## 4 Security Analysis  
The work one way function tree (OFT) proposes a new generic definition for collusion resistance. Although our scheme follows ROFT to be collusion-resistant, a new proposition is made to prove the collusion resistance of our scheme.  
Proposition 1: _The OFT scheme is collusion-resistant if the leaving users at the time t1 and joining users at time t2 cannot compute any unknown node secrets if the intersection of their set of known secrets does not contain any adjacent pair node secrets, i.e., the leaving users at time t1 known key set \(t_{\textit{leave}}\) and the joining users at time t2 known key set \(t_{\textit{join}}\) should not contain the secrets of adjacent pairs \(t_{\textit{leave}}\)\(\cup\)\(t_{\textit{join}}\)\(\
eq\) secrets of pair \(\{\textit{I}_{\textit{oi}}\), \(\textit{I}_{\textit{oi+1}}\}\) where \(\textit{oi}\)\(\in\)\(\{\textit{set}\) of odd numbers\(\}\), \(t_{\textit{leave}}\) is the key set known in the time duration between t1 and the first key update after the user leaves \(t_{\textit{MIN}}\), \(t_{\textit{join}}\) is the key set known in the time interval between the last key update that happened before the user join \(t_{\textit{MAX}}\) and t2._  
Proof: The group key is calculated in a bottom-up fashion using a mixing function g(x) of adjacent blinded node secrets bl\({}_{\textit{oi}}\), bl\({}_{\textit{oi+1}}\). So, to compute any parent intermediate node secret SI\({}_{i}\), both the child's adjacent blinded secrets and adjacent secrets should be known. Hence, if the chain of knowing adjacent secrets and adjacent blinded secrets is broken then the colluding users cannot compute any intermediate key or the group key for an unauthorized time. \(\square\)  
Figure 9: User join event.  
Theorem 1: _MOFT is collusion-resistant._  
Proof of Theorem: According to Proposition 1, the OFT scheme is collusion-resistant if the leaving users \(\mathfrak{t}_{\text{leave}}\) and the joining users \(\mathfrak{t}_{\text{join}}\) cannot collude to contain any pair \(\{\text{SI}_{\text{oi}},\text{SI}_{\text{oi+1}}\}\). Consider user [PERSON] leaves at the time \(\mathfrak{t}_{\text{j}}\), as in Figure 10 (B-E) subtree sections. The set of keys [PERSON] knows after time \(\mathfrak{t}_{\text{j}}\), \(\mathfrak{t}_{\text{leave}}=\text{ secret key of nodes}\{\text{R},\text{R}^{ \prime},\text{R}^{\prime\prime},\text{I}_{\text{R}}\}\). To perform a collusion attack, [PERSON] has to collude with any of the joining users at the time \(\mathfrak{t}_{\text{j}}\). Consider [PERSON] joining at the time \(\mathfrak{t}_{\text{j}}\) at any of the sections B, C, D, or E. The known key set of [PERSON] that existed before time \(\mathfrak{t}_{\text{j}}\), \(\mathfrak{t}_{\text{join}}=\{\text{null}\}\) since all the node secrets on the path are hashed using the one-way function before being distributed to [PERSON]. The collusion of [PERSON] and [PERSON] known key sets \(\mathfrak{t}_{\text{leave}}\cup\mathfrak{t}_{\text{join}}=\text{ secret key of nodes}\{\text{R},\text{R}^{\prime},\text{R}^{\prime\prime},\text{I}_{\text{R}}\}\). Hence, according to Proposition 1, the proposed MOFT confirms collusion resistance. \(\square\)