WO2009031082A1

WO2009031082A1 - Apparatus and methods for transferring digital content

Info

Publication number: WO2009031082A1
Application number: PCT/IB2008/053480
Authority: WO
Inventors: Stefan Katzenbeisser; Aweke N. Lemma; Mehmet U. Celik; Minne Van Der Veen
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2007-09-03
Filing date: 2008-08-28
Publication date: 2009-03-12
Also published as: TW200925923A

Abstract

The present invention relates to methods and apparatus for transfer of digital content. A method of transferring digital content from a first entity (60) to a second entity (70) includes a transfer control entity (50) transmitting a transmission key k1[n] to the first entity. The first entity applies the transmission key to digital content, to encrypt the digital content. The first entity transmits the encrypted digital content to the second entity. The transfer control entity transmits a receive key k2[n] for receipt by the second entity. The second entity applies the receive key to the encrypted digital content to generate decrypted data comprising the decrypted digital content embedded with a watermark w[n]. The transfer control entity transmits a degraded version w'[n] of the watermark to an entity for watermark detection.

Description

Apparatus and methods for transferring digital content

FIELD OF THE INVENTION

The present invention relates to methods and apparatus suitable for transferring digital content between different entities. Embodiments of the present invention are particularly suitable for, but not limited to, distributing digital content from a seller to a buyer, in a manner that results in the buyer obtaining watermarked digital content and limits the opportunity for accusations by the buyer that they have been framed, should copies of the watermarked digital content subsequently be distributed in an unauthorized manner.

BACKGROUND OF THE INVENTION Digital content, such as audio, video, text, data, multimedia files and the like, can be easily shared or distributed e.g. over a computer network. Forensic watermarking is increasingly being used to protect distributed digital content.

To allow the tracing of unauthorized copies, a watermark is often embedded within the digital content. The watermark can be a forensic watermark e.g. a watermark relating to the identity of a user, such as a buyer of the content. Thus, typically a service provider will embed a forensic watermark (relating to the identity of the customer) into the digital content downloaded to the customer. For example, Fig. 1 shows such an architecture, in which a seller or service provider (SP) transmits digital content (c) embedded with a forensic watermark (w) to a buyer or customer (C). When an unauthorized copy of the content is found, this forensic information allows the identification of the customer who leaked the content.

Traditionally, it has been assumed that the service provider (e.g. the content owner) is completely trustworthy i.e. performs the watermark insertion honestly and does not frame an innocent customer by trying to falsely identify him as a copyright infringer. However, problems can occur if the service provider is not trustworthy.

Two problems that can occur are:

(1) As the service provider watermarks the distributed digital content, the service provider has access to the watermarked piece of content distributed to each customer. Consequently, the service provider is able, at least theoretically, to distribute this watermarked content illegally. Following the unauthorized distribution of the content containing the forensic watermark, any investigations could incorrectly identify the customer as the source of the leak, due to the watermark embedded within the content. (2) The service provider chooses the watermark identifying a specific customer. Thus, the service provider could potentially insert such a watermark in any piece of content, and subsequently pretend that the customer (to which the watermark payload points) has distributed the content illegally. In other words, digital content could be distributed in an unauthorized manner, and the unauthorized distribution attributed to a customer, without the customer even ever having seen or obtained a copy of that content. In practice, the service provider often has no financial motivation to frame an innocent customer. However, problems can arise if a malicious customer invokes the possibility that the service provider/content owner has framed the customer, potentially as a means to discredit the forensic information provided by the watermark.

Having said that, it may also theoretically be possible for untrustworthy employees of the service provider to illegally distribute watermarked content (with the watermark identifying an innocent customer) as identified above.

Such problems were noted by N. Memon and P. Wang, who also describe a solution to that problem in their article "A buyer-seller watermarking protocol," IEEE Transactions on Image Processing, vol. 10, no. 4, pp. 643-649, 2001. In such a scheme, to embed a watermark, the service provider and the customer jointly execute a cryptographic protocol, which assures that both the watermark and the watermarked content are not available to the service provider, but that the customer receives a uniquely watermarked version and has no access to the unmarked original of the digital content.

The central tool for construction of that solution, as well as for subsequent improvements on that solution, is an additive homomorphic public-key encryption scheme, which allows insertion of encrypted watermarks directly into the encrypted content without prior decryption. However, such schemes are very inefficient in practice as they encrypt each sample of the content (or at least those samples to be watermarked) individually. In addition to the significant computational overhead, the protocol often expands the data due to the use of public-key encryption, and requires a high communication bandwidth. For example, a public-key encrypted coefficient can take up hundreds, if not thousands, of bits. SUMMARY OF THE INVENTION

It is an aim of embodiments of the present invention to provide an alternative method of content distribution, that preferably substantially addresses one or more problems with the prior art, whether referred to herein or otherwise. It is an aim of particular embodiments of the present invention to provide a method of content distribution for use in service provider-customer content distribution, for inhibiting framing of an innocent customer, but also allowing the identification of customers who illegally distribute content.

In a first aspect, the present invention provides a method of transferring digital content from a first entity to a second entity, comprising the steps of: a transfer control entity transmitting a transmission key to a first entity; the first entity applying the transmission key to digital content to encrypt the digital content; the first entity transmitting the encrypted digital content to a second entity; the transfer control entity transmitting a receive key for receipt by the second entity; the second entity applying the receive key to the encrypted digital content to generate decrypted data comprising the decrypted digital content embedded with a watermark; and wherein the transfer control entity transmits a degraded version of the watermark to an entity for watermark detection.

Such a method allows secure transmission of the digital content between the first entity and the second entity, by encryption of the digital content. The receive key (which both decrypts and watermarks the encrypted content) ensures that the second entity retains a watermarked version of the content. Transmission of a degraded version of the watermark to the first entity, allows the first entity to check subsequently as to whether or not the watermark content has been distributed in an unauthorized manner, but without requiring the first entity (e.g. the service provider/content owner) to have access to the original watermark. The transfer control entity may transmit the degraded version of the watermark to the first entity.

The first entity may store the degraded version of the watermark in association with information indicative of the identity of the second entity.

The method may further comprise checking for unauthorized distribution of digital content by: performing watermark detection on suspect digital content using the degraded version of the watermark.

The comparison may be performed by correlating the degraded version of the watermark with the watermark embedded in the suspect digital content. The method may comprise the steps of: the first entity transmitting information indicative of the identity of the second entity to the transfer control entity; and the transfer control entity generating the receive key such that the watermark obtained by applying the receive key to the encrypted digital content is indicative of the identity of the second entity.

Said receive key may be arranged to simultaneously decrypt the encrypted digital content and embed the watermark in said digital content, when applied to the encrypted digital content.

The degraded version of the watermark may be a distorted version of the watermark.

The degraded version of the watermark may be a linearly distorted version of the watermark.

The degraded version of the watermark may be obtained by application of a random function to the watermark. The step of the transfer control entity transmitting a receive key for receipt by the second entity may comprise: the transfer control entity transmitting an encrypted version of the receive key for receipt by the second entity; and the second entity decrypting the encrypted version of the receive key, for application of the receive key to the digital content.

The method may comprise the steps of: the second entity transmitting an encryption key for receipt by the transfer control entity; and the transfer control entity generating an encrypted version of the receive key using the encryption key.

The method may comprise the steps of: the transfer control entity transmitting the encrypted version of the receive key to the first entity; and the first entity transmitting the encrypted version of the receive key to the second entity. The transfer control entity may transmit the receive key to the second entity.

The transmission key may be arranged to encrypt the digital content and remove a predetermined watermark embedded within the digital content, when applied to said digital content.

In a second aspect, the present invention provides a method for controlling the transfer of digital content, comprising the steps of: a transfer control entity transmitting a transmission key to a first entity, for application of the transmission key to digital content to encrypt the digital content; the transfer control entity transmitting a receive key for receipt by the second entity, such that application of the receive key to the encrypted digital content generates decrypted data comprising the decrypted digital content embedded with the watermark; and wherein the transfer control entity transmits a degraded version of the watermark to an entity for watermark detection.

In a third aspect, the present invention provides a method of transmitting digital content, comprising the steps of: a first entity storing digital content; the first entity receiving a transmission key from a transfer control entity; the first entity applying the transmission key to the digital content to encrypt the digital content; the first entity transmitting the encrypted digital content to a second entity; and wherein the first entity receives a degraded version of a watermark from the transfer control entity.

In a fourth aspect, the present invention provides a carrier medium carrying computer readable code configured to cause a computer to carry out the method as described herein.

In a fifth aspect, the present invention provides an apparatus comprising means arranged to perform the method as described herein.

In a sixth aspect, the present invention provides a computer apparatus comprising: a program memory containing processor readable instructions; and a processor configured to read and execute instructions stored in said program memory, wherein said processor readable instructions comprise instructions configured to cause the computer to carry out a method as described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

Preferred embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

Fig. 1 is a schematic diagram of a prior art digital content distribution architecture; Fig. 2 is a schematic diagram illustrating the transfer of digital content between two entities, in accordance with an embodiment of the present invention; and

Fig. 3 is a schematic diagram illustrating the transfer of digital content between two entities, in accordance with a further embodiment of the present invention.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Prior art content distributing schemes, that use homomorphic public-key encryption of content, can lead to unpractical requirement on computational resources and transmission bandwidth. Such problems can be addressed by instead using a method of transferring digital content in accordance with an embodiment of the present invention. Use is made of a trusted third party (TTP) to provide (e.g. generate) an appropriate transmission key for encrypting the digital content sent from a first entity (e.g. the service provider) to the second entity (e.g. the customer). The TTP also provides or generates a receive key, which is used for decrypting the encrypted digital content at the customer (second entity) and also watermarking the digital content. The TTP thus acts as a transfer control entity.

To allow subsequent identification of the watermarked content by the service provider, the TTP provides the service provider with a degraded version of the watermark. As the TTP does not provide an original version of the watermark to the service provider, and as the service provider does not have access to the receive key, then the service provider can not produce a copy of the digital content embedded with the same watermark as that of the customer.

The TTP transmits the receive key for receipt by the customer (second entity). The term "for receipt by" covers the concept that the receive key is sent in a transmission from the TTP to the second entity, and it also covers the alternative concept that the receive key is sent in a transmission from the TTP to a different entity, for subsequent later transmission to the customer. For example, to prevent the service provider having a copy of the receive key, the TTP can send the receive key directly to the customer. Alternatively, the TTP can transmit the receive key to the customer via the service provider, as long as the receive key is encrypted (with an encryption agreed with the customer) during the transmission process.

The service provider is capable of performing checks on the authenticity of watermarked content (e.g. to detect unauthorized distribution of digital content), by performing watermark detection using the degraded version of the watermark. If a positive detection result is achieved, then the suspect digital content can be determined as being an unauthorized copy. For example, the degraded version of the watermark may be compared with a watermark embedded in the digital content. If the similarity between the degraded version of the watermark and the watermark embedded in the digital content is high enough (e.g. above a predetermined threshold) then the embedded watermark is determined as being the same as the (original, undegraded) watermark. If the relevant digital content embedded with the watermark is thus obtained from a source or entity other than the customer, then unauthorized copying can be assumed/determined. Preferred embodiments of the present invention will now be described with reference to Figs. 2 & 3. A first embodiment will be described with reference to Fig. 2 and a second embodiment with reference to Fig. 3.

The preferred embodiments will be described in relation to a Trusted Third Party 50 (i.e. a transfer control entity) and two entities (first entity & second entity) 60, 70. It should be realized that in most implementations the TTP and both the entities will each be implemented as computers, computational devices, or other automated communications and data storage devices. Each computer/computational device would comprise a program memory storing processor readable instructions, and a processor configured to read and execute the stored instructions, so as to cause the computer to carry out the relevant method steps.

Typically, the digital content will take the form of audio, video, text, data or multimedia files or the like. In most instances (but not necessarily all), such data will be stored in a data file. The device/computer (of at least each entity) would typically be arranged to display, play or edit the digital content, or store the digital content for download to a suitable display device or playing device, or editing device, or a combination of the aforesaid. For example, in the case of an audio file, a computer could be arranged to both edit the audio file and play the audio file, as well as store the audio file for download to an MP3 player. The TTP and first and second entities are each separate, discrete entities. The transfer control entity (TTP) allows the secure transfer of digital content from the first entity to the second entity. Preferably, each entity 50, 60, 70 can communicate with the other two entities. However, in the second embodiment it is only necessary that the first entity 60 is in communication with the other two entities 50, 70. The ability of each entity to communicate with the other entities need not be continuous. For example, the transfer control entity (TTP 50) and the first entity 60 could each be a server, each connected to one or more communications networks. Each network can comprise a computer network, such as the Internet or an Intranet. The second entity (which could correspond to a user or a group of users) 60, 70 could be a personal computer, or a mobile device such as a mobile phone, media player, Personal Digital Assistant etc. Each of the first and second entities is preferably connectable to the same communications network (e.g. the Internet) as the transfer control entity. Thus, both the first and second entities can only communicate with the transfer control entity over one or more communications networks. The first entity can also communicate with the second entity (e.g. send digital content), over a communications link. This could be a communications link over a communications network, or it could be a direct link between the two entities such as a wireless link (e.g. a Bluetooth link or an Infrared link) or a wired link (e.g. a cable connecting the two entities together). From a business perspective, the TTP 50 will typically be a trusted watermark generation authority, the first entity a content provider (e.g. the service provider, seller, or content owner), and the second entity a consumer or buyer.

As shown in Fig. 2, the transfer control entity 50 includes a memory 52, the first entity 60 includes a memory 62, and the second entity 70 includes a memory 72. The memories 62, 72 are each arranged to store the relevant digital content, and all of the memories 52, 62, 72 are arranged to store the respective additional associated data.

As it is preferable that the resulting watermark in the final digital content (as stored by the second entity) is a forensic watermark providing information indicative of the identity of the second entity 70, the transfer control entity (i.e. TTP 50) is informed of the identity ID2 of the second entity 70. Typically, the first entity 60 will transmit data indicative of the identity of the second entity 70 to the TTP 50. The first entity 60 will store digital content Ci[n]. It is desirable to transmit this information from the first entity 60 to the second entity 70. It is also desirable that the digital content the second entity 70 subsequently stores is watermarked, preferably with a forensic watermark. To facilitate the secure transmission of the digital content, the TTP 50 provides a transmission key ki [n] to the first entity. The transmission key is arranged to encrypt the digital content for transmission.

To ensure that the received encrypted content can be both decrypted and watermarked (preferably simultaneously) by the second entity 70, the TTP 50 also provides the second entity 70 with a receive key k₂[n]. The receive key k₂[n] is arranged to, when applied to the encrypted digital content from the first entity, simultaneously decrypt the digital content and embed the digital content with a watermark w[n]. The watermark w[n] can be a forensic watermark, indicative of the identity ID2 of the second entity 70. The TTP 50 can generate both the transmission key ki[n], and the receive key k₂[n]. The receive key can be generated using ID2.

To allow subsequent accurate verification regarding the identity of the watermark, the TTP 50 can store the watermark w[n], information indicative of the identity of the second entity 70 (e.g. ID2), and/or any of the information that it transmits to the first or second entities e.g. ki[n], k₂[n], and w'[n]. In the particular embodiment illustrated in Fig. 2, the transmission key and the receive key are sent, respectively, to the first entity 60 and the second entity 70 by the TTP 50. In the illustrated example, the watermarking scheme is assumed to be additive in the sense that the watermark is added to the content to obtain the watermarked version. Further, to encrypt the digital content, the transmission key is subtracted from the initial content. The transmission key could be a random series of numbers r[n]. The receive key k₂[n] can be the combination of the transmission key encryption component r[n] and the watermark w[n] i.e. k₂[n]=r[n]+w[n].

The first entity 60 applies the transmission key ki [n] to the digital content Ci[n] to form the encrypted digital content:

E(C₁ [nl = c_l[n]-r[n] [1]

The first entity 60 then transmits the encrypted digital content E(ci[n]) to the second entity 70.

The second entity 70 then decrypts the encrypted digital content E(ci[n]) by applying (e.g adding) the receive key k₂[n] to the encrypted content, to obtain the digital content embedded with the watermark w[n] i.e. c₂[n] = E(C₁[H]) + k₂[n] [2]

= C₁[H] - r[n] + r[n] + M{n] [3]

Thus, the second entity 70 stores data C₂ [n], which corresponds to the original digital content embedded with the watermark i.e. c₂[n] = c_λ[n]+ w[n] [4]

To allow subsequent detection of the watermark w[n], the TTP 50 provides the first entity 60 with a degraded version (w'[n]) of the watermark w[n].

For example, again assuming an additive (or subtractive) system, the degraded version of the watermark could be obtained by subtracting a random sequence of values r'[n] from the watermark w[n] i.e. w'[n]=w[n]-r'[n]. The function r'[n] could be a similar function to r[n], e.g. the same type of function, but with different values. The degraded watermarked version w'[n] can be a noisy variant of the watermark.

The degraded watermarked version w'[n] is still of sufficient quality to allow the first entity 60 to perform detection of the watermark w[n] in a piece of unauthorized content. A check can be made of whether suspect content c' is an unauthorized copy or version, by detecting or checking for the degraded watermark w'[n] in the suspect content c'.

Thus, the first entity can store the degraded watermarked version w'[n], in conjunction with information (e.g. ID2) indicative of the identity of the second entity, so as to facilitate management of digital rights. However, as the first entity 60 does not have a copy of the original watermark w[n], then it should not be possible for the first entity 60 to generate digital content embedded with that watermark i.e. it would then be difficult for the second entity 70 to indicate that they had been falsely accused of distributing C₂ [n], if copies c' of C₂ [n] are obtained from a source other than the second entity 70.

It should be appreciated that the above embodiment is described by way of example only, and that various alternatives will be apparent to the skilled person as falling within the scope of the appended claims. For example, within the above embodiment the transfer control entity transmits a degraded version of the watermark to the first entity. That degraded version of the watermark can subsequently be used for detection of unauthorized distribution of digital content. However, it should be appreciated that the invention could be implemented by the transfer control entity transmitting the degraded version of the watermark to an entity other than the first entity. For example, the transfer control entity could transmit a degraded version of the watermark to a different entity than the first entity, with that different entity being responsible for checking for unauthorized distribution of digital content (e.g. tracking of the unauthorized distribution of digital content).

Within the above embodiment, the r[n] has been used to represent the function used to encrypt digital content. As previously indicated, the function r[n] can represent a sequence of random numbers. A piece of digital content is encrypted by heavily distorting its perceptually significant components with randomness derived from r[n].

The function r[n] could represent any masking function (including a random noise signal or function), which when applied to the digital content, prevents the reading of the resulting marked digital content. For example, if the digital content represents an audio stream or signal, then the encryption r[n] could represent any signal to mask the audio signal, and prevent a listener from hearing (or at least hearing clearly) the desired digital content when played. Preferably, the digital content is encrypted using random noise i.e. r is a random noise function, so as to inhibit the ability of an attack to remove the encryption/masking of the digital content. Most preferably, the digital content is encrypted using a one time pad (OTP). An OTP is an encryption algorithm where the plain text (e.g. the audio signal) is combined with a random key or "pad" that is as long as the plain text, and used only once. If the random key (r) is truly random, never re-used, and kept secret, the OTP is theoretically unbreakable. An example of a suitable marking function (together with a description of how the function can be removed by a suitable key) is described within the article "Copyright Protection for MPEG-2 Compressed Broadcast Video" by S Emmanuel & M Kankanhalli, ICME 2001, IEEE International Conference on Multimedia and Expo, pp. 273-276. The article describes examples of how video files can be encrypted (i.e. masked) in either the spatial domain or the compressed domain. The content of that article is incorporated herein by reference. The article describes how an opaque mask frame can be added on to the original compressed video, frame by frame, by a broadcaster. A subscriber can remove the mask and also embed a robust, invisible watermark. Such a technique as described in that document can be utilized in embodiments of the present invention (e.g. to encrypt video or multi-media signals). The technique can be implemented with the additional concept that the key used to encrypt/mask the digital content is also arranged to remove a watermark (which can be robust and/or invisible) embedded within the digital content i.e. if the content stored on the first entity 50 includes a watermark. This removal of the embedded watermark is useful, as it facilitates secure sharing of digital content.

Other encryption techniques such as partial encryption based techniques, or homomorphic ciphers can also be applied, as alternatives to OTPs.

In the above embodiment, the method has been described with respect to additive forensic watermarks. It should be appreciated that forensic watermarks need not be utilized. A non-forensic watermark could be utilized e.g. with a database storing data indicative of that watermark and the associated user (i.e. second entity). Equally, it should be appreciated that the watermarks need not be additive or subtractive watermarks - the invention could be implemented using any watermark scheme (e.g. multiplicative or other) that allows the watermark to be embedded, preferably in a robust manner. To further facilitate digital rights management, the digital content Ci[n] stored by the first entity 60 may already be embedded with a watermark (e.g. wo[n]). In some embodiments, it may be desirable to leave the original watermark wo[n] within the digital content, so as to facilitate later further tracking of the source of the digital content i.e. such that the unencrypted digital content C₂ [n] stored by entity 70 contains not only the watermark w[n] relevant to that second entity, but also the original watermark wo[n]. However, in an alternative implementation, it is envisaged that the transmission key ki [n] is arranged to simultaneously remove the original watermark wo[n], and encrypt the digital content. For example, an appropriate transmission key, assuming that the encryption is performed by subtracting the transmission key from the digital content embedded with the watermark (e.g. an additive watermark) would be: k[[n] = r[n] + w_o[n] [5]

Thus, by removal of the original embedded watermark prior to encryption, subsequent collision between the later watermark w[n] and the original watermark wo[n] is prevented.

Further, the above method describes how digital content may be encrypted (using the transmission key), and then decrypted (using the receive key), to generate decrypted data comprising the decrypted digital content embedded with the watermark. It should be appreciated that such operations need not be applicable to all of the content. The first entity may apply the transmission key to the content data so as to only encrypt a portion of the digital content. Similarly, the second entity may apply the receive key to the encrypted digital content to generate decrypted data, only a portion of which is embedded with the watermark. For example, the article by A. Lemma, S. Katzenbeisser, M. Celik, M. van derVeen, "Secure Embedding Through Partial Encryption", International Workshop on Digital Watermarking, 2006, Springer Lecture Notes in Computer Science vol. 4238, pp. 433-445, describes examples of how perceptually significant features of data can be selected, and only those features encrypted. Similarly, embodiments of the present invention may be implemented by only encrypting portions of the digital content, such as the perceptually significant features. The content of that article is incorporated herein by reference. The article describes how the MASK watermarking scheme can be utilized in joint decryption and watermarking. In MASK, a watermark is embedded by modifying the envelope of the host signal. Also, the article describes how the general methodology of joint watermarking and decryption can be applied to MPEG-2 compressed streams. Embodiments of the present invention may utilize such a methodology applied to video streams, such as MPEG-2.

The function Ci[n] can be a piece of digital content, represented as a vector of real numbers. The elements of this vector can either denote samples in the spatial/temporal domain or coefficients in a transform domain (e.g. DCT or wavelet coefficients). Typically, the representation of the digital content will eventually determine the watermark embedding domain. The function Ci[n] is typically only used to denote that those parts of the digital content that will be encrypted and watermarked; the rest of the content can be multiplexed with the encrypted content. A further embodiment of the present invention will now be described, with reference to Fig. 3. The most significant difference between the embodiment illustrated in Fig. 2 and the embodiment illustrated in Fig. 3 is that the embodiment illustrated in Fig. 3 does not require a communication link directly between the TTP 50 and the second entity 70. Instead, the relevant receive key is sent, suitably encrypted, via the first entity 60. A further advantage of the embodiment shown in Fig. 3 is that the TTP 50 does not need memory for storing long term copies of the information/data it receives, or generates or transmits. To initiate the method, the first entity 60 generates an identifier for the exchange of digital content ID_seSs, with that identifier (e.g. a transaction number transmitted from the first entity 60 to the second entity 70.

In the subsequent step, the second entity 70 then transmits the session identity ID_Sess, and an identifier IDci of the requested digital content (i.e. Ci[n]) to the first entity 60. To allow subsequent transmission of a suitably encrypted receive key, the first entity 70 also transmits an encrypted version of a random session key K (i.e. E(K)) to the first entity. For security purposes, a cryptographic signature (Sig2) of the request is also sent from the second entity 70 to the first entity 60. Typically, information indicative of the identity of the second entity (ID2) will also be sent from the second entity to the first entity, for storage by the entity.

The first entity then checks the signature (Sig2) on the information transmitted from the second entity, and aborts the process if the signature is invalid. Otherwise, the first entity forwards the session identifier ID_seSs, an identifier of the requested content IDci and the receive session key E(K) to the trusted third party 50. Typically, information indicative of the identity of the second entity 70 (i.e. ID2) is not sent to the TTP 50.

The trusted third party 50 decrypts the session key E(K) to obtain K. The TTP 50 will also generate a valid watermark sequence w[n]. Preferably the watermark w[n] is not directly indicative of ID2, as preferably the identity of the second entity is not disclosed to the TTP 50. The watermark sequence w[n] can be a sequence of random numbers. The TTP 50 also generates two random sequences r[n] and r'[n]. The degraded version of the watermark w'[n] is generated by applying the random sequence r'[n] to the watermark w[n] e.g. w'[/z]= w[/z]-r'[/z] [6]

Similarly, the receive key can be generated by combining the watermark with the random sequence r[n] i.e. the receive key k₂[n] can be of the form:

The TTP 50 then uses the session key (K) chosen by the second entity 70 to encrypt the receive key, i.e. to form the encrypted receive key Eκ(k2[n]). The encrypted receive key preferably is encrypted to include the session identifier ID_seSs. The TTP 50 transmits the encrypted receive key, the transmit key, and the degraded version of the watermark to the first entity 60. The TTP 50 can also, for security purposes, generate and transmit a cryptographic signature SigTTP of the transmitted information.

The first entity 60 will then store (e.g. in memory 62) the information transmitted to it by the TTP 50. In particular, the first entity stores the degraded version of the watermark (e.g. an encrypted version of the watermark) for subsequent tracing purposes, as outlined below. For use in potential accusations of infringement, the TTP 60 will also store the signature of the TTP 50 SigTTP. Information indicative of the identity ID2 of the second entity 70 is also stored, along with the session identifier (ID_seSs). As in the first embodiment, the first entity 60 subsequently encrypts the digital content Ci[n], and transmits the encrypted digital content E(ci[n]) to the second entity 70. The first entity 60 also sends the encrypted receive key E(k₂[n]) to the second entity 70.

The second entity 70 uses the session key K to decrypt the encrypted receive key. Most preferably, the TTP 50 encrypted not only the receive key k₂[n] in E(k₂[n]), but also the session identifier ID_seSs. If so, then when the second entity 70 uses the session key K to decrypt the encrypted receive key, then the second entity 70 will extract not only the receive key k₂[n] but also the relevant session identifier; such a session identifier should match the original ID_seSs provided to the second entity by the first entity. If the session identifier does not match the original ID_seSs, then the second entity 70 can abort. Use of the session identifier thus acts as an extra security measure within the method.

Following decryption of the encrypted receive key, the second entity 70 subsequently applies the receive key k₂[n] to the encrypted digital content E(ci[n]), so as to decrypt the content and form the digital watermarked content c₂[n] e.g. c₂[n] = c₁[n]+ w[n] [4] Thus, as previously, the protocol assures that the first entity 60 does not get access to the chosen watermark w[n] or the watermark content c₂[n]. The only information on the watermark available to the first entity 60 is the degraded version of the watermark. Preferably, removing the degrading function/factor r'[n] is of comparable hardness as attacking the robustness of the watermark. Further, in this example, the identity of the second entity (e.g. a customer) is anonymous for the TTP 50, as the TTP 50 only generates valid watermarks, and encrypts them by an asymmetric key K given to it. This is useful in the accusation protocol, as outlined below. To trace the leak source of an unauthorized copy c' of the digital content, the first entity uses the degraded version w'[n] of the watermark. Typically, the first entity will store degraded versions of a plurality of different watermarks (corresponding to different transactions) in the transaction database in memory 62.

The first entity does not have direct access to the original of any of the watermarks w[n] embedded in a piece of content. However, the first entity 60 can detect for the presence of the degraded version of the watermark(s) within the unauthorized digital content c'.

In the watermark detector described in the above referenced article relating to partial encryption, the watermark detector is a correlation detector that bases its decision on the correlation between the suspect content c' and the watermark. Instead of using the actual, original watermark (or copies of the different original watermarks stored within the database), the first entity 60 here can access the degraded version w'[n]. Typically, this degraded or distorted version of the watermark will be linearly distorted. As the random sequence r'[n] is chosen at random, then the correlation between the degraded version of the watermark w'[n] and the unauthorized content c', will give a rough estimation of the correlation between w[n] and the embedded watermark.

Due to the introduction of additional noise (i.e. due to the degradation of the watermark version w'[n]), the detection is not as accurate as the detection would be if the original watermark w[n] was utilized. However, such a process usually suffices to gain a suspicion about a traitor, which can be verified in more formal proceedings (i.e. a run of the "accusation protocol" indicated below.

Typically the first entity 60 will hold the database including a plurality of degraded watermarks. For a suspect piece of content, the first entity 60 will iterate over all entries in his local transactional database and determine the correlations between each of the degraded versions of the watermark and suspect content c'. The first entity records the session identifier ID_seSs that led to the highest correlation value, and accuses the customer that such a correlation points to. Subsequently, the first entity 60 will utilize the accusation protocol indicated below to prove his suspicion to a third person or entity, termed herein as a judge. In the accusation protocol, to prove to a judge that a specific entity (e.g. second entity 70) is the source of the leaked copy of content c', the first entity reveals the corresponding entry of his transaction database to the judge.

The judge can calculate the correlation between the degraded version of the relevant watermark and the suspect content c', and determine that the correlation is large enough so that a suspicion by the first entity is justified.

Furthermore, the judge will verify both signatures (Sig2 and SigTTP) stored by the first entity in the database, thereby implicitly verifying that Sig2 was computed by the customer with identity ID2, and that both signatures are computed over the same transaction number ID_seSs and preferably also over the same session key K. Inclusion of the session key K in both signatures assures that requests of the second entity 70 and the responses of the TPP 50 are linked, even if the identity of the second entity 70 is unknown to the TTP 50. In addition, the judge will verify that the unauthorized content c' is a copy of the content as requested by the customer (i.e. that c' corresponds to IDci requested by the customer). If the above test in the accusation protocol are passed, then the judge can proceed to ask the TTP 50 to decrypt the encrypted receive key E(k₂[n]), thereby gaining access to the embedded watermark w[n]. Furthermore, assuming that the encrypted receive key string also contained information relating to the session identifier ID_seSs, the judge can then verify that the decrypted string points to the right session identifier and also session key K chosen by the second entity 70. Finally, the judge can verify the presence of the watermark w[n] in the content c' using a standard correlation detector. If the detector indicates that the watermark is detectable, then the judge can accept the accusations of the first entity 60.

Thus, a protocol is proposed that allows the secure transmission of digital content between two different entities (e.g. a buyer and a seller), that compared with prior art techniques that use homomorphic public-key encryption techniques reduces the necessary computational resources and transmission bandwidth. Further, by providing a degraded version of the watermark to the first entity (e.g. the seller), that entity can determine whether the watermark is likely to be present in suspect digital content, but without having access to the original watermark.

In summary, the present invention relates to methods and apparatus for transfer of digital content. A method of transferring digital content from a first entity to a second entity includes the transfer control entity transmitting a transmission key to the first entity. The first entity applies the transmission key to digital content, to encrypt the digital content. The first entity transmits the encrypted digital content to the second entity. The transfer control entity transmits a receive key for receipt by the second entity. The second entity applies the receive key to the encrypted digital content to generate decrypted data comprising the decrypted digital content embedded with a watermark. The transfer control entity transmits a degraded version of the watermark to an entity for watermark detection.

Claims

CLAIMS:

1. A method of transferring digital content from a first entity to a second entity, comprising the steps of: a transfer control entity transmitting a transmission key to a first entity; the first entity applying the transmission key to digital content to encrypt the digital content; the first entity transmitting the encrypted digital content to a second entity; the transfer control entity transmitting a receive key for receipt by the second entity; the second entity applying the receive key to the encrypted digital content to generate decrypted data comprising the decrypted digital content embedded with a watermark; and wherein the transfer control entity transmits a degraded version of the watermark to an entity for watermark detection.

2. A method as claimed in claim 1, wherein the transfer control entity transmits the degraded version of the watermark to the first entity.

3. A method as claimed in claim 2, comprising: the first entity storing the degraded version of the watermark in association with information indicative of the identity of the second entity.

4. A method as claimed in any one of the above claims, further comprising checking for unauthorized distribution of digital content by: performing watermark detection on suspect digital content using the degraded version of the watermark.

5. A method as claimed in claim 4, wherein the comparison is performed by correlating the degraded version of the watermark with the watermark embedded in the suspect digital content.

6. A method as claimed in any one of the above claims, comprising the steps of: the first entity transmitting information indicative of the identity of the second entity to the transfer control entity; and the transfer control entity generating the receive key such that the watermark obtained by applying the receive key to the encrypted digital content is indicative of the identity of the second entity.

7. A method as claimed in any one of the above claims, wherein said receive key is arranged to simultaneously decrypt the encrypted digital content and embed the watermark in said digital content, when applied to the encrypted digital content.

8. A method as claimed in any one of the above claims, wherein the degraded version of the watermark is a distorted version of the watermark.

9. A method as claimed in claim 8, wherein the degraded version of the watermark is a linearly distorted version of the watermark.

10. A method as claimed in any one of the above claims, wherein the degraded version of the watermark is obtained by application of a random function to the watermark.

11. A method as claimed in any one of claims 1 to 10, wherein the step of the transfer control entity transmitting a receive key for receipt by the second entity comprises: the transfer control entity transmitting an encrypted version of the receive key for receipt by the second entity; and the second entity decrypting the encrypted version of the receive key, for application of the receive key to the digital content.

12. A method as claimed in claim 11, comprising the steps of: the second entity transmitting an encryption key for receipt by the transfer control entity; and the transfer control entity generating an encrypted version of the receive key using the encryption key.

13. A method as claimed in claim 11 or claim 12, comprising the steps of: the transfer control entity transmitting the encrypted version of the receive key to the first entity; and the first entity transmitting the encrypted version of the receive key to the second entity.

14. A method as claimed in any one of claims 1 to 12, wherein the transfer control entity transmits the receive key to the second entity.

15. A method as claimed in any one of the above claims, wherein the transmission key is arranged to encrypt the digital content and remove a predetermined watermark embedded within the digital content, when applied to said digital content.

16. A method for controlling the transfer of digital content, comprising the steps of: a transfer control entity transmitting a transmission key to a first entity, for application of the transmission key to digital content to encrypt the digital content; the transfer control entity transmitting a receive key for receipt by the second entity, such that application of the receive key to the encrypted digital content generates decrypted data comprising the decrypted digital content embedded with the watermark; and wherein the transfer control entity transmits a degraded version of the watermark to an entity for watermark detection.

17. A method of transmitting digital content, comprising the steps of: a first entity storing digital content; the first entity receiving a transmission key from a transfer control entity; the first entity applying the transmission key to the digital content to encrypt the digital content; the first entity transmitting the encrypted digital content to a second entity; and wherein the first entity receives a degraded version of a watermark from the transfer control entity.

18. A carrier medium carrying computer readable code configured to cause a computer to carry out a method according to any one of the above claims.

19. An apparatus comprising means arranged to perform the method of any one of claims 1 to 17.

20. A computer apparatus comprising: a program memory containing processor readable instructions; and a processor configured to read and execute instructions stored in said program memory, wherein said processor readable instructions comprise instructions configured to cause the computer to carry out a method according to any one of claims 1 to 17.