\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{19}{November 12, 1996}{Ron Rivest}{Jake Harris} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Handouts}
There were two handouts today
\begin{enumerate}
\item Problem Set 9 
\item The reading {\it Collusion-Secure Fingerprinting for Digital Data}
by Boneh and Shaw. Today's lecture will focus largely on this paper.
\end{enumerate}

\section{Intellectual Property Protection}

In recent years, the Internet (and other electronic networks) has
become a powerful medium for the widespread dissemination of
information in all sorts of forms (research papers, images, sounds,
moves, etc.). Such unrestricted distribution is perfectly acceptable
for some information, but this is not true for all content. As the
volume of commercial and data transmitted over networks
increases, controlling access and distribution of such data become
more important. Such control over access and distribution of content
is know as {\bf Intellectual Property Protection} (IPP).

A hypothetical example of IPP is the Internet Joke Book. As the
president and maintainer of the IJB, I charge users \$ 0.01 a joke. As
a concerned president, I need IPP to protect my jokes and keep my
profits more than laughable. The first thing to prevent is to keep
unauthorized users from getting my jokes (puns intended) without
paying. The second is to keep my jokes from crossing the road and
winding up on the other side posted anonymously to alt.humor
or repackaged for sale at Yoav's Internet Joke Hut.

Of course, these issues of IPP are more than just idle academic
exercises, but is a real concern for many businesses. As a real
example, concern over IPP has hindered the development of the next
form of CDs, known as DVDs. These DVDs are capable of storing large
amounts of data, even entire movies. The Motion Picture industry thus
refuses to approve DVDs until they are satisfied with its mechanisms
for protecting the movies burned into it. Similar concerns from the
Music Industry ruined any possibility of commercial success for the
DAT tape.

This lecture outlines some approaches to protecting intellectual
property, with a major emphasis on digital fingerprinting. It does not
address electronic payment schemes (next lecture) or legal issues, but
just establishes some mechanisms for preserving the safety of
intellectual property.

\section{Basic Approaches}

There are several possible ways to implement IPP. Note that none of
these strategies are mutually exclusive, and a hybrid scheme involving
a few of them would probably work quite well.

IPP Schemes
\begin{itemize}
\item {\bf Distribute Encrypted Versions}. This is the simplest and
most widely used approach to protecting intellectual property. The
idea is to encrypt the information and provide the keys only to
authorized (usually paying) customers.  
\item {\bf Fingerprinting}. Assign each copy a unique "fingerprint."
This prevents content from being repackaged as someone else's and
allows the culprits responsible for illegal redistribution to be
caught.
\item {\bf Copy Protection}. Use some mechanism to prevent copies from
being easily made. While this may work for some media and
applications, it usually is infeasible for generic digital information.
\item {\bf Removing the Economic Incentive} Yet another approach is to
make the cost of copying and redistributing much higher than
legitimately purchasing another copy.
\end{itemize}

Of course, none of these schemes are impossible to defeat, but that is
not really the point. As with many of the security examples we have
discussed earlier in the course, the goal is to simply raise the fence
high enough to frustrate all but the most dedicated attacker. 

\section{Distributing Encrypted Versions}

As mentioned above, the approach here is to encrypt information and
provide the keys only to authorized customers.  This scheme is geared
towards the {\bf prevention} of unauthorized distribution. A common
example of encrypted distribution is cable TV, where subscribers pay
extra to have HBO and other premium cable channels descrambled. The
reading on cryptolopes is included to provide the latest version of
this scheme.

This approach is a good start, but it has its shortcomings. Because it
places a large amount of trust in the end user, this scheme is unable
to effectively prevent illegal redistribution from occurring. What is
to keep users from reposting the unencrypted information or even the
keys themselves? Even worse, what is prevent them from repackaging it
and selling it as the real thing? 

It is not enough to prevent all copying, since US law allows people to
make a copy for personal use. Of course, the law also forbids
widespread redistribution, but when has that stopped anybody? This has
not been such a big concern in the case of HBO and cable channels,
since any VCR-recorded copies will be of low enough quality that they
present no real threat, but it's a whole different ballgame with
digital data that reproduces perfectly. Microsoft is unable to be so
unconcerned about the safety of its product, as several recent
criminal cases have demonstrated. Clearly, a better scheme is needed.

\section{Digital Fingerprinting}

Unlike distributing encrypted versions, digital fingerprinting is more
of a deterrent than a prevention. The idea here is brand each
distributed copy with a unique fingerprint. This scheme relies on
implementing the paradox of making seemingly identical copies unique;
each fingerprint should be unique and also unnoticeable to the end
user. In addition, fingerprints should also be resistant to
tampering. Where the encrypted distribution was designed to prevent,
this scheme is geared more towards {\bf detection}. Although we will
be concerning ourselves with the pragmatics of fingerprinting only
digital data, it is possible to extend more conventional analog media
as well.

Some possible implementations of fingerprinting are 
\begin{itemize}
\item {\bf Music} Tweaking note pitch slightly. Compressing and
expanding timing by small amounts.
\item {\bf Images} Making tiny changes to color values, pixel
locations, or image sizes.
\item {\bf Maps} Inserting fictional towns or streets. Moving
locations slightly.
\item {\bf Movies} Inserting, duplicating, or deleting frames. Filming
with two cameras 6'' apart and switching between the two views.
\item {\bf Software} Producing unique binaries for each
user. Inserting NOPs. Changing instruction order slightly. Frobbing
with register allocation.
\item {\bf Digital Information} Tweaking the least significant bits of
a digital representation. 
\end{itemize}

These are just a few sketchy examples of how fingerprinting can be
implemented. Most of these are a bit too simplistic and vulnerable to
tampering to be put to practical use. Also, some of these schemes are
a bit hard to implement or do not scale very well, making them a major
headache for high-volume applications. Still, you get the idea.

\section{The Boneh-Shaw Paper}

The included paper by Boneh and Shaw presents a few practical methods
for collusion-secure fingerprinting of digital data. Before, we can
begin to examine the details of the Boneh-Shaw paper, we must specify
several assumptions.

Assumptions of the Boneh-Shaw Algorithm
\begin{itemize}
\item {\bf There is a way to mark the data.} Although this is usually
true for digital representations, we can not assume this is the case
for everything. Indeed, it is quite simple to imagine information
which is not easily markable.
\item {\bf Marks are binary in nature}. Marks can be digital data (1s
and 0s) or more abstract binary operations (presence vs. absence,
compression vs. expansion).
\item {\bf Marks are only detectable by comparing copies}. It is
impossible to find the fingerprint by examining a single copy
alone. Rather it is only through comparing multiple copies for
differences that the marks can be identified.
\end{itemize}

{\bf Collusion.} As you may have noticed from the title, the
Boneh-Shaw paper outlines several fingerprinting algorithms that are
resistant to collusion. This means they can not be successfully thwarted by
conspiracies less than a certain size acting together to produce a new
copy for illegal redistribution (i.e. $D_1,D_2,...,D_n \Rightarrow
D'$).

To see why collusion is a concern, observe how it is possible to use
multiple copies to detect fingerprints, as the following example
demonstrates. Simply performing an XOR on multiple copies indicates
some of the mark locations.
\begin{center}
\begin{tabular}{ccccccc}
$f_1$=& 1& 0& 1& 0& 1& 1\\
$f_2$=& 0& 1& 1& 0& 1& 1\\
$f_3$=& 1& 1& 1& 0& 0& 1\\
Marks& $\uparrow$& $\uparrow$& & & $\uparrow$& $\uparrow$\\
\end{tabular}
\end{center}
Any collusion attack on the Boneh-Shaw scheme involving less than a
certain number of members will be unsuccessful (i.e., it will be
possible to identify at least one of the culprits involved.)

\section{Using an Identity Matrix}

The simplest method for fingerprinting is to use an identity matrix
for generating the set of all fingerprints. 
\begin{center}
\begin{tabular}{cccccc}
$w^{(1)}$& 1& 0& 0& 0& 0\\
$w^{(2)}$& 0& 1& 0& 0& 0\\
$w^{(3)}$& 0& 0& 1& 0& 0\\
$w^{(4)}$& 0& 0& 0& 1& 0\\
$w^{(5)}$& 0& 0& 0& 0& 1\\
\end{tabular}
\end{center}

This works, but it has severe shortcomings. For starters, the length
of the digital fingerprint (denoted henceforth as $\ell$) is as long
as the number of unique copies in circulation. Needless to say, this
does not scale well, and is feasible really only for the largest of
data files like movie. In addition, it takes only a minimum of 2
copies for an adversary to guess how this scheme works and create a
copy which can not be traced to anyone (i.e. with a fingerprint of all
0's). It is impossible for them to fabricate a copy with someone
else's fingerprint though.

\section{A C-secure and C-frameproof fingerprinting scheme}

As the analysis of the above scheme suggested, there are two different
levels of collusion security we are looking for in a digital
fingerprinting method:
\begin{enumerate}
\item {\bf Prevent framing}. The goal here is to prevent a collusion
from producing a new copy which frames someone else as the
culprit. Any scheme which does this is {\it c-frameproof}.
\item {\bf Prevent anonymous copies.} Here the fingerprinting scheme
should stop a collusion from merely generating a copy which is not
linked to them. Such a scheme is said to be {\it c-secure}. This is a
more difficult condition to meet.
\end{enumerate}

In both these cases, c is the size of the collusion (e.g. for $D_1,
D_2, D_3$, c = 3). Of course, we would like to be able to produce a
scheme where c=n, but that is rarely possible. As an example of this
notation, the fingerprinting method outlined above is n-frameproof,
but only 2-secure.

\section{The Boneh-Shaw Fingerprinting Scheme}

It would be nice if we could produce a more manageable and scalable
digital fingerprint ($\ell = O(\log n)$) that is c-secure with short
$\ell$.  The Boneh-Shaw paper also describes a c-frameproof and
c-secure scheme that achieves such logarithmic growth.
\begin{center}
\begin{tabular}{lcc}
c-frameproof& $\ell = 16c_2 \log n$& (Theorem 9)\\
c-secure&     $\ell = c_4 \log n$& (Theorem 17)\\
\end{tabular}
\end{center}

The best way to see how the Boneh-Shaw fingerprinting method works
(besides reading the paper) is through the following example. Suppose
there are 5 copies of some data with the following fingerprints.
\begin{center}
\begin{tabular}{ccccc}
$w^{(1)}=$& 111& 111& 111& 111\\
$w^{(2)}=$& 000& 111& 111& 111\\
$w^{(3)}=$& 000& 000& 111& 111\\
$w^{(4)}=$& 000& 000& 000& 111\\
$w^{(5)}=$& 000& 000& 000& 000\\
\end{tabular}
\end{center}

Notice that the fingerprint is divided into $n-1$ blocks of $d$ bits
each (here n=5 and d=3). Suppose everybody except $w^{(2)}$ is in a
collusion together to break the fingerprint scheme. Assume the actual
bits that form the fingerprint in the data file are randomly chosen
before the signatures are created by the producer. The collusion
should be able to figure out what bits belong to the first two
columns, but they need $w^{(2)}$'s fingerprint to figure exactly what
bits belong in each column. Of course, they may be able to guess, but
there is no way they can be certain. With larger keys and smaller
proportionate collusions, the chance of their success becomes
extremely small. Usually c-secure codes are described as {\it c-secure
codes with $\epsilon$-error} to reflect this probabilistic basis; this
indicates that any attempt to tamper with the code will result in the
capture of at least one member of the collusion with probability $1 -
\epsilon$.

As a result, any attempt by the collusion to produce a counterfeit key
will most likely fail, since they will be unable to really tell which
bits in the data correspond to which column. In the actual
fingerprint, the 1's should be evenly distributed between the two
unknown columns. If the collusion attempts to generate a false
signature, it is unlikely that the 1's will be evenly distributed in
the false signature and it should be possible to finger one of the
members of the collusion with high probability. For the exact
algorithm used, the reader is encouraged to check Theorem 12 of the
paper.

Of course, the example outlined above requires a fingerprint of length
$\ell = (n-1)^d$, hardly the $O(\log n)$ behavior we were looking
for. It is possible to transform this into a shorter fingerprint, and
you are encouraged to check the Boneh-Shaw paper for details.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
