A public fragile watermarking scheme for 3D model authentication

37 downloads 97983 Views 2MB Size Report
Keywords: 3D authentication; Digital signature; Fragile watermarking; Tamper detection. 1. ... Digital signatures are designed for the receiver of electronic ...... Apple. 891/1704. 343. Beethoven. 2655/5028. 1 022. Blade. 24 998/49 992. 10 320.
Computer-Aided Design 38 (2006) 1154–1165 www.elsevier.com/locate/cad

A public fragile watermarking scheme for 3D model authentication Chang-Min Chou a,b,∗ , Din-Chang Tseng a a Institute of Computer Science and Information Engineering, National Central University, No. 300, Jungda Road, Jhongli City, Taoyuan, 320, Taiwan b Department of Electronic Engineering, Ching Yun University, No. 229, Cheng-Shing Road, Jhongli City, Taoyuan, 320, Taiwan

Received 14 October 2005; accepted 29 June 2006

Abstract A public fragile watermarking scheme based on the sensitivity of vertex geometry is proposed for 3D model authentication. In the 3D fragile watermarking embedding, slightly perturbing the positions of a subset of vertices is usually needed to keep them in some predefined relationship with their neighboring vertices. Two problems frequently arise in the embedding stage: the causality problem and the convergence problem. The causality problem arises while the neighboring relationship of a former processed vertex is influenced by the perturbing of its latter processed neighboring vertices. The convergence problem means that the original model has been heavily distorted before some vertices reach the predefined relationship. In this paper, we propose a multi-function vertex embedding method and an adjusting-vertex method to overcome these two problems. The proposed method does not need the original model and watermarks for authentication; moreover, the key for extracting watermarks is relatively smaller than that of previous works. For some artistic or technical models, sometimes it is very important to control the distortion ratio caused by watermark embedding. Our method can control the average distortion by the keys used in watermark embedding. Experimental and analytic results on various kinds of 3D models show the effectiveness of the scheme. c 2006 Elsevier Ltd. All rights reserved.

Keywords: 3D authentication; Digital signature; Fragile watermarking; Tamper detection

1. Introduction With the explosive growth of the Internet and the development of digital content designing and processing techniques, many valuable materials can be represented in digital form for exhibition and access via the Internet. Due to the characteristic of easy duplication and modification of digital content, it is necessary to develop a variety of digital signature or watermarking techniques for various protection purposes such as model authentication and ownership claiming. Digital signatures are designed for the receiver of electronic documents to verify the identity of the sender and to check the originality of the documents. The watermarking schemes are usually designed for the sender to check the copyright ownership (robust watermarking) or for the receiver to verify the authentication of the received media (fragile watermarking). The main difference between digital signature ∗ Corresponding author at: Institute of Computer Science and Information Engineering, National Central University, No. 300, Junda Road, Jhongli City, Taoyuan, 320, Taiwan. Tel.: +886 3 4227151x35202; fax: +886 3 4222681. E-mail address: [email protected] (C.-M. Chou).

c 2006 Elsevier Ltd. All rights reserved. 0010-4485/$ - see front matter doi:10.1016/j.cad.2006.06.009

and watermarking techniques is that the former attaches a small piece of information (the digital signature) transmitted with the original documents whereas the latter embeds invisible information (the watermarks) in the original media. Encryption techniques can be symmetric or asymmetric [1]. Generally speaking, asymmetric methods have better security but are very computationally expensive when compared with symmetric methods. A compensation scheme is to encrypt the digital contents by a symmetric method and then encrypt the “symmetric key” by an asymmetric method. A typical digital signature scheme extracts a “message digest” from the original document and then encrypts the message digest by an asymmetric method. The message digest can represent the original document in such a way that two different message digests will be generated for two different documents even if they have only one bit of difference. The encrypted message digest is attached to the original document and transmitted to the receiver. Although all data types can be treated as binary data files and encrypted by digital signature schemes, directly applying digital signatures for large multimedia data sets is still costly and computationally expensive [1,2]. Instead of using digital signatures for all kinds of electronic documents,

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165 Table 1 A comparison of fragile watermarking and digital signature as applied to 3D models Functions

Digital signature

Fragile watermarking

Verify the identity of the sender Check the integrity of the documents Locate the changed regions Implementation cost Computation speed Application fields

Yes Yes

No Yes

No High Slow General

Yes Low Fast Particular

researchers develop various watermarking schemes for various multimedia data types such as video, audio, images, and 3D models. Watermarks can be invisibly/inaudibly embedded in these media by altering some of their lower significant bits. Watermarking schemes usually don’t need any complex computation (at most a FFT or wavelet transform [3] is used); thus they can be performed in a fast and low cost way compared with digital signature schemes. According to the application purpose, watermarking techniques can be classified into robust and fragile schemes. Robust watermarking is usually designed for ownership claiming while fragile watermarking is used for digital content authentication and verification. The design goal of robust watermarking is to make the embedded watermarks remain detectable after being attacked. In contrast, the requirements of fragile watermarking are to detect the slightest unauthorized modifications and locate the changed regions. According to the extraction strategies of watermarks, watermarking schemes can be classified into the private and the public approach. A private watermarking scheme needs the original model and watermark to extract the embedded watermarks while a public (or so-called blind) scheme can extract watermarks in the absence of the original model and watermark. On the other hand, a “semipublic” watermarking scheme does not need the original model in the watermark extraction stage, but the original watermark is necessary for comparing with the extracted watermark. The word “public” used in watermarking schemes is different from that represented in cryptography schemes. All fragile watermarking schemes are public, since it makes no sense to use a private fragile watermark. Possible applications of public fragile watermarking include demonstrating that digital material has not been changed (or has been changed) in an official situation (e.g., in a court) and to confirm the received digital material has not been changed at the receiver end. The functions of the 3D fragile watermarking scheme are similar to that of a digital signature. Both schemes can check the originality of the received 3D models. Digital signatures can verify the identity of the sender while the 3D fragile watermarking can locate the changed regions. Moreover, for 3D models, the 3D fragile watermarking is superior to the digital signature scheme in its easy implementation and faster computation. A comparison of these two schemes is summarized in Table 1. In 3D fragile watermark embedding, slightly perturbing the positions of a subset of vertices is usually needed to keep

1155

them in some predefined relationship with their neighboring vertices. Two problems frequently arise in the embedding stage: the causality problem and the convergence problem. The causality problem arises when the neighboring relationship of a former processed vertex is influenced by the perturbing of its later processed neighboring vertices. The convergence problem means that the original model has been heavily distorted before some vertices reach the predefined relationship. In this paper, we propose a multi-function vertex embedding method and an adjusting-vertex method to overcome these two problems. The proposed method does not need the original model and watermarks for authentication; moreover, the key for extracting watermarks is relatively smaller than that of previous works. For some artistic or technical models, sometimes it is very important to control the distortion ratio caused by watermark embedding. Our method can control the average distortion by the keys used in watermark embedding. The remaining sections of this paper are organized as follows. A brief review of the robust and fragile 3D watermarking schemes is given in Section 2, where the causality and convergence problems are also discussed. The proposed watermarking embedding scheme is described in Section 3; moreover, we illustrate how to examine the originality of the received 3D model and how to locate the changed regions by the proposed method. We discuss the control of the distortion caused by the watermark embedding in Section 4. In this section, a variant scheme which attaches a “watermark digest” with the original model instead of embedding watermarks in the original model is presented. Finally, experimental results and concluding summaries are provided in Section 5. 2. Previous work and problems Watermarking techniques for still images have been widely studied and investigated in recent years. On the other hand, watermarking for 3D models gets relatively less notice. Initially, Ohbuchi et al. [4–6] proposed a large variety of techniques for embedding data into 3D polygonal models. Benedens and Busch [7,8] embedded private watermarks by altering 3D object with a normal distribution. Their watermarking systems achieved robustness against randomization of vertices, mesh altering (re-meshing), and polygon simplification operations. Praun et al. [9] proposed a sophisticated robust mesh watermarking scheme. They first constructed a set of scalar basis functions over the mesh vertices using multi-resolution analysis [10] and then perturbed vertices along the direction of the surface normal weighted by the basis functions. Their watermarking scheme is resistant to common mesh attacks such as translation, rotation, scaling, cropping, smoothing, simplification, and re-sampling operations. These above researches concentrated on 3D robust watermarking techniques. Yeo and Yeung are the pioneers for discussing 3D fragile watermarking [11]. They computed two indices for every vertex: the location index and the value index. For each vertex v, the location index is calculated by a hash function according

1156

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

to the coordinates of it and its neighboring vertices, while the value index is calculated by another hash function based on its coordinates. Then they slightly perturbed every vertex to make these two indices equal. Unauthorized modifications will be detected in the watermark extraction phase by checking the difference between these two indices. The scheme is both public and fragile, but there are two disadvantages: (i) The causality problem: The location index of a former processed vertex will be changed by the perturbing of later processed neighboring vertices. As one example, illustrated in Fig. 1, suppose we process vertices in the order v0 , v1 , v2 , . . . , vn , we first process and perturb v0 to make its value index (calculated from its coordinates) being equal to its location index (calculated from the coordinates of it and its neighboring vertices). However, the location index of v0 will be changed when we process and perturb v1 to adjust its value index. The same situation occurred when the following vertices are processed. To avoid the causality problem, we need to perturb vertices in a predefined order (v0 , v1 , v2 , . . . , vn ) and constrain the calculation of the location index for each vertex only to involve the vertices that have been processed. For example, in Fig. 1, the calculation of the location index of v0 should only involve itself. The calculation of the location index of v1 should only involve v0 and v1 . The calculation of the location index of v2 can only involve v0 , v1 and v2 , and so on. This constraint can avoid the causality problem. A drawback of this constraint is that the capability for detecting modification will be ruined if the predefined traverse order has been changed or became untraceable. For example, a simple model simplification (vertex decimation) or vertex re-numbering operation may totally disable the capability of the scheme. (ii) The convergence problem: In the vertex perturbing stage, it requires perturbing the vertices of the whole model to make the value index and the location index of every vertex equal. In practice, some vertices may need to be perturbed more and more to satisfy the requirement as in the example illustrated in Fig. 2. In the figure, v0 has to be perturbed to a position that heavily distorts the original structure to make its two indices equal. It is possible that the requirement is met only when the model has been heavily distorted or the requirement can never be met. Another disadvantage coming from the convergence problem is that the user can not control the distortion induced by the perturbing process. Fornaro and Sanna [12] proposed a public key approach for authentication of Constructive Solid Geometry (CSG) models. They computed watermarks from a model followed by a watermark encryption operation and then attached the encrypted watermarks to the solids or comments of the CSG models. The advantage of the method is that no modification on the original 3D model is needed and this characteristic is sometimes very important to some “artistic” or “technical” models. The drawback of this scheme is that it can only tell if a model has been modified, but can not locate the modified regions. To locate modifications is an important issue in 3D fragile watermarking.

Fig. 1. An example of the causality problem.

Fig. 2. An example of the convergence problem.

Lin et al. [13] proposed a scheme similar to Yeo and Yeung’s method [11]. Their method eliminates the causality problem by applying two different hash functions on the vertex coordinates, without considering the neighboring vertices of a vertex. In the embedding stage, they slightly perturbed every vertex making these two hash function values equal; however, the convergence problem still occurs in this scheme. To avoid heavy distortion due to vertex perturbing, they set a threshold and simply skip the vertices that could not meet the requirement under the threshold. This causes some embedding “holes” which cause false-alarms in the watermark detection stage. Wu and Cheung [14] proposed a fragile watermarking scheme for authenticating 3D mesh models. The watermark embedded by the method is invariant to translation, rotation, and uniform scaling, but is sensitive to other operations. The main idea of the method is to keep the ratio between the distance from the mesh center to each surface face and a quantization step remaining the same after the model is translated, rotated, or uniformly scaled. There are two major drawbacks in this scheme. Firstly, it is a semi-public watermarking scheme since the original watermark is needed in the decoding stage to authenticate the watermarked model. In fragile watermarking, a pure public watermarking scheme is preferred since we don’t want to pay extra cost for encrypting the original watermark. Secondly, it fails in locating the changed regions since the center position of the mesh will be changed once any vertex has been changed. In our opinion, the ability of locating the changed region is important for fragile watermarking. However, their concept of invariant geometry transformation is worth further study since the transformation does not affect the integrity of the mesh. No other paper discussing the topic has been published as yet.

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

1157

Fig. 3. An overview of our watermark embedding and extraction schemes.

3. The proposed watermarking scheme In the proposed watermarking scheme, two major methods, the multi-function vertex embedding method and the adjustingvertex method, are proposed for 3D model authentication. An overview of our watermark embedding and extraction schemes is illustrated in Fig. 3. The multi-function vertex embedding method means that the three coordinates of a mark vertex are assigned and embedded with different functions of watermark in the watermark embedding stage. At first, we select a set of mark vertices from the original mesh model. The union of the selected vertices and their neighboring vertices should cover the whole model. Then we modulate the x1 coordinate of each vertex to indicate if it is a mark vertex. For mark vertices, we embed wi and h(wi ) into their x2 and x3 coordinates respectively. The embedding needs to ensure all mark vertices satisfy the relationship of h i = h(wi ) after watermark embedding, and this relationship will be used for the authentication check in the extraction stage. In the watermark extraction stage, we examine a mesh model by first checking the x1 coordinate of every vertex to see if it is a mark vertex. Then for each mark vertex, we extract the possible embedded information w 0 and h 0 from its x2 and x3 coordinates respectively and examine if it can satisfy the relationship h(w0 ) = h 0 . For any mark vertex that can not hold

this predefined relationship, we set it and all its neighboring vertices as suspicious vertices. 3.1. The watermark embedding scheme Given a mesh M(V, C), where V is the vertex set and C is the connectivity relationship on M, a watermark W = (w1 , w2 , . . . , wn ) is embedded by inducing each wi with a small displacement in a subset of V . A vertex v is noted as v(x1 , x2 , x3 ) or v 0 (x10 , x20 , x30 ) before or after embedding (or say marking), respectively. The approach for embedding wi in vertex v is as follows: (i) The three coordinates of vertex v(x1 , x2 , x3 ) are defined with different functions: x1 is used to indicate if v is a mark vertex (i.e., v is a watermark embedded vertex), x2 is used for embedding watermark wi , and x3 is used for embedding h(wi ), where h is a predefined hash function and is used for checking modification. (ii) For each vertex, its x1 value is divided by a factor k w to generate an integer. If v is a mark vertex, the integer must be odd; otherwise, x1 is changed to x1 + k w . If v is a non-mark vertex, the integer must be even; otherwise, x1 is changed to x1 + k w . That is, jx k 1 mod 2 (1) m= w k

1158

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

and x10 =

 x1 ,

if (m = 1 and v is a mark vertex) or (m = 0 and v is not a mark vertex). (2)  x1 + k w , otherwise.

(iii) For a mark vertex v, its barycenters of x2 and x3 coordinates, x2c and x3c , are calculated by averaging the coordinates of its neighboring vertices, 1 X x j , j = 2, 3, (3) x cj = |N (v)| N (v) where N (v) is the set of v’s neighboring vertices and |N (v)| is the size of N (v). In this paper, we use the “barycenters” of a vertex to represent the vertex features calculated by Eq. (3). (iv) For a mark vertex v, its x j coordinate is slightly moved toward x cj to the new locations x ej such that |x ej − x cj | are q divisible by k j , j = 2, 3, respectively, ( q x j − (|x j − x cj | mod k j ), if x j > x cj ; e xj = (4) q x j + (|x j − x cj | mod k j ), otherwise. q

(v) Finally, we employ k j and k dj to embed watermark wi and hash function value h i in x ej ,  e x + d j , if x j > x cj 0 x j = ej , j = 2, 3, (5) x j − d j , otherwise q

q

k k2 w , d3 = 3d h i , h i = k2d i k3 k3d , wi , h i , k2d , k3d ∈ N ,

where d2 =

h(wi ), 0 < wi < k2d ,

0 < hi < and h is a predefined hash function. The embedding perturbs x ej toward the original value x j with a small displacement d j which is q always less than k j , j = 2, 3. k w , k j , k dj , and h will serve as the keys in the watermark extraction stage. The causality problem and the convergence problem arise in the embedding stage when we embed watermarks through the whole model. It is obvious that the barycenters (x2 and x3 coordinates) of a former processed vertex will be changed when any of its neighboring vertices was selected to be a mark vertex too and need to be perturbed. We propose an “adjusting vertex” method to overcome the causality problem. The function of the adjusting vertex is to keep the barycenters of the mark vertex unchanged. For each chosen mark vertex, we randomly assign an adjusting vertex from its neighboring vertices. In other words, a vertex is qualified to be a mark vertex as long as it can find an adjusting vertex among its neighboring vertices. Any mark vertex can’t be taken as an adjusting vertex and vice versa. To avoid the causality problem, the neighboring vertices of the previously selected mark vertices can’t be taken as adjusting vertices for later mark vertices. This constraint eliminates the causality problem but may leave a few isolated vertices, which is a vertex wholly surrounded by adjusting vertices. The isolated vertices will be treated as mark vertices and be perturbed after all adjusting vertices having been modulated. Most 3D fragile watermarking embedding schemes perturb the positions of a subset of vertices to keep q

them in some predefined relationship with their neighboring vertices. The convergence problem arises when the original model has been heavily distorted before some vertices reach the predefined relationship. The use of the “adjusting vertex” method guarantees that there is no endless perturbing while embedding watermarks; thus there is no convergence problem in the proposed method. The detailed watermark embedding procedure is given in Algorithm 1. Algorithm 1 (The Watermark Embedding Algorithm). for each vertex vi in the mesh model { vi .mark = False vi .mark eligible = True vi .adjusting eligible = True } set v1 as the active vertex, vact while (vact ! = NULL) { if vact is a mark eligible vertex and there is at least one eligible adjusting vertex among vact ’s neighboring vertices then { randomly select one eligible adjusting vertex v j from vact ’s neighboring vertices as its adjusting vertex vact .mark = True vact .mark eligible = False vact .adjusting eligible = False v j .mark eligible = False for each vact ’s neighboring vertex vi vi .adjusting eligible = False calculate the x2 and x3 coordinate barycenters of vact using Eq. (3) embed watermarks to vact ’s x2 and x3 coordinates using Eqs. (4) and (5) } elseif vact is surrounded by all adjusting vertices then { set vact as an isolated vertex vact .mark = True } set the next vertex as the active vertex, vact (Traverse the whole model) } set v1 as the active vertex, vact while (vact ! = NULL) { modulate vact ’s x1 coordinate according to its mark flag using Eqs. (1) and (2) if vact is a mark vertex then make compensation perturbation on vact ’s adjusting vertex using Eq. (6) set the next vertex as the active vertex, vact (Traverse the whole model) } for each isolated vertex vi in the mesh model { calculate the x2 and x3 coordinate barycenters of vi using Eq. (3) embed watermarks to vi ’s x2 and x3 coordinates using Eqs. (4) and (5) }

1159

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Three flags are used in the algorithm to indicate the state of each vertex in the mesh model: the “mark” flag indicates if a vertex is a mark vertex or a non-mark vertex, the “mark eligible” flag indicates if a vertex is eligible to be a mark vertex, and the “adjusting eligible” flag indicates if a vertex is eligible to be an adjusting vertex. Initially, all vertices are set to be non-mark, mark eligible, and adjusting eligible vertices. Then we set v1 as the active vertex and traverse the whole model starting from v1 to select a set of mark vertices. Any traversal algorithm works fine in this scheme as long as it can visit every vertex exactly once. In our experiments, a simple breadth-first search (BFS) algorithm is used for the mesh vertex traversal. A vertex is set to be a mark vertex if it is a mark eligible vertex and there is at least one eligible adjusting vertex among its neighboring vertices. We randomly select one eligible adjusting vertex from its neighboring vertices as its adjusting vertex and then modify the related flags: set the active vertex as a mark, non-mark eligible, and non-adjusting eligible vertex. The selected adjusting vertex is set as a non-mark eligible vertex, and all active vertex’s neighboring vertices are set as non-adjusting eligible vertices. For each selected mark vertex, the barycenters of their x2 and x3 coordinates are calculated using Eq. (3). Then we slightly perturb their x2 and x3 coordinates to embed watermarks by using Eqs. (4) and (5). A vertex that is surrounded by all adjusting vertices (i.e., an isolated vertex) is set to be a mark vertex. An isolated vertex’s mark eligible and adjusting eligible flags are not modified since these two flags won’t be checked anymore if a vertex is surrounded by all adjusting vertices. Without adjusting vertices, the isolated vertices are watermarked after all their neighboring adjusting vertices have been perturbed to prevent their barycenters from being changed. Therefore, the isolated vertices are not watermarked at this stage. The selection of mark vertices will keep going till the end of mesh traversal. After the mark vertices have been selected, we traverse the mesh model again with the same order as the selection of the mark vertices. During this iteration, we first modulate the x1 coordinate of each vertex according to its mark flag using Eqs. (1) and (2). The x1 coordinate will be used to indicate if a vertex is a mark vertex in the watermark extraction stage. Then we make compensation perturbations on adjusting vertices, X a x a0 (x 0j − x j ), j = 2, 3, (6) j = xj − N (mv)

where x2a and x3a are the second and third coordinates of the adjusting vertex for a mark vertex v; N (mv) is the set of all v’s neighboring mark vertices and adjusting vertices of previous mark vertices. Lastly, we embed watermarks into all isolated vertices using the same technique as we applied for other mark vertices. The union of all mark vertices and their neighboring vertices cover the whole model; thus we can detect any change on the model. A brief proof of the coverage completeness is given below. Proof of coverage completeness: The union of all mark vertices and their neighboring vertices cover the whole model. Proof. Assume there is a non-mark vertex vi which is not covered by any mark vertex; that is, it is surrounded by

adjusting vertices and other non-mark vertices. If vi is surrounded by all adjusting vertices, it is an isolated vertex and will be set as a mark vertex; otherwise, vi can pick a non-mark vertex from its neighboring vertices to be its adjusting vertex, and it will be set as a mark vertex. In both cases, vi can be set as a mark vertex; thus, there is no such non-covered vertex vi . 3.2. The watermark extraction scheme and tamper detection In the watermark extraction stage, k w , k j , k dj , and h serve as the keys for malicious change detection. The detailed watermark extraction procedure is given in Algorithm 2. q

Algorithm 2 (The Watermark Extraction Algorithm). set all vertices in the mesh model as non-suspicious vertices set v1 as the active vertex, vact while (vact ! = NULL) { Check vact ’s x1 coordinate to see if it is a mark vertex if vact is a mark vertex then { calculate the x2 and x3 coordinate barycenters of vact using Eq. (3) extract w 0 and h 0 from vact ’s x2 and x3 coordinates using Eq. (7) if h(w 0 )! = h 0 then set vact and all its neighboring vertices as suspicious vertices } set the next vertex as the active vertex, vact (Traverse the whole model) } Initially, all vertices of the mesh model are set to be nonsuspicious vertices. Then we set v1 as an active vertex and traverse the whole model starting from v1 to examine the model. We check if a vertex is a mark vertex by applying its x1 coordinate and k w to Eq. (1). For each mark vertex, we first calculate its x2 and x3 barycenters using Eq. (3), and then apply q its x2 and x3 coordinates, the barycenters, and k j , k dj to extract the watermarks using the following equations,  d q k2  0 c 0  w = (|x − x | mod k )  q 2 2 2  k2 (7)  kd   h 0 = (|x3c − x30 | mod k3q ) 3q . k3 Vertices that have not been changed will satisfy the relationship, h(w0 ) = h 0 . On the other hand, a vertex that does not satisfy the above relationship indicates that at least one of its neighboring vertices or the vertex itself (or both) has been changed. Thus, for any mark vertex that can not satisfy this relationship, we’ll set it and all its neighboring vertices as suspicious vertices. There is no way for a forger to modify a model and keeping the relationship unchanged without the keys. Fig. 4 shows how our scheme detects modifications and locates the suspicious modified regions. In Fig. 4(a), v is a vertex that has been changed, and wi , i = 0–5, are

1160

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Fig. 4. A mesh with one vertex changed. (a) v is a vertex that has been changed and wi , i = 0–5, are mark vertices. (b) Two mark vertices, w1 and w4 , have detected the change. (c) These two mark vertices and their neighboring vertices are set to be suspicious vertices (linked by dashed lines). (d) Parts of suspicious vertices are released by the undetected mark vertices (changed from gray to non-gray nodes). In this figure, black nodes denote the mark vertices, white nodes denote the non-mark vertices, and gray nodes denote the suspicious vertices.

mark vertices. In Fig. 4(b), two mark vertices, w1 and w4 , have detected the change, whereas other four mark vertices don’t. Fig. 4(c) shows that these two mark vertices and their neighboring vertices are set to be suspicious vertices (linked by dashed lines, shown as gray nodes). Then parts of suspicious vertices are released by the undetected mark vertices (changed from gray to non-gray nodes), as shown in Fig. 4(d). Lastly, we can induce the possible modified vertices: v and/or w1 . 4. Distortion control In 3D models, the distance between two surfaces X and Y can be defined as an L 2 measurement [15], s Z 1 d(x, Y )2 dx, (8) d(X, Y ) = area(X ) x∈X where d(x, Y ) is the Euclidean distance from a point x on X to the closest point on Y . We modify the definition of the L 2 measurement to d(M, M 0 ) for representing the average distortion of all vertices in a model: |M|

d(M, M 0 ) =

1 X |vi − vi0 |, |M| i=1

(9)

where M and M 0 are the original and marked models, respectively. In our scheme, the distortion induced by

Fig. 5. The distortion control analysis. (a) The chart of k q versus the average model distortion with various k w s. (b) The chart of k w versus the average model distortion with various k q s.

watermark embedding depends on the x1 , x2 , and x3 q q quantization steps: k w , k2 , and k3 . Key value k w controls q the quantization step of x1 coordinate and key values k2 and q k3 control the quantization steps of x2 and x3 coordinates, respectively. The setting of these three key values depends on the desired average distortion. Fig. 5 shows how the average distortion d(M, M 0 ) is relative to these three parameters in the Venus model. Fig. 5(a) is the chart of k q versus the average model distortion with various k w s; Fig. 5(b) is the chart of k w versus the average model distortion with various k q s. For the q q simplicity of discussion, we set k2 = k3 = k q for both charts in Fig. 5. From these two charts, we can see that the less k w and k q are, the less the distortion is. Thus the average distortion caused by the watermark embedding process can be controlled by setting appropriate k w and k q s. For example, suppose we want to control the average distortion under 10−3 , we may reasonably set the key values of k w to be 10−3 and both k q s to be 10−3.5 by observing the curves in Fig. 5(a) and (b).

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

1161

Fig. 6. The steps of the “watermark digest” method.

For some artistic or technical models, it is sometimes very important not to make any modification on the original mesh models. We propose a variant scheme to satisfy this requirement. In the variant scheme, a watermark digest (WD) is calculated from the original model and then attached to the original model for transmission. The WD consists of two parts of information: w m and w p . The w m part records the indices of the mark vertices while the w p part records the required perturbing displacements of all mark vertices. The receiver can perturb the received model according to the WD record and then check the originality of the received model by the method described in Section 3. This scheme is simple and the original model need not be modified. To ensure security, the WD needs to be encrypted. In other words, the WD plays the same role as the “message digest” in the digital signature scheme. Users can treat this method as a simple scheme for extracting message digests from 3D models. Fig. 6 illustrates the idea of this alternative method. 5. Experimental results and conclusions We evaluated the proposed watermarking scheme on a set of 3D models with various unauthorized attacks. Table 2 lists the models used in our experiments. In these models, about 38%–45% of vertices were chosen to be mark vertices. The key values have to be carefully chosen since they directly influence the average distortion of the marked models. The settings of k2d and k3d depend on the range of embedded integer watermarks, wi , and the hash function of wi , h(wi ), respectively. According to Eq. (5), k2d has to be set greater than all wi and k3d has to be set greater than all h(wi ). For example, if the selected set of integer watermarks is in the range [0, n] and the hash function of this watermark set is in the range [0, m], we may set k2d = n + 1 and k3d = m + 1. The setting of key values k w and k q s depends on the desired average distortion. Key values k w and k q s directly

Fig. 7. One example of 3D fragile watermarking. (a) The original Venus model. (b) The marked Venus model. (c) The marked Venus model changed by various attacks simultaneously, where ‘A’ denotes the region of invisible noise added, ‘B’ denotes the region of an extra vertex added, and ‘C’ denotes the region of some vertices deleted. (d) The detection results: the marked areas represent the suspicious regions.

relate to the quantization steps of x2 and x3 coordinates, thus the smaller the key values are, the smaller the average distortion is. Key values k d s, which relate to the watermarks embedded within each quantization step of x2 and x3 coordinates, have no certain relationship to the average distortion. Table 3 lists several experimental results of various models to illustrate the

1162

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Table 2 The list of models used in our experiments Model name

Number of vertices/faces

Apple

891/1704

343

Beethoven

2655/5028

1 022

Blade

24 998/49 992

10 320

Dinosaur

14 070/28 136

6 213

Horse

48 485/96 966

20 241

Pulley

25 482/50 964

10 402

Rocker-arm

10 044/20 088

4 142

Triceratops

2832/5660

1 132

Venus

8268/16 532

3 175

relationship between the setting of key values and the average distortion. The precision level is 10−4 for the original Venus model, and is 10−6 for all other original models in Table 3. As shown in Table 3, smaller key values will produce smaller average distortion, but will increase the precision requirement of the marked model. Extra precision requirement will cause a size overload of the marked model. Users should determine the trade-off between a small average distortion and a small-sized overload. Fig. 7 illustrates how a Venus model is watermarked and the detected changes by our scheme. Fig. 7(a) shows the original Venus model. The Venus model has 8268 vertices and 16 532 faces; 3175 vertices were chosen to embed watermarks.

Number of mark vertices

Model

Fig. 7(b) shows the same view of the marked model. These two models are visually identical. Fig. 7(c) shows a marked Venus model that has been illegally changed by various operations: noising, vertex adding, and vertex deleting simultaneously. The regions labeled ‘A’, ‘B’, and ‘C’ denote the regions of invisible noise added, an extra vertex added, and some vertices deleted, respectively. The proposed scheme locates these changed regions by setting all regions that can not hold the predefined neighborhood relationship as suspicious regions. Fig. 7(d) shows the detected suspicious regions with marks. In this experiment, we tried to control the average distortion within 10−4 . By observing the charts of Fig. 5, we set k w = 10−4

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

1163

Table 3 The average distortion of various models with different settings of key values kw

k2

k3

k2d

k3d

Hash function

Average distortion/Precision requirement of marked model

Blade/10−6

0.01 0.001 0.01 0.001 0.0001 0.001 0.0001 0.0001 0.0001 0.0001 0.00001

0.01 0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001 0.00001

0.01 0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001 0.00001

250 250 250 250 250 250 250 250 500 500 250

250 250 250 250 250 250 250 500 250 500 250

h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = 2wi h(wi ) = 0.5wi h(wi ) = wi h(wi ) = wi

0.019382/10−5 0.018326/10−6 0.003973/10−6 0.002088/10−6 0.001982/10−7 0.000383/10−7 0.000192/10−7 0.000193/10−7 0.000215/10−7 0.000213/10−7 0.000019/10−8

Pulley/10−6

0.01 0.001 0.01 0.001 0.0001 0.001 0.0001 0.0001 0.0001 0.0001 0.00001

0.01 0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001 0.00001

0.01 0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001 0.00001

250 250 250 250 250 250 250 250 500 500 250

250 250 250 250 250 250 250 500 250 500 250

h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = 2wi h(wi ) = 0.5wi h(wi ) = wi h(wi ) = wi

0.013444/10−5 0.012352/10−6 0.003285/10−6 0.001330/10−6 0.001222/10−7 0.000332/10−7 0.000136/10−7 0.000146/10−7 0.000146/10−7 0.000155/10−7 0.000014/10−8

Rocker-arm/10−6

0.01 0.001 0.01 0.001 0.0001 0.001 0.0001 0.0001 0.0001 0.0001 0.00001

0.01 0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001 0.00001

0.01 0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001 0.00001

250 250 250 250 250 250 250 250 500 500 250

250 250 250 250 250 250 250 500 250 500 250

h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = 2wi h(wi ) = 0.5wi h(wi ) = wi h(wi ) = wi

0.014812/10−5 0.013800/10−6 0.003286/10−6 0.001266/10−6 0.001153/10−7 0.000323/10−7 0.000121/10−7 0.000130/10−7 0.000134/10−7 0.000143/10−7 0.000013/10−8

Venus/10−4

0.01 0.01 0.001 0.0001 0.001 0.0001 0.0001 0.0001 0.0001

0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001

0.01 0.001 0.001 0.001 0.0001 0.0001 0.0001 0.0001 0.0001

250 250 250 250 250 250 250 500 500

250 250 250 250 250 250 500 250 500

h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = wi h(wi ) = 2wi h(wi ) = 0.5wi h(wi ) = wi

0.013823/10−5 0.003250/10−6 0.001343/10−6 0.001222/10−7 0.000326/10−7 0.000125/10−7 0.000134/10−7 0.000132/10−7 0.000141/10−7

Model/Precision level of original model

q

q

q

and k j = 10−5 , j = 2, 3, to achieve the requirement. As a result, the average distortion of the marked Venus model was 10−4.5 . The value of k dj was set to 256; thus all watermarks were integers randomly generated in the range [0, 255]. A simple hash function h(x) = x was used for the change detection. For engineering/technical models with flat surfaces, distortion control of the watermark effect on the flat surfaces is the most important issue. Our scheme can control the watermark effect with proper key value setting. Fig. 8 shows the marked results of three engineering models with different key value setq q tings. We set k2 = k3 = k q for all models in Fig. 8. Fig. 8(a) and (b) show that the surfaces of marked models Blade and

Pulley keep flat while the average distortion is around 10−3 , and become rugged while the average distortion is around 10−2 . Fig. 8(c) shows that the surface of the marked model Rockerarm stays flat when the average distortion is around 10−4 , and becomes rugged when the average distortion is around 10−3 . The precision levels of these three original models are all 10−6 . According to Table 3, if we want to keep these marked surfaces flat, the precision level requirements of marked models Blade, Pulley and Rocker-arm are 10−6 , 10−6 and 10−7 , respectively. Users can set the key values according to their requirements of precision level and visual effect of marked models. However, for conservative users who do not want to make any change on

1164

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Fig. 8. The marked results of three engineering models with different key value settings in front and back views. (a) The Blade model with various levels of distortion. (b) The Pulley model with various-level distortions. (c) The Rocker-arm model with various-level distortions.

the original models, we recommend they choose the alternative watermark digest method instead of the direct watermark embedding scheme. Our scheme is superior in that the average distortion of the marked models is under control by the user while the other schemes may suffer from the distortion problem due to the convergence problem. In addition, a relatively small key is needed for watermark extraction in our watermarking scheme. In Yeo and Yeung’s work [11], three lookup tables each with 256 binary entries (256×3 = 768 bits) and two predefined hash functions are needed to extract watermarks while the proposed q q scheme needs only three floating-point numbers (k2 , k3 , and d d w k ), two integers (k2 and k3 ) and a predefined hash function for watermark extraction (32 × 3 + 16 × 2 = 128 bits). In both schemes, the key size is independent of the size of the 3D mesh model. Moreover, our scheme can detect the changed regions and give a reasonable guess of unauthorized modifications. We think the ability of locating unauthorized modifications is an important issue in 3D fragile watermarking. Fig. 9 shows an example of how our watermarking scheme detects unauthorized modification and gives a reasonable guess

to the kind of change that has been added on the marked model. Fig. 9(a) shows a marked Dinosaur model. The Dinosaur model has 14 070 vertices and 28 136 faces. 6213 vertices were chosen to embed watermarks. Fig. 9(b) shows a marked Dinosaur model changed by cutting the end of its tail. Fig. 9(c) shows the cutting plane and vertices on the cutting plane. The mark vertices (black nodes) detected a modification since their neighboring relations were changed. Fig. 9(d) shows these detected mark vertices setting themselves and their neighboring vertices as suspicious vertices (turn to gray nodes). As a result, these detected suspicious vertices roughly form a circle. Two possible attacks are most likely to produce this situation: cropping and vertex decimation. Thus, we may reasonably suspect that a part of the Dinosaur model has been cut from this circle (the cutting plane) or a part of vertices around this circle has been decimated. The main contributions of the proposed scheme are summarized as follows: (i) The causality problem has been overcome using the adjusting vertex method so that the traverse order is not needed in the watermark extraction stage. (ii) The adjusting vertex method eliminates the possible problem

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

1165

Acknowledgements The authors thank the anonymous reviewers for their valuable comments and suggestions which improved the readability and quality of this paper. The Blade model was provided courtesy of IMATI-GE/CNR by the AIM@SHAPE Shape Repository. The Pulley model was provided courtesy of INRIA by the AIM@SHAPE Shape Repository. References

Fig. 9. An example of detecting modification. (a) The marked Dinosaur model. (b) The marked Dinosaur model changed by cutting the end of its tail. (c) The cutting plane. (d) The circle formed by the suspicious vertices. In this figure, black nodes denote the mark vertices and white nodes denote the non-mark vertices.

of endless perturbing on mark vertices. This concept can effectively limit the distortion ratio caused by watermark embedding. (iii) Different functions are defined for the three coordinates of vertices so that multiple meaningful information can be embedded in one vertex. This characteristic is helpful for other 3D applications such as robust watermarking and data hiding. (iv) The average distortion of the marked models is under user control with proper key value setting. (v) The proposed scheme can detect and locate all unauthorized modifications even if various multiple illegal changes are made on a model simultaneously. (vi) The proposed scheme is public and a relative small key is needed for the watermark extraction. (vii) A variant scheme which attaches a “watermark digest” with the original model instead of embedding watermarks in the original model is proposed. It can be treated as a simple and easy implementation version of the digital signature scheme in extracting a “message digest” from 3D models.

[1] Schneier B. Applied cryptography: Protocols, algorithms, and source code in C. 2nd ed. New York: Wiley; 1996. [2] Xie L, Arce GR. A class of authentication digital watermarks for secure multimedia communication. IEEE Trans Image Process 2001;10(11): 1754–64. [3] Barni M, Bartolini F, Piva A. Improved wavelet-based watermarking through pixel-wise masking. IEEE Trans Image Process 2001;10(5): 783–91. [4] Ohbuchi R, Mukaiyama A, Takahashi S. A frequency-domain approach to watermarking 3D shapes. Comput Graph Forum 2002;21(3):373–82. [5] Ohbuchi R, Masuda H, Aono M. Watermarking three-dimensional polygonal models through geometric and topological modifications. IEEE J Sel Areas Commun 1998;16:551–60. [6] Ohbuchi R, Takahashi S, Miyazawa T, Mukaiyama A. Watermarking 3D polygonal meshes in the mesh spectral domain. In: Proc of the graphics interface. 2001. [7] Benedens O. Geometry-based watermarking of 3-D models. IEEE Comput Graph Appl 1999;19:46–55. [8] Benedens O, Busch C. Towards blind detection of robust watermarks in polygonal models. Comput Graph Forum 2000;19:C199–208. [9] Praun E, Hoppe H, Finkelstein A. Robust mesh watermarking. In: ACM siggraph proc. 1999. [10] Hoppe H. Progressive meshes. In: ACM siggraph proc. 1996. [11] Yeo BL, Yeung MM. Watermarking 3D objects for verification. IEEE Comput Graph Appl 1999;19:36–45. [12] Fornaro C, Sanna A. Public key watermarking for authentication of CSG models. Comput Aided Des 2000;32:727–35. [13] Lin HY, Liao HY, Lu CS, Lin JC. Fragile watermarking for authenticating 3-D polygonal meshes. IEEE Trans Multimedia 2005;7(6):997–1006. [14] Wu HT, Cheung YM. A fragile watermarking scheme for 3D meshes. In: Proc the 7th workshop on multimedia and security. 2005. [15] Khodakovsky A, Schr¨oder P, Sweldens W. Progressive geometry compression. In: ACM siggraph proc. 2000.