Traitor tracing
Encyclopedia
Traitor tracing is a copyright infringement
detection system which works by tracing the source of leaked files rather than by direct copy protection
. The method is that the distributor adds a unique value to each copy given out. When a copy of it is leaked to the public, the distributor can check the value on it and trace it back to the "leaker".
, and evolved from the previous method of activation codes. In this model, software ships with a sticker or label printed on the outside of the software, but inside the package. This number is an encoded serial number
, expanded to a usually large number or string of numbers, digits, and hyphens. When the software is being installed, or the first time it is run, the user is prompted to type in the license code. This code is then decoded back to its base serial number. This process reduces the number in complexity, and the additional information removed by this process is used to verify the authenticity of the serial number. If the user mistypes a single character in what is sometimes a very long code, the software will refuse to install and require them to retype the number until they get it right.
This activation code is generated during the packaging phase of manufacture, so that every user is receiving the same software but a different activation code. If a user performs a "casual copy" of the software for a friend, that friend must have the license code as well as the software to install it on their system. Since the software itself cannot determine that it is a copy, this is a way to beat this basic system.
With the expansion of computer networking, two additional levels of software protection have evolved, "network registration" and "online registration".
being operated by the software manufacturer. The license code is transmitted to the server, and it waits for the server to tell it whether the install should be permitted. The server maintains a database
of all the serial numbers that have been used to install their software. If a single serial number is used on a number of machines (a typical limit would be five machines) then the server tells the software that it is likely a copy and to abort the installation. The user is usually presented with a dialog instructing them to contact the manufacturer.
". In this case, the software, either each time it is used or at some preset interval such as monthly, makes another connection back to the registration server. It does this to check in with the server to see if the serial number it is using has been determined to be one that is being used to install in many places. Serial numbers that have been identified as "pirated" (illegally distributed) are added to a blacklist
on the server, a process referred to as being "burned". Burned serial numbers cannot be used to install or activate the product. Serial number lists are available on the internet that include a large number of valid registration codes for many software titles. It is common for software manufacturers to seek out these lists and invalidate the serial numbers that appear on these lists. This discourages individuals from giving out their registration codes for fear that this code will later be invalidated, disabling the original install of the software the next time that it "phones home".
Some of the more expensive software requires the user to send personal information to the software vendor before receiving the activation code. The activation code is usually a large sequence of numbers and letters, and encodes information including the license serial number, information to ensure the code is valid, and also includes the ability to verify the personal information the user sent to the software vendor. In this way, the user's name or business name must be entered along with the registration code. The registration code will not be accepted by the software unless the user types in the business name exactly as submitted to the software vendor. The business name is usually displayed by the software on its opening banner whenever the software is used. If the customer gives away his activation code it will be useless without his business name, and anyone that uses the activation code must enter it in during the activation process, leaving the original buyer's business name on the banner of the software. This makes it very easy to "trace the traitor" and find the customer that originally gave out their activation code. Since giving away the registration code is a violation of the license agreement, the software vendor may invalidate the user's serial number (disabling that user's software in the process) and may take legal action. This does raise privacy
concerns in some areas.
Copyright infringement
Copyright infringement is the unauthorized or prohibited use of works under copyright, infringing the copyright holder's exclusive rights, such as the right to reproduce or perform the copyrighted work, or to make derivative works.- "Piracy" :...
detection system which works by tracing the source of leaked files rather than by direct copy protection
Copy protection
Copy protection, also known as content protection, copy obstruction, copy prevention and copy restriction, refer to techniques used for preventing the reproduction of software, films, music, and other media, usually for copyright reasons.- Terminology :Media corporations have always used the term...
. The method is that the distributor adds a unique value to each copy given out. When a copy of it is leaked to the public, the distributor can check the value on it and trace it back to the "leaker".
Activation Controls
The practice of traitor tracing is most often implemented with computer softwareComputer software
Computer software, or just software, is a collection of computer programs and related data that provide the instructions for telling a computer what to do and how to do it....
, and evolved from the previous method of activation codes. In this model, software ships with a sticker or label printed on the outside of the software, but inside the package. This number is an encoded serial number
Serial number
A serial number is a unique number assigned for identification which varies from its successor or predecessor by a fixed discrete integer value...
, expanded to a usually large number or string of numbers, digits, and hyphens. When the software is being installed, or the first time it is run, the user is prompted to type in the license code. This code is then decoded back to its base serial number. This process reduces the number in complexity, and the additional information removed by this process is used to verify the authenticity of the serial number. If the user mistypes a single character in what is sometimes a very long code, the software will refuse to install and require them to retype the number until they get it right.
This activation code is generated during the packaging phase of manufacture, so that every user is receiving the same software but a different activation code. If a user performs a "casual copy" of the software for a friend, that friend must have the license code as well as the software to install it on their system. Since the software itself cannot determine that it is a copy, this is a way to beat this basic system.
With the expansion of computer networking, two additional levels of software protection have evolved, "network registration" and "online registration".
Network registration
Software that employs this additional security keeps a copy of the actual serial number being used in the license code. When it is active, it is broadcasting this number on a clandestine channel on the local network. If the software has been installed on another computer on that same network, using the same license code, when the second copy is run it will detect its serial number in use on the network and typically will refuse to run. It may also cause the other copy of itself already in use to close. This prevents a small business from buying one copy of expensive software and installing it on several of the computers at their location, provided they are networked.Online registration
The process of online registration is very similar to activation codes, but adds an additional step. Most modern companies are now not only internally networked, but are also connected to the internet. This allows the software manufacturers to add an additional check to their system during the installation process. When the user enters a valid license code, the software does not immediately install. Instead, it uses the active internet connection to contact a serverServer (computing)
In the context of client-server architecture, a server is a computer program running to serve the requests of other programs, the "clients". Thus, the "server" performs some computational task on behalf of "clients"...
being operated by the software manufacturer. The license code is transmitted to the server, and it waits for the server to tell it whether the install should be permitted. The server maintains a database
Database
A database is an organized collection of data for one or more purposes, usually in digital form. The data are typically organized to model relevant aspects of reality , in a way that supports processes requiring this information...
of all the serial numbers that have been used to install their software. If a single serial number is used on a number of machines (a typical limit would be five machines) then the server tells the software that it is likely a copy and to abort the installation. The user is usually presented with a dialog instructing them to contact the manufacturer.
Steganography
Websites offering subscriber downloads may embed a cryptographic signature in the download, usually in a way that is not readily apparent to the user. For example, an identification number may be embedded in an image, or in metadata such as the date of a file.Other methods
Some software that implements online registration extends this with a process commonly known as "phoning homePhoning home
Phoning home, in computing, refers to an act of client to server communication where a client device or client application software reports its location on a network, the currently logged on user, or any other information to a server computer...
". In this case, the software, either each time it is used or at some preset interval such as monthly, makes another connection back to the registration server. It does this to check in with the server to see if the serial number it is using has been determined to be one that is being used to install in many places. Serial numbers that have been identified as "pirated" (illegally distributed) are added to a blacklist
Blacklist
A blacklist is a list or register of entities who, for one reason or another, are being denied a particular privilege, service, mobility, access or recognition. As a verb, to blacklist can mean to deny someone work in a particular field, or to ostracize a person from a certain social circle...
on the server, a process referred to as being "burned". Burned serial numbers cannot be used to install or activate the product. Serial number lists are available on the internet that include a large number of valid registration codes for many software titles. It is common for software manufacturers to seek out these lists and invalidate the serial numbers that appear on these lists. This discourages individuals from giving out their registration codes for fear that this code will later be invalidated, disabling the original install of the software the next time that it "phones home".
Some of the more expensive software requires the user to send personal information to the software vendor before receiving the activation code. The activation code is usually a large sequence of numbers and letters, and encodes information including the license serial number, information to ensure the code is valid, and also includes the ability to verify the personal information the user sent to the software vendor. In this way, the user's name or business name must be entered along with the registration code. The registration code will not be accepted by the software unless the user types in the business name exactly as submitted to the software vendor. The business name is usually displayed by the software on its opening banner whenever the software is used. If the customer gives away his activation code it will be useless without his business name, and anyone that uses the activation code must enter it in during the activation process, leaving the original buyer's business name on the banner of the software. This makes it very easy to "trace the traitor" and find the customer that originally gave out their activation code. Since giving away the registration code is a violation of the license agreement, the software vendor may invalidate the user's serial number (disabling that user's software in the process) and may take legal action. This does raise privacy
Privacy
Privacy is the ability of an individual or group to seclude themselves or information about themselves and thereby reveal themselves selectively...
concerns in some areas.