## 3 Construction
### Implementation
**Step 2**: First, PA carries out a comparison: \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]2 If they are equal, \(PA\) enter the \(t_{id}\) extraction process using \(n\), \(\lambda\), defines \(L(x)=(x-1)/n\), calculates \(\mu=(L(g^{\lambda}\ mod\ n^{2}))^{-1}\ mod\ n\), then by \(L(T^{\prime\lambda}\ mod\ n^{2})\times\mu\ mod\ n\) to extract the \(Do^{\prime}s\ t_{id}\). **Step 3**: \(PA\) is needed to verify whether the given equation is valid or false. \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]3

Assuming the equation is satisfied, we can conclude that the data belong to the user \(Do\). Let us take the unique identifier \"\(address\)\" during encryption as an example: the decryption Algorithm 3 and the decrypted \(t_{id}\) are as follows:
```
1:\(\lambda\leftarrow(p-1)*(q-1)\);
2:\(\mu\leftarrow\ Get\ \mu\) according to the formula \((L(g_{1}^{\lambda}\ mod\ n^{2}))^{-1}\ mod\ n\);
3:\(t_{id}\leftarrow\ Obtain\ the\ t_{id}\) in the ciphertext according to the decryption algorithm \(L(T^{\prime\lambda}\ mod\ n^{2})\)\(\times\mu\ mod\ n\);
4:\(\mathcal{U}_{id}^{\prime}\)=79847630022358710946125273965671104052858 065717629025639108307113838327353
```

**Algorithm 3** Decrypt \(t_{id}\)If the data are generated by multiple users, then \(t_{id_{1}}+t_{id_{2}}\equiv L(g^{\lambda(t_{id_{1}}+t_{id_{2}})}\cdot(r_{1}\cdot r _{2})^{\lambda n})\cdot\mu\ mod\ n\), \(PA\) verifies \(H(identity_{1})\rightarrow\mathbb{Z}_{N}+H(identity_{2})\rightarrow\mathbb{Z}_{N} \stackrel{{?}}{{=}}t_{id_{1}}+t_{id_{2}}\). During the entire audit phase, \(PA\) needs to do two things:

1. Compare whether the leaked plaintext is the same as that owned by \(Do\) and calculate whether the ciphertext is generated by \(Do\) through the formula \(C_{0}\stackrel{{? }}{{=}}M\cdot e(g^{\alpha\beta},C_{1})\);
2. Obtain the user credential \(T\) corresponding to the plaintext in the \(AT\)'s database and obtain the owner of the plaintext through Paillier decryption.