## 3 Construction
### Implementation
The decryption process begins with \(AT\) decrypting \(G_{T}(H(M))\) using the following method:

\[G_{T}(H(M))=\overline{C_{0}}/e(g^{s},g^{s})\]

After successfully decrypting \(G_{T}(H(M))\), the authority \(AT\) checks if it already has a record of \(G_{T}(H(M))\) in its database. If a record already exists, the application is rejected; otherwise, \(AT\) utilizes their private key \(\beta\) to sign the message and generates

\[C_{0}^{{}^{\prime}}=G_{T}(H(M))\cdot e(g,g)^{as\beta}\]

and stores the data credentials of \(Do\) in the local database in the form of \(T:G_{T}(H(M)):timeStamp\). By following this process, it is guaranteed that there is only one legitimate owner associated with the original data source. This measure also serves as a safeguard against any attempts by malicious actors to produce ciphertext and assert false ownership over the data. Furthermore, this also serves to prevent \(AT\) from directly accessing the plaintext, which enhances the security of the system. Finally, \(C_{0}^{{}^{\prime}}\) is sent back to the data owner \(Do\) for further processing. The user credentials setting Algorithm 2 is as follows:
```
0:\(\overline{C_{0}}\), \(g^{s}\), \(T\)
1: Divide \(\overline{C_{0}}\) by \(e(g^{s},g^{s})\) to get \(G_{T}(H(M))\);
2:if Retrieving \(G_{T}(H(M))\) locally is empty then
3: Element \(P=e(g,g)^{as\beta}\);
4: Date \(date=\) Get the current time through the time function;
5:\(Recordlist[]\leftarrow(T,G_{T}(H(M)),date)\);
6:endif
7:return\(P*G_{T}(H(M))\);
```
**Algorithm 2** Store user credentials

**Step 4**: \(Do\) first calculates

\[C_{0}=M\cdot(C_{0}^{{}^{\prime}}/G_{T}(H(M)))^{T}\]

after receiving \(C_{0}^{{}^{\prime}}\), afterwards, the ciphertext is assigned the value

\[CT_{A,T}=<C_{0}=M\cdot e(g,g)^{asT\beta},C_{1}=g^{sT},C_{i,1}=g^{sTA_{i}\cdot \
u}U_{\rho(i)}^{-\tau_{i}},C_{i,2}=g^{s\tau_{i}},C_{i,3}=g^{sTA_{i}\cdot\
u}>\]

and uploads \(CT_{A,T}\) to the cloud. _Note:_ A notable characteristic of this scheme is the possibility of having multiple owners for a given \(data\), which is made feasible by the additive homomorphism property of Paillier encryption. For example, in a scenario where the data are jointly owned by two parties, denoted as \(Do_{1}\) and \(Do_{2}\), they can both hash their unique identifiers and use them to generate separate \(Paillier\) ciphertexts \(T_{1}\) and \(T_{2}\) using different random numbers, then \(Do_{1},Do_{2}\) calculate \(T_{1}=g_{1}^{t_{1}}r_{2}^{n}\ mod\ n^{2}\), \(T_{2}=g_{1}^{t_{1}}r_{2}^{n}\ mod\ n^{2}\), let \(T=T_{1}\cdot T_{2}\). During the entire encryption stage, we have realized data confirmation. Hash the plaintext and map it to \(G_{T}\) for encryption(\(\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as}\)) and send it to \(AT\); \(AT\) only needs to perform division and signature operations on \(\overline{C_{0}}\), and store user ID \(T\) locally as a certificate. Therefore, \(AT\) cannot touch the plaintext. 3. **KeyGen**\((MSK,PS,PK)\to Sk_{Du}\) : The generation of the decryption key in this scheme is a collaborative process between \(Du\) and \(AT\); \(Du\) first chooses a random number \(t\xleftarrow{R}\). \(\mathbb{Z}_{N}\) as a parameter. Next, \(Du\) forwards their personal set of attributes \(S\) andthe value \(g^{t}\) to \"\(AT\) as part of its request to generate a key. Then, \(AT\) selects random numbers \(h\stackrel{{ R}}{{\leftarrow}}\mathbb{Z}_{N}\) and \(R_{0},R_{1},R_{2},R_{3},R_{i}\in G_{p_{3}}\) to generate part of the decryption key

\[Sk_{pri}=<S,\overline{D}=g^{\beta a},\overline{D_{1}}=g^{ah},\overline{D_{2}}= g^{\beta h},\overline{D_{3}}=g^{th},\{\overline{D_{i}}=\mathcal{U}_{i}^{h}\}_{i \in S}>\]

Finally, \(AT\) transmits the decryption key \(Sk_{pri}\) and a collection of values labeled as \(\{R_{0},R_{1},R_{2},R_{3},R_{i}\}\) to \(Du\), and \(Du\) generates the decryption key locally using these values:

\[Sk_{Du}=<S,D=\overline{D}R_{0},D_{1}=\overline{D_{1}}^{t}R_{1},D_{2}= \overline{D_{2}}^{t}R_{2},D_{3}=\overline{D_{3}}R_{3},\{D_{i}=\overline{D_{i}} ^{t}R_{i}\}_{i\in S}>\]
4.