Protecting a museum's digital stock through watermarks
Basically, museums have only limited possibilities to ensure their existence and to secure their funds: by sponsors, by donations, by visitors, and by selling copies of their collection in form of copyrights. While the first two (external) are almost completely out of their control, they have major influence on the visitors' acceptance by keeping their collection together, by enlarging it, and by making it attractive (internal funding). This has been well understood for years. By granting copyrights to other parties and by publishing parts of their collection in the Web, museums touch the essence of their stock and they have to enter a new technology realm at the same time. As long as the copyright issue is not solved in a satisfactory manner, museums may not offer open access to the digital information of their collection. Granting copyrights based on secure technology will become more and more crucial in the near future as unallowed duplication will be facilitated which will harm the museums' funding essentially. Digital watermarks may offer a solution.
This paper is not about intellectual property rights in general, copyright policies, or about copyright laws. We will talk about copyright technology based on digital watermarking. Ideally, all scans should have integrated header information including author/creator of the object, title, date, owner, copyright owner, and some usage patterns (sale or license agreements). This information has to be protected against manipulation and destruction. Robustness is needed urgently.
This paper is structured as follows: Section 2 provides an introduction on digital watermarking in general, a watermarking infrastructure needed and requirements for watermarking tools. Section 3 is about robustness of watermarks, attacks, and existing watermarking tools. Section 4 describes visible watermarks as one possible solution in more detail. An alternate approach of copyright protection without watermarks is finally described in section 5, before section 6 the paper concludes with practical recommendations for museums.
In the history of mankind watermarks have been used to prove the genuineness, authenticity (Bearman and Trant 1998), and authorship of documents or certain products of different crafts (e.g. paintings or carpets). Today a well-known example is watermarks in banknotes which make it difficult to counterfeit them and which improve the detection of faked ones.
(ZDWEBOPEDIA, 2000) defines digital watermarks as:
Digital watermarks may be visible or invisible. They may identify the originator of the material and the owner of the copyright or they may identify the recipient (e.g. a publisher, an end-user, another museum) to whom the material was given for special purposes (fingerprint). All possibilities mentioned make sense depending on the application in a museum itself and the boundary conditions.
When talking about watermarks for digital media (especially for pictures and videos) one has to distinguish between three categories of watermarks with different purposes:
In this paper our concern is especially in robust hidden watermarks. Digital watermarks for copyright protection are part of the wider discipline of information-hiding techniques which has got increasing attention from the research community and from industry in the last 10 years. Although there have been several conferences and a lot of papers published on the subject of watermarking still images and videos today only few products are available on the market. A good collection on products and patents can be found at (Petitcolas, 2000).
Finding the right solution
As mentioned above our paper is not about intellectual property rights in general, copyright policies, or about copyright laws. We do not want to discuss whether digital watermarks are necessary or whether copyright laws are sufficient. Our experience is that a lot of people responsible for museums feel uncomfortable by enabling access to their digital information without additional protection mechanisms.
Apart from the products available today a few questions have to be answered beforehand and can function as a basis for future evaluations:
We want to give a short answer to the first question by reflecting publications on the subject and show solutions available today. The second question deals with the necessary infrastructure. There is a close relationship between the first and this question. The main subject in answering the third question is the aspect of "robustness". Without the ability to embed robust watermarks all efforts must be insane. This will be considered in below.
Components of a watermark
To assert and protect someone's rights in an image it is necessary to embed information about the owner/originator, the end-user, and the rights a user has in the image. In (Franz & Schoenfeld, 1999) the minimum requirements are described as:
It is obvious that this information consumes too much space when embedded into an image. (Apparently the literature e.g. Kutter & Petitcolas, 1999 reached an agreement that 100 Bits is the maximum length of a watermark which can by inserted into a typical image without making changes humanís normally can notice.) This will lead us to a framework similar to the well-known ISBN system (ISO Standard 2108) we all know from identifying books.
It should be possible to extract some public information (e.g. the originator information and the ID of the image) from the watermarked image so it is possible to lookup which company or person has the rights in that image. The mapping between originator number and the real company should be handled by an independent trust center, which also could pay attention to give this or other information (like the rights the originator might have on this document) only to an authorized questioner. Some companies now offer such needed authentication and certificates services like VeriSign (http://www.verisign.com/). A very similar system is described in (Delaigle, 1996).
Components of a watermarking infrastructure
The ability to embed robust watermarks in digital images does not necessarily imply the ability to establish ownership. Nevertheless robust watermarks offer added value especially if they are used for fingerprinting. Robust watermarks must be combined with hash functions and time stamping mechanisms and be embedded in a framework of trusted third parties for registration and time stamping to fit the requirements mentioned above.
At present such an infrastructure is not established. Instead we find some vendor specific solutions, which means that the vendor of a watermarking product acts as a registration office by offering user identification numbers and granting access to this database. The originator himself must manage individual fingerprints. In addition there are efforts to develop special search engines that crawl the Internet for watermarked data.
A museum using such a system has to pay for the software, mostly a yearly fee for a registration ID, and has to establish its own database to manage used fingerprints and the combined exploitation rights. By accessing the publicly available database of registered IDs knowledge of the originator of a work can be achieved. The knowledge about the copyrights of specific persons or organizations is not publicly available.
This can also be achieved by using visible watermarks (see Visible Watermaring, below).
Requirements for watermarking tools
The crucial requirement is robustness against data manipulation (see next section). Watermarks ideally should not reduce the quality of a multimedia object significantly. A watermarking tool should therefore embed marks in salient parts of the data. This will improve its robustness. Besides this there should be the ability to decide on the "strength" of an embedded watermark which regulates the amount of embedded data according to individual needs.
Watermarking tools must have the ability to be integrated in existing production environments, ie. especially when used for "fingerprinting". The importance of performance considerations is increasing with the growing amount of accesses or by offering huge amounts of data.
Ideally everyone should have the ability to extract the originator ID to gain knowledge of copyright information. This can be achieved either by integrating the needed functionality in common software for image or video processing or by offering a Web interface where data can be submitted for checking. The second solution is not appropriate for high quality images since their size is often very big.
Robustness of Watermarks
A good watermark should survive many different operations on the image that carries it. Some operations could be called 'attacks' while others occur in the normal day-to-day work with an image to be published.
Geometric transformations are considered as 'unintentional' attacks on the image. Rotating, scaling, flipping, shearing, mirroring, or cropping a watermarked image are normal operations on an image and should easily be survived by a watermark. Also the conversion into another graphic format (especially JPEG) and the beautification of an image (sharpen, histogram modification, gamma correction, color quantization, adjustments in brightness or contrast) should have no effect on the watermark. Rather intentional attacks are the deletion or addition of lines or columns inside a watermarked image, printing and scanning the image, adding noise to it, and applying low pass filters.
However, there also exist even more sophisticated attacks; we will list only the most important ones:
Another important aspect for the robustness of a watermark is the human behavior, which should not be ignored. The infrastructure for the insertion process of the watermark should be very safe. At no point should it be possible for anyone to have illegal access to one of the components in the process (e.g. the original image or the watermarked image before it received a time stamp from the registration office).
Evaluation of existing systems
Nearly all vendors and developers of methods to embed watermarks in multimedia data claim that their method is robust. But seldom there is a definition of "robustness" and an explanation how it is tested.
In seeking an appropriate tool for one's needs there is the difficulty to compare different tools according to certain criteria in an easy manner. Especially (Petitcolas & Anderson, 1999) attended to this problem. By developing a Ñfair benchmark for image watermarking systems" they laid the basis for an objective comparison of different systems and products. They developed a tool called "StirMark" (Petitcolas, Anderson, and Kuhn, 1998) with which all the image manipulations mentioned above can be done in a performant and reproducible manner. StirMark is available for free. Together with a set of commonly available test images being representative for several demands, every product vendor and every interested user can do his own tests and comparisons.
In Petitcolas and Anderson have tested several available products and published their results (Petitcolas & Anderson, 1999). EIKONAmark (http://www.alphatecltd.com/), Giovanni (http://www.bluespike.com/), and SysCop (http://www.mediasec.com/products/index.html) lack the demanded robustness on "normal" image transformations. Digimarc 1.51 (http://www.digimarc.com/) and SureSign 3.0 (http://www.signumtech.com/) have better results. Nevertheless there are attacks that destroy embedded watermarks without disturbing the image quality so much.
The results achieved by Petitcolas and Anderson are based on an election of five different pictures. These images may not be typical for a museum. There may be museums offering only black and white pictures. Others have colored images with rich details. We have chosen such an example (see figure 2). Normally the strength of an embedded watermark has to be chosen appropriate to the individual needs of a chosen picture and the planned use. In spite of the fact that several human perceptual models are described in literature and some are already available, only trained experts are able to decide on the quality changes.
In our example, we used Digimarc as Adobe PhotoShop Plugin Version 1.6.84 and SureSign Version 3.1. We choose maximum robustness. As a test candidate, we took a picture from the Beethoven House collection in Bonn, showing a theatre in Vienna ('Theater an der Wien').
Figure 2.1 shows the original image ('Theater an der Wien' published by Tranquillo Mollo, 1830). Figure 2.2 shows the same image after the watermark insertion (ID=162905) by Digimarc's product. For a human eye there is no noticeable change in the image. Figure 2.3 shows the image after insertion of a watermark (User ID=99-ZZ-99 and Image ID=AA00001) by SureSign's product. As in Figure 2.2 no change is noticeable.
Figure 2.5 and Figure 2.6 show both watermarked images after going through the program StirMark mentioned in chapter 3 (without giving any of the many possible options). The images are somewhat bended. (By tuning some of the possible parameters of StirMark you will be able to produce a de-watermarked image without this bending effect. This is only an example how easy it is to remove a watermark.)
This trivial example shows that invisible watermarks are far from what the customer wants them to be. There is no commercial product available capable of surviving all of the known possible attacks. Although scientific research has found new ways in inserting watermarks (e.g. Kutter, Bhattacharjee, and Ebrahimi, 1999), a solution in the near future is not foreseeable.
Figure 2.4 shows the image with a visible watermark inserted by the product H20maker (http://www.kagi.com/EquitySoft/maker.html). Because the watermark is now a real visible part of the image, it is not that easy to remove it. Also the usage of the attacks mentioned above cannot remove the watermark. If the image is manipulated and it is not possible to recognize the watermark by human eye the image itself has no longer a real commercial value. Regarded in this way visible watermarks are a good choice, but there also exists some problems with them: They are visible! Possibly this is not acceptable. Another problem might be the rapid evolution in the area of pattern recognition and image editing which might allow the removal of those visible watermarks through sophisticated tools. Further studies will be done in this area to ascertain the feasibility of this new technologies.
Digital images with visible watermarks can be used for advertisement purposes. Combined with a low-resolution image quality, these images can be given away for free. Only after purchasing an authorized copy of an image, the high-resolution quality without a visible watermark or a tool/software package/key to eliminate the visible watermark will be provided by a museum. By this, robust visible watermarks establish ownership. However, even this simple scenario leads to some challenging requirements for the robustness of the visible watermark.
In (Mintzer, Lotspiech, and Morimoto, 1997) two different approaches for visible watermarks offered by IBM are described:
(Mintzer, Boyle, Cazes, Christian, Cox, Giordano, Gladney, Lee, Kelmanson, Lirani, Magerlein,, Pavani, and Schiattarella, 1996) describe the first approach in more detail:
Apart from IBM, there are a few products for visible image watermarking on the market only. We made some tests, see figure 2.4, with the product H20marker.
An alternative approach
The argument against the use of watermarking for protecting property rights in general is well-known (see for instance Dittmann & Steinmetz, 1999). The watermarks shall contain the information, which are necessary to prove ownership and they are embedded in the original image, i.e. they modify the original. Moreover, they must not mar the intrinsic information given by the image, so they are redundant by definition. Therefore, as mentioned in our description of the philosophical attack, theoretically it will always be possible to extract the watermarks without disturbing the image. Ideas that tend to weave the watermark with the image, which makes it not efficient to destroy the hidden information, often refer to the success of cryptographic methods but they lack the proof of concept.
The functionality of watermarking
The watermarking workflow is always the same, regardless of the specific methods used. First, the image of interest is patterned (see fig. 4). There are a variety of different algorithms, which are described below. All methods claim to give the best possible summary of the pictureís content. This filtered information, which we call attribute vector from now on, must represent the knowledge mediated by the image. So converting, compressing, and attacking the image should not change the vector ideally. In the next step, a redundant mapping between the ID and the attribute vector is developed. Because this mapping embeds the ID in the picture and therefore changes it in common watermarking methods, it has to be as smooth as possible. For instance the frequency analysis maps on those coefficients which seem not to be essential for the human eye to recognize the picture. Indeed, only the least significant bits can be changed.
Many authors (e.g. Kutter & Leprévost, 1999) agree that there must be a third party (let us call it a trust center) which verifies the date of embedding a watermark by time stamping. In proving the ownership the trust center must also get an inscription which makes sure which pattern method was used to get the appropriate attribute vector and a description of the mapping to extract the ID. The trust center also saves the ID to get a connection between owner and image.
Without marking the original
If the pattern algorithm and the mapping to the ID must be deposited there is no need to mark the image. The owner proves his rights in alluding to the data at the trust center by his ID. The image of interest will be patterned according to the method deposited and afterwards, the mapping to the attribute vector will be executed which must lead to the claimerës ID.
This approach goes beyond the use of simple hashing because the attribute vector is robust against attacks and the mapping makes use of redundancy in extracting the ID. Furthermore, it is better than watermarking because it leaves the image unchanged and therefore there are no restrictions in finding a mapping, otherwise there is no possibility for using techniques of fingerprinting. This registration can also be used as an input for robots, which search the web for the protected image.
For the success of the described method, the quality of the pattern algorithm is decisive. Here we can fall back on a lot of different techniques, which are also used in the context of watermarking because the first step of both methods is the same. (Hartung & Kutter, 1999) give a summary of common pattern algorithms. These techniques make use of the spatial or a transform domain. Their robustness against attacks must be checked.
Recent research has shown that watermarking techniques which operate in the wavelet domain are more successful than those using the discrete cosine transformation (Wolfgang, Podilchuk, and Delp, 1998). In other works (Kim, Kwon, and Park, 1999; Kutter, Bhattacharjee, and Ebrahimi, 1999) the combination of wavelet transformation and Human Visual System is promising.
Today museums often can not avoid presenting digital copies of their collections using the internet or CDs/DVDs, because they have to attract potential visitors and to gain additional funding. In doing this the risk of unauthorized copying is not disputable and disturbing.
Unfortunately evaluations of available products and techniques show that there are no solutions available today that fit all requirements for increasing copyright protection. In our paper we used the example of pictures to prove this. We mentioned possible starting-points for solutions and showed essential evaluation criteria that allow us to find appropriate solutions without finishing up in an expensive blind alley. In particular restricting options to a certain method a priori (e.g. invisible, robust watermarks) without evaluating special needs and business models is not wise. Visible watermarks must be considered as a legitimate alternative since they can be used to identify a museum's ownership, also in form of a reference to a museum ('we have the source'), and to tell an end-user that he/she has only limited usage rights. Reversible Visible Watermarks (see section 4) can be used as a starting point ('teaser' or 'appetizer') for an authorized and copyrighted usage later on. Finally we must state that the search for adequate methods and solutions is still ongoing.
Anderson, R.J. & Petitcolas, F.A.P. (1999). Information Hiding - an annotated bibliography. last updated 13. August 1999. consulted February 1, 2000. http://www.cl.cam.ac.uk/~fapp2/steganography/bibliography/
Bearman, D., Trant, J. (1998). Authenticity of Digital Resources, Towards a Statement of Requirements in the Research Process. D-Lib Magazine, June 1998, ISSN 1082-9873
Cox, I. J., Kilian, J., Leighton, T., Shammon, T. (1996). A Secure, Robust Watermark for Multimedia. In R.J. Anderson (Ed.) Information Hiding: first international workshop, vol. 1174 of Lecture Notes in Computer Science, Isaac Newton Institute, Cambridge, England, May 1996. Springer Verlag, Berlin, Germany
Delaigle, Jean-Francois (1996). Common Functional Model. CEC: AC019-UCL-TEL-DR-P-D12-b1. Tracing Authors' Rights by Labelling Image Services and Monitaring Access (TALISMAN)
Dittmann, J., Steinmetz R., (1999). Digitale Wasserzeichen: Möglichkeiten und Grenzen der versteckten Wissenschaft zur Sicherung von Copyrights für digitales Bild- und Tonmaterial. In: Bundesamt für Sicherheit in der Informationstechnik: IT-Sicherheit ohne Grenzen? Tagungsband 6. Deutscher IT-Sicherheitskongress des BSI 1999, Ingelheim: SecuMedia Verlag 1999, S. 343-354, ISBN 3-922746-32-2
Franz, E. & Schönfeld, D. (1999). Geschäftsmodelle für Watermarking, DuD - Datenschutz und Datensicherheit 23 (1999) 12, 705-711
Gladney, H.M., Mintzer, F., and Schiattarella, F. (1997). Safeguarding Digital Library Contents and Users, Digital Images of Treasured Antiquities. D-Lib Magazine, July/ August 1997, ISSN 1082-9873 (see also: http://www.dlib.org/dlib/july97/vatican/07gladney.html)
Hartung, H. & Kutter, M. (1999). Multimedia watermarking techniques. Proceedings of the IEEE (USA), vol. 87 no. 7 pp. 1079-1107
Kim, Y., Kwon, O., and Park R. (1999). Wavelet based watermarking method for digital images using the human visual system, Electronics letters, 18th March 1999, Vol.35, No.6
Kutter, M. & Leprévost, F. (1999). Symbiose von Kryptographie und digitalen Wasserzeichen: Effizienter Schutz des Urheberrechts digitaler Medien. In Bundesamt für die Sicherheit in der Informationstechnik (Eds.) IT-Sicherheit ohne Grenzen?, Tagungsband 6. Deutscher IT-Sicherheitskongreß des BSI 1999 (pp. 479-484). Ingelheim: SecuMedia Verlag, Germany
Kutter, M., Bhattacharjee, S. K., Ebrahimi, T. (1999). Towards Second Generation Watermarking Schemes. Proceedings 6th International Conference on Image Processing (ICIP'99), volume 1, pp. 320-323
Kutter, M. & Petitcolas, F. (1999). A fair benchmark for image watermarking systems. Proceedings of SPIE: Security and Watermarking of Multimedia Contents, Volume 3657, pp. 226-239, San Jose, California, January, 1999.
Mintzer, F.C., Boyle, L.E., Cazes, A.N., Christian, B.S., Cox, S.C., Giordano, F.P., Gladney, H.M., Lee, J.C., Kelmanson, M.L., Lirani, A.C., Magerlein, K.A., Pavani, A.M.B., and Schiattarella, F. (1996). Toward on-line, worldwide access to Vatican Library materials. IBM Journal of Research & Development, Vol. 40, No. 2 - Services, Applications, and Solutions, © 1996 IBM.
Mintzer, F., Lotspiech, J., and Morimoto, N. (1997). Safeguarding Digital Library Contents and Users, Digital Watermarking. D-Lib Magazine, December 1997, ISSN 1082-9873
Fabien A. P. Petitcolas, Ross J. Anderson, Markus G. Kuhn. Attacks on copyright marking systems, in David Aucsmith (Ed), Information Hiding, Second International Workshop, IH'98, Portland, Oregon, U.S.A., April 15-17, 1998, Proceedings, LNCS 1525, Springer-Verlag, ISBN 3-540-65386-4, pp. 219-239
Petitcolas, F.A.P., Anderson, R.J., Kuhn, M.G. (1999). Information Hiding - A survey. Proceedings of the IEEE (USA), vol. 87 no. 7, pp. 1062-1078
Petitcolas, F.A.P. & Anderson, R.J. (1999). Evaluation of copyright marking systems. Proceedings of the IEEE Multimedia Systems í99, vol. 1, pp. 574-579
Petitcolas, F.A.P. (2000). Watermarking & Copy Protection - Companies. consulted February 13, 2000. http://www.cl.cam.ac.uk/~fapp2/steganography/products.html
Wolfgang, R., Podilchuk, C., and Delp E. (1998). The Effect of Matching Watermark and Compression Transforms in Compressed Color Images, Proceedings of the IEEE International Conference on Image Processing, Chicago, Illinois
ZDWEBOPEDIA: http://www.zdwebopedia.com/Multimedia/digital_watermark.html, 2000