# A Secure Key Aggregate Searchable Encryption with Multi Delegation in Cloud Data Sharing Service
## 4 Our Proposed Scheme
### Data Retrieve Phase  
\(DU_{j}\) generate a trapdoor of keyword \(w\) using their aggregate key. \(DU_{j}\) sends the trapdoor to \(CS\) for a search query and an authentication credential for mutual authentication. \(CS\) authenticates with \(DU_{j}\), then \(CS\) determine whether the encrypted keyword is \(CK\) using \(DU_{j}\)'s trapdoor. After verification of keyword, \(CS\) generates a result set and proof set. After \(DU_{j}\) receives result set and proof set from \(CS\), \(DU_{j}\) authenticate with \(CS\) and conducts the verification proofs that the keyword exists in owner's document set. Figure 5 describes this phase, and the detailed steps are as follows.  
**Step 1: \(DU_{j}\)** generates a single aggregate trapdoor \(Tr_{j}=k_{s}\cdot h_{1}(w)\). A trapdoor relates to a set of all documents related to the aggregate key. Then, \(DU_{j}\) generates timestamp \(T_{1}\) and random nonce \(R_{du}\). Furthermore, \(DU_{j}\) computes \(V_{j}=PK_{j}^{R_{du}}\), \(Verif_{j}=PK_{cs}^{b_{j}:R_{du}}\), \(M_{j}=h_{1}(ID_{j}||b_{j})\oplus Verif_{j}\), \(MA_{j}=h_{1}(Verif_{j}||HD_{j}||T_{1})\), and \(HHID_{j}=TID_{j}^{MA_{j}}\). After that, \(DU_{j}\) sends \(M_{j}\), \(V_{j}\), \(HHID_{j}\), \(T_{1},T_{j}\), \(S_{i}\) via an insecure channel.  
**Step 2:** After receiving messages from \(DU_{j}\), \(CS\) computes \(Verif_{j}=V_{j}^{A_{\infty}}\) and \(HID_{j}^{{}^{\prime}}=Verif_{j}\oplus M_{j}\). Furthermore, \(CS\) checks if \(h_{1}(HD_{j}^{{}^{\prime}}||A_{cs})=ACS_{i}\). If it is valid, \(CS\) computes \(MA_{j}^{{}^{\prime}}=h_{1}(Verif_{j}||HD_{j}^{{}^{\prime}})\) and checks if \(e(HHID_{j},PK_{cs})=e(DPK_{do}^{HD_{j}:A_{cs}},DPK_{do}^{MA_{j}})\). If it is valid, \(CS\) computes as follows for index \(i\): \(pub_{1}=\pi_{z\in s,z\
eq i}\bar{s}_{n+1-z+i}\), \(Tr_{i}=TR_{j}\cdot pub_{1}\), \(pub_{2}=\pi_{z\in s}\bar{s}_{n+1-z}\), and \(p_{1}=c_{4}\cdot\frac{e(pub_{2}c_{2})}{e(pub_{2}c_{2})}\). Then, \(CS\) checks \(ck=\frac{e(Tr_{i}c_{1})}{e(pub_{2}c_{2})}\), where encrypted keyword is \(ck\in CK_{i}\). \(CS\) adds the identity of results which is corresponding document to \(Result_{i}\). Furthermore, \(CS\) sets \(PRF_{i}=(c_{1},p_{1},c_{3})\). Then, \(CS\) generates a random nonce \(R_{cs}\) and computes \(VA_{cs}=PK_{cs}^{R_{cs}}\), \(Verif_{cs}=PK_{j}^{A_{cs}:R_{cs}}\)\(AUITH_{cs}=h_{1}(MA_{j}||Verif_{j}||Verif_{cs})\). \(CS\) sends set \(Result\), \(PRF\), \(VA_{cs}\) and \(AUITH_{cs}\) over an open channel to \(DU_{j}\).  
Figure 4: Data request phase.  
**Step 3:** After receiving sets from \(CS\), \(DU_{j}\) computes \(Verif_{cs}=VA_{cs}^{b_{j}}\). Then, \(DU_{j}\) checks if \(AUTH_{cs}^{{}^{\prime}}=h_{1}(MA_{j}||Verif_{j}||Verif_{cs})\). If it is valid, \(DU_{j}\) computes for each \(i\) as follows: \(M^{{}^{\prime}}=p_{1}\cdot e(k_{s},c_{1})\), \(BF_{i}^{{}^{\prime}}=h_{1}(M^{{}^{\prime}})\oplus c_{3}\), \(ACC_{i}=BFverify(\{H_{1}^{{}^{\prime}},\ \ldots,\ H_{k}^{{}^{\prime}}\},\ BF_{i}^{{}^{\prime}},W)\). If the keyword \(w\) exists in the document, \(ACC_{i}=1\). Otherwise, \(ACC_{i}=0\).  
Figure 5: Data retrieve phase.