# Confidential Smart Contracts and Blockchain to Implement a Watermarking Protocol
## 6 The Protocol
### The Protection Protocol
#### 6.1.2 Protection  
This phase, whose scheme is shown in Table 3, starts when \(\mathcal{B}\) requests the purchase of content \(X\) from \(\mathcal{CP}\) in message \(m_{1}\), also sending its unique identifier \(B_{id}\). In particular, \(B_{id}\) can be a personal digital certificate, an anonymous digital certificate, a credit card reference, or any other document that can refer to \(\mathcal{B}\) unambiguously [18]. \(\mathcal{CP}\) generates a unique descriptor of \(X\), denoted by \(X_{d}\), and a timestamp \(T_{X}\) needed to identify the ongoing transaction. Then, \(\mathcal{CP}\) generates a secret key \(K^{X}_{\mathcal{CP}}\) to be used only in this transaction, which must be used by the smart contract to encrypt the output data to be returned to \(\mathcal{CP}\). \(\mathcal{CP}\) also reads from \(\mathcal{BC}\) the identifier \(c_{id}\) and the corresponding public key \(pk_{c_{id}}\) relating to the previously deployed contract that implements the watermarking protocol. Finally, \(\mathcal{CP}\) chooses one or more TEE nodes to which to delegate the execution of the contract. Assuming, for simplicity, that the contract is executed by a single TEE node, indicated by \(\mathcal{CN}\), \(\mathcal{CP}\) sends it the message \(m_{2}\), which contains two tokens: the \(c_{id}\) and the set of \(B_{id}\), \(X_{d}\), \(T_{X}\), \(K^{X}_{\mathcal{CP}}\), and the payment specification \(\sigma(X)\), all encrypted with the contract's public key \(pk_{c_{id}}\). In particular, the specification \(\sigma(X)\) allows \(\mathcal{CN}\) to be remunerated for the execution activity performed. \(\mathcal{CP}\) then sends the reference of \(\mathcal{CN}\), \(X_{d}\), \(T_{X}\), \(c_{id}\), and \(pk_{c_{id}}\) to \(\mathcal{B}\) in message \(m_{3}\). Similarly to \(\mathcal{CP}\), \(\mathcal{B}\) generates its secret key \(K^{X}_{B}\) to be used only in this transaction and needed to receive the encrypted output data of the smart contract. Then, \(\mathcal{B}\) encrypts \(B_{id}\), \(X_{d}\), \(T_{X}\), and \(K^{X}_{\mathcal{B}}\) with the key \(pk_{c_{id}}\), and sends the encrypted token and \(c_{id}\) to \(\mathcal{CN}\) in message \(m_{4}\). Once messages \(m_{2}\) and \(m_{4}\) are received, \(\mathcal{CN}\) starts the execution in TEE of the contract identified by \(c_{id}\). \(\mathcal{CN}\) fetches the contract from \(\mathcal{BC}\), together with the associated information \(E_{K^{st}_{id}}\left(in_{c_{id}}\right)\), \(\Pi[AttD[c_{id},pk_{c_{id}}]]\), and \(pk_{c_{id}}\), and loads them into its TEE. \(\mathcal{CN}\) sends message \(m_{5}\) to \(KMS\). Then, \(\mathcal{CN}\) receives in response message \(m_{6}\), which contains the keys \(K^{st}_{c_{id}}\) and \(sk_{c_{id}}\), which can be used to decrypt the current state and the information received as input related to the contract. \(\mathcal{CN}\), once decrypted, checks the consistency of the information contained in messages \(m_{2}\) and \(m_{4}\). If the check is passed, \(\mathcal{CN}\) continues the execution of the contract in its secure enclave. \(\mathcal{CN}\) generates three tokens: (1) a public-private key pair (\(pk^{X}\), \(sk^{X}\)) to be used exclusively in the current transaction; (2) a \"nonce\" \(N\) consisting of a binary string; and (3) the token \(\mathbb{E}_{pk^{X}}(N)\) obtained by encrypting \(N\) with \(pk^{X}\) and a \"privacy homomorphic\" cryptosystem with respect to the watermarking algorithm used. At this point, \(\mathcal{CN}\) generates the block  
\[Block=[B_{id},X_{d},T_{X},pk^{X},sk^{X},N,\mathbb{E}_{pk^{X}}(N),K^{X}_{\mathcal{ CP}},K^{X}_{\mathcal{CP}}]\]  
and encrypts it with the key \(K^{st}_{\text{cl}}\), generating \(E_{K^{st}_{id}}\) (\(Block\)). Then, \(\mathcal{CN}\) calculates the digest of \(Block\), denoted by \(H(Block)\), and obtains the certification of the correct execution of this first computational phase, denoted by \(\Pi[Att1]\).