## 3 Construction
### Implementation
### Correctness

\[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]4 \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]5 \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]6 \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]7 \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]8 \[MSK=(\alpha,g_{3})(g_{3}\in G_{p_{3}}\text{ and is a generator})\text{ and }MSK\) is sent to the authority \(AT\); \(AT\) performs the following steps locally: randomly selecting two safe large primes \(p\) and \(q\), which satisfy \(gcd(pq,(p-1)(q-1))=1\), calculating \(n=pq,\lambda=lcm(p-1,q-1)\), and then randomly selecting a positive integer \(g_{1}\) that is less than \(n^{2}\). Next, AT computes \(\mu=(L(g^{\lambda}modn^{2}))^{-1}mod\)\(n\) and randomly selects a value \(\beta\in\mathbb{Z}_{N}\). The public parameter \(Pk_{AT}=(n,g_{1},g^{\beta})\) is generated, whereas the private key \(Sk_{AT}=(\lambda,\mu,\beta)\) is stored locally.
2. **Encrypt**\((Pk_{AT},<A,\rho>,PK,M)\to CT_{A,T}:\) **Step 1**: The unique identifier (e.g., ID number, address, mailbox, etc.) is hashed by data owner \(Do\) and mapped to an integer in \(\mathbb{Z}_{N}\), denoted as \[t_{id}=H(identity)\rightarrow\mathbb{Z}_{N}\]9 \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]0 \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]1 \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]2 \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]3 \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]4 \[\overline{CT_{A,T}}=<\overline{C_{0}}=G_{T}(H(M))\cdot e(g,g)^{as},C_{1}=g^{sT},C_{i,1}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}\mathcal{U}_{\rho(i)}^{-r_{i}},C_{i,2}=g^{s_{1}},C_{i,3}=g^{sT}\overline{TA_{i}\cdot\mathbf{v}}>\]5

### IND-CPA Security

Suppose there is an adversary \(\mathcal{A}\) who can eavesdrop on the channel between the user and the data owner, and he can obtain the ciphertext corresponding to the plaintext within a limited time, so as to crack the key and gain unlimited access to the ciphertext.