## 6 Comparison
### Calculation Comparison  
The computational cost comparison of the algorithms for each scheme is shown in Table 2. We consider only the time-consuming cryptographic operations. Let \(E\) denote the exponential operation, \(P\) denote the pairing operation, \(H\) denote the hash operation, \(M\) denote the homomorphic multiplication operation, and \(A\) denote the homomorphic addition operation. \(m\) denotes the number of keywords in \(W\), \(n\) denotes the number of files in \(F\), and \(\ell\) denotes the number of search result files returned, while \(f\) denotes the number of data owners. \(U\) denotes the number of attributes in the system. For BDOP  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Schemes**} & \multirow{2}{*}{**KC-IND**} & \multirow{2}{*}{**KT-IND**} & **External** & **Internal** & **Quantum** & **Correctness** & **Integrity** & **Third-Party** \\  & & & **KGA** & **KGA** & **Artick** & **Verifiable** & **Verifiable** & **Auditor** \\ \hline BDOP-PEKS [5] & yes & no & insecure & insecure & insecure & no & no & / \\ VSEF [33] & yes & yes & secure & secure & insecure & yes & no & required \\ Zhang’s [16] & yes & yes & secure & secure & insecure & yes & no & required \\ Ours & yes & yes & secure & secure & secure & yes & yes & not \\ \hline \hline \end{tabular}
\end{table}
Table 1: Security comparison.  
PEKS and its improved scheme, due to using a forward index (file-keyword), when performing keyword matching, almost all encrypted indexes of the ciphertext file need to be matched once, so the complexity of the search phase is \(O(n)\). This leads to a serious decrease in search efficiency in systems with a large number of files. VSEF, [PERSON] et al.'s scheme, and ours are constructed based on the reverse index (keyword-file), and the search efficiency is proportional to the number of keywords, which is more efficient. The algorithms in [5; 16; 33] are based on bilinear pairing construction, which requires elliptic curve-based operations. The algorithms in ours are based on the RLWE construction, which can improve the computational speed and achieve higher security strength [40]. However, it slightly increases the storage overhead and communication overhead because the ciphertext is usually stored in matrix form.  
We performed experimental simulations of searchable encryption schemes based on bilinear pairing and RLWE-based constructions to measure the practical performance of the above schemes. These experiments were conducted on Windows with a 3.40 GHz AMD Ryzen 5 2600 Six-Core processor, and Java's Pairing-Based Cryptography (JPBC) Library and Rings Library. We consider \(\left|Z_{p}\right|=96\) bit and \(\left|G_{1}\right|=\left|G_{2}\right|=208\) bit. The depth of the polynomial ring is 32 bits. The encrypted keyword is 2 bytes. In this paper, we show the performance characteristics of the main algorithms, namely _KeyGen_, _Enc_, _GenTrap_, and _Search_. In Figure 5, we show the computational overhead of the four main algorithms. In performing the experiments, we only considered the operations within the noise allowed. Bootstrapping is required after the noise of the fully homomorphic encryption operation reaches the upper limit, and it may take several minutes to execute bootstrapping in the BFV scheme [34]. Since the bilinear pairing-based encryption scheme involves exponential operations, while the RLWE-based encryption scheme involves only additive and multiplicative operations, the computational overhead of the RLWE-based encryption scheme is much lower than that of the bilinear pairing-based encryption scheme in the noise range allowed for decryption.  
Figure 5: Reverse encrypted keyword index structure.