## 4 Security Analysis  
The proposed TR-AC scheme is proved secure based on the following theorems. Neither the cloud servers nor the unauthorized users can compromise the components of the ciphertext and the authority content key based on the Diffe-Hellman (DH) assumption. In the encryption stage, which is executed using Algorithm 3, this algorithm is executed by the cloud servers. The input is a set of components that are useful in generating a secure ciphertext, such as the access structure \(\mathcal{AC}\) which is provided by the system authorities. These inputs are secure and cannot be recovered by the cloud server. The most important one is the authority content key because it will be recovered first in the decryption Algorithm 2, in order to recover the original data. After that, the encryption algorithm computes the variables that compromise the ciphertext:  
* \(C=ck_{k}\cdot(\prod_{k\in K}\hat{e}(g,g)^{\alpha_{k}})^{f}\), which is computed based on the content key \(ck_{k}\), so it is secure and cannot be recovered by unauthorized users;
* \(C^{\prime}=g^{\prime}\), where \(f\in\mathbb{Z}_{q}^{*}\) is the random encryption exponent and \(g^{\prime}\), which is secure based on the Diffie-Hellman \((DH)\) assumption. Given \(g\) and \(g^{\prime}\), it is hard to find \(f\), because it is a discrete logarithm (DL) problem. Thus, the value of \(C^{\prime}\) cannot be computed by an attacker;
* \(\{C^{\prime\prime}=g^{\frac{f}{R_{k}}}\}_{\forall k\in K}\), which is also secure based on the Diffie-Hellman \((DH)\) assumption;
* \(\{C_{i}=g^{\alpha_{k}i}\cdot((g^{\bar{g}(i)\rho(i)}\cdot H(\rho(i))^{\gamma_{k }}))^{-r_{j}}\}_{\forall k\in K}\). According to the first component \((g^{\alpha_{k}i})\), given as \(g\) and \(g^{\alpha_{k}i}\), it is hard to find \(\lambda_{i}\) for two reasons, because it is a DL problem and because it is generated using linear secret sharing (LSSS) as follows: To generate the shares for a secret \(f\in\mathbb{Z}_{q}^{*}\), we choose a column vector \(\overrightarrow{v}=(s,r_{2},\cdots,r_{n})^{T}\) where \(r_{2},\cdots,r_{n}\) are randomly picked from \(\mathbb{Z}_{q}^{*}\), then \(M\overrightarrow{v}\) is the vector of \(\ell\) shares of \(f\) according to the sharing \(\sum\), and the share \((M\overrightarrow{v})_{i}\) belongs to the party \(\rho(i)\). Accordingly, the second part \(((g^{\bar{g}(i)\rho(i)}\cdot H(\rho(i))^{\gamma_{k}}))\) is based on the calculation of the hash function \(H(\rho(i))\). Let us consider \(g^{\prime}=H(\rho(i))\in\langle g\rangle\), where \(g\) is the generator of \(\mathbb{G}\) and \(\langle g\rangle=g\cdot g^{2}\cdot g^{3}\cdots g^{d-1}\cdot g^{d}\) where \(g^{d}=g\). Thus, given \(g\) and \(g^{\prime}\) it is hard to find \(r\), because it is a DL problem. In addition, the hash function \(H(\cdot)\) is a one-way function, and \(\gamma_{k}\in\mathbb{Z}_{q}^{*}\) is a random constant. Thus, the attacker cannot compute the value of \(C_{i}\) and
* \(\{D_{1,i}=g^{\frac{f_{i}}{R}}\}_{\forall k\in K}\) and \(\{D_{2,i}=g^{-\frac{\gamma_{k}}{R_{k}}r_{j}}\}_{\forall k\in K}\) are also computed based on the values of some random constants such as \(\beta_{k},\gamma_{k}\in\mathbb{Z}_{q}^{*}\) and are secure based on the \(DH\) assumption, because it is DL problem. Therefore, an unauthorized user cannot compute the values of \(D_{1,i}\) and \(D_{2,i}\). Therefore, the encryption algorithm is secure and each component in the ciphertext is secure and cannot be computed by unauthorized sets of users. The user can successfully generate the authentic token and decrypt the ciphertext only if it has a set of attributes that are a part of the \(\mathcal{AC}\) for the requested ciphertext. Proof.