Certified tracking of leaked satellite monitoring software with zero-knowledge proofs
ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring
Cryptography and SecurityMachine Learning
Summary
Satellites help us navigate, but sometimes monitoring software for these systems gets shared when it shouldn’t be. The authors present a way to mark each copy with secret digital fingerprints and verify who leaked it without needing the leaker’s help. Their system uses clever math called zero-knowledge proofs to check these fingerprints safely and with very low risk of blaming the wrong person. Tests show it works well even when copies are combined or altered, making it practical for protecting satellite monitoring tools.
What this means in practice
- •For satellite system engineers: Identify the source of leaked GNSS monitoring software copies without needing cooperation from suspects.
- •For security teams in software companies: Detect and trace unauthorized sharing of proprietary software using robust fingerprinting and verification methods.
Authors
Redwanul Karim, Nisha L. Raichur, Lucas Heublein, Tobias Feigl, Christopher Mutschler, Felix Ott
Abstract
Federated global navigation satellite system (GNSS) monitoring distributes a proprietary classifier to partly trusted stations, any of which may leak its copy. ZK-Trace combines public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification. The registry supports offline tracing without the leaker's cooperation. We establish conditional false-accusation bounds for arbitrary recovered bit patterns, a finite completeness bound under a hidden-bias residual channel, and a deterministic tracing-score bound for correlated feature-distillation errors. An interval-arithmetic checker makes the conditional bound executable and allocates a common budget across accusation and tamper decisions. Under innocent-row independence, the certificate-based evaluation uses a false-naming budget of 0.001 per investigation. It isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures without naming an innocent. Experiments use a simulated GNSS federation and CIFAR-10. Feature matching preserves the feature mark in 20/20 runs and cross-architecture transfer in 19/20, at copy-accuracy costs of 4.8 and 6.1 percentage points on GNSS and CIFAR-10. Function-only distillation erases the feature mark, and distillation also removes weight-space marks. These results support verifiable tracing under explicit statistical and cryptographic assumptions. Credential knowledge and recipient evidence serve distinct roles.