## 4 Security Proof and Efficiency
The ciphertext \(ct^{\prime}\) is the target challenge for \(\mathcal{A}\). **Phase 2:** The adversary \(\mathcal{A}\) could make new queries, such as those mentioned in Phase 1. However, it is not allowed to directly make a \(Decrypt\) query on the challenged ciphertext. At the end of this game, \(\mathcal{A}\) has to output a bit \(\lambda^{\prime}\). If \(\lambda^{\prime}=\lambda\), we say that \(\mathcal{A}\) wins this game. **Analysis of the game:** In the above simulation game, \(\mathcal{B}\) responds to each query made by \(\mathcal{A}\) with an indistinguishable response without termination. Therefore, we could claim that if the adversary \(\mathcal{A}\) has the non-negligible advantage \(\varepsilon\) to break the ciphertext indistinguishability of the proposed scheme, the distinguisher \(\mathcal{B}\) also has the non-negligible advantage \(\varepsilon\) to solve the given DDHP instance. Precisely specking, when \(\lambda^{\prime}=\lambda\), we could know that \(g^{c}=g^{ab}\). Otherwise, \(g^{c}\
eq g^{ab}\). Q.E.D. Considering potential data risks in medical cloud systems, the authors analyze the essential security requirements with respect to the constructed system as follows. (1) **User-controlled access control**  
In our system, the encryption process uses an attribute-based encryption mechanism. That is, the DO can formulate a corresponding access structure for his/her ciphertext and authorize it to a specific DU through the access structure. In other words, when the DU wants to access the ciphertext stored in the cloud, the attribute set corresponding to the DU's private key must satisfy the access structure of desired ciphertext. Therefore, the proposed system has the characteristic of user-controlled access control. (2) **Multi-user sharing**  
Cloud data sharing mechanisms could be categorized into two types, i.e., single-user and multi-user. Traditionally, it is not secure to achieve multi-user data sharing by using the technique of private key sharing. In our system, the idea of multi-user sharing is realized by utilizing the technique of linear secret-sharing (LSSS) which randomly chooses a secret-sharing value \(s\) through the Share algorithm to achieve multi-user sharing and avoid the risk of private key leakage. (3) **Confidentiality of ciphertexts**  
According to the proposed Encrypt algorithm, the ciphertext \(ct\) generated by the DO includes parameters (\(C\), \(C^{\prime}\), \(\{C_{i}\}\)). However, only the parameter \(C\) is related to the plaintext \(msg\). Since \(C=msg\cdot e\) (\(g^{a}\), \(g^{b}\)). Without the secret-sharing value \(s\) randomly chosen by the DO, any malicious attacker can only derive the original plaintext \(msg\) by guessing the correct \(s\), and the success probability is only \((p-1)^{-1}\), which is negligible. (4) **Confidentiality of searched keywords**  
In the proposed trapdoor algorithm, the keywords sent by the DU will be encrypted by the PS, which utilizes the DU's KS-Key and an integer \(u\) chosen at random. Therefore, only the parameter \(T_{q}(kw)\) of the trapdoor contains the plaintext information of the keyword \(kw\) searched by the DU. When the PS re-encrypts the parameter \(L^{\prime}\) of the trapdoor with its private key \(\beta\), it learns nothing about the keyword searched by the DU. Moreover, a malicious TA only knows the KS-Key of the DU. Even if it colludes with the PS, they cannot successfully derive the keyword \(kw\) due to the unknown random number \(u\) chosen by the DU. (5) **Unforgeability of trapdoors**  
A legitimate trapdoor \(T_{kw}\) generated by the DU includes (\(T_{q}(kw)\), \(L^{\prime}\), \(\{K^{\prime}_{x}\}_{x\in w}\)), in which the parameter \(T_{q}(kw)\) is generated by the KS-Key, the parameters \(L^{\prime}\) and \(\{K^{\prime}_{x}\}_{x\in w}\) are both generated using a random number correlated to the KS-Key.