# Blockchain and Cloud to Overcome the Problems of Buyer and Seller Watermarking Protocols
## 5 Security Analysis
### Analysis
#### 5.2.1 \(\mathcal{CP}\) Is Corrupt  
Suppose that \(\mathcal{CP}\) wants to cheat \(\mathcal{B}\). Preliminarily, it is assumed that \(B_{id}\) cannot be altered since the current analysis does not address the problem of fake identities. Moreover, it is useless to consider the possible changes to \(X_{d,t}\), \(W\) and the key pair \((pk_{\mathcal{CP}}^{X},pk_{\mathcal{CP}}^{X})\), since they are still generated by \(\mathcal{CP}\). Therefore, the only tokens that \(\mathcal{CP}\) can try to alter to cheat \(\mathcal{B}\) are \(pk_{\mathcal{B}}^{X}\), \(\mathbb{E}_{pk_{\mathcal{B}}^{X}}(\mathbb{E}_{pk_{\mathcal{CP}}^{X}}(N))\), \(E_{\mathcal{RA}}\), and \(\mathbb{S}_{\mathcal{RA}}\). The first token to consider is the key \(pk_{\mathcal{B}}^{X}\). Its path among the entities involved in the protocol is shown in Figure 0(a), where the corrupt entity is draw as a circle. In particular, \(pk_{\mathcal{B}}^{X}\) is generated by the trusted entity \(\mathcal{RA}\) and is initially received by \(\mathcal{CP}\) and \(\mathcal{B}\) in the messages \(m_{3}\) and \(m_{4}\). Then, it is sent to \(\mathcal{BC}\) by \(\mathcal{B}\) in the message \(m_{9}\). Finally, \(pk_{\mathcal{B}}^{X}\) is returned to \(\mathcal{RA}\) in the message \(m_{11}\) (see Table 3). Suppose that \(\mathcal{CP}\) wants to alter the key \(pk_{\mathcal{B}}^{X}\) used to protect \(X\), thus generating the corrupt key \(pk_{\mathcal{B}}^{X^{c}}\). Such an action succeeds only if the check carried out by \(\mathcal{BC}\) after the reception of the messages \(m_{8}\) and \(m_{9}\) is passed (see also Table 3 and Figure 0(a)). In fact, the tokens contained in the two messages enable \(\mathcal{BC}\) to verify the signature \(\mathbb{S}_{\mathcal{RA}}\), which is calculated on \(X_{d,t}\), \(pk_{\mathcal{B}}^{X}\), \(pk_{\mathcal{CP}}^{X}\), \(\mathbb{E}_{pk_{\mathcal{B}}^{X}}(\mathbb{E}_{pk_{\mathcal{CP}}^{X}}(N))\), and \(E_{\mathcal{RA}}\). Since \(\mathcal{BC}\) receives \(pk_{\mathcal{B}}^{X}\) only from \(\mathcal{B}\), who in turn receives this key from \(\mathcal{RA}\), \(\mathcal{CP}\) can replace \(pk_{\mathcal{B}}^{X}\) with \(pk_{\mathcal{B}}^{X^{c}}\) only if it can generate the corrupt tokens \(\mathbb{S}_{\mathcal{RA}}^{c}\) and \(E_{\mathcal{RA}}^{c}\), which are to be both consistent with \(pk_{\mathcal{B}}^{X^{c}}\). However, assuming that the key pair \((pk_{\mathcal{RA}},sk_{\mathcal{RA}})\) is not impaired, \(\mathcal{CP}\) cannot generate these tokens. Furthermore, as reported in Section 4.3, the protocol prevents the reuse of the tokens previously published in the blocks of the blockchain, which are just \(X_{d,t}\), \(pk_{\mathcal{B}}^{X}\), \(pk_{\mathcal{CP}}^{X}\), \(\mathbb{E}_{pk_{\mathcal{B}}^{X}}(\mathbb{E}_{pk_{\mathcal{CP}}^{X}}(N))\), \(\mathbb{S}_{\mathcal{RA}}\), and \(E_{\mathcal{RA}}\). In fact, any transaction can successfully complete only if the tokens included in the messages \(m_{8}\), \(m_{9}\), and \(m_{11}\) are consistent, have not been already published in the blocks of the blockchain, and have been directly generated or initially received by \(\mathcal{RA}\) in the message \(m_{2}\). More precisely, the protocol is made secure by three main properties:  
1. It is impossible to reuse the tokens generated in a successfully completed purchase transaction since, in this hypothesis, they are already published in a block of the blockchain. 2. \(\mathcal{CP}\) cannot force the use of specific or arbitrary tokens during a purchase transaction, since only the tokens initially generated by \(\mathcal{RA}\) and sent to \(\mathcal{B}\) in the message \(m_{4}\) can be used during the ongoing transaction. These tokens are then sent by \(\mathcal{B}\) to \(\mathcal{BC}\) in the message \(m_{9}\), and forwarded to \(\mathcal{RA}\) in the message \(m_{11}\), along a path over which \(\mathcal{CP}\) has no control (see Figure 1a). 3. A purchase transaction can complete only if all the tokens published in the corresponding block of the blockchain are consistent.