## 3 Preliminaries
### BCP and BCP Enhance Method  
According to the actual demand of target scenario, the basic PHE algorithm chose in our scheme is BCP proposed by [28]. The supported homomorphic operation of this scheme contains only addition, which is also called to own the attribute of linear homomorphism. The supported operations and specific processes defined by [28] is showed as below:  
* Algorithm Initialization: choose two large primes \(p\) and \(q\), compute \(N=pq\) and randomly select \(g=-a^{2N}(a\in\mathbb{Z}_{N^{2}}^{*})\);
* Key Generation: Randomly choose secret key \(s\in[1,\frac{N^{2}}{2}]\), the public key \(p=g^{s}mod\ N^{2}\);
* Encryption: The plaintext \(m\) should be \(m\in\mathbb{Z}_{N}\). To encrypt \(m\), firstly select a random \(r\in[1,\frac{N}{4}]\). And the ciphertext \(E(m)\) can be calculate as (3): \[E(m)=(C_{m}^{1},C_{m}^{2})=(g^{r}mod\ N^{2},g^{r\cdot s}(1+mN)mod\ N^{2})\] (3)
* Decryption: \(m\) can be calculated from \(E(m)\) and \(s\) like (4): \[m=\frac{(\frac{C_{m}^{2}}{(C_{m}^{1})^{s}}-1)mod\ N^{2}}{N}\] (4)
* Linear Homomorphism: If we have two ciphertext \(E(m_{1})=(C_{m_{1}}^{1},C_{m_{1}}^{2})\), \(E(m_{2})=(C_{m_{2}}^{1},C_{m_{2}}^{2})\) under the same secret key \(s\), we can calculate \(E(m_{1}+m_{2})\) as (5): \[E(m_{1}+m_{2})=E(m_{1})\dot{+}E(m_{2})=(C_{m_{1}}^{1}\cdot C_{m_{2}}^{1},C_{m _{1}}^{2}\cdot C_{m_{2}}^{2})\] (5)  
To be noticed, the multiple operations on each part of ciphertexts are all modular operations based on \(N^{2}\).  
Except from the operations it already defined, we can also use the Proxy Re-encryption technique on this cryptographic algorithm as follows: If there are three secret key \(s,s_{1},s_{2}\) and they conform to the relationship shown as (6), the Proxy Re-encryption process between and by them can be acted.  
\[s=(s_{1}+s_{2})mod\ N^{2} \tag{6}\]  
To keep the efficiency of BCP while supporting more necessary operations, a framework proposed by [PERSON] and [PERSON] in [29] is used in our scheme. By using this method, we could support homomorphic multiplication and keep all system fast. This scheme build a construction \(\mathcal{E}(m)\) with basic encryption \(E()\) so that it can calculate the \(\mathcal{E}(m_{1}m_{2})\). Although, the multiplication operations is not used in this passage, we keep it for better security. The necessity of using this method will be explained in Section 6.3. In contrast, a realign operation supported by [29] mechanism is needed. We can realign its plaintext part as (7).  
\[\begin{split}\mathcal{E}(m_{1})=&(a_{1},\beta_{1})=[m_{ 1}-b_{1},E(b_{1})]\\ \mathcal{E}(m_{2})=&(a_{2},\beta_{2})=[m_{2}-b_{2},E( b_{2})]\\ \mathcal{E}^{{}^{\prime}}(m_{2})=&(a_{1},\beta_{2} \dot{\perp}E(a_{2}-a_{1}))=[m_{1}-b_{1},E(b_{2}+a_{2}-a_{1})]\end{split} \tag{7}\]  
To be noticed, the encryption process \(E(a_{2}-a_{1})\) must be done with the same key of original ciphertext \(\beta_{1}\) and \(\beta_{2}\). Otherwise, the Equation (7) does not hold. Of course we can also align the plaintext part of \(\mathcal{E}(m_{1})\) and \(\mathcal{E}(m_{1})\) to a new value \(a_{3}\) by the same key of them like (8).  
\[\begin{split}\mathcal{E}^{{}^{\prime}}(m_{1})&=(a_{ 3},\beta_{2}\dot{\perp}E(a_{1}-a_{3}))=[a_{3},E(b_{1}+a_{1}-a_{3})]\\ \mathcal{E}^{{}^{\prime}}(m_{2})&=(a_{3},\beta_{2} \dot{\perp}E(a_{2}-a_{3}))=[a_{3},E(b_{2}+a_{2}-a_{3})]\end{split} \tag{8}\]  
If \(m_{1}=m_{2}\), \(b_{1}+a_{1}-a_{3}\) should be equal to \(b_{2}+a_{2}-a_{3}\). Of cause, this is not obvious in our scenario, a special method will be used in Section 5.5 to show whether they are equal.