# A Privacy-Preserving Scheme for a Traffic Accident Risk Level Prediction System
## 4 Materials and Methods
### Our Security Approach
#### 4.3.2 Secrecy Proofs
However, \(\mathcal{A}\) cannot decrypt \(c_{m_{i}}\) or \(c_{m_{o}}\) because \(sk_{u}\) is required (Algorithm 1 line 9). Given that the FHE algorithm is IND-CPA, our algorithm guarantees that \(m_{i}\) sent by \(u\) from \(\mathcal{V}\) to \(\mathcal{C}\) or \(m_{o}\) sent by \(s\) from \(\mathcal{C}\) to \(\mathcal{V}\) are secure even if \(\mathcal{A}\) intercepts \(m_{i}\) or \(m_{o}\) in \(\mathcal{Z}\). Lemma 3.: _Given a vehicular network \(\mathcal{V}\), a cloud provider network \(\mathcal{C}\), a set of authorized users of \(\mathcal{V}\) (\(\mathcal{U}_{v}\)), a user \(u\in\mathcal{U}_{v}\), the Internet network \(\mathcal{I}\), a set of authorized users of \(\mathcal{I}\) (\(\mathcal{U}_{i}\)), a pair of messages \((m_{i}\), \(m_{o})\in\mathcal{M}\), a server \(s\in\mathcal{C}\), and an adversary \(\mathcal{A}\) such that \(\mathcal{A}\in\mathcal{U}_{i}\), but \(\mathcal{A}\
otin\mathcal{U}_{v}\) (Type III according to our Section 4.2.2), our algorithm guarantees that \(m_{i}\) sent by \(u\) from \(\mathcal{V}\) to \(\mathcal{C}\) or \(m_{o}\) sent by \(s\) from \(\mathcal{C}\) to \(\mathcal{V}\) are IND-CPA secure even if \(\mathcal{A}\) intercepts \(m_{i}\) or \(m_{o}\) in any place of \(\mathcal{I}\)._  
Proof of Lemma 3.: Let \(sk_{u}\) be the secret key of \(u\), \(ek_{u}\) be the evaluation key of \(u\), and a pair of messages \((m_{i}\), \(m_{o})\) such that \((m_{i}\), \(m_{o})\in\mathcal{M}\). First, \(u\) sends \(ek_{u}\) to \(s\) in \(\mathcal{C}\) where the encrypted learning model is hosted (Algorithm 1 line 3 and Algorithm 2 line 2). Second, \(u\) encrypts \(m_{i}\) using \(sk_{u}\) and FHE (Algorithm 1 line 5). Third, \(u\) sends the encrypted message \(c_{m_{i}}\) to \(s\). Fourth, \(s\) makes an inference using the encrypted model and returns the result in \(c_{m_{o}}\) to \(u\) (Algorithm 1 line 7 and Algorithm 2 line 6). It is assumed that \(\mathcal{A}\) is located in any place of \(\mathcal{I}\) and \(\mathcal{A}\) perform any attack to intercept information of \(\mathcal{V}\). Finally, \(\mathcal{A}\) intercepts \((c_{m_{i}}\) or \(c_{m_{o}})\) and \(ek_{u}\) and tries to decrypt \(c_{m_{i}}\) or \(c_{m_{o}}\). However, \(\mathcal{A}\) cannot decrypt \(c_{m}\) because \(sk_{u}\) is required (Algorithm 1 line 9). Given that the FHE algorithm is IND-CPA, our algorithm guarantees that \(m_{i}\) sent by \(u\) from \(\mathcal{V}\) to \(\mathcal{C}\) or \(m_{o}\) sent by \(s\) from \(\mathcal{C}\) to \(\mathcal{V}\) are secure even if \(\mathcal{A}\) intercepts \(m_{i}\) or \(m_{o}\) in \(\mathcal{I}\). Lemma 4.: _Given a vehicular network \(\mathcal{V}\), a set of authorized users of \(\mathcal{V}\) (\(\mathcal{U}_{v}\)), a user \(u\in\mathcal{U}_{v}\), a cloud provider network \(\mathcal{C}\), a set of authorized users of \(\mathcal{C}\) (\(\mathcal{U}_{c}\)), a pair of messages \((m_{i}\), \(m_{o})\in\mathcal{M}\), a server \(s\)\(\in\mathcal{C}\), and an adversary \(\mathcal{A}\) such that \(\mathcal{A}\in\mathcal{U}_{c}\), but \(\mathcal{A}\
otin\mathcal{U}_{v}\) (Type IV according to our Section 4.2.2), our algorithm guarantees that \(m_{i}\) sent by \(u\) from \(\mathcal{V}\) to \(\mathcal{C}\) or \(m_{o}\) sent by \(s\) from \(\mathcal{C}\) to \(\mathcal{V}\) are IND-CPA secure even if \(\mathcal{A}\) intercepts \(m_{i}\) or \(m_{o}\) in \(\mathcal{C}\)._  
Proof of Lemma 4.: Let \(sk_{u}\) be the secret key of \(u\), \(ek_{u}\) be the evaluation key of \(u\), and a pair of messages \((m_{i}\), \(m_{o})\) such that \((m_{i}\), \(m_{o})\in\mathcal{M}\). First, \(u\) sends \(ek_{u}\) to \(s\) in \(\mathcal{C}\), where the encrypted learning model is hosted (Algorithm 1 line 3 and Algorithm 2 line 2). Second, \(u\) encrypts \(m_{i}\) using \(sk_{u}\) and FHE (Algorithm 1 line 5). Third, \(u\) sends the encrypted message \(c_{m_{i}}\) to \(s\). Fourth, \(s\) makes an inference using the encrypted model and returns the result in \(c_{m_{o}}\) to \(u\) (Algorithm 1 line 7 and Algorithm 2 line 6).