## 4 Proposed Scheme
### Details of the Proposed Scheme  
**Phase 1: System Setup**  
The public parameter (\(P_{t}\)) of the system is generated by the trust server. To initialize the system, it selects the security parameter (Y) as follows:  
* A bilinear pairing mapping and an additive group (\(\mathcal{G}\)) are chosen so that \(\hat{e}:\mathcal{G}\times\mathcal{G}\rightarrow\mathbb{G}\). A multiplicative group is represented by \(\mathbb{G}\). Keep in mind that the order number (\(q\)) is the same for \((\mathcal{G},\mathbb{G})\). * A point generator (\(P\in\mathcal{G}\)) and the number (\(n\)) of secret keys (\(s\in Z_{q}^{*}\)) are selected to compute \(\lambda_{j}=s^{j}P\) for \(j\in[1,n]\), where \(n\) is the maximum limit of stored files. * Two homomorphic hash algorithms (\(\hbar_{1}:\{0,1\}\to Z_{q}^{*}\) and \(\hbar_{2}=\mathbb{G}\to Z_{q_{2}}^{*}\)) and a collision-resistant hash algorithm (\(H:\mathbb{G}\to Z_{q}^{*}\)) are selected. * \(n\) keywords are generated (\(K=\{k_{i}\in[i,n]\}\)). The trust server publishes \(P_{t}=\{q,\mathcal{G},\mathbb{G},\hat{e},P,\{\lambda_{j}\}_{i\in[1,n]},\hbar_{ 1},\hbar_{2},H,K\}\). Registration  
Each system's entity is in charge of generating its public and private keys, as described below. * **Data generators \((dg)\) registration. ** Each \(dg_{i}\) generates its key pair, where \(Y_{i}=\{y_{i}^{j}P\}_{j\in[1,n]}\) is a public key and \(y_{i}\in Z_{q}^{*}\) is a private key. * **Data requester \(dr\) registration. ** Each \(dr\) generates its key pair, where \(X=xP\) is a public key and \(x\in Z_{q}^{*}\) is a private key. **Phase 2: Ciphertext generation. **  
Each data generator \(dg_{i}\) first chooses a keyword (\(k\in K\)) and selects \(r_{ij}\in Z_{q}^{*}\). It then encrypts its data (\(d_{i}\)) and the selected \(k\) as follows:  
* \(E_{0 ij}=\hbar_{1}(d_{i}^{j})\)
* \(E_{1 ij}=E_{0 ij}\oplus d_{i}^{j}\)
* \(E_{2 ij}=E_{1 ij}^{E_{0 ij}}\)
* \(E_{3 ij}=r_{ij}P\)
* \(E_{4 ij}=\hat{e}(E_{3 ij},(y_{i}+k_{i})P)\)
* \(E_{5 ij}=k\oplus E_{0 ij}^{\omega}\)
* \(E_{6 ij}=y_{i}\lambda_{j}\)  
After that, the \(dg_{i}\) sends the ciphertext (\(E=(\{E_{1 ij},E_{2 ij},E_{3 ij},E_{4 ij}\}_{j\in[1,n]})\)) to the FS and sends \(\{E_{5 ij},E_{6 ij}\}_{j\in[1,n]}\) to the blockchain. **Phase 3: Trapdoor generation. **  
Each \(dr\) chooses a keyword (\(\hat{k}\in K\)) and uses its private key (\(x\)) to generate a trapdoor as follows. * \(T_{0i}=(xy_{i})P+(x\hat{k})P\)
* \(T_{1i}=\frac{1}{x}(Y_{i}+\hat{k}P)\)  
After that, the \(dr\) sends \(T_{i}=(\{T_{0i},T_{1i}\}_{i\in[1,l]})\) to the data generators (\(dg\)), where \(l\) is the number of data generators (\(dg\)s). **Phase 4: Verification and aggregation. **  
**Verification. ** When the data generator (\(dg_{i}\)) receives \(T_{i}\) from the \(dr\), it first verifies the validity of the keyword as follows. \[\varphi_{i}=\frac{\hat{e}((y_{i}+k)P,P)}{\hat{e}(T_{1i}+T_{0i},P)}=1 \tag{2}\]The trapdoor is closed if the equation is not true, which means that the keyword is \(\hat{k}\
otin K\). Otherwise, the authorization (\((T_{0i},X)\)) is sent to the blockchain by each data generator (\(dg\)) and to the \(dr\) by each data generator. Therefore, the authorized \(dr\) transmits \((X,\hat{k})\) as a request to the blockchain after receiving \((T_{0i},X)\). **Correctness:** The test algorithm is considered correct when the encrypted keyword and the trapdoor keyword match. \[\varphi_{i} =\frac{\hat{e}((y_{i}+k)P,P)}{\hat{e}(T_{1i}+T_{0i},P)}\] \[=\frac{\hat{e}((y_{i}+k)P,P)}{\hat{e}(\frac{1}{x}(Y_{i}+\hat{k}P+ (xy_{i})P+(x\hat{k})P,P)}\] \[=\frac{\hat{e}((y_{i}+k)P,P)}{\hat{e}(\frac{1}{x}(y_{i}+\hat{k})P+ x(y_{i}+\hat{k})P,P)}\] \[=\frac{\hat{e}((y_{i}+k)P,P)}{\hat{e}((y_{i}+\hat{k})P,P)}=1,\, if\,k=\hat{k}\]  
**Aggregation. **  
Following receipt of the permission \((T_{0i},X)\) and request \((X,\hat{k})\), the blockchain's aggregation smart contact confirms that the \(dr\) is a valid requester. The aggregation smart contact calculates \((E_{0 ij}^{y_{i}}=\hat{k}\oplus E_{5 ij})\) if the validation is successful.