## 6 Security and Performance Analysis
### Security Analysis  
We assume a probabilistic polynomial-time adversary \(\mathcal{A}\) to break the proposed methodology with a non-negligible advantage. In this regard, we created a simulator \(\mathcal{B}\) that can break the decisional q-parallel bilinear Diffie-Hellman exponent by \(\frac{\epsilon}{2}\). \(\mathcal{C}\) first selects \(\mathcal{G}\) and \(\mathcal{G}_{\mathcal{T}}\) and \(e:\mathcal{G}*\mathcal{G}\rightarrow\mathcal{G}_{\mathcal{T}}\). The \(\mathcal{C}\) tosses a uniform coin and chooses the random number (in bits) \(v\in(0,1)\), given that \(\vec{y}=\big{(}g,g_{1},\ldots,g_{q},g_{q+2},\ldots,g_{2q},g_{s}\big{)}\). If \(v=1\), the \(\mathcal{C}\) orders \(\mathcal{T}=\hat{e}(g,g)^{at+1}\); otherwise, \(\mathcal{T}=Z\). The \(Z\) is randomly chosen from \(\mathcal{G}_{\mathcal{T}}\). Further details are given below. 1. **Initialization:**\(\mathcal{A}\) selects \((\mathcal{M}^{*},\rho^{*})\) and \(u^{*}\). 2. **Setup:** The simulator \(\mathcal{B}\) accepts \(GP\), i.e., \(GP=(\mathcal{G},\mathcal{G}_{\mathcal{T}},p,g,e,U,AID,UID,\mathcal{H},\mathcal{ F},\mathcal{T})\) from the \(\mathcal{C}\), and delivers to \(\mathcal{A}\). The adversary \(\mathcal{A}\) obtains a set of corrupt authorities \(AID_{\mathcal{C}}\subset AID\) and the remaining noncorrupt authorities \(AID_{N}=(AID-AID_{\mathcal{C}})\). As a result, \(\mathcal{B}\) accepts the data from \(\mathcal{A}\) and transmits them to \(\mathcal{C}\). 3. **Phase 1:** For noncorrupt authorities \(AID_{N}\), \(\mathcal{C}\) transmits the authorized public keys to \(\mathcal{B}\), which are then transmitted to \(\mathcal{A}\). Consider the secret key query \((uid,S_{uid,aid})\) from \(\mathcal{A}\), where \(uid\in UID\), \(S_{uid,aid}\in U\). \(\mathcal{B}\) transmits it to \(\mathcal{C}\) and attains the private key \(SK_{S,aid,aid}=\left\{ \begin{array}{l}K_{uid,i},K_{uid,i}^{{}^{\prime}}\\ \end{array} \right\}_{i\in S_{uid,aid}}.\) For each attribute \(x\in S_{uid,aid}\), \(\mathcal{B}\) executes Attr-Group _Key-Gen._ in order to generate a Binary State Tree and an attribute-group key. Here, it is important to see that \(PATH_{u}id\) is included in the tree. Finally, \(\beta\) transmits \(SK_{S,uid,aid}\) and \(PATH_{uid}\) to \(\mathcal{A}\). 4. **Challenge:**\(\mathcal{A}\) sends \((m_{0},m_{1})\) of equal length and \(a_{p}\), i.e., \(\left\{\left(\mathcal{M}_{1}^{*},p_{1}^{*}\right),\ldots,\left(\mathcal{M}_{q} ^{*},p_{q}^{*}\right)\right\}\) to \(\mathcal{B}\). Thus, \(\mathcal{B}\) sends to \(\mathcal{C}\). Thus, \(\mathcal{C}\) tosses a random coin, i.e., \(b\in\{0,1\}\), and encrypts \(m_{b}\). \(\mathcal{C}\) sends the challenge ciphertext \(\left\{CT_{1},\ldots,CT_{q}\right\}\) to \(\mathcal{B}\). Then, \(\mathcal{B}\) runs the \(Attr-GroupKey-Gen.\) and re-encrypts the ciphertext as \(CT_{i}^{*}\). Finally, \(\mathcal{B}\) sends the ciphertext \(\left\{\mathcal{CT}_{q}^{*},\ldots,\mathcal{CT}_{q}^{*}\right\}\) to \(\mathcal{A}\). Furthermore, we consider a scenario where \(\mathcal{A}\) delivers the updated query of the secret key to submit \((uid,S_{uid,aid})\) and revoke the attribute \(u\). However, each \(uid\) is an unrevoked end user having attribute \(u\). As a result, \(\mathcal{B}\) computes the secret key query to obtain \(SK_{S,aid,aid}\) from \(\mathcal{C}\) and computes the process, i.e., \(KeyUpdate(uid,SK_{S,uid,aid},u,\)\(AGK_{u}^{{}^{\prime}})\to SK_{S,uid,aid}^{{}^{\prime}}\) to transmit the updated secret key \(SK_{S,uid,aid}^{{}^{\prime}}\) to \(\mathcal{A}\). The \(\mathcal{A}\) can also make the _UkeyGen._ query for the challenge messages \((m_{0},m_{1})\) between two access policies, i.e., \(\left(\mathcal{M}_{i}^{*},\rho_{i}^{*}\right)\) and \(\left(\mathcal{M}_{i}^{*},\rho_{i}^{*}\right)\), \(\forall i\
eq j\)\(\xi\)\(i,j\in[1,q]\). \(B\) sends the request to \(\mathcal{C}\). Since only one \(m_{b}\) is selected by \(\mathcal{C}\) in the encryption stage, we assume that the random encryption numbers are the same in encrypting \(m_{0}\) and \(m_{1}\).