# Blockchain-Assisted Verifiable and Multi-User Fuzzy Search Encryption Scheme
## 4 Definitions of Algorithm and Security Model
### Security Model  
The \(CS\) is considered an entity that may have malicious behavior and is not fully trustworthy, it may return untrue results to save computation and bandwidth resources, which can seriously harm the \(DU\). In addition, \(DU\) uploads its own set of attributes honestly to obtain \(user\_id\), all communication with \(TA\) is secure.  
Regarding privacy requirements, this article considers two threat models with different adversary capabilities.  
Known Ciphertext Model: The cloud server can only observe the encrypted file set, the encrypted index, the submitted tokens, and the search results. It has no prior knowledge of the file set or the search keywords.  
Known Background Model: the cloud server is also able to obtain some additional background information like statistical information about the files, the queried keywords and their corresponding tokens, and the frequency of searched keywords.  
A simulation-based game between adversary \(\mathcal{A}\) and a stateful simulator \(\mathcal{B}\) using an allowed leakage access model and a search model are used to prove security. Two leakage functions \(\mathcal{L}=(\mathcal{L}_{1},\ \mathcal{L}_{2})\) are defined, where \(\mathcal{L}_{1}\) and \(\mathcal{L}_{2}\) are expressed formally as follows.  
\(\mathcal{L}_{1}(D)=\left\{\left|D\right|,n,\left\{\left|F_{i}\right|,ind(F_{i} )\right\}_{i\in[1,n]}\right\}\) and takes the plaintext file collection \(D\) as input and outputs the plaintext collection size \(\left|D\right|\), the number of files \(n\), the size of each file \(\left|F_{i}\right|\), and file identifiers \(ind(F_{i})_{i\in[1,n]}\).  
\(\mathcal{L}_{2}(D,W_{q}{}^{*})=\left\{P(W_{q}{}^{*}),T^{*}\right\}\), it takes the plaintext file collection \(D\) and the search keyword collection as input and outputs the keyword access patterns \(P(W_{q}{}^{*})\) and search trapdoor \(T^{*}\). Here, suppose \(\mathcal{A}\) is an adversary, \(\mathcal{B}\) is a stateful simulator, and \(\mathcal{G}\) acts as a challenger. The interaction game between \(\mathcal{A}\), \(\mathcal{B}\), and \(\mathcal{G}\) is as follows.  
* \(Real_{A}(\lambda)\). \(\mathcal{G}\) initializes system and runs \(KeyGen(1^{\lambda},m)\to KS\), then sends a collection of files \(D\) to \(\mathcal{G}\). \(\mathcal{G}\) generates encrypted file \(C\) and index \(I\) with a secure symmetric encryption algorithm and index generation algorithm, then sends them to \(\mathcal{A}\). \(\mathcal{A}\) generates a polynomial number of keywords sets and launches an adaptive search \(Q_{1}=(w_{1},w_{2},\ldots,w_{q})\). Then the search keywords in set are transformed into a set of vectors to generate search trapdoor by \(\mathcal{G}\), which is sent to \(\mathcal{A}\). Eventually, \(\mathcal{A}\) outputs \(ansert\in\{0,1\}\), ending the game.
* \(Ideal_{\mathcal{A}}(\lambda)\). Given the leakage functions \(\mathcal{L}_{1}\) and \(\mathcal{L}_{2}\), \(\mathcal{G}\) inputs plaintext file \(D\). Simulator \(\mathcal{B}\) generates a simulated index \(I^{*}\) and ciphertext \(C^{*}\), sends \(I^{*}\) and \(C^{*}\) to \(\mathcal{A}\). \(\mathcal{B}\) chooses a polynomial number of keywords \(Q_{1}=(w_{1},w_{2},\ldots,w_{q})\) for adaptive interrogation, then outputs search trapdoor \(T_{t}{}^{*}\) based on \(\mathcal{L}_{2}\). Finally, \(\mathcal{A}\) outputs the result \(ansert\in\{0,1\}\), ending the game.