# Unified Ciphertext-Policy Weighted Attribute-Based Encryption for Sharing Data in Cloud Computing
## 6 Security Analysis  
### Security Proof  
Extended from CP-WABE, UCP-WABE is expected to have the same security property as CP-WABE, which has been proven to be selectively secure under a variant of the decision \(\ell\)-bilinear Diffie-Hellmann exponent (BDHE) assumption [16]. Based on the selective security of CP-WABE, we prove UCP-WABE is selectively secure.  
Theorem 6.1: _If no polynomial time adversary can selectively break CP-WABE with a weighted challenge access policy \(\Gamma^{*}\), no polynomial time adversary can selectively break UCP-WABE with \(\Gamma^{*}\)._  
Proof: To prove the theorem, we assume that there exists a polynomial time adversary \(\mathcal{A}\), which has a non-negligible advantage \(Adv_{\mathcal{A}}\) in selectively breaking UCP-WABE. Using \(\mathcal{A}\), we will build a polynomial time adversary \(\mathcal{B}\), which selectively breaks CP-WABE with a non-negligible advantage \(Adv_{\mathcal{B}}\).  
**Init:**\(\mathcal{A}\) declares a challenge weighted access policy \(\Gamma^{*}\) and sends it to \(\mathcal{B}\). \(\mathcal{B}\) sends \(\Gamma^{*}\) to the CP-WABE challenger.  
**Setup:** The public parameter of CP-WABE \(PP=\left\{\mathcal{G}_{1},g,\widehat{e}(g,g)^{\alpha},\{h_{i,emd},h_{i,j}\}_{ \forall u_{ij}\in\mathcal{U},j=0,\cdots,l_{i}\}\right\}\) is sent to \(\mathcal{B}\), then \(\mathcal{B}\) sends \(PP^{\prime}=PP\) to \(\mathcal{A}\).  
**Phase 1:**\(\mathcal{A}\) makes secret key queries to \(\mathcal{B}\) for attribute sets, and none of these sets satisfy the challenge access policy \(\Gamma^{*}\). Suppose \(\mathcal{A}\) asks for attribute set \(\mathbb{S}_{q1}\). \(\mathcal{B}\) gives \(\mathbb{S}_{q1}\) to the CP-WABE challenger and gets \(SK_{q1}=\left\{\{K_{(i,0),1},K_{(i,0),2},K_{(i,j),1},K_{(i,j),2},K_{(i,j),3},K _{(i,emd_{j}),1},K_{(i,emd_{j}),2}\}_{\forall u_{i}\in\mathbb{S}_{q1},q\in \mathcal{A}}\right.\)\(\mathcal{B}\) returns \(SK^{\prime}_{q1}=SK_{q1}\) to \(\mathcal{A}\) to answer the query. This process would repeat until \(\mathcal{A}\) no longer queries.  
**Challenge:**\(\mathcal{A}\) submits two messages of the same length \(m_{0},m_{1}\). Then, \(\mathcal{A}\) constructs a weighted access policy \(\Gamma^{\prime}\) that there is a mutual access sub-policy between \(\Gamma^{*}\) and \(\Gamma^{\prime}\). \(\Gamma^{\prime}\) is also sent to \(\mathcal{B}\). \(\mathcal{B}\) sends \(m_{0},m_{1}\) to the CP-WABE challenger. The CP-WABE challenger flips a random coin \(b\xleftarrow{R}\{0,1\}\) and encrypts \(m_{b}\) with \(\Gamma^{*}\). The ciphertext is \(CT=\left\{\Gamma^{*},C_{m_{b^{\prime}}},\{C_{(i,j),1},\allowbreak C_{(i,j),2} \}_{\forall u_{i}\in\Gamma_{1},j=1,\cdots,\omega_{i}},\{C_{(i,emd),1},C_{(i,emd),2}\}_{\forall u_{i}\in\Gamma_{1}}\right\}\), and the CP-WABE challenger sends it to \(\mathcal{B}\). \(\mathcal{B}\) constructs challenge ciphertext \(CT^{*}\) as \(CT^{*}=CT\) and returns it to \(\mathcal{A}\).  
**Phase 2:**\(\mathcal{A}\) asks for more secret keys, and the same restriction is that \(\Gamma^{*}\) must not be satisfied by any one of the queried attribute sets. \(\mathcal{B}\) answers as in **Phase 1**.  
**Guess:**\(\mathcal{A}\) outputs its guess \(b^{\prime}\in\{0,1\}\), and \(\mathcal{B}\) outputs \(b^{\prime}\) in its own game. \(\mathcal{B}\) has an advantage in breaking CP-WABE as  
\(Adv_{\mathcal{B}}=|Pr[b=b^{\prime}]-1/2|=Adv_{\mathcal{A}}\)  
Thus, \(\mathcal{B}\) has a non-negligible advantage in selectively breaking CP-WABE, so the proof of the theorem is completed.  
Figure 5: The process flow of decryption.