# Confidential Smart Contracts and Blockchain to Implement a Watermarking Protocol
## 7 Security Analysis
### Analysis  
The security analysis of the protocol can be conducted by mainly focusing on the specific functions performed by the smart contract and the blockchain, leaving aside the contract deployment phase, the outcome of which can be verified directly by \(\mathcal{CP}\) by accessing the information published on \(\mathcal{BC}\). As reported in Section 6, the smart contract is executed by \(\mathcal{CN}\) in two phases. In the first phase of contract execution, schematized in Figure 5, \(\mathcal{CN}\) receives from \(\mathcal{CP}\) and \(\mathcal{B}\) in \(m_{2}\) and \(m_{4}\) the preliminary encrypted information relating to the transaction by which \(\mathcal{B}\) wishes to purchase \(X\) from \(\mathcal{CP}\). \(\mathcal{CN}\) performs the first check and, if the received tokens are consistent, continues the execution of the contract, generating all the information and tokens necessary to protect \(X\) correctly. Then, \(\mathcal{CN}\) publishes on \(\mathcal{BC}\) two tokens, among others, \(E_{E_{E_{M}^{\mathcal{C}}}^{\mathcal{C}}}(Block)\) and \(H(Block)\): the first contains the encrypted information to be used for the protection of \(X\) and also represents the current state reached by the execution of the smart contract; the second represents a summary of this state. Both tokens can be generatedand are accessible only to \(\mathcal{CN}\). Finally, \(\mathcal{CN}\) sends two messages, \(m_{7}\) and \(m_{8}\), to \(\mathcal{CP}\) and \(\mathcal{B}\), respectively. In them, it includes, in the form of tokens encrypted with the secret keys of \(\mathcal{CP}\) and \(\mathcal{B}\), part of the information published on \(\mathcal{BC}\) and necessary to start phase 2 of the execution of the smart contract. Phase 2 of contract execution, shown in Figure 6, is started by \(\mathcal{CN}\) after \(\mathcal{CP}\) has released the watermarked content \(X\) to \(\mathcal{B}\), still in encrypted form. \(\mathcal{CN}\) retrieves the encrypted information from \(\mathcal{BC}\) related to the ongoing transaction. It checks and, if the encrypted information sent by \(\mathcal{CP}\) and \(\mathcal{B}\) is consistent with that published on \(\mathcal{BC}\), \(\mathcal{CN}\) generates the license to purchase \(X\) sold by \(\mathcal{CP}\) to \(\mathcal{B}\) and publishes it on \(\mathcal{BC}\). Then, \(\mathcal{CN}\) sends the private key \(sk^{X}\) to \(\mathcal{B}\), with which \(\mathcal{B}\) can decrypt \(\overline{\mathbb{E}}_{pk^{X}(X)}\) and obtain his protected and personalized accessible copy of \(\bar{X}\). From what has been reported so far, it emerges that the security of the proposed watermarking protocol depends on the following factors:  
* As reported in the preliminary assumptions, the execution of \(\mathcal{CN}\) in TEE ensures the correctness, integrity, and confidentiality of the computation performed. Figure 5: Phase 1 of contract execution. Figure 6: Phase 2 of contract execution. All tokens and information in messages exchanged between \(\mathcal{CN}\), \(\mathcal{CP}\), \(\mathcal{B}\), and \(\mathcal{BC}\) are always encrypted and accessible only to the entities responsible for managing them. * The watermarking phase of \(X\) implemented by \(\mathcal{CP}\) uses the security tokens generated during the first phase of smart contract execution. This phase can trigger the second phase of smart contract execution, which leads to the generation of the license to purchase \(X\) only if the information generated in the first phase by \(\mathcal{CP}\), \(\mathcal{B}\), and \(\mathcal{CN}\) is confirmed by \(\mathcal{CN}\) in the second phase. * The security tokens generated and used in the first phase of execution of the smart contract are fixed by the publication on the blockchain. By accessing \(\mathcal{BC}\), \(\mathcal{CN}\) is responsible for ensuring that these tokens are also used in the second execution phase of the smart contract. Suppose that \(\mathcal{B}\) is corrupt.