# A Watermarking Protocol Based on Blockchain
## 5 Watermarking Protocol
### Protection Protocol
In addition, \(\mathcal{B}\) also sends \(B_{id}\) and \(B_{ad}\) to \(\mathcal{BC}\) in the message \(m_{7}\): the former is a token that unambiguously identifies \(\mathcal{B}\), whereas the latter represents his/her destination address. In particular,  
* \(B_{id}\) is generated depending on the specific \"negotiation mechanism\" chosen by \(\mathcal{B}\) among those ones supported by \(\mathcal{BC}\)[4; 5]. In this regard, in the proposed protocol \(\mathcal{BC}\) is assumed to provide multiple negotiation mechanisms, which enable \(\mathcal{B}\) to be identified, for example, using an anonymous digital certificate or a personal digital certificate or a credit card [4; 5]. In fact, the last two mechanisms enable \(\mathcal{B}\) to be directly identified. However, they are assumed to be implemented according to the concept of \"multilateral security\" applied to web transactions [53; 54]. * \(B_{ad}\) is the \(\mathcal{B}\)'s shipping address that will enable him/her to receive the secret key \(sk^{X}_{\mathcal{R},\mathcal{A}}\) corresponding to the public key \(pk^{X}_{\mathcal{R},\mathcal{A}}\). When the messages \(m_{6}\) and \(m_{7}\) are received by \(\mathcal{BC}\), the code associated to a specific smart contract is automatically executed. The code of the contract mainly compares the tokens, verifies the signatures contained in the two received messages, and checks whether the tokens \(pk^{X}_{\mathcal{R},\mathcal{A}}\) and \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)\), generated by \(\mathcal{R}\mathcal{A}\), have been already used in a previous purchase transaction or not. In fact, this means to check whether \(pk^{X}_{\mathcal{R},\mathcal{A}}\) and \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)\) have been already published in a node of the blockchain or not. If all data turn out to be correct, match, and the tokens generated by \(\mathcal{R}\mathcal{A}\) have not been used in previous transactions, the code enables the generation of a new node in \(\mathcal{BC}\), which makes some of the tokens identifying the ongoing transactions, such as \(X_{d}\), \(T_{X}\), \(pk^{X}_{\mathcal{R},\mathcal{A}}\), \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)\), \(\mathbb{S}_{\mathcal{R}\mathcal{A}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E} _{pk^{X}_{\mathcal{R},\mathcal{A}}}(N))\), and \(\mathbb{S}_{\mathcal{CP}}(X_{d},T_{X},pk^{X}_{\mathcal{R},\mathcal{A}}, \mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N),\mathbb{S}_{\mathcal{R} \mathcal{A}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X}_{\mathcal{R}, \mathcal{A}}}(N)))\), public. Moreover, the execution of the smart contract within \(\mathcal{BC}\) takes also charge of implementing the payment phase. It ends by sending two messages, \(m_{8}\) and \(m_{9}\), to \(\mathcal{R}\mathcal{A}\) and \(\mathcal{CP}\), respectively. The message \(m_{8}\) includes \(B_{ad}\) and \(pk_{\mathcal{RA}}^{X}\), and enables \(\mathcal{RA}\) to send the secret key \(sk_{\mathcal{RA}}^{X}\) to \(\mathcal{B}\) in the message \(m_{10}\). \(\mathcal{B}\) can thus decrypt \(\overline{\mathbb{E}}_{pk_{\mathcal{RA}}^{X}}(X)\) and obtain the final protected content according to the following equalities:  
\[\overline{\mathbb{E}}_{pk_{\mathcal{RA}}^{X}}(X)=\mathbb{E}_{pk_{\mathcal{RA}} ^{X}}(\bar{X}),\qquad\bar{X}=\mathbb{D}_{sk_{\mathcal{RA}}^{X}}(\overline{ \mathbb{E}}_{pk_{\mathcal{RA}}^{X}}(X)) \tag{3}\]  
The message \(m_{9}\) contains the security token \(E_{pk_{\mathcal{RA}}}(B_{id},pk_{\mathcal{RA}}^{X},\mathbb{E}_{pk_{\mathcal{RA} }^{X}}(N))\). It is stored by \(\mathcal{CP}\) in a new entry in its databases, whose search key is the watermark \(W_{\mathcal{CP}}\). The entry also includes the following tokens: \(X_{d}\), \(T_{X}\), \(pk_{\mathcal{RA}}^{X}\), \(\mathbb{E}_{pk_{\mathcal{RA}}^{X}}(N)\), and \(\mathbb{S}_{\mathcal{RA}}(pk_{\mathcal{RA}}^{X},\mathbb{E}_{pk_{\mathcal{RA} }^{X}}(N))\).