# A Watermarking Protocol Based on Blockchain
## 5 Watermarking Protocol
### Protection Protocol
Then, \(\mathcal{CP}\) generates the signature \(\mathbb{S}_{\mathcal{CP}}(X_{d},T_{X},pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{S} _{\mathcal{R}\mathcal{A}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X}_{ \mathcal{R},\mathcal{A}}}(N)))\) and sends the message \(m_{4}\) to \(\mathcal{B}\), which includes \(X_{d}\), \(T_{X}\), \(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{S}_{\mathcal{R}\mathcal{A}}(pk^{X}_{ \mathcal{R},\mathcal{A}},\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N))\), and \(\mathbb{S}_{\mathcal{CP}}(X_{d},T_{X},pk^{X}_{\mathcal{R},\mathcal{A}}, \mathbb{S}_{\mathcal{R}\mathcal{A}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E} _{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)))\). After having confirmed the purchase request, \(\mathcal{CP}\) can apply the protection to \(X\). Therefore, \(\mathcal{CP}\) generates its part of watermark, denoted by \(W_{\mathcal{CP}}\), which is a fingerprinting binary code obtained as an anti-collusion code [6; 7; 16] concatenated with an error correcting code used to address the problems of bit errors that can arise during the watermark verification process. Then, \(\mathcal{CP}\) encrypts \(W_{\mathcal{CP}}\) and \(X\) using the public key \(pk^{X}_{\mathcal{R},\mathcal{A}}\) and the same homomorphic cryptosystem used by \(\mathcal{R}\mathcal{A}\) to encrypt \(N\), thus generating \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(W_{\mathcal{CP}})\) and \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(X)\). Then, according to the basics reported in Section 4, \(\mathcal{CP}\) concatenates \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(W_{\mathcal{CP}})\) and \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)\) to generate the encrypted watermark \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(W)\) according the following expression:  
\[\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(W)\!=\!\mathbb{E}_{pk^{X}_{ \mathcal{R},\mathcal{A}}}(W_{\mathcal{CP}})\|\mathbb{E}_{pk^{X}_{\mathcal{R}, \mathcal{A}}}(N)\!=\!\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(W_{ \mathcal{CP}}\|N) \tag{1}\]  
Moreover, \(\mathcal{CP}\) can embed the encrypted watermark \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(W)\) directly into the encrypted content \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(X)\) according to the following expression:  
\[\overline{\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(X)}=\mathbb{E}_{pk^{ X}_{\mathcal{R},\mathcal{A}}}(X)=\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(X \oplus W)=\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(X)\oplus\mathbb{E}_{ pk^{X}_{\mathcal{R},\mathcal{A}}}(W) \tag{2}\]  
since encryption is homomorphic with respect to watermark insertion [10; 49; 50]. The encrypted and watermarked content \(\overline{\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(X)}\) can be thus sent by \(\mathcal{CP}\) to \(\mathcal{B}\) in the message \(m_{5}\). At this point, \(\mathcal{CP}\) and \(\mathcal{B}\) can activate the smart contract in the blockchain \(\mathcal{BC}\) by sending the messages \(m_{6}\) and \(m_{7}\), respectively. In particular, the message \(m_{6}\) is sent by \(\mathcal{CP}\) to \(\mathcal{BC}\), and contains \(X_{d}\), \(T_{X}\), \(pk^{X}_{\mathcal{R},\mathcal{A}}\), \(\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)\), \(\mathbb{S}_{\mathcal{R}\mathcal{A}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E} _{pk^{X}_{\mathcal{R},\mathcal{A}}}(N))\), and the signature \(\mathbb{S}_{\mathcal{CP}}(X_{d},T_{X},pk^{X}_{\mathcal{R},\mathcal{A}}, \mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N),\mathbb{S}_{RA}(pk^{X}_{\mathcal{ R},\mathcal{A}},\mathbb{E}_{pk^{X}_{\mathcal{R},\mathcal{A}}}(N)))\). The message \(m_{7}\) is sent by \(\mathcal{B}\) to \(\mathcal{BC}\), and includes \(X_{d}\), \(T_{X}\), \(pk^{X}_{\mathcal{R},\mathcal{A}}\), and \(\mathbb{S}_{\mathcal{R}\mathcal{A}}(pk^{X}_{\mathcal{R},\mathcal{A}},\mathbb{E} _{pk^{X}_{\mathcal{R},\mathcal{A}}}(N))\).