# Confidential Smart Contracts and Blockchain to Implement a Watermarking Protocol
## 5 Basics Assumptions  
The proposed watermarking protocol is based on the following assumptions.  
First, the entities participating in the protocol and all communications among them are secured using a public key infrastructure (PKI) and Transport Layer Security (TLS).  
Figure 4: The execution model.  
Digital contents and watermarks are represented according to block diagrams of the type \(X=\{x_{1},x_{2},\ldots x_{l}\}\) and \(W=\{w_{1},w_{2},\ldots w_{l}\}\), respectively. The elements of \(W\) are binary values that usually represent fingerprinting anti-collusion codes [22; 23; 24].  
Encryption and watermarking processes are represented by block-wise functions. As a consequence, the encryption \(E\) of a content \(X=\{x_{1},x_{2}\ldots x_{l}\}\) under the key \(k\) can be calculated as  
\[E_{k}(X)=E_{k}(x_{1},x_{2}\ldots x_{l})=(E_{k}(x_{1}),E_{k}(x_{2})\ldots E_{k} (x_{l}))\]  
Likewise, the insertion of the watermark \(W\) into the content can be calculated as  
\[X\oplus W=\{x_{1}\oplus w_{1},x_{2}\oplus w_{2},\ldots x_{l}\oplus w_{l}\}=\bar {X}\]  
in which \(\bar{X}\) is the watermarked content, and the symbol \(\oplus\) represents the insert function [22].  
Furthermore, \(\mathbb{E}\) denotes an encryption function \"homomorphic\" with respect to the watermark insertion [25]. Therefore, the watermark can be directly inserted into the encrypted domain according to the following formula [26]:  
\[\mathbb{E}_{k}(X\oplus W)=\mathbb{E}_{k}(X)\oplus\mathbb{E}_{k}(W)=\mathbb{E} _{k}(\bar{X})\]  
In particular, the function \(\mathbb{E}\) has to be \"probabilistic\" and \"semantically secure\". This means that the knowledge of a ciphertext does not provide any useful information on the plaintext to an adversary having only a reasonably restricted computational power represented by polynomial resources. Furthermore, \(\mathbb{E}\) can be limited to homomorphic encryption schemes that support addition or multiplication since such operations are functionally complete sets over finite sets and are sufficient to implement the most common and safe watermarking algorithms [25]. Therefore, if \(x\) is an element of \(X\) and \(w\) is an element of \(W\), the multiplicatively homomorphic encryption schemes ensure that [27]  
\[\mathbb{E}_{k}(x\cdot w)=\mathbb{E}_{k}(x)\cdot\mathbb{E}_{k}(w)\]  
whereas the additively homomorphic encryption schemes ensure that [28; 29]  
\[\mathbb{E}_{k}(x+w)=\mathbb{E}_{k}(x)\cdot\mathbb{E}_{k}(w)\]  
Finally, nodes that execute smart contracts must provide a CPU-based implementation of the TEE, such as the one provided by INTEL Software Guard eXtensions (SGX) [30; 31; 32]. This implementation must guarantee the confidentiality and integrity of the computation performed and must also be able to provide proof, in the form of attestations, of its correctness. To this end, following the example of the INTEL SGX system, a TEE node must generate an attestation each time it executes a smart contract. Then, the TEE node obtains proof of the validity of the attestation by contacting a specific service, such as the INTEL Attestation Service (IAS). The IAS receives the attestation and verifies it. If the attestation received is considered valid, the IAS returns a certification \(\Pi\) consisting of the attestation itself digitally signed by the IAS.