## 5 Analysis of the Scheme
### Security Analysis of Algorithm
\begin{array}{ll}&\mathbf{B}^{\prime}=\left[\mathbf{B}_{2}^{\prime\top} \right]\cdots\left[\mathbf{B}_{s_{\max}}^{\prime\top},\mathbf{T}_{\mathbf{B}^{ \prime}}\right]\leftarrow\\ 1.&\mathbf{EnTrapGen}\left(1^{n\left(s_{\max}-1\right)},1^{m-1},q\right):\\ &\left\{\mathbf{B}_{j}^{\prime}\right\}_{j\in\left\{2,\cdots,s_{\max}\right\} }\in\mathbb{Z}_{q}^{n\times\left(m-1\right)}\\ 2.&\left\{\mathbf{b}_{j}^{\prime}\right\}_{j\in\left\{2,\cdots,s_{\max}\right\} }\leftarrow\mathbb{Z}_{q}^{n}\\ 3.&\forall j\in\left\{2,\cdots,s_{\max}\right\}:\mathbf{B}_{j}=\left[\mathbf{ b}_{j}^{\prime\top}\left|\mathbf{B}_{j}^{\prime}\right]\end{array} \]  
The indistinguishableness between **Hyb4** and **Hyb3** originates from the enhanced trapdoors lattice sampler function \(\mathbf{EnLT}=\left(\mathbf{EnTrapGen},\mathbf{EnSamplePre}\right)\). **Hyb5:**_This game is analogous to **Hyb4**, except for the change of vector \(\left\{\mathbf{k}_{u}\right\}_{u\in U\cap\rho\left(\left[\ell\right]\right)}\) when answering the key query of the adversary \(\mathcal{A}\):_  
\[ \begin{array}{ll}&\widetilde{\mathbf{k}}_{u}\leftarrow\mathbf{ EnSamplePre}\\ 1.&\left(\begin{array}{c}\mathbf{A}_{u},T_{\mathbf{A}_{u}},\sigma,\\ \mathbf{t}\left(M_{\rho^{-1}(u),1}\left[\mathbf{y}^{\top}\right]\!\!\left[ 0^{\top}\right]\!\!\left[\cdots\!\left[0^{\top}\right]\right]\right)^{\top}+ \\ &\left(\sum\limits_{j\in\left\{2,\cdots,s_{\max}\right\}}\mathbf{t}\!\left(M_{ \rho^{-1}(u),j}\mathbf{B}_{j}\right)^{\top}-\hat{\mathbf{k}}_{u}\mathbf{A}_{u }^{\top}\right)\\ 2.&\mathbf{k}_{u}=\hat{\mathbf{k}}_{u}+\widetilde{\mathbf{k}}_{u}+\imath \mathbf{R}_{u}^{\top}\end{array}\right).\end{array} \]  
The indistinguishableness between **Hyb5** and **Hyb4** follows from Lemma 1. **Hyb6:**_This game is the same as **Hyb5** except for the generation of vector \(\hat{\mathbf{t}}\) while answering the key query of the opponent \(\mathcal{A}\). Let \(\mathbf{d}=\left(d_{1},\cdots,d_{s_{\max}}\right)\in\mathbb{Z}_{q}^{s_{\max}}\) be a vector such that \(d_{1}=1\) and for all \(u\in U\), there is \(\sum\limits_{j\in\left[s_{\max}\right]}M_{\rho^{-1}(u),j}d_{j}=0\). It is worth noting that due to the game restrictions, the set of the index of \(\mathbf{M}\) row in \(\rho^{-1}(U)\) must be unauthorized to the access control policy \((\mathbf{M},\rho)\), thus ensuring the existence of the vector \(\mathbf{d}\)._  
1.In the Key query phase, let \(\hat{\mathbf{t}}\leftarrow\mathcal{X}_{1}\) change to \(\left\{f_{j}\right\}_{j\in\left\{2,\cdots,s_{\max}\right\}}\leftarrow\mathbb{Z }_{q}^{n}\)
2.The vectors is \(\hat{\mathbf{t}}\leftarrow\mathbf{EnSamplePre}\left( \begin{array}{c} \mathbf{B}^{\prime},T_{\mathbf{B}^{\prime}},\sigma,\\ \left(\begin{array}{c}d_{2}\mathbf{y}+f_{2}-\mathbf{b}_{2}^{\prime},\cdots, \\ d_{s_{\max}}\mathbf{y}+f_{s_{\max}}-\mathbf{b}_{s_{\max}}^{\prime}\end{array} \right)\end{array} \right)\)  
The indistinguishableness between **Hyb6** and **Hyb5** originates from the enhanced trapdoors function \(\mathbf{EnLT}=\left(\mathbf{EnTrapGen},\mathbf{EnSamplePre}\right)\). **Hyb7:**_This game is the same as **Hyb6**, except for the change of key module while answering the key query of the adversary \(\mathcal{A}\):_  
1. \(\left\{\mathbf{z}_{u}\right\}_{u\in U\cap\rho\left(\left[\ell\right]\right)} \leftarrow\mathbb{Z}_{q}^{n}\)
2. \(\left\{f_{j}\right\}_{j\in\left\{2,\cdots,s_{\max}\right\}}\leftarrow\mathbb{Z }_{q}^{n}\) exploits the constraint \(\sum\limits_{j\in\left\{2,\cdots,j_{\max}\right\}}M_{\rho^{-1}(u),j}f_{j}= \mathbf{z}_{u}+\hat{\mathbf{k}}_{u}\mathbf{A}_{u}^{\top}\)
3. \(\forall u\in U\cap\rho\left(\left[\ell\right]\right):\)
4. \(\forall u\in U\cap\rho\left(\left[\ell\right]\right):\)
5. \(\widetilde{\mathbf{k}}_{u}\leftarrow\mathbf{EnSamplePre}(\mathbf{A}_{u},T_{ \mathbf{A}_{u}},\rho,\mathbf{z}_{u})\)  
The change between **Hyb7** and **Hyb6** is only in syntax, so the hybrid games are indistinguishable.