## 2 Preliminaries
### Linear Secret-Sharing Schemes  
**Definition 2**.: _LSSS [28; 29]. Suppose \(S\) represents the set of attributes, and let \(p\) be a prime number. A secret sharing scheme is denoted as \(\Pi\) and is operating on \(\mathbb{Z}_{p}\). If the following two criteria are met by \(\Pi\), then \(\Pi\) is referred to as linear:_  
1. _The secret_ \(s\in\mathbb{Z}_{p}\) _shared by each participant forms a column vector on_ \(\mathbb{Z}_{p}\)_._
2. _A secret sharing scheme_ \(\Pi\) _has a shared generator matrix_ \(M\)_, which is an_ \(l\)_-by-_\(n\) _matrix for every access structure_ \(\mathbb{A}\) _defined on_ \(S\)_. For_ \(i=1,\ldots,l\)_, the_ \(i\)_th line of_ \(M\) _is marked as an attribute_ \(\rho(i)\) _(_\(\rho\) _is a map that maps each row of matrix_ \(M\) _to_ \(\Pi\)_). Given a vector_ \(\mathbf{v}=(s,r_{2},\ldots,r_{n})\)_, where_ \(s\) _is the shared secret,_ \(r_{2},\ldots,r_{n}\) _are randomly selected;_ \(\lambda=M_{l\times n}\cdot\mathbf{v}\) _identifies the_ \(l\) _shares of_ \(\Pi\) _to the secret number_ \(s\)_. Line_ \(i\) _belongs to attribute_ \(\rho(i)\)_._  
**Secret Recovery:** Assuming \(\Pi\) accesses the \(LSSS\) of the structure \(\mathbb{A}\), \(S\) is the set of authorization attributes owned by the user, and \(M\) is the shared generation matrix. Define \(J=1,\ldots,j\) and \(J=\{j\mid\rho(j)\in S\}\). For the vector \(\{\lambda_{j}\}_{j\in J}\) generated by the product of matrix \(M\) and secret vector \(\mathbf{v}\), there exists a vector \(\mathbf{w}=\{w_{j}\}\) of integers in \(\mathbb{Z}_{p}\) such that \(\sum_{j\in J}M_{j}\cdot w_{j}=(1,0,\ldots,0)\) and \(\rho(j)^{T}\cdot\mathbf{w}=s(mod\ N)\), \(\{w_{j}\}\) can be found in polynomial time, and \(\{w_{j}\}\) does not exist for non-authorized sets.  
**Definition 3** ([30]).: _Suppose \(\mathbb{A}\) is a monotonic access structure. In such a case, the definition of the shared generator matrix \(M\) yields the following conclusions:_  
* _If_ \(M\in\mathbb{A}\)_, there exists a vector_ \(\{\kappa_{i}\}\) _of integers in_ \(\mathbb{Z}_{p}\) _such that_ \(M^{\top}\cdot\{\kappa_{i}\}=(1,0,\ldots,0)^{\top}\cdot\)__
* _If_ \(M\
otin\mathbb{A}\)_, there exists a vector_ \(\{v_{i}\}\) _of integers in_ \(\mathbb{Z}_{p}\) _such that_ \(M^{\top}\cdot\{v_{i}\}=(0,0,\ldots,0)^{\top}\) _and_ \(v_{1}=1\)_._  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **[PERSON] et al. [25]** & **[PERSON] et al. [27]** \\ \hline Ways of identifying & Key verification & Fingerprint tracking protocol \\ Confirmation method & Consortium blockchain and & Smart contract \\ Security assumption & Collision-resistant properties & \\  & of hash function & null \\ Source data security & ✓ & ✓ \\ Can be applied to the cloud & \(\times\) & \(\times\) \\ storage environment & [PERSON] et al. [23] & ours \\ \hline Ways of identifying & Digital watermark & Pailler decryption \\ Confirmation method & Digital watermarking + & CP-ABE and Paillier \\  & blockchain & encryption \\ Security assumption & CDH assumption & Subgroup decision problem \\ Source data security & \(\times\) & for 3 primes \\ Can be applied to the cloud & ✓ & ✓ \\ storage environment & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of our scheme and other schemes.