ · I∗ , θ df s s + 0      0.5/s f 2f 2 ∗  = ,θ ·I , θ df I s s 0+ 
 0.5 2 ∗  I (f, θ) · I (2f, θ)df =

p (θ) = 






0.5

s3 I 2

0+

= p(θ)

(12)

As p(θ) is invariant to scale, p is invariant to scale. 2.3

Rotation

An image i (x, y) rotated by α◦ and its Fourier transform can be expressed as, i (x, y) = i(xcosα + ysinα, −xsinα + ysinα) I (fx , fy ) = I(fx cosα + fy sinα, −fx sinα + fy cosα) 

(13)

The polar mapped I  (f, θ) will have circularly shifted I(f, θ − α) as 2-D Fourier transform rotates as well when an image rotates. This can be shown from I  (fx , fy ) substituting (13) with (6) and (7) as follows,

Title Suppressed Due to Excessive Length

151

I  (fx , fy ) = I(f cosθcosα + f sinθsinα, −f cosθsinα + f sinθcosα) = I(f cos(θ − α), f sin(θ − α)) I (f, θ) = I(f, θ − α)

(14) (15)



Then, p (θ) becomes,






p (θ) =

0.5 0+

∗



I (f, θ − α)I (2f, θ − α)df 2



= p(θ − α)

(16)

Hence, p will be circularly shifted according to the rotation by α◦ and for the detection, we will circularly shift p before measuring similarity.

3

Algorithm

We use an invariant feature vector of the image as a watermark. The watermark is embedded by selecting a vector from the set of extracted feature vectors. The chosen feature vector is used as the watermark and the inverted image is used as the watermarked image. The watermarks are generated through an iterative feature modification and verification procedure. This procedure avoids the interpolation errors that can occur during insertion and detection of the watermark. At detector, the feature vector is estimated from the test image. We use rootmean-square-error (RMSE) as our similarity measure instead of the traditional normalized correlation. It is because the feature vectors are not white and the correlation measure can not produce peak value when they are same vectors. Hence, we measure the distance between two vectors using RMSE function. If the RMSE value is smaller than the threshold, the watermark is detected. The original image is not required at the detector. We define the detector first and an iterative embedder is designed using the detector. 3.1

Watermark Detection

Detector takes a test image I(x, y) and extracts a feature vector p of length N from the polar mapping of the Fourier spectrum of I(x, y). The similarity s, is defined with RMSE between the extracted vector p and the watermark s as following,  N 1  [p(θi ) − wi ]2 (17) s(p, w) =

N i=1 where N is the length of the feature vector. If s is smaller than the detection threshold T , the watermark is detected.

152

3.2

Hyung-Shin Kim et al.

Watermark Embedding

A watermark is embedded by modifying the feature vector p of an input image. The 2-D Fourier transform X(f1 , f2 ) of an M ×M input image I is computed and polar mapped to construct the M × N 2-D matrix Xp (f, θ) at N evenly spaced angles from 0 to 180◦ . We can shape the feature vector p by modifying some of its components p(θw ) at θw ∈ 0, . . . , 180. If we shift all the phase spectrum of the image by δ along the radial angle of θw , we have a modified component p (θw ) as follows: p (θw ) = 




0.5

X(f )ejδ X(f )ejδ X ∗ (f + f )e−jδ df

0+ 0.5


 =



∗





X(f )X(f )X (f + f )df + δ 0+

= p(θw ) + δ

(18)

After shifting the phases of the selected columns of Xp (f, θ), we inverse transform it to have the watermarked image I  . However, we cannot extract the embedded signal δ from I  at detector. As reported in the previous researches [5][6], algorithms that modify the Fourier coefficients in polar or log-polar domain suffer three problems. First, interpolation at embedder causes errors at detector. During the polar or log-polar mapping, an interpolation method should be involved because we are dealing with discrete image data. Though we choose more accurate interpolation function, there will be some errors as long as we are working with discrete images. Second, zeropadding at detector degrades the embedded signal further. By zero-padding, spectrum resolution is improved but interpolation error is increased. Third, the interrelations of the Fourier coefficients in the neighboring angles cause ‘smearing’ effect of the modified feature values. If we modify a single component p(θ), it affects other values nearby. In [7], the authors have provided approximation methods to reduce the effects of these errors. Instead of using a similar method, we approach this problem differently. After modifying some components of the feature vector, the watermarked image which contains the implementation errors is produced by the inverse 2-D DFT. We extract the feature vector from this watermarked image and use it as the embedded watermark instead of the initially modified feature vector. In this way, we can embed the watermark without exact inversion of the modified signal. However, to guarantee the uniqueness of the watermark and its perceptual invisibility after insertion, we need a verification procedure to use it as a watermark. Fig. 2 shows the geometry of feature vector space. Black dots represent feature vectors and each dot corresponds to a feature vector of an image. The solid circles show the robustness boundaries resulted from geometric distortion. r1 is the maximum distortion of the feature vector resulted from a geometric distortion. The inside region of the solid circle means

Title Suppressed Due to Excessive Length

153

Fig. 2. Geometrical modeling of feature vector space a set of distorted images where the centered feature vector can be successfully extracted. The dotted circles show the minimum feature distance r2 between the feature vectors of unmarked images. The distance r2 is determined empirically by measuring the feature distances d1, d2, d3, . . . between unmarked images and taking the minimum among them. The feature distances r1 and r2 are measured with the similarity s. Vectors D, I, K, and L are the feature vectors extracted from four different unmarked images. Vectors A, B, C, and E are the valid watermarks modified from a feature vector D. For a modified feature vector to be used as a valid watermark, the distance between the modified vector and original vector should be larger than r1 and smaller than r2. During embedding, the extracted feature vectors from the inverted image will be checked if they meet the requirements for valid watermarks. This validity check routine will be performed iteratively until we get the distinguishable s and meet unobtrusiveness requirement.

4

Experimental Results

Experiments are performed with 100 images from the Corel image library [17]. For valid watermark generation, r1 and r2 are determined empirically using unwatermarked images. The similarity s is measured between unmarked test images and the smallest s is chosen for r2. For the determination of r1, robustness of the defined feature vector is tested. Similarity s is measured between the original image and attacked images. The largest s is chosen for r1. For the robustness test, we set r1 = 4.5 and r2 = 20. Feature vectors are modified with δ = 5◦ ∼ 7◦ at randomly selected angles. The number of insertion angles

154

Hyung-Shin Kim et al.

(a)

(b)

Fig. 3. Embedding example : (a) Watermarked Lena image embedding at θw = 35◦ and 125◦ (b) Amplified difference between wateraraked and original image is randomly determined between 1 and 3. T = 4.5 is used for the detection threshold. Watermarks are generated using the iterative procedure described in section 3.2. During the iteration, parameters are adjusted accordingly. Fig. 3 shows the watermarked Lena image and the amplified difference between original and watermarked images. The watermarked image shows PSNR of 36dB and the embedded signal is invisible. During the watermark insertion, we maintained the PSNR higher than 36dB. Robustness of the watermark against each attack is measured with 100 unmarked images and 100 marked images. We measure the empirical probability density function (pdf) of the computed with histogram. Assuming that the empirical pdf of s can be approximated by a normal distribution, false positive probability (Pf p ) and false negative probability (Pf n ) can be computed using the estimates of mean and variance. Random geometric attack performance is the worst with Pf p = 4.00 × 10−3 and Pf n = 6.20 × 10−2 . It shows that our method performs well over the intended attacks. The similarity histograms and receiver operating characteristic (ROC) curves (Pf p versus Pf n for several thresholds) are produced for analysis. In this section, five attacks are examined: rotation, scaling, random geometric distortion, compression and Gaussian noise. 4.1

Rotation

Fig. 4 shows the histogram of s and ROC curve. Though the rotation by large angle can be detected by cyclically shifting the extracted feature vector, the performance of rotation by a large angle is poor due to the difficulty of interpolation in the Fourier phase spectrum. For this reason, we show the results of rotation by small angles. With T = 4.5, Pf p is 6.03 × 10−2 and Pf n is 1.90 × 10−3 . False

Title Suppressed Due to Excessive Length

155

ROC curve for rotation Histogram of similarity s

0

180 Unmarked images Marked images

160

−2 −4

Number of occurance

140 120

fn

log (P )

−6 −8

10

100 80

−10

60

−12 40

−14

20 0 0

5

10 Similarity s

15

20

−16 −3

−2.5

−2

−1.5 log (P ) 10

(a)

−1

−0.5

0

fp

(b) ◦

◦

Fig. 4. Rotation ±0.25 , ±0.5 : (a) Histogram of s (b) ROC Curve negative probability shows better performance than false positive probability in this attack. This is because the pdf of the similarity between unmarked images and watermarks has relatively large variance that resulted into the larger false positive probability. As Pf p and Pf n show, our method is robust against rotation by small angle. 4.2

Scaling

The detection histogram was measured using 50% scaled down images and 200% scaled up images. As the histogram in Fig. 5 shows, the watermarked images show strong resistance to scaling attack. The ROC curve shows that Pf p is 5.6 × 10−3 and Pf n is 1.14 × 10−4 . These values are relatively lower than other attacks and this means our method performs well with scaling attacks. Our method has strong robustness against scaling attack even after scaling down to 50%. 4.3

Random Geometric Distortion

This attack simulates the print-and-scanning process of images. It applies a minor geometric distortion by an unnoticeable random amount in stretching, shearing, and/or rotating an image [2]. In Fig. 6, the histogram shows large variance in the similarity between watermark and unmarked image. As the result, Pf p is 4.0 × 10−3 and Pf n is 6.2 × 10−2 , which are relatively large compared with others. Not many previous methods survive this attack and our algorithm works well even with those numbers. 4.4

Compression

JPEG compression with Q=30 and 70 was applied after watermark embedding. With Q=30, the watermarked image fidelity is unacceptable. However, our method survives the harsh compression attack. Fig. 7 shows the histogram

156

Hyung-Shin Kim et al.

ROC curve for scale Histogram of similarity s

0

200 Unmarked images Marked images

180

−2

Number of occurance

160

−4

140

log (P )

−6 fn

120

−8

10

100 80

−10

60

−12

40

−14 20 0 0

5

10 Similarity s

15

20

−16 −7

−6

−5

−4 −3 log (P ) 10

(a)

−2

−1

0

fp

(b)

Fig. 5. Scale 50%, 200% : (a) Histogram of s (b) ROC Curve ROC curve for random geometric distortion

Histogram of similarity s

0

25 Unmarked images Marked iamges

−2

20 Number of occurance

−4

log (P )

−6 fn

15

10

−8

10

−10 −12

5

−14 0 0

5

10 Similarity s

(a)

15

20

−16 −7

−6

−5

−4 −3 log (P ) 10

−2

−1

0

fp

(b)

Fig. 6. Random geometric distortion : (a) Histogram of s (b) ROC Curve and ROC curve. Pf p is 3.5 × 10−3 and Pf n is 2.2 × 10−20 . The false negative probability is extremely low and this is because our feature vector is not affected by any high frequency noises. Our method has strong resilience to JPEG compression. 4.5

Gaussian Noise

As our invariant feature vector is defined from HOS, it must be invariant against additive Gaussian noise. Gaussian noise was added to the watermarked image by convolving a 3 × 3 kernel as follows

Title Suppressed Due to Excessive Length

157



 121 G = 2 4 2 121

(19)

The histogram of the similarity of unmarked and marked images is shown in Fig. 12. (a). The ROC curve is shown in Fig. 8. From the curve, Pf p is 6.78 × 10−4 and Pf n is 1.9 × 10−20 . These probabilities show that our method is robust against the Gaussian noise.

ROC curve for compression

Histogram of similarity s

0

200 Unmarked images Marked images

180

−2

160 Number of occurance

−4

log (P )

140 −6

10

fn

120 100

−8

80 −10

60 40

−12

20 0 0

5

10 Similarity s

15

20

−14 −7

−6

−5

−4

−3

−2

−1

0

log (P ) 10

(a)

fp

(b)

Fig. 7. JPEG Compression Q=30 and 70 : (a) Histogram of s (b) ROC Curve ROC curve for Gaussian noise

Histogram of similarity s

0

60 Unmarked images Marked images

−2

50 Number of occurance

−4

40

fn

log (P )

−6 −8

10

30

−10

20 −12

10

0 0

−14

5

10 Similarity s

(a)

15

20

−16 −9

−8

−7

−6

−5

−4

−3

−2

log (P ) 10

fp

(b)

Fig. 8. Additive Gaussian noise : (a) Histogram of s (b) ROC Curve

−1

0

158

5

Hyung-Shin Kim et al.

Conclusions

We propose a new RST invariant watermarking method based on an invariant feature of the image. A bispectrum feature vector is used as the watermark and this watermark has a strong resilience on RST attacks. This approach shows a potential in using a feature vector as a watermark. An iterative informed embedding procedure is designed to overcome the problem of inverting watermarked image. This method can be generalized for other embedding functions that do not have exact inverse function. In all our experiments, we have shown the empirical probability density functions with histograms and the ROC curves. Experimental results show that our scheme is robust against wide range of attacks including rotation, scaling, JPEG compression, random geometric distortion and Gaussian noise.

Acknowledgements This work was supported by the Korea Science and Engineering Foundation (KOSEF) through the Advanced Information Technology Research Center (AITrc). The authors would like to thank Dr. Ingemar Cox and Matt Miller of NEC Research Institute for helpful discussions on Fourier-Mellin transform and watermarking with side information. In addition, the authors would like to thank K. M. Park of Korea Advanced Institute of Science and Technology (KAIST) for helpful discussions on higher order spectra.

References [1] F. Hartung and M. Kutter, “Multimedia watermarking technique,” Proc. IEEE, Vol 87, pp. 1079 1107, July, 1999. 145 [2] F. A. P. Petitcolas, R. J. Anderson, and M. G. Kuhn, “Attacks on copyright marking systems,” in Proc. 2nd Int. Workshop on Information Hiding, pp. 218-238 , 1998. 145, 147, 155 [3] S. Pereira and T. Pun, “Robust template matching for affine resistant image watermarksI,” IEEE Trans. Image Processing, Vol 9, pp. 1123-1129, July, 2000. 146 [4] G. Csurka, F. Deguillaume, J. J. K. O’Ruanaidh, and T. Pun, “A Bayesian approach to affine transformation resistant image and video watermarking, ” Proc. 3rd Int. Workshop on Information Hiding pp. 315-330, 1999. 146 [5] M. Kutter, “Watermarking resisting to translation, rotation, and scaling,” Proc. SPIE Multimedia Systems Applications, pp. 3528 423-431, 1998. 146, 152 [6] J. J. K. O’Ruanaidh and T. Pun, “Rotation, scale, and translation invariant spread spectrum digital image watermarking”, Signal Processing, Vol 66, pp. 303-317, 1998. 146, 147, 152 [7] C. Y. Lin, M. Wu, J. A. Bloom, I. J. Cox, M. L. Miller and Y. M. Lui, “Rotation, scale, and translation resilient watermarking for images,” IEEE Trans. Image Processing, Vol 10. May, pp. 767-782, 2001. 146, 147, 152

Title Suppressed Due to Excessive Length

159

[8] M. Kutter, S. K. Bhattacharjee, and T. Ebrahimi, “Towards second generation watermarking schemes,” Proc. IEEE Int. Conf. Image Processing, pp. 320-323, 1999. 146 [9] S. Guoxiang and W. Weiwei, “Image-feature based second generation watermarking in wavelet domain,” Lecture Notes in Computer Science, Vol l2251, pp. 16-21, 2001. 146 [10] C. Nikias and M. Raghuveer, “Bispectrum estimation: A digital signal processing framework,” Proc. IEEE, Vol 75, July pp. 869-889 1987. 146 [11] C. L. Nikias and A. P. Petropulu, Higher-Order Spectra Analysis, PTR Prentice Hall, Englewood Cliffs, New Jersey, 1993. 146 [12] V. Chandran, B. Carswell, B. Boashash, and S. Elgar, “Pattern recognition using invariants defined from higher order spectra: 2-D image inputs,” IEEE Trans. Image Processing, Vol 6, May, pp. 703-712, 1997. 146, 149 [13] Y. Horikawa, “Bispectrum-based feature of 2-D and 3-D images invariant to similarity transformations,” Proc. IEEE Int. Conf. Pattern Recognition, pp. 511-514, 2000. 146 [14] I. J. Cox, M. L. Miller, and A. L. Mckellips, “Watermarking as communications with side information”, Proc. IEEE, Vol 87, July, pp. 1127-1141, 1999. 147 [15] M. H. Hayes, “The reconstruction of a multidimensional sequence,” IEEE Trans. Acoustics, Speech and Signal Processing, Vol 4, pp. 140-154, 1992. 147 [16] A. K. Jain, Fundamentals of Digital Image Processing, Prentice Hall, Englewood Cliffs, NJ, 1989. 148 [17] Corel Corporation, Corel Stock Photo Library 3. 153

Audio Watermark Robustness to Desynchronization via Beat Detection Darko Kirovski and Hagai Attias Microsoft Research One Microsoft Way, Redmond, WA, USA {darkok,hagaia}@microsoft.com

Abstract. Watermarks are hidden, imperceptible, and robust marks augmented into a host signal such as audio or video. Recent studies show that in the presence of an adversary, ”blind” watermark detection within an attacked clip is an exceptionally difficult task. In this paper, we explore two technologies, beat detection and block redundant coding, to combat de-synchronization and watermark estimation as two attacks that have demonstrated superior effectiveness in preventing watermark detectors from reliably accomplishing their goal. As a result, we have achieved robustness of spread-spectrum watermarks augmented in audio clips to almost arbitrary constant time-warp, pitch-bending, and wowand-flutter of up to 1%. The adversary can remove the watermark by subtracting an estimate of the watermark from the signal with an amplitude in excess of 6dB with respect to the host. Such an attack vector typically affects substantially the fidelity of the ”pirated” recording.

1

Introduction

With the growth of the Internet, unauthorized copying and distribution of digital media has never been easier. As a result, the music industry claims a multi-billion dollar annual revenue loss due to piracy [20], which is likely to increase due to peer-to-peer file sharing Web communities. One source of hope for copyrighted content distribution on the Internet lies in technological advances that would provide ways of enforcing copyright. Traditional data protection methods such as scrambling or encryption cannot be used, since the content must be played back in the original form, at which point it can always be re-recorded and then freely distributed. A promising solution to this problem is marking the media signal with a secret, robust, and imperceptible watermark. The media player at the client side can detect this mark and consequently enforce a corresponding e-commerce policy. Recent introduction of a content screening system that uses asymmetric direct sequence spread-spectrum WMs has significantly increased the value of WMs, because a single compromised detector (client player) in that system does not affect the security of the content [14]. In order to compromise the security of such a system without any traces, an adversary needs to break large number of players for a typical two-hour feature movie. Although the effectiveness of F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 160–176, 2003. c Springer-Verlag Berlin Heidelberg 2003


Audio Watermark Robustness to Desynchronization via Beat Detection

161

any content screening system requires global adoption of many standards, the industry is determined to carry out such a task [21]. Watermarking Technologies. Audio watermarking schemes rely on the imperfections of the human auditory system (HAS) [11]. Numerous data hiding techniques explore the fact that the HAS is insensitive to small amplitude changes, either in the time [2] or frequency [5, 19, 23] domains, as well as insertion of low-amplitude time-domain echoes [7]. Information modulation is usually carried out using: direct sequence spread spectrum (SS) [24] or quantization index modulation (QIM) [4]. The main advantage of both SS and QIM is that WM detection does not require the original recording. However, it is important to review the disadvantages that both technologies exhibit. First, the marked signal and the WM have to be perfectly synchronized at WM detection. Next, to achieve a sufficiently small error probability, WM length may need to be quite large, increasing detection complexity and delay. Finally, the most significant deficiency of both schemes is that by breaking a single player (debugging, reverse engineering, or the sensitivity attack [16]), one can extract the secret information (the SS sequence or the hidden quantizers in QIM) and recreate the original (in the case of SS) or create a new copy that induces the QIM detector to identify the attacked content as unmarked. While an effective mechanism for enabling asymmetric SS watermarking has been developed [14], an equivalent system for QIM does not exist to date, which renders QIM at this point relatively impractical for content screening. 1.1

Spread-Spectrum Watermarking of Audio via Beat Detection

One the most effective attacks on almost any type of watermarking system is de-synchronization. In order to validate existence of a WM, the detector usually computes a certain statistical measure dependent upon the WM – however, the statistical measure is accurate only if the location of the detector is known with relatively high precision. A typical de-synchronization attack, such as Stirmark [1], aims at rescaling the multimedia object with a variable scaling factor such that both the location and the size of the WM are changed as much as possible under the hi-fidelity requirement. Kirovski and Malvar proposed block repetition coding of the WM chip combined with multi-test WM search as a remedy for this problem in audio [12]. Unfortunately, the deployed redundancy, while providing robustness to de-synchronization, opens doors to another attack: watermark estimation [15]. The more redundancy, the better the robustness, but also the more accurate the attacker’s WM estimate. In this paper, we introduce beat detection as the key tool for enabling synchronicity between the WM detector and the location of the WM in an audio clip. In an exemplary watermarking system, we perform marking in several steps. First, we identify the average beat period in the clip. Then, we identify the location of each beat as accurately as possible. Next, we rescale the clip such that

162

Darko Kirovski and Hagai Attias

the length of each beat period is constant and equal to the average beat period rounded to the nearest multiple of a certain block of samples (typically, 1024 samples). The rescaled clip is marked with a SS sequence where each chip has an amplitude proportional to the variance of the host signal in its locality. The marked content is finally created by rescaling the marked clip back to its original tempo. Assuming the adversary may have rescaled the content with a variable but slow-varying scaling factor, we detect the WM using a multi-test search. First, the same beat-scaling transform is applied to the clip as during embedding. Next, using the same multi-search process as described in [12], we perform matched filtering with the hidden secret in order to detect WM existence. Using beat detection as means of synchronization, we reduce the redundancy of the block repetition codes up to 4 times, while attaining the same robustness to variable time-warp. Another consequence of using beat detection as a synchronization mechanism is that WMs can be placed at known positions in the clip (e.g. starting from a beat) which can speed up the search up to an order of magnitude compared to ”blind” and exhaustive search [12]. In the remainder of the paper, we describe in detail the marking and detection procedures and we present a beat detector based on a variant of the expectation-maximization (EM) algorithm [6]. We investigate the robustness of such a technology with respect to WM estimation and de-synchronization both analytically and empirically. We show that if the variance of the time-warp attack within a single beat does not exceed a certain realistic limit value, the multi-search highly reliably synchronizes the detector with the location of the WM in the clip. The limit on the time-warp variance is relatively high, about 1%, knowing the strong impact of such an attack to sound fidelity. Finally, we show that, based on the deployed redundancy, the adversary can remove the WM by subtracting an estimate of the WM from the signal with an amplitude in excess of 6dB with respect to the host, a noise signal that has a strong impact on sound fidelity. 1.2

Applications of Watermarking Technologies

While it seems that WMs as defined can provide powerful copyright protection tools [10], it turns out that all of the four most important copyright protection applications actually do not need classic WMs1 . Content screening – assumes that media players detect WMs before playing the content and if the WM is present and the user does not have the license to play the content the media player refuses to play the media. Clearly, by the definition of both classic SS and QIM watermarking, the player needs to store the secret (SS sequence or the QIM quantizers) in order to detect the WM. The adversary in such case does not target the robustness of the WM but aims to 1

Imperceptible hidden marks that are robustly and reliably detected in the presence of the adversary in a ”blind” manner, i.e. without having access to the original recording.

Audio Watermark Robustness to Desynchronization via Beat Detection

163

reverse engineer or debug the media player in order to extract the hidden secret, i.e. the root of system security. A single broken client breaks the security of the entire system in such a scenario. Thus, some form of public-key watermarking is required, where the adversary cannot break the security of the entire system by breaking a single client as the detection key should not reveal the hidden secret. Proof of authorship – assumes that the author of the content is distributing only a marked version of her recording, where the mark serves as a statistically undeniable proof of creation. In this scenario, both the original and the secret are securely stored only with the author and detection is performed potentially only in court. ”Blind” detection is really not a requirement here, because in court, the author uses both the original and the hidden secret to demonstrate authorship. Tracing roots of piracy – is usually a goal of media studios, who create several copies of the original content each marked with a distinct mark (fingerprint) and distribute these copies to their clients. If a ”pirated” copy is found, the marks are used to trace that copy to the client-”pirate”. Again, ”blind detection” is not an issue just as in the previous case because the media studios use both the original copy as well as the fingerprint data only internally or in court. The main system requirement is collusion resistance, i.e. the number of copies that a clique of malicious users needs to create a clean copy or a copy which points to a client not in the clique [3]! Tracing unlicensed broadcast – refers to automated monitoring of the content played by a broadcasting station (radio, TV, e-radio, etc.) against a database of licenses. The system creates a proof of an unlicensed broadcast and sends it to the copyright owners. Commonly, two technologies are mentioned in this context: non-robust WMs or content identifiers (hashes) [8]. WM robustness in the most general sense, is not a system requirement as it is expected that due to legal penalties related to ”willful infringement”, the broadcaster is not likely to tamper with the WMs. In this paper, we refer to content screening as the main target of our watermarking technology. We assume that the dual watermarking and fingerprinting system [14] is deployed as a system-level solution, which poses a requirement of robustness of SS WMs in the traditional sense.

2

Fundamentals of Spread-Spectrum Watermarking

Beat detection can be potentially attached to any audio watermarking system: e.g. SS or QIM. However, for the sake of applicability to content screening and in the light of using the dual watermarking and fingerprinting system, in this paper, we restrict our work exclusively to SS. In this section, we review the fundamentals of SS data hiding. The media signal to be watermarked x ∈ RN can be modeled as a random vector, where each element xi ∈ x is a normal independent identically distributed (i.i.d.) random variable with standard deviation σx , i.e. xi ∼ N (0, σx ).2 Signal x 2

N (a, b) denotes a Gaussian with a-mean and b2 -variance.

164

Darko Kirovski and Hagai Attias

actually represents a collection of blocks of samples from an appropriate invertible transformation on the original audio signal [5], [23], [24]. Modeling x with a gaussian is relatively accurate because at detection time samples with redundant WM information are averaged – regardless of the pdf of a single sample, due to the Central Limit Theorem their sum quickly takes the looks of a gaussian. A watermark is defined as a direct SS sequence w, which is a vector pseudorandomly generated in w ∈ {±1}N . Each element wi is usually called a “chip”. WM chips are generated such that they are mutually independent with respect to the original recording x. The marked signal y is created by vector addition y = x + δw, where δ is the WM amplitude. Signal variance σx2 directly impacts the security of the scheme: the higher the variance, the more securely information can be hidden in the signal. Similarly, higher δ yields more reliable detection, less security, and potential WM audibility. Let
p · q denote the normalized inner product of vectors p and q, i.e. p · q ≡ N −1 pi qi , with p2 ≡ p·p. For example, for w as defined above, we have w2 = 1. A WM w is detected by correlating (matched filtering) a given signal vector z with w: √ C(z, w) = z · w = E[z · w] + N (0, σx / N ).

(1)

Under no malicious attacks or other signal modifications, if the signal z has been marked, then E[z · w] = δ, else E[z · w] = 0. The detector decides that a WM is present if C(z, w) > θ, where θ is a detection threshold that controls the tradeoff between the probabilities of false positive and false negative decisions. We recall from modulation and detection theory that under the condition that x and w are i.i.d. signals, such a detector is optimal [25]. Finally, the probability PF A that the detection decision is a false alarm is quantified as:

PF A

1 = Pr[C(z, w) ≥ θ|(z = x)] = erfc 2

 √  θ N √ , σx 2

(2)

and the probability PMD that the detection decision is a misdetection, equals:

PMD

1 = Pr[C(z, w) ≤ θ|(z = x + w)] = erfc 2



√  (E[z · w] − θ) N √ . σx 2

(3)

Due to the de-synchronization and estimation attack, straightforward application of the above mentioned SS WM principles does not provide reliability nor robustness. In the following sections, we outline the deficiencies of the basic SS WM paradigm and provide solutions for improved SS WM robustness and detection reliability.

Audio Watermark Robustness to Desynchronization via Beat Detection

3

165

Hiding Spread-Spectrum Sequences in Audio Signals

In the developed watermarking system, vector x is composed of magnitudes of several frames of a modulated complex lapped transform (MCLT) [17] in the dB scale. The MCLT is a 2x oversampled DFT filter bank, used in conjunction with analysis and synthesis windows that provide perfect reconstruction. After addition of the WM, we generate the time-domain marked audio signal by combining the vector y = x + δw with the original phase of x, and passing these modified frames to the inverse MCLT. Typically, WM amplitude δ is set to a fixed value in the range {0.5-2.5}dB. For example, our technology has passed the ”golden ears test” for δ = 1.5dB and a benchmark suite consisting of pop, rock, jazz, classical, instrument solo, and vocals musical pieces. For the typical 44.1kHz sampling, we use a length-2048 MCLT. Only the coefficients within 200-2kHz are marked and only the audible magnitudes in the same sub-band are considered during detection. Sub-band selection aims at minimizing carrier noise effects as well as sensitivity to downsampling and compression. In addition, we use several additional mechanisms (already detailed in [12], [13]) to cope with the problems inherent in SS watermarking. Psycho-Acoustic Masking. (PAFM) The WM detector must correlate only the audible frequency magnitudes with the WM [23], because the inaudible portion of the frequency domain is significantly more susceptible to attack noise. Consequently, the attacker can remove the entire inaudible portion of the spectrum and reduce the proof of authorship, as correlation of silence and any WM equals zero. Such an attack can be effective because the inaudible portion often dominates the frequency spectrum of an audio signal [19]. In order to quantify the audibility of a particular frequency magnitude, we use a simple PAFM model [18] and a modified correlation test that addresses a consequence of using PAFM described in [12]. Cepstrum Filtering. The variance σx2 of the original signal directly affects the carrier noise in Eqn.1. Audio clips with large energy fluctuations or with strong harmonics are especially bound to produce large σx . Thus, we use cepstrum filtering, a nonlinear processing step to reduce the carrier noise by filtering out the low-frequency components of the signal cepstrum [12]. Cepstrum filtering preserves the WM because it exists in the higher frequencies of the cepstrum due to its randomness. As a result, cepstrum filtering usually halves σx – thus, in order to attain the performance of a detector that uses cepstrum filtering, a traditional detector must integrate almost four times more magnitude points. Improved Watermark Imperceptiveness. SS WMs can be audible when embedded in the MCLT domain even at low magnitudes (e.g. δ < 1dB). This can happen in MCLT blocks where certain part of the block (up to 10ms) is quiet whereas the remainder of the MCLT block is rich in audio energy. Since the SS

166

Darko Kirovski and Hagai Attias ipl c dn uo sl an ig ir O

m orf sn ar T gn lia c S t-a e B eh T

ipl c dn uo st se T

Watermark window Inverse beat scaling

Beat detector Mean Period

Beat events Beat scaling

iMCLT

x+w

Rescaled signal

New block of chips, w, created every R MCLT blocks

Scaling factor {0.9:1.1}

Beat-Scaling Transform

y

MCLT

WM audible?

WM addition

Analysis window

Yes/No MCLT

x

WM audible?

Watermark window

Yes/No

This test is repeated for a range of timewarp and pitchbending attacks.

PAFM Cepstrum filtering WM Correlation

New block of chips, w, created every R MCLT blocks

WM found

Fig. 1. Block diagram of the WM embedding (left) and detection (right) procedures sequence spreads over the entire MCLT block, it can cause audible noise in its quiet portion. To alleviate this problem, we detect blocks with dynamic content where a SS WM may be audible if added. The blocks are identified according to a certain empirically determined criteria. WMs are not embedded nor detected in such blocks. Fortunately, such blocks do not occur often in audio content; in our benchmark set we identified up to 5% of MCLT blocks per WM as potential hazard for audibility. Putting It Altogether. A block diagram that illustrates how the enlisted technologies, jointly with the beat-scaling transform presented in the next Section, are linked into a cohesive system for audio marking is presented in Figure 1. Reference implementation of our data hiding technology on an x86 platform requires 32 KB of memory for code and 100 KB for the data buffer. The data buffer stores averaged MCLT blocks of 12.1 seconds of audio (for a WM length of 11 seconds). Real-time WM detection under these circumstances requires about 15 MIPS. WM encoding is an order of magnitude faster, with smaller memory footprints.

Audio Watermark Robustness to Desynchronization via Beat Detection

4

167

Preventing De-synchronization via Beat Detection

The correlation metrics from Eqns. 1, 2, and 3 are reliable only if the majority of detection chips are aligned with those used in marking. Thus, an adversary can attempt to de-synchronize the correlation by fluctuating time- or frequencyaxis scaling within the loose bounds of acceptable sound quality. To prevent from such attacks, we use beat detection as a time-synchronization mechanism and block repetition coding of WM chips combined with a multi-test search (as presented in [12]) to provide robustness to variable pitch-bending. The Time-Warp and Pitch-Bending Attack Model. It is important to define the degree of freedom for time- and frequency-scaling that preserves the relative fidelity of the attacked recording with respect to the original. The HAS is much more tolerable to constant scaling rather than wow-and-flutter. Hence, we adopt the following tolerance levels: γT
0.1 for constant time-scaling, γF
0.05 for constant frequency-scaling, and γV
0.01 for the scaling variance (wowand-flutter) along both time and frequency. An additional requirement is that the scaling factor does not change more than γV within a single detected beat. This requirement is probably the least constraining as variable scaling with fast dynamics is commonly highly intolerable. Finally, note that similar tolerance levels have been adopted within the SDMI call for proposals for music screening technologies [21]. 4.1

The Beat-Scaling Transform

One of the most robust events in music is its beat. For example, while one can easily remove and/or add instrument solos and voice with potentially perceptive but still not unpleasant effect, the repetitiveness and relatively small variance of the periodicity of the music beat must be preserved in almost any attack if the adversary aims at creating a marketable content. An overwhelming portion of popular and in particular classical music, can be, in general, rigorously defined across almost all cultures, even ancient, using a notation as illustrated in Figure 2. Rarely, music content experiences intentional and significant rhythm speed-up and even when it happens it does not last more than several seconds. In summary, although music has been authored in diverse ways, primarily with different harmonic scales, one characteristic that is predominant for music is the rigorous constraint for accurate rhythm. We use this characteristic of music to create a transform that aims at enabling synchronicity between the WM detector and mark’s location in an audio clip. For a given audio time-domain signal x(t) ∈ RN , the beat-scaling transform (BST) initially computes two parameters of clip’s rhythm: (i) the average period between two beats T¯ and (ii) the actual beat pattern – a binary vector b(t) ∈ {0, 1}N , where b(t) = 1 denotes a start of a beat or else b(t) = 0. Details of the EM-based beat detector that we have developed are presented in Section 4.2. Lets denote the sorted list of indices of the vector b(t) for which b(t) = 1, as ti , i = 1 . . . K where K is the number of beats in the clip.

168

Piano

dark0 Kirovski and Hagai Attias

I

Fig. 2. First two bars of the sonata in C-major K545 by Mozart. The pulse, or pattern of regular accents, of a musical piece can be broken into individual pulses, or beats. In rhythmic notation, notes are assigned time values by their relation to these beats. The grouping of beats in a piece of music establishes the musics meter. Meter is identified by the time signature, a fractional symbol in which the numerator specifies the number of beats per bar, and the denominator specifies the relative note value assigned to one beat. A time signature of 414 indicates four beats per measure and the 6fourth noteo is given a value of one beat

Fig. 3. An example of t h e basic rescaling entities: x(t) - audio signal, b(t) - beat events denoted as pulses, and a periodic pulse at kT samples where k t N

> specifically restricted slots (not inherited) >> cause-effect >> composition >> inheritance (should be rare in TMRs). 4.2

Accommodating the Watermark Bits

We have devised three general methods for changing the text in such a way that the TMR tree, and consequently our reading of it and the resulting bitstring for the watermark, will be affected by this change. 1. 2. 3.

grafting: cutting/copying of information in one sentence and pasting it into another pruning: cutting of information that is repeated substitution: replacement with equivalent information

In general, the information that can be used for these schemata is chosen by two criteria. The first, most important, is that information that is repeated, established in the TMR through co-reference, can be safely removed, or repeated again. The second is that there is additional information available from the fact database of ontological semantics, and this additional information can be substituted for part of or added to the tree. We will discuss these criteria and their application in depth below. Note that in an important sense, substantive rather than technical, we detect, manipulate, and/or create the LSBs in natural language texts, something that they do not possess so naturally and in such abundance as video and audio data do. In other words, while we do

Natural Language Watermarking and Tamperproofing

203

change the meaning of the sentences we make sure that we do it in the least significant way possible. 4.2.1 Co-reference In order to be coherent, every well-formed text has cohesion, that is, it is about something. This theme will be established early in the text, which then proceeds to add more information about it. The new information will be in relation to the old information already given, and is often explicitly established in this way. If the text we have to watermark is, for example, about the United States bombing Afghanistan, we will expect it to make reference throughout to the concepts “United States,” “Afghanistan,” and “bombing.” These instances of the concepts will be interrelated, because it is, for example, always the same “Afghanistan” the text will refer to. That is, the instances are co-referential. In non-technical terms, for our sample text, Afghanistan is the main theme, or at least one of the main themes. Accordingly, many sentences will be about this nation itself or several of its slot fillers resulting in a rather extensive co-reference of “Afghanistan.” The following are the established co-reference relations for the sample text (see Appendix) with the portion of the text that contains the proposition which instantiates “Afghanistan” on the right: (5)

co-reference-4 bomb-1.target victory-1.theme assault-1.theme fly-air-vehicle-1.path carry-2.destination assault-4.theme assault-6.location ...

“carpet-bombed Taliban front lines in Afghanistan” “With no visible victory so far in Afghanistan” “The United States has been attacking Afghanistan” the occurrence in the example sentence ”fly additional ... troops into the country” “U.S. strikes on Afghanistan” (assault-1 = assault-4) “In Afghanistan, U.S. planes stepped up strikes”

It is safe to assume that the web of co-references woven throughout a text is very tight. To illustrate this fact, in reverse, it is very exceptional that a sentence will not have any co-reference to its surrounding context. In a text about the United States bombing Afghanistan, there will not be a sentence like (6). (6)

Today, coffee is the second most popular beverage in the world, after water.

For the use in our watermarking scheme, every set of co-references is given with the full subtrees of the co-referenced concepts as they appear in each context. This way, the meaning-manipulating operations of our system are optimally facilitated. It should be added that co-reference detection, essential for meaning processing aside of any IAS concerns, is very reliable.

204

Mikhail J Atallah et al.

4.2.2 Fact Database The second basic tool is the use of information available from the fact database resource of ontological semantics. The fact database entry for Afghanistan would yield the following additional information, conveniently structured in a tree-like hierarchy: (7) Afghanistan (nation-1) borders-on has-currency has-member has-representative ... 4.3

China, Iran, Pakistan, Tajikistan, Uzbekistan afghani Pashtun, Tajik, Hazara, Uzbek Mullah Mohammad Omar

Manipulation of the TMR Tree

In general, concepts that have greater co-reference will be better candidates to be changed. This selection principle to determine the possible cutting or pasting points of the tree is only outranked by the following one: The lower a concept is in the TMR tree, the less important we assume the information it represents to be. The search for a candidate to change will thus start from the lower end of the tree and proceed until it identifies a concept for which co-reference is established. Through the co-reference relations computed for the whole text we know additional slot fillers for several of the ontological concepts instantiated in the TMR of the sentence to be changed. This includes, for example, MINISTRY-1 “Pentagon,” but most prominently NATION-4 “Afghanistan.” 4.3.1 Pruning of TMR Trees In case several candidates present themselves for the manipulation based on repeated information as witnessed by co-reference, the pruning method will prefer the one for which more information is repeated. Although we won’t completely lose any information through pruning, because we know it is repeated elsewhere in the text, the assumption is that it is less likely to be a salient loss in the position where we cut it, if we have more than two uses of the concept. In our example, co-reference tells us that NATION-4 is abundantly repeated and can be pruned more safely than other concepts that are less often repeated, like, for example, CITY-1, “Washington,” which occurs five times in the text. We will not clear the first use of a concept for pruning, but any of the subsequent ones und the assumption that the first mention is privileged. This would make the omission of NATION-5 in the TMR trees of these and any following co-referenced instances possible: VICTORY1.THEME, ASSAULT-1.THEME, FLY-AIR-VEHICLE-1.PATH. The following are the respective sentences with the words in italics cleared for pruning: (8) a.

With no visible victory so far in Afghanistan, President Bush asserted that the campaign he launched in reprisal for September’s mass killings on U.S. soil was going well, and he urged Americans to remain patient.

Natural Language Watermarking and Tamperproofing

b. c.

205

In Pakistan, which is backing U.S. strikes on Afghanistan, a minister said official tests confirmed that at least one suspicious letter received there contained anthrax spores. The Pentagon ordered two new spy planes, including the unmanned “Global Hawk”, to the region to start flying over Afghanistan.

When a co-referenced instance of a concept has been used for any manipulation, grafting, pruning, or substitution, it gets a flag that will prevent its repeated use in the same cycle. Only if at a later point nothing but the use of a flagged concept could tweak a sentence to read the desired bit, will such concepts be considered again. 4.3.2 Grafting of TMR Trees If we decide to pursue the scheme that would add additional information for an instance of a concept, our analyzer will pick one of the other instances and “litter” it with information about it that could be gleaned from the instance of the concept’s mention at hand. If it would choose, for example, the third co-reference, ASSAULT1.THEME, the information in (9) from the TMR tree will be grafted onto the tree of sentence (10) after it has been copied or cut from its original occurrence, resulting in tree (11): (9)

assault-1--|--agent--nation-1--“United States” |--theme--nation-4--“Afghanistan”

(10)

The Pentagon ordered two new spy planes, including the unmanned “Global Hawk”, to the region to start flying over Afghanistan.

(11)

purpose--fly-air-vehicle-1--|--agent--unknown |--path--assault-1.theme--assault-1--|--agent--nation-1--“United States” |--theme--nation-4--“Afghanistan”

In order to keep the tree branching strictly downward the new proposition is simply grafted onto the concept of the main tree that is co-referential to the other concept. Since this is a reversible process, the generator of ontological semantics will be able to generate the following new sentence out of the grafted TMR tree (11): (12)

The Pentagon ordered two new spy planes, including the unmanned “Global Hawk”, to the region to start flying over Afghanistan, which they are attacking.

4.3.3 Adding/Substitution The methods described in this section can, of course, be combined, and we can utilize additional information ontological semantics provides through its fact database. For the example, we find the database entry given in subsection 3.2.2 above and can glean from it the fact that Afghanistan was at the time of writing of the text ruled by the politician Mullah Mohammed Omar. Thus, we can add to the final node this piece of information as in (13), or we can substitute it as in (14), yielding the sentences in (15) and (16), respectively. (13) assault-1--|--agent--nation-1--“United States” (14)

|--theme--geopolitical-entity--|--has-representative--politician-6 assault-1--|--agent--nation-1--“United States” |--theme--nation-4--|--has-representative--politician-6

206

(15) (16)

Mikhail J Atallah et al.

The United States are attacking the country ruled by Mullah Mohammed Omar. The United States are attacking Afghanistan, which is ruled by Mullah Mohammed Omar.

4.3.4 Summary The three methods of TMR tree manipulation make use of the resources provided by ontological semantics in the following way: pruning grafting substitution

co-reference co-reference fact database

If necessary they can be combined to more than one concept in most sentences, namely any concept that has co-reference, accounting for the high bandwidth of this scheme (see above).

5

Putting Large Watermarks in Short Texts

If the number of sentences n is small enough that nβ is not much larger than the number of bits (= w) in the watermark, as happens with short communiqués or newsclips, then we cannot afford to “waste” sentences by using them for markers. Every sentence is needed for carrying watermark bits. In that case we do not use markers, we simply use the first sentence s1 for the first β bits of the watermark, s2 for the next β bits of the watermark, etc. We may even be interested in choosing a rather large β, but for a large enough β there is then a danger that we may be unable to insert the next β watermark bits in a particular sentence. This failure has probability (1–2–βt of occurring in a sentence that we can “torture” in t different ways. While this is not a concern if β is small or when t is large, an ambitious enough choice for β would make the failure likely for at least some of the sentences that have a low t (even though t is exponential in the number of co-references for that sentence, that number of coreferences may be small for some sentences). One way around this is to choose a large β anyway, but to provide a recovery mechanism in case the failure does happen. The mechanism is simply to sacrifice one (say, the first) of the β bits secretly said by each sentence, i.e., to no longer use that particular bit to store a watermark bit, but rather to use that bit as an indicator of whether that particular sentence is watermark-carrying or not (hence a watermark-carrying sentence now effectively carries β–1 rather than β watermark bits, but we are now free to choose a large β). In case of failure for a particular sentence, it is practically always possible to make the “indicator” bit 0, in which case the remaining β–1 bits secretly said by that sentence are ignored at watermark-reading time (for the watermark-carrying sentences that indicator-bit is 1). Assuming, for the sake of an approximate quantitative discussion, the same t for all sentences, the expected number of watermark bits successfully inserted is then n(β–1)(1–(1–2–βt 

Natural Language Watermarking and Tamperproofing

207

Compare the above quantity to the deterministic nβ’ capacity that would have resulted had we used a β’ that is smaller than β. Such a β’ would have had to be small enough to practically guarantee that every sentence would be watermark-carrying. Sacrificing n bits to enable a larger β, in the manner described above, is a better design than getting stuck with a low β’ whose value is determined by the “weakest” sentence (the one with smallest t), especially since most sentences will have a substantially higher t (and therefore higher watermark-carrying capacity) than the weakest sentence. Of course the “long watermark in a short text” framework of this section results in a watermark that is less resilient than in the “short watermark in a long text” case when we could afford the luxury of markers. The above way of avoiding markers may be attractive even in the “short watermark in a long text” case. We could simply repeat the watermark, effectively using a longer watermark of length n that consists of repetitions of the watermark string as many times as needed to use all of the sentences. But the attacker who knows we are doing this then immediately knows there is a periodicity involved and may be able to selectively damage everywhere the same fragment of the watermark (the fragment he dislikes) without damaging its other fragments. Another drawback is that an attack that consists of changing the order of some sentences now becomes effective, whereas it had a low probability of success when markers were used. (The probabilities of success of various attacks are, for the version of our scheme that uses markers, the same as in [1], although an attacker must now change the TMR, a more tricky proposition for her than modifying the syntax tree.) The main other advantages of the scheme presented in this section are that: •

•

•

Watermark-carrying capacity of a sentence is much improved, because a typical sentence involves many co-references and the number of possible ways we can “torture” a sentence (to make it secretly say what we want) is exponential in the number of co-references for that sentence. Specifically, if ρ is the number of coreferences and we are using t modification mechanisms then the number of ways is tρ. Contrast this with the t possibilities we could play with in the syntactic approach: no exponent in that approach, the number of ways was simply t (see [1]). Watermark-carrying capacity of the whole text is liberated from the straightjacket of “weakest sentence determines bits of watermark per sentence.” This is achieved through a choice of watermark bits per sentence (a number we call β) that is so high that many of the weaker sentences will fail to accommodate the β bits, in which case we “bypass” them by sacrificing one watermark bit and using it as an “indicator” of whether the sentence is watermark-carrying or not (the weaker sentences will not—but they no longer force upon us a low β The scheme deals with collusion tolerance by providing a mechanism for creating deliberate noise in the text; however, that as well as the interesting topic of error correction and post-attack restoration are subjects for future research.

208

Mikhail J Atallah et al.

6

Tamperproofing

Our scheme of meaning-based text marking and manipulation lends itself not only to watermarking, but also to tamperproofing. As stated earlier, here we use “tamperproofing” in the sense of “making tamper-evident,” i. e., any tampering with the text can be inferred from the corrupted text itself (without the use of any other outside information). The problem of tamperproofing text is easier if one considers trivial formatting modifications (such as reformatting the text, like inserting new line breaks or blank spaces in it) as tampering to be detected, than when one is supposed to be forgiving of such changes, as we indeed are. The reason the former is easy is because one can then compute some kind of keyed hash of a format-independent version of the text, and hide that hash value in the formatting information—any change to either the text or the formatting would be detectable because they would no longer be “tuned” to each other. Here we consider the harder version of the problem, where trivial formatting changes are not considered to be tampering, and in fact they are specifically allowed because different people in the organization use different word processors, etc. It is hard because we run into a circularity problem: by embedding the hash in the text as a watermark, we change the text, so that it is inevitably no longer represented by that hash. Consequently, it is not tamperproof, because a change of the text by an attacker is in principle indistinguishable from the change resulting from the embedding. Note also that we reject, as many researchers do, making the hash obvious: among other things, it is rejected in business models as the visible expression of distrust. Making the hash obvious would, of course, make our and most other tamperproofing proposals redundant. One straightforward way to use our marking scheme for tamperproofing, is to simply manipulate the text so that every sentence says the same secret bitstring (e.g., β zeroes for some small β). While easily achievable with our marking method, this scheme has two major drawbacks: it is impervious to the deletion of whole sentences, as the remainder will still appear tamperproof; and a modification of a sentence has a 2–β probability of succeeding in being undetected. In the design we give below, the probability that removing or modifying a sentence goes undetected is 2–β(n+1). Here β is chosen to be fairly small, so we are practically certain of being able to put β watermark bits in a sentence (even β=2 is fine, as the probability of an undetected modification of a sentence is then 2–2(n+1), which is one in a million even in a ninesentence text). As mentioned earlier, we make two passes over the sentences. The first pass examines the sentences in the same secret ordering of them that we described earlier. The second pass examines them in the reverse order of the first. To avoid cumbersome notation, we assume in what follows that we have re-numbered the sentences according to their secret ordering, so that si is the ith sentence according to the secret ordering and Ti is the representation of its associated tree (a TMR tree in the first pass, a syntax tree in the second pass). Note also that this takes care of the risk of lastsentence tampering. Implementation note: In what follows, when we refer to semantic or syntactic watermarking schemes, we mean a deliberately “fragilized” version of each—for example,

Natural Language Watermarking and Tamperproofing

209

in the syntactic scheme a syntax tree Ti’s leaves now do contain the exact words associated with these leaves, so that synonym substitution is detected. First pass: The first pass is a semantic marking scheme. We need to state precisely which β bits are to be the inserted as a “mini-watermark” in each sentence. Let H denote a keyed hash function. We do the following: We compute x1 = Hk (1…1) = the keyed hash of all 1s (e.g., 100 ones). We insert (as watermark) in s1 the leftmost β bits of x1. Then for i = 2, … , n we do the following: We compute xi = Hk (xi–1 , Ti–1) where xi–1 , Ti–1 denotes the concatenation of xi–1 and Ti–1, and Ti–1 is the TMR tree obtained from the already marked version of sentence si–1. We insert (as watermark) in si the leftmost β bits of the just-computed xi. The verification phase that corresponds to the first pass is a similar pass, except that instead of inserting β watermark bits in an si we instead read them and compare them to the leftmost β bits of xi. Because of the “forward chaining” from 1 to n, the probability that a modification of si goes undetected by this “first pass verification” is 2–β(n–I+1). Second pass: The second pass is a syntactic marking scheme (so it does not change any of the TMRs resulting from the first pass). We need to state precisely which β bits are to be the inserted as a “mini-watermark” in each sentence. As before, Hk denotes a keyed hash function. We do the following: We compute xn = Hk (1…1) = the keyed hash of all 1s (e.g., 100 ones). We insert (as watermark) in sn the leftmost β bits of xn. Then for i = n–1, … , 1 we do the following: We compute xi = Hk (xi+1 , Ti+1). where xi+1 , Ti+1 denotes the concatenation of xi+1 and Ti+1, and Ti+1 is the syntax tree obtained from the already marked version of sentence si+1. We insert (as watermark) in si the leftmost β bits of the just-computed xi. The verification phase that corresponds to the second pass is a similar pass, except that instead of inserting β watermark bits in an si we instead read them and compare them to the leftmost β bits of xi. Because of the “backward chaining” from n to 1, the probability that a modification of si goes undetected by this “second pass verification” is 2–β . The probability that a modification to si escapes detection by both the first-pass verification and the second-pass verification is therefore: 2–β(n–i+1) 2–β = 2–β(n+1) which is as we claimed it to be.

210

Mikhail J Atallah et al.

References [1]

[2]

[3] [4] [5] [6] [7] [8] [9] [10]

[11]

[12]

Atallah, M. J., V. Raskin, M. Crogan, C. F. Hempelmann, F. Kerschbaum, D. Mohamed, and S. Naik 2001. Natural Language Watermarking: Design, Analysis, and a Proof-of-Concept Implementation. In: I. S. Moskowitz (ed.), Information Hiding: 4th International Workshop, IH 2001, Pittsburgh, PA, USA, April 2001 Proceedings. Berlin: Springer, 185-199. Atallah, M. J., C. J. McDonough, V. Raskin, and S. Nirenburg 2001. Natural Language Processing for Information Assurance and Security: An Overview and Implementations. In: M. Shaeffer (ed.), NSPW '00: Proceedings of Workshop on New Paradigms in Information Security, Cork, Ireland, September 2000. New York: ACM Press, 51-65. Nirenburg, S., and V. Raskin 2003. Ontological Semantics. Cambridge, MA: MIT Press (forthcoming). Pre-publication draft, http://crl.nmsu.edu/Staff.Pages/Technical/sergei/book/index-book.html. Katzenbeisser, S. C. 2000. Principles of Steganography. In: S. Katzenbeisser and F. A. P. Petitcolas (eds.), Information Hiding. Techniques for Stenography and Digital Watermarking. Boston: Artech, 17-41. Brassil, J., N. F. Maxemchuk, and L. O’Gorman 1994. Electronic Marking and Identification Technique to Discourage Document Copying. Proceedings of INFOCOM '94, 1278-1287. Maxemchuk, N. F. 1994. Electronic Document Distribution. AT&T Technical Journal, September/October, 73-80. Low, S. H., N. F. Maxemchuk, and A. M. Lapone 1998. Document Identification for Copyright Protection Using Centroid Detection. IEEE Transactions on Communication 46(3), 372-383. Wayner, P. 1992. Mimic Functions. Cryptologia XVI(3), 193-214. Wayner, P. 1995. Strong Theoretical Steganography. Cryptologia XIX(3), 285299. Chapman, M., and G. Davida 1997. Hiding the Hidden: A Software System for Concealing Ciphertext as Innocuous Text. Proceedings of the International Conference on Information and Communication Security. Lecture Notes in Computer Sciences 1334. Berlin: Springer, 333-345. Anderson, R. J., 1996. Stretching the limits of steganography. In: R. Anderson (ed.), Information Hiding. First International Workshop. Cambridge, UK, May June 1996. Proceedings, Lecture Notes in Computer Science 1174, Berlin: Springer, 39-48. Anderson, R. J., and F. A. P. Petitcolas 1998. On the limits of steganography. IEEE Journal of Selected Areas in Communications 16:4, 474-481.

Natural Language Watermarking and Tamperproofing

211

Appendix: Sample Text U.S. Carpet-Bombs Taliban; Western Bridges Guarded / Last Updated: November 02, 2001 03:51 PM ET By Alan Elsner and Mike Collett-White WASHINGTON/RABAT, Afghanistan (Reuters) - The United States on Friday carpet-bombed Taliban front lines in Afghanistan and dispatched two new spy planes to pinpoint targets, while at home troops guarded California bridges against new terror attacks. // The anthrax scare spread abroad. One letter in Pakistan was confirmed to contain spores of the deadly bacteria but initial fears that the germ warfare weapon had also spread to Germany appeared to be a false alarm. // "We're slowly but surely tightening the net on the enemy. We're making it harder for the enemy to communicate. We're making it harder for the enemy to protect themselves. We're making it harder for the enemy to hide. And we're going to get him and them," Bush said. // The United States has been attacking Afghanistan for almost four weeks to root out the ruling Islamic fundamentalist Taliban and their "guest", Saudi-born militant Osama bin Laden, whom Washington accuses of masterminding the Sept. 11 attacks on New York and Washington that killed almost 4,800 people. // The Pentagon ordered two new spy planes, including the unmanned "Global Hawk", to the region to start flying over Afghanistan. // But Navy Rear Adm. John Stufflebeem said freezing rain was hampering efforts to fly additional elite U.S. special forces troops into the country to join the handful already there. The United States added 22 groups including Hamas and Hizbollah, which have taken responsibility for suicide bombings against Israeli civilians, to the list of "terrorist" groups under tight financial controls introduced after Sept. 11. // Americans were on top alert on Friday, after warnings of new terror attacks in the coming week, and California beefed up security around several bridges, including San Francisco's landmark Golden Gate Bridge in the light of what it called credible threats of a rush hour attack on November 2. [...] ATTACKS "SPOT ON" An opposition commander, Mustafah, watched from his roof near the front as B-52s unleashed their second day of carpet-bombing this week. He said he saw flames and smoke rise from positions used by the Taliban to shell the opposition-held Bagram air base. // "These attacks are spot on," another opposition commander, Rellozai, said from a rooftop vantage point. // Washington's strategy has focused on promoting a broad-based alliance incorporating the Northern Alliance, the majority Pashtun, from which the Taliban draw their support, and other ethnic groups across the impoverished country. // The effort suffered a blow last week when the Taliban captured and executed one prominent Afghan opposition leader, Abdul Haq, who had sneaked into the country to organize resistance to the Taliban. // In southern Afghanistan, Taliban fighters chased Hamid Karzai, a supporter of ex-King Zahir Shahon, on a mission to rally opposition to the Muslim militia. The former minister fled to the hills after his base was overrun.

212

Mikhail J Atallah et al.

Hamid's brother, Ahmed Karzai, said Hamid was fine. He said his brother had been holding a meeting with tribal leaders when he was attacked. // The brother said Hamid had more than 100 fighters with him on his mission that he said was trying to find support for a broad-based government to be formed after a Loya Jirga, or grand council, of Afghans in a post-Taliban Afghanistan. // The Taliban, who have imposed their own strict interpretation of Islam on Afghanistan, say 1,500 people have been killed since the U.S.-led air campaign began. There is no independent confirmation of the figure, which Washington says is grossly exaggerated. LEADERS SAFE The Taliban consul in Karachi said on Friday that the movement's leader, Mullah Mohammad Omar, as well as bin Laden were safe. // Moulvi Rahamatullah Kakazada told Qatar's al-Jazeera television that "thank God all brothers inside are protected from any harm especially the prince of believers (Mullah Omar) and Sheikh Osama bin Laden." The governor of the war-battered city of Kandahar, where rubble from flattened houses litters the streets, said the Taliban movement would survive even if U.S. forces killed Mullah Omar. // "We are Muslims, we are an organization. These things do happen, but one person can be replaced by others," he said. © Copyright Reuters 2000. All rights reserved. Any copying, re-publication or redistribution of Reuters content or of any content used on this site, including by framing or similar means, is expressly prohibited without prior written consent of Reuters. Quotes and other data are provided for your personal information only, and are not intended for trading purposes. Reuters, the members of its Group and its data providers shall not be liable for any errors or delays in the quotes or other data, or for any actions taken in reliance thereon. © Reuters 2001. All rights reserved. Republication or redistribution of Reuters content, including by caching, framing or similar means, is expressly prohibited without the prior written consent of Reuters. Reuters and the Reuters sphere logo are registered trademarks and trademarks of the Reuters group of companies around the world.

Cryptanalysis of UCLA Watermarking Schemes for Intellectual Property Protection Tri Van Le and Yvo Desmedt
Department of Computer Science, Florida State University Tallahassee, Florida, USA {levan,desmedt}@cs.fsu.edu

Abstract. We analyze four recently proposed watermarking schemes for intellectual property protection of digital designs. The first scheme watermarks solutions of a hard optimization problem, namely the graph coloring problem. The other three schemes belong to a family of techniques for watermarking digital circuits on programmable hardware. They are different from the usual image and audio watermarking since they must maintain correctness of the watermarked objects. Thus their watermarks cannot be embedded in the form of small errors as usually done in audio and visual watermarking. Although constraint-based watermarking schemes existed long before, these schemes are the first ones to protect hardware designs. In this paper, we apply a novel method to break the first of these schemes. We show how to modify a watermarked object in such a way that every signature strings can be extracted from it. Thus anyone can claim ownership of the object, yet leave no traces of who leaked the object. According to our best knowledge, this method is new and it may be of its own interest. In the remaining three schemes, we show how to locate and to remove the watermark embedded in the object, without knowing the secret key used in the embedding. Keywords: cryptanalysis, watermarking, watermark analysis.

1

Introduction

As pressures for fast time-to-market and high quality hardware components increase, design reuse and a market for design reuse effectively provides a viable way to tackle the preasures. Not only they reduce the complexity, but also they minimize the time and risks of the development process. The healthiness of such a design market, however, depends on the existence of good schemes to protect intellectual properties against illegal usages. This necessity is natural since intellectual property creators often need to protect and to recoup their investments in developing the designs. Digital watermarking is one among many solutions towards this end. The main purpose of this paper is to analyze several constraint-based watermarking schemes proposed recently by UCLA team [3, 4, 5, 6, 7, 8, 9, 10].


The authors were partially supported by NFS 0096247.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 213–225, 2003. c Springer-Verlag Berlin Heidelberg 2003


214

Tri Van Le and Yvo Desmedt

It is well known that in order to be effective against malicious users, a watermarking scheme must satisfy at least the following requirements [4]: – Validity The embedding must produce a watermarked object that is both syntactically valid and functionally equivalent to the original object. If the watermarking process destroys the product then we can not use it anymore. – Quality Besides validity and functionality, the watermarked object must also maintain the high quality of the original object. This means the overhead of the watermark inside the intellectual property must be small so that the commercial grade of the object stays intact. – Undeniability The watermarked object is claimable by the owner, but attributable to any other user. Thus the verification algorithm must have high probability of success when executed by the legitimate owner, and have very low probability of success when performed by any non-legitimate owner. This guarantees the creator a high credibility in claiming his ownership of the object. – Robustness It is difficult for any user to destroy the watermark without downgrading the quality, or altering the functionality of the object. Therefore, even when a watermarked object is modified by a malicious user, the verification algorithm still succeeds with high probability when run by the possessor, but nevertheless succeeds with low probability when carried out by malicious users. – Resiliency Since it is usually desirable in practice to sell one intellectual property to many users, any coalition of legitimate users should not be able to destroy the watermark. It means given multiple watermarked copies of the same object, a malicious is unable to locate and to remove, or to change, the watermark into one of his own. Otherwise, a malicious group of users will be able to claim illegal ownership of a copyrighted object, or be able to transfer it to another third party. It is often (miss) believed that one needs to destroy the watermark in order to render it useless. Several schemes were indeed proposed in this view [3, 4, 5, 6, 7, 8, 9, 10], and we will show later that this belief is quite untrue. One of the above schemes is broken without touching the original watermark. The idea of constraint based watermarking, initially reported in [2] and then extensively applied in [3, 4, 5, 6, 7, 8, 9, 10], is that in order to watermark an object, a secret signature is embedded into the object by adding artificial design-time constraints to the object’s creation process. When the object is discovered being used illegally, the owner runs a verification algorithm that extracts the embedded watermark, and then shows it to a court that the watermarked object belongs to him. Depending on the particular scheme, he may also be able to trace back the origin of mis-appropriation, i.e. to identify the customer, or group of customers, who transferred the watermarked property. Contrary to the believes of [3, 4, 5, 6, 7, 8, 9, 10], we show here that the newly proposed watermarking schemes are not quite robust. Their watermarks can be destroyed entirely in the first scheme, or completely located and removed in the

Cryptanalysis of UCLA Watermarking Schemes

215

last three schemes. The functionality and high quality of the attacked objects remain unaltered. We first give sketches of these schemes here, and will describe them in more details later. In the first scheme [9, 10], a new approach is applied to embed a signature into the coloring solution of a graph. The considered scenario is: assume someone has developed an efficient heuristic algorithm to solve a hard optimization problem but wishes to keep it secret, in order to recover his investment in developing the algorithm. The graph coloring problem is used extensively in automatic tools in computer aided design, and thus it is important. The watermarking algorithm is following: instead of directly embedding a watermark into a good solution obtained, the owner of the graph coloring algorithm modifies his algorithm accordingly to his secret signature so that the obtained solution implicitly contains the signature. The verification algorithm then consists of showing that the watermarked solution satisfies a secret set of constraints, which are very unlikely satisfied by a randomly chosen object. This unique set of constraints represents the secret signature of the owner. In the other three schemes, an encrypted signature is suitably embedded into unused configurable logic blocks (CLB) of a field programmable gate array (FPGA) which contains the design of a digital circuit. The embedding of the signature bits into each non-functional CLB is done by modifying its lookup table (LUT) accordingly to the bits. Usually, there are many unused CLBs available on a typical FPGA design. The purpose of encrypting the signature with a secret key is to whiten it out so that the users cannot tell apart which CLBs are non-functional. The non-functional CLBs are further disguised by randomly relocating and connecting them to other functional CLBs. In order to deter users from detecting or locating the watermark, the pseudo random numbers used in the embedding and hiding process above are generated from a secret random key. Along with the hiding operations, the watermark is additionally strengthened by preprocessing the signature string with an error correcting code, and interleaving the code blocks [7]. In order to verify the signature, the owner first captures the configuration loaded onto the FPGA, for example by monitoring its bus, then uses his secret key to locate the non-functional CLBs, and finally decrypts the embedded watermark using the same secret key [3, 4, 5, 6, 7, 8]. Since the key used to generate the pseudo random numbers and to encrypt the watermark is kept secret, the authors of the papers believed that it is difficult to detect and to hence remove the watermark. Contribution We show that these schemes are not as secure as they are believed to be. For the first scheme, we employ a new approach to destroy the original creator’s watermark. We modify the watermarked solution in such a way that any signature string can be extracted by the verification algorithm, and thus the original owner can neither claim his ownership nor make use of the watermark to identify the origin of mis-appropriation. For the other three schemes, we show that after successful capturing of the program (configuration) that is loaded into an FPGA (as presumed possible in [4]), a malicious user can detect all

216

Tri Van Le and Yvo Desmedt

non-functional CLBs embedded into the FPGA program by the original owner, and remove them from the design. In the next sections, we describe each of the schemes, and how to break them in turn. Our two approaches to break the above schemes are the complement of each others. The first one makes sure that every user can claim ownership of the watermarked object, while the later one ensures that no user can claim it.

2

Watermarking for Graph Coloring

Given an undirected graph G, a coloring of G is an assignment of colors to the vertices of G so that the end points of each edges of G have different colors. The objective is to use the fewest possible number of colors. A watermarking scheme for this problem embeds a secret signature into the final coloring so that it can later be detected or extracted. Graph coloring problem has many real life application such as in register allocations, scheduling problems, and other resource allocation problems similar to those in computer aided design. Therefore a watermarking scheme for graph coloring problem is an interesting aspect of watermarking in digital designs. 2.1

Scheme Description

We first describe the embedding and verifying procedures of [9]. In our descriptions, E(G) denotes the set of edges of the graph G, and (vi , vj ) denotes an edge joining vertices vi and vj . The idea of the scheme is to add additional constraint in the form of “ vi and vj are to be assigned with different colors” to the original coloring problem. This type of constraints is satisfied by adding the additional edge (vi , vj ) to the original graph G. The choice of the additional edge (vi , vj ) is calculated based on the secret signature string M , and the graph G. In the followings, let C be a coloring solution of G. Embedding Let M =m0 m1 . . . mk be the signature string. Let v0 , v1 , ..., vn−1 be the vertices of G. Let [vi , vj ] = {vi+1 , vi+2 , . . . , vj−1 } if i < j, and [vi , vj ] = {vi+1 , vi+2 , . . . , vn−1 , v0 , v1 , . . . , vj−1 } if i > j. The embedding process is done incrementally, one bit at a time until all bits are embedded. To embed bit mi into C, one does the following: – Let {vi1 , vi2 } be the next two nearest vertices in G that are not directly connected to vi0 , where i0 := i mod n. Here the term nearest means (vi0 , vi1 ), ∈ E(G); (vi0 , vj ) ∈ E(G) for all vj ∈ [vi0 , vi1 ] ∪ [vi1 , vi2 ]. (vi0 , vi2 )  – Add the edge (vi0 , vi1+mi ) to G. Let G be the final graph obtained after adding all the edges accordingly to the bits of M to G. Let C  be a coloring of G , then output C  as the watermarked version of C. In the verification stage, one verifies that all the added constraints are indeed satisfied. Note that in order to keep the location of the watermark secret, one must also keep M secret.

Cryptanalysis of UCLA Watermarking Schemes

217

Verification Let input be a graph G with a coloring C  . – Using the secret key, one reconstructs the binary string M , and the graph G with all the extra edges added as in the embedding process. – If C  is a valid coloring of G then outputs Yes. Otherwise, if C  is not a valid coloring of G then outputs No. It is easy to see that the above scheme is valid since any valid coloring of G is also a valid coloring of G. Additionally, it has been shown in [9] that the watermarked coloring C  almost always uses only one additional color, and that the probability of a random valid coloring C of G being a valid coloring of G is small, too. Hence the scheme has high quality and undeniability property. We show here that, however, this scheme is not robust against a malicious user. 2.2

Scheme Analysis

Our attack algorithm modifies the watermarked coloring C  to obtain a new coloring C  of G, using approximately only two additional colors, in such a way that any signature string can be extracted from C  . That means for every secret signature string M , the verification algorithm described above will succeed. In other words, everyone can claim ownership of the new coloring C  . Therefore the original owner cannot claim his exclusive ownership. Further, since any input signature string can be extracted from the coloring C  , it is difficult for the owner to tell who is the real malicious user who leaked this solution. Our dewatermark algorithm is described bellow. Destroy Let input be a graph G with a valid coloring C  . – Let c =  nk , where k is the length of the embedded signature. – For each i ∈ {0, 1, . . . , n − 1}, let Ei = {(vi , vi1 ), (vi , vi2 ), . . . , (vi , vic+1 )} such that (vi , vit ) ∈ E(G) for t ∈ {1, 2, . . . , c + 1}, and that (vi , vj ) ∈ E(G) for all j ∈ [vi , vi1 ] ∪ [vi1 , vi2 ] ∪ . . . ∪ [vic , vic+1 ]. – Let G∗ be the result of adding E0 , E1 , . . . , En−1 to G. – Loop i from 0 to n − 1: If ∃0 ≤ j < n : (vi , vj ) ∈ E(G∗ ) and C  [vi ] = C  [vj ] then: • If there exists a color c in C  such that no neighbor of vi in G∗ has color c, then let c be any one of such colors. Otherwise, let c be a new color not already in C  . • Assign the new color c to vi and let C  [vi ] := c. – Let C  be the result of C  after the loop and exits. We now analyze our destroy algorithm. Using the same model as in [10], we assume in the next analysis that: – G is a randomly chosen graph of n vertices with edge probability p. n 1 – The number of colors in C is exactly χ =  2 log n , where b = 1−p . b

218

Tri Van Le and Yvo Desmedt

Theorem 1. The number of additional colors used in the destroy algorithm is at most 2bc logb n, which is negligible with respect to χ. Proof. Let C  be the output of our algorithm. It is clear that C  is a valid coloring of G∗ , and thus also a valid coloring of G. For each vertex vi , the number of neighboring vertices of vi is about np. The number of all vertices of the same color as vi s is about  nn  < 2 logb n. Consequently, the probability 2 logb n

that a randomly chosen pair of non-adjacent vertices (vi , vj ) having the same logb n color is at most 2n−np . Therefore the probability that vertex vi needs a different c
logb n logb n ≈ 2cn−np . Hence color in our destroy algorithm is at most 1 − 1 − 2n−np

logb n = 2bc logb n in almost all graphs, our destroy algorithm uses at most 2nc n−np additional colors. This number is exponentially small, or negligible, compared n ) to color G. Therefore the to the original number of colors needed ( 2 log bn  

dewatermarked coloring C is of very high quality compared to C  .

See Subsection 2.3 for experimental results of our algorithm. We show bellow that the destroy algorithm described above indeed removes the watermark from C  . Theorem 2. Let C  be the output of the destroy algorithm on input (G,C  ), where C  is the output of the embedding algorithm on input graph G. Then the verification algorithm will always output yes on input (G,C  ,M ) for arbitrary signature M . Proof. We note that for some i < j, Ei ∩ Ej = ∅ if and only if (vi , vj ) ∈ Ei ∩ Ej . This implies that |Eij | ≤ c, and |Eji | ≤ c where Eij = {(vi , vt ) ∈ E(G) | vt ∈ [vi , vj ]}, and Eji = {(vj , vt ) ∈ E(G) | vt ∈ [vj , vi ]}. Therefore the probability that Ei ∩ Ej  = ∅ is at most the probability that |Eij | + |Eji | ≤ 2c. Let q = 1 − p, n! , then the later probability is: and Ckn = k!(n−k)! n−2 n−2−2c 2c pn−2 + C1n−2 pn−3 q + . . . + C2c p q < c(n − 2)2c pn−2−2c .

Since c ∈ o(log n) when n → ∞, this probability is negligible when n → ∞. Hence for almost all graphs G, we have Ei ∩ Ej = ∅ for all i < j. Let G be the graph constructed by verification algorithm on input string signature M , and let G∗ be the graph constructed in the destroy algorithm. Since Ei ∩ Ej = ∅ for i = j, we see that: regardless of the content of the message M , all the edges that were added to G are added to G∗ as well. Hence we have E(G ) ⊂ E(G∗ ). Further, C  is a valid coloring of G∗ , therefore a valid coloring of G . That means the verification algorithm will succeed on (G,C  ,M ). 

2.3

Experimental Results

In the numerical simulation, we take a random graph of n = 1000 vertices with edge density varied accordingly to sparse graphs (p = 0.1), normal graphs

Cryptanalysis of UCLA Watermarking Schemes

219

(p = 0.5), and dense graphs (p = 0.9). The length of the signature is either 1000 bits or 2000 bits. These parameters are the same as thouse suggested in [9, 10]. The numbers in each lines of the table are measured by watermarking and then dewatermarking 10 random graphs of the same edge probability p. The watermark column shows the number of colors in the watermarked graph coloring solution. The dewatermark column is the number of colors in the dewatermarked graph coloring solution. The last column is the difference between the previous two columns, and it represents the number of additional colors used by our destroy algorithm. G1000,p bits watermark dewatermark additional p = 0.1 k=1000 27.0 27.4 0.4 p = 0.5 ” 109.1 109.6 0.5 p = 0.9 ” 271.3 273.2 1.9 p = 0.1 k=2000 27.0 27.6 0.6 p = 0.5 ” 109.2 109.5 0.3 p = 0.9 ” 272.1 273.2 1.1 From the above table, we see that even in the hardest cases, i.e. when the graph is highly dense, our destroy algorithm uses less than two additional colors to remove the watermark. For all other cases, only one or even no additional colors is needed. In all of our tests, the destroy step runs in under 10 seconds for each graph. This shows that our destroy algorithm uses very small number of colors, and preserves the very high quality of the dewatermarked object. Therefore we demonstrated that it is not necessary to alter the original watermark in order to break a scheme.

3

Watermarking for FPGAs

We now analyze three watermarking and fingerprinting schemes for digital circuits on programmable hardware [3, 4, 5, 6, 7, 8]. While FPGA may not be the largest sector of custom circuits market, it is interesting to see how watermarking for digital circuits works in this case. All these schemes consist of three common stages which we describe bellow: 1. Preparation This step prepares the binary signature string so that it can be embedded into the design. The preparation is a combination of the following operations: compression with a secure hash function, encryption with a secret key, encoding with an error correcting code (ECC), interleaving across ECC blocks. While the application of a secure hash function makes the signature shorter and thus easier to embed, the purpose of the encryption is to whiten out the signature so that it will be harder to detect its presence and location. The ECC and interleaving of ECC blocks make the embedding of the signature more resistant against damages in small number of bits. 2. Embedding This step searches for unused locations in the design, i.e. CLBs in an FPGA that can be used to embed the signature. The possible locations

220

Tri Van Le and Yvo Desmedt

for consideration are: non-functional (unused) CLBs, and multiplexers of unused outputs of functional CLBs. For example, in an unused CLB of the Xilinx XC4000 series, 16 bits can be embedded into its lookup table (LUT). Further, for each output of a CLB, there can be a multiplexer attached to it, in order to select which signal will be copied to the output. Therefore an unused output that has a 2-to-1 multiplexer attached to it can be used to embed 1 bit of information, while an unused output with an attached 4-to-1 multiplexer can contain 2 bits of information. 3. Hiding Since non-functional CLBs and functional CLBs’ unused outputs can be both removed without affecting the digital design, they should be well hidden. The operations available to hide these elements are: a secure hash function to randomly replace the unused CLBs, randomly connecting their inputs and outputs to nearby passing lines, and to dont-care inputs of other CLBs. These techniques make the non-functional CLBs appear like functional ones. In the followings, we describe each of the schemes, from simple to complex ones. For each schemes, we show how to find the locations of the embedded bits and consequently delete them from the FPGA. Since our technique depends only on the particular scheme’s embedding and hiding operations, we just need to present these operations for each scheme, and then present our corresponding deletion algorithm. In our deletion algorithms, the capture of an FPGA configuration can be done, for example, by using image inspection tools [1], or by simply monitoring the bus of the targeted FPGA [4]. However, the later technique is known to work with static RAM devices only. 3.1

Basic Scheme

This scheme is introduced in [5, 6]. It is the first scheme that use the unique characteristics of FPGA to protect digital circuit designs. Embedding The locations to embed the bits are unused CLBs. They are found by inspecting the FPGA configuration. Since unused CLBs are disconnected from other functional CLBs and from the outputs of the FPGA design, they can be found easily using any graph connectivity algorithm. Next, the prepared signature bits are embedded into the lookup tables of the non-functional CLBs. The CLBs are then randomly placed back into the FPGA configuration. The other functional CLBs are simply placed and routed around these unused CLBs. Note that the unused CLBs are disconnected from other functional CLBs, and the outputs of the FPGA. Therefore using any connectivity checking algorithm, we can locate these hidden CLBs efficiently, even after they have been embedded with signature bits and randomly relocated. Below is the deletion algorithm. Deletion Locate CLBs that are disconnected from output pins of the FPGA. Delete these CLBs and output the result.

Cryptanalysis of UCLA Watermarking Schemes

221

It is easy to see that our algorithm completely remove all embedded nonfunctional CLBs that were used to embed the signature. Therefore this simple scheme is easily defeated. 3.2

Intermediate Scheme

This scheme is introduced in [4, 8], and also used in [7]. It differs from the basic scheme in the preprocessing and hiding operations. A secure hash function is applied to the signature before embedding, in order to reduce its size. The locations of the embedded CLBs are also fingerprinted with the identity of the user in order to trace back the origin of mis-appropriation. Additional hiding operations are also put in. Embedding The signature bits are embedded into the unused CLBs. They are found by inspecting the FPGA configuration, and then pseudo-randomly placed back into the FPGA configuration. Instead of routing the other functional CLBs around these embedded CLBs as done in Scheme I, one connects their outputs to dont-care inputs of functional CLBs, and connects their inputs to other functional CLBs’ outputs. This scheme is better than the previous scheme in hiding the non-functional CLBs since they cannot be simply located with connectivity property anymore. Unused CLBs appear as functional ones since their inputs and outputs are used and connected to other CLBs. However, we see that each CLB is a small size finite-state machine, therefore we can find all of its dont-care inputs by searching. Consequently we locate all the non-functional CLBs. Therefore the deletion algorithm is: Deletion – For each CLB in the configuration, and for each input of this CLB: if the output of this CLB does not depend on the value of this input then delete all connections to this input. – Find CLBs that are disconnected from the outputs of the FPGA and delete them. After the first step, all embedded non-functional CLBs are disconnected from the outputs of the FPGA. Hence they are removed in the second step, i.e. the watermarking scheme is broken. This deletion algorithm breaks the scheme of [8] too because this scheme also uses the same embedding and hiding algorithm. 3.3

Advanced Scheme

This scheme is proposed in [3]. Since non-functional CLBs can be located as we have seen in the previous two schemes, this scheme tries to embed the signature into functional CLBs too so that users cannot simply delete all unused CLBs.

222

Tri Van Le and Yvo Desmedt

Embedding For all unused outputs of functional CLBs that have a multiplexer attached to the output, embed the signature bits into the multiplexer. If the multiplexer is a n-to-1 multiplexer then log2 n bits can be embedded. Connect the unused outputs to dont-care inputs of other CLBs. Nevertheless, similarly to the second scheme, unused outputs can be located since they are not connected to any CLB. Therefore we have the deletion algorithm as follow. Deletion – For each CLB in the configuration, and for each input of this CLB: if the output of this CLB does not depend on the value of this input then delete all connections to this input. – Find all CLB outputs that are not connected to any other CLB inputs nor the FPGA’s outputs. – Zero the multiplexers attached to each of these outputs. – Remove all CLBs that are isolated from the output of the FPGA. – Output the resulting board. 3.4

Discussions

From the three preceding subsections, we see that a real life attack consists of three steps: reverse engineering low-level hardware to obtain corresponding high-level design, running the deletion algorithm, and recompiling the newly trimmed design back into hardware. In contrast, a typical design process more or less consists of the following steps: specifying, constructing, debugging, and compiling the design into hardware. Thus by hacking, a crook will gain the cost of specifying, constructing, and debugging the design. However, he or she will have to pay for the cost of reverse engineering the hardware (plus the cost of running the deletion algorithm, but this cost is negligible compared to other steps, as we have already seen in previous subsections). Assuming that the thief is rational, so an attack is practical only if there are incentives for the thief to hack. In this case, that means the cost of reverse engineering should be less than the cost of specifying, designing and debugging a circuit from scratch. While this is indeed the case for FPGA circuits, which have relatively simple design process, one expects that it may not be the case for a complex non-FPGA circuit design project, which typically has much more design layers. For this later case, the cost of reverse engineering should be much higher. Hence attacks based on reverse engineering may not be attractive in this new case. However, it may be surprise that in practice one should not take this as a motivation or additional assurance to use any watermarking scheme in the later case because in such case one does not need any watermarking at all. The reason is that in such case, one simply keeps the original design (which was usually done in practice already) as a legitimate proof of ownership. Because recovering high level design from hardware, i.e. reverse engineering, is more costly than designing a circuit oneself, the attacker will either have no proof of ownership (since he can

Cryptanalysis of UCLA Watermarking Schemes

223

not do reverse engineering), or he must have obtained one by designing it from scratch himself (since he may be able to do reverse engineering but it is more costly). This is exactly what one wants from a watermarking scheme. Therefore whether the owner does in fact own the design is not a real problem in this later case. In reality, this is true not only for digital designs but also for other non-tech objects such as a magazine article or a photo. For example, the spec and the creation history (i.e. successive versions, editor’s comments, email correspondence between publisher and author, cancelled royalty cheques, etc.) are indeed good proofs of originality. Therefore, we should stress that watermarking for proving ownership is only needed in the case where reverse engineering is actually easier than designing. There are conjectures that the above three schemes may be quickly fixed by running a pseudo random generator through a live data scheme twice, where the later run will clear all the effects of the earlier one. This may make the non-functional CLBs that were used as the pseudo-random generator appear functional. While this heuristics is interesting, we will show later in the appendix that it does not work for this case. It may not be a trivial task to fix these schemes.

4

Conclusion

We shown that several constraint-based watermarking schemes for intellectual property protection of digital designs can be broken. We used different approaches to analyze these schemes. In the first scheme, we did not remove the signature but modified it so that arbitrary signature could be extracted, thus nullified the creditability of the original watermark. This also made it more difficult for the owner to trace back to the origin of mis-appropriation of his design. In the other schemes, we completely located the embedded signature and then removed it. These two methods are quite complement of each other. In the first scheme, we shown how to destroy the watermark without knowing where it is. While in the other schemes, we shown how to remove the watermark by first locating them. This shows that one should not base the robustness of a watermark on the secrecy of its location and content alone. We also shown further that in many practical situations, watermarking may not be the best solution to proving ownership of intellectual properties.

Acknowledgement We are thankful for anonymous comments that helped improving the presentation of this paper. We thank Professor Ross Anderson for interesting discussions regarding real life examples of ownership proofs that do not involve watermarking at all.

224

Tri Van Le and Yvo Desmedt

References [1] Ross Anderson and Markus Kuhn. “Tamper Resistance - A Cautionary Note”, 1996 USENIX Electronic Commerce Workshop, pp. 1-11, Oakland, California, November 1996. 220 [2] Ross Anderson and Fabien Peticolas. “On The Limits of Steganography”, IEEE Journal on Selected Areas in Communications, vol. 16, pp. 474-481, May 1998. 214 [3] Andrew B. Kahng, John Lach, William H. Mangione-Smith, Stefanus Mantik, Igor L. Markov, Miodrag Potkonjak, Paul Tucker, Huijuan Wang, and Gregory Wolfe. “Watermarking Techniques for Intellectual Property Protection”, 35th ACM/IEEE DAC Design Automation Conference, pp. 776-781, San Francisco, CA, June 1998. 213, 214, 215, 219, 221 [4] John Lach, William H. Mangione-Smith, and Miodrag Potkonjak. “Fingerprinting Digital Circuits on Programmable Hardware”, 1998 Information Hiding Workshop, pp. 16-31, Portland, Oregon, April 1998. 213, 214, 215, 219, 220, 221 [5] John Lach, William H. Mangione-Smith, and Miodrag Potkonjak. “FPGA Fingerprinting Techniques for Protecting Intellectual Property”, 1998 Custom Integrated Circuits Conference, Santa Clara, CA, pp. 299-302, May 1998. 213, 214, 215, 219, 220 [6] John Lach, William H. Mangione-Smith, and Miodrag Potkonjak. “Signature Hiding Techniques for FPGA Intellectual Property Protection”, 1998 International Conference on Computer-Aided Design, pp. 186-189, San Jose, CA, November 1998. 213, 214, 215, 219, 220 [7] John Lach, William H. Mangione-Smith, and Miodrag Potkonjak. “Robust FPGA Intellectual Property Protection Through Multiple Small Watermarks”, 36th ACM/IEEE Design Automation Conference, pp. 831-836, New Orleans, LA, June 1999. 213, 214, 215, 219, 221 [8] John Lach, William H. Mangione-Smith, and Miodrag Potkonjak. “Enhanced Intellectual Property Protection for Digital Circuits on Programmable Hardware”, 1999 Information Hiding Workshop, pp. 331-345, Dresden, Germany, September 1999. 213, 214, 215, 219, 221 [9] John Lach, William H. Mangione-Smith, and Miodrag Potkonjak. “Hiding Signatures in Graph Coloring Solutions”, 1999 Information Hiding Workshop, pp. 391-408, Dresden, Germany, September 1999. 213, 214, 215, 216, 217, 219 [10] G. Qu and Miodrag Potkonjak. “Analysis of Watermarking Techniques for Graph Coloring Problem”, 1998 International Conference on Computer-Aided Design, pp. 190-193, San Jose, CA, November 1998. 213, 214, 215, 217, 219

A

Appendix

It is believed by some that running a pseudo random generator through a live data scheme twice, where the later run clears all the effects of the earlier one, will make the non-functional CLBs appear as functional ones. We show now that this fix unfortunately does not work for this case. The reason is that by having the output from the pseudo random generator used twice, one can easily detect which CLBs are used to construct the pseudo random generator. If the

Cryptanalysis of UCLA Watermarking Schemes

225

second run of the pseudo-random values was generated by the same CLB as in the first run then one can easily detect these CLBs by simple trial and error removing as we will show later. So in order for this fix to succeed, one should have the second run of the pseudo-random values in different CLBs. However, this makes the two types of CLBs pop out because in a typical circuit, not very often there are two CLBs that always have identical outputs. Therefore the real attack is follows: first capture the configuration of the FPGA, then simulate the execution of FPGA with a large number of random inputs. If there are two CLB connections such that the values sent over each of them are identical to each other all the time, then we know that these two may be outputs from the mentioned pseudo random generator. Hence we can safely disconnect them. If later we discover that by disconnecting these connections, the circuit does not work correctly anymore, i.e. does not output the same values as before, then we know that we made a mistake and reconnect them. Using this trial and error attack, we can remove all the output from the hidden pseudo random generators, and then using earlier breaking algorithm, we eventually remove all of them. Note that our attack is different from the usual attacks in which one locate the watermark in order to remove them. Here we test if we can remove them in order to detect the watermark. Note also that one can always generalize the above approach so that the same random output does not occur twice anymore, but rather occurs as related, for example. This new relation (instead of the previous equality relation) is needed to ensure that the output of the modified circuit stay unaltered. However, we believe that all such approaches to fix the above schemes will eventually be broken because it is quite hard to hide the relation between the two runs of the pseudo random generator. Therefore it will be a non trivial task to fix these schemes.

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks M. Kıvan¸c Mıh¸cak1 , Ramarathnam Venkatesan1 , and Mustafa Kesal2 1

2

Microsoft Research {kivancm,venkie}@microsoft.com University of Illinois, Urbana-Champaign [email protected]

Abstract. Assume that we are given a watermark (wm) embedding algorithm that performs well against generic benchmark-type attacks that comprise of simple operations that are independent of the algorithm and generally of the input as well. A natural question then is to ask for a nearly perfect cryptanalytic attack for the specific watermarking method. In this paper we present and analyze an attack on a state-ofthe-art Discrete-Sequence Spread Spectrum (dsss) audio watermarking algorithm. Our method uses detailed models for watermarked signal and almost always jams or recovers > 90% of the watermarking-key. It exploits the host and wm correlations, and the fact that one can locally correct errors in the wm estimates if the watermarking coefficients are discrete. It is natural to use error-correction codes in a watermarking algorithm, and we study the effects of the accompanying redundancy as well.

1

Introduction

Many wm embedding schemes use spread spectrum (ss) techniques [1], where typically the wm is an additive perturbation independent of the host signal. We consider a “blind private-key watermarking scheme”, where the detector knows the secret key, but not the the original host. The attacker knows everything about the watermarking algorithm, but has no access to the secret key, the host data or the detector itself. We denote the host by s ∈ RN and the wm by m ∈ RN where mi ∈ B, where B is a set of possible values. The wm m is usually generated pseudo-randomly from some class of distributions using a random number generator, given a secret key. Then, the watermarked signal is given by y ∈ RN , where y = s + m. At the detector end, the goal is to successfully detect the existence of the wm in the input signal. In dsss watermarking , B is a finite set. In this paper, we consider the case B = {∆, −∆}. By key extraction, we mean computing m from y. We call an attack against a given watermarking algorithm, an ε-perfect cryptanalytic attack (or ε-perfect attack for short) if with probability ≥ 1 − ε, it (a) yields perceptually undistorted outputs and (b) removes wm . Barring such an attack, a given watermarking algorithm may be useful in many circumstances. F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 226–246, 2003. c Springer-Verlag Berlin Heidelberg 2003


Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

227

If a pirate has an attack that works, for example, only with 90% probability, he will be exposed with ε = 10% probability, which limits his business model. Thus, ε-perfect attacks have a significantly higher threshold over generic benchmark attacks. As we discuss next, it is non-trivial and can be hopeless to convert a generic attack into a ε-perfect cryptanalytic attack. Previous Work and Benchmarks: The watermarking problem is often viewed as a communication problem with side information, where the message to be transmitted is the wm m and the side information is the host data s. If one wishes to account for adversaries, in particular with bounded computational resources (the only type of adversaries we are interested in), then this is no longer a typical communication problem and is inextricably tied to computational complexity issues, which have little to do with the methods of communication and information theory. This issue has often been overlooked in the literature. In addition, suggested (or tested) attacks are often independent of the particular watermarking algorithm and do not fully exploit the available correlations in the host and possibly in the wm in an adaptive manner, or information about the particular targeted watermarking algorithm: usual attacks are non-malicious such as additive independent noise, denoising, smoothing, compression, rotation, cropping, shearing, etc [2, 3]. See [4] for a comprehensive survey. With respect to most watermarking algorithms, some of which have characterizations of optimal attacks (which involves scaling and addition of Gaussian or other noise) and proofs that in their models that the attack can be withstood, Stirmark, with its fairly elementary methods, established an important point: they are vulnerable for reasons unclear or unaccounted for in the theoretical model of their design. Using mathematically more sophisticated and remarkably successful models and tools of signal processing (such as estimation, compression, de-noising) for attacks is a natural variation and a motivation for more benchmarks [3]. However, such benchmarks are at best sanity checks, and akin (in cryptography) to running randomness tests such as Diehard[5] or NIST’s[6] (or applying favorite cryptanalytic tools [7] such as differential or linear analysis) to one’s latest cipher. There is no guarantee whatsoever such generic methods apply to a targeted algorithm. For example, Checkmark as an attack on image watermarking algorithm [8] is comparable to jpeg compression; this image watermarking algorithm is yet to yield to targeted and specific estimation attacks, which are in part effective against plain dsss watermarking . It may be non-trivial to make it work near perfectly, for images, see website of [3] for some examples. We remark that issues here may be more complicated than in cryptography: both watermarking algorithms and attacks/benchmarks ail from the same problem: lack of a reasonably robust perceptual metric applicable in this context [9]. Furthermore, most of such attacks aim to jam the detector, rather than extracting the key. Contribution of Our Work: Assuming we are given a specific watermarking algorithm that is well engineered and performs remarkably well against a wide-

228

M. Kıvan¸c Mıh¸cak et al.

range of generic attacks, (e.g., audio analogies of those in [10]), a natural and important question to decide the practical applicability of the algorithm is to ask if there is a ε-perfect attack. We studied a state of the art dsss audio watermarking algorithm in [11] that embeds the wm which also uses error correcting codes for robustness. We study the algorithm for both hidden and known codebooks, with the goal of extracting the secret key, and as a byproduct get a ε-perfect cryptanalytic attack with ε ∼ 0. Our attack exploits the host and wm correlations. We also implemented and tested an attack that does not recover secret key, but was ε-perfect and used more detailed source models and in fact may be better for wider applicability since there may exist some watermarking scheme for which it may be possible to jam, but not recover the key. Owing to space constraints we do not describe this here. We estimate the embedded wm and subtract a scaled version of the estimate from the watermarked data. This is similar to the so-called “remodulation attacks” in [10] and Wiener filtering in [12]; the non-trivial part is to derive a method to perform this task for the targeted algorithm that is theoretically and empirically justifiable. In our results the attacked signal sounded closer to the original than signal with the wm . We use maximum a posteriori estimation which is optimal in the sense of probability of error (unlike the Wiener filter in [12] which is optimal only for stationary Gaussian sources). Furthermore, we employ a Gaussian-based stochastic model for audio coefficients in the log-MCLT transform domain [13]. It is natural to use error correcting codes in watermarking algorithms, and we analytically characterize the tradeoff between the estimation accuracy and redundancy, and provide experimental results on the success of the proposed attack. Moreover, we precisely quantify the performance of the attack in a detection-theoretic sense. We are not aware of such a discussion in related literature (see [10, 12] or their references). Outline of the Paper: In section 2 we give an overview of the method. Section 3 explains our source model, section 4 analyzes correlation detectors for dsss watermarking schemes, section 5 describes the key extraction and section 6 presents the attack and quantifies the degradation of the detector. Section 7 describes the method’s empirical effectiveness against [11]: our key extraction almost always recovers > 90% of the key. For further details, see [14]; we omit our experimental results on images for ss watermarking schemes with no repetition and our attacks are not yet effective against watermarking methods which use explicit randomization and choose watermarking pseudo-randomly from an interval [8]. Notation: We are going to use calligraphic letters for sets, | . | operator for the cardinality of sets, superscripts to index set elements, boldface letters for vectors, and corresponding regular letters with subscripts to index  elements of vectors.
For example, consider set A where A = a1, a2 , . . . , a|A| and aji denotes the ith element of vector aj . Also let N µ, σ 2 denote the Gaussian distribution

230

M. Kıvan¸c Mıh¸cak et al.

sake of simplicity. The correlations in the source are embedded in the correlations between the variances. As a result, we propose a locally i.i.d. (independent identically distributed) source model. Under this model we assume that s consists of segments of length M where N = qM , both q and M are positive integers. 2 Within segment  i,2 s is assumed to be i.i.d. Gaussian with variance σi , 1 ≤ i ≤ q, i.e., sj ∼ N 0, σi , (i − 1)M + 1 ≤ j ≤ iM , 1 ≤ i ≤ q, where j ∈ {1, . . . N }. Then, we have   q iM   s2j 1 √ exp − 2 , p (s) = 2σi 2πσi i=1 j=(i−1)M+1

and

q

q

  1 1 log p (s) = − M log 2πσi2 − 2 i=1 2 i=1

iM  j=(i−1)M+1

s2j , σi2

where p(.) is the corresponding probability density function. Variants of this model have been shown to be quite useful within the context of image compression [16] and image denoising [17].

4

On dsss Watermarking Methods

Let m ∈ M be the wm vector (message) which is chosen randomly (under N uniform distribution) from the “codeword set” M where M ⊆ {∆, −∆} (randomization is carried out using the secret key as the seed of the random number generator). For dsss methods, watermarking rule is defined by y = s + m where addition is component-wise and y is the watermarked signal. At the detector end, the purpose is to reliably detect the presence of wm . Under private key blind watermarking scenario, it is assumed that the detector knows the secret key and M, hence m, however it does not know s. Under these conditions, the detector provides a solution to the following binary hypothesis testing problem : H0 : y = s H1 : y = s + m In this paper, we consider the detectors that use “correlation test”, since this is usually the detection rule that is used in the literature for sswatermarking schemes1 . The correlation detector is given by H1 > y i mi τ < i=1 H0

N 

1

(4.1)

It can be shown that the correlation detector is not optimal (in the sense of probability of error) in general for non-i.i.d. host signals. The optimality holds only for i.i.d. Gaussian host signals. The performance loss due to suboptimality of the correlation detector shall be quantified in our future work

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

231

Next, we derive the performance of the correlation detector using our source model. Within a detection-theoretic setting, the performance of the detector is characterized by PF (probability of false alarm) and PM (probability of miss)[18], where  PF = Pr [deciding on H1 |H0 ] and



PM = Pr [deciding on H0 |H1 ] .



  N N y m > τ |H = Pr y m < τ |H and P . Using rule (4.1), PF = Pr i i 0 M i i 1 i=1 i=1  

N

q 2 2 Under H0 , we have i=1 yi mi ∼ N 0, ∆ M i=1 σi and hence   τ √ q PF = Q , (4.2) 2 ∆ M i=1 σi    ∞ where Q(t) = t √12π exp −u2 /2 du. Under H1 , we have  

N

q 2 2 2 i=1 yi mi ∼ N N ∆ , ∆ M i=1 σi and hence   N ∆2 − τ √ q PM = Q . 2 ∆ M i=1 σi

(4.3)

The results (4.2) and (4.3) shall be useful in the subsequent sections in order to evaluate the degradation in the performance of the detector after the proposed attack. In the next section, we outline our attack approach and provide a brief discussion. In Secs. 5 and 6, we explain the details of our approach and derive the related results.

5

Key Extraction

We use ML estimation to extract the key. We assume that the estimation of wm will be carried out on watermarked data only, i.e., we assume that the attacker is aware of the presence of a wm and hence, the attack is applied only to watermarked signals. Moreover, we assume that the attacker knows everything about the wm embedding algorithm, except for the secret key, i.e., the attacker knows the domain where wm is embedded, the magnitude of wm samples, ∆ and the set M from which wm is selected; however he does not know the wm sequence itself. Furthermore,  we assume that the total wm m consists of concatenation of
wm vectors w(i) where w(i) is the wm for segment i, and w(i) is chosen from M set W ⊆ {∆, −∆} , 1 ≤ i ≤ q. First note that, according to MAP (Maximum A Posteriori) rule, the estimation problem is ˆ MAP = argmax p (y|m) f (m) , m m∈M

232

M. Kıvan¸c Mıh¸cak et al.

where f (.) is the probability density function according to which codewords are selected from M. Now, we assume that the choice of a particular wm from set M bears no bias over another one. In that case f (m) = 1/ |M|, ∀m ∈ M and the MAP rule reduces to ML rule : ˆ ML = argmax p (y|m) . m

(5.4)

m∈M

Next, we show that under the assumptions stated above, it is optimal to carry out estimation locally within each segment independent of other segments.  (1) (2) (q) ˆ ML . . . w ˆ ML w ˆ ML is a solution to (5.4) where for Lemma 1. The choice of w (i)

ˆ ML is a solution to each i w

    (i) ˆ ML = argmax p y(i) |w = argmax log p y(i) |w . w w∈W

w∈W

(5.5)

where y(i) is the watermarked data in segment i, 1 ≤ i ≤ q. Proof : See Appendix A. 5.1

Estimation Analysis - Most General Case

In this section, our goal is to quantify the accuracy of the estimator in terms of finding the probability distribution of the number of wm samples that are estimated inaccurately. Due to Lemma 1, it is optimal to carry out estimation independently in each segment. Thus, we shall follow this procedure. In this section, we will confine our analysis to a single segment. However the results presented here can be extended to the total signal without difficulty once the structure of W is known. For convenience, we drop the superscripts of type (i) that index the segments in this section. Let σ2 be the variance of each sj within segment i. In the most general case, our goal is to solve the following discrete optimization problem for each segment ˆ ML = argmax log p (y|w) , w

(5.6)

w∈W


   where W = w1 , w2 , . . . , w|W| . Since p (yi |wi ) ∼ N wi , σ 2 , 

ˆ ML w

M   1  M = argmax − log 2πσ 2 − 2 (yi − wi )2 2 2σ i=1 w∈W



= argmax < y, w >, w∈W

where the last equality follows since wi2 = ∆2 is constant, 1 ≤ i ≤ M . Before stating the result, first we introduce the following definitions: 

– e = number of bits that are estimated incorrectly within a segment.

(5.7) (5.8)

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

229

with mean µ and variance σ 2 , log stand for the natural logarithm and < . , . > represent the inner product corresponding to Euclidean norm. Further notation shall be introduced in Secs. 2, 3 and 4, wherever applicable.

2

Overview of the Proposed Attack

Our attack consists of two steps: ˆ of the wm m using models that exploit 1. Given y, we produce an estimate m correlations in the watermarked image and the wm if any; 2. An estimate for input signal is now made; for example, one can use z = ˆ where α > 0 is an input parameter and y is the input to the y − αm wm detector. For step 1, one can use various methods to suit different source models. A good estimate for wm depends on the specific watermarking algorithm itself, in particular the structure of the codeword set M ⊆ {∆, −∆}N from which the wm m is chosen. Obviously, more accurate estimation will make the attack more effective. On the other hand, the estimation accuracy in step 1, depends on the amount of redundancy used in the design of the codeword set M. The redundancy can be used in the form of repetitions as in most ss based watermarking algorithms. We remark that it is safe for the designers to assume that (i.e., unsafe to assume the contrary) if repetitions help the watermarking detector quantitatively (in terms of robustness against common signal processing attacks), it is likely to help the attack as well. As for a good defense, we suggest explicit randomization of the steps in watermarking algorithm (e.g. as in [8, 15]).

3

Source Model

We assume that the host data is a realization of conditionally independent Gaussian distribution (conditioned on the parameters of the Gaussian distribution). The parameters of the Gaussian distribution can be heavily correlated. Note that, in terms of the assumptions about the source distribution, there is a significant difference between the watermarking algorithm designer and the attacker. The designers could possibly design the wm encoding algorithm based on a source distribution, however from a security perspective it is inherently dangerous to design a watermarking detector relying on a source distribution, since an attacker can in principle “skew” or “bend” the distribution so as to force the detector to produce unwanted outputs. On the other hand, the situation is more or less the opposite for attackers. This is because a fixed watermarking algorithm cannot easily ensure that the outputs do not obey a class of distributions. Hence the attack analysis presented here has its importance as it clarifies the algorithm and points some subtleties. Let the unwatermarked source data be s, a length-N zero mean Gaussian vector whose elements are conditionally independent (conditioned on the variances). Throughout the text, we drop the conditioning from notation for the

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

233

   ˆ ML = wi |w = wj (conditional probability of getting wi as a re– pij = Pr w sult of ML estimation where wj was actually embedded).  

 1 M  i j i j – dij = 2∆ k=1 wk − wk  (normalized l1 distance between w and w , also can be viewed as the Hamming distance between “variants” of wi and wj in GF2 ). Note that 1 ≤ dij ≤ M for i = j.
 – Ajk = wi ∈ W|dij = k , 0 ≤ k ≤ M (the set of codewords which are at
 M distance k from wj ). Note that Aj0 = wj , 1 ≤ j ≤ |W|, k=0 Ajk = W, ∀j. 

– M × 1 vector ai where aik = < s, wi − wk >, 1 ≤ k ≤ M . 

ij ij i j k j – M × 1 vector b  where bk = < w , w > − < w , w >, 1 ≤ k ≤ M .  T – Ri = E ai ai (autocorrelation matrix of ai ).

Now, we present Lemma 2 where we quantify the results of wm estimation in the most general case and provide closed form expressions for estimation error. Lemma 2 presents closed form expressions for: – Conditional probability of estimating wj where wi is actually embedded (i.e. pij ). – The probability distribution of the error made as a result of the estimation (i.e., the probability distribution of e) Lemma 2.    ij i 2 2 (i) pij = Pr aik + bij k ≥ 0, 1 ≤ k ≤ M where ak ∼ N 0, 4∆ σ dik and bk = 2∆2 (dkj − dij ). an eigenvector (ii) Assuming that Ri is strictly positive definite, there exists  M ˜ bij i i i iT k ˜ ij = decomposition R = V Λ V such that pij = k=1 Q − √ i where b iT

λk

ij

λik

i

is the k-th element of Λ along the diagonal. V b and 

(iii) Pr e = k|w = wj = i s.t.wi ∈Aj pij and k

|W|

1 Pr [e = k] = |W| j=1 i s.t.wi ∈Ajk pij . Proof : See Appendix B. Naturally the characteristic of the estimation error depends on the structure of the codeword set W. In general it is a nontrivial task to find the these characteristics (pij and Pr [e = k]) for arbitrary codeword sets W. In this paper, we concentrate on the special case of “block repetition codes”, i.e., the case when ∆ or −∆ is repeated within each segment. As a result, we derive tractable expressions for the distribution of the error that is made in the estimation process. More detailed analysis on different codes shall be considered in our future work. 5.2

Estimation Analysis - Block Repetition Code 
In this section, we consider the case where W = w0 , w1 where wk0 = −∆, wk1 = ∆, 1 ≤ k ≤ M .

234

M. Kıvan¸c Mıh¸cak et al.

Lemma
3.  √   If W = w0 , w1 , for segment k, p01 = p10 = Q σ∆k M , p00 = p11 = 1 − p01 , Pr [e = 0] = p00 , Pr [e = M ] = p01 , where σk2 is the variance of segment k, 1 ≤ k ≤ q. Proof : See Appendix C. Now, we extend the estimation error result to the whole signal under our locally i.i.d. source model for the block repetition code case. Let 

B k = {(l1 , l2 , . . . , lk ) |li = lj fori = j and li ∈ {1, 2, . . . , q} , 1 ≤ i ≤ k} , 

k 1 ≤ k ≤ q with B 0 = ∅ (i.e., B isthe set of all possible k–tuples from the set  k q . Also let etotal be the number of bits that {1, 2, . . . q}. Note that B  = k are estimated incorrectly in the whole signal. Then we have the following result.

Corollary 1. Pr [etotal = kM ] =

 (l1 ,...,lk )∈Bk



k 

m=1

 Q

∆ √ M σlm

   q m=k+1

 1−Q

∆ √ M σlm

 .

Corollary 1 is immediate from the independence of codeword selection between different segments. Remark: Clearly, the wm estimation process will perform strictly better than 50% (i.e., in expectation sense strictly more than half of the watermarking bits shall be estimated correctly). The estimation accuracy depends on relative strength of the wm with respect to the signal as well as the wm length and the particular codebook used. For instance, the usage of block repetition codes greatly increases the estimation accuracy. Also as the wm strength increases, the estimation error would in general decrease. Note that, some controlled redundancy and relatively strong wms are usually essential in ss based watermarking schemes in order to provide synchronization against de–synch attacks and withstand against common signal processing attacks. This redundancy is usually provided in terms of using a block repetition code in the watermarking community. Such a watermarking scheme, if designed properly, is expected to withstand most reasonable “blind” attacks (such as de–synchronization attacks, band pass filtering, compression, denoising, etc.), that aim to jam the detector only. We use the term “blind” for an attack if the attack does not make use of the watermarking algorithm used in the system. In general, as a rule of thumb, as the amount of redundancy in the watermarking code and the strength of the wm increase, the robustness against blind attacks is expected to increase. On the other hand, this also brings advantages to a “non–blind” attacker (a non–blind attacker is an attacker that knows the watermarking algorithm completely or has some partial information about the watermarking algorithm), who aims to extract the key.

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

6

235

Analysis of the Proposed Attack

Our proposed attack produces the following signal: ˆ ML = s + m − αm ˆ ML . z = y − αm

(6.9)

Since the attacker is going perform strictly better than “random coin flips” in expectation sense, clearly if α is chosen large enough, the wm detector is expected to fail. If the estimation accuracy is high (say around %90) α ∼ 1 would be sufficient. However, as the estimation accuracy degrades (i.e., gets closer to %50), it would be necessary to use higher values of α in order to increase the PM of detector to a desired level. On the other hand, if α is too large, the attacker is going to introduce unacceptable amount of distortion to the signal. In this section, our goal is to quantify this trade–off. In particular, in Sec. 6.1, we quantify the distortion introduced by the proposed attack in an expected MSE (mean squared error) sense. In Sec. 6.2, we quantify the degradation in wm detection by analyzing the variations in PF and PM of a correlation detector of a dsss scheme after proposed attack. We provide results for block repetition codes. 6.1

Distortion Induced by Proposed Attack

Let



ˆ ML dtotal = z − s = m − αm be the total distortion vector introduced by the attack. Our goal in this section 2 is to find E ||dtotal || . First, we derive the expected MSE in a particular segment. This result can easily be generalized to the whole signal. Afterwards, we specialize to the case of block repetition codes. Lemma 4. Within a particular segment,   |W| |W|     2 2 E ||d|| = ∆2 M 1 + α2 + 2α∆2 −M + dij pij  , |W| i=1 j=1

(6.10)

  ˆ ML and pij = Pr w ˆ ML = wi |w = wj within that segment where d = w − αw and dij is the “Hamming distance” between wi and wj (as defined in Sec. 5.1). Proof : See Appendix D.


 Corollary 2. In the block repetition code case, i.e., W = w0 , w1 , where wl0 = −∆, wl1 = ∆, 1 ≤ l ≤ M , we have      ∆√ 2 2 2 M −1 , (6.11) E ||d|| = ∆ M 1 + α + 2α 2Q σk in segment k, and

   q    ∆√ 2 2 Q M . E ||dtotal || = ∆ N 1 + α + ∆ M 2α −q + 2 σk 2

2

k=1

Proof : See Appendix E.

(6.12)

236

6.2

M. Kıvan¸c Mıh¸cak et al.

Degradation of wm Detection after Proposed Attack

Now, we quantify the degradation in the performance of the wm detector, which uses correlation test. First recall that we assume the attacker is aware of the presence of the wm i.e., proposed estimation attack is applied only if the input signal is watermarked. Therefore, PF (i.e., probability of detecting wm if wm is not embedded) does not change after the attack. The proposed attack only changes PM (i.e., probability of declaring wm is not present even though wm was embedded). In order to gain insight, we first consider the simplest case, where we consider a single Gaussian random variable. We are able to find tractable closed form expressions in this case. Then, we extend this result to the case of block repetition codes and provide tractable lower bounds on PM . Single Random Variable Case: Consider a single Gaussian random variable s, that is watermarked via dsss : y = s + w, w is randomly chosen from W = {∆, −∆} with a fair coin toss. The detector applies the simple correlation test; then the decision rule is H1 > yw τ, < H0  2  −τ and σ 2 is the variance of s. The where PM = Pr [yw < τ |y = s + w] = Q ∆∆σ estimation attack produces w ˆ = ∆signy. After the attack, the detector input is  ˆ z = y − αwˆ = s + w − αw. ˆ Let E = zw = sw + ∆2 − αww. Lemma 5. For the single random variable setup,   2    2    Q ∆ (1+α)−τ − Q ∆ + Q ∆ (1−α)−τ if ∆2 α > τ ∆σ ∆σ  2 σ  PM = Pr [E < τ ] = .  Q ∆ (1−α)−τ else ∆σ (6.13) Proof : See Appendix F. Remark: There is a nonuniform behavior in the functional behavior of PM . There are 2 regions (2 different functional forms); these regions are determined by comparing ∆2 α with τ . It can be shown that PM is an increasing function of α, however the rate of increase changes in the regions of ∆2 α > τ and ∆2 α ≤ τ . In particular it can be shown that when ∆2 α ≤ τ , PM increases a lot faster with respect to α than the other regime. Hence, for fixed τ , an increase in ∆2 α is very useful for attacker (since the rate of increase in PM increases), i.e. increasing wm strength (∆) and/or attack strength (α) benefits the attacker. Also, for fixed ∆ and α, decreasing τ damages the attackers performance. However, note that, as τ decreases, the chances of declaring unwatermarked data as watermarked (i.e., PF ) increases, which is not shown here.

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

237

Block Repetition Code Case Now, consider the case where block repetition code is used within each segment. Due to our locally i.i.d. model, this case can be viewed as watermarking the length–q signal (recall that q is the number of segments) ˜s, which is given by the local averages of s. Hence, s˜i =  

iM 1 ˜i ∼ N 0, σi2 /M for segment i, where 1 ≤ i ≤ q. Furj=(i−1)M+1 sj , and s M ˜ be the length q signal that consists

thermore let y of arithmetic means of the iM 1 watermarked signal y for each segment, i.e., y˜i = M j=(i−1)M+1 yj , 1 ≤ i ≤ q. yi = s˜i + ∆). Then for segment i, if w = w0 (w = w1 ), then clearly y˜i = s˜i − ∆ (˜ ˜, Hence, the whole setup can be viewed as attacking the watermarked signal y where no ECC (error correction coding) has been used in the wm generation. Utilizing this approach, we can use the result of Lemma 5 in deriving probability of error results for the block repetition code case. Thus, we present the following result. 
Corollary 3. When W = w0 , w1 , where wk0 = −∆, wk1 = ∆, 1 ≤ k ≤ M , according to 0–mean locally i.i.d. Gaussian model with variance σi2 in segment i, 1 ≤ i ≤ q, N = qM , we have the following: (i) For segment i, we have  √  √  √  2 2 Q M ∆ (1+α)−τ M σ∆i + Q M ∆ (1−α)−τ −Q if ∆2 α > τ ∆σi ∆σ i  √ . PM = 2  else Q M ∆ (1−α)−τ ∆σi (6.14) ˜ k be the set of all k–tuples from index set {1, 2, . . . , q}, i.e., (ii) Let D "  #  ˜k = ˜k| = q ˜ kl |˜ v D vikl = v˜jkl for i = j and v˜ikl ∈ {1, . . . , q} , 1 ≤ i ≤ k, 1 ≤ l ≤ |D . k ˜ kl (i.e., elements of the l-th k-tuple Accordingly define the index set of v ˜ k ): from set D  
V˜ kl = v˜0kl , v˜1kl , . . . , v˜kkl . Also let V˜ kl,C denote {1, . . . , q} − V˜ kl . Then for the whole signal we have ˜k

D | N | 

 q 

q∆2 (1 + α) − τ − 2kα∆2 , s˜m < ∆, m ∈ V˜ kl , ∆ i=1 k=0 l=1  (6.15) s˜n > ∆, n ∈ V˜ kl,C "     q  √ q∆2 (1 + α) − τ − 2kα∆2 q ≥ M Q k q∆σmin 1 τ k= 2 (q− α∆2 )  k   q−k $ √ √ ∆ ∆ M M , (6.16) −Q Q σmin σmin

PM =



Pr

s˜i >

where σmin = min1≤i≤q σi .

238

M. Kıvan¸c Mıh¸cak et al.

The results (6.14) and (6.15) follow directly from the extension of (6.13). In order to obtain (6.16), we use union bound and monotonicity properties of the Q (·) function. The complete proof has been omitted here due to space constraints.

7

Practical Applications

We developed 3 variants of our attack approach and applied them on the state-ofthe-art audio watermarking algorithm [11], which was designed using dsss signal watermarking approach. 7.1

An Overview of the Tested Audio Watermarking Scheme [11]

Here, we provide an outline of [11]. Some of the pre– and post–processing details are omitted due to space constraints. Both wm embedding and detection takes place in the time–frequency representation of the audio clip. In particular MCLT (Modulated Complex Lapped Transform) has been used in order to pass to this domain [13]. 8 bits are hidden in a L = 11 second audio clip. The first 4 bits are used for randomization purposes together with the secret key. The last 4 bits are actually embedded after the randomization process. An L second audio clip is divided into “cells” in the time–frequency domain. There are total of 120 splits along the frequency axis and 24 splits along the time axis. The splitting along the time axis is done in a uniform fashion whereas the splitting along the frequency axis is done in a geometric progression. In the embedding process a codeword set C is used. The set C has the following properties: 6

– C ∈ {∆, −∆} – |C| = 12 – c∈C ⇔ ¯ c ∈ C where c¯ is defined such that c¯i = −ci , 1 ≤ i ≤ 6. Now for each frequency split (there are 120 of them), there are 24 cells to consider. These cells are divided into 4 groups (because there are 4 bits to embed), 6 cells in each group. 1 bit falls to each group. Given 1 bit, an element c is chosen randomly from C. Then, the chosen c is embedded to each group by using the block repetition code, i.e., ci ∈ {∆, −∆} is embedded in the i–the cell of the group. The addition of ±∆ is done in the magnitude MCLT domain after applying log non–linearity. The detector uses the correlation test. The frequency band, that is used both in wm embedding and detection, is 2–7 kHz band. For further details, we refer the reader to [11]. 7.2

Simulation Results Based on Quantitative Analysis of the Attack

Now, we present predictions about proposed attack for the setup of [11] by numerically evaluating our theoretic results that were derived in the previous sections. Our experiments revealed that, the variance of MCLT coefficients (using

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

239

on a 0-mean locally i.i.d. Gaussian model) were in the range of 4 − 6 most of the time (after applying the proper pre-processing mentioned in [11]). Also average cell size for proposed method was about 40 coefficients. In [11], ∆ is typically chosen in the range of [1, 3]. ∆ = 1 is used for numerical simulations of our analysis. Next, we give plots that show the behavior of PM without any attack and after attack. Recall that, although we derive closed form expressions for PM after attack, they are not tractable. Thus, in the plots the curve that gives the behavior of wm detector after attack is a lower bound on actual PM (given by (6.16)). The plots are given in Fig. 1 in Appendix. Consider 0-mean locally i.i.d. Gaussian signal model within each cell,   (i.i.d. independent everywhere), ∆ = 1, and σi = 5 + sin 2πi L , 1 ≤ i ≤ q where q is the number of segments (i.e., the number of cells); i indexes each cell in the MCLT domain and L = 5. We assume that each cell consists of 40 coefficients (i.e., M = 40) and we choose τ /number of coefficients = ∆2 /2 to equalize PF and PM when there are no attacks. . In the plots (a) and (b) given in Fig. 1, the solid line shows PM at the detector without any attack (given by (4.3)) and the dashed line shows a lower bound on PM after our proposed attack (given by (6.16)). The lower bound (6.16)) is given by the solid line in Fig. 1(c). First we fix α = 3 and look at the performance of detector in terms of degradation in PM vs N (total number of coefficients) (Fig. 1(a)). Then, we fix N = 80000 and examine the performance with respect to varying α: 0 < α ≤ 5. The degradation in the performance of the detector is shown in Fig. 1(b) with respect to changing α. Note that, the meaning of varying α is changing the strength of the attack, thereby increasing the distortion introduced to the signal. Hence, next we examined the performance degradation of the detector performance with respect to the average distortion introduced by the attack. The degradation in the performance of the detector is shown in Fig. 1(c) vsthe “average normalized  distortion” introduced by the attack, i.e., E||dtotal ||2 / N ∆2 given by (6.12). 7.3

Practical Details and Experimental Results of Proposed Attack Methods on Audio Clips

We assume that attacker knows everything about the watermarking algorithm except for the secret key, i.e., the locations of the cells and the codeword set C are known, however the exact codewords, that have been used, are unknown. We applied 3 variations of our estimation attack approach as described briefly below. Method 1: Relying on the 0–mean locally i.i.d. Gaussian source model (i.i.d. within each cell, independent everywhere), we carried out the following ML estimation independently for each group of 6 cells: ˆcML = argmax < y, c >, c∈C

240

M. Kıvan¸c Mıh¸cak et al.

where y is the watermarked signal within each cell. Then for each group of 6 cells, the attacked signal is given by z = y − αˆ cML . Here α is an attack parameter and determines the strength of the attack. Method 2: Relying on the 0–mean locally i.i.d. Gaussian source model (i.i.d. within each cell), this time we assumed that we do not know C. Thus we assumed that 6 C = {∆, −∆} in general. Hence, we carried out estimation independently within each cell. Thus for the i–th cell of a group of cells, we used  yj . cˆi,ML = ∆ sign j∈cell i Then for each cell, the attacked signal is given by z = y − αˆ cML . Method 3: In the latest method, we used a slightly different source model: We assumed that the signal is independent Gaussian and locally i.i.d., however not 0–mean in general. This is based on our experimental observations. Based on this model, we used vertical strips (in the time–frequency plane where frequency stands for the y axis) of watermarked data (that cover more than 1 cell) in order to find estimate of the mean at each location. The rationale for using vertical strips that cover more than 1 cell is to cancel the effect of bias due to wm as much as possible in mean estimation. The estimated mean is subtracted from the watermarked signal. Then Method 2 is applied to the resulting signal. Experimental Results: 25 audio clips of length approximately 22 seconds (and of different types and characteristics) have been experimented. 16 bits of wm have been embedded to each of these audio clips; 8 bits in the first 11 second half and 8 bits in the second 11 second half. 7 different wm strength levels have been tried, namely ∆ = 1, 1.5, 2, 2.5, 3, 3.5, 4 (all in dB since wm is added in log magnitude MCLT domain). All 3 attack methods have been tried at all wm strength levels. The wm detector in the proposed scheme of [11] is a normalized correlation detector and naturally we used this detector in our experiments. Furthermore, the detector does not know which attack took place. It has been observed that wm detector always failed to detect the presence of wm after the attack when we chose α ∼ 2 − 3 for Method 1 and Method 3 and α ∼ 4 − 5 for Method 2. After all attacks, we observed very mild or no degradation in the perceptual quality of the attacked audio clip; in fact the attacked audio clip sounded closer to the original than the watermarked clip in most of our experiments. Also, when Method 1 is applied, we observed that more than 90% of wm was estimated correctly on average. Thus, approximate key extraction is achieved in this case.

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

241

Acknowledgments We would like to thank Mariusz Jakubowski of Microsoft Research for providing experimental results on applying [2, 3] to [8].

References [1] I. J. Cox, J. Killian, F. T. Leighton and T. Shamoon, “Secure Spread Spectrum Watermarking for Multimedia,” IEEE Trans. Image Proc., Vol. 6, No. 12, pp. 1673–1687, Dec. 1997. 226 [2] F. A. P. Petitcolas and M. G. Kuhn: StirMark software, available from www.cl.cam.ac.uk/~fapp2/watermarking/image watermarking/stirmark/. 227, 241 [3] S. Pereira, S. Voloshynovskiy, M. Madue˜ no, S. Marchand-Maillet and T. Pun: Checkmark software, available from watermarking.unige.ch/Checkmark/. 227, 241 [4] S. Voloshynovskiy, S. Pereira, T. Pun, J. J. Eggers and J. K. Su, “Attacks on Digital Watermarks: Classification, Estimation-based Attacks and Benchmarks,” IEEE Communications Magazine (Special Issue on Digital watermarking for copyright protection: a communications perspective), F. Bartolini, I. J. Cox, J. Hernandez, F. P´erez-Gonz´ alez, Guest Eds. , Vol. 39, No. 8, pp. 118–127, 2001, Invited paper. 227 [5] G. Marsaglia: Diehard software, available from stat.fsu.edu/~geo/diehard.html. 227 [6] Software for random number generation and testing, available from csrc.nist.gov/rng/. 227 [7] A. J. Menezes, P. C. van Oorschot and S. A. Vanstone, Handbook of Applied Cryptography, CRC Press, 1997. 227 [8] R. Venkatesan and M. H. Jakubowski, “Robust Image Watermarking,” Proc. ICIP, Vancouver, B. C., Canada, 2000. 227, 228, 229, 241 [9] R. Venkatesan, “Signal Processing in the Presence of Adversary,” preprint, available from research.microsoft.com/~venkie/. 227 [10] S. Voloshynovskiy, S. Pereira, V. Iquise and T. Pun, “Attack modeling: Towards a second generation benchmark”, Signal Processing, Special Issue on Information Theoretic Issues in Digital Watermarking, Vol. 81, No. 6, pp. 1177–1214, June 2001. 228 [11] D. Kirovski and H. S. Malvar, “Robust Covert Communication Over a Public Audio Channel Using Spread Spectrum,” Proceedings of Information Hiding Workshop, Pittsburgh, PA, 2001. 228, 238, 239, 240 [12] J. K. Su, J. J. Eggers, and B. Girod, “Analysis of Digital Watermarks Subjected to Optimum Linear Filtering and Additive Noise,” Signal Processing, Special Issue on Information Theoretic Issues in Digital Watermarking, Vol. 81, No. 6., pp. 1141–1175, 2001. 228 [13] H. S. Malvar, “A modulated complex lapped transform and applications to audio processing,”, Proc. IEEE ICASSP, Phoenix, AZ, March 1999. 228, 238 [14] M. K. Mıh¸cak, R. Venkatesan and M. Kesal, “Discrete-Sequence Spread Spectrum Watermarking Methods and Estimation Attacks,” preprint, August, 2001. 228 [15] M. K. Mıh¸cak and R. Venkatesan, “Blind Image Watermarking via Derivation and Quantization of Robust Semi-Global Statistics,” Proc. IEEE ICASSP, Florida, FL, June 2002. 229

242

M. Kıvan¸c Mıh¸cak et al.

[16] S. LoPresto, K. Ramchandran and M. T. Orchard, “Image Coding based on Mixture Modeling of Wavelet Coefficients and a Fast Estimation–Quantization Framework,” Proc. Data Compression Conference 1997, Snowbird, Utah, pp. 221—230, 1997. 230 [17] M. K. Mıh¸cak, I. Kozintsev, K. Ramchandran and P. Moulin, “Low-Complexity Image Denoising Based on Statistical Modeling of Wavelet Coefficients,” IEEE Signal Processing Letters, Vol. 6, No. 12, pp. 300—303, Dec. 1999. 230 [18] H. L. Van Trees, Detection, Estimation and Modulation Theory, Wiley, 1968. 231

A

Proof of Lemma 1

ˆ ML = argmaxm∈M The optimization problem (5.4) can be rewritten as m log p (y|m) , which in turn can be rewritten as ˆ ML = m

argmax

q 

w(i) ∈W,1≤i≤q i=1

  log p y(i) |w(i)

  (i) ˆ ML ≥ due to conditional independence of y on m. Now we have log p y(i) |w   (i) ˆ ji for all 1 ≤ i ≤ q, 1 ≤ ji ≤ |W| where w ˆ ML are defined by (5.5). log p y(i) |w    

q (i) ˆ ML ≥ qi=1 log p y(i) |w ˆ ji for all 1 ≤ ji ≤ |W|. This implies i=1 log p y(i) |w Hence the proof.  

B

Proof of Lemma 2

First,we present the proof of part (i). Note that, using (5.8),   pij = Pr < y, wi > ≥ < y, wk >, 1 ≤ k ≤ |W| | w = wj . Conditioned on wj , y = s + wj . Hence < y, wi > − < y, wk > |wj = aik + bij k. Since wi − wk are different at dik locationsand at eachof those locations the difference value is ±2∆, we have aik ∼ N 0, 4∆2 σ 2 dik . Also < wi , wj >= ij 2 ∆2 (M − 2dij ), < wk , wj >= ∆2 (M − 2dkj ), and hence  2 bk = 2∆ (dkj2−2dij ). i k j Therefore, < y, w > − < y, w > |w ∼ N 2∆  (dkj − dij ) , 4∆ σ dik

and pij = Pr aik ≥ ∆2 (dij − dkj ) = −bij k , 1 ≤ k ≤ M . Hence the proof of part (i). Next, we give the proof of part (ii). Note that by construction Ri is a positive semidefinite matrix; the assumption of strict positive definiteness is equivalent to having no full correlation between the components of ai (i.e., one cannot be determined from the other with full certainty) and hence this assumption is quite mild. If this assumption is not satisfied, it is possible to decrease dimension until this assumption is satisfied. Now, we briefly show that there exists an eigenvec- T ˜ik ≥ −˜bij tor decomposition Ri = Vi Λi Vi such that pij = Pr a k ,1 ≤ k ≤ M

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks T

243

T

˜ ij = Vi bij . Firstly, note that for any eigenvector de˜i = Vi ai and b where a i composition of R , since the eigenvector matrix is unitary, the norm is preserved T and hence the probability is invariant under the transform with Vi . However T in general, after transforming with an arbitrary Vi , the corresponding probabilities would be the probability of a ˜ik ≥ −˜bij k some k and the probability of T ki T ij a ˜ik ≤ −˜bij for some other k. Now note that a ˜ik = vki ai and ˜bij b k k = v ki i i where v is the k-th eigenvector of R (i.e., k-th column of V ). If for some k, ki the corresponding probability is a ˜ik ≤ −˜bij with −vki and k , we just replace v we still have a valid eigenvector decomposition. Thus there exists an eigenvector i i decomposition of R such that pij = Pr a ˜k ≥ −˜bij k , 1 ≤ k ≤ M . Furthermore,   i iT  T T T T ˜ ˜i is an inde˜a = Vi E ai ai Vi = Vi Vi Λi Vi Vi = Λi . Hence a E a   of pendent Gaussian vector and a ˜ik ∼ N 0, λik where λik is the k-th element    ij  M ˜ b M ij i i k Λ along the diagonal. Thus, pij = k=1 Pr a ˜k ≥ −˜bk = k=1 Q − √ i . λk

Hence the proof of part (ii). Part (iii) is obvious.

C

 

Proof of Lemma 3


Using W = w0 , w1 within each segment, is equivalent to adding −∆ to the arithmetic mean of that segment if w = w0 or adding ∆ to the arithmetic mean of that segment if w = w1 . In that case the estimation problem can be rewritten as  yi . w ˆML = argmax w w∈{∆,−∆}

The solution is given by

" ˆ ML = w

w0 if w1

i



i yi < 0, else

for each segment. Then we have Pr [w ˆML = ∆|w = −∆] = Pr ( i yi > 0|w  √

= −∆) = Pr ( i si > M ∆) = Q M ∆/σ . From symmetry we have Pr [w ˆML √  = −∆|w = ∆] = Pr [w ˆML = ∆|w = −∆] = Q M ∆/σ .  

D

Proof of Lemma 4

After the attack,

" di =

(1 − α) wi if wi = w ˆML,i . (1 + α) wi if wi = w ˆML,i

ˆ ML = wi and w = wj , then Therefore, if w  ||d||2 =< d, d > = ∆2 (1 − α)2 (M − dij ) + (1 + α)2 dij     = ∆2 M 1 + α2 + 2α (2dij − M ) .

244

M. Kıvan¸c Mıh¸cak et al.

Hence, 

  |W| |W|       ˆ ML = wi , w = wj  . E ||d|| = ∆2 M 1+α2 +2α −M +2 dij Pr w 2

i=1 j=1

(D.1)     ˆ ML = wi , w = wj = pij Pr w = wj = pij / |W|. Using this in (D.1) But, Pr w yields (6.10).  

E

Proof of Corollary 2

By using Lemma 3 in segment k, we have |W| |W|

1  1 dij pij = [d01 p01 + d10 p10 ] = d01 p01 = M Q |W| i=1 j=1 2



∆√ M σk

 .

(E.1)

Using (E.1) in (6.10) we get (6.11).(6.12) is a trivial extension of (6.11) to the whole signal.  

F

Proof of Lemma 5 PM = Pr [E < τ |w = −∆] Pr [w = −∆] + Pr [E < τ |w = ∆] Pr [w = ∆] = Pr [E < τ |w = −∆] ,

from symmetry. Now, Pr [E < τ |w = −∆] = Pr [E < τ |y > 0, w = −∆] Pr [y > 0|w = −∆] + Pr [E < τ |y < 0, w = −∆] Pr [y < 0|w = −∆] . (F.1) Concentrating on each of the components of (F.1), we get : Pr [y > 0|w = −∆] = Pr [s > ∆] , Pr [y < 0|w = −∆] = Pr [s < ∆] ,   Pr [E < τ |y > 0, w = −∆] = Pr −s∆ + ∆2 + α∆2 < τ |s > ∆   ∆2 (1 + α) − τ = Pr s > |s > ∆ , ∆   2 Pr [E < τ |y < 0, w = −∆] = Pr −s∆ + ∆ − α∆2 < τ |s < ∆   ∆2 (1 − α) − τ = Pr s > |s < ∆ . ∆ Employing (F.2), (F.3), (F.4) and (F.5) in (F.1), we obtain   ∆2 (1 + α) − τ Pr [E < τ |w = −∆] = Pr s > , s>∆ ∆

(F.2) (F.3)

(F.4)

(F.5)

(F.6)

Cryptanalysis of Discrete-Sequence Spread Spectrum Watermarks

 ∆2 (1 − α) − τ , s ∆   2  ∆ (1 + α) − τ = Pr s > max , ∆ ∆   ∆2 (1 − α) − τ + Pr s > , s τ . Thus, if ∆ α > τ , (F.7) can be rewritten as     ∆2 (1 + α) − τ ∆2 (1 − α) − τ Pr [E < τ |w = −∆] = Pr s > + Pr ∆ > s > , ∆ ∆  2     2  ∆ (1+α)−τ ∆ ∆ (1−α)−τ =Q −Q +Q , (F.8) ∆σ σ ∆σ after carrying out necessary manipulations. Similarly, if ∆2 α ≤ τ , (F.7) can be rewritten as   ∆2 (1 − α) − τ Pr [E < τ |w = −∆] = Pr [s > ∆] + Pr ∆ > s > , ∆   2 ∆ (1 − α) − τ , (F.9) =Q ∆σ after carrying out necessary algebra. Combining (F.8) with (F.9), we get (6.13).  

246

M. Kıvan¸c Mıh¸cak et al.

1 0.9

0.8

0.8

0.7

0.7

0.6

0.6

PM

1 0.9

P

M

0.5

0.5

0.4

0.4

0.3

0.3

0.2

0.2

0.1

0.1

0

0 0

1

2

3

4

5 N

6

7

8

9

10

0

6

0.5

1

1.5

2

2.5 alpha

x 10

(a) PM before attack(solid) - lower bound on PM after attack (dashed) vs. N , τ = N ∆2 /2

3

3.5

4

4.5

5

(b) PM before attack(solid) - lower bound on PM after attack (dashed) vs, α, τ = N ∆2 /2

1

0.9

0.8

lower bound on P

M

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0

0

2

4

6

8

10 E||d

2

12

14

16

18

20

2

|| /(N∆ )

total

(c) Lower bound on   PM after attack vs E||dtotal ||2 / N ∆2 , τ = N ∆2 /2

Fig.  1. Locally i.i.d. 0–mean Gaussian model is employed where σi = 25 + sin 2πi L , L = 5, 1 ≤ i ≤ q, M = 40, N = M q; τ /number of coefficients = ∆ /2. In plots (a) and (b), solid line shows PM without any attack (4.3); dashed line shows lower bound on PM after proposed attack (6.16) (the latter one is shown by solid line in (c)). In (a), α = 3 is fixed, x-axis shows N . In (b) and (c), N = 80000 is fixed, 0 < α ≤ 5. In (b), x-axis shows α; in (c), x-axis shows the average  nor- malized distortion introduced in the attack signal, given by E||dtotal ||2 / N ∆2 (6.12)

Detectors for Echo Hiding Systems Scott Craver, Bede Liu, and Wayne Wolf Department of Electrical Engineering Princeton University, Princeton NJ 08544, USA

Abstract. Echo hiding is a method of hiding information in an audio clip by the addition of embedding imperceptible echoes. The echoes are detected by various methods, including autocorrelation and cepstral analysis. We treat echo hiding as general multiplicative embedding in the frequency domain, and derive appropriate detectors based on various statistical models of audio FFT coefficients. This results in several detectors that are both simpler and more powerful than cepstral detection. We also observe that detection by simple correlation in the log-spectral domain performs very well in contrast to much more complicated approaches.

1

Introduction

Various methods exist for embedding and detecting echo hiding watermarks. Echo hiding methods may embed simple echoes, multiple echoes, filtered echoes with time-varying parameters; these may be detected detected by methods ranging from simple autocorrelation to cepstral and autocepstral analysis (for two well-known examples, see [4], [7].) Recent research efforts to analyze watermarks known to use echo hiding, but with unknown parameters, led us to assess the capabilities of known echo detection methods, and compare them to detector structures suggested by various statistical assumptions about audio data. One reason why echo hiding in particular deserves such analysis is the common use of older detection techniques traditionally intended for echo detection, such as the computation of the real or complex cepstrum of an audio signal. This turns out to be suboptimal, and should not be used. As we will show, echo detection is best treated as a special case of general multiplicative frequency-domain embedding, in which a watermark vector w is immersed in a data vector x by the formula y = x(1 + αw). Not only do existing detectors for this very common type of watermark perform quite well at detecting echo hiding watermarks, but are much more flexible, able to detect complex echoes without an increase in complexity of the detector structure. This paper is organized as follows. In section 2, we provide an overview of echo hiding and cepstral detection. In section 3 we examine several statistical models of audio transform coefficients, and derive detector structures based on these models. In section 4 we provide a comparision of the detector performance on an audio clip with a faint, simple echo. Finally, we present our conclusions.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 247–257, 2003. c Springer-Verlag Berlin Heidelberg 2003


248

1.1

Scott Craver et al.

A Brief Note about SDMI

The motivation for this research was provided by the outcome of the SDMI challenge, a three-week contest in the fall of 2000 to break four watermarking methods, as well as other auxilliary technologies, proposed for SDMI’s phase II screening technology [10]. Several research groups broke the technologies, learning a great deal about how they worked [11, 12]. In the process of breaking these watermarking methods, it was determined that at least one of them used an echo hiding system, which utilized complicated echoes with time-varying parameters [12]. Efforts to detect these echoes and estimate their parameters led to the investigation of echo detection methods themselves, and their relative capabilities. The analysis of security systems can lead to the development of improved systems, and we believe this is no exception. Efforts to break a certain kind of watermark will lead researchers to develop powerful methods of detecting clues and artifacts left behind by that kind of watermark; this naturally leads to more powerful detectors for future information hiding systems. Future watermarks can thus be made less perceptible with the same degree of strength, or can embed data with a higher capacity under similar constraints. While the Secure Digital Music Initiative itself appears to have faded into obscurity [5], we hope that scientific research which grew out of breaking it will prove useful for some time to come.

2

Echo Hiding

Echo hiding, described in [4] and [6], is a method of embedding information by inserting imperceptible echoes into music. A stream of music is combined with a delayed, attenuated, and possibly filtered version of itself, with the choice of delay and attenuation values encoding a message.

X[k]

Y[k]

H

z-D

α

H

z-D

α

W[k] Fig. 1. Block diagram of an example echo hiding system. Message data W controls the delay D and attenuation α of a collection of echoes. Filtering may be employed to reduce audibility

Detectors for Echo Hiding Systems

249

Echo hiding is naturally content-dependent, in that the added message is shaped in both amplitude and frequency distribution to match that of the cover data. While many information hiding systems can be viewed as additive or multiplicative in nature, embedding a signal s[k] into a cover-message x[k] as y[k] = x[k] + αs[k] or y[k] = x[k](1 + αs[k]), echo hiding is more
properly modeled as passing audio through a time-varying linear filter: y[k] = 0≤j≤m cm x[k − m]. Detection consists of testing the hypothesis that the data has indeed been subjected to such a filter; the varying parameters of the filter encode the data. 2.1

Detection via Cepstral Analysis

Popular techniques for detecting echo watermarks include simple autocorrelation and cepstral analysis. Detection by autocorrelation is straightforward because the echo delay is known to (indeed, chosen by) the designers of the watermarking system, and thus known to the detector. Further, the embedding method can be designed to induce specific values in the signal’s autocorrelation. [7] Cepstral analysis was introduced for the application of detecting echoes in seismic data [1]. It is thus natural that this technique would be employed to detect echoes in an echo-hiding system. Cepstral analysis employs a combination of frequency transforms and the logarithm function, which has the effect of transforming the artifacts caused by an echo into a deterministic signal plus additive noise; the signal is then detected in a perhaps circuitous manner, using a second frequency transform as a sort of filter bank. Given an audio signal x(t) with an echo added to produce y(t) = x(t)+αx(t− τ ), α < 1, we have the multiplicative relationship between Fourier transforms X and Y : Y (ω) = X(ω)(1 + αe−jωτ ) Computing the complex logarithm of both sides separates the echo from the audio as an additive deterministic signal which is periodic in ω: log Y (ω) = log X(ω) + log(1 + αe−jωτ ) ∞  −1n−1 n −jnωτ α e = log X(ω) + n n=1 ≈ log X(ω) + αe−jωτ The final approximation relies on the fact that the signal’s higher-order harmonics drop in magnitude as αn /n. A second Fourier transform of this expression yields the complex cepstrum, collating much of the echo signal’s energy into a single frequency. Thus the cepstrum of the output is equal to the cepstrum of the input, plus an impulse of magnitude α at a frequency corresponding to the echo delay τ , which can simply be thresholded—if the approximation is to be believed. In reality, the echo signature’s harmonics will have enough energy that it is worthwhile for the detector to take them into account. In their seminal paper on echo hiding, Gruhl,

250

Scott Craver et al.

Lu and Bender describe an “autocepstral” detector [4]. This detector computes the complex cepstrum of a frame of audio samples using FFTs, and then subjects the result to an extra autocorrelation step in order to utilize the signature’s higher-order harmonics. The resulting detector offered improved performance over the cepstrum alone for detecting embedded echoes. In this paper, we never use a simple cepstral detector, as we observed consistently better performance from computing an autocepstrum.

3

Other Detectors

Aside from these time-honored methods, one can derive appropriate detectors for a given type of embedded signal in a straightforward manner, by modelling the probability distribution of the underlying audio data and utilizing detection and estimation theory (a comprehensive introduction can be found in [8].) It stands to reason that a detector that is both based on the underlying signal statistics, and designed to perform optimally given an apt model of the underlying channel, should offer an improvement over existing methods. 3.1

Why Not to Use Cepstral Detection

In our opinion, it is a bad idea to detect echo-hiding by computing a signal’s cepstrum. When computing the complex cepstrum of a signal using FFTs, the first FFT and logarithm transform the input data into a signal, approximated by s[k] = αe−j2πkτ /N , immersed in the additive “noise” of the cover data. Each bin of the second FFT represents this transformed input correlated with another signal of the form s[k] = αej2πkω/N for some ω. Thus the complex cepstrum can be seen as a bank of correlation detectors for various echo signatures. There are several reasons why this approach is suboptimal: – Cepstral analysis was originally proposed as a method for detecting echoes whose delay and gain are unknown to the detector. In echo hiding, these values are known in advance, and do not need to be computed for every possible delay value. – The echo signal is not a true complex exponential, but merely an approximation of one. Hence we are correlating with the wrong signal! There is no good reason to use just an approximation to a signal that is known to the detector. The reason an approximation is used in cepstral analysis is that one can employ an FFT to quickly detect a large number of separate echoes, which is largely unnecessary. – Cepstral analysis alone is problematic for complex echoes. A frequencyselective echo, for instance, will be smeared across multiple FFT bins. This can be remedied by performing some prescaling to compensate for filtering before the final FFT step. – This process makes an implicit Gaussian assumption, detecting a signal by correlation. The logarithms of FFT coefficients of music samples may not

Detectors for Echo Hiding Systems

251

fit a Gaussian distribution well, and a different detector structure may offer better performance. As we will see below, this assumption is not a great problem after all, especially given the computational simplicity of correlation. However, it is worthwhile to compare to other statistical models before choosing which detection method to use. 3.2

Detectors for Additive and Multiplicative Noise

We approach the detection problem of an echo’s signature in a straightforward manner, which results in both greater flexibility for complex echoes, and improved efficiency. As in cepstral analysis, we work in the frequency domain, but we do not need to use the logarithm function: rather, we treat the signal as immersed in multiplicative noise rather than additive noise, and simply derive the appropriate detector for this scenario. Further, we make an effort to model the statistical properties of the “noise,” in this case the frequency components of the audio signal in which the echo is embedded. Again, For an audio signal x(t) and echo y(t) = x(t) + αx(t − τ ), we have the multiplicative relationship between Fourier transforms X and Y : j: Command not found. Regarding the right half as a deterministic signal, we have Y (ω) = X(ω)(1 + S(ω)) By this characterization, S can be generalized to complex echoes (and beyond) very simply. A suitable detector for an arbitrary signal S can not only handle frequency-dependent echoes, but detect multiple echoes in a single pass rather than using a bank of echo detectors. One detector that immediately springs to mind is a correlation detector in the log-frequency domain. As with ceptral analysis, we have: log Y (ω) = log X(ω) + log(1 + S(ω)) If the echo parameters are known to the detector, then we know the signal log(1 + S(ω)), and simply attempt to detect it by correlation. Note that this is already an improvement over a cepstral detector in two ways: first, it searches for the actual echo signal, rather than using a sinusoidal approximation. Second, it is computationally simpler, and more flexible. However, if logarithms of audio FFT coefficients are better modeled by a non-Gaussian distribution, it may be suboptimal. As we will show, however, this fear is relatively unfounded for audio FFT coefficients. 3.3

Statistical Modelling of Transform Coefficients

We considered several statistical models for FFT coefficients of a frame of audio data. We consider modelling the coefficient magnitudes as having a Nakagami mdistribution, with a value of m estimated empirically. Also, we consider modelling

252

Scott Craver et al.

real and imaginary coefficients as generalized Gaussian, with a shape parameter γ estimated empirically. Consider the simple case of a real signal Y [k], which is either of the form X[k](1 + s[k]), or X[k], where s[k] is deterministic and X[k] is i.i.d. generalized Gaussian. Our goal is to develop an optimal detector to decide which of these hypotheses is the case. The distribution of x is fx (x; µ, σ, γ) = Aσ −1 exp{−[B|x − µ|/σ]γ }  A = Bγ/2Γ (1/γ), B = Γ (3/γ)/Γ (1/γ) The log-likelihood ratio for a single observation y[k] is then: L(y) = (B/σ)γ [|y[k] − µ|γ − |y[k]/(1 + s[k]) − µ|γ ] − log(1 + s[k]) ...where the log(1+s[k]) and (B/σ)γ terms can be absorbed into the threshold τ of the detector, and µ can be ignored for zero-mean data (an assumption we make for our non-DC FFT coefficients.) A block diagram of this detector is illustrated in figure 2. We use this to detect the magnitude of the echo signal |1 + S[k]| in both the real and imaginary parts of the FFT coefficients Y [k]. Doing so throws away phase information from the echo signature, but when |S| is small this is not a great sacrifice: in our experiments, the echo strength α was chosen to be 0.2. Another common distribution is the Nakagami m-distribution, which can be used to model FFT magnitudes. For a magnitude R, the Nakagami pdf is fR (r; Ω, m) =

2 m 2 ( )m r2m−1 e−mr /Ω Γ (m) Ω

Where Ω = E(R2 ), and the “fading figure” m is defined as Ω 2 /E[(R2 − Ω)2 ] [9]. When m = 1, the pdf is the same as the Rayleigh distribution, which de-

Fig. 2. Detector structure for deterministic signal embedded in i.i.d. generalized Gaussian noise X[k], using embedding formula Y [k] = X[k](1 + s[k]). In this detector, Y, X and (1 + s) are real quantities

Detectors for Echo Hiding Systems

253

Fig. 3. Detector structure for deterministic signal in multiplicative Nakagami noise scribes the magnitudes of complex numbers whose real and imaginary components are i.i.d. Gaussian. For the Nakagami assumption, the log-likelihood ratio becomes: L(y) = (m/Ω)[|y[k]|2 − |y[k]/(1 + s[k])|2 ] − 2m log(1 + s[k]) Figure 3 illustrates this detector for i.i.d. Nakagami noise, similar in structure to the generalized Gaussian detector. In the i.i.d. case, the distribution parameters m and Ω are conveniently absorbed into the detector threshold. Since only squaring is needed, the detector can be faster than the generalized Gaussian version. Note that this structure is essentially correlation in a transformed domain. For each magnitude |X[k]|, we compute |X[k]|2 (1 − 1/|1 + S[k]|2 ), correlating the signal |X[k]|2 with the deterministic signal (1 − 1/|1 + S[k]|2 ). Contrast this with the correlation detector described earlier, correlation detector, in which we correlate log signal magnitudes log |X[k]| with the modified signal log |1 + S[k]|. 3.4

Two Important Implementation Notes

Certain implementation details cause considerable variation in some of our experiments. Two in particular deserve mentioning, one of which can have a severe impact on perfomance, and one which can be safely ignored. For multiplicative detection, it is strongly advisable to compute and maintain separate statistics for different regions in the frequency range.1 For our generalized Gaussian and Nakagami detectors, the spectrum was divided into 16 separate regions, and separate values of E[X 2 ] (and thus σ 2 and Ω) were computed for each. When a single estimate was used, performance suffered severely. 1

We emphasize this for multiplicative detection, because we found it offered no real performance improvement for the correlation detector in the log-frequency domain.

254

Scott Craver et al.

On the other hand, a global estimate for γ or m did not greatly hamper performance. Note that any parameter which varies with k must not be “absorbed” into the detector threshold as described earlier. A second note on implementing these detector structures is that one can safely throw away the log(1+s[k]) term, as the sum of all such terms is effectively zero. In practice, it is a good
idea to design multiplicative signals s[k] so that they satisfy the constraint s[k] = 0 anyways; then, for sufficiently weak signals,
log(1 + s[k]) ≈ 0 to first order. Eliminating the log(1 + s) term greatly simplifies maximum-likelihood detection, in which the detector threshold is set to 0. In this case, any global constant factors in the log-likelihood ratio can be left out, as they have no effect on the sign of the detector output. This implies that we don’t need to compute the value of m for the Nakagami detector at all, or (B)γ for the GGD detector, if these parameters do not vary with k. Combining these two implementation details gives us the modified detectors:  y[k] y[k] |γ − | |γ ] [| σ σ(1 + s[k]) k  L(y)Nakagami = [|y[k]|2 − |y[k]/(1 + s[k])|2 ]/Ω[k] LGGD (y) =

k

4

Results

We implemented both the GGD and Nakagami detector structures, as well as an autocepstral detector and a simple correlation detector in the log-spectrum domain. These were given music clips, some of which contained an embedded echo of approximately 1ms (44 frames in 44.1KHz PCM audio,) with a gain of 0.2 relative to the original music. These values were chosen because they are weak enough to present a challenge, lying just outside the window of echo detection determined empirically in [6]. The hypothesized echo delay and gain were known to the detector structure, whilst shape-parameters (and Nakagami m-values) of the audio were determined empirically, by analyzing a window of audio, whose size was chosen by trial and error. Per-frame detection occurred over a frame size ranging from 128 to 4096 samples. For 1024 samples, the receiver operating characteristics are shown in figure 4. These are derived empirically from the same audio data with and without added echo signals, by measuring the miss and false alarm rate for various thresholds. Both the GGD and Nakagami detectors show superiority to the autocepstral detector, but a simple correlation detector seems to beat them all by a small margin. 4.1

Nominal Channel Capacity

To further illustrate the difference in performance between these detectors, we can compute a basic channel capacity based on each detector. Given empirically

Detectors for Echo Hiding Systems

255

Fig. 4. Empirically derived ROCs for four detectors

derived detection and false-alarm probabilities, we can consider a channel which transmits a single bit via the presence or absence of an echo (i.e., on-off keying.) Then we have a binary channel with input X and output Y , whose (Shannon) capacity [2] in bits per channel use is max I(Y ; X) = max H(Y ) − H(Y |X) = max H(Y ) − pE H(PD ) − (1 − pE )H(PF ) ...where pE is the a priori probability of an echo being sent. We can then maximize this expression over pE . Figure 5 shows this nominal channel capacity as a function of the false alarm rate for all four detectors. In practice, one would hope to improve the capacity by sending one of a constellation of signals, but this nominal capacity metric helps to illustrate the comparative capabilities of the various detectors. Again, straightforward correlation is slightly in the lead, with the GGD detector close behind. The effects of frame size are displayed in the lower half of figure 5. Intuitively, we would expect the detector to become less reliable as the frame size, and thus amount of input data, decreases; however, the number of symbol intervals per second increases linearly, resulting in a capacity tradeoff. Over a range of frame sizes, we notice that the Nakagami detector begins to outpace with the GGD detector as the frame size decreases, and compete with correlation.

5

Discussion and Conclusion

We were surprised at first with the result that simple correlation in the logfrequency domain outperformed a number detectors based on careful estimation of the data’s underlying distribution, which maintained frequency-dependent

256

Scott Craver et al.

Fig. 5. Nominal capacity of three echo-hiding detectors. Above, capacity as a function of the false alarm rate. Below left, achievable capacity as a function of frame size, in bits per channel use. Below right, the same in bits per second estimates of the cover data’s statistics. In contrast, the correlation detector did not maintain any variable estimates of the cover data statistics; we found that this extra information offered no real performance improvement. One explanation for this is that the logarithms of FFT magnitudes are much more well-behaved than the FFT magnitudes themselves, in that their variance is much smaller, and varies much less with frequency. Even with extra code to maintain separate statistics for different frequency ranges, competing detectors are probably hampered by large misestimates of variance. We have yet to consider other statistical models, and fully explore the various implementation issues under which detectors may experience performance gains or losses. In any case, a cepstral detector is best avoided in favor of a one designed for multiplicative frequency domain watermarks.

References [1] R. P. Bogert, M. J. Healy and J. W. Tukey, “The Quefrency Alanysis of Time Series for Echoes: Cepstrum, Pseudo-Autocovariance, Cross-Ceptsrum and SapheCracking,” Proceedings of the Symposium on Time Series Analysis, Brown University, jun 1962. pp. 209-243. 249 [2] T. M. Cover and J. A. Thomas, Elements of Information Theory. New York: John Wiley and Sons, Inc., 1991. 255

Detectors for Echo Hiding Systems

257

[3] S. Craver, M. Wu and B. Liu, “What Can We Reasonably Expect From Watermarks?”, Proceedings of IEEE Workshop on Applications of Signal Processing to Audio and Acoustics, 2001. [4] D. Gruhl, A. Lu and W. Bender, “Echo Hiding,” 1st workshop on Info. Hiding, 1996. 247, 248, 250 [5] R. Harris, ”Whatever Happened to SDMI?,” Associated Press, 29 Apr. 2002. 248 [6] F. A. P. Petitcolas, R. J. Anderson and M. Kuhn ”Attacks on Copyright Marking Systems,” 2nd workshop on Info. Hiding, 1998. 248, 254 [7] R. Petrovic, J. M. Winograd, K. Jemili and E. Metois, “Apparatus and method for encoding and decoding information in analog signals,” US Patent No 05940135, August 1999. 247, 249 [8] H. V. Poor, An Introduction to Signal Detection and Estimation, 2nd ed. BerlinHeidelberg: Springer-Verlag, 1998. 250 [9] J. G. Proakis, Digital Communications, 3rd ed. Boston, MA: McGraw-Hill, 1995. 252 Secure Digital Music Initiative, “SDMI Portable Device Specification Part 1, Version 1.0”, July, 1999. [10] Secure Digital Music Initiative, “Call for Proposals for Phase II Screening Technology, Version 1.0,” February 2000. 248 [11] J. Stern and J. Boeuf, “An Analysis of One of the SDMI Candidates,” 4th workship Workshop on Info. Hiding, 2001. 248 [12] M. Wu, B. Liu, S. Craver, D. Dean, A. Stubblefield, D. Wallach, B. Swartzlander, and E. Felten, “Reading Between the Lines: Lessons Learned from the SDMI Challenge,” Proceedings of the 10th USENIX security symposium, Washington DC, August 2001. 248

A Steganographic Embedding Undetectable by JPEG Compatibility Steganalysis
Richard E. Newman1 , Ira S. Moskowitz2 , LiWu Chang2 , and Murali M. Brahmadesam1 1

CISE Department, University of Florida Gainesville, FL 32611-6120, USA [email protected] 2 Center for High Assurance Computer Systems Code 5540, Naval Research Laboratory, Washington, DC 20375, USA [email protected]

Abstract. Steganography and steganalysis of digital images is a catand-mouse game. In recent work, Fridrich, Goljan and Du introduced a method that is surprisingly accurate at determining if bitmap images that originated as JPEG files have been altered (and even specifying where and how they were altered), even if only a single bit has been changed. However, steganographic embeddings that encode embedded data in the JPEG coefficients are not detectable by their JPEG compatibility steganalysis. This paper describes a steganographic method that encodes the embedded data in the spatial domain, yet cannot be detected by their steganalysis mechanism. Furthermore, we claim that our method can also be used as a steganographic method on files stored in JPEG format. The method described herein uses a novel, topological approach to embedding. The paper also outlines some extensions to the proposed embedding method.

1

Introduction

Steganography and steganalysis of digital images is a cat-and-mouse game. Ever since Kurak and McHugh’s seminal paper on LSB embeddings in images [10], various researchers have published work on either increasing the payload, improving the resistance to detection, or improving the robustness of steganographic methods [1, 15, 21, 22]; or conversely, showing better ways to detect or attack steganography [5, 7, 23]. Fridrich, Goljan and Du recently raised the bar for embeddings in the spatial domain with the introduction of their “JPEG compatibility” steganalysis method, which is very precise at detecting even small changes to bitmap images that originated as JPEGs [6]. This paper presents a steganographic embedding that encodes the embedded data in the spatial domain (bitmap) by manipulating the image in the frequency domain (the JPEG coefficients) (and in fact, the stego image may be stored either as a bitmap or as


Research supported by the Office of Naval Research.

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 258–277, 2003. c Springer-Verlag Berlin Heidelberg 2003


A Steganographic Embedding

259

a JPEG). Due to this, the embedding cannot be detected by JPEG compatibility steganalysis. However, in order to elude other means of detection (either by human inspection or statistical tests), we found it necessary to introduce notions of topology. This, we believe, has larger implications. Often, one is called upon to perform steganalysis on the uncompressed, spatial realization (from, e.g., a TIFF, BMP, or PNG file) of an image (i.e., its bitmap). Eggers, B¨ auml and Girod [4] assert that “...uncompressed image data looks to Eve as suspicious as encrypted data. Thus, the steganographic image r has to be always in a compressed format.” However, many small images are stored in bitmap format without compression, and larger images may be stored with lossless compression. Also, steganography can be used to store data on a local disk without placing it on a website or sending it through email, in which case there are many instances in which uncompressed formats may be found. A user may choose to store passwords or other secret information in her local image files in a way that she can recover them but another might not even know that they were there at all. In many cases, na¨ıve users will transfer data in arbitrary formats. Even sophisticated users may find that their recipients do not have software compatible with the format of choice, and so either send an alternative format or provide a choice of formats (much as websites often provide both postscript and PDF versions along with a compressed version of a document). Further, Eggers et al. earlier posit that Eve should consider any natural image data as suspicious, given its ability to hide a considerable amount of embedded data. However, they concede that this at the very least makes the field less interesting, and we contend that transmission of all sorts of images in every conceivable format over the Internet is likely to continue, with the mix mostly consisting of innocent images. Therefore, it is still incumbent upon the steganalyst to detect which images are innocent and which are suspicious on the basis of something other than their format alone; that is, we discount “cover format profiling.” A common steganographic method for modifying such images is replacing the least significant bits (LSBs) with the embedded information [8, 10, 12]. Since the image is stored in a lossless format, there is much redundancy of which steganographic methods can take advantage. Although steganographic methods that replace lower bit planes in the spatial domain are easily detectable by statistical tests, steganographic methods that affect the lower bit values of only a small percentage of the pixels (e.g., [17]) are extremely difficult to detect (e.g., [16]) by statistical means. However, if the image was at one time stored as a JPEG, the artifacts of the quantization of the DCT coefficients remain in the spatially realized bitmap. Leveraging this fact, JPEG compatibility steganalysis may detect even such minuscule tampering of the bitmap derived from a JPEG. With this in mind we feel that it is important to come up with a way of “tricking” such steganalysis tools, and thus allow a modest amount of information (payload, e.g. [15]) to be embedded in the spatial realization of a JPEG, without detection. This paper presents one such method.

260

Richard E. Newman et al.

Fridrich, Goljan and Du never stated or implied that their method could not be evaded. The beauty of their steganalysis method is that it shockingly showed how small deviations in the bitmap of a JPEG could be detected. We show in the body of this paper that our method will not be detected by the JPEG compatibility method of Fridrich et al. We also believe that for small payloads our method with simple extensions will not be detectable by any other existing steganalytical tools. A priori our steganography is performed in the spatial domain, that is, the data are embedded by encoding in the spatial domain, but since the changes actually come from adjusting quantized DCT coefficients our method a fortiori can actually use JPEG files (i.e., an image saved in the JFIF format as a .jpg) as the cover/stego file. Our method is a hybrid in that it encodes the embedded data in the spatial domain via JPEG coefficient manipulation; this is why it is resistant to detection using either spatial or frequency steganalysis techniques. Marvel et al. [14] propose a simple means of storing one bit per block in the quantized JPEG coefficients. Although this bears some surface resemblance to the work given here, the embedded data are stored in the JPEG coefficients themselves, and it is required that the receiver have them in order to extract the embedded data. In the method presented here, the data are encoded in the spatial domain, albeit through manipulation of the frequency domain, and the receiver must have the spatial domain realization of the image in order to extract the embedded data. In our baseline system, the receiver must also generate the topologically nearby spatial blocks in order to determine whether the block in question actually encodes data or is unusable. In follow-on work, this requirement is eliminated. Another contribution of this paper, and perhaps an even more important one, is that we introduce a topological approach to steganography. We attempt to formalize what it means for one image (or part of an image) to be near another image (or part of an image). The obvious upshot of this is that the stego image will be indistinguishable from the cover image (by either human or machine). Section 4 presents a baseline, proof-of-concept version of our method of hiding in the bitmap (spatial) realization of a JPEG file that is not detectable by the method of Fridrich et al. [6]. Our method makes use of the topological concept of “closeness,” which is formalized along with a generalized form of our method in section 5. Extensions are discussed in section 7, with results in section 6 and concluding remarks in section 8. Section 3 presents and analyzes the method of Fridrich et al. and see that it can be “tricked,” provided you retain qualities that a legitimate JPEG should have in the spatial domain. In order to appreciate the method of JPEG compatibility steganalysis of Fridrich et al., and to understand our way around it, it is necessary to have a basic understanding of how JPEG works. Section 2 presents a brief discussion of JPEG for completeness.

A Steganographic Embedding

2

261

JPEG Basics

JPEG [19] first partitions a bitmapped image (such as one might obtain from a CCD camera or a scanner) into 8 by 8 blocks of pixels, starting with the top, leftmost pixel. Generally, the pixel values are constrained to one or a few planes of one or a few bits (e.g., 8- or 10-bit grayscale, or 24-bit color). Each of these 64-pixel blocks (A in Figure 1) in the spatial domain is then transformed using the Discrete Cosine Transform (DCT) [24] into the frequency domain, which produces 64 raw DCT coefficients per plane (B). The resulting coefficients are real numbers (albeit over a limited range), and so require considerably more storage. Each coefficient is then divided by the quantum step for that coefficient (defined by a quantizing table QT = QT [1], ..., QT [64]) and rounded to the nearest integer to produce quantized coefficients (C) (JPEG coefficients). This step (including rounding) is generally called quantization. Lossless entropy coding further reduces the space needed to store the quantized coefficients considerably, and is the bulk of what is stored in .jpg files (X). The “quality level” of JPEG compression determines the magnitude of the quantum steps in the quantizing table, which in turn determines the visual quality of the compressed image after decoding. To decode a JPEG file, the inverse DCT (IDCT) is applied to the decompressed, dequantized coefficients (i.e., the JPEG coefficients, C, are multiplied by their respective quanta to produce the integer multiples of the quanta nearest to the original coefficients, D) to obtain a raw bitmapped output file (E) in the spatial domain, whose pixel values are real numbers. These values are then clamped (if they are less than the minimum value or greater than the maximum value for the format used) and rounded to the nearest integer value in the range [0..2n − 1] to produce the final output block (F ). Although the Discrete Cosine Transform is mathematically invertible (i.e., for a block A, IDCT (DCT (A) = A)), quantizing and dequantizing by any value other than unity generally distorts the DCT coefficients so greatly that, referring to Figure 1, A may not be the same as F . Likewise, clamping and rounding render the the process of decoding and then re-encoding imprecise, even when the same quantizing table is used. That is, referring to Figure 1, C and C  (and hence, D and D ) may not be identical, even if F  = F . It is important to note that at any non-trivial quantization level, there are many bitmap blocks that cannot be the output of JPEG decoding at all. We will call the spatial domain blocks that are the result of decoding a set of JPEG coefficients for a given quantization table JPEG compatible blocks, or JPEG blocks for short, and those that are not, JPEG incompatible, or non-JPEG blocks.1 1

Note that blocks that are JPEG incompatible for one quantizing table may be JPEG compatible for a different quantizing table, and vice-versa.

262

Richard E. Newman et al. Spatial Domain

Frequency Domain

A

B

C

Discrete Cosine Transform (DCT)

quantization Corresponding Quantized dequantization DCT coefficients 64 DCT coefficients (JPEG coef.) entropy coding

8x8 block in spatial domain (original image)

F

E

8x8 JPEG decoded block

D

X

Inverse DCT (IDCT)

clamping & rounding

Dequantized JPEG coefficents

8x8 raw block in spatial domain

Compressed JPEG coefficients

B’

F’ Discrete Cosine Transform (DCT) Possibly modified block

C’ quantization Quantized coefficients

Corresponding 64 DCT coefficients

dequantization

F’’

E’ clamping & rounding

8x8 JPEG decoded block

D’ Inverse DCT (IDCT)

8x8 raw block in spatial domain

Dequantized JPEG coefficents

Fig. 1. JPEG Operation

3

JPEG Compatibility Steganalysis

Fridrich, Goljan and Du [6] introduced an ingenious steganalysis technique that determines whether a bitmap representation of an image derived from a JPEG file has been altered. If a bitmap image were derived from an image once stored in JPEG format, their method can determine this in most cases, even if the low order bits of the image have been manipulated after conversion to bitmap format. Their method takes advantage of the last fact mentioned in the previous section: not all spatial domain blocks can be the output of decoded JPEG coefficient sets, i.e., not all spatial blocks are JPEG blocks. Their steganalytical method first determines that the bitmap was at one time stored in JPEG format, then recovers the 8 × 8 JPEG block alignments and the best candidate for the quantization table. It then detects those blocks that could not have been

A Steganographic Embedding Spatial Domain

Frequency Domain

quantization Quantized coefficients

E1 8x8 raw block in spatial domain

Fk

...

Dequantized JPEG coefficients

...

...

8x8 JPEG decoded block

D1 IDCT

clamping & rounding

Dk

Ek IDCT

clamping & rounding 8x8 raw block in spatial domain

Dequantized JPEG coefficients

...

Corresponding 64 DCT coefficients

neighbors of D1 in dequantized coefficient space

neighbors of F0 in spatial domain

Original block

8x8 JPEG decoded block

C1

B’ DCT

Ck

neighbors of C1 in quantized coefficient space

F0

F1

263

Quantized coefficients

Fig. 2. JPEG-Compatible Neighbors of a Spatial Block

produced by the JPEG decoding process. Since changing a single bit in a spatial block can cause a JPEG block to become JPEG incompatible, this approach is extremely sensitive to manipulation of images in the spatial domain; it can readily detect even low payload size [15] steganographical embeddings that do not take the JPEG characteristics into account, provided they manipulate bitmaps that were once stored in JPEG form. As they note, their method has some limitations, the most notable being the cases of blocks in which clamping has occurred (i.e., the JPEG decoding intermediate block E held values less than −0.5 or greater than 255.5, for which the rounding error is greater than 0.5), and when the JPEG quality is very high (i.e., when the quantization table has very small values). In the former case, the basic test they use for energy bounds does not apply, while in the latter, the number of possible sets of DCT coefficients they must test is prohibitively large (although theoretically possible). In addition to these cases, there are some other cases in which an image has been manipulated, but the manipulation will not be detected by their method even though artifacts may be apparent to a human observer.2 Nonetheless, any bitmapped file that was once stored in JPEG format that fails their test can only do so if it has been manipulated, and their test is 2

An example is given at the beginning of the next section.

264

Richard E. Newman et al.

sensitive enough to detect even a single bit change in a bitmap file. Hence their test produces no false positives, but can produce some false negatives. Any steganographic embedding that embeds data directly in the JPEG coefficients will not be detected by JPEG compatibility steganalysis, as the decoded spatial image will consist entirely of JPEG blocks. However, these embedding methods use .jpg files as the stego image storage format, so that the JPEG coefficients are maintained without error after the embedding is performed. If a bitmap image is produced for the stego image, then it must be re-encoded in JPEG form in order to recover the JPEG coefficients, which is a process likely to introduce errors in the steganographic data extraction process. In the next section, we present a steganographic spatial embedding method that is JPEG compatible. In fact, the stego image may be stored in either bitmap format or as a JPEG.

4

A Baseline Spatial Domain Stego Embedding that Defies JPEG Compatibility Steganalysis

This section presents our baseline version of a novel, topological approach that may change many bits in the spatial file, but will never be detected by JPEG compatibility steganalysis; it will always produce a false negative. Extensions will be explored in section 7. The basic idea is to manipulate the image in such a way that all of the 8 × 8 blocks are valid outputs of the JPEG decoder, and all the spatial blocks are “near” the original spatial blocks as well. Of course, a file that is the result of intermingling 8 × 8 blocks from two different decoded JPEG files that both used the same quantization table would satisfy the first condition, but that is likely to be easily detected by the human visual system (HVS). The key is to be able to escape detection by either the HVS or machine, which means making the result compatible both with JPEG and with the HVS. This section will introduce the topological concept of neighbor, and will define “rich” and “poor” blocks according to the ability of the system to use them to embed data. In the context of this discussion, neighbors of a block will not be the surrounding blocks in the image file (compressed or not), but will be other blocks that are not much different in their content from the block of interest (that is, they are intended to be undetectably different to the steganalyst). Those blocks that are in effect indistinguishable from the block of interest will be called its neighbors, and a block will be called rich if it and its neighbors can encode any datum desired; otherwise it will be called poor. Our baseline system stores only one bit of embedded data per JPEG block, in 8-bit, grayscale images. It uses the LSB of the upper left pixel in the spatial block to store the embedded data. A small, fixed size length field is used to delimit the embedded data. As a first cut, if the bit is the desired value, then we could leave the block alone. If the desired bit is the opposite of the original value, then the system changes the JPEG block in such a way that the upper left LSB is the desired value, but the modified spatial block is still JPEG compatible. However, as we will see, there is more to it than this.

A Steganographic Embedding

265

Encoding is done by going back to the quantized coefficients for that JPEG block and changing them slightly in a systematic way to search for a minimally perturbed JPEG compatible block that embeds the desired bit (one of the Fj ’s in Figure 2), hence the topological concept of “nearby.” This is depicted in Figure 2, where B  is the raw DCT coefficient set for some block F0 of a cover image, and D1 is the set of dequantized coefficients nearest to B  .3 Note that B  is a point in (continuous) raw DCT coefficient space, while each Di is a point in the subspace consisting of dequantized JPEG coefficients (for the quantization table in use). In other words, the neighbors Fi , i = 1, 2, ..., k of the spatial block F0 must be blocks that are the decoded JPEG output of points near D1 in the dequantized coefficient block space. Thus, our maps are “continuous” (in the topological sense). The topological concept of nearness has to be defined in terms of both human detection and machine detection, and this is the subject of continuing research. The preliminary version presented here changes only one JPEG coefficient at a time by only one quantization step. In other words, it uses the L1 metric on the points in the 64-dimensional quantized coefficient space corresponding to the spatial blocks, and a maximum distance of unity. (Note that this is different from inverting the LSB of the JPEG coefficients, which only gives one neighbor per coefficient.) For most blocks, a change of one quantum for only one coefficient produces acceptable distortion for the HVS. This results in between 65 and 129 JPEG compatible neighbors4 for each block in the original image. If there is no neighboring set of JPEG coefficients whose spatial domain image carries the desired datum, then the system could deal with this in a number of ways. One is to treat this as an error in the stego channel and provide error correction to handle it. Another is to provide some kind of signal that this block is not to be used (that is, in the embedded data stream, insert a control sequence in the bits preceding the unusable block(s) to indicate that it is (they are) not to be used, then move the data that would have been encoded there to usable blocks occurring after the unusable block or blocks). Yet another is to provide a map of the locations of the unused blocks within the embedded data. A similar approach is used in BPCS steganography [8] to identify blocks for which the embedded data were transformed so they would be correctly identified as embedded data by the receiver. These approaches use up scarce payload space of the steganographic encoding. A fourth approach trades off computation at both sender and especially the receiver for improved payload space. The sender 3

4

For quantized DCT coefficients or for DCT coefficient sets, dequantized or raw, we will use the L1 metric to define distances. D1 is the set of coefficients of B
rounded to the nearest multiple of the corresponding quantum in QT . The notion of neighbor will be made precise in subsection 5.1. Each of the 64 JPEG coefficients may be changed by +1 or -1, except those that are already extremal. Extremal coefficients will only produce one neighbor, so including the original block itself, the total number of neighbors is at most 129, and is reduced from 129 by the number of extremal coefficients. If the QT has very small values, it is possible that some of the neighbors coincide, reducing this number further, but for typical quantum values, this is unlikely.

266

Richard E. Newman et al.

avoids unusable blocks in such a way that the receiver can tell which blocks the sender could not use without the sender explicitly marking them. This is the method our baseline system employs. There are two criteria that must be met for this approach to work. First, the receiver must be able to test each block that it receives to determine whether it has been used to encode data or not. Second, if the receiver classifies a block as having been used to encode data, it must encode the correct datum. If the set of neighbors that the sender explores to find a suitable block does not have some block that could send any possible desired datum, then that block might be considered to be inutile. Thus the sender and the receiver could agree that a block can be used to encode data if and only if, for any possible datum, its set of neighbors includes at least one block that can send that datum. We will call these blocks ‘rich,’ and those that do not satisfy this criterion ‘poor.’ However, for the receiver this decision is based on the block received, to wit, the block with which the sender replaced the original block. This in turn means that the sender can not just find any neighboring block that encodes the desired datum (or leave a block alone if it already conveys the desired datum), but must also test a candidate replacement block to see if the receiver would consider it to have been used (i.e., would find it to be rich). That is, the neighborhoods are not a partition, and rich blocks are not guaranteed to have only rich neighbors. Otherwise, if the sender chooses the original or a neighboring block to encode a datum, but that chosen block is not rich (i.e., there is some datum that its set of neighbors can not encode), then the receiver will mistakenly assume that the replacement block was not used and will skip it. As long as there is at least one rich block that conveys the desired datum among the neighbors of the original block, then that block can be used to replace the original (even if it conveys the same data, so that an original but poor block that conveys the correct data can be replaced by one of its rich neighbors that conveys the same data, if one exists). Otherwise, the block cannot be used by the sender. However, if the original block is rich, and hence appears to be usable, then it must not be left untouched or else the receiver will classify it as used and include the datum it encodes in the received stream in error. Instead, the original block must be replaced by one of its poor neighbors that will be classified as unused by the receiver, regardless of what datum it may encode. These notions are formalized in the next section.

5

Generalization and Formalization of Our Stego Embedding Technique

This section describes formally how our method hides an arbitrary embedded data string in the spatial realization of a JPEG image. The embedded data must be self-delimiting in order for the receiver to know where it ends, so at least this amount of preprocessing must be done prior to the embedding described. In addition, the embedded data may first be encrypted, and it may have a frame check sequence (FCS) added if unusable blocks are rare to save the receiver from

A Steganographic Embedding

267

costly tests, allowing it to assume that all the blocks were used unless the FCS fails. Let the embedded data string (after encryption, end delimitation, frame check sequence if desired, etc.) be s = s1 , s2 , ..., sK . The data are all from a finite domain Σ = {σ1 , σ2 , ..., σN }, and si ∈ Σ for i = 1, 2, ..., K. Let τ : Σ ∗ → {0, 1} be a termination detector for the embedded string, so that τ (s1 , s2 , ..., sj ) = 0 for all j = 1, 2, ..., K − 1, and τ (s1 , s2 , ..., sK ) = 1. Let S = [0..2m − 1]64 be the set of 8 × 8 spatial domain blocks with m bits per pixel (whether they are JPEG compatible or not), and let SQT ⊆ S be the JPEG compatible spatial blocks for a given quantization table QT . Let Φ extract the embedded data from a spatial block F , Φ:S → Σ We polymorphically extend this to sets of blocks Γ ⊆ 2S by def

Φ(Γ ) = {Φ(γ) | γ ∈ Γ }. Let µ be a pseudo-metric5 on SQT , µ : SQT × SQT → R+ ∪ {0}. Let NΘ (F ) be the set of JPEG compatible neighbors of JPEG compatible block F according to the pseudo-metric µ and threshold Θ based on some acceptable distortion level (µ and Θ are known to both sender and receiver), NΘ (F ) = {F  ∈ SQT | µ(F, F  ) < Θ}, def

where QT is the quantizing table for the image of which F is one block. The NΘ (F ) may be thought of as a basis for the “topology,” however our technique only uses a fixed Θ which is chosen small enough so that the HVS cannot detect our stego embedding technique. Neighborhoods can likewise be defined for JPEG coefficients and for dequantized coefficients for a particular quantizing table (by pushing the pseudo-metric forward). If F  ∈ NΘ (F ), we say that F  is a neighbor of F (the Θ is understood and not explicitly mentioned for notational convenience). Being a neighbor is both reflexive and symmetric. Now we can make our definitions from the previous section precise. 5.1

Definitions

Definition 1. A block F is called rich if and only if Φ(NΘ (F )) = Σ, 5

That is F = F
⇒ µ(F, F
) = 0 but not necessarily the converse. See Chap. 9, Sec. 10 of [3]. This is needed because nonlinearities introduced by rounding in both the quantization step and in decoding can possibly cause two distinct, JPEG compatible, spatial blocks to have distance 0. For most JPEG quantizing tables, however, µ is in fact a true metric.

268

Richard E. Newman et al.

that is, for every datum σ ∈ Σ, F has at least one neighbor, F  , that encodes σ, and we write F ∈ R (the set of rich blocks). Otherwise, F is poor. Definition 2. Block F is usable if and only if for every datum σ ∈ Σ, F has at least one neighbor that both encodes σ and is rich: Φ(NΘ (F ) ∩ R) = Σ . If F is not usable, then it is unusable. (In Section 7, we relax this definition somewhat.) Of course any usable block is rich, but the converse need not hold. Claim 0: If block F is unusable then either F is poor, or one its neighbors is poor. Proof of Claim 0: F is either rich or poor. If F is poor we are done. Assume then that F is rich, therefore one can always find a neighbor of F that encodes σ for any σ ∈ Σ. If every such neighbor were rich, then F would be usable, which it is not. Therefore, when F is rich, there exists some neighbor of F that is poor. 5.2

Algorithm in Brief

The key to our method is that the receiver only considers rich blocks for decoding. The receiver ignores poor blocks — it simply skips over them. If the transmitter has a poor block it is sent and the receiver ignores it. Thus, no information is passed if a poor block is transmitted. – transmitter has usable block (F is usable): • If F encodes the information that the transmitter wishes to send, the transmitter leaves F alone and F is sent. The receiver gets (rich) F , decodes it and gets the correct information. • If F does not encode the correct information, the transmitter replaces it with a rich neighbor F  that does encode the correct information. The replacement ability follows from the definition of usable. Since F  is a neighbor of F the deviation is small and the HVS does not detect the switch. – transmitter has unusable block (F is unusable): • If F is poor, the transmitter leaves F alone, F is sent, and the receiver ignores F . No information is transferred. • If F is rich, the transmitter changes it to a neighbor F  that is poor. The ability to do this follows from Claim 0. Block F  is substituted for block F , the receiver ignores F  since it is poor, and no information is passed. Since F  is a neighbor of F the deviation is small and the HVS does not detect the switch. Note that when dealing with an unusable block that the algorithm may waste payload. For example, if F is unusable and poor, F may still have a rich neighbor that encodes the desired information. See section 7 for further discussion. The

A Steganographic Embedding

269

advantage of the algorithm as given above is that it is non-adaptive. By this we mean that the payload size is independent of the data that we wish to send. If we modify the algorithm as suggested, the payload can vary depending on the data that we are sending. 5.3

Algorithm in Detail

To hide the embedded data, the sender first must find a JPEG image cover file I with at least K usable blocks. (Since the sender has great flexibility here, it should not be difficult to find such an image if the total number of blocks M is sufficiently larger than K, Σ is not too large, and Θ is not too small.) Let the spatial domain JPEG blocks of the cover file be I1 , I2 , ...IM , and let π be a permutation of the block indices known to the sender and receiver so that the blocks of I are considered in the permuted order, Iπ(1) , Iπ(2) , ...Iπ(M) . (Note that the order in which blocks of I are tested for use must be known to both sender and receiver, so that the receiver extracts only the blocks that were used and extracts them in order. This permutation can be part of the key material or derived from it. Our baseline system scans blocks in left-to-right, top-to-bottom order.) Let the usable blocks of the permuted order of I be V = V1 , V2 , ..., VM1 , and let the unusable blocks of the permuted order of I that are interspersed with V be U = U1 , U2 , ..., UM2 . Thus M = M1 + M2 , M1 ≥ K, and either Iπ(1) = V1 or Iπ(1) = U1 . For the ith datum, si , i = 1, 2, ..., K, the sender will pick some rich block  Vi ∈ NΘ (Vi ) such that Φ(Vi ) = si . The sender will then replace each usable block Vi with block Vi in forming the stego image I  (note that if Φ(Vi ) = si and Vi ∈ R, then Vi = Vi , i.e., the block need not be replaced since the receiver will correctly decode it already). For each unusable block Ui of I that is interspersed with the blocks used to embed the embedded data, the sender will either leave Ui alone in forming I  if Ui is poor, or will replace Ui with a poor neighbor Ui otherwise. Claim 0 tells us we can do this. The receiver then tests the blocks of the stego image I  in the predefined order π(1), π(2), ..., discarding the poor blocks U1 , U2 , ... and extracting the rich blocks of I  (note that they do not have to be usable), V1 , V2 , ..., VK to extract the embedded data, si = Φ(Vi ). This continues until the last datum, sK , is extracted, and s is found to be complete by the self-delimiting mechanism, τ (s ) = 1. The remainder of I  is ignored. 5.4

Claims

Claim 1: JPEG compatibility steganalysis will not detect this stego embedding method. Proof of Claim 1: Since every block in I  is a valid JPEG block (of course with the same quantization table), the JPEG based steganalysis can not detect that it has been altered.

270

Richard E. Newman et al.

Note that if the pseudo-metric µ/threshold Θ are not defined/chosen properly, there may be other means (even human inspection of the image) that could detect artifacts indicating that I  is a stego image. Claim 2: Any usable block F has a neighbor that can encode any datum σ ∗ in such a way that the receiver will accept it. Proof of Claim 2: F is usable ⇐⇒ ∀ σ ∈ Σ, ∃F  ∈ NΘ (F ) ∩ R, σ = Φ(F  ) by definition. In particular, ∃ F ∗ ∈ NΘ (F ) ∩ R such that σ ∗ = Φ(F ∗ ). Since F ∗ ∈ R, the receiver will classify the corresponding block Ii of I as rich, and will extract the datum σ ∗ from it. Claim 3: Any unusable block F will be modified (if necessary) in forming the stego image I  so that the receiver rejects it. Proof of Claim 3: By Claim 0, either F or one of its neighbors is poor. If F is poor, leave it alone and the receiver rejects it for decoding. If F is rich we replace it with one of its poor neighbors, which the receiver then rejects. Claim 4: Using the stego embedding described above, a cover file I with at least K usable blocks can embed any self-delimited data string s = s1 , s2 , ..., sK correctly. Proof of Claim 4: While space limitations preclude us from presenting the full proof here, it is easily shown by induction on the length of the embedded string and is in the appendix.

6

Results

We have implemented the baseline version of our method. As discussed in section 4, this initial version is very rudimentary and is essentially a proof of concept. It does, however, yield very good results that are resistant to detection. Since the changes to the JPEG coefficients are minimal (at most one quantum of one coefficient), and the quanta have been chosen to more or less equalize the effect on the HVS, the stego image is indistinguishable from the cover by humans. Changes to the statistics of the JPEG coefficients are minimal by design. An initial version had a bias toward incrementing the coefficients, which caused the number of JPEG coefficients with a value of 1 to outnumber significantly those with a value of -1. Since this asymmetry could have been detected easily, we removed this bias in our baseline system. In both versions, the JPEG coefficient frequencies decreased away from zero, and were generally concave upward, and so would pass the test of Westfeld et al. [25]. Further, although there are typically a large number of zero coefficients that are changed (since these predominate), the relative number is small (usually around half of a percent). Thus, we expect that statistical tests (such as correlation toward one) will fail to discern an abnormality. An example of the baseline embedding for a particular block is given in Figure 3. (We see little point in taking up space showing two spatial images that look the same when printed at poor resolution.) A specific JPEG coefficient block results in the spatial block (cover image) on the left of Figure 3. We desire that the LSB of the upper left pixel be 0 (which it is not). Therefore we adjust the JPEG coefficient block by one quantum (we change the

A Steganographic Embedding Original Spatial Block ********************** 137 137 137 135 132 127 136 136 135 134 131 128 134 134 133 133 131 128 132 132 131 131 130 129 131 131 130 129 128 128 132 131 129 128 127 127 133 132 129 127 126 126 134 132 129 127 125 125

123 124 126 127 128 127 126 125

121 122 125 127 128 128 127 126

271

Spatial Block after Embedding ***************************** 136 137 137 136 133 128 123 119 135 135 136 135 133 128 124 121 132 133 134 134 132 129 126 123 131 131 132 132 131 129 127 126 130 130 130 130 130 129 127 127 131 130 130 129 128 127 127 127 132 131 130 128 127 126 126 126 133 132 130 128 126 125 125 125

Fig. 3. Cover image spatial block and stego image spatial block

sixth JPEG coefficient AC0,2 from 0 to -1), which results in the spatial block (stego image) on the right (in which the LSB of the upper left pixel is 0). Our baseline version runs somewhat slowly due to the number of tests6 that are made and the computational burden of each test. With typical JPEG files, however, and encoding only one bit per usable block, the number of tests it has to make is small since it only has to find neighboring blocks that encode both values, and with typical quanta, these are quickly found. The payload is small — only one bit per usable 8 × 8 block, but the likelihood of detection is very low. Although this already small number may be decreased by the number of poor blocks found in the cover image, with typical JPEG files we find very few poor blocks, so this is not an issue.

7

Extensions

Although the current definition of usable does not depend on the datum that the block is intended to encode (and thus is independent of the embedded data s), there may be greater payload space available if the definition is loosened to be specific to a particular datum σ (refer to the discussion at the end of subsection 5.2). Definition 3. A block F is usable for datum σ if and only if F has at least one neighbor that both encodes σ and is rich: {σ} ∩ Φ(NΘ (F ) ∩ R) = ∅. This allows a block that is not usable itself to be usable for σ if it has a rich neighbor, possibly itself, that encodes the desired datum. However, it should be noted that this makes the embedding adaptive to both the image and the embedded data, so that the payload size becomes dependent on the embedded data (as well as the cover image—same as before). The degree to which this increases the payload space by decreasing the probability of encountering an unusable block is worthy of exploration. 6

It also does much computation to gather statistics that would not be needed simply to perform embedding or extraction.

272

Richard E. Newman et al.

If unusable blocks are rarely encountered, then it may be desirable to have an error detection code appended to the whole message so that the receiver can determine if there were any unusable blocks or not, and search for them only if there were. This is relatively inexpensive in terms of space (a short CRC will do), and only if the test fails must the receiver perform the more expensive blockby-block test for usability. The additional work required of the receiver to check the CRC is minimal, and all of the decoding work it performs would have to be done anyway, so this extension is likely to provide a significant gain in decoding speed at very little cost. Our baseline system only works on grayscale images; it is easily extended to color (multichannel) images. While currently the stego image is stored, sent, or posted in bitmap format (e.g., TIFF, BMP), we have enhanced the system with an option to store the stego image in JPEG format as is done in spread spectrum steganographic techniques [13, 20] and other JPEG-based systems such as Jsteg or F5 [25]. This is because our modifications are performed on the quantized coefficient blocks, and then we choose from among the corresponding spatial blocks. It does not suffice simply to reencode the bitmap stego image, as the reencoding may not produce decoded output identical to the stego image. Instead, it is necessary to remember the JPEG coefficients for the replacement blocks, and store these in the format required. Provos has described methods for detecting information hidden in the JPEG coefficients [21, 22]. In these works, the statistical characteristics of the JPEG coefficients are analyzed to determine if there has been tampering. Based on the results reported, it is unlikely that the small changes our baseline method makes to the JPEG coefficients will be detected (at most one JPEG coefficient per block is changed). Even so, the flexibility afforded by often having more than one choice for the coefficient set with which to encode a datum should allow selection based on minimum disturbance of the coefficient statistics. This will require further investigation. Currently, the search order and the data extraction function Φ are fixed. Use of a key may provide a means to make this system satisfy Kerckhoffs’ principle [2], so that even with knowledge that the system is being used on a subset of images, without the key, detection of which of the images are stego images and which are not is practically impossible. One set of issues as yet to be resolved includes the best way to use the key to define the search order π of blocks in I (and I  ) and the best way to use the key to define Φ (which may be parametrized to be Φi ). The key may also contain information used to set µ, Θ and Σ. However, the main question that remains is how better to construct the pseudo-metric µ and how to pick the threshold Θ that are used to define the neighborhood NΘ . Our baseline system uses only those JPEG blocks that are the result of decoding the vectors of quantized DCT coefficients that differ from the quantized DCT coefficient set of the original block Ij in only one place i, and there by only unity. That is, we use the L1 metric in the JPEG coefficient space with Θ = 1 + %. This usually provides 129 neighbors for each block (including the block itself), but depending on the number of extremal coefficients, the

A Steganographic Embedding

273

total may range between between 65 and 129 candidates to replace the block. In most cases, this should be sufficient to encode more than one bit per usable block reliably. We expect that for most blocks and coefficients, we will be able to change single coefficients by more than one quantum, and will be able to change more than one coefficient simultaneously without introducing humanly detectable artifacts, resulting in a combinatorial number of acceptable neighbors of each original block. A larger neighborhood will allow the approach to encode a larger amount of data per block than a single bit. While a larger Σ allows more bits to be stored per usable block, at the same time it reduces the probability that a block is usable for a fixed Θ. Generally, it is of interest to determine what is the best balance between the size of the data set Σ, the pseudo-metric µ, and the threshold Θ, so that the payload space can be maximized without detection. The pseudo-metric and threshold must be set at least so that the artifacts produced by the replacement of the blocks in the stego image are not obvious to the trained human eye. The baseline pseudo-metric makes no distinction among the DCT coefficients. However, there are two good reasons it might do so. First, the HVS has different sensitivities to the different coefficients (that is, one can generally change the higher frequency components by greater values than the lower frequency components without human detection). The quantizing tables take this into account by using larger quanta for coefficients to which the HVS is less sensitive, and so the baseline pseudo-metric just relies upon this fact to equalize the changes relative to the HVS. It may be better for the pseudo-metric to consider this more directly. Second, with reasonable compression, many of the quantized DCT coefficients are zero, which is where much of the compression gain is made during entropy coding. If these coefficients are modified, it may be easier for machine detection to discover tampering inconsistent with typical JPEG images (even though the image is entirely JPEG compatible and the overall statistics still appear normal). For these reasons, it may be desirable to restrict the ways in which the JPEG coefficients are changed in a more sophisticated manner. Beyond this, adaptive encodings should be considered [8, 11, 18]. It would be of interest to explore the degree to which the threshold (and perhaps even the pseudo-metric) may be adapted to each block Ii , so that blocks that contain sufficient amounts of clutter can encode more embedded data, while blocks whose alteration would be more easily detected may encode less data or even no data. The complexity measure used by Kawaguchi et al. may be of use for this [9]. Here, the nature of the block Ii being considered for use affects the threshold Θi and possibly the pseudo-metric µi . Care must be taken, since these must also apply to the replacement block, which is all that the receiver sees, and from which the receiver must be able to determine µi and Θi . It would also be useful to extend this approach to one that is robust in the presence of noise and other alterations to the stego image. One interesting twist is that JPEG-compatibility steganalysis can be used as error correction for some noise introduced in the spatial domain. Using this approach, the original (JPEG-

274

Richard E. Newman et al.

compatible) spatial image can be restored, so that an error-free version of the stego image can be extracted.

8

Conclusions

This paper has briefly discussed JPEG encoding, and the method used by Fridrich et al. to detect tampering with JPEG based bitmap images. It then described a stego embedding method to circumvent detection by the JPEG compatible steganalysis method, including proofs of correctness for the embedding method. While our baseline method is both low rate (1 bit per block) and is easily detectable if the approach is known, it is only a proof of concept. More advanced versions improve the data rate, efficiency, and decrease the detectability of the system (perhaps to the point of satisfying Kerckhoffs’ principle). One might want to use an improved version of this method to store relatively small amounts of data in a relatively undetectable way, or if it is desired to store them in spatial form. Since only one (or a few) coefficients are changed per block, the overall statistical changes will be small, as will be the visual distortion (relative to the distortions already present in the compressed cover, assuming that the QT is balanced in the effect of one quantum change on human perceptibility). The steganalyst is not likely to detect changes in either the frequency domain or the spatial domain, even using extremely sensitive detection methods. Also, our method can be extended as a steganographic method for files stored in the JPEG format, and detectability in the frequency domain is considered in follow-on work. Equally as important, topological notions of pseudo-metrics and neighborhoods are used to define its operation and as a perspective on the problem. Finally, some extensions to the work are proposed to increase its payload space or decrease the likelihood that an image is correctly detected by steganalysis.

Acknowledgments We thank the anonymous referees and the program chair, Fabien Petitcolas, for their insightful comments and assistance.

References [1] R. Anderson. Stretching the limits of steganography. In R. Anderson, editor, Information Hiding 1996, volume LNCS 1174, pages 39–48. Springer, 1996. 258 [2] R. Anderson. Security Engineering. Wiley, 2001. 272 [3] J. Dugundji. Topology. Allyn and Bacon, 1976. 267 [4] J. J. Eggers, R. B¨ auml, and B. Girod. A communications approach to image steganography. In SPIE Electronic Imaging 2002, Security and Watermarking of Multimedia Contents IV, volume 4675, pages 26–37, San Jose, USA, Jan. 2002. 259

A Steganographic Embedding

275

[5] J. Fridrich. Methods for detecting changes in digital images. In 6th IEEE International Workshop on Intelligent Signal Processing and Communication Systems (ISPACS’98), Melbourne, Australia, 4-6 November 1998. 258 [6] J. Fridrich, M. Goljan, and R. Du. Steganalysis based on JPEG compatibility. In A. Tescher, B. Vasudev, and Jr. V. M. Bove, editors, SPIE Vol. 4518, Special session on Theoretical and Practical Issues in Digital Watermarking and Data Hiding, SPIE Multimedia Systems and Applications IV, pages 275–280, Denver, CO, 20-24 August 1998. 258, 260, 262 [7] N. F. Johnson, Z. Duric, and S. Jajodia. Information hiding: Steganography and watermarking—attacks and countermeasures. In Advances in Information Security 1. Kluwer Academic Publishers, 2001. 258 [8] E. Kawaguchi and R. O. Eason. The principle and applications of bpcssteganography. In SPIE International Symposium on Voice, Video, and Data Communications: Multimedia Systems and Applications, pages 464–473, Boston, MA, November 2-4 1998. 259, 265, 273 [9] E. Kawaguchi and M. Niimi. Modeling digital image into informative and noiselike regions by complexity measure. In Information Modeling and Knowledge Bases IX, pages 255–265. IOS Press, April 1998. 273 [10] C. Kurak and J. McHugh. A cautionary note on image downgrading. In Computer Security Applications Conference, pages 153–159, San Antonio, Dec. 1992. 258, 259 [11] Y. Lee and L. Chen. An adaptive image steganographic model based on minimum-error lsb replacement. In Ninth National Conference on Information Security, pages 8–15, Taichung, Taiwan, 14-15 May 1999. 273 [12] Y. Lee and L. Chen. A high capacity image steganographic model. In IEE Vision, Image and Signal Processing, 2000. 259 [13] L. M. Marvel, C. G. Boncelet Jr., and C. T. Retter. Spread spectrum image steganography. IEEE Trans. Image Processing, 8:1075–1083, August 1999. 272 [14] L. M. Marvel, G. W. Hartwig, and C. Boncelet. Compression-compatible fragile and semi-fragile tamper detection. In SPIE EI Photonics West, pages 131–139, San Jose, CA, 2000. 260 [15] I. S. Moskowitz, L. Chang, and R. E. Newman. Capacity is the wrong paradigm. In New Security Paradigms Workshop, Virginia Beach, VA, USA, September 2002. 258, 259, 263 [16] I. S. Moskowitz, N. F. Johnson, and M. Jacobs. A detection study of an NRL steganographic method. NRL Memorandum Report NRL/MR/5540–02-8635, Naval Research Laboratory, Code 5540, August 16 2002. 259 [17] I. S. Moskowitz, G. E. Longdon, and L. Chang. A new paradigm hidden in steganography. In New Security Paradigms Workshop, pages 12–22, Ballycotton, County Cork, Ireland, Sept 2000. ACM (also appears in “The Privacy Papers” ed. R Herold, Auerbach Press 2002). 259 [18] M. Niimi, H. Noda, and E. Kawaguchi. An image embedding in image by a complexity based region segmentation method. In ICIP, volume 3, pages 74–77, 1997. 273 [19] W. B. Pennebaker and J. L. Mitchell. JPEG Still Image Data Compression Standard. Van Nostrand Reinhold, New York, 1993. 261 [20] F. A. P. Petitcolas, R. J. Anderson, and M. G. Kuhn. Information hiding – a survey. Proceedings of the IEEE, 87(7):1062–1078, July 1999. 272 [21] N. Provos. Defending against statistical steganalysis. In 10th USENIX Security Symposium, pages 323–335, August 2001. 258, 272

276

Richard E. Newman et al.

[22] N. Provos. Probabilistic methods for improving information hiding. Technical Report 01-1, CITI, University of Michigan, January 2001. 258, 272 [23] N. Provos and P. Honeyman. Detecting steganographic content on the internet. Technical Report 01-1, CITI, University of Michigan, August 2001. 258 [24] G. Strang. The discrete cosine transform. SIAM Review, 41(1):135–147, 1999. 261 [25] A. Westfeld. F5 — a steganographic algorithm: High capacity despite better steganalysis. In I. S. Moskowitz (Ed.) Information Hiding, LNCS 2137, IH 2001, pages 289–302. Springer, 2001. 270, 272

A

Proof of Claim 4

Claim 4: Using the stego embedding described in subsection 5.3, a cover file I with at least K usable blocks can embed any self-delimited data string s = s1 , s2 , ..., sK correctly. Proof of Claim 4: The sender tests each block of the cover image I in the π-permuted order Iπ(1) , Iπ(2) , ... until K usable blocks have been found. Each usable block Vi encodes datum si by replacing it (if necessary) with block Vi in the stego image I  , and each unusable block Ui that comes before VK in I is replaced (if necessary) with Ui ∈ R. The receiver tests each block of I  in the same order that the sender tests (and replaces if necessary) it, I1 , I2 , ..., until all of the embedded data s1 , s2 , ..., sK have been decoded. We will prove that the string extracted by the receiver is the same as that embedded by the sender, assuming there is no noise in the transmission process, by induction on l, the number blocks of I  tested by the receiver. Inductive Hypothesis: Let n(l) be the number of usable blocks of I that occur in the first l blocks of I, that is, Vn(l) is Il
for some l ≤ l, and ∀l , l < l ≤ l, Il

= Uj for some j. For all i < n(l − 1), the ith decoded datum si = Φ(Vi ) is identical to the ith encoded datum, si . Base Case: The base case, i = 0, is trivially true, and initially the decoded data string s [1..0] is empty, s [1..0] = φ. Inductive Step: The inductive step will assume the hypothesis is true for l − 1, and will show it to hold for l. Suppose that l−1 blocks of I have been tested, with j = n(l − 1) of them classified as rich (whose datum was extracted) and l − j − 1 of them classified as poor (and skipped). Then at this point the output data string is s [1..j] = s1 , s2 , ..., sj , and by the inductive hypothesis, ∀i ≤ j, si = si .  The receiver then tests the next block Iπ(l) to determine if it is rich.   If Iπ(l) ∈ R then the receiver extracts datum sj+1 = Φ(Iπ(l) ) and appends      it to s [0..j] to produce s [0..j + 1]. Iπ(l) ∈ R ⇒ Iπ(l) = Vj+1 since the sender leaves a rich block in I  before the end of s if and only if it encodes data, and the order in which the sender and receiver test and use blocks is the same. Thus   ) = Φ(Vj+1 ) = sj+1 and the inductive hypothesis holds for l. sj+1 = Φ(Iπ(l)    Otherwise Iπ(l) is poor, hence Iπ(l) is Ul−j and is skipped. This only happens  before the end of s if the sender places a poor block Ul−j ∈ R in I  that must be discarded by the receiver. In this case, the partially extracted string remains

A Steganographic Embedding

277

unchanged, and n(l) = n(l − 1) = j so the inductive hypothesis still holds for l. If the block were rich and another datum were appended to s [0..j], the receiver tests s [0..j + 1] to determine if it is complete (i.e., τ (s [0..j + 1]) = 1 and the self-delimitation mechanism indicates that all of s has been extracted). If this is the case, then the receiver skips the rest of I  and outputs s [1..j + 1] = s1 , s2 , ..., sK = s1 , s2 , ..., sK , since the inductive hypothesis holds for l = K and no prefix of the self-delimiting data s tests true for completeness (i.e., ∀i < K, τ (s[1..i]) = 0).

Steganography Preserving Statistical Properties Elke Franz Dresden University of Technology, Department of Computer Science D–01062 Dresden, Germany

Abstract. Steganographic modifications must not noticeably change characteristics of the cover data known to an attacker. However, it is a difficult task to define an appropriate set of features that should be preserved. This article investigates possibilities to maintain statistical properties while embedding information. As an example, the simple embedding function “overwriting the least significant bits” is discussed, w.r.t. greyscale images used as covers. Two modifications of this technique are presented here: The first modification avoids changes of first-order statistics and thereby overcomes possible attacks based on histogram analysis. The second modification tries to reduce noticeable modifications of second-order statistics and, thereby, of the structure of an image. The suggested modifications are tested on a set of images. Testing a possible attack and comparing these results to the results of the same attack on stego images created by the original method clarifies the improvements.

1

Introduction

Steganography aims to hide the existence of secret messages by embedding them into innocuously looking cover data. The generated stego data must not raise suspicion to be the result of steganographic processing. The goal of attacks is to detect the use of steganography [10, 18]. Successful attacks are able to detect modifications of the cover data, which can only be caused by the embedding. With regard to these attacks, an important requirement for steganography can be specified: The embedding must not cause significant properties that indicate the use of steganography. Attacking means nothing but analyzing features of the stego data. It is not necessary to preserve the absolute values of the features, but changing their essential properties is critical for the security of a steganographic algorithm. As the analyses of attackers cannot be foreseen, it is very difficult to define the set of features that should be considered. Obviously, the modifications caused by embedding have to be imperceptible. This can be regarded as the basic requirement that should be fulfilled by each steganographic method. Steganographic algorithms of the first generation concentrated on this problem. However, successful attacks on such systems have shown that imperceptibility is necessary, but not sufficient for secure steganography. The human visual perception is not able to recognize all information of an image. This is commonly used for lossy compression. Statistical analysis can disclose imperceptible differences between F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 278–294, 2003. c Springer-Verlag Berlin Heidelberg 2003


Steganography Preserving Statistical Properties

279

images. Steganographic algorithms of the second generation are the answer to these successful attacks [15, 19]. The evaluation of additional features is necessary to improve the security of steganographic algorithms. This article concentrates on statistical analysis, which will be used to define modifications of the well-known embedding operation “overwriting of the least significant bits” (LSBs). The replacing of all LSBs of an image with a sequence of random bits will be simply attackable by histogram analysis (statistical attacks in [18]). The first modification overcomes this weakness. However, even if first-order statistics are necessary to hide the use of steganography, they are also not sufficient. An image consisting of a white and a black half has the same histogram as an image consisting of the same number of white and black pixels randomly scattered over the image. Therefore, the image structure also has to be considered. The second modification introduces a possible approach to further improve the overwriting by analysing second-order statistics. To evaluate the improvements yielded by the modifications, various stego images were generated from test images and analysed afterwards.

2 2.1

First Modification First-Order Statistical Properties

First-order statistics describe the commonness of the colours or shades of grey of an image. Usually, histograms are used to describe the distribution of the shades. The problem of the embedding function “overwriting” is the fact that it changes the characteristics of the histogram [18]. If embedding is done in the spatial domain, frequencies of adjacent colours or shades, which only differ in the least significant bit, become equal by replacing the LSBs with a random bit stream. The same happens to the histogram of frequency coefficients if embedding is done in the frequency domain. To avoid such deviations, [19] suggests to use decrementing instead of overwriting. A possible solution to maintain the frequencies of coefficients despite of overwriting is introduced in [15]: Every change is corrected by an inverse change of another coefficient. Another approach is presented in this paper. 2.2

Modelling the Embedding

For this approach, it is useful to model the embedding as Markov source [9]. The frequencies of the shades after embedding depend on the frequencies of the shades before embedding and the transition probabilities. Because the state just depends on the previous state, we can think of it as a first-order Markov source. The state probabilities of a Markov source are usually variable while the transition probabilities are invariant. The frequencies of the shades are given by the cover image and will be changed by embedding. The transition probabilities

280

Elke Franz

are defined by the embedding algorithm and the distribution of the message to be embedded. Therefore, they are constant for embedding the same message by using the same embedding algorithm. For overwriting, the probabilities of the message bits correspond to the transition probabilities. Transitions between shades can solely happen between adjacent shades that only differ in the least significant bits which are replaced with random message bits. Such adjacent shades are referred to as groups in the following. 2.3

Suggested Modification

To preserve the distribution of the shades, we suggest the following approach: First, we determine the ideal distribution of the message to be embedded with the given algorithm in a given cover. The distribution is ideal if it can be embedded without changing the characteristics of the histogram. In fact, even the exact frequencies are preserved in our approach. Second, adjust the message that it matches the ideal distribution and embed it into the cover. It is assumed, that a given distribution can be changed to match an arbitrary distribution for practical reasons. Adding the necessary bits and subsequently permuting the message could do this. Permutation algorithms can be found in the literature, for example in [12]. Another possibility to change a distribution is described in [17]. The frequencies of the shades after embedding can be described by using the total probability theorem [14]. The present message distribution is given by the probability q0 (q1 ) for a message bit to be zero (one). In order preserve the cover histogram, the embedding is modelled as stationary Markov source. In this special case, the frequencies of the shades after embedding pi are equal to the frequencies of the shades before embedding pi , whereas pi stands for the probability of shade gi . Using this condition pi = pi , we can determine the ideal distribution of the message. As the message is a sequence of zeros and ones, it is sufficient to determine one probability. For example, the required probability q0 is given by: p2i = q0 (p2i + p2i+1 ) for p2i = p2i : where: q0 + q1 = 1, q0 + q1 = 1,

q0 = 255
j=0

p2i p2i + p2i+1

(1)

pj = 1, i = 0, ..., 127.

The distribution of the message has to match for each group. If overwriting a pixel of a group with the message bit “0” yields the shade g2i , the probability for the message bit to be “0” has to be equal to the probability for a pixel belonging to this group to be of shade g2i . Or in other words, the probabilities of the message bits have to be equal to the probabilities of the corresponding shades of the respective group. Moreover, really all pixels belonging to a selected group

Steganography Preserving Statistical Properties

281

have to be used for embedding; otherwise the transition probabilities would be modified. It is also possible to overwrite more than just the LSBs. This could be done to increase the embedding capacity. The modification described below can be extended to maintain the histogram as follows: By overwriting the least significant b bits of the pixels, groups of m = 2b bits can be transformed into each other. The groups consist of the shades that only differ in the least significant b  blocks Bi of length b. For each bits. The message is divided into n =
length(emb) b group, the distribution of these blocks has to match the probability of a pixel to be of the corresponding shade of the respective group: pmi+j = qj

m−1 

pmi+k

k=0

for

pmi+k = pmi+k :

qj =

pmi+j m−1
k=0

where: j = 0, ..., m − 1, i = 0, ...,  255 m , qj = p(Bj ).

m−1
j=0

qj = 1,

m−1
j=0

(2)

pmi+k

qj = 1,

255
l=0

pl = 1,

Figure 1 illustrates the modelling. Theoretically, it would be possible to overwrite all bits of a pixel (supposed an appropriate distribution). Of course, this would significantly change the image. Without evaluating any further properties, the allowed bit rate per pixel must be subjectively limited by the human user. The histogram of the stego image is identical to the histogram of the cover image; therefore, attacks based on first-order statistics will fail. 2.4

Algorithm

The necessary steps are illustrated in Figure 2. First, the cover histogram is calculated in order to obtain the probabilities of the shades. Afterwards, one looks for usable groups of shades. A group is usable, if all of its shades occur in the image. In the next step, the groups are sorted. An embedding table is used for this step. The first three columns of this table are directly derived from the histogram. Groups are referenced by their starting value, which is the first shade of this group. The relative frequency of a group is the sum of all relative frequencies of the belonging shades. The capacity specifies the number of bits that can be embedded in the pixels belonging to a certain group. The capacity is the product of the absolute frequency of the group and the number of embedded bits per pixel. Groups can be sorted according to various criteria, for example according to – the capacity, largest capacity first (as used in the tests), or – the deviation from normal distribution, least deviation first.

Elke Franz

p

2i+1

mi+1

.....

.....

2i+1

p

mi+2

...

p’

mi+2

.....

.....

.....

p’

p

p’

p

p’

4i+1

4i+2

4i+1

4i+2

4i+3

4i+3

p

p’

mi+m-1

mi+m-1

.....

p’

.....

p

...

4i

4i

...

p

.....

overwriting the least significant bits

mi+1

...

p

mi

p’

...

p’

p’

...

mi

...

p

2i

.....

p’

2i

.....

.....

.....

p

...

282

.....

.....

overwriting the b least significant bits b = ld m = log2 m

overwriting the two least significant bits transition probabilities: q0

q3

p

probabilities for the shades before embedding

q1

qm-1

p’

probabilities for the shades after embedding

q2

i i

Fig. 1. Overwriting the least significant bits

The sorting corresponds to the selection of groups if the embedded message is shorter than the embedding capacity of the cover image. The overall goal is the best utilization of the cover image. After this step, the first three columns of the embedding table are filled. The order of rows corresponds to the order of processing while embedding. In the last preprocessing step, the message is prepared for embedding. It is split into parts which will be embedded in the groups. The distribution of every part has to be adjusted as described above in order to match the intended group. The length of a part is determined by the capacity of this group. These parts are inserted into the last column of the embedding table, subsequently filling up the rows. The last group will be padded if necessary. Finally, the message is embedded. The algorithm processes the cover pixel by pixel in a fixed order. For each pixel belonging to a usable group, the next b bits of the appropriate row of the embedding table overwrite the b least significant bits of the pixel. The resulting stego image is transmitted to the recipient of the message. Extracting the message is done in a similar manner. The recipient must generate the same embedding table to be able to extract the message. As the frequencies of the shades are not changed, he can do so by using the histogram of the stego image. Sender and recipient must know the sorting criteria of the groups. After

Steganography Preserving Statistical Properties

283

probability

0.008

0.006

0.004

0.002

0 0

50

100 150 shades of grey

200

1. Calculate cover histogram 4. Split the message into pieces for embedding into the groups and match distribution 2. Look for usable groups

46 47 48 49 50 51 52 53

..

Embedding table:

0.0436 0.0932 0.2336 0.1400 0.1832 0.1128 0 0.0448

..

relative frequency

starting value of the group

capacity (bit)

message

0.3736 0.2960 0.1368 ...

48 50 46 ...

934 740 342 ...

101101... 010011... 110111... ...

3. Sort usable groups

embedded bit string: 46 51 49 48 ... 45 53 40 42 ...

5. Process cover pixel by pixel in a fixed order, embedding in pixels belonging to a usable group

47 50 49 48 ...

1010...

... ... ... ... ...

46 51 43 48 ...

... ... ... ... ...

... ... ... ...

... ... ... ...

part of cover image

part of stego image

Fig. 2. Overwriting the LSBs — first modification generating the embedding table, the cover has to be processed in exactly the same order as it was done while embedding. The b least significant bits of pixels belonging to a usable group are sorted in the respective row of the embedding table. Thereafter, the adjusting of the distribution has to be reversed. The rows of the table include pieces of the original message after this reversing. In the last step, the message must be successively put together from these pieces.

3 3.1

Second Modification Co-occurrence Matrices

As first-order statistics are not sufficient, we want to have a look at correlations between pixels in order to get more information about the structure of an image. A common means of describing such correlations is the use of cooccurrence matrices. A co-occurrence matrix is a two dimensional matrix whose

284

Elke Franz

entries give the frequency for the co-occurrence of shades at two pixels separated by a fixed distance and direction. Relations (∆x, ∆y) describe distance and direction. This is second-order statistics, because relations between two pixels are considered. For the shade g(x, y) of the pixel at position (x, y), the entry cij of a co-occurrence matrix describes the frequency of pairs of pixels with (g(x, y) = i) ∧ (g(x + ∆x, y + ∆y) = j). A separate matrix is generated for each relation. 3.2

Approach to Maintain the Matrix Entries

It is more difficult to describe the effects of embedding for second-order statistics. Instead of looking at a single histogram, various matrices must be considered. It is not clear from the beginning, which relations must be analysed. Therefore we want to use the co-occurrence matrices only as a means to find shades that occur randomly and independent of each other in the image. If they are transformed into each other while embedding, it would neither be noticeable nor measurable. That means we are looking for noisy parts of the image that can be replaced by noise, and the analysis of second-order statistics should be used as a means of detecting noise. The random occurrence of the shades will be identifiable in the co-occurrence matrices: Two events A and B are called independent if their probabilities satisfy P (AB) = P (A)P (B) [14]. The entries of the matrix correspond to the joint probability, and the probabilities of the events are given by the frequencies of the shades in the histogram. That means, the formula is valid if the shades are stochastically independent. This condition can be used to establish rules that will maintain the matrix entries: 1. The shades, which can be transformed into each other while embedding, must be stochastically independent. 2. The embedding function used has to maintain first-order statistics. A method to fulfill the second rule was already proposed in the previous chapter. So the remaining task is to find independent shades. The relations to be analysed have to be specified. As it can be expected that neighbouring pixels are most correlated, we want to concentrate on relations that describe the direct neighbourhood of a pixel, namely (∆x, ∆y) ∈ {(1, 0), (−1, 1), (0, 1), (1, 1)}. 3.3

Stochastically Independent Shades

The χ2 -test of independence (e. g., [2]) was used to detect stochastically independent shades. This test belongs to the class of significance tests that determine the probability that a given result did not occur by chance. The following null hypothesis was tested here: The shades, which can be transformed into each other while embedding, are stochastically independent. The number of shades for which independence must be tested depends on the embedding operation. In the example examined here it is given by the groups.

Steganography Preserving Statistical Properties

285

If the least significant bit is used for embedding, two shades can be transformed into each other at a time: the shades g2i and g2i+1 . With regard to the cooccurrence matrix, the independence of the features “shade of the first pixel” and “shade of the second pixel” is tested. The sample for the test consists of all pairs of pixels belonging to the given relation and having shades g2i and g2i+1 . A fourfold table can be used in this special case:

Feature Y

Feature X g2i+1 h21 h22 h2.

g2i h11 h12 h1.

g2i

g2i+1



h.1 h.2 n

The statistic for the test of the hypothesis 2

χ2r =

n (h11 h22 − h12 h21 ) h1. h2. h.1 h.2

is χ2 -distributed with one degree of freedom. The Yates-correction is used for small samples with size less than 50. The statistic is calculated for all relations mentioned above. The modified embedding algorithm must be extended by the additional analysis described above. After selecting usable groups, they were further restricted to the groups whose shades occur independently of each other.

4 4.1

Evaluating the Modifications General Testing

R Both algorithms were realized in Mathematica
. A set of 50 test images was used for embedding. The maximum amount of data was embedded, whereby the messages were random bit strings of the necessary distribution. To show the improvements of the modifications, embedding was compared to the original method of overwriting the least significant bits. For each of the test images, four stego images were generated:

– – – –

stego1: stego2: stego3: stego4:

overwriting overwriting overwriting overwriting

according according according according

to to to to

the the the the

original method, first modification, 1 bit per pixel, first modification, 2 bits per pixel, second modification, 1 bit per pixel.

The test images are scans of photographs showing natural scenes. They are of different characteristics. Some of them include greater homogenous areas of

286

Elke Franz

test images (%)

80

1st modification (1 bit) 1st modification (2 bit) 2nd modification

60

40

20

1

2

3

4

5

6

7

8

9

10

class

embedding capacity

1 2 3 4 5 6 7 8 9 10 11

[ 0% - 10%) [10% - 20%) [20% - 30%) [30% - 40%) [40% - 50%) [50% - 60%) [60% - 70%) [70% - 80%) [80% - 90%) [90% - 99%) [99% - 100%]

11

class (as defined on the right)

Fig. 3. Embedding capacities of the test images shades that are possible in the saturation areas of the scanner used, others consist of medium shades only. In the former case, it can be expected to find mainly one shade in such areas [4]. The maximum size of the images was 110 kByte. This test shows that the restriction to usable groups does not generally restrict the embedding capacity. The histograms of natural images usually cover a continuous area of shades. Therefore, the restriction may become noticeable only at the marginal areas of the histograms and only if the images include large homogenous areas. This is the same for embedding two bits per pixel. The second modification results in stronger restrictions of the capacity, but in general, despite these restrictions, quite an amount of data can be embedded. The possible capacities for each method are compared in Figure 3; the maximal number of bits that can be embedded in a cover is given in percents (all LSBs of the cover correspond to 100 %). The covers are grouped into classes of different capacity as described in the figure. 4.2

Possible Attacks

Describing the Attacks. The discussion of possible attacks on the steganographic methods is of special interest. To classify the attacks tested here, some relevant items are shortly discussed in the following. Possible attacks can be described w.r.t. – the strategy of the attack, – the analysed features of the stego images, and – the possible result of the attack. Attacking Strategies. The first strategy may be to model features of the cover images and to look for deviations from this model. However, it is difficult to generally describe the “normal” appearance of these features. There are different strategies known to approach this problem. One of them is making assumptions about the features of the stego image by modelling the impact of embedding [18]. Another approach is to investigate changes of the features, even by

Steganography Preserving Statistical Properties

287

steganographic modifications [5], or by other operations, such as image processing functions [1]. Considering a set of training images, the impact of processing the images to the chosen features is analysed. To answer the question whether an intercepted image contains steganographic data, the same processing is done with this image and the changes of the analysed features are compared to the empirically determined thresholds. Analysed Features. Attacks concentrate on special features of the suspected image. Regarding statistical analysis, these features can be classified by first-order statistics, second-order statistics and so on. It can be assumed that the force of an attack increases in this order. First-order statistics are used in attacks that analyse histogram modifications [5, 13, 15, 18]. Analysing more than one pixel at a time leads to higher-order statistics. Examples are the Laplace filtering as described in [11], the subband filtering used in [3], and the analysis of regular and singular groups in [7]. Possible Result. Of course, it will not be possible to get absolute certainty about the use of steganography, because this would require absolute certainty about the cover images and the impact of all possible processing. Therefore, at best it can be stated that an image is a stego image with the utmost probability. It depends on the attack such a statement is based on: – only on the attacker’s subjective estimation, – on the comparison to empirically determined thresholds, or – on statistical hypothesis testing. Both efficiency and reliability of an attack seem to increase in this order. The visual attacks in [18] as well as the subjective estimation of other image features belong to the first category. The attacks in [1] and [5] can be seen as examples for the second category, and the statistical attacks in [15, 18] belong to the third category. Examined Attacks. As the suggested modifications maintain the first-order statistics of the cover images, it is not necessary to test attacks based on histogram analysis. We can focus on attacks based on higher-order statistics. The strategy used here is to make assumptions about the features of the stego images. And finally, the result shall be based on hypothesis testing. Starting point is the Laplace filtering described in [11]. Using the following Laplace operator regarding four adjacent pixels filters the images:   0 −1 0 H =  −1 4 −1  0 −1 0 The results of filtering two of the test images are shown in Figure 4. Because it is assumed that adjacent pixels are of similar colours, the maximum of the resulting filter histogram is expected to be zero. Overwriting the least significant bits

288

Elke Franz

0.25 0.05 probability

probability

0.2 0.15 0.1

0.04 0.03 0.02

0.05 0.01 0 -40

-20 0 20 result of filtering

40

-40

-20 0 20 result of filtering

40

Image with large homogenous areas 0.007 0.007 probability

probability

0.0065 0.006 0.0055 0.005 0.0045

0.0065 0.006 0.0055 0.005 0.0045

0.004 0.004 0.0035 -40

-20 0 20 result of filtering

40

-40

-20 0 20 result of filtering

40

Image with medium shades

Fig. 4. Results of Laplace filtering; cover on the left, stego1 on the right changes this characteristic; the LSBs become stochastically independent, which can be noticed in the histogram. However, the result depends on the structure of the image. The impact of overwriting cannot be noticed when the LSBs of the cover image look noisy. To work as efficiently as possible, a hypothesis test was used. The results of Laplace filtering cannot generally be estimated because they depend on the image. However, just regarding the LSBs simplifies the situation. At least, the impact of overwriting all LSBs according to the original method can be modelled. After overwriting all LSBs with a random bit sequence as done by the original method, each bit is zero or one with probability 0.5. Filtering only the LSBs of such a stego therefore yields a filter histogram whose frequencies can be derived from the probabilities of the LSBs. Possible results of this operation are values in the range of −4, ..., 4. Only the number of zeros n0 and ones n1 of the adjacent bits has to be regarded when determining the number of combinations that yield a certain result. The number of possible combinations of the adjacent pixels nm (n0 , n1 ) is given by the permutation Pnm of n elements of m groups with k1 , k2 , ..., km equal elements [8]: nm (n0 , n1 ) = Pnm =

4! n! = k1 ! · k2 !...km ! n0 ! · n1 !

The probability for a result P (res) of the filtering is simply given by: P (res) = 0, 5nm (n0 ,n1 )+1

Steganography Preserving Statistical Properties

289

Table 1. Expected distribution after filtering the LSBs with the Laplace operator Middle pixel Adjacent pixels Result Number Probability

0

1

4x1 3x1, 1x0 2x1, 2x0 1x1, 3x0 4x0 4x1 3x1, 1x0 2x1, 2x0 1x1, 3x0 4x0

–4 –3 –2 –1

1 4 6 4

0,03125 0,125 0,1875 0,125

0

2

0,0625

1 2 3 4

4 6 4 1

0,125 0,1875 0,125 0,03125

This way, the theoretically expected distribution of the filter histogram for filtering the LSBs of a stego image as stated above can be determined (Table 1). Summarizing, to discriminate between cover and stego images, the Laplace operator filters the least significant bit plane. The χ2 -test of homogeneity [2] is used to test the null hypothesis that the distribution of this result matches the expected distribution after overwriting the LSBs (Table 1). If the hypothesis is rejected, it is concluded that the LSBs of the analysed image do not contain a secret message in the form of a random bit string. The significance level α of the test determines the critical value that decides whether or not the hypothesis is rejected. Therefore, the significance level is the probability to make a type I error, that means to wrongly reject the null hypothesis. In the tests examined here, two significance levels were used: α = 0.05 and α = 0.01. Therefore, three possible regions for the results can be defined: – hypothesis is not rejected, – hypothesis is still accepted for α = 0.01, but rejected for α = 0.05, and – hypothesis is rejected even for α = 0.01. If the hypothesis is not rejected, the LSBs may contain a secret message. Other possible reasons are that the LSBs of this image match the expected distribution anyway, or that a type II error occured. This kind of error cannot be handled by a significance test. This attack has a high probability of detecting the original embedding method. The first modification only considers first-order statistics and is not constructed to resist such analysis. However, detection will become more difficult because the distribution of the message was changed and therefore the embedded stream is not uniformly distributed. The best resistance can be expected from the second modification, which respects second-order statistics. Of course, an attack has to be tailored to the specific embedding method. A second analysis was done to illustrate a possibility. The object of this analysis

290

Elke Franz 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% cover

stego1

stego 2

stego3

stego4

null hypothesis: distribution of LSBs matches distribution after overwriting with random message

hypothesis is not rejected hypothesis is rejected for α = 0.05 hypothesis is rejected for α = 0.01

indicates possible use of steganography detecting structures (no signs of steganography)

Fig. 5. Result of Laplace attack for images with non-noise LSBs

is the independence of shades. The embedding process in the first modification does not consider correlations between pixels. The distribution of the embedded stream is modified, but it is just a random sequence of bits. It can be expected that the embedding will destroy existing correlations. The number of independent shades is expected to increase after embedding. In contrast, the number of independent shades will not increase when using the second modification because only independent shades are used for embedding. This is just one possibility for a more sophisticated attack tailored to the modification suggested here. Another possibility would be testing randomness especially for possible groups. Results of the Attacks. The Laplace filtering tests whether the LSBs of an image are uniformly distributed. The evaluation shows the advantage of using hypothesis testing: The test is able to detect deviations from uniform distribution that are imperceptible for the human eye. Deviations of the uniform distribution are, in fact, structures in the appropriate bit plane. Of course, even the LSBs of a cover image can look noisy and may not include structure at all. The test did identify structures in 33 of the 50 test images (with the naked eye, only in 17 images the structures were recognized). For the images without any measurable structures, the test result will not change for the analysis of the stego images. The 33 images with measurable structures in the LSBs are of greater interest. The assumptions made above are corroborated by the tests (Figure 5). Embedding without any modification was detectable by the test for each test image. The first modification makes the recognition more difficult, and finally, the stego images generated by using the second modification yield the same test results as the cover images.

independent shades (%)

independent shades (%)

Steganography Preserving Statistical Properties

80

60

40

20

291

90 80 70 60 50 40 30 20

0 cover

stego1

stego2

stego 3

stego 4

Images with larger homogenous areas

cover

stego1

stego2

stego 3

stego 4

Images with medium shades

Fig. 6. Ratio of independent shades (in percents)

The second assumption about the number of independent shades was also supported by the tests (Figure 6). Randomization of the least significant bit plane(s) has little effect on the number of independent shades for noisy images (right hand side of the figure). In contrast, this number is significantly changed if there are recognizable structures in the least significant bit plane of the cover (left hand side of the figure). However, using the second modification (stego4) will largely avoid these changes. Future work will be done to create further evaluations.

5

Summary and Outlook

In this paper we investigated possibilities that aim to preserve statistical properties while overwriting the LSBs of an image. For first-order statistics, the embedding was modelled as stationary Markov source. For second-order statistics, an additional analysis of the cover image was suggested to improve the selection of random image parts. The modifications use groups of shades for embedding. Another approach that uses pairs of colors is described in [16]: Two colours are a pair and can be used for embedding if the difference between them is less than the noise of the host, and if they occur with about the same statistical frequency. The approach suggested here can be considered as a generalization of that approach. The impact of the modifications is illustrated in Figure 7. Overwriting all LSBs with a random string destroys structures in the least significant bit plane. Our modifications clearly improve this result by maintaining existing structures. Tests have shown the usability of the suggested modifications. At worst, the algorithm reduces the embedding capacity of improper images. In spite of necessary restrictions, quite an amount of data can be embedded. Analysing the LSBs of stego images generated according to the second modification yielded the same results as analysing the LSBs of the corresponding cover images. As it can be expected, the test results depend on the images. Only overwriting non-noise LSBs is detectable at all. Therefore, images with a perceptible structure in the LSBs are not suited for embedding according to the original method. However,

292

Elke Franz

cover: “bastei.pgm”

LSBs of the cover

LSBs of stego1

LSBs of stego2

LSBs of stego3

LSBs of stego4

Fig. 7. Results of suggested modifications

one can use them as covers nevertheless by preserving existing structures as it was proposed here. Future work has to be done to improve the statistical analyses and to use these results in order to improve embedding. The investigations were done for overwriting the LSBs of images in the spatial domain. For practical reasons, it is important to investigate the applicability of the modifications for other embedding operations. And finally, as mentioned above, the analyses for validating the results have to be improved, too. This will also include researching the applicability of attacks known from the literature. In [6] it was pointed out that the use of cover images previously stored in the JPEG format should be avoided. The JPEG compatibility test described in that article was not yet tested for the algorithms suggested here. Especially the RS analysis in [7] seems to be of great interest. Some first tests were done to determine the R and S groups for cover and stego images produced here, but much more evaluation is necessary to make concrete statements. Finally, the author would like to thank the reviewers for their helpful comments.

Steganography Preserving Statistical Properties

293

References [1] Ismail Avcibas, Nasir Memon, B¨ ulent Sankur: Steganalysis of Watermarking Techniques using Image Quality Metrics. In: Ping Wah Wong, Edward J. Delp (Ed.): Security and Watermarking of Multimedia Contents III. Proceedings of SPIE Vol. 4314, 2001, 523-531. 287 [2] Wilfried J. Dixon, Frank J. Massey: Introduction to Statistical Analysis. McGraw-Hill Book Company, Inc. New York, 1957. 284, 289 [3] Hany Farid: Detecting Steganographic Messages in Digital Images. http://www.cs.dartmouth.edu/˜farid/publications/tr01.html 287 [4] Elke Franz, Andreas Pfitzmann: Steganography Secure Against Cover-StegoAttacks. In Andreas Pfitzmann (Ed.): Information Hiding. Third International Workshop, IH’99, Dresden, Germany, September/October 1999, Proceedings, Springer, LNCS 1768, 2000, 29-46. 286 [5] Jessica Fridrich, Rui Du, Meng Long: Steganalysis of LSB Encoding in Color Images. ICME 2000, New York City, July 31th - August 2nd, USA. http://www.ssie.binghampton.edu/fridrich/publications.html 287 [6] Jessica Fridrich, Miroslav Goljan, Rui Du: Steganalysis Based on JPEG Compatibility. SPIE Multimedia Systems and Applications IV, Denver, CO, August 20-24, 2001. 292 [7] Jessica Fridrich, Miroslav Goljan, Rui Du: Reliable Detection of LSB Steganography in Color and Grayscale Images. Proc. of the ACM Workshop on Multimedia and Security, Ottawa, CA, October 5, 2001, 27-30. 287, 292 [8] Wilhelm G¨ ohler: H¨ ohere Mathematik: Formeln und Hinweise. Bearb. von Barbara Ralle, 10. u ¨berarb. Auflage, VEB Deutscher Verlag f¨ ur Grundstoffindustrie, Leipzig, 1987. 288 [9] Solomon W. Golomb, Robert E. Peile, Robert A. Scholtz: Basic Concepts in Information Theory and Coding. Plenum Press, New York, 1994. 279 [10] Neil F. Johnson, Sushil Jajodia: Steganalysis of Images Created Using Current Steganography Software. In David Aucsmith (Ed.): Information Hiding. Second International Workshop, IH’98, Portland, Oregon, USA, April 1998, Proceedings, Springer, LNCS 1525, 1998, 273-289. 278 [11] Stefan Katzenbeisser, Fabien A. P. Petitcolas (Ed.): Information Hiding Techniques for Steganography and Digital Watermarking. Artech House, 2000. 287 [12] Donald E. Knuth: The art of computer programming. Volume 2: Seminumerical algorithms. Addison-Wesley, 3rd Ed., 1998. 280 [13] Maurice Maes: Twin Peaks: The Histogram Attack to Fixed Depth Image Watermarks. In David Aucsmith (Ed.): Information Hiding. Second International Workshop, IH’98, Portland, Oregon, USA, April 1998, Proceedings, Springer, LNCS 1525, 1998, 290-305. 287 [14] A. Papoulis, Probability, Random Variables, and Stochastic Processes, 2nd ed. New York, McGraw-Hill, 1984. 280, 284 [15] Niels Provos: Defending Against Statistical Steganalysis. 10th USENIX Security Symposium, August 2001. http://www.citi.umich.edu/u/provos/stego/ 279, 287 [16] Maxwell T. Sandford, Jonathan N. Bradley, Theodore G. Handel: The data embedding method. In Proc. of the SPIE Photonics East Conference, Philadelphia, September 1995. 291 [17] Peter Wayner: Mimic Functions. Technical Report, Cornell University, Department of Computer Science, 1990. 280

294

Elke Franz

[18] Andreas Westfeld, Andreas Pfitzmann: Attacks on Steganographic Systems. In Andreas Pfitzmann (Ed.): Information Hiding. Third International Workshop, IH’99, Dresden, Germany, September/October 1999, Proceedings, Springer, LNCS 1768, 2000, 61-76. 278, 279, 286, 287 [19] Andreas Westfeld: F5 — A Steganographic Algorithm: High Capacity Despite Better Steganalysis. In Ira S. Moscowitz (Ed.): Information Hiding. 4th International Workshop, IH’01, Pittsburgh, PA, USA, April 2001, Proceedings, Springer, LNCS 2137, 2001, 289-302. 279

Bit-Plane Decomposition Steganography Combined with JPEG2000 Compression Hideki Noda1 , Jeremiah Spaulding1 , Mahdad N. Shirazi2 , Michiharu Niimi1 , and Eiji Kawaguchi1 1

Kyushu Institute of Technology Dept. of Electrical, Electronic and Computer Engineering 1-1 Sensui-cho, Tobata-ku, Kitakyushu, 804-8550 Japan {noda,jerry,niimi,kawaguch}@know.comp.kyutech.ac.jp http://www.know.comp.kyutech.ac.jp/ 2 Communications Research Laboratory Keihanna Human Info-Communications Research Center 2-2-2 Hikaridai, Seika-cho, Soraku-gun, Kyoto, 619-0289 Japan [email protected]

Abstract. This paper presents a steganography method based on JPEG2000 lossy compression scheme and bit-plane complexity segmentation (BPCS) steganography. In JPEG2000 compression, wavelet coefficients of an image are quantized into a bit-plane structure and therefore BPCS steganography can be applied in the wavelet domain. The proposed JPEG2000-BPCS steganography was implemented using JJ2000 Java software of JPEG2000 compression, with which the program module for BPCS steganography was integrated. The proposed steganography enables us to use JPEG2000 lossy compressed images as dummy files for embedding secret data. Embedding rates of around 15% of the compressed image size were achieved for pre-embedding 1.0bpp compressed images with no visually noticeable degradation in image quality.

1

Introduction

Communication between two parties over long distances has always been subject to interception. This led to the development of encryption schemes and there are many good encryption protocols in use today. Encryption schemes achieve security basically through a process of making a message unintelligible so that those who do not possess necessary keys cannot recover the message. Though encryption can hide the content of a message, the existence of an encrypted communication in progress can not be hidden from a third party. Also if the third party discovers the encrypted communication, they might be able to decipher the message. The need to avoid this led to the development of steganography schemes which compensate encryption by hiding the existence of a secret communication. Steganography provides good security in itself and when combined with encryption becomes an extremely powerful security tool. All steganographic techniques share the same basic premise: they take a media and by modifying it in a subtle way, create meaning in it that can only be F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 295–309, 2003. c Springer-Verlag Berlin Heidelberg 2003


296

Hideki Noda et al.

understood after a knowledgeable party examines it in a special way. The media that is to be modified is usually referred to as container, or dummy. This container may be a digital still image, an audio file, a video file, or even a printed image. Once the data has been embedded, it may be transferred across insecure lines or posted in public places. The most important properties of steganography schemes are undetectability, perceptual transparency, and capacity. The challenge is to embed as much data as possible with no noticeable degradation of the dummy media and/or with undetectable statistical changes of the dummy media under possibly attempted statistical tests. Among various steganographic techniques, the least significant bit (LSB) embedding technique is the simplest and the most commonly used one [1, 2]. It is based on bit-plane decomposition1 of the dummy image and replacement of the binary data in the least significant bit-planes with secret binary data. In a previous work, we presented a sophisticated steganography method, called bit-plane complexity segmentation (BPCS) steganography, which makes use of bit-plane decomposition and the characteristics of the human vision system [4]. Noting that the human eye cannot perceive any shape information in a complex binary pattern, we can replace noise-like regions in the bit-planes of a dummy image with secret data without visually noticeable deterioration of image quality. BPCS steganography has proven to be very effective in embedding data into many classes of dummy files including 8-bit gray images [4], 24-bit true color images [5] and 8-bit indexed color images [6]. BPCS steganography has also been successfully applied to mono and stereo digital audio files [7]. The benefits of this technique over the traditional steganography techniques are the very large percentage (30%-50%) of the dummy file that can be replaced with secret data and the lower occurrence of visual artifacts in the post-embedding image. In reality, most media files are stored and transmitted in lossy compressed formats and so there is a need for steganography techniques which are capable of hiding data in compressed dummy files. There have been very few steganographic techniques which consider compression of dummy files, i.e., steganography applicable to lossy compressed images [8, 9, 10]. Kataoka et al. [8] presented a data embedding method which is based on an adaptive discrete cosine transform (ADCT) encoding of images. Kobayashi et al. [9] presented a method for embedding data into JPEG bitstreams through a scheme which modifies the quantization phase of JPEG algorithm. However the embedding rate ((embedded data size)/(compressed image file size)) of these methods is very limited (around 2%). Chung et al. [10] presented an image hiding scheme based on singular value decomposition (SVD) and vector quantization (VQ) methods. However it is effective only for hiding one image’s data in a dummy image. Moreover, SVD and VQ are not viable techniques for compressing images. BPCS steganography, though promising due to its high data embedding capability, is not robust with respect to lossy compression of dummy image, as are all other bit-plane-based steganography methods. Lossy compression of an embed1

For example, an n-bit image can be decomposed into a set of n binary images by bit-slicing operations [3].

Bit-Plane Decomposition Steganography

297

ded dummy image can easily lead to destruction of the embedded information. To deploy the merits of BPCS steganography technique, in a practical scenario where the dummy image should be compressed before being transmitted over the network, we propose a steganography technique which is based on JPEG2000 lossy compression standard [11, 12] and BPCS steganography scheme. In the JPEG2000 compression, wavelet coefficients of an image are quantized into a bit-plane structure and therefore BPCS steganography can be applied in the wavelet domain. The proposed method provides a significant integration noting that the JPEG2000 lossy compression scheme forms the state-of-the-art standard for image compression, the BPCS steganography method has a noticeably large capacity as compared to alternative steganography methods, and that it provides a solution to the aforementioned problem associated with bitplane-based steganography methods. We call the proposed method JPEG2000BPCS steganography. A rich set of features that only JPEG2000 can provide brings additional benefits to the JPEG2000-BPCS steganography. Note that JPEG2000 lossy compressed images become available as dummy data in the proposed method but another lossy compression applied to an already embedded dummy image can still easily destroy the embedded information. The rest of this paper is organized as follows. In Section 2, necessary background on BPCS steganography is given, followed by information on JPEG2000 compression standard in Section 3. In Section 4, BPCS steganography combined with JPEG2000 compression scheme is presented. The paper continues with experiments done with an implementation of the JPEG2000-BPCS steganography in Section 5. Conclusions are addressed in Section 6.

2

BPCS Steganography

BPCS steganography addresses the embedding limit by working to disguise the visual artifacts that are produced by the steganographic process. Optometric studies have shown that the human vision system is very good at spotting anomalies in areas of homogenous color, but less adept at seeing them in visually complex areas. When an image is decomposed into bit-planes, the complexity of each region can be measured. Areas of low complexity such as homogenous color or simple shapes appear as uniform areas with very few changes between 1 and 0. Complex areas such as a picture of a forest would appear as noise-like regions with many changes between 1 and 0. These random-seeming regions in each bit-plane can then be replaced with hidden data, which is ideally also noiselike. Because it is difficult for the human eye to distinguish differences between the two noise-like areas, we are able to disguise the changes to the image. Additionally, since complex areas of an image tend to be complex through many of their bit-planes, much more data can be embedded with this technique than with those that are limited to only the lowest planes. In BPCS steganography, the complexity of each subsection of a bit-plane is defined as the number of non-edge transitions from 1 to 0 and 0 to 1, both horizontally and vertically. For any square of n × n pixels, the maximum complexity

298

Hideki Noda et al.

(a)

(b)

Fig. 1. Noise-like patch (a) and informative patch (b): (a) complexity 68, (b) complexity 29 is 2n(n − 1) and the minimum is of course 0. In Fig. 1, white represents a one and black a zero. Both squares, or patches, have the same number of ones and zeros, but very different complexities. This shows that one contains much more visual information than the other. The complex patch (a) has very little visually informative information, therefore it can be replaced with secret data and have a very small effect on the image’s quality. However, if the more visually informative patch (b) was replaced, it would cause noise-like distortion of the definite edges and shapes. A typical procedure for data hiding in BPCS steganography is summarized as follows. (1) Segment each bit-plane of a dummy image into small size, for example 8 × 8, blocks. Then classify these blocks into informative and noise-like blocks using a threshold of the complexity denoted by α0 . A typical value of α0 is 0.3αmax , where αmax is the maximum possible complexity value. (2) Segment a secret file into a series of blocks each containing 8 bytes of data. These blocks (which we call secret blocks) are regarded as 8 × 8 binary images. (3) If a secret block is less complex than the threshold α0 , conjugate it to make it more complex. Here the process called conjugation, which guarantees that any secret data can be embedded, is the exclusive OR operation with a checkerboard pattern. The relation α∗ = αmax − α holds true [4], where α and α∗ are the complexity of a given image and that of the conjugated image, respectively. (4) Replace each noise-like block in the bit-planes with a block of secret data. If the block is conjugated, then record this fact in a conjugation map. (5) Also embed the conjugation map in the same way as the secret blocks. The decoding procedure to extract the embedded secret data is just the reverse of the embedding procedure. In the decoding process, the complexity threshold α0 and the amount of secret data need to be known. The amount of secret data can be embedded into a specific place in the dummy file.

Bit-Plane Decomposition Steganography

299

This technique works very well with natural images, as they tend to have many areas of high complexity. Images with many complex textures and well shaded objects usually have a high embedded data capacity. BPCS steganography works much less well with computer generated images and line art, as those classes of images tend to have large areas of uniformity and sharply defined border areas. With these types of images, there is very little complexity to exploit and any changes tend to generate very visible artifacts. This is one of the flaws that BPCS steganography shares with traditional steganography. Another shared flaw is the fragility of the secret data with respect to changes in the post-embedding image. Any lossy compression will corrupt the hidden data, as will most transformations and filters. Since this makes the hidden data very vulnerable to any destructive attack, BPCS steganography is almost useless for watermarking purposes. However, depending on the desired application, this property may actually be a benefit. In the realm of data hiding, it can be a good thing, allowing for easy destruction of the secret message after completing the extraction of the embedded message. This allows retention of the dummy image, which is now completely innocent.

3

JPEG2000 Compression Standard

JPEG2000 encoder consists of several fundamental components: pre-processing, discrete wavelet transform (DWT), quantization, arithmetic coding (tier-1 coding), and bit-stream organization (tier-2 coding) [11, 12] (see the left part of Fig. 2). JPEG2000 can handle input images with an arbitrary number of components (1 to 16384). Pre-processing includes intercomponent transformation for multi-component images, typically color images. After the DWT is applied to each component, wavelet coefficients are quantized uniformly with deadzone. After the quantization step, an optional step to realize a functionality called region of interest (ROI) can be added. The ROI is realized by scaling up the wavelet coefficients in the relevant regions. The quantized wavelet coefficients are then bit-plane encoded by arithmetic coding. In JPEG2000, each subband of the wavelet transformed image is encoded independently of the other subbands. Furthermore, each subband is partitioned into small blocks called codeblocks, and each codeblock is independently encoded by the embedded block coding with optimized truncation (EBCOT) algorithm [13]. This procedure is absolutely different from other well-known embedded wavelet coders such as EZW [14] and SPIHT [15]. The independent encoding of codeblocks provides many advantages such as localized random access into image, improved error resilience, efficient rate control, and flexible bit-stream ordering. The quantized wavelet coefficients in a codeblock are bit-plane encoded in the way that each bit-plane is encoded by three passes with arithmetic coding: significance propagation pass, refinement pass, and cleanup pass. This arithmetic coding of the bit-plane data is referred to as tier-1 coding. The compressed data from the codeblocks are organized into units called packets and layers in tier-2 coding. A precinct is a collection of spatially con-

300

Hideki Noda et al.

tiguous codeblocks from all subbands at a resolution level. The compressed data from the codeblocks in a precinct constitutes a packet. A collection of packets from all resolution levels constitutes a layer. Therefore a layer corresponds to one quality increment for the entier full resolution image. In JPEG2000, different types of progression orders are possible and a typical one is layer-resolutioncomponent-position progression. Once the entire image has been compressed, a rate-distortion optimized bit-stream is generated for a target file size (bit rate).

4 4.1

BPCS Steganography Combined with JPEG2000 Compression BPCS Steganography in Wavelet Domain

This paper proposes a method of embedding secret data into JPEG2000 lossy compressed images using the previously described BPCS steganography. In the JPEG2000 compression, the wavelet coefficients of an image are quantized into a bit-plane structure and therefore BPCS steganography can be applied in the wavelet domain. The wavelet coefficients have many image-like properties, and BPCS steganography is ideal for exploiting them. The main properties leveraged for BPCS steganography are: – Correspondence: Spatial areas in each section of the coefficient subbands correspond directly to areas in the original image. – Complexity: The bit-planes at corresponding significance levels of the wavelet coefficients and the original image are usually proportionally complex. – Resilience: Changes in the values of the wavelet coefficients do not create disproportionately large changes in the reconstructed image. The property of correspondence states that in each subband of the wavelet coefficients, any subsection of that subband directly corresponds to a section of the original image. This is a scaled relationship, as the subbands decrease in size by a factor of two with each iteration of the multi-scale DWT. For example, an 8 × 8 patch of pixels in the original image corresponds to a 4 × 4 patch of pixels in the finest (first scale) subband. This allows the same complexity metrics to be used on the wavelet coefficients as are used on the original image. In the wavelet coefficients, the complexity of any subsection is related to the complexity of the corresponding subsection of the original image. While the amount of complexity in the wavelet coefficients is very important, the distribution of the complexity is also important. In the wavelet coefficients, the bits are ordered in decreasing significance, just as in the original image. Because of this, bit-planes tend to become more complex towards the least significant bits. This is good for BPCS steganography because this is where changes will have the smallest impact. The capacity of a container image is limited not only by its complexity, but by the decoder’s resilience to changes made in the coefficients. Resilience indicates

Bit-Plane Decomposition Steganography

301

Image Data

Pre-Processing

DWT Secret Data

Secret Data

Quantization

BPCS (Extraction)

BPCS (Embedding)

ROI Scaling

ROI Descaling

ROI Scaling

Arithmetic Encoder (Tier-1 Coding)

Arithmetic Decoder (Tier-1 Decoding)

Arithmetic Encoder (Tier-1 Coding)

Bit-Stream Organization (Tier-2 Coding)

Bit-Stream Unorganization (Tier-2 Decoding)

Bit-Stream Organization (Tier-2 Coding)

Bit-Stream

Bit-Stream (Embedded)

Fig. 2. A flowchart of data embedding and extraction in JPEG2000-BPCS steganography

the ability of the wavelet coefficients to absorb changes in value without changing the final image. The more resilient they are, the more changes that can be made and thus the more data that can be embedded. The inverse DWT is quite resilient to small changes in the coefficient values, and large changes experience a blending and blurring effect. This property is extremely useful for BPCS steganography, as many slight changes in the coefficients are blended out and result in little visual impact on the reconstructed image.

302

4.2

Hideki Noda et al.

JPEG2000-BPCS Steganography

Basically, secret data can be embedded in the bit-plane representation of the quantized wavelet coefficients after quantization step, provided that the ratedistortion optimization of JPEG2000 is bypassed. However, this procedure, which determines the optimal number of bit-planes for a given bit rate, is an essential part of the codec which contributes to its high compression efficiency. Thus, to avoid compromising the compression efficiency of JPEG2000, data embedding by BPCS is decided to be performed right after ROI descaling in decoding process where the optimal bit-plane structure for a given bit rate is available. The procedure for data embedding and extraction in JPEG2000-BPCS steganography is shown in Fig. 1. The entire process to embed data in JPEG2000-BPCS steganography follows the solid line arrows shown in Fig. 2. An image is encoded into JPEG2000 bitstream, whose size can be set almost exactly to a target bit rate (bit per pixel; bpp). The encoding process is shown in the left part of Fig. 2; from pre-processing to bit-stream organization. The JPEG2000 bit-stream (compressed image file) is then decoded, but decoding is halted right after ROI descaling (see steps from bit-stream unorganization to ROI descaling in the middle part of Fig. 2). The data at this point is a set of quantized wavelet coefficients. Using these quantized wavelet coefficients, bit-planes for the wavelet coefficients can be constructed and used to embed secret data with BPCS steganography (see the top box of the right part in Fig. 2). The quantized wavelet coefficients modified by embedding are then subjected to JPEG2000 encoding again (see steps from ROI scaling to bit-stream organization in the right part of Fig. 2), which produces secret-dataembedded JPEG2000 bit-stream. Data embedding into an already compressed JPEG2000 file is also possible. In this case, the process starts with a JPEG2000 compressed image, i.e., a bit-stream from the bottom of the middle part in Fig. 2 and follows the same process as the aforementioned one. The data extraction procedure follows the dashed arrows in the middle part of Fig. 2. JPEG2000 decoding of the secret-data-embedded bit-stream starts from bit-stream unorganization and is halted right after ROI descaling. At this point, extraction of secret data is carried out by the BPCS method using quantized wavelet coefficients. That is, the BPCS method can extract secret data from the bit-planes of the quantized wavelet coefficients. Generally the data extraction starts after the entire file of the bit-stream has been received. Error detection measures, such as embedding the amount of secret data as described in Section 2, can be used to check whether the bit-stream has been truncated in transit.

5

Experimental Results

We implemented the JPEG2000-BPCS steganography algorithm by integrating our program module for BPCS steganography with the Java implementation of JPEG2000 compression standard produced by JJ2000 [16]. The algorithm was tested on several standard images including “Lena”, “Barbara” and “Mandrill”. “Lena” and “Barbara” are 8bpp gray images and “Mandrill” 24bpp true color

Bit-Plane Decomposition Steganography

303

image, all of which were 512 × 512 pixels in size. A 5-scale wavelet transform with the Daubechies 9/7 filter was applied to images. Here 4 × 4 patch size was used as an embedding unit and random binary data was used as secret data. In the implementation of JPEG2000-BPCS steganography, an error correction scheme was devised to decrease the distortion of a data-embedded image. As data is being embedded into the wavelet coefficients, each bit that is used for embedding is recorded. After all the data has been embedded, the bits of each coefficient that have not been used are changed to bring the new value of the coefficient as close to the original value as possible. The change of bits is only allowed unless the change makes the complexity value for the relevant patch larger than the complexity threshold for embedding. The effectiveness of the error correction scheme is shown in Fig. 3, which was obtained by experiments using 1.0bpp compressed “Barbara” as a dummy data and using the first three least significant bit-planes for embedding. 9 data points within each line in Fig. 3 were obtained by changing the complexity threshold α0 from 2 to 10. The PSNR with the error correction increased by about 1.7 dB. In the following embedding experiments, the error correction was always applied.

40

with error correction without error correction 35

1 plane

PSNR(dB)

1 plane 2 planes 30

2 planes

3 planes

3 planes

25

20

0

5

10

15 20 25 Embedding Rate (%)

30

35

40

Fig. 3. Effectiveness of error correction scheme in JPEG2000-BPCS steganography

304

Hideki Noda et al.

Experimental results are shown in Fig. 4 and Table 1 for “Lena”, Fig. 5 and Table 2 for “Barbara”, and Fig. 6 and Table 3 for “Mandrill”. In these figures and tables, (a)s are 0.5bpp JPEG2000 compressed images, (b)s are embedding results using (a)s with no noticeable degradation in image quality. Similarly, (c)s and (d)s are relevant results, using 1.0bpp compressed images. Note that the compression rate for color “Mandrill” image is in fact three times less than those for the other gray images. Generally, the proposed JPEG2000-BPCS steganography was able to achieve embedding rates of around 9% of the final compressed image size for pre-embedding 0.5bpp compressed images, and 15% for pre-embedding 1.0bpp compressed images with no noticeable degradation in image quality.

Table 1. Experimental results for “Lena” image # planes used complexity embedded data compressed file PSNR (bytes) (bytes) (dB) for embedding threshold α0 (a) 16381 37.2 (b) 1 8 1724 20359 36.0 (c) 33745 40.5 (d) 2 8 6062 43419 37.1

Table 2. Experimental results for “Barbara” image # planes used complexity embedded data compressed file PSNR (bytes) (bytes) (dB) for embedding threshold α0 (a) 16588 32.3 (b) 1 8 2412 21532 30.7 (c) 32581 37.1 (d) 2 8 7332 43283 31.9

Table 3. Experimental results for “Mandrill” image # planes used complexity embedded data compressed file PSNR (bytes) (bytes) (dB) for embedding threshold α0 (a) 16344 23.1 (b) 1 8 1464 20238 22.5 (c) 32580 25.1 (d) 2 8 6698 43797 23.3

Bit-Plane Decomposition Steganography

(a)

(b)

(c)

(d)

305

Fig. 4. Experimental results for “Lena”: (a) JPEG2000 compressed image (0.5bpp), (b) 8% embedded into (a), (c) JPEG2000 compressed image (1bpp), (d) 14% embedded into (c)

306

Hideki Noda et al.

(a)

(b)

(c)

(d)

Fig. 5. Experimental results for “Barbara”: (a) JPEG2000 compressed image (0.5bpp), (b) 11% embedded into (a), (c) JPEG2000 compressed image (1bpp), (d) 17% embedded into (c)

Bit-Plane Decomposition Steganography

(a)

(b)

(c)

(d)

307

Fig. 6. Experimental results for “Mandrill”: (a) JPEG2000 compressed image (0.5bpp), (b) 7% embedded into (a), (c) JPEG2000 compressed image (1bpp), (d) 15% embedded into (c)

308

6

Hideki Noda et al.

Conclusions

This paper presented a solution to the problem of hiding data into compressed media files, an issue which can not be ignored noting that most media are stored and transmitted over networks in compressed formats. The proposed scheme is based on a seamless integration of BPCS steganography technique with the JPEG2000 image compression standard, while keeping untouched all the features of the standard. The JPEG2000-BPCS steganography will allow the access of many more people to the benefits of BPCS steganography due to the success and popularity of the JPEG2000 which has many desirable features including high compression rates and scalability. Embedding rates of around 15% of the compressed image size were achieved for pre-embedding 1.0bpp compressed images with no noticeable degradation in image quality. We should note that the JPEG2000-BPCS scheme is not robust with respect to lossy compression in the sense that lossy compression of an already embedded and compressed dummy image can still easily destroy the embedded information. Works are under progress to address this issue as well as the extension of the proposed method to motion JPEG2000 compressed video.

Acknowledgement This work was partly supported by the Mazda Foundation’s Research Grant.

References [1] Katzenbeisser, S., Petitcolas F. A. P.: Information Hiding Techniques for Steganography and Digital Watermarking. Artech House (2000) 296 [2] Wang, R. Z., Lin, C. F., Lin, J. C.: Image Hiding by Optimal LSB Substitution and Genetic Algorithm. Pattern Recognition, Vol. 34 (2001) 671-683 296 [3] Jain, A. K.: Fundamentals of Digital Image Processing. Prentice Hall (1989) 296 [4] Niimi, M., Noda, H., Kawaguchi, E.: A Steganography Based on Region Segmentation by Using Complexity Measure. Trans. of IEICE, Vol. J81-D-II (1998) 1132-1140 296, 298 [5] Kawaguchi, E., Eason, R. O.: Principle and applications of BPCS-steganography. Proc. of SPIE, Vol. 3528 (1998) 464-473 296 [6] Ouellette, R., Noda, H., Niimi, M., Kawaguchi, E.: Topological Ordered Color Table for BPCS Steganography Using Indexed Color Images. IPSJ Journal, Vol. 42 (2000) 110-113 296 [7] Kusatsu, I., Niimi, M., Noda, H., Kawaguchi, E.: A Large Capacity Steganography Using Acoustic Dummy Data. Technical Report of IEICE, EA98-69-78 (1998) 27-32 296 [8] Kataoka, T., Tanaka, K., Nakamura, Y., Matsui, K.: Embedding a Document into Color Picture Data under Adaptive Discrete Cosine Transform Coding. Trans. of IEICE, Vol. J72-B-I (1989) 1210-1216 296 [9] Kobayashi, H., Noguchi, Y., Kiya, H.: A Method of Embedding Binary Data into JPEG Bitstreams. Trans. of IEICE, Vol. J83-D-II (2000) 1469-1476 296

Bit-Plane Decomposition Steganography

309

[10] Chung, K. L., Shen, C. H., Chang, L. C.: A Novel SVD- and VQ-based Image Hiding Scheme. Pattern Recognition Letters, Vol. 22 (2001) 1051-1058 296 [11] Rabbani, M., Joshi R.: An Overview of JPEG 2000 Still Image Compression Standard. Signal Processing: Image Communication, Vol. 17 (2002) 3-48 297, 299 [12] Skodras, A., Christopoulis, C., Ebrahimi, T.: The JPEG 2000 Still Image Compression Standard. IEEE Signal Process. Magazine, Vol. 18 (2001) 36-58 297, 299 [13] Taubman, D.: High Performance Scalable Image Compression with EBCOT. IEEE Trans. Image Process., Vol. 9 (2000) 1158-1170 299 [14] Shapiro, J. M.: Embedded Image Coding Using Zerotrees of Wavelet Coefficients. IEEE Trans. Signal Process., Vol. 41 (1993) 3445-3462 299 [15] Said, A., Pearlman, W. A.: A New, Fast, and Efficient Image Codec Based on Set Partitioning in Hierarchical Trees. IEEE Trans. Circuits and Systems for Video Technology, Vol. 6 (1996) 243-250 299 [16] http://jj2000.epfl.ch/index.html 302

Steganalysis of JPEG Images: Breaking the F5 Algorithm Jessica Fridrich1, Miroslav Goljan1, and Dorin Hogea2 1

Department of Electrical and Computer Engineering SUNY Binghamton, Binghamton, NY 13902-6000, USA {fridrich,mgoljan}@binghamton.edu http://www.ssie.binghamton.edu/fridrich 2 Department of Computer Science SUNY Binghamton, Binghamton, NY 13902-6000, USA [email protected]

Abstract. In this paper, we present a steganalytic method that can reliably detect messages (and estimate their size) hidden in JPEG images using the steganographic algorithm F5. The key element of the method is estimation of the cover-image histogram from the stegoimage. This is done by decompressing the stego-image, cropping it by four pixels in both directions to remove the quantization in the frequency domain, and recompressing it using the same quality factor as the stego-image. The number of relative changes introduced by F5 is determined using the least square fit by comparing the estimated histograms of selected DCT coefficients with those of the stego-image. Experimental results indicate that relative modifications as small as 10% of the usable DCT coefficients can be reliably detected. The method is tested on a diverse set of test images that include both raw and processed images in the JPEG and BMP formats.

1

Overview of Steganography and Steganalysis

Steganography is the art of invisible communication. Its purpose is to hide the very presence of communication by embedding messages into innocuous-looking cover objects. In today’s digital world, invisible ink and paper have been replaced by much more versatile and practical covers for hiding messages – digital documents, images, video, and audio files. As long as an electronic document contains perceptually irrelevant or redundant information, it can be used as a “cover” for hiding secret messages. In this paper, we deal solely with covers that are digital images stored in the JPEG format. Each steganographic communication system consists of an embedding algorithm and an extraction algorithm. To accommodate a secret message, the original image, also called the cover-image, is slightly modified by the embedding algorithm. As a result, the stego-image is obtained. Steganalysis is the art of discovering hidden data in cover objects. As in cryptanalysis, we assume that the steganographic method is publicly known with the F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 310-323, 2003.  Springer-Verlag Berlin Heidelberg 2003

Steganalysis of JPEG Images: Breaking the F5 Algorithm

311

exception of a secret key. The method is secure if the stego-images do not contain any detectable artifacts due to message embedding. In other words, the set of stegoimages should have the same statistical properties as the set of cover-images. If there exists an algorithm that can guess whether or not a given image contains a secret message with a success rate better than random guessing, the steganographic system is considered broken. For a more exact treatment of the concept of steganographic security, the reader is referred to [1–3]. The ability to detect secret messages in images is related to the message length. Obviously, the less information we embed into the cover-image, the smaller the probability of introducing detectable artifacts by the embedding process. Each steganographic method has an upper bound on the maximal safe message length (or the bit-rate expressed in bits per pixel or sample) that tells us how many bits can be safely embedded in a given image without introducing any statistically detectable artifacts. Determining this maximal safe bit-rate (or steganographic capacity) is a nontrivial task even for the simplest methods. Chandramouli et al. [4] give a theoretical analysis of the maximal safe bit-rate for LSB embedding in the spatial domain. Recently, Fridrich et al. [5,6] derived a more stringent estimate using dual statistics steganalysis. The choice of cover-images is important because it significantly influences the design of the stego system and its security. Images with a low number of colors, computer art, images with a unique semantic content, such as fonts, should be avoided. Aura [7] recommends grayscale images as the best cover-images. He also recommends uncompressed scans of photographs or images obtained with a digital camera containing a high number of colors, and considers them safest for steganography. The choice of the image format also makes a very big impact on the design of a secure steganographic system. Raw, uncompressed formats, such as BMP, provide the biggest space for secure steganography, but their obvious redundancy makes them very suspicious in the first place. Indeed, some researchers do not consider those formats for steganography claiming that exchanging uncompressed images is “equivalent” to using cryptography [8]. Never the less, most steganographic products available on the Internet work with uncompressed image formats or formats that compress data losslessly (BMP, PCX, GIF, PGM, and TIFF). Fridrich et al. [9] have recently shown that cover-images stored in the JPEG format are a very poor choice for steganographic methods that work in the spatial domain. This is because the quantization introduced by JPEG compression can serve as a "semi-fragile watermark" or a unique fingerprint that can be used for detection of very small modifications of the cover-image by inspecting the compatibility of the stegoimage with the JPEG format. Indeed, changes as small as flipping the least significant bit (LSB) of one pixel can be reliably detected. Consequently, one should avoid using decompressed JPEG images as covers for spatial steganographic methods, such as the LSB embedding or its variants. Despite its proven insecurity, the method of choice of most publicly available steganographic tools is the LSB embedding. This paradigm can be adapted not only to raw formats but also to palette images after pre-sorting the palette (EZ Stego [10]) and to JPEG images (J-Steg [10], JP Hide&Seek [10], and OutGuess [11]).

312

Jessica Fridrich et al.

Fridrich et al. [5,6] introduced the dual statistics steganalytic method for detection of LSB embedding in uncompressed formats. For high quality images taken with a digital camera or a scanner, the dual statistics steganalysis indicates that the safe bitrate is less than 0.005 bits per sample, providing a surprisingly stringent upper bound on steganographic capacity of simple LSB embedding. Pfitzmann and Westfeld [12] introduced a method based on statistical analysis of Pairs of Values (PoVs) that are exchanged during message embedding. For example, grayscales that differ in the LSBs only, could form these PoVs. This method, which became known as the χ2 attack, is quite general and can be applied to many embedding paradigms besides the LSB embedding. It provides very reliable results when the message placement is known (e.g., for sequential embedding). Pfitzmann [12] and Provos [13] noted that the method could still be applied to randomly scattered messages by applying the same idea to smaller portions of the image while comparing the statistics with the one obtained from unrelated pairs of values. Unfortunately, no further details regarding this generalized χ2 attack are provided in their papers, although Pfitzmann [12] reports that messages as small as one third of the total image capacity are detectable. Farid [14] developed a universal blind detection scheme that can be applied to any steganographic scheme after proper training on databases of original and coverimages. He uses an optimal linear predictor for wavelet coefficients and calculates the first four moments of the distribution of the prediction error. Fisher linear discriminant statistical clustering is then used to find a threshold that separates stegoimages from cover-images. Farid demonstrates the performance on J-Steg, both versions of OutGuess, EZ Stego, and LSB embedding. It appears that the selected statistics is rich enough to cover a very wide range of steganographic methods. However, the results are reported for a very limited image database of large, highquality images, and it is not clear how the results will scale to more diverse databases. Also, the authors of this paper believe that methods that are targeted to a specific embedding paradigm will always have significantly better performance than blind methods. Johnson and Jajodia [15] pointed out that some steganographic methods for palette images that preprocess the palette before embedding are very vulnerable. For example, S-Tools [10] or Stash [10] create clusters of close palette colors that can be swapped for each other to embed message bits. These programs decrease the color depth and then expand it to 256 by making small perturbations to the colors. This preprocessing, however, will create suspicious and easily detectable pairs (clusters) of close colors. Recently, the JPEG format attracted the attention of researchers as the main steganographic format due to the following reasons: It is the most common format for storing images, JPEG images are very abundant on the Internet bulletin boards and public Internet sites, and they are almost solely used for storing natural images. Modern steganographic methods can also provide reasonable capacity without necessarily sacrificing security. Pfitzmann and Westfeld [16] proposed the F5 algorithm as an example of a secure but high capacity JPEG steganography. The authors presented the F5 algorithm as a challenge to the scientific community at the Fourth Information Hiding Workshop in Pittsburgh in 2001. This challenge stimulated the research presented in this paper.

Steganalysis of JPEG Images: Breaking the F5 Algorithm

313

In the next section, we give a description of the F5 algorithm as introduced in [16]. Then, in Sect. 3, we describe an attack on F5 and give a sample of experimental results. The limitations of the detection method and ways to overcome those limitations are discussed in Sect. 4. The paper is concluded in Sect. 5, where we also outline our future research.

2

The F5 Algorithm

The F5 steganographic algorithm was introduced by German researchers Pfitzmann and Westfeld in 2001 [16]. The goal of their research was to develop concepts and a practical embedding method for JPEG images that would provide high steganographic capacity without sacrificing security. Guided by their χ2 attack, they challenged the paradigm of replacing bits of information in the cover-image with the secret message while proposing a different paradigm of incrementing image components to embed message bits. Instead of replacing the LSBs of quantized DCT coefficients with the message bits, the absolute value of the coefficient is decreased by one. The authors argue that this type of embedding cannot be detected using their χ2 statistical attack. The F5 algorithm embeds message bits into randomly-chosen DCT coefficients and employs matrix embedding that minimizes the necessary number of changes to embed a message of certain length. According to the description of the F5 algorithm, version 11, the program accepts five inputs: • • • • • •

Quality factor of the stego-image Q; Input file (TIFF, BMP, JPEG, or GIF); Output file name; File containing the secret message; User password to be used as a seed for PRNG; Comment to be inserted in the header.

In the embedding process, the message length and the number of non-zero non-DC coefficients are used to determine the best matrix embedding that minimizes the number of modifications of the cover-image. Matrix embedding has three parameters (c, n, k), where c is the number of changes per group of n coefficients, and k is the number of embedded bits. In their paper [16], the authors describe a simple matrix embedding (1, 2k–1, k) using a “hash” function that outputs k bits when applied to 2k– 1 coefficients. The embedding process starts with deriving a seed for a PRNG from the user password and generating a random walk through the DCT coefficients of the coverimage. The PRNG is also used to encrypt the value k using a stream cipher and embed it in a regular manner together with the message length in the beginning of the message stream. The body of the message is embedded using matrix embedding, inserting k message bits into one group of 2k–1 coefficients by decrementing the absolute value of at most one coefficient from each group by one. The embedding process consists of the following six steps: 1. 2.

Get the RGB representation of the input image. Calculate the quantization table corresponding to quality factor Q and compress the image while storing the quantized DCT coefficients.

314

Jessica Fridrich et al.

3.

Compute the estimated capacity with no matrix embedding C = hDCT – hDCT /64 – h(0) – h(1) + 0.49h(1), where hDCT is the number of all DCT coefficients, h(0) is the number of AC DCT coefficients equal to zero, h(1) is the number of AC DCT coefficients with absolute value 1, hDCT/64 is the number of DC coefficients, and –h(1)+0.49h(1) = –0.51h(1) is the estimated loss due to shrinkage (see Step 5). The parameter C and the message length together determine the best matrix embedding. The user-specified password is used to generate a seed for a PRNG that determines the random walk for embedding the message bits. The PRNG is also used to generate a pseudo-random bit-stream that is XOR-ed with the message to make it a randomized bit-stream. During the embedding, DC coefficients and coefficients equal to zero are skipped. The message is divided into segments of k bits that are embedded into a group of 2k–1 coefficients along the random walk. If the hash of that group does not match the message bits, the absolute value of one of the coefficients in the group is decreased by one to obtain a match. If the coefficient becomes zero, the event is called shrinkage, and the same k message bits are re-embedded in the next group of DCT coefficients (we note that LSB(d)= d mod 2, for d > 0, and LSB(d)=1– d mod 2, for d < 0). If the message size fits the estimated capacity, the embedding proceeds, otherwise an error message showing the maximal possible length is displayed. There are rare cases when the capacity estimation is wrong due to a larger than anticipated shrinkage. In those cases, the program embeds as much as possible and displays a warning.

4.

5.

6.

While the F5 algorithm does modify the histogram of DCT coefficients, the authors show that some crucial characteristics of the histogram are preserved, such as its monotonicity and monotonicity of increments. The F5 algorithm cannot be detected using the χ2 attack because the embedding is not based on bit-replacement or exchanging any fixed Pairs of Values. In the next section, we describe an attack on F5. It is based on the idea that one can accurately estimate the histogram of the cover-image from the stego-image. Because F5 modifies the histogram in a well-defined manner, we can calculate the number of modified coefficients by comparing the estimated histogram with the histogram of the stego-image.

3

Description of the Attack

We divided our attack on F5 into two separate parts: (1) Finding distinguishing statistical quantities T that correlate with the number of modified coefficients, and (2) Determining the baseline values of the statistics T. In fact, it is not that difficult to find a quantity that changes with embedded message length. For example, the number of coefficients equal to zero increases while the number of remaining non-zero coefficients decreases. Another measure that can be used is the “blockiness“ or the measure of discontinuity at the boundaries of the 8×8 grid. Actually, the blockiness is likely to increase for any method that embeds message bits by modifying the

Steganalysis of JPEG Images: Breaking the F5 Algorithm

315

quantized DCT coefficients of the cover-JPEG image (for example, in [17,18] we use the blockiness increase as the distinguishing quantity to successfully attack the OutGuess [11]). What is difficult, however, is finding the baseline values or their estimates for the distinguishing statistics T – the original value(s) of T for the coverimage. In the following subsection, we first analyze how F5 changes the histogram values. Then, we describe a method for obtaining the estimate of the cover-image histogram from the stego-image. We continue with a detailed description of a detection method that is capable of estimating the message length. Finally, we close Sect. 3 with experimental results and their discussion. 3.1

Analysis of Histogram Modifications

Let h(d), d = 0, 1, … be the total number of AC coefficients in the cover-image with absolute value equal to d after the image has been compressed inside the F5 algorithm (Step 2 above). In a similar manner, we denote hkl(d) the total number of AC DCT coefficients corresponding to the frequency (k, l), 1 ≤ k, l ≤ 8, whose absolute value is equal to d. The corresponding histogram values for the stego-image will be denoted using the capital letters H and Hkl. Let us suppose that the F5 embedding process changes n AC coefficients. The probability that a non-zero AC coefficient will be modified is β = n/P, where P is the total number of non-zero AC coefficients (P = h(1) + h(2) + …). Because the selection of the coefficients is random in F5, the expected values of the histograms Hkl of the stego-image are

H kl (d ) = (1 − β )hkl (d ) + βhkl (d + 1), for d > 0, H kl (0) = hkl (0) + βhkl (1),

for d = 0.

(1)

Let us further assume that we have an estimate hˆkl (d ) of the cover-image histogram

(the baseline). We can use this estimate to calculate the expected values H kl (d ) using Eq. (1) and estimate β as the value that gives us the best agreement with the coverimage histogram. We have experimented with different formulas for β and the best performance was obtained using the least square approximation. Because the first two values in the histogram (d=0 and d=1) experience the largest change during embedding (see Fig. 1), we calculate β as the value that minimizes the square error between the stego-image histogram Hkl, and the expected values Hˆ kl (d ) calculated from the estimated histogram hˆ using Eq. (1): kl

β kl = arg min [ H kl (0) − hˆkl (0) − βhˆkl (1)]2 + [ H kl (1) − (1 − β )hˆkl (1) − βhˆkl (2)]2 . β

(2)

The least square approximation in Eq. (2) leads to the following formula for β

β kl =

hˆkl (1)[ H kl (0) − hˆkl (0)] + [ H kl (1) − hˆkl (1)][(hˆkl (2) − hˆkl (1)] . hˆ 2 kl (1) + [hˆ (2) − hˆ (1)]2 kl

kl

(3)

316

Jessica Fridrich et al.

The final value of the parameter β is calculated as an average over selected lowfrequency DCT coefficients (k, l) ∈{(1,2),(2,1),(2,2)}. We decided to not include the higher frequency coefficients due to problems with potential insufficient statistics especially for small images. The reasons why we opted to work with histograms of individual low-frequency DCT coefficients rather than the global histogram will become apparent in Sect. 3.2 after we introduce the method for obtaining the cover-image histogram. 3.2

Estimating the Cover-Image Histogram

Accurate estimation of the cover-image histogram h is absolutely crucial for our detection method to work. We first decompress the stego-image to the spatial domain, then crop the image by 4 columns, and recompress the cropped image using the same quantization matrix as that of the stegoimage. The resulting DCT coefficients will provide the estimates hˆ (d ) for kl

our analysis. Because the accuracy of the estimates is the major factor influencing the detection accuracy, we include a simple preprocessing step to remove possible JPEG blocking artifacts from the Fig. 1. The effect of F5 embedding on the histogram of the cropped image before DCT coefficient (2,1) recompressing. We have experimented with several spatial blocking-removing algorithms, but the best results were obtained using a simple uniform blurring operation with a 3×3 kernel B, B 22=1−4e, B 21 = B23 = B12 = B 32 = e, and Bij = 0 otherwise. This low-pass filter helps remove some spurious non-zero DCT coefficients produced by “discontinuities” at the block boundaries, which are in the middle of the 8×8 blocks of the cropped image. According to our experiments, the estimated histogram is quite close to the histogram of the original image. We provide a simple heuristic explanation of why the method for obtaining the baseline histogram values is indeed plausible. In fact, unless the quality factor of the JPEG compression is too low (e.g., lower than 60), the stegoimage produced by F5 is still very close to the cover-image both visually and using measures, such as the PSNR. The spatial shift by 4 pixels effectively breaks the structure of quantized DCT coefficients and subsequent low-pass filtering helps to reduce any spurious frequencies due to discontinuities at block boundaries. Thus, it is

Steganalysis of JPEG Images: Breaking the F5 Algorithm

317

not surprising that the statistical properties of DCT coefficients are similar to those of the cover-image. In Fig. 1, we show a typical example of how good the histogram estimate is when compared to the histogram of the original image. The graph shows the original histogram values h21(d) (crosses), histogram values after applying the F5 algorithm with maximal possible message, or β = 0.5 (stars), and the estimate of the original histogram (circles). The main reason why we decided to use histograms of individual low-frequency DCT coefficients rather than the global image histogram is as follows. Even with the low-pass pre-filtering, the spatial shift by 4 pixels introduces some non-zero coefficients in high frequencies due to the discontinuities at block boundaries. And the values that are most influenced are 0, 1, and –1, which are the most influential in our calculations. Individual histograms of low frequency coefficients are much less susceptible to this onset of spurious non-zero DCTs. We have identified two cases when the estimated histogram obtained using the algorithm described above does not give accurate values. This may occur, for example, when the cover-image sent to F5 has already been saved in the JPEG format with a different quality factor Q1 ≠ Q, or when the image contains some regular structure with a characteristic length comparable to the block size. Fortunately, both cases can be easily identified and our detection procedure correspondingly modified to obtain accurate results in those cases as well (see Sect. 4 and 5). 3.3

Estimating the True Message Length

Once the relative number of changes β has been estimated, we may attempt to further estimate the total message length. Let n be the total number of changes in quantized DCT coefficients introduced by the F5 algorithm. We can write n as n = s + m, where s is the shrinkage (modifications that did not lead to message bits embedding), and m is the number of changes due to actual message bit embedding. The probability of selecting a coefficient that may lead to shrinkage is PS = h(1)/P. Since the coefficients are selected at random, the expected value of s is nPS. Thus, we obtain the following formula: m + nPS = n, which gives m=n(1–PS) for the number of changes due to message embedding. Assuming the (1,2k−1, k) matrix embedding, the expected number of bits per change W(k) is W (k ) =

2k k. 2k − 1

Thus, the unknown message length M can be calculated as M = W (k )m = where

2k 2k 2k kn ( 1 − P ) = k β P ( 1 − h ( 1 ) / P ) = kβ ( P − h(1)) , S 2k − 1 2k − 1 2k − 1

318

Jessica Fridrich et al.

P=

∑ i≥0

8

h(i ) ≈

∑ ∑ hˆ

kl (i )

i ≥ 0 k , l =1 k +l > 2

The parameter k can be derived from the knowledge of n = βP and m and the estimated cover-image histogram by following the algorithm of determining the optimal matrix embedding as implemented in F5. 3.4

Experimental Results

We have created a database of 20 grayscale images with dimensions ranging from as small as 469×625 pixels up to 1336×1782 pixels. The images were obtained using ten different digital cameras and two scanners, resized to a smaller, randomly chosen size, and saved as BMPs. Then, we applied the F5 algorithm with quality factor 75 so that the ratio β of modified coefficients to the number of all non-zero, non-DC coefficients was 0, 0.25, and 0.5, corresponding to an empty message embedded, 25%, and 50% of usable coefficients modified. The estimated ratio β and its distribution across the test images are depicted in Fig. 2. All three Gaussian peaks are centered very close to the true value of β and all three are very well separated. In fact, based on this statistical data, the detection threshold T = 0.125 will lead to a false detection probability of 10—8, probability of missing a message with β = 0.25 equal to 10—7, and probability of missing a message with β = 0.5 (full capacity) equal to 10—32. To find out the limits of the detection methods, we have embedded a relatively short message of 4.5kB in 10 randomly chosen test grayscale BMP images (out of 20 images) all of the same dimensions 800×600. Table 1 shows the estimated ratio βˆ and the estimated number of modifications nˆ together with the actual values β and n.

4

Eliminating the Effects of Double Compression

When the cover-image is stored in the JPEG format, the F5 decompresses it first and then recompresses with a user-specified quality factor. After that, the message is embedded in the quantized DCT coefficients. This means that the stego-image has been double compressed before embedding. The double compression can have a profound effect on the image histogram and it complicates the detection. The process of obtaining the baseline histogram from the cropped image as described in the previous section will produce a histogram similar to the broken line in Fig. 3 instead of the solid line from which the F5 started its embedding. Consequently, the estimated relative number of changes β may be quite different from the actual value. Fig. 4 shows the estimated β for a grayscale cover-image saved as JPEG with quality factors Q1 = 55 to 95. Good accuracy is only obtained for values Q1 close to the F5 quality factor of 75 and for high quality JPEGs with Q1 > 90. The estimated β is particularly inaccurate when the quality factor of the stego-image Q1 is lower than 75 (see the numbers in brackets in Table 3).

Steganalysis of JPEG Images: Breaking the F5 Algorithm

319

To address the problems with inaccurate detection when the cover-images are stored in the JPEG format, we proposed the following modification of our detection. Table 1. The number of relative modifications of DCT coefficients β = n/P and its estimate obtained using our detection method for 20 test images. Ten images contain a 4.5kB message, while the other 10 have only been compressed with F5. The absolute number of modified coefficients and its estimate are given in the last two columns

Img

β

βˆ

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

0 0.202 0 0.259 0.244 0.234 0.216 0.347 0 0 0 0.342 0.499 0 0 0.257 0 0 0.370 0.428

0.106 0.238 0.079 0.273 0.265 0.276 0.248 0.409 0.044 0.070 0.103 0.250 0.522 0.113 0.078 0.291 0.083 0.073 0.329 0.377

n 19845 20254 21401 20267 19675 24741

23589 22775

20164

23930 24278

nˆ 11846 21937 5214 19490 21011 22040 21176 25873 2570 5124 6187 15745 21531 8386 4571 20955 7222 4513 19342 19308

Fig. 2. Estimated number and distribution of relative modifications of DCT coefficients β in 20 test images. The lines correspond to the actual modifications with β = 0, 0.25, 0.5

We calculate the ratio β for a fixed set of quantization tables, {Q1, Q2, …, Qr}. For each quantization table, we run our detection scheme with one small modification – after cropping the decompressed filtered stego-image, we compress it with the quantization table Qi and immediately decompress before proceeding with the rest of the baseline histogram estimation. Then, we calculate the estimated ratio βi, i = 1, …, r in the usual manner. For each i and for each DCT mode kl, we calculate the L2 distance E(i)kl between the stego-image histogram Hkl and the histogram obtained using Eq. (1) with β = βi :

320

Jessica Fridrich et al.

E (i ) kl = [ H kl (0) − hˆkl (0) − β i hˆkl (1)]2 +

∑ [H j

kl (

j ) − (1 − β i )hˆkl ( j ) − β i hˆkl ( j + 1)]2 .

The final estimated ratio β is obtained as β = βt , where t = arg min i

∑

kl

Ekl (i ) , the

sum being taken over all low-frequency coefficients that participate in our calculations (see Sect. 3.1).

Fig. 3. Effect of double compression on the histogram of quantized DCT coefficients. The broken line is the image histogram with a single compression, the solid line after double compression with a lower quality factor being the first one. The histogram corresponds to the DCT coefficient (1,2)

Fig. 4. Estimated number of relative modifications β for a grayscale 800×600 test cover-image saved as JPEG with quality factors QF = 55 to 95, and F5 quality factor 75, as a function of QF. Circles, crosses, and stars correspond to β = 0, 0.25, and 0.5, respectively

The estimated relative number of modifications improves dramatically when the double compression detection is added to the detection routine (see Table 2). The improvement in estimates due to incorporating double compression detection and correction is quite obvious. The table shows the estimated ratio β obtained without considering the effects of double compression (in brackets), and β calculated using the extended detection algorithm as described above. Although the overall accuracy of the estimated ratio β is somewhat lower when compared to the results obtained for cover-images that were not JPEG compressed, the results indicate that a reasonably accurate detection is still possible. Another case of test images that may produce large errors in our detection scheme are images that exhibit very different block frequency characteristics after the cropping. This “spatial resonance” may occur when the cover-image contains some regular structure with a characteristic length comparable to the block size, such as the metal grid in Fig. 5. Fortunately, it is easy to identify such images both visually and algorithmically and take appropriate measures. One possibility is to use those frequency modes that are most stable with respect to cropping and avoid those that exhibit strong resonant behavior. In our tests, we have encountered only two images with spatial resonance among hundreds of images randomly selected from different sources.

Steganalysis of JPEG Images: Breaking the F5 Algorithm

321

Table 2. Estimated β obtained with double compression correction and without (in brackets)

Image kangaroo.jpg portrait.jpg mcdonalds.jpg kobe_pyramid.jpg bday.jpg

Dimensions 533×800 469×625 960×1280 697×1045 1050×1400

β = 0.00 0.02 (−0.10) −0.01 (0.14) −0.02 (0.13) 0.02 (0.06) 0.17 (−0.13)

β = 0.25 0.26 (0.15) 0.23 (0.48) 0.24 (0.41) 0.28 (0.31) 0.37 (0.14)

β = 0.50 0.47 (0.35) 0.44 (0.79) 0.50 (0.65) 0.53 (0.59) 0.56 (0.42)

Fig. 5. Example of an image with spatial resonance. The same image cropped by 4 and 4 pixels has very different block frequency characteristics than the original image

5

Conclusion

In this paper, we present an attack on the F5 steganographic algorithm as proposed by Pfitzmann and Westfeld in [16]. The attack is based on the idea that it is possible to estimate the cover-image histograms of individual low-frequency DCT modes by cropping the decompressed stego-image by 4 and 4 pixels and recompressing it again using the stego-image quantization matrix. After these baseline histograms are obtained, we determine the relative number of modified non-zero non-DC coefficients β as the value that minimizes the least square error between the stego-image histograms and the histograms obtained by embedding a message that leads to exactly β modifications. The detection algorithm estimates β, which can consequently be turned into an estimate of the secret embedded message. When the cover-image is in some other format that the JPEG format, the detection results are very reliable and accurate. We demonstrated the performance of our detection method on a test database consisting of 20 grayscale images obtained with different digital cameras and scanners with various dimensions. The experimental results indicate that the detection threshold T = 0.125 leads to the probability of a false detection 10—8, probability of missing a message with β = 0.25 equal to 10—7, and probability of missing a message with β = 0.5 (full capacity) equal to 10—32.

322

Jessica Fridrich et al.

When the cover-images are stored in the JPEG format, the detection method must be modified to accommodate the effects of double JPEG compression produced by the embedding. The F5 always decompresses the cover-image and recompresses it using a user-defined quality factor. This leads to artifacts in coefficient histograms (jaggedness) that may introduce quite large detection errors. Fortunately, the previous JPEG compression can be estimated from the stego-image and the same compression/decompression that occurred prior to applying the F5 can be carried out for the cropped stego-image before deriving the estimated histograms for comparison. This small modification of the detection algorithm dramatically improves the performance and makes the accuracy and reliability of our results independent of the cover-image format. The method for obtaining the cover-image histogram by cropping and low-pass filtering can in fact be used for designing detection mechanisms for other steganographic schemes that manipulate quantized DCT coefficients. We can use different statistical quantities rather than first-order statistics in the frequency domain to obtain their baseline values. For example, the increase of “blockiness” (the sum of spatial discontinuities at block boundaries) during embedding can be used as the distinguishing quantity for OutGuess [11]. Using this measure, we have been able to successfully attack OutGuess [17,18]. The blockiness measure increases with embedding for most steganographic schemes for JPEGs independently of their inner mechanisms. This opens up a new direction in steganalysis of JPEG images that yet needs to be further explored.

Acknowledgement The work on this paper was supported by Air Force Research Laboratory, Air Force Material Command, USAF, under a research grant number F30602-00-1-0521. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation there on. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of Air Force Research Laboratory, or the U. S. Government.

References [1] [2]

[3]

Anderson, R.J. and Petitcolas, F.A.P.: On the Limits of Steganography. IEEE Journal of Selected Areas in Communications: Special Issue on Copyright and Privacy Protection), Vol. 16(4) (1998) 474−481 Cachin, C.: An Information-Theoretic Model for Steganography. In: Aucsmith D. (eds.): Information Hiding: 2nd International Workshop. Lecture Notes in Computer Science, Vol. 1525. Springer-Verlag, Berlin Heidelberg New York (1998) 306–318 Katzenbeisser, S. and Petitcolas, F.A.P.: On Defining Security in Steganographic Systems. Proceedings of SPIE: Electronic Imaging 2002, Security and Watermarking of Multimedia Contents, Vol. 4675. San Jose, California (2002)

Steganalysis of JPEG Images: Breaking the F5 Algorithm

[4] [5] [6] [7]

[8] [9] [10] [11] [12]

[13] [14] [15] [16]

[17] [18]

323

Chandramouli, R. and Memon, N.: Analysis of LSB Based Image Steganography Techniques. Proceedings of ICIP 2001 (CD version). Thessaloniki, Greece (2001) Fridrich, J., Goljan, M., and Du, R.: Reliable Detection of LSB Steganography in Grayscale and Color Images. Proc. of ACM: Special Session on Multimedia Security and Watermarking. Ottawa, Canada (2001) 27–30 Fridrich, J., Goljan, M., and Du, R.: Detecting LSB Steganography in Color and Grayscale Images. Magazine of IEEE Multimedia: Special Issue on Security, Vol. Oct-Dec (2001) 22–28 Aura, T.: Practical Invisibility in Digital Communication. In: Anderson, R.J. (eds.): Information Hiding: 1st International Workshop. Lecture Notes in Computer Science, Vol.1174. Springer-Verlag, Berlin Heidelberg New York (1996) 265−278 Eggers, J.J., Bäuml, R., and Girod, B.: A Communications Approach to Image Steganography. Proceedings of SPIE: Electronic Imaging 2002, Security and Watermarking of Multimedia Contents, Vol. 4675. San Jose, California (2002) Fridrich, J., Goljan, M., and Du, R.: Steganalysis Based on JPEG Compatibility. Proc. SPIE Multimedia Systems and Applications IV, Vol. 4518. Denver, Colorado (2001) 275–280 Steganography software for Windows, http://members.tripod.com/steganography/stego/ software.html Provos, N.: Defending Against Statistical Steganalysis. Proc. 10th USENIX Security Symposium. Washington, DC (2001) Westfeld, A. and Pfitzmann, A.: Attacks on Steganographic Systems. In: Pfitzmann A. (eds.): 3rd International Workshop. Lecture Notes in Computer Science, Vol.1768. Springer-Verlag, Berlin Heidelberg New York (2000) 61−75 Provos, N. and Honeyman, P.: Detecting Steganographic Content on the Internet. CITI Technical Report 01-11. (2001) Farid, H.: Detecting Steganographic Message in Digital Images. Technical Report, TR2001-412. Dartmouth College, New Hampshire (2001) Johnson, N.F., Duric, Z., and Jajodia, S.: Information Hiding: Steganography and Watermarking - Attacks and Countermeasures. Kluwer Academic Publishers, Boston Dodrecht London (2000) Westfeld, A.: High Capacity Despite Better Steganalysis (F5–A Steganographic Algorithm). In: Moskowitz, I.S. (eds.): Information Hiding. 4th International Workshop. Lecture Notes in Computer Science, Vol.2137. Springer-Verlag, Berlin Heidelberg New York (2001) 289–302 Fridrich, J., Goljan, M., and Hogea, D.: Attacking the OutGuess. Proc. ACM: Special Session on Multimedia Security and Watermarking, Juan-les-Pins, France (2002) Fridrich, J., Goljan, M., and Hogea, D.: New Methodology for Breaking Steganographic Techniques for JPEGs. Submitted to SPIE: Electronic Imaging 2003, Security and Watermarking of Multimedia Contents. Santa Clara, California (2003)

Detecting Low Embedding Rates
Andreas Westfeld Institute for System Architecture, Technische Universit¨ at Dresden 01062 Dresden, Germany [email protected]

Abstract. This paper shows three approaches for detecting steganograms with low change density. MP3Stego is a steganographic algorithm with a very low embedding rate. The attack presented here is a statistical analysis of block sizes. It is able to detect 0.001 % of steganographic payload in MP3 files. The second approach is the use of hash functions to combine sample categories for the chi-square attack. One of these hash functions enables us to detect about 0.2 bits per pixel in true colour images. Another algorithm (Hide) was presented at the last workshop and constructed to be secure against visual and statistical chi-square attacks. The detection method for Hide combines the three colour components of each pixel to recognise an increased number of “neighbour colours”.

1

Introduction

Steganographic tools change bits in a carrier medium to embed a secret message. Whether these changes are noticeable to an attacker or not, depends on many different things. The embedding function must keep certain properties the attacker knows about carrier media. If an attacker has a better model for the carrier media, the person who implements the tool cannot be sure about the security of the algorithm. There are two kinds of attacks: On the one hand there are attacks that prove the use of a steganographic tool without error, e. g. specially produced palettes that occur only with S-Tools resp. Mandelsteg and so on [5]. On the other hand, most statistical attacks have a probability of error larger than 0. If we embed less and spread the changes over the carrier medium we decrease the change density. The lower the change density the higher the probability of error. A lower change density decreases the probability of detection, although this decreases the steganographic capacity as well. As we will see, the question is not how much data is embedded, but how much the carrier is changed. Sect. 2 gives an example of a tool with only limited steganographic payload (less than 0.1 %), and with surprisingly strong changes per embedded bit—although imperceptible by human ears. Maybe its low capacity kept away potential attackers. (Some years ago, I looked at this tool through the glasses of one specific vulnerability


This work is supported by the German Federal Ministry of Economics and Technology (BMWi).

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 324–339, 2003. c Springer-Verlag Berlin Heidelberg 2003


Detecting Low Embedding Rates

325

that many simple tools have. But this attack did not match the embedding algorithm of MP3Stego.) The main issue of Sect. 3 is the definition of categories for the chi-square attack. Building a direct histogram of samples will lead to a significant statement only if there are at least 97 % of the samples steganographically used. This is the case if the message was continuously embedded, or if we know the embedding places. It is necessary to guarantee one embedded bit per observed value. Finally, Sect. 4 explains an attack on Hide, a steganographic tool presented by Sharp [11] at the last workshop. Hide uses an algorithm secure against statistical chi-square attacks [12]. It does not simply overwrite the least significant bits. Nevertheless, it is detectable.

2

MP3Stego

MP3Stego is a modified version of the 8HZ-mp3 [1] encoder. It reads Windows WAV files (RIFF-WAVE-MSPCM) and encodes them as MPEG Audio Layer-3. WAV files from audio CDs typically contain digital audio signals that consist of 16 bit samples recorded at a sampling rate of 44.1 kHz. So we end up with 2 × 705.6 kbits/s in these WAV files. Using the command encode example.wav example.mp3 these sound data are reduced by a factor of 11. The resulting MPEG Layer-3 stream in the MP3 file still maintains the same sound quality with only 128 kbits/s. This is realised by perceptual coding techniques addressing the perception of sound waves by the human ear. Compared with other audio coding schemes, MP3 files achieve the highest sound quality for a given bit rate. Because of this, the MP3 file format is very popular and it is a great idea to use it for steganography. With MP3Stego [6] we can embed a file (e. g. hidden.txt) in the Layer-3 stream while encoding a WAV file. In a first step, the tool compresses the file to hide using zlib [9]. A passphrase (e. g. abc123) is used to encrypt the compressed message with triple-DES and to dilute the changes pseudo-randomly: encode -E hidden.txt -P abc123 example.wav example.mp3 The heart of a Layer-3 encoder is a system of two nested iteration loops for quantisation and coding. The inner iteration loop (cf. Fig. 1) finds the optimal quantisation parameter (q factor). If the number of bits resulting from the quantisation (block length) exceeds the number of bits available to code a given block of data (max length), this can be corrected by adjusting the global gain to result in a larger q factor. The operation is repeated with increasing q factor until the resulting block is smaller than max length. Without embedding, the iteration will end as soon as the block length is not larger than the specified max length. The parameter hidden bit is 2 if a block should bypass the steganographic processing after finding this optimal size.

326

Andreas Westfeld

int inner_loop(int max_length, int *q_factor, int hidden_bit) { int block_length; *q_factor -= 1; /* increase q_factor until block_length max_length) || embed_rule); return block_length; }

Fig. 1. The modified inner iteration loop of the Layer-3 encoder (simplified) 2.1

Embedding Algorithm

In case hidden bit is 0 or 1, the inner iteration loop will continue until a q factor is found that produces an even or odd block length respectively. The final block length is not larger than the specified max length. (In rare cases this is an endless loop if the block length is already 0 and hidden bit is 1.) We should take into consideration that incrementing the q factor by 1 does not automatically flip the least significant bit (LSB) of the block length. In most cases the block length will decrease by a value larger than one. So if we want to embed a hidden bit, the LSB of the block length could remain the same for several iterations. The per track maximum of such unsuccessful series is 12. . . 18 (consecutive) iterations on an average CD. Although the quality of some frames is artificially decreased by messages embedded with MP3Stego, you probably need golden ears to notice that. Without the original music file it is difficult to distinguish between background noise and steganographic changes. 2.2

Detection by Block Length Analysis

The length of steganographically changed blocks is smaller than one quantisation step size below the upper bound max length, i. e. smaller than necessary for the requested bit rate. If max length were fixed, an MP3 file bearing a steganographic message would have a lower bit rate than a clean one. Then we could

Detecting Low Embedding Rates Frequency

Frequency

2500

2500

2000

2000

1500

1500

1000

1000

500

500

0

0

1

2

3

4

5

6

7

8

9

10 11 30 block length/100

0

0

1

2

3

4

5

6

7

8

9

327

10 11 30 block length/100

Fig. 2. Histogram of block length without steganography (left) and with the maximum of embedded data (right) just calculate the bit rate (or the mean value of the block lengths) to detect steganographic changes. Unfortunately, max length is adjusted from frame to frame by the rate control process to bring the bit rate of the blocks in line with the requested average (default 128 kbps). Every time the block length is steganographically decreased, the following blocks are larger to equalise the bit rate. At the end, the steganographic MP3 file and a clean version from the same WAV file have equal size. Although the mean value is the same, the variance is increased. The histograms in Fig. 2 show that there is a peak at 7 (i. e. blocks with 700–799 bits), and two accumulations at 0 and 30 (0–99/3000–3099). There are some seconds of quietness between tracks. Each frame of digital silence contains one block of 3056 bits and three zero-length blocks. So the first and last accumulation in the histogram is caused by the pause at the end of the track. For detection of steganography we will only consider block lengths between 100 and 3000 bits, so that we get a unimodal distribution with an expected block length of 764 bits. 2 lengths n, To calculate the variance
s we need the count of considered
block the sum of block lengths x, and the sum of their squares x2 :
s = 2


x2 − n1 ( x)2 n−1

As mentioned earlier, the max length is adjusted from block to block to get the requested average bit rate. The initial value of max length is 764, which is the ideal block length for 128 kbits/s. Since max length is only the upper limit for the blocks, the first frames of the MP3 file are shorter than the average. After getting too large, the value of max length swings in to 802 bits (or some more in case something is embedded). This oscillation of max length causes a stronger variance of the block length at the start of the MP3 file. Hence, the variance depends also on the file length. Figure 3a shows the result of four test series with 25 tracks from a mixed CD:

328

1. 2. 3. 4.

Andreas Westfeld

one one one one

without a message, with an empty message, with 0.01 % steganographic contents, and with 0.05 % relative to the length of the MP3 file.

All messages were pseudo-random. MP3Stego can embed 0 bytes as the shortest message. However, this does not mean that the MP3 file remains unchanged. Because every message is compressed using zlib to eliminate the redundancy before it is embedded, there are effectively more than 0 bits to embed. If we compress a file with 0 bytes using zlib we get 24 bytes. MP3Stego embeds these together with 4 extra bytes to store the length of the message. The resulting 28 bytes are about 2 % of the maximum capacity in a 3 MB MP3 file, or 0.001 % of the carrier file size. Even this low embedding rate is visually

15000

0.05 % steganographic 0.01 % steganographic minimum embedded nothing embedded

0

5000

Variance

25000

a)

500

1000

1500

2000

2500

3000

2500

3000

File Size/KB

6000

b)

4000 3000 1000

2000

Variance

5000

minimum embedded (28 bytes) nothing embedded − P(embed)=0.5: 983676888 + 1003.075 variance = size

500

1000

1500

2000

File Size/KB

Fig. 3. The variance of the block length depends on the file size and payload

Detecting Low Embedding Rates

329

Fig. 4. a) Other encoders have different bit rates, or b) a characteristic rate control process, or c)produce the same bit rate like MP3Stego but are d ) otherwise distinguishable by quadratic discriminance analysis. e ) low variance in a clean MP3 file f ) strong oscillation caused by 224 embedded bits (zlib-compressed zero-length file)

+

different in Fig. 3b. A curve of type "Alsize B" separates all cases correctly (a posteriori). Now, the attack already has a good selectivity, especially if we restrict it to the first part of MP3 files, say 500 KB. However, for an attack under ''real world circumstances" we have t o recognise that a file was created using an 8HZ compatible application ([I],[6]) and not one of the many other implementations of MP3 encoders with their own characteristics of variance.

2.3

How T o Distinguish Encoders

Figure4a shows 1308 MP3 files of unknown origin classified by their bit rate and size. Most of these files are on the stroke at 128kbits/s, together with the MP3Stego files (black bullets). Each black bullet actually stands for three MP3Stego files: The clean version is at the same position in the diagrams as

330

Andreas Westfeld

the versions with minimum and maximum payload. If we zoom to bit rates between 127.5 and 128.5 kbits/s (Fig. 4b) we discover that it is not just one stroke but many different curves. Probably every encoder has its own characteristic rate control process. The curve in Fig. 4c is the interpolated characteristic of MP3Stego. There is only a small subset (55 of 1308) with questionable files that could come from MP3Stego. But lets move from the macroscopic properties bit rate and file size to individual block lengths. The following autoregressive model explains one block size by its two predecessors. blocki = β0 + β1 · blocki−1 + β2 · blocki−2 It is still possible to distinguish the questionable subset of unknown origin from files encoded with MP3Stego regardless whether there is something embedded. We apply the autoregressive model to the individual block lengths of a questionable file first. A quadratic discriminance analysis (QDA) with the coefficients β0 , β1 , and β2 can tell us whether it matches the MP3Stego rate control process or not (Fig. 4d). 2.4

Estimating the Size of Embedded Text

In addition, we can use a plot of consecutive block lengths (Fig. 4e and f) to estimate the size of the embedded message. Although the steganographic changes are not dense—only up to 60 % of the blocks are used—the message bits are not uniformly spreaded over the whole MP3 file but randomly diluted with the ratio 3 : 2 (3 used, 2 skipped). We can use the following formula to estimate the length of the embedded message in bits: message length/bits ≈ 0.6 · last dirty block index

3

Chi-square Attack Despite Straddling

The statistical chi-square attack [12] reliably discovers the existence of embedded messages that are embedded with tools which simply replace least significant bits (LSBs). However, if the embedded message is straddled over the carrier medium, and if less than 97 % of the carrier medium is used, a direct histogram of sample values will not lead to a satisfactory result. So we have to know either the embedding sequence (which we probably do not without a secret key), or change the categories of samples to guarantee one embedded bit per observed value. After modifying these categories, the attack gives significant results even if only one third of the steganographic capacity is used. It can even detect a difference between clean and steganographic images with only 5 to 10 % of the capacity used. There have been other attempts to generalise the chi-square attack to allow the detection of messages that are randomly scattered in the cover media. The most notable is the work of Provos and Honeyman [8], and Provos [7]. Instead of increasing the sample size and applying the test at a constant position, they

Detecting Low Embedding Rates

331

Table 1. The p-value (in %) depends on the part of the capacity that is used

hash a1 (w/o hash) a1 + a2 a1 ⊕ a2 a1 ⊕ 3a2 a1 + a2 + a3 a1 ⊕ a2 ⊕ a3 a1 ⊕ 3a2 ⊕ 5a3 a1 + 3a2 + 5a3

Exploitation of the steganographic capacity (%) 100 95 94 50 33 25 16 10 5 0 100 68.8 1.85 — — — — — — — 100 99.9 99.8 99.5 38 4.5 0.6 — — — 100 100 100 99.9 1.0 0.1 — — — — 100 100 100 2.3 — — — — — — 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 90.6 91.7 66.1 37.7 12.6 2.5 100 100 100 99.9 76.1 33.9 7.4 1.1 — —

use a constant sample size but slide the position where the samples are taken over the entire range of the image. Using the extended test they are able also to detect messages that are not continuously embedded but spread in the carrier. However, the resulting p-value of the chi-square test is not significant, i. e. most of the time it is jumping in the range between 0.05 and 0.95. Here, we unify several observed values to one with the legitimate hope to get one steganographically used value on average. For example, if somebody uses 50 % of the steganographic capacity, only every second observed value is used for the secret message. In this case we have to combine two observed values to one, so that we can expect one steganographic bit in the combined sample. With the use of 33 % we have to combine three observed values for the same expectation. 3.1

Experiments

The experiments in Table 1 show that the resulting p-value all depends on how we unify the categories, i. e. which operation we use to combine the values. The table contains the results for 10 versions of a true colour image with different steganographic message sizes. 100 % exploitation of the steganographic capacity means that the steganographic algorithm replaced every LSB in all pixels with pseudorandom message bits (3 bits per pixel). 95 % means that the algorithm used only a subset of the LSBs and skipped 5 % of them. The column with 0 % exploitation contains the results for the carrier medium (without any embedded message). The 9 steganograms were created using S-Tools, although it does not matter which tool overwrites the LSBs in true colour images. The ai denote periodic sample values. The first line in Table 1 lists the results for the direct samples. Then there are three experiments for hashing each two consecutive samples, and four experiments for hashing each three samples. Let b1 , b2 , . . . , bn be the n bytes of the image content, i. e. the observed values. The different hash functions combine the sample values as follows:

332

Andreas Westfeld

a1 : a1 + a2 : a1 ⊕ a2 : a1 ⊕ 3a2 : a1 + a2 + a3 : a1 ⊕ a2 ⊕ a3 : a1 ⊕ 3a2 ⊕ 5a3 : a1 + 3a2 + 5a3 : 3.2

b1 , b2 , b3 , . . . b1 + b2 , b3 + b4 , b5 + b6 , . . . b1 ⊕ b2 , b3 ⊕ b4 , b5 ⊕ b6 , . . . b1 ⊕ 3b2 , b3 ⊕ 3b4 , b5 ⊕ 3b6 , . . . b1 + b2 + b3 , b4 + b5 + b6 , b7 + b8 + b9 , . . . b1 ⊕ b2 ⊕ b3 , b4 ⊕ b5 ⊕ b6 , b7 ⊕ b8 ⊕ b9 , . . . b1 ⊕ 3b2 ⊕ 5b3 , b4 ⊕ 3b5 ⊕ 5b6 , b7 ⊕ 3b8 ⊕ 5b9 , . . . b1 + 3b2 + 5b3 , b4 + 3b5 + 5b6 , b7 + 3b8 + 5b9 , . . .

Conclusions

It turns out that the hash values a1 + a2 + a3 and a1 ⊕ a2 ⊕ a3 do not distinguish anything. This wants to remind us of the “power of parity”: Anderson and Petitcolas suggested not to embed each bit in a single pixel, but in a set of them, and embed the ciphertext bit as their parity [2]. If a bit of ai is “1” with probability 0.6, then the probability that the same bit of a1 ⊕ a2 will be 1 is 0.48; if we move to a1 ⊕ a2 ⊕ a3 , it is 1 with probability 0.504, and so on. The more observed values we combine, the more equalised our histogram will be. However, the chi-square attack works because the histogram of observed values in cover media is not equalised, but pairs in steganograms are. That’s probably also the reason why all experiments to hash four values were not successful. We can deduce the following rules from the experiments: 1. The combination of observed values should not increase the number of categories too much. Otherwise they are underpopulated. Example: If the hash function simply concatenates the observed values (e. g., 256 · a1 + a2 ), we increase the number of categories by a factor of 256 (and divide the mean population by 256). The minimum theoretically expected frequency in a category of the chi-square test must be at least 5. This would require a population of 1280 or more for a1 and a2 . 2. The unification should keep a lot of the entropy from the single values. A lossless unification means to keep all the bits, e. g., by concatenation. But a simple concatenation (cf. a), where we xor only the LSBs (s = x ⊕ y), increases the number of categories and contradicts the first rule. So we need to reduce the information of the higher bits using a hash function (cf. b). The best hash function found is a linear combination with small odd factors: – The factors have to be different to equalise the entropy of the bits in the single values. Example: If bit 6 of the sample values has more information than bit 7, we lose less information if we combine bit 6 with bit 7, instead bit 6 with bit 6. – The factors have to be small to keep the number of categories small. – They have to be odd to project the sum of the LSBs into the LSB.

Detecting Low Embedding Rates

333

This distinguishes best between “low embedding rate” and “nothing embedded.” a)

A

x “∪◦ ”

B

y

→

A

b)

A

x “∪⊕ ”

B

y

→

hash(A, B)

B

s

s

3. It has a favourable effect if the observed values are locally close to each other. Because the colour and brightness of close pixels correlates stronger than that of more distant, less entropy is destroyed by combining them: Our hash function selects limited information from several values. If we consider one value, another value in the neighbourhood adds less information than one more distant. If we can only keep a limited amount of information, we discard less when we have less before. In true colour images it is better to combine the red and the green component of one pixel, rather than two red (or green) components of neighbouring pixels. An explanation of this might be, that they correlate stronger, because two colour components of one pixel have a local distance of 0. The example in Fig. 5 illustrates the conversion of the most suitable variant a1 + 3a2 + 5a3 into code that hashes all three colour components of a pixel for the histogram.

int histogram=new int[256]; for (int line=0; line |Cm+1 | (or 2|C0 | > |C1 | for (6)) holds under rather relaxed conditions. Let U and V be discrete random variables corresponding to the

360

Sorina Dumitrescu et al.

first and second values of the sample pairs of P that have joint probability mass function (pmf) P (u, v). Consider the difference between U and V , a new random variable Z = U − V . Then the probability mass function of Z, PZ (z), is a projection of the joint pmf P (u, v) in the direction (1, 1). If the sample pairs of P are drawn at random, then clearly PZ (z) has zero mean since E{U } = E{V }. Further, a sufficient condition for the probability P (|U − V | = m) to be monotonically decreasing in m, i.e., for |Dm+1 | > |Dm | and |Cm | > |Cm+1 | to hold, is that PZ (z) is unimodal and peaks at mean. This condition is satisfied by a large class of joint distributions, including the family of Kotz-type elliptical joint distributions P (u, v) = α(r, s)|Σ|−1/2 exp{−r[((u, v) − (µu , µv ))Σ −1 ((u, v) − (µu , µv )) ]s }(7) where r and s are constants, and α is a scaling function in r and s to make P (u, v) a probability function. This family includes the joint Gaussian distribution as a special case. If P consists of spatially adjacent sample pairs rather than randomly drawn, then |Di | even has an exponential decay in i (see Fig. 5 for a preview of the distribution in practice). For proving that the actual value of p equals the smaller of the two real roots of equation (5) it suffices to show that p≤

    | − |D2m+2 | + 2|Y2m+1 | − 2|X2m+1 |) (|D2m . |Cm | − |Cm+1 |

(8)

The right side of the above inequality represents the semisum of the two solutions of equation (5). Relation (8) is equivalent to p≤

    (|Cm | − |Cm+1 | + |Y2m+1 | − |X2m−1 | + |Y2m+3 | − |X2m+1 |) . |Cm | − |Cm+1 |

(9)

Using (26) and |Cm | > |Cm+1 |, (9) becomes (p − 1)(|Cm | − |Cm+1 |) ≤ (1 − p)(|Y2m+1 | − |X2m−1 | + |Y2m+3 | − |X2m+1 |) (10) Applying (1), the above inequality reduces to 0 ≤ (1 − p)(|D2m | − |D2m+2 |).

4

(11)

Accuracy of Estimated Hidden Message Length

In this section we examine the factors that influence the robustness of the steganalytic technique developed above, and suggest ways of improving the accuracy of estimated hidden message length. Given a chosen multiset P of sample pairs, the proposed LSB steganalytic technique hinges on assumption (1). The accuracy of the estimated hidden message length pˆ made by (5) or (6) primarily depends on the actual difference "m = |X2m+1 | − |Y2m+1 |.

(12)

Detection of LSB Steganography via Sample Pair Analysis

361

0.5

0.45

0.4

0.35

0.3

0.25

0.2

0.15

0.1

0.05

0

0

20

40

60

80

100

120

Fig. 3. Solid line: relative error |"m |/(|X2m+1 | + |Y2m+1 |) for 0 ≤ m ≤ 50; Dash
line: the percentage of |X2m+1 | + |Y2m+1 | in 127 m=0 (|X2m+1 | + |Y2m+1 |). Note the exponential decay of |X2m+1 | + |Y2m+1 | An immediate reaction to this observation is to compute the estimate pˆ with (5) or (6) for an m value such that |"m | is as small as possible. For natural signals that have reasonably smooth waveforms, the smaller the value of m, the smaller the difference |"m |. In Fig. 3 we plot the value |"m | |X2m+1 | + |Y2m+1 | averaged over 29 continuous-tone test images as a function of m. However, a more robust estimate of hidden message length can be obtained by combining trace multisets for a range of m values in which |"m | is small. For arbitrary 1 ≤ i ≤ j ≤ 2b−1 − 1, the finite-state machines of Fig. 1 for Cm , 1 ≤ m ≤ 2b−1 − 1, can be combined and extended to ∪jm=i Cm by replacing the trace multisets X2m−1 , X2m , Y2m , Y2m+1 with ∪jm=i X2m−1 , ∪jm=i X2m , ∪jm=i Y2m , ∪jm=i Y2m+1 respectively. We say that the multiset ∪jm=i Cm is unbiased if the four unions of trace multisets considered above are unbiased. The advantage of combining multiple trace multisets for different m values is that E{| ∪jm=i X2m+1 |} = E{| ∪jm=i Y2m+1 |}

(13)

is a more relax condition to satisfy than (1) with respect to individual m. In other
words, | jm=i "m | tends to be significantly smaller than |"m | for a fixed m, which

362

Sorina Dumitrescu et al.

−3

x 10

13 12 11 10 9 8 7 6 5 4 3 0

20

40

Fig. 4. Relative error of (13):

60

80

||∪jm=0 X2m+1 |−|∪jm=0 Y2m+1 || |∪jm=0 X2m+1 |+|∪jm=0 Y2m+1 |

100

120

, j = 0 . . . 127. Solid line:

the case of randomly chosen sample pairs in P; Dotted line: the case of spatially adjacent sample pairs in P is a determining factor of the accuracy of the proposed steganalytic approach as we will see shortly. Note that (13) does not require that (1) holds for all m. Instead, (13) only requires that for a sample pair (u, v) ∈ P with u and v of different parity, the even value of u and v has equal probability to be larger or smaller than the odd value of u and v. This is true for natural signals. To corroborate on this assertion we plot in Fig. 4 the value || ∪jm=0 X2m+1 | − | ∪jm=0 Y2m+1 || | ∪jm=0 X2m+1 | + | ∪jm=0 Y2m+1 |

as a function of j. The statistics of Fig. 4 is collected from the 29 test images of our experiment (see Section 5). The graph shows that in general, the more terms included in the summation of (13), the more accurate it becomes, up to m = 30. The error of (13) starts to increase when m > 30 due to rarity of sample pairs of large differences. Another important observation is that (13) is far more accurate if P consists of spatially adjacent sample pairs than if it consists of randomly chosen sample pairs. As we saw above, the four unions of trace multisets ∪jm=i X2m−1 , ∪jm=i Y2m+1 , j ∪m=i X2m , and ∪jm=i Y2m have the same finite-state machine structure as in Fig. 1. Based on this finite-state machine structure, the statistical relation

Detection of LSB Steganography via Sample Pair Analysis

363

of (13), and the fact that the multisets ∪jm=i Cm and ∪j+1 m=i+1 Cm are unbiased if LSB steganography is done via random embedding, we can derive, in analogous way to Appendix A, the following more robust quadratic equations for estimating p: p2 4

  (|Ci | − |Cj+1 |) − p2 [|D2i | − |D2j+2 |+
j   | − |X2m+1 |)] + 2 m=i (|Y2m+1


j

 m=i (|Y2m+1 |

 − |X2m+1 |) = 0, i ≥ 1.

(14)

In fact, by summing up (5) for consecutive values of m, 1 ≤ i ≤ m ≤ j ≤ 2b−1 −2, we can also arrive at (14). Similarly, based on (13) and the assumption that the multisets C0 , ∪jm=1 Cm b−1 and ∪j+1 − 2, which is true for random m=1 Cm are unbiased for 0 = i ≤ j ≤ 2 LSB embedding, we have p2 4 (2|C0 |

 − |Cj+1 |) − p2 [2|D0 | − |D2j+2 |+


j

  m=0 (|Y2m+1 | − |X2m+1 |)]   m=0 (|Y2m+1 | − |X2m+1 |) = 0,


j

2

+ i = 0.

(15)

We can solve either of the two quadratic equations in p, depending on the start index value i, for the smaller root that is the estimated p. Next we develop a bound on the estimation error of (14) and (15). The error bound is a function of the actual differences "m = |X2m+1 | − |Y2m+1 |, 0 ≤ m ≤ 2b−1 − 2. For 1 ≤ i ≤ j ≤ 2b−1 − 2, denote
2 jm=i "m eij = , |D2i | − |D2j+2 |

(16)

(17)

and for 0 = i ≤ j ≤ 2b−1 − 2, denote e0j


2 jm=0 "m . = 2|D0 | − |D2j+2 |

(18)

Mention that, under some very easy to met assumptions, the denominator of eij is positive. We can bound the estimation error as below |p − pˆ(i, j)| ≤

2|eij | (1 − p), 1 − eij

(19)

for all 0 ≤ i ≤ j ≤ 2b−1 − 2, where pˆ(i, j) is the estimated value of p obtained by solving (14) (when i ≥ 1) or (15) (when i = 0), provided that eij < 1 and the LSB embedding is done randomly in the time or spatial domain of the signal. The derivation of error bound (19) is given in Appendix B.

364

Sorina Dumitrescu et al.

0.3

0.2

2i

Percentage of |D | with respect to |P|

0.25

0.15

0.1

0.05

0

0

5

10

15

20 i

25

30

35

40

Fig. 5. Probability function P (|D2i |) for spatially adjacent sample pairs (solid line), and for randomly selected sample pairs (dotted line). The sample statistics is collected from a set of 29 continuous-tone images To reduce estimation error we want to make |eij | small. In other words,
j we would like to reduce | m=i "m | and increase |D2i | − |D2j+2 |. Observe from
j Fig. 4 that | m=i "m | decreases in general as the difference between i and j increases. But more critically to robust estimation of p, given an i, the larger the distance j − i, the larger the difference |D2i | − |D2j+2 |. This is because |D2i | is a monotonically decreasing function in i (see Fig. 5). Therefore, we should let i = 0 and choose a sufficiently large j in (15) to obtain robust estimate of p. The estimate accuracy is also affected by the way how the sample pairs of the multiset P are chosen. Appendix C shows that the more the two values of sample pairs are correlated, the faster |Di | decreases in i. This means that given i and j, |D2i | − |D2j+2 |, the denominator of (17), are larger if the sample pairs of P are drawn from closer positions of a signal waveform. Consequently, for more robust estimate of p the members of multiset P should be pairs of two spatially adjacent samples (assuming the signal source is Markov). This reasoning is well corroborated in practice. To illustrate this fact we plot in Fig. 5 the probability mass function of P (|D2i |) against all possible i values for two different multisets P: one consisting of spatially adjacent sample pairs, and the other consisting of randomly selected sample pairs.

Detection of LSB Steganography via Sample Pair Analysis

365

The analysis of Appendix C also means that the estimate pˆ is more robust if samples of the signal are more highly correlated, and vice versa.

5

Experimental Results

The proposed LSB steganalytic technique is tested on a set of 29 continuoustone images of both color and gray-scale types. This test image set includes all original ISO/JPEG test images such as barb, balloon, goldhill, girl, etc., and those of the kodak set. Guided by our estimation error analysis of the proceeding section, in our experiments we form the multiset P by selecting all pairs of 4-connected pixels. The inclusion of both vertically and horizontally adjacent pixel pairs in P also accounts for sample correlation in both directions. The accuracy of the LSB steganography detection technique is evaluated for hidden message lengths p = 0, 3, 5, 10, 15, 20, where p is measured by the ratio of the number of message bits over the total number of pixels in the test image. In our simulation the embedded message bits are randomly scattered in a test image. Fig. 6 plots the distribution of the estimates pˆ of different test images for different embedded message lengths p. The vertical distance between an estimate point and the diagonal line is the estimation error p − pˆ. It is evident from Fig. 6 that our LSB steganalytic technique is highly effective, making very good estimate of p. The average error magnitude is only 0.023, and it stays almost the same for different p. We define false alarm rate as the probability that the steganalytic technique reports the existence of embedded message when the input signal is truly original, and the missing rate as the probability that a tampered signal survives the steganography detection. If one is to set a threshold of pˆ > 0.018 to determine whether a hidden message is embedded in the image, the the false alarm rate when p = 0 is 13.79%, and the missing rate is 11.03% when p = 3%. The missing rate quickly drops to 0 if the embedded message length p > 3%.

6

Possible Attacks and Counter Measures

If the message bits are scattered randomly among the least significant bits of all signal samples, then the use of spatially adjacent sample pairs makes the estimate of p more robust. But this choice of P opens a door for possible attacks on the detection method. An adversary can try to fool the detection method by avoiding hiding message bits at locations where some of adjacent sample pairs have close values. For instance, if the adversary does not embed in adjacent sample pairs that differ by less than 3 in value, then he makes ρ(π, D0 ) = 0, π ∈ {01, 10, 11}. In other words, the adversary purposefully tricks C0 to be biased, violating an assumption that ensures the accuracy of (15). An attack of this type is to only embed message bits among candidate sample positions where all adjacent sample pairs are in Ct such that t ≥ τ , where τ is prefixed threshold. In other words, any sample pair (u, v) that is tampered by LSB embedding satisifies |u − v| ≥ 2τ − 1,

366

Sorina Dumitrescu et al.

threshold = 1 0.5

0.45

0.45

0.4

0.4

0.35

0.35 Estimated message length %

Estimated message length %

threshold = 0 0.5

0.3

0.25

0.2

0.3

0.25

0.2

0.15

0.15

0.1

0.1

0.05

0.05

0

0 0

0.05 0.1 0.15 Embedded message length %

0.2

Fig. 6. Performance of the proposed LSB steganalytic technique in case of random LSB embedding

0

0.05 0.1 0.15 Embedded message length %

0.2

Fig. 7. Performance of the proposed LSB steganalytic technique in case of selective embedding, with τ = 1

and |u − v  | ≥ 2τ − 1, where (u , v  ) represents the values of the two samples after LSB embedding. Clearly, this LSB embedding scheme conditioned on Ct such that t ≥ τ can be decoded, because both encoder and decoder can refer to the same Ct , t ≥ τ , to decide whether a sample is a candidate for embedding. Recently, a study was carried out by Chandramouli et al. [1], with an aim to defeat the RS LSB steganalytic technique of Fridrich et al. [3]. The authors of [1] proposed a technique called adaptive embedding that is based on the same idea of not embedding in smooth waveforms. But their technique cannot be decoded. Without requiring decodability, they were able to make the estimated message length of the technique of [3] to be close to zero at the presence of embedded messages of substantial lengths. The effects of the attack by embedding only at positions where all adjacent sample pairs are in Ct such that t ≥ τ are demonstrated by Fig. 7 of threshold τ = 1. By comparing Fig. 7 with Fig. 6 of threshold τ = 0, we see that the distribution of estimated message lengths pˆ has significantly wider spread as τ changes from 0 (random embedding) to 1 (selective embedding).

Detection of LSB Steganography via Sample Pair Analysis

367

Table 1. Probability of wrong decision: missing rate when p > 0, and false alarm rate when p = 0, with the decision threshold set at pˆ > 0.018 p=0% p=3% p=5% p=10% p=15% p=20% τ = 0 0.1379 0.1103 0 0 0 0 τ = 1 0.1379 0.0828 0.0069 0.0069 0 0

Table 1 tabulates the false alarm rates when p = 0 and the missing rates when p > 0 for different p and for τ = 0, 1. The statistics of Table 1 is collected from the set of test images. Our empirical evidence indicates that the proposed LSB steganalytic technique cannot be fooled by selective LSB embedding scheme that avoids embedding in smooth waveforms. As we can see in Table 1 that for p = 3% the missing rate actually drops from random embedding (τ = 0) to selective embedding (τ = 1), and it only increases very slightly for larger p. In general, the proposed method is open for attack if the locations of chosen sample pairs in P are known, and if the algorithm examines a specific close set Cs and the chosen s is also known. Fortunately, to the benefit of steganalysis the detection algorithm can solve (14) for different choices of i and j. In other words, the steganalyst can choose different multisets ∪jm=i Cm and ∪j+1 m=i+1 Cm to estimate p. The estimate will be improved as long as ∪jm=i Cm and ∪j+1 m=i+1 Cm are unbiased. It is extremely difficult, if not impossible, to select locations of embedded message bits in such a way that all of Cm , 0 ≤ m ≤ 2b−1 − 1, become biased. The research on this type of counter measures against attacks is underway. We conclude this section with an analysis on the capacity of the aforementioned selective steganography. The adversary’s objective is to make the multiset C 0, we apply Assertion to (41) and subsequently conclude (19).

372

Sorina Dumitrescu et al.

Appendix C. Sample Correlation and Multiset Cardinality Suppose that the sample pairs (u, v) of P are randomly drawn. Since the marginal distributions PU (u) and PV (v) of the joint distribution P (u, v), are themselves the distribution of sample values. Hence the random variables U and V have the same mean: E{U } = E{V }, (45) and the same variance: V ar(U ) = V ar(V ) = σ 2 .

(46)

Now consider the difference Z = U − V , a new random variable. Since Z = (U, V )(1, −1)t , it follows that the variance of Z is given by V ar(Z) = (1, −1)Σ(1, −1)t,

(47)

where Σ is the covariance matrix of the random vector (U, V ). Denoting by Cov(U, V ) the covariance between the two random variables U and V , and using (46), it follows that V ar(Z) = 2σ 2 − 2Cov(U, V ). (48) Let ρ denote the correlation between the random variables U and V . Then Cov(U, V ) Cov(U, V ) = . ρ=  σ2 V ar(U )V ar(V )

(49)

V ar(Z) = 2σ 2 (1 − ρ).

(50)

Hence This means that the variance of Z = U −V decreases as the correlation between U and V increases. Note that |Di | = (PZ (i) + PZ (−i))|P|.

(51)

Hence we conclude that the probability P (|Di |) decreases more rapidly in i when the correlation between U and V becomes higher, if PZ (z) is unimodel and peaks at 0, which is a rather relaxed condition satisfied by many two-dimensional joint distributions of U and V .

Hiding Data in DNA Boris Shimanovsky1, Jessica Feng2, and Miodrag Potkonjak2 1

2

XAP Corporation Dept. Computer Science, Univ. of California, Los Angeles

Abstract. Just like disk or RAM, DNA and RNA can store vast amounts of information, and just like data stored in digital media, DNA data can be easily copied or tampered with. However, unlike in the digital realm, there are no techniques for watermarking, annotating, or encrypting information in DNA and RNA. The ability to catalogue genes, place checksums, watermark, and otherwise protect intellectual property in such a medium is of profound importance. This paper proposes the original idea of hiding data in DNA and RNA. Moreover, it defines two new and original techniques for hiding the data. The first is a simple technique that hides data in non-coding DNA such as nontranscribed and non-translated regions as well as non-genetic DNA such as DNA computing solutions. The second technique can be used to place data in active coding segments without changing the resulting amino acid sequence. Combining codon redundancy with arithmetic encoding and public key cryptography, this robust technique can be used simultaneously for encryption and authentication. Protecting genetic discoveries, gene therapy drugs, and a great deal of other intellectual property in medicine, genetics, molecular biology, and even DNA computing, could be made possible by the techniques presented in this paper.

1

Introduction

Learning new methods for storing data is of fundamental importance to us. Science constantly seeks novel ways of retaining and laying claim to information. And what information storage medium could be of more profound importance than the one that details the construction of life as we know it? DNA and RNA, over millions of years, have demonstrated their effectiveness as a coding medium for the instruction set that governs and propagates living things. Of late, their medicinal usefulness and propensity for solving complex, highly parallel computational problems have also been demonstrated. The ability to hide, watermark, and annotate information within this medium is clearly meaningful. Molecular biology and genetics are heavily researched fields with a great deal of intellectual property and colossal amounts of money to protect. Academic and commercial institutions may feel more comfortable conducting years of costly research for isolating and recombining a gene responsible for some vital enzyme, if F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 373-386, 2003.  Springer-Verlag Berlin Heidelberg 2003

374

Boris Shimanovsky et al.

there was some way to embed a watermark identifying their contribution and claim to the work. DNA sequences, themselves, cannot be patented, and rightly so. However, the nature of DNA is such that, once the real work of isolating and identifying a useful sequence has been done, copying is trivial. Moreover, DNA has demonstrated that it has significant computational power [1], being able to perform trillions of parallel operations, using little energy, space, and money. Still in developmental infancy, DNA computing is already getting a lot of attention, not only due to the novelty of the whole thing, but also because theoretically, it can do things in hours or days that today’s digital computers cannot do in a lifetime. There is already a lot of attention paid to watermarking digital circuitry [2, 3] and solutions made by digital computers. It seems useful to consider the same kinds of things with regard to DNA. DNA is a coding medium. Just like a disk or RAM, DNA strands contain information that can be interpreted and copied. However, rather than a binary representation of zeroes and ones, which are assigned for human comprehension, DNA contains sequences of 4 nucleic acids—adenine, thymine, guanine, and cytosine. These nucleotides could be used to encode binary information. Continuing the analogy, hiding a secret message in a binary sequence can be accomplished either by adding the message and increasing the overall size of the sequence, or by altering some portion intelligently such that the data is not functionally or perceptibly altered. To embed such a message, one would not arbitrarily add or intersperse information. It requires a complete understanding of the original message and the machinery that processes it. Similarly, one would not blindly change a sequence of nucleotides simply to facilitate a hidden message. The goal of this paper is to propose the theoretical notion of hiding information in DNA and RNA, and offer some general schemes for embedding data.

2

Background – Molecular Biology

To understand the possible avenues for hiding information, it is necessary to establish the biological background for the material. The amount of knowledge in DNA processing and genetics is intractable, even in broad swipes, however, since this paper is written with computer scientists and engineers in mind, a general discussion of the central dogma of molecular biology, that is, how a DNA sequence eventually leads to a protein, is warranted. To biologists, the material will seem trite; they are advised to skip ahead. 2.1

Basics

DNA molecules are arranged as two oppositely oriented strands with sugar-phosphate backbones joined together in an alpha-helical structure by hydrogen bonding between the complementary nitrogenous bases. The bases, adenine(A), thymine(T), guanine(G), and cytosine(C) represent the “genetic code”. A bonds with T and G bonds with C. This pairing is, among other things, useful for the error detection/correction machinery in the cell. Through a long and complex process, these

Hidmg Data in DNA

375

bases are "read and eventually translated into chaim of amino acids, which form a protein. Proteim are responsible for nearly everything that goes on in our cells, from providing structure, to helping digest nutrients, to catalyzing a reaction in a pathway leading to brown hair pigmentation. The arrangement of the amino acids dictates the stmcture and function of the protein. The DNA sequence determines the arrangement of amino acids. Through complex interactions, DNA determines the "what", "when", and "how m u c h of everything that our cellular machmery produces. The two main steps in protein genesis are transcription and translation.

Fig. 1. Transcription

2.2

Transcription

Transcription is the process in which an intermediary copy of the instmctions contained in DNA is created. This intermediary copy, RNA, is single stranded, and contains the nucleotide, uracil, where thymine would appear in DNA. The RNA is what is actually interpreted by the cellular machinery. In this manner, the DNA is retained safely in the cell's nucleus, while RNA copies, or tramcripts, can be created in abundance and translated into proteins. Transcription begins with the binding of an enzyme called RNA polymerase to the DNA. The polymerase binds to a thermodynamically favorable region of the DNA called a promoter. This promoter acts as the start signal for transcription. Its effectiveness at attracting RNA polymerase is one of the methods used to control how much of a protein is produced. Many deficiency diseases and cancers are linked to

376

Boris Shimanovsky et al.

problems with promoter sites, so clearly, data hiding schemes must be sensitive to promoters, which can lie over a thousand bases upstream of the gene. Once bound, RNA polymerase facilitates the binding of bases complementary to the ones on the DNA template it is transcribing. As it elongates, the RNA strand peels away from the DNA. The RNA polymerase eventually reaches a region called a terminator, which causes it to release. In eukaryotic cells (cells that have a nucleus—except for some simple bacteria, cells are generally eukaryotic), the RNA transcript undergoes a processing step in which INTervening sequences (introns) are cut out and discarded, leaving the EXpressed sequences (exons). These intervening sequences have structural functions and, thus, are not innocuous, however they do not code for protein [4]. Once processed, the RNA transcript is referred to as messenger RNA (mRNA). mRNA leaves the nucleus and binds a structure called a ribosome. The ribosome facilitates the translation of the mRNA sequence into protein. 2.3

Translation

mRNA binds two ribosomal subunits, forming a complex. The ribosomes step linearly along the mRNA strand, “reading” it. There are 20 distinct amino acids that can be chained together during protein synthesis. On the mRNA, a grouping of three nucleotides, called a codon, indicates which amino acid will be attached next. The codon binds a group of three nucleotides on a tRNA molecule called an anticodon. There are about 40 distinct tRNA molecules. Each has a binding site for one of the amino acids. In this way, tRNA acts as the medium for translating from nucleic acid code to protein.

exon1

exon2

exon1

exon2

exon3

exon4

exon3

exon4

Transcription

Chromosomal DNA

Splicing

Nuclear RNA

mRNA

exon1

exon2

Fig. 2. Splicing

exon3

exon4

Hiding Data in DNA

377

Ribosome Complex mRNA

The ribosome complex binds the mRNA, then the complementary tRNA binds bringing the appropriate amino acid.

tRNA complex

Amino acid

As the complex moves, the amino acid chain elongates, one at a time, until the peptide chain becomes the protein the mRNA encodes Growing peptide chain (becoming protein)

Fig. 3. Translation

The appropriate tRNA, bearing the appropriate amino acid, binds to the codon on the mRNA, extending the amino acid chain. Translation is completed when the ribosome encounters a STOP codon and the protein is released [5, 6]. 2.4

Gene Therapy and Retroviruses

Gene therapy is a field that can benefit greatly from a data hiding scheme, and a bit of background in retroviral gene therapy is required to understand the examples. One approach to gene therapy is to use a retroviral vector to deliver a functional gene to cells with a faulty one. The retrovirus is an extremely simple RNA virus that has the ability to reverse the transcription process and get its RNA converted into DNA, which can then insert itself in the host DNA [7, 8]. The process involves the removal of the virulent components from the retrovirus genome and leaving in the components that are necessary for infiltrating the target cells and delivering the genetic payload. The gene sequence that needs to be delivered is added to the retroviral RNA, completing the “drug”. The virus is unleashed upon the target cells, its RNA is released and reverse-transcribed, and the newly formed DNA, which would have ordinarily coded for the production of the virus, encodes the correct sequence for a defective gene. This results in the ability for a cell to produce a protein that it lacks, and the deficiency of which led to the expression of a particular congenital disease.

378

Boris Shimanovsky et al.

3

Intellectual Property Protection and Data Hiding

As with digital information, DNA-encoded information can be copied such that the possibility of theft of intellectual property is high. Thus, it makes sense to observe the basic requirements and principles of digital data hiding, The fundamental requirements when hiding data in digital information are [9]: • • • • • • •

reasonable ease of placement and detection by the legitimate party sufficient difficulty in detection and erasure for attackers credibility in case of a dispute robustness against filtering, compression, or truncation reasonable overhead no significant change in meaning or function of the original data the data being hidden should have error correction/redundancy

Unlike, audio or video, which can be altered in such a way that it is qualitatively noticeable when the signal has been too degraded, DNA is hard to filter for the purposes of defeating a watermark. It is important to bear in mind that DNA, especially if it codes for some biological product is not altered easily without a good understanding of the sequence, at which point, an attacker has been forced to do substantial original work. As such, the criteria of robustness against filtering, compression, or truncation, is not applicable. A DNA and RNA data hiding technique should meet the other basic requirements.

4

Hiding Data

To hide data, we need one of three things: the ability to insert a sequence containing the data, to alter an existing innocuous sequence, or to find redundancy in an existing sequence and leveraging it to hide data. Again, the fundamental principles of digital data hiding techniques are extremely useful in the conception and evaluation of techniques for hiding data in DNA. In fact, encryption and compression techniques that are already proven and widely accepted for digital data can and should be used when storing data in DNA. For one thing, they’re proven and widely accepted, which makes for fewer things that have to be proven credible in a dispute. Second, the work has already been done which makes the process simpler. Recall that these considerations are among the key criteria in creating data hiding schemes. Another key consideration is the purpose of the data hiding scheme. If the goal is to annotate and help catalog sequences, then encryption and resistance to attack is of minimal concern, but ease of placement and retrieval are of primary importance. On the other hand, if the data is being hidden specifically for the purpose of protecting intellectual property, then easy placement and extraction steps are of less importance than a robust and well-hidden encrypted message. The two techniques presented in this paper will be evaluated based on their capacity for these distinct purposes. Before proceeding, it is also important to clarify some nomenclature. Cellular DNA, gene therapy sequences, or other DNA that ultimately ends up in a living organism, will be called “live DNA”. DNA sequences that are not intended to

Hiding Data in DNA

379

undergo processing by cellular machinery, but are just chemical messages such as DNA computing solutions, will be called “chemical DNA”. This is important since live DNA processing is extremely complex with elaborate structure and subtle interactions that must be fully understood before any modifications are made. For the purposes of this paper, unless stated otherwise, DNA should be thought of as a theoretical construct. 4.1

Non-coding DNA, Non-transcribed DNA, or Non-translated RNA

Adding or hiding data in chemical DNA sequences does not require us to be very clever. For most tasks, a flat encoding of 2 bits/nucleotide, assigned in alphabetical order would be a sufficient starting point. A=00 C=01 G=10 T=11 With this basic foundation, we can add binary segments to DNA that could be used to store interspersed hidden data, annotate existing DNA sequences, watermark a DNA computing solution, and so on. Depending on the task, different operations could be performed on the binary sequence while the DNA encoding scheme remains constant. For the purposes of data storage or transport, a compression step on the binary data would be useful. For a watermark, an encryption step would be appropriate. For annotation, plain text or simple codes could be used. After each important sequence, perhaps it would be useful to add a checksum to verify that the DNA strand hasn’t degraded or been altered. In all cases, the application would drive the operations performed on the hidden data and in all cases, existing well-known binary techniques could be used for this purpose. The motivation for this is simple. The fewer complex and unprecedented steps are performed on data, the easier it is to process, embed, extract, and explain in court. Extending this notion to live DNA requires great care. Unlike, chemical DNA where changes can be made wherever necessary to hide data, with live DNA, besides the obvious dangers of active genetic segments, there are other complications. Although, only a small percentage of DNA codes directly for genes, in addition to genes, there are regulatory and structural regions. Altering or adding sequences that seem innocuous may have profound effects when processed by cellular machinery. Nevertheless, with enough study, this will be feasible. Mutations in live DNA happen with some frequency, but most of the time they happen to non-coding, non-regulatory regions, and are not expressed. So, clearly, it must be possible to make changes without repercussions. In live DNA, there are two possible areas for data placement: Non-transcribed DNA and non-translated RNA regions. Non-transcribed regions are all DNA that is not transcribed to RNA. Most of the live DNA is not transcribed, and represents a vast space to hide data. After DNA is transcribed, in eukaryotic cells, certain portions of the RNA transcript are edited out before translation. Moreover, not all of the mRNA is translated into amino acid sequences. All transcript RNA that isn’t translated into protein makes up the non-translated regions. For chemical DNA, the level of robustness that this flat encoding scheme offers depends entirely on what data is hidden. If this method is used to watermark a DNA

380

Boris Shimanovsky et al.

computing solution for something like a traveling salesman problem, the watermark could be placed by choosing an almost-optimal path instead of an optimal one, hiding the watermark inside the sequence of destinations. In such a case, the watermark is in the answer to a problem. The ability to remove it would mean knowing an answer that is at least as good. Such a watermark derives its robustness from the difficulty of solving the problem. Likewise, this scheme would fare well for annotations or cataloging since the data only needs to be resistant to degradation or truncation. In this case, redundancy and error correcting encoding would be used, but efforts to prevent attack are unwarranted. Conversely, using a technique like this for live DNA watermarking, where the goal is to protect intellectual property, is not the strongest solution. This is particularly the case for non-transcribed DNA segments. Active genetic regions have characteristic sequences surrounding them, acting as a demarcation for an attacker. This makes the process of isolating the important sections from a small DNA segment relatively simple. With this information, an attacker would be able to isolate the key elements of the gene, and begin to search for the watermark, or even easier, they could simply cut the active segment out and splice it into a neutral sequence that otherwise matches the original. At this point, the watermark that may have surrounded the active segments is effectively removed. A watermark in non-translated, but transcribed, sections is somewhat stronger since it would lie between the start and end markers for the active portion of the DNA segment. However, a watermark in these regions can also be removed with a bit of backtracking. Since the final mRNA product has neither the non-transcribed nor the non-translated regions, it could be used to exactly identify the portions of DNA that are part of the gene. Removing or altering the rest of the DNA segment can eventually be accomplished. This method does offer substantial delay, but it can be defeated with some work. 4.2

Codon Redundancy

An ideal watermark stays with the data it is protecting without altering it functionally. In audio and video, one would prefer to place the watermark in the active signal rather than in header or trailer segments. This improves robustness since headers and trailers can be easily chopped out. The same is true for DNA. The strongest watermarking scheme for live DNA is one where the watermark is embedded in the actual sequence coding for the gene. However, how can one change DNA that is part of an active genetic sequence and still make the protein product come out the same? The answer is redundancy. mRNA codons are 3 bases long. There are 4 possible bases, U, C, A, and G. That means that there are 43 or 64 unique codes that can be generated. However, there are only 20 amino acids that are encoded. Therefore, there is redundancy in the mRNA to amino acid mapping. This redundancy can be leveraged to embed additional information into the sequence without altering its function or length. Any time we are offered a choice, the choice that is made can be used to convey information. Observing the chart, it is clear that a flat binary encoding scheme will not be optimal, since there can be sets of 1,2,3,4 or 6 codons representing the same amino acid. An encoding scheme that does not waste space for each of these possible set sizes is required to store a more optimal amount of data. One such scheme is arithmetic encoding, since it works with an arbitrary amount of subdivisions.

Hiding Data in DNA

381

Arithmetic encoding would involve taking a binary sequence containing the encrypted message and converting it to a decimal number between 0 and 1 [10]. Then one would take the amino acid sequence that would be generated by the original mRNA, and generate a list of all possible codons that lead to the same sequence, listing the codons in alphabetical order. The number can then be generated by continually subdividing by the number of codon combinations for each amino acid in the sequence. Putting the codons in alphabetical order serves to standardize the process. This way, there is no ambiguity to the scheme, thus strengthening the credibility of the watermark. To demonstrate how this works, let’s take a sample message and embed it into a short sequence. The first step is choosing the binary sequence we wish to embed. For the purposes of the example, we choose the following binary sequence: “0100100010010001010110010011010011011101”. Now that we have the sequence we wish to store, we take the given mRNA sequence (chosen arbitrarily for the example) “AUG GCG CAG GUA UUA GAC GUA CGC CUA GCU CCA UGG ACC GUU GCC GGU CUG CCC GGG AUA CCU GAU” and translate it into the amino acid sequence it represents. Note that for this example we start in reading frame. “AUG” is the start codon so we do not count it. The amino acid sequence “Ala Gln Glu Leu Asp Val Ser Leu Ala Pro Trp Thr Val Ala Gly Leu Pro Gly Val Ser Ile Pro Asp” is generated from the translation. Our watermarked mRNA sequence must also translate exactly into this sequence. Now, we take advantage of the redundancy. There are a number of ways to generate that same amino acid sequence. We will use arithmetic encoding to choose the path we take. Converting the above binary sequence into a decimal number between one and zero yields “.283467841536”. Table 1. Codon to amino acid mapping

U

C

A

G

U

UUU→Phe UUC→Phe UUA→Leu UUG→Leu

UCU→Ser UCC→Ser UCA→Ser UCG→Ser

UAU→Tyr UAC→Tyr UUA→STOP UAG→STOP

UGU→Cys UGC→Cys UGA→STOP UGG→Trp

U C A G

C

CUU→Leu CUC→Leu CUA→Leu CUG→Leu

CCU→Pro CCC→Pro CCA→Pro CCG→Pro

CAU→His CAC→His CUA→Gln CAG→Gln

CGU→Arg CGC→Arg CGA→Arg CGG→Arg

U C A G

A

AUU→Ile AUC→Ile AUA→Ile AUG→Met, Start

ACU→Thr ACC→Thr ACA→Thr ACG→Thr

AAU→Asn AAC→Asn AUA→Lys AAG→Lys

CGU→Ser CGC→Ser CGA→Arg CGG→Arg

U C A G

G

GUU→Val GUC→Val GUA→Val GUG→Val

GCU→Ala GCC→Ala GCA→Ala GCG→Ala

GAU→Asp GAC→Asp GUA→Glu GAG→Glu

GGU→Gly GGC→Gly GGA→Gly GGG→Gly

U C A G

382

Boris Shimanovsky et al.

We use this as the target number in the repeated subdivision steps of arithmetic encoding, as shown in the figure below.

0-0.25 0.25-0.5 0.5-0.75 0.75-1

Ala Ala Ala Ala

GCA GCC GCG GCU

0.25-0.3125 0.3125-0.375

Glu GAG Glu GUA

0.281249999998 - 0.286458333331 0.286458333331 - 0.291666666331

Asp GAC Asp GAU

0.2825520833313- 0.2827690972198 0.2827690972198- 0.2829861111087 0.2829861111087- 0.2832031249975 0.2832031249975- 0.2834201388863 0.2834201388863- 0.2836371527748 0.2836371527748- 0.2838541666637

Ser Ser Ser Ser Ser Ser

CGC CGU UCA UCC UCG UCU

0.2834563078673- 0.2834653501123 0.2834653501123- 0.2834743923575 0.2834743923575- 0.2834834346028 0.2834834346028- 0.283492476848

Ala Ala Ala Ala

GCA GCC GCG GCU

-

Trp UGG

0.2834676106733-0.2834677519581 0.2834677519581-0.2834678932431 0.2834678932431-0.2834680345282 0.2834680345282-0.2834681758132

Val Val Val Val

GUA GUC GUG GUU

0.25-0.375 0.375-0.5

0.25-0.26… 0.26...-0.27… 0.27…-0.281… 0.281…-0.292… 0.292-0.302 0.302-0.3125

Gln CAG Gln CUA

Leu Leu Leu Leu Leu Leu

CUA CUC CUG CUU UUA UUG

0.281249999998-0.2825520833313 0.2825520833313-0.2838541666645 0.2838541666645-0.2851562499977 0.2851562499977- 0.286458333331

Val Val Val Val

GUA GUC GUG GUU

0.2834201388863- 0.2834563078673 0.2834563078673- 0.2834924768487 0.2834924768487- 0.28352864583 0.28352864583- 0.2835648148113 0.2835648148113- 0.2836009837927 0.2836009837927- 0.283637152774

Leu Leu Leu Leu Leu Leu

CUA CUC CUG CUU UUA UUG

0.2834653501123- 0.2834676106733 0.2834676106733- 0.2834698712345 0.2834698712345- 0.2834721317958 0.2834721317958- 0.283474392357

Pro Pro Pro Pro

CCA CCC CCG CCU

0.2834676106733- 0.2834681758133 0.2834681758133- 0.2834687409535 0.2834687409535-0.2834693060938 0.2834693060938- 0.283469871234

0.2834677519581- 0.2834677872793 0.2834677872793- 0.2834678226005 0.2834678226005- 0.2834678579218 0.2834678579218- 0.2834678932431

Thr Thr Thr Thr

Ala Ala Ala Ala

ACA ACC ACG ACU

GCA GCC GCG GCU

Hiding Data in DNA

0.2834678226005- 0.2834678314303 0.2834678314303- 0.2834678402606 0.2834678402606- 0.2834678490909 0.2834678490909- 0.2834678579213

Gly Gly Gly Gly

GGA GGC GGG GGU

0.2834678402606- 0.2834678406279 0.2834678406279- 0.2834678409959 0.2834678409959- 0.2834678413638 0.2834678413638- 0.2834678417317

Pro Pro Pro Pro

CCA CCC CCG CCU

0.283467841455- 0.283467841478 0.283467841478- 0.283467841501 0.283467841501- 0.283467841524 0.283467841524- 0.283467841547

Val Val Val Val

GUA GUC GUG GUU

0.2834678415355- 0.2834678415363 0.2834678415363- 0.2834678415376 0.2834678415376- 0.2834678415388

Ile Ile Ile

AUA AUC AUU

0.2834678415359-0.283467841536 0.2834678415360-0.2834678415361

Asp GAC Asp GAU

0.2834678402606- 0.2834678417317 0.2834678417317- 0.2834678432034 0.2834678432034- 0.2834678446752 0.2834678446752- 0.2834678461469 0.2834678461469- 0.2834678476186 0.2834678476186- 0.2834678490903

Leu Leu Leu Leu Leu Leu

0.2834678413638- 0.283467841455 0.283467841455- 0.283467841547 0.283467841547- 0.2834678416389 0.2834678416389- 0.2834678417309

Gly Gly Gly Gly

0.283467841524- 0.2834678415278 0.2834678415278- 0.2834678415317 0.2834678415317- 0.2834678415355 0.2834678415355- 0.2834678415393 0.2834678415393- 0.2834678415432 0.2834678415432- 0.283467841547

Ser Ser Ser Ser Ser Ser

0.2834678415355-0.2834678415357 0.2834678415357-0.2834678415359 0.2834678415359-0.2834678415361 0.2834678415361-0.2834678415363

Pro Pro Pro Pro

383

CUA CUC CUG CUU UUA UUG

GGA GGC GGG GGU

CGC CGU UCA UCC UCG UCU

CCA CCC CCG CCU

Fig. 4. Arithmetic coding example

This process has generated the new mRNA sequence. Following the highlighted path, we get “AUG GCC CAG GAG CUU GAC GUC UCG CUC GCC CCC UGG ACA GUC GCG GGG CUA CCU GGC GUU UCC AUA CCG GAU”, which codes for the same amino acid sequence as the original mRNA, and now, also contains the intended watermark. The ability to embed 40 bits into a sequence this short should make it clear that there is adequate space to encrypt and embed a strong and repetitive watermark into live sequences, which consist of many thousands of base pairs. The example given is purely theoretical. In live DNA, there are various speciesspecific restrictions to which codons can be used. As a result, the chosen scheme must degrade optimally as well, always working with the full potential of the redundancy available. This arithmetic encoding scheme degrades nicely, continuing to embed data without waste. As such, even if the amount of available redundancy is significantly reduced by real-life constraints, the assumption is that some will remain, and a long sequence can still retain a significant message. Strengthening this technique to make it a good watermarking solution requires some additional work. Revisiting the notion of using the power and credibility of

384

Boris Shimanovsky et al.

existing digital techniques gives us a good starting point, especially since we are encrypting a binary sequence anyway. Also, we need to overcome the fact that an attacker can apply the same process to our watermarked sequence and replace the watermark with their own. First, we try to generate a highly credible, difficult to detect type of binary sequence. Plain text can be discovered very quickly since the algorithm for placing it there is publicly known. A good solution for dealing with this is using private/public key cryptography since it is well known and can act simultaneously as an authentication scheme and an encryption scheme [11]. To generate the watermark, first the placing party would encrypt with their private key. This ensures that they were the only party that could have placed it there. Then they encrypt again, with their public key. This ensures that they are the only party that can read it. Now the message appears random to anyone that doesn’t know their private key, and can be proven with high probability that they placed it there, since the encryption required a combination of information that only they could know and information that is known publicly to identify them. Now the trick is to prevent someone else from doing the same thing. If we take as given that only the placing party knows the original sequence prior to the watermark, it could be used to settle a dispute. In the example above we arranged the nucleotide subdivisions alphabetically and started subdividing from the top. Instead, we could start with the codon that is in the original sequence and subdivide from there, wrapping around as necessary. For example, instead of starting from the first codon chosen alphabetically as presented earlier (left side), we can start numbering from the original codon before the watermark (right side). In the original sequence, GCG was the first codon, so that is where the zero point is. When we reach the bottom, we wrap around to GCA and GCC. This would result in a completely different sequence, but the information conveyed would be the same. This step keeps the process unambiguous, and at the same time ensures that the original mRNA sequence is required to place and decode the watermark. Therefore, unlike the first example, an attacker would not be able to simply repeat the watermarking process. Using this technique in a retrovirus vector, means that the message will transfer through the reverse transcription pathway and be embedded in the target cells’ DNA in complementary form. In the other direction, with some effort, one can generate an appropriate DNA sequence that, when transcribed, would create the mRNA strand with the embedded message. 0-0.25 0.25-0.5 0.5-0.75 0.75-1

Ala Ala Ala Ala

GCA GCC GCG GCU

0.5-0.75 0.75-1 0-0.25 0.25-0.5

Fig. 5. Arithmetic coding, more robust variation

Ala Ala Ala Ala

GCA GCC GCG GCU

Hiding Data in DNA

385

gene1

Reverse Transcription

`

gene1’

`

DNA

`

watermarked mRNA Fig. 6. Reverse transcription of watermark

5

Conclusion

DNA as a storage medium is extremely effective. It is compact, biodegradable, and consumes very little energy. Today it is used to propagate species, encode protein synthesis, and solve complex computational problems. Who knows what it will do in the future? Recognizing this, techniques for hiding data to catalog, annotate, watermark, and/or encrypt information in this medium can have tremendous purpose. This paper proposes the original idea of hiding data in DNA and RNA. Moreover, it defines two new and original techniques for hiding the data, along with an evaluation and analysis of the utility of each for the different functions of hidden data. The first technique hides data in non-coding DNA such as non-transcribed and nontranslated regions as well as non-genetic DNA such as DNA computing solutions. The second, in theory, can actually be used to embed information directly into active genetic segments. In addition to a straightforward set of steps for embedding the data, this paper also addresses the codon redundancy technique’s susceptibility to attack and offers several additional steps to strengthen a watermark. The practical usefulness of such a technique can be enormous. The techniques presented in this paper can be applied to protecting intellectual property in the realms of gene therapy, transgenic crops, tissue cloning, and DNA computing. Data can also be hidden to verify the integrity of DNA sequences, annotate sequences for easier cataloging and study, or simply to convey data inconspicuously in biological carriers.

386

Boris Shimanovsky et al.

References 1.

Adelman L., “Molecular computation of solutions to combinatorial problems”, Science 266, Nov. 11, 1994 2. J. Lach, W. Mangione-Smith, and M. Potkonjak Fingerprinting Digital Circuits on Programmable Hardware. Information Hiding Workshop, Portland, Oregon, 1998 3. B. Kahng, J. Lach, W. H. Mangione-Smith, S. Mantik, I.L. Markov, M. Potkonjak, P. Tucker, H. Wang, and G. Wolfe Watermarking Techniques for Intellectual Property Protection. DAC-98 35th ACM/IEEE DAC Design Automation Conference, pp. 776-781, San Francisco, CA, June 1998 4. Campbell, N.A., Biology pp 322-335, Benjamin/Cummings Publishing, 1990 5. Felsenfeld, G. “DNA”, Scientific American, Oct 1985 6. Darnell, J., “RNA”, Scientific American, Oct 1985 7. Campbell, N.A., Biology pp 360, Benjamin/Cummings Publishing, 1990 8. Gallo, R. C., “The First Human Retrovirus”, Scientific American, December 1986 9. Bender, W., Gruhl, D., Morimoto, N., Lu, A., “Techniques for Hiding Data”, IBM Systems Journal, Vol. 35, NOS 3 & 4, 1996 10. Howard P., Vitter J., “Arithmetic Coding for Data Compression” '' Proceedings of the IEEE, 82(6), June 1994, 857-865 11. Diffie, W. and Hellman, M. E. “Privacy and Authentication: An Introduction to Cryptography”, Proceedings of the IEEE, Vol. 67, No. 3, March 1979

Tracing the Source of a Shredded Document Jack Brassil HP Laboratories, Palo Alto CA 94304, USA [email protected]

Abstract. Consider two ordinary, seemingly identical plain paper shredders labeled A and B. When each of the two shredders is fed a blank sheet of paper, the resulting remnants are sufficiently similar that they are indistinguishable upon visual inspection. Now suppose that one of the shredders has been modified to introduce imperceptible variations in the size of each remnant it cuts. One of the shredders is then selected at random to destroy a blank sheet. By examination of the resulting paper remnants, can one determine if the sheet was shredded by A or B? In this paper we show how information hidden in the size and shape of shredded page remnants can be used to reveal the identity of the device used for shredding. We describe means for modifying shredders to introduce this hidden information. Experimental results reveal that properly embedded information can survive the severe nonlinear distortions introduced by the mechanics of paper shredding. Finally, we consider the question of whether paper shreds could reveal shredder identity even in the absence of device modifications. Keywords: jigsaw puzzle reconstruction, machine identification, information hiding, detection theory, image analysis, forensic science

1

Introduction

As long as there is need for either classified, limited distribution or secure paper documents [1], so too will there be need to destroy them beyond the point of practical reconstruction. The attention paid to destruction and disposal practices varies greatly with the need for document security, and the willingness to pay for it. The United States Department of Defense publishes requirements for secure plain paper shredders, and these requirements can be realized at relatively low cost. Secure document disposal is more often a matter of time and vigilance than money. As a result the humble plain paper shredder has become a fixture in environments where the security requirements for waste documents are relatively modest. It is often the case that the actual distribution of a limited distribution document is of as much interest as the information contained in the document itself. While it might not be possible to know what a recovered, shredded document said or who read it, it is of some interest to know by whom, or where, a document F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 387–399, 2003. c Springer-Verlag Berlin Heidelberg 2003


388

Jack Brassil

was ultimately destroyed. This is particularly the case if there is suspicion that a sensitive document managed to find its way to an unintended recipient. It has long been recognized that physical devices routinely leave telltale identification marks or ’fingerprints’ of their use [2]. These fingerprints can be unique even if unintended, as is the case if introduced solely by the natural variations in the electrical or mechanical tolerances of device components. As an example, two identically manufactured plain paper copiers will routinely be found to have slightly different magnifications. This subtle observation might enable an examiner armed with an original document to help identify the particular device responsible for creating a plain paper copy. For that matter, at a sufficiently microscopic level no two sheets of paper appear identical, and this observation can be used to distinguish between two seemingly identical documents. Reconstruction of fragmented documents has long been of interest to researchers in both computer science and the social sciences. Ancient manuscripts such as the Dead Sea Scrolls have been painstakingly reconstructed [3]. In the case of the scrolls, who authored and possessed the documents is as central a question as the reconstructed text itself. Since the earliest days of digital computers, computer scientists have considered the problem of the computer-assisted reconstruction of both 2-dimensional and 3-dimensional jigsaw puzzles. Reconstructing a document from fragments may be considered an unusual but highly specialized case of puzzle reconstruction [4], [5]. The generalized reconstruction problem remains formidable, and we do not consider that problem here. It is worth noting that the attacks on this problem that we are aware of make use of the fragment content in addition to its shape. Instead we consider the simpler problem of whether the remnants of a shredded document can be associated with the shredding device it passed through. We have no knowledge that the identification problem examined in this manuscript has been considered by other researchers. Yet a great deal of effort has been directed to the recovery of supposedly ’deleted’ documents from computer disk drives, as well as tracking ownership and distribution via digital watermarking. However the recent investigation into fraudulent accounting practices at a major US corporation, and the subsequent assertion that paper documents were wrongfully destroyed by its accountant, has encouraged us to consider this question. The remainder of this paper is organized as follows. Section 2 briefly reviews the mechanical operation of common office shredders. Section 3 describes how to hide identifying information in a shredder, and the experiments we performed to gauge our ability to detect that hidden information. The next section discusses alternative approaches to embedding identifying marks in a device. Section 5 develops a mathematical model for detecting marks in the presence of the severe ’noise’ introduced by the shredding process. Section 6 analyzes the probability of distinguishing between two shredders without modification to either shredder, and the final section summarizes our results.

Tracing the Source of a Shredded Document

2

389

Basic Operation of a Plain Paper Shredder

Though secure techniques for destroying paper are easily realized (e.g., burning), it is a simple fact that those techniques are used only in the most secure environments. Most of the rest of us settle for the low cost and convenience of common office-grade electronic shredders, a market exceeding US $100 million per year. Practical document destruction appears premised on the likelihood that few will bother to go to the effort of reconstruction, and also that other enterprise security risks (e.g., network attacks) are a larger threat. Though the mechanics of document shredding vary dramatically, shredders tend to fall into a small number of distinct security classes. Minimally secure shredders for office applications known as strip shredders cut paper only along its length (i.e., perpendicular to the shredder mouth). The resulting shreds form long narrow strips, with common widths ranging from 1/8 to 5/16 inch. Because of the requirement to destroy multipage documents bound by paper clips or staples, the typical cutting assembly is surprisingly strong. A common cutting mechanism employs two arrays of rapidly rotating, ribbed metal bands (caterpillar tracks or treads) whose width defines the strip width. These opposing band arrays come together at an acute angle to form a V-shaped mouth with adjacent bands interleaved. The effect of this tearing action will be observed by examining strip edges in figures later in this manuscript. The crosscut shredder cuts both lengthwise and widthwise to achieve additional security protection. Crosscuts occur relatively infrequently, often being made only every few inches of page length. A relatively recent innovation is the confetti shredders, which crumples crosscut remnants. One of the oddities encountered in the marketing of shredders is the relative prominence of convenience over security; crosscut shredders advertise that densely packed remnants offer the convenience of fewer disposal trips, stripcut shredders advertise fast cutting, and confetti shredder ads go as far as suggest that the remnants are to be used for packing materials. To establish a security baseline, the US Department of Defense has specified that Class I secure shredders crosscut documents to yield remnant sizes no larger than 1/32 inch wide by 1/2 inch long [10]. Note that a 10 point character (approx. 10/72 inch) would be vertically cut several times by such a device, making this presumably adequate to deter attempts at reconstruction. Such a standard, of course, does not ensure that secure papers are destroyed properly. Documents are highly portable, and there are many environments where careful document security is impractical, such as in battlefield settings or mobile workplaces, including airports and hotels.

3

Experimental Setup and Results

Prior to plunging into a discussion of the experiments we performed, let’s begin by addressing the most basic question: ”Is shredder identification feasible?” The answer is clearly yes, as illustrated by the following pedagogical construction.

390

Jack Brassil

Suppose strip shredder A cuts each inch of page width into four identical pieces, each 1/4” in width. Next suppose that shredder B cuts each inch of page width into four pieces, two 1/8” strips and two 3/8” strips. Then given the remnants of a shredded page, at a glance one can obviously determine whether the resulting page was destroyed by A or B. This leaves the remaining question: ”Can shredder identification still be performed if the cutting width difference of strips is sufficiently small to be undetectable by human observation of the page remnants?” The remainder of this paper addresses just this question, and identifies just how small such a difference can be. We will show that, given a sufficient number of samples to test, the difference in widths that can be detected can be of the same order as the ’noise’ introduced in remnant size due to the tearing action of the shredding process. Even more remarkably, we will go on to consider whether the natural variations that occur in the manufacture of cutting assembly components is enough to permit an observer to identify an otherwise unmodified shredding machine. Anecdotal evidence suggests that shredders are among the most misused yet least maintained of all electronic office equipment. Rather than consider a new piece of office equipment, we sought out a stripcut shredder that had received considerable use over a period of years, while receiving no maintenance whatsoever. Our objective was to ensure that our results would be robust to the degenerative effects of machine aging and general misuse. We selected a Panasonic Compact Shredder Model MPS20 with a 3 mm (0.118 in.) strip width, a device meeting ordinary office security requirements. We tested the device with blank sheets of 20 lb. (75g/m2) multi-purpose office stock paper. Colored paper was chosen to obtain adequate contrast during scanning, and avoid the occurrence of optical edge effects produced when scanning white paper. Each sheet was separately fed into the shredder mouth, though it is likely that most samples recovered in practice would not have been destroyed one page at a time. After selecting a shred whose width was to be measured, grayscale (8-bit) scanning was performed at 600 dpi on an HP Officejet R80xi flatbed scanner. Figure 1 shows a typical resulting image of a strip cut. Observe how the jagged nature of the strip edge shows how the page is torn rather than cut. In some samples, particularly careful observation can reveal indications that the remnant passed through a cutting assembly using ribbed bands, as the resulting strip outline take on a slight crosshatched appearance, as in a sketch of a railroad track or a corral fence. Scanning requires confronting a number of minor practical considerations. If one was to perform a smoothing operation on the jagged strip edge, one would find find that opposite edges of the strip to be very nearly parallel. But the nature

Fig. 1. A strip cut

Tracing the Source of a Shredded Document

391

Fig. 2. A strip cut with overlayed grid

of a thin flat strip is to tend to curl (e.g., like a human hair). This curling action tends to cause a strip to not lie flat when placed on a flatbed scanner without being secured. Hence, the paper edges in scans of individual strips appear ’wavy’. Figure 2 shows this waviness of the strip when a grid is superimposed over the of the image in Figure 1. Ultimately we found it convenient to secure strips to a rigid background prior to scanning to avoid an excessive amount of this waviness due to curling. Scanning a strip generally produces a skewed image of a strip, that is, one having a rotation with respect to the horizontal axis. Note how the strip in Figure 1 is not sitting horizontally across the page, but is slightly tilted. But even if modest skew occurred (θ = ±2.5◦ ) then the error in width calculation would only be .118 in × 600 dots/in. × cos 5◦ = 0.3 dots, or less than 1 pixel in error. Relatively speaking this is a minor source of error, so we choose not to bother attempting to correct any skew. A final consideration in scanning paper strips was to ensure that the strip was oriented such that the movement of the scanner’s light bar traveled along the strip length, rather than the strip width (to be measured). Otherwise, shadowing and other optical edge effects in the scan created problems in detecting the strip edge, making width measurement unnecessarily difficult. Following scanning, each image was processed using a collection of software tools to prepare for a width measurement. We used publicly available tools found in [6], occasionally supplemented by a comparable feature available in the shareware tool xv version 3.10a. Image preparation typically involved: 1. 2. 3. 4. 5. 6.

cropping to reduce image size, a 90% rotation to approximately horizontal, binarization (i.e., color or grayscale image to binary), despeckling to remove noise introduced by scanning, inversion to a white strip on a black background, and edge detection (to extract the noisy cut edge).

Figure 3 shows a typical result of this process. Often, a final cropping was helpful to remove artifacts such as the detected left edge in the figure (corresponding to the strip top or bottom and of no immediate interest).

Fig. 3. Noisy cut edges whose separation is to be measured

392

Jack Brassil

The combination of skew and waviness caused us to abandon our initial simple approach to measuring the strip width, which was roughly to be as follows. Suppose that we binarized and inverted Figure 1, such that we created a binary image, where the strip was white and the background black. We would then create a horizontal projection profile, that is a histogram of the number of ”on” bits per horizontal row. Ideally, a projection onto the vertical access would show a distinct transition at the edge of each strip, enabling us to measure the strip width by finding the difference between the transitions (in pixels). But our experiments showed that waviness and skew easily caused that distinct transition to blur over approximately 5 or 6 pixels, producing too much variability in width measurement. To circumvent these problems we found it necessary to write a dedicated program to precisely estimate the strip width. This program measured the exact distances between the edges detected in the (rotated, binary, despeckled, inverted) image for a large number of points along the strip’s length. A histogram of the measured strip width is shown in Figure 5. The distance was estimated at 5601 points that our algorithm deemed sufficiently free of noise to obtain an accurate measurement. This represented about 90% of the points across the entire strip length. The width of this strip was found to have mean 65.85 pixels, and variance equal to 9.045 pixels2 (σ ≈ 3 pixels, or 1/200 inch). We will develop a detailed analytical detection model shortly, but for now our intuition suggests that we would be able to reliably detect the difference between two strips differing in width by 2σ ≈ 1/100”. And as we had hoped, that difference is small enough to be effectively imperceptible to all but the most astute human observer.

Fig. 4. A closer look at the detected edges of Figure 3

Tracing the Source of a Shredded Document

4

393

Alternate Techniques for Embedding Identifying Information

So far we have limited our discussion to a single means of hiding identifying information in a single type of stripcut shredder, namely by embedding information in the size of remnants. There are several ways in which this technique can be realized, among the most straightforward being using cutting bands with imperceptibly different widths. In the case of the device we used, the manufacturer was already known to have cutting components producing 3 mm. and 4 mm. cuts. Note, however, that the experiments described here are suggesting that a much smaller width difference, such as 0.25 mm, would most effectively balance detection accuracy and imperceptibility. Other means of embedded information are possible, and in some cases may be preferred. For example, other features such as the overall shape of a remnant may be useful for hiding identifying marks. Consider the effect of carving small notches or indentations in cutting bands, producing small but detectable imperfections in the cut edges of remnants occurring at well known intervals. Such a technique would in principle be effective on a variety of shredder types, including crosscut shredders. Though we have not performed experiments demonstrat-

Strip width measurement histogram no. of measurements distance_data

850 800 750 700 650 600 550 500 450 400 350 300 250 200 150 100 50 0

distance (pixels) 55

60

65

70

75

80

Fig. 5. Width measurement histogram

394

Jack Brassil

ing that this is possible, the experiments we have done suggest that we may be capable of detecting notches of perhaps .005 inch in depth. A sequence of such notches could be used to encode a unique identifier using any number of techniques, such as their relative positions (analogous to pulse-position modulation in digital communication systems). Though it is possible to imagine modulating information in the path of a cut, an inexpensive mechanical design might be difficult to realize. But if successful, such an approach may be capable of embedding far more information in a shredded page than would be possible by modulating strip widths. It is worth noting that the analysis of shred sizes is only one technique that might be useful in a machine identification. In practice, there are many artifacts of the shredding process that can help the identification of a shredding source. As an example, paper dust within the shredder enclosure can be examined for fibers or dyes that are consistent with those found in shred waste. Even more simply, paper length might be revealing when compared to the operating profile of the device environment. For example, a legal department might produce more 14” paper than a human resources department. We have not had an opportunity to examine the effects of device aging on detection accuracy. Shredders are notoriously some of the most abused and poorly maintained of office equipment, so it is likely that equipment will show the affects of aging. Dulled cutters are likely to increase tearing and produce jagged cuts, likely making device identification harder or even impossible. On the other hand, other artifacts that could be helpful in the detection process might in fact be amplified by aging or misuse. For example, one could imagine distinguishing between a new and an old shredder by simply examining the jaggedness of paper tearing at a strip edge, which is likely to increase with device use. A device’s signature may in fact become more pronounced with age.

5

Analytical Detection Model

We next develop an analytical detection model to evaluate our ability to trace shredder identity. Let’s begin with the simple case of deciding whether a single strip X was produced by shredder A or B. Label the sample strip width x, and assume that the corresponding strip widths produced by machines A and B are known to be a and b, respectively. We assume that each shredder has been modified to make imperceptible increases or decreases to each strip’s width, such that a  = b. Let Ha (Hb ) be the hypothesis that the sample passed through machine A (B). Then, if it is equally likely that the sample was destroyed by either machine, the decision rule we would implement is as follows: if

|x − a | < |x − b| : decide Ha |x − a | > |x − b| : decide Hb

(1)

Now let’s move on to the general case of identifying a device’s unique k bit identifier, permitting us to distinguish between each of 2k shredders. Suppose

Tracing the Source of a Shredded Document

395

that our sample collection X contains the (ordered) shredded output of an entire page, and Xi : i = 0, 1, 2, . . . , N + 1 is the ith strip from the left that exited the shredder. Let xi , i = 1, 2, . . . , N be the width of the ith strip, as measured by the process discussed in Section 3. Note that we are excluding the strip at each page edge, which we assume to not have two cut edges. We will hide a unique identifier in the page remnants produced by each machine by embedding a binary code in the remnant strip widths. To make detection as simple as possible, 1 bit will be encoded by using two adjacent strips, in the following fashion: – A ”zero” is embedded by increasing the width of odd-numbered strip i by distance ∆, and decreasing the width of strip i + 1 by ∆. – A ”one” is embedded by decreasing the width of odd-numbered strip i by distance ∆, and increasing the width of strip i + 1 by ∆. We will refer to the hypothesis corresponding to each of the above modifications as H0i and H1i , respectively. Note that the sum of the widths of any two adjacent strips remains the same after this modification, as does the sum of all strip widths. Since a single bit of identifying information is embedded in every other strip, an 8-1/2 in. paper sheet passing through a shredder making a typical 3/16 =  = 21 bits in each 0.1875 in. wide cut would permit embedding  8.5/0.1875−2 2 page, where we subtract 2 bits corresponding to the possibly incomplete strips at the paper edges. Note that the decision rule analogous to (1) would require information about the widths of each strip for each of as many as 2k shredders. This is the case because the strip widths of each machine may be different prior to modification, as a result of natural variations in manufacturing. However this decision rule can be greatly simplified if we make the following assumption. If the widths of both the ’narrow’ and ’wide’ strips cut by all modified machines are identical, then we can simply compare the measured widths of two adjacent strips with the following decision rule: if

xi < xi+1 : decide H1i xi > xi+1 : decide H0i

f or i odd

(2)

In practice, of course, manufactured components are not identical (a fact we will exploit shortly) so we can not expect the strip widths to be such. However if the magnitude of the variation in manufactured components is small relative to the displacement ∆, this assumption is reasonable. The practical benefits of making this assumption are large, since (2) frees us from the requirement of access to all machines to perform measurements. We would next like to calculate the probability of making an error in detecting a single encoded bit. To do so, we observe that there are many sources of ’noise’ affecting our detection accuracy, including imprecision in component manufacture, variability due to paper types, machine aging, and measurement errors. Suppose that we model the composite affects of all these error sources as

396

Jack Brassil

additive noise through a collection of n/2 (n even) independent and identically distributed (i.i.d) random variables ni : i = 1, 2, . . . , n/2, each with zero mean and variance σ 2 . That is, H1i : xi = ai + ni H0i : xi = bi + ni

f or i odd

(3)

Assuming that each shredder was equally likely, we can write the detection error probability as Perror = 1/2P [xi+1 − xi > ∆|H1i ] + 1/2P [xi+1 − xi > ∆|H0i ] = P [xi+1 − xi > ∆|H1i ]

(4)

If we further assume that the noise variables are Gaussian, then the conditional probability density function xi+1 − xi |H1i is a normal random variable with mean −∆, and xi+1 − xi |H0i is a normal with mean ∆. We can then write the probability of making a single decision error in (4) as 2
∞ −1/2 −x2 Perror = P [ni > ∆] = ∆ (2πσ 2 ) e 2σ dx = 1.0 − erf c( ∆ σ)

(5)

To provide a sense of how small a strip width difference ∆ is required, if we set ∆ equal to the standard deviation of the composite ’noise’, than the probability of correctly guessing an embedded bit is erf c(1) ≈ 0.84. Given our ability to embed a single bit in every other strip (totaling about 21 bits for an 8-1/2 wide page), how best should we embed a unique identifier? Here we would naturally rely on standard error correction techniques, likely combining binary block coding and interleaving. A properly selected code could easily correct as many as 3 errors in these 21 bits. As a simple illustration, if we interleaved 3 Hamming (7,4) codes we would be capable of distinguishing 212 = 4096 uniquely encoded shredders. Using this (naive) scheme, if we set the strip width adjustment ∆ = 2σ as suggested in Section 3, the probability of correctly identifying a shredder among its 4095 colleagues would be 7 7 1 − Perror = [( ).9957 + ( ).9956 × .0051 ]3 = .998 0 1

(6)

Let us pause momentarily to revisit some of the assumptions made in arriving to the result in (6). Recall that we assumed that each strip could be associated with the cutting band which created it. That is, not only is each strip indexed, but we can explicitly associate it with a particular cutting band. Note that the shredder operator ordinarily dictates where the paper is fed into the device’s mouth. So in practice, achieving this alignment might take some care, and may require embedding marks solely for alignment purposes. Indeed, overhead lost to ’alignment’ or ’synchronization’ is quite common in detection systems. For example, in principle this alignment is no different than the use of standard center band and edge guard band sequences in 1-dimensional bar code systems such as the Universal Product Code [8].

Tracing the Source of a Shredded Document

397

To this point we have also assumed that we have recovered an entire sample page to test (or more precisely a collection of remnants forming a complete horizontal strip across a page). What if this is not the case? Suppose, for example, we are confronted with a bag of shreds produced by one of two hypothetical shredders A or B, created entirely from blank sheets of paper of unknown original page widths. It appears that we may again be able to identify the shredder used, assuming that the device embedded a fingerprint in a fashion designed to handle this form of remnant recovery. A naive approach to this would be as follows. Machine A embeds no fingerprint (i.e., no modification of the strip widths it produces) while machine B uses the width modulation technique discussed above. Then, upon measurement of large numbers of shreds, the appearance of a bimodal distribution in the width histogram (a unimodal distribution is shown in Figure 5) would clearly reveal that the shreds were produced by B. Indeed, a detection strategy based on the frequency of appearance of certain shred widths seems ideal. Not only would such an approach avoid the need for ordering shreds and associating them with a particular cutting band, but it would also be effective when bound, multiple page documents are shredded.

6

Detecting a Native Fingerprint

Is it possible to determine whether one of two shredders destroyed a document when neither shredder has been modified to embed a fingerprint? We will next show that there is reason for cautious optimism regarding this problem. Once again we limit our attention to a binary decision problem, assume that our recovered sample comprises an entire page, and assume that we have access to the shredders for measurement purposes. Our ability to distinguish between two shredders rests on our expectation that the cutting assembly components will be manufactured to within some allowable tolerance, and that such imprecision will be of sufficient magnitude so as to be detectable. Suppose that we assume that, due to manufacturing tolerances, the variation in widths of each strip cut by machines A and B can be represented by i.i.d. random variables. Suppose we assume that these variables are uniformly distributed, and that mechanical tolerances produce a ±5% variation about a strip width mean of 3 mm. (0.118 in.). Then we may write the probability density function  f (x) = fA (x) = fB (x) =

1 0

.118 − .0118/2 ≤ x ≤ .118 + .0118/2 otherwise

(7)

To distinguish between the 2 shredders, it is necessary to find a detectable difference in the width of the corresponding strip produced by A and B. Let’s suppose that we can detect a difference of ∆ inch. Do any corresponding strips have at least this difference is size? The density of the random variable Z = |X − Y | is easily calculated for i.i.d. uniform random variables (see [9], p. 190191) and equals

398

Jack Brassil

 fZ (x) =

20 − 200x 0

0 ≤ x ≤ 0.1 otherwise

(8)

The probability that any one pair of associated strips differs in width by an amount larger than our detection threshold is 

.0118

P [Z > ∆] = ∆

(20 − 200x) dx

(9)

If we set the detection threshold to ∆ = 0.005 in. (half that recommended earlier in this manuscript) then (9) reveals that a given associated pair of strips produced by A and B will have a detectable difference in width with probability 0.1245, or about 1/8. Recall that a full sheet of paper produces about 40 strips. Hence, we would likely encounter about about 5 instances of strip width differences of sufficient magnitude to be detectable. Hence, there is some reason to believe that a correct binary decision could be made under this set of assumptions. However, far more experimentation with actual modified shredders will be required to empirically verify this conjecture, and the assumption of uniformly distributed manufactured metal components is convenient but unlikely. In closing, it is interesting to note that the tolerance we assumed in our calculation was a modest ±5% variation about a strip’s mean width. However [10] specifies that the strip width tolerance for Class I shredders is 1/64 inch, or a surprisingly large ±25% variation about the mean.

7

Conclusions

We have provided initial evidence indicating that it is possible to modify document shredders in such a way that analysis of imperceptible variations in paper shreds can reveal the shredding device’s identity. Though we omitted the discussion from this paper, there are numerous simple yet effective countermeasures to our approach to machine identification. No doubt the thoughtful reader has already conceived of several, and all are invited to read the best document destruction practices identified in [10] for some additional clues. We have barely scratched the surface of an investigation into the detection of hardware device signatures. It may well be that the signatures of devices other than shredders, such as copiers and facsimile, will be just as intriguing to identify yet produce more immediate applications. For those interested in pursuing further work on document destruction, it appears that two large questions are worthy of attention. The first is whether it is possibly to establish the ’channel capacity’ of information hidden in shredded page remnants. The second, and likely more important question, is to what extent modifications to remnants provide a means of reducing the complexity of the document reconstruction problem.

Tracing the Source of a Shredded Document

399

Acknowledgements Thanks to the authors of [6] for developing and making public a set of image processing tools useful in our experiments. Thanks also to Adrian Perrig for informing the author of the existence of [11]. The author is eternally indebted to the recently deceased author of [9] for his teaching and guidance.

References [1] van Renesse, R. L.: Optical Document Security. Artech House, Boston (1993) 387 [2] Wagner, N. R.: Fingerprinting. Proceedings of the 1983 IEEE Symposium on Security and Privacy. IEEE Computer Society (1983) 18–22 388 [3] Golb, N.: Who Wrote the Dead Sea Scrolls? The Search for the Secret of Qumran. Scribner, New York (1995) 388 [4] Ogden, J. A.: The Siting of Papyrus Fragments: An Experimental Application of Digital Computers. Ph.D. Thesis, University of Glascow (1969) 388 [5] Levison, M.: The Siting of Fragments. The Computer Journal, vol 7, no 4 (1965) 388 [6] Seul, M., O’Gorman, L., Sammon, M.: Practical Algorithms for Image Analysis: Description, Examples and Code. Cambridge University Press, Cambridge UK (2000) 391, 399 [7] Helstrom, C. W.: Probability and Stochastic Processes for Engineers. MacMillan Publishing Co., New York (1984) [8] UPC Symbol Specification Manual. Uniform Code Council, Inc., Dayton Ohio (1986). See http://www.uc-council.org/reflib/01302/d36-t.htm 396 [9] Papoulis, A.: Probability, Random Variables and Stochastic Processes. McGrawHill Book Co., New York (1965) 397, 399 [10] Information Security Team: Terminator VIII: How to Destroy your Classified Materials. Department of Defense Security Institute (1992). See http://www.dss.mil/training/term4/doc 398 [11] Cohen, F.: The Mathematics of Shredding. Proceedings of the 2002 IEEE Symposium on Security and Privacy. IEEE Computer Society (2002) 399

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive Yuqun Chen¹, Ramarathnam Venkatesan¹, Matthew Cary², Ruoming Pang³, Saurabh Sinha², and Mariusz H. Jakubowski¹ ¹ Microsoft Research, One Microsoft Way, Redmond, WA 98052 {yuqunc,venkie,mariuszj}@microsoft.com ² University of Washington, Box 352350, Seattle, WA 98195 {mcary,saurabh}@cs.washington.edu ³ Princeton University, 35 Olden Street, Princeton, NJ 08544 [email protected]

Abstract. We describe a novel software verification primitive called Oblivious Hashing. Unlike previous techniques that mainly verify the static shape of code, this primitive allows implicit computation of a hash value based on the actual execution (i.e., space-time history of computation) of the code. We also discuss its applications in local software tamper resistance and remote code authentication.

1

Introduction

A major challenge in Software Tamper Resistance is finding a stealthy and robust primitive to ascertain the operational correctness of protected software. A prevalent method used today verifies the shape of the code, and sometimes critical data, before or during the runtime. It is accomplished by computing a cryptographic checksum on one or more segments of the code that is being protected. The shape-verification approach has many drawbacks of which we mention two here. First, it is quite straightforward to detect the verification routine, owing to the atypical nature of the operation, since most applications do not read their own code segments. Second, this approach fails to detect certain behavioral or data modifications to the software. For example, a hacker can temporarily change the return result by patching a register, right before the protected function returns, without having to alter the code. To address such problems, we propose a new concept called Oblivious Hashing (OH). The main idea is to hash the execution trace of a piece of code, thereby allowing us to verify probabilistically or deterministically the run-time behavior of the software. We accomplish this by injecting additional computation (hashing code) into the software (host code). The hashing code implicitly computes a hash value from the dynamic execution context of the host code. A main feature of our injection method is to blend the hashing code seamlessly with the host code, making them locally

F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 400-414, 2003.  Springer-Verlag Berlin Heidelberg 2003

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

401

indistinguishable and thus difficult to separate without non-trivial effort to run and observe the program’s execution repeatedly. Given OH as a primitive, a number of techniques can be used to make it an effective tool for tamper resistance. At the minimum, there must be stealthy ways for checking and acting upon the execution hashes; invocations of the checks must be networked into a graph so as to make it combinatorially hard to identify the underlying graph structure and remove these checks [1,11]. These techniques are critical to tamper resistance regardless of the software verification mechanism used. In this paper we focus on the oblivious hashing primitive itself, describing its concept and some implementation details. We also discuss its application to local tamper resistance and remote code authentication.

2

Related Work

Tamper-resistance techniques traditionally took advantage of software- and hardwarespecific features that were often un-documented (e.g., hidden functionality and “reserved” processor instructions). Unfortunately, special features are invariably limited in quantity and unchangeable over time. Typically, it did not take long before an unrelenting hacker uncovered the “trick” and completely defeated the protection. Not surprisingly, the security-by-obscurity approach has gradually given ground to more systematic approaches. The last few years have seen active development of computation-based techniques in software tamper resistance. A typical such system incorporates both software integrity verification and software obfuscation as its two main weapons against tampering. Among software integrity verification methods, computing a checksum (or hash) of code bytes (or, Code Checksum) is perhaps the oldest. An obvious direct derivative of the long studied areas of hashing for searching and sorting [18] and that of message authentication codes in cryptography [19], it is straightforward to implement and can be made quite efficient [1, 14, 15]. The main drawback of code checksum is that reading the code segment tends to stick out as an atypical operation during execution. The hackers can usually pin-point the checks by setting breakpoints or examining the code. Spreading many smaller checks over time and space, repeating atypical operations all over the code are the obvious heuristics to mitigate this problem. Furthermore, since this method only verifies the static shape of the code, it cannot detect certain run-time attacks whereby the hacker patches the instructions or return value (often held in a register) temporarily. Software obfuscation [1, 3, 4, 5] is another general but complementary technique that tries to make it difficult for attackers to understand and modify code in a useful manner. Most commercial obfuscation deployments involve proprietary technologies without many published implementation details, except on sites run for and by hackers who enjoy reverse engineering. A popular technique in software obfuscation is Code Encryption. Unless almost all the code is encrypted, use of this technique is easy to identify and attack. It does, however, help prevent straightforward disassembly and patching [1]. In the extreme case, code can even be decrypted one instruction at a time and custom-generated on the fly. On processor architectures with

402

Yuqun Chen et al.

variable-length instructions, for example Intel x86, one may also devise some antidisassembly and anti-decompilation techniques by embedding instructions within other instructions. Furthermore, since a debugger is a primary tool of crackers, debugger-detection and -disabling techniques may be viewed as useful deterrents. Some protection methodologies have strived to detect and disable general tools that might be used for observation and modification of running programs, such as described in [9, 10, 20s]. Historically, hardware and software debugging methods use printing out the trace of an execution. Our contribution can be viewed as a (probabilistic) compression of the trace from a security point of view. This is quite sensitive to the attack model, which in our case is that the program runs in a system owned by the adversary, who can use program analysis tools to detect, thwart and undo the checks and protection. This has to be contrasted with protection from downloaded code (where the adversary is external and the sandboxing can be an appropriate measure) or running a given code in an untrusted remote system and checking if the computations are properly carried out. The latter problem in a distributed execution environment is studied in [16], where a suitably embedded trace-gathering code ensures that the remote computer sends the result and the trace which can be locally cross-checked. Our tracecollection differs fundamentally on how it is done, used and the goals themselves. Our emphasis is on stealth and security via adequate randomization of the end results. OH gathers only a small subset of the execution states and state reduces the sequence of state changes to a small hash value to approximate and implement a light-weight progressive, one-way hash function designed to fingerprint the computation. It uses random keys and stresses the production of hash values that are hard to guess even if one has a functionally equivalent program that is not the exact copy of it. It is suitable for both local tamper resistance and remote execution verification. An orthogonal but seemingly related task is program (or result) checking [2, 7, 8, 13] that attempts to verify the input-output behavior of a program, but not its full execution behavior as OH does. These techniques are applicable only to problems on algebraic domains (whereas OH is intended for general software) and have no stealth criterion. Ideally one would have an algorithm that transform any given program into an “obfuscated” version which, roughly speaking, can be executed in a black-box fashion as if on a secure co-processor. But this is impossible or unlikely [17] in many models, because there exist programs that do not admit such an algorithmic transformation. However, for large, practical programs (e.g., not the “hello world” type), under suitable engineering assumptions one still may be able to derive quantifiably secure systems, where a primitive such as oblivious hashing can play a significant role.

3

Oblivious Hashing

We first present the OH technique using an abstract, and then describe a softwareonly implementation approach.

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

3.1

403

Abstract Model

In a simplified model of computation, a function (or a program)1 is represented by a sequence of abstract machine instructions I={i1, i2, …, iN} that read and write memory locations M={m1, m2, …, mK}, the initial configuration of the memory M0, an instruction counter C and its initial value C0. Our main idea is to capture the function’s execution trace T from which to compute a hash value H, as shown in Figure 1. Since the trace reflects the actual execution, the hash value thus computed serves as a robust signature on the function’s behavior. This value is a function of the code, data, the initial configuration of the machine, and the input parameter P: H ← H (T) ← H (I, M, C0, M0, P) { ← means “depends on” } We observe that in this model, external environment to the function is encoded in the initial memory configuration M0. A slight modification of the code and/or data is likely to cause the hash value to change, provided that T contains sufficient information from the actual execution.

Fig. 1. An abstract model for oblivious hashing

Attack Model: The attacker changes the instruction sequence and memory content during runtime in order to produce a correct hash value for a given set of inputs (which can be exorbitantly large). Note that if we apply OH only to a portion of the code, e.g., licensing verification, the attacker can bypass the licensing check by modifying the rest of the application. In general, protection must be extensive and spread out throughout the application. At the minimum, all the functions on the calling-hierarchy to the protected code must also be protected by OH and other mechanisms. The ideal trace T should include memory references made by each instruction and the instruction itself. One way to accomplish this is by using special-purpose hardware built into the microprocessor. A much less expensive and more flexible approach is to implement the hashing model in software.

1

Unless explicitly stated, the terms “function” and “program” are considered inter-changeable.

404

Yuqun Chen et al.

3.2

The Software Approach

The naïve software approach is to build a machine simulator that mimics the behavior of the hashing co-processor. But this is quite inefficient and vulnerable to a total break by a one-time attack on the simulator. A practical and efficient implementation can be done via code injection, which is common practice employed by profilers and bounds checkers. We inject into the host code “monitor” instructions that capture each step of the computation and compute the oblivious-hashing value as the computation proceeds, as illustrated in Figure 2. The hashing instructions, colored black in the figure, take the results of previous instructions and apply them to the hash values stored in main memory. The diagram illustrates multiple memory locations that jointly store the intermediate and final result. Note that these hashing instructions are the same kind of instructions as in the original software; they read and write data locations just like other instructions. With proper care when injecting the hashing instructions, we can make them blend seamlessly into the to-be-verified software both in appearance and during execution.

Fig. 2. Software-only Oblivious Hashing

Compared with the hardware approach, the code-injection approach can achieve similar degree of efficiency, and yet requires no modifications to the underlying hardware and operating system. We term our method of hashing computation “oblivious hashing,” as an attacker is oblivious to the fact that part of the software is computing an execution hash value during the normal computation.

4

Implementation

To implement OH, we preferred not to perform binary editing on the compiled code and chose to work with a higher-level representation. Besides the obvious high overhead, binary-level code injection suffers from several practical constraints that make it difficult to obfuscate the identity of hashing instructions. For example, due to the register-oriented nature of modern processor architecture, our hashing injections have to use registers to store intermediate values. However, register allocation is already fixed by the time object code is generated and it is inefficient to reverse-

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

405

engineer the register-allocation at the binary level, and find free registers for use by hashing code. Pushing-and-popping used registers will make the hashing instructions obvious and thus allow them to be easily spotted. Hence, injection of the hashing instructions at a higher level is preferred. 4.1

Syntax-Tree Modification

This higher level that we have in mind is the syntax tree produced in the parsing stage of the compilation process. The syntax tree contains explicit dependency information, which makes it straightforward to insert additional statements while preserving the correctness of original computation. The second advantage in inserting OH code in the syntax tree is speed. The syntaxtree representation can be thought of as a higher-level abstract machine: Instead of instructions, we have expressions and statements. Instrumenting the syntax tree is more efficient than instrumenting the machine code, because many intermediate computations are saved from hashing. For example, to hash the C statement X=Y+A*B–C/D, we need only hash the final assignment to X, because the intermediate value computations do not cause changes to the state of the function (or program). Were the attacker to change the intermediate computation, he would still be caught if X is assigned an incorrect value. The third advantage is that the optimizations performed in the subsequent stage may interleave the hashing code with the host code, making detection of the hashing code more difficult. Temporary variables used by the hashing code are allocated identically to host-code variables by the second phase of the compiler, and thus are not easily distinguishable from host-code variables. Finally, instrumenting the syntax tree makes oblivious hashing machineindependent. Being used in early stages of compilation, syntax trees contain little or none information on the machine architecture. Oblivious hashing will thus produce the same results regardless of the final machine platform. This is especially useful for platforms such as MSIL and Java. We implemented OH for the Microsoft Visual C/C++ compiler, version 7.0. The compiler emits intermediate-level representation, C Intermediate Language (CIL) for every source file. The CIL representation is just like any compiler intermediate representation. The CIL files are stored temporarily on disk before being passed on to the compiler backend. The CIL representation contains just enough information for the C-style backend to perform optimization and code generation. Though information on complex types is lost in CIL, we found the representation adequate for adding OH code2. 4.2

Hashing Sites

Our next step is to determine the kind of programming constructs to hash. Assignments and control flows are two natural choices. Assignments change the state 2

We later found out that CIL is inadequate for using static analysis to identify “unhashable” statements. A re-writable syntax tree with richer information would have been more suitable. Unfortunately, such a tool does not exist on Windows platform yet.

406

Yuqun Chen et al.

of a function or a program, and hence are the largest indicator of a program's behavior. We found, however, that many functions served only to make high-level control flow decisions, and that few assignments were performed in coming to these decisions. Adding control flow expressions to our set of hash sites made the final hash value much more sensitive to program behavior. While a more complete system could hash things such as function arguments, hashing assignments and control flows captures most of the dynamic behavior of a program . For example, since most function arguments are simply variables whose value has been computed in a previous assignment, hashing function arguments would not add much extra information to the hash. Assignment and Expressions: The C operator we which is rarely used in programming. Note that the as the comma used to separate function arguments. expk) will evaluate exp1 through expk, and have assignment is transformed in the following way:

rely on is the comma operator, comma operator is not the same A C expression (exp1, exp2, ..., the value of expk. Thus, an

a = exp is transformed to a = (t = exp, HASH(t), t) Conditional expressions are similarly transformed: if (exp) {…} is transformed to if ( (t=exp, HASH(t), t) ) {…} Using the comma operator and a temporary variable t, this transformation lets us intercept the value of assignment, and at the same time preserve the C semantics that the assignment operator has a value of the assigned value. Here expression HASH(t) is an inline macro, as an explicit function call would violate our principle of making the hash code difficult to detect and not centrally located. Control Flows: To capture the control flow within a function, we inject one or more hashing instructions within each basic block. In our syntax-tree representation of the function, a basic block is identified by a label that is either specified by the programmer or generated by the compiler front end. In the CIL representation, it is quite straightforward to locate the labels and inject hashing operations between two adjacent ones. Our OH-injection tool also allows the user to specify the percentage of a function to be hashed. This gives the user to control the amount of overhead, in terms of both code size increase and run-time overhead. This feature is especially useful when applying OH in remote code authentication (described in Section 5.2). 4.3

Hash Computation

The hashing instructions are executed every time the host code runs, and thus they must comprise inexpensive operations. Fortunately, our situation is different from message authentication codes (MAC) so that such performance optimizations are possible. A MAC is applied to a piece of static data each time, whereas an oblivious hash is derived from the execution of the host code or a fraction of it. The execution of the host code depends on the input parameters. The attacker may be able to carefully modify the code so that the tampered code produces the correct oblivious hash for a given input parameter. But it would be much more difficult to do this for

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

407

many different inputs. In fact, if a code segment yields the same OH values for sufficiently large number of inputs, there may be only one such segment. An analogy to linear algebra will help illustrate this point. Let us imagine that the code including the hashing instructions is a vector of numbers denoted as Ω, that each input is a test vector, and that the dot product between the code vector and the input vector yields an oblivious hash. A collection of inputs I1, I2, .., In forms a test matrix Γ such that Γ · Ω = H = [H1, H2, …, Hn], where Hi is the corresponding hash value. Given a sufficient number of orthogonal vectors in Γ, Ω is uniquely determined. The above analogy is a gross over-simplification of oblivious hashing: The instructions in the hashed code do not correspond to numbers, and the interrelationship between instructions is far more complicated than that in a set of numbers. Even a simple analogy like this shows the difficulty faced by the hacker: It is very difficult to tamper with the code (i.e., the vector Ω) while producing correct hash results (i.e., preserving the relationship Γ · Ω = H). In reality, the amount of binary modifications that the hackers can do is quite limited, due to the lack of sufficient information in a compiled, released binary executable. The common operations employed by the hackers are replacing existing instructions with different ones, setting debug breakpoints to hijack controls from the code, and intercepting API calls to the underlying operating system. Given that the patched instructions must not result in program crashing, the attacker can generally patch only a tiny number of instructions. This greatly restricts his freedom in altering the code and yet producing the same hash results for more than one challenge input. We conjecture that weaker but efficient operations are adequate to compute the oblivious hash. In one of our implementations, the hash result is kept in a logical array of 32-bit words, initialized to a random pattern during compile time. Each hashing operation HASH(val) takes the general form H[i] = H[i] op1 H[j] op2 X { op3 random_constant } where H[i] and H[j] are two elements in the hash result array, randomly chosen for the hashing operation. X is a random constant generated at the compile time. The three operators, op1, op2, and op3, are chosen randomly from a set of arithmetic and bit operators at the compile time. The operation “op3 random_constant” in the curly braces are optional. We can also profile the original program to bias the operation selection so as to avoid creating “obvious” hashing code such as one containing too many XOR operations. In principle, the hash array need not be contiguously allocated; it can be made up of a number of unrelated 32-bit variables scattered around in the heap. For convenience, our current implementation allocates the hash array contiguously, though minor change in our software will easily remove this artifact. The hash storage need not be in the global variables, either. Our hash injection tool can also modify the hashed functions3 and their call sites to have the hash variables passed by pointer. For example, in order to verify a function F(x, y) using oblivious 3

We here address only C functions, and omit decorated names for modified C++ functions.

408

Yuqun Chen et al.

hashing, the caller can simply allocate a hash variable h on its stack and passes it to F as an additional argument, e.g., F(x, y, &h). Note that our injection software can place the hash variable at an arbitrary place on hashed function’s argument list, as long as its position is consistent for all call (and hashing) sites. Code Sample: In the appendix, we illustrate oblivious hashing using a factorial function written in C. We compile the program using the Microsoft C/C++ compiler with the “-O2 –GB” optimization flags. Disassembly listing of the original function and two hashed versions are provided. In the first hashed version, 50% of the hashable statements are randomly chosen for hashing. In the second version, OH is performed on the entire function. For both versions, the 32-bit OH result is passed back and forth via an additional pointer argument to the function, which is created automatically by our OH-injection tool. 4.4

Unhashable Statements

So far we have assumed a simplistic function that is deterministic with respect to input data4. In reality, some code depends on external environment such as time of the day, user identity, etc., that is hard to control. The internal memory allocator may return different addresses depending on how the thread is scheduled. Unpredictable data, such as external input or return values of system calls, can cause oblivious hashes to vary arbitrarily. As a result, only a portion of the host code executes deterministically with respect to the input parameters. The question of what to fingerprint for an execution is a major problem. There are two obvious approaches to solving this problem. One can apply the usual static-analysis techniques to conservatively locate the deterministic portion of the host code. Alternatively, one can gather run-time traces on some test inputs, and use the traces to determine the portion of the execution path that remains the same across the test inputs. Once these “unhashable” expressions and side effects are determined, we can exclude them from the hash computation. We may also determine and specify “unhashable” sites manually, though automated analysis would prove much more convenient and less prone to human errors. We experimented with the second approach on a commercial application with antitampering features. We instrumented the program to produce a trace of expression values that we are interested in. We then ran the instrumented program multiple times, in all interesting execution contexts, and post-processed the tracing output to determine which expressions were constant across runs. The graph above (Figure 3) shows the distribution of functions according to the amount of hashable expressions in each. The results are quite telling. We found that even using such a strong requirement still left enough hashable expressions to provide good code coverage for our test program. However, we do want to point out that our test inputs may not exhaust all possible code paths, although we have reasons to believe that they do by visual inspection. In production code the situation may well be different. A conservative approach based on static analysis would be more assuring. Static analysis for oblivious hashing is still an on-going work. 4

Accesses to global data inside the function can be parameterized with additional pass-byreference parameters.

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

409

Percentage Distribution

100%

Percentage of Functions

90% 80% 70% 60% 50% 40% 30% 20% 10% 0% 0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Percentage of Hashable Expressions per Function

Fig. 3. Hashable expressions per function

5

Applications of Oblivious Hashing

As a method to verify the behavior of programs, oblivious hashing helps solve some currently important problems in both local-software security and network-oriented computing. For software running locally on a single machine, oblivious hashing can prevent tampering by either a malicious hacker or malware (viruses, worms, and Trojans). For client-server applications, oblivious hashing can prove a client’s authenticity and proper functioning to a server, and vice versa. 5.1

Local Software Tamper Resistance

For verifying the proper operation of a program in a simple manner, oblivious hashes can be used much like typical hashes or checksums of code bytes: The program computes hashes and compares them against pre-stored values. However, if done naïvely (e.g., with one or a few simple Boolean checks), this is not likely to be strong; the problem of easily patched Boolean comparisons is the same as with verification of code-byte checksums. Additionally, oblivious hashes introduce a number of unique issues: Pre-computation of Correct Hashes: Unlike a code-byte hash, an oblivious hash is “active” in that the code to be protected must run (or be simulated) in order for the hash to be produced. Security Coverage over Code Paths: An oblivious hash depends on the exact path through a program, as determined by input data. If execution does not reach some part of a program during hash computation, that part is not hashed and thus unprotected. Unhashable Data: As described earlier, data that are too variable or not predictable typically cannot be hashed obliviously.

410

Yuqun Chen et al.

One strategy for addressing the above issues is as follows. Prior to shipping a protected application, we choose a number of specific functions and inputs that exercise security-sensitive code paths. We then run the given functions on the specified inputs, saving the resulting oblivious hashes. Our security requirements and knowledge of the application’s semantics determine the functions and inputs used for oblivious hashing. Alternately, static analysis or hints from the developer could automate the process of determining what to hash. Another unique issue with oblivious hashing involves cross-checking of different code sections, a technique essential for increasing the complexity of breaking protection [11]. With code-byte hashes, two code segments, A and B, can crosscheck each other simply by verifying each other’s hashes. With oblivious hashing, however, a cross-check involves mutually recursive calls. Without special methods of termination, this recursion is infinite. Unfortunately, explicit termination measures could point the hacker’s attention to oblivious-hashing code, as well as create significant complexity when more involved cross-checking graphs and indirect recursion are present. A promising approach is to invoke cross-checks probabilistically. It’s a topic of our current research on OH. 5.2

Remote Code Authentication

Autonomy is the trend in network services: Software client agents act on behalf the users; servers talk to one another without human intervention. There is a growing demand for robust authentication of remote software entities. Remote code authentication is the problem of verifying the identity of a remote program. Authentication can occur at all levels: between a client and a server, between two servers, and between two communicating clients. Unless specifically noted, the terms “client” and “server” refer to the application software that runs on each client or server machine. Remote code authentication differs from the usual user-based authentication, in that it strives to verify the identity (or the authenticity) of the communicating application as opposed to the user who is running the software. Unlike passwords, a piece of code is an active entity. Verifying its dynamic behavior yields stronger authentication than checking its static shape, as the hacker can easily fool the latter mechanism by keeping a copy of the original, unhacked code around. Oblivious Hashing is an ideal fit for remote code authentication, as the oblivious hash represents a fingerprint of the code execution. In a simple embodiment (Figure 4), machine A authenticates a program P on machine B by generating a random input X to P and sending it to B. An identical copy of P (or a critical portion of P) is also present on machine A. Both A and B run P on the random input X and derive an oblivious hash value H. To forestall the man-in-the-middle attack, the hash value H is not transmitted over the wire. Instead, a session encryption key is derived from H; it is used to encrypt all subsequent communication between A and B. If B and A run the same version of P, they ought to derive the same session key. This is how A can verify the authenticity of program P on a remote machine B. An adversary can still attempt to crack this system by extracting the hashed computation from P or calling the computation directly. The problem thus becomes reverse-engineering the program P, which can be made quite difficult by usual

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

411

obfuscation techniques such as OH for local tamper resistance, code encryption and anti-debugging mechanisms.

Fig. 4. Oblivious Hashing used in remote code authentication

6

Conclusions

In this paper we presented a novel software integrity verification primitive, Oblivious Hashing, which implicitly computes a fingerprint of a code fragment based on its actual execution. Its construction makes it possible to thwart attacks using automatic program analysis tools or other static methods. This new method verifies the intended behavior of a piece of code by running it and obtaining the resulting fingerprint. It is more implicit than the traditional shape-verification methods, and addresses some attacks that cannot be detected by the latter. We also presented a software-only implementation that injects and blends hashing code into the syntax-tree representation of the program. This approach avoids many problems faced by a binary-editing method. Only critical expressions are hashed by our method. For example, intermediate computations are skipped as they do not directly affect the program state. The result is much lower overhead. Manipulating at the syntax-tree level also allows the injected code to blend well with the host code, achieving high degree of secrecy. This technique is suitable for local software tamper resistance and remote code authentication. Our experiment with a real-world program showed that a large portion of the code can be obliviously hashed for a majority of functions, which is encouraging. Our method also raises questions about how to adapt existing program analysis techniques to suit our purposes. Oblivious Hashing has its own limitations. For example, it cannot detect x86 debugger breakpoints implemented by using the INT3 instruction, whereas the traditional code-checksum method can. A robust software tamper-resistance solution should incorporate both OH and other methods.

Acknowledgement We thank the reviewers for their feedback and pointers to related literature.

412

Yuqun Chen et al.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17]

D. Aucsmith, “Tamper Resistant Software: An Implementation,” in Proceedings of the First International Workshop on Information Hiding , May 1996. M. Blum and S. Kannan, "Designing Programs That Check Their Work,” in Proceedings of ACM Symposium on Theory of Computing, pgs 86-97, 1989. C. Collberg, C. Thomborson and D. Low, “Breaking Abstractions and Unstructuring Data Structures,” in Proceedings of IEEE International Conference on Computer Languages, ICCL'98, May 1998. C. Collberg, C. Thomborson and D. Low, "Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs", in Proceedings of Symposium on Principles of Programming Languages, pp. 184-196, 1998. C. Collberg and C. Thomborson, “Watermarking, Tamper-Proofing, and Obfuscation - Tools for Software Protection.” Cloakware Corporation, http://www.cloakware.com. F. Ergun, S. Kannan, S. R. Kumar, R. Rubinfeld and M. Viswanathan, “SpotCheckers,” in Proceedings of ACM Symposium on Theory of Computing, pgs 259 – 268, 1998. F. Ergun, S. R. Kumar and D. Sivakumar, “Self-Testing Without the Generator Bottleneck,” SIAM Journal of Computing, vol. 29, no. 5, pgs 1630—1651, 2000. G. Hunt and D. Brubacher, “Detours: Binary Interception of Win32 Functions,” in Proceedings of the 3rd USENIX Windows NT Symposium, pgs 135 – 143, July 1999. Sysinternals, http://www.sysinternals.com. R. Venkatesan, V. Vazirani, and S. Sinha, “A Graph Theoretic Approach to Software Watermarking,” in Proceedings of the Fourth International Workshop on Information Hiding, April 2001. C. Wang, J. Hill, J. Knight and J. Davidson, “Software Tamper Resistance: Obstructing Static Analysis of Programs,” Technical Report CS-2000-12, University of Virginia, December 2000. H. Wasserman and M. Blum, “Software Reliability via Run-Time ResultChecking,” Journal of ACM, vol. 44, no. 6, pgs 826 – 849, 1997. B. Horne, L. Matheson, C. Sheehan and R. Tarjan, “Dynamic Self-Checking Techniques for Improved Tamper Resistance,” in Proceedings of the Workshop on Security and Privacy in Digital Rights Management, November 2001. H. Chang and M. Atallah, “Protecting Software Code by Guards,” in Proceedings of the Workshop on Security and Privacy in Digital Rights Management, November 2001. F. Monrose, P. Wyckoff, and A. Rubin, “Distributed Execution with Remote Audit,” in Proceedings of the ISOC Network and Distributed System Security (NDSS) Symposium, February 1999. B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S.Vadhan and K. Yang, “On the (impossibility) of Obfuscating Programs,” Advances in Cryptology - CRYPTO `01, vol. 2139 of Springer-Verlag Lecture Notes in Computer Science, pp. 1-18, August 19-23, 2001.

Oblivious Hashing: A Stealthy Software Integrity Verification Primitive

413

[18] D. Knuth, “The Art of Computer Programming, Volume 2, Seminumerical Algorithms,” Addison-Wesley Publishing Company, Inc., 1973. [19] Menezes, P. van Oorschot and S. Vanstone, “Handbook of Applied Cryptography,” CRC Press, 1997. [20] SoftICE debugger, Compuware Corporation, http://www.compuware.com.

Appendix C Source Code unsigned int factorial(int n) { unsigned int fact; for (fact=1; n>0; n--) fact=fact*n; return fact; }

Assembly List of the Original, Unhashed Function _factorial: 00000000: 00000004: 00000006: 0000000B: 0000000D: 00000010: 00000013: 00000014: 00000016: 00000018:

mov test mov jle lea imul dec test jg ret

ecx,dword ptr [esp+4] ecx,ecx eax,1 00000018 ecx,[ecx] eax,ecx ecx ecx,ecx 00000010

Assembly Listing of the 50%-Hashed Function _factorial: 00000000: 00000004: 00000006: 0000000B: 0000000D: 0000000E: 00000012: 00000015: 00000017: 00000018: 0000001A: 0000001C: 0000001E: 00000022: 00000024: 00000025: 00000026: 0000002A: 0000002E: 00000030:

mov test mov jle push mov imul mov dec xor test jg mov mov pop ret mov mov mov ret

ecx,dword ecx,ecx eax,1 00000026 esi esi,dword eax,ecx edx,ecx ecx esi,edx ecx,ecx 00000012 eax,dword dword ptr esi

ptr [esp+4]

ptr [esp+0Ch]

ptr [esp+0Ch] [eax],esi

ecx,dword ptr [esp+8] edx,dword ptr [esp+8] dword ptr [ecx],edx

414

Yuqun Chen et al.

Assembly Listing of the 100%-Hashed Function _factorial: 00000000: 00000004: 00000006: 00000008: 0000000B: 0000000C: 00000010: 00000015: 00000017: 00000019: 0000001B: 0000001C: 0000001D: 00000020: 00000023: 00000025: 00000027: 00000028: 0000002A: 0000002D: 0000002F: 00000031: 00000033: 00000035: 00000037: 00000039: 0000003B: 0000003F: 00000040: 00000041: 00000043: 00000044: 00000045: 00000049: 0000004B: 0000004C:

mov xor test setg push mov mov add test je push push lea imul mov xor dec test setg mov sub sub add test mov jne mov pop pop mov pop ret mov mov pop ret

ecx,dword edx,edx ecx,ecx dl esi esi,dword eax,1 esi,edx edx,edx 00000045 ebx edi ecx,[ecx] eax,ecx edi,ecx edx,edx ecx ecx,ecx dl ebx,edx ebx,esi ebx,eax ebx,edi edx,edx esi,ebx 00000020 eax,dword edi ebx dword ptr esi

ptr [esp+4]

ptr [esp+0Ch]

ptr [esp+14h] [eax],esi

ecx,dword ptr [esp+0Ch] dword ptr [ecx],esi esi

Practical Oblivious Transfer Protocols Christian Tobias Justus Liebig University Giessen, Department of Mathematics Arndtstrasse 2, 35392 Giessen, Germany [email protected]

Abstract. We consider 1-out-N Oblivious Transfer (OT) for strings. Oblivious Transfer is a primitive used in a variety of cryptographic protocols and applications (e.g. [11, 1, 10, 17, 12, 13]). We present a new highly efficient two-pass (one-round) protocol for 1out-N OT. Our protocol has a constant online computational complexity (for the chooser as well as for the sender). This is a surprising property, since in our protocol the sender’s computational complexity does not depend on the number N of strings. The privacy of chooser and sender is protected computational under the Decisional Diffie-Hellman assumption. We also sketch how to apply the techniques of [1] to our protocol to get a protocol for priced OT.

1

Introduction

This article considers 1-out-N oblivious transfer (OT) for strings. In the setting of OT a sender holds N strings M1 , . . . , MN and is willing to disclose exactly one of them to a chooser. The index σ ∈ {1, . . . , N } of the disclosed string Mσ is determined by the chooser and must not be learned by the sender. It further has to be assured that the chooser does not gain any information about any string Mi with i  = σ. Oblivious transfer protocols can be used as stand-alone protocols, e.g. for trading digital information [1], or as a building block for more complex protocols, e.g. for secure two-party computations [10, 17], privacy-preserving auctions [13] and oblivious polynomial evaluation [12]. We present a new protocol for 1-out-N OT that is highly efficient. In an initialisation phase chooser and sender exchange their public data. The chooser further has to prove the correctness of the data he presented using a zero-knowledge proof of knowledge. After this initialisation phase all following protocol executions are only one-round (two-pass). Our protocol is provably secure under the Decisional Diffie-Hellman (DDH) assumption. Against honest (but curious) choosers we show this by a formal reduction to the DDH problem. Against dishonest choosers we show that a successful adversary must be able to solve random instances of the DDH problem which is a slightly weaker result. The security of our protocol does not rely on the use of random oracles. F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 415–426, 2003. c Springer-Verlag Berlin Heidelberg 2003


416

Christian Tobias

The main advantage of our protocol is its computational complexity. It is constant for the chooser and O(N ) for the sender. However, nearly all of the sender’s computations can be done offline, i.e. these computations do not depend on data sent by the chooser and can be performed before the actual protocol execution. The sender only needs to calculate 3 modular exponentiations online. In particular the sender’s computational complexity does not depend on the number N of strings Mi . For this property a price has to be paid. The sender’s public data that is transmitted once before the first protocol execution has to comprise at least N random group elements. In section 3.2 we show how the size of the sender’s public data can be reduced to just one group element if random oracles are used. When using OT protocols to sell digital information, the sender does not learn anything about the chooser’s choice. So he can only charge him for the number of strings he retrieved, i.e. for the number of OT protocol executions that have been run. For realistic business scenarios a model in which the sender may charge different amounts for the offered message strings would be more suitable. Aiello, Ishai and Reingold [1] presented techniques to reach this goal. In Section 4 we sketch how to extend our solutions with the techniques of [1] to get a protocol for priced OT. Related Work: Our protocol falls in the category of 1-out-N OT protocols that are (after an initialisation phase) two-pass and whose security does not rely on random oracles. Other OT protocols in this category have been recently published by Naor, Pinkas [14], Aiello, Ishai, Reingold [1] and Tzeng [16]. In all these protocols the (online) computational work is constant for the chooser1 and O(N ) for the sender.2 The amount of data transmitted from the sender to the chooser is also O(N ). In the protocol we propose the amount of transmitted data and the chooser’s computational work are the same, but the sender only has to perform 3 modular exponentiations online. The protocols [14], [1] and [16] differ in the amount of work that has to be done before the first protocol execution between a certain chooser and the sender. In [14] and [16] sender and chooser only have to agree upon a common group and one (resp. two in case of [16]) generators of that group. In [1] and the protocol we propose the sender further has to be in possession of the chooser’s public-key. To be simulatable in the ideal implementation the chooser has to give an interactive zero-knowledge proof of knowledge that he knows the secret key corresponding to his public key. Aiello, Ishai and Reingold [1] considered priced oblivious transfer. In this extension of the standard OT setting the sender is able to charge money from the chooser for the transmitted information. The sender is able to charge different amounts for his strings without learning which string has been chosen by the 1

2

To be simulatable in the ideal implementation the chooser in [16] further has to give a non-interactive zero-knowledge proof of knowledge that his first message has been constructed properly in every protocol execution. Measured in modular exponentiations as the most expensive operations.

Practical Oblivious Transfer Protocols

417

chooser. In a concluding section we sketch how to apply the techniques of [1] to our protocol to get a protocol for priced OT. Organisation: In section 2 we specify the problem and its security requirements and give all necessary definitions. In section 3 we describe our new protocol and discuss its security and efficiency. In section 4 we sketch how the techniques of [1] can be applied to our protocol to extend its applicability to priced oblivious transfer.

2

Framework and Definitions

All exponentiations in the following sections are carried out in ZZ ∗p . Throughout this article all random elements are chosen uniformly and independently of all other random processes. The following definitions for the ElGamal encryption scheme and the DiffieHellman assumption can also be defined for arbitrary cyclic groups. Decisional Diffie-Hellman (DDH) Assumption: There is no efficient algorithm that given (p, q, g, g a , g b ) distinguishes between g ab and g c with nonnegligible advantage, where g is a uniformly chosen generator of order q and a, b and c are uniformly chosen from ZZ q . For a detailed discussion of the DDH-Assumption we refer to [15].

ElGamal Encryption: Let p, q be two large primes with q | p − 1, g be an element of ZZ ∗p of order q and Gq be the subgroup of ZZ ∗p generated by g.3 The secret key is a random value a ∈R ZZ q and the corresponding public-key is g a . The encryption of a message m ∈ Gq is (g ab m, g b ) for a random b ∈R ZZ q . The ElGamal encryption scheme is semantically secure under the DDH assumption if the message space is restricted to Gq . By using a pair-wise independent hash function one can overcome the limitation of the message space and extend the usability of the ElGamal scheme to arbitrary strings. In this case ElGamal ciphertexts have the form (m ⊕ h(g ab ), g b ). This variant of ElGamal is semantically secure under the DDH assumption if h is a pair-wise independent hash function (see [15] for details).

Oblivious Transfer: Oblivious transfer considers a sender holding N strings M1 , . . . , MN and a chooser who has an index σ ∈ {1, . . . , N } as his private input. During the execution of the OT protocol the chooser should learn string Mσ , but gain no information about the other strings Mi with i  = σ. On the other hand 3

In the original ElGamal public-key encryption scheme [7, 8] g is a generator of the cyclic group ZZ ∗p .

418

Christian Tobias

the sender must not be able to find out which index the chooser has decided on. We define security separately for the chooser and for the sender:

Privacy of the Chooser: For any σ, τ ∈ {1, . . . , N } and for any probabilistic polynomial time adversary A executing the sender’s part, the views that A sees when the chooser tries to obtain Mσ and in case the chooser tries to obtain Mτ are computationally indistinguishable given Mσ and Mτ .

Privacy of the Sender: In the ideal implementation a trusted third party (TTP) gets M1 , . . . , MN from the sender and σ ∈ {1, . . . , N } from the chooser and sends Mσ to the chooser. Our requirement is that for every distribution on the inputs (M1 , . . . , MN ) and any probabilistic polynomial time adversary A substituting the chooser, there exists a simulator A that gets to play the chooser’s role in the ideal implementation and receives the same a priori information about M1 , . . . , MN as A , such that the outputs of A and A are computationally indistinguishable to a polynomial time distinguisher that is given M1 , . . . , MN . This definition of security for OT goes back to Beaver [2] and is motivated by security definitions for general multi-party computation. The idea is that an adversary that breaks the real protocol can be used to create an adversary that breaks the ideal protocol, which is impossible by definition. It is also possible to define information-theoretical privacy of chooser resp. sender. In this case the adversary is assumed to be computationally unbounded and the resulting views have to be statistically indistinguishable. The Random Oracle Model: In the Random Oracle Model cryptographic hash functions are replaced by random functions. Random functions are idealisations of hash functions, because the function values of different (even related) pre-images are statistically independent. So it is computationally hard to find any collisions among the function values. The idealised hash functions are defined as oracles. Every participant is allowed to ask arbitrary oracle queries and gets a random (independently and uniformly chosen) answer if this query has not been asked before. Identical oracle queries certainly result in the same answer. For a detailed description and discussion of the random oracle model we refer to [3, 4, 5, 6].

3

The New OT Protocol

We assume that sender and chooser use the same parameters p, q and g. Let (x, h = g x ) be the chooser’s ElGamal key pair. The sender chooses random values b1 , . . . , bN ∈R ZZ q and publishes the values g bi (for 1 ≤ i ≤ N ). These values have to be pair-wise different, have to be known by the chooser before the

Practical Oblivious Transfer Protocols

419

first protocol execution and can be used in arbitrary many protocol executions with arbitrary choosers. For the security of the protocol it is essential that the exponents bi , i.e. the discrete logs of the published values, are not known by the chooser. So the values g bi can be interpreted as the sender’s public-key or as system-wide parameters. We further assume that the chooser gives an interactive zero-knowledge proof of knowledge that he knows the secret key corresponding to his public-key before the first protocol execution. We will use the knowledge extractor of this proof of knowledge later for simulating the protocol in the ideal implementation. In the following section we assume that the messages M1 , . . . , MN are elements of the cyclic subgroup Gq of ZZ ∗p generated by g. One can override this limitation and allow the messages Mi to be arbitrary bitstrings by using a pair-wise independent hash function H. In this case the encrypted messages that are transmitted in the second pass of the protocol are of the form Ei = Mi ⊕ H(g abi +k ) (see also section 3). When chooser and sender have agreed on common parameters and exchanged their public-keys all subsequent protocol executions are 2-pass. The protocol is summarised in the following table. Public Input: g b1 , . . . , g bN Chooser

Sender

Private Input: σ ∈ {1, . . . , N } ElGamal key pair: (x, h = g x ) C = (C1 , C2 ) = (g bσ hr , g r )

Private Input: M1 , . . . , MN

C

✲ ?

(C1 )q = 1 ?

(C2 )q = 1 a, k, l ∈R ZZ q C1 = C1a g k hl C2 = C2a g l C  = (C1 , C2 ) For 1 ≤ i ≤ N compute 

abσ +k

C1

· (C2 )−x −abσ −k

g = Mσ = Eσ · g

✛ C , Ei

Ei = Mi · g abi +k

Note that C and C  are ElGamal encryptions of g bσ and g abσ +k under the chooser’s public-key. The sender is able to compute C  without knowing the corresponding plaintext using the homomorphic property of the ElGamal cryptosystem. By checking that (C1 )q = 1 and (C2 )q = 1 the sender ensures that

420

Christian Tobias

C ∈ G2q and that C is a proper ElGamal ciphertext. If one of this equations is not fulfilled the sender aborts the protocol execution. Efficiency: We measure computational complexity in terms of modular exponentiations only, because they are most expensive. Further we distinguish between online and offline computations. Offline computations may be done in a preprocessing stage whereas online computations have to be done during protocol execution. We consider all computations that depend on particular input from the chooser (e.g. his public-key) to be online4 . The chooser has to perform 3 exponentiations (2 for the computation of C and 1 for the decryption of C  ), where g r and hr can already be precomputed and thus only 1 exponentiation needs to be done online. The sender has to perform N + 5 modular exponentiations altogether, but only 3 need to be done online. We assume that the random values a, k and l are chosen in the preprocessing stage. Thus the ciphertexts Ei (N exponentiations) and the values g k and g l can be precomputed. The sender then only needs to compute hl and raise the two components of C to the power a to get C  . 3.1

Security Analysis

The protocol is complete. If both parties follow the protocol, the chooser gets the desired string Mσ . The chooser is protected computationally under the Decisional DiffieHellman assumption (because of the semantic security of the ElGamal encryption scheme). The sender is also protected computationally under the Decisional DiffieHellman assumption. We prove security by a simulation in the ideal implementation: The knowledge extractor of the zero-knowledge proof of knowledge given before the first protocol execution by the chooser is used to extract the chooser’s secret key. The simulator now can decrypt the messages that the chooser sends in the first protocol pass. Case 1 (Honest Chooser): The resulting cleartext equals g bσ for 1 ≤ σ ≤ N . Since we assumed the g bi to be pair-wise different, the simulator is able to extract the index σ. – – – – 4

The The The The

simulator simulator simulator simulator

contacts the oracle to get Mσ . chooses random a, k, l ∈R ZZ q . computes C  = (g abi +k hl , g l ). computes Eσ = Mσ · g abσ +k and chooses Ei ∈R Gq for i  = σ.

It certainly also would be possible to do these computations in a preprocessing phase, but in this case the sender has to preprocess and store data for each possible chooser.

Practical Oblivious Transfer Protocols

421

Case 2 (Dishonest Chooser): The resulting cleartext c is different from g bi for all 1 ≤ i ≤ N . – The simulator chooses random a, k, l ∈R ZZ q . – The simulator computes C  = (ca g k hl , g l ). – The simulator chooses Ei ∈R Gq for 1 ≤ i ≤ N . We now show by a hybrid argument that real and simulated protocol executions cannot be distinguished under the DDH assumption. We therefore assume that there exists an adversary A that can distinguish real and simulated protocol executions. In simulated protocols all components of the chooser’s view are generated as in real protocol executions except the values Ei . In real protocol executions all Ei are of the form Ei = Mi · g abi +k (for 1 ≤ i ≤ N ) whereas in simulated protocol executions only Eσ is of this particular form and all other Ei (for i  = σ) are randomly chosen (case 1) resp. all Ei are randomly chosen (case 2). We first consider case 1: We assume w.l.o.g. that σ = 1 (can be reached by renumbering) and define a series of intermediate distributions Dj (for 1 ≤ j ≤ N ): In distribution Dj all values except the Ei are generated as in real resp. simulated protocol executions. The values Ei are of the form Mi · g abi +k for 1 ≤ i ≤ j and uniformly chosen otherwise. Note that we defined the distributions such that D1 occurs in simulated and DN in real protocol executions. If an (arbitrary) adversary A substituting the chooser is able to distinguish D1 and DN , A must also be able to distinguish the distributions Dµ and Dµ+1 for an index 1 ≤ µ ≤ N − 1 , i.e. there exists a polynomial p(.) such that 1 ∆(n) =| Pr (A(Dµ ) = 1) − Pr (A(Dµ+1 ) = 1) |> p(n) for infinitely many n. ∗ We use adversary A to construct an adversary A that is able to distinguish between (g, g a , g b , g ab ) and (g, g a , g b , g r ) for uniformly chosen a, b, r which is a contradiction to the Decisional Diffie-Hellman assumption. Let (g, g a , g b , g¯) an instance of the DDH problem. Adversary A∗ does the following: – – – – – – – – –

Choose M1 , . . . , MN ∈ Gq with the same distribution as in real protocols. Choose 1 < τ ≤ N uniformly (τ represents the index of the distribution). Choose bi for 1 ≤ i ≤ N uniformly. Output g b1 , . . . , g bτ −1 , g b , g bτ +1 , . . . , g bN . Calculate C as A does. Since we consider the case of honest choosers and assumed that σ = 1, C is an ElGamal encryption of g b1 . Choose k, l ∈R ZZ q . Set C  = (g ab1 +k , g l ) Set Ei = Mi · g abi +k for 1 ≤ i < τ . Set Eτ = Mτ · g¯ · g k . Choose Ei ∈R Gq for τ < i ≤ N . Give all outputs together with the values Mi as inputs to A.

In the OT protocol the second component C2 = g r of the ElGamal encryption is transformed to C2 = g ar+l . The value l is used to rerandomize the ciphertext. Without the random value l, the above simulator would not work, since he only knows g a and g r and does not know a and r. Thus he cannot calculate g ar .

422

Christian Tobias

If g¯ = g ab then the resulting distribution equals Dτ , otherwise Dτ −1 . It 1 follows that | Pr (A∗ (g, g a , g b , g ab ) = 1) − Pr (A∗ (g, g a , g b , g r ) = 1) |> N ·p(n) . The factor N comes from the choices of τ . If N is polynomial in n the fraction 1 N ·p(n) is non-negligible in n which is a contradiction to the Decisional DiffieHellman assumption. We define N +1 distributions D0 , . . . , DN for case 2. We compute the value C as the (dishonest) chooser does and choose C  ∈R G2q . If c = g y is the plaintext message encrypted in C and the simulator chooses a ∈R ZZ q , then there exists a value k ∈ ZZ q such that C  is an ElGamal encryption of g ya+k (this k is not known by the simulator). In distribution Dj the elements Ei (1 ≤ i ≤ j) are set ˆ to Mi · g abi +k for a random value kˆ ∈R ZZ q . All other Ei are chosen uniformly in Gq . Note that in distribution D0 all Ei are chosen uniformly, i.e. D0 occurs in simulated protocols. By an argument that is similar to those used for case 1, it can be shown that D0 and DN are computational indistinguishable under the DDH-assumption. It remains to show that A cannot distinguish DN from D, where D is the distribution that occurs in real protocol executions. In real protocol executions ˆ whereas in simulated protocol executions different values for k and kˆ k = k, are used. Let c = g y be the cleartext of the chooser’s first message C. From the value C  the adversary A gets g ay+k . By calculating g ay+k · (Ei )−1 · Mi the ˆ adversary gets g a(y−bi ) when the Ei are chosen according to D and g a(y−bi )+(k−k) if the Ei are chosen according to DN . Thus A is able to distinguish D and DN if and only if he is able to distinguish g a(y−bi ) from a random element given g, g a and g y−bi , i.e. if he is able to solve random DDH instances. Unfortunately this instance depends on the chooser’s first protocol message. The level of security against dishonest choosers therefore is weaker than the level of security against honest choosers where the challenge DDH instance was given before the protocol execution started. 3.2

Remarks and Extensions

Information-Theoretical Privacy of the Chooser: The protocol can be adapted to offer information-theoretical privacy of the chooser. To reach this the chooser selects a random value rˆ ∈R ZZ q to blind g bσ by multiplying g rˆ. The result g bσ +ˆr is ElGamal encrypted and transmitted to the sender who sends back the values E = (g a(bσ +ˆr)+k har+l , g ar+l ), Ei = Mi · g abi +k and g a . The chooser then can decrypt E to get g a(bσ +ˆr)+k . He uses rˆ and g a to calculate g −aˆr which is used to undo the blinding and calculate g abσ +k . This value reveals Mσ = Eσ · g −abσ −k . Using this modification the above given simulator cannot be used any longer, because decrypting the chooser’s first message does not reveal the chooser’s choice any more.

Practical Oblivious Transfer Protocols

423

Shortening the Sender’s Public-Key: In our scheme there is no need for the sender to know the exponents b1 , . . . , bN . Only the values g b1 , . . . , g bN are needed for his calculations. Furthermore the number of elements g bi in the sender’s public-key depends on the number N of strings Mi . Thus the sender’s public-key has to be chosen long enough to be usable with all possible databases. We now describe an approach that allows the sender to choose a very compact public-key. The idea is to use a hash function H : {0, 1}∗ → Gq . The sender’s public-key simply consists of a random seed g0 ∈R {0, 1}k for a value k of appropriate length. The series g b1 , . . . , g bN is replaced by the series gi = H(gi−1 ). Using the random oracle model the resulting OT protocol is still provably secure. This procedure reduces the amount of data to be transmitted before the first protocol execution and the amount of data to be stored by the chooser dramatically. At the same time the computational work of the chooser increases only slightly. Thus this procedure might be useful when the chooser has only limited storing capabilities (as smart cards or PDAs) or when the number N is very large.

4

Priced Oblivious Transfer

Oblivious Transfer protocols can be used to sell digital goods which are encoded into the message strings Mi . Such a scenario makes sense when the buyer does not want others to learn which information he is interested in, e.g. when buying stock information. In the following we use the terms buyer and vendor instead of chooser and sender. But because the vendor does not know which item the buyer has chosen, using standard OT protocols all items have to have the same price and the vendor can only charge the buyer per protocol execution. In [1] Aiello, Ishai and Reingold introduce the problem of Priced Oblivious Transfer where items may have different prices. The proposed solution is a prepaid system. The buyer has to open an account which is managed by the vendor. The account balance is encrypted by an homomorphic encryption scheme so that it can be decreased without knowing the current balance and without knowing the price of the purchased good (which is encrypted under the same key pair). We now sketch how to combine the OT protocol of section 3 with the techniques from [1] to build a secure protocol for priced OT. For an in-depth discussion of the used techniques, especially the technique of conditional disclosure, we refer to [1]. 4.1

Encoding Prices

We assume that the prices of the messages Mi are encoded in the values bi . In the protocol of section 3 the group elements g b1 , . . . , g bN are used for multiple protocol executions and are transmitted before the first protocol execution takes place.

424

Christian Tobias

Simply setting bi to the price of message Mi is not possible, because in a purchase process the price of each message Mi has to be known by the potential buyer. On the other hand the values bi have to be random and have to be kept secret, because we use DDH as underlying security assumption. We now show how the prices can be encoded into the values bi while still ensuring the security of the protocol: In the following we distinguish between the real prices of the goods Mi (interpreted as integers) which we denote by pi and their encodings bi in ZZ q which we call price encodings. We assume that 0 ≤ pi < 2t for 1 ≤ i ≤ N . Thus we need t bits to represent the prices pi . We further assume that at most 2k goods have the same price and that there are at most 2l different values among the pi (this implicitly limits the number N of message strings Mi to 2kl ). The price encodings bi consist of the bits of pi followed by a sequence of random bits. We now show that the distribution of the price encodings is statistically close to the uniform distribution in Gq under certain restrictions for k, l and t. Let n be the bit length of q, i.e. 2n−1 ≤ q < 2n , Xn denote the uniform distribution in Gq and Yn the distribution of the values g bi in Gq which follows if prices are encoded in bi as stated above. The statistical difference (also known as variation distance) of two ensembles X = {Xn }n∈IN and Y = {Yn }n∈IN is defined as
| Pr(Xn = a) − Pr(Yn = a) | ∆(n) = 12 a

We call the ensembles X and Y close if their statistical difference is negligible. For every h ∈ Gq there exists an x ∈ ZZ q such that h = g x (the generator g is a public parameter of our scheme). We partition Gq in two sets G1 and G2 . An element h ∈ Gq is in G1 if there exists an 1 ≤ i ≤ N such that pi = xt where xt denotes the t most significant bits of x = logg h. Otherwise h ∈ G2 . We now give an upper bound for the statistical difference ∆(n) of Xn and Yn . ∆(n) =

1  | Pr(Xn = a) − Pr(Yn = a) | 2 a∈Gq

≤

 1 1 1  2k ( ( n−t − ) + ) 2 2 q 2n a∈G1

a∈G2

1 ≤ (2l (2k+t−n − 2−n ) + 2t−l 2−n ) 2 1 = (2k+t+l−n − 2l−n + 2t−l−n ) 2 Thus the distribution of the group elements g b1 , . . . , g bN ∈ Gq is statistically close to the uniform distribution in Gq if k + l + t < cn for a constant 0 < c < n. This allows us to publish the t most significant bits of each bi which represent the price of message string Mi while we can still use DDH as underlying security assumption (eventually the bit length n of prime q has to be increased).

Practical Oblivious Transfer Protocols

4.2

425

Adapting our Protocol

We now sketch how our OT protocol has to be adapted to fulfill the requirements of priced OT. Before the first protocol execution buyer and vendor agree on a common string u0 . In following protocol executions the buyer has only knowledge of string ut if the t-th protocol execution has been completed without disputes. All subsequent protocol executions have the following structure: The buyer encrypts the value g bσ (for the σ of his choice) using his own public-key and transmits the ciphertext E(g bσ ) = (g bσ hr , g r ) together with the encryption of a value ut−1 obtained in the last protocol execution to the vendor. The vendor updates the buyer’s account balance and calculates E = E(g abσ +k+vt ) = (g abσ +k+vt har+l , g ar+l ) and the ciphertexts Ei = Mi g abi +k for 1 ≤ i ≤ N using the homomorphic property of the ElGamal encryption scheme. All these values are transmitted to the buyer. n In the same protocol message the vendor discloses two random values ut and vt to the buyer under the condition that 0 ≤ bσ ≤ b (where b is the chooser’s current account balance, i.e. under the condition that the buyer is able to pay for the goods he ordered) and under the condition that the buyer has sent the correct value ut−1 . The random value vt is used to blind the messages Mi in the t-th protocol execution. Knowledge of ut is required to get ut+1 and vt+1 in the (t + 1)-th protocol execution. Thus a chooser that does not know ut will not be able to get any useful information in all subsequent protocol executions. The buyer can decrypt the vendor’s answer to get g abσ +k+vt . If he behaved properly up to that point he further will get the blinding value vt that he can use to calculate g abσ +k . The resulting protocol for priced OT offers computational privacy (under the computational Diffie-Hellman assumption) for the buyer as well as for the vendor. For the proof of security the simulator of section 3 has to be extended by arguments from [1].

References [1] B. Aiello, Y. Ishai, O. Reingold, ”Priced Oblivious Transfer: How to Sell Digital Goods”, Advances in Cryptology - Eurocrypt 2001, LNCS 2045, pp. 119-135 415, 416, 417, 423, 425 [2] D. Beaver, ”How to Break a ’Secure’ Oblivious Transfer Protocol”, Advances in Cryptology - Crypto ’92, LNCS 658, pp. 285-296 418 [3] M. Bellare, P. Rogaway, ”Random Oracles are Practical: a paradigm for designing efficient protocols”, Proceedings of the 1st ACM Conference on Computer and Communications Security, pp. 62-73, Fairfax (Virginia) USA, 1993, ACM Press 418 [4] R. Canetti, ”Towards Realizing Random Oracles: Hash Functions That Hide All Partial Information”, Proceedings of Advances in Cryptology - Crypto ’97, pp. 455-469 418 [5] R. Canetti, O. Goldreich, S. Halevi, ”The Random Oracle Methodology, Revisited”, Proceedings of the 30th Annual ACM Symposium on Theory of Computing (STOC) 1998, pp. 209-218, ACM Press 418

426

Christian Tobias

[6] C. Dwork, M. Naor, O. Reingold, L. Stockmeyer, ”Magic Functions”, Proceedings of the 40th Symposium of Foundations of Computer Science (FOCS) 1999, pp. 523-534 418 [7] T. ElGamal, ”A public key cryptosystem and a signature scheme based on discrete logarithms”, Advances in Cryptology - Crypto ’84, LNCS 196 417, 426 [8] T. ElGamal, ”A public key cryptosystem and a signature scheme based on discrete logarithms” IEEE Transactions on Information Theory, 31 (1985), An earlier version appeared in [7] 417 [9] O. Goldreich, ”Secure Multi-Party Computation”, Working Draft, Version 1.2, March 2000 [10] O. Goldreich, M. Micali, A. Widgerson, ”How to Play any Mental Game”, Proceedings of the 19th ACM symposium on Theory of Computing (STOC), 1987, pp. 218-299 415 [11] J. Kilian, ”Founding Cryptography on Oblivious Transfer”, Proceedings of the 20th ACM Symposium on Theory of Computing, 1988, pp. 20-31 415 [12] M. Naor, B. Pinkas, ”Oblivious Transfer and Polynomial Evaluation”, Proceedings of the 31st ACM symposium on Theory of Computing (STOC), 1999, pp. 245-254 415 [13] M. Naor, B. Pinkas, ”Privacy Preserving Auctions and Mechanism Design”, Proceedings of the 1st ACM Conference on Electronic Commerce, 1999, pp 129-139 415 [14] M. Naor, B. Pinkas, ”Efficient Oblivious Transfer Protocols”, Proceedings of the 12th ACM-SIAM Symposium on Discrete Algorithms (SODA) 2001, pp. 448-457 416 [15] M. Naor, O. Reingold, ”Number-Theoretic Constructions of Efficient PseudoRandom Functions”, Proceedings of the 38th Symposium of Foundations of Computer Science (FOCS) 1997, pp. 458-467 417 [16] W. Tzeng, ”Efficient 1-out-n oblivious transfer schemes”, Workshop on Practice and Theory in Public-Key Cryptography (PKC 02), LNCS, 2002 416 [17] A. C. Yao, ”How to Generate and Exchange Secrets”, Proceedings of the 27th IEEE Symposium on Foundations of Computer Science, 1986, pp. 162-167 415

Author Index

Agrawal, Dakshi . . . . . . . . . . . . . . . . 53 Atallah, Mikhail J. . . . . . . . . . . . . .196 Attias, Hagai . . . . . . . . . . . . . . . . . . 160 Baek, Yunju . . . . . . . . . . . . . . . . . . . 145 Balado, F´elix . . . . . . . . . . . . . . . . . . . 87 Benedens, Oliver . . . . . . . . . . . . . . .177 Brahmadesam, Murali M. . . . . . . 258 Brassil, Jack . . . . . . . . . . . . . . . . . . . 387 Cary, Matthew . . . . . . . . . . . . . . . . 400 Chang, Ee-Chien . . . . . . . . . . . . . . 119 Chang, LiWu . . . . . . . . . . . . . . . . . . 258 Chen, Yuqun . . . . . . . . . . . . . . . . . . 400 Clayton, Richard . . . . . . . . . . . . . . . 70 Craver, Scott . . . . . . . . . . . . . . . . . . 247 Danezis, George . . . . . . . . . . . . . . . . 70 Desmedt, Yvo . . . . . . . . . . . . . . . . . 213 Dingledine, Roger . . . . . . . . . . . . . . . 36 Dumitrescu, Sorina . . . . . . . . . . . . 355 Farid, Hany . . . . . . . . . . . . . . . . . . . .340 Feng, Jessica . . . . . . . . . . . . . . . . . . .373 Fisk, Gina . . . . . . . . . . . . . . . . . . . . . . 18 Fisk, Mike . . . . . . . . . . . . . . . . . . . . . . 18 Fletcher, Peter A. . . . . . . . . . . . . . 129 Franz, Elke . . . . . . . . . . . . . . . . . . . . 278 Fridrich, Jessica . . . . . . . . . . . . . . . 310 Furon, Teddy . . . . . . . . . . . . . . . . . . 106 Goljan, Miroslav . . . . . . . . . . . . . . . 310 Hempelmann, Christian F. . . . . . 196 Hogea, Dorin . . . . . . . . . . . . . . . . . . 310 Hurley, Neil J. . . . . . . . . . . . . . . . . . 106 Jakubowski, Mariusz H. . . . . . . . 400 Karahan, Mercan . . . . . . . . . . . . . . 196 Kawaguchi, Eiji . . . . . . . . . . . . . . . . 295 Kedogan, Dogan . . . . . . . . . . . . . . . . 53 Kesal, Mustafa . . . . . . . . . . . . . . . . 226 Killourhy, Kevin . . . . . . . . . . . . . . . . . 1 Kim, Hyung-Shin . . . . . . . . . . . . . . 145 Kirovski, Darko . . . . . . . . . . . . . . . . 160

Larkin, Kieran G. . . . . . . . . . . . . . .129 Le, Tri Van . . . . . . . . . . . . . . . . . . . . 213 Lee, Heung-Kyu . . . . . . . . . . . . . . . 145 Li, Qiming . . . . . . . . . . . . . . . . . . . . .119 Liu, Bede . . . . . . . . . . . . . . . . . . . . . . 247 Lyu, Siwei . . . . . . . . . . . . . . . . . . . . . 340 McHugh, John . . . . . . . . . . . . . . . . . . . 1 Moskowitz, Ira S. . . . . . . . . . . . . . . 258 Mıh¸cak, M. Kıvan¸c . . . . . . . . . . . . 226 Neil, Joshua . . . . . . . . . . . . . . . . . . . . 18 Newman, Richard E. . . . . . . . . . . .258 Niimi, Michiharu . . . . . . . . . . . . . . 295 Noda, Hideki . . . . . . . . . . . . . . . . . . 295 Pang, Ruoming . . . . . . . . . . . . . . . . 400 Papadopoulos, Christos . . . . . . . . . 18 Penz, Stefan . . . . . . . . . . . . . . . . . . . . 53 P´erez-Gonz´alez, Fernando . . . . . . . 87 Potkonjak, Miodrag . . . . . . . . . . . .373 Raskin, Victor . . . . . . . . . . . . . . . . . 196 Serjantov, Andrei . . . . . . . . . . . . . . . 36 Shimanovsky, Boris . . . . . . . . . . . . 373 Shirazi, Mahdad N. . . . . . . . . . . . . 295 Silvestre, Gu´enol´e C.M. . . . . . . . . 106 Sinha, Saurabh . . . . . . . . . . . . . . . . 400 Sion, Radu . . . . . . . . . . . . . . . . . . . . 196 Spaulding, Jeremiah . . . . . . . . . . . 295 Suh, Young-Ho . . . . . . . . . . . . . . . . 145 Syverson, Paul . . . . . . . . . . . . . . . . . . 36 Tan, Kymie . . . . . . . . . . . . . . . . . . . . . . 1 Tobias, Christian . . . . . . . . . . . . . . 415 Topkara, Umut . . . . . . . . . . . . . . . . 196 Triezenberg, Katrina E. . . . . . . . . 196 Venkatesan, Ramarathnam 226, 400 Wang, Zhe . . . . . . . . . . . . . . . . . . . . . 355 Westfeld, Andreas . . . . . . . . . . . . . 324 Wolf, Wayne . . . . . . . . . . . . . . . . . . . 247 Wu, Xiaolin . . . . . . . . . . . . . . . . . . . 355