## 3 Construction of Our Work
### Detailed Construction
0: Data Owner:
1:\(k_{w}\gets F(k_{s},w)\)
2:\(st_{c}\leftarrow\mathbf{W}[w]\)
3:if\(st_{c}=\bot\)then
4:\(st_{0}\xleftarrow{\$}\{0,1\}^{\lambda}\)
5:endif
6:\(st_{c+1}\xleftarrow{\$}\{0,1\}^{\lambda}\)
7:\(\mathbf{W}[w]\gets st_{c+1}\)
8:\(v_{c+1}\gets H_{1}(k_{w}||st_{c+1})\)
9:\(e_{c+1}\leftarrow(bs||st_{c})\oplus H_{2}(k_{w}||st_{c+1})\)
10:for all user \(u_{j}\) can access \(bs\)do
11:\(l_{j}\gets F(k_{u},u_{j}),L\gets L\cup l_{j}\)
12:endfor
13: Send \((v_{c+1},e_{c+1},L,bs)\) to cloud server
14: Send \((bs,k_{w},L)\) to block chain
15:\(Cloud\)\(Server:\)
15:\(\mathbf{T}[u_{c+1}]\ =\ e_{c+1}\)
16:for\(l_{j}\in L\)do
17:\(\mathbf{A}[l_{j}]\leftarrow\mathbf{A}[l_{j}]\oplus bs\)
18:endfor
19:\(Block\)\(Chain:\)
20:for\(l_{j}\in L\)do
21:\(\mathbf{\Sigma}[k_{w}||l_{j}]\leftarrow\mathbf{\Sigma}[k_{w}||l_{j}]\oplus bs\)
22:\(\mathbf{Tag}[k_{w}||l_{j}]\gets MAC(\mathbf{\Sigma}[k_{w}||l_{j}])\)
23:endfor
```  
**Algorithm 2**_VSSE.Update._  
_Search._ When searching for the files containing keyword \(w\), \(DU\) encrypts keyword \(w\) by using \(k_{s}\) and a pseudorandom function \(F\), and retrieves the current state from \(\mathbf{W}[w]\). Then, \(DU\) sends \((k_{w},l_{j},st_{c})\) to \(CS\). \(CS\) uses the \((k_{w},l_{j},st_{c})\) to obtain the location of current state \(st_{c}\) and retrieves the corresponding encrypted entry \(e_{c}\) from \(\mathbf{T}\). By decrypting the encrypted entry, \(CS\) obtains the file identifier \(bs\) associated with the current state \(st_{c}\) and the previous state \(st_{c-1}\). Finally, after \(c\) iterations, \(CS\) XORs each bitmap \(bs\) to obtain the final result \(Bs\), which includes all the results involving the keyword \(w\). For different \(DU\), the server retrieves the files that the current \(DU\) is authorized to access from \(\mathbf{A}\) by the user's identifier. After completing the search for files containing \(w\), \(CS\) must determine whether the user has permission to access these files, i.e., it performs an AND operation between \(Bs\) and \(\mathbf{A}[l_{j}]\). The final result \(Res\) is not directly returned to the \(DU\) but is sent by the server to the blockchain for further verification. ```
0: The security key \(k_{s},k_{u}\), the keyword \(w\) and user \(u_{j}\). 0: The search result \(Res\). 0: Data User:
1:\(k_{w}\gets F(k_{s},w),l_{j}\gets F(k_{u},u_{j})\)
2:\(st_{c}\leftarrow\mathbf{W}[w]\)
3:if\(st_{c}=\bot\)then
4: return\(\emptyset\)
5:endfor
6: Send \((k_{w},l_{j},st_{c})\) to cloud server
6: Cloud Server:
7:\(Bs\gets 0,Res\leftarrow\emptyset\)
8:for\(i=c\)to\(1\)do
9:\(v_{i}\gets H_{1}(k_{w}||st_{i}),e_{i}\leftarrow\mathbf{T}[v_{i}]\)
10:\((st_{i-1},bs)\gets e_{i}\oplus H_{2}(k_{w}||st_{i})\)
11:\(Bs\gets Bs\oplus bs\)
12:endfor
13:\(Res\gets Bs\wedge\mathbf{A}[l_{j}]\)
14: Send \((k_{w},l_{j},Res)\) to block chain
```  
**Algorithm 3**_VSSE.Search._  
```
0: The encrypted keyword \(k_{w}\), the encrypted user \(l_{j}\) and search result \(Res\). 0: The search result \(Res\) and the verify information \(proof\). 0: \(Block\) Chain:
1: \(Tag^{*}\leftarrow\mathbf{Tag}[k_{w}||l_{j}]\)
2: \(Tag\gets MAC(Res)\)
3:if\(Tag^{*}=Tag\)then
4:\(proof=1\)
5:else
6:\(proof=0\)
7:endif
8: Return\((Res,proof)\)
```  
**Algorithm 4**_VSSE.Verify._  
_Verify._ In this protocol, the blockchain utilizes a verification contract to validate the correctness of search results. The verification contract constructs a key-value pair list \(\mathbf{Tag}\) in the form of (addr, val), where the first column contains user and keyword information used to locate a specific entry, and the second column stores the MAC for the corresponding result. Upon receiving encrypted keywords \(k_{w}\), encrypted user identifiers \(l_{j}\), and search results \(Res\) from the server, the verification contract retrieves the MAC value \(Tag^{*}\) for the corresponding result by using \(k_{w}\) and \(l_{j}\) as indices in the \(\mathbf{Tag}\).