## 5 The Proposed VR-PEKS Scheme
### Correctness  
**Correctness**. For the whole scheme, if each entity performs correctly according to the algorithms, DR can generate a valid keyword trapdoor to obtain the matching ciphertext files and can verify the correctness and integrity of the result.  
For keyword ciphertext \(CT_{\mathbf{w}}\) and trapdoor \(T_{\mathbf{v}}\),  
Figure 4: The encrypted verification index structure.  
Figure 3: Reverse encrypted keyword index structure.  
\[CT_{\mathbf{w}}+T_{\mathbf{v}} =\left(\left[\mathbf{p}_{0}\cdot\mathbf{u}_{2}+\mathbf{e}_{3}+ \triangle\cdot\mathbf{w}^{\prime}\right]_{q^{\prime}}\left[\mathbf{p}_{1}\cdot \mathbf{u}_{2}+\mathbf{e}_{4}\right]_{q}\right)\] \[\quad+\left(\left[\mathbf{p}_{0}\cdot\mathbf{u}_{3}+\mathbf{e}_{ 5}+\triangle\cdot\mathbf{v}^{\prime}\right]_{q^{\prime}}\left[\mathbf{p}_{1} \cdot\mathbf{u}_{3}+\mathbf{e}_{6}\right]_{q}\right)\] \[=\left(\left[\mathbf{p}_{0}\cdot(\mathbf{u}_{2}+\mathbf{u}_{3})+ \underbrace{(\mathbf{e}_{3}+\mathbf{e}_{5})}_{\text{noise}}+\underbrace{ \triangle\cdot(\mathbf{w}^{\prime}+\mathbf{v}^{\prime})}_{\text{ message}}\right]_{q}\right.,\] \[\left.\left[\mathbf{p}_{1}\cdot(\mathbf{u}_{2}+\mathbf{u}_{3})+ \underbrace{(\mathbf{e}_{4}+\mathbf{e}_{6})}_{\text{noise}}\right]_{q}\right)\]  
Since the scheme uses fully homomorphic encryption, the keyword ciphertext and trapdoor have additive homomorphism. As seen from the above equation, the result of adding \(CT_{\mathbf{w}}\) and \(T_{\mathbf{v}}\) ciphertext only exists in scaled ciphertext, and the form of the added result is same as that of \(\mathbf{w}^{\prime}+\mathbf{v}^{\prime}\), and only new noise is added. \(\mathbf{w}^{\prime}\) and \(\mathbf{v}^{\prime}\) are the oblivious pseudorandom values of \(\mathbf{w}\) and \(\mathbf{v}\), respectively, \(\mathbf{w}^{\prime}=F_{k}(\mathbf{w}),\mathbf{v}^{\prime}=F_{k}(\mathbf{v})\). Then, if \(\mathbf{w}\) and \(\mathbf{v}\) correspond to the same keyword,  
\[IsEqual(CT_{\mathbf{w}},T_{\mathbf{v}})=\prod_{i\in[m]}\left(1+CT_{\mathbf{w }_{i}}[i]+T_{\mathbf{v}}[i]\right)\,\,mod\,2\longrightarrow\bar{1}\]  
Otherwise, \(IsEqual(CT_{\mathbf{w}},T_{\mathbf{v}})\to 0\).  
It is easy to find that only users who know the key \(k\) can generate a valid keyword search trapdoor. CS matches \(T_{\mathbf{v}}\) with each keyword ciphertext in the search index \(I_{S}\) to obtain array \(\mathbf{m}\). Then, CS securely retrieves the index \(I_{S}\) using the LEAF protocol (the protocol's correctness has been proven in [22]), and obtains the matching index to obtain the corresponding ciphertext file result set \(R_{F}\) and file name set \(ID_{R_{F}}\).  
After the data recipient receives the retrieval result, the data recipient can generate the verification proof \(pf^{\prime}\) with the pre-proof \(pf\) in the verification index for calculation and determine whether the cloud server returns the correct result,  
\[pf^{\prime}+pf=-(\sum\,\,ID_{CF},\sum\,\,L_{CF})+(\sum_{j\in[1,n]}ID_{CF_{j}}, \sum_{j\in[1,n]}L_{ij}),\,\,CF\in R_{F}\]  
By addition homomorphism, the calculation result is \(\bar{0}\) or other. After decryption with the private key sk, the data receiver can determine whether the size and name of the ciphertext file set returned by the cloud server are correct.