Patent Application
20160365973
The invention relates to secure distribution of a watermarked content item and, in particular, though not exclusively, to methods and systems enabling secure delivery and watermarking of a content item, a watermark embedding module for use in such systems and a computer program product using such methods.
Content providers generate and offer content (e.g. content items in the form of video and/or music titles) to consumers, but rarely deliver it directly to consumers. Instead, the delivery of the content to a consumer is outsourced to an intermediate party, a content distributor, which may comprise one or more content delivery networks (CDNs) for delivering content to customers. Currently CDNs are developed that allow cheap, efficient and high quality content delivery to a large number of consumers. When a CDN receives content items from a content source, the items are replicated and distributed over one or multiple delivery nodes of the CDN. Upon a request from a consumer, a content item is delivered from the nearest (or otherwise most suited) delivery node in the CDN.
Delivering content via a third party on the basis of a CDN or a network of CDNs, comprising multiple copies of content items, may substantially increase the risk of unauthorized access to content (signal theft) and unauthorized (re)distribution of content (content theft). For example, a content item may be illegally copied, by using e.g. a high-definition camcorder or by decrypting illegally intercepted encrypted content. For that reason content protection systems like Digital Rights Management (DRM) and Conditional Access (CA) systems are used to reduce the risk of signal or content theft, and to allow only authorized consumers and systems accessing it.
Typically, a content protection system may use a combination of encryption and watermarking techniques. Encryption may be regarded as a measure against signal theft. By using encryption, the signal (containing the content) can only be read by consumers that have the key to decipher the content. Hence, even if the signal is illegally intercepted, the content is only accessible if it is decrypted.
Watermarking may be regarded as a measure against content theft. Invisible to the consumer, there can be one or multiple watermarks in the content item identifying for example: the content item itself, the content source, the content distributor, the buying consumer and/or a transaction. A watermark may generally relate to hidden information, usually digital information, in the one or more data units of a content item, typically a content file or stream. When rendered for display, the watermark is not perceptible or only perceptible under certain conditions. This way, a watermark can be used to test the authenticity (origin) of the content item and to trace unauthorized distribution of the content item. Usually the watermark may have the form of a sequence of bits, which may form a unique value for identification of a transaction.
Watermarks may be designed so that they survive different signal processing and filtering techniques and so that it remains possible to trace an illegal copy of the content item back to its last authorized user, e.g. the consumer who bought the content, using a forensic tracing technique. Combining encryption and watermarking in a CDN environment poses considerable technological challenges, as it requires a CDN to securely watermark content, which typically is already encrypted by the content source. Hence, a CDN should be able to watermark content without decrypting it as the presence of a decryption and re-encryption process in the CDN would introduce an undesirable loophole in the security scheme.
An example of a content distribution system, which combines encryption and watermarking is described in an article by Verimatrix “Integrated Watermarking Creates More Profitable Pay-TV Businesses, Layered Security Enables Protection Beyond Networks and Devices”, 2011. This article describes a server-side watermark embedding system, wherein a compressed video file is watermarked on the basis of basis of “replacement data” by a server in the network. Replacement data is generated during pre-processing of the video file and comprises information allowing the server to replace video information in the video file with alternative information in order to form a watermark, which is traceable by forensic techniques. According to the article, the proposed watermarking technique can also be used for watermarking encrypted video files, however no further explanation is provided how watermarking in the encrypted domain is actually achieved.
US2011/0129116 describes techniques wherein an embedding device in a server or a client is configured for replacing parts of the original video by watermarked parts so that when an illegally redistributed content item is discovered, the watermark can be extracted using forensic tracing technologies and linked to e.g. the last authorized user. In the document reference is made to the use of techniques to watermark content in the encrypted domain however very little detail is provided how an encryption scheme can be combined with the watermarking technique.
If a content distributor would generate differently watermarked versions of one content item, which is encrypted on the basis of a single encryption key, all differently watermarked versions can be decrypted with the same decryption key. Such situation would pose a serious security threat as a rogue consumer could perform signal theft of a watermarked version of the content item associated with a different consumer and decrypt it with his own decryption key in order to obtain a decrypted watermarked version of the content item that bears the watermark of a different consumer. Such decrypted watermarked content item could then be illegally redistributed without the risk of being traced back to the rogue consumer.
On the other hand, generating a differently encrypted watermarked version for every customer would require the content source to continuously generate differently encrypted versions and the content distributor to continuously ingest these differently encrypted versions of the same content item. Such scheme could increase the content processing at the content source to an unacceptable level. Moreover, it would undermine proper functioning of the outsourcing model wherein the content delivery is outsourced to a specialized content distributor, only requiring one-time ingestion of the content item by a content distributor which thereafter takes care of efficient watermarking and secure delivery of the content item to each requesting CCU. Instead such method would cause that for every content request, the requested content would have to be delivered all the way from the content source, through the network (CDN) of the content distributor, to the consumer (end-user). One of the main benefits of a CDN, which is efficient content distribution through the storage of (multiple copies) of content at network nodes close to the consumer, would thus no longer be realized.
Hence, there is a need in the art for improved methods and systems for enabling efficient watermarking and secure delivery of a content item to a CCU.
It is an object of the invention to reduce or eliminate at least one of the drawbacks known in the prior art and to provide in a first aspect of the invention a method for enabling secure delivery and watermarking of at least part of a content item X using a split-key cryptosystem. Said split-key cryptosystem comprises encryption and decryption algorithms E and D, a key generating algorithm, also referred to as a key-generation algorithm, associated with E and D for generating encryption and decryption keys e, d. Said split-key cryptosystem further comprises a split-key algorithm for splitting e into i different split-encryption keys e1, e2, . . . , ei and/or for splitting d into k different split-decryption keys d1, d2, . . . , dk respectively, wherein i, k≧1 and i+k>2. The split-key cryptosystem is further defined in that when executing i consecutive encryption operations and k consecutive decryption operations on content item X using said split-encryption and split-decryption keys respectively, a fully decrypted content item X (Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . ))=X) may be generated. The method may comprise the step of forming a watermark in a first content part of said content item in the encrypted domain on the basis of said split-key cryptosystem and one or more perturbations.
Here the term “fully decrypted” may refer to the result of the execution of i consecutive encryption operations and k consecutive decryption operations on content item X (as input) on the basis of i split-encryption keys and k split-decryption keys respectively, so that a fully decrypted content item Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . )=X is generated. A fully encrypted content item is identical to the content item which is used as input. Hence, a fully decrypted content item may be clear text if a clear text content item X is used as input to the encryption and decryption operations; or it may be an encrypted content item if an encrypted content item X is used as input to the encryption and decryption operations.
The split-key encryption system allows the generation of many sets of different split-decryption keys d1, d2, . . . , dk on the basis of a decryption key d and/or many sets of different split-encryption keys e1, e2, . . . , ei on the basis of an encryption key e. Each Content Consumption Unit (CCU) may be associated with a different (personalized) set of keys for fully decrypting an encrypted (and watermarked) content item. Hence, each content item delivered to a CCU may be differently (uniquely) encrypted and differently (uniquely) watermarked. It allows (partial) encryption of a content item in a single (partial) encryption step so that it can be securely sent from a first content processing entity, e.g. a content source, to a second content processing entity, e.g. a content distributor. Depending on the implementation, decryption of the (partially) encrypted content item may take place in a sequence of partial encryption and/or decryption steps wherein these steps may be performed by different content processing entities (in the network or in a CCU). This makes the method according to an aspect of the invention particularly suitable for situations wherein the delivery to the CCU and watermarking of the content is outsourced to one or more third parties (such as one or more content distributors, e.g. one or more CDN's). The watermarking scheme may be used by a content distributor (e.g. a CDN) to watermark the encrypted content item and to further (partially) decrypt it so that a personalized encrypted watermarked version is delivered.
In one embodiment, forming said watermark may comprise: partially encrypting one or more perturbations using said encryption algorithm E and a split-encryption key e1, e2, . . . , ei in order to form one or more partially encrypted perturbations; a first encryption module associated with a content source partially encrypting said at least first content part using said encryption algorithm E and said split-encryption key e1, e2, . . . , ei in order to form a partially encrypted first content part; a watermark embedding module associated with a content distributor embedding said one or more partially encrypted perturbations in said partially encrypted first content part in order to form a partially encrypted watermarked first content part; and, a second encryption module associated with said content distributor further partially encrypting said partially encrypted watermarked first content part in order to form a further partially encrypted watermarked first content part using said encryption algorithm E and a further split-encryption key e1, e2, . . . , ei. Here, partially encrypting said one or more perturbations may be executed by said first encryption module associated with said content source or by a second encryption module associated with said content distributor.
In another embodiment, forming said watermark may comprise: encrypting one or more perturbations using said encryption algorithm E and said encryption key e in order to form one or more encrypted perturbations; a first encryption module associated with a content source encrypting said at least first content part using said encryption algorithm E and said encryption key e; a watermark embedding module associated with a content distributor embedding said one or more encrypted perturbations in said encrypted first content part in order to form an encrypted watermarked first content part; and, a decryption module associated with said content distributor partially decrypting said encrypted watermarked first content part using said decryption algorithm D and at least one of said split-decryption keys d1, d2, . . . , dk in order to form a partially decrypted watermarked first content part. Here, encrypting said one or more perturbations may be executed by said first encryption module associated with said content source or by a second encryption module associated with said content distributor.
In yet another embodiment, forming of said watermark may comprise: encrypting one or more perturbations using said encryption algorithm E and said encryption key e in order to form one or more encrypted perturbations; a first encryption module associated with a content source encrypting said at least first content part using said encryption algorithm E and said encryption key e in order to form a first encrypted content part; a decryption module associated with a content distributor partially decrypting said first encrypted content part using said decryption algorithm D and one or more of said split-decryption keys d1, d2, . . . , dk, and partially decrypting said one or more encrypted perturbations using said decryption algorithm D and using said one or more of said split-decryption keys d1, d2, . . . , dk in order to form a partially decrypted first content part and one or more partially decrypted perturbations; and, a watermark embedding module associated with said content distributor embedding said one or more partially decrypted perturbations in said partially decrypted first content part in order to form a partially decrypted watermarked first content part. Here, encrypting said one or more perturbations may be executed by said first encryption module associated with said content source or by a second encryption module associated with said content distributor.
In contrast with the known methods for delivering encrypted and watermarked content items, encrypting and watermarking encrypted content on the basis of a split-key cryptosystem allows secure watermarking of encrypted content in the encrypted domain. The whole sequence of decryption steps need to be executed before the fully decrypted content item X is generated so that during delivery the content item is always in the form of a cipher text. The sequence of decryption steps may be executed by different elements in the delivery chain such that the last decryption step delivers the fully decrypted content item X.
Hence, a content source (such as a content provider) has to (partially) encrypt a content item and in some cases (partially) encrypt the one or more perturbations only once using the encryption algorithm E and a (split-)encryption key before it is sent to the content distributor, which will store the (partially) encrypted content item and one or more perturbations for future use. Thereafter, during subsequent distribution of content items by the content distributor to requesting CCUs, the watermarking process and further crypto operations associated with these segment requests are executed by the content distributor. This way, secure outsourcing of watermarking to a content distributor (an intermediate party) and the provisioning of differently (uniquely) encrypted and differently (uniquely) watermarked content items to a different CCUs may be achieved. The outsourcing of the watermarking process to the content distributor allows substantial reduction of processing load of the content source and substantial reduction of data traffic between the content source and the content distributor.
In an embodiment said method may further comprise providing position information associated with the position of one or more encrypted, partially encrypted or partially decrypted perturbable data units in said encrypted, partially encrypted or partially decrypted first content item respectively, a perturbable data unit comprising a payload which is designated for embedding at least one of said one or more perturbations.
In this embodiment, position information may be used to identify specific data units in a content item that are designated, e.g. suitable, for embedding a perturbation. The position information may be generated by a first content processing entity, e.g. a content provider, when pre-processing the content item and may be—for example—used in situations wherein the payload in the data units is encoded using entropy encoding which is very sensitive to small alterations in the information so that the addition of a small perturbation to an encoded payload may have—in some cases—a large impact on how the content associated with the payload is eventually displayed. Therefore, during pre-processing only certain predetermined data units (referred to as perturbable data units), which have a payload that allows (e.g. without being perceivable by a user upon consuming the content) insertion of a perturbation, are selected for the embedding process. On the basis of the position information, another second content processing entity, e.g. a content distributor, which is responsible for watermarking a content item, is able to localize particular data units that are suitable for embedding perturbations.
In an embodiment, said encryption and decryption algorithms are homomorphic algorithms, thus resulting in a homomorphic split-key cryptosystem. In another embodiment, said encryption and decryption algorithms are additive and/or multiplicative homomorphic algorithms. In yet another embodiment, said embedding may comprise: combining at least one of said encrypted, partially encrypted or partially decrypted first perturbations with at least one of said encrypted, partially encrypted or partially decrypted perturbable data units in the encrypted domain respectively using at least one homomorphic algebraic operation. The homomorphic properties of a homomorphic split-key cryptosystem may be used to efficiently generate an encrypted watermarked content item in the encrypted domain. A watermark w may be embedded in the content on basis of a set of encrypted perturbations using a simple algebraic process (e.g. multiplication between an encrypted perturbation and an encrypted data unit).
In an embodiment said split-key cryptosystem may be based on the (additive) homomorphic Damgard-Jurik (DJ) encryption and decryption algorithms. In an embodiment said DJ split-key cryptosystem may comprise a split-key algorithm comprising: determining an integer d2 to be a random number d2ε{0, . . . , n−1} wherein n is the modulus of the DJ system; determining d1 by calculating (d−d2)mod n.
In an embodiment said split-key cryptosystem may be based on the (multiplicative) homomorphic RSA encryption and decryption algorithms. In an embodiment said RSA split-key cryptosystem may comprise a split-key algorithm comprising: determining an integer d1 to be a random number 1<d1<φ(n), wherein d1 and φ(n) are coprime, n is the modulus of the RSJ system, and φ(n) is Euler's totient function; determining d2=d1−1*d(mod φ(n)).
In an embodiment said split-key cryptosystem may be based on the (multiplicative) homomorphic ElGamal encryption and decryption algorithms. In an embodiment said ElGamal split-key cryptosystem may comprise a split-key algorithm comprising: determining integer d1 to be a random number d1ε{1, . . . , p−2}; determining d2=(d−d1)mod p. The above-mentioned homomorphic encryption/decryption schemes allow a split-key algorithm to split a decryption key d into multiple split-decryption keys such that a homomorphic split-key cryptosystem is formed wherein an encrypted content item is decrypted by applying a sequence of decryption steps on the basis of the split-decryption keys.
The properties of a homomorphic split-key cryptosystem allows the outsourcing of the generation of encrypted perturbations which are used in the watermark embedding process to a third party, e.g. the content distributor, as even with the public encryption key e a content distributor cannot decrypt the (non-watermarked) encrypted content item. This way, encrypted perturbations and an identifier, e.g. a content identifier, may be generated by the third party and used by that third party to insert a watermark into an encrypted content item upon request of that content item by a consumer. Such implementation reduces processing time at the side of the content source and it reduces the traffic between the content source and the content distributor as encrypted perturbations typically comprise more bits than the identifier itself.
In an embodiment said one or more encrypted perturbable data units may comprise display distortion information; and, wherein said one or more encrypted perturbable perturbations are configured to compensate said display distortion information when said one or more data units are combined with said encrypted perturbations. Hence, this embodiment provides the advantage that it is not possible for a rogue employee of a content distributor to manipulate watermarks. For example, it is not possible add “zero” watermarks w=0 (i.e. performing an embedding operation without actually inserting perturbations in a content item) to the content in the encrypted domain as the combination of Ee(0) and Ee(X+y) results in Ee(X+y) which—once decrypted—results in a distorted content item X+y which is not suitable for content consumption. This way a content distributor is stimulated to watermark the content in accordance with the specifications as provided with the content source (content provider).
In an embodiment said method may further comprise:
encrypting a second content part of said content item on the basis of a further cryptosystem associated with a second encryption and decryption algorithm and a second key generating algorithm. Thus, in this embodiment, the a content item may be split in at least a first and second part, wherein only the first part of the content item comprises perturbable data units that are encrypted in accordance with an homomorphic split-key cryptosystem. The data units of the second part of the content item may be encrypted using another, fast encryption scheme, e.g. AES or a symmetric (split-key) stream cipher. As the second part of the content item typically represents a substantial part of the total content item, processing time and traffic between the entities in the content delivery system can be substantially reduced.
In an embodiment, said embedding (of said encrypted, partially encrypted or partially decrypted perturbation) may comprise: on the basis of said position information, replacing one or more of said encrypted, partially encrypted or partially decrypted perturbable data units with one or more partially encrypted or partially decrypted perturbed data units respectively, a perturbed data unit comprising at least one perturbation. In this particular embodiment, perturbable data units may be replaced with associated perturbed data units, i.e. a data unit comprising (substantially) the same payload as the perturbable data unit that it is substituted for, and at least one perturbation. Depending on the implementation either (partially) encrypted or decrypted perturbed data units may be used during the replacement process. The (partially) encrypted or decrypted perturbed data units may be generated by pre-processing the content before it is sent to a content distributor.
Embedding by replacing encrypted data units, i.e. encrypted perturbable data units, at predetermined locations in the encrypted content item with encrypted data units comprising one or more perturbations, i.e. encrypted perturbed data units, provides a simple and processing-efficient mechanism for introducing a watermark into a content item in the encrypted domain. Furthermore, replacement by watermarking allows the use of a non-homomorphic split-key cryptosystem (non-homomorphic encryption/decryption algorithms). In particular, it allows the use of symmetric split-key cryptosystems such as the one time path split key cryptosystem or a split-key cryptosystem on the basis of a linear stream cipher (which may use one or more multiple linear feedback shift registers). These symmetric split-key cryptosystems are very fast and efficient algorithms and are particular important in video streaming applications wherein fast watermarking and fast encryption/decryption of large amounts of data is required.
In an embodiment, said method may comprise: decrypting said partially encrypted or partially decrypted watermarked first content part into a fully decrypted first content part on the basis of said first decryption algorithm D and a split-decryption key respectively. In another embodiment, a decryption unit in a content consumption unit or a second content delivery network may perform said decrypting.
In an embodiment, watermarking said encrypted first content may be performed by a first content delivery network, preferably said first content delivery network comprising a watermark embedding function and a decryption unit. As already discussed above, the invention is especially suited for use in situations wherein the delivery of content is outsourced to one or more content distributor, e.g. a CND or a network of CDNs.
In an embodiment, said delivery of said content item comprises the delivery of at least part of said first content item from a first (upstream) content distribution network (CDN1) to at a second (downstream) content distribution network (CDN2), wherein said first and second content distribution networks comprise at least an encryption unit or a decryption unit. In another embodiment, said first and/or second content delivery network may comprise a watermark embedding unit for embedding perturbations in said content item in the encrypted domain.
In an embodiment, said method may further comprise:
said first content delivery network transmitting at least part of said encrypted, partially encrypted or partially decrypted first content part and at least part of said one or more encrypted, partially encrypted or partially decrypted perturbations to said second content distribution network respectively; said second content distribution network using said at least part of said one or more encrypted, partially encrypted or partially decrypted perturbations for embedding a watermark associated with said second content distribution network in said encrypted, partially encrypted or partially decrypted first content part.
Hence, in these CDN-based embodiments, the content item and the perturbations may be sent in encrypted form to a first CDN1, processed and subsequently forwarded to a second CDN2, which may use these perturbations to watermark a content item in the encrypted domain. A CDN may be configured to send perturbations to another CDN in advance over an inter-CDN interface. This interface may also be used by CDNs to exchange information on the watermarking and/or the split-key cryptosystem, including the type of encryption algorithm and a seed for generating (split) encryption keys
In an embodiment said one or more perturbations may be embedded in the payload of one or more (partially) encrypted or (partially) decrypted perturbable data units. In a further embodiment said payload may comprise encoded data. In yet further embodiment said payload may comprise MPEG or H.264-encoded data. In another embodiment said one or more perturbations may be embedded in one or more DCT coefficients. In yet another embodiment, said one or more perturbations may be embedded in one or more low frequency DCT coefficients associated an MPEG-encoded payload. In this embodiment, perturbations may be embedded in encoded data units by combining (adding, subtracting and/or multiplying) a perturbation with one or more low frequency DCT coefficients. Typically, the low frequency DCT coefficient values are sufficiently high so that a slight modification (e.g. adding a perturbation) will not be noticed when the perturbed data units are displayed.
In an embodiment, said method may further comprise:
generating an identifier associated with the delivery of at least part of a content item; embedding said one or more perturbations in said first encrypted, partially encrypted or partially decrypted content part on the basis of said identifier.
In a further aspect, the invention may relate to a system for enabling secure delivery and watermarking of a content item X comprising: a key generator associated wherein said key generator may comprise a key generating algorithm for generating an encryption key e for said encryption unit and a decryption key d and a split-key algorithm for splitting e into i different split-encryption keys e1, e2, . . . , ei and/or for splitting d into k different split-decryption keys d1, d2, . . . , dk respectively wherein i, k≧1 and i+k>2; wherein executing i consecutive encryption operations and k consecutive decryption operations on content item X using said split-encryption and split-decryption keys respectively, generates content item X (Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei−1( . . . (Ee2(Ee1(X)) . . . ))=X); one or more encryption units for (partially) encrypting at least a first content part of said content item using a first encryption algorithm E; and, using said encryption key e or at least one of said split-encryption keys; one or more decryption units comprising a decryption algorithm D and being configured for decrypting an encrypted or partially encrypted first content part on the basis of said first decryption algorithm D; and on the basis of at least one of said split-decryption keys; at least one watermark embedding module configured for embedding one or more encrypted, partially encrypted or partially decrypted perturbations in an encrypted, partially encrypted or partially decrypted first content part respectively, a perturbation representing at least part of a watermark.
In a further aspect, the invention may relate to content delivery network for enabling secure delivery and watermarking of at least part of a content item X to a content consumption unit using a split-key cryptosystem wherein said split-key cryptosystem may comprise encryption and decryption algorithms E and D, a key generating algorithm for generating encryption and decryption keys e, d, a split-key algorithm for splitting e into i different split-encryption keys e1, e2, . . . , ei and/or for splitting d into k different split-decryption keys d1, d2, . . . , dk respectively wherein i, k≧1 and i+k>2; wherein executing i consecutive encryption operations and k consecutive decryption operations on content item X using said split-encryption and split-decryption keys respectively, generates a fully decrypted content item X (Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . ))=X).
In an embodiment, said content delivery network may comprise: at least one encryption unit for encrypting or partially encrypting at least a first content part of said content item using a first encryption algorithm E; and, using said encryption key e or at least one of said split-encryption keys; and/or, at least one decryption unit comprising a decryption algorithm D and being configured for decrypting an encrypted or partially encrypted first content part on the basis of said first decryption algorithm D; and, on the basis of at least one of said split-decryption keys; and, a watermark embedding module configured for embedding one or more encrypted, partially encrypted or partially decrypted perturbations in an encrypted, partially encrypted or partially decrypted first content part, a perturbation representing at least part of a watermark; and, at least one content delivery node configured for storing one or more encrypted content items and for delivering a partially decrypted watermarked content item to said content consumption unit.
In an embodiment, said content delivery network may further comprise: an interface for transmitting at least part of said encrypted, partially encrypted or partially decrypted perturbations to a further content delivery network; or, for receiving encrypted, partially encrypted or partially decrypted perturbations from a further content delivery network.
In a further aspect, the invention may relate to a watermark embedding module for use with a, preferably homomorphic, split-key cryptosystem, wherein said, preferably homomorphic, split-key cryptosystem may comprise, preferably homomorphic, encryption and decryption algorithms E and D, a key generating algorithm for generating encryption and decryption keys e, d, a split-key algorithm for splitting e into i different split-encryption keys e1, e2, . . . , ei and/or for splitting d into k different split-decryption keys d1, d2, . . . , dk respectively wherein i, k≧1 and i+k>2; wherein when executing i consecutive encryption operations and k consecutive decryption operations on content item X using said split-encryption and split-decryption keys respectively, generates a fully decrypted content item X (Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . ))=X) and wherein said watermark embedding module may be configured for: receiving at least an encrypted, partially encrypted or partially decrypted first content part and one or more encrypted, partially encrypted or partially decrypted perturbations respectively, a perturbation representing at least part of a watermark, said perturbation optionally being received embedded in (comprised in/as part of) a perturbed data unit; said watermark embedding module further configured for: embedding said one or more encrypted, partially encrypted or partially decrypted perturbations in said at least one of an encrypted, partially encrypted or partially decrypted first content part respectively, a perturbation representing at least part of a watermark,
preferably said embedding comprising at least one of
The replacement (substitution) of the perturbable data units by their associated perturbed data units, is preferable performed on the basis of position information associated with (indicating) the position of the one or more encrypted, partially encrypted or partially decrypted perturbable data units in said encrypted, partially encrypted or partially decrypted first content item respectively (also referred to throughout this application as replacement information); which position information may be provided to the watermark embedding module. The alternative of combining the perturbations with the perturbable data units may be performed on the basis of the same or other position information. However said combining does not necessary require providing the position information to the watermark embedding module. For example by providing the perturbations at the correct positions (meaning the same positions as those of the associated perturbable data units in the first content part) in a data stream of equal length as the length of (the data stream comprising) the first content part, the watermark embedding module may combine the data stream comprising the perturbations with the first content part without needing the position information. The areas of the datastream outside the areas containing the perturbations may contain data that when combined with the data of the first content part at the same positions, have no effect on the resulting content (e.g. lead to zero perturbations in those areas of the first content part after the combining operation). For example in embodiments of the invention, when combining the datastreams in the encrypted domain, the data in the areas outside the perturbations may be all ‘zero’ bits (before encryption) and the two datastreams are encrypted, partially encrypted or decrypted on the basis of homomorphic encryption/decryption algorithms. A (homomorphic) algebraic addition operation performed on the two streams, will have the effect that outside the areas containing the perturbable data units, the (content) bitstream is not altered (because only zero bits are being added in these areas to the existing (content) bitstream). Likewise when a multiplication operation in the encrypted domain is foreseen, these bits (outside the areas containing the perturbations) could all have the value of 1 (prior to encryption).
Other (non-exhaustive) examples wherein no position information is required, are provided in the application.
The invention also relates to a computer program product comprising software code portions configured for, when run in the memory of computer executing at least one of the method steps as described above.
The invention will be further illustrated with reference to the attached drawings, which schematically will show embodiments according to the invention. It will be understood that the invention is not in any way restricted to these specific embodiments.
The content delivery system may comprise a content protection system (which may also be referred to as a DRM system) in order to protect the content items from content or signal theft. The content protection cryptosystem may comprise a cryptosystem and a watermarking system. The cryptosystem typically comprises an encryption unit associated with an encryption algorithm 120, which is configured to encrypt plaintext content items into encrypted content items using an encryption key e 118 and a decryption unit associated with an decryption algorithm D 162,172, which is implemented in the CCU 160,170 and configured to decrypt encrypted content items on the basis of a decryption key d 119. An encrypted content item may also be referred to as a DRM-protected content item. The generation and distribution of encryption and decryption keys e, d are managed by a secret key generator 116. The watermarking system typically comprises a watermarking embedding (WE) function 142 (in short an embedding function) for embedding watermarks 144 in the encrypted content items it delivers to CCUs.
The content source 110 may further comprise a content pre-processor 124 for pre-processing a content item X 121. The pre-processor is configured to decode and analyze the payload of data units in the content item (e.g. a compressed video file), to select data units that are suitable for watermarking and to determine position information regarding the position of these selected data units in the (encrypted) content item. These data units are hereafter referred to as a perturbable data unit, i.e. a data unit comprising a payload to which a perturbation may be added. Embedding perturbations in the perturbable data units results in a watermarked content item. The perturbation (and perturbable data unit) is selected such that—when rendered (as part of the content rendering)—it is not visible or perceptible by an average viewer.
The pre-processor is further configured to generate perturbed data units, i.e. perturbable data units to which a perturbation is added, and to send replacement information 126, i.e. the position information and encrypted perturbed data units, to the embedding function. After the pre-processing, content source may sent the content in encrypted form Ee(X)=Xe 122 to the CD (where Xe is a short notation of Ee(X), i.e. the application of encryption algorithm E to content item X using encryption key e). Multiple copies of the encrypted content item may be stored at different delivery nodes within the CDN.
When a CCU requests a content item from the CDN, the CDN may generate a transaction identifier, e.g. a sequence of bits. Such identifier may be generated on the basis of the user's identity, the content distributor's identity, date and time of the transaction, etc., including combinations thereof.
The embedding function may use the transaction identifier and the replacement information to embed the transaction identifier as a watermark in the content. The transaction ID may uniquely identify the transaction between the first consumer and the CDN and/or content provider. The embedding of the watermark may be realized by selectively replacing encrypted perturbable data units with encrypted perturbed data units. For example, if the replacement information may identify the position of five data units 1001, 2004, 2248, 8888 and 9233 in the encrypted content item as perturbable data units, a transaction identifier 10001 may be embedded in the content item by replacing perturbable data units 1001 and 9233 with their associated perturbed data units Hence, in such scheme a replacement represents a “1” and no replacement represents a “0”.
The replacement information allows the CDN to watermark an encrypted content item with a watermark w and sent the encrypted watermarked content item Ee(X+w) 152 (hereafter in short Xwe) to the requesting CCU 166, comprising a first decryption unit 162 for decrypting the encrypted data into a first watermarked content item Xw 164 using a decryption key d, which the consumer received from the content provider during the transaction.
In the system of
Generating a different encrypted version for each request of a CCU cannot solve the problem, as for each request a newly encrypted version of the content item should be ingested. Moreover, for each newly encrypted version replacement information should be provided to the CDN. Generating differently encrypted versions of a content item would therefore largely increase the processing at the content source side and undermine proper functioning of the outsourcing of the content delivery to a content distributor, i.e. one-time ingestion of the content item by a specialized CDN which takes care of efficient watermarking and secure delivery of the content item to each requesting CCU.
The pre-processing and encryption of a content item and the generation of the replacement information is a relatively expensive and time-consuming process, hence preferably, it is desired to pre-process a content item only once by the content source, e.g. upon ingestion of the encrypted content by the CDN. Thereafter, preferably all (or at least most of the) further content processing required for secure delivery to CCUs, e.g. watermarking, is outsourced to the CDN.
As will be shown hereunder in more detail, the above-described problem may be solved by the content protection system according to the present invention. This content protection system comprises a so-called split-key cryptosystem and a watermarking system, wherein the split-key cryptosystem allows a content source to deliver a single encrypted content version to a content distributor, e.g. a CDN, and allows the content distributor to generate for each requested content item a differently encrypted watermarked version without decryption of the encrypted content item. It allows a content source to control and monitor the delivery of encrypted watermarked content items to CCUs even though the actual delivery and watermarking of the content is outsourced to a content distributor. The details and advantages of the content protection system are described hereunder in more detail with reference to the appending figures.
A content distributor may relate to a content distribution platform or a chain of different content distribution platforms configured to distribute content from the content source to the content consumption units. A content distributor may use electronic means for delivering content e.g. one or more content delivery networks (CDNs). A CDN may comprise a number of delivery nodes for storing and delivering (part of) a content item to a CCU and a central CDN node for controlling ingestion of content items into the CDN from an external source and for managing the distribution of copies of a content item over one or more delivery nodes in the CDN.
CDNs are especially suited for delivery of so-called segmented or tiled content. For example, HTTP adaptive streaming (HAS), Scalable Video Coding (SVC) and spatially segmented video (e.g. tiled video) use segmentation on the basis of time, quality and space respectively. A so-called manifest file (also known as a Media Presentation Description or MPD for MPEG-DASH or M3U8 playlist for Apple HTTP Live Streaming) describes the relation between the different segment files and/or streams and the location where the segments may be retrieved. In order to enable a client to access stored content in a CDN, the client is provided with the manifest file so that it is able to retrieve the segments.
A segment file or segment stream (in a short a segment) identified in the manifest file may be retrieved by a file retrieval protocol, e.g. HTTP or FTP, or a streaming protocol, e.g. RTSP/RTP or HAS. Further, a video title, or more in general, a content item rendered by a segmentation scheme may be referred to as a segmented content item.
Alternatively and/or in addition a content distributor may use physical means for delivering content, e.g. a recording-medium such as a magnetic recording medium, an optical recoding medium using e.g. DVD and Blu-Ray technology or an opto-magnetic recording medium.
A content source, sometimes also referred to as the content originator, may relate to a content provider (CP), a content preparation system or another CDN. A content source may comprise one or more network nodes, e.g. one or more media servers, configured to offer and/or deliver content items, including but not limited to video, pictures, audio, software, data and/or text in the form of files and/or streams to consumers or another content distributor. A consumer may purchase and receive the content items using a content consumption unit (CCU), comprising a software client or a combined hardware/software client for interfacing with the CDN and the CP.
A CUU may generally relate to a device configured to process file-based and/or (live) streaming content items. Such devices may include a (mobile) content play-out device such as an electronic tablet, a smart-phone, a notebook, a media player, a player for play-out of a recording medium such as a DVD of a Blu-Ray player. In some embodiments, a CCU may be a set-top box or a content recording and storage device configured for processing and temporarily storing content items for future consumption by a further content consumption unit (e.g. a smart-phone or a media player connected to the set-top box or the content recording and storage device).
The content source may comprise (or be associated with) an encryption unit 220 comprising encryption algorithm E and secret key generator 216 comprising a key algorithm and a split-key algorithm for generating keys e, d and split-decryption keys d1, d2 respectively on the basis of secret information S. The content distributor and CCUs may comprise decryption units 262,266,250 associated with decryption algorithm D. Here, E, D, the key generating and the split-key algorithm belong to a predetermined split-key cryptosystem wherein applying the encrypted content item Ee(X) to a sequence of decryption steps (in this case two decryption steps on the basis of split-decryption keys d1 and d2) results in a fully decrypted content item: Dd2(Dd1(Ee(X))=Dd2(Dd1(Xe))=X. As will be explained hereunder in more detail, the split-decryption cryptosystem allows decryption of the content by the content source and decryption of the encrypted content via a sequence of two or more split-decryption steps, which are executed by one or more decryption units in the content distributor and a decryption unit in the CCU respectively. Detailed examples of spit-key cryptosystems are described hereunder in more detail.
The key generator 216 may generate at least one encryption key e 218 for encryption unit 220 in order to encrypt content item X 221 into encrypted content item Xe 222. The thus encrypted content item may be sent by the content source as an encrypted file or stream to the content distributor 240 for further processing and delivery.
The content item X may be pre-processed by pre-processing function 224 associated with the content source in order to generate replacement information 226 identifying perturbable data units, i.e. data units in encrypted content item Xe, which may be replaced with encrypted perturbed data units. The generated replacement information of encrypted content item Xe may be sent to an embedding function WE 242 associated with the content distributor (the embedding function may be executed by a watermark embedding module comprising for example a microprocessor, memory for storing received data, and memory for loading computer program instructions executable by the microprocessor for performing parts of the method according to the invention).
The pre-processing function may be configured to decode and analyze a content item, e.g. a compressed video file or stream. In particular, the pre-processing function may generate position information associated with a predetermined number of perturbable data units xi i=1, . . . , N in a content file or stream. A perturbable data unit may refer to a logical data structure, carrying part of the content (payload) in a content file or stream (e.g. (part of) an (encoded) video frame, macro block, video slice or audio frame) that allows a perturbation δ (e.g. addition or subtraction). Such perturbation may be introduced into the payload using any type of content processing operation, e.g. binary addition or a binary XOR operation bits so that a predetermined bit or number of predetermined bits are changed from “0” to “1” or vice-versa. Such operation thus changes a perturbable data unit xi into a perturbed data unit xi+δ (wherein the + symbol denotes any suitable operation for changing one or more bits in a perturbable data unit xi).
Further, in some embodiments, the pre-processing function may generate one or more encrypted perturbed data unit Ee(xi+δ) which are used to replace encrypted perturbable data unit Ee(xi) in the original encrypted content item Ee(X) when a predetermined condition is met, e.g. when a predetermined bit in the identifier is “1”.
The perturbable data units in the encrypted content item and the encrypted perturbed data units may be used to embed a watermark in a content item in the encrypted domain, wherein the watermark is detectable using forensic techniques and not visible when displayed. The position information associated with perturbable data units in the encrypted content item, and, in some embodiments, the generated (encrypted) perturbed data units may be organized and structured as replacement information 226 associated with a predetermined content item.
Then, upon a request of a first CCU, the content distributor may generate an identifier, e.g. a transaction identifier, comprising a sequence of bits of a predetermined length for identifying the transaction with the first consumer. The embedding function associated with the content distributor may execute a predetermined embedding process so that the identifier is embedded into the encrypted content Xe 222 as watermark w1 244, thereby forming watermarked encrypted content Xw1e 243.
The embedding function may use the replacement information associated with the encrypted content item and replace one or more encrypted, perturbable data units with encrypted perturbed data units such that a desired identifier is embedded as a watermark in the encrypted content. For example, the replacement information may identify the position of five data units 1001, 2004, 2248, 8888 and 9233 in the encrypted content item as (encrypted) perturbable data units {Ee(x1), Ee(x2), Ee(x3), Ee(x4), Ee(x5)}. By replacing one or more of these perturbable data units with perturbed data units, a transaction identifier may be embedded as a watermark into the content item. For example, replacing encrypted perturbable data units 1001,2004 and 9233 with their associated encrypted perturbed data units Ee(x1+δ), Ee(x2+δ), Ee(x5+δ), may result in a watermark corresponding to the binary code “11001”.
The secret key generator in the content source may use encryption key e 218 and associated secret information S in order to generate an associated decryption key d. A split-key algorithm in the secret key generator may then use the decryption key d and the secret information S to determine split-decryption keys d1 and d2, which are required in order to fully decrypt the encrypted watermarked content item Xw1e. To that end, the key generator may distribute the first split-decryption key d1 232 to the content distributor and the second split-decryption key d2 234 to the CCU 270 of a first consumer. The decryption unit 250 of the content distributor may use the first decryption key d1 232 to partially decrypt encrypted watermarked content item Ee(X+w1)=Xw1e 243 in into a partially decrypted watermarked content item Dd1(Ee(X+w1))=Xw1e,d1 256.
The thus “partially” decrypted and watermarked content item Xw1e,d1 may be sent to the decryption unit 266 of the first CCU 270 which may fully decrypt the partially decrypted and watermarked content item Xw1e,d1 on the basis of split-decryption key d2 and decryption algorithm D: Dd2(Dd1(Ee(X+w1))=Dd2(Dd1(Xw1e))=Dd2(Xw1e,d1)=Xw1 268.
It is submitted that the wording “partially decrypted” in this document refers to the process of applying one or more decryption steps to an encrypted content item wherein the one or more decryption steps are part of a sequence of decryption steps which is needed to fully decrypt an encrypted content item content item. Unless expressly mentioned, “partially decrypted” does not mean that only part of the content is decrypted. Partially decrypted content Ee,d1(X)=Xe,d1 is cipher text and as such as secure to unauthorized access as fully encrypted content Xe.
Here “fully decrypted” may refer to the result of the execution of i consecutive encryption operations and k consecutive decryption operations on content item X (as input) on the basis of i split-encryption keys and k split-decryption keys respectively, so that a fully decrypted content item Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . )=X is generated. A fully encrypted content item is identical to the content item which is used as input. Hence, a fully decrypted content item may be clear text if a clear text content item X is used as input to the encryption and decryption operations; or it may be an encrypted content item if an encrypted content item X is used as input to the encryption and decryption operations.
In the process described above, in on embodiment, the partially decrypted watermarked content item may be sent to the CCU using a suitable streaming protocol, e.g. an adaptive streaming, such as the HTTP adaptive streaming protocol (HAS). In another embodiment, the partially decrypted and watermarked content item may be recorded on a storage medium, e.g. an optical or magnetic storage medium, which may be delivered to the user of the CCU. In that case, the CCU may comprise a player for reading the content item from the storage medium.
The process above may be repeated for different CCUs, wherein, the embedding and split-decryption process as described above may repeated using a different watermark w2, a different first decryption key d1′ and a different second decryption key d2′.
Hence, from the above it follows that, in contrast with the known CDN-based content delivery systems for delivering encrypted and watermarked content items to a consumer, watermarking encrypted content using a split-decryption cryptosystem allows secure watermarking of encrypted content so that each content item delivered to a consumer is differently (uniquely) encrypted and differently (uniquely) watermarked.
The split-key cryptosystem according to the invention is configured such that the combined knowledge of Xe or Xw1e and d1 does not leak information how to obtain a clear version of the encrypted or partially encrypted content item. Similarly, the combined knowledge of Xe or Xw1e and d2 does also not leak information how to obtain a clear version of the encrypted or partially encrypted content item.
Moreover, the split-key cryptosystem allows the generation of many set of different split-decryption key d1, d2, . . . associated with one encryption key e so that each consumer may be associated with a different (personalized) set of keys for fully decrypting a set of encrypted (and watermarked) content items. The whole sequence of decryption steps need to be executed before a clear text is generated. Furthermore, the sequence of decryption steps may be executed by different elements in the delivery chain such that the last decryption step delivers the clear content item.
Further details and embodiments associated with split-key cryptosystems and content delivery systems comprising such split-key cryptosystems are described in related European patent application with application Ser. No. 11/182,553.5 with title “Secure distribution of content”, which is hereby incorporated by reference into this application.
A number of embodiments of the split-key cryptosystems will be described hereunder in more detail.
In a first embodiment, a split-key cryptosystem may be based on the symmetrical encryption algorithm known as the “one-time pad”. In this embodiment, an encryption key e may be generated in the form of a long random binary number generated using a random generator. Encryption algorithm E may be a binary function for encrypting content item X into an encrypted content item Xe by applying an exclusive-or (XOR, ⊕) operation to X using e:
e=RAN_1
X
e
=E
PT(X)=X⊕e
A first split-decryption key d1 and second split-decryption key d2 may be formed on the basis of e. For example, second split-decryption key d2 may be a random binary number having the same length as e and first split-decryption key d1 may be generated by executing a bitwise exclusive-or operation between d1 and e:
d
2=RAN_2
d
1
=d
2
⊕e
A first decryption operation may “partially” decrypt encrypted content item Xe into Xe,d1 by executing a bitwise exclusive-or operation on Xe and d1. A second decryption operation may fully decrypt partially decrypted content item Xe,d1 into content item X by executing an exclusive-or operation on the basis of Xe,d1 and d2:
X
e,d1
=D
d1(Xe)=Ee(X)⊕d1
X
e,d1,d2
=D
d2(Xe,d1)=Dd1(Xe)⊕d2=X
If the binary values e, d1 and d2 are shorter than content item X, each of them may be concatenated with itself several times, and then truncated to the length of content item X. However, such concatenation would reduce the security of the system.
The above described “one-time pad” cryptosystem with two split-decryption keys may be easily generalized to a split-key cryptosystem with k split-decryption keys and/or i split-encryption keys. For example, instead of choosing long binary streams d1 and d2 such that d1⊕d2=e, k−1 random binary streams d1 . . . dk-1 may be generated and the final random binary stream may be determined using dk=d1⊕ . . . ⊕dk-1⊕e.
In a similar way a split-key cryptosystem with i split-encryption keys and k split-decryption keys may be generated. In this embodiment encryption and decryption algorithms D, E are identical, i.e. both are performed as an exclusive-or operation. Further, the encryption and decryption algorithms are commutative, so the split-keys may be generated in any desired order and the encryption and decryption operations may be performed in any desired order.
In second embodiment, a split-key cryptosystem may be based on a symmetric stream cipher.
In particular,
In this split-key cryptosystem encryption key e and first split-decryption key may be generated as a set of random bits {e1, e2, e3, . . . , em} and {d11, d12, d13, . . . , d1m} respectively and split-decryption key d2 may be calculated as a bitwise XOR of e and d1, i.e. d2=e⊕d1.
In this particular embodiment, the output of a further LFSR is used to select which bit of the other two LFSRs is taken as the output 316 of the selector. The bits p {p1, p2, p3, . . . , pn} defining the start state of the further LFSR may be pre-configured. As the stream cipher is linear in k, the decryption key may be calculated as a bitwise XOR of e and d1, i.e. d2=e⊕d1. Also other partial non-linear functions may be used as a combination generator.
Stream ciphers form easy implementable symmetrical ciphers requiring keys of much shorter lengths when compared to the one-time path algorithm. The non-linear part of a partial non-linear combination generator makes the cipher more secure against certain types of attacks.
In a third embodiment, a split-key cryptosystem may be based on the asymmetrical encryption algorithm known as the RSA encryption scheme. In that case, an encryption/decryption key pair e, d using the following cipher algorithms:
The parameters p, q, φ(n), e, d and n may be stored as secret information for further use if necessary. In particular, the value n needs to be shared with the content distributor and the CCU, as these entities require n to perform their encryption and decryption operations. The value n may be transferred to the content distributor and the CCU in protocol messages associated with a content transaction. In one embodiment, when multiple transactions use the same secret information, n needs to be communicated only once.
A content item X may be processed on the basis of an agreed-upon reversible protocol known as a padding scheme, which turns X into an integer x wherein 0<x<n. If the process determines that X is too long, it may divide X in blocks that each satisfies the length requirement. Each block is thereafter separately processed in accordance with the padding scheme.
The RSA encryption algorithm E for encrypting X into Xe may be calculated as follows:
X
e
=E
e(X)=xe(mod n).
A split-key algorithm for determining a pair of split-decryption keys d1, d2 may comprise the steps of:
A first decryption operation based on decryption algorithm D and split-encryption key d1 may generate a “partially” decrypted content item by calculating Xe,d1=Dd1(Xe)=(Xed1)(mod n) (Read: Xe to the power d1 followed by a modulo n operation). A second decryption operation based on decryption algorithm D and split-encryption key d2 may generate Xe,d1,d2=Dd2(Xe,d1)=(Xe,d1d2)(mod n). The original plaintext content item X may be derived from Xe,d1,d2 by applying the padding scheme in reverse.
Since the RSA encryption and decryption algorithms E and D are identical, the split-key algorithm for determining a pair of split-encryption keys e1, e2 may be determined on the basis of the same algorithm for determining the split-decryption keys.
The above double split-key RSA cryptosystem may be generalized to a multiple split-key cryptosystem with k keys. To that end, instead of selecting d1 and d2 such that d1*d2=d(mod φ(n)), k−1 random (preferably different) integers d1, . . . , dk-1 which are coprime with φ(n) are determined and the final integer is computed as dk=(d1* . . . *dk-1)−1*d(mod φ(n)). RSA encryption and decryption algorithms E, D are commutative, so the keys may be generated in any desired order and the encryption and decryption operations may be performed in any desired order.
In fourth embodiment, a split-key cryptosystem may be formed on the basis of the asymmetrical encryption algorithm known as the ElGamal (EG) encryption scheme. The EG scheme is based on the discrete logarithm problem rather than the factoring problem of RSA. In that case, encryption/decryption key pair e, d may be determined on the basis of the key generating algorithm:
Note that e is called “public” because it could be published without leaking secret information. In one embodiment, e would be published to enable third parties (e.g. users that generate and upload user-generated content) to encrypt content for the system, while the content source remains in fully control over the (partial) decryption steps. However, when there is no need to publish e, it is kept private.
Decryption key d and (public) encryption key e=(p, g, h)—wherein p, g, h are integers—may be stored as secret information for future use if necessary. In particular, the value p needs to be shared with the content distributor and the CCU, as these entities require p to perform their encryption and decryption operations. The value of p may be included in protocol messages exchanged during a content transaction between a content source and a CCU. In one embodiment, multiple transactions may use the same secret information. In that case, p would need to be communicated to the content distributor and a CCU only once.
A content item X may be processed on the basis of an agreed-upon reversible protocol known as a padding scheme, which turns X into an integer x wherein 0<x<p. If the process determines that X is too long, it may divide X in blocks that each satisfies the length requirement. Each block is thereafter separately processed in accordance with the padding scheme.
Encryption algorithm Ee(X) for encrypting content item X into Xe may comprise the steps of:
Similarly, a decryption operation Dd(Y1,Y2) for decrypting an encrypted content item Xe may be computed as:
A split-key EG algorithm for determining a pair of split-decryption key d1, d2 may comprise the steps of:
A split-key EG algorithm for splitting the random encryption parameter s into l parts may be defined as follows:
Party i sends (gs mod p, Yi) to party i+1;
Party i+1 performs its encryption step:
Yi+1:=(hsi*Yi)mod p.
It may be easily verified that (gs mod p, Yl)=Ee(X, s), because s=(s1+s2+ . . . sl)mod p. The different encryption steps are commutative.
A first decryption operation on the basis of decryption algorithm D and d1 may be used to “partially” decrypt encrypted content Xe into Xe,d1 by calculating Dd1(Xe)=Dd1(Y1,Y2)=(Y1, Y1−d1*Y2(mod p)). Partially decrypted content Xe,d1 is represented by a pair with the same first element Y1. Since Y1 is part of the encryption, it may be included in the protocol messages.
A second decryption operation on the basis of decryption algorithm D and d2 may be used to determine the fully decrypted content by calculating Xe,d1,d2=Dd2(Xe,d1) wherein the second element of Xe,d1,d2 will equal x: Xe,d1,d2=Dd2(Xe,d1)=Dd2(Dd1(Y1,Y2))=(Y1, Y1−d2*Y1−d1*Y2)(mod p))=(Y1, (Y1−d*Y2)(mod p))=(Y1, X). Original content item X may be determined from the calculated Xe,d1,d2 by applying the padding scheme in reverse.
The EG decryption algorithm D is commutative, so the decryption keys can be generated in any desired order and the decryption operations may be performed in any desired order. Similarly, the encryption algorithm is also communicative, so encryption keys may be generated in any desired order and the encryption operations may be performed in any particular order.
It is noted that the above-described RSA and EG split-key cryptosystems are multiplicative homomorphic, exhibiting the property D(E(Z1)*E(Z2))=(Z1*Z2)(mod p).
An additive homomorphic cryptosystem exhibits the property Ee(X1)*Ee(X2))=Ee(X1+X2)(mod p). In the context of signal processing such as watermarking, an additive homomorphic encryption scheme may provide advantageous properties in the sense that it allows embedding (adding) of a watermark into a content item in the encrypted domain using a simple algebraic operation, e.g. a multiplication. Embedding a watermark using an additive homomorphic split-key cryptosystem will be described hereunder in more detail.
In an embodiment, the split-key cryptosystem may be based on an additive homomorphic cryptosystem known as a Damgard-Jurik (DJ) cryptosystem. The DJ split-key cryptosystem system is described hereunder in more detail. The encryption/decryption pair e, d for the DJ cryptosystem may be generated using the following key generating algorithm:
Note that e is called “public” because it could be published without leaking secret information.
In one embodiment, e would be published to enable third parties (e.g. users that generate and upload user-generated content) to encrypt content for the system, while the content source remains in full control over the (partial) decryption steps. When there is no need to publish e, it may be kept private.
The values p, q and d may be stored as secret information S together with public key e=(n,g,h). The value of n needs to be shared with the content distributor and the CCU, as these entities require n to perform their encryption and decryption operations. The value of n may be included in protocol messages exchanged during a content transaction between a content source and a CCU. In one embodiment, multiple transactions may use the same secret information. In that case n would need to be communicated to the content distributor and the CCU only once.
A content item X may be processed on the basis of an agreed-upon reversible protocol known as a padding scheme, which turns X into an integer x wherein 0<x<n. If the process determines that X is too long, it may divide X in blocks that each satisfies the length requirement. Each block is thereafter separately processed in accordance with the padding scheme.
An encryption algorithm Ee(X) for encrypting content X into Xe may comprise the steps of:
The decryption algorithm Dd(Y1,Y2) for decrypting an encrypted content item Xe may comprise the steps of:
This indeed gives the desired result Xe,d=Dd(Y1,Y2)=X because H′=((n+1)x)(mod n2)=(n*X+1)(mod n2).
A split-key algorithm for determining a pair of split-decryption keys d1 and d2 may comprise the steps of:
A split-key DJ algorithm for splitting the random encryption parameter r into l parts may be defined as follows:
Party i sends (gr mod n, Yi) to party i+1;
Party i+1 performs its encryption step:
Yi+1=(hn*ri*Yi)mod n2.
It may be easily verified that (gr mod n, Yl)=Ee(X, r), because r=(r1+r2+ . . . +rl)mod n. The different encryption steps are commutative.
A first decryption operation on the basis of decryption algorithm D and d1 may be used to “partially” decrypt” encrypted content Xe into Xe,d1 by calculating Dd1(Xe)=Dd1(Y1,Y2)=(Y1,Y′2)=(Y1,(Y1(−d
In one embodiment, if multiple transactions are based on the same secret information and the same random number r, then Y1 does not change and may need to be communicated to the content distributor and the CCU only once.
A second decryption operation on the basis of algorithm D and d2 may be used to determine the fully decrypted content by calculating H′=(Y1(−d2*n)*Y′2)(mod n2) and x=((H′−1)*n−1)mod n2. Indeed, H′=(Y1−(d2+d1)n*Y2) mod n2=(Y2*g′(−d*n))(mod n2) thus showing the correctness of the split-key algorithm.
The above split-key DJ cryptosystem may be easily generalized to a multiple split-key cryptosystem with k split-decryption keys. To that end, instead of choosing d1 and d2 such that d1+d2=d mod n, k−1 random integers d1 . . . dk-1 smaller than n may be selected and the final integer may be computed as dk=d−(d1+ . . . +dk-1)(mod n).
The DJ decryption algorithm D is commutative, so the decryption keys may be generated in any desired order and the decryption operations may be performed in any desired order. The same holds for the encryption algorithm. Moreover, the DJ split-key cryptosystem uses probabilistic encryption, which prevents eavesdroppers from recognizing the content.
The split-key cryptosystems described above are non-limiting examples of a family of split-key cryptosystems, wherein each split-key cryptosystem is defined by a predetermined an encryption and decryption algorithm E, D, a key generating algorithm for generating encryption and decryption keys e, d on the basis of secret information S; and, a split-key algorithm for splitting e and/or d into multiple split-encryption and/or split-decryption keys respectively.
One group of split-key cryptosystems may be defined by crypto-algorithms E and D, a split-key algorithm for generating encryption and decryption keys e, d on the basis of secret information S and a split-key algorithm using secret information S for multiple splitting of decryption key d into an arbitrary number of k split-decryption keys d1, d2, . . . , dk (k≧2) wherein an encrypted content item Ee(X) is decrypted by applying a sequence of decryption steps on the basis of said split-decryption keys d1, d2, . . . , dk i.e. Ddk(Ddk-1( . . . (Dd2(Dd1(Ee(X)) . . . ))=Ddk(Ddk-1( . . . (Dd2(Xe,d1) . . . ))=X. Here Xe,d1,d2, . . . ,dk is a short notation of a predetermined sequence of decryption operations on encrypted content item Xe using decryption algorithm D and split-decryption keys d1, d2, . . . , dk, respectively. In such split-key cryptosystem decryption operations associated with all split-decryption keys need to be executed on an encrypted content item Xe in order to obtain clear text.
Another group of split-key cryptosystems may be defined by an encryption and decryption algorithm E, D, a split-key algorithm for generating encryption and decryption keys e, d on the basis of secret information S and a split-key algorithm using secret information S for multiple splitting of e into an arbitrary number of i split-encryption keys e1, e2, . . . , ei (i≧2) such that Dd(Eei(Eei-1 . . . (Ee2(Ee1(X)) . . . ))=Dd(Xe1,e2, . . . ,ei))=X. Here Xe1,e2, . . . ,ei is a short notation of a predetermined sequence of encryption on plaintext content item X using encryption algorithm E and split-encryption keys e1, e2, . . . , ei, respectively.
Yet another group of split-key cryptosystems may be defined by crypto-algorithms E and D, a split-key algorithm for generating encryption and decryption keys e, d on the basis of secret information S and a split-key algorithm using secret information S for multiple splitting of both e and d into an arbitrary number of i split-encryption keys e1, e2, . . . , ei and k split-decryption keys d1, d2, . . . , dk (i, k≧1 and i+k>2) such that Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . ))=Ddk(Ddk-1( . . . (Dd2(Dd1(Xe1,e2, . . . ,ei))=X.
In some embodiments E and D may be different algorithms. In other embodiments, the encryption and decryption algorithms E and D may be identical, i.e. E=D, which allows multiple splitting of both e and d into an arbitrary number i split-encryption keys e1, e2, . . . , ei and k split-decryption keys dk, dk-1, . . . , d1, such that Ddk(Ddk-1( . . . (Dd2(Dd1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . ))=Edk(Edk-1( . . . (Ed2(Ed1(Eei(Eei-1( . . . (Ee2(Ee1(X)) . . . ))=Xe1,e2, . . . ,ei,d1,d2, . . . dk=X.
In such split-key cryptosystem, there is no functional distinction between encryption keys e and decryption keys d. In some embodiments, the encryption and/or decryption algorithms may be commutative, i.e. they may be applied in any order always giving the same result. Such commutative property may be useful when split-keys are used in a different order as they are generated, or when they are used in an order that is unknown at the time of the generation of the split-keys.
In the example of
Secret information S and decryption key d may be used by split-key generator 402 to generate split-keys, e.g. split-encryption keys and/or split-decryption keys. To that end, secret information S may be input to a random split-key generator 420 in order to generate a random split-decryption key d2 422. A deterministic split-key cipher algorithm 624 may generate a further split-decryption key d1 426 on the basis of d and d2.
In another embodiment, the split-key generator may be configured to generate on the basis of secret information S and d, k split decryption keys d1, d2, . . . , dk (k≧2). In a further embodiment, split-key generator may be configured to receive secret information S and encryption key e in order to generate i split encryption keys e1, e2, . . . , ei (i≧2). In yet a further embodiment split-key generator may be configured to generate i split encryption keys e1, e2, . . . , ei and k split decryption keys d1, d2, . . . , dk (i, k≧1 and i+k≧2) on the basis of secret information S and encryption/decryption key pair e, d.
Similarly, when using the EG cryptosystem (as described above), encryption key e may be determined on the basis of process including selection a large prime number p and a generator g that generates the multiplicative group {0, 1, . . . , p−1} mod p and subsequent determination of d by random selection from this group dε{1, . . . , p−2}.
Then, on the basis of the random encryption key e and a predetermined deterministic cipher algorithm 514 associated with the cryptosystem, associated decryption key d 516 may be determined. For example, when using the RSA cryptosystem, decryption key is calculated as d=e−1(mod φ(n)). In some embodiments secret information S may also be used in the calculation of d. For example, in the above referred to RSA case, decryption key is calculated by using φ(n), which is part of the secret information S.
In other embodiments, decryption key d may be determined on the basis of a certain random process and encryption key e may be calculated using a predetermined deterministic cipher algorithm (such as the EG or DJ cryptosystem).
Thereafter, on the basis of d2 522 and d 526 (and − in some embodiments, on the basis of secret information S) associated split-key d1 528 may be determined using a deterministic split-key algorithm 524. For example, in the RSA case the associated split-key may be calculated as d1=(d2−1*d)(mod φ(n)).
Hence, from the above it follows that various symmetric and asymmetric cryptosystem may be used in combination with a split-key algorithm allowing multiple splitting of decryption and/or encryption keys d and e respectively. These split-key cryptosystems may be implemented in content delivery systems as described in this disclosure.
Table 1 provides a comprehensive overview of key information and part of the secret information S, which needs to be distributed to the CS, the CD and the CCU for the different cryptosystems. From this table, it follows that for the split-key RSA, EG and DJ cryptosystems not only the split-keys d1 and d2 but also part of the secret information S, i.e. n (RSA and DJ) and p (EG), are sent to the CD and the CCU respectively.
This information may be sent in a suitable “encryption container” to the entities in the content distribution system. In particular, it may use a so-called split-encryption control message (SECM) to send encryption information to a specific entity configured for (partially) encrypting a content item (e.g. an encryption module associated with the CS) and a split-decryption control message (SDCM) to send decryption information to as specific entity configured for (partially) decrypting a content item (e.g. a CDN of CCU decryption module).
Other embedding functions may be used in order to efficiently watermark a content item in the encrypted domain. For example, in further embodiments embedding of a watermark in an encrypted content item may be achieved using the homomorphic properties of a homomorphic split-decryption cryptosystem as described above. For example, the above-described RSA and ElGamal split-key cryptosystem is multiplicative homomorphic and the Damgård-Jurik split-key cryptosystem is additative homomorphic. Embedding a watermark in a content item using an homomrphic split-key system described hereunder in more detail.
In this particular embodiment, the split-key cryptosystem is based on an homomorphic encryption algorithm, in particular an additive and/or multiplicative homomorphic encryption algorithm, so that a watermark may be embedded into the encrypted content item using a simple algebraic operation. For example, when using additive homomorphic split-key cryptosystem, multiplying an encrypted perturbable data unit Ee(xi) with an associated encrypted perturbation Ee(δ) may result in an encrypted perturbed data unit Ee(xi+δ), i.e. an encrypted data unit wherein the perturbation is added to the perturbable data units in the encrypted domain. In one embodiment, the additive homomorphic split-key cryptosystem may be a Damgard-Jurik split-key cryptosystem.
A similar effect may be achieved using a multiplicative homomorphic split-key cryptosystem such as the RSA or the ElGamal split-key cryptosystem. In that case multiplication of encrypted perturbable data unit Ee(xi) with an associated encrypted perturbation Ee(δ) may result in an encrypted perturbed data unit Ee(xi*δ).
The pre-processing function 624 may be configured to pre-process a content item X and associated encrypted content item Xe in order to generate position information associated with perturbable data units in the encrypted content item in a similar way as described with reference to
Once the content item is pre-processed and encrypted, the encrypted content item 622 and the associated position information 626 associated with perturbable data units in the encrypted content item Xe may be sent to the content distributor. For example, the position information may identify the positions of four perturbable data units {Ee(x1),Ee(x2),Ee(x3),Ee(x4)}) which can be used by an embedding function for embedding a watermark.
When a consumer requests a content item from the content source, a watermark generator WG 646 in (or associated with) the content source, may generate an identifier e.g. a predetermined sequence of bits, for embedding as a watermark w1, w2 in a content item. On the basis of the identifier and encryption key e 618, the watermark generator may generate encrypted one or more perturbations Ee(δ1), Ee(δ2), . . . 648 for the embedding function. The embedding function of the content distributor may use the one or more perturbations and the position information in order to embed the watermark in the content item in the encrypted domain using the homomorphic properties of the split-key algorithm. The embedding function may for example introduce a perturbation in a perturbable data unit by multiplying an homomorphic encrypted perturbable data unit in the encrypted content item with an homomorphic encrypted perturbation: Ee(xi)e*Ee(δ)=Ee(xi+δ). The formation of a watermark w1 in an encrypted content item by embedding a sequence of encrypted perturbations in the encrypted content on the basis of an additive homomorphic algebraic operations may be represented in short by the expression: Ee(X)*Ee(w1)=Ee(X+w1)=Xw1e wherein Ee(w1) represents one or more encrypted perturbations which are used for embedding watermark w1 into the content item X.
The thus watermarked and encrypted content may be further processed in a similar way as described with reference to
It is submitted that the sequence of embedding a watermark and decryption by the content distributor is not limited to the process depicted in
Further, in situations where the content is encoded on the basis of entropy, insertion of a perturbation in the encoded payload of a data unit may have a large impact on the way the payload is displayed. Hence, in that case, the pre-processing functions needs to identify specific perturbable data units, which comprise a payload which allows the addition of a perturbation which is not perceptible when displayed, and sent this as location information to the content distributor. In other situations however, the encoding of a data unit may be less sensitive to insertion of a perturbation in the payload. For example, when a content item is formatted on the basis of IPCM frames using linear RGB coding, adding a perturbation to the payload of a data unit may not be perceptible when it is displayed. Hence, in that case, a perturbation may be added to a data unit without examining in advance whether the payload is particularly suitable for embedding a perturbation. Such embodiment provides the advantage that the content does not need to be pre-processed and embedding of a watermark does not require the use of position information on perturbable data units. In that case, the content distributor or the embedding function itself may select encrypted data units for embedding the watermark.
Hence from the above it follows that, the homomorphic properties of the split-key cryptosystem may be used to efficiently generate an encrypted watermarked content item Xw1e by embedding a watermark w1 on the basis of a set of encrypted perturbations Ee(w1) into encrypted content item Xe using a simple algebraic process (e.g. multiplication). In some embodiments, no position information is required for embedding the watermark so that watermarking in the encrypted domain is possible without pre-processing a content item.
Further, the encrypted content Xe stored with the content distributor cannot be decrypted, neither by the content distributor, nor by a consumer having a split-decryption key. Moreover, as the watermark is only added upon a consumer transaction, multiple CDNs could get the same encrypted version Xe. This may save pre-processing efforts in CDN interconnect scenarios in which a content source uses multiple content distributors (in parallel or cascade) to deliver the content to consumers, as the pre-processing needs to be performed only once per content item instead of once per content item/content distributor combination.
For example, in an embodiment, the content source 610 may partially encrypt a content item X into a partially encrypted content item Ee1(X) and partially encrypt one or more perturbations in partially encrypted perturbations Ee1(δ) on the basis of split-encryption key e1. These data Ee1(X,δ) 680 may be sent to a first CDN1 6401, comprising a first watermark embedding module and an encryption unit. In some embodiments, these data may further include position information associated with perturbable data units in the partially decrypted content item. The partially encrypted perturbations may be embedded into the partially encrypted content item using a homomorphic algebraic operation in order to form a partially encrypted watermarked content item Ee1(X+w1) comprising a first watermark associated with CDN1.
The encryption unit may be used to further encrypt the partially encrypted watermarked content item Ee1(X+w1) on the basis of a further split-encryption key e2 into encrypted watermarked content item Ee2(Ee1(X+w1)), before it is sent to a further, second CDN2. As the second CDN2 6402 also comprises a watermark embedding module, CDN1 6401 may also encrypt the partially encrypted perturbed data units Ee1(δ) in to (fully) encrypted perturbations Ee2(Ee1(δ)) and send these encrypted perturbations along with the encrypted watermarked content item Ee2(Ee1(X+w1,δ)) 682 to the second CDN2.
The second CDN2 may comprise a second watermark embedding module which may embed the partially encrypted perturbations in the partially encrypted watermarked content item using a homomorphic algebraic operation so that a partially encrypted watermarked content item Ee2(Ee1(X+w1+w2)) is obtained wherein a first part w1 of the watermark is associated with the first CDN1 and a second part w2 of the watermark is associated with the second CDN2.
A decryption unit in CDN2 may partially decrypt the fully encrypted watermarked content item Ee2(Ee1(X+w1+w2)) into a partially decrypted watermarked first content item Dd1(Ee2(Ee1(X+w1+w2))) 684, before it is sent to the CCU. The requesting CCU may comprise a decryption module and receive the second split-decryption key d2 in order to fully decrypt the partially decrypted watermarked content item Dd2(Dd1(Ee2(Ee1(X+w1+w2))))=X+w1+w2.
Hence, in this scheme, the content item and the perturbations are sent in encrypted form to a first CDN1, are processed and subsequently forwarded to a second CDN2, which may use the encrypted perturbations to watermark the content item in the encrypted domain. In one embodiment, a CDN may be configured to send and receive perturbations to and from other CDNs (in advance) over an inter-CDN interface. This interface may also be used by CDNs to exchange information on the watermarking and/or the split-key cryptosystem, including information on the type of encryption algorithm used, a seed for generating (split) encryption keys, a watermarking policy, etc.
It is submitted that may other variants are possible within leaving the scope of the invention. For example, the system in
Hence, in this particular embodiment, the pre-processing function 724 in the content source 510 may pre-process a content item X 721 in order to generate position information associated with perturbable data units in the encrypted content item. The position information may be sent as replacement information 726 to the embedding function 742 of the content distributor 740. Similarly, the content item X may be encrypted by an encryption unit 720 on the basis of a public encryption key e 718 of the additive homomorphic split-key cryptosystem and sent the content distributor.
Then, if the content item is requested by a consumer, a watermark generator 719 associated with the content source may send a watermark w1 719 to the watermark encryptor 723 of the content source. Using the watermark and the public encryption key e, the watermark encryptor may generate one or more encrypted perturbations Ee(δ) 725, which are used by the embedding function for generating encrypted watermarked content item Xw1e 743 wherein the additive homomorphic properties of the split-key cryptosystem are used to add the a sequence of perturbations forming the content item in the encrypted domain in a similar way as described with reference to
Hence, the properties of the additive homomorphic split-key cryptosystem allows the outsourcing of the generation of encrypted perturbations which are used in the watermark embedding process to a third party, e.g. the content distributor, as even with the public encryption key e a content distributor cannot decrypt the non-watermarked encrypted content item Xe. This way, encrypted perturbations and identifier, e.g. a content identifier, may be generated by the third party and used by that third party to inserted a watermark into an encrypted content item upon request of that content item by a consumer. Such implementation reduces processing time at the side of the content source and it reduces the traffic between the content source and the content distributor as encrypted perturbations typically comprise more bits than the identifier itself. It further allows that watermarks are generated locally by the content distributor, thereby even further reducing the traffic between the content source and distributor when compared with the embodiment described with reference to
The content delivery systems described above with reference to
This problem may be solved by “forcing” a content distributor to embedded a predetermined watermark in the content item X. This may be achieved using a special watermarking scheme in combination with an additive homomorphic split-key cryptosystem according to an embodiment of the invention.
In this particular embodiment, the content source 810 may execute a pre-processing function 824 to determine the position information of perturbable data units, i.e. content parts in the encrypted content item that are suitable for watermarking and which are going to be used for embedding part of a watermark. Based on the position information, the content source (or in particular the pre-processing function associated with the content source) may add display distortion information y 815 to the content item so that a distorted content item X+y 818 is formed. The display distortion information in the distorted content item will distort the display of the content in such a way that it is not suitable for content consumption. The display distortion information y is inserted at the positions of the perturbable data units. Further, the distorted content item is encrypted on the basis of public encryption key e 818 into an encrypted distorted content item Ee(X+y) 842, which is subsequently sent to the content distributor 840.
Further, a watermark generator WG 817 associated with the content source may generate perturbations for embedding a watermark w1 in the content item and subtract the display distortion information y from the perturbations resulting into a first compensating perturbations for embedding a watermark w1−y 819 in the content item. The compensating perturbations are sent to the watermark encryptor 823 of the content distributor, which encrypts the compensating perturbations into encrypted compensating perturbations. The encrypted compensating perturbations used for embedding a watermark w1 in the content item may be denoted in short as: Ee(w1−y).
An embedding function 842 may combine the encrypted distorted content item Ee(X+y) with the first encrypted compensating perturbations Ee(w1−y) using an homomorphic addition into encrypted watermarked content item Xew1 843. Thereafter, the content is processed in a similar was described with reference to
As already shortly referred to above, selection of data units comprising a payload which is suitable for carrying a perturbation which is not perceptible when displayed, may depend on the protocol and/or codec's used for delivering content to the CCUs. For example, when an MPEG-type protocol is used, the consecutive pictures of a video are coded in I, P and B frames, wherein an I (intra) frame is an image which is processed on a spatial basis, wherein a P (predicted) frame is predicted from an I-frame or another P-frame and processed in a temporal way using a technique known as motion compensation; and, wherein an B (bi-directional) frame is not only predicted by its predecessor (like a P frame) but also by its successor.
Encoding of an I-frame consists of a number of consecutive steps, which are well-known in the art. First a video filter transforms RGB pixels represented by bit values, e.g. an 8-bit value, for each primary colour to an YCbCr presentation where Y is the luminance signal. A Discrete Cosine Transform (DCT) transforms a block, e.g. an 8 by 8 or a 16 by 16 block, of pixels to a block of weighting values, e.g. 12-bit weighting values, similar to the discrete Fourier transform. The first weighting value, called the DC value, corresponds to a solid luminance or colour value for the entire block and the remaining lower frequency DCT coefficients correspond to smoother spatial contours.
Each DCT value is quantized (compressed) by dividing it by a quantization value and rounding the result to the nearest integer. After quantization many DCT values, especially the ones corresponding to high frequencies, will be zero, which allows for further efficiency in the coding. For example, run-length variable length coding (VLC) may be used to encode likely (small) coefficient values by a small number of bits. Encoding of the P and B frames is a little more complicated but also results in a matrix of DCT coefficients, e.g. a 8 by 8 matrix of DCT coefficients 900, as depicted in
A suitable location for inserting watermarks in (encrypted) MPEG videos may be one or more low frequency DCT coefficients (excluding the first so-called DC value) of the I frames. In an embodiment, one or more of the 14 low frequency DCT coefficients 902 (indicated in gray in
Hence, from the above it follows in one embodiment, one or more predetermined (low frequency) DCT coefficients associated with an MPEG frame, preferably an I-frame, may be identified during the pre-processing of the content item as perturbable data units. The positions of these low frequency coefficients in the content item may be sent as position information to a content distributor. Similarly, the one or more low frequency DCT coefficients in a content item may be used for insertion of display distortion information in order to generate a distorted content item as described above with reference to
In the embodiments of
Further, the content source may pre-processes the content before it is ingested by the content distributor wherein the pre-processing may include the determination of the locations of perturbable data units, i.e. data units in the (encrypted) coded content item, which are suitable for embedding a perturbation.
In one embodiment, “embedding” may comprise replacing one or more encrypted perturbable data units with one or more encrypted perturbed data units each comprising a perturbation. In another embodiment, “embedding” may comprise combining (e.g. adding) one or more encrypted perturbations with one or more encrypted perturbable data units on the basis of a homomorphic algebraic operation.
The use of homomorphic cryptosystem such as the DJ split-key cryptosystem may cause a factor of two in the amount of data transmitted (as e.g. 1024 bit plaintext is encrypted into a 2048 bit cipher text). However, an homomorphic cryptosystem is in principle only required for the data units that are designated to be watermarked in the encrypted domain.
Hence, in some embodiments, the content source may split a content item X in a common, non-perturbable content item X1 comprising data units which are not designated as perturbable and a perturbable content item X2 comprising data units of which at least part is designated as perturbable. In that case, common content item X1 may be encrypted by a fast and efficient cryptosystem, e.g. EAS or a symmetric (split-key) stream cipher, and the perturbable content item X2 may be encrypted using a homomorphic split-key cryptosystem. Thus, in this embodiment, the content is split in at least a first and second part wherein only the first part of the content item comprises perturbable data units that are encrypted in accordance with a homomorphic split-key cryptosystem. The data units of the content item may be encrypted using another encryption scheme, e.g. AES or a symmetric (split-key) stream cipher. This way the processing of data and the traffic between the entities in the content delivery system can be substantially reduced.
Hence, in this embodiment, the content source may pre-process the content item X in order generate position information 1026 associated with perturbable data units. Further, on the basis of the position information, the content splitting unit may split the content in a common content item X1 and a perturbable content item X2. Examples of perturbable data units may include e.g. DCT coefficients in MPEG2-encoded video or IPCM frames in an H.264-encoded video as used with HD DVD, Blu-ray Discs, and (internet) streaming. Some embodiments associated with perturbable data units will be discussed hereunder in more detail.
The content source may distribute the common content item X1 via the content distributor to the consumer. The common content item X1 may be encrypted by an encryption unit 880 on the basis of an efficient cryptosystem, e.g. the well-known Advanced Encryption Standard (AES) or a derivative thereof or a symmetric split-key stream cipher (e.g. described with reference to
Similarly, the perturbable content item X2 may be encrypted, watermarked, distributed and decrypted (by the CCU) into plaintext watermarked (perturbed) content item Xw2 using any of the embodiments described with reference to
A content combiner (CC) 1072 in the CCU may subsequently combine the watermarked and common content item into a watermarked content item Xw 1074. Hence, this particular embodiment provides the advantage that most part of the content item is encrypted and distributed in accordance with an efficient cryptosystem, which does not increase the traffic between the content source, content distributor and CCUs. Only a relative small part (e.g. 1 Mb of a 1 Gb video file) is encrypted using an homomorphic split-key cryptosystem thereby reducing the data traffic.
Thereafter, in a further step 1104, the content splitting unit of the content source may split the DCT coded content item into a common content item X1 and a perturbable content item X2 comprising a predetermined number of perturbable data units. In one embodiment, the perturbable data units may relate to one or more DCT coefficients in different DCT blocks. These selected DCT coefficients, which may be structured in a data structure (hereafter referred to as a watermarking (W) block), are not run-length encoded using VLC. Optionally, in an embodiment, the remaining part, the common content item (comprising the quantized DCT coefficients of P- and B-frames and the quantized DCT coefficients of the I-frames that are not part of the W-block) may be further compressed. For example, in one embodiment, using e.g. a run-length encoding scheme.
The split content item may then encrypted and delivered to the CCU in a similar way as described with reference to
For example, when using the DJ split-key cryptosystem, each DCT coefficient xi may be encrypted into Ee(xi,ri) wherein xi is the i-th quantized DCT coefficient and ri is the random number for the i-th coefficient used by the DJ encryption algorithm. The thus encrypted common content item and the encrypted W-block may be sent to the content distributor.
Then, once a consumer decides to buy content item X, the content may generate an identifier, e.g. a transaction identifier, and—on the basis of the identifier—generate an encrypted watermarked W-block by adding encrypted perturbations to the encrypted W-block using the homomorphic properties of a homomorphic split-key cryptosystem (step 1110). The encrypted watermarked W-block, in particular the encrypted perturbed DCT coefficients in the W-block, may be partially decrypted by a decryption unit using a first split-decryption key d1.
The content distributor may then send the two encrypted content items, the encrypted common content item and the partially decrypted watermarked W-block, to the CCU, which may fully decrypt the partially decrypted perturbed W-block on the basis of a second split-decryption key and decrypt the common content item on the basis of a suitable decryption key. Thereafter, it may combine the perturbed DCT coefficient in the perturbed W-block with the plaintext common content item into a non-compressed plaintext watermarked content item (step 1112).
Alternatively, in one embodiment, the CCU may generate a watermarked compressed MPEG movie. To that end, the combiner unit in the CCU may for each DCT-coefficient in the W-block perform the steps of: decode the run-length encoded VLC blocks of the common content item into DCT blocks; insert the perturbed DCT coefficients; and, recode the complete set of DCT blocks by run-length encoding into a watermarked and compressed content item so that the CCU is able to play it using a suitable video player, e.g. an MPEG player.
It is noted that the process flow of
The content source may send the encrypted distorted data units (in this case encrypted distorted DCT coefficients) to the content distributor together with the DJ public key e=(n,g,h). Then, when a consumer wishes to buy the content item X from the content source, the content source may generate two DJ split-decryption keys d1 and d2 wherein the first split-decryption key is provided to the content distributor and the second split key is provided together with the DJ public key to the CCU of the consumer. The content source may then generate an identifier, e.g. content identifier, and—on the basis of the identifier—a set of perturbations may be generated which are corrected for the distortion information (in this example distortion information is subtracted from the distortion) thereby forming compensating perturbations wi−yi.
The content source may then encrypt the perturbations wi−yi into encrypted perturbations Ee(wi−yi) on the basis of the DJ crypto cipher and the DJ public key e=(n,g,h). When an encrypted compensating perturbation is added to its associated encrypted distorted data unit, the distortion information is compensated (cancelled). The encrypted compensating perturbations are subsequently sent to the content distributor.
In an alternative embodiment, the content source may send the perturbations wi−yi to the content distributor, which performs the encryption on the basis of the public key e.
The embedding function may subsequently add encrypted compensating perturbations Ee(wi−yi) to the encrypted distorted perturbable data units, in this case encrypted distorted DCT coefficients, using a multiplication of the homomorphic encrypted distorted data units and compensating perturbations: {Ee(xi+yi)*Ee(wi−yi)} mod n2=Ee(xi+wi). Further, the thus encrypted watermarked DCT coefficients may be partially decrypted on the basis of a first DJ split-key d1 and subsequently sent to the CCU, which then fully decrypts the partially decrypted and watermarked DCT coefficients using a second DJ spit-key d2. The watermarked DCT coefficients are then combined with the plaintext common content item into a watermarked content item in a similar way as described with reference to
It is submitted that the embodiments in
It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. One embodiment of the invention may be implemented as a program product for use with a computer system. The program(s) of the program product define functions of the embodiments (including the methods described herein) and can be contained on a variety of computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, flash memory, ROM chips or any type of solid-state non-volatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory) on which alterable information is stored. The invention is not limited to the embodiments described above, which may be varied within the scope of the accompanying claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 12190643.2 | Oct 2012 | EP | regional |
