## 6 Safety Proof
**\(\mathcal{A}\) sends one challenge identity group \(S^{*}=\{ID_{1}^{*},\ldots,ID_{d}^{*}\}\) and two equal-length challenge messages \(M_{0}\) and \(M_{1}\) to \(\mathcal{B}\). \(\mathcal{B}\) randomly selects \(\beta\in\{0,1\}\) and calculates the ciphertext: \(CT=(CM,Hd)=(CM,C_{1},C_{2},C_{3})=(M\oplus Ext(e(g_{1},A_{1}A_{2})^{\alpha},r),\)\((A_{1}A_{2})^{\sum\limits_{j=1}^{d}a^{j}ID_{j}+b},A_{1}A_{2},r)\). **Stage 2. **\(\mathcal{A}\) continues to make a private key inquiry for \(ID_{i}\). The condition that needs to be met is \(ID_{i}\
otin S^{*}\). **Guess. **\(\mathcal{A}\) outputs the guess \(\beta^{\prime}\) about \(\beta\). If \(\beta^{\prime}=\beta\), \(\mathcal{A}\) wins the game. **Probability analysis**. When \(T\in G_{q_{1}q_{3}}\), \(\mathcal{B}\) correctly simulates the game GM\({}_{k-1}\). When \(T\in G_{1}\), \(\mathcal{B}\) correctly simulates the game GM\({}_{k}\). The joint distribution of all variables is represented by the symbol \(VD\). When there is no leakage, the paper [65] shows that \(\widetilde{H}_{\infty}(\mathcal{A}|VD)\geq log_{2}^{N}\). Thus, the probability that the adversary receives the invalid ciphertext in every decryption query is \(2^{-\widetilde{H}_{\infty}(\mathcal{A}|VD)}\leq 2^{-log_{2}^{N}}=\frac{1}{3v}\). When the symmetric key exposes \(l\) bits of information, we obtain that \(\widetilde{H}_{\infty}(\mathcal{A}|(VD,Leak))\geq log_{2}^{N}-l\). Thus, the probability that the adversary receives the invalid ciphertext in every decryption query is \(2^{-\widetilde{H}_{\infty}(\mathcal{A}|(VD,Leak))}\leq 2^{-(log_{2}^{N}-l)}=\frac{2l}{N}\). Therefore, the advantage of solving the difficult Hypothesis 2 using \(\mathcal{B}\) is \(\epsilon^{\prime}\geq\frac{2l}{N}\epsilon\). That is to say, if \(\mathcal{A}\) can distinguish GM\({}_{k-1}\) and GM\({}_{k}\) over advantage \(\epsilon\), the challenger can destroy Hypothesis 2 with the advantage \(\epsilon^{\prime}\geq\frac{2l}{N}\epsilon\). This contradicts Hypothesis 2. So, \(\Big{|}AD_{\mathcal{A}}^{\text{GM}_{k-1}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{ k}}(L_{K})\Big{|}\leq\epsilon\). By the same token, for \(i=k\) to \(i=p\), we obtain \(\Big{|}AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{k+1}}( L_{K})\Big{|}\leq\epsilon\), \(\ldots\), \(\Big{|}AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{p-1}}( L_{K})\Big{|}\leq\epsilon\). Therefore,  
\[\Big{|}AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})-AD_{\mathcal{A}}^{ \text{GM}_{p}}(L_{K})\Big{|}\] \[= \Big{|}AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})-AD_{\mathcal{A}}^{ \text{GM}_{k+1}}(L_{K})+\ldots+AD_{\mathcal{A}}^{\text{GM}_{p-1}}(L_{K})-AD_{ \mathcal{A}}^{\text{GM}_{p}}(L_{K})\Big{|}\] \[\leq \big{|}AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})-AD_{\mathcal{A}}^{ \text{GM}_{k+1}}(L_{K})\Big{|}+\ldots+\Big{|}AD_{\mathcal{A}}^{\text{GM}_{p-1}}( L_{K})-AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})\Big{|}\] \[\leq (p-k)\epsilon\]In addition, \(\left|AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{F}}(L_{K })\right|\leq\varepsilon\) (the proof will be given in Lemma 3). In this way, we can obtain:  
\[ \begin{array}{l}AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})\\ =\left|AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{p }}(L_{K})+AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})-AD_{\mathcal{A}}^{\text{GM} _{F}}(L_{K})\right|\\ \leq\left|AD_{\mathcal{A}}^{\text{GM}_{k}}(L_{K})-AD_{\mathcal{A}}^{\text{GM} _{p}}(L_{K})\right|+\left|AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})-AD_{\mathcal{ A}}^{\text{GM}_{F}}(L_{K})\right|\\ \leq(p-k+1)\varepsilon\end{array} \]  
This indicates that the advantage of \(\mathcal{A}\) can be ignored in GM\({}_{k}\). Lemma 2 is proved. \(\square\)  
**Lemma 3**. : _Considering that the symmetric key has \(l\) bits of leakage, if there is an adversary \(\mathcal{A}\) such that \(\left|AD_{\mathcal{A}}^{\text{GM}_{p}}(L_{K})-AD_{\mathcal{A}}^{\text{GM}_{F} }(L_{K})\right|\geq\varepsilon\), the challenger \(\mathcal{B}\) destroys Hypothesis 3 with the advantage \(2^{l}\varepsilon\)._  
Proof.