# DSVN: A Flexible and Secure Data-Sharing Model for VANET Based on Blockchain
## 5 Security Analysis  
**Theorem 1**. : _If the CDH assumption holds in Group \(\mathbb{G}\), then no CPA attacker can selectively corrupt the scheme in polynomial time with a non-negligible advantage._  
Proof. : Assuming that attacker \(\mathcal{A}\) can selectively break the scheme proposed in this paper with a non-negligible advantage \(Adv_{\mathcal{A}}=\varepsilon\) after executing \(q_{1}\) times Type-1 and \(q_{2}\) times Type-2 key queries, then a challenger \(\mathcal{C}\) can be constructed to break the CDH assumption with a non-negligible advantage \(Adv_{\mathcal{C}}=\varepsilon/(q_{1}\cdot q_{2})\). This section describes the IND-CPA security model of the scheme, which is a game between a challenger and an attacker. The flow is as follows:  
**Init**: The challenger \(\mathcal{C}\) inputs a random CDH challenge \(A=g^{Z_{1}}\) and \(B=g^{Z_{2}}\). The attacker \(\mathcal{A}\) selects the access structure \(T^{*}\) and attribute \(att_{x}^{*}\) to be sent to \(\mathcal{C}\), where \(att_{x}^{*}\) is a required attribute to satisfy \(T^{*}\). Setup: The challenger \(\mathcal{C}\) generates \(PK=\left(g,e(g,g)^{\text{a}},h=g^{\text{g}}\right)\), \(MSK=(\beta,g^{\text{a}})\), \(\overline{DPK}=\{T_{i}|1\leq i\leq n,i\
eq x\}\cup\{\overline{T_{x}^{*}}\}\), and \(\overline{MSK}=\{t_{i}|1\leq i\leq n,i\
eq x\}\cup\{\overline{t_{x}^{*}}\}\). Among them, \(\overline{T_{x}^{*}}=(T_{x}^{*})^{z_{1}}\) is a theoretical value. Then \(\mathcal{C}\) sends \(PK\) to \(\mathcal{A}\). **Phase 1**: The attacker \(\mathcal{A}\) can request two types of keys. The challenger \(\mathcal{C}\) initializes two empty lists \(L_{1}\), \(L_{2}\) to record the requested key. **Type-1**: The attributes set \(S_{1}\) of user \(u_{1}\) satisfies the access structure \(T^{*}\), but the attribute \(att_{x}^{*}\) are revoked. The challenger \(\mathcal{C}\) calculates \(SK_{u_{1}}\), \(kek\) and \(KEK\), then sends them to \(\mathcal{A}\):  
\[ \begin{split}& SK_{u_{1}}=(D,D^{\prime},USK_{1})=(g^{\frac{4+u_{1} \cdot q_{2}}{\beta}},g^{u_{1}\cdot Z_{2}\cdot USK_{1}},USK_{1}),\\ & kek=\begin{cases}\left\{att_{i},kek_{i}=g^{t_{i}\cdot u_{1} \cdot USK_{1}}\right\}&att_{i}\in S_{1},i\
eq x\\ \left\{att_{x},kek_{x}^{*}=g^{t_{x}\cdot u_{1}\cdot USK_{1}\cdot Z_{2}}\right\}&att_{x}^{*} \in S_{1}\\ \end{cases},\\ KEK_{S_{1}}=\left\{KEK_{i}\right\}_{i\
eq x}\cup\left\{KEK_{x}^{*}=(kek_{x}^{ *})^{1/\theta^{*}}=B^{t_{x}^{*}\cdot u_{1}\cdot USK/\theta^{*}}\right\}.\end{split}  \tag{14}\]  
**Type-2**: The attributes set \(S_{2}\) of user \(u_{2}\) has attributes \(att_{x}^{*}\), but does not satisfy the access structure \(T^{*}\). The challenger \(\mathcal{C}\) calculates \(SK_{u_{2}}\), \(kek\) and \(KEK\), then sends them to \(\mathcal{A}\). The calculation here is like Type-1. **Challenge**: The attacker \(\mathcal{A}\) submits two messages of equal length, \(M_{0}\) and \(M_{1}\), and randomly selects \(b=\{0,1\}\). The challenger \(\mathcal{C}\) will calculate \(\widetilde{C}=M_{b}e(g,g)^{\texttt{as}}\), \(C=h^{\texttt{s}}\) and \(C_{y}^{\prime}\) (or \(C_{x}^{*}\)). For \(i\
eq x,C_{y}^{\prime}=g^{Q_{y}(0)}\cdot g^{k_{y}}\). For \(att_{x}^{*}\), \(C_{x}^{*}=g^{Q_{y}(0)}\cdot A^{k_{x}}\). Then, \(\mathcal{C}\) calculates \(CT_{b}\) and \(Hdr^{*}\):  
\[ \begin{split}& CT_{b}=\left\{\widetilde{C},C,\{C_{x}^{*}\} \cup\left\{C_{y}^{\prime}\right\}_{i\
eq x}\right\},\\ & Hdr^{*}=\left\{\begin{matrix}\{v_{j}^{*},E(k_{x}^{*})=g^{k_{x} ^{*}\theta_{j}^{*}/t_{x}^{*}}\}v_{j}^{*}\in\mathit{Mincs}(G_{x})\\ \{v_{j},E(k_{y})=g^{k_{y}\theta_{j}/t_{j}}\}v_{j}\in\mathit{Mincs}(G_{i}),i\
eq x \end{matrix}.\end{split}  \tag{15}\]  
Finally, \(\mathcal{C}\) sends \(CT_{b}\) and \(Hdr^{*}\) to \(\mathcal{A}\). **Phase 2**: The attacker \(\mathcal{A}\) is allowed to request keys as in Phase 1. **Guess**: The attacker \(\mathcal{A}\) outputs \(b^{\prime}\in\{0,1\}\) as the prediction. Assume the attacker's advantage \(Adv_{A}=\left|P_{r}[b^{\prime}=b]-\frac{1}{2}\right|=\varepsilon\), and the challenger \(\mathcal{C}\) chooses a key from \(L_{1}\) and \(L_{2}\).