Is it possible to make a video that is provably non-manipulated?

Question

Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which videotape the room during the entire exam. Now, if the student is blamed for cheating (e.g. because his/her exam is similar to another exam), then he can show the video and prove that he did, indeed, write the exam by his own, did not leave the room during the exam, did not use unallowed materials, etc.

The only problem is that video can be edited. Theoretically, the student can exit the room, talk with a friend about the exam, then get back into the room, and after the fact, use a video editing software to erase the relevant part.

Is there a way to take a video and simultaneously sign it digitally, so that it will be possible to verify later that the video was not edited? (Is there maybe a software that does this?)

Answer 1

Trusted Timestamping

I think, if you continue down this line of thinking, you will end up with something very similar to Trusted Timestamping Servers.

The core idea of trusted timestamping is that you submit a file to the server and it signs an attestation saying that it saw the file with hash aabbcc112233 at time X. This is typically used for both proving the initial publication time (and who published it), as well as proving that the file has not been modified since.

You need the trusted 3rd party because if the end-user creating the video is the same person signing it, then there's nothing stopping them from re-signing it after they edit it.

---

Why not just save the video stream on the server?

That said, I don't think you really need any fancy crypto here; the simplest solution is probably best. Have the student live-stream their cameras to an exam-monitoring website. The website logs the video stream in its database as it comes in, and it can detect and alert if the live stream had any breaks or disruptions long enough for manual editing to potentially have taken place.

---

Create a blockchain of the video stream

Update addressing comments.

Ah, you have the extra privacy requirement that students do not want their video stored on 3rd party servers (that should have been in the question!).

In that case, what makes this problem hard is that you can't wait until the end of the exam and publish a single hash for the entire video because that gives the student too much time to edit a middle section of the video. The solution that comes to mind would be some kind of hash-block-chaining (not "The Blockchain (Bitcoin)" but "a blockchain"). Either the sender or receiver breaks the video stream into, for example, 10 s "blocks", hash each block as they are produced/recieved, and stream the hash for each block along with the video in real-time. You do "block-chaining" by including in each block the hash of the previous block. In math notation:

h_0 = hash(videoblock_0)
h_1 = hash(videoblock_1 || h_0)
...
h_n = hash(videoblock_n || h_n-1)

This preserves privacy because the server only needs to store the hashes and not the video itself. This is streaming-friendly because you are producing hashes throughout the stream and each hash covers the entire stream up to that point. This is efficient because the server only needs to store the most recent hash (h_n), and that is enough to later verify if a provided video was tampered with at any point in the stream (though to detect where it was tampered you would need to save every block hash).

Answer 2

Before you get to the "video" part of the question, you should know that a video does not guarantee fool proof honesty.

There was a student who surgically implanted an earphone to cheat. There's also invisible ink, bluetooth pens, watch hacks etc. Do a bunch of internet searches for how students cheat.

I wouldn't recommend using video as proof at all. A human invigilator has to be physically present to ensure cheating does not happen. Institutions could either re-think how students are seated or protected from infections when writing exams in institutions or perhaps re-evaluate the way the education system tests students. I've personally found the test/exam system to be fundamentally flawed, in the way it makes people memorize information and regurgitate it out instead of being designed to help the student understand and appreciate what they are learning and how it'd be useful to them in the world.

Now for the video part, an elaborately created deepfake could allow somebody else to write the exam. There are claims of using AI to spot cheating by checking even writing style, but there's a long way to go before it can be foolproof. Recent advances ref1, ref2, ref3.

Answer 3

The actual answer is NO, unless you record the video with a device that signs the file with a key that can't be extracted from its hardware. In other words, your videos should be signed by the camera's hardware, which will guarantee the recordings are truly the original ones. Otherwise the files could always have been manipulated by someone or something external, even in real time.

All the other answers are very interesting, but they all have one major flaw: they suppose the video file you provide is genuine, but it's actually your file so you are still in control of whatever you are recording and providing. Between the camera and the upload, anything could happen. A small lag could be added to the video, or it could be slowed down, or looped, etc., even by someone else in real time while you are taking the exam. Actually, if you really want an easier way to cheat, you can just focus on the audio part: it's easier to manipulate the audio in real time (muting the room's channel, mixing white noise or ambient sounds, etc.) to allow someone else to talk to you and help you. When you sign the video with the audio track it's too late, because the result has already been manipulated (gone through a mixer, etc.).

That's why the file must be signed by the device itself: if exam-video.mp4 was signed by Nikon on 2021-01-10 09:01:15, then you can be sure that's the original file recorded by the camera. Note that if the camera didn't detect the difference between the internal mic (original sound) and an external mic (potentially manipulated channel) then you would still have the "audio vulnerability" even in signed files. I actually don't know how such cameras work, all I know is that they do exist, and in the past some were even hacked (someone managed to extract the crypto keys from the camera's hardware).

As a final note, remember that "manipulating videos" and "cheating on online exams" are separate issues. Students can cheat even if they record and provide genuine videos of themselves taking the exam.

Answer 4

No, sending/retrieving/verifying a tamper-resistant cameras that could deliver the level of confidence wanted here is prohibitively expensive and still cannot reveal non-visually-obvious augmentations.

Though some companies are happy to sell video analysing software that by design cannot possibly work as advised - any trick investigating a video from unknown sources can be circumvented, even on a live low-latency feed, given enough computing power & effort. (This also means any scheme trying to prove a video was not edited after a certain time is useless, as it is not ruling out it was edited shortly before that time).

There is, however, a more fundamental problem that is even further away from being efficiently solvable: The whole idea of trying to assess a student outside a controlled environment implies a certain regularity of events outside the students control that can cast some doubt on fair play anyway: Imagine one out of 100 students loses electric lighting during the assessment. Two have to pause to deal with a possible emergency down the hallway. One camera malfunction and two computer malfunction later, the whole testing environment just is not reliable enough to even bother disqualifying students with irregularities.

I am afraid (happy) we will have to go back to the super old school way of eliminating ways in which students can gain unfair advantages by using what is & should always be available to them. Which may cost more in designing clever methods of assessment, but at least that money is invested towards students learning, rather than camera manufacturers.

Answer 5

Ultimately, you're asking about trusting an untrusted subject, using untrusted hardware and software, located in an untrusted environment. That's not a recipe for success.

Answer 6

You actually have 2 questions, and I don't know.which is the "real" one:

1. "Is there a way to take a video and simultaneously sign it digitally, so that it will be possible to verify later that the video was not edited? (Is there maybe a software that does this?)"

2. Is there a way the student or.university can use a camera or authenticated video to prove no.cheating.

The first asks technologically can a video be validated as "true" or at least unmodified. The second asks socially if cheating can be proven or disproven for either party's comfort (possibly using such a technological means).

Short answer is,:

1. A video or other file can be validated as unaltered, at least until encryption advances, that's how digital security works.

2. But that's useless because it assumes the original before digital signing was validated. What will you do? Use trusted encryption and a verified/encrypted pathway? At worst I play games with the camera, or even in theory the light entering the sensor - its just a sensor, it can be fooled as to what's going on, and its output has to be interpreted by humans who also can be fooled. Ask any conjurer. Or I find ways to cheat it can't detect. Are you sure your camera will highlight if my identical supergenius twin with stick-on matching fingerprints, retina matching lenses, and a faked sample of my DNA took the paper? Or a hundred other loopholes, ranging from realistic to.far-fetched sci-fi. Other answers touch on these.

3. If you go for social solutions, such as China might - every person chipped, CCTV everywhere, that raises the barrier.

Really that's all you can do in security. Raise the barrier. Almost never eliminate it.

Answer 7

The surveillance industry developed a standard for defining a way to get a video from the camera while having at the same time the proof that it was not manipulated, so that it cannot be rejected in trials.

The result is the so called ONVIF Export File Format, which has been also evaluated and, I think, adopted by NIST.

Answer 8

What about having a projector in the student's room that projects a number on to a wall that is visible to the camera. That projector is fed via a secure stream to the university server. The number changes every 5 seconds in a cryptographic random sequence.

Answer 9

You have to start with hardware you trust. This hardware has a difficult to breach trusted core chip. In that trusted core chip, it has a secret cryptographic signing module.

Each component in turn has a slightly less secure identity that it validates with the core chip, and the entire system refuses to work if they aren't all valid and running valid firmware and software.

Next you produce a series of trusted timestamp tokens that include the crytographically secure hashes of the video segments in a blockchain.

Each token is signed by a 3rd party trusted timestamp server, and includes the hash of the previous token plus a hash of the current segment of video.

PreviousToken: HASH_TEXT
CurrentBlob: HASH_TEXT
Timestamp: XXX GMT
TrustedTimestampSignature: BLAH BLAH BLAH

They transmit

PreviousToken: HASH_TEXT
CurrentBlob: HASH_TEXT

to the trusted server, who responds with

PreviousToken: HASH_TEXT
CurrentBlob: HASH_TEXT
Timestamp: XXX GMT
TrustedTimestampSignature: BLAH BLAH BLAH

and this resulting token is guaranteed to have been produced prior to the time written there by the 3rd party timestamp server.

The above is then signed by the trusted hardware

PreviousToken: HASH_TEXT
CurrentBlob: HASH_TEXT
Timestamp: XXX GMT
TrustedTimestampSignature: BLAH BLAH BLAH
Latency: ZZZ nanoseconds
MaxLatency: YYY nanoseconds
HardwareFailures: QQQ
TrustedHardwareSignature: BLAH BLAH BLAH

where the trusted hardware promises that the video blob was produced by the video hardware within a certain number of nanoseconds of the timestamp from the 3rd party server being placed on it.

Then the hardware and software proceeds to record the next segment, which in turn uses a hash of the above to link it to the previous segment.

When you are all done, you transmit one token to the proctor:

PreviousToken: HASH_TEXT
CurrentBlob: HASH_TEXT
Timestamp: XXX GMT
TrustedTimestampSignature: BLAH BLAH BLAH
Latency: ZZZ nanoseconds
MaxLatency: YYY nanoseconds
HardwareFailures: QQQ
TrustedHardwareSignature: BLAH BLAH BLAH

From this, you cannot get the video the student produced.

But if the student produces that video later, plus the tokens that where not transmitted, the proctor can prove that the video provided was recorded during the exam, was continuous, and was from trusted hardware.

I included enough information in my token that if a technical problem happened (there was a network outage that was long enough to make the security not work, for example), the proctor can determine that this happened from the metadata.

So if someone tries to cheat by inducing networking errors or hardware failures, this shows up before investigation for cheating from other evidence. And if there is such a failure, they can get the student to do another exam and ignore the contents of the failed one, without even looking for other signs of cheating, based on whatever criteria they choose.

Alternatively, your system could just treat any hardware failures, or communication latency beyond a certain value, as a refusal to continue to sign the tokens.

Answer 10

In CCTV systems there is a method called Watermark. Watermark is a digital signature and when talking in the CCTV area, usually a word or a sentence which would be present in the recorded video.

It is possible to see digital watermark that confirms authenticity and integrity of signal holder and shows owner’s identity using a software which is provided by the manufacturer of the CCTV system.

Taking Dahua devices for example, on the next screenshot you can see how one can configure watermark string.

Now, when recorded video data is edited, when checking the Watermark string with the appropriate software, watermark would be false and that would be the proof.

Answer 11

Here's one Idea: At the end of the exam when the student submits the answers ask him to also submit a hash (md5sum, sha etc.) Of the video recording itself.

Assuming you put a time limit say 5 mins within which he must submit the hash any editing he does after that on the recording will change the hash.

Should be pretty low overhead to impliment. Maybe set up a Google form to upload the hash.

On the other hand the biggest challange I have faced is more physical: how do you ensure that the video cameras even if multiple have a 100% coverage? What if the student sets up something eg a display beyond the field of view to cheat.

Answer 12

I propose a more tactical solution than technical.

We need to juxtapose video of the User with that of realtime verifier to ensure user and verifier always go hand in hand. This would ensure user is not the sole creator of all parts of the video.

University streams a video of say random long codes changing at regular intervals. This streaming starts with exam and ends with exam at predefined time or when user requests for one. University records all the codes and timestamp in their servers for verification. Let's call this verifier stream or video

This verifier video is live streamed or recorded along with User activities. Now there are two components of the video : one owned by user and another owned by university.

This unified video is now used to validate if user uploaded an unedited video. ASCII codes are rather easy for ocr to detect. In case quality or orientation of video is an issue, a test run could be performed before real test to ensure everything works good.

Initial verification of user that its human and not some recorded agent could be performed like we use captcha today. User is asked to perform certain activities in realtime which reasonably only a human could perform (say gestures, or speak certain answers). Once the user is verified, it can start with the exam.

In case user already has the problem statement and its not a surprise test (where problems are shared at the start of exam), a user maybe asked to write down some realtime generated codes which are tied to timestamps .