The security proof for Key Policy Attribute Based Encryption My question relates to the original KP-ABE paper: 

http://research.microsoft.com/en-us/um/people/vipul/abe.pdf

I'm having trouble understanding the proof (pages 10–13) that the scheme is secure in the Selective Set Model:


  Proof: Suppose there exists a polynomial-time adversary A, that can attack our scheme
  in the Selective-Set model with advantage $\epsilon$. We build a simulator B that can play the Decisional BDH game with advantage $\epsilon/2$. The simulation proceeds as follows:
  
  We first let the challenger set the groups G1 and G2 with an efficient bilinear map, e
  and generator g. The challenger fips a fair binary coin $\mu$, outside of B's view. If $\mu = 0$, the challenger sets $(A, B, C, Z) = (g^a,g^b,g^c,e(g,g)^{abc})$, otherwise it sets $(A, B, C, Z) =(g^a, g^b, g^c, e(g,g)^z)$ for random $a, b, c, z$. We assume the universe, U is defined.
  
  ...
  
  Phase 1 A adaptively makes requests for the keys corresponding to any access structures T such that the challenge set $\gamma$ does not satisfy T . Suppose A makes a request for the secret key for an access structure T where $T(\gamma) = 0$. To generate the secret key, B needs to assign a polynomial $Q_x$ of degree $d_x$ for every node in the access tree T .
  
  We first define the following two procedures: PolySat and PolyUnsat.
  
  PolySat$(T_x,\gamma,{\lambda_x})$ : ....
  
  PolyUnsat$(T_x,\gamma, g^{\lambda_x})$: This procedure sets up the polynomials for the nodes of an access tree with unsatisfied root node, that is, $T_x(\gamma) = 0$. The procedure takes an access tree $T_x$ (with root node x) as input along with a set of attributes $\gamma$ and an element $g^{\lambda_x} \in G1$ (where $\lambda_x \in Z_p$).
  It first defines a polynomial $q_x$ of degree $d_x$ for the root node $x$ such that $q_x(0) = \lambda_x$. Because $T_x(\gamma) = 0$, no more than $d_x$ children of $x$ are satisfied. Let $h_x \leq d_x$ be the number of satisfied children of $x$. For each satisfied child $x'$ of $x$, the procedure chooses a random point $\lambda_{x'} \in Z_p$ and sets $q_x(index(x')) = \lambda_{x'}$. It then fixes the remaining $d_x - h_x$ points of $q_x$ randomly to completely define $q_x$.
  
  ...
  
  To give keys for access structure $T$, simulator first run PolyUnsat$(T,\gamma,A)$ to define a polynomial $q_x$ for each node $x$ of $T$. 
  
  ...


My question is relating to the last (bold) paragraph: How is it possible to define such $q_x$, since the simulator cannot learn $\lambda_{x}$ from $g^{\lambda_x}$ unless he can compute discrete log?
Because the simulator picked   $\gamma$ to generate $g^\gamma$.  He acts as an ABE authority for an attacker who breaks the Selective Set Model security game so he can use the attacker to solve the   Decisional Bilinear Diffie-Hellman problem .

As a result of being  the ABE authority, the simulator  knows  the master secrets and all other secrets created by the ABE authority. Remember, that for normal ABE, the authority knows everything, including user's private keys (attributes).


  Proof: Suppose there exists a polynomial-time adversary A, that can attack our scheme
  in the Selective-Set model with advantage $\epsilon$. We build a simulator B that can play the Decisional BDH game with advantage $\frac{\epsilon}{2}$. The simulation proceeds as follows:
  
  We first let the challenger set the groups G1 and G2 with an efcient bilinear map, e
  and generator g. The challenger flips a fair binary coin $\mu$, outside of B's view. If $\mu$ = 0,
  the challenger sets $(A; B; C; Z) = (g^a, g^b, g^c, e(g, g)^{abc} )$ otherwise it sets 
  $(A; B, C,Z) =
(g^a, g^b,g^c, e(g, g)^z)$
   for random $a, b, c, z$. We assume the universe, $U$ is defined.


The simulator, then, gets to set up an ABE system so he can use the attacker


  The simulator B runs A. A chooses the set of attributes $\gamma$ it wishes to be challenged upon


$\gamma$ has nothing to do with the DBLDH assumption.