## 4 Security Analysis
: The decryption token will be successfully generated based on the following corrected proof for generating \(DT\):  
\[DT=\prod_{k=1}^{N_{A}}\frac{\hat{e}(C^{\prime},K_{c_{j},k})\cdot\hat{e}(R_{c_{j},k},C^{\prime\prime})^{-1}}{\prod_{i\in I}[\hat{e}(C_{i},GPK_{c_{j}})\cdot\hat{e} (D_{1,i},K_{c_{j},\hat{\rho}(i)})\cdot\hat{e}(D_{2,i},L_{c_{j},k})]^{\delta_{i}}} \tag{2}\]  
\[C^{\prime}=g^{f},C^{\prime\prime}=g^{\frac{f}{\delta_{k}}},\]  
\[C_{i}=g^{a\lambda_{i}}\cdot((g^{\overline{g}(i)\rho(i)}\cdot H(\rho(i))^{ \gamma_{k}}))^{-r_{i}},\]  
\[D_{1,i}=g^{\frac{r_{i}}{\gamma_{k}}}D_{2,i}=g^{-\frac{\gamma_{k}}{\gamma_{k}}r _{i}},\]  
\[K_{c_{j},k}=g^{\frac{\kappa_{k}}{\gamma_{j}}}\cdot g^{a\cdot c_{j}}\cdot g^{ \frac{\kappa_{k}}{\gamma_{j}}},\]  
\[R_{c_{j},k}=g^{a\cdot t_{j}\lambda_{i}},L_{c_{j}}=g^{\frac{\delta_{k}}{\gamma_ {j}}t_{j\lambda}},\]  
\[GPK_{c_{j}}=g^{c_{j}},\text{ and }\]  
\[K_{c_{j},\rho(i)}=g^{\frac{\delta_{k}\gamma_{k}}{\gamma_{j}}t_{j\lambda}}\cdot (g^{\rho(i)}\cdot H(\rho(i)))^{\gamma_{k}\beta_{k}c_{j}}.\]  
Computing the numerator of Equation ((2)):  
\[ \begin{split}\hat{e}(C^{\prime},K_{c_{j},k})\cdot& \hat{e}(R_{c_{j},k},C^{\prime\prime})^{-1}\\ &=\frac{\hat{e}(g^{f},g^{\frac{\kappa_{k}}{\gamma_{j}}})\cdot \hat{e}(g^{f},g^{a\cdot c_{j}})\cdot\hat{e}(g^{f},g^{\frac{a}{\gamma_{k}}t_{j \lambda}})}{\hat{e}(g^{a\cdot t_{j\lambda}},g^{\frac{f}{\gamma_{k}}})}\\ &=\frac{\hat{e}(g,g)^{\frac{f_{\kappa_{k}}}{\gamma_{j}}}\cdot \hat{e}(g,g)^{f\cdot a\cdot c_{j}}\cdot\hat{e}(g,g)^{\frac{f_{\kappa}}{\gamma_ {k}}t_{j\lambda}}}{\hat{e}(g,g)^{\frac{f_{\kappa}}{\gamma_{k}}t_{j\lambda}}} \\ &=\hat{e}(g,g)^{\frac{f_{\kappa_{k}}}{\gamma_{j}}}\cdot\hat{e}(g,g )^{f\cdot a\cdot c_{j}},\end{split}  \tag{3}\]  
Computing the denominator of Equation ((2)):  
\[ \begin{split}\hat{e}(C_{i},GPK_{c_{j}})&=\hat{e}((g ^{a\lambda_{i}}\cdot((g^{\overline{g}(i)}\cdot H(\rho(i))^{\gamma_{k}}))^{-r_ {i}}),g^{c_{j}})\\ &=\hat{e}((g^{a\lambda_{i}},g^{c_{j}})\cdot\hat{e}((((g^{ \overline{g}(i)}\cdot H(\rho(i))^{\gamma_{k}}))^{-r_{i}}),g^{c_{j}})\\ &=\hat{e}(g,g)^{a\cdot\lambda_{i}c_{j}}\cdot\hat{e}(g^{-r_{i} \overline{g}(i)\rho(i)},g^{c_{j}})\cdot\hat{e}(H(\rho(i))-r_{i}\cdot\gamma_{k },g^{c_{j}})\\ &=\hat{e}(g,g)^{a\cdot\lambda_{i}c_{j}}\cdot\hat{e}(g,g)^{-r_{i} \cdot\overline{g}(i)\rho(i)}\cdot\hat{e}(H(\rho(i)),g)^{-r_{i}\cdot c_{j} \cdot\gamma_{k}}\\ &=\frac{\hat{e}(g,g)^{a\cdot\lambda_{i}c_{j}}}{\hat{e}(g,g)^{r_{ i}\cdot\overline{g}(i)\rho(i)}\cdot\hat{e}(H(\rho(i)),g)^{r_{i}\cdot c_{j} \cdot\gamma_{k}}},\end{split}  \tag{4}\]  
Let us consider the hash \(H(\rho(i))\). Let \(g^{r}=H(\rho(i))\in\langle g\rangle\) and \(g\) be generator of \(\mathbb{G}\). Given \(g\) and \(g^{r}\), finding \(r\) is very hard because it is DL problem. Let \((x,y)\in\langle g\rangle\) for \((x,y)\) as an elliptic curve point. If we let \(x=\rho(i)\), then finding \(y^{2}=ax^{3}+b\) modulo \(q\) is easy and can be found; however, in our case, it will be \(y^{2}=ax^{3}+b\) modulo \(N\) which is very hard because it is square problem. In addition, obtaining the first part of the denominator for Equation (2): \((\hat{e}(g,g)^{a\cdot\lambda_{i}\cdot\hat{c}_{j}}\cdot\hat{e}(g^{-\tau_{i}\cdot \hat{c}(i)\rho(i)},g^{\xi_{j}})\cdot\hat{e}(H(\rho(i)))^{-\tau_{i}\cdot\hat{ \gamma}_{k}},g^{\xi_{j}}))\) is complex. It is based on the extend-gcd, so the attacker cannot obtain it. \[