Efficient Dynamic Traitor Tracing

Abstract. Traceability schemes allow detection of at least one traitor when a group of colluders attempt to construct a pirate decoder and gain illegal access to digital content. Fiat and Tassa proposed dynamic traitor tracing schemes that can detect all traitors if they attempt to rebroadcast the content after it is decrypted. In their scheme the content is broken into segments and marked so that a re-broadcasted segment can be linked to a particular subgroup of users. Mark allocation for a segment is determined when the re-broadcast from the previous segment is observed. They showed that by careful design of the mark allocation scheme it is possible to detect all traitors. We consider the same scenario as Fiat and Tassa and propose a new type of traceability scheme, called sequential traitor tracing, that can efficiently detect all traitors and does not require any real-time computation. That is, the marking allocation is pre-determined and is independent of the re-broadcasted segment. This is very attractive as it allows segments to be shortened and hence the overall convergence time reduced. We analyse the scheme and give two general constructions one based on a special type of function family, and the other on error correcting codes. We obtain the convergence time of these schemes and show that the scheme based on error correcting codes has a convergence time which is the same as the best known result for dynamic schemes.

“…This is the same order as O(p log N + p 2 /c) which is the best known result [1] for p + c + 1 versions.…”

Section: Theorem 4 Suppose We Havesupporting

confidence: 67%

Section: Ft Schemementioning

confidence: 99%

Section: A Construction Using a Function Familymentioning

confidence: 99%

“…If (2) matches the (r − 1)n + k th row (row (r, k) for short) of (1) in p + 1 positions, then no collusion excluding (r, k), of at most p users, can produce (2).…”

Section: Lemma 1 Suppose There Are At Most P Traitors Letmentioning

confidence: 99%

Section: Time/bandwidth Trade-offmentioning

confidence: 99%

See 3 more Smart Citations

Sequential Traitor Tracing

Wang

2000

Fully Collusion Resistant Traitor Tracing with Short Ciphertexts and Private Keys

Boneh

Sahai²,

Waters

2006

228

267

We construct a fully collusion resistant tracing traitors system with sublinear size ciphertexts and constant size private keys. More precisely, let N be the total number of users. Our system generates ciphertexts of size O( √ N ) and private keys of size O(1). We first introduce a simpler primitive we call private linear broadcast encryption (PLBE) and show that any PLBE gives a tracing traitors system with the same parameters. We then show how to build a PLBE system with O( √ N ) size ciphertexts. Our system uses bilinear maps in groups of composite order.

Revocation and Tracing Schemes for Stateless Receivers

Naor

Lotspiech

2001

799

970

Abstract. We deal with the problem of a center sending a message to a group of users such that some subset of the users is considered revoked and should not be able to obtain the content of the message. We concentrate on the stateless receiver case, where the users do not (necessarily) update their state from session to session. We present a framework called the Subset-Cover framework, which abstracts a variety of revocation schemes including some previously known ones. We provide sufficient conditions that guarantees the security of a revocation algorithm in this class. We describe two explicit Subset-Cover revocation algorithms; these algorithms are very flexible and work for any number of revoked users. The schemes require storage at the receiver of log N and 1 2 log 2 N keys respectively (N is the total number of users), and in order to revoke r users the required message lengths are of r log N and 2r keys respectively. We also provide a general traitor tracing mechanism that can be integrated with any Subset-Cover revocation scheme that satisfies a "bifurcation property". This mechanism does not need an a priori bound on the number of traitors and does not expand the message length by much compared to the revocation of the same set of traitors. The main improvements of these methods over previously suggested methods, when adopted to the stateless scenario, are: (1) reducing the message length to O(r) regardless of the coalition size while maintaining a single decryption at the user's end (2) provide a seamless integration between the revocation and tracing so that the tracing mechanisms does not require any change to the revocation algorithm.