## 5 Specific Construction of LR-SP-IBBE
It randomly selected \(s,r\in Z_{N}\) and \(Z,Z^{\prime}\in G_{p_{2}}\). Then, it calculated the \(CT=(CM,Hd)=(CM,C_{1},C_{2},C_{3})\)  
\[\text{ciphertext}=(M\oplus Ext(e(g_{1},g_{1})^{as},r),(h_{1}\prod\limits_{j=1 }^{d}u_{j}^{ID_{j}})^{s}Z,g_{1}^{s}Z^{\prime},r)\enspace.\]The symmetric encryption key was \(e(g_{1},g_{1})^{as}\). \(CT\) was sent to the receivers. **Decryption1. ** If one receiver \(ID_{i}\) belongs to \(S\), it split \(CT\) into two parts \((CM,Hd)\). This receiver ran the decryption algorithm \(\mathbf{D}1(PP,SK_{ID_{i},k,1},S,CT)\to CT^{\prime}\). This receiver calculated the part of the plaintext \(CT^{\prime}\) using \(Hd\). First, the receiver used \(SK_{ID_{i},k,1}\) to compute \(CT^{\prime}=(CM,C_{1},C_{2},C_{3},C^{\prime},C^{\prime},C^{\prime},C_{2})\), where  
\(C^{\prime}_{1}=e(SK^{1}_{ID_{i},k,1},C_{1})=e(g_{1}^{r_{1}}R_{1}g_{1}^{g_{i1}+ \cdots+g_{i,k}},(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{s}Z)\) and \(C^{\prime}_{2}=e(SK^{2}_{ID_{i},k,1},C_{2})=e(g_{1}^{a}(h_{1}\prod\limits_{j=1} ^{d}u_{j}^{ID_{j}})^{r_{1}}Q_{1}g_{1}^{\gamma_{i1}+\cdots+\gamma_{i,k}},g_{1}^{ s}Z^{\prime})\). **Decryption2. **\(\mathbf{D}2(PP,SK_{ID_{i},k,2},S,CT^{\prime})\to M\). This receiver input \(PP\), private key \(SK_{ID_{i},k,2}\), identity sets \(S\), and ciphertexts \(CT^{\prime}\). Suppose \(ID_{i}\in S\); this receiver first calculated \(K\). The plaintext message was recovered by decrypting \(CT^{\prime}\) using \(K\). First, it used \(SK_{ID_{i},k,2}\) to compute:  
\(C^{\prime}_{1}e(SK^{1}_{ID_{i},k,2},C_{1})=e(SK^{1}_{ID_{i},k,1},C_{1})e(SK^{1 }_{ID_{i},k,2},C_{1})\)  
\(=e(g_{1}^{r_{1}}R_{1}R^{\prime}_{1}g_{1}^{g_{1}+\cdots+g_{k}}g_{1}^{-\beta_{1} -\cdots-\beta_{k}},(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{s}Z)=e(g_{1}^{ r_{j}},(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{s})\)  
\(C^{\prime}_{2}e(SK^{2}_{ID_{i},k,1},C_{2})=e(SK^{2}_{ID_{i},k,1},C_{2})2.e(SK^{ 2}_{ID_{i},k,2},C_{2})\)  
\(=e(g_{1}^{a}(h\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})r_{i}Q_{1}Q^{\prime}_{1}s_{ 1}^{\gamma_{1}+\cdots+\gamma_{k}}g_{1}^{-\gamma_{1}-\cdots-\gamma_{k}},g_{1}^{ s}Z^{\prime})=e(g_{1}^{a}(h\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})r_{i},g_{1}^{ s})\)  
\(M=C_{0}\oplus Ext(\frac{C^{\prime}_{2}e(SK^{2}_{ID_{i},k,1},C_{2})}{C_{1}e( SK^{2}_{ID_{i},k,2},C_{1})},C_{3})\)  
\(=M\oplus Ext(e(g_{1},g_{1})^{as},r)\oplus Ext(\frac{e(g_{1}^{a}(h\prod\limits_{j =1}^{d}u_{j}^{ID_{j}})^{r_{i}},g_{1}^{s})}{e(g_{1}^{s}(h_{1}\prod\limits_{j =1}^{d}u_{j}^{ID_{j}})^{r_{j}})},r)=M\)  
**Semifunctional private key generation. ** For the private keys \(SK_{ID_{i},k}\)= \((SK_{ID_{i},k,1},\)\(SK_{ID_{i},k,2})\), where \(SK_{ID_{i},k,1}\)= \((SK^{1}_{ID_{i},k,1},SK^{2}_{ID_{i},k,1})=(g_{1}^{r_{1}}R_{1}g_{1}^{\beta_{i},k},g_{1}^{a}(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})r_{i}Q_{1}g_{1}^{ \gamma_{ik}})\) and \(SK_{ID_{i},k,2}\)= \((SK^{1}_{ID_{i},k,2},SK^{2}_{ID_{i},k,2})=(R^{\prime}_{1}g_{1}^{-\beta_{i},k},Q ^{\prime}_{1}g_{1}^{-\gamma_{ik}})\), it randomly selected \(\xi_{1},\xi_{2},\xi_{1}\), \(\zeta_{2}\in Z_{N}\) and generated the semifunctional private key \(\widetilde{SK_{ID_{i},k}}=(\widetilde{SK_{ID_{i},k,1}},\widetilde{SK_{ID_{i},k,2}})\), where \(\widetilde{SK_{ID_{i},k,1}}=(g_{1}^{r_{1}}R_{1}g_{1}^{\beta_{i},k}g_{2}^{\xi_{1 }},g_{1}^{a}(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{r_{j}}Q_{1}g_{1}^{ \gamma_{ik}}g_{2}^{\xi_{2}})\) and \(\widetilde{SK_{ID_{i},k,2}}=(R^{\prime}_{1}g_{1}^{-\beta_{i},k}g_{2}^{\xi_{1 }},\)\(Q^{\prime}_{1}g_{1}^{-\gamma_{i},k}g_{2}^{\xi_{2}})\). **Semifunctional encryption. ** By revoking the normal encryption algorithm, it gained the general ciphertext \(CT=(CM,Hd)=(CM,C_{1},C_{2},C_{3})=(M\oplus Ext(e(g_{1},g_{1})^{as},r),\)\((h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{s}Z,g_{1}^{s}Z^{\prime},r)\).