## 2 Related Works
### Anonymous Broadcast Encryption  
For broadcast encryption (BE) schemes, the sender may send an encrypted message to many users. In a BE scheme, broadcasters usually encrypt messages by combining the public identity of the receiver and system parameters to reveal the identity of the receiver to the public and thus attract attention to user privacy. Most identity-based broadcast encryption schemes have no anonymity, so the attackers may obtain some information about those identities from that ciphertext. Fortunately, some anonymous broadcast encryption schemes have been constructed. [PERSON], et al. [14] provided the definition of anonymous BE (ANOBE) and two general constructions of ANOBE. Their first scheme came from a public key encryption (PKE) scheme. Their second scheme came from an IBE scheme whose security is weak. The paper [15] presented the idea of an anonymous IBBE (AIBBE) on a server and proposed a concrete scheme with random oracle by pairing. Both the encryption and decryption operations were relatively easy. However, their scheme was secure against the chosen plaintext attack. [PERSON], et al. [16] provided an effective anonymous IBBE scheme by a prime order bilinear group in which no attacker could obtain the receivers' identity from the given ciphertext. Their scheme has a fixed ciphertext size. They proved the security through the assumption of an asymmetric decision bilinear Diffie Hellman exponent (DBDHE) in the standard model. [PERSON], et al. [17] proposed a completely anonymous IBBE construction using asymmetric bilinear groups. The construction achieved adaptive security and had no random oracle. Any attacker could not obtain the receivers' identity from the given ciphertext. Each receiver was an anonymous receiver to other receivers. Only the broadcaster knew all the receivers. This scheme could achieve both semantic security and receiver anonymity. [PERSON] [18] pointed out that the construction in [PERSON], et al. [17] did not provide the security requirements of message indistinguishability for broadcast encryption. In addition, [PERSON] made some improvements to the scheme and constructed a secure and anonymous IBBE. The reference [19] proposed the first IBBE scheme that achieved both confidentiality and complete anonymity using standard assumptions. The scheme also provided two other required features. One was full collusion resistance; that is to say, even if all external recipients colluded, they could not obtain information in the plaintext. The other was statelessness; that is to say, when a user joined or left the system, other users of the system did not need to update the private key. The authors of [20] provided a novel AIBBE and proved that their scheme had security against the chosen ciphertext attacks (CCAs) using a random oracle. Based on a comparison with the other four schemes, their scheme was the most effective one. The reference [21] put forward a general AIBBE that provided confidentiality of information and anonymity of users against CCA. The lengths of the public key and private key were fixed. The decryption calculation was independent of the number of receivers. Therefore, regardless of the perspective, this construction was suitable for the information management system of a smart city. [PERSON], et al. [22] designed an updatable identity-based hash proof system (IB-HPS). They updated the private key and added some new random values to one new private key. The new private key had the same distribution as the old one. By using an updatable IB-HPS, they provided a general continual leakage-resilient IBE under a random oracle model. The reference [23] constructed a receiver-anonymous BE for ciphertext-policy attribute-based encryption (CP-ABBE) that could protect the access structure and the description ofthe broadcast set related to the ciphertext. The scheme realized complete security and a constant size of the ciphertext. [PERSON], et al. [24] presented a new anonymous IBBE scheme using asymmetric bilinear pairing.