## 4 CLAP-PRE Scheme
### Construction  
Let \(PairGen(1^{\lambda})\) be an algorithm that, on input of a security parameter \(1^{\lambda}\), outputs a tuple \(\gamma=(q,G_{1},G_{2},G_{3},G_{4},e_{ij})\), where \(G_{1},G_{2},G_{3}\) and \(G_{4}\) are the cyclic group with the same prime order \(q\) and \(\{e_{ij}:G_{i}\times G_{j}\to G_{i+j},|i,j\geq 1\wedge i+j\leq 4\}\) are efficient non-degenerate multilinear maps such that for all \(a,b\in Z_{q},e(g_{i}^{a},g_{j}^{b})=e(g_{i},g_{j})^{ab}\). * \(Setup(1^{\lambda})\rightarrow(par,msk)\): The algorithm runs the group generator algorithm \(PairGen(1^{\lambda})\) and gets the groups and the multilinear mapping description \(\gamma=(q,G_{1},G_{2},G_{3},G_{4},e_{ij})\), \(G_{i}=<g_{i}>\). The system's parameters are generated as follows. We choose a master secret key \(\alpha\in Z_{q}\) randomly, set \(A=g_{2}^{\alpha}\in G_{2}\) and choose random elements \(u_{1}\) in \(G_{1}\), \(B\) in \(G_{2}\). Let \(H_{1}:\{0,1\}^{*}\to G_{1}\), \(H_{2}:\{0,1\}^{*}\to G_{2}\), \(H_{3}:G_{2}\to Z_{q}^{*}\), \(H_{4}:\{0,1\}^{*}\to Z_{q}^{*}\) be four collision-resistant hash functions. Thus, we can get the public parameters \(par=(q,G_{1},G_{2},G_{3},G_{4},e_{ij},u_{1},A,B,H_{1},H_{2},H_{3},H_{4})\) and the master secret key \(msk=\alpha\), which is kept secretly by the key generation center (KGC);
* \(PPKE(par,msk,ID_{i})\to d_{ID_{i}}\): Upon input of the public parameters \(par\) of the cryptosystem, the system's master secret key \(msk\) and a user's identity \(ID_{i}\); the key generation center (KGC) computes the partial private key as follows. First, the KGC chooses a random value \(r\in Z_{q}\). Then KGC computes \(g_{2}^{\alpha}\), \(B^{\alpha}e(u_{1},H_{1}(ID_{i}))^{r}\) and \(H_{2}(ID_{i})^{\alpha}\). The partial private key of the user \(i\) with identity \(ID_{i}\) is formed as: \[d_{ID_{i}}=\{B^{\alpha}e(u_{1},H_{1}(ID_{i}))^{r},g_{2}^{r},H_{2}(ID_{i})^{ \alpha}\};\]
* \(UKG(par,d_{ID_{i}})\rightarrow(PK_{ID_{i}},SK_{ID_{i}})\): Upon input of the public parameters \(par\) of the cryptosystem and the partial private key \(d_{ID_{i}}\) generated by KGC, the user computes \(PK_{ID_{i}}\) and \(SK_{ID_{i}}\) as follows. First, the user randomly chooses a secret value \(x\in Z_{q}^{*}\) and sets \(PK_{ID_{i}}=\{ID_{i},X=g_{2}^{x},Y=B^{x}\}\); \(SK_{ID_{i}}=\{SK_{ID_{i}0},SK_{ID_{i}1},SK_{ID_{i}2},SK_{ID_{i}3}\}=\{B^{ \alpha}e(u_{1},H_{1}(ID_{i}))^{r},g_{2}^{r},H_{2}(ID_{i})^{\frac{\alpha}{H_{2} (3)}(x)},x\}\). * \(Proof(par,SK_{ID_{i}})\to proof\): Upon input of the public parameters \(par\) of the cryptosystem and the private key \(SK_{ID_{i}}\), the user \(i\) randomly chooses a message \(p\) and a value \(s\). The \(proof\) is computed as follows: \[U=H_{2}(ID_{i})^{s},V=(SK_{ID_{i}2})^{sH_{4}(p,U)},\] \[proof=\{p,PK_{ID_{i}},U,V\};\]
* \(Verify(par,proof)\rightarrow\{0,1\}\): Upon input of the public parameters \(par\) of the cryptosystem and the \(proof\), the algorithm outputs \(1\) if and only if: \[e(V,X^{H_{3}(X)})==e(U^{H_{4}(p,U)},A),\] and \[e(X,B)==e(g_{2},Y);\]
* \(CreatePath(par,ID_{i})\rightarrow(Pa_{ID_{i}},I_{ID_{i}})\): Upon input of the public parameters \(par\) of the cryptosystem and the identity \(ID_{i}\) of the delegator, it outputs an autonomous delegation path \(Pa_{ID_{i}}\) of length \(l_{ID_{i}}\). The autonomous delegation path \(Pa_{ID_{i}}=\{ID_{0}=ID_{i},ID_{1},\ldots,ID_{l_{ID_{i}}}\}\) designated by the delegator is a sequence of ordered \(l_{ID_{i}}\) different public keys.