# Blockchain-Based Multiple Authorities Attribute-Based Encryption for EHR Access Control Scheme
## 6 Scheme Analysis
### Security Analysis
#### 6.2.3 Security against Collusion Attack  
Multiple malicious users conspire with each other to share their own attribute keys \(e(H(uid),g)^{c_{x}}\) in an attempt to decrypt other secrets. Suppose two users with identities \(uid\) and \(uid^{\prime}\), respectively, try to conspire to merge their secrets \(e(H(uid),g)^{c_{x}}\) and \(e(H(uid),g)^{c^{\prime}_{x}}\). They cannot cancel each other and thus cannot continue to recover out \(e(g,g)^{us\times y\cdot s}\). 2.4 Adaptive Selection of Ciphertext Indistinguishable Security under Chosen Plaintext Attack (INDS-CPA)  
Let \(G_{1}\) and \(G_{2}\) be two multiplicative cyclic groups of order \(p\) and satisfy the bilinear mapping \(e:\ G_{1}\times G_{1}\to G_{2}\), \(g\) is the \(G_{1}\) generating elements, and randomly selected \(a,b,s,z\in Z_{p}^{*}\). No probabilistic polynomial-time algorithm can distinguish the tuples \([g,g^{a},g^{b},s^{s},e(g,g)^{abs}]\) and the tuples \([g,g^{a},g^{b},s^{s},e(g,g)^{z}]\) by a non-negligible advantage, called the DBDH assumption. If the DBDH problem is intractable, then the VO-PH-MAABE scheme satisfies the indistinguishable security under the chosen ciphertext attack. It includes adversary \(\mathfrak{A}\) and challenger \(\mathfrak{B}\), as follows. _Initialization_: Adversary \(\mathfrak{A}\) submits a challenge access policy \((M^{*},\rho^{*})\) to Challenger \(\mathfrak{B}\). _Setup_: Challenger \(\mathfrak{B}\) chooses a sufficiently safe parameter \(\lambda\) to run the \(Setup(1^{\lambda})\) algorithm to generate the public parameter \(GP\). Challenger \(\mathfrak{B}\) sends \(GP\) to adversary \(\mathfrak{A}\). _Query Phase_ **1**: The adversary adaptively queries the following Oracle. \(O_{AAs}\): Adversary \(\mathfrak{A}\) specifies a set of corrupted permissions, and for each attribute \(\omega\) belonging to the uncorrupted permissions, \(\mathfrak{B}\) runs \(AASetup(GP,\omega)\) to generate the public attribute key \((e(g,g)^{\omega_{\omega}},g^{\omega_{\omega}})\) and returns it to \(\mathfrak{A}\). \(O_{UAK}\): Adversary \(\mathfrak{A}\) submits an identity and its corresponding attribute set \((uid,S^{*})\) to \(\mathfrak{B}\). When the attribute set is insufficient for the challenge access strategy, adversary \(\mathfrak{B}\) runs \(UAKGen(uid,(M^{*},\rho^{*}),S^{*},GP)\) to generate the attribute key \(UAK_{\omega,uid}\), and returns it to \(\mathfrak{A}\). _Challenge_: \(\mathfrak{A}\) submits two equal-length symmetric keys \(KEY_{0}\) or \(KEY_{1}\) to \(\mathfrak{B}\). \(\mathfrak{B}\) rolls a coin to determine the value of \(\gamma\in\{0,1\}\) and executes \(Encrypt(KEY_{\gamma},M_{data},(M^{*},\rho^{*}),GP,e(g,g)^{\omega_{\omega}},g^{ \omega_{\omega}})\). \(\mathfrak{B}\) computes \(CT_{KEY}=KEY\cdot e(g,g)^{abs}\), and for each row \(M^{*}\) in the matrix \(M^{*}_{x}\), \(\mathfrak{B}\) randomly chooses \(v=(s,r_{1},r_{2},\ldots,r_{m})\in Z_{p}^{*},h=(0,h_{1},h_{2},\ldots,h_{m})\in Z _{p}^{*}\), where \(r_{1},r_{2},\ldots,r_{m},h_{1},h_{2},\ldots,h_{m}\) are chosen randomly from \(Z_{p}^{*}\), and computes \(\lambda_{x}=M_{x}v^{T}\) and \(c_{x}=M_{x}h^{T}\). In addition, \(\mathfrak{B}\) randomly chooses \(z,u_{1},u_{2},\ldots,u_{l}\in Z_{p}^{*}\) and computes \(C_{0}=e(g,g)^{z},C_{1,x}=e(g,g)^{a_{\rho(x)}\cdot u_{x}},C_{2,x}=g^{u_{x}},C_{3,x}=g^{c_{x}}\cdot g^{\rho(x)\cdot u_{x}},C_{4,x}=g^{c_{x}}\cdot g^{\
u\cdot \lambda_{x}}\). The challenge message \(CT^{*}=((M^{*},\rho^{*}),g^{r},CT_{KEY},C_{1,x},C_{2,x},C_{3,x},C_{4,x})\) and sends it to \(\mathfrak{A}\). _Query Phase_ **2**: Adversary \(\mathfrak{A}\) continues the adaptive query according to _Query Phase_ **1**. _Guess_: Adversary \(\mathfrak{A}\) makes a guess \(\gamma^{\prime}\in\{0,1\}\) for \(M\). If \(\gamma=\gamma^{\prime}\), then challenger \(\mathfrak{B}\) returns \(1\), and \(Z=e(g,g)^{abs}\); if \(\gamma\
eq\gamma^{\prime}\), then \(\mathfrak{B}\) returns \(0\), and \(Z=e(g,g)^{z}\). If \(Z=e(g,g)^{abs}\), then \(Pr[\gamma=\gamma^{\prime}]=1/2+\epsilon\); if \(Z=e(g,g)^{z}\), then \(Pr[\gamma=\gamma^{\prime}]=1/2\).