## 5 Security Analysis
### Secure Search  
When a search is secure, it can withstand keyword selection attacks. For instance, an attacker may select specific terms to deduce or reveal private information.  
Under the DBDH assumption, the proposed solution is capable of withstanding the specified keyword attacks.  
The chosen keyword attack (CKA) game can be won with a minimal advantage, denoted as \(xi\), if \(\mathcal{A}\) is a polynomial-time adversary. To participate in the CKA game with \(\mathcal{A}\), we construct a challenger (\(\mathcal{C}\)) within a bilinear group.  
**Setup**. The system parameters (\(P_{i}=\{q,\mathcal{G},\mathbb{G},\ell,P,\{\lambda_{j}\}_{i\in[1,n]},h_{1},h_{2 },H,K\}\)) are calculated by \(\mathcal{C}\). \(\mathcal{C}\) creates an aggregate key \(PP_{agg}=\sum_{i\in I}P_{agg}\) for file set \(Z_{i}\). It then chooses a value (\(y_{i}\in Z_{q}^{*}\)) at random and computes \(Y_{i}=\{y_{i}^{j}P\}_{j\in[1,n]}\). The file set \((P_{i},PP_{agg},Y_{i})\) is sent to \(\mathcal{A}\), together with the public parameters and public key, by \(\mathcal{C}\).  
**Phase 1**. Some inquiries are performed by \(\mathcal{A}\).  
**Query 1.** The adversary (\(\mathcal{A}\)) uses the phrase expressed as \(\hat{k}\in K\) to query a token. Using a random number (\(y_{i}\)) as his private key, \(\mathcal{C}\) computes the following:  
\(\{T_{0i}\}_{i\in[1,k]}=(x\Pi_{\hat{k},k\hat{y}_{i}})P+(x\Pi_{\hat{1},k\hat{y} \hat{k}}\hat{k})P\)  
It then sends \(T_{i}=(\{T_{0i},T_{1i}\}_{i\in[1,l]})\) to \(\mathcal{A}\).  
**Query 2**. Using a collection of files (\(Z_{i}\)), the adversary (\(\mathcal{A}\)) executes aggregate queries. \(\mathcal{C}\) transmits \((PP_{agg},S{S_{agg}})\) to \(\mathcal{A}\) and responds to the aggregation key as follows: \((PP_{agg}=\sum_{i\in l}P_{agg},S{S_{agg}}=\sum_{i\in l}S_{agg})\).  
**Query 3**.  
\(\mathcal{A}\) uses phrase \(\hat{k}\) to execute a trapdoor query. After computing \(\tau=(\tau_{1},\tau_{2})\), \(\mathcal{C}\) forwards the result to \(\mathcal{A}\).  
**Challenge.** Two keywords \((k_{0},k_{1})\) are chosen by \(\mathcal{A}\), where \((k\
eq k_{0}\
eq k_{1})\). \(\mathcal{C}\) aborts and makes a random guess if \(k_{0}=k_{1}\). If not, \(\mathcal{C}\) computes the keyword ciphertext for \(k_{0}\) by randomly selecting a bit (\(b\in\{0,1\}\)). \(\mathcal{C}\) sets \((E_{3 ij},E_{4 ij})\) after selecting a random number (\(r_{ij}\in Z_{q}^{*}\)), which it sends to \(\mathcal{A}\); it then sends \(E_{ij}=(\{E_{3 ij},E_{4 ij}\}_{j\in[1,n]})\).  
**Phase 2**. As in step 1, \(\mathcal{C}\) answers the questions. The trapdoor \((\cdot)\) on query terms \(k_{0}\) and \(k_{1}\) cannot be issued by \(\mathcal{A}\).  
**Guess.** A guess \((b\in\{0,1\})\) is sent to \(\mathcal{C}\) by \(\mathcal{A}\). \(\mathcal{A}\) is the winner of the game if \(b^{\prime}=b\), meaning that \(\hat{e}(\lambda_{j},(y_{i},k_{0})r_{ij}P)=\hat{e}(P,P)^{\theta}\). In any other case, \(\mathcal{A}\) loses the game.  
In the guessing phase, the ciphertext \((E_{ij})\) is a correct keyword ciphertext of keyword \(k_{y}\) if \(\hat{e}(\lambda_{j},(y_{i},k_{0})r_{ij}P)=\hat{e}(P,P)^{\theta}\). In this instance, the DBDH problem is solved by \(\mathcal{A}\) with a minor \(\xi\) benefit. That aligns with the DBDH presumption. Therefore, the suggested plan may withstand the ASCunder the DBDH assumption.