## 5 The Proposed Scheme
### The Designed Fast Searchable Decryption Algorithm
This ensures that \(\mathcal{C}\) has control over one of the entries while maintaining the integrity of the challenge. Next, \(\mathcal{C}\) constructs the keyword index \(I_{w}^{*}=(I_{0}^{*},I_{1,w_{j}}^{*})\) in the following two steps: (1) \(\mathcal{C}\) randomly selects a value \(t_{2}\in\mathbb{Z}p^{*}\) and computes \(I_{0}^{*}=(u_{3})^{1/t_{2}}\), ensuring the implicit condition (\(\xi=d/t_{2}\)) holds, where \(d\) remains unknown to the challenger. (2) \(\mathcal{C}\) then randomly chooses a value \(Z\in\{0,1\}^{\log_{p}}\) and assigns it to \(I_{1,w_{j}}^{*}=Z\). Thus, \(\mathcal{C}\) ensures that the generated index \(I_{w}^{*}\) is a valid index for the challenge keyword \(w_{q}\), satisfying the necessary conditions for the cryptographic protocol. * _Query Phase 2:_ After obtaining the challenge index \(I_{w}^{*}\), \(\mathcal{A}\) can perform polynomial additional queries, which are processed identically to the initial ones. * _Guess:_ At the conclusion of the second query phase, \(\mathcal{A}\) outputs a guess, denoted by \(q^{\prime}\) for the bit \(q\). It is important to observe that in the query \(H_{2}\), the value of \(h_{i}=u_{2}^{\varepsilon_{i}}\) is determined with a probability of \((\frac{1}{q_{T}}+1)\). Similarly, in the query \(H_{3}\), \(\mathcal{A}\) determines the value with the same probability \((\frac{1}{q_{T}}+1)\). The process can be represented as follows: \[e\big{(}g^{\beta\xi},H_{2}(w_{q})\big{)} =e\big{(}(g^{\alpha t_{1}})^{d/t_{2}},g^{\log_{q}}\big{)}\] (23) \[=e(g,g)^{abd(\varepsilon_{1}t_{1}/t_{2})}.\] Next, \(\mathcal{C}\) randomly picks a pair \((t_{i},V_{i})\) from the \(H_{3}\) list. It then calculates \(t^{\varepsilon_{q}t_{1}/t_{2}}\) as its guess for the value \(e(g,g)^{abd}\). _Probability Analysis_: If the adversary \(\mathcal{A}\) has a noticeable advantage in winning the experiment \(\mathrm{Exp}_{\mathcal{A}}^{\mathrm{CKA}}(1^{\lambda})\), then the challenger can solve the BDH problem with a probability of at least \((2\varepsilon/eq_{T}q_{H_{3}})\). Based on the BDH assumption outlined in Section 3, the probability \((2\varepsilon/eq_{T}q_{H_{3}})\) is considered negligible, leading to the following conclusion:

If the adversary \(\mathcal{A}\) has a non-negligible advantage in the experiment \(\mathrm{Exp}_{\mathcal{A}}^{\mathrm{CKA}}(1^{\lambda})\), then the challenger \(\mathcal{C}\) would be able to solve the BDH problem with a probability of at least \((2\varepsilon/eq_{T}q_{H_{3}})\). Given the BDH assumption, the probability \((2\varepsilon/eq_{T}q_{H_{3}})\) is considered negligible. This leads to the following conclusion:

\[Pr[\mathrm{Exp}_{\mathcal{A}}^{\mathrm{CKA}}(1^{\lambda})]=Pr[\mathrm{Exp}_{ \mathcal{C}}^{\mathrm{BDH}}(1^{\lambda})]=\frac{2\varepsilon}{eq_{T}q_{H_{3}} }\approx\varepsilon. \tag{24}\]

Thus, assuming the BDH assumption is valid, we conclude that the security of our scheme holds against CKAs. ## 7 Performance Evaluation

Based on both a theoretical analysis and the experimental tests, this section conducts an evaluation of ABE-RS. ### Theoretical Analysis

In Table 2, we compare our scheme with others [26; 30; 31] in terms of _public key size_, _secret key size_, _ciphertext size_, and _trapdoor size_. The main storage overhead of the data owner comes from the public key, and the storage overhead of the data user comes from the secret key. Our public key is smaller than those in [26; 30]. The size of our secret key is comparable to that in [30], which is linear in \(log_{V_{\mathcal{U}}}\). Regarding ciphertext size, our scheme incurs additional storage costs of \((V_{\mathcal{M}}+2+\iota)|\mathbb{G}|+\iota|\log_{P}|\) due to keyword encryption. This, however, facilitates more efficient search and decryption processes. In reference [31], the size of the trapdoor pertains to multiple keywords associated with a single user. In contrast, our scheme defines the size of the trapdoor in terms of a single keyword associated with multiple users.