## 3 Related Knowledge
### Composite Order Bilinear Groups  
Ref. [54] put forward the concept of composite order bilinear groups. Let \(\Phi\) represent a bilinear group generation algorithm. Taking the safety parameters \(\varpi\) as inputs, \(\Phi\) can produce a bilinear group with composite order \(\Omega=\{N=w_{1}w_{2}w_{3}\), \(G_{1}\), \(G_{2}\), \(e\}\). \(w_{1}\), \(w_{2}\) and \(w_{3}\) are three different primes with \(\theta\) bits (that is, \(\log_{2}^{w_{1}}=\log_{2}^{w_{2}}=\log_{2}^{w_{3}}=\theta\)). \(G_{1}\) is a cyclic group with order \(N=w_{1}w_{2}w_{3}\), so is \(G_{2}\). \(e\) is a bilinear map that maps \(G_{1}\times G_{1}\) to \(G_{2}\). \(\theta\) is determined by safety parameter \(\varpi\). \begin{table}
\begin{tabular}{c c} \hline
**Notation** & **Description** \\ \hline \(G_{1}\), \(G_{2}\) & Cyclic groups \\ \(N=w_{1}w_{2}w_{3}\) & Order of \(G_{1}\) and \(G_{2}\) \\ \(\Phi\) & Bilinear group generation algorithm \\ \(G_{w_{1}}\), \(G_{w_{2}}\), \(G_{w_{3}}\) & Subgroups of \(G_{1}\) for order \(w_{1},w_{2}\) and \(w_{3}\) \\ \(\varpi\) & Safety parameter \\ \(X_{1}\) & Random value of \(G_{w_{1}}\) \\ \(X_{2}\), \(Y_{2}\), \(Z_{2}\) & Random values of \(G_{w_{2}}\) \\ \(X_{3}\), \(Y_{3}\) & Random values of \(G_{w_{3}}\) \\ \(MP\) & Public parameters \\ \(MK\) & Master private key \\ \(SK_{ID,k}\) & Private key for identity \(ID\) \\ \(SK_{ID,k+1}\) & Updated private key \\ \(M\) & A plaintext \\ \(CT\) & A ciphertext \\ \(\mathcal{A}\) & An adversary \\ \(\mathcal{B}\) & A challenger \\ \(L_{SK}\) & Bound for private key leakage \\ EX\({}_{\text{R}}\) & Real security game \\ \hline \end{tabular}
\end{table} 
Table 1: Some notations. Figure 2: The system’s framework of anonymous leakage-resilient IBBE in cloud storage services. Let \(G_{w_{1}},G_{w_{2}}\) and \(G_{w_{3}}\) denote the subgroups of order \(w_{1}\), \(w_{2}\) and \(w_{3}\), respectively, in the group \(G_{1}\). Let \(G_{w_{1}w_{2}}\) denote the subgroup of order \(w_{1}w_{2}\) in \(G_{1}\). If an element \(Y\) can be written as the product of an element in \(G_{w_{1}}\) and an element in \(G_{w_{2}}\), then these two parts are called the part \(G_{w_{1}}\) of \(Y\) and the part \(G_{w_{2}}\) of \(Y\), respectively. Assuming that \(p_{i}\in G_{w_{i}}\) and \(p_{j}\in G_{w_{j}}\) (\(i\
eq j\)), we can acquire \(e(p_{i},p_{j})=1\). So, \(G_{w_{i}}\) and \(G_{w_{j}}\) are orthogonal. For example, \(G_{w_{1}}\) and \(G_{w_{2}}\) are orthogonal. Suppose \(g\) is a generator of \(G_{1}\), \(g^{w_{1}w_{2}}\) is a generator of \(G_{w_{2}}\), \(g^{w_{1}w_{2}}\) is a generator of \(G_{w_{2}}\), and \(g^{w_{2}w_{3}}\) is a generator of \(G_{w_{1}}\). Then, there are \(a_{1}\) and \(a_{2}\), such that \(p_{1}=(g^{w_{2}w_{3}})^{a_{1}}\) and \(p_{2}=(g^{w_{1}w_{3}})^{a_{2}}\). Therefore, \(e(p_{1},p_{2})=e(g^{w_{2}w_{3}a_{1}},g^{w_{1}w_{2}a_{2}})=e(g^{a_{1}},g^{w_{2}a _{2}})^{w_{1}w_{2}w_{3}}=1\). So, \(G_{w_{1}}\) and \(G_{w_{2}}\) are orthogonal. Three assumptions [49; 51] are given below. Suppose \(g_{i}\) is the generator of \(G_{w_{i}}\). Let \(\Phi\) generate a bilinear group. Given the following distribution:  
\(\Omega=\{N=w_{1}w_{2}w_{3},G_{1},G_{2},e\}\stackrel{{ R}}{{ \leftarrow}}\Phi\), \(g_{1}\stackrel{{ R}}{{\leftarrow}}G_{w_{1}},X_{3}\stackrel{{ R}}{{\leftarrow}}G_{w_{3}}\), \(U=(\Omega,g_{1},X_{3})\). No adversary can distinguish \(T_{1}\in G_{w_{1}w_{2}}\) from \(T_{2}\in G_{w_{1}}\). The superiority that one adversary destroys Assumption 1 is denoted by  
\(Adv_{\psi,\mathcal{A}}(\varnothing)=\)\(|\)Su\(|\mathcal{A}(U,T_{1})=1|-\) Su\(|\mathcal{A}(U,T_{2})=1|\). If \(Adv_{\psi,\mathcal{A}}(\varnothing)\) can be ignored, Assumption 1 is considered valid. Let \(\Phi\) generate a bilinear group. Given the following distribution:  
\(\Omega=\{N=w_{1}w_{2}w_{3},G_{1},G_{2},e\}\stackrel{{ R}}{{ \leftarrow}}\Phi,X_{1},g_{1}\stackrel{{ R}}{{\leftarrow}}G_{w_{1}},X_{2},Y_{2} \stackrel{{ R}}{{\leftarrow}}G_{w_{2}},X_{3},Y_{3}\stackrel{{ R}}{{\leftarrow}}G_{w_{2}}\), \(U=(\Omega,g_{1},X_{1}X_{2},X_{3},Y_{2}Y_{3})\).