Protected

Interactive

Graphics

Via

Remote

Rendering

Valuable

graphical

models

such

as

high-resolution

digital

scans

of

cultural

heritage

objects

may

require

protection

to

prevent

piracy

or

misuse

while

still

allowing

for

interactive

display

and

manipulation

by

a

widespread

audience

We

have

investigated

techniques

for

protecting

graphics

content

and

we

have

developed

a

remote

rendering

system

suitable

for

sharing

archives

of

models

while

protecting

the

geometry

from

unauthorized

extraction

The

system

consists

of

a

viewer

client

that

includes

low-resolution

versions

of

the

models

and

a

rendering

server

that

renders

and

returns

images

of

high-resolution

models

according

to

client

requests

The

server

implements

a

number

of

defenses

to

guard

against

reconstruction

attacks

such

as

monitoring

and

limiting

request

streams

and

slightly

perturbing

and

distorting

the

rendered

images

We

consider

several

possible

types

of

reconstruction

attacks

on

such

a

rendering

server

and

we

examine

how

these

attacks

can

be

defended

against

without

excessively

compromising

the

interactive

experience

for

non-malicious

users

CR

Categories

I.

-LSB-

Computer

Graphics

-RSB-

Graphics

Systems-Remote

systems

Protecting

digital

information

from

theft

and

misuse

a

subset

of

the

digital

rights

management

problem

has

been

the

subject

of

much

research

and

many

attempted

practical

solutions

Efforts

to

protect

software

databases

digital

images

digital

music

files

and

other

content

are

ubiquitous

and

data

security

is

a

primary

concern

in

the

design

of

modern

computing

systems

and

processes

However

there

have

been

few

technological

solutions

to

specifically

protect

interactive

graphics

content

The

demand

for

protecting

graphical

models

is

significant

Contemporary

digitization

technologies

allow

for

the

reliable

and

efficient

creation

of

accurate

models

of

many

physical

objects

and

a

number

of

sizable

archives

of

such

objects

have

been

created

The

Stanford

Digital

Michelangelo

Project

-LSB-

Levoy

et

al.

-RSB-

for

example

has

created

a

high-resolution

digital

archive

of

large

statues

of

Michelangelo

including

the

David

These

statues

represent

the

artistic

patrimony

of

Italy

's

cultural

institutions

and

the

contract

with

the

Italian

authorities

permits

the

distribution

of

the

models

only

to

established

scholars

for

non-commercial

use

Though

all

parties

involved

would

like

the

models

to

be

widely

available

for

constructive

purposes

were

the

digital

model

of

the

David

to

be

distributed

in

an

unprotected

fashion

it

would

soon

be

pirated

and

simulated

marble

replicas

would

be

manufactured

outside

the

provisions

of

the

parties

authorizing

the

creation

of

the

model

Digital

archives

of

archaeological

artifacts

are

another

example

of

models

often

requiring

piracy

protection

Curators

of

such

artifact

collections

are

increasingly

turning

to

digitization

as

a

way

to

preserve

and

widen

scholarly

usage

of

their

holdings

by

allowing

virtual

display

and

object

examination

over

the

Internet

for

example

However

the

owners

and

maintainers

of

the

artifacts

often

desire

to

maintain

strict

control

over

the

use

of

the

data

and

to

guard

against

theft

An

example

of

such

a

collection

is

-LSB-

Stanford

Digital

Forma

Urbis

Project

-RSB-

in

which

over

one

thousand

fragments

of

an

ancient

Roman

map

were

digitized

and

are

being

made

available

through

a

web-based

database

providing

that

the

models

can

be

adequately

protected

Other

application

areas

such

as

entertainment

and

online

commerce

may

also

require

protection

for

graphics

content

character

models

developed

for

use

in

motion

pictures

are

often

repurposed

for

widespread

use

in

video

games

and

promotional

materials

Such

models

represent

valuable

intellectual

property

and

solutions

for

preventing

their

piracy

from

these

interactive

applications

would

be

very

useful

In

some

cases

such

as

body

scans

of

high

profile

actors

content

developers

may

be

reluctant

to

distribute

the

models

without

sufficient

control

over

reuse

In

the

area

of

online

commerce

a

number

of

Internet

content

developers

have

reported

an

unwillingness

of

clients

to

pursue

graphics

projects

specifically

due

to

the

lack

of

ability

to

prevent

theft

of

the

content

-LSB-

Ressler

-RSB-

Prior

technical

research

in

the

area

of

intellectual

property

protections

for

data

has

primarily

concentrated

on

digital

watermarking

techniques

Over

papers

in

the

last

years

describe

steganographic

approaches

to

embedding

hidden

information

into

graphical

models

with

varying

degrees

of

robustness

to

attacks

that

seek

to

disable

watermarks

through

alterations

to

the

shape

or

data

representation

Many

of

the

most

successful

watermarking

schemes

are

based

on

spread-spectrum

frequency

domain

transformations

which

embed

watermarks

at

multiple

scales

by

introducing

controlled

perturbations

into

the

coordinates

of

the

model

vertices

-LSB-

Praun

et

al.

Ohbuchi

et

al.

-RSB-

Complementary

technologies

search

collections

of

models

and

examine

them

for

the

presence

of

digital

watermarks

in

an

effort

to

detect

piracy

We

believe

that

for

the

digital

representations

of

highly

valuable

objects

such

as

cultural

heritage

artifacts

it

is

not

sufficient

to

detect

piracy

after

the

fact

we

must

instead

prevent

it

The

computer

industry

has

experimented

with

a

number

of

techniques

for

preventing

unauthorized

use

and

copying

of

computer

software

and

digital

data

These

techniques

have

included

physical

dongles

software

access

keys

node-locked

licensing

schemes

copy

prevention

software

program

and

data

obfuscation

and

encryption

with

embedded

keys

Most

such

schemes

are

either

broken

or

bypassed

by

determined

attackers

and

cause

undue

inconvenience

and

expense

for

non-malicious

users

High-profile

data

and

software

is

particularly

susceptible

to

being

quickly

targeted

by

attackers

ACM

Fortunately

graphics

data

differs

from

most

other

forms

of

digital

media

in

that

the

presentation

format

images

is

fundamen-tally

different

from

the

underlying

representation

-LRB-

geometry

-RRB-

Usually

graphics

data

is

displayed

as

a

projection

onto

a

display

device

resulting

in

tremendous

information

loss

for

single

views

This

property

supports

an

optimistic

view

that

graphics

systems

can

be

designed

that

maintain

usability

and

utility

while

not

being

as

vulnerable

to

piracy

as

other

types

of

digital

content

In

this

paper

we

address

the

problem

of

preventing

the

piracy

of

models

while

still

allowing

for

their

interactive

display

and

manipulation

Specifically

we

attempt

to

provide

a

solution

for

maintainers

of

large

collections

of

high-resolution

static

models

such

as

the

digitized

cultural

heritage

artifacts

described

above

The

methods

we

develop

aim

to

protect

both

the

geometric

shape

of

the

models

as

well

as

their

particular

geometric

representation

such

as

the

mesh

vertex

coordinates

surface

normals

and

connectivity

information

We

accept

that

the

coarse

shape

of

visible

objects

can

be

easily

reproduced

regardless

of

our

protection

efforts

so

we

concentrate

on

defending

the

high-resolution

geometric

details

of

models

which

may

have

been

most

expensive

to

model

or

measure

-LRB-

perhaps

requiring

special

access

and

advanced

digitizing

technology

-RRB-

and

which

are

most

valuable

in

exhibiting

fidelity

to

the

original

object

In

the

following

paper

sections

we

first

examine

the

graphics

pipeline

to

identify

its

possible

points

of

attack

and

then

propose

several

possible

techniques

for

protecting

graphics

data

from

such

attacks

Our

experimentation

with

these

techniques

led

us

to

conclude

that

remote

rendering

provides

the

best

solution

for

protecting

graphical

models

and

we

describe

the

design

and

implementation

of

a

prototype

system

in

Section

Section

describes

some

types

of

reconstruction

attacks

against

such

a

remote

rendering

system

and

the

initial

results

of

our

efforts

to

guard

against

them

Figure

shows

a

simple

abstraction

of

the

graphics

pipeline

for

purposes

of

identifying

possible

attacks

to

recover

geometry

We

note

several

places

in

the

pipeline

where

attacks

may

occur

model

file

reverse-engineering

Fig.

-LRB-

a

-RRB-

graphics

models

are

typically

distributed

to

users

in

data

streams

such

as

files

in

common

file

formats

One

approach

to

protecting

the

data

is

to

obfuscate

or

encrypt

the

data

file

If

the

user

has

full

access

to

the

data

file

such

encryptions

can

be

reverse-engineered

and

broken

and

the

geometry

data

is

then

completely

unprotected

Tampering

with

the

viewing

application

Fig.

-LRB-

b

-RRB-

A

viewer

application

is

typically

used

to

display

the

model

and

allow

for

its

manipulation

Techniques

such

program

tracing

memory

dumping

and

code

replacement

are

practiced

by

attackers

to

obtain

access

to

data

in

use

by

application

programs

Graphics

driver

tampering

Fig.

-LRB-

c

-RRB-

Because

the

geometry

usually

passes

through

the

graphics

driver

software

on

its

way

to

the

GPU

the

driver

is

vulnerable

to

tampering

Attackers

can

replace

graphics

drivers

with

malicious

or

instrumented

versions

to

capture

streams

of

vertex

data

for

example

Such

replacement

drivers

are

widely

distributed

for

purposes

of

tracing

and

debugging

graphics

programs

Reconstruction

from

the

framebuffer

Fig.

-LRB-

d

-RRB-

Because

the

framebuffer

holds

the

result

of

the

rendered

scene

its

contents

can

be

used

by

sophisticated

attackers

to

reconstruct

the

model

geometry

using

computer

vision

reconstruction

techniques

The

Figure

Abstracted

graphics

pipeline

showing

possible

attack

locations

-LRB-

a-e

-RRB-

These

attacks

are

described

in

the

text

framebuffer

contents

may

even

include

depth

values

for

each

pixel

and

attackers

may

have

precise

control

over

the

rendering

parameters

used

to

create

the

scene

-LRB-

viewing

and

projection

transformations

lighting

etc.

-RRB-

This

potentially

creates

a

perfect

opportunity

for

computer

vision

reconstruction

as

the

synthetic

model

data

and

controlled

parameters

do

not

suffer

from

the

noise

calibration

and

imprecision

problems

that

make

robust

real

world

vision

with

real

sensors

very

difficult

Reconstruction

from

the

final

image

display

Fig.

-LRB-

e

-RRB-

Regardless

of

whatever

protections

a

graphics

system

can

guarantee

throughout

the

pipeline

the

rendered

images

finally

displayed

to

the

user

are

accessible

to

attackers

Just

as

audio

signals

may

be

recorded

by

external

devices

when

sound

is

played

through

speakers

the

video

signals

or

images

displayed

on

a

computer

monitor

may

be

recorded

with

a

variety

of

video

devices

The

images

so

gathered

may

be

used

as

input

to

computer

vision

reconstruction

attacks

such

as

those

possible

when

the

attacker

has

access

to

the

framebuffer

itself

though

the

images

may

be

of

degraded

quality

unless

a

perfect

digital

video

signal

-LRB-

such

as

DVI

-RRB-

is

available

In

light

of

the

possible

attacks

in

the

graphics

pipeline

as

described

in

the

previous

section

we

have

considered

a

number

of

approaches

for

sharing

and

rendering

protected

graphics

Software-only

rendering

A

graphics

viewing

system

that

does

not

make

use

of

hardware

acceleration

may

be

easier

to

protect

from

the

application

programmer

's

point

of

view

Displaying

graphics

with

a

GPU

can

require

transferring

the

graphics

data

in

precisely

known

and

open

formats

through

a

graphics

driver

and

hardware

path

that

is

often

out

of

the

programmer

's

control

A

custom

viewing

application

with

software

rendering

allows

the

content

distributor

to

encrypt

or

obfuscate

the

data

in

a

specific

manner

all

the

way

through

the

graphics

pipeline

until

display

Hybrid

hardware/software

rendering

Hybrid

hardware

and

software

rendering

schemes

can

be

used

to

take

at

least

some

advantage

of

hardware

accelerated

rendering

while

benefiting

from

software

rendering

's

protections

as

described

above

In

one

such

scheme

a

small

but

critically

important

portion

of

a

protected

model

's

geometry

-LRB-

such

as

the

nose

of

a

face

-RRB-

is

rendered

in

software

while

the

rest

of

the

model

is

rendered

normally

with

the

accelerated

GPU

hardware

This

technique

serves

as

a

deterrent

to

attackers

tampering

with

the

graphics

drivers

or

hardware

path

but

the

two-phase

drawing

with

readback

of

the

color

and

depth

buffers

can

incur

a

performance

hit

and

may

require

special

treatment

to

avoid

artifacts

on

the

border

of

the

composition

of

the

two

images

In

another

hybrid

rendering

scheme

the

geometry

is

transformed

and

per-vertex

lighting

computations

are

performed

in

software

The

depth

values

computed

for

each

vertex

are

distorted

in

a

manner

that

still

preserves

the

correct

relative

depth

ordering

while

concealing

the

actual

model

geometry

as

much

as

possible

The

GPU

is

then

used

to

complete

rendering

performing

rasteri-zation

texturing

etc.

Such

a

technique

potentially

keeps

the

vertex

stream

hidden

from

attackers

but

the

distortions

of

the

depth

buffer

values

may

impair

certain

graphics

operations

-LRB-

fog

computation

some

shadow

techniques

-RRB-

and

the

geometry

may

need

to

be

coarsely

depth

sorted

so

that

Z-interpolation

can

still

be

performed

in

a

linear

space

Deformations

of

the

geometry

Small

deformations

in

large

images

displayed

on

the

Internet

are

sometimes

used

as

a

defense

against

image

theft

zoomed

higher

resolution

sub-images

with

varying

deformations

can

not

be

captured

and

easily

reassembled

into

a

whole

A

similar

idea

can

be

used

with

data

subtle

deformations

are

applied

to

geometry

before

the

vertices

are

passed

to

the

graphics

driver

The

deformations

are

chosen

so

as

to

vary

smoothly

as

the

view

of

the

model

changes

and

to

prohibit

recovery

of

the

original

coordinates

by

averaging

the

deformations

over

time

Even

if

an

attacker

is

able

to

access

the

stream

of

data

after

it

is

deformed

they

will

encounter

great

difficulty

reconstructing

a

high-resolution

version

of

the

whole

model

due

to

the

distortions

that

have

been

introduced

Hardware

decryption

in

the

GPU

One

sound

approach

to

providing

for

protected

graphics

is

to

encrypt

the

model

data

with

public-key

encryption

at

creation

time

and

then

implement

custom

GPUs

that

accept

encrypted

data

and

perform

on-chip

decryption

and

rendering

Additional

system-level

protections

would

need

to

be

implemented

to

prevent

readback

of

framebuffer

and

other

video

memory

and

to

place

potential

restrictions

on

the

command

stream

sent

to

the

GPU

in

order

to

prevent

recovery

of

the

data

Image-based

rendering

Since

our

goal

is

to

protect

the

geometry

of

graphic

models

one

technique

is

to

distribute

the

models

using

image-based

representations

which

do

not

explicitly

include

the

complete

geometry

data

Examples

of

such

representations

include

light

fields

and

Lumigraphs

-LSB-

Levoy

and

Hanrahan

Gortler

et

al.

-RSB-

both

of

which

are

highly

amenable

to

interactive

display

Remote

rendering

A

final

approach

to

secure

graphics

is

to

retain

the

model

data

on

a

secure

server

under

the

control

of

the

content

owner

and

pass

only

rendered

images

of

the

models

back

to

client

requests

Very

low-resolution

versions

of

the

models

for

which

piracy

is

not

a

concern

can

be

distributed

with

special

client

programs

to

allow

for

interactive

performance

during

manipulation

of

the

model

This

method

relies

on

good

network

bandwidth

between

the

client

and

server

and

may

require

significant

server

resources

to

do

the

rendering

for

all

client

requests

but

it

is

vulnerable

primarily

only

to

reconstruction

attacks

Discussion

We

have

experimented

with

several

of

the

model

protection

approaches

described

above

For

example

our

first

protected

model

viewer

was

an

encrypted

version

of

the

QS-plat

-LSB-

Rusinkiewicz

and

Levoy

-RSB-

point-based

rendering

system

which

omits

geometric

connectivity

information

The

model

files

were

encrypted

using

a

strong

symmetric

block

cipher

scheme

and

the

decryption

key

was

hidden

in

a

heavily

obfuscated

model

viewer

program

using

modern

program

obfuscation

techniques

-LSB-

Collberg

and

Thomborson

-RSB-

Vertex

data

was

decrypted

on

demand

during

rendering

so

that

only

a

very

small

portion

of

the

decrypted

model

was

ever

in

memory

and

only

software

rendering

modes

were

used

Unfortunately

systems

such

as

this

ultimately

rely

on

security

through

obfuscation

which

is

theoretically

unsound

from

a

computer

security

point

of

view

Given

enough

time

and

resources

an

attacker

will

be

able

to

discover

the

embedded

encryption

key

or

otherwise

reverse-engineer

the

protections

on

the

data

For

this

reason

any

of

the

graphics

protection

techniques

that

make

the

actual

data

available

to

potential

attackers

in

software

can

be

broken

-LSB-

Schneier

-RSB-

It

is

possible

that

future

trusted

comput-ing

platforms

for

general

purpose

computers

will

be

available

that

make

software

tampering

difficult

or

impossible

but

such

systems

are

not

widely

deployed

today

Similarly

the

idea

of

a

GPU

with

decryption

capability

has

theoretical

merit

but

it

will

be

some

years

before

such

hardware

is

widely

available

for

standard

PC

computing

environments

if

ever

Thus

for

providing

practical

robust

anti-piracy

protections

for

data

we

gave

strongest

consideration

to

purely

image-based

representations

and

to

remote

rendering

Distributing

light

fields

at

the

high

resolutions

necessary

would

involve

huge

unwieldy

file

sizes

would

not

allow

for

any

geometric

operations

on

the

data

-LRB-

such

as

surface

measurements

performed

by

archaeologists

-RRB-

and

would

still

give

attackers

unlimited

access

to

the

light

field

for

purposes

of

performing

reconstruction

attacks

using

computer

vision

algorithms

For

these

reasons

we

finally

concluded

that

the

last

technique

remote

rendering

offers

the

best

solution

for

protecting

interactive

graphics

content

Remote

rendering

has

been

used

before

in

networked

environments

for

visualization

although

we

are

not

aware

of

a

system

specifically

designed

to

use

remote

rendering

for

purposes

of

security

and

content

protection

Remote

rendering

systems

have

been

previously

implemented

to

take

advantage

of

off-site

specialized

rendering

capabilities

not

available

in

client

systems

such

as

intensive

volume

rendering

-LSB-

Engel

et

al.

-RSB-

and

researchers

have

developed

special

algorithmic

approaches

to

support

efficient

distribution

of

rendering

loads

and

data

transmission

between

rendering

servers

and

clients

-LSB-

Levoy

Yoon

and

Neumann

-RSB-

Remote

rendering

of

graphical

content

is

common

for

Internet

services

such

as

online

map

sites

only

small

portions

of

the

whole

database

are

viewed

by

users

at

one

time

and

protection

of

the

entire

data

corpus

from

theft

via

image

harvesting

may

be

a

factor

in

the

design

of

these

systems

To

test

our

ideas

for

providing

controlled

protected

interactive

access

to

collections

of

graphics

models

we

have

implemented

a

remote

rendering

system

with

a

client-server

architecture

as

described

below

Client

Description

Users

of

our

protected

graphics

system

employ

a

specially-designed

viewing

program

to

interactively

view

protected

content

This

client

program

is

implemented

as

an

OpenGL

and

wxWindows-based

viewer

with

menus

and

GUI

dialogs

to

control

various

viewing

and

networking

parameters

-LRB-

Figure

-RRB-

The

client

program

includes

very

low-resolution

decimated

versions

of

the

models

which

can

be

interactively

rotated

zoomed

and

re-lit

by

the

user

in

real-time

When

the

user

stops

manipulating

the

low-resolution

model

detected

via

a

mouse

up

event

the

client

program

queries

the

remote

rendering

server

via

the

network

for

a

Figure

Screenshot

of

the

client

program

high-resolution

rendered

image

corresponding

to

the

selected

rendering

parameters

These

parameters

include

the

model

name

viewpoint

position

and

orientation

and

lighting

conditions

When

the

server

passes

the

rendered

image

back

to

the

client

program

it

replaces

the

low-resolution

rendering

seen

by

the

user

-LRB-

Figure

-RRB-

On

computer

networks

with

reasonably

low

latencies

the

user

thus

has

the

impression

of

manipulating

a

high-resolution

version

of

the

model

In

typical

usage

for

cultural

heritage

artifacts

we

use

models

with

approximately

polygons

for

the

low

resolution

version

whereas

the

server-side

models

often

contain

tens

of

millions

polygons

Such

low-resolution

model

complexities

are

of

little

value

to

potential

thieves

yet

still

provide

enough

clues

for

the

user

to

navigate

The

client

viewer

could

be

further

extended

to

cache

the

most

recent

images

returned

from

the

server

and

projec-tively

texture

map

them

onto

the

low-resolution

model

as

long

as

they

remain

valid

during

subsequent

rotation

and

zooming

actions

Server

Description

The

remote

rendering

server

receives

rendering

requests

from

users

client

programs

renders

corresponding

images

and

passes

them

back

to

the

clients

The

rendering

server

is

implemented

as

a

module

running

under

the

Apache

HTTP

Server

as

such

the

module

communicates

with

client

programs

using

the

standard

HTTP

protocol

and

takes

advantage

of

the

wide

variety

of

access

protection

and

monitoring

tools

built

into

Apache

The

rendering

server

module

is

based

upon

the

FastCGI

Apache

module

and

allows

for

multiple

rendering

processes

to

be

spread

across

any

number

of

server

hardware

nodes

As

render

requests

are

received

from

clients

the

rendering

server

checks

their

validity

and

dispatches

the

valid

requests

to

a

GPU

for

OpenGL

hardware-accelerated

rendering

The

rendered

images

are

read

back

from

the

framebuffer

compressed

using

JPEG

compression

and

returned

to

the

client

If

multiple

requests

from

the

same

client

are

pending

-LRB-

such

as

if

the

user

rapidly

changes

views

while

on

a

slow

network

-RRB-

earlier

requests

are

discarded

and

only

the

most

recent

is

rendered

The

server

uses

level-of-detail

techniques

to

speed

the

rendering

of

highly

complex

models

and

lower

level-of

detail

renderings

can

be

used

during

times

of

high

server

load

to

maintain

high

throughput

rates

In

practice

an

individual

server

node

with

a

Pentium

CPU

and

an

NVIDIA

video

card

can

handle

a

maximum

of

typical

client

requests

per

second

the

Figure

Client-side

low

resolution

-LRB-

left

-RRB-

and

server-side

high

resolution

-LRB-

right

-RRB-

model

renderings

bottlenecks

are

in

the

rendering

and

readback

-LRB-

about

milliseconds

-RRB-

and

in

the

JPEG

compression

-LRB-

approximately

milliseconds

-RRB-

Incoming

request

sizes

are

about

bytes

each

and

the

images

returned

from

our

deployed

servers

average

kB

per

request

Server

Defenses

In

Section

we

enumerated

several

possible

places

in

the

graphics

pipeline

that

an

attacker

could

steal

graphics

data

The

benefit

of

using

remote

rendering

is

that

it

leaves

only

reconstruction

from

images

in

the

framebuffer

or

display

device

as

possible

attacks

General

reconstruction

from

images

constitutes

a

very

difficult

computer

vision

problem

as

evidenced

by

the

great

amount

of

research

effort

being

expended

to

design

and

build

robust

computer

vision

systems

However

synthetic

graphics

renderings

can

be

particularly

susceptible

to

reconstruction

because

the

attacker

may

be

able

to

exactly

specify

the

parameters

used

to

create

the

images

there

is

a

low

human

cost

to

harvest

a

large

number

of

images

and

synthetic

images

are

potentially

perfect

with

no

sensor

noise

or

miscalibration

errors

Thus

it

is

still

necessary

to

defend

the

remote

rendering

system

from

reconstruction

attacks

below

we

describe

a

number

of

such

defenses

that

we

have

implemented

in

combination

for

our

server

Session-based

defenses

Client

programs

that

access

the

remote

rendering

system

are

uniquely

identified

during

the

course

of

a

usage

session

This

allows

the

server

to

monitor

and

track

the

specific

sequence

of

rendering

requests

made

by

each

client

Automatic

analysis

of

the

server

logs

allows

suspicious

request

streams

to

be

classified

such

as

an

unusually

high

number

of

requests

per

unit

time

or

a

particular

pattern

of

requests

that

is

indicative

of

an

image

harvesting

program

High

quality

computer

vision

reconstructions

often

require

a

large

number

of

images

that

densely

sample

the

space

of

possible

views

so

we

are

able

to

effectively

identify

such

access

patterns

and

terminate

service

to

those

clients

We

can

optionally

require

recurrent

user

authentication

in

order

to

further

deter

some

image

harvesting

attacks

although

a

coalition

of

users

mounting

a

low-rate

distributed

attack

from

multiple

IP

addresses

could

still

defeat

such

session-based

defenses

Obfuscation

Although

we

do

not

rely

on

obfuscation

to

protect

the

model

data

we

do

use

obfuscation

techniques

on

the

client

side

of

the

system

to

discourage

and

slow

down

certain

attacks

The

low-resolution

models

that

are

distributed

with

the

client

viewer

program

are

encrypted

using

an

stream

cipher

and

the

keys

are

embedded

in

the

viewer

and

heavily

obfuscated

The

rendering

request

messages

sent

from

the

client

to

the

server

are

also

encrypted

with

heavily

obfuscated

keys

These

encryptions

simply

serve

as

another

line

of

defense

even

if

they

were

broken

attackers

would

still

not

be

able

to

gain

access

to

the

high

resolution

data

except

through

reconstruction

from

images

Limitations

on

valid

rendering

requests

As

a

further

defense

we

provide

the

capability

in

our

client

and

remote

server

to

constrain

the

viewing

conditions

Some

models

may

have

particular

stayout

regions

defined

that

disallow

certain

viewing

and

lighting

angles

thus

keeping

attackers

from

being

able

to

reconstruct

a

complete

model

For

the

particular

purpose

of

defending

against

the

enumeration

attacks

described

in

Section

we

put

restrictions

on

the

class

of

projection

transformations

allowed

to

be

requested

by

users

-LRB-

requiring

a

perspective

projection

with

particular

fixed

field

of

view

and

near

and

far

planes

-RRB-

and

we

prevent

viewpoints

within

a

small

offset

of

the

model

surface

Perturbations

and

distortions

Passive

computer

vision

reconstructions

of

real-world

objects

from

real-world

images

are

usually

of

relatively

poor

quality

compared

to

the

original

object

This

failure

inspires

the

belief

that

we

can

protect

our

synthetically

rendered

models

from

reconstruction

by

introducing

into

the

images

the

same

types

of

obstacles

known

to

plague

vision

algorithms

The

particular

perturbations

and

distortions

that

we

use

are

described

below

we

apply

these

defenses

to

the

images

only

to

the

degree

that

they

do

not

distract

the

user

viewing

the

models

Additionally

these

defenses

are

applied

in

a

pseudorandomly

generated

manner

for

each

different

rendering

request

so

that

attackers

can

not

systematically

determine

and

reverse

their

effects

even

if

the

specific

form

of

the

defenses

applied

is

known

-LRB-

such

as

if

the

source

code

for

the

rendering

server

is

available

-RRB-

Rendering

requests

with

identical

parameters

are

mapped

to

the

same

set

of

perturbations

in

order

to

deter

attacks

which

attempt

to

defeat

these

defenses

by

averaging

multiple

images

obtained

under

the

same

viewing

conditions

Perturbed

viewing

parameters

We

pseudorandomly

introduce

subtle

perturbations

into

the

view

transformation

matrix

for

the

images

rendered

by

the

server

these

perturbations

have

the

effect

of

slightly

rotating

translating

scaling

and

shearing

the

model

The

range

of

these

distortions

is

bounded

such

that

no

point

in

the

rendered

image

is

further

than

either

m

object

space

units

or

n

pixels

from

its

corresponding

point

in

an

unperturbed

view

In

practice

we

generally

set

m

proportional

to

the

size

of

the

model

's

geometry

being

protected

and

use

values

of

n

pixels

as

experience

has

shown

that

users

can

be

distracted

by

larger

shifts

between

consecutively

displayed

images

Perturbed

lighting

parameters

We

pseudorandomly

introduce

subtle

perturbations

into

the

lighting

parameters

used

to

render

the

images

these

perturbations

include

modifying

the

lighting

direction

specified

in

the

client

request

as

well

as

addition

of

randomly

changing

secondary

lighting

to

illuminate

the

model

Users

are

somewhat

sensitive

to

shifts

in

the

overall

scene

intensity

and

shading

so

the

primary

light

direction

perturbations

used

are

generally

fairly

small

-LRB-

maximum

of

for

typical

models

which

are

rendered

using

the

OpenGL

local

lighting

model

-RRB-

High-frequency

noise

added

to

the

images

We

introduce

two

types

of

high-frequency

noise

artifacts

into

the

rendered

images

The

first

JPEG

artifacts

are

a

convenient

result

of

the

compression

scheme

applied

to

the

images

returned

from

the

server

At

high

compression

levels

-LRB-

we

use

a

maximum

libjpeg

quality

factor

of

-RRB-

the

quantization

of

DCT

coefficients

used

in

JPEG

compression

creates

blocking

discontinuities

in

the

images

and

adds

noise

in

areas

of

sharp

contrast

These

artifacts

create

problems

for

low-level

computer

vision

image

processing

algorithms

while

the

design

of

JPEG

compression

specifically

seeks

to

minimize

the

overall

perceptual

loss

of

image

quality

for

human

users

Additionally

we

add

pseudorandomly

generated

monochromatic

Gaussian

noise

to

the

images

implemented

efficiently

by

blending

noise

textures

during

hardware

rendering

on

the

server

The

added

noise

defends

against

computer

vision

attacks

by

making

background

segmentation

more

difficult

and

by

breaking

up

the

highly

regular

shading

patterns

of

the

synthetic

renderings

Interestingly

users

are

not

generally

distracted

by

the

added

noise

but

have

even

commented

that

the

rendered

models

often

appear

more

realistic

with

the

high-frequency

variations

caused

by

the

noise

One

drawback

of

the

added

noise

is

that

the

increased

entropy

of

the

images

can

result

in

significantly

larger

compressed

file

sizes

we

address

this

in

part

by

primarily

limiting

the

application

of

noise

to

the

non-background

regions

of

the

image

via

stenciled

rendering

Low-frequency

image

distortions

Just

as

real

computer

vision

lens

and

sensor

systems

sometimes

suffer

from

image

distortions

due

to

miscalibration

we

can

effectively

simulate

and

extend

these

distortions

in

the

rendering

server

Subtle

non-linear

radial

distortions

pinching

and

low-frequency

waves

can

be

efficiently

implemented

with

vertex

shaders

or

with

two-pass

rendering

of

the

image

as

a

texture

onto

a

non-uniform

mesh

accelerated

with

the

render

to

texture

capabilities

of

modern

graphics

hardware

Due

to

the

variety

of

random

perturbations

and

distortions

that

are

applied

to

the

images

returned

from

the

rendering

server

there

is

a

risk

of

distracting

the

user

as

the

rendered

model

exhibits

changes

from

frame

to

frame

even

when

the

user

makes

very

minor

adjustments

to

the

view

However

we

have

found

that

the

brief

switch

to

the

lower

resolution

model

in

between

display

of

the

high

resolution

perturbed

images

inherent

to

our

remote

rendering

scheme

very

effectively

masks

these

changes

This

masking

of

changes

is

attributed

to

the

visual

perception

phenomenon

known

as

change

blindness

-LSB-

Simons

and

Levin

-RSB-

in

which

significant

changes

occurring

in

full

view

are

not

noticed

due

to

a

brief

disruption

in

visual

continuity

such

as

a

flicker

introduced

between

successive

images

In

this

section

we

consider

several

classes

of

attacks

in

which

sets

of

images

may

be

gathered

from

our

remote

rendering

server

to

make

reconstructions

of

the

model

and

we

analyze

their

efficacy

against

the

countermeasures

we

have

implemented

Enumeration

Attacks

The

rendering

server

responds

to

rendering

requests

from

users

specifying

the

viewing

conditions

for

the

rendered

images

This

ability

for

precise

specification

can

be

exploited

by

attackers

as

they

can

potentially

explore

the

entire

model

space

using

the

returned

images

to

discover

the

location

of

the

model

to

any

arbitrary

precision

In

practice

these

attacks

involve

enumerating

many

small

cells

in

a

voxel

grid

and

testing

each

such

voxel

to

determine

intersection

with

the

remote

high-resolution

model

's

surface

thus

we

term

them

enumeration

attacks

Once

this

enumeration

process

is

complete

occupied

cells

of

the

voxel

grid

are

exported

as

a

point

cloud

and

then

input

to

a

surface

reconstruction

algorithm

In

the

plane

sweep

enumeration

attack

the

view

frustum

is

specified

as

a

rectangular

one-voxel-thick

plane

and

is

swept

over

the

model

-LRB-

Figure

-LRB-

a

-RRB-

-RRB-

Each

requested

image

represents

one

slice

of

the

model

's

surface

and

each

pixel

of

each

image

corresponds

to

a

single

voxel

A

simple

comparison

of

each

image

pixel

against

the

expected

background

color

is

performed

to

determine

whether

that

-LRB-

a

-RRB-

-LRB-

b

-RRB-

Figure

Enumeration

Attacks

-LRB-

a

-RRB-

the

plane

sweep

enumeration

attack

sweeps

a

one-voxel

thick

orthographic

view

frustum

over

the

model

-LRB-

b

-RRB-

the

near

plane

sweep

enumeration

attack

sweeps

the

viewpoint

over

the

model

marking

voxels

where

the

model

surface

is

clipped

by

the

near

plane

pixel

is

a

model

surface

or

background

pixel

Sweeps

from

multiple

view

angles

-LRB-

such

as

the

six

faces

of

the

voxels

-RRB-

are

done

to

catch

backfacing

polygons

that

may

not

be

visible

from

a

particular

angle

These

redundant

multiple

sweeps

also

allow

the

attacker

to

be

liberal

about

ignoring

questionable

background

pixels

that

may

occur

such

as

if

low-amplitude

background

noise

or

JPEG

compression

is

being

used

as

a

defense

on

the

server

Our

experiments

demonstrate

that

the

remote

model

can

be

efficiently

reconstructed

against

a

defenseless

server

using

this

attack

-LRB-

Figure

-LRB-

b

-RRB-

-RRB-

Perturbing

viewing

parameters

can

be

an

effective

defense

against

this

attack

the

maximum

reconstruction

resolution

will

be

limited

by

the

maximum

relative

displacement

that

an

individual

model

surface

point

undergoes

Figure

-LRB-

c

-RRB-

shows

the

results

of

a

reconstruction

attempt

against

a

server

pseudorandomly

perturbing

the

viewing

direction

by

up

to

in

the

returned

images

Since

plane

sweep

enumeration

relies

on

the

correspondence

between

image

pixels

and

voxels

image

warps

can

also

be

effective

as

a

defense

The

large

number

of

remote

image

requests

required

for

plane

sweep

enumeration

-LRB-

O

-LRB-

n

-RRB-

requests

for

an

n

n

n

voxel

grid

-RRB-

and

the

unusual

request

parameters

may

look

suspicious

and

trigger

the

rendering

server

log

analysis

monitors

Plane

sweep

enumeration

attacks

can

be

completely

nullified

by

limiting

user

control

of

the

view

frustum

parameters

which

we

implement

in

our

system

and

use

for

valuable

models

Another

enumeration

attack

near

plane

sweep

enumeration

involves

sweeping

the

viewpoint

-LRB-

and

thus

the

near

plane

-RRB-

over

the

model

checking

when

the

model

surface

is

clipped

by

the

near

plane

and

marking

voxels

when

this

happens

-LRB-

Figure

-LRB-

b

-RRB-

-RRB-

The

attacker

knows

that

the

near

plane

has

clipped

the

model

when

a

pixel

previously

containing

the

model

surface

begins

to

be

classified

as

the

background

In

order

to

determine

which

voxel

each

image

pixel

corresponds

to

the

attacker

must

know

two

related

parameters

the

distance

between

the

viewpoint

position

and

the

near

plane

and

the

field

of

view

These

parameters

can

be

easily

discovered

The

near

plane

distance

can

be

determined

by

first

obtaining

the

exact

location

of

one

feature

point

on

the

model

surface

through

triangulation

of

multiple

rendering

requests

and

then

moving

the

viewpoint

slowly

toward

that

point

on

the

model

When

the

near

plane

clips

the

feature

point

the

distance

between

that

point

and

the

view

position

equals

the

near

plane

distance

The

horizontal

and

vertical

field

of

view

angles

can

be

obtained

by

moving

the

viewpoint

slowly

toward

the

model

surface

stopping

when

any

surface

point

becomes

clipped

by

the

near

plane

The

viewpoint

is

then

moved

a

small

amount

perpendicular

to

its

original

direction

of

motion

such

that

the

clipped

point

moves

slightly

relative

to

the

view

but

stays

on

the

new

image

-LRB-

near

plane

-RRB-

Since

the

near

plane

distance

has

already

been

-LRB-

a

-RRB-

-LRB-

b

-RRB-

-LRB-

c

-RRB-

-LRB-

d

-RRB-

Figure

reconstruction

results

from

enumeration

attacks

-LRB-

a

-RRB-

original

model

-LRB-

b

-RRB-

plane

sweep

attack

against

defenseless

server

-LRB-

passes

total

rendered

images

-RRB-

-LRB-

c

-RRB-

plane

sweep

attack

against

viewing

direction

perturbation

defense

-LRB-

passes

total

rendered

images

-RRB-

-LRB-

d

-RRB-

near

plane

sweep

attack

against

defenseless

server

-LRB-

passes

total

rendered

images

-RRB-

obtained

the

field

of

view

angle

-LRB-

horizontal

or

vertical

depending

on

direction

of

motion

-RRB-

can

be

obtained

from

the

relative

motion

of

the

clipped

point

across

the

image

Because

the

near

plane

is

usually

small

compared

to

the

dimensions

of

the

model

many

sweeps

must

be

tiled

in

order

to

attain

full

coverage

Sweeps

must

also

be

made

in

several

directions

to

ensure

that

all

model

faces

are

seen

Because

this

attack

relies

on

seeing

the

background

to

determine

when

the

near

plane

has

clipped

a

surface

concave

model

geometries

will

present

a

problem

for

surface

detection

Although

sweeps

from

multiple

directions

will

help

this

problem

is

not

completely

avoidable

Figure

-LRB-

d

-RRB-

illustrates

this

problem

showing

a

case

in

which

six

sweeps

have

not

fully

captured

all

the

surface

geometry

Viewing

parameter

perturbations

and

image

warps

will

nearly

destroy

the

effectiveness

of

near

plane

sweep

enumeration

attacks

as

they

can

make

it

very

difficult

to

determine

where

the

surface

lies

and

where

it

does

not

near

silhouette

edges

-LRB-

pixels

near

these

edges

will

change

erratically

between

surface

and

background

-RRB-

The

most

solid

defense

against

this

attack

is

to

prevent

views

within

a

certain

small

offset

of

the

model

surface

This

defense

which

we

use

in

our

system

to

protect

valuable

models

prevents

the

near

plane

from

ever

clipping

the

model

surface

and

thereby

completely

nullifies

this

attack

Shape-from-silhouette

Attacks

Shape-from-silhouette

-LSB-

Slabaugh

et

al.

-RSB-

is

one

well

studied

robust

technique

for

extracting

a

model

from

a

set

of

images

The

method

consists

of

segmenting

the

object

pixels

from

the

background

in

each

image

then

intersecting

in

space

their

resulting

extended

truncated

silhouettes

and

finally

computing

the

surface

of

the

resulting

shape

The

main

limitation

of

this

technique

is

that

only

a

visual

hull

-LSB-

Laurentini

-RSB-

of

the

shape

can

be

recovered

the

line-concave

parts

of

the

model

are

beyond

the

capabilities

of

the

reconstruction

Thus

the

effectiveness

of

this

attack

depends

on

the

specific

geometric

characteristics

of

the

object

the

high-resolution

models

that

we

target

often

have

many

concavities

that

are

difficult

or

impossible

to

fully

recover

using

shape-from-silhouette

However

this

attack

may

also

be

of

use

to

attackers

Figure

The

viewpoints

used

to

reconstruct

the

model

with

a

shape-from-silhouette

attack

results

are

shown

in

Figure

to

obtain

a

coarse

low-resolution

version

of

the

model

if

they

are

unable

to

break

through

the

obfuscation

protections

we

use

for

the

low-resolution

models

distributed

with

the

client

To

measure

the

potential

of

a

shape-from-silhouette

attack

against

our

protected

graphics

system

we

have

conducted

reconstruction

experiments

on

a

model

of

the

David

as

served

via

the

rendering

server

using

a

shape-from-silhouette

implementation

described

in

-LSB-

Tarini

et

al.

-RSB-

With

all

server

defenses

disabled

images

were

harvested

from

a

variety

of

viewpoints

around

the

model

-LRB-

Figure

-RRB-

these

viewpoints

were

selected

incrementally

with

later

viewpoints

chosen

to

refine

the

reconstruction

accuracy

as

measured

during

the

process

The

resulting

reconstruction

is

shown

in

Figure

-LRB-

b

-RRB-

Several

of

the

perturbation

and

distortion

defenses

implemented

in

our

server

are

effective

against

the

shape-from-silhouette

attack

Results

from

experiments

showing

the

reconstructed

model

quality

with

server

defenses

independently

enabled

are

shown

in

Figures

-LRB-

c-g

-RRB-

Small

perturbations

in

the

viewing

parameters

were

particularly

effective

at

decreasing

the

quality

of

the

reconstructed

model

as

would

be

expected

Niem

-LSB-

-RSB-

performed

an

error

analysis

of

silhouette-based

modeling

techniques

and

showed

the

linear

relationship

between

error

in

the

estimation

of

the

view

position

and

error

in

the

resulting

reconstruction

Perturbations

in

the

images

returned

from

the

server

such

as

radial

distortion

and

small

random

shifts

were

also

effective

Combining

the

different

perturbation

defenses

as

they

are

implemented

in

our

remote

rendering

system

makes

for

further

deterioration

of

the

reconstructed

model

quality

-LRB-

Figure

-LRB-

h

-RRB-

-RRB-

High

frequency

noise

and

JPEG

defenses

in

the

server

images

can

increase

the

difficulty

of

segmenting

the

object

from

the

background

However

shape-from-silhouette

software

implementa-tions

with

specially

tuned

image

processing

operations

can

take

the

noise

characteristics

into

account

to

help

classify

pixels

accurately

The

intersection

stage

of

shape-from-silhouette

reconstruction

algorithms

makes

them

innately

robust

with

respect

to

background

pixels

misclassified

as

foreground

Stereo

Correspondence-based

Attacks

Stereo

reconstruction

is

another

well

known

computer

vision

technique

Stereo

pairs

of

similarly

neighborhooded

pixels

are

detected

and

the

position

of

the

corresponding

point

on

the

surface

is

found

via

the

intersection

of

epipolar

lines

Of

particular

relevance

to

our

remote

rendering

system

Debevec

et

al.

-LSB-

-RSB-

showed

that

the

reconstruction

task

can

be

made

easier

and

more

accurate

if

an

approximate

low

resolution

model

is

available

by

warping

the

images

over

it

before

performing

the

stereo

matching

-LRB-

a

-RRB-

E

-LRB-

b

-RRB-

E

-LRB-

c

-RRB-

E

-LRB-

d

-RRB-

E

-LRB-

e

-RRB-

E

-LRB-

f

-RRB-

E

-LRB-

g

-RRB-

E

-LRB-

h

-RRB-

E

Figure

Performance

of

shape-from-silhouette

reconstructions

against

various

server

defenses

Error

values

-LRB-

E

-RRB-

measure

the

mean

surface

distance

-LRB-

mm

-RRB-

from

the

tall

original

model

Top

row

-LRB-

a

-RRB-

original

model

-LRB-

b

-RRB-

reconstruction

from

defenseless

server

reconstruction

with

-LRB-

c

-RRB-

and

-LRB-

d

-RRB-

perturbations

of

the

view

direction

Bottom

row

-LRB-

e

-RRB-

reconstruction

with

a

random

image

offset

of

pixels

with

-LRB-

f

-RRB-

and

-LRB-

g

-RRB-

radial

image

distortion

and

-LRB-

h

-RRB-

reconstruction

against

combined

defenses

-LRB-

view

perturbation

pixel

random

offset

and

radial

image

distortion

-RRB-

Ultimately

however

stereo

correspondence

techniques

usually

rely

on

matching

detailed

high-frequency

features

in

order

to

yield

high-resolution

reconstruction

results

The

smoothly

shaded

computer

models

generated

by

laser

scanning

that

we

share

via

our

remote

rendering

system

thus

present

significant

problems

to

basic

two-frame

stereo

matching

algorithms

When

we

add

in

the

server

defenses

such

as

image-space

high

frequency

noise

and

slight

perturbations

in

the

viewing

and

lighting

parameters

the

stereo

matching

task

becomes

even

more

ill-posed

Other

stereo

research

such

as

-LSB-

Scharstein

and

Szeliski

-RSB-

also

reports

great

difficulty

in

stereo

reconstruction

of

noise-contaminated

low-texture

synthetic

scenes

Were

we

to

distribute

models

with

high

resolution

textures

applied

to

their

surfaces

stereo

correspondence

methods

may

be

a

more

effective

attack

Shape-from-shading

Attacks

Shape-from-shading

attacks

represent

another

family

of

computer

vision

techniques

for

reconstructing

the

shape

of

a

object

-LRB-

see

-LSB-

Zhang

et

al.

-RSB-

for

a

survey

-RRB-

The

primary

attack

on

our

remote

rendering

system

that

we

consider

in

this

class

involves

first

-LRB-

a

-RRB-

E

-LRB-

b

-RRB-

E

-LRB-

c

-RRB-

E

-LRB-

d

-RRB-

E

-LRB-

e

-RRB-

E

-LRB-

f

-RRB-

E

Figure

Performance

of

shape-from-shading

reconstruction

attacks

Error

values

-LRB-

E

-RRB-

measure

the

mean

surface

distance

-LRB-

mm

-RRB-

from

the

original

model

Top

row

-LRB-

a

-RRB-

original

model

-LRB-

b

-RRB-

low-resolution

base

mesh

-LRB-

c

-RRB-

reconstruction

from

defenseless

server

Bottom

row

reconstruction

results

against

-LRB-

d

-RRB-

high-frequency

image

noise

-LRB-

e

-RRB-

complicated

lighting

model

-LRB-

lights

-RRB-

and

-LRB-

f

-RRB-

viewing

angle

perturbation

-LRB-

up

to

-RRB-

defenses

obtaining

several

images

from

the

same

viewpoint

under

varying

known

lighting

conditions

Then

using

photometric

stereo

methods

a

normal

is

computed

for

each

pixel

by

solving

a

system

of

rendering

equations

The

resulting

normal

map

can

be

registered

and

applied

to

an

available

approximate

geometry

such

as

the

low-resolution

model

used

by

the

client

or

one

obtained

from

another

reconstruction

technique

such

as

shape-from-silhouette

This

coarse

normal-mapped

model

itself

may

be

of

value

to

some

attackers

when

rendered

it

will

show

convincing

high

frequency

details

that

can

be

shaded

under

new

lighting

conditions

though

with

artifacts

at

silhouettes

However

the

primary

purpose

of

our

system

is

to

protect

the

high-resolution

geometry

which

if

stolen

could

be

used

maliciously

for

shape

analysis

or

to

create

replicas

Thus

a

greater

risk

is

posed

if

the

normal

map

is

integrated

by

the

attacker

to

compute

a

displacement

map

and

the

results

are

used

to

displace

a

refined

version

of

the

low-resolution

model

mesh

Following

this

procedure

with

images

harvested

from

a

defenseless

remote

rendering

server

and

using

a

low-resolution

client

model

we

were

able

to

successfully

reconstruct

a

high-resolution

model

The

results

shown

in

Figure

-LRB-

c

-RRB-

depict

a

reconstruction

of

the

David

's

head

produced

from

pixel

images

taken

from

viewpoints

with

lighting

positions

used

at

each

viewpoint

assuming

a

known

single-illuminant

OpenGL

lighting

model

and

using

a

polygon

low-resolution

model

-LRB-

Fig.

-LRB-

b

-RRB-

-RRB-

of

the

whole

statue

Some

of

the

rendering

server

defenses

such

as

adding

high-frequency

noise

to

the

images

can

be

compensated

for

by

attackers

by

simply

adding

enough

input

images

to

increase

the

robustness

of

the

photometric

stereo

solution

step

-LRB-

although

harvesting

too

many

images

will

eventually

trigger

the

rendering

server

log

analysis

monitors

-RRB-

Figure

-LRB-

d

-RRB-

shows

the

high

quality

reconstruction

result

possible

when

only

random

Gaussian

noise

is

used

as

a

defense

More

effective

defenses

against

shape-from-shading

attacks

include

viewing

and

lighting

perturbations

and

low-frequency

image

distortions

which

can

make

it

difficult

to

precisely

register

images

onto

the

low-resolution

model

and

can

disrupt

the

photometric

stereo

solution

step

without

a

large

number

of

aligned

input

images

Figure

-LRB-

e

-RRB-

shows

a

diminished

quality

reconstruction

when

the

rendering

server

complicates

the

lighting

model

by

using

perturbed

light

sources

with

a

Phong

component

unknown

to

the

attacker

and

Figure

-LRB-

f

-RRB-

shows

the

significant

loss

of

geometric

detail

in

the

reconstruction

when

the

server

randomly

perturbs

the

viewing

direction

by

up

to

-LRB-

note

that

the

reconstruction

error

exceeds

that

of

the

starting

base

mesh

-RRB-

The

quality

of

the

base

mesh

is

an

important

determinant

in

the

success

of

this

particular

attack

For

example

repeating

the

experiment

of

Figure

with

a

more

accurate

base

mesh

of

polygons

yields

results

of

E

E

and

E

for

the

conditions

of

Figures

-LRB-

b

-RRB-

-LRB-

c

-RRB-

and

-LRB-

e

-RRB-

respectively

This

reliance

on

an

accurate

low-resolution

base

mesh

for

the

model

reconstruction

is

a

potential

weak

point

of

the

attack

attackers

may

be

deterred

by

the

effort

required

to

reverse-engineer

the

protections

guarding

the

low-resolution

model

or

to

reconstruct

an

acceptable

base

mesh

from

harvested

images

using

another

technique

Discussion

Because

we

know

of

no

single

mechanism

for

guaranteeing

the

security

of

content

delivered

through

a

rendering

server

we

have

instead

taken

a

systems-based

approach

implementing

multiple

defenses

and

using

them

in

combination

Moreover

we

know

of

no

formalism

for

rigorously

analyzing

the

security

provided

by

our

defenses

the

reconstruction

attacks

that

we

have

empirically

considered

here

are

merely

representative

of

the

possible

threats

Of

the

reconstruction

attacks

we

have

experimented

with

so

far

the

shape-from-shading

approach

has

yielded

the

best

results

against

our

defended

rendering

server

Enumeration

attacks

are

easily

foiled

when

the

user

's

control

over

the

viewpoint

and

view

frustum

is

constrained

pure

shape-from-silhouette

methods

are

limited

to

reconstructing

a

visual

hull

and

two-frame

stereo

algorithms

rely

on

determining

accurate

correspondences

which

is

difficult

with

the

synthetic

untextured

models

we

are

attempting

to

protect

Attackers

could

improve

the

results

of

the

shape-from-shading

algorithm

against

our

perturbation

defenses

by

explicitly

modeling

the

distortions

and

trying

to

take

them

into

account

in

the

optimization

step

or

alternatively

by

attempting

to

align

the

images

by

interactively

establishing

point

to

point

correspondences

or

using

an

automatic

technique

such

as

-LSB-

Lensch

et

al.

-RSB-

Such

procedures

for

explicitly

modeling

the

server

defenses

or

correcting

for

them

via

manual

specification

of

correspondences

are

applicable

to

any

style

of

reconstruction

attempt

To

combat

these

attacks

we

must

rely

on

the

combined

discouraging

effect

of

multiple

defenses

running

simultaneously

which

increases

the

number

of

degrees

of

freedom

of

perturbation

to

a

level

that

would

be

difficult

and

time-consuming

to

overcome

Some

of

our

rendering

server

defenses

such

as

the

lighting

model

and

non-linear

image

distortions

can

be

increased

arbitrarily

in

their

complexity

Likewise

the

magnitude

of

server

defense

perturbations

can

be

increased

with

a

corresponding

decrease

in

the

fidelity

of

the

rendered

images

Ultimately

no

fixed

set

of

defenses

is

bulletproof

against

a

sophisticated

malicious

attacker

with

enough

resources

at

their

disposal

and

one

is

inevitably

led

to

an

arms

race

between

attacks

and

countermeasures

such

as

we

have

implemented

As

the

expense

required

to

overcome

our

remote

rendering

server

defenses

becomes

greater

determined

attackers

may

instead

turn

to

reaching

their

piracy

goals

via

non-reconstruction-based

methods

beyond

the

scope

of

this

paper

such

as

computer

network

intrusion

or

exploitation

of

non-technical

human

factors

A

prototype

of

our

remote

rendering

system

-LRB-

ScanView

available

at

-RRB-

has

been

deployed

to

share

models

from

a

major

cultural

heritage

archive

the

Digital

Michelangelo

Project

-LSB-

Levoy

et

al.

-RSB-

as

well

as

other

collections

of

archaeological

artifacts

that

require

protected

usage

In

the

several

months

since

becoming

publically

available

more

than

users

have

installed

the

client

program

on

their

personal

computers

and

accessed

the

remote

servers

to

view

the

protected

models

The

users

have

included

art

students

art

scholars

art

enthusiasts

and

sculptors

examining

high-resolution

artworks

as

well

as

archaeologists

examining

particular

artifacts

Few

of

these

individuals

would

have

qualified

under

the

strict

guidelines

required

to

obtain

completely

unrestricted

access

to

the

models

so

the

protected

remote

rendering

system

has

enabled

large

entirely

new

groups

of

users

access

to

graphical

models

for

professional

study

and

enjoyment

Reports

from

users

of

the

system

have

been

uniformly

positive

and

enthusiastic

Fetching

high-resolution

renderings

over

intercontinental

broadband

Internet

connections

takes

less

than

seconds

of

latency

while

fast

continental

connections

generally

experience

latencies

dominated

by

the

rendering

server

's

processing

time

-LRB-

around

ms

-RRB-

The

rendering

server

architecture

can

scale

up

to

support

an

arbitrary

number

of

requests

per

second

by

adding

additional

CPU

and

GPU

nodes

and

rendering

servers

can

be

installed

at

distributed

locations

around

the

world

to

reduce

intercontinental

latencies

if

desired

Our

log

analysis

defenses

have

detected

multiple

episodes

of

system

users

attempting

to

harvest

large

sets

of

images

from

the

server

for

purposes

of

later

reconstruction

attempts

though

these

incidents

were

determined

to

be

non-malicious

In

general

the

monitoring

capabilities

of

a

remote

rendering

server

are

useful

for

reasons

beyond

just

security

as

the

server

logs

provide

complete

accounts

of

all

usage

of

the

models

in

the

archive

which

can

be

valuable

information

for

archive

managers

to

gauge

popularity

of

individual

models

and

understand

user

interaction

patterns

Our

plans

for

future

work

include

further

investigation

of

computer

vision

techniques

that

address

reconstruction

of

synthetic

data

under

antagonistic

conditions

and

analysis

of

their

efficacy

against

the

various

rendering

server

defenses

More

sophisticated

extensions

to

the

basic

vision

approaches

described

above

such

as

multi-view

stereo

algorithms

and

robust

hybrid

vision

algorithms

which

combine

the

strengths

of

different

reconstruction

techniques

can

present

difficult

challenges

to

protecting

the

models

Another

direction

of

research

is

to

consider

how

to

allow

users

a

greater

degree

of

geometric

analysis

of

the

protected

models

without

further

exposing

the

data

to

theft

scholarly

and

professional

users

have

expressed

interest

in

measuring

distances

and

plotting

profiles

of

objects

for

analytical

purposes

beyond

the

simple

viewing

supported

in

the

current

system

Finally

we

are

continuing

to

investigate

alternative

approaches

to

protecting

graphics

designing

specialized

systems

which

make

data

security

a

priority

while

potentially

sacrificing

some

general

purpose

computing

platform

capabilities

The

GPU

decryption

scheme

described

herein

for

example

is

one

such

idea

that

may

be

appropriate

for

console

devices

and

other

custom

graphics

systems

Acknowledgements

We

thank

Kurt

Akeley

Sean

Anderson

Jonathan

Berger

Dan

Boneh

Ian

Buck

James

Davis

Pat

Hanrahan

Hughes

Hoppe

David

Kirk

Matthew

Papakipos

Nick

Triantos

and

the

anonymous

reviewers

for

their

useful

feedback

and

Szymon

Rusinkiewicz

for

sharing

code

This

work

has

been

supported

in

part

by

NSF

contract

IIS

the

Max

Planck

Center

for

Visual

Computing

and

Communication

and

the

EU

Project

C

OLLBERG

C.

AND

T

HOMBORSON

C.

Watermarking

tamper-proofing

and

obfuscation

Tools

for

software

protection

Tech

Rep.

Dept.

of

Computer

Science

The

University

of

Auckland

D

EBEVEC

P.

T

AYLOR

C.

AND

M

ALIK

J.

Modeling

and

rendering

architecture

from

photographs

A

hybrid

geometry

and

image-based

approach

In

Proc

of

ACM

SIGGRAPH

E

NGEL

K.

H

ASTREITER

P.

T

OMANDL

B.

E

BERHARDT

K.

AND

E

RTL

T.

Combining

local

and

remote

visualization

techniques

for

interactive

volume

rendering

in

medical

applications

In

Proc

of

IEEE

Visualization

G

ORTLER

S.

G

RZESZCZUK

R.

S

ZELISKI

R.

AND

C

OHEN

M.

F.

The

lumigraph

In

Proc

of

ACM

SIGGRAPH

L

AURENTINI

A.

The

visual

hull

concept

for

silhouette-based

image

understanding

IEEE

Trans

on

Pattern

Analysis

and

Machine

Intelligence

L

ENSCH

H.

P.

H

EIDRICH

W.

AND

S

EIDEL

H.-P

A

silhouette-based

algorithm

for

texture

registration

and

stitching

Graphical

Models

L

EVOY

M.

AND

H

ANRAHAN

P.

Light

field

rendering

In

Proc

of

ACM

SIGGRAPH

L

EVOY

M.

P

ULLI

K.

C

URLESS

B.

R

USINKIEWICZ

S.

K

OLLER

D.

P

EREIRA

L.

G

INZTON

M.

A

NDERSON

S.

D

AVIS

J.

G

INSBERG

J.

S

HADE

J.

AND

F

ULK

D.

The

digital

michelangelo

project

In

Proc

of

ACM

SIGGRAPH

L

EVOY

M.

Polygon-assisted

jpeg

and

mpeg

compression

of

synthetic

images

In

Proc

of

ACM

SIGGRAPH

N

IEM

W.

Error

analysis

for

silhouette-based

shape

estimation

from

multiple

views

In

International

Workshop

on

Synthetic-Natural

Hybrid

Coding

and

Imaging

O

HBUCHI

R.

M

UKAIYAMA

A.

AND

T

AKAHASHI

S.

A

frequency-domain

approach

to

watermarking

shapes

Computer

Graphics

Forum

P

RAUN

E.

H

OPPE

H.

AND

F

INKELSTEIN

A.

Robust

mesh

watermarking

In

Proc

of

ACM

SIGGRAPH

R

ESSLER

S.

security

discussion

Online

article

R

USINKIEWICZ

S.

AND

L

EVOY

M.

QSplat

A

multiresolution

point

rendering

system

for

large

meshes

In

Proc

of

ACM

SIGGRAPH

S

CHARSTEIN

D.

AND

S

ZELISKI

R.

A

taxonomy

and

evaluation

of

dense

two-frame

stereo

correspondence

algorithms

International

Journal

of

Computer

Vision

S

CHNEIER

B.

The

fallacy

of

trusted

client

software

Information

Security

-LRB-

August

-RRB-

S

IMONS

D.

AND

L

EVIN

D.

Change

blindness

Trends

in

Cognitive

Sciences

S

LABAUGH

G.

C

ULBERTSON

B.

M

ALZBENDER

T.

AND

S

CHAFER

R.

A

survey

of

methods

for

volumetric

scene

reconstruction

from

photographs

In

Proc

of

the

Joint

IEEE

TCVG

and

Eurographics

Workshop

-LRB-

-RRB-

Springer-Verlag

S

TANFORD

D

IGITAL

F

ORMA

U

RBIS

P

ROJECT

T

ARINI

M.

C

ALLIERI

M.

M

ONTANI

C.

R

OCCHINI

C.

O

LSSON

K.

AND

P

ERSSON

T.

Marching

intersections

An

efficient

approach

to

shape-from-silhouette

In

Proceedings

of

the

Conference

on

Vision

Modeling

and

Visualization

-LRB-

VMV

-RRB-

Y

OON

I.

AND

N

EUMANN

U.

Web-based

remote

rendering

with

IBRAC

Computer

Graphics

Forum

Z

HANG

R.

T

SAI

P.-S.

C

RYER

J.

E.

AND

S

HAH

M.

Shape

from

shading

A

survey

IEEE

Transactions

on

Pattern

Analysis

and

Machine

Intelligence

O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O

remote rendering
security
digital rights management
3d models