## 4 Security Proof and Efficiency  
We first formally prove that the proposed system is secure against the adaptive chosen-ciphertext attacks (CCA2), assuming the hardness of Decisional Diffie-Hellman Problem (DDHP) in the random oracle model as Theorem 1. **Theorem 1**. : _The proposed multi-user CP-ABE with keyword search is secure against the adaptive chosen-ciphertext attacks (CCA2) in the random oracle model provided that there is no polynomial-time adversary having a non-negligible advantage to break the intractable DDHP._ \begin{table}
\begin{tabular}{|p{227.6 pt}|} \hline
**Setup(\(1^{k}\))** \\ Choose system parameters \(p\), \(G_{1}\), \(G_{2}\), \(g\), \(e\), \(H\), \(F\), \(d\), \(\beta\), \(\Omega=\{attr_{1}\), \(\dots\), \(attr_{n}\)\(\}\), \(\mathbf{w}\), \(\Lambda=\{kw_{1}\), \(\dots\), \(kw_{1}\)\(\}\); \\ \hline
**ABE-KeyGen(\(id\), \(\mathbf{w}\))** \\ Choose \(t\in_{R}Z_{p}\)*; \\ Compute \(K=(g^{k})^{t}(g^{d})\), \(L=(g^{\delta})^{t}\), \(\{K_{x}=H(x)^{t}\}_{x\in w}\); \\ Record (\(id\), \(g^{dd}\)) in the user list; \\ return \(d_{id,\ w}=(K\), \(L\), \([K_{x}])\); \\ \hline
**KS-KeyGen(\(id\))** \\ If (id is in the user list) then \\ Compute \(q_{u}=g^{u}\) where \(u\in Z_{p}\)*; \\ Retrieve \(g^{dl}\) from the user list; \\ return \(q_{id}=(g^{dl})(q_{u}{}^{d})\); \\ \hline
**Encrypt(\(\mathbb{A}\), \(msg\))** \\ Choose a random vector \(v=(s\), \(y_{2}\), \(\dots\), \(y_{n})\in_{R}Z_{p}\)*; \\ Compute \(\lambda_{i}=\langle M_{i}\), \(v\rangle\), \(C=[e(g,g)^{d}]\)* \((msg)\), \(C^{*}=g^{s}\), \(\langle C_{i}=g^{d\lambda_{i}}H(\rho(i))^{-s}]\); \\ return \(ct=(C\), \(C^{*}\), \(\{C_{i}\})\); \\ \hline
**Index(\(kw\))** \\ Choose \(t_{i}\in_{R}Z_{p}\)* for each \(kw_{i}\in kw\); \\ Compute \(\{k_{i}=[e(g,g)^{d}]\)* \(e(g,H(kw_{i}))^{s}\}_{kw_{i}\in kw}\), \(IX(\mathbf{kw})=\{(t_{i},f_{i}=F(k_{i},t_{i}))\}_{kw_{i}\in kw}\); \\ return \(IX(kw)\); \\ \hline
**Re-Encrypt(\(ct\), \(\beta\))** \\ Compute \(C^{*}=C^{\beta}\) and return \(ct^{*}=(C^{*}\), \(C^{*}\), \([C_{i}])\); \\ \hline
**Trapdoor(\(q_{id}\), \(kw\), \(d_{id}\), \(w\), \(\beta\))** \\ Compute \(T_{q}(kw)=(g^{H(kw)})(q_{id}{}^{-u})\), \(L^{*}=L^{-u}\), \(\{K^{\prime}_{x}=K_{x}{}^{-u}\}_{x\in w}\), \(L^{*}=(L^{*})^{\beta^{-1}}\); \\ return \(T_{kw}=(T_{q}(kw),L^{*}\), \(\{K^{\prime}_{x}\}_{x\in w})\); \\ \hline
**Test(\(T_{kw}\), \(\mathbf{w}\))** \\ Check all (\(ct\)*, \(IX(\mathbf{kw})\)) and embedded access policy (\(M_{IX,n}\), \(\rho\)); \\ If (\(w\) fulfills the access policy (\(M_{IX,n}\), \(\rho\)) of some ciphertext \(ct^{*}\)) then \\ Compute \(Q_{ct}=\Pi_{i\in I}e(C_{i}\), \(L^{*})e(C^{*}\), \(K^{\prime}_{q(i)}))|u^{i}\), \(k_{kw}=e(C^{*}\), \(T_{q}(kw))/Q_{ct}\); \\ If (\(IX(kw)\)) satisfies \(\{f_{i}=F(k_{kw},t_{i})\}_{f_{i}\in IX(kw)}\) then return (\(ct^{*}\), \(Q_{ct}\)); \\ return \(\bot\); \\ \hline
**Pre-Decrypt(\(ct^{*}\), \(Q_{ct}\), \(\beta\))** \\ Compute \(C=(C^{*})^{\beta^{-1}}\) and return \(Q_{ct}\) & \(ct=(C\), \(C^{*}\), \(\{C_{i}\})\); \\ \hline
**Decrypt(\(ct\), \(Q_{ct}\), \(d_{id,\ w}\))** \\ return \(msg=C\cdot Q_{ct}{}^{u}\)/\(c(C^{*}\), \(K)\); \\ \hline \end{tabular}
\end{table} 
Table 2: The pseudo-code of the proposed system. **Proof. ** We will complete this security proofs by showing that if the ciphertext indistinguishability of the proposed system could be broken by a polynomial-time adversary \(\mathcal{A}\), another DDH distinguisher \(\mathcal{B}\) could also be built by calling \(\mathcal{A}\) as a subroutine. The goal of \(\mathcal{B}\) is to decide whether \(g^{c}=g^{ab}\) or not by giving a DDHP instance (\(g\), \(g^{a}\), \(g^{b}\), \(g^{c}\)). In the following simulation game, the distinguisher \(\mathcal{B}\) is responsible for answering queries submitted by the adversary \(\mathcal{A}\). \(\square\)  
**Setup:** Initially, \(\mathcal{B}\) chooses \(\beta\in Z_{p}\)* and computes \(g^{\beta}\) as the key pair of PS. The public key of TA is set as \((g^{c}\), \(e(g^{c},g))\).