## 6 Security Analysis
### Secure Data Access
The goal of the attack tree analysis is to exhaustively list all possible sets of necessary attack steps (i.e., concurrently compromised security components) to succeed in the attack. For this tree, the set of identified attack components (nodes) is:  
\(\mathbb{C}=\{A,B,\underline{C},\underline{D},E,F,\underline{G},\underline{H}, I,\underline{I},\underline{K},\underline{L}\}\), with seven leaf nodes (for clarity, the leaf nodes are underlined). Leaf nodes are vulnerable components that an attacker can exploit to initiate an attack. Any attack suite must contain such nodes, as well as the target node \(T\). We examine the attack suites of the unauthorized data access attack tree of the HMBAC, with respect to the successful attack steps required by an adversary. We consider the following cases:  
**Case 1. **_Fully compromised user:_ all user credentials (BC credentials or PBC access (\(C\) or \(D\)), user-side Vault credentials (\(G\) or \(H\)) and attribute certificates (\(K\))) are compromised. We get the attacks: \(\{\underline{C},A\}\), \(\{\underline{D},A\}\), \(\{\underline{G},E,B\}\), \(\{\underline{H},E,B\}\) and \(\{\underline{K},I,F,B\}\), that when combined give us the attack suites:  
\(S_{1 cgk} = \{\underline{C},A,\underline{G},E,\underline{K},I,F,B,T\}\),  
\(S_{1 dgk} = \{\underline{D},A,\underline{G},E,\underline{K},I,F,B,T\}\),  
\(S_{1 chk} = \{\underline{C},A,\underline{H},E,\underline{K},I,F,B,T\}\),  
\(S_{1 dhk} = \{\underline{D},A,\underline{H},E,\underline{K},I,F,B,T\}\). The attacker will then be able to post to the system all queries available to the target user. However, this attack does not leak data from other users. **Case 2. **_Partially compromised user:_ at least one of the required user credentials \(C,D,G,H\) and \(K\) is secure. In this case, from the attacks: \(\{\underline{C},A,\underline{G},E\}\), \(\{\underline{D},A,\underline{G},E\}\), \(\{\underline{C},A,\underline{H},E\}\), \(\{\underline{D},A,\underline{H},E\}\), and \(\{\underline{K},I,F\}\), \(\{\underline{L},I,F\}\), \(\{\underline{L},I,F\}\), \(\{\underline{L},F\}\), we obtain the attack suites:  
\(S_{2 cgk} = \{\underline{C},A,\underline{G},E,\underline{K},I,F,B,T\}\),  
\(S_{2 cgj} = \{\underline{C},A,\underline{G},E,\underline{L},I,F,B,T\}\),  
\(S_{2 cgk} = \{\underline{D},A,\underline{G},E,\underline{K},I,F,B,T\}\),  
\(S_{2 dgl} = \{\underline{D},A,\underline{G},E,\underline{L},I,F,B,T\}\),  
Again, these attacks only affect the data of the compromised users. **Case 3. **_Fully compromised PBC (D) and DBC (L)._ Here, unauthorized queries are posted due to a compromised Proxy BC (bypassing the TMSC), while access to the BC-side keys assumes a compromised domain BC (bypassing the ACSC control and utilizing the BC-side attribute keys via the KSSC). However, a successful attack suite requires additionally access to the user attribute keys, either by compromising the user-side Vault (\(H\)) or by getting the user credentials (\(G\)). We obtain the attack suites:  
\[S_{3 dhl} = \{\underline{D},A,\underline{H},E,\underline{L},I,F,B,T\},\] \[S_{3 dgl} = \{\underline{D},A,\underline{G},E,\underline{L},I,F,B,T\}.\]  
**Case 4. **_Fully compromised Vault._ Here both the user- side and BC-side Vaults (\(H\) and \(J\)) are compromised. Again, a successful attack requires additionally a partially compromised user (\(C\)) or Proxy BC (\(D\)). We obtain the attack suites:  
\[S_{4 chj} = \{\underline{C},A,\underline{H},E,\underline{I},F,B,T\},\] \[S_{4 dhj} = \{\underline{D},A,\underline{H},E,\underline{I},F,B,T\}.\]  
**Case 5. **_All entities partially compromised._ Here the user credentials/certificates (\(C,K\)), blockchains (\(D,L\)) and vault storage (\(G,H,J\)) are all partially compromised. We get the attack suites:  
\[S_{5 dhl} = \{\underline{C},A,\underline{H},E,\underline{L},I,F,B,T\},\] \[S_{5 dgj} = \{\underline{D},A,\underline{G},E,\underline{I},F,B,T\},\] \[S_{5 dhk} = \{\underline{D},A,\underline{H},E,\underline{K},I,F,B,T\}.\]  
We now have:  
**Proposition 1**.