## 5 Specific Construction of CLR-SS-AIBBE  
Let \(\Phi\) to represent a bilinear group generation algorithm. Taking the safety parameters \(\varpi\) as inputs, \(\Phi\) produces a bilinear group with composite order \(\Omega=\{N=w_{1}w_{2}w_{3},G_{1},G_{2},e\}\). \(w_{1}\), \(w_{2}\) and \(w_{3}\) are three different primes with \(\theta\) bits (that is, \(\log_{2}^{w_{1}}=\log_{2}^{w_{2}}=\log_{2}^{w_{3}}=\theta\)). \(G_{1}\) is a cyclic group with order \(N=w_{1}w_{2}w_{3}\), so is \(G_{2}\). \(e\) is a bilinear map that maps \(G_{1}\times G_{1}\) to \(G_{2}\). \(\theta\) is determined by safety parameter \(\varpi\). **Initialization algorithm**. Let \(l\) indicate the maximum number of users. The algorithm randomly selects \(g_{1},h_{1}\in G_{w_{2}},g_{3}\in G_{w_{3}}\), \(a_{1},a_{2},\ldots,a_{l},b\in Z_{N}\) and \(\alpha\in Z_{N}\) and sets \(u_{1}=g_{1}^{a_{1}},\ldots,u_{l}=g_{1}^{a_{1}}\) and \(h_{1}=g_{1}^{b_{1}}\). The master public key is \(MP=\left\{N,g_{1},g_{3},h_{1},u_{1},\ldots,u_{l},e(g_{1},g_{1})^{a}\right\}\). The master private key is \(MK=\{\alpha\}\). **Private key generation algorithm**. For an identity \(ID_{i}\in S\), where \(S=(ID_{1},\ldots,ID_{d})\) (\(d\leq l\)) is this set of the intended recipients, the algorithm inputs \(MP\), \(MK\) and one user's identity, \(ID_{i}\). The algorithm randomly selects \(a_{1},a_{2},\ldots,a_{d},b\in Z_{N}\), \(\beta_{i,0},\gamma_{i,0}\in Z_{N}\), \(r_{i}\in Z_{N}(i=\{1,\ldots,d\})\) and \(R_{i},Q_{i},R^{\prime}_{i},Q^{\prime}_{i}\in G_{p_{3}}\). It sets \(u_{1}=g_{1}^{a_{1}},\ldots,u_{l}=g_{1}^{a_{1}}\) and \(h_{1}=g_{1}^{b_{1}}\). The generated private key is \(SK_{ID,p}\)= \((SK_{ID_{i},01},SK_{ID,02})\), where \(SK_{ID_{i},01}=(g_{1}^{r_{i}}R_{i}g_{1}^{b_{i},\alpha},g_{1}^{a}(h_{1}\mathop{ \underset{j=1}{\overset{d}{\sim}}}^{l}\,u_{j}^{r_{i}})^{r_{i}}Q_{i}g_{1}^{T_{i }0})\) and \(SK_{ID_{i},02}=(R_{i}^{\prime}g_{1}^{-\beta_{i,0}},Q_{i}^{\prime}g_{1}^{-\gamma_ {i,0}})\). **Private key update algorithm**. It inputs \(SK_{ID_{i},k}\) and \(MP\). It obtains a new private key \(SK_{ID_{i},k+1}\). For the private key \(SK_{ID_{i},k}=(SK_{ID_{i},k,1},SK_{ID_{i},k,2})\), where \(SK_{ID_{i},k,1}=(SK_{ID_{i},k,1}^{1},\)  
\(SK_{ID_{i},k,1}^{2})=(g_{1}^{r_{i}}R_{1}g_{1}^{\beta_{i,1}+\ldots+\beta_{i,k}},g_ {1}^{a}(h_{1}\mathop{\underset{j=1}{\overset{d}{\sim}}}^{l}\,u_{j}^{ID_{i}}) ^{r_{i}}Q_{1}g_{1}^{\gamma_{i,1}+\ldots+\gamma_{i,k}})\) and \(SK_{ID_{i},k,2}=(SK_{ID_{i},k,2}^{1},\)  
\(SK_{ID_{i},k,2}^{2})=(R_{1}^{\prime}g_{1}^{-\beta_{i,1}-\ldots-\beta_{i,k}},Q_{1}^ {\prime}g_{1}^{-\gamma_{i,1}-\ldots-\gamma_{i,k}})\). It chooses randomly \(\beta_{i,k+1},\lambda_{i,k+1}\in Z_{N}\) and calculates a new private key:  
\(SK_{ID_{i},k+1}=(SK_{ID_{i},k+1,1},SK_{ID_{i},k+1,2})\),  
where  
\[SK_{ID_{i},k+1,1}=(SK_{ID_{i},k,1}^{1}g_{1}^{\beta_{i,k+1}},SK_{ID_{i},k}^{2}g_{1 }^{\gamma_{i,k+1}})\]  
\[=(g_{1}^{r_{i}}R_{1}g_{1}^{\beta_{i,1}+\ldots+\beta_{i,k}},g_{1}^{\beta_{i,k+1}},g_ {1}^{\beta_{i,k+1}},g_{1}^{\alpha}(h_{1}\mathop{\underset{j=1}{\overset{d}{\sim}}}^{l}\,u_{j} ^{ID_{i}})^{r_{i}}Q_{1}g_{1}^{\gamma_{i,1}+\ldots+\gamma_{i,k}}g_{1}^{\gamma_{ i,k+1}})\]  
\[\[SK_{ID,k+1,2}=(SK^{1}_{ID,k,2}s_{1}^{-\beta_{i,k+1}},SK^{2}_{ID,k,2}s_{1}^{-\gamma _{i,k+1}})=(R^{\prime}_{1}g_{1}^{-\beta_{i,1}-\cdots-\beta_{i,k}-\beta_{i,k+1}}, Q^{\prime}_{1}s_{1}^{-\gamma_{i,1}-\cdots-\gamma_{i,k}-\gamma_{i,k+1}})\]  
Since \(\beta_{i,k+1},\lambda_{i,k+1}\in Z_{N}\) are randomly selected, \(\beta_{i,1}+\ldots+\beta_{i,k}+\beta_{i,k+1}\) and \(\gamma_{i,1}+\ldots+\gamma_{i,k}+\gamma_{i,k+1}\) are also random. The private keys \(SK_{ID,k+1}\) and \(SK_{ID,k}\) have the same distributions. Without losing the generality, if a private key is needed, the original private key \(SK_{ID_{i}}\) will be used for the convenience. **Encryption algorithm. ** It takes \(M\) and one set \(S=(ID_{1},\ldots,ID_{d})\) that will receive the ciphertext as the input.