FR2896938A1 - METHOD FOR TATOOTING DIGITAL DATA - Google Patents

Abstract

The invention relates to a digital tattooing method comprising the stages of decomposition of the video in blocks (N, N + 1, N + 2) - computation (E1, E2) for each block of said video of a digital signature ( S), according to the invention the method further comprises a step of insertion in a second block (N + 1) of said signature (S) relating to a first block (N), before the calculation of said signature (S) said second block (N + 1).

Description

METHOD FOR TATOOTING DIGITAL DATA The invention relates to a method

  tattooing of digital data.

  The invention relates to the general field of tattooing digital data. More precisely, it concerns the integrity control of digital data.

  Integrity is generally understood as strict integrity. In electronic notary applications for example, we want to ensure that a document (testament for example) is strictly identical to its original version. Any modification, even minimal, of this document (change of a word or even of a single character) can have a strong impact on the semantics. On the other hand, such documents are not likely to evolve or be transformed for reasons of storage or transport cost: the size of a text document to a few thousand bytes does not require any compression efforts. Any cut in the document is also synonymous with integrity violation, and is therefore not considered acceptable. Strict integrity is also required when exchanging executable code, so that everyone can ensure the source of the code, including protection against possible viruses. Here again, the small size of the data and their particular structure - no possibility of compression at a loss in particular - make a strict integrity mechanism perfectly suitable.

  Solutions exist in the state of the art, which make it possible to guarantee the strict integrity of a document. The functions of cryptographic hash allow in particular to obtain, from any document, a digest (dataset size much smaller than the original document) with interesting properties. In particular, any very small change (eg a single bit) of the source document leads to a totally different digest.

  The probability of having two source documents with the same digest is very low; on the other hand, there is no simple method (that is to say, a much lower complexity than the exhaustive exploration) to generate, from a condensed, a source document corresponding to this condensed. It is therefore very difficult to manufacture a falsified document corresponding to a given condensate; On the other hand, even if we get there, this document will probably be very different from the original document (if it is a text, the falsified document will probably consist of a series of unintelligible characters).

  Flexible Integrity Strict integrity mechanisms are ideally suited to text, program, executable, and other data. On the other hand, they are poorly suited to data such as images, video or audio. Indeed, data of this type are often very large, therefore they are generally compressed. On the other hand, they lend themselves particularly well to compression at a loss. Indeed, they are ultimately intended for a human user - viewer or listener - whose brain can only process a very limited amount of information.

  The eye, or the ear, is thus little or not sensitive to a large number of components of the audio or video signals. It is well known, for example, that very high audio frequencies are not very noticeable: the frequency bandwidth can be reduced without altering the subjective quality of the sound. Punctual changes and small amplitude of an image are likewise very rarely perceived. Lossy compression exploits these properties by suppressing or strongly altering (eg, quantizing) all the components to which the subjective receiver is insensitive.

  The signal obtained after compression at a loss is therefore different from the original signal. In addition, there may be a large number of different compressed documents for the same original document, depending on the type of compression algorithm used, the setting, or the desired perceptual quality. Other alterations are also common. They do not change the semantics of the video, but strongly alter the content of the data. This is particularly the case for geometric transformations for images - light cut-outs, scaling or aspect ratio - of the change in sampling frequency for sound.

  All these transformations are unfortunately common in the life of an audiovisual content, because they are often made indispensable by operational contingencies (limited storage space, reduced bandwidth, etc.). A strict end-to-end integrity protection mechanism, applied indiscriminately, is therefore likely to be totally inappropriate in this context.

  We rather seek to preserve the semantics of the content. It should be noted now that the notion of semantics is extremely difficult to define formally. Indeed, it involves not only the aforementioned mechanisms of selectivity of vision or hearing, which are still poorly understood at present, but also the high-level analysis performed by the brain to extract the meaning of the scene.

  For example, the attention of the subject will be focused on the characters of a scene rather than the background. An extraction of semantics thus requires prior recognition of objects, then an analysis of the relationships between these objects in the given scene, operations that are out of reach for current scientific knowledge.

  The term "visual hash function" (in English visual hash) or "flexible signature" is used to calculate a digest of an image (or a video, a sound). Unlike cryptographic hash functions, such a function can (at least that is expected at its conception) give an identical digest for two different images, provided that they are sufficiently close to the perceptual point of view; hence the qualifier of flexible or sometimes robust as opposed to the strict qualifier.

  On the other hand, the condensed will have to be different since the image undergoes an alteration of its semantics; for example adding a character or an object in a scene, editing text images, etc. We immediately realize that the problematic of formal definition of the semantics of an image will make the design of functions of hash visual delicate. One can even doubt the well-posed nature of the problem.

  We can nevertheless define a locality criterion, which can be considered valid in the vast majority of cases: a contingent alteration (due to compression for example) will give rise to modifications of the signal of small amplitude, but distributed relatively uniform over the entire image. On the other hand, an alteration of the semantics will result in a strong but localized modification of the data. We therefore look for threshold hash functions, which tolerate modifications that are lower than a certain value but react to localized variations that are too strong.

  The condensed image must accompany it throughout its life, so that integrity can be verified at any stage of the chain of transmission and storage. Unfortunately, the steps of processing, routing and archiving images are often multiple and complex, and implement formats or equipment in which it is not always possible to associate image and condensed. It is therefore particularly interesting that the condensed can be conveyed with the image, transparently and regardless of the data representation standard used.

  Tattooing techniques are particularly indicated here: they make it possible to transmit information by visually imperceptible modification of the support data. Unlike metadata, tattooing is therefore persistent even after format conversion of the support image. If robust tattooing algorithms are used, the buried information can be re-read even when the image has been altered, for example compressed. On the other hand, if the image is too strongly modified, the tattoo is then erased. Two possible uses, not exclusive, of the tattoo are thus envisioned: • Robust and persistent transport of the condensate, together with the image • Detection of strong alterations of the image, based on the readability of the tattoo itself.

  The tattoo algorithm and its setting are carefully chosen to meet the integrity protection requirements. Changes in the image due to tattooing should not be too strong, so as not to alter the integrity. The tattoo must be readable at least for alterations corresponding to the acceptance limits for integrity. To implement the locality criterion, it is interesting to have separable tattooing algorithms for coding distinct information in distinct areas of the image.

  Different digital tattooing techniques for data integrity control exist: • Fragile methods that detect all changes, even just changing a bit. These methods are very accurate for locating alterations. • So-called semi-fragile methods, the purpose of which is not only to tolerate certain treatments (especially JPEG compression) but also to detect substitutions or the addition of objects in the image. Unlike the previous ones, the location is relatively coarse. The big problem today is that these techniques may not work properly and sometimes generate false alarms (that is, report "imaginary" alterations for some images). • Hybrid methods, which try to combine the advantages of the previous methods; in fact, a double marking is used. Finally, methods with self-correction capability propose to restore the modified image.

  For the particular type of tattooing application that is integrity control, substitute techniques are preferred. They allow the insertion of a message that can be extracted during the integrity verification process.

  Fragile techniques generally use a summary, calculated on the image data not affected by the insertion phenomenon. This may be the result of a checksum, or a hash function on the most significant bit planes, followed by an insertion in the least significant bits.

  For semi-fragile methods, the summary extraction process is more relevant and focuses on image attributes that should not be altered. Other authors take advantage of the relationships between DCT coefficients of distinct blocks; a priori relations invariant by JPEG compression.

  A second solution is to introduce alterations in the image, and to check for presence on detection.

  Finally, we must mention the methods of reversible tattooing. In these approaches, after calculating a summary of the image as a whole, it is inserted into the LSBs of the image by compressing the original bits of the image. In fact, the signature hidden in the low-order bits consists of the summary and the low-order bits that are compressed. This method is obviously fragile.

  The invention proposes to carry a signature of the video by tattooing the video itself. It can then pose a problem of type embrace fatal: the tattoo modifies the video, which can then give rise to a digest different from that of the original video.

  C. Rey & J.-L. Dugelay's Blind Detection of Malicious Alterations On Stil / Images Using Robust Watermarks, published in Secure Images and Image Authentication, IEE Electronics & Communications, April 10, 2000 - London, proposes a method to solve this problem by an iterative approach: one calculates the condensate of the tattooed image, which one reinserts in the image, and one reiterates the process until convergence. However, this method poses problems of calculation time, stability and visibility of tattooing: convergence is not guaranteed. In particular, this method can not be used with a strict hash function because there is no guarantee of its convergence, that is to say that an image may not be protectable without being able to do anything. The following approach is proposed here: the video is cut into blocks.

  These blocks can be groups of images or portions of images; the structures defined in standards such as MPEG or JPEG (GOP - Group of Pictures, 16x16 macroblocks or 8x8 blocks) can be used to simplify operations on compressed streams and promote interoperability.

  For this purpose, the invention proposes a digital tattooing method comprising the steps of - decomposing the video into blocks, - calculating for each block of said video a digital signature, according to the invention the method further comprises a step inserting in a second block of said signature relating to a first block, before calculating said signature of said second block.

  Advantageously, during the step of calculating said digital signature, a hash function and an asymmetric encryption function are applied to each block.

  According to a preferred embodiment, said blocks comprise a series of sub-blocks representative of a frequency decomposition of said video.

  Preferably, said first and second blocks are temporally and spatially adjacent blocks.

  Advantageously, said signature being a sequence of bits, inserting said signature relating to a first block in the second block, inserting in each of the sub-blocks of said second block one of said bits of said signature of said first block.

  Preferably, during the insertion of said bits into said sub-blocks, the order of coefficients of said sub-block is modified.

  Advantageously, the coefficients to be modified are chosen so that the absolute value of the difference of their absolute values is less than a predetermined threshold.

  The invention also relates to a computer program product; According to the invention the program comprises program code instructions for executing the steps of the method according to the invention when said program is executed on a computer.

  By computer program product is meant a computer program support, which may consist not only of a storage space containing the program, such as a floppy disk or a cassette, but also a signal, such as a electrical or optical signal.

  The invention will be better understood and illustrated by means of examples of advantageous embodiments and implementations, in no way limiting, with reference to the appended figures in which:

  FIG. 1 represents a block diagram illustrating the modifications made on the blocks during the encryption operation. FIG. 2 represents a cryptographic algorithm (digital signature) used in the preferred embodiment of the invention. The invention is described in the context of data coded according to the MPEG-4 AVC video coding standard as described in FIG. ISO / IEC 14496-10 (entitled information technology - coding of audio-visual objects - part 10: advanced video coding).

  In accordance with conventional video compression standards, such as MPEG-2, MPEG-4, and H.264, the images of a sequence of images may be of intra type (I-picture), ie encoded without reference to other images of the sequence or inter type (ie P and B images), ie encoded by being predicted from other images of the sequence. The images are generally divided into macroblocks themselves divided into blocks of disjoint pixels of size N pixels by P pixels, called NxP blocks. These macroblocks are themselves coded according to an intra or inter coding mode. More precisely, all the macroblocks in an image I are coded according to the intra mode while the macroblocks in a picture P can be coded in an inter or intra mode. The possibly predicted macroblocks are then transformed block by block using a transform for example a Discrete Cosine Transform in English referenced DCT or a Hadamard transform. The blocks thus transformed are quantized and then coded using generally variable length codes. In the particular case of the MPEG-2 standard, the macroblocks of size 16 by 16 pixels are divided into 8x8 blocks themselves transformed with an 8x8 DCT in transformed 8x8 blocks. In the case of H.264, the intra type macroblocks relating to the luminance component can be encoded according to the intra4x4 mode or the intral6x16 mode. An intra-coded macroblock in intra4x4 mode is divided into 16 4x4 disjoint blocks. Each 4x4 block is spatially predicted relative to some neighboring blocks located in a causal neighborhood, i.e. to each 4x4 block is associated a 4x4 prediction block generated from said neighboring blocks. 4x4 blocks of residuals are generated by subtracting from each of the 4x4 blocks the associated 4x4 prediction block. The 16 residue blocks thus generated are transformed by an integral 4x4 transform H which approximates a 4x4 DCT. An intral6x16 intra-coded macroblock is spatially predicted relative to some neighboring macroblocks located in a causal neighborhood, i.e. a 16x16 prediction block is generated from said neighbor macroblocks. A residue macroblock is generated by subtracting from the intra macroblock the associated prediction macroblock. This macroblock of residues is divided into 16 4x4 disjoint blocks which are transformed by the H transform. The 16 low frequency coefficients (called DC coefficients) thus obtained are in turn transformed by a 4x4 Hadamard transform. In the remainder of the document, the transform T that is applied to a macroblock designates a 4x4 H transform applied to each of the 4x4 blocks of the macroblock if the macroblock is encoded in intra4x4 mode and a 4x4 H transform applied to each of the 4x4 blocks of the macroblock followed. a Hadamard transform applied to the DC coefficients if the macroblock is coded in intral6x16 mode.

  We introduce here the notion of ST-block. The term denotes a concatenation in space and time coded block (in mpeg-4 for example) or, indifferently, block of pixels. An ST block is therefore a particular subset in the space and time of the video. It can correspond to several blocks as described above, to an entire image. It corresponds to the cutting unit of the video. The blocks N, N + 1, N + 2 shown in FIG. 1 each represent an ST-block. The ST-block N is applied to a cryptography method described later with reference to FIG. 2, comprising a hash function and asymmetric encryption. At the end of the application of this cryptographic method, N authentication data is obtained. This authentication data is then inserted into the next N + 1 block of the video on which the method will also be applied. cryptography to obtain authentication data that is inserted in the next block N + 2 and so on.

  This advantageously makes it possible not to modify the blocks after calculating the hash. Otherwise, the block would be more honest on arrival. The next block is certainly modified but imperceptibly, because of the properties of the tattoo. There is no violation of the semantic integrity of the content.

  In addition, this method also makes it possible to control or verify the integrity of the chaining of the blocks, that is to say the temporal integrity of the sequence. Suppose we delete the sequence [N; N + K] of the blocks. The signature extracted from the image N + K + 1 does not then correspond to the signature of the image N-1, except if the images N + K + 1 and N-1 were originally identical; however, this case is extremely unlikely because of the intrinsic variability of the sensors (thermal noise, etc.). This mechanism has the advantage of being implemented over the water, so with a large memory gain and a very low processing latency. A real-time implementation at low cost is therefore possible, which is not the case with the iterative or global approaches of the state of the art. This low complexity is particularly interesting in a video surveillance application since, to ensure a maximum level of security, the algorithm must be operated closer to the sensor.

  On the other hand, the block division is particularly well suited to the locality criterion defining the flexible integrity. The algorithm makes it possible to determine which block (es) have been altered. This information can be particularly interesting to know if crucial areas of the video have been altered, in which case one can suspect a fraudulent modification, or if the alteration relates to minor areas of the scene.

  Note that it is necessary to size the blocks according to a compromise between security / complexity of processing / location of the artifacts.

  Figure 2 shows a cryptographic algorithm used in the preferred embodiment of the invention. This cryptographic algorithm firstly comprises a hash function, step E1, followed by a digital signature calculation function, step E2. The hash function used makes it possible to obtain a condensed version of the ST-block on which a digital signature is then calculated.

  The hash function used is a function of type sha-1. The function of sha-1 takes as input the coefficients of the macro-block and outputs a digest of the block presented as input. In other embodiments, one can also take a SHA-256, SHA-384 or SHA-512, MD5, Whirepool or TIGER function. On this digest of ST-block N, a signature algorithm is applied during step E2. The signature used is the ElGamal algorithm. In other embodiments, it is also possible to take an RSA type signature function.

  An asymmetric encryption algorithm can be derived from a digital signature algorithm as follows: the decryption function D () (using the private key KS) is applied to the document to be signed m, or preferentially to its condensed H (m) , to obtain the signature S = D (H (m)).

  In asymmetric crypto systems, an encryption key (called public key Kp) different from the decryption key (called private key or secret key KS) is used. The public key is generated from the private key: it is easy to generate Kp from Ks, but it is extremely difficult (in terms of computation time and resources) to generate Ks from Kp. The person wishing to encrypt or sign his messages chooses a secret key, for example by drawing a random number, then generates the public key from this secret key. She keeps Ks strictly hidden, and divulges Kp.

  For example, for the El Gamal signature system, the secret key Ks is a random number x. We then calculate y = gX mod [p] from a prime number p and a number g. The public key Kp then consists of the numbers (y, p, g). The properties of calculations on integers modulo p make it extremely difficult to find x from (y, p, g).

  The signature of the message m is a pair (r, $) such that: gm = yr rs mod [p] To verify the signature, we examine whether the equality gm = yrrs mod [p] is verified.

  A digital signature is then output for the block. This digital signature is then inserted into the next block N + 1 using known tattooing techniques. Before the tattoo signature is inserted, the digital signature is enciphered using an error correction code, of the BCH type, for example. A possible tattooing technique consists of cutting the ST-block N + 1 into a set of k DCT blocks (k being at least equal to the size of the digital signature), and applying the following tattoo algorithm: known tattoo, applied for example in the DCT transformation space transformed 8x8 blocks noted Bg gT of an image to tattoo, is to possibly modify for each block Bg gT the order relationship existing between the absolute values of two of its DCT coefficients, denoted F1 and T2. The signature S of ST-block N is a sequence of j bits {bl, b2 ... bj}. The ST-15 N + 1 block comprises a set of k DCT blocks Bg gT (k> = j). In each of these blocks Bg gT, one of the bi bits of the signature of the ST-block N is inserted. This insertion is carried out by the application of the tattoo algorithm below.

  In general, these two coefficients are selected for a given block 20 using a secret key. The bit bi of the footprint associated with a block Bg gT is inserted into this block by modifying the order relation existing between the absolute values of the two coefficients F1 and F2. In order to control the visibility of the watermarking, the coefficients of a block are only modified if the following relation is satisfied: 25 rl û 11 -'2 Il <Th where Th is a parameterizable threshold. The coefficients F1 and F2 are modified so that the following order relation is satisfied: F1 = 1F'21 + d * BZ (1) where: F1 and I'2 are the modified coefficients F1 and F2. 30 - d is a marking parameter called marking distance, and - Bi is a coefficient whose value is defined as follows: Bi = 1 if bi = 0 and Bi = -1 if bi = 1. F1 and F2 can be modified in various ways to ensure the relationship defined above. Let us define e1 = ri ûF1 and e2 = r2 -F2, the values of e1 and e2 are defined for each block Bg gT as follows: e1 = ùT1 + sign (T1) * (f (T1, F2) + di) and e2 = ùT2 + sign (T2) * (f2 (T1, T2) + d2) The choice of the function / is free, we can for example choose fi (F1, T2) = f2 (F1, T2) = F2 .By example, in the case where bi = O, choose d2 = -1F21 and d1 = -1F21 + d, then the relation of order (1) is well verified. In the case where bi = 1, choose di = ûF2 and d2 = ûF2 û d, then the order relation (1) is also verified. The values of d and Th vary according to the application and in particular according to the risk of piracy. Indeed, the higher the value of d, the more robust the tattoo is but the more visible it is. Thus to maintain a good visual quality of the image sequence, the marking force must be limited.

  Once the signature S inserted in the block N + 1, the signature of the block N + 1 is calculated as indicated previously for the block N. The last block of the video is therefore not protected, since one can not tattoo his signature in the next block, which does not exist. However, if you work on the water in a video stream, for example if you want to certify the integrity of a video acquired by a surveillance camera that runs continuously, we never have a last block and so the protection is always guaranteed. On a bounded video, care must be taken to size the blocks so that a loss of integrity on the last block is not important. Note that we do not need to proceed in the temporal or spatial order with all the video available, we can reorder the blocks of the video in any way (the n + 1 block does not will not necessarily be located after block n). we can then choose an unimportant block for the semantics of the video as being the end block.

  To check the integrity of the document m ', we calculate its digest H (m') by applying the hash function. Then, we apply the asymmetric encryption function CO (using the public key Kp) to the signature S: C (S) = C (D (H (m))) = H (m) We then obtain the digest of the initial document H (m), which we compare with the condensate H (m ') of the suspect document m': if both are equal, then the integrity of the document is verified.

Claims (8)

claims   A digital tattooing method comprising the steps of: - decomposing the video into blocks (N, N + 1, N + 2) - calculating (E1, E2) for each block of said video of a digital signature (S), characterized in that it further comprises a step of insertion in a second block (N + 1) of said signature (S) relating to a first block (N), before the calculation of said signature (S) of said second block (N + 1).   2. Digital tattooing method according to claim 1 characterized in that during the step of calculating said digital signature (E1, E2), is applied to each block a hash function and an asymmetric encryption function.   3. Method according to one of the preceding claims characterized in that said blocks (N, N + 1, N + 2) comprise a series of sub-blocks (B "representative of a frequency decomposition of said video.   4. Method according to one of the preceding claims characterized in that, said first (N) and second blocks (N + 1) are adjacent blocks temporally and spatially.   5. Method according to claims 3 and 4 characterized in that, said signature (S) being a sequence of bits (bi), inserting said signature (S) relating to a first block (N) in the second block (N + 1), inserting into each of the sub-blocks (B8 8r) of said second block (N + 1) one of said bit (bi) of said signature (S) of said first block (N).   6. Method according to claim 5, characterized in that, during the insertion of said bits (bi) into said sub-blocks (Bg 8T), the order of coefficients (I'1, F2) of said sub-block is modified. block (B8 8T).   7. The method of claim 6 characterized in that one chooses the coefficients (F1, r'2) to be modified so that the absolute value of the difference of their absolute values is less than a predetermined threshold (Th).   8. Method according to claim 3 characterized in that said sub-blocks (B $ T) are representative of a decomposition by the Fourier transformation (DCT) of said video.