## 4 Problem Formulation
### Security Model  
_(1) Message Confidentiality:_  
* _Setup_: Challenger_ \(\mathcal{C}\) executes \(\mathsf{Setup}(1^{\kappa})\) to obtain \((GP,MSK)\), subsequently transmitting \(GP\) to adversary \(\mathcal{A}\). * _Phase-1:_ Adversary \(\mathcal{A}\) may repeatedly query the oracle \(\mathcal{O}_{K\mathsf{S}\mathsf{S}\mathsf{S}\mathsf{S}\mathsf{S}}(S_{x}, \mathsf{uid}_{x})\) for \(x\in[1,\mathcal{U}_{1}]\). In responding, \(\mathcal{C}\) generates \(SK_{\mathsf{uid}_{x},S_{x}}\leftarrow\mathsf{KeyGen}(GP,MSK,S_{x},\mathsf{uid }_{x})\) and supplies \(SK_{\mathsf{uid}_{x},S_{x}}\) to \(\mathcal{A}\). * _Challenge:_\(\mathcal{A}\) presents \(\mathcal{C}\) with \((m_{0}^{*},m_{1}^{*})\), \(\mathbb{M}^{*}\), and \(L^{*}\). None of the identity-attribute pairs \((\mathsf{uid}_{x},S_{x})\) queried in Phase-1 can meet the criteria \(S_{x}\in\mathbb{M}^{*}\) and \(\mathsf{uid}_{x}\
otin L^{*}\) concurrently. \(\mathcal{C}\) selects \(q\) randomly from \(\{0,1\}^{*}\), encrypts via \(CT^{*}\leftarrow\mathsf{Encrypt}(GP,m_{q},\mathbb{M}^{*},L^{*})\), and forwards \(CT^{*}\) to \(\mathcal{A}\). * _Phase-2:_\(\mathcal{A}\) can query the oracle \(\mathcal{O}_{\mathsf{KeyGen}}(S_{x},\mathsf{uid}_{x})\) as in Phase-1, where \(x\in[\mathcal{U}_{1}+1,\mathcal{U}]\). Any of the queried identity-attribute pairs \((\mathsf{uid}_{x},S_{x})\) in Phase-2 cannot satisfy \(S_{x}\in\mathbb{M}^{*}\) and \(\mathsf{uid}_{x}\
otin L^{*}\) simultaneously. * \(\mathcal{A}\) continues to access \(\mathcal{O}_{K\mathsf{S}\mathsf{S}\mathsf{S}}(S_{x},\mathsf{uid}_{x})\) for \(x\) ranging from \([\mathcal{U}_{1}+1,\mathcal{U}]\). Again, no queried identity-attribute pair \((\mathsf{uid}_{x},S_{x})\) should meet the criteria \(S_{x}\in\mathbb{M}^{*}\) and \(\mathsf{uid}_{x}\
otin L^{*}\) concurrently. * _Guess:_\(\mathcal{A}\) outputs a bit \(q^{\prime}\). If \(q^{\prime}=q\), then \(\mathcal{A}\) is deemed to have won the game. \(\mathcal{A}\)'s advantage is quantified as follows:  
\[\mathsf{Adv}_{\mathcal{A}}=\bigg{|}\Pr[q^{\prime}=q]-\frac{1}{2}\bigg{|}. \tag{2}\]  
**Definition 2** (IND-CPA secure). : _An ABE-RS scheme achieves indistinguishability under chosen plaintext attacks if the advantage \(\mathit{Adv}_{\mathcal{A}}\), defined as the probability that any probabilistic polynomialtime (PPT) adversary \(\mathcal{A}\) successfully distinguishes between encryptions of two chosen plaintexts, is negligible._  
(2) Index Confidentiality:Our ABE-RS scheme ensures CKA security, guaranteeing that no index information is disclosed without the corresponding trapdoor, as detailed in reference [42]. The static corruption of the authority limits the adversary's capacity to query any decryption keys crucial for decrypting the challenge ciphertext within a feasible timeframe. The CKA security setup between a probabilistic polynomial-time (PPT) attacker, \(\mathcal{A}\), and a challenger, \(\mathcal{C}\), is structured as follows:  
* _Setup:_\(\mathcal{C}\) initializes the system by running the \(\mathsf{Setup}(\lambda)\) algorithm, generating the global parameters \(GP\) that are then shared with \(\mathcal{A}\). * _First Query Phase:_ During this phase, \(\mathcal{A}\) makes a polynomial number of queries, which include the following: (a) _Hash oracle queries (\(H_{2}\), \(H_{3}\)):_\(\mathcal{A}\) requests data from the hash oracles \(H_{2}\) and \(H_{3}\). (b) _Trapdoor generation:_\(\mathcal{A}\) submits keywords to \(\mathcal{C}\), who then uses \(\mathsf{Trapdgen}(GP,w)\) to generate and return the corresponding trapdoors. * _Challenge:_\(\mathcal{A}\) challenges \(\mathcal{C}\) with a pair of previously unqueried keywords \((w_{0}^{*},w_{1}^{*})\), \(\mathcal{C}\) randomly selects a bit \(q\in\{0,1\}\) and uses \(\mathsf{Idxgen}(GP,S_{w})\) to produce the index \(I_{w_{0}}^{*}\), which is conveyed back to \(\mathcal{A}\). * _Second query phase:_\(\mathcal{A}\) continues to query as before, following the receipt of \(I_{w_{0}}^{*}\). * _Guess:_\(\mathcal{A}\) attempts to guess the bit \(q\), with the experiment deemed successful if \(q^{\prime}=q\).