## 3 Construction
### Implementation
Our scheme's \(IND-CPA\) security is analogous to the \(IND-CPA\) security of the \(CP-ABE\) scheme proposed by [PERSON] and his colleagues in [33], and we only prove Assumption 1 here. To begin with, we create a semi-functional ciphertext (defined as SF-C) and a semi-functional key (defined as SF-K) in the following format:

**SF-C:** We define \(g_{2}\) as the generator element of the group \(G_{p_{2}}\). It randomly selects \(f\stackrel{{ R}}{{\longleftarrow}}\mathbb{Z}_{N}\), for each attribute, selects \(z_{i}\stackrel{{ R}}{{\longleftarrow}}\mathbb{Z}_{N}\), then selects \(\gamma_{i}\stackrel{{ R}}{{\longleftarrow}}\mathbb{Z}_{N}\) for each row of the shared generator matrix and two random vectors \(\mathbf{u},\mathbf{w}\in\mathbb{Z}_{N}^{n}\), SF-C is defined as follows: \(C_{1}=g^{sT}\cdot g_{2}^{f},C_{2}=g^{\beta sT}\cdot g_{2}^{\beta f},C_{i,1}=g ^{aTA_{i}\cdot\mathcal{U}_{\rho(i)}^{-\tau_{i}}S_{2}^{A_{i}\cdot\mathbf{w}+ \gamma_{i}\rho(i)}},C_{i,2}=g^{sT_{i}}g_{2}^{-\gamma_{i}},C_{i,3}=g^{sTTA_{i} \cdot\mathbf{v}}\cdot g_{2}^{A_{i}\cdot\mathbf{w}}\)

**SF-K:** We can create two types of SF-K by randomly selecting the parameters \(d,h,c\stackrel{{ R}}{{\longleftarrow}}\mathbb{Z}_{N},R_{0}^{ \prime},R_{1}^{\prime},R_{2}^{\prime},R_{3}^{\prime},R_{1}^{\prime}\in G_{p_ {3}}\) as follows:

**Type 1**: \(D=g^{\beta\alpha}g_{2}^{d}R_{0}^{\prime}\), \(D_{1}=g^{aht}g_{2}^{d}R_{1}^{\prime}\), \(D_{2}=g^{\beta ht}g_{2}^{d}R_{2}^{\prime}\), \(D_{3}=g^{ht}g_{2}^{c}R_{3}^{\prime}\), \(\{D_{i}=\mathcal{U}_{i}^{ht}R_{i}^{\prime}\mathcal{C}_{i2}^{c_{i}}\}\)

**Type 2**: \(D=g^{\beta\alpha}g_{2}^{d}R_{0}^{\prime}\), \(D_{1}=g^{aht}g_{2}^{d}R_{1}^{\prime}\), \(D_{2}=g^{\beta ht}g_{2}^{d}R_{2}^{\prime}\), \(D_{3}=g^{ht}R_{3}^{\prime}\), \(\{D_{i}=\mathcal{U}_{i}^{ht}R_{i}^{\prime}\}\)(let \(c=0\))

Upon decrypting an SF-C with an SF-K, an additional term is introduced into the plaintext due to the semi-functional properties of the key and ciphertext:

\[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]6

where \(u_{1}\) represents the first item of the vector \(\mathbf{u}\). We will now introduce a series of games to analyze the security of our proposed scheme:\(Game_{Real}\): In this game, both the ciphertext and the decryption key are valid, and the security of the scheme is not compromised. \(Game_{0}\): We define a game where all keys are normal, but the challenge ciphertext is SF-C. Let \(q\) be the number of times the attacker requests the key. For \(k\in[1,q]\), we define:

\(Game_{k,1}\): The challenge ciphertext is SF-C, the first \(k-1\) keys requested by the adversary are SF-K of **Type 2**, the \(k\)th key is SF-K of **Type 1**, and the rest are normal. \(Game_{k,2}:\) We define a game where the challenge ciphertext is SF-C, the first \(k\) keys are SF-K of **Type 2**, and the remaining keys are normal. At the end of the game, we play the game's last round (\(Game_{final}\)): all the keys are **Type 2** SF-K, and the ciphertext is generated by semi-functionally encrypting random messages without using the two messages supplied by the adversary. **Lemma 1**. : _Assume the existence of a polynomial-time algorithm \(\mathcal{A}\) such that \(Game_{Real}Adv_{A}-Game_{0}Adv_{A}=\epsilon\). where \(\epsilon\) is a non-negligible value. We can find a polynomial-time algorithm \(\mathcal{B}\) to break **Assumption 1** by \(\epsilon\)._

Proof.