# A Security-Enhanced Query Result Verification Scheme for Outsourced Data in Location-Based Services
## 3 Background
### Threat Model  
Our threat model is mostly consistent with work in [9]. The LBSP and the blockchain are assumed to be honest; that is, they honestly behave similar to the scheme designed. To some extent, they can be regarded as reliable entities without leaking any privacy of users or colluding with the fog side. The fog side is assumed to be dishonest and curious; that is, they may maliciously discard or tamper with outsourced data to obtain improper benefits while attempting to analyze not only the users' queries themselves and their frequencies but also the outsourced encrypted data. The two threat models are described as follows:  
Given two fog node verification objects \(VO_{g}\), \(VO_{g^{{}^{\prime}}}\) of two different fog node identifiers \(g,g^{{}^{\prime}}\), the attackers cannot tell the difference between the above two verification objects. The semantic security (i.e., fog node verification object indistinguishability security) of the fog node verification object is defined by a game between probabilistic polynomial-time adversary \(\mathcal{A}\) and challenger \(\mathcal{B}\). \((\widetilde{Game}1)\)  
1. Setup. 2. Phase 1. \(\mathcal{A}\) asks \(\mathcal{B}\) to return the fog node verification objects after submitting different fog node identifiers many times. 3. Challenge. \(\mathcal{A}\) sends two challenge fog node identifiers \(g_{1},g_{2}\) to \(\mathcal{B}\), which have not been sent in Phase 1. \(\mathcal{A}\) asks \(\mathcal{B}\) for the challenge fog node verification object. After receiving two challenge fog node identifiers \(g_{1},g_{2}\), \(\mathcal{B}\) fairly chooses a bit \(b\in\{1,2\}\) and returns the challenge fog node verification object \(VO_{g_{b}}\) of \(g_{b}\) to \(\mathcal{A}\). 4. Phase 2. \(\mathcal{A}\) continues to ask \(\mathcal{B}\) to return the fog node verification objects after submitting different fog node identifiers many times. The only restriction is that the fog node identifiers are different from the identifiers sent in Phase 1 and Challenge. 5. Guess. The adversary \(\mathcal{A}\) outputs a guess \(b^{{}^{\prime}}\) of \(b\). If \(b=b^{{}^{\prime}}\), \(\mathcal{A}\) wins the game. As the space of \(b\) is only two, \(\mathcal{A}\) can choose the correct number with the probability of 50% if taking a random guess. Figure 2: System model. **Definition 1**. : _The advantage of the probabilistic polynomial-time adversary \(\mathcal{A}\) wins (\(\widehat{\text{Game}1}\)) is_  
\[Adv_{\mathcal{A}}=\mid Pr[b=b^{{}^{\prime}}]-\frac{1}{2}\mid. \tag{3}\]  
_If \(Adv_{\mathcal{A}}\) is negligible in the game, the fog node verification object is semantically secure and achieves indistinguishability._  
Given two description file verification objects \(VO_{w},VO_{w^{{}^{\prime}}}\) of set \(c(ds)_{w},c(ds)_{w^{{}^{\prime}}}\) for two different keywords \(w,w^{{}^{\prime}}\), the attackers cannot tell the difference between the above two verification objects. The semantic security (i.e., the description file verification object achieving indistinguishability) of the description file verification object is defined by a game between probabilistic polynomial-time adversary \(\mathcal{A}\) and challenger \(\mathcal{B}\). (\(\widehat{\text{Game}2}\))  
1. Setup. 2. Phase 1. \(\mathcal{A}\) asks \(\mathcal{B}\) to return the corresponding description file verification objects after submitting different keywords many times. 3. Challenge. \(\mathcal{A}\) sends two challenge keywords \(w_{1},w_{2}\) to \(\mathcal{B}\), which have not been sent in Phase 1. \(\mathcal{A}\) asks \(\mathcal{B}\) for the challenge description file verification objects. After receiving two challenge keywords, \(w_{1},w_{2}\), \(\mathcal{B}\) fairly chooses a bit \(b\in\{1,2\}\) and returns the challenge description file verification object \(VO_{w_{b}}\) of \(w_{b}\) to \(\mathcal{A}\). 4. Phase 2. \(\mathcal{A}\) continues to ask \(\mathcal{B}\) to return the corresponding location data file verification objects after submitting different keywords many times.