## 3 Preliminaries
### Step-by-Step Process  
This process is summarized in Table 3. The overall workflow of this paper is also illustrated in Figure 2, and the details are given below:  
1. \(GlobalSetup(\lambda)\to GP\): The \(GlobalSetup\) runs by the central authority, \(CA\). It requires no input other than the security parameter, \(\lambda\). It delivers the outputs of the global public parameters, \(GP\). 2. \(AASetup(GP,aid)\rightarrow(APK_{aid},ASK_{aid})\): The \(AASetup\) runs by each attribute authority, \(AA\). It considers the \(GP\) and authority, \(aid\), as the inputs. The output of \(AASetup\) is the public and secret key pair \((APK_{aid},ASK_{aid})\). 3. \(SKGen(GP,ASK_{aid},uid,S_{aid,aid})\to SK_{s,aid,aid}\): The \(SKGen\) runs by each \(AA\). It requires the \(GP\), authority secret key \(ASK_{aid}\), end-user identity \(uid\) and a set of the end user's attributes \(S_{aid,aid}\) entitled by the \(aid\) as the inputs. It outputs the secret key \(SSK_{s,aid,aid}\) for the end-user \(uid\). 4. \(AttrGroupKey(aid,x)\rightarrow(KEK_{TREE_{x}},AGK)\): The \(AttrGroupKey\) runs by each \(AA\). It takes the \(aid\) and attributes \(x\) as the inputs. It outputs \(KEK_{TREE_{x}}\) and the attribute-group key \(AGK\) for \(x\). 5. \(FogEnc. (\mathcal{A},GP,\left\{APK\right\}_{aid})\rightarrow\mathcal{CT}_{out}^ {1}\): The \(FogEnc.\) runs by the fog nodes. It takes \(a_{p}\), the \(GP\) and a set of authority public keys \(APK_{aid}\) as the inputs. It outputs the ciphertext \(\mathcal{CT}_{out}^{1}\). 6. \(DOEnc. (m,\mathcal{A},GP,\left\{APK\right\}_{aid})\rightarrow\mathcal{CT}\): The \(DOEnc.\) run by the data owners. It obtains the message \(m\), \(a_{p}\), \(GP\) and \(APK_{aid}\) as the inputs. It outputs the ciphertext \(\mathcal{CT}\). Figure 1: System model. \(ReEnc(\mathcal{CT},\{AGK\})\rightarrow\mathcal{CT}^{\prime}\): The \(Re.Enc.\) runs by \(CSP\). It takes the ciphertext \(\mathcal{CT}\) and a set of attribute-group keys \(AGK\) as the inputs and outputs the re-encrypted \(\mathcal{CT}^{\prime}\). * \(PreDec(uid,\{AGK\},\{SK_{S,uid,aid}\})\rightarrow\left(SK^{{}^{\prime}}_{S,uid,aid },OSK_{S,uid},\mathcal{CT}^{\prime^{\prime}}\right)\): The \(PreDec.\) runs by the end users. It takes the \(uid\), \(AGK\) and a set of the end users' secret keys \(SK_{S,uid,aid}\) as the inputs. It outputs \(SK^{{}^{\prime}}_{S,uid,aid}\) and \(OSK_{S,uid}\). * \(Fog.Dec(\mathcal{CT}^{\prime},GP,OSK_{S,uid})\rightarrow\mathcal{CT}^{\prime}_{ out}\): The \(FogDec.\) runs by fog nodes. It takes \(\mathcal{CT}^{\prime}\), \(GP\) and outsourcing private keys \(OSK_{S,uid}\) as the inputs. It outputs a partially decrypted ciphertext \(\mathcal{CT}_{out}\). * \(End-user.Dec(\mathcal{CT}^{\prime}_{out},uid,SK^{{}^{\prime}}_{S,uid,aid}) \rightarrow(m/\bot)\): The \(end-userDec.\) runs by the end users. It takes the partially decrypted ciphertext \(\mathcal{CT}^{\prime}_{out}\), end-user identity \(uid\) and the key \(SK_{S,uid,aid}\) as the inputs. If the attributes of the end-user \(uid\) are satisfied, then the access structure \(\mathcal{A}\) embedded in the ciphertext outputs \(m\). Otherwise, it outputs \(\bot\). * \(KeyUpdate\): End users run the \(KeyUpdate\) algorithm. It outputs a new attribute-group key \(AGK^{{}^{\prime}}_{x}\) for the revoked attribute \(x\). * \(CTUpdate\Big{(}\mathcal{CT}^{\prime},x,AGK^{{}^{\prime}}_{x}\Big{)}\rightarrow \mathcal{CT}^{*}\): The \(CTUpdate\) runs by \(CSP\). It takes \(\mathcal{CT}^{\prime}\), \(x\) and \(AGK^{{}^{\prime}}_{x}\) as the inputs. It delivers the updated ciphertext \(\mathcal{CT}^{*}\) as the output. In the scenario of attribute revocation, \(CSP\) operates the algorithm to change the ciphertext.