Patent Description:
Digital watermarking is the method of embedding data into digital multimedia content. The watermarking may be used to verify the credibility of the content or to recognize the identity of the digital content's consumer. Digital watermarking may be used for copyright protection, and/or for tracking a pirated content distributed by an unauthorized distributor. In some cases, to render a digital watermark ineffective, distributers of a pirated content utilize a collusion attack. The collusion attack may combine several media copies together to produce a new copy. For example, video frames of videos distributed to different consumers may be combined to produce a new video copy. To deter collusion attacks, anti-collusion codes may be incorporated into multimedia content, and when such codes are detected in a copy of the multimedia content, these codes may be used to determine a probability that a given consumer of the multimedia content is involved in a collusion attack.

Using anti-collusion codes and digital watermarking enables distributors of multimedia content to embed a digital identification into multimedia content, where the content may include digital images, video data, and audio data. Anti-collusion codes and digital watermarks may be imperceptible to humans reviewing the content but can be detected by computers, routers, and various data processing devices. For instance, a digital watermark and anti-collusion codes may be easily embedded into a copy of a confidential document or a copy of a video streaming signal, as the copy is being created and/or distributed.

The data contained in a digital watermark may include identifiable information about a recipient, such that a copy of the multimedia content that is intentionally leaked and distributed may be traced back to the recipient. Additionally, distributors of multimedia content can use network detectors to check for digital watermarks within documents, images, video, and audio data, and to disrupt attempts to upload the watermarked content to the web or forwarding it in an email. Similarly, as describes above, data contained in anti-collusion codes extracted from multimedia content marked with such anti-collusion codes may be used to determine a probability that the multimedia content was distributed to a given recipient, thus allowing distributors of multimedia content to disrupt attempts to illegally share content that contains the anti-collusion codes.

Identifying recipients of multimedia content based on embedded watermarks and anti-collusion codes faces many challenges. For example, a large number of anti-collusion codes may be required to effectively determine one or more recipients of multimedia content when the content is modified via a collusion attack.

The disclosed systems and methods for distributing and identifying content containing anti-collusion codes and digital watermarks address one or more of the problems set forth above and/or other problems in the prior art.

<CIT> discloses a method which involves updating a score that indicates whether a receiver is a colluding-receiver based on a fingerprint-code and suspect-code for the receiver, where the colluding-receiver is provided with version of watermarked source item, of a content.

<CIT> discloses a method which involves transmitting particular version of multiple requested segments to a requesting device. A communication network is monitored to obtain disseminated version of real-time content. A determination is made to check whether the obtained real-time content includes unique sequence of segments based on characteristics of the obtained real-time content. Multiple actions are initiated to thwart dissemination of the real-time content upon the determination that the real-time content includes unique sequence of segments.

The foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the claims.

The accompanying drawings are not necessarily to scale or exhaustive. Instead, the emphasis is generally placed upon illustrating the principles of the embodiments described herein. These drawings, which are incorporated in and constitute a part of this specification, illustrate several embodiments consistent with the disclosure, and, together with the detailed description, serve to explain the principles of the disclosure. In the drawings:.

Reference will now be made in detail to exemplary embodiments discussed with regard to the accompanying drawings. In some instances, the same reference numbers will be used throughout the drawings and the following description to refer to the same or like parts. Unless otherwise defined, technical and/or scientific terms have the meaning commonly understood by one of ordinary skill in the art. The disclosed embodiments are described in sufficient detail to enable those skilled in the art to practice the disclosed embodiments. It is to be understood that other embodiments may be utilized and that changes may be made without departing from the scope of the disclosed embodiments. Thus, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting.

The disclosed embodiments relate to systems and methods for identifying a device that received digitally marked content, such as multimedia content. Additionally, the disclosed embodiments relate to systems and methods for distributing digitally marked content to user devices. The multimedia content can include video, image, audio data, 3D graphical objects, texts, software codes, network streams, XML data, or any other suitable binary or text data. For digitally marking multimedia content, any suitable computer-based models may be used, such as, for example, machine-learning techniques.

Digital marking may include any suitable digital markings for marking multimedia content. For example, the digital markings may include anti-collusion codes or any other suitable digital watermarks that may be undetectable during playback of the multimedia content. In many cases, digital watermarking (herein, also referred to as watermarking) may be a first line of defense for combating multimedia content piracy. Since, in many cases, the multimedia content may be a video, for the brevity of description, the term "video" may be used for describing multimedia content with the understanding that methods and systems described in this disclosure may be equally applied for other suitable multimedia content.

In some example embodiments, the system for watermarking content is a content processing system which is a computer system that includes a processor and a memory for storing instructions. The content processing system obtains identifiable information associated with a user device (also referred to as a device identification) configured to receive content and generate a digital watermark reflecting the identification of the device. In an example embodiment, the identifiable information associated with the user device may include a machine code, an IP address, a type of device (e.g., a laptop, a smartphone, a router, etc.), a location of the device (e.g., GPS coordinates, address of the location, and the like). In some embodiments, the content processing system obtains identifiable information associated with an account of the user that is used for the authentication of the user device. The identifiable information associated with the user account may be a user ID, a user email, a user name, an image of the user, a user address, a user financial information (e.g., a user credit card number, a bank account number, and the like) or any other suitable identifiable information related to the user.

In some example embodiments, the content processing system is configured to generate a digital watermark that is associated with the identification of a user device or the identifiable information related to an account of the user. The watermarked content reflects the receiver (e.g., a user receiving the multimedia content, a device for receiving the content, or a user account for receiving the content) of the content, and the receiver of the content is identified based on the detected watermark within the content. The content processing system generates a digital watermark using any suitable technique (e.g., using a machine-learning model, such as, for example, a neural network). In an example embodiment, the content processing system receives an identification for a user device (e.g., a user device MAC address) and associates a watermark with the identification. The association of the watermark and the identification may be stored in a database for a future reference. When content is a video, the content processing system may output a watermark that may be a bit data embedded in several frames of the video, audio soundtrack for the video, or metadata for the video.

In various embodiments, watermarking multimedia content may be head-end based. The head-end based watermarking refers to an approach in which multiple copies of the multimedia content are generated with each segment copy including a different watermark. A segment of the multimedia content may encode one bit (which means there can be two different copies of each segment). For example, a first copy of a segment may contain bit "<NUM>", and a second copy of a segment may contain bit "<NUM>". When multimedia content is requested by a user device, the device may receive a unique combination of segments from the two copies of the content. In an example embodiment, the segments may be determined by a unique manifest file transmitted to a user device, with a unique combination of segments reflecting the identity of the user device.

It should be noted that the content processing system may include any other suitable information that may be associated with the watermark and retrieved based on the watermarked content using a specialized application. For example, the information associated with the watermark may include transmission-related information (e.g., time of transmission, network information, encoding type for the content, information related to the content processing system, devices used to facilitate transmission such as routers, edge computing systems, processors, memory devices, servers, and the like). Additionally, the information associated with the watermark may be related to the content. For example, the information may include the content classification (e.g., video, image, audio, software, code, script, article, etc.), the keywords associated with the content (e.g., a title of a video if the content is a video), the size of the media, or any other suitable characteristics of the media (e.g., the duration of the media for the media being an audio or video), a public key associated with the content processing system that can be used to encrypt messages received by the content processing system, and the like.

The content processing system may include more than one watermark in the content. For example, when watermarking multimedia content containing multiple media (e.g., a video containing video frames and an audio signal), a first watermark may be embedded into one or more video frames and a second watermark may be embedded into an audio signal. It should be understood that any number of watermarks containing any suitable information may be used to watermark the multimedia content. After including the digital watermark, the content processing system is configured to transmit the watermarked content to the user device for the playback. For example, the content processing system may include software that, when executed by a processor, performs internet-related communication (e.g., TCP/IP) and transmits the watermarked content to the user device.

In various embodiments, the digital watermark is embedded in the multimedia content and is not visually observable during playback/display of the watermarked multimedia content. For example, the digital watermark may be a single bit (or few bits) placed within an image frame of the multimedia content. In an example embodiment, a digital watermark may be bit data placed within an audio signal of multimedia content containing audio. The embedded digital watermark may enable tracking of transmission of the watermarked content to a user device, as it contains identifiable information associated with the user device.

Depending on the application of digital watermarking, the watermarking system is designed to address the trade-off problem resulting from competition among watermark capacity, robustness, watermark imperceptibility, and computational costs associated with the digital watermarking.

The content processing system may be a computing system that is a part of a network system for distributing content. An example network system <NUM> is shown in <FIG>. Network system <NUM> includes a server <NUM>, a set of edge computing systems <NUM> communicatively connected to server <NUM> and user devices <NUM>. <FIG> shows, for example, an edge computing system <NUM> connected to a device <NUM> and an edge computing system <NUM> connected to a device <NUM> and a device <NUM>. In an example embodiment, <FIG> shows a content processing system <NUM> as a part of server <NUM>. System <NUM> includes one or more processors <NUM>, a memory <NUM> for storing programming instructions, and an interface <NUM> for modifying programming instructions and controlling various parameters of system <NUM>. In some embodiments, a content processing system is part of an edge computing system. For example, a content processing system <NUM> is shown to be a part of system <NUM>. System <NUM> includes one or more processors <NUM>, a memory <NUM> for storing programming instructions, and an interface <NUM> for modifying programming instructions and controlling various parameters of system <NUM>.

In some embodiments, content processing system <NUM> (or system <NUM>) communicates with a database, such as a database <NUM>, as shown in <FIG>, for storing content, including, for example, the multimedia data, and any other relevant data related to processing multimedia content. For example, other relevant data may include profile data of various users of system <NUM> that can include user multimedia preferences, user authentication information, or any other user related information (e.g., links to other users, and the like). As described above, content processing system <NUM> and <NUM> include at least one processor (e.g., processors <NUM> and <NUM>) for performing various tasks, such as receiving communication data from edge computing system <NUM>, decrypting the communication data, for cases when the data is encrypted, analyzing the communication data (e.g., determining what type of multimedia is being requested by a user device, authenticating the user device, and the like), retrieving multimedia content requested by the user device, and processing the content. Processing the retrieved content includes watermarking the content, including embedding anti-collusion codes in the content, encoding and/or encrypting the content, and/or transmitting the processed content to one or more edge computing systems. Alternatively, the content is transmitted to one or more edge computing systems (e.g., system <NUM>), and system <NUM> processes the content, as described above. In some cases, some of the steps of content processing may be done by system <NUM>, and other steps may be done by system <NUM>. For example, system <NUM> may watermark the content and embed anti-collusion codes in the content, while system <NUM> may encode the content.

In an example embodiment, as shown in <FIG> encrypted communication data <NUM> is communicated to server <NUM> that includes a request for multimedia content by device <NUM>. Server <NUM> retrieves multimedia content <NUM>, encodes and encrypts content <NUM> and communicates content <NUM> to edge computing system <NUM>. Edge computing system <NUM> decrypts and decodes at least a portion of the encrypted and encoded content <NUM>, generates anti-collusion codes and a digital watermark, and includes the anti-collusion codes and the digital watermark into the decrypted and uncompressed portion of the content. In one embodiment, system <NUM> communicates with device <NUM> using data packages <NUM> to obtain identifiable information (e.g., device identification, account-related information, or user-related information as described above) and includes the identifiable information into the digital watermark. <FIG> shows content <NUM>, <NUM> that are used for data exchange between server <NUM> and edge computing systems <NUM> and <NUM>, and data packages <NUM>, <NUM>, and <NUM> used for exchanging data between edge computing systems <NUM> and user devices <NUM>.

An example embodiment of a process 170A for processing multimedia content is shown in <FIG>. Content 171A is processed by a computer-based software application <NUM> configured to watermark content 171A and embed anti-collusions codes in content 171A. As an exemplary input, application <NUM> may take a device identification number (a device ID <NUM>, as shown in <FIG>), as well as content 171A. For example, device ID <NUM> may be used as data to be embedded into a watermark for content 171A. Application <NUM> processes content 171A by watermarking the content and embedding anti-collusion codes in content 171A, and outputs processed content 171B. Content 171B may be encoded by an encoder <NUM>, and after being encoded, may be packaged by an adaptive bitrate (ABR) packager (e.g., just-in-time packager), such as an ABR packager <NUM>. In an example embodiment, encoder <NUM> may generate several ABR streams, and ABR packager <NUM> may provide sequentially arranged segments of ABR streams to user device <NUM> via a content distribution network.

It should be noted that in some cases, process 170A may be altered, as shown in <FIG>, by a modified process 170B. In this example, content 171A is first encoded by encoder <NUM>, and encoded content 171C is processed by application <NUM>. As before, application <NUM> may take as input device ID <NUM>. In some cases, application <NUM> may partially decode the content 171C in order to watermark content 171C and to embed anti-collusion codes into content 171C resulting in a processed content 171D. Content 171D may then be packaged by ABR packager <NUM>. In an example embodiment, ABR packager <NUM> may re-encode content 171D to generate several ABR streams to provide sequentially arranged segments of ABR streams to user device <NUM> via a content distribution network.

Aspects of the present disclosure relate to a system and method for identifying a receiving device. In an example embodiment, the receiving device may be any of user devices <NUM>, as shown in <FIG> configured to receive a video. A video receiving device includes a unique device identification, which is any suitable device identification as described above.

In some embodiments, system <NUM> of server <NUM> (or system <NUM>) may be configured to identify a video receiving device by analyzing various videos collected (also referred to as harvested) by system <NUM>. In an example embodiment, system <NUM> (or system <NUM>) may be configured to include a web crawler (e.g., an Internet bot) that may systematically browse the World Wide Web or any suitable network, peer-to-peer communications, and the like to obtain various video files being distributed by accounts of various users of being shared/exchanged by various users. System <NUM> (or system <NUM>) may be configured to collect videos for a corresponding user account (or related to a particular video-distributing party) and analyze the videos to determine which device (herein referred to as a video receiving device) may be involved in the distribution of such videos. Various aspects of a method of determining the video receiving device are further described below.

Identifying a video receiving device by analyzing one or more videos includes identifying a watermark within the one or more videos, and determining a device identification from the watermark. As described above, digital watermarking may be a first line of defense for combating multimedia content piracy, and may allow for the determination of the video receiving device. However, a collusion attack may prevent determining a watermark contained within a video. A collusion attack, as described above, may include combining multiple copies of the same video that was distributed to different user devices, so as to produce a new copy of the video. The operations used during the collusion attack may include but are not limited to averaging of data in video frames of one or more video copies, creating a new copy of the video by assembling video data from multiple video copies, and the like. A collusion attack may be effective in altering watermarks presented in various video copies such that the altered watermarks may not be extracted from the new copy of the video obtained using the collusion attack. A collusion attack may be characterized by a number of colluders engaging in the collusion attack. For example, a number of video copies that are used to create a new video copy may correspond to the number of colluders. Since the number of colluders is typically not known, when determining whether a collusion attack has happened, a method for identifying a video receiving device may assume a suitable number of colluders (e.g., two, three, four, five, six, seven, eight, nine, ten, eleven colluders, and the like). In some cases, system <NUM> (or system <NUM>) may be configured to analyze hardware (which may be determined by analyzing the pirated video) that may be used by a pirate (or a group of pirates) to determine a possible number of colluders (e.g., the number of colluders may correspond to a number of HDMI ports available for the hardware).

As described above, in order to deal with the collusion attacks, anti-collusion codes were invented. The anti-collusion codes correspond to a particular type of watermark payload that allow identifying users involved in the collusion attack. For example, the anti-collusion codes may be used for calculating a score, and then for calculating the probability of a user who has this score to be part of the pirate coalition. The anti-collusion codes may include generating a new identification (ID) for each user device and/or each video distributed to each user device. Such ID may also be referred to as a codeword. In an example embodiment, a codeword may be retrieved from a pirated copy, and a score and a corresponding probability may be calculated for a video receiving device based on the codeword. The probability can be calculated either by theoretical equations or by using empirical results based on a Monte Carlo simulation, which in practice may give better results (meaning that a shorter code is required in order to be resistant against a certain number of colluders, for a given population size).

In some cases, if a score for a video (or several videos) for a user device does not indicate with a sufficiently high probability that the user device is engaging in pirating the video (or several videos), the user device may be ignored. Alternatively, the device may be identified as a pirating device. Additionally, a user device may be determined to be a suspicious device depending on the value of the score for a video (or several videos) for the user device. When a device is determined to be suspicious, the additional anti-collusion characters may be used (such characters may be obtained from other video segments) to further improve the determination of the probability that the user device is a pirating device.

One way to probabilistically (i.e., with some measurement of assurance) determining that a video is distributed by a specific video receiving device (i.e., the video receiving device is involved in pirating the video) may be obtained using anti-collusion codes, such as, for example, Tardos codes. In example embodiments, a digital watermark (that in some cases may be generated to include anti-collusion codes) may include a plurality of characters (including any suitable characters such as digits, letters, and the like) that may be inserted into multimedia content in any suitable way. For example, the watermark data may be bit data such as zeros and ones inserted into video, audio, image, or binary data. In an example embodiment, the bit data may be inserted into frames of a video. Alternatively, the data may be inserted for a video segment that may contain multiple frames. For example, the data may be inserted into the first frame of a video segment. In some cases, a single bit (e.g., "<NUM>" or "<NUM>") may be inserted in a frame of a video. The number of characters (or bits) inserted into video frames may be referred to as a code length, a payload length, or a codeword (the codeword being all the characters inserted in a given video). In various embodiments, the code length may be desired to be as short as possible while still allowing for determining a probability that the video is distributed by a specific video receiving device.

In an example embodiment, a choice of which character (e.g., "<NUM>" or "<NUM>") is inserted for a particular video segment is determined by a suitable probability value. For example, insertion of code "<NUM>" for a particular video segment i for a video copy j distributed to a user device J may be given by a probability value pi, and insertion of code "<NUM>" for segment i and a video copy j (distributed to device J) may be given by a probability value <NUM> - pi. For instance, for video copy j, if pi = <NUM>, then a random number generator may be configured to generate "<NUM>" with a probability <NUM> and "<NUM>" with a probability of <NUM> for the ith segment. The generated anti-collusion code then may be inserted into multimedia content as a watermark.

In various embodiments, the digital watermark may be embedded into a video using either a "standard" approach or an "anti-collusion" approach. When using a standard approach, for each user device with the user device ID, a digital watermark may be embedded one bit after another, with each bit embedded in a segment of a video that is distributed to the user device. For example, for the ith segment, a process of embedding a digital watermark may include embedding a value of the ith bit of the user device ID (i.e., using a head-end based watermarking approach discussed above, when the bit value is "<NUM>" we use the first copy of a video with the embedded bit "<NUM>", and when the bit value is "<NUM>", we use the second copy of this segment, in which "<NUM>" is embedded).

In some cases, a process of embedding the digital watermark may include encoding the same bit in more than one segment (e.g., two segments). In such a case, the process may include embedding the ith bit of the ID in the ith and ith + <NUM> segments. Additionally, or alternatively, for digital watermarking robustness, it may be preferred to embed the same watermark characters into multiple frames of a video to ensure that watermark may be identified even when some of the video frames are removed in a pirated video.

When using an anti-collusion approach, for each video a process of embedding a digital watermark may include defining a set of probabilities pi for each ith segment, and determining the bit value "<NUM>" or "<NUM>", based on the probability value. In an example embodiment, the bit values "<NUM>" and "<NUM>" form a codeword for which a user device ID may be associated. Similar to a standard approach described above, in some cases, a process of embedding the digital watermark may include encoding the same bit in more than one segment. In various embodiments, anti-collusion codes may be essentially unique for a given video received by a given device, as the probability of two devices having the same anti-collusion code for a given video is negligibly small. Also, if, in rare cases, any two anti-collusion codes are the same, a seed value that is used for generating anti-collusion characters may be modified to ensure that anti-collusion codes are different. Additionally, besides embedding anti-collusion codes, a code for identifying a user device may be embedded before an anti-collusion code. Such a code may be used for cases when there is no collusion, and a pirate may be determined by identifying this code.

For a motivation, one can observe that having "<NUM>" for segment i in a pirated copy makes a device J that receives video copy j more suspicious when a video copy j has "<NUM>" for segment i, and less suspicious otherwise. Clearly, having a "<NUM>" in the pirated copy for segment i where only a few devices that received video copies that have that digit (i.e., digit "<NUM>" for a corresponding segment i of video copy j ) makes these videos even more suspicious. In an example embodiment a choice for probability value pi may be biased towards values close to zero or one.

In some cases, in order to determine with an adequate measure of assurance (i.e., with sufficiently high probability, such as the probability of <NUM>, <NUM>, <NUM> and the like) that a video is distributed by a video receiving device, the video may include a large number of symbols (also for clarity referred to as anti-collusion symbols or anti-collusion characters) that form an anti-collusion code. In various embodiments, anti-collusion codes may be used to identify a user who may be engaged in submitting copyright videos to one or more pirate sites. The number of the anti-collusion symbols for establishing that a video is distributed by a video receiving device depends on a number of colluders. The dependency is quadratic. For example, if the number of pirates doubles, the code length should be four times larger. The size of a code length may require using long video segments or multiple video segments. For example, a table below illustrates a number of anti-collusion symbols in the column "Code Length" corresponding to a number of colluders, as shown in the column "# Colluders. " A column "Total Time (minutes) indicates how much video time is needed to embed the anti-collusion symbols of an anti-collusion code of a given code length. The total time column assumes that one watermark character is embedded per a video segment and that each segment is five seconds long.

The present disclosure also addresses the problem of having too many anti-collusion symbols (represented, for example, by bits of data such as "<NUM>" and "<NUM>") in a single video by distributing anti-collusion symbols across multiple videos (or across any other suitable multimedia content, such as audio data). Multiple videos distributed by an account of a user may be treated as a single "long video," and the anti-collusion codes of the long video may be used for calculating an aggregated probability that at least some of videos distributed by the account of the user are distributed by an identified video receiving device. A motivation for using multiple videos as an effective single video is based on typical approaches used by pirates to pirate multimedia content such as videos. For example, a pirate may typically upload pirated content continuously over an open Internet or private networks (for cases when a pirate uploads a single video, the necessity of identifying the pirate may be sufficiently low to not warrant the use of computer resources for identifying the pirate).

Furthermore, videos that may be continuously uploaded by a pirate may have one or more common characteristics that may correspond to patterns found in a pirate's behavior. Such characteristics may be found in all, most, or some of the videos distributed by a pirate (i.e., distributed from an account of a user associated with the pirate). For example, a pirate may use the same commercial encoder with the same configuration to re-encode the pirated uncompressed content, and/or a pirate may upload their stolen content to the same web sites or the same set of private networks. Other common characteristics may be a common genre associated with distributed videos, or a common one or more shows depicted in the distributed videos. Any other common characteristics may be identified (e.g., if a video has a mark associated with a pirate, or if a pirate distributes videos with a particular type of modification (e.g., stretched videos, zoomed videos, videos with a modified sound, and the like). In an example embodiment, the method includes identifying at least one common characteristic for at least some of the videos from the plurality of videos. The common characteristic may be an encoder used for encoding at least some of the videos, a website for hosting at least some of the videos, or a private network for distributing at least some of the videos.

Aspects of the method for identifying a video receiving device include identifying the device using anti-collusion codes. The anti-collusion symbols may be inserted into segments of a video V transmitted to a user device U, and may reflect an identification of user device U (herein referred to as a user device ID). Further, the anti-collusion code may be unique for a video V. For a given video V, and device U an anti-collusion identification (ACID) codeword may be used. The codeword may include characters "<NUM>"s and "<NUM>"s. In various embodiments, the following requirements may be satisfied (<NUM>) for a certain user device U, the corresponding ACID for a first video (e.g., video V<NUM>) may be different than the one used for a second video V<NUM>, and (<NUM>) for a video V, an ACID for a first user (e.g., user U<NUM>) should be different than the one used for a second user (e.g., user U<NUM>). In an example embodiment, requirements (<NUM>) and (<NUM>) can be achieved by using numerical characteristics for video V and user U (e.g., numerical characteristics may be unique identifiers for video V and user U) as a seed for the pseudorandom generator. In an example embodiment, an ACID should be encoded in a watermark that is embedded in a video V for user U.

Additionally, aspects of the present disclosure include embedding non-anti-collusion codes. Such codes may enable a fast detection in a case when the pirate is not part of a coalition of colluders.

Aspects of the method for identifying a video receiving device includes obtaining a plurality of videos containing anti-collusion codes, the plurality of videos distributed by an account of a user (e.g., a YouTube account, Vimeo account, or any other suitable identifiable account, video channel, message channel, peer-to-peer participant, and the like). In some embodiments, the method includes calculating an aggregated probability that a device is a video receiving device for the plurality of videos, wherein the aggregated probability is calculated based on the anti-collusion codes contained in the plurality of videos. For example, an aggregated probability may be calculated using all of the anti-collusion symbols obtained in the plurality of videos. When the aggregated probability is above a threshold value, the method may include identifying the device as the video receiving device for receiving at least some videos from the plurality of videos. In various embodiments, a threshold value may be a value sufficiently close to one. For example, the threshold value may be <NUM>, <NUM>, <NUM>, <NUM>, or may be given by <NUM> - ε, where ε is a small number (e.g., <NUM>E - <NUM>) and may correspond to an acceptable false-positive value. It should be noted that the aggregated probability is calculated to ensure that we can detect the video receiving device identification (device ID) after the plurality of videos were altered via the collusion attack.

In some embodiments, obtaining a plurality of videos that include digital watermarking includes obtaining a video from an account of a user, processing a video to determine if the video contains digital watermarks, and associating the video with the plurality of videos if the video contains the digital watermarks. In various embodiments, determining whether the video includes digital watermarks may use any suitable approach known in the art of digital watermarking (e.g., checking for the existence of a pattern associated with the digital watermark).

In some embodiments, an image recognition software may be used to find an original video corresponding to the obtained video. The image recognition software may be configured to select one or more video frames of the obtained video and identify the corresponding one or more frames of the corresponding original video stored in a database (e.g., database <NUM>, as shown in <FIG>). In some cases, the original video may be determined based on metadata that may be associated with the obtained video (e.g., a name of the obtained video, text data found in the obtained video, size of the obtained video, length of the obtained video, and the like).

An example process <NUM> for identifying a video receiving device (e.g., device U) is shown in <FIG>. For an illegal copy of a video V (for example, which was found on the internet by an appropriate search operation performed by, for example, a web crawler), the following list of steps may be performed by process <NUM>. At step <NUM>, process <NUM> determines if non-anti-collusion codes are present in video V. If non-anti-collusion codes are identified in video V (step <NUM>, Yes), process <NUM> determines if the video receiving device U is identified at step <NUM>. If device U is identified (step <NUM>, Yes), process <NUM> may proceed to step <NUM> and take action against device U. An example action may include blacklisting device U, blacklisting account associated with device U, and the like. Herein, blacklisting may refer to terminating a streaming service for device U and/or account associated with device U. In various embodiments, device U ID may be identified via non-blind (or blind) detection.

Alternatively, if non-anti-collusion codes were not used by a content service provided or if a user device ID cannot be identified from such non-anti-collusion codes (step <NUM>, No), process <NUM> proceeds to step <NUM> and retrieves anti-collusion codes found in video V (only videos that have anti-collusion codes may be considered, and the ones that do not have anti-collusion codes may be discarded).

At step <NUM>, process <NUM> checks if video V was previously processed (e.g., by checking whether previous records indicate that the video was processed). Such a check may be useful since processing the same video copy with the same watermark multiple times may increase the probability of false positives. In an example embodiment, a certain number of bits (e.g., five percent, ten percent, twenty percent, thirty percent of the bits, and the like) of video V may be different from bits of any other video that was previously processed to determine that video V was not previously processed. If video V was previously processed (step <NUM>, Yes), process <NUM> is terminated. Otherwise, (step <NUM>, No) process <NUM> continues to group of steps <NUM>-<NUM>. At step <NUM> for every user device U, an anti-collusion score S(U, V) (e.g., Laarhoven score) is calculated. Herein, score S depends on user device U, and video V. At step <NUM>, a probability P(S(U, V); C, L, N) that user device U is illegally distributing video V (i.e., device U is a pirate) is computed. Probability P depends on calculated score S, a number of colluders C, a code length L, and a number of user devices N for receiving video V. In some cases, probability P may be computed using a mathematical equation, and in other cases, the probability may be computed using Monte Carlo simulations. For example, Monte Carlo simulations may be computed for each set of parameters (e.g., number of colluders, numbers of users, a code length, and the like). In an example embodiment, colluders may be chosen randomly, and the anti-collusion score may be calculated for each user. Such a process of selecting colluders and calculating anti-collusion scores may be repeated multiple times (e.g., one to ten million times) with different users chosen as colluders. In various embodiments, Score S and probability P may be calculated for reasonable values of C (e.g., four, six, seven, eight, nine, ten, or more), which may be selected based on equipment available for recording and distributing multimedia content. At step <NUM>, process <NUM> determines if P is greater or equal to a suspicious threshold (e.g., the suspicious threshold may be in a range of <NUM> to <NUM>). If P is greater than the suspicious threshold (step <NUM>, Yes), process <NUM> proceeds to step <NUM> which includes storing in a database various data associated with user device U and video V, which may include but is not limited to a timestamp determining when this video was found, user device U identification, information about video V (e.g., video V name, or any other suitable identification for video V), values for C, L, and N, and probability value P. At step <NUM>, a score S calculated for user U for video V, as well as encoding parameters for video V such as (CBR/VBR, bitrate, GOP size, B frames existence, resolution, and the like) is stored. Further, at step <NUM>, optionally, a domain name of a website for distributing video V and a genre/type of video V (e.g., video V being News Channel) may be stored.

An example process <NUM> for identifying a video receiving device is shown in <FIG>. At step <NUM>, process <NUM> includes obtaining a plurality of videos from an account of a user, the plurality of videos containing anti-collusion codes, as described above. At step <NUM>, process <NUM> includes calculating an aggregated probability that a device is the video receiving device for the plurality of videos, wherein the aggregated probability is calculated based on the anti-collusion codes contained in the plurality of videos, and at step <NUM>, process <NUM> includes evaluating if the calculated aggregated probability is above a predetermined threshold value. If the aggregated probability is above the predetermined threshold value (step <NUM>, Yes), process <NUM> proceeds to step <NUM> to determine that the device is the video receiving device and take actions against the device (e.g., blacklist the device by preventing the device from receiving any videos from a content distributing network for broadcasting videos). Alternatively, if the aggregated probability is below the predetermined threshold value (step <NUM>, No), process <NUM> may complete without taking any actions against the device.

In various embodiments, calculation of the aggregated probability may not need to be done every time to identify pirated content. For example, when a user device ID may be extracted from a digital watermark, the aggregated probability may not need to be calculated. In various cases, information about a user as well as historical information about content that was previously requested by the user (e.g., movies watched by the user and their score/probability) may be collected and stored in a database. The collected information may be used to calculate the aggregated probability based on anti-collusion symbols found in the plurality of videos consumed by the user.

<FIG> shows an example embodiment of process <NUM> for obtaining a plurality of videos containing anti-collusion codes. At step <NUM>, process <NUM> obtains a video from an account of a user, and at step <NUM>, process <NUM> determines if the video contains anti-collusion codes using any suitable approaches as previously described. If the video contains anti-collusion codes (step <NUM>, Yes), the video is added to the plurality of videos that contain anti-collusion codes. Alternatively, if the video does not contain anti-collusion codes (step <NUM>, No), the video may be ignored/discarded, as shown by step <NUM>.

In some cases, videos obtained from an account of the user is analyzed for determining the presence of a watermark. If a watermark is identified, the method for identifying a video receiving device includes determining based on the watermark a device identification for the video receiving device. If the device identification is obtained, the method may be configured to take action against the device (e.g., blacklist the device).

<FIG> shows an example process <NUM>, that may be configured to first execute process <NUM> and then execute process <NUM>. For example, process <NUM> may be executed to obtain a plurality of videos that contain anti-collusion codes, and such videos may be used for process <NUM>.

<FIG> shows an example process <NUM> for identifying a video receiving device. At step <NUM>, process <NUM> includes receiving a video (e.g., the video may be retrieved from an account of a user, as described above). At step <NUM>, the video is analyzed to determine if it contains a watermark that identifies a user device. If the watermark is found, and if it identifies a user device (step <NUM>, Yes), process <NUM> may take actions against the user device at step <NUM> (e.g., blacklist the user device, as described above). Step <NUM> of process <NUM> may be the same as step <NUM> of process <NUM>. Alternatively, if the watermark is not found, or if the found watermark does not identify a user device (step <NUM>, No), process <NUM> determines if the video contains anti-collusion codes at step <NUM>. If the video does not contain anti-collusion codes (step <NUM>, No), the video may be ignored or discarded at step <NUM>. Alternatively, if the video contains anti-collusion codes (step <NUM>, Yes), process <NUM> proceeds to step <NUM> and calculate an anti-collusion score S and a probability of collusion P for each one of user devices N that are configured to receive videos from a content distributing network (i.e., each one of the devices that are subscribed to a broadcasting service administered by a content distributing network).

In various embodiments, anti-collusion score S may be calculated using any suitable approach known in the art. For example, the score may be calculated using a scoring function as defined for Tardos codes, and anti-collusion score may be calculated using the same approach as used to calculate the score for Tardos codes.

Probability of collusion P may depend on anti-collusion score S, a number of colluders C, a number of anti-collusion codes L, and a number of devices N configured to receive broadcasting service, as previously described. As previously shown, P = P(S(U,Vi); C, L, N) when calculated for a user device U and video Vi. An example calculation of the probability of collusion as a function of score S is shown in <FIG> for values C = <NUM>, L = <NUM>, and N = <NUM>,<NUM>,<NUM>. As seen in <FIG>, as score S increases, probability P approaches one.

Returning to <FIG>, after completing step <NUM>, process <NUM> proceeds to step <NUM>, at which probability P is compared with a suspicious threshold. The suspicious threshold may be any suitable value for probability indicating a likelihood that a device may have been used as the video receiving device. For example, the suspicious threshold may be <NUM>-<NUM> or, in some cases, may include higher or lower values. If probability P is less than the suspicious threshold (step <NUM>, No), process <NUM> may proceed to step <NUM> and ignore or discard the video. Alternatively, if probability P is greater or equal to the suspicious threshold (step <NUM>, Yes), process <NUM> proceeds to step <NUM> and record information related to the device (for which probability P was calculated) to a database.

In an example embodiment, at step <NUM>, any suitable information related to the device is recorded. For example, a timestamp of when a video containing anti-collusion codes, for which probability P was calculated, was found, an identification for the device, an identification for the video, the assumed number of colluders, a number of anti-collusion codes identified the video containing anti-collusion codes, as well as the value of probability P may be recorded. In some cases, a plurality of videos for which it is determined that probability P is higher or equal to a suspicious threshold may also be stored in the database for the device. In some cases, domains for distributing a plurality of videos may be recorded, a genre of the plurality of videos, and various encoding parameters for the plurality of videos such as CBR/VBR, bitrate, GOP size, B frames existence, resolution, and the like.

While not shown as a step of process <NUM>, in some cases, at least some information related to the device (for which probability P was calculated) may be removed from the database. In an example embodiment, the information may be removed based on a time at which the information was added to the database (e.g., the information that is "old" may be removed). The old information may be any type of information that has resided in the database for a predetermined amount of time (e.g., more than ten days, twenty days, thirty days, and the like). In some cases, if for new videos (that have anti-collusion codes and are identified by a system for collecting the videos, such as web crawler, as described above), it is determined that probability P is higher or equal to a suspicious threshold for a given device, the new videos may be added to the database as a part of a record corresponding to the given device, while older videos may be removed from the database. In an example embodiment, if aggregated code length for anti-collusion codes L for all the videos stored in the database for the device is larger than a target effective length L' (i.e., if ΣiLi > L') then some of the older videos may be removed to maintain ΣiLi ≤ L'. Here the sign of summation indicates that summation is over all videos Vi stored in the database, with Li being a number of anti-collusion symbols for a video Vi. The effective length L' may be defined as L' = f · l, where l may be the smallest required anti-collusion code length for identifying a device as the video receiving device, and f may be an appropriate factor, which may be in the rage of <NUM>-<NUM>.

Once probabilities P for a plurality of videos containing anti-collusion codes have been determined, the method for identifying a video receiving device may include calculating aggregated probability, as shown in Fig. 2A, for example, by step <NUM> of process <NUM>. In an example embodiment, aggregated probability Pa for a given device may be calculated as Pa = <NUM> - Πi(<NUM> - P(S(U, Vi); L, C)), where index i indicates that P is a probability calculated for the ith video Vi in the plurality of videos. Herein, expression Pa = <NUM> - Πi(<NUM> - P(S(U, Vi); L, C) is referred to as an aggregated probability expression, and such expression may be used for calculation of the aggregated probability Pa. Thus, calculating the aggregated probability for the device may include calculating a difference between one and a product of a plurality of probabilities, each one of the plurality of probabilities indicating a probability that the device is not the video receiving device for a video containing anti-collusion codes, where the video may be one of the plurality of videos.

In an example embodiment, steps <NUM>-<NUM> of process <NUM> are performed for every device of all devices N subscribed to a broadcasting service. Thus, for every device and a given video, process <NUM> may calculate probability P that the device is the video receiving device for the given video. To indicate that probability P is calculated for a given device and a given vide probability P may be written as P(S(Um, Vi), L, C), with Vi indicating a video for which P was calculated and Um indicating a device for which P was calculated.

<FIG> shows an example process <NUM> for determining if a device is the video receiving device based on the calculated aggregated probability. At step <NUM>, process <NUM> includes calculating aggregated probability Pa for a device (e.g., every device out of N devices subscribed to a broadcasting service), as described above. At step <NUM>, process <NUM> compares aggregated probability Pa and a threshold value, where the threshold value may be a first threshold value. In an example embodiment, the first threshold value may be any suitable value and may be sufficiently close to one. For example, the first threshold value may be given by <NUM> - ε, as described above, where ε is a false-positive value, and may be small (e.g., ε = <NUM>. E - <NUM>). If aggregated probability Pa is larger than the first threshold value (step <NUM>, Yes), process <NUM> proceeds to step <NUM> and take actions against the device as described above (e.g., step <NUM> may be the same as step <NUM>, as shown in <FIG>, or step <NUM>, as shown in <FIG>). If aggregated probability Pa is less than or equal to the first threshold value (step <NUM>, No), process <NUM> proceeds to step <NUM> and determine if the aggregated probability Pa is less than a second threshold.

If aggregated probability Pa is less than or equal to the second threshold value (step <NUM>, No), process <NUM> is configured to proceed to step <NUM> and maintain information related to a device for which the aggregated probability is calculated in a database. In various embodiments, the information may be maintained if at least one probability P(S(Um, Vi), L, C) for at least one video from the plurality of videos is larger than a suspicious threshold as indicated by step <NUM> of process <NUM>, as shown in <FIG>. In some cases, if any relevant information is missing or incorrect in the database, the information may be recorded and/or updated. Notably, provided that process <NUM> has been performed to calculate probabilities P(S(Um, Vi), L, C) (and process <NUM> may be performed before calculating the aggregated probability Pa), at step <NUM>, the information may be updated in the database. For example, the information may be updated if it is different from information previously stored in the database.

If the aggregated probability Pa is greater than the second threshold value (step <NUM>, Yes), process <NUM> is configured to proceed to step <NUM> and check if the plurality of videos includes at least one common characteristic (also referred to as a common pattern), as previously described. In an example embodiment, if at least some of the videos from the plurality of videos include a common pattern (step <NUM>, Yes), process <NUM> proceeds to step <NUM> described above, and if there is not at least a pair of videos that includes a common pattern (step <NUM>, No), process <NUM> proceeds to step <NUM>, as described above. In various embodiments, process <NUM> may include adjustable constants that may define a flow pattern of process <NUM>. For example, a first constant C<NUM> may be associated with a minimum number of multimedia content copies that share one or more common patterns. For instance, C<NUM> may be two, three, four, or any other suitable number. In an example embodiment, if more than C<NUM> videos include a common pattern (step <NUM>, Yes), process <NUM> proceeds to step <NUM>; otherwise, (step <NUM>, No), process <NUM> proceeds to step <NUM>, as described above. Additionally, in some cases, more than one common pattern may be required to be shared by a number of multimedia content copies to proceed to step <NUM>.

Various variations of process <NUM> may be possible. For instance, various common patterns, as described above, may have assigned weights, and such weights may be used to calculate a common pattern score using any suitable analytical means (e.g., algebraic expressions) and/or computer-based models. A common pattern for videos may include using the same commercial encoder with the same configuration to re-encode uncompressed multimedia content, or uploading re-encoded content to the same web sites or the same set of private networks. In some cases, if two common patterns are present, the common pattern score may be larger than when only one common pattern is present. Additionally, or alternatively, some common patterns may have a larger associated weight than other common patterns. If a common pattern score exceeds or equal to a threshold value, process <NUM> may be configured to proceed to step <NUM>, and if the common pattern score is below the threshold value process <NUM> may be configured to proceed to step <NUM>.

In some embodiments, the method for determining from among network-connected devices a particular device likely associated with a theft of distributed content may include determining whether a calculated aggregated probability is above an aggregated suspicious threshold value, and storing information related to the device in a database when the aggregated probability computed for the device is above the suspicious threshold value. In an example embodiment, the aggregated suspicious threshold value may be the same as a suspicious threshold (as used in connection with a description of <FIG>), or it may be larger or smaller than the suspicious threshold. In some embodiments, the aggregated suspicious threshold value may be smaller than the first threshold value (as shown in <FIG>).

Aspects of the present disclosure also include a system for distributing videos to user devices and identifying a video receiving device. The system may be any suitable computer-based system such as, for example, server <NUM>, as shown in Fig. <NUM>. In an example embodiment, server <NUM> may use a processor (e.g., processor <NUM>) to perform various operations such as operations for distributing one or more videos to a user device. Additionally, or alternatively, some of the operations may be performed by edge computing systems <NUM>, as shown in <FIG>. Such operations are described by an example process <NUM>, as shown in <FIG>. At step <NUM>, process <NUM> includes obtaining an identification associated with a user device configured to receive a video. The identification may be any suitable identification, as described above. Process <NUM> proceeds to step <NUM> and generate a watermark for a video, the watermark reflecting the user device identification. The watermark may be generated using any suitable approach, as described above. Process <NUM> then proceeds to step <NUM> at which anti-collusion codes are generated for the video to be delivered to the user device. The anti-collusion codes may include a plurality of characters (e.g., bits "<NUM>" and "<NUM>"). At step <NUM>, process <NUM> provides the video to the user device, with the video having embedded the generated watermark and the generated anti-collusion codes. The anti-collusion codes may be embedded in a video using a probabilistic approach as previously described. In various embodiments, as described before, the watermark is not visually observable during playback of the video containing the watermark.

Additionally, server <NUM> may use a processor (e.g., processor <NUM>) to perform various operations such as operations for identifying a video receiving device. <FIG> shows an example set of operations <NUM> for identifying the video receiving device. The operations may be part of a process of identifying the video receiving device as shown, for example, by processes <NUM>, <NUM>, and <NUM>, depicted in corresponding figures Fig 2A, <FIG>, and <FIG>. Operations <NUM> includes an operation <NUM> for obtaining a plurality of videos from an account of a user, an operation <NUM> for determining whether one of the plurality of videos includes a watermark having a user device identification, an operation <NUM> for determining whether one of the plurality of videos includes anti-collusion codes, an operation <NUM> for calculating a probability indicating that a device is a video receiving device for a video containing anti-collusion codes, an operation <NUM> for calculating an aggregated probability that a device is a video receiving device for a plurality of videos that contain anti-collusion codes. The aggregated probability may be calculated based on the anti-collusion codes contained in the set of videos, as described above. Additionally, operations <NUM> includes an operation <NUM> for identifying a device as the video receiving device for receiving at least some videos from the plurality of videos based on the calculated aggregated probability.

In some embodiments, the method for identifying a video receiving device may include processing a video (e.g., determining whether a video contains a watermark, determining whether the video includes anti-collusion codes, calculating anti-collusion score for the video, calculating a probability for the video and a device that the device is the video receiving device, and the like). The method may include any suitable checks to ensure that the same video is not processed multiple times (or is not processed more than one time). For example, the method may include comparing a video that is about to be processed to previously processed videos, and forgo processing the video if a first set of frames of the video contains substantially the same information as at least one of the previously processed videos. In an example embodiment, the first set of frames may include any suitable number of frames, and such frames may be compared to frames of previously processed videos using any suitable approach (e.g., using an image recognition software as discussed above).

As described above, network system <NUM> may include various devices, such as processors, memory devices, and various client devices. For example, client devices <NUM> may include one or more computing devices configured to perform one or more operations consistent with disclosed embodiments. For example, client devices <NUM> may include a desktop computer, a laptop, a server, a mobile device (e.g., tablet, smartphone, etc.), a set-top box, a gaming device, a wearable computing device, or another type of computing device. Client devices <NUM> may include one or more processors configured to execute software instructions stored in memory, such as memory included in client devices <NUM>, to perform operations to implement the functions related to requesting content, receiving the content, and playing the content. Client devices <NUM> may be configured for wired and/or wireless communications and may include software that, when executed by a processor, performs internet-related communication (e.g., TCP/IP) and content display processes. For instance, client devices <NUM> may execute browser software that generates and displays interfaces including content on a display device included in, or connected to, client devices <NUM>. Client devices <NUM> may execute applications that allow client devices <NUM> to communicate with components over network system <NUM>, and generate and display content in interfaces via display devices included in client devices <NUM>. For example, client devices may display a media player to output content received from edge computing system <NUM>.

The disclosed embodiments are not limited to any particular configuration of client devices <NUM>. For instance, a client device <NUM> may be a mobile device that stores and executes an application for performing operations of requesting, receiving, and playing the content. In certain embodiments, client devices <NUM> may be configured to execute software instructions relating to location services, such as GPS locations. For example, client devices <NUM> may be configured to determine a geographic location and provide location data and time stamp data corresponding to the location data to computing system <NUM>.

Server <NUM> may include one or more computing systems that perform various operations such as storing content, computing compression parameters for the content, providing the content, retrieving the content from database <NUM>, and the like. Server <NUM> may include processors that perform authentication functions of client devices <NUM>, users of client devices <NUM>, and/or resolve client identities based on client IDs and/or a secure token. In some embodiments, server <NUM> may include processors configured to compress video or audio content and packet content in different formats. Further, server <NUM> may include processing devices to resolve URLs. In some embodiments, server <NUM> may include multiple core processors to handle concurrently multiple operations and/or streams. For example, server <NUM> may include parallel processing units to concurrently handle requests of multiple client devices <NUM>.

In some embodiments, server <NUM> may store the original and/or compressed version of content and send copies of the original and/or compressed content to edge computing system <NUM>. For example, server <NUM> may compress an original video file and send it to system <NUM>, which may then store it in the cache. In such embodiments, server <NUM> may allow automatic requests from edge computing system <NUM>. However, in other embodiments, server <NUM> may implement firewalls that only allow a limited number of pull requests or only allow periodic pull requests to update content. Server <NUM> may be configured to automatically handle specific requests from edge computing system <NUM>. For example, when edge computing system <NUM> performs a pull request due to a "cache miss," server <NUM> may be configured to redirect edge computing system <NUM> to a different memory address. In such embodiments, server <NUM> may include a relational database, or other similar data structures, to correlate the pull request from edge computing system <NUM> with an address that has a copy of the content. Further, server <NUM> may include dedicated hardware to perform redirecting operations. For example, server <NUM> may include a simple RISC computer (SRC) architecture, or other reconfigurable computing systems, specifically configured to handle pull requests with "cache miss.

Database <NUM> may include one or more computing devices configured with appropriate software to perform operations for providing content to server <NUM>. Database <NUM> may include, for example, Oracle™ database, Sybase™ database, or other relational databases or non-relational databases, such as Hadoop™ sequence files, HBase™, or Cassandra™. In an illustrative embodiment, database <NUM> may include computing components (e.g., database management system, database server, etc.) configured to receive and process requests for data stored in memory devices of the database and to provide data from the database.

Database <NUM> may be configured to collect and/or maintain the data associated with user accounts and user preferences. For example, database <NUM> may store information about user privileges. Database <NUM> may collect the data from a variety of sources, including, for instance, online resources.

Network system <NUM> may include any type of connections between various computing components. For example, network system <NUM> may facilitate the exchange of information via network connections that may include Internet connections, Local Area Network connections, near field communication (NFC), or other suitable connection(s) that enables the sending and receiving of information between the components of system <NUM>. In some embodiments, one or more components of system <NUM> may communicate directly through a dedicated communication link(s).

As described above, edge computing system <NUM> may transmit content to user device <NUM>. System <NUM> may store content in local memories, such as caching infrastructures associated with system <NUM>, local proxies, and/or the HTTP caching capability. In some embodiments, system <NUM> may perform functions such as routing content, resolving domain systems, handling content requests, and creating sessions with client devices for content delivery. System <NUM> may obtain information from other computing systems (e.g., server <NUM> or computing system <NUM>, as shown in <FIG>), arrange it for client devices, and deliver it to client devices <NUM>. In such embodiments, system <NUM> may be configured to handle multiple streams in parallel, such as providing different data streams to multiple client devices <NUM>. Further, system <NUM> may be configured to provide authentication credentials to client devices <NUM>. For example, system <NUM> may provide a secure cookie, or an equivalent technique for authentication, at a session startup time.

In some embodiments, an edge computing system (e.g., system <NUM>) may take the form of a server, a general-purpose computer, a mainframe computer, or any combination of these components. In other embodiments, edge computing system <NUM> may be a virtual machine. System <NUM> may be configured to communicate with one or more databases, such as database <NUM>, and other elements of system <NUM> either directly or via network connections.

System <NUM> may include one or more storage devices configured to store instructions used by processors of system <NUM> to perform functions related to disclosed embodiments. For example, memory storage devices may store software instructions.

In some embodiments, processors of server <NUM> (e.g., processors <NUM>) may include one or more known processing devices, such as, but not limited to, microprocessors from the Pentium™ or Xeon™ family manufactured by Intel™, the Turion™ family manufactured by AMD™, or any of various processors from other manufacturers. However, in other embodiments, processors <NUM> may be a plurality of devices coupled and configured to perform functions consistent with the disclosure. For example, processors <NUM> may include a plurality of co-processors, each configured to run specific server <NUM> related operations such as floating-point arithmetic, graphics, signal processing, string processing, cryptography or I/O interfacing. In some embodiments, processors may include a field-programmable gate array (FPGA), central processing units (CPUs), graphical processing units (GPUs), and the like.

It is to be understood that the configuration and the functionality of components of system <NUM> have been defined herein for the convenience of the description. Alternative configurations can be defined as long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent.

In various embodiments, there are numerous advantages for inserting anti-collusion codes and watermarks at edge computing systems <NUM> instead of at the server <NUM>. For example, edge computing systems <NUM> may have significantly more critical resources, such as memory (e.g., random access memory (RAM)), and processing power. An edge computing system (e.g., system <NUM>, as shown in <FIG>) may have limited scalability because it needs to support only devices that request content from that system. Further, system <NUM> may be configured to support any device, and system <NUM> may be secure, as it may prevent any individual or software accessing its operational system, applications running on system <NUM>, and any content of system <NUM>. In various embodiments, a digital marking of a video may be stateless (i.e., designed not to remember preceding events or user interactions), and thus, it can be done at any edge computing system independently, without a need for shared memory or for database synchronization. Hence, a mobile device (e.g., device <NUM>, as shown in <FIG>) that changes the connection from one edge computing system to another may get content that contains a digital watermark based on device <NUM> identifiable information (e.g., device MAC address).

The foregoing description has been presented for purposes of illustration. It is not exhaustive and is not limited to precise forms or embodiments disclosed. Modifications and adaptations of the embodiments will be apparent from a consideration of the specification and practice of the disclosed embodiments. For example, while certain components have been described as being coupled to one another, such components may be integrated with one another or distributed in any suitable fashion.

Claim 1:
A method for identifying, from among network-connected devices (<NUM>), a device (<NUM>, <NUM>, <NUM>) likely associated with a theft of distributed content, the method comprising:
obtaining (<NUM>, <NUM>) content (171D), the content comprising a plurality of videos that have been distributed from a device of the network-connected devices and treating the plurality of videos as a single long video;
identifying (<NUM>, <NUM>, <NUM>) anti-collusion codes in the plurality of videos;
calculating (<NUM>, <NUM>, <NUM>) an aggregated probability across the long video using the anti-collision codes identified in the plurality of videos;
determining (<NUM>) that the device of the network-connected devices is likely associated with the theft of distributed content upon determining that:
the aggregated probability exceeds (<NUM>, <NUM>) a first predetermined threshold, or
the aggregated probability equals to or is below (<NUM>) the first predetermined threshold and exceeds a second predetermined threshold, and at least some of the plurality of videos include (<NUM>) at least one common characteristic, the common characteristic being one of a content encoder used to encode the at least some of the plurality of videos in the obtained content, a website for hosting the at least some of the plurality of videos in the obtained content, or a private network for distributing the at least some of the plurality of videos in the obtained content.