## 5 Analysis of the Scheme  
### Analysis of Correctness  
Assuming that a data user has the attributes \(\mathbf{u}\in\mathbb{U}\) and the LSSS access control policy \((\mathbf{M},\rho)\) for which \(\mathbf{U}\) constitute an authorized set. By construction,  
\[K=\sum\limits_{i\in\mathbf{I}}\omega_{i}\Big{(}\mathbf{c}_{i}\mathbf{k}_{\rho(i)}^{\top}+ \mathbf{\hat{c}}_{i}\mathbf{t}^{\top}\Big{)} \tag{19}\]  
Expanding \(\{\mathbf{c}_{i}\}_{i\in\mathbf{I}}\) and \(\{\mathbf{\hat{c}}_{i}\}_{i\in\mathbf{I}}\) we get  
\[K =\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{A}_{\rho(i)}\mathbf{k}_{ \rho(i)}^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}\] \[\quad+\sum\limits_{i\in\mathbf{I},j\in\{2,\cdots,s_{\max}\}}\omega_{i }M_{i,j}\mathbf{v}_{j}\mathbf{t}^{\top}-\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{ H}_{\rho(i)}\mathbf{t}^{\top} \tag{20}\] \[\quad+\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{\hat{c}}_{i}\mathbf{t}^{\top}\]  
For each \(u\in\mathbf{U}\), we run **EnSamplePre** algorithm, and then \(\mathbf{A}_{u}\mathbf{\hat{k}}_{u}^{\top}=\mathbf{H}_{u}\mathbf{t}^{\top}-\mathbf{A}_{u}\mathbf{\hat{k }}_{u}^{\top}\). Therefore, for each \(i\in\mathbf{I}\), it holds that \(\mathbf{A}_{\rho(i)}\mathbf{k}_{\rho(i)}^{\top}=\mathbf{A}_{\rho(i)}\mathbf{\hat{k}}_{\rho(i) }^{\top}+\mathbf{A}_{\rho(i)}\mathbf{\hat{k}}_{\rho(i)}^{\top}=\mathbf{H}_{\rho(i)}\mathbf{t} ^{\top}\), Hence,  
\[K =\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{H}_{\rho(i)}\mathbf{t}^{ \top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}\] \[\quad+\sum\limits_{i\in\mathbf{I},j\in\{2,\cdots,s_{\max}\}}\omega_{i }M_{i,j}\mathbf{v}_{j}\mathbf{t}^{\top}-\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{H}_ {\rho(i)}\mathbf{t}^{\top}\] \[\quad+\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{e}_{i}\mathbf{k}_{\rho(i) }^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{\hat{e}}_{i}\mathbf{t}^{\top}\] \[\quad=\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{ \top},0,\cdots,0\big{)}\mathbf{t}^{\top}\] \[\quad+\sum\limits_{i\in\mathbf{I},j\in\{2,\cdots,s_{\max}\}}\omega_{i }M_{i,j}\mathbf{v}_{j}\mathbf{t}^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{e}_{i} \mathbf{k}_{\rho(i)}^{\top} \tag{21}\] \[\quad+\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{\hat{e}}_{i}\mathbf{t}^{\top}\] \[K =\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{A}_{\rho(i)}\mathbf{k}_{ \rho(i)}^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}\]0 \[K =\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{A}_{\rho(i)}\mathbf{k}_{ \rho(i)}^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}\]1 \[K =\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{A}_{\rho(i)}\mathbf{k}_{ \rho(i)}^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}\]2When \(\sum_{i\in I}\omega_{i}M_{i,j}=1\) for \(1<j\leq s_{\max}\), it holds that \(\sum_{i\in I}\omega_{i}M_{i,j}=0\). Also, \(\mathbf{t}=(1,\mathbf{\hat{t}})\) is constructed using **KeyGen** in Section 3.1, and hence \(\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}=\mathbf{sy}^{\top}\). Thus,  
\[K =\sum\limits_{i\in\mathbf{I}}\omega_{i}\mathbf{s}\mathbf{A}_{\rho(i)}\mathbf{k}_{ \rho(i)}^{\top}+\sum\limits_{i\in\mathbf{I}}\omega_{i}M_{i,1}\big{(}\mathbf{sy}^{\top},0,\cdots,0\big{)}\mathbf{t}^{\top}\]3  
As for the noise part \(\sum_{i\in I}\omega_{i}\mathbf{e}_{i}\mathbf{k}_{\rho(i)}^{\top}+\sum_{i\in I}\omega_{i} \mathbf{\hat{e}}_{i}\mathbf{t}^{\top}\), the following inequalities hold except with negligible probability. (1) According to Lemma 2, the positive integer \(m\) coordinates in \(\mathbf{e}_{i}\) are from truncated discrete Gaussians distribution \(\widehat{D}_{\mathbb{Z},\sigma}\), so there is \(\|\mathbf{e}_{i}\|\leq\sqrt{m}\sigma\).