## 5 Specific Construction of LR-SP-IBBE  
We used \(\Theta\) to represent a bilinear group generation algorithm for the composite order. \(\Theta\) input safety parameters \(\zeta\) and output the formalization of the bilinear group with the composite order \(\Phi=\{N=q_{1}q_{2}q_{3},G_{1},G_{2},e\}\), where \(q_{1}\), \(q_{2}\), and \(q_{3}\) are three different primes with a \(v\) bit length (that is to say, \(\log_{2}^{q_{1}}=\log_{2}^{q_{2}}=\log_{2}^{q_{3}}=v\)). \(G_{1}\) was a cyclic group with order \(N=q_{1}q_{2}q_{3}\), as was \(G_{2}\). \(e\colon G_{1}\times G_{1}\to G_{2}\) is one bilinear map. \(v\) was determined by the safety parameter. It was assumed that any identity information was a member of \(Z_{N}\) and any message was a member of \(G_{2}\). Suppose that \(g_{1},g_{2}\), and \(g_{3}\) are the generators of the subgroups \(G_{q_{1}},G_{q_{2}}\), and \(G_{q_{3}}\). The first subgroup \(G_{q_{1}}\) carried some primary information for the plaintext and every user's private key. \(G_{q_{2}}\) offered the semifunctionality that was used in the security proof. \(G_{q_{3}}\) randomized the private key. **Initialization. **\(t\) was used to represent the maximum number of users. It randomly selected \(g_{1},h_{1}\in G_{q_{1}},g_{3}\in G_{q_{2}},u_{1},\ldots,u_{t}\in G_{q_{1}}\), and \(\alpha\in Z_{N}\). It selected a \((k,\epsilon)\) strong binary extractor \(Ext:G_{2}\times Z_{N}\to G_{2}\). The public parameter was \(PP=\{N,Ext,g_{1},g_{3},h_{1},u_{1},\ldots,u_{t},e(g_{1},g_{1})^{\alpha}\}\). The master private key was \(MK=\{a\}\). **Private key generation**. For an identity \(ID_{i}\in S\) where \(S=(ID_{1},\ldots,ID_{d})\), (\(d\leq t\)) is the target users. The algorithm input \(PP\), \(MK\), and one user's identity \(ID_{i}\). It randomly selected \(a_{1},a_{2},\ldots,a_{d},b\in Z_{N}\), \(\beta_{i,0},\gamma_{i,0}\in Z_{N}\), \(r_{i}\in Z_{N}(i=\{1,\ldots,d\})\), and \(R_{i},Q_{i},R^{\prime},U^{\prime}_{i}\in G_{p_{3}}\). It set \(u_{1}=g_{1}^{a_{1}},\ldots,u_{d}=g_{1}^{a_{1}},h_{1}=g_{1}^{b}\) and generated the private key \(SK_{ID_{i}0}=(SK_{ID_{i}0,1},\\ SK_{ID_{i}0,2})\), where \(SK_{ID_{i}0,1}=(g_{1}^{r_{i}}R_{i}g_{1}^{\beta_{i,0}},g_{1}^{a}(h_{1}\prod \limits_{j=1}^{d}u_{j}^{ID_{j}})^{r_{i}}Q_{i}g_{1}^{\gamma_{i,0}})\) and \(SK_{ID_{i}0,2}=(R_{i}^{\prime}g_{1}^{-\beta_{i,0}},\\ Q_{i}^{\prime}g_{1}^{-\gamma_{i,0}})\). **Private key update. ** This input \(PP\) and \(SK_{ID_{i}k}\) and produced one new private key \(SK_{ID_{i}k+1}\). For \(SK_{ID_{i}k}=(SK_{ID_{i}k,1},SK_{ID_{i}k,2})\), where \(SK_{ID_{i}k,1}=(SK_{ID_{i}k,1}^{1},SK_{ID_{i}k,1}^{2})=(g_{1}^{r_{i}}R_{1}g_{1}^ {\beta_{i,k}},g_{1}^{a}(h_{1}\prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{r_{i}}Q_{i }g_{1}^{\gamma_{i,k}})\) and \(SK_{ID_{i}k,2}\)\(=(SK_{ID_{i}k,2}^{1},SK_{ID_{i}k,2}^{2})=\)(\(R^{\prime}\)\(\cdot\)\(g_{1}^{-\gamma_{i,k}}\)), it randomly selected \(\beta_{i,k+1},\lambda_{i,k+1}\in Z_{N}\) and generated one new private key \(SK_{ID_{i}k+1}=(SK_{ID_{i}k+1,1},SK_{ID_{i}k,1}^{2})\), where  
\[SK_{ID_{i}k+1,1}=(SK_{ID_{i}k,1}^{1},SK_{ID_{i}k,1}^{2},SK_{1}^{2},SK_{1}^{2},SK _{1}^{2},SK_{1}^{2},SK_{1}^{2},SK_{1}^{2})=(g_{1}^{r_{i}}R_{1}g_{1}^{\beta_{i,k }}g_{1}^{\beta_{i,k+1}},\\ =(g_{1}^{r_{i}}R_{1}g_{1}^{\beta_{i,k}+\beta_{i,k+1}},g_{1}^{a}(h_{1} \prod\limits_{j=1}^{d}u_{j}^{ID_{j}})^{r_{i}}Q_{i}g_{1}^{\gamma_{i,k}+\gamma_{ i,k+1}})\]  
and \(SK_{ID_{i}k+1,2}=(SK_{ID_{i}k,2}^{1}g_{1}^{-\beta_{i,k+1}},SK_{ID_{i}k,2}^{2}g_{1}^{- \gamma_{i,k+1}})\)\(=(R_{1}^{\prime}g_{1}^{-\beta_{i,k}-\beta_{i,k+1}},Q_{1}^{\prime}g_{1}^{- \gamma_{i,k}+\gamma_{i,k+1}})\). Since \(\beta_{i,k+1},\lambda_{i,k+1}\in Z_{N}\) were all random, \(\beta_{i,k}+\beta_{i,k+1}\) and \(\gamma_{i,k}+\gamma_{i,k+1}\) were also random. The private keys \(SK_{ID_{i}k+1}\) and \(SK_{ID_{i}k}\) had the same distribution. Without losing generality, the original \(SK_{ID_{i}}\) was used for convenience. **Encryption**. This took the message \(M\) and an identity set \(S=(ID_{1},\ldots,ID_{d})\) of the receivers as input.