# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 4 System and Security Models
### Security Model  
Two categories of attackers are defined in certificateless cryptography: Type I attackers \(A_{I}\) and Type II attackers \(A_{II}\). \(A_{I}\) simulates an external attacker who can replace the user's public key but cannot obtain the system's master key; \(A_{II}\) simulates an internal attacker with access to KGC's master key, but cannot replace any user's public key. The security model in this paper is primarily based on confidentiality under adaptive chosen ciphertext attacks (IND-CCA2) and unforgeability under adaptive chosen message attacks (EUF-CMA). The security of the scheme is formally verified through an interactive game framework involving a challenger \(C\) and adversaries \(A_{I}\) and \(A_{II}\). The adversary can query the following random oracles:  
* Hash Query: The adversary can execute arbitrary hash function \(H_{i}(i=1,2,3,4)\) queries. The challenger \(C\) returns the corresponding hash value to the adversary. * Partial Private Key Query: When the adversary requests a partial private key with an anonymous identity \(EID_{i}\), the challenger \(C\) sends the partial private key \(d_{i}\) to the adversary. * Private Key Query: When the adversary requests a full private key with an anonymous identity \(EID_{i}\), the challenger \(C\) sends the private key \(SK_{i}\) to the adversary. * Public Key Query: When the adversary requests a public key with an anonymous identity \(EID_{i}\), the challenger \(C\) sends the public key \(PK_{i}\) to the adversary. * Public Key Replacement Query: Upon receiving a request to replace the public key of user \(EID_{i}\), the challenger \(C\) replaces \(EID_{i}\)'s public key \(PK_{i}\) with \(PK_{i}^{\prime}\). * Signcryption Query: When receiving a signcryption request for message \(m\), the challenger \(C\) generates the signcrypted ciphertext \(C_{m}\) by executing the signcryption algorithm and returns it to the adversary. * Unsigncryption Query: When receiving a query for unsigncryption with the sender \(EID_{i}\)'s public key, the receiver's identity \(EID_{j}\), and the signcrypted ciphertext \(C_{m}\), the challenger \(C\) retrieves \(EID_{j}\)'s private key, executes the unsigncryption algorithm to recover the message \(m\), and returns \(m\) to the adversary. **Definition 1** (Confidentiality). : _Under the Random Oracle Model, if there are no adversaries that can achieve victory over Game 1 and Game 2 with a significant advantage within the PPT, then the CLSC_SAT model satisfies indistinguishability against adaptive chosen ciphertext attacks for certificateless signcryption (IND-CLSC-CCA2)._  
**Game 1** (IND-CLSC-CCA2-G1). The challenger \(C\) interacts with adversary \(A_{I}\) as follows:  
1. Initialization: The challenger \(C\) takes a security parameter as input, runs the system initialization algorithm to generate the system master key \(s\) and public parameters PP. C sends PP to \(A_{I}\) and keeps \(s\) secret. 2. Query Phase: \(A_{I}\) adaptively issues queries to the oracles defined above, subject to the following constraints: * \(A_{I}\) cannot request a partial private key query for the receiver \(EID_{j}\). If the receiver's public key has been replaced, \(A_{I}\) cannot request a private key query for \(EID_{j}\). * \(A_{I}\) cannot request an unsigncryption query for the challenge ciphertext \(C^{*}\). * Challenge Phase: \(A_{I}\) submits two equal-length distinct messages \(m_{0},m_{1}\), a sender identity \(EID_{i}\), and a receiver identity \(EID_{j}\). The challenger \(C\) randomly selects \(b\in\{0,1\}\), computes the signcrypted ciphertext \(C^{*}\), and returns \(C^{*}\) to \(A_{I}\). * Guessing Stage: \(A_{I}\) outputs a guess \(b^{\prime}\). If \(b=b^{\prime}\), \(A_{I}\) wins the game. The advantage of \(A_{I}\) is defined as: \[Adv_{A_{1}}^{IND-CLSC-CCA2}=|Pr[b^{\prime}=b]-\frac{1}{2}|\] (2) **Game 2*
* (IND-CLSC-CCA2-G2).