## 6 Security Analysis
### Security  
The security of basic BCP algorithm and the building method from a linear homomorphic encryption to a homomorphic encryption in degree-2 functions are individually proved in their resources paper [28; 29], so this passage mainly analyze the security of parameter negotiation for data sharing task, ciphertext conversion and policy using steps in proposed scheme. To prove the security of our scheme, we prove it with the method of real and ideal paradigm proposed in [30]. And the following theorems are needed.  
**Theorem 1**.: _In process Section 5.2, it is computationally infeasible for every participators including users, server and Key Generation Center to get \(r_{i}\) from others and \(r\)._  
Proof.: Even the Key Generation Center is acting as a trusted third party. We could set up a Semi-Honest adversary who could get the view of server \(Server\), Key Generation Center \(KGC\) and multiply users \(User_{i}\) and \(User_{j}\) as \(\mathcal{A}_{(Server,KGC,User_{ij})}^{\mathrm{SH}}\). the view of \(\mathcal{A}_{(Server,KGC,User_{ij})}^{\mathrm{SH}}\) includes all \(np_{i}=g^{r_{i}}mod\ N^{2}\) and the \(r_{i}\) and \(r_{j}\) of \(User_{i}\) and \(User_{j}\). Based on Discrete logarithm Problem (DLP), all \(r_{k}\) chosen by \(User_{k}\) except the one from \(User_{i}\) and \(User_{j}\) are computationally infeasible except those \(r_{k}\) completely identical to \(r_{i}\) or \(r_{j}\), which can obviously be probability neglected. Therefore, the probability to gather all part of \(r\) is negligible. It indicates that \(r\) is computationally infeasible too.  
**Theorem 2**.: _In processes of Sections 5.4-5.7, it is computationally infeasible for server Server or several Users colluded with each other \(User_{i}\) and \(User_{j}\) to obtain the plaintext from another User \(User_{k}\) based on the semantically security of BCP algorithm which is proved in [28]._  
Proof.: To discuss this, we should assume two Semi-Honest adversary for server \(Server\) and users \(User_{i}\) and \(User_{j}\) as \(\mathcal{A}_{Server}^{\mathrm{SH}}\) and \(\mathcal{A}_{User_{i},User_{j}}^{\mathrm{SH}}\). Firstly, the view of \(\mathcal{A}_{Server}^{\mathrm{SH}}\) could contains \(A_{i}\) and \(c\) from all users. To get the plaintext of \(m\), the value of \(b\) is needed while it is encrypted into \(\beta\), as is shown in (15) and (16), which constitute a variant of BCP ciphertext for the \(\beta_{2}\) can be seen as \(g^{(s_{t}-s_{hi})\cdot r}\cdot E_{2}(b)\) in which \(E_{2}(b)\) presents the second part of a BCP ciphertext corresponding to plaintext of \(b\) under the secret key of \(s_{KGC}\). For \(\mathcal{A}_{Server}^{\mathrm{SH}}\), \(s_{KGC}\) is obviously unfeasible so that \(\beta\) is computationally undecryptble based on the semantically secure of BCP. Even \(g^{(s_{t}-s_{hi})}\) is removed in following steps, the structure of \(E_{2}(b)\) is still kept.  
Secondly, the map from \(E_{2}(b)\) to corresponding action is given by Key Generation Center \(KGC\) to all user such as \(User_{a}\) so that it can infer the actual means of the returned result from server \(Server\) after decryption by the secret key \(s_{ta}\) chosen by itself. But the \(g^{(s_{t}-s_{hi})}\) removed version of encrypted data from other user such as \(User_{k}\) is not included in the view of \(\mathcal{A}_{User_{i},User_{j}}^{\mathrm{SH}}\). That is to say, \(g^{(s_{t}-s_{hi})}\) is needed to investigate the plaintext of uploaded by \(User_{k}\), which needed \(s_{tk}\) or \(A_{k}\). However, as is designed by proposed scheme, \(s_{tk}\) is not sent out and \(A_{k}\) is sent in secret channel as authorization credentials, which is all unfeasible for \(\mathcal{A}_{User_{i},User_{j}}^{\mathrm{SH}}\).