## 5 The Proposed VR-PEKS Scheme
### Construction of the Scheme
Then, he encodes \(\mathbf{w}^{\prime}\) as a polynomial \(\mathbf{w}^{\prime}\) in \(Z_{2}[x]/(x^{d}+1)\), where \(d\) is a parameter in the BFV encryption scheme. Samples \(\mathbf{u}_{2},\mathbf{e}_{3},\mathbf{e}_{4}\leftarrow\chi\). [PERSON] generates keyword searchable ciphertext  
\[CT_{\mathbf{w}}=BFV.Enc(\big{[}\mathbf{p}_{0}\cdot\mathbf{u}_{2}+\mathbf{e}_{ 3}+\bigtriangleup\cdot\mathbf{m}^{\prime}\big{]}_{q^{\prime}}[\mathbf{p}_{1} \cdot\mathbf{u}_{2}+\mathbf{e}_{4}]_{q})\]  
(c) Build the search index \(I_{S}\): Assume that the outsourced ciphertext file set \(CF\) contains \(n\) encrypted data files, which are associated with \(m\) keywords. [PERSON] establishes a reverse searchable index \(I_{S}\). This allows him to place ciphertext files associated with the same keywords on one line. Given keywords \(w_{i}(i=1,\cdots,m)\) and their associated file set \(F_{j}(j=1,\cdots,n)\), [PERSON] builds encrypted keyword index \(I_{S}\), and the index structure is shown in Figure 3.  
(d) Build and expose verification index \(I_{V}\): [PERSON] constructs an encrypted verification index \(I_{V}\), as shown in Figure 4. \(I_{V}\) is a two-dimensional table with \(m\times(n+2)\). The first column stores the keyword ciphertext \(CT_{w_{i}}(i=1,\cdots,m)\). The \(2\sim(n+1)\) columns store size \(L_{ij}=Enc(CF_{j}.length)(i=1,\cdots,m,j=1,\cdots,n)\) of encrypted files \(CF_{j}(j=1,\cdots,n)\). If ciphertext file \(CF_{j}\) is not associated with the keyword \(CT_{\mathbf{w}_{i}}\), \(L_{ij}\) is empty. The last column stores the verification proof \(pf_{j}\) corresponding to the keyword ciphertext \(CT_{\mathbf{w}_{i}}\),  
\[pf_{i}=(\sum_{j\in[1,n]}ID_{CF_{j}},\sum_{j\in[1,n]}L_{ij}),\ L_{ij}\ \
eq null\]  
(3) \(T_{\mathbf{w}}\leftarrow\mathit{GenTrapdoor}(pk,\mathbf{w},k)\): When DR wants to search the ciphertext file corresponding to t-bit keyword \(\mathbf{w}=w_{1}\cdots w_{m}\), he first uses the OPRF function to pseudo-randomize \(\mathbf{w}\) to obtain \(\mathbf{w}^{\prime}=F_{k}(\mathbf{w})\), and encodes \(\mathbf{w}^{\prime}\) as a polynomial in \(Z_{2}[x]/(x^{d}+1)\). Then, DR samples \(\mathbf{u}_{3},\mathbf{e}_{5},\mathbf{e}_{6}\leftarrow\chi\) to generate keyword trapdoor  
\[T_{\mathbf{w}}=BFV.Enc(\mathbf{w}^{\prime},pk)=(\big{[}\mathbf{p}_{0}\cdot \mathbf{u}_{3}+\mathbf{e}_{5}+\bigtriangleup\cdot\mathbf{w}^{\prime}\big{]}_{ q^{\prime}}[\mathbf{p}_{1}\cdot\mathbf{u}_{3}+\mathbf{e}_{6}]_{q})\]  
(4) \((R_{F},ID_{R_{F}})\leftarrow\mathit{Search}(T_{\mathbf{w}^{\prime}},I_{S})\): When CS receives the trapdoor \(T_{\mathbf{w}^{\prime}}\) from DR, CS runs the \(Search\) algorithm to retrieve index \(I_{S}\) to obtain the matching ciphertext file result set \(R_{F}\) and file name set \(ID_{R_{F}}\). Then, it returns the result to DR. The specific steps are as follows. (a) Determine whether the keyword ciphertext \(CT_{\mathbf{w}_{i}}\) matches the trapdoor \(T_{\mathbf{w}^{\prime}}\). We use the exact match function to determine whether the search trapdoor matches the keyword ciphertext and obtain the matching array \(\mathbf{m}\). The encrypted 1s or 0s are stored in \(\mathbf{m}\), denoted by \(\bar{1}\) and \(\bar{0}\). \(\bar{1}\) indicates that the trapdoor \(T_{\mathbf{w}^{\prime}}\) corresponds to the same keyword as the keyword ciphertext \(CT_{\mathbf{w}_{i}}\), \(\bar{0}\) on the contrary. For \(CT_{\mathbf{w}_{i}}\), \(T_{\mathbf{w}^{\prime}}\in\left\{0,1\right\}^{m}\),  
\[\mathbf{m}[i]=IsEqual(CT_{\mathbf{w}_{i}},T_{\mathbf{w}^{\prime}})=\prod_{i \in[m]}(1+CT_{\mathbf{w}_{i}}[i]+T_{\mathbf{w}^{\prime}}[i])\ mod\ 2,\ i=1,2,\cdots,m\]  
(b) Retrieve indexes securely. We use the LEAF protocol [22] to securely obtain the matching index \(I=LEAF(\mathbf{m})\). (c) Obtain related ciphertext file set \(R_{F}\) and file name set \(ID_{R_{F}}\) according to index \(I\). Then, send \(R_{F}\) and \(ID_{R_{F}}\) to DR.  
(5) \(Verify(R_{F},ID_{R_{F}},I_{V})\): When DR receives the retrieval result \(R_{F}\), \(ID_{R_{F}}\) from CS, he completes following verification steps.