## 6 Security Analysis
### Privacy Protection  
Theorem 3: _The server, FN, and curious user can know nothing about the private information of user \(\mathcal{U}_{i}\)._  
Proof of Theorem 3: We assume that any probabilistic polynomial time adversary (PPTA), such as the honest but curious server, the FN, and the user, can eavesdrops on any communication between user \(\mathcal{U}_{i}\), the FN, and the server. Moreover, the PPTA successfully obtains all messages transmitted between user \(\mathcal{U}_{i}\) and the FN, including but not limited to \((y_{i},y_{i+1},y_{i-1},C_{i,t},H_{0}(t)^{sk_{FN}})\). To obtain the privacy information \(w_{i,t}\), it is impossible for any PPTA without knowing the blinding factor \(Y_{i}\) and \(H_{0}(t)^{sk_{FN}sk_{i}}\). However, solving \(Y_{i}\) and \(H_{0}(t)^{sk_{FN}sk_{i}}\) with \((y_{i},y_{i+1},y_{i-1},H_{0}(t)^{sk_{FN}})\) is a CDH problem. That is, for any PPTA, inferring the private value \(w_{i,t}\) during training of our proposed scheme is at least as difficult as the CDH problem in \(\mathbb{G}_{1}\). Thus, any PPTA can know nothing about the private information of user \(\mathcal{U}_{i}\). Theorem 4: _Even though user \(\mathcal{U}_{i+1}\), \(\mathcal{U}_{i-1}\) and the FN are colluded, it is infeasible to deduce any private information of user \(\mathcal{U}_{i}\)._  
Proof of Theorem 4: We assume that user \(\mathcal{U}_{i+1}\), \(\mathcal{U}_{i-1}\) and the FN are colluded. User \(\mathcal{U}_{i}\) sends \((C_{i,t},Au_{i,t}^{1},Au_{i,t}^{2})\) to the FN. The FN randomly selects a number \(r_{i^{\prime}}\in\mathbb{Z}_{p}^{*}\), and sends \(y_{i^{\prime}}\) to user \(\mathcal{U}_{i-1}\) and \(\mathcal{U}_{i+1}\). \(\mathcal{U}_{i-1}\) and \(\mathcal{U}_{i+1}\) compute \(Y_{i-1}^{\prime}=(y_{i}/y_{i^{\prime}})^{r_{i-1}}\) and \(Y_{i+1}^{\prime}=(y_{i^{\prime}}/y_{i})^{r_{i+1}}\), respectively, and send them to the FN. The FN can remove blinding factor \(Y_{i}\). The FN first computes \(Y_{i^{\prime}}=(y_{i-1}/y_{i+1})^{r_{i^{\prime}}}\), and then computes \(C_{i,t}\cdot Y_{i^{\prime}}\cdot Y_{i-1}^{\prime}\cdot Y_{i+1}^{\prime}=(1+p \cdot w_{i,t})H_{0}(t)^{sk_{FN}sk_{i}}\). To obtain the privacy information \(w_{i,t}\), it is impossible without knowing the blinding factor \(H_{0}(t)^{sk_{FN}sk_{i}}\). However, solving \(H_{0}(t)^{sk_{FN}sk_{i}}\) with \(H_{0}(t)^{sk_{FN}}\) is a CDH problem. That is, for any PPTA, inferring the private value \(w_{i,t}\) during training of our proposed scheme is at least as difficult as the CDH problem in \(\mathbb{G}_{1}\). Thus, even though user \(\mathcal{U}_{i+1}\), \(\mathcal{U}_{i-1}\) and the FN are colluded, it is infeasible to deduce any private information of user \(\mathcal{U}_{i}\). Theorem 5: _Even though the user \(\mathcal{U}_{i+1}\), \(\mathcal{U}_{i-1}\) and the server are colluded, it is infeasible to deduce any private information of user \(\mathcal{U}_{i}\)._  
Proof of Theorem 5: We assume that user \(\mathcal{U}_{i+1}\), \(\mathcal{U}_{i-1}\) and the server are colluded. The server will obtain \((C_{i,t},H_{0}(t)^{sk_{FN}})\). The server randomly selects a number \(r_{i^{\prime}}\in\mathbb{Z}_{p}^{*}\), and sends \(y_{i^{\prime}}\) to user \(\mathcal{U}_{i-1}\) and \(\mathcal{U}_{i+1}\). \(\mathcal{U}_{i-1}\) and \(\mathcal{U}_{i+1}\) compute \(Y_{i-1}^{\prime}=(y_{i}/y_{i^{\prime}})^{r_{i-1}}\) and \(Y_{i+1}^{\prime}=(y_{i^{\prime}}/y_{i})^{r_{i+1}}\), respectively, and send them to the server. The server can remove blinding factor \(Y_{i}\). The server first computes \(Y_{i^{\prime}}=(y_{i-1}/y_{i+1})^{r_{i^{\prime}}}\), and then computes \(C_{i,t}\cdot Y_{i^{\prime}}\cdot Y_{i-1}^{\prime}\cdot Y_{i+1}^{\prime}=(1+p \cdot w_{i,t})H_{0}(t)^{sk_{FN}sk_{i}}\). To obtain the privacy information \(w_{i,t}\), it is impossible without knowing the blinding factor \(H_{0}(t)^{sk_{FN}sk_{i}}\). However, solving \(H_{0}(t)^{sk_{FN}sk_{i}}\) with \(H_{0}(t)^{sk_{FN}}\) is a CDH problem. That is, for any PPTA, inferring the private value \(w_{i,t}\) during training of our proposed scheme is at least as difficult as the CDH problem in \(\mathbb{G}_{1}\).