# Confidential Smart Contracts and Blockchain to Implement a Watermarking Protocol
## 7 Security Analysis
### Assumptions  
Limiting the analysis to the watermarking protocol only and based on what is reported above, it is possible to assume the following description:  
* \(\mathcal{CP}\)sells \(X\) to \(\mathcal{B}\);
* \(\mathcal{BC}\) implements the ledger that publishes the smart contract responsible for executing the watermarking protocol;* \(\mathcal{CN}\) is a computation node equipped with TEE in whose enclave it executes the smart contract that implements the off-chain protocol in confidential form;
* The results of the execution of the protocol are published in encrypted form on \(\mathcal{BC}\);
* \(\mathcal{CP}\) can autonomously ascertain whether \(\mathcal{B}\) has illegally distributed the copy received with his/her personalized protection.  
Furthermore, the entities participating in the protocol are assumed to have the following behavior:  
* \(\mathcal{B}\) and \(\mathcal{CP}\) do not distribute pirated copies of the contents in their possession when they are not corrupted;
* \(\mathcal{BC}\) is considered an \"honest-but-curious\" entity [37] whose nodes (miners), while being able to access some of the information managed by the protocol, are still forced to follow the rules set by the protocol in accordance with the concept of a public blockchain;
* \(\mathcal{CN}\), when executing the smart contract in its TEE, guarantees correctness, integrity, and confidentiality, and it is supposed to be incorruptible;
* \(KMS\) correctly executes the key management protocol in its TEE without compromising the keys;
* \(\mathcal{CP}\) and \(\mathcal{B}\) can be corrupted only \"statically\", i.e., deciding which of the two entities is corrupt is made before running the protocol and can no longer be changed [37].  
Consistent with what has been reported and in the absence of corrupt entities, the protocol allows \(\mathcal{B}\) to receive from \(\mathcal{CP}\) the chosen content \(X\) protected by the insertion of a personalized watermark. Once extracted from a copy of \(X\), the watermark allows the link of the content to the legitimate purchaser, the content provider, and the purchase transaction, thus carrying out a deterrent action against the illegal sharing of content on the network.  
If \(\mathcal{B}\) or \(\mathcal{CP}\) are corrupted, the protocol can always take appropriate countermeasures. In particular, if \(\mathcal{B}\) is corrupted, the protocol aborts the ongoing transaction, preventing the release of the content \(X\) requested by \(\mathcal{B}\). On the contrary, if \(\mathcal{CP}\) is corrupted, then the content \(X\) is released to \(\mathcal{B}\) incorrectly protected by inserting a watermark that is not correctly linked to \(\mathcal{B}\). The result is as if \(X\) had been released without being protected, and this damages \(\mathcal{CP}\) itself.  
Starting from what has been exposed so far, a brief series of considerations on the security of the protocol are reported below. A specific protocol analysis was conducted using the AVISPA tool (Automated Validation of Internet Security Protocols and Applications) [38]. This analysis, which is not reported here for brevity, highlighted how the tool failed to document successful attacks.