## 5 The Proposed VR-PEKS Scheme
### Construction of the Scheme  
We describe the construction of VR-PEKS based on the fully homomorphic encryption BFV scheme [34]. The working process is as follows: KGC runs the _KeyGen_ algorithm to generate the public-private key pair \((pk,sk)\) of BFV and key \(k\) of \(OPRF\). Then, it securely sends \((pk,k)\) and \((pk,sk,k)\) to DS and DR, respectively. DS encrypts the file and keywords using the BFV encryption algorithm and creates a searchable index and an encrypted verified index, \((CF,I_{S},I_{V})\leftarrow Enc(pk,k,W,F)\). Then, he uploads the ciphertext file \(CF\) and searchable index \(I_{S}\) to the CS for storage, and exposes the encrypted verification index \(I_{V}\). We use \(pk\) and \(k\) to encrypt document keywords, which has two benefits. Firstly, after preprocessing by the OPRF, we can use highly optimized FHE parameters during the search operation and do not need to worry about noise flooding because OPRF already provides sufficient protection. Secondly, [PERSON] and external adversaries are not aware of the key \(k\), making them unable to generate a valid keyword search trapdoor. Therefore, the scheme is able to defend against KGA by malicious cloud servers and external adversaries. When [PERSON] wants to retrieve files, he runs the GenTrapdoor algorithm to generate a valid keyword trapdoor and sends it to CS. Then, CS runs a search algorithm to search the corresponding ciphertext files and returns the result to DR. DR verifies the retrieval results locally, and decrypts them to obtain plaintext data after verification is passed. The schematic flow of the algorithm is shown in Figure 2.  
The VR-PEKS algorithm is as follows. (1) \((pk,sk,k)\leftarrow KeyGen(1^{\lambda})\): The algorithm is executed by KGC to generate the keys required by the system. Given security parameter \(\lambda\), KGC runs BFV's key generation algorithm [34] to obtain the public key \(pk\) and private key \(sk\). It randomly samples \(\mathbf{s}\leftarrow\chi\), lets private key \(sk=\mathbf{s}\), and samples \(\mathbf{a}\gets R_{2}\), \(\mathbf{e}\leftarrow\chi\), and then computes the public key \(pk=([-(\mathbf{a}\cdot\mathbf{s})+\mathbf{e}]_{q},\mathbf{a})\). In addition, KGC needs to sample a key \(\mathbf{k}\) for OPRF \(F:\{0,1\}^{*}\longrightarrow\{0,1\}^{*}\). Then, KGC sends securely \((pk,k)\) to DS and sends \((sk,pk,k)\) to DR. DR discloses \(pk\). (2) \((CF,I_{S},I_{V})\leftarrow Enc(pk,k,W,F)\): The algorithm is executed by DS to encrypt files and keywords and create indexes. DS encrypts files \(F=\{F_{1},F_{2},\cdots,F_{n}\}\) using a BFV encryption algorithm, generates ciphertext file set \(CF=\{CF_{1},CF_{2},\cdots,CF_{n}\}\), encrypts keywords \(W=\{w_{1},w_{2},\cdots,w_{m}\}\) associated with the file set, and establishes keyword searchable index \(I_{S}\) and encrypted verification index \(I_{V}\). Finally, DS uploads the ciphertext file set \(CF\) and searchable index \(I_{S}\) to CS for storage, and makes the encrypted verification index \(I_{V}\) publicly available so that DR can use it to verify the correctness and integrity of the search results. The specific steps are as follows. (a) Generate encrypted files: Given \(pk\) and plaintext file set \(F=\{F_{1},F_{2},\cdots,F_{n}\}\), DS generates the set of ciphertext files  
Figure 2: Algorithm flow chart of the proposed VR-PEKS scheme. \[CF\gets BFV.Enc(pk,F)\]  
Sets \(\mathbf{p}_{0}=pk[0]\), \(\mathbf{p}_{1}=pk[1]\), samples \(\mathbf{u}_{1},\mathbf{e}_{1},\mathbf{e}_{2}\leftarrow\chi\), for each message \(\mathbf{m}\) in \(F\), generate ciphertext  
\[CT=([\mathbf{p}_{0}=pk[0]\cdot\mathbf{u}_{1}+\mathbf{e}_{1}+\bigtriangleup \cdot\mathbf{m}]_{q^{\prime}}[\mathbf{p}_{1}\cdot\mathbf{u}_{1}+\mathbf{e}_{2}] _{q})\]  
(b) Generate keyword ciphertext \(CT_{\mathbf{w}}\): Given a t-bit keyword \(\mathbf{w}=w_{1}w_{2}\cdots w_{t}\), DS first pseudorandomizes \(\mathbf{w}\) using the OPRF function: \(\mathbf{w}^{\prime}=F_{k}(\mathbf{w})\).