## 3 Construction of Our Work
### Security Analysis  
Forward privacy is a crucial security attribute that a DSSE scheme should possess, as it involves the update and search operations common to all DSSE schemes. Therefore, our security analysis primarily focuses on threats associated with the update and search operations. VSSE satisfies definition of forward security. Specifically, in VSSE, each state of the keyword is randomly generated, the value of each state is indistinguishable from a random value in the server's view, and the server is incapable of deducing the forthcoming state using the present state of the keyword. As a result, the forward privacy of VSSE remains ensured. The theorem regarding the security of VSSE is as follows. Theorem 1: _Assume that \(F\) is a secure pseudorandom function, and \(H_{1}\) and \(H_{2}\) are hash functions in random oracle model. The leakage functions are denoted as \(\mathcal{L}^{\text{U}pdt}(i,bs_{i},w)=(i,bs_{i})\) and \(\mathcal{L}^{\text{S}rch}(w)=(\mathbf{sp}(w),\mathbf{ap}(w))\), where \(\mathcal{L}^{\text{U}pdt}\) and \(\mathcal{L}^{\text{S}rch}\) are used to capture the leakage during the update and search, \(\mathbf{ap}(w)\) is the access pattern, and \(\mathbf{sp}(w)\) is the search pattern. Then VSSE is an \(\mathcal{L}\)-adaptively secure SSE scheme with forward privacy._  
Proof of Theorem 1: The security of VSSE is proven through a sequence of games involving the real game \(R_{\text{E}AL}\) and the ideal game \(I_{\text{D}EAL}\). By demonstrating the indistinguishability between two adjacent games, we establish the equivalence between the real and ideal games. **Game \(G_{0}\)**: \(G_{0}\) is \(R_{\text{E}AL}\) game. \[\Pr(\text{R}_{\text{E}AL}(\lambda)=1)=\Pr(G_{0}=1). \tag{1}\]  
Figure 4: The example of verification. **Game \(G_{1}\)**: In \(G_{1}\), instead of using a pseudo-random function \(F\) to generate \(k_{w}\), we randomly select \(k_{w}\) and store it in the mapping **Key**. For the subsequent query on \(w\), we can directly retrieve the corresponding \(k_{w}\) from **Key**. Since we cannot distinguish between a \(F\) and a true random function, \(G_{1}\) and \(G_{0}\) are indistinguishable. **Game \(G_{2}\)**: \(G_{2}\) no longer calls \(H_{1}\) to generate location in the update protocol, but uses random numbers instead. Specifically, it involves using \(v\stackrel{{\mathcal{S}}}{{\leftarrow}}\{0,1\}^{\lambda}\) instead of \(v\gets H_{1}(k_{w},st_{c+1})\) and performing \(\mathbf{L}[k_{w}||st_{c+1}]\gets v\), where \(\mathbf{L}\) is a mapping held by \(G_{2}\). Then, \(\mathbf{H_{1}}[k_{w}||st_{c+1}]\leftarrow\mathbf{L}[k_{w}||st_{c+1}]\) is executed in the search protocol, where \(\mathbf{H_{1}}\) is the table of \(H_{1}\). It can be seen that \(\mathbf{H_{1}}\) is not updated in real time, so when the adversary accesses \(\mathbf{H_{1}}[k_{w}||st_{c+1}]\) before the search query is issued, \(\mathbf{H_{1}}[k_{w}||st_{c+1}]\) will randomly generate a value \(v^{*}\) that is different from \(v\). When the adversary accesses \(\mathbf{H_{1}}[k_{w}||st_{c+1}]\) once more following the subsequent search, it will obtain the value \(v\) that has been updated into \(\mathbf{H_{1}}\). By comparing the differences between the two access results, the adversary will know that it is in \(G_{2}\). However, the probability of such case occurring is negligible. Based on the above, this case only happens when the adversary accesses \(\mathbf{H_{1}}\) using \(k_{w}||st_{c+1}\). Given that \(st_{c+1}\) is randomly generated, the likelihood of the adversary selecting \(st_{c+1}\) is \(\frac{1}{2^{\lambda}}+negl(\lambda)\). Assuming a PPT adversary makes up to \(p=poly(\lambda)\) guesses, the probability of this occurrence is \(\frac{p}{2^{\lambda}}+p\cdot negl(\lambda)\), which can be negligible. Therefore, \(G_{2}\) and \(G_{1}\) are indistinguishable. \[\Pr(G_{1}=1)-\Pr(G_{2}=1)\leq\frac{p}{2^{\lambda}}+p\cdot negl(\lambda). \tag{2}\]  
**Game \(G_{3}\)**: In the update protocol of \(G_{3}\), \(H_{2}\) is processed in the same way as \(H_{1}\) in \(G_{2}\).