# Confidential Smart Contracts and Blockchain to Implement a Watermarking Protocol
## 8 Implementation and Performance  
The implementation of the described protocol consists of two main parts: the first concerns the watermark insertion algorithm, while the second concerns the execution model of the smart contract that is responsible for running the protocol. As for the first part, two different watermark insertion algorithms are available: one based on the SS insertion technique [22] and the other based on QIM [34]. Both are used in conjunction with the Paillier homomorphic cryptosystem [29], as described in [39; 40; 41], and exploit the optimizations, described in [26; 42], capable of improving the watermark insertion directly in the encrypted domain. The SS insertion algorithm is based on the following formula:  
\[\bar{x}=x+\alpha(2b-1)s\]  
in which \(x\) is a host signal feature obtained by calculating the cosine discrete transform, \(\bar{x}\) is the corresponding watermarked feature, \(b\!\in\!\{0,1\}\) is the bit to embed, \(s\) is the component of a spreading sequence, and \(\alpha\) is a scaling factor that controls the watermark's strength. Therefore, inserting the watermark into the encrypted domain employs the following formula [26; 39; 40]:  
\[E[\bar{x}]=E[x]\cdot E[b]^{2 as}\cdot E[\alpha s]^{-1}\]  
The insertion algorithm using QIM is based on the following formula [26]:  
\[\bar{x}=f(x)+b\Delta(x)\]  
where \(x\), \(\bar{x}\), and \(b\) have the same meaning reported above, while \(f(x)\) and \(\Delta(x)\) denote a function of the original signal features and a signal-dependent quantization step, respectively [4; 34]. Consequently, the insertion of the watermark into the encrypted domain uses the following formula [26; 40; 41]:  
\[E[\bar{x}]=E[f(x)]\cdot E[b]^{\Delta(x)}\]  
As for the second part, the smart contract execution model has been implemented using the Oasis Network [43], a blockchain based on the \"layer-2\" architecture adopted by the proposed protocol. Oasis is, in fact, composed of a layer dedicated to reaching consensus and an off-chain execution layer of smart contracts (see Figure 7). In particular, the consensus layer is implemented by validator nodes that maintain the integrity of the blockchain by running the Tendermint BFT (Byzantine Fault Tolerance) protocol and employing a proof-of-stake as the block propos  
Figure 7: The Oasis Network blockchain. The execution layer of smart contracts is implemented by execution nodes hosting the so-called \"paratimes\" (parallel runtimes), which represent the environments dedicated to executing smart contracts. In this regard, the proposed protocol uses a specific paratime made available by Oasis, called Sapphire, which supports the confidential execution of EVM-compatible smart contracts in TEE, just like the one implementing the proposed protocol, which was written in Solidity (see Figure 8). Sapphire leverages INTEL SGX as a TEE, which ensures that all input, output, intermediate, and final states of smart contracts are always encrypted and managed securely, even with respect to the nodes hosting the TEEs. As a confidential paratime, Sapphire provides a key manager that can guarantee the generation, storage, distribution, and revocation of the keys needed for execution in TEE. In addition, Sapphire ensures the integrity of the computation performed in TEE through the \"discrepancy-detection\" algorithm. This algorithm provides that the results of the execution in TEE of the same smart contract by multiple execution nodes are sent to a \"committee\" of nodes in the form of \"cryptographic commitment\". The nodes of the committee then execute the discrepancy-detection algorithm and, if they reach an agreement, they declare the smart contract execution as complete and send the result to the consensus layer for finalization on the blockchain. Otherwise, the committee nodes run the more expensive \"discrepancy-resolution\" algorithm to identify the correct result of the smart contract execution.