## 3 LWE-CP-ABE Scheme  
### Algorithm Construction  
In this section, we present the LWE-CP-ABE scheme for access structures with LSSS using blockchain technology, which is associated with Proxy Re-Encryption (PRE) protocol under a subset of on-chain node client by transforming encrypted data from one public key to another. As shown in Figure 1, our CP-ABE system under LWE assumption LWE - CP - ABE = (Setup, KeyGen, Enc, Dec, AccGen, AccUpdate) mainly consists of six procedures with the following syntax:  
Figure 1: Flowchart of LWE-CPABE. (1) \(\mathbf{Setup}\big{(}1^{\lambda},s_{\max},\mathbb{U}\big{)}\rightarrow(\text{PK}, \text{MSK})\)  
The setup algorithm takes as input the security parameter \(\lambda\), the maximum width \(s_{\max}=s_{\max}(\lambda)\) supported by an LSSS matrix supported by the scheme, and the attribute universe \(\mathbb{U}\). For each attribute \(u\) in the system, it selects \(\mathbf{A}_{u}\in\mathbb{Z}_{q}^{n\times m}\) to generate the trapdoors function \(\mathbf{T}_{\mathbf{A}_{u}}\), and selects the uniformly distributed random matrix \(\mathbf{H}_{u}\leftarrow\mathbb{Z}_{q}^{n\times m}\) and random vector \(\mathbf{y}\leftarrow\mathbb{Z}_{q}^{n}\). It outputs the system's public parameters and the master secret key. \[\text{PK}=(\mathbf{y},\{\mathbf{A}_{u}\},\{\mathbf{H}_{u}\}),\text{MSK}=\{\mathbf{T}_{\mathbf{A}_{u}}\} \tag{8}\]  
(2) \(\mathbf{KeyGen}(\text{MSK},\mathbf{U})\rightarrow\text{SK}\)  
The key generation algorithm takes as input the user's attribute set \(U\) and MSK. We let a vector \(\mathbf{\hat{t}}\leftarrow\text{noise}^{m-1}\) and set the vector \(\mathbf{t}=(1,\mathbf{\hat{t}})\in\mathbb{Z}^{m}\). The vector \(\mathbf{t}\) is a part of the user attribute SK, and every user has a different \(\mathbf{t}\), which can prevent conspiracy attacks. For each attribute \(u\in U\), a short vector \(\mathbf{\widetilde{k}}_{u}\) is generated by the trapdoors \(\mathbf{T}_{\mathbf{A}_{u}}\) and satisfies \(\mathbf{A}_{u}\mathbf{\widetilde{k}}_{u}^{\top}=\mathbf{H}_{u}\mathbf{t}^{\top}\). Finally, it outputs:  
\[\text{SK}=\Big{(}\Big{\{}\mathbf{\widetilde{k}}_{u}\Big{\}},\mathbf{t}\Big{)} \tag{9}\]  
(3) \(\mathbf{Enc}(\text{PK},m,(\mathbf{M},\rho))\rightarrow\text{CT}\)  
The encryption algorithm takes as input the public parameter PK, a message bit \(\mathbf{m}\in\{\mathbf{0},\mathbf{1}\}\) and access policy \((\mathbf{M},\rho)\) from LSSS. Let \(\rho\) be the mapping function that maps the attribute to the row of the matrix \(\mathbf{M}\). that is, \(\rho(i)\) is the attribute \(M=\left(M_{ij}\right)_{l\times s_{\max}}\in\left\{-1,0,1\right\}^{l\times s_{ \max}}\subset\mathbb{Z}_{q}^{l\times s_{\max}}\) associated with the \(i\) row in the matrix \(\mathbf{M}\). The procedure Randomly samples vectors \(s\leftarrow\mathbb{Z}_{q}^{n}\), \(\mathbf{v}_{2},\cdots,\mathbf{v}_{s_{\max}}\leftarrow\mathbb{Z}_{q}^{m}\) and \(\{x_{i}\}\leftarrow\mathbb{Z}_{q}^{n}\), and then it computes as follows:  
\[\mathbf{c}_{i} =\mathbf{s}\mathbf{A}_{\rho(i)}+\text{noise}\] \[\mathbf{\hat{c}}_{i} =M_{i,1}\left(\mathbf{sy}^{\top},\overbrace{0,\cdots,0}^{m-1}\right) +\left[\sum_{j\in\{2,\cdots,s_{\max}\}}M_{ij}\mathbf{v}_{j}\right] \tag{10}\] \[\quad-\mathbf{s}\mathbf{H}_{\rho(i)}+\text{noise}\]  
and it outputs:  
\[\text{CT}=\Big{(}\{\mathbf{c}_{i}\}_{i\in[i^{\prime}},\{\mathbf{\hat{c}}_{i}\}_{i\in[ i^{\prime}},C=\text{MSB}\Big{(}\mathbf{sy}^{\top}\Big{)}\oplus m\Big{)} \tag{11}\]  
\[\text{SK}_{GID,u}=\mathbf{\hat{k}}_{GID,u}+\mathbf{\hat{k}}_{GID,u} \tag{12}\]  
(4) \(\mathbf{Dec}(\text{PK},\text{CT},\text{SK})\to m\)  
The decryption algorithm takes as inputs the PK, the ciphertext CT generated with respect to an LSSS, and the user secret key **SK** related to some subset of attributes U. Let the attribute owned by the user meet the access control policy. We denote \(\mathbf{I}\) as the row vector set corresponding to the attribute and \(\left\{\omega_{i}\right\}_{i\in\mathbf{I}}\in\{0,1\}\subset\mathbb{Z}_{q}\) the reconstruction coefficient.