## 4 Security Proof and Efficiency
Then \(\mathcal{B}\) transmits necessary system parameters {\(p\), \(G_{1}\), \(G_{2}\), \(g\), \(e\), \(H\), \(F\), \(g^{\beta}\), \(g^{c}\), \(e(g^{c},g)\), \(\Omega\), \(\mathbf{w}\), \(\Lambda\)} to \(\mathcal{A}\). **Phase 1:** The adversary \(\mathcal{A}\) will interact with the distinguisher \(\mathcal{B}\) below. \(H\) _oracle:_ When \(\mathcal{A}\) submits an \(H(x)\) query, \(\mathcal{B}\) returns with an integer \(v_{1}\in_{R}Z_{p}\)*. The record (\(x\), \(v_{1}\)) is also stored in the H-list. \(F\) _oracle:_ When \(\mathcal{A}\) submits an \(F(k_{i},t_{i})\) query, \(\mathcal{B}\) responds with an integer \(v_{2}\in_{R}Z_{p}\)*. The record (\(k_{i}\), \(t_{i}\), \(v_{2}\)) is also stored in the F-list. _ABE-KeyGen oracle:_ When \(\mathcal{A}\) submits an \(ABE\)-_KeyGen_(\(id\), \(\mathbf{w}\)) query, \(\mathcal{B}\) selects \(t\in_{R}Z_{p}\)* to derive \(K=(g^{c})^{t}(g^{c})\), \(L=(g^{\beta})^{t}\), \(\{K_{x}=H(x)^{t}\}_{x\in w}\), and keeps (\(id\), \(g^{cd}\)) in the user list. Finally, \(\mathcal{B}\) returns the ABE-Key \(d_{id}\), \(\mathbf{w}=(K\), \(L\), \(\{K_{x}\})\). _KS-KeyGen oracle:_ When \(\mathcal{A}\) submits a _KS-KeyGen_(\(id\)) query, \(\mathcal{B}\) first checks if \(id\) is stored in the user list and then retrieves \(g^{ct}\) to compute \(q_{u}=g^{u}\) and \(q_{id}=(g^{ct})(g^{cu})\) where \(u\in Z_{p}\)*. The value \((q_{id},u)\) is also returned to \(\mathcal{A}\) as a result. _Encrypt oracle:_ When \(\mathcal{A}\) submits an \(Encrypt(\mathbb{A}\), \(msg\)) query, \(\mathcal{B}\) first chooses a random vector \(\mathbf{v}=(s,y_{2},\ldots,y_{n})\in_{R}Z_{p}\)* and computes \(\lambda_{i}=\langle\mathbf{M}_{i},\mathbf{v}\rangle\), \(C=[g^{c},g)]^{s}\cdot(msg)\), \(C^{\ast}=g^{s}\), \(|C_{i}=g^{c\lambda_{i}}H(\rho(i))^{-s}\). The ciphertext \(ct=(C\), \(C^{\ast}\), \(\{C_{i}\})\) is returned to \(\mathcal{A}\) as a result. _Index oracle:_ When \(\mathcal{A}\) submits an \(Index(\mathbf{kw})\) query, \(\mathcal{B}\) chooses \(t_{i}\in_{R}Z_{p}\)* for each keyword \(kw_{i}\in\)\(k\mathbf{w}\), and then computes \(\{k_{i}=[e(g,g^{c})]^{s}\cdot e(g,H(kw))^{s}\}_{k\in k\mathbf{w}}\) and \(IX(\mathbf{kw})=\{(t_{i},f_{i}=F(k_{i},\)\(t_{i}))\}_{k\in k\mathbf{w}}\). At last, the index set \(IX(\mathbf{kw})\) is returned to \(\mathcal{A}\) as a result. _Re-Encrypt oracle:_ When \(\mathcal{A}\) submits a \(Re\)-_Encrypt_(\(ct\)) query, \(\mathcal{B}\) returns \(ct^{\ast}=(C^{\ast}\), \(C^{\ast}\), \(\{C_{i}\})\) where \(C^{\ast}=C^{\beta}\). _Trapdoor oracle:_ When \(\mathcal{A}\) submits a \(Trapdoor(id\), \(q_{id}\), \(u\), \(k\), \(u\), \(k\), \(d_{id}\), \(w\), \(\mathbf{w}\)) query, \(\mathcal{B}\) runs the Trapdoor algorithm of the proposed system and then returns \(T_{kw}=(T_{q}(kw),L^{\prime}\), \(\{K^{\prime}_{x}\}_{x\in w})\) to \(\mathcal{A}\). _Test oracle:_ When \(\mathcal{A}\) submits a \(Test(T_{kw},\mathbf{w})\) query, \(\mathcal{B}\) runs the Test algorithm of the proposed system and then returns the result to \(\mathcal{A}\). _Pre-Decrypt oracle:_ When \(\mathcal{A}\) submits a \(Pre\)-_Decrypt_(\(ct^{\ast}\), \(Q_{ct}\)) query, \(\mathcal{B}\) runs the Precrypt algorithm of the proposed system and then returns \(ct=(C\), \(C^{\ast}\), \(\{C_{i}\})\) & \(\mathcal{Q}_{ct}\) to \(\mathcal{A}\). _Decrypt oracle:_ When \(\mathcal{A}\) submits a \(Decrypt(id\), \(ct^{\ast}\), \(Q_{ct}\)) query, \(\mathcal{B}\) first find out the ABE-Key \(d_{id,\ w}\) from previous history of ABE-KeyGen queries and then runs the Decrypt algorithm. Then the recovered \(msg\) is returned to \(\mathcal{A}\). **Challenge:** The adversary \(\mathcal{A}\) would deliver \(\mathcal{B}\) two messages, \((msg_{0},\)\(msg_{1})\) of the same length and an access policy \(\mathbb{A}\). Next, \(\mathcal{B}\) decides \(m_{\lambda}\) using an internal flipped coin \(\lambda\leftarrow[0,1]\) and generates a corresponding ciphertext \(ct^{\prime}\) according to the steps of previous Encrypt queries except that \(C=[e(g^{a},g^{b})]^{s}\cdot(msg_{\lambda})\).