an anonymous fingerprinting scheme in accordance with a preferred embodiment of the present invention makes use of a bilinear map on an elliptic curve to construct a group g , in which a c - dh ( computational diffie - hellman ) problem is intractable but a d - dh ( decisional diffie - hellman ) problem is tractable . however , since in the d - dh problem , it is too easy to build cryptosystems , the security of the anonymous fingerprinting scheme in accordance with the present invention is intrinsically based on an intractability of the c - dh problem called a b - dh ( bilinear diffie - hellman ) problem . the anonymous fingerprinting scheme using b - dh problem in accordance with the present invention includes following three procedures : a registration procedure ( step s 100 ), a fingerprinting procedure ( steps s 200 and s 300 ) and an identification procedure ( step s 400 ), wherein the registration procedure involves a key generation process and the fingerprinting procedure is divided into a buyer authentication process ( step s 200 ) and a fingerprints embedding process ( step s 300 ), as shown in fig1 . [ 0026 ] fig2 represents an anonymous fingerprinting scheme in accordance with the present invention , which includes a buyer 100 , a merchant 200 and a registration authority 300 , each of which has a storage medium , e . g ., a memory , and an operating unit , e . g ., a cpu , as participants of the anonymous fingerprinting scheme . each of the participants , which may be a computer system or an actual user , communicates remotely through any kind of communications network or other techniques . information to be transferred between each of the participants may be stored or detained in various types of storage media . the registration authority 300 , which has an operating unit ( not shown ) for computing algorithms and a storage medium 301 for storing computed results or specific information , introduces system parameters to be shared and utilized by the buyer 100 and the merchant 200 . also , the registration authority 300 produces a public key and a secret key of the buyer 100 based on the system parameters and then provides corresponding keys to the buyer 100 through secure channels . further , the registration authority 300 issues a certificate so that the buyer 100 can prove fairness for itself to the merchant 200 . moreover , when the merchant 200 detects a clue for a buyer to be a traitor and presents the registration authority 300 with a proof that the buyer is the traitor , the registration authority 300 ascertains whether the buyer is truly the traitor . the buyer 100 , which has an operating unit ( not shown ) for computing algorithms and a storage medium 101 for storing computed results or specific information , registers information of the buyer such as personal profile to the registration authority 300 by using the public and the secret key of the buyer 100 provided from the registration authority 300 . the information on the buyer 100 becomes grounds that the merchant 200 can distinguish the buyer 100 from another buyers when the merchant 200 finds an illegal digital content . that is , when the illegal digital content is found , the information on the buyer 100 can be used for the merchant 200 to ascertain who an original buyer of the illegal digital content is . the buyer 100 authenticates fairness for itself to the merchant 200 by using the secret and the public key of the buyer 100 and the certificate provided from the registration authority 300 . further , the buyer 100 participates in the fingerprints embedding process through an interactive protocol with the merchant 200 , while concealing an identity of the buyer 100 , after being determined to be fair in the buyer authentication process . the merchant 200 , which has an operating unit ( not shown ) for computing algorithms and a storage medium 201 for storing computed results or specific information , examines information presented by the buyer 100 to verify fairness of the buyer 100 . further , the merchant 200 participates with the buyer 100 in the fingerprints embedding process . hereinafter , the anonymous fingerprinting scheme using b - dh problem of the present invention will be described with reference to fig3 to 6 , in detail . [ 0033 ] fig3 depicts a flow chart for illustrating the key generation process of the registration procedure in the anonymous fingerprinting scheme using b - dh problem . at step s 101 , the registration authority 300 generates cyclic groups g 1 and g 2 , each of which is of a prime order m , and then takes an arbitrary generator p out of the cyclic group g 1 , wherein the cyclic group g 1 is an elliptic curve group and the cyclic group g 2 is a cyclic multiplicative group . at step s 102 , the registration authority 300 produces a bilinear map e on the two cyclic groups g 1 and g 2 as follows : at step s 103 , the registration authority 300 stores system parameters such as g 1 , g 2 and p in the storage medium 301 and opens the system parameters so that the buyer 100 and the merchant 200 can share and use them . at step s 104 , the registration authority 300 selects random values s 1 , s 2 and s 3 corresponding to g 2 to generate a secret key { s 1 , s 2 , s 3 } of the buyer 100 and then calculates a public key y b of the buyer 100 as follows : y v = e ( p , p ) s 1 s 2 s 3 eq . 2 and then the secret key { s 1 , s 2 , s 3 } and the public key y b are forwarded to the buyer 100 to be stored in the storage medium 101 of the buyer 100 . hereinafter , the registration procedure after the key generation process in the anonymous fingerprinting scheme using b - dh problem will be described as shown in fig4 . at step s 201 , the registration authority 300 selects an arbitrary random value . x r corresponding to the cyclic group g 2 based on the system parameters , calculates a confidential value t r as follows : , and then sends the confidential value t r to the buyer 100 , wherein t r is used to make it sure that x r is safely sent to the buyer 100 . at step s 202 , the buyer 100 computes pseudonym keys x and y by using the secret key { s 1 , s 2 , s 3 } as follows : and then sends the pseudonym keys x and y to the registration authority 300 . at step s 203 , on receiving the pseudonym keys x and y , the registration authority 300 verifies validity of the pseudonym keys x and y as follows : e ( y , p )= y b · e ( p , t r ) eq . 6 . at step s 204 , if the pseudonym keys x and y determined to be valid , the registration authority 300 calculates t as follows : and stores calculated result in the storage medium 301 , wherein t is an intermediate value for judging whether or not the buyer 100 is an owner of a secret key corresponding to the pseudonym keys x and y . at step s 205 , the registration authority 300 issues certificates cert ( t ) and cert ( y | x r ), which certify respectively validities of t and y , for proving a fairness of the buyer 100 and then forwards the certificates cert ( t ) and cert ( y | x r ) to the buyer 100 . at step s 206 , on receiving the certificates cert ( t ) and cert ( y | a r ), the buyer 100 calculates t ′ as follows : wherein t ′ is a value for notifying that the buyer 100 is an owner of a secret key corresponding to the pseudonym keys x and y . then the buyer 100 views ( y , t ′) as a pseudonym pair and safely stores the pseudonym pair ( y , t ′) in the storage medium 101 . next , the buyer authentication process in the anonymous fingerprinting scheme using a b - dh problem will be carried out as shown in fig5 . at step s 301 , the buyer 100 sends y , [ t ′, cert ( t )] and text to the merchant 200 , wherein the text represents normal information about a digital content to be fingerprinted . at step s 302 , the buyer 100 selects an arbitrary random value k corresponding to g 2 , thereby generating a b - dh signature sig to be embedded as follows : sig = sign ( text , s 1 , s 2 , s 3 , x r , k ) eq . 9 . at step s 303 , the merchant 200 checks fairness of the buyer 100 based on the certificate cert ( t ) sent from the buyer 100 . if the buyer 100 is determined to be fair , the merchant 200 stores [ t ′, cert ( t )] as a purchase record of the buyer 100 in the storage medium 201 . [ 0054 ] fig6 shows a fingerprints embedding process for the buyer 100 and the merchant 200 , which is realized through a secure two - party computation between them . at step s 401 , the buyer 100 and the merchant 200 exchange certain information therebetween . that is , the buyer 100 sends x r , sig , s 1 , x 2 , cert ( y | x r ) to the merchant 200 and the merchant 200 presents t ′, y , the text and em to the buyer 100 , wherein em denotes the digital content to be fingerprinted . at step s 402 , a specific value val 1 is generated as follows : val n = verify 1 ( text , sig , y ) eq . 10 , val 1 being a boolean variable to be seen by only the merchant 200 when verification of the b - dh signature sig for the text is completed successfully . at step s 403 , a particular value val 2 is generated as follows : val 2 = verify 2 ( y , cert ( y | x r ), s 1 , s 2 , x r , t ′) eq . 11 val 2 being also a boolean variable to be seen by only the merchant 200 when the certificate cert ( y | x r ) and the b - dh signature sig for the text are respectively verified as to be described later . at step s 404 , the merchant 200 generates emb as follows : emb = text | sig | y | cert ( y | x r )| s 1 | s 2 | x r | t ′ eq . 12 to be stored in the storage medium 201 , wherein emb represents fingerprints to be embedded into the digital content em . at step s 405 , the merchant 200 obtains a fingerprinted digital content em * as follows : and then sends the fingerprinted digital content em * to the buyer 100 . as a consequence , the fingerprinted digital content em * is obtained as an output of the two - party computation and is seen by only the buyer 100 . however , the buyer 100 cannot get the fingerprinted digital content em * unless both val 1 and val 2 from eqs . 10 and 11 are true . finally , an identification procedure is carried out in case where the merchant 200 detects a clue for a buyer to be a traitor . referring to fig7 at step s 501 , the merchant 200 verifies the b - dh signature sig for the text as follows : t ″= e ( s 1 s 2 p , x r p ) eq . 14 and then stores the verified result from eq . 14 in the storage medium 201 , wherein t ″ is a value for checking whether or not the buyer 100 is an owner of a secret key corresponding to the pseudonym key y ′. at step s 502 , the merchant 200 examines who is an owner of a pseudonym key y ′, as follows : e  ( y ′ , p ) = e  ( s 1  s 2  s 3  p + t r  p ) = e  ( s 1  s 2  s 3  p + x r  p , p ) = e  ( s 1  s 2  s 3  p , p ) · e  ( x r  p ,  p ) = y b · e  ( p , p ) x r , eq .  15 , wherein if the pseudonym key y ′ satisfies eq . 15 , the merchant 200 can prove that the owner of the pseudonym key y ′ is the traitor . that is , only x r is associated with t and y as seen from eq . 5 and eq . 7 and only the registration authority 300 can provide x r such that the result t ″ of eq . 14 is same as the result t of eq . 7 . further , the buyer 100 cannot produce t ′ identical to t without knowing x r in polynomial time and the merchant 200 cannot forge x r because t and y are certified by only the registration authority 300 . therefore , x r can be used for proving that an owner of the pseudonym key y ′ is same as that of t ′. in other words , the merchant 200 can prove that the buyer 100 is a traitor because t ″ calculated by the merchant 200 based on t ′ provided from the buyer 100 does not correspond to t calculated by the registration authority 300 . while the invention has been shown and described with respect to the preferred embodiments , it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention as defined in the following claims .