## 4 Security Proofs
### Tamper Resistance  
In our scheme, the information \((\delta,\sigma,\gamma)\) of a ticket is used for anonymity control, charging, and recording the due date of the ticket, respectively. In this subsection, we will show that none can tamper \((\delta,\sigma,\gamma)\) of a ticket. First, we introduce a problem called the alternative formulation of RSA Known-Target Inversion (RSA-AKTI) Problem [20] which has been proved being hard by [PERSON] _et al._  
**Definition 4** (Rsa Akti). : _Let \(k\in\mathbb{N}\) be the security parameter. Let \(\mathcal{A}\) be an adversary which can access the RSA-inversion oracle \(\mathcal{O}_{inv}\) and the challenge oracle \(\mathcal{O}_{N}\). The challenge oracle \(\mathcal{O}_{N}\) will randomly return \(y_{i}\in\mathbb{Z}_{n_{H}}^{s}\) when it is queried. Consider the following experiment:_  
Figure 7: The forget \(\mathcal{F}\). \(\mathcal{A}_{TR}\) _Experiment_ \(Exp_{\mathcal{A}}^{RSA-AKTI}(k)\) - \((n_{H},e_{H},d_{H})\) + \(KeyGen(k)\). - \((x_{1},\ldots,x_{m})\) \(\gets\)\(A^{\mathcal{O}_{inv},\mathcal{O}_{N}}(n_{H},e_{H},k)\) _where_ \(m\) _is the number of queries to_ \(\mathcal{O}_{N}\)_. - Let_ \(y_{1},\ldots,y_{m}\) _be the challenges returned by_ \(\mathcal{O}_{N}\)_. If the followings are both true, return 1; else return 0._ 1. \(\forall i\in\{1,\ldots,m\}:x_{i}^{e_{H}}\equiv y_{i}\pmod{n_{H}}\)_. 2. \(\mathcal{A}\) _made strictly fewer than_ \(m\) _queries to_ \(\mathcal{O}_{inv}\)_._  
In the ticket requesting protocol (Section 3.3) and the ticket using protocol (Section 3.4), if \(\lambda\) tickets are requested, the system side (the judge device) will generate \((\delta_{i},\sigma_{i},\gamma_{i})\) for each ticket where \(1\leq i\leq\lambda\). Here, we define ticket tampering below. **Definition 5** (Ticket Tampering). : _There exists an attacker \(\mathcal{A}_{TR}\) who runs the ticket requesting protocol in Section 3.3 or the ticket using protocol in Section 3.4\(\lambda\) times. Let \(S_{\mathcal{A}}=\{(\delta_{1},\sigma_{1},\gamma_{1}),\ldots,(\delta_{\lambda},\sigma_{\lambda},\gamma_{\lambda})\}\) where \((\delta_{i},\sigma_{i},\gamma_{i})\) is generated for \(\mathcal{A}_{TR}\) and thus \(\delta_{i}\) contains \(\mathcal{A}_{TS}\)'s identity and \(\sigma_{i}\) contains an accumulated value which \(\mathcal{A}_{TR}\) spent for \(i=1,\ldots,\lambda\). \(\mathcal{A}_{TR}\) can output a tampered ticket \((s,m,\delta^{\prime},\sigma^{\prime},\gamma^{\prime})\) where \((\delta^{\prime},\sigma^{\prime},\gamma^{\prime})\
otin\mathcal{S}_{\mathcal{A}}\)._  
**Theorem 3**. : _The proposed scheme is secure against Ticket Tampering if the RSA-AKTI problem is hard._  
Proof. : The model of this proof is shown in Figure 8. There exist a simulator \(\mathcal{S}\) and an attacker \(\mathcal{A}_{\mathcal{TR}}\) in this model. \(\mathcal{S}\) will simulate the environment of our proposed scheme in the random oracle model. \(\mathcal{S}\) engages in the proposed scheme to generate the key pair \((pk_{I},sk_{I})\) of the judge and creates two oracles \(\mathcal{O}_{F_{1}}\) and \(\mathcal{O}_{F_{2}}\). \(\mathcal{S}\) can query the oracles \(\mathcal{O}_{N}\) and \(\mathcal{O}_{inv}\) defined in Definition 4. \(\mathcal{A}_{TR}\) will query \(\mathcal{O}_{F_{1}}\) and \(\mathcal{O}_{F_{2}}\) for the hashed values of the hash functions \(F_{1}\) and \(F_{2}\), respectively. There are two lists \(L_{F_{1}}\) and \(L_{F_{2}}\). \(L_{F_{1}}\) will be used to store \((m,\tau)\) where \(F_{1}(m)=\tau^{e_{H}}\bmod n_{H}\) and \(L_{F_{2}}\) will be used to record \((\delta,\sigma,\gamma,\pi)\) where \(F_{2}(\delta,\sigma,\gamma)=\pi\). \(\mathcal{A}_{TR}\) can query \(\mathcal{S}\) at most \(\lambda_{1}\) times, \(\mathcal{O}_{F_{1}}\) at most \(\lambda_{2}\) times, and \(\mathcal{O}_{F_{2}}\) at most \(\lambda_{3}\) times.