## 3 Construction
### Implementation
**Decrypt**\((Sk_{Du},CT_{A,T})\to M:\) The decryption key allows \(Du\) to decrypt the ciphertext and obtain access to the data. The decryption algorithm searches for a vector \(\mathbf{w}\) such that \(A_{i}^{T}\cdot\mathbf{w}=(1,0,\ldots,0)^{T}(i\in S)\), if the attributes of \(Du\) do not satisfy the access policy, then there is only one vector \(\{\kappa_{i}\}\), such that \(A_{i}^{T}\cdot\{\kappa_{i}\}=(0,0,\ldots,0)^{T}(i\in S)\) and \(\kappa_{1}=1\), the plaintext \(M\) is obtained by the following formula: \[F=e(C_{1},DD_{1}D_{2})\] \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]0 \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]1
5. **Audit**\((PK,M,M^{*},Pk_{AT},Sk_{AT},MSK)\to t_{id}\): If the data owner \(Do\) suspects that his data have been infringed upon or abused, he can prove his ownership by interacting with the public auditor \(PA\) and the authority \(AT\). This interaction serves two purposes: 1. To demonstrate that \([PERSON]\) was the first to upload the data; 2. To prove that the ciphertext corresponding to the data is indeed generated by \([PERSON]\). **Step 1**: To prove that \([PERSON]\) is the first to upload the data, the source data \(M\) and \(CT_{A,T}\) are sent by \([PERSON]\) to the public auditor \(PA\). \(PA\) obtains the hash value of the source data \(M\) by applying the hash function \(H(x)\) and sends it to the authority \(AT\) to identify the owner of the plaintext.