## 6 Security Proof
If the \(\mathcal{A}\) makes the hash query on (\(r_{V}+1||r_{HCA}\)) and \(r_{HCA}+1\), \(\mathcal{C}\) also forwards them to the hash oracle and returns the response hashed value to \(\mathcal{A}\). * In the EHR migration phase, \(\mathcal{A}\) asks for the \(r_{V}^{*}+1\), \((r_{W}^{*}+1)\oplus r_{U}^{\prime\prime}\), and \((r_{W}^{*}+1)||(r_{V}^{*}+1)\) hash values of the \(H_{2}\) function, and \(\mathcal{C}\) also forwards them to the hash oracle and lets the hash oracle generate the corresponding hash values to \(\mathcal{A}\). * If \(\mathcal{C}\) receives the \(Corrupt(i)\) query, then it returns the private key to \(\mathcal{A}\). If \(\mathcal{C}\) receives the \(Reveal(i)\) query, it checks if \(i\
eq i^{*}\) or \(j\
eq j^{*}\), then \(\mathcal{D}\) computes the session key \(sk_{i,j}=H_{1}(\omega_{1}(r_{W}^{*}+1))||\omega_{2}((r_{V}^{*}+1)))\), where \(r_{W}^{*}+1\) and \(r_{V}^{*}+1\) are chosen from \(\omega_{1}\) and \(\omega_{2}\) functions, respectively. On the other hand, if \(i=i^{*}\), \(j=j^{*}\), and \(t_{1}=t_{2}=l\), then \(\mathcal{C}\) computes \(H_{1}((r_{W}^{*}+1)||(r_{V}^{*}+1))\) as the session key \(ssk_{i,j}\) and delays this key in the response in the _Test_ query. * If the adversary \(\mathcal{A}\) has finished the above queries, it can make the _Test_ query to \(\mathcal{C}\). At this time, \(\mathcal{C}\) will check the instance session and player to see if \(i=i^{*}\) and \(j=j^{*}\), and \(\mathcal{C}\) then tosses a coin \(b\) to answer the session key. If \(b\)=0, then it computes \(ssk_{i,j}=H_{1}((r_{W}^{*}+1)||(r_{V}^{*}+1))\). Otherwise, it computes \(ssk_{i,j}\longleftarrow\{0,1\}^{*}\) from the random pseudo-random function. Finally, if \(\mathcal{C}\) answers the _Test_ query for \(\Pi_{i^{*}}^{t_{1}}\) and \(\Pi_{j^{*}}^{t_{2}}\) by using \((Z_{n}^{*},H_{1},H_{2},\omega_{1},\omega_{2})\), and \(\mathcal{A}\) does not fail in guessing \(b^{\prime}\), then \(\mathcal{A}\) answers the session key depending on its coin flip \(b^{\prime}\). We can have  
\[ \begin{split} Adv_{\mathcal{C},\mathcal{A},\mathcal{S}E}^{H_{1},H_{2}\omega_{1},\omega_{2}}(\theta,t)&=\\ Pr[\mathcal{C}(Z_{n}^{*},H_{1},H_{2},\omega_{1},\omega_{2})=1| ssk_{i,j}&=H_{1}((r_{W}^{*}+1)||(r_{V}^{*}+1)))]-\\ Pr[\mathcal{C}(Z_{n}^{*},H_{1},H_{2},\omega_{1},\omega_{2})=1| ssk_{i,j}\longleftarrow\{0,1\}^{*},t\in Z_{q}^{*}]&\leq\\ \frac{1}{(Iq_{h})^{2}}(Pr[\mathcal{A}(\cdot)=1|ssk_{i^{*},j^{*}} \text{ is real in {Test query}}]-Pr[\mathcal{A}(\cdot)=1|ssk_{i^{*},j^{*}} \text{ is random in {Test query}}])&\leq\\ \frac{1}{(Iq_{h})^{2}}(2 Pr_{\mathcal{A}}[b=b^{\prime}\wedge \overline{dis}\wedge\overline{forge}]-1).\end{split}  \tag{8}\]  
Finally, we could conclude that  
\[Pr_{\mathcal{A}}[b=b^{\prime}\wedge\overline{dis}\wedge\overline{forge}]\leq \frac{1}{2}((Iq_{h})^{2}Adv_{\mathcal{C},\mathcal{A},\mathcal{S}E}^{H_{1},H_ {2}\omega_{1},\omega_{2}}(\theta,t)+1). \tag{9}\]  
**Lemma 6**. : _Before we prove Lemma 1, we assume that there is no event such that the attacker \(\mathcal{F}^{*}\) can forge the signature \(S_{U}\) of patient \(U\) with non-negligible probability_  
\[Pr_{\mathcal{F}}[forge]\leq(l^{3}q_{s}(Adv_{Sig,\mathcal{S},\mathcal{F}}^{UInf} (\theta,t^{*}),\]  
_in the polynomial time bound \(t^{*}\) under the above Ind-CCA security definition with \(q_{h}\) hash queries, at most \(q_{e}\) encryption queries, and at most \(q_{s}\) decryption queries, respectively._  
Proof of Lemma 6.: In this lemma proof, we start to prove our above **Lemma 1** (Unforgeability). To start the proof of **Lemma 1** (Unforgeability), we defined the **Game** asthe simulation game that runs as the proposed protocol controlled by the simulator \(\mathcal{S}\). We define **Game** as follows. \[