Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We want to distribute digital content (think pictures) to a select number of partners (around 1000, worldwide) to use as visual reference. We would like however to prevent them from copying or in any way reusing this content. Or, if they do, to be apparent that this is not the original source of the content. Until now we distribute CDs with a specific reading application that takes control of your system (thus disables screen capture etc.) and only then allows content to be decoded (no encryption though) and presented. I was wondering if it would be possible to move this process online.

The requirements and possible corresponding solutions would be:

  1. Selective access -> login/password, perhaps a hardware token or other way of two-factor authentication
  2. Disallow reuse of images-> watermarking, preferably indicating the specific user accessing the information

Other solutions one could employ? Or better, any suggestion for a different distribution model? Is perhaps online distribution broken from start?

share|improve this question
5  
I suspect one answer maybe to make each image very slightly (by a couple of pixels) different, and then take cryptographically secure hashes. This way you'd know which partner released the image, if any were released. I also think that online distribution is doomed. –  DanBeale Oct 3 '11 at 11:08
    
Still, any particular reasons why online distribution is "doomed", esp. if one tries to address alleged risks with counter-measures? –  Georgios Oct 3 '11 at 11:30
3  
Your "distribute CDs with a specific application" looks trivial to defeat using a VM unless you didn't tell all. Watermarking can make the reuse evident, but can't possibly forbid it. –  Bruno Rohée Oct 3 '11 at 11:59
3  
You also haven't specified what your partners are supposed to do with the images. It's completely possible that their expected use will require that they modify (effectively, reuse) the images for their purposes. If you're attempting to use this type of functionality to get concept art to 3D modelers for example, they may want to be able to convert it to something they can import into their modelling program. Your current program is (likely) defeatable, and thus only serves as an annoyance... –  Clockwork-Muse Oct 3 '11 at 16:10
    
The images are supposed to be just for visual reference. They don't even need to be whole, so I was also considering the solution of displaying different parts of them each consecutive time. –  Georgios Oct 4 '11 at 7:11

4 Answers 4

up vote 7 down vote accepted

How much protection do you really want ? The problem is that when the image reaches the client's computer, it's not yours anymore. The specific image that is displayed in his computer can be captured and can be used anywhere, if protected by software.

So, if you really don't want that the picture is redistributed and used, you can't send him the image. What leaves you sending an image with

  1. visible watermark
  2. low-res, low-quality
  3. hidden watermarking (for tracking purposes)

Any other measure won't prevent him from doing a Print Screen and saving the file. (maybe not literally pressing the print screeen, but using some program to achive the same behaviour).

Note: computers can have some hardware protection preventing copies. It's how it's done using blu-ray disks and HDMI cables, and works for audio and video. But I'm not sure that you could implement that through software, because the BD leaves the drive already encrypted somehow.

share|improve this answer
    
And like DVDs, the drm on blu-ray players can and will be broken. –  Rory Alsop Oct 3 '11 at 17:34
2  
@RoryAlsop: Indeed, AACS was broken 5 years ago. –  josh3736 Oct 3 '11 at 19:02
    
I was also wondering if, in addition to the above measures, showing just part of the picture each time would also help... –  Georgios Oct 4 '11 at 6:40
    
@Georgios: sending picture in parts will make people have to copy-and-paste the part of the picture... What would help is to send a low-quality image (that would be redistributed, but perhaps not commercially used as yours could be). And watermarking. –  woliveirajr Oct 4 '11 at 11:43

On a general basis, proactive measures do not work. For instance, your "specific reading application" is defeated by using virtualization: the guest operating system and its applications (including your reading application) believe that they have full control of the machine, but the machine is not a real one, and the host can easily keep screenshots at will. Also, see KVM over IP devices: from the point of view of the connected machine, such a device is a normal display, but screen contents are then sent over TCP/IP, making screenshots a piece of cake.

The best that you can hope for, realistically, is to make aware your users that reusing the pictures is not allowed. I mean this in a legal way: if they must go through various hoops such as virtualization to copy the contents, then at least they will not be able to claim that they did it "in good faith". Even this will be hard; for instance, if you send me a Windows-only application on a CD, I will have to use virtualization to run it, since my main machine does not have any Windows.

Once you have your legal tools, there remains the problem of detecting unauthorized reuse of the pictures. For reuse "on the Web", the tool to use is watermarking: embedding some data within pictures, in a way which does not degrade (too much) image quality, but resists various treatments which can be done on the pictures, such as cropping, recompression or adjusting colour balance. This is a hard problem; there are various commercial solutions of questionable robustness. The name is quite adequate: this is akin to "writing on water". Assuming that you have a secure watermark in your pictures, the "only" remaining task is to roam the Web, downloading all the pictures, and looking for the watermark; if detected, send a lawyer squad at the offender.

share|improve this answer

There isn't a technological answer as once you let someone view your content on a device in their possession, a tech-savvy person can and will get at the images if they want them.

At best, you could make it more difficult than its worth; e.g., send a user the images on a locked-down tablet/image viewer with no networking/data out cables. (So if they want your images they'll have to physically modify the hardware.) Even then, they could easily use a camera to take a picture of the device and use that to spread your work.

Your current strategy of giving them cds with image data in a custom format read by a custom reader that locks down the system could be replicated online quite easily. E.g., you have your users download a program, which downloads the custom image data online, but needs to be read by a certain proprietary reader running on their computer. Obviously, a dedicated user would be able to take screenshots from the reader, but this is no different than your cd method. And if someone took the time, they could reverse engineer your image format if they have the working program.

Now you can copyright your work and vigorously defend your copyrights/daily searches/watermark images/etc. Recognize that your images will get out there; but not legally and you can try getting violators to stop and may even win some fines.

My general advice would be to try and alter your business model to not be so reliant on others not redistributing your images.

share|improve this answer

Is perhaps online distribution broken from start?

Digital distribution is complicated by the low-cost(near zero) perfect copy mechanism.

Back in the age of audio casette tapes, people made copies of audio casettes. But the copies were not as good as the orginal (degraded). Copying also had significant startup cost: a system capable of playing one tape and recording another. And making copies had some operational cost: i.e. cost of a blank casette. Furthermore coping reached a limit: a copy of a copy was further degraded and after some number of copies was unuseable. As a further impediment, the original had a limited lifetime: a casette could only be played some many times before it wore out.

On the other hand a digital copy is usually perfect (no degredation). A copy of a digital copy is usually as good as the original. In fact it is usually the same (identical). This means there is no limit to the number of copies that can be made. Additionally the cost of making a digital copy is very small. There is no startup cost as any computer is capable of making some type of copy. And there is little marginal or operation cost: you don't need to buy a new CD-ROM, hard drive, flash cip, etc for each copy. And, as long as users can make backups, a digital copy has an unlimited lifetime.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.