## 7 Unbalanced PSI-CA Protocol Based on Dual-Cloud Assistance
### Security Analysis  
Firstly, we consider the security of the small health app developer's data in the set. In considering security against collusion attacks, it is generally assumed that there is an adversary who possesses the perspective and information of all participating parties except for the protected entity. This means the adversary can access, control, or receive information and resources from all participants except for the small health app developer. In this scenario, the adversary attempts to compromise the system's security or privacy by aggregating these insights, such as revealing the sensitive data of the small health app developer. If, in this context, the adversary still cannot learn or infer the small health app developer's data, then it is proven that the data and privacy of the small health app developer are sufficiently secured against collusion attacks. This section defines a game where the security objective is to maintain confidentiality of the data within the set under semi-honest and collusion conditions. The game for securing the small health app developer's dataset is as follows:  
1. The small health app developer runs the preprocessing algorithm, sharing the cryptographic hash function \(H\) and the large prime \(q\) used in the protocol with the adversary. 2. The small health app developer simulates the outsourcing algorithm and sends their (encrypted) input to the adversary. 3. The small health app developer and the adversary simulate the intersection algorithm and discard any output. 4. The adversary is asked to output a guess \(\hat{y}\) of the small health app developer's input \(y\). The game is analogized to a deterministic one-way function, such as a public key encryption scheme. Let \(S\) be the simulated messages of the small health app developer during the game. Let a one-way function adversary \(A^{\prime}\) be given the information (public key) \(pk\) and function (ciphertext) \(c\) (encrypted \(y\)). The advantage of the adversary \(Adv_{A}\) is defined as the difference between the successful guesses of \(A\) and \(A^{\prime}\). If this advantage is negligible in the security parameter \(\lambda\), then the outsourced private-set intersection is considered secure. That is, let \(Adv_{A}=\Pr[A(S)=y]-\Pr[A^{\prime}(pk,c)=y]\). If \(Adv_{A}<\frac{1}{\text{poly}(\lambda)}\), then the protocol is said to be secure. Specifically, after the steps mentioned above, \(H_{1}\), \(H_{2}\), and the large medical institution have a complete view of the process. However, under the two-server architecture, as illustrated in Figure 4:  
1. In step four of Figure 4, since \(r_{1j}\) and \(r_{2j}\) are unknown to the adversary, \(h_{j}\) cannot be derived. The adversary can only attempt exhaustive guessing, thus making \(\text{Adv}_{A}\) negligible. 2. In subsequent steps, as \(A\) does not know the small health app developer's private key for the [PERSON] encryption system, it is impractical to decrypt the ciphertexts, making it even more challenging to derive \(h_{j}\). For instance, \(item_{j}=C_{1,j}^{\prime\prime}*C_{2,j}^{\prime\prime}={C_{1,j}^{\prime}}^{1/ \omega_{j}}*C_{2,j}^{\prime}{}^{1/\beta_{j}}=E_{pk_{c}}(r_{1j}h_{j}\omega_{j})^{ \alpha*1/\omega_{j}}*E_{pk_{c}}(r_{2j}h_{j}\beta_{j})^{\alpha*1/\beta_{j}}\), and since the private key used in [PERSON]'s system by the small health app developer is unknown, decrypting this compound is complex and hence \(h_{j}\) remains secure. From the analysis above, it is evident that the advantage of \(\text{Adv}_{A}\) is negligible. Therefore, if both cloud servers collude with the large medical institution, they cannot deduce the small health app developer's original data. Next, consider the security of the data in the large medical institution's set. Obviously, apart from the large medical institution itself, none of the parties know the large medical institution's private key \(\alpha\); hence, even if both cloud servers colluded with the small health app developer, they cannot derive the original data from \(CF\).