Table Of ContentDynamic Tardos Traitor Tracing Schemes
ThijsLaarhoven Jeroen Doumen† PeterRoelse† Boris Sˇkoric´ Benne deWeger
∗ ∗ ∗
November16,2011
Abstract
tracing schemes. The number of watermark symbols needed in
1
our schemes is a significant improvementcompared to [9], and
1
0 We constructbinarydynamic traitor tracing schemes, where the ourschemescanbeeasilyadjustedwhenthemodelisslightlydif-
2 number of watermark bits needed to trace and disconnect any ferentfromthestandarddynamictraitortracingmodeldescribed
coalition of pirates is quadratic in the number of pirates, and in[1,4,9].
v
logarithmic in the total number of users and the error probabil-
o
N ity. Our resultsimproveuponresultsof Tassa, and ourschemes 1.1 Model
haveseveralotheradvantages,suchasbeingabletogenerateall
5 codewordsinadvance,asimpleaccusationmethod,andflexibility Let us first formally describe the mathematical model for the
1
whenthefeedbackfromthepiratenetworkisdelayed. problemdiscussedinthispaper. First,someentitycalledthedis-
tributor controls the database of watermarks and distributes the
]
R content. The recipients, each receiving a watermarked copy of
1 Introduction
C thecontent,arereferredtoasusers. WewriteU = 1,...,n for
{ }
. the set of all users, and we commonly use the symbol j for in-
s
c To protect digital content from unauthorized redistribution, dis- dexingtheseusers. Forthewatermarks,werefertothesequence
[ tributors embed watermarks in the content such that, if a cus- of watermarking symbols assigned to a user j by the vector~X ,
j
1 tomer distributes his copy of the content, the distributor can see which is also called a codeword. We write ℓ for the total num-
v this copy, extract the watermark and see which user it belongs berofwatermarksymbolsinacodeword,sothateachcodeword
7 to. By embedding a unique watermark for each different user, ~X haslengthℓ,andwecommonlyusethesymbolitoindexthe
j
9 thedistributorcanalwaysdeterminefromthedetectedwatermark watermarkpositions. In this paper we only focuson watermark
5 which of the customers is guilty. However, several users could symbolsfromabinaryalphabet,sothat(~X ) 0,1 foralli,j.
3 cooperateto forma coalition, and comparetheir differentlywa- Thetraitortracingcode,consistingofallwjatie∈rm{ark}symbolsfor
.
1 termarked copies to look for the watermark. Assuming that the eachuser,isdenotedbyX = ~X ,...,~X .Amorecommonway
1 originaldataisthesameforallusers,thedifferencestheydetect torepresentthiscodeisbypu{ttin1gallcond}ewords~X asrowsina
1 j
1 are differencesin their watermarks. The colluderscan then dis- matrixX,sothatXj,i=(~Xj)iisthesymbolonpositioniofuser j.
: tortthiswatermark,anddistributeacopywhichmatchesalltheir After assigning a codeword to each user, the codewords are
v
copies on the positions where they detected no differences, and
i embedded in the data as watermarks. The watermarked copies
X hassomepossiblynon-deterministicoutputonthesedetectedwa- aresenttotheusers,andsomeoftheusers(referredtoasthepi-
r termarkpositions.Sincethewatermarkdoesnotmatchanyuser’s rates) collude to create a pirate copy. The pirates form a subset
a
watermarkexactly,findingtheguiltyusersisnon-trivial.
C U,andweusec= C forthenumberofpiratesinthecoali-
In this paper we focus on the problem of constructing effi- tio⊆n. Thepiratecopyha|s|somedistortedwatermark,denotedby
cient collusion-resistant schemes for tracing pirates, which in- ~y. We assume thatif on some positioniall piratessee the same
volvesfindingawaytochoosewatermarksymbolsforeachuser symbol, they output this symbol. This assumption is known in
(thetraitortracingcode)andawaytotraceadetectedcopyback the literatureas the markingassumption. On other positionswe
to the guilty users (an accusation algorithm). In particular, we assumepiratessimplychooseoneofthe two symbolsto output.
will focuson the application of such schemes in a dynamic set- This choice of pirate symbols can be formalized by denoting a
ting, where the pirate outputis detected in real-time, before the piratestrategybyafunctionr , whichmapsa codematrixX (or
nextwatermark symbols are embeddedin consecutive segments the part of the matrix visible to them) to a forgery~y. After the
of the content. We will show that by building upon the Tardos coalition generates a pirate copy, we assume the distributor de-
scheme[8],wecanconstructefficientandflexibledynamictraitor tectsitandusessomeaccusationalgorithms tomaptheforgery
~ytosomesubsets (~y)=Cˆ U ofaccusedusers. Theseusersare
∗T.Laarhoven,B.Sˇkoric´,andB.deWegerarewiththeDepartmentofMath- thendisconnectedfromthe⊆system. IdeallyCˆ =C, butthismay
ematics andComputerScience, EindhovenUniversity ofTechnology, 5612AZ
Eindhoven,TheNetherlands. notalwaysbeachievable.
E-mail:{t.m.m.laarhoven,b.skoric,b.m.m.d.weger}@tue.nl.
†J. Doumen and P. Roelse are with Irdeto BV, 5656 AE Eindhoven, The
Staticschemes. Wedistinguishbetweentwotypesofschemes.
Netherlands.
E-mail:{jdoumen,peter.roelse}@irdeto.com. In static schemes, the process ends after one run of the above
1
algorithmwithafixedcodelengthℓ,andthesetCˆ isthefinalset mostcandforallpiratestrategiesr ,theprobabilityofnotcatch-
ofaccusedusers. Sothecompletecodewordsaredistributed,the ingallpiratesisboundedfromaboveas
pirates generate and distribute a pirate copy, and the distributor
detectsthisoutputandcalculatesthesetofaccusedusers. Inthis P(C Cˆ) e2.
6⊆ ≤
caseanelementaryresultisthatonecanneverhaveanycertainty
In the following sections we will omit the c in the complete-
of catching all pirates. After all, the coalition could decide to
sacrificeoneofitsmembers,sothat~y=~X forsome j C. Then nesspropertyif the parameteris implicit. Similarly, when e1 or
j ∈ e isimplicit,we sometimesalsosimplycallaschemesoundor
it is impossible to distinguishbetween otherpirates j C j 2
′
∈ \{ } complete. As we will see later, in the schemesdiscussed in this
andinnocentusers j U C. However,static schemesdoexist
′ ∈ \ paper, e /n and e are closely related. We will use the notation
thatachievecatchingatleastoneguiltyuserandnotaccusingany 1 2
h =ln(e )/ln(e /n)to denotethe logratioof these errorproba-
innocentuserswithhighprobability.TheoriginalTardosscheme 2 1
bilities. Inmostpracticalscenarioswehavee /n<e ,sousually
[8]belongstothisclassofschemes. 1 2
h (0,1).
∈
Dynamicschemes. Theothertypeofschemeistheclassofdy-
namicschemes,wheretheprocessofsendingoutsymbols,detect- 1.2 Relatedwork
ingpirateoutputandrunninganaccusationalgorithmisrepeated
Theschemesin thispaperallbuild uponthe Tardosscheme, in-
multipletimes. Inthiscase,ifauseriscaught,heisimmediately
troducedin[8]. Thisisanefficientstatic traitortracingscheme,
cut off from the system and can no longer access the content.
and it was the first scheme to achieve e -soundness and (e ,c)-
1 2
These dynamic scenarios for example apply to live broadcasts,
completeness with a codelength of ℓ = O(c2ln(n/e )). In the
1
suchaspay-tv. Thedistributorbroadcaststhe content,whilethe
same paper it was also proved that this asymptotic behaviour
piratesdirectlyoutputapiratecopyofthecontent.Thedistributor
is optimal. The original Tardos scheme had a codelength of
then listens in on this pirate broadcast, extracts the watermarks,
ℓ = 100c2ln(n/e ), and several improvements for the Tardos
1
and uses this information for the choice of watermarks for the
scheme have been suggested to reduce the constant before the
nextsegmentof the content. We assume that the pirates always
c2ln(n/e ). We mention two in particular: the improved anal-
try to keep their broadcastrunning, so we assume that if one of 1
ysisdonein[2];andtheintroductionofasymmetricscorefunc-
thepiratesisdisconnected,theotherpirateswilltakeover.Ideally
tion in [7]. Combining these improvements led to even shorter
onedemandsthatthesetofaccusedusersalwaysmatchestheex-
codelength constants in [6]. For c 2 and h 1 the construc-
actcoalition,i.e.Cˆ =C, andwithdynamicschemeswecanalso tionin [6] givescodelengthsof ℓ<≥24c2ln(n/e≤), with thecon-
1
achievethiswithhighprobability,aswewillsee later. Thenew
stantfurtherdecreasingascincreasesorh decreases.Forasymp-
schemeswepresentinthispaperbelongtothisclassofschemes.
toticallylargec, the constructionfrom[6] givesa codelengthof
Asmentionedearlier,wecallstaticschemessuccessfulifwith
ℓ=[p 2+O(c 1/3)]c2ln(n/e ).Theschemefrom[6]anditsprop-
high probability, at least one guilty user is caught, and no inno- 2 − 1
ertiesarediscussedinSection2.
cent users are accused. With dynamic schemes one can catch
For the dynamic setting, we mention three papers. In [4] a
allpirates, so we onlycallsuch schemessuccessfulif with high
scheme with no probabilityof errorwas introduced, which uses
probability, all pirates are caught and no innocent users are ac-
a large alphabet size. The number of symbols needed to catch
cused. This leads to the following definitions of soundness and
pirates in that scheme is ℓ=O(clog (n)), but the alphabet size
static/dynamiccompleteness. 2
neededisq=2c+1. In[1]severalschemesweresuggestedus-
Definition 1 (Soundness and completeness). Let (X,s ) be a ing a smaller alphabetof size q=c+1, with codelengthsrang-
traitor tracing scheme, let c 2 and let e ,e (0,1). Then a ing fromO(c3log (n)) to O(c2+clog (n)). In [9] the dynamic
schemehasthesoundnesspro≥pertywithpar1am2et∈ere ,oriscalled schemefrom[4]w2ascombinedwithth2estatic schemefrom[3],
1
e -sound,ifforallcoalitionsC U andpiratestrategiesr , the giving a dynamic scheme using a binary alphabet with a to-
1
probability of accusing one or m⊆ore innocent users is bounded tal codelength of ℓ=O(c4log (n)ln(c/e )). In the same paper
2 1
fromaboveas the author suggests that using the Tardos scheme instead of the
schemefrom[3]maydecreasethecodelengthbyafactorc,thus
P(Cˆ C) e1. possiblygivingacodelengthofℓ=O(c3log (n)ln(c/e )). Asde-
6⊆ ≤ 2 1
tailed later, the schemeswe presenthereare evenmoreefficient
A static traitor tracing scheme (X,s ) has the static complete-
thanthissuggestedimprovement.
ness property with parameters e ,c, or is called static (e ,c)-
2 2
complete, if for all coalitions C U of size at most c and for
allpiratestrategiesr ,theprobab⊆ilityofnotcatchinganypirates 1.3 Contributions and outline
isboundedfromaboveas
FirstweshowthatthestaticTardosschemecanbeextendedtoa
P(C Cˆ=0/) e . dynamictraitortracingschemein a veryefficientway. Thisdy-
2
∩ ≤ namicschemethenhasacodelengthofℓ=O(c2ln(n/e )),where
1
Finally, a dynamic traitor tracing scheme (X,s ) has the dy- theconstantonlyslightlyincreasescomparedtotheschemefrom
namic completeness property with parameters e ,c, or is called [6], while with this scheme we have certainty about catching
2
dynamic (e ,c)-complete, if for all coalitions C U of size at all pirates, instead of at least one pirate as in the static Tardos
2
⊆
2
scheme.Theseadjustmentsdonotinfluencethecodewordgener- Notethattakingd =0(i.e.usingnocutoff)leadstoF (p) F(p).
0
≡
ationoftheTardosscheme, sothecodewordscanstillbegener-
ated in advance. This is an advantagecomparedto the schemes
from[1,4,9]. 2.2 Construction
Sincethevalueofcisusuallynotknowninadvance,wethen
showhowtocreateac-independent“universal”dynamicscheme Here we describe the Tardos scheme, with parameters dℓ,dz,dd
asintroducedin[2],andwiththesymmetricscorefunctionintro-
that does not require c as input. The property that the code-
ducedin[7]. Ifcertainrequirementsontheseconstantsaresatis-
words can be generated in advance is left unchanged, while the
fied,onecanprovesoundnessandstaticcompleteness,asin[6].
scheme also has several advantages with respect to flexibility,
detailed in Section 6. The codelength of this scheme is also
ℓ=O(c2ln(n/e )), thusimprovinguponthe resultsfrom[9] by 1. Initializationphase
1
roughlyafactorO(c2)anduponthesuggestedimprovementin[9]
byafactorO(c). (a) Takethecodelengthasℓ=dℓc2ln(n/e1).
This paper is organized as follows. First, in Section 2 we (b) TaketheaccusationthresholdasZ=d cln(n/e ).
z 1
presenttheconstructionofthestaticTardosschemewiththeim-
proved analysis from [6]. This scheme and its results will be (c) Takethecutoffparameterasd =1/(dd c4/3). 1
usedasthefoundationforthedynamicTardosscheme,whichwe
presentinSection3.Then,inSection4wepresentamodification 2. Codewordgeneration
of the dynamic Tardos scheme when the setting is not fully dy- Foreachposition1 i ℓ:
≤ ≤
namic.InSection5wethenpresenttheuniversalTardosscheme,
whichisanextensionofthedynamicTardosschemethatdoesnot (a) Select pi [d ,1 d ] from the distribution function
∈ −
requirecasinput. InSection6,wediscusstheresultsandargue Fd (p)definedin(2).
that our schemes have several advantages with respect to flexi-
(b) For each user j U, generate the ith entry of the
bility as well. Finally, in Section 7 we list some openproblems ∈
codewordof user j accordingto P(X =1)= p and
raisedbyourwork. j,i i
P(X =0)=1 p.
This paper is mainly based on results from the first author’s j,i − i
Master’sthesis[5].
3. Distributionofcodewords
2 Preliminaries: The Tardos scheme (a) Send to each user j U their codeword ~X =
j
∈
(X ,...,X ), embedded as a watermark in the con-
j,1 j,ℓ
The results in the next sections all build upon results from the tent.
staticTardosscheme,sowefirstdiscussthisschemehere. Since
the codeword generation of the schemes discussed in this paper 4. Detectionofpirateoutput
alluse(avariantof)thearcsinedistribution,wealsofirstdescribe
thisdistributionbelow. (a) Detectthepirateoutput,andextractthewatermark~y=
(y ,...,y ).
1 ℓ
2.1 Arcsine distribution
5. Accusationphase
ThestandardarcsinedistributionfunctionF(p),anditsassociated Foreachuser j U:
probabilitydensityfunction f(p),aregivenby: ∈
2 1 (a) For each position1 i ℓ, calculate the user’s score
F(p)= arcsin(√p), f(p)= . (1) ≤ ≤
p p p(1 p) Sjiforthispositionaccordingto:
−
p
ThisdistributionfunctionwillbeusedinSection5. InSections2,
+ (1 p)/p ifX =1,y =1,
3and4wewilluseavariantofthisdistributionfunction,where − i i ji i
p(1 p)/p ifX =1,y =0,
thevaluesofpcannotbearbitrarilycloseto0and1,asthisgener- i i ji i
allyleadstoahighprobabilityofaccusinginnocentusers. In[8], Sj,i=−ppi/−(1 pi) ifXji=0,yi=1, (4)
− −
Tardosthereforeusedthearcsinedistributionwithacertainsmall +pp/(1 p) ifX =0,y =0.
cutoff parameter d >0, such that p [d ,1 d ]. By scaling F p i − i ji i
∈ −
and f appropriatelyonthisinterval,thisleadstothedistribution
(b) Calculatetheuser’stotalscoreS (ℓ)=(cid:229) ℓ S .
functionsFd andassociateddensityfunctions fd : j i=1 ji
2arcsin(√p) 2arcsin(√d ) (c) User jisaccused(i.e. j∈Cˆ)ifSj(ℓ)>Z.
Fd (p)= − , (2)
p −4arcsin(√d ) 1Previously, in[2,6–8], itwas commontoparametrize the offset d asd =
1 1/(dd c).However,in[6]itwasshownthattogetoptimalresults,d shouldscaleas
fd (p)= (p 4arcsin(√d )) p(1 p). (3) c−4/3ratherthanc−1.Thereforewenowused =1/(dd c4/3),withdd converging
− − toanon-zeroconstantforasymptoticallylargec.
p
3
2.3 Soundness 2.5 Codelengths
For the above construction, one can prove soundness and static In [2] and [6] a detailed analysis is given to go from require-
completeness,providedtheconstantsdℓ,dz,dd satisfycertainre- ments(S)and(C)totheasymptoticallyoptimalsetofparameters
quirements. For soundness, in [6] the following lemma was that satisfies the constraints and minimizes d . Recall that ℓ=
ℓ
proved.Hereh(x)=(ex 1 x)/x2,whichisastrictlyincreasing d c2ln(n/e ),soasmallerd givesshortercodelengths,whereas
ℓ 1 ℓ
functionfrom(0,¥ )to(−21,¥ −). theparametersdz anddd affectonlyZ andd , whichhavenoin-
fluenceontheefficiencyofthescheme.In[6]thefollowingresult
Lemma 1. [6, Lemma 1]Let the Tardosscheme be constructed
wasobtained.
asinSubsection2.2. Let j besomearbitraryinnocentuser, and
leta>0. Then Lemma3. [6,Theorem6]Letg = 2 2/3 0.36. Theoptimal
3p ≈
E eaSj(ℓ)c−1 e1 −aladℓ, asymptoticvaluefordℓis (cid:0) (cid:1)
(cid:16) (cid:17)≤(cid:16)n (cid:17) d = p 2 +O(c 1/3),
wherel a=ah(a√dd c−1/3). ℓ 2 −
theassociatedvaluesfordzanddd are
Nowifthefollowingconditionofsoundnessissatisfied,
4 h
∃a>0: a(dz−l adℓ)≥1, (S) dz=p +O(c−1/3), dd = g −O(cid:16)lnc(cid:17),
then using the Markov inequality and Lemma 1 with this a, for andthecorrespondingvaluesfora,b,l ,l are
a b
innocentusers jweget
2 lnc lnc
E eaSj(ℓ)c−1 a= p −O(c−1/3), b= 9pg −O(cid:18)ln(cid:18) h (cid:19)(cid:19),
P(j Cˆ)=P(S (ℓ)>Z) (cid:16) (cid:17)
∈ j ≤ eaZc−1 l = 1 +O(c 1/3), l = 2 O(c 1/3).
e1 a(dz−ladℓ) e1. a p − b p − −
≤(cid:16)n (cid:17) ≤ n A direct consequence of Lemma 3 is the following corollary,
whichgivestheoptimalasymptoticschemeparametersforc ¥ .
Sotheprobabilitythatnoinnocentuserisaccusedisatleast(1 →
en1)n≥1−e1,aswasalsoshownin[6,Theorem3]. − Corollary1. [6,Corollary1]TheconstructionfromSubsection
2.2 gives an e -sound and static (e ,c)-complete scheme with
1 2
2.4 Static completeness asymptoticschemeparameters
To prove static completeness, in [6] the following lemma was p 2 g
ℓ c2ln(n/e ), Z p cln(n/e ), d c 4/3.
used. Below, and throughout the rest of this paper, S(ℓ) = → 2 1 → 1 → 4 −
(cid:229) S (ℓ)representsthetotalcoalitionscore,i.e.thesumofthe
j C j Forfurtherdetailsontheoptimalfirstorderconstants,see[6].
sco∈resofallpirates j C.
∈
Lemma 2. [6, Lemma 2]Let the Tardosscheme be constructed 2.6 Example
asinSubsection2.2,andletb>0. Then
Let the scheme parameters be given by c=25 pirates, n=106
E e−bS(ℓ)c−5/3 e1 blbdℓc1/3, users, and error probabilitiese1 =e2 =10−3. Then h = 13, and
(cid:16) (cid:17)≤(cid:16) n(cid:17) theoptimalvaluesofdℓ,dz,dd canbecalculatednumericallyas
wherel b= p2 −dd4p c−1/3−bh(b√dd )c−2/3. dℓ=8.46, dz=4.53, dd =14.36.
Ifthefollowingconditionofcompletenessissatisfied, Thisleadstotheschemeparameters
∃b>0: b(l bdℓ−dz)≥h c−1/3, (C) ℓ=109585, Z=2345, d =5.09·10−4.
then using the pigeonhole principle, the Markov inequality and So using these scheme parameters, we know that after 109585
Lemma2withthisbweget symbols,with probabilityat least1 e therearenofalse accu-
1
sations, and with probabilityat least−1 e at least one pirate is
E e−bS(ℓ)c−5/3 accused. InFig.1we showsimulation−res2ultsfortheseparame-
P(C Cˆ=0/) P(S(ℓ)<cZ) (cid:16) (cid:17)
∩ ≤ ≤ e−bZc−2/3 ters. ThecurvesinthefigurearethepiratescoresSj(i)foreach
pirate j C,whiletheshadedareaisboundedfromabovebythe
e1 b(lbdℓ−dz)c1/3 e1 h =e . highests∈coreofaninnocentuser,andboundedfrombelowbythe
2
≤(cid:16)n (cid:17) ≤(cid:16)n (cid:17) lowestscoreofaninnocentuserinthissimulation. InFig.1awe
SostaticcompletenessfollowsfromLemma2andcondition(C), simulatedpiratesusingtheinterleavingattack(i.e.foreachposi-
aswasalsoshownin[6,Theorem4]. tion,theychoosearandompirateandoutputhissymbol),andin
4
4000 disconnectedimmediatelyandcan no longeraccess the content.
HisscoreisthennecessarilybetweenZ andZ˜ :=Z+√dd c2/3>
3000 Z+maxpi,Xji,yiSji. Therestoftheconstructionremainsthesame,
Z=2345 exceptfor the valuesof dℓ,dz,dd , which now have to be chosen
2000 differently.
5
HLSij 1000 0958 3.1 Construction
™ 1
=
{ Theschemeagaindependsonthreeconstantsdℓ,dz,dd . Weshow
0
in Subsections 3.2 and 3.3 that if certain requirements on these
constantsaresatisfied,wecanprovesoundnessanddynamiccom-
-1000 pleteness. Belowwesayauserisactiveifheisnotdisconnected
inthescheme.Weassumethatthepiratesalwaysoutputsomewa-
-2000 termarkeddata, unless all of the pirates are disconnected. Then
0 20000 40000 60000 80000 100000 120000
thetraitortracingschemeterminates.
™i
1. Initializationphase
(a)Interleavingattack
(a) Takethecodelengthasℓ=d c2ln(n/e ).
4000 ℓ 1
(b) TaketheaccusationthresholdasZ=d cln(n/e ).
z 1
3000 (c) Takethecutoffparameterasd =1/(dd c4/3).
Z=2345
(d) SetinitialuserscoresatS (0)=0.
j
2000
2. Codewordgeneration
5
HLSij 1000 0958 Foreachposition1≤i≤ℓ:
™ 1= (a) Select pi [d ,1 d ]fromFd (p)definedin(2).
{ ∈ −
0 (b) GenerateXj,i 0,1 usingP(Xj,i=1)=pi.
∈{ }
3. Distribution/Detection/Accusation
-1000
Foreachposition1 i ℓ:
≤ ≤
(a) Sendtoeachactiveuser jsymbolX .
-2000 j,i
0 20000 40000 60000 80000 100000 120000
(b) Detectthepirateoutputy.
i
™i (Ifthereisnopirateoutput,terminate.)
(b)Scapegoatstrategy (c) CalculatescoresS using(4).
j,i
Figure1:SimulationsoftheTardosscheme,withc=25colluders,n=106users, (d) Foractiveusers j,setSj(i)=Sj(i 1)+Sj,i.
anderrorprobabilitiese1=e2=10−3.InFig.1athepiratesusedtheinterleaving (Forinactiveusers j,setSj(i)=S−j(i 1).)
attack,whereasinFig.1btheyusedthescapegoatstrategy.Inbothcases,thetotal −
(e) Disconnectallactiveusers jwithS (i)>Z.
coalitionscoreS(ℓ)attimeℓisapproximately72000,butwhileinthefirstcase j
thescoreisevenlydividedamongthepirates,inthesecondcaseonepiratetakes
Intheconstructionabove,we separatedthecodewordgenera-
alltheblame.
tionfromthedistribution,detectionandaccusation.Thesephases
canalsobemergedbygenerating p andX onceweneedthem.
i ji
Fig.1btheyusedthescapegoatstrategy(i.e.onepirate,thescape- However,we presentthe schemeas aboveto emphasizethefact
goat,alwaysoutputshissymbol,untilheiscaughtandanotherpi- thatthese phasescan indeed be executedsequentially instead of
rateispickedasthescapegoat).Withthescapegoatstrategy,only simultaneously, and that the codeword generation can thus be
one pirate is caught, while using the interleavingattack leads to donebeforethetraitortracingprocessbegins.
manyaccusedpirates.
3.2 Soundness
3 The dynamic Tardos scheme ForthedynamicTardosschemeasgivenabove,wecanprovethe
followingresultregardingsoundness.
Let us now explain how we create a dynamic scheme from the Theorem1. ConsiderthedynamicTardosschemeinSubsection
staticTardosscheme,suchthatwithhighprobabilitywecatchall 3.1. Ifthefollowingconditionissatisfied,
colluders, instead of at least onecolluder. The changewe make
ln(2)
isthefollowing. InsteadofonlycomparingscoreswithZ afterℓ a>0: a(d l d ) 1+ , (S’)
∃ z− a ℓ ≥ ln(n/e )
symbols,wenowcomparethescoreswithZ aftereveryposition 1
i. If a user’s score exceeds Z at any point in time, then he is thentheschemeise -sound.
1
5
Toprovethetheorem,wefirstprovearelativeupperboundon 3.3 Dynamiccompleteness
theprobabilitythatasingleinnocentuserisaccusedanddiscon-
WiththedynamicTardosscheme,wegetthefollowingresultre-
nected. This bound relates the error probability in the dynamic
gardingdynamiccompleteness. Recallthat herewe requirethat
Tardos scheme to the probabilitythat the user score at time ℓ is
all pirates are caught, instead of at least one, as was the case in
aboveZ. WethenusetheproofoftheoriginalTardosschemeto
theoriginalTardosscheme.
get an absolute upper boundon the soundnesserror probability,
andtoproveTheorem1. Sincetherelativeupperboundgivesus Theorem2. ConsiderthedynamicTardosschemeinSubsection
anextrafactor2,andsincethetermsin(S’)appearasexponents 3.1. Ifthefollowingconditionissatisfied,
intheproof,wegetanadditionaltermln(2)/ln(n/e )compared
1
eto1,(Sso).thNiostoentlhyathtahsisatsemrmallisimsmpaaclltfoonrtrheeasroignhabtlheavnadlusiedseooffn(San’)d, ∃b>0:b(l bdℓ−dz)≥(cid:18)h +ln(l2n)(n+/be1√)dd (cid:19)c−1/3, (C’)
comparedto(S).
InthefollowingwewriteS˜j(i)=(cid:229) ik=1Sjk. Ifuser jisstillac- thentheschemeisdynamic(e2,c)-complete.
tiveattimei,thenS˜ (i)=S (i),butwhereasS (i)doesnotchange
j j j Similartotheproofofsoundness,weprovedynamiccomplete-
anymoreonceuser jisdisconnected,thescoreS˜ (i)doeschange
j ness by relating the error probability to the static completeness
oneverypositioneveniftheuserhasalreadybeendisconnected,
error probability of the static scheme from Section 2. Then we
andcalculatestheuser’sscoreasifhehadnotbeendisconnected.
usetheresultsfromthestaticschemetocompletetheproof. We
Similarly,wewriteS˜(i)=(cid:229) S˜ (i)forcoalitionsC. Notethatif
j C j againseeafactor2intherelativeupperbound,whichagainex-
thelastpirateisdisconnected∈atpositioni <ℓ,thenS andS (i)
0 ji j plainsthe additionalterm ln(2)/ln(n/e ) comparedto (C). The
arenotdefinedfori <i ℓ. 1
0 ≤ othertermb√dd /ln(n/e1)isaconsequenceofusingZ˜ insteadof
Zintheproofs.Notethatthesetwotermsaresmall,comparedto
Lemma 4. Let j U be an arbitrary innocent user, let C
U j be a pirate∈coalition and let r be some pirate strateg⊆y thefirsttermh .
\{ }
employedbythiscoalition.Then Lemma5. LetCbeacoalitionofsizeatmostc,andletr beany
piratestrategyemployedbythiscoalition.Then
P(j Cˆ) 2 P S˜ (ℓ)>Z .
j
∈ ≤ · (cid:0) (cid:1) P(C Cˆ) 2 P S˜(ℓ)<cZ˜ .
6⊆ ≤ ·
Proof. LetusdefineeventsAandBas (cid:0) (cid:1)
Proof. FirstweremarkthatP(S˜(ℓ)<cZ˜ C Cˆ) 1/2. Thisis
ℓ because ifC Cˆ, then S(ℓ)<cZ˜, and si|nce6⊆S˜(ℓ)≥S(ℓ)=R(ℓ)
A:= j Cˆ = Sj(ℓ)>Z = S˜j(i)>Z , isasymmetri6⊆cal,unbiasedrandomwalk,withprob−abilityatleast
{ ∈ } { } { }
i[=1 1/2wehaveR(ℓ)<0andS˜(ℓ)<cZ˜. Next,weusethedefinition
B:= S˜j(ℓ)>Z . oftheconditionalprobabilitytoget
{ }
We trivially have P(A B)=1. For P(B A), note that under P(C Cˆ) 2 P(C Cˆ) P(S˜(ℓ)<cZ˜ C Cˆ)
tphoesiatisosnumi p=tiomninthia:tSA(|hi)o>ldsZ, theℓpdreosccersibse{s|S˜ajs(yi)m}¥im=ie0trsitcarratinndgomat =6⊆2·P(S≤˜(ℓ)·<cZ˜,6⊆C6⊆·Cˆ)≤2·P(S˜(ℓ|)<6⊆cZ˜).
0 j
walkwithnodrif{t.Sowethen}h≤aveP(S˜j(ℓ) S˜j(i0))=1/2,and Thisprovestheresult.
≥
sinceS (i )>Z itfollowsthatP(B A) 1/2. Finallyweapply
j 0
Bayes’TheoremtoAandBtoget | ≥ ProofofTheorem2. First, note that in the dynamic Tardos
scheme, the only extra information pirates receive compared to
P(A B) the static Tardos scheme is the fact whether some of them are
P(A)= | P(B) 2 P(B). disonnected. This informationis certainly coveredby the infor-
P(B A)· ≤ ·
| mationcontainedinthevaluesof p (ifpiratesknow p,thenthey
i i
Thiscompletestheproof. cancalculatetheirscoresSj(i)themselvesandcalculatewhether
theywillbedisconnectedornot).AlsonotethatS˜(ℓ)behavesthe
same as S(ℓ) in the static Tardos scheme, where the total coali-
ProofofTheorem1. First, we remark that the distribution of
tionscoreiscalculatedforallpiratesandallpositions,regardless
S˜ (ℓ) is the same as the distribution of the scores S (ℓ) in the
j j ofwhethertheycontributedonthatpositionornot. Soifwecan
originalTardosscheme,forthesameparametersℓ,Z,d . Fromthe
provethateveninthestaticTardosscheme,andevenifcoalitions
Markov inequality, Lemma 1 and condition (S’) it thus follows
get information about the values of p, the probability of keep-
i
that
ingthecoalitionscoreS(ℓ)belowcZ˜ isboundedbye /2,thenit
2
followsthatalsoP(S˜(ℓ)<cZ˜) e /2.
P(S˜ (ℓ)>Z) E(cid:16)eaS˜j(ℓ)c−1(cid:17) e1 a(dz−ladℓ) e1. For the static Tardos schem≤e, n2ote that the proof method for
j ≤ eaZc−1 ≤(cid:16)n (cid:17) ≤ 2n thecompletenesspropertydoesnotrelyon pi beingsecret. The
onlyassumptionthatisusedinthatproofisthattheMarkingAs-
UsingLemma4theresultfollows. sumptionapplies,whichdoesapplyhere.Soherewecanalsouse
6
Tardosscheme,thetotalcoalitionscoreS(i)=(cid:229) S (i)always
30 j C j
increaseslinearlyiniwithapproximatelythesame∈slope,regard-
lessofthecoalitionsize. Moreprecisely,thescoreS(i)behaves
25
as S(i) im˜, with m˜ 2 only slightly depending on the coali-
Η=0.01 p
tion size≈c and the pir≈ate strategy r . Since one choosesℓ and Z
20 suchthatS(ℓ) ℓm˜ c Z, itfollowsthatS(cℓ) cZ. Inother
≈ ≈ 0 c0 ≈
d™{ 15 Η=1 wsyomrdbso,ltsonceaetdcehdaicsoaaplpitriooxnimofastiezleycℓ≤=cO0(,tchℓe)e=xpOec(tcecdnlnu(mn/beer)o)f.
c0 0 1
SocomparedtothestaticTardosscheme,wherethecodelengthis
10 fixedinadvanceatO(c2ln(n/e )),thecodelengthisreducedbya
0 1
factor c. Inparticular,smallcoalitionsoffewpiratesarecaught
5 c0
uptoO(c )timesfaster.
0
0
5 10 50 100 500 1000 3.5 Example
™c
LettheschemeparametersbethesameasinSection2.6,i.e.c=
Figure2: Optimalvaluesofdℓ inthedynamicTardosscheme. Thedottedline 25,n=106ande1=e2=10−3,sothath =31.Theoptimalvalues
cshoorrwestphoendvsalutoesthoefadsℓyimnpthtoetisctaotipctimTaarldovsalsucehedmℓ=efop2r2h≈=4.193(.topT)heanbdohld=cu0rv.0e1s oasfdℓ,dz,dd satisfying(S’)and(C’)canbecalculatednumerically
(bottom)respectively.Thefivecurvesslightlyaboveeachoftheboldcurvesshow
theoptimalvaluesofdℓinthedynamicTardosschemeforn/e1=103k,fork=1 dℓ=9.00, dz=4.73, dd =13.44
upto5.Highervaluesofkcorrespondtolowervaluesofd.
ℓ
Thisleadstotheschemeparameters
ℓ=116561, Z=2448, d =1.02 10 3
theproofmethodofthestaticTardosscheme. FromtheMarkov · −
inequality,Lemma2andcondition(C’),itthusfollowsthat InFig. 3 we show some simulationresultsfor these parameters.
InFig.3athepiratesusedtheinterleavingattack,andinFig.3b
E e−bS˜(ℓ)c−5/3 theyusedthescapegoatstrategy.
P S˜(ℓ)<cZ˜ (cid:16) (cid:17)
(cid:0) (cid:1)≤ e−b(Z+√dd c2/3)c−2/3
4 The semi-dynamic Tardos scheme
e1 b(cid:18)lbdℓ−dz−ln√(n/ded1)c−1/3(cid:19)c1/3
≤(cid:16)n (cid:17) In the dynamic Tardos scheme, we need to disconnect users as
e1 h +ln(lnn/2e1) = e2. soon as their scores exceed the threshold Z. In some scenarios
≤(cid:16)n (cid:17) 2 thismaynotbefeasible, andwemayonlybeabletodisconnect
usersseveralpositionslater,sayafterBmoresymbols. Thiscan
UsingLemma5theresultthenfollows.
haveseveralreasons:
3.4 Codelengths Thepiratestransmittheircontentwithasmalldelay,sothat
•
thereisadelayofBsymbolsbetweenoriginalbroadcastand
The requirements (S’) and (C’) are only slightly different from thecorrespondingpirateoutput.
requirements(S) and (C). For asymptoticallylarge c, these dif-
Detectingthepirateoutput,extractingthewatermark,updat-
ferences disappear, and thus the optimal asymptotic codelength •
ing the scores and disconnecting users takes so much time
is the same as in the static Tardos scheme. In Fig. 2 we show
theoptimalvaluesofd inthedynamicTardosschemeforh =1 thata user is onlydisconnectedafter B more symbolshave
ℓ
and h =0.01. The differentcurves correspondto differentval- alreadybeendistributed.
uesofn/e ,rangingfromn/e =103(thehighestvaluesofd )to Forthesecases,wepresenttwodifferentsolutions. First,inSec-
1 1 ℓ
n/e =1015(thelowestvaluesofd ). tion 4.1 we present a scheme that achieves a codelength of at
1 ℓ
Notethatthesevaluesofd correspondtothetheoreticalcode- most ℓ=d c2ln(n/e )+Bc, where d is the same as in the dy-
ℓ ℓ 1 ℓ
lengths such that probabilityat least 1 e , by time ℓ all of the namic Tardos scheme for the same parameters. For small val-
1
−
pirateshavebeendisconnected.Thishoweverdoesnotmeanthat uesof B, this meansthatwith codelengthwhich is only slightly
the last pirate is caughtexactly at time ℓ, only that he is caught higherthaninthedynamicTardosscheme,wecanalsocatchall
beforeorattimeℓ. Soinpracticethenumberofsymbolsneeded piratesinasemi-dynamicsetting.Then,inSection4.2wepresent
todisconnectalltraitorsmaybebelowthistheoreticalcodelength aschemethatachievesacodelengthofℓ=d c2ln(n/e ),where
ℓ,B 1
ℓ,andmayevendecreasecomparedtothestaticTardosscheme. d increases with B. Since a small increase in d can already
ℓ,B ℓ
Furthermore,ifthecoalitionsizeisnotknown,butonlyanup- leadtoabigincreaseinthecodelength,thesecondschemegen-
per bound on the coalition size is known, i.e. c c for some erallyhasalargercodelengththanthefirstscheme. Onlyforval-
0
c , thenonegenerallyusesa traitortracingschem≤e thatis resis- uesBwithB>(d d )cln(n/e )=W (cln(n/e )),thesecond
0 ℓ,B ℓ 1 1
−
tant against up to c colluders. In [7] it was shown that for the schemeachievesashortercodelengththanthefirstscheme.
0
7
3000
30
Z=2448
2000 25 32
1000 528 561 20 16
HLSi™j i91= {116= d™{,B 15 8 4
0 2
1
10
-1000
5
-2000 0
0 20000 40000 60000 80000 100000 120000 5 10 50 100 500 1000
™i ™c
(a)Interleavingattack
Figure4:Optimalvaluesofdℓ,Binthesemi-dynamicTardosschemefromSection
3000 4.2,fortheparametersn=106,e1=e2=10−3,andh = 13.Theboldcurvecor-
respondstothevaluesofd inthestaticTardosschemewiththesameparameters,
Z=2448 ℓ
whilethesixcurvesabovethiscurvecorrespondtotheoptimalvaluesofdℓ,Bfor
B=1,2,4,8,16,32 respectively. Thedottedlinecorresponds totheasymptotic
2000 optimalvaluedℓ= p22 ≈4.93. ForB=1wegetexactlythecodelengths ofthe
dynamicTardosscheme.
1000 899 561
HLSi™j 0 i93= {116= tdhecr2elfno(rne/uese)tphoesiatnioanlyssfisorfrwomhicShecwtieonca3lcaunladtecosnccolruedse, wtheatcwaticthh
ℓ 1
any coalition of size ℓ. Since we disregarded Bc positions, the
pirate broadcastwill not last longer than ℓ=d c2ln(n/e )+Bc
ℓ 1
-1000
positionsintotal, wheredℓ,dz anddd areasinthedynamicTar-
dosschemeforthesameparameters.Thismeansthatwithatmost
-2000 BcmoresymbolsthaninthedynamicTardosscheme,wecanalso
0 20000 40000 60000 80000 100000 120000 catchcoalitionsinthissemi-dynamictraitortracingsetting.
™i
(b)Scapegoatstrategy
4.2 Second scheme: ℓ=d c2ln(n/e )
Figure3: Simulations ofthedynamicTardosscheme, withparameters c=25, ℓ,B 1
n=106 ande1=e2=10−3. InFig. 3athepiratesusedtheinterleavingattack,
whereasinFig.3btheyusedthescapegoatstrategy. Inbothcases,afterlessthan Instead of using Bc more symbols, we can also try to adjust
95000 symbols all pirates have been caught, which is less than the theoretical theanalysisof the dynamicTardosscheme to the semi-dynamic
codelengthℓ=116561,andlessthanthecodelengthofthestaticTardosscheme
traitor tracing scenario. We can do this by following the proof
withthesameparameters,ℓ=109585.
methodsofthedynamicTardosscheme,andbymakingonesmall
adjustment. ThechangewemakeintheanalysisistouseZ˜ :=
B
4.1 Firstscheme: ℓ=d c2ln(n/e )+Bc Z+B√dd c2/3 >Z+BmaxpSji(p) instead of Z˜ =Z+√dd c2/3
ℓ 1
asournewupperboundforthescoresofusersintheproofs.This
The first scheme is based on the following modification to the resultsin the following,slightly differentconditionfor dynamic
accusationalgorithmof the dynamicTardosscheme. Suppose a completeness:
user’s score exceedsZ after i positions. At position i we now
0 0
disconnectthisuser. Sincethisusermayhavecontributedtothe b>0:b(l d d ) h +ln(2)+Bb√dd c 1/3. (C”)
nextBsymbolsofthepirateoutput~y,wedisregardthefollowing ∃ b ℓ− z ≥(cid:18) ln(n/e ) (cid:19) −
1
B positions of the watermark, and do not update the scores for
positions i∈{i0+1,...,i0+B}. After those positions we con- If some parametersdℓ,B,dz,B,dd ,B satisfy (S’) and (C”), then us-
tinuethetraitortracingprocessasinthedynamicTardosscheme, ing these constants as our scheme parameters, we obtain a e -
1
and we repeat the above procedure for each time a user’s score soundanddynamic(e ,c)-completeschemewithacodelengthof
2
exceedsZ. ℓ=d c2ln(n/e ). In Fig. 4 we show the valuesof d for the
ℓ,B 1 ℓ,B
Withthismodification,thetraitortracingprocessonthosepo- parametersn=106,e =e =10 3,andh =1,forseveralvalues
1 2 − 3
sitions that were used for calculating scores is identical to the of B. As the value of B increases, the value of d increases as
ℓ,B
traitor tracing process of the dynamic Tardos scheme. We can well.
8
4.3 Example have to be calculated for each of these schemes, i.e. for each of
the values of c. We introduce counterst(c) to keep track of the
Asbefore,lettheschemeparametersbegivenbyc=25,n=106
numberofpositionsthatarenotdisregarded,foreachvalueofc.
ande =e =10 3,sothath = 1,andletususeB=8. Forthe
1 2 − 3 ForeachcwethenbasicallyrunadynamicTardosschemeusing
firstscheme,thecodelengththenincreasesbyBc=200compared
thesamecodeX untilt(c)=ℓ(c).
tothedynamicTardosscheme,givingschemeparameters:
ℓ=116761, Z=2448, d =1.02 10 3 1. Initializationphase
−
· Foreachc 2:
≥
Forthesecondscheme,theoptimalvaluesofdℓ,B,dz,B,dd ,Bsatis-
fying(S’)and(C”)forB=8canbecalculatednumericallyas (a) Takethecodelengthasℓ(c)=d(c)c2ln(n/e (c)).
ℓ 1
dℓ,B=10.16, dz,B=4.94, dd ,B=10.07. (b) TakethethresholdasZ(c)=dz(c)cln(n/e1(c)).
Thisleadstotheschemeparameters (c) Takethecutoffparameterasd (c)=1/(dd(c)c4/3).
ℓ=131587, Z=2561, d =1.36 10 3. (d) InitializetheuserscoresatS(c)(0)=0.
− j
·
So in this case, using the first scheme leads to a shorter code- (e) Initializethecounterst(c) att(c)(0)=0.
length.
2. Codewordgeneration
Foreachpositioni 1:
≥
5 The universal Tardos scheme
(a) Select p [0,1]fromF(p)asdefinedin(1).
i
∈
Inthissectionwepresentadynamicschemethatdoesnotrequire (b) GenerateX 0,1 usingP(X =1)=p.
ji ji i
∈{ }
c as input. The name “universal” comes from the fact that for
the codeword generation, we now use a distribution function F 3. Distribution/Detection/Accusation
whichdoesnotdependonc, butisa universaldistributionfunc- Foreachpositioni 1:
≥
tionthatcanbeusedforallvaluesofc. Becauseofthis,wecan
(a) Sendtoeachactiveuser jsymbolX .
use the same codewords for different values of c. In particular, ji
wewillusethefirstℓ(c)=O(c2ln(n/e1))symbolstocatchcoali- (b) Detectthepirateoutputyi.
tions of size c, for c 2. We do this in such a way that if a (Ifthereisnopirateoutput,terminate.)
≥
coalition has some unknown size c, then after ℓ(c) symbols, the (c) CalculatescoresS using(4).
ji
probabilityof nothavingcaughtall membersofthis coalitionis
at most e . Since we do this for each value of c, we now only (d) Foractiveusers jandvaluescsuchthat pi [d (c),1
2 ∈ −
needO(c2ln(n/e1))symbolstocatchacoalitionofsizec. d (c)],setS(jc)(i)=S(jc)(i−1)+Sji.
Theonlyproblemwith thisnewcodewordgenerationmethod (OtherwisesetS(c)(i)=S(c)(i 1).)
isthatacompletelyuniversaldistributionfunctionwhichisopti- j j −
mallyefficientforallvaluesofcdoesnotexist. Moreprecisely, (e) For values of c such that pi [d (c),1 d (c)], set
theproofofsoundnessoftheTardosschemerequiresthatthecut- t(c)(i)=t(c)(i 1)+1. ∈ −
off parameter d is sufficiently large in terms of c, whereas for (Otherwiseset−t(c)(i)=t(c)(i 1).)
−
completenesswe need that d approaches0 as c→¥ . One way (f) Disconnect all active users j with S(c)(i) > Z(c) and
toavoidthisproblemisthefollowing. Forgeneratingthevalues j
t(c)(i) ℓ(c)forsomec.
of p, weusethestandardarcsinedistributionfunctionfrom(1).
i ≤
Thenforanyvalueofcwesimplydisregardthosevaluesp which
i
arenotbetweenthecorrespondingcutoffparameterd and1 d . As was already mentioned in Section 3.1, if desired
− the codeword generation can be merged with the distribu-
The fractionof valuesof p thatis disregardedcan be estimated
i
tion/detection/accusationphase.Thisdependsonthescenarioand
easilyasfollows:
theexactimplementationofthescheme.
1 d (c) 4 Alsonotethatintheaboveconstruction,noboundsoniandc
1 − f(p)dp= arcsin d (c) .
−Zd (c) p (cid:16)p (cid:17) are given. If we run the above scheme forever, we will eventu-
allycatch anycoalitionof anysize. Inpracticeonemaychoose
Since p4arcsin(√d (c))=p √4dd c−2/3+O(c−2),therighthandside to use some upper bound c0 on the size of any coalition (in the
worstcase: c n),andonlykeepscoresfor2 c c . Inthat
issmallanddecreasinginc,sothefractionofdisregardeddatais 0 0
≤ ≤ ≤
case,drawingvaluesp fromF alsomakesmoresense,asval-
small. i d (c0)
ues pi /[d (c0),1 d (c0)]wouldbedisregardedforall2 c c0.
∈ − ≤ ≤
Sowhile the constructiongivenaboveis the theoreticalsolution
5.1 Construction
to catch arbitrarylarge coalitions, we can also constructan effi-
BasicallywerunseveraldynamicTardosschemessimultaneously cientschemetocatchcoalitionsofsizeatmostc fromtheabove
0
with shared codewords, so scheme parameters and scores now schemebymakingthesesmalladjustments.
9
5.2 Soundness 5.4 Codelengths
For the universal Tardos scheme we prove the following result The theoreticalresults fromthe previoussubsectionsare notfor
regardingsoundness. exactlyℓ(c)watermarkpositions,butforsomenumberofsymbols
T(c) such that there are ℓ(c) positions i with p [d (c),1 d (c)]
Theorem 3. Consider the universal Tardos scheme in Sub- by then. The difference T(c) ℓ(c) is a randomi ∈variable,−and is
section 5.1. If (S’) is satisfied for each set of parameters −
distributedaccordingtoanegativebinomialdistributionwithpa-
dz(c),dℓ(c),dd(c),e1(c), and if the e1(c) satisfy the following require- rametersr=ℓ(c)(thenumberofsuccesseswearewaitingfor)and
ment:
p=1 P(p [d (c),1 d (c)])= 4arcsin(√d (c))(theprobability
i p
¥ − ∈ −
(cid:229) e (c) e , (E) ofasuccess). Becausetheparameter p=O(c−2/3)isverysmall
1 ≤ 1 forlargec,thedifferencebetweenT(c)andℓ(c)willalsobesmall.
c=2
Moreprecisely,T(c) hasmeanℓ(c)/(1 p)=ℓ(c)(1+O(c 2/3))
thentheschemeise1-sound. andvariances 2=ℓ(c)p/(1 p)2=O(−ℓ(c)c 2/3),andthep−roba-
−
Proof. Foreachc 2,letCˆ(c)bethesetofusersthatareaccused bilitythatT(c)exceedsitsm−eanbym>0decreasesexponentially
≥
because their scores S(c) exceeded Z(c) beforet(c) >ℓ(c). Then inm.
j
Cˆ= ¥c=2Cˆ(c). Foranyfixedc,wecanthenapplyTheorem1to ingAtlhseosncohteemtheaatsifdseosmcreibuepdpeearrblioeur,ntdhecn0≥sincciestuhseevdaflourecsoonfsptruacrte-
tthheeppSraorbamabeitleitrystdhℓ(act),jdz(cC)ˆ,(dcd)(cf)o,ar(icn)naoncdenet1(uc)sesrostjhiastawtmeoksntoew(c)t/hnat. ddrisarwegnafrrdoemdfFodr(cc0)=wce.hSaovethTen(c0th)e=mℓa(cx0i)m, uasmncoodvealleunegsthofispfiiixaerde
∈ 1 0
So the probability that an innocent user is disconnected is then inadvance,atthecostofpossiblynotcatchingcoalitionsofsize
boundedfromaboveby c>c .
0
Finally, note that this scheme is constructed in such a way
¥ ¥ e (c) e
P(j Cˆ) (cid:229) P(j Cˆ(c)) (cid:229) 1 1. thatcoalitionsofany(small)sizecanbecaughtmoreefficiently.
∈ ≤ ∈ ≤ n ≤ n To catch a coalition of size c we now only use O(c2ln(n/e ))
c=2 c=2 1
symbols. This in comparison to the static and dynamic Tardos
Theresultthenfollows.
scheme,whereweneedO(c2ln(n/e ))andO(cc ln(n/e ))sym-
0 1 0 1
Note that one can choose values e (c) satisfying (E) such bols respectively, where c0 is again some upper bound on the
1
that O(c2ln(n/e (c))) = O(c2ln(n/e )), e.g. by taking e (c) = coalitionsize usedto constructthe schemes. So whileusing the
6e /(p 2c2). If1furthermore c2 =1o(n), then it also fo1llows dynamicTardosschemealreadyreducesthecodelengthbyafac-
1 tor c,theuniversalTardosschemefurtherreducesthecodelength
thatdℓc2ln(n/e1(c))=dℓc2ln(n/e1)(1+o(1))andweachievethe byacn0otherfactor c.
sameasymptoticcodelengthasinthe static anddynamicTardos c0
schemes.
5.5 Example
5.3 Dynamiccompleteness Asbefore,lettheschemeparametersbegivenbyc=25,n=106
and e = e = 10 3. Let us take c = 25, and use F for
Theorem 4. Consider the universal Tardos scheme in Sub- 1 2 − 0 d (c0)
section 5.1. If (C’) is satisfied for each set of parameters generating values of pi. Let us also use e1(c) = 6e1/(p 2c2),
dz(c),dℓ(c),dd(c),e1(c),h (c), where h (c) =ln(1/e2)/ln(n/e1(c)), then so that (cid:229) cc0=2e1(c) ≤ (cid:229) ¥c=2e1(c) ≤ e1. The optimal values of
foreachc≥2theschemeisdynamic(e2,c)-complete. dℓ(25),dz(25),dd(25)satisfying(S’)and(C’)canbecalculatednumer-
icallyas
Proof. This follows directly from applying Theorem 2 to
dℓ(c),dz(c),dd(c),a(c)ande1(c),wherecistheactual(unknown)coali- dℓ(25)=8.59, dz(25)=4.61, dd(25)=13.83.
tionsize.
Forc=25,thisleadstotheschemeparameters
To prove that the scheme catches a coalition of size c, we
onlyarguethatthecoalition’sscoreS(c)(i)willexceedcZ(c) be- ℓ(25)=148457, Z(25)=3188, d (25)=9.89 10−4.
·
fore we have seen ℓ(c) positions with d (c) p 1 d (c). In
i InFig. 5 we show some simulationresultsfor these parameters.
≤ ≤ −
reality, the probability of catching the coalition is much larger
InFig.5awesimulatedpiratesusingtheinterleavingattack,and
than this, since e.g. with high probability their score S(c 1) will
− in Fig. 5b the pirates used the scapegoat strategy. As one can
also exceed Z(c 1) before we have seen ℓ(c 1) positions with
− − see, intheuniversalTardosschemethescapegoatstrategyisnot
p [d (c 1),1 d (c 1)]. Andifapirateisdisconnectedbecause
i∈ − − − agoodstrategy,asthewholecoalitioniscaughtsooner.
his score exceeded some threshold Z(k), then we do not have to
waituntilS(i)>cZ˜(c)butonlyuntilS(i)>(c 1)Z(c)+Z(k). And
since S(i)/c has a constant slope, as soon a−s a pirate is caught, 6 Discussion
theotherpirates’scoreswillincreaseevenfaster. Inpracticewe
thereforealsoseethatweusuallyneedfewerthanℓ(c) usefulpo- Comparingtheuniversalschemetothestaticscheme,weseethat
sitionstocatchacoalitionofsizec. the main advantages are that (a) we now have certainty about
10
