## 3 Construction
### Implementation  
1. **Setup**\((1^{\theta},U)\to PK\), \(MSK\), \(Pk_{AT}\), \(Sk_{AT}\): In the setup phase of our system, we provide the security parameter \(\varphi\) and the user attribute universe \(U\) as inputs to the setup algorithm. This algorithm then generates a group \(G\) of order \(N=p_{1}p_{2}p_{3}\), a mapping \(e\), an integer group \(\mathbb{Z}_{N}\), and a hash function \(H:H(x)\rightarrow\mathbb{Z}_{N}\). This setup process establishes the necessary parameters and functions to enable secure and efficient cryptographic operations in our system. The resulting setup allows us to implement our system in a manner that satisfies our security and performance requirements. Then the system proceeds to select random parameters \(\alpha,a\in\mathbb{Z}_{N}\), and the generator \(g\in G_{p_{1}}\). For each attribute \(s\in U\), the system randomly selects a corresponding value \(u_{i}\in\mathbb{Z}_{N}\). The system global parameter is set as \[PK=(N,G,\mathbb{Z}_{N},H(x),g,g^{a},e(g,g)^{a},\{U=g^{u_{i}}\}_{\forall i\in U})\] \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\] After mapping the data owner's unique identifier to an integer in \(\mathbb{Z}_{N}\), \(Do\) chooses a value \(r\xleftarrow{R}\mathbb{Z}_{n^{2}}^{*}\) and employs Paillier encryption to generate the encrypted output \(T=g_{1}^{i_{lat}}r^{n}\)\(mod\)\(n^{2}\). The Algorithm 1 is as follows (here we assume the unique identifier string is \"_address_\"): ```
**Algorithm 1** Encrypt \(t_{id}\)
```
1:\(\mathit{addrHash}\leftarrow\) Convert \"_address_\" to a byte array after hashing;
2:\(t_{id}\leftarrow\) Map addrHash into \(\mathbb{Z}_{N}\);
3:\(r\leftarrow\) Randomly pick an element from \(\mathbb{Z}_{N}\);
4:\(T\leftarrow\) Use Paillier encryption to obtain encrypted identity information;
5:Output:
6:\(t_{id}\)=79847630022358710946125273965671104052858 065717629025639108307113838327353 ```
**Step 2**: To encode the access structure for the data, the owner of the data, \(Do\), creates a shared generator matrix \(A\) with dimensions \(l\) by \(n\) using the LSSS. First, a secret number \(s\xleftarrow{R}\mathbb{Z}_{n}\) is randomly selected. Then, \(n-1\) random numbers \(y_{2},\ldots,y_{n}\xleftarrow{R}\mathbb{Z}_{n}\) are selected to generate a vector \(\mathbf{y}=(s,y_{2},\ldots,y_{n})\). Finally, random numbers \(r_{i}\xleftarrow{R}\mathbb{Z}_{N}\) are chosen for each row \(A_{i\in[l]}\) of matrix \(A([l]\) that represents the entire set of \(\{1,2,\ldots,l\})\), \(H(M)\) is obtained by taking a hash of the plaintext \(M\) and mapping it to \(G_{T}\) to generate ciphertext: \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]
```  
**Algorithm 2** Encrypt \(t_{id}\)  
```
1:\(\mathit{addrHash}\leftarrow\) Convert \"_address_\" to a byte array after hashing;
2:\(t_{id}\leftarrow\



**Step 3**: Both \(\widehat{C_{0}}\), \(g^{s}\) and \(T\) are sent to the authority \(AT\) for decryption.